LLVM  4.0.0
ShadowStackGCLowering.cpp
Go to the documentation of this file.
1 //===-- ShadowStackGCLowering.cpp - Custom lowering for shadow-stack gc ---===//
2 //
3 // The LLVM Compiler Infrastructure
4 //
5 // This file is distributed under the University of Illinois Open Source
6 // License. See LICENSE.TXT for details.
7 //
8 //===----------------------------------------------------------------------===//
9 //
10 // This file contains the custom lowering code required by the shadow-stack GC
11 // strategy.
12 //
13 // This pass implements the code transformation described in this paper:
14 // "Accurate Garbage Collection in an Uncooperative Environment"
15 // Fergus Henderson, ISMM, 2002
16 //
17 //===----------------------------------------------------------------------===//
18 
19 #include "llvm/CodeGen/Passes.h"
20 #include "llvm/ADT/StringExtras.h"
22 #include "llvm/IR/CallSite.h"
23 #include "llvm/IR/IRBuilder.h"
24 #include "llvm/IR/IntrinsicInst.h"
25 #include "llvm/IR/Module.h"
27 
28 using namespace llvm;
29 
30 #define DEBUG_TYPE "shadowstackgclowering"
31 
32 namespace {
33 
34 class ShadowStackGCLowering : public FunctionPass {
35  /// RootChain - This is the global linked-list that contains the chain of GC
36  /// roots.
37  GlobalVariable *Head;
38 
39  /// StackEntryTy - Abstract type of a link in the shadow stack.
40  ///
41  StructType *StackEntryTy;
42  StructType *FrameMapTy;
43 
44  /// Roots - GC roots in the current function. Each is a pair of the
45  /// intrinsic call and its corresponding alloca.
46  std::vector<std::pair<CallInst *, AllocaInst *>> Roots;
47 
48 public:
49  static char ID;
50  ShadowStackGCLowering();
51 
52  bool doInitialization(Module &M) override;
53  bool runOnFunction(Function &F) override;
54 
55 private:
56  bool IsNullValue(Value *V);
57  Constant *GetFrameMap(Function &F);
58  Type *GetConcreteStackEntryType(Function &F);
59  void CollectRoots(Function &F);
60  static GetElementPtrInst *CreateGEP(LLVMContext &Context, IRBuilder<> &B,
61  Type *Ty, Value *BasePtr, int Idx1,
62  const char *Name);
63  static GetElementPtrInst *CreateGEP(LLVMContext &Context, IRBuilder<> &B,
64  Type *Ty, Value *BasePtr, int Idx1, int Idx2,
65  const char *Name);
66 };
67 }
68 
69 INITIALIZE_PASS_BEGIN(ShadowStackGCLowering, "shadow-stack-gc-lowering",
70  "Shadow Stack GC Lowering", false, false)
72 INITIALIZE_PASS_END(ShadowStackGCLowering, "shadow-stack-gc-lowering",
73  "Shadow Stack GC Lowering", false, false)
74 
75 FunctionPass *llvm::createShadowStackGCLoweringPass() { return new ShadowStackGCLowering(); }
76 
78 
79 ShadowStackGCLowering::ShadowStackGCLowering()
80  : FunctionPass(ID), Head(nullptr), StackEntryTy(nullptr),
81  FrameMapTy(nullptr) {
83 }
84 
85 Constant *ShadowStackGCLowering::GetFrameMap(Function &F) {
86  // doInitialization creates the abstract type of this value.
87  Type *VoidPtr = Type::getInt8PtrTy(F.getContext());
88 
89  // Truncate the ShadowStackDescriptor if some metadata is null.
90  unsigned NumMeta = 0;
92  for (unsigned I = 0; I != Roots.size(); ++I) {
93  Constant *C = cast<Constant>(Roots[I].first->getArgOperand(1));
94  if (!C->isNullValue())
95  NumMeta = I + 1;
96  Metadata.push_back(ConstantExpr::getBitCast(C, VoidPtr));
97  }
98  Metadata.resize(NumMeta);
99 
100  Type *Int32Ty = Type::getInt32Ty(F.getContext());
101 
102  Constant *BaseElts[] = {
103  ConstantInt::get(Int32Ty, Roots.size(), false),
104  ConstantInt::get(Int32Ty, NumMeta, false),
105  };
106 
107  Constant *DescriptorElts[] = {
108  ConstantStruct::get(FrameMapTy, BaseElts),
109  ConstantArray::get(ArrayType::get(VoidPtr, NumMeta), Metadata)};
110 
111  Type *EltTys[] = {DescriptorElts[0]->getType(), DescriptorElts[1]->getType()};
112  StructType *STy = StructType::create(EltTys, "gc_map." + utostr(NumMeta));
113 
114  Constant *FrameMap = ConstantStruct::get(STy, DescriptorElts);
115 
116  // FIXME: Is this actually dangerous as WritingAnLLVMPass.html claims? Seems
117  // that, short of multithreaded LLVM, it should be safe; all that is
118  // necessary is that a simple Module::iterator loop not be invalidated.
119  // Appending to the GlobalVariable list is safe in that sense.
120  //
121  // All of the output passes emit globals last. The ExecutionEngine
122  // explicitly supports adding globals to the module after
123  // initialization.
124  //
125  // Still, if it isn't deemed acceptable, then this transformation needs
126  // to be a ModulePass (which means it cannot be in the 'llc' pipeline
127  // (which uses a FunctionPassManager (which segfaults (not asserts) if
128  // provided a ModulePass))).
129  Constant *GV = new GlobalVariable(*F.getParent(), FrameMap->getType(), true,
130  GlobalVariable::InternalLinkage, FrameMap,
131  "__gc_" + F.getName());
132 
133  Constant *GEPIndices[2] = {
134  ConstantInt::get(Type::getInt32Ty(F.getContext()), 0),
135  ConstantInt::get(Type::getInt32Ty(F.getContext()), 0)};
136  return ConstantExpr::getGetElementPtr(FrameMap->getType(), GV, GEPIndices);
137 }
138 
139 Type *ShadowStackGCLowering::GetConcreteStackEntryType(Function &F) {
140  // doInitialization creates the generic version of this type.
141  std::vector<Type *> EltTys;
142  EltTys.push_back(StackEntryTy);
143  for (size_t I = 0; I != Roots.size(); I++)
144  EltTys.push_back(Roots[I].second->getAllocatedType());
145 
146  return StructType::create(EltTys, ("gc_stackentry." + F.getName()).str());
147 }
148 
149 /// doInitialization - If this module uses the GC intrinsics, find them now. If
150 /// not, exit fast.
151 bool ShadowStackGCLowering::doInitialization(Module &M) {
152  bool Active = false;
153  for (Function &F : M) {
154  if (F.hasGC() && F.getGC() == std::string("shadow-stack")) {
155  Active = true;
156  break;
157  }
158  }
159  if (!Active)
160  return false;
161 
162  // struct FrameMap {
163  // int32_t NumRoots; // Number of roots in stack frame.
164  // int32_t NumMeta; // Number of metadata descriptors. May be < NumRoots.
165  // void *Meta[]; // May be absent for roots without metadata.
166  // };
167  std::vector<Type *> EltTys;
168  // 32 bits is ok up to a 32GB stack frame. :)
169  EltTys.push_back(Type::getInt32Ty(M.getContext()));
170  // Specifies length of variable length array.
171  EltTys.push_back(Type::getInt32Ty(M.getContext()));
172  FrameMapTy = StructType::create(EltTys, "gc_map");
173  PointerType *FrameMapPtrTy = PointerType::getUnqual(FrameMapTy);
174 
175  // struct StackEntry {
176  // ShadowStackEntry *Next; // Caller's stack entry.
177  // FrameMap *Map; // Pointer to constant FrameMap.
178  // void *Roots[]; // Stack roots (in-place array, so we pretend).
179  // };
180 
181  StackEntryTy = StructType::create(M.getContext(), "gc_stackentry");
182 
183  EltTys.clear();
184  EltTys.push_back(PointerType::getUnqual(StackEntryTy));
185  EltTys.push_back(FrameMapPtrTy);
186  StackEntryTy->setBody(EltTys);
187  PointerType *StackEntryPtrTy = PointerType::getUnqual(StackEntryTy);
188 
189  // Get the root chain if it already exists.
190  Head = M.getGlobalVariable("llvm_gc_root_chain");
191  if (!Head) {
192  // If the root chain does not exist, insert a new one with linkonce
193  // linkage!
194  Head = new GlobalVariable(
195  M, StackEntryPtrTy, false, GlobalValue::LinkOnceAnyLinkage,
196  Constant::getNullValue(StackEntryPtrTy), "llvm_gc_root_chain");
197  } else if (Head->hasExternalLinkage() && Head->isDeclaration()) {
198  Head->setInitializer(Constant::getNullValue(StackEntryPtrTy));
199  Head->setLinkage(GlobalValue::LinkOnceAnyLinkage);
200  }
201 
202  return true;
203 }
204 
205 bool ShadowStackGCLowering::IsNullValue(Value *V) {
206  if (Constant *C = dyn_cast<Constant>(V))
207  return C->isNullValue();
208  return false;
209 }
210 
211 void ShadowStackGCLowering::CollectRoots(Function &F) {
212  // FIXME: Account for original alignment. Could fragment the root array.
213  // Approach 1: Null initialize empty slots at runtime. Yuck.
214  // Approach 2: Emit a map of the array instead of just a count.
215 
216  assert(Roots.empty() && "Not cleaned up?");
217 
219 
220  for (Function::iterator BB = F.begin(), E = F.end(); BB != E; ++BB)
221  for (BasicBlock::iterator II = BB->begin(), E = BB->end(); II != E;)
222  if (IntrinsicInst *CI = dyn_cast<IntrinsicInst>(II++))
223  if (Function *F = CI->getCalledFunction())
224  if (F->getIntrinsicID() == Intrinsic::gcroot) {
225  std::pair<CallInst *, AllocaInst *> Pair = std::make_pair(
226  CI,
227  cast<AllocaInst>(CI->getArgOperand(0)->stripPointerCasts()));
228  if (IsNullValue(CI->getArgOperand(1)))
229  Roots.push_back(Pair);
230  else
231  MetaRoots.push_back(Pair);
232  }
233 
234  // Number roots with metadata (usually empty) at the beginning, so that the
235  // FrameMap::Meta array can be elided.
236  Roots.insert(Roots.begin(), MetaRoots.begin(), MetaRoots.end());
237 }
238 
239 GetElementPtrInst *ShadowStackGCLowering::CreateGEP(LLVMContext &Context,
240  IRBuilder<> &B, Type *Ty,
241  Value *BasePtr, int Idx,
242  int Idx2,
243  const char *Name) {
244  Value *Indices[] = {ConstantInt::get(Type::getInt32Ty(Context), 0),
245  ConstantInt::get(Type::getInt32Ty(Context), Idx),
246  ConstantInt::get(Type::getInt32Ty(Context), Idx2)};
247  Value *Val = B.CreateGEP(Ty, BasePtr, Indices, Name);
248 
249  assert(isa<GetElementPtrInst>(Val) && "Unexpected folded constant");
250 
251  return dyn_cast<GetElementPtrInst>(Val);
252 }
253 
254 GetElementPtrInst *ShadowStackGCLowering::CreateGEP(LLVMContext &Context,
255  IRBuilder<> &B, Type *Ty, Value *BasePtr,
256  int Idx, const char *Name) {
257  Value *Indices[] = {ConstantInt::get(Type::getInt32Ty(Context), 0),
258  ConstantInt::get(Type::getInt32Ty(Context), Idx)};
259  Value *Val = B.CreateGEP(Ty, BasePtr, Indices, Name);
260 
261  assert(isa<GetElementPtrInst>(Val) && "Unexpected folded constant");
262 
263  return dyn_cast<GetElementPtrInst>(Val);
264 }
265 
266 /// runOnFunction - Insert code to maintain the shadow stack.
267 bool ShadowStackGCLowering::runOnFunction(Function &F) {
268  // Quick exit for functions that do not use the shadow stack GC.
269  if (!F.hasGC() ||
270  F.getGC() != std::string("shadow-stack"))
271  return false;
272 
273  LLVMContext &Context = F.getContext();
274 
275  // Find calls to llvm.gcroot.
276  CollectRoots(F);
277 
278  // If there are no roots in this function, then there is no need to add a
279  // stack map entry for it.
280  if (Roots.empty())
281  return false;
282 
283  // Build the constant map and figure the type of the shadow stack entry.
284  Value *FrameMap = GetFrameMap(F);
285  Type *ConcreteStackEntryTy = GetConcreteStackEntryType(F);
286 
287  // Build the shadow stack entry at the very start of the function.
289  IRBuilder<> AtEntry(IP->getParent(), IP);
290 
291  Instruction *StackEntry =
292  AtEntry.CreateAlloca(ConcreteStackEntryTy, nullptr, "gc_frame");
293 
294  while (isa<AllocaInst>(IP))
295  ++IP;
296  AtEntry.SetInsertPoint(IP->getParent(), IP);
297 
298  // Initialize the map pointer and load the current head of the shadow stack.
299  Instruction *CurrentHead = AtEntry.CreateLoad(Head, "gc_currhead");
300  Instruction *EntryMapPtr = CreateGEP(Context, AtEntry, ConcreteStackEntryTy,
301  StackEntry, 0, 1, "gc_frame.map");
302  AtEntry.CreateStore(FrameMap, EntryMapPtr);
303 
304  // After all the allocas...
305  for (unsigned I = 0, E = Roots.size(); I != E; ++I) {
306  // For each root, find the corresponding slot in the aggregate...
307  Value *SlotPtr = CreateGEP(Context, AtEntry, ConcreteStackEntryTy,
308  StackEntry, 1 + I, "gc_root");
309 
310  // And use it in lieu of the alloca.
311  AllocaInst *OriginalAlloca = Roots[I].second;
312  SlotPtr->takeName(OriginalAlloca);
313  OriginalAlloca->replaceAllUsesWith(SlotPtr);
314  }
315 
316  // Move past the original stores inserted by GCStrategy::InitRoots. This isn't
317  // really necessary (the collector would never see the intermediate state at
318  // runtime), but it's nicer not to push the half-initialized entry onto the
319  // shadow stack.
320  while (isa<StoreInst>(IP))
321  ++IP;
322  AtEntry.SetInsertPoint(IP->getParent(), IP);
323 
324  // Push the entry onto the shadow stack.
325  Instruction *EntryNextPtr = CreateGEP(Context, AtEntry, ConcreteStackEntryTy,
326  StackEntry, 0, 0, "gc_frame.next");
327  Instruction *NewHeadVal = CreateGEP(Context, AtEntry, ConcreteStackEntryTy,
328  StackEntry, 0, "gc_newhead");
329  AtEntry.CreateStore(CurrentHead, EntryNextPtr);
330  AtEntry.CreateStore(NewHeadVal, Head);
331 
332  // For each instruction that escapes...
333  EscapeEnumerator EE(F, "gc_cleanup");
334  while (IRBuilder<> *AtExit = EE.Next()) {
335  // Pop the entry from the shadow stack. Don't reuse CurrentHead from
336  // AtEntry, since that would make the value live for the entire function.
337  Instruction *EntryNextPtr2 =
338  CreateGEP(Context, *AtExit, ConcreteStackEntryTy, StackEntry, 0, 0,
339  "gc_frame.next");
340  Value *SavedHead = AtExit->CreateLoad(EntryNextPtr2, "gc_savedhead");
341  AtExit->CreateStore(SavedHead, Head);
342  }
343 
344  // Delete the original allocas (which are no longer used) and the intrinsic
345  // calls (which are no longer valid). Doing this last avoids invalidating
346  // iterators.
347  for (unsigned I = 0, E = Roots.size(); I != E; ++I) {
348  Roots[I].first->eraseFromParent();
349  Roots[I].second->eraseFromParent();
350  }
351 
352  Roots.clear();
353  return true;
354 }
static PassRegistry * getPassRegistry()
getPassRegistry - Access the global registry object, which is automatically initialized at applicatio...
LLVMContext & getContext() const
getContext - Return a reference to the LLVMContext associated with this function. ...
Definition: Function.cpp:226
LLVMContext & Context
A Module instance is used to store all the information related to an LLVM module. ...
Definition: Module.h:52
iterator end()
Definition: Function.h:537
void initializeShadowStackGCLoweringPass(PassRegistry &)
FunctionPass * createShadowStackGCLoweringPass()
ShadowStackGCLowering - Implements the custom lowering mechanism used by the shadow stack GC...
StringRef getName() const
Return a constant reference to the value's name.
Definition: Value.cpp:191
iterator begin()
Instruction iterator methods.
Definition: BasicBlock.h:228
EscapeEnumerator - This is a little algorithm to find all escape points from a function so that "fina...
#define INITIALIZE_PASS_DEPENDENCY(depName)
Definition: PassSupport.h:53
bool hasGC() const
hasGC/getGC/setGC/clearGC - The name of the garbage collection algorithm to use during code generatio...
Definition: Function.h:250
Class to represent struct types.
Definition: DerivedTypes.h:199
This provides a uniform API for creating instructions and inserting them into a basic block: either a...
Definition: IRBuilder.h:588
An analysis pass which caches information about the entire Module.
Definition: GCMetadata.h:155
shadow stack gc lowering
#define F(x, y, z)
Definition: MD5.cpp:51
static std::string utostr(uint64_t X, bool isNeg=false)
Definition: StringExtras.h:79
static GCRegistry::Add< OcamlGC > B("ocaml","ocaml 3.10-compatible GC")
void replaceAllUsesWith(Value *V)
Change all uses of this to point to a new Value.
Definition: Value.cpp:401
void takeName(Value *V)
Transfer the name from V to this value.
Definition: Value.cpp:263
iterator begin()
Definition: Function.h:535
Class to represent pointers.
Definition: DerivedTypes.h:443
static GCRegistry::Add< CoreCLRGC > E("coreclr","CoreCLR-compatible GC")
an instruction for type-safe pointer arithmetic to access elements of arrays and structs ...
Definition: Instructions.h:830
The instances of the Type class are immutable: once they are created, they are never changed...
Definition: Type.h:45
This is an important class for using LLVM in a threaded context.
Definition: LLVMContext.h:48
This is an important base class in LLVM.
Definition: Constant.h:42
INITIALIZE_PASS_END(RegBankSelect, DEBUG_TYPE,"Assign register bank of generic virtual registers", false, false) RegBankSelect
FunctionPass class - This class is used to implement most global optimizations.
Definition: Pass.h:298
rewrite statepoints for gc
Iterator for intrusive lists based on ilist_node.
shadow stack gc Shadow Stack GC Lowering
This is a 'vector' (really, a variable-sized array), optimized for the case when the array is small...
Definition: SmallVector.h:843
Module.h This file contains the declarations for the Module class.
Type * getType() const
All values are typed, get the type of this value.
Definition: Value.h:230
const BasicBlock & getEntryBlock() const
Definition: Function.h:519
bool isNullValue() const
Return true if this is the value that would be returned by getNullValue.
Definition: Constants.cpp:90
Intrinsic::ID getIntrinsicID() const LLVM_READONLY
getIntrinsicID - This method returns the ID number of the specified function, or Intrinsic::not_intri...
Definition: Function.h:146
static GCRegistry::Add< ShadowStackGC > C("shadow-stack","Very portable GC for uncooperative code generators")
Value * CreateGEP(Value *Ptr, ArrayRef< Value * > IdxList, const Twine &Name="")
Definition: IRBuilder.h:1141
const std::string & getGC() const
Definition: Function.cpp:412
#define I(x, y, z)
Definition: MD5.cpp:54
safe stack
Definition: SafeStack.cpp:796
LLVM_NODISCARD std::enable_if<!is_simple_type< Y >::value, typename cast_retty< X, const Y >::ret_type >::type dyn_cast(const Y &Val)
Definition: Casting.h:287
INITIALIZE_PASS_BEGIN(ShadowStackGCLowering,"shadow-stack-gc-lowering","Shadow Stack GC Lowering", false, false) INITIALIZE_PASS_END(ShadowStackGCLowering
shadow stack gc Shadow Stack GC false
assert(ImpDefSCC.getReg()==AMDGPU::SCC &&ImpDefSCC.isDef())
Module * getParent()
Get the module that this global value is contained inside of...
Definition: GlobalValue.h:537
LLVM Value Representation.
Definition: Value.h:71
Root of the metadata hierarchy.
Definition: Metadata.h:55
IntegerType * Int32Ty
A wrapper class for inspecting calls to intrinsic functions.
Definition: IntrinsicInst.h:44
an instruction to allocate memory on the stack
Definition: Instructions.h:60
void resize(size_type N)
Definition: SmallVector.h:352