Lines Matching refs:Shadow
16 /// (http://goo.gl/QKbem). We associate a few shadow bits with every
17 /// byte of the application memory, poison the shadow of the malloc-ed
18 /// or alloca-ed memory, load the shadow bits on every memory read,
19 /// propagate the shadow bits through some of the arithmetic
20 /// instruction (including MOV), store the shadow bits on every memory
22 /// associated shadow is poisoned.
32 /// Another difference from Memcheck is that we use 8 shadow bits per
33 /// byte of application memory and use a direct shadow mapping. This
35 /// shadow updates (Memcheck is single-threaded so races are not a
36 /// concern there. Memcheck uses 2 shadow bits per byte with a slow
39 /// The default value of shadow is 0, which means "clean" (not poisoned).
42 /// shadow memory is ready. On error, __msan_warning is called. Since
44 /// specialized thread-local shadow for return values
54 /// They are stored in a second shadow mapping, one 4-byte value for 4 bytes
127 cl::desc("propagate shadow through ICmpEQ and ICmpNE"),
138 // This flag controls whether we check the shadow of the address
145 cl::desc("report accesses through a pointer which has poisoned shadow"),
188 /// \brief Thread-local shadow storage for function parameters.
192 /// \brief Thread-local shadow storage for function return value.
196 /// \brief Thread-local shadow storage for in-register va_arg function
199 /// \brief Thread-local shadow storage for va_arg overflow area
218 /// \brief Address mask used in application-to-shadow address calculation.
221 /// \brief Offset of the origin shadow from the "normal" shadow.
380 /// necessary to propagate argument shadow through VarArg function
410 /// instructions store and load corresponding shadow and origin
411 /// values. Most instructions propagate shadow from arguments to their
413 /// test their argument shadow and print reports (with a runtime call) if it's
425 Instruction *Shadow;
429 : Shadow(S), Origin(O), OrigIns(I) { }
430 ShadowOriginAndInsertPoint() : Shadow(0), Origin(0), OrigIns(0) { }
454 Value *Shadow = getShadow(Val);
455 Value *ShadowPtr = getShadowPtr(Addr, Shadow->getType(), IRB);
458 IRB.CreateAlignedStore(Shadow, ShadowPtr, I.getAlignment());
467 if (ClStoreCleanOrigin || isa<StructType>(Shadow->getType())) {
471 Value *ConvertedShadow = convertToShadowTyNoVec(Shadow, IRB);
474 // TODO(eugenis): handle non-zero constant shadow by inserting an
495 Instruction *Shadow = InstrumentationList[i].Shadow;
498 DEBUG(dbgs() << " SHAD0 : " << *Shadow << "\n");
499 Value *ConvertedShadow = convertToShadowTyNoVec(Shadow, IRB);
529 // blocks, such nodes will not have any shadow value associated with them.
530 // It's easier to remove unreachable blocks than deal with missing shadow.
533 // Iterate all BBs in depth-first order and create shadow instructions
535 // For PHI nodes we create dummy shadow PHIs which will be finalized later.
561 // Insert shadow value checks.
567 /// \brief Compute the shadow type that corresponds to a given Value.
572 /// \brief Compute the shadow type that corresponds to a given Type.
577 // For integer type, shadow is the same as the original type.
605 /// \brief Convert a shadow value to it's flattened variant.
613 /// \brief Compute the shadow address that corresponds to a given application
616 /// Shadow = Addr & ~ShadowMask.
641 /// \brief Compute the shadow address for a given function argument.
643 /// Shadow = ParamTLS+ArgOffset.
662 /// \brief Compute the shadow address for a retval.
675 /// \brief Set SV to be the shadow value for V.
677 assert(!ShadowMap.count(V) && "Values may only have one shadow");
689 /// \brief Create a clean shadow value for a given value.
691 /// Clean shadow (all zeroes) means all bits of the value are defined
700 /// \brief Create a dirty shadow of a given shadow type.
717 /// \brief Get the shadow value for a given Value.
723 // For instructions the shadow is already stored in the map.
724 Value *Shadow = ShadowMap[V];
725 if (!Shadow) {
726 DEBUG(dbgs() << "No shadow: " << *V << "\n" << *(I->getParent()));
728 assert(Shadow && "No shadow for a value");
730 return Shadow;
739 // For arguments we compute the shadow on demand and store it in the map.
758 // ByVal pointer itself has clean shadow. We copy the actual
759 // argument shadow to the underlying memory.
778 assert(*ShadowPtr && "Could not find shadow for an argument");
781 // For everything else the shadow is zero.
785 /// \brief Get the shadow for i-th argument of the instruction I.
809 /// \brief Remember the place where a shadow check should be inserted.
816 Instruction *Shadow = dyn_cast_or_null<Instruction>(getShadow(Val));
817 Shadow) return;
819 Type *ShadowTy = Shadow->getType();
821 "Can only insert checks for integer and vector shadow types");
825 ShadowOriginAndInsertPoint(Shadow, Origin, OrigIns));
832 /// Loads the corresponding shadow and (optionally) origin.
863 /// Stores the corresponding shadow and (optionally) origin.
940 /// \brief Propagate shadow for bitwise AND.
944 /// corresponding bit in B don't affect the resulting shadow.
989 /// \brief Default propagation of shadow and/or origin.
991 /// This class implements the general case of shadow propagation, used in all
993 /// actually does. It converts all input shadow values to a common type
1006 Value *Shadow;
1013 Shadow(0), Origin(0), IRB(IRB), MSV(MSV) {}
1015 /// \brief Add a pair of shadow and origin values to the mix.
1019 if (!Shadow)
1020 Shadow = OpShadow;
1022 OpShadow = MSV->CreateShadowCast(IRB, OpShadow, Shadow->getType());
1023 Shadow = IRB.CreateOr(Shadow, OpShadow, "_msprop");
1048 /// \brief Set the current combined values as the given instruction's shadow
1052 assert(Shadow);
1053 Shadow = MSV->CreateShadowCast(IRB, Shadow, MSV->getShadowTy(I));
1054 MSV->setShadow(I, Shadow);
1078 "Vector of pointers is not a valid shadow type");
1084 /// \brief Cast between two shadow types, extending or truncating as
1102 /// \brief Propagate shadow for arbitrary operation.
1177 // Split shadow into sign bit and other bits.
1180 // Maximise the undefined shadow bit, minimize other undefined bits.
1194 // Split shadow into sign bit and other bits.
1197 // Minimise the undefined shadow bit, maximise other undefined bits.
1208 /// This function does exact shadow propagation for all relational
1242 /// propagating the highest bit of the shadow. Everything else is delegated
1258 Value* Shadow =
1260 setShadow(&I, Shadow);
1324 /// we will memove the shadow twice: which is bad in case
1338 // Similar to memmove: avoid copying shadow twice.
1397 Value *Shadow = getShadow(&I, 1);
1398 Value *ShadowPtr = getShadowPtr(Addr, Shadow->getType(), IRB);
1402 IRB.CreateAlignedStore(Shadow, ShadowPtr, 1);
1549 // For inline asm, do the usual thing: check argument shadow and mark all
1558 // we may have a false positive: shadow for a non-void RetVal
1593 // Compute the Shadow for arg even if it is ByVal, because
1594 // in that case getShadow() will copy the actual arg shadow to
1599 " Shadow: " << *ArgShadow << "\n");
1629 // Now, get the shadow for the RetVal.
1632 // Untill we have full dynamic coverage, make sure the retval shadow is 0.
1650 "Could not find insertion point for retval shadow load");
1664 // Set the shadow for the RetVal.
1665 Value *Shadow = getShadow(RetVal);
1667 DEBUG(dbgs() << "Return: " << *Shadow << "\n" << *ShadowPtr << "\n");
1668 IRB.CreateAlignedStore(Shadow, ShadowPtr, kShadowTLSAlignment);
1789 // Everything else: stop propagating and check for poisoned shadow.
1833 // For VarArg functions, store the argument shadow in an ABI-specific format
1839 // MSanParamTLS, and extract shadow on va_arg() call in the argument list
1875 /// \brief Compute the shadow address for a given va_arg.
1923 // Copy va_list shadow from the backup copy of the TLS contents.
