LLVM  11.0.0git
SafeStack.cpp
Go to the documentation of this file.
1 //===- SafeStack.cpp - Safe Stack Insertion -------------------------------===//
2 //
3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4 // See https://llvm.org/LICENSE.txt for license information.
5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6 //
7 //===----------------------------------------------------------------------===//
8 //
9 // This pass splits the stack into the safe stack (kept as-is for LLVM backend)
10 // and the unsafe stack (explicitly allocated and managed through the runtime
11 // support library).
12 //
13 // http://clang.llvm.org/docs/SafeStack.html
14 //
15 //===----------------------------------------------------------------------===//
16 
17 #include "SafeStackLayout.h"
18 #include "llvm/ADT/APInt.h"
19 #include "llvm/ADT/ArrayRef.h"
20 #include "llvm/ADT/BitVector.h"
21 #include "llvm/ADT/SmallPtrSet.h"
22 #include "llvm/ADT/SmallVector.h"
23 #include "llvm/ADT/Statistic.h"
27 #include "llvm/Analysis/LoopInfo.h"
35 #include "llvm/IR/Argument.h"
36 #include "llvm/IR/Attributes.h"
37 #include "llvm/IR/ConstantRange.h"
38 #include "llvm/IR/Constants.h"
39 #include "llvm/IR/DIBuilder.h"
40 #include "llvm/IR/DataLayout.h"
41 #include "llvm/IR/DerivedTypes.h"
42 #include "llvm/IR/Dominators.h"
43 #include "llvm/IR/Function.h"
44 #include "llvm/IR/IRBuilder.h"
45 #include "llvm/IR/InstIterator.h"
46 #include "llvm/IR/Instruction.h"
47 #include "llvm/IR/Instructions.h"
48 #include "llvm/IR/IntrinsicInst.h"
49 #include "llvm/IR/Intrinsics.h"
50 #include "llvm/IR/MDBuilder.h"
51 #include "llvm/IR/Module.h"
52 #include "llvm/IR/Type.h"
53 #include "llvm/IR/Use.h"
54 #include "llvm/IR/User.h"
55 #include "llvm/IR/Value.h"
56 #include "llvm/InitializePasses.h"
57 #include "llvm/Pass.h"
58 #include "llvm/Support/Casting.h"
59 #include "llvm/Support/Debug.h"
67 #include <algorithm>
68 #include <cassert>
69 #include <cstdint>
70 #include <string>
71 #include <utility>
72 
73 using namespace llvm;
74 using namespace llvm::safestack;
75 
76 #define DEBUG_TYPE "safe-stack"
77 
78 namespace llvm {
79 
80 STATISTIC(NumFunctions, "Total number of functions");
81 STATISTIC(NumUnsafeStackFunctions, "Number of functions with unsafe stack");
82 STATISTIC(NumUnsafeStackRestorePointsFunctions,
83  "Number of functions that use setjmp or exceptions");
84 
85 STATISTIC(NumAllocas, "Total number of allocas");
86 STATISTIC(NumUnsafeStaticAllocas, "Number of unsafe static allocas");
87 STATISTIC(NumUnsafeDynamicAllocas, "Number of unsafe dynamic allocas");
88 STATISTIC(NumUnsafeByValArguments, "Number of unsafe byval arguments");
89 STATISTIC(NumUnsafeStackRestorePoints, "Number of setjmps and landingpads");
90 
91 } // namespace llvm
92 
93 /// Use __safestack_pointer_address even if the platform has a faster way of
94 /// access safe stack pointer.
95 static cl::opt<bool>
96  SafeStackUsePointerAddress("safestack-use-pointer-address",
97  cl::init(false), cl::Hidden);
98 
99 // Disabled by default due to PR32143.
100 static cl::opt<bool> ClColoring("safe-stack-coloring",
101  cl::desc("enable safe stack coloring"),
102  cl::Hidden, cl::init(false));
103 
104 namespace {
105 
106 /// Rewrite an SCEV expression for a memory access address to an expression that
107 /// represents offset from the given alloca.
108 ///
109 /// The implementation simply replaces all mentions of the alloca with zero.
110 class AllocaOffsetRewriter : public SCEVRewriteVisitor<AllocaOffsetRewriter> {
111  const Value *AllocaPtr;
112 
113 public:
114  AllocaOffsetRewriter(ScalarEvolution &SE, const Value *AllocaPtr)
115  : SCEVRewriteVisitor(SE), AllocaPtr(AllocaPtr) {}
116 
117  const SCEV *visitUnknown(const SCEVUnknown *Expr) {
118  if (Expr->getValue() == AllocaPtr)
119  return SE.getZero(Expr->getType());
120  return Expr;
121  }
122 };
123 
124 /// The SafeStack pass splits the stack of each function into the safe
125 /// stack, which is only accessed through memory safe dereferences (as
126 /// determined statically), and the unsafe stack, which contains all
127 /// local variables that are accessed in ways that we can't prove to
128 /// be safe.
129 class SafeStack {
130  Function &F;
131  const TargetLoweringBase &TL;
132  const DataLayout &DL;
133  ScalarEvolution &SE;
134 
135  Type *StackPtrTy;
136  Type *IntPtrTy;
137  Type *Int32Ty;
138  Type *Int8Ty;
139 
140  Value *UnsafeStackPtr = nullptr;
141 
142  /// Unsafe stack alignment. Each stack frame must ensure that the stack is
143  /// aligned to this value. We need to re-align the unsafe stack if the
144  /// alignment of any object on the stack exceeds this value.
145  ///
146  /// 16 seems like a reasonable upper bound on the alignment of objects that we
147  /// might expect to appear on the stack on most common targets.
148  enum { StackAlignment = 16 };
149 
150  /// Return the value of the stack canary.
152 
153  /// Load stack guard from the frame and check if it has changed.
154  void checkStackGuard(IRBuilder<> &IRB, Function &F, ReturnInst &RI,
155  AllocaInst *StackGuardSlot, Value *StackGuard);
156 
157  /// Find all static allocas, dynamic allocas, return instructions and
158  /// stack restore points (exception unwind blocks and setjmp calls) in the
159  /// given function and append them to the respective vectors.
160  void findInsts(Function &F, SmallVectorImpl<AllocaInst *> &StaticAllocas,
161  SmallVectorImpl<AllocaInst *> &DynamicAllocas,
162  SmallVectorImpl<Argument *> &ByValArguments,
164  SmallVectorImpl<Instruction *> &StackRestorePoints);
165 
166  /// Calculate the allocation size of a given alloca. Returns 0 if the
167  /// size can not be statically determined.
168  uint64_t getStaticAllocaAllocationSize(const AllocaInst* AI);
169 
170  /// Allocate space for all static allocas in \p StaticAllocas,
171  /// replace allocas with pointers into the unsafe stack and generate code to
172  /// restore the stack pointer before all return instructions in \p Returns.
173  ///
174  /// \returns A pointer to the top of the unsafe stack after all unsafe static
175  /// allocas are allocated.
176  Value *moveStaticAllocasToUnsafeStack(IRBuilder<> &IRB, Function &F,
177  ArrayRef<AllocaInst *> StaticAllocas,
178  ArrayRef<Argument *> ByValArguments,
179  ArrayRef<ReturnInst *> Returns,
180  Instruction *BasePointer,
181  AllocaInst *StackGuardSlot);
182 
183  /// Generate code to restore the stack after all stack restore points
184  /// in \p StackRestorePoints.
185  ///
186  /// \returns A local variable in which to maintain the dynamic top of the
187  /// unsafe stack if needed.
188  AllocaInst *
189  createStackRestorePoints(IRBuilder<> &IRB, Function &F,
190  ArrayRef<Instruction *> StackRestorePoints,
191  Value *StaticTop, bool NeedDynamicTop);
192 
193  /// Replace all allocas in \p DynamicAllocas with code to allocate
194  /// space dynamically on the unsafe stack and store the dynamic unsafe stack
195  /// top to \p DynamicTop if non-null.
196  void moveDynamicAllocasToUnsafeStack(Function &F, Value *UnsafeStackPtr,
197  AllocaInst *DynamicTop,
198  ArrayRef<AllocaInst *> DynamicAllocas);
199 
200  bool IsSafeStackAlloca(const Value *AllocaPtr, uint64_t AllocaSize);
201 
202  bool IsMemIntrinsicSafe(const MemIntrinsic *MI, const Use &U,
203  const Value *AllocaPtr, uint64_t AllocaSize);
204  bool IsAccessSafe(Value *Addr, uint64_t Size, const Value *AllocaPtr,
205  uint64_t AllocaSize);
206 
207  bool ShouldInlinePointerAddress(CallInst &CI);
208  void TryInlinePointerAddress();
209 
210 public:
211  SafeStack(Function &F, const TargetLoweringBase &TL, const DataLayout &DL,
212  ScalarEvolution &SE)
213  : F(F), TL(TL), DL(DL), SE(SE),
214  StackPtrTy(Type::getInt8PtrTy(F.getContext())),
215  IntPtrTy(DL.getIntPtrType(F.getContext())),
217  Int8Ty(Type::getInt8Ty(F.getContext())) {}
218 
219  // Run the transformation on the associated function.
220  // Returns whether the function was changed.
221  bool run();
222 };
223 
224 uint64_t SafeStack::getStaticAllocaAllocationSize(const AllocaInst* AI) {
225  uint64_t Size = DL.getTypeAllocSize(AI->getAllocatedType());
226  if (AI->isArrayAllocation()) {
227  auto C = dyn_cast<ConstantInt>(AI->getArraySize());
228  if (!C)
229  return 0;
230  Size *= C->getZExtValue();
231  }
232  return Size;
233 }
234 
235 bool SafeStack::IsAccessSafe(Value *Addr, uint64_t AccessSize,
236  const Value *AllocaPtr, uint64_t AllocaSize) {
237  AllocaOffsetRewriter Rewriter(SE, AllocaPtr);
238  const SCEV *Expr = Rewriter.visit(SE.getSCEV(Addr));
239 
240  uint64_t BitWidth = SE.getTypeSizeInBits(Expr->getType());
241  ConstantRange AccessStartRange = SE.getUnsignedRange(Expr);
242  ConstantRange SizeRange =
243  ConstantRange(APInt(BitWidth, 0), APInt(BitWidth, AccessSize));
244  ConstantRange AccessRange = AccessStartRange.add(SizeRange);
245  ConstantRange AllocaRange =
246  ConstantRange(APInt(BitWidth, 0), APInt(BitWidth, AllocaSize));
247  bool Safe = AllocaRange.contains(AccessRange);
248 
249  LLVM_DEBUG(
250  dbgs() << "[SafeStack] "
251  << (isa<AllocaInst>(AllocaPtr) ? "Alloca " : "ByValArgument ")
252  << *AllocaPtr << "\n"
253  << " Access " << *Addr << "\n"
254  << " SCEV " << *Expr
255  << " U: " << SE.getUnsignedRange(Expr)
256  << ", S: " << SE.getSignedRange(Expr) << "\n"
257  << " Range " << AccessRange << "\n"
258  << " AllocaRange " << AllocaRange << "\n"
259  << " " << (Safe ? "safe" : "unsafe") << "\n");
260 
261  return Safe;
262 }
263 
264 bool SafeStack::IsMemIntrinsicSafe(const MemIntrinsic *MI, const Use &U,
265  const Value *AllocaPtr,
266  uint64_t AllocaSize) {
267  if (auto MTI = dyn_cast<MemTransferInst>(MI)) {
268  if (MTI->getRawSource() != U && MTI->getRawDest() != U)
269  return true;
270  } else {
271  if (MI->getRawDest() != U)
272  return true;
273  }
274 
275  const auto *Len = dyn_cast<ConstantInt>(MI->getLength());
276  // Non-constant size => unsafe. FIXME: try SCEV getRange.
277  if (!Len) return false;
278  return IsAccessSafe(U, Len->getZExtValue(), AllocaPtr, AllocaSize);
279 }
280 
281 /// Check whether a given allocation must be put on the safe
282 /// stack or not. The function analyzes all uses of AI and checks whether it is
283 /// only accessed in a memory safe way (as decided statically).
284 bool SafeStack::IsSafeStackAlloca(const Value *AllocaPtr, uint64_t AllocaSize) {
285  // Go through all uses of this alloca and check whether all accesses to the
286  // allocated object are statically known to be memory safe and, hence, the
287  // object can be placed on the safe stack.
290  WorkList.push_back(AllocaPtr);
291 
292  // A DFS search through all uses of the alloca in bitcasts/PHI/GEPs/etc.
293  while (!WorkList.empty()) {
294  const Value *V = WorkList.pop_back_val();
295  for (const Use &UI : V->uses()) {
296  auto I = cast<const Instruction>(UI.getUser());
297  assert(V == UI.get());
298 
299  switch (I->getOpcode()) {
300  case Instruction::Load:
301  if (!IsAccessSafe(UI, DL.getTypeStoreSize(I->getType()), AllocaPtr,
302  AllocaSize))
303  return false;
304  break;
305 
306  case Instruction::VAArg:
307  // "va-arg" from a pointer is safe.
308  break;
309  case Instruction::Store:
310  if (V == I->getOperand(0)) {
311  // Stored the pointer - conservatively assume it may be unsafe.
312  LLVM_DEBUG(dbgs()
313  << "[SafeStack] Unsafe alloca: " << *AllocaPtr
314  << "\n store of address: " << *I << "\n");
315  return false;
316  }
317 
318  if (!IsAccessSafe(UI, DL.getTypeStoreSize(I->getOperand(0)->getType()),
319  AllocaPtr, AllocaSize))
320  return false;
321  break;
322 
323  case Instruction::Ret:
324  // Information leak.
325  return false;
326 
327  case Instruction::Call:
328  case Instruction::Invoke: {
329  const CallBase &CS = *cast<CallBase>(I);
330 
331  if (I->isLifetimeStartOrEnd())
332  continue;
333 
334  if (const MemIntrinsic *MI = dyn_cast<MemIntrinsic>(I)) {
335  if (!IsMemIntrinsicSafe(MI, UI, AllocaPtr, AllocaSize)) {
336  LLVM_DEBUG(dbgs()
337  << "[SafeStack] Unsafe alloca: " << *AllocaPtr
338  << "\n unsafe memintrinsic: " << *I << "\n");
339  return false;
340  }
341  continue;
342  }
343 
344  // LLVM 'nocapture' attribute is only set for arguments whose address
345  // is not stored, passed around, or used in any other non-trivial way.
346  // We assume that passing a pointer to an object as a 'nocapture
347  // readnone' argument is safe.
348  // FIXME: a more precise solution would require an interprocedural
349  // analysis here, which would look at all uses of an argument inside
350  // the function being called.
351  auto B = CS.arg_begin(), E = CS.arg_end();
352  for (auto A = B; A != E; ++A)
353  if (A->get() == V)
354  if (!(CS.doesNotCapture(A - B) && (CS.doesNotAccessMemory(A - B) ||
355  CS.doesNotAccessMemory()))) {
356  LLVM_DEBUG(dbgs() << "[SafeStack] Unsafe alloca: " << *AllocaPtr
357  << "\n unsafe call: " << *I << "\n");
358  return false;
359  }
360  continue;
361  }
362 
363  default:
364  if (Visited.insert(I).second)
365  WorkList.push_back(cast<const Instruction>(I));
366  }
367  }
368  }
369 
370  // All uses of the alloca are safe, we can place it on the safe stack.
371  return true;
372 }
373 
375  Value *StackGuardVar = TL.getIRStackGuard(IRB);
376  if (!StackGuardVar)
377  StackGuardVar =
378  F.getParent()->getOrInsertGlobal("__stack_chk_guard", StackPtrTy);
379  return IRB.CreateLoad(StackPtrTy, StackGuardVar, "StackGuard");
380 }
381 
382 void SafeStack::findInsts(Function &F,
383  SmallVectorImpl<AllocaInst *> &StaticAllocas,
384  SmallVectorImpl<AllocaInst *> &DynamicAllocas,
385  SmallVectorImpl<Argument *> &ByValArguments,
387  SmallVectorImpl<Instruction *> &StackRestorePoints) {
388  for (Instruction &I : instructions(&F)) {
389  if (auto AI = dyn_cast<AllocaInst>(&I)) {
390  ++NumAllocas;
391 
392  uint64_t Size = getStaticAllocaAllocationSize(AI);
393  if (IsSafeStackAlloca(AI, Size))
394  continue;
395 
396  if (AI->isStaticAlloca()) {
397  ++NumUnsafeStaticAllocas;
398  StaticAllocas.push_back(AI);
399  } else {
400  ++NumUnsafeDynamicAllocas;
401  DynamicAllocas.push_back(AI);
402  }
403  } else if (auto RI = dyn_cast<ReturnInst>(&I)) {
404  Returns.push_back(RI);
405  } else if (auto CI = dyn_cast<CallInst>(&I)) {
406  // setjmps require stack restore.
407  if (CI->getCalledFunction() && CI->canReturnTwice())
408  StackRestorePoints.push_back(CI);
409  } else if (auto LP = dyn_cast<LandingPadInst>(&I)) {
410  // Exception landing pads require stack restore.
411  StackRestorePoints.push_back(LP);
412  } else if (auto II = dyn_cast<IntrinsicInst>(&I)) {
413  if (II->getIntrinsicID() == Intrinsic::gcroot)
415  "gcroot intrinsic not compatible with safestack attribute");
416  }
417  }
418  for (Argument &Arg : F.args()) {
419  if (!Arg.hasByValAttr())
420  continue;
421  uint64_t Size =
422  DL.getTypeStoreSize(Arg.getType()->getPointerElementType());
423  if (IsSafeStackAlloca(&Arg, Size))
424  continue;
425 
426  ++NumUnsafeByValArguments;
427  ByValArguments.push_back(&Arg);
428  }
429 }
430 
431 AllocaInst *
432 SafeStack::createStackRestorePoints(IRBuilder<> &IRB, Function &F,
433  ArrayRef<Instruction *> StackRestorePoints,
434  Value *StaticTop, bool NeedDynamicTop) {
435  assert(StaticTop && "The stack top isn't set.");
436 
437  if (StackRestorePoints.empty())
438  return nullptr;
439 
440  // We need the current value of the shadow stack pointer to restore
441  // after longjmp or exception catching.
442 
443  // FIXME: On some platforms this could be handled by the longjmp/exception
444  // runtime itself.
445 
446  AllocaInst *DynamicTop = nullptr;
447  if (NeedDynamicTop) {
448  // If we also have dynamic alloca's, the stack pointer value changes
449  // throughout the function. For now we store it in an alloca.
450  DynamicTop = IRB.CreateAlloca(StackPtrTy, /*ArraySize=*/nullptr,
451  "unsafe_stack_dynamic_ptr");
452  IRB.CreateStore(StaticTop, DynamicTop);
453  }
454 
455  // Restore current stack pointer after longjmp/exception catch.
456  for (Instruction *I : StackRestorePoints) {
457  ++NumUnsafeStackRestorePoints;
458 
459  IRB.SetInsertPoint(I->getNextNode());
460  Value *CurrentTop =
461  DynamicTop ? IRB.CreateLoad(StackPtrTy, DynamicTop) : StaticTop;
462  IRB.CreateStore(CurrentTop, UnsafeStackPtr);
463  }
464 
465  return DynamicTop;
466 }
467 
468 void SafeStack::checkStackGuard(IRBuilder<> &IRB, Function &F, ReturnInst &RI,
469  AllocaInst *StackGuardSlot, Value *StackGuard) {
470  Value *V = IRB.CreateLoad(StackPtrTy, StackGuardSlot);
471  Value *Cmp = IRB.CreateICmpNE(StackGuard, V);
472 
474  auto FailureProb = BranchProbabilityInfo::getBranchProbStackProtector(false);
475  MDNode *Weights = MDBuilder(F.getContext())
476  .createBranchWeights(SuccessProb.getNumerator(),
477  FailureProb.getNumerator());
478  Instruction *CheckTerm =
479  SplitBlockAndInsertIfThen(Cmp, &RI,
480  /* Unreachable */ true, Weights);
481  IRBuilder<> IRBFail(CheckTerm);
482  // FIXME: respect -fsanitize-trap / -ftrap-function here?
483  FunctionCallee StackChkFail =
484  F.getParent()->getOrInsertFunction("__stack_chk_fail", IRB.getVoidTy());
485  IRBFail.CreateCall(StackChkFail, {});
486 }
487 
488 /// We explicitly compute and set the unsafe stack layout for all unsafe
489 /// static alloca instructions. We save the unsafe "base pointer" in the
490 /// prologue into a local variable and restore it in the epilogue.
491 Value *SafeStack::moveStaticAllocasToUnsafeStack(
492  IRBuilder<> &IRB, Function &F, ArrayRef<AllocaInst *> StaticAllocas,
493  ArrayRef<Argument *> ByValArguments, ArrayRef<ReturnInst *> Returns,
494  Instruction *BasePointer, AllocaInst *StackGuardSlot) {
495  if (StaticAllocas.empty() && ByValArguments.empty())
496  return BasePointer;
497 
498  DIBuilder DIB(*F.getParent());
499 
500  StackLifetime SSC(F, StaticAllocas, StackLifetime::LivenessType::May);
501  static const StackLifetime::LiveRange NoColoringRange(1, true);
502  if (ClColoring)
503  SSC.run();
504 
505  for (auto *I : SSC.getMarkers()) {
506  auto *Op = dyn_cast<Instruction>(I->getOperand(1));
507  const_cast<IntrinsicInst *>(I)->eraseFromParent();
508  // Remove the operand bitcast, too, if it has no more uses left.
509  if (Op && Op->use_empty())
510  Op->eraseFromParent();
511  }
512 
513  // Unsafe stack always grows down.
514  StackLayout SSL(StackAlignment);
515  if (StackGuardSlot) {
516  Type *Ty = StackGuardSlot->getAllocatedType();
517  unsigned Align =
518  std::max(DL.getPrefTypeAlignment(Ty), StackGuardSlot->getAlignment());
519  SSL.addObject(StackGuardSlot, getStaticAllocaAllocationSize(StackGuardSlot),
520  Align, SSC.getFullLiveRange());
521  }
522 
523  for (Argument *Arg : ByValArguments) {
524  Type *Ty = Arg->getType()->getPointerElementType();
525  uint64_t Size = DL.getTypeStoreSize(Ty);
526  if (Size == 0)
527  Size = 1; // Don't create zero-sized stack objects.
528 
529  // Ensure the object is properly aligned.
530  unsigned Align = std::max((unsigned)DL.getPrefTypeAlignment(Ty),
531  Arg->getParamAlignment());
532  SSL.addObject(Arg, Size, Align, SSC.getFullLiveRange());
533  }
534 
535  for (AllocaInst *AI : StaticAllocas) {
536  Type *Ty = AI->getAllocatedType();
537  uint64_t Size = getStaticAllocaAllocationSize(AI);
538  if (Size == 0)
539  Size = 1; // Don't create zero-sized stack objects.
540 
541  // Ensure the object is properly aligned.
542  unsigned Align =
543  std::max((unsigned)DL.getPrefTypeAlignment(Ty), AI->getAlignment());
544 
545  SSL.addObject(AI, Size, Align,
546  ClColoring ? SSC.getLiveRange(AI) : NoColoringRange);
547  }
548 
549  SSL.computeLayout();
550  unsigned FrameAlignment = SSL.getFrameAlignment();
551 
552  // FIXME: tell SSL that we start at a less-then-MaxAlignment aligned location
553  // (AlignmentSkew).
554  if (FrameAlignment > StackAlignment) {
555  // Re-align the base pointer according to the max requested alignment.
556  assert(isPowerOf2_32(FrameAlignment));
557  IRB.SetInsertPoint(BasePointer->getNextNode());
558  BasePointer = cast<Instruction>(IRB.CreateIntToPtr(
559  IRB.CreateAnd(IRB.CreatePtrToInt(BasePointer, IntPtrTy),
560  ConstantInt::get(IntPtrTy, ~uint64_t(FrameAlignment - 1))),
561  StackPtrTy));
562  }
563 
564  IRB.SetInsertPoint(BasePointer->getNextNode());
565 
566  if (StackGuardSlot) {
567  unsigned Offset = SSL.getObjectOffset(StackGuardSlot);
568  Value *Off = IRB.CreateGEP(Int8Ty, BasePointer, // BasePointer is i8*
569  ConstantInt::get(Int32Ty, -Offset));
570  Value *NewAI =
571  IRB.CreateBitCast(Off, StackGuardSlot->getType(), "StackGuardSlot");
572 
573  // Replace alloc with the new location.
574  StackGuardSlot->replaceAllUsesWith(NewAI);
575  StackGuardSlot->eraseFromParent();
576  }
577 
578  for (Argument *Arg : ByValArguments) {
579  unsigned Offset = SSL.getObjectOffset(Arg);
581  Type *Ty = Arg->getType()->getPointerElementType();
582 
583  uint64_t Size = DL.getTypeStoreSize(Ty);
584  if (Size == 0)
585  Size = 1; // Don't create zero-sized stack objects.
586 
587  Value *Off = IRB.CreateGEP(Int8Ty, BasePointer, // BasePointer is i8*
588  ConstantInt::get(Int32Ty, -Offset));
589  Value *NewArg = IRB.CreateBitCast(Off, Arg->getType(),
590  Arg->getName() + ".unsafe-byval");
591 
592  // Replace alloc with the new location.
594  -Offset);
595  Arg->replaceAllUsesWith(NewArg);
596  IRB.SetInsertPoint(cast<Instruction>(NewArg)->getNextNode());
597  IRB.CreateMemCpy(Off, Align, Arg, Arg->getParamAlign(), Size);
598  }
599 
600  // Allocate space for every unsafe static AllocaInst on the unsafe stack.
601  for (AllocaInst *AI : StaticAllocas) {
602  IRB.SetInsertPoint(AI);
603  unsigned Offset = SSL.getObjectOffset(AI);
604 
605  replaceDbgDeclare(AI, BasePointer, DIB, DIExpression::ApplyOffset, -Offset);
606  replaceDbgValueForAlloca(AI, BasePointer, DIB, -Offset);
607 
608  // Replace uses of the alloca with the new location.
609  // Insert address calculation close to each use to work around PR27844.
610  std::string Name = std::string(AI->getName()) + ".unsafe";
611  while (!AI->use_empty()) {
612  Use &U = *AI->use_begin();
613  Instruction *User = cast<Instruction>(U.getUser());
614 
615  Instruction *InsertBefore;
616  if (auto *PHI = dyn_cast<PHINode>(User))
617  InsertBefore = PHI->getIncomingBlock(U)->getTerminator();
618  else
619  InsertBefore = User;
620 
621  IRBuilder<> IRBUser(InsertBefore);
622  Value *Off = IRBUser.CreateGEP(Int8Ty, BasePointer, // BasePointer is i8*
623  ConstantInt::get(Int32Ty, -Offset));
624  Value *Replacement = IRBUser.CreateBitCast(Off, AI->getType(), Name);
625 
626  if (auto *PHI = dyn_cast<PHINode>(User))
627  // PHI nodes may have multiple incoming edges from the same BB (why??),
628  // all must be updated at once with the same incoming value.
629  PHI->setIncomingValueForBlock(PHI->getIncomingBlock(U), Replacement);
630  else
631  U.set(Replacement);
632  }
633 
634  AI->eraseFromParent();
635  }
636 
637  // Re-align BasePointer so that our callees would see it aligned as
638  // expected.
639  // FIXME: no need to update BasePointer in leaf functions.
640  unsigned FrameSize = alignTo(SSL.getFrameSize(), StackAlignment);
641 
642  // Update shadow stack pointer in the function epilogue.
643  IRB.SetInsertPoint(BasePointer->getNextNode());
644 
645  Value *StaticTop =
646  IRB.CreateGEP(Int8Ty, BasePointer, ConstantInt::get(Int32Ty, -FrameSize),
647  "unsafe_stack_static_top");
648  IRB.CreateStore(StaticTop, UnsafeStackPtr);
649  return StaticTop;
650 }
651 
652 void SafeStack::moveDynamicAllocasToUnsafeStack(
653  Function &F, Value *UnsafeStackPtr, AllocaInst *DynamicTop,
654  ArrayRef<AllocaInst *> DynamicAllocas) {
655  DIBuilder DIB(*F.getParent());
656 
657  for (AllocaInst *AI : DynamicAllocas) {
658  IRBuilder<> IRB(AI);
659 
660  // Compute the new SP value (after AI).
661  Value *ArraySize = AI->getArraySize();
662  if (ArraySize->getType() != IntPtrTy)
663  ArraySize = IRB.CreateIntCast(ArraySize, IntPtrTy, false);
664 
665  Type *Ty = AI->getAllocatedType();
666  uint64_t TySize = DL.getTypeAllocSize(Ty);
667  Value *Size = IRB.CreateMul(ArraySize, ConstantInt::get(IntPtrTy, TySize));
668 
669  Value *SP = IRB.CreatePtrToInt(IRB.CreateLoad(StackPtrTy, UnsafeStackPtr),
670  IntPtrTy);
671  SP = IRB.CreateSub(SP, Size);
672 
673  // Align the SP value to satisfy the AllocaInst, type and stack alignments.
674  unsigned Align = std::max(
675  std::max((unsigned)DL.getPrefTypeAlignment(Ty), AI->getAlignment()),
676  (unsigned)StackAlignment);
677 
678  assert(isPowerOf2_32(Align));
679  Value *NewTop = IRB.CreateIntToPtr(
680  IRB.CreateAnd(SP, ConstantInt::get(IntPtrTy, ~uint64_t(Align - 1))),
681  StackPtrTy);
682 
683  // Save the stack pointer.
684  IRB.CreateStore(NewTop, UnsafeStackPtr);
685  if (DynamicTop)
686  IRB.CreateStore(NewTop, DynamicTop);
687 
688  Value *NewAI = IRB.CreatePointerCast(NewTop, AI->getType());
689  if (AI->hasName() && isa<Instruction>(NewAI))
690  NewAI->takeName(AI);
691 
692  replaceDbgDeclare(AI, NewAI, DIB, DIExpression::ApplyOffset, 0);
693  AI->replaceAllUsesWith(NewAI);
694  AI->eraseFromParent();
695  }
696 
697  if (!DynamicAllocas.empty()) {
698  // Now go through the instructions again, replacing stacksave/stackrestore.
699  for (inst_iterator It = inst_begin(&F), Ie = inst_end(&F); It != Ie;) {
700  Instruction *I = &*(It++);
701  auto II = dyn_cast<IntrinsicInst>(I);
702  if (!II)
703  continue;
704 
705  if (II->getIntrinsicID() == Intrinsic::stacksave) {
706  IRBuilder<> IRB(II);
707  Instruction *LI = IRB.CreateLoad(StackPtrTy, UnsafeStackPtr);
708  LI->takeName(II);
709  II->replaceAllUsesWith(LI);
710  II->eraseFromParent();
711  } else if (II->getIntrinsicID() == Intrinsic::stackrestore) {
712  IRBuilder<> IRB(II);
713  Instruction *SI = IRB.CreateStore(II->getArgOperand(0), UnsafeStackPtr);
714  SI->takeName(II);
715  assert(II->use_empty());
716  II->eraseFromParent();
717  }
718  }
719  }
720 }
721 
722 bool SafeStack::ShouldInlinePointerAddress(CallInst &CI) {
724  if (CI.hasFnAttr(Attribute::AlwaysInline) &&
725  isInlineViable(*Callee).isSuccess())
726  return true;
727  if (Callee->isInterposable() || Callee->hasFnAttribute(Attribute::NoInline) ||
728  CI.isNoInline())
729  return false;
730  return true;
731 }
732 
733 void SafeStack::TryInlinePointerAddress() {
734  auto *CI = dyn_cast<CallInst>(UnsafeStackPtr);
735  if (!CI)
736  return;
737 
738  if(F.hasOptNone())
739  return;
740 
742  if (!Callee || Callee->isDeclaration())
743  return;
744 
745  if (!ShouldInlinePointerAddress(*CI))
746  return;
747 
748  InlineFunctionInfo IFI;
749  InlineFunction(*CI, IFI);
750 }
751 
752 bool SafeStack::run() {
753  assert(F.hasFnAttribute(Attribute::SafeStack) &&
754  "Can't run SafeStack on a function without the attribute");
755  assert(!F.isDeclaration() && "Can't run SafeStack on a function declaration");
756 
757  ++NumFunctions;
758 
759  SmallVector<AllocaInst *, 16> StaticAllocas;
760  SmallVector<AllocaInst *, 4> DynamicAllocas;
761  SmallVector<Argument *, 4> ByValArguments;
763 
764  // Collect all points where stack gets unwound and needs to be restored
765  // This is only necessary because the runtime (setjmp and unwind code) is
766  // not aware of the unsafe stack and won't unwind/restore it properly.
767  // To work around this problem without changing the runtime, we insert
768  // instrumentation to restore the unsafe stack pointer when necessary.
769  SmallVector<Instruction *, 4> StackRestorePoints;
770 
771  // Find all static and dynamic alloca instructions that must be moved to the
772  // unsafe stack, all return instructions and stack restore points.
773  findInsts(F, StaticAllocas, DynamicAllocas, ByValArguments, Returns,
774  StackRestorePoints);
775 
776  if (StaticAllocas.empty() && DynamicAllocas.empty() &&
777  ByValArguments.empty() && StackRestorePoints.empty())
778  return false; // Nothing to do in this function.
779 
780  if (!StaticAllocas.empty() || !DynamicAllocas.empty() ||
781  !ByValArguments.empty())
782  ++NumUnsafeStackFunctions; // This function has the unsafe stack.
783 
784  if (!StackRestorePoints.empty())
785  ++NumUnsafeStackRestorePointsFunctions;
786 
787  IRBuilder<> IRB(&F.front(), F.begin()->getFirstInsertionPt());
788  // Calls must always have a debug location, or else inlining breaks. So
789  // we explicitly set a artificial debug location here.
790  if (DISubprogram *SP = F.getSubprogram())
791  IRB.SetCurrentDebugLocation(DebugLoc::get(SP->getScopeLine(), 0, SP));
792  if (SafeStackUsePointerAddress) {
794  "__safestack_pointer_address", StackPtrTy->getPointerTo(0));
795  UnsafeStackPtr = IRB.CreateCall(Fn);
796  } else {
797  UnsafeStackPtr = TL.getSafeStackPointerLocation(IRB);
798  }
799 
800  // Load the current stack pointer (we'll also use it as a base pointer).
801  // FIXME: use a dedicated register for it ?
802  Instruction *BasePointer =
803  IRB.CreateLoad(StackPtrTy, UnsafeStackPtr, false, "unsafe_stack_ptr");
804  assert(BasePointer->getType() == StackPtrTy);
805 
806  AllocaInst *StackGuardSlot = nullptr;
807  // FIXME: implement weaker forms of stack protector.
808  if (F.hasFnAttribute(Attribute::StackProtect) ||
809  F.hasFnAttribute(Attribute::StackProtectStrong) ||
810  F.hasFnAttribute(Attribute::StackProtectReq)) {
811  Value *StackGuard = getStackGuard(IRB, F);
812  StackGuardSlot = IRB.CreateAlloca(StackPtrTy, nullptr);
813  IRB.CreateStore(StackGuard, StackGuardSlot);
814 
815  for (ReturnInst *RI : Returns) {
816  IRBuilder<> IRBRet(RI);
817  checkStackGuard(IRBRet, F, *RI, StackGuardSlot, StackGuard);
818  }
819  }
820 
821  // The top of the unsafe stack after all unsafe static allocas are
822  // allocated.
823  Value *StaticTop =
824  moveStaticAllocasToUnsafeStack(IRB, F, StaticAllocas, ByValArguments,
825  Returns, BasePointer, StackGuardSlot);
826 
827  // Safe stack object that stores the current unsafe stack top. It is updated
828  // as unsafe dynamic (non-constant-sized) allocas are allocated and freed.
829  // This is only needed if we need to restore stack pointer after longjmp
830  // or exceptions, and we have dynamic allocations.
831  // FIXME: a better alternative might be to store the unsafe stack pointer
832  // before setjmp / invoke instructions.
833  AllocaInst *DynamicTop = createStackRestorePoints(
834  IRB, F, StackRestorePoints, StaticTop, !DynamicAllocas.empty());
835 
836  // Handle dynamic allocas.
837  moveDynamicAllocasToUnsafeStack(F, UnsafeStackPtr, DynamicTop,
838  DynamicAllocas);
839 
840  // Restore the unsafe stack pointer before each return.
841  for (ReturnInst *RI : Returns) {
842  IRB.SetInsertPoint(RI);
843  IRB.CreateStore(BasePointer, UnsafeStackPtr);
844  }
845 
846  TryInlinePointerAddress();
847 
848  LLVM_DEBUG(dbgs() << "[SafeStack] safestack applied\n");
849  return true;
850 }
851 
852 class SafeStackLegacyPass : public FunctionPass {
853  const TargetMachine *TM = nullptr;
854 
855 public:
856  static char ID; // Pass identification, replacement for typeid..
857 
858  SafeStackLegacyPass() : FunctionPass(ID) {
860  }
861 
862  void getAnalysisUsage(AnalysisUsage &AU) const override {
866  }
867 
868  bool runOnFunction(Function &F) override {
869  LLVM_DEBUG(dbgs() << "[SafeStack] Function: " << F.getName() << "\n");
870 
871  if (!F.hasFnAttribute(Attribute::SafeStack)) {
872  LLVM_DEBUG(dbgs() << "[SafeStack] safestack is not requested"
873  " for this function\n");
874  return false;
875  }
876 
877  if (F.isDeclaration()) {
878  LLVM_DEBUG(dbgs() << "[SafeStack] function definition"
879  " is not available\n");
880  return false;
881  }
882 
883  TM = &getAnalysis<TargetPassConfig>().getTM<TargetMachine>();
884  auto *TL = TM->getSubtargetImpl(F)->getTargetLowering();
885  if (!TL)
886  report_fatal_error("TargetLowering instance is required");
887 
888  auto *DL = &F.getParent()->getDataLayout();
889  auto &TLI = getAnalysis<TargetLibraryInfoWrapperPass>().getTLI(F);
890  auto &ACT = getAnalysis<AssumptionCacheTracker>().getAssumptionCache(F);
891 
892  // Compute DT and LI only for functions that have the attribute.
893  // This is only useful because the legacy pass manager doesn't let us
894  // compute analyzes lazily.
895  // In the backend pipeline, nothing preserves DT before SafeStack, so we
896  // would otherwise always compute it wastefully, even if there is no
897  // function with the safestack attribute.
898  DominatorTree DT(F);
899  LoopInfo LI(DT);
900 
901  ScalarEvolution SE(F, TLI, ACT, DT, LI);
902 
903  return SafeStack(F, *TL, *DL, SE).run();
904  }
905 };
906 
907 } // end anonymous namespace
908 
909 char SafeStackLegacyPass::ID = 0;
910 
911 INITIALIZE_PASS_BEGIN(SafeStackLegacyPass, DEBUG_TYPE,
912  "Safe Stack instrumentation pass", false, false)
914 INITIALIZE_PASS_END(SafeStackLegacyPass, DEBUG_TYPE,
915  "Safe Stack instrumentation pass", false, false)
916 
917 FunctionPass *llvm::createSafeStackPass() { return new SafeStackLegacyPass(); }
uint64_t CallInst * C
Return a value (possibly void), from a function.
SymbolTableList< Instruction >::iterator eraseFromParent()
This method unlinks &#39;this&#39; from the containing basic block and deletes it.
Definition: Instruction.cpp:80
A parsed version of the target data layout string in and methods for querying it. ...
Definition: DataLayout.h:111
constexpr char Align[]
Key for Kernel::Arg::Metadata::mAlign.
Safe Stack instrumentation pass
Definition: SafeStack.cpp:914
bool isInterposable() const
Return true if this global&#39;s definition can be substituted with an arbitrary definition at link time ...
Definition: Globals.cpp:98
iterator_range< use_iterator > uses()
Definition: Value.h:373
LLVM_NODISCARD std::enable_if_t< !is_simple_type< Y >::value, typename cast_retty< X, const Y >::ret_type > dyn_cast(const Y &Val)
Definition: Casting.h:334
InlineResult InlineFunction(CallBase &CB, InlineFunctionInfo &IFI, AAResults *CalleeAAR=nullptr, bool InsertLifetime=true, Function *ForwardVarArgsTo=nullptr)
This function inlines the called function into the basic block of the caller.
#define DEBUG_TYPE
Definition: SafeStack.cpp:76
DILocation * get() const
Get the underlying DILocation.
Definition: DebugLoc.cpp:21
static PassRegistry * getPassRegistry()
getPassRegistry - Access the global registry object, which is automatically initialized at applicatio...
This class represents an incoming formal argument to a Function.
Definition: Argument.h:29
bool doesNotAccessMemory(unsigned OpNo) const
Definition: InstrTypes.h:1577
void replaceDbgValueForAlloca(AllocaInst *AI, Value *NewAllocaAddress, DIBuilder &Builder, int Offset=0)
Replaces multiple llvm.dbg.value instructions when the alloca it describes is replaced with a new val...
Definition: Local.cpp:1615
NodeTy * getNextNode()
Get the next node, or nullptr for the list tail.
Definition: ilist_node.h:288
LLVM_ATTRIBUTE_NORETURN void report_fatal_error(Error Err, bool gen_crash_diag=true)
Report a serious error, calling any installed error handler.
Definition: Error.cpp:140
This class represents lattice values for constants.
Definition: AllocatorList.h:23
bool hasOptNone() const
Do not optimize this function (-O0).
Definition: Function.h:641
Value * CreateGEP(Value *Ptr, ArrayRef< Value *> IdxList, const Twine &Name="")
Definition: IRBuilder.h:1753
bool replaceDbgDeclare(Value *Address, Value *NewAddress, DIBuilder &Builder, uint8_t DIExprFlags, int Offset)
Replaces llvm.dbg.declare instruction when the address it describes is replaced with a new value...
Definition: Local.cpp:1574
amdgpu Simplify well known AMD library false FunctionCallee Value const Twine & Name
unsigned getFrameSize()
Returns the size of the entire frame.
A handy container for a FunctionType+Callee-pointer pair, which can be passed around as a single enti...
Definition: DerivedTypes.h:170
The main scalar evolution driver.
This class represents a function call, abstracting a target machine&#39;s calling convention.
Value * CreateICmpNE(Value *LHS, Value *RHS, const Twine &Name="")
Definition: IRBuilder.h:2164
An immutable pass that tracks lazily created AssumptionCache objects.
virtual const TargetLowering * getTargetLowering() const
Value * CreateMul(Value *LHS, Value *RHS, const Twine &Name="", bool HasNUW=false, bool HasNSW=false)
Definition: IRBuilder.h:1200
bool hasFnAttribute(Attribute::AttrKind Kind) const
Return true if the function has the attribute.
Definition: Function.h:330
STATISTIC(NumFunctions, "Total number of functions")
Metadata node.
Definition: Metadata.h:870
Base class for all callable instructions (InvokeInst and CallInst) Holds everything related to callin...
Definition: InstrTypes.h:1100
F(f)
Value * CreateIntToPtr(Value *V, Type *DestTy, const Twine &Name="")
Definition: IRBuilder.h:2041
User::op_iterator arg_end()
Return the iterator pointing to the end of the argument list.
Definition: InstrTypes.h:1230
This defines the Use class.
This class captures the data input to the InlineFunction call, and records the auxiliary results prod...
Definition: Cloning.h:172
Value * getLength() const
INITIALIZE_PASS_BEGIN(SafeStackLegacyPass, DEBUG_TYPE, "Safe Stack instrumentation pass", false, false) INITIALIZE_PASS_END(SafeStackLegacyPass
Value * CreateAnd(Value *LHS, Value *RHS, const Twine &Name="")
Definition: IRBuilder.h:1316
static cl::opt< bool > SafeStackUsePointerAddress("safestack-use-pointer-address", cl::init(false), cl::Hidden)
Use __safestack_pointer_address even if the platform has a faster way of access safe stack pointer...
const SCEV * getZero(Type *Ty)
Return a SCEV for the constant 0 of a specific type.
AllocaInst * CreateAlloca(Type *Ty, unsigned AddrSpace, Value *ArraySize=nullptr, const Twine &Name="")
Definition: IRBuilder.h:1585
StoreInst * CreateStore(Value *Val, Value *Ptr, bool isVolatile=false)
Definition: IRBuilder.h:1631
bool isSuccess() const
Definition: InlineCost.h:143
bool doesNotCapture(unsigned OpNo) const
Determine whether this data operand is not captured.
Definition: InstrTypes.h:1547
AnalysisUsage & addRequired()
inst_iterator inst_begin(Function *F)
Definition: InstIterator.h:131
unsigned getObjectOffset(const Value *V)
Returns the offset to the object start in the stack frame.
const DataLayout & getDataLayout() const
Get the data layout for the module&#39;s target platform.
Definition: Module.cpp:397
unsigned getAlignment() const
Definition: Instructions.h:127
PointerType * getType() const
Overload to return most specific pointer type.
Definition: Instructions.h:102
A Use represents the edge between a Value definition and its users.
Definition: Use.h:44
This class consists of common code factored out of the SmallVector class to reduce code duplication b...
Definition: APFloat.h:43
FunctionPass * createSafeStackPass()
This pass splits the stack into a safe stack and an unsafe stack to protect against stack-based overf...
Definition: SafeStack.cpp:917
This file contains the simple types necessary to represent the attributes associated with functions a...
This class represents a set of interesting instructions where an alloca is live.
Definition: StackLifetime.h:63
CallInst * CreateCall(FunctionType *FTy, Value *Callee, ArrayRef< Value *> Args=None, const Twine &Name="", MDNode *FPMathTag=nullptr)
Definition: IRBuilder.h:2324
bool contains(const APInt &Val) const
Return true if the specified value is in the set.
Target-Independent Code Generator Pass Configuration Options.
This file implements a class to represent arbitrary precision integral constant values and operations...
Type * getVoidTy()
Fetch the type representing void.
Definition: IRBuilder.h:496
Subprogram description.
Type * getType() const
All values are typed, get the type of this value.
Definition: Value.h:244
CallInst * CreateMemCpy(Value *Dst, MaybeAlign DstAlign, Value *Src, MaybeAlign SrcAlign, uint64_t Size, bool isVolatile=false, MDNode *TBAATag=nullptr, MDNode *TBAAStructTag=nullptr, MDNode *ScopeTag=nullptr, MDNode *NoAliasTag=nullptr)
Create and insert a memcpy between the specified pointers.
Definition: IRBuilder.h:562
static cl::opt< bool > ClColoring("safe-stack-coloring", cl::desc("enable safe stack coloring"), cl::Hidden, cl::init(false))
Value * CreateIntCast(Value *V, Type *DestTy, bool isSigned, const Twine &Name="")
Definition: IRBuilder.h:2115
ArrayRef - Represent a constant reference to an array (0 or more elements consecutively in memory)...
Definition: APInt.h:32
void SetCurrentDebugLocation(DebugLoc L)
Set location information used by debugging information.
Definition: IRBuilder.h:185
void replaceAllUsesWith(Value *V)
Change all uses of this to point to a new Value.
Definition: Value.cpp:486
void takeName(Value *V)
Transfer the name from V to this value.
Definition: Value.cpp:348
iterator begin()
Definition: Function.h:705
Concrete subclass of DominatorTreeBase that is used to compute a normal dominator tree...
Definition: Dominators.h:144
void SetInsertPoint(BasicBlock *TheBB)
This specifies that created instructions should be appended to the end of the specified block...
Definition: IRBuilder.h:161
IntegerType * getIntPtrType(LLVMContext &C, unsigned AddressSpace=0) const
Returns an integer type with size at least as big as that of a pointer in the given address space...
Definition: DataLayout.cpp:789
static bool runOnFunction(Function &F, bool PostInlining)
xray instrumentation
This means that we are dealing with an entirely unknown SCEV value, and only represent it as its LLVM...
initializer< Ty > init(const Ty &Val)
Definition: CommandLine.h:434
static GCRegistry::Add< OcamlGC > B("ocaml", "ocaml 3.10-compatible GC")
bool isNoInline() const
Return true if the call should not be inlined.
Definition: InstrTypes.h:1667
void set(Value *Val)
Definition: Value.h:764
constexpr bool isPowerOf2_32(uint32_t Value)
Return true if the argument is a power of two > 0.
Definition: MathExtras.h:492
Value * CreateSub(Value *LHS, Value *RHS, const Twine &Name="", bool HasNUW=false, bool HasNSW=false)
Definition: IRBuilder.h:1183
bool hasName() const
Definition: Value.h:250
The instances of the Type class are immutable: once they are created, they are never changed...
Definition: Type.h:46
DISubprogram * getSubprogram() const
Get the attached subprogram.
Definition: Metadata.cpp:1528
static GCRegistry::Add< CoreCLRGC > E("coreclr", "CoreCLR-compatible GC")
Value * CreateBitCast(Value *V, Type *DestTy, const Twine &Name="")
Definition: IRBuilder.h:2046
This file contains the declarations for the subclasses of Constant, which represent the different fla...
std::pair< iterator, bool > insert(PtrType Ptr)
Inserts Ptr if and only if there is no element in the container equal to Ptr.
Definition: SmallPtrSet.h:364
Compute the layout of an unsafe stack frame.
Represent the analysis usage information of a pass.
InlineResult isInlineViable(Function &Callee)
Minimal filter to detect invalid constructs for inlining.
FunctionPass class - This class is used to implement most global optimizations.
Definition: Pass.h:284
ConstantRange add(const ConstantRange &Other) const
Return a new range representing the possible values resulting from an addition of a value in this ran...
amdgpu Simplify well known AMD library false FunctionCallee Value * Arg
constexpr unsigned BitWidth
Definition: BitmaskEnum.h:147
LLVMContext & getContext() const
getContext - Return a reference to the LLVMContext associated with this function. ...
Definition: Function.cpp:251
LoadInst * CreateLoad(Type *Ty, Value *Ptr, const char *Name)
Provided to resolve &#39;CreateLoad(Ty, Ptr, "...")&#39; correctly, instead of converting the string to &#39;bool...
Definition: IRBuilder.h:1602
const Value * getArraySize() const
Get the number of elements allocated.
Definition: Instructions.h:98
bool hasFnAttr(Attribute::AttrKind Kind) const
Determine whether this call has the given attribute.
Definition: InstrTypes.h:1397
static PointerType * getInt8PtrTy(LLVMContext &C, unsigned AS=0)
Definition: Type.cpp:234
INITIALIZE_PASS_END(RegBankSelect, DEBUG_TYPE, "Assign register bank of generic virtual registers", false, false) RegBankSelect
This struct is a compact representation of a valid (non-zero power of two) alignment.
Definition: Alignment.h:39
Type * getAllocatedType() const
Return the type that is being allocated by the instruction.
Definition: Instructions.h:111
This base class for TargetLowering contains the SelectionDAG-independent parts that can be used from ...
User * getUser() const
Returns the User that contains this Use.
Definition: Use.h:73
This is the common base class for memset/memcpy/memmove.
SmallPtrSet - This class implements a set which is optimized for holding SmallSize or less elements...
Definition: SmallPtrSet.h:439
This is the shared class of boolean and integer constants.
Definition: Constants.h:77
Type * getType() const
Return the LLVM type of this SCEV expression.
Align max(MaybeAlign Lhs, Align Rhs)
Definition: Alignment.h:350
This struct is a compact representation of a valid (power of two) or undefined (0) alignment...
Definition: Alignment.h:119
This is a &#39;vector&#39; (really, a variable-sized array), optimized for the case when the array is small...
Definition: SmallVector.h:883
Module.h This file contains the declarations for the Module class.
This class represents a range of values.
Definition: ConstantRange.h:47
LLVM_NODISCARD T pop_back_val()
Definition: SmallVector.h:420
static Constant * get(Type *Ty, uint64_t V, bool isSigned=false)
If Ty is a vector type, return a Constant with a splat of the given value.
Definition: Constants.cpp:786
FunctionCallee getOrInsertFunction(StringRef Name, FunctionType *T, AttributeList AttributeList)
Look up the specified function in the module symbol table.
Definition: Module.cpp:143
virtual const TargetSubtargetInfo * getSubtargetImpl(const Function &) const
Virtual method implemented by subclasses that returns a reference to that target&#39;s TargetSubtargetInf...
raw_ostream & dbgs()
dbgs() - This returns a reference to a raw_ostream for debugging messages.
Definition: Debug.cpp:132
unsigned getObjectAlignment(const Value *V)
Returns the alignment of the object.
Class for arbitrary precision integers.
Definition: APInt.h:69
amdgpu Simplify well known AMD library false FunctionCallee Callee
void initializeSafeStackLegacyPassPass(PassRegistry &)
void computeLayout()
Run the layout computation for all previously added objects.
unsigned getFrameAlignment()
Returns the alignment of the frame.
User::op_iterator arg_begin()
Return the iterator pointing to the beginning of the argument list.
Definition: InstrTypes.h:1224
Virtual Register Rewriter
Definition: VirtRegMap.cpp:220
use_iterator use_begin()
Definition: Value.h:357
uint64_t alignTo(uint64_t Size, Align A)
Returns a multiple of A needed to store Size bytes.
Definition: Alignment.h:158
Constant * getOrInsertGlobal(StringRef Name, Type *Ty, function_ref< GlobalVariable *()> CreateGlobalCallback)
Look up the specified global in the module symbol table.
Definition: Module.cpp:204
This class represents an analyzed expression in the program.
static IntegerType * getInt32Ty(LLVMContext &C)
Definition: Type.cpp:186
StringRef getName() const
Return a constant reference to the value&#39;s name.
Definition: Value.cpp:270
Function * getCalledFunction() const
Returns the function called, or null if this is an indirect function invocation.
Definition: InstrTypes.h:1314
#define I(x, y, z)
Definition: MD5.cpp:59
uint32_t Size
Definition: Profile.cpp:46
bool isDeclaration() const
Return true if the primary definition of this global value is outside of the current translation unit...
Definition: Globals.cpp:227
Value * CreatePtrToInt(Value *V, Type *DestTy, const Twine &Name="")
Definition: IRBuilder.h:2036
bool isArrayAllocation() const
Return true if there is an allocation size parameter to the allocation instruction that is not 1...
assert(ImpDefSCC.getReg()==AMDGPU::SCC &&ImpDefSCC.isDef())
const BasicBlock & front() const
Definition: Function.h:712
Module * getParent()
Get the module that this global value is contained inside of...
Definition: GlobalValue.h:572
LLVM Value Representation.
Definition: Value.h:74
Compute live ranges of allocas.
Definition: StackLifetime.h:37
Value * CreatePointerCast(Value *V, Type *DestTy, const Twine &Name="")
Definition: IRBuilder.h:2092
Primary interface to the complete machine description for the target machine.
Definition: TargetMachine.h:65
void addObject(const Value *V, unsigned Size, unsigned Alignment, const StackLifetime::LiveRange &Range)
Add an object to the stack frame.
IRTranslator LLVM IR MI
inst_iterator inst_end(Function *F)
Definition: InstIterator.h:132
inst_range instructions(Function *F)
Definition: InstIterator.h:133
bool isStaticAlloca() const
Return true if this alloca is in the entry block of the function and is a constant size...
static Value * getStackGuard(const TargetLoweringBase *TLI, Module *M, IRBuilder<> &B, bool *SupportsSelectionDAGSP=nullptr)
Create a stack guard loading and populate whether SelectionDAG SSP is supported.
#define LLVM_DEBUG(X)
Definition: Debug.h:122
static IntegerType * getInt8Ty(LLVMContext &C)
Definition: Type.cpp:184
Value * getRawDest() const
bool use_empty() const
Definition: Value.h:341
Instruction * SplitBlockAndInsertIfThen(Value *Cond, Instruction *SplitBefore, bool Unreachable, MDNode *BranchWeights=nullptr, DominatorTree *DT=nullptr, LoopInfo *LI=nullptr, BasicBlock *ThenBlock=nullptr)
Split the containing block at the specified instruction - everything before SplitBefore stays in the ...
This visitor recursively visits a SCEV expression and re-writes it.
static BranchProbability getBranchProbStackProtector(bool IsLikely)
iterator_range< arg_iterator > args()
Definition: Function.h:744
bool empty() const
empty - Check if the array is empty.
Definition: ArrayRef.h:151
IntegerType * Int32Ty
A wrapper class for inspecting calls to intrinsic functions.
Definition: IntrinsicInst.h:44
This file describes how to lower LLVM code to machine code.
an instruction to allocate memory on the stack
Definition: Instructions.h:60
INITIALIZE_PASS_DEPENDENCY(DominatorTreeWrapperPass)
MachineBasicBlock MachineBasicBlock::iterator DebugLoc DL