LLVM 20.0.0git
AArch64StackTagging.cpp
Go to the documentation of this file.
1//===- AArch64StackTagging.cpp - Stack tagging in IR --===//
2//
3// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4// See https://llvm.org/LICENSE.txt for license information.
5// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6//
7//===----------------------------------------------------------------------===//
8//===----------------------------------------------------------------------===//
9
10#include "AArch64.h"
11#include "AArch64InstrInfo.h"
12#include "AArch64Subtarget.h"
14#include "llvm/ADT/APInt.h"
15#include "llvm/ADT/MapVector.h"
17#include "llvm/ADT/Statistic.h"
19#include "llvm/Analysis/CFG.h"
37#include "llvm/IR/DebugLoc.h"
38#include "llvm/IR/Dominators.h"
39#include "llvm/IR/Function.h"
41#include "llvm/IR/IRBuilder.h"
43#include "llvm/IR/Instruction.h"
46#include "llvm/IR/IntrinsicsAArch64.h"
47#include "llvm/IR/Metadata.h"
48#include "llvm/IR/ValueHandle.h"
50#include "llvm/Pass.h"
52#include "llvm/Support/Debug.h"
56#include <cassert>
57#include <iterator>
58#include <memory>
59#include <utility>
60
61using namespace llvm;
62
63#define DEBUG_TYPE "aarch64-stack-tagging"
64
66 "stack-tagging-merge-init", cl::Hidden, cl::init(true),
67 cl::desc("merge stack variable initializers with tagging when possible"));
68
69static cl::opt<bool>
70 ClUseStackSafety("stack-tagging-use-stack-safety", cl::Hidden,
71 cl::init(true),
72 cl::desc("Use Stack Safety analysis results"));
73
74static cl::opt<unsigned> ClScanLimit("stack-tagging-merge-init-scan-limit",
75 cl::init(40), cl::Hidden);
76
78 ClMergeInitSizeLimit("stack-tagging-merge-init-size-limit", cl::init(272),
80
82 "stack-tagging-max-lifetimes-for-alloca", cl::Hidden, cl::init(3),
84 cl::desc("How many lifetime ends to handle for a single alloca."),
86
87// Mode for selecting how to insert frame record info into the stack ring
88// buffer.
90 // Do not record frame record info.
92
93 // Insert instructions into the prologue for storing into the stack ring
94 // buffer directly.
96};
97
99 "stack-tagging-record-stack-history",
100 cl::desc("Record stack frames with tagged allocations in a thread-local "
101 "ring buffer"),
102 cl::values(clEnumVal(none, "Do not record stack ring history"),
103 clEnumVal(instr, "Insert instructions into the prologue for "
104 "storing into the stack ring buffer")),
106
107static const Align kTagGranuleSize = Align(16);
108
109namespace {
110
111class InitializerBuilder {
112 uint64_t Size;
113 const DataLayout *DL;
114 Value *BasePtr;
115 Function *SetTagFn;
116 Function *SetTagZeroFn;
117 Function *StgpFn;
118
119 // List of initializers sorted by start offset.
120 struct Range {
121 uint64_t Start, End;
122 Instruction *Inst;
123 };
125 // 8-aligned offset => 8-byte initializer
126 // Missing keys are zero initialized.
127 std::map<uint64_t, Value *> Out;
128
129public:
130 InitializerBuilder(uint64_t Size, const DataLayout *DL, Value *BasePtr,
131 Function *SetTagFn, Function *SetTagZeroFn,
132 Function *StgpFn)
133 : Size(Size), DL(DL), BasePtr(BasePtr), SetTagFn(SetTagFn),
134 SetTagZeroFn(SetTagZeroFn), StgpFn(StgpFn) {}
135
136 bool addRange(uint64_t Start, uint64_t End, Instruction *Inst) {
137 auto I =
138 llvm::lower_bound(Ranges, Start, [](const Range &LHS, uint64_t RHS) {
139 return LHS.End <= RHS;
140 });
141 if (I != Ranges.end() && End > I->Start) {
142 // Overlap - bail.
143 return false;
144 }
145 Ranges.insert(I, {Start, End, Inst});
146 return true;
147 }
148
149 bool addStore(uint64_t Offset, StoreInst *SI, const DataLayout *DL) {
150 int64_t StoreSize = DL->getTypeStoreSize(SI->getOperand(0)->getType());
151 if (!addRange(Offset, Offset + StoreSize, SI))
152 return false;
153 IRBuilder<> IRB(SI);
154 applyStore(IRB, Offset, Offset + StoreSize, SI->getOperand(0));
155 return true;
156 }
157
158 bool addMemSet(uint64_t Offset, MemSetInst *MSI) {
159 uint64_t StoreSize = cast<ConstantInt>(MSI->getLength())->getZExtValue();
160 if (!addRange(Offset, Offset + StoreSize, MSI))
161 return false;
162 IRBuilder<> IRB(MSI);
163 applyMemSet(IRB, Offset, Offset + StoreSize,
164 cast<ConstantInt>(MSI->getValue()));
165 return true;
166 }
167
168 void applyMemSet(IRBuilder<> &IRB, int64_t Start, int64_t End,
169 ConstantInt *V) {
170 // Out[] does not distinguish between zero and undef, and we already know
171 // that this memset does not overlap with any other initializer. Nothing to
172 // do for memset(0).
173 if (V->isZero())
174 return;
175 for (int64_t Offset = Start - Start % 8; Offset < End; Offset += 8) {
176 uint64_t Cst = 0x0101010101010101UL;
177 int LowBits = Offset < Start ? (Start - Offset) * 8 : 0;
178 if (LowBits)
179 Cst = (Cst >> LowBits) << LowBits;
180 int HighBits = End - Offset < 8 ? (8 - (End - Offset)) * 8 : 0;
181 if (HighBits)
182 Cst = (Cst << HighBits) >> HighBits;
183 ConstantInt *C =
184 ConstantInt::get(IRB.getInt64Ty(), Cst * V->getZExtValue());
185
186 Value *&CurrentV = Out[Offset];
187 if (!CurrentV) {
188 CurrentV = C;
189 } else {
190 CurrentV = IRB.CreateOr(CurrentV, C);
191 }
192 }
193 }
194
195 // Take a 64-bit slice of the value starting at the given offset (in bytes).
196 // Offset can be negative. Pad with zeroes on both sides when necessary.
197 Value *sliceValue(IRBuilder<> &IRB, Value *V, int64_t Offset) {
198 if (Offset > 0) {
199 V = IRB.CreateLShr(V, Offset * 8);
200 V = IRB.CreateZExtOrTrunc(V, IRB.getInt64Ty());
201 } else if (Offset < 0) {
202 V = IRB.CreateZExtOrTrunc(V, IRB.getInt64Ty());
203 V = IRB.CreateShl(V, -Offset * 8);
204 } else {
205 V = IRB.CreateZExtOrTrunc(V, IRB.getInt64Ty());
206 }
207 return V;
208 }
209
210 void applyStore(IRBuilder<> &IRB, int64_t Start, int64_t End,
211 Value *StoredValue) {
212 StoredValue = flatten(IRB, StoredValue);
213 for (int64_t Offset = Start - Start % 8; Offset < End; Offset += 8) {
214 Value *V = sliceValue(IRB, StoredValue, Offset - Start);
215 Value *&CurrentV = Out[Offset];
216 if (!CurrentV) {
217 CurrentV = V;
218 } else {
219 CurrentV = IRB.CreateOr(CurrentV, V);
220 }
221 }
222 }
223
224 void generate(IRBuilder<> &IRB) {
225 LLVM_DEBUG(dbgs() << "Combined initializer\n");
226 // No initializers => the entire allocation is undef.
227 if (Ranges.empty()) {
228 emitUndef(IRB, 0, Size);
229 return;
230 }
231
232 // Look through 8-byte initializer list 16 bytes at a time;
233 // If one of the two 8-byte halfs is non-zero non-undef, emit STGP.
234 // Otherwise, emit zeroes up to next available item.
235 uint64_t LastOffset = 0;
236 for (uint64_t Offset = 0; Offset < Size; Offset += 16) {
237 auto I1 = Out.find(Offset);
238 auto I2 = Out.find(Offset + 8);
239 if (I1 == Out.end() && I2 == Out.end())
240 continue;
241
242 if (Offset > LastOffset)
243 emitZeroes(IRB, LastOffset, Offset - LastOffset);
244
245 Value *Store1 = I1 == Out.end() ? Constant::getNullValue(IRB.getInt64Ty())
246 : I1->second;
247 Value *Store2 = I2 == Out.end() ? Constant::getNullValue(IRB.getInt64Ty())
248 : I2->second;
249 emitPair(IRB, Offset, Store1, Store2);
250 LastOffset = Offset + 16;
251 }
252
253 // memset(0) does not update Out[], therefore the tail can be either undef
254 // or zero.
255 if (LastOffset < Size)
256 emitZeroes(IRB, LastOffset, Size - LastOffset);
257
258 for (const auto &R : Ranges) {
259 R.Inst->eraseFromParent();
260 }
261 }
262
263 void emitZeroes(IRBuilder<> &IRB, uint64_t Offset, uint64_t Size) {
264 LLVM_DEBUG(dbgs() << " [" << Offset << ", " << Offset + Size
265 << ") zero\n");
266 Value *Ptr = BasePtr;
267 if (Offset)
269 IRB.CreateCall(SetTagZeroFn,
270 {Ptr, ConstantInt::get(IRB.getInt64Ty(), Size)});
271 }
272
273 void emitUndef(IRBuilder<> &IRB, uint64_t Offset, uint64_t Size) {
274 LLVM_DEBUG(dbgs() << " [" << Offset << ", " << Offset + Size
275 << ") undef\n");
276 Value *Ptr = BasePtr;
277 if (Offset)
279 IRB.CreateCall(SetTagFn, {Ptr, ConstantInt::get(IRB.getInt64Ty(), Size)});
280 }
281
282 void emitPair(IRBuilder<> &IRB, uint64_t Offset, Value *A, Value *B) {
283 LLVM_DEBUG(dbgs() << " [" << Offset << ", " << Offset + 16 << "):\n");
284 LLVM_DEBUG(dbgs() << " " << *A << "\n " << *B << "\n");
285 Value *Ptr = BasePtr;
286 if (Offset)
288 IRB.CreateCall(StgpFn, {Ptr, A, B});
289 }
290
291 Value *flatten(IRBuilder<> &IRB, Value *V) {
292 if (V->getType()->isIntegerTy())
293 return V;
294 // vector of pointers -> vector of ints
295 if (VectorType *VecTy = dyn_cast<VectorType>(V->getType())) {
296 LLVMContext &Ctx = IRB.getContext();
297 Type *EltTy = VecTy->getElementType();
298 if (EltTy->isPointerTy()) {
299 uint32_t EltSize = DL->getTypeSizeInBits(EltTy);
300 auto *NewTy = FixedVectorType::get(
301 IntegerType::get(Ctx, EltSize),
302 cast<FixedVectorType>(VecTy)->getNumElements());
303 V = IRB.CreatePointerCast(V, NewTy);
304 }
305 }
306 return IRB.CreateBitOrPointerCast(
307 V, IRB.getIntNTy(DL->getTypeStoreSize(V->getType()) * 8));
308 }
309};
310
311class AArch64StackTagging : public FunctionPass {
312 const bool MergeInit;
313 const bool UseStackSafety;
314
315public:
316 static char ID; // Pass ID, replacement for typeid
317
318 AArch64StackTagging(bool IsOptNone = false)
319 : FunctionPass(ID),
320 MergeInit(ClMergeInit.getNumOccurrences() ? ClMergeInit : !IsOptNone),
321 UseStackSafety(ClUseStackSafety.getNumOccurrences() ? ClUseStackSafety
322 : !IsOptNone) {
324 }
325
326 void tagAlloca(AllocaInst *AI, Instruction *InsertBefore, Value *Ptr,
327 uint64_t Size);
328 void untagAlloca(AllocaInst *AI, Instruction *InsertBefore, uint64_t Size);
329
330 Instruction *collectInitializers(Instruction *StartInst, Value *StartPtr,
331 uint64_t Size, InitializerBuilder &IB);
332
333 Instruction *insertBaseTaggedPointer(
334 const Module &M,
336 const DominatorTree *DT);
337 bool runOnFunction(Function &F) override;
338
339 StringRef getPassName() const override { return "AArch64 Stack Tagging"; }
340
341private:
342 Function *F = nullptr;
343 Function *SetTagFunc = nullptr;
344 const DataLayout *DL = nullptr;
345 AAResults *AA = nullptr;
346 const StackSafetyGlobalInfo *SSI = nullptr;
347
348 void getAnalysisUsage(AnalysisUsage &AU) const override {
349 AU.setPreservesCFG();
350 if (UseStackSafety)
352 if (MergeInit)
354 }
355};
356
357} // end anonymous namespace
358
359char AArch64StackTagging::ID = 0;
360
361INITIALIZE_PASS_BEGIN(AArch64StackTagging, DEBUG_TYPE, "AArch64 Stack Tagging",
362 false, false)
365INITIALIZE_PASS_END(AArch64StackTagging, DEBUG_TYPE, "AArch64 Stack Tagging",
367
369 return new AArch64StackTagging(IsOptNone);
370}
371
372Instruction *AArch64StackTagging::collectInitializers(Instruction *StartInst,
373 Value *StartPtr,
375 InitializerBuilder &IB) {
376 MemoryLocation AllocaLoc{StartPtr, Size};
377 Instruction *LastInst = StartInst;
378 BasicBlock::iterator BI(StartInst);
379
380 unsigned Count = 0;
381 for (; Count < ClScanLimit && !BI->isTerminator(); ++BI) {
382 if (!isa<DbgInfoIntrinsic>(*BI))
383 ++Count;
384
385 if (isNoModRef(AA->getModRefInfo(&*BI, AllocaLoc)))
386 continue;
387
388 if (!isa<StoreInst>(BI) && !isa<MemSetInst>(BI)) {
389 // If the instruction is readnone, ignore it, otherwise bail out. We
390 // don't even allow readonly here because we don't want something like:
391 // A[1] = 2; strlen(A); A[2] = 2; -> memcpy(A, ...); strlen(A).
392 if (BI->mayWriteToMemory() || BI->mayReadFromMemory())
393 break;
394 continue;
395 }
396
397 if (StoreInst *NextStore = dyn_cast<StoreInst>(BI)) {
398 if (!NextStore->isSimple())
399 break;
400
401 // Check to see if this store is to a constant offset from the start ptr.
402 std::optional<int64_t> Offset =
403 NextStore->getPointerOperand()->getPointerOffsetFrom(StartPtr, *DL);
404 if (!Offset)
405 break;
406
407 if (!IB.addStore(*Offset, NextStore, DL))
408 break;
409 LastInst = NextStore;
410 } else {
411 MemSetInst *MSI = cast<MemSetInst>(BI);
412
413 if (MSI->isVolatile() || !isa<ConstantInt>(MSI->getLength()))
414 break;
415
416 if (!isa<ConstantInt>(MSI->getValue()))
417 break;
418
419 // Check to see if this store is to a constant offset from the start ptr.
420 std::optional<int64_t> Offset =
421 MSI->getDest()->getPointerOffsetFrom(StartPtr, *DL);
422 if (!Offset)
423 break;
424
425 if (!IB.addMemSet(*Offset, MSI))
426 break;
427 LastInst = MSI;
428 }
429 }
430 return LastInst;
431}
432
433void AArch64StackTagging::tagAlloca(AllocaInst *AI, Instruction *InsertBefore,
435 auto SetTagZeroFunc =
436 Intrinsic::getDeclaration(F->getParent(), Intrinsic::aarch64_settag_zero);
437 auto StgpFunc =
438 Intrinsic::getDeclaration(F->getParent(), Intrinsic::aarch64_stgp);
439
440 InitializerBuilder IB(Size, DL, Ptr, SetTagFunc, SetTagZeroFunc, StgpFunc);
441 bool LittleEndian =
443 // Current implementation of initializer merging assumes little endianness.
444 if (MergeInit && !F->hasOptNone() && LittleEndian &&
446 LLVM_DEBUG(dbgs() << "collecting initializers for " << *AI
447 << ", size = " << Size << "\n");
448 InsertBefore = collectInitializers(InsertBefore, Ptr, Size, IB);
449 }
450
451 IRBuilder<> IRB(InsertBefore);
452 IB.generate(IRB);
453}
454
455void AArch64StackTagging::untagAlloca(AllocaInst *AI, Instruction *InsertBefore,
456 uint64_t Size) {
457 IRBuilder<> IRB(InsertBefore);
458 IRB.CreateCall(SetTagFunc, {IRB.CreatePointerCast(AI, IRB.getPtrTy()),
459 ConstantInt::get(IRB.getInt64Ty(), Size)});
460}
461
462Instruction *AArch64StackTagging::insertBaseTaggedPointer(
463 const Module &M,
464 const MapVector<AllocaInst *, memtag::AllocaInfo> &AllocasToInstrument,
465 const DominatorTree *DT) {
466 BasicBlock *PrologueBB = nullptr;
467 // Try sinking IRG as deep as possible to avoid hurting shrink wrap.
468 for (auto &I : AllocasToInstrument) {
469 const memtag::AllocaInfo &Info = I.second;
470 AllocaInst *AI = Info.AI;
471 if (!PrologueBB) {
472 PrologueBB = AI->getParent();
473 continue;
474 }
475 PrologueBB = DT->findNearestCommonDominator(PrologueBB, AI->getParent());
476 }
477 assert(PrologueBB);
478
479 IRBuilder<> IRB(&PrologueBB->front());
480 Function *IRG_SP =
481 Intrinsic::getDeclaration(F->getParent(), Intrinsic::aarch64_irg_sp);
483 IRB.CreateCall(IRG_SP, {Constant::getNullValue(IRB.getInt64Ty())});
484 Base->setName("basetag");
485 auto TargetTriple = Triple(M.getTargetTriple());
486 // This is not a stable ABI for now, so only allow in dev builds with API
487 // level 10000.
488 // The ThreadLong format is the same as with HWASan, but the entries for
489 // stack MTE take two slots (16 bytes).
490 if (ClRecordStackHistory == instr && TargetTriple.isAndroid() &&
491 TargetTriple.isAArch64() && !TargetTriple.isAndroidVersionLT(10000) &&
492 !AllocasToInstrument.empty()) {
493 constexpr int StackMteSlot = -3;
494 constexpr uint64_t TagMask = 0xFULL << 56;
495
496 auto *IntptrTy = IRB.getIntPtrTy(M.getDataLayout());
497 Value *SlotPtr = memtag::getAndroidSlotPtr(IRB, StackMteSlot);
498 auto *ThreadLong = IRB.CreateLoad(IntptrTy, SlotPtr);
499 Value *FP = memtag::getFP(IRB);
500 Value *Tag = IRB.CreateAnd(IRB.CreatePtrToInt(Base, IntptrTy), TagMask);
501 Value *TaggedFP = IRB.CreateOr(FP, Tag);
502 Value *PC = memtag::getPC(TargetTriple, IRB);
503 Value *RecordPtr = IRB.CreateIntToPtr(ThreadLong, IRB.getPtrTy(0));
504 IRB.CreateStore(PC, RecordPtr);
505 IRB.CreateStore(TaggedFP, IRB.CreateConstGEP1_64(IntptrTy, RecordPtr, 1));
506 // Update the ring buffer. Top byte of ThreadLong defines the size of the
507 // buffer in pages, it must be a power of two, and the start of the buffer
508 // must be aligned by twice that much. Therefore wrap around of the ring
509 // buffer is simply Addr &= ~((ThreadLong >> 56) << 12).
510 // The use of AShr instead of LShr is due to
511 // https://bugs.llvm.org/show_bug.cgi?id=39030
512 // Runtime library makes sure not to use the highest bit.
513 Value *WrapMask = IRB.CreateXor(
514 IRB.CreateShl(IRB.CreateAShr(ThreadLong, 56), 12, "", true, true),
515 ConstantInt::get(IntptrTy, (uint64_t)-1));
516 Value *ThreadLongNew = IRB.CreateAnd(
517 IRB.CreateAdd(ThreadLong, ConstantInt::get(IntptrTy, 16)), WrapMask);
518 IRB.CreateStore(ThreadLongNew, SlotPtr);
519 }
520 return Base;
521}
522
523// FIXME: check for MTE extension
524bool AArch64StackTagging::runOnFunction(Function &Fn) {
525 if (!Fn.hasFnAttribute(Attribute::SanitizeMemTag))
526 return false;
527
528 if (UseStackSafety)
529 SSI = &getAnalysis<StackSafetyGlobalInfoWrapperPass>().getResult();
530 F = &Fn;
531 DL = &Fn.getDataLayout();
532 if (MergeInit)
533 AA = &getAnalysis<AAResultsWrapperPass>().getAAResults();
534
536 for (Instruction &I : instructions(F))
537 SIB.visit(I);
538 memtag::StackInfo &SInfo = SIB.get();
539
540 if (SInfo.AllocasToInstrument.empty())
541 return false;
542
543 std::unique_ptr<DominatorTree> DeleteDT;
544 DominatorTree *DT = nullptr;
545 if (auto *P = getAnalysisIfAvailable<DominatorTreeWrapperPass>())
546 DT = &P->getDomTree();
547
548 if (DT == nullptr) {
549 DeleteDT = std::make_unique<DominatorTree>(*F);
550 DT = DeleteDT.get();
551 }
552
553 std::unique_ptr<PostDominatorTree> DeletePDT;
554 PostDominatorTree *PDT = nullptr;
555 if (auto *P = getAnalysisIfAvailable<PostDominatorTreeWrapperPass>())
556 PDT = &P->getPostDomTree();
557
558 if (PDT == nullptr) {
559 DeletePDT = std::make_unique<PostDominatorTree>(*F);
560 PDT = DeletePDT.get();
561 }
562
563 std::unique_ptr<LoopInfo> DeleteLI;
564 LoopInfo *LI = nullptr;
565 if (auto *LIWP = getAnalysisIfAvailable<LoopInfoWrapperPass>()) {
566 LI = &LIWP->getLoopInfo();
567 } else {
568 DeleteLI = std::make_unique<LoopInfo>(*DT);
569 LI = DeleteLI.get();
570 }
571
572 SetTagFunc =
573 Intrinsic::getDeclaration(F->getParent(), Intrinsic::aarch64_settag);
574
576 insertBaseTaggedPointer(*Fn.getParent(), SInfo.AllocasToInstrument, DT);
577
578 int NextTag = 0;
579 for (auto &I : SInfo.AllocasToInstrument) {
580 memtag::AllocaInfo &Info = I.second;
581 assert(Info.AI && SIB.isInterestingAlloca(*Info.AI));
583 AllocaInst *AI = Info.AI;
584 int Tag = NextTag;
585 NextTag = (NextTag + 1) % 16;
586 // Replace alloca with tagp(alloca).
587 IRBuilder<> IRB(Info.AI->getNextNode());
589 F->getParent(), Intrinsic::aarch64_tagp, {Info.AI->getType()});
590 Instruction *TagPCall =
591 IRB.CreateCall(TagP, {Constant::getNullValue(Info.AI->getType()), Base,
592 ConstantInt::get(IRB.getInt64Ty(), Tag)});
593 if (Info.AI->hasName())
594 TagPCall->setName(Info.AI->getName() + ".tag");
595 // Does not replace metadata, so we don't have to handle DbgVariableRecords.
596 Info.AI->replaceUsesWithIf(TagPCall, [&](const Use &U) {
597 return !memtag::isLifetimeIntrinsic(U.getUser());
598 });
599 TagPCall->setOperand(0, Info.AI);
600
601 // Calls to functions that may return twice (e.g. setjmp) confuse the
602 // postdominator analysis, and will leave us to keep memory tagged after
603 // function return. Work around this by always untagging at every return
604 // statement if return_twice functions are called.
605 bool StandardLifetime =
606 !SInfo.CallsReturnTwice &&
607 SInfo.UnrecognizedLifetimes.empty() &&
608 memtag::isStandardLifetime(Info.LifetimeStart, Info.LifetimeEnd, DT, LI,
610 if (StandardLifetime) {
611 IntrinsicInst *Start = Info.LifetimeStart[0];
612 uint64_t Size =
613 cast<ConstantInt>(Start->getArgOperand(0))->getZExtValue();
615 tagAlloca(AI, Start->getNextNode(), TagPCall, Size);
616
617 auto TagEnd = [&](Instruction *Node) { untagAlloca(AI, Node, Size); };
618 if (!DT || !PDT ||
619 !memtag::forAllReachableExits(*DT, *PDT, *LI, Start, Info.LifetimeEnd,
620 SInfo.RetVec, TagEnd)) {
621 for (auto *End : Info.LifetimeEnd)
622 End->eraseFromParent();
623 }
624 } else {
625 uint64_t Size = *Info.AI->getAllocationSize(*DL);
626 Value *Ptr = IRB.CreatePointerCast(TagPCall, IRB.getPtrTy());
627 tagAlloca(AI, &*IRB.GetInsertPoint(), Ptr, Size);
628 for (auto *RI : SInfo.RetVec) {
629 untagAlloca(AI, RI, Size);
630 }
631 // We may have inserted tag/untag outside of any lifetime interval.
632 // Remove all lifetime intrinsics for this alloca.
633 for (auto *II : Info.LifetimeStart)
634 II->eraseFromParent();
635 for (auto *II : Info.LifetimeEnd)
636 II->eraseFromParent();
637 }
638
639 memtag::annotateDebugRecords(Info, static_cast<unsigned long>(Tag));
640 }
641
642 // If we have instrumented at least one alloca, all unrecognized lifetime
643 // intrinsics have to go.
644 for (auto *I : SInfo.UnrecognizedLifetimes)
645 I->eraseFromParent();
646
647 return true;
648}
static cl::opt< bool > ClMergeInit("stack-tagging-merge-init", cl::Hidden, cl::init(true), cl::desc("merge stack variable initializers with tagging when possible"))
StackTaggingRecordStackHistoryMode
static cl::opt< unsigned > ClMergeInitSizeLimit("stack-tagging-merge-init-size-limit", cl::init(272), cl::Hidden)
static cl::opt< unsigned > ClScanLimit("stack-tagging-merge-init-scan-limit", cl::init(40), cl::Hidden)
static cl::opt< bool > ClUseStackSafety("stack-tagging-use-stack-safety", cl::Hidden, cl::init(true), cl::desc("Use Stack Safety analysis results"))
static cl::opt< size_t > ClMaxLifetimes("stack-tagging-max-lifetimes-for-alloca", cl::Hidden, cl::init(3), cl::ReallyHidden, cl::desc("How many lifetime ends to handle for a single alloca."), cl::Optional)
AArch64 Stack Tagging
#define DEBUG_TYPE
static const Align kTagGranuleSize
static cl::opt< StackTaggingRecordStackHistoryMode > ClRecordStackHistory("stack-tagging-record-stack-history", cl::desc("Record stack frames with tagged allocations in a thread-local " "ring buffer"), cl::values(clEnumVal(none, "Do not record stack ring history"), clEnumVal(instr, "Insert instructions into the prologue for " "storing into the stack ring buffer")), cl::Hidden, cl::init(none))
This file implements a class to represent arbitrary precision integral constant values and operations...
MachineBasicBlock MachineBasicBlock::iterator DebugLoc DL
Expand Atomic instructions
static GCRegistry::Add< OcamlGC > B("ocaml", "ocaml 3.10-compatible GC")
static GCRegistry::Add< ErlangGC > A("erlang", "erlang-compatible garbage collector")
Analysis containing CSE Info
Definition: CSEInfo.cpp:27
#define clEnumVal(ENUMVAL, DESC)
Definition: CommandLine.h:684
#define LLVM_DEBUG(X)
Definition: Debug.h:101
This file contains constants used for implementing Dwarf debug support.
uint64_t Size
bool End
Definition: ELF_riscv.cpp:480
A set of register units.
#define F(x, y, z)
Definition: MD5.cpp:55
#define I(x, y, z)
Definition: MD5.cpp:58
This file implements a map that provides insertion order iteration.
static void addRange(SmallVectorImpl< ConstantInt * > &EndPoints, ConstantInt *Low, ConstantInt *High)
Definition: Metadata.cpp:1274
This file contains the declarations for metadata subclasses.
ConstantRange Range(APInt(BitWidth, Low), APInt(BitWidth, High))
uint64_t IntrinsicInst * II
#define P(N)
#define INITIALIZE_PASS_DEPENDENCY(depName)
Definition: PassSupport.h:55
#define INITIALIZE_PASS_END(passName, arg, name, cfg, analysis)
Definition: PassSupport.h:57
#define INITIALIZE_PASS_BEGIN(passName, arg, name, cfg, analysis)
Definition: PassSupport.h:52
assert(ImpDefSCC.getReg()==AMDGPU::SCC &&ImpDefSCC.isDef())
static unsigned getNumElements(Type *Ty)
This file defines the SmallVector class.
This file defines the 'Statistic' class, which is designed to be an easy way to expose various metric...
Target-Independent Code Generator Pass Configuration Options pass.
Value * RHS
Value * LHS
A wrapper pass to provide the legacy pass manager access to a suitably prepared AAResults object.
ModRefInfo getModRefInfo(const Instruction *I, const std::optional< MemoryLocation > &OptLoc)
Check whether or not an instruction may read or write the optionally specified memory location.
an instruction to allocate memory on the stack
Definition: Instructions.h:61
Represent the analysis usage information of a pass.
AnalysisUsage & addRequired()
void setPreservesCFG()
This function should be called by the pass, iff they do not:
Definition: Pass.cpp:256
LLVM Basic Block Representation.
Definition: BasicBlock.h:61
const Instruction & front() const
Definition: BasicBlock.h:471
InstListType::iterator iterator
Instruction iterators...
Definition: BasicBlock.h:177
This is the shared class of boolean and integer constants.
Definition: Constants.h:81
static Constant * getNullValue(Type *Ty)
Constructor to create a '0' constant of arbitrary type.
Definition: Constants.cpp:370
A parsed version of the target data layout string in and methods for querying it.
Definition: DataLayout.h:63
Concrete subclass of DominatorTreeBase that is used to compute a normal dominator tree.
Definition: Dominators.h:162
Instruction * findNearestCommonDominator(Instruction *I1, Instruction *I2) const
Find the nearest instruction I that dominates both I1 and I2, in the sense that a result produced bef...
Definition: Dominators.cpp:344
static FixedVectorType * get(Type *ElementType, unsigned NumElts)
Definition: Type.cpp:680
FunctionPass class - This class is used to implement most global optimizations.
Definition: Pass.h:310
virtual bool runOnFunction(Function &F)=0
runOnFunction - Virtual method overriden by subclasses to do the per-function processing of the pass.
const DataLayout & getDataLayout() const
Get the data layout of the module this function belongs to.
Definition: Function.cpp:384
bool hasFnAttribute(Attribute::AttrKind Kind) const
Return true if the function has the attribute.
Definition: Function.cpp:743
Module * getParent()
Get the module that this global value is contained inside of...
Definition: GlobalValue.h:656
Value * CreateConstGEP1_64(Type *Ty, Value *Ptr, uint64_t Idx0, const Twine &Name="")
Definition: IRBuilder.h:1943
Value * CreateConstGEP1_32(Type *Ty, Value *Ptr, unsigned Idx0, const Twine &Name="")
Definition: IRBuilder.h:1896
IntegerType * getIntNTy(unsigned N)
Fetch the type representing an N-bit integer.
Definition: IRBuilder.h:536
Value * CreateZExtOrTrunc(Value *V, Type *DestTy, const Twine &Name="")
Create a ZExt or Trunc from the integer value V to DestTy.
Definition: IRBuilder.h:2059
Value * CreatePointerCast(Value *V, Type *DestTy, const Twine &Name="")
Definition: IRBuilder.h:2190
BasicBlock::iterator GetInsertPoint() const
Definition: IRBuilder.h:172
Value * CreateIntToPtr(Value *V, Type *DestTy, const Twine &Name="")
Definition: IRBuilder.h:2142
Value * CreateLShr(Value *LHS, Value *RHS, const Twine &Name="", bool isExact=false)
Definition: IRBuilder.h:1454
IntegerType * getIntPtrTy(const DataLayout &DL, unsigned AddrSpace=0)
Fetch the type of an integer with size at least as big as that of a pointer in the given address spac...
Definition: IRBuilder.h:572
IntegerType * getInt64Ty()
Fetch the type representing a 64-bit integer.
Definition: IRBuilder.h:528
Value * CreateBitOrPointerCast(Value *V, Type *DestTy, const Twine &Name="")
Definition: IRBuilder.h:2225
LoadInst * CreateLoad(Type *Ty, Value *Ptr, const char *Name)
Provided to resolve 'CreateLoad(Ty, Ptr, "...")' correctly, instead of converting the string to 'bool...
Definition: IRBuilder.h:1807
Value * CreateShl(Value *LHS, Value *RHS, const Twine &Name="", bool HasNUW=false, bool HasNSW=false)
Definition: IRBuilder.h:1433
LLVMContext & getContext() const
Definition: IRBuilder.h:173
Value * CreateAnd(Value *LHS, Value *RHS, const Twine &Name="")
Definition: IRBuilder.h:1492
StoreInst * CreateStore(Value *Val, Value *Ptr, bool isVolatile=false)
Definition: IRBuilder.h:1820
Value * CreateAdd(Value *LHS, Value *RHS, const Twine &Name="", bool HasNUW=false, bool HasNSW=false)
Definition: IRBuilder.h:1344
Value * CreatePtrToInt(Value *V, Type *DestTy, const Twine &Name="")
Definition: IRBuilder.h:2137
Value * CreateOr(Value *LHS, Value *RHS, const Twine &Name="")
Definition: IRBuilder.h:1514
PointerType * getPtrTy(unsigned AddrSpace=0)
Fetch the type representing a pointer.
Definition: IRBuilder.h:566
CallInst * CreateCall(FunctionType *FTy, Value *Callee, ArrayRef< Value * > Args=std::nullopt, const Twine &Name="", MDNode *FPMathTag=nullptr)
Definition: IRBuilder.h:2432
Value * CreateAShr(Value *LHS, Value *RHS, const Twine &Name="", bool isExact=false)
Definition: IRBuilder.h:1473
Value * CreateXor(Value *LHS, Value *RHS, const Twine &Name="")
Definition: IRBuilder.h:1536
IntegerType * getInt8Ty()
Fetch the type representing an 8-bit integer.
Definition: IRBuilder.h:513
This provides a uniform API for creating instructions and inserting them into a basic block: either a...
Definition: IRBuilder.h:2686
const Module * getModule() const
Return the module owning the function this instruction belongs to or nullptr it the function does not...
Definition: Instruction.cpp:66
static IntegerType * get(LLVMContext &C, unsigned NumBits)
This static method is the primary way of constructing an IntegerType.
Definition: Type.cpp:266
A wrapper class for inspecting calls to intrinsic functions.
Definition: IntrinsicInst.h:48
This is an important class for using LLVM in a threaded context.
Definition: LLVMContext.h:67
This class implements a map that also provides access to all stored values in a deterministic order.
Definition: MapVector.h:36
Value * getLength() const
Value * getDest() const
This is just like getRawDest, but it strips off any cast instructions (including addrspacecast) that ...
bool isVolatile() const
Value * getValue() const
This class wraps the llvm.memset and llvm.memset.inline intrinsics.
Representation for a specific memory location.
A Module instance is used to store all the information related to an LLVM module.
Definition: Module.h:65
const std::string & getTargetTriple() const
Get the target triple which is a string describing the target host.
Definition: Module.h:295
static PassRegistry * getPassRegistry()
getPassRegistry - Access the global registry object, which is automatically initialized at applicatio...
virtual void getAnalysisUsage(AnalysisUsage &) const
getAnalysisUsage - This function should be overriden by passes that need analysis information to do t...
Definition: Pass.cpp:98
virtual StringRef getPassName() const
getPassName - Return a nice clean name for a pass.
Definition: Pass.cpp:81
PostDominatorTree Class - Concrete subclass of DominatorTree that is used to compute the post-dominat...
This is a 'vector' (really, a variable-sized array), optimized for the case when the array is small.
Definition: SmallVector.h:1209
This pass performs the global (interprocedural) stack safety analysis (legacy pass manager).
An instruction for storing to memory.
Definition: Instructions.h:290
StringRef - Represent a constant reference to a string, i.e.
Definition: StringRef.h:50
Triple - Helper class for working with autoconf configuration names.
Definition: Triple.h:44
bool isLittleEndian() const
Tests whether the target triple is little endian.
Definition: Triple.cpp:1924
The instances of the Type class are immutable: once they are created, they are never changed.
Definition: Type.h:45
bool isPointerTy() const
True if this is an instance of PointerType.
Definition: Type.h:251
A Use represents the edge between a Value definition and its users.
Definition: Use.h:43
void setOperand(unsigned i, Value *Val)
Definition: User.h:174
LLVM Value Representation.
Definition: Value.h:74
void setName(const Twine &Name)
Change the name of the value.
Definition: Value.cpp:377
std::optional< int64_t > getPointerOffsetFrom(const Value *Other, const DataLayout &DL) const
If this ptr is provably equal to Other plus a constant offset, return that offset in bytes.
Definition: Value.cpp:1028
const ParentTy * getParent() const
Definition: ilist_node.h:32
unsigned ID
LLVM IR allows to use arbitrary numbers as calling convention identifiers.
Definition: CallingConv.h:24
@ C
The default llvm calling convention, compatible with C.
Definition: CallingConv.h:34
Function * getDeclaration(Module *M, ID id, ArrayRef< Type * > Tys=std::nullopt)
Create or insert an LLVM Function declaration for an intrinsic, and return it.
Definition: Function.cpp:1539
@ ReallyHidden
Definition: CommandLine.h:138
ValuesClass values(OptsTy... Options)
Helper to build a ValuesClass by forwarding a variable number of arguments as an initializer list to ...
Definition: CommandLine.h:711
initializer< Ty > init(const Ty &Val)
Definition: CommandLine.h:443
Value * getFP(IRBuilder<> &IRB)
bool isStandardLifetime(const SmallVectorImpl< IntrinsicInst * > &LifetimeStart, const SmallVectorImpl< IntrinsicInst * > &LifetimeEnd, const DominatorTree *DT, const LoopInfo *LI, size_t MaxLifetimes)
bool forAllReachableExits(const DominatorTree &DT, const PostDominatorTree &PDT, const LoopInfo &LI, const Instruction *Start, const SmallVectorImpl< IntrinsicInst * > &Ends, const SmallVectorImpl< Instruction * > &RetVec, llvm::function_ref< void(Instruction *)> Callback)
Value * getAndroidSlotPtr(IRBuilder<> &IRB, int Slot)
void annotateDebugRecords(AllocaInfo &Info, unsigned int Tag)
void alignAndPadAlloca(memtag::AllocaInfo &Info, llvm::Align Align)
Value * getPC(const Triple &TargetTriple, IRBuilder<> &IRB)
bool isLifetimeIntrinsic(Value *V)
This is an optimization pass for GlobalISel generic memory operations.
Definition: AddressRanges.h:18
@ Offset
Definition: DWP.cpp:480
void initializeAArch64StackTaggingPass(PassRegistry &)
raw_ostream & dbgs()
dbgs() - This returns a reference to a raw_ostream for debugging messages.
Definition: Debug.cpp:163
auto lower_bound(R &&Range, T &&Value)
Provide wrappers to std::lower_bound which take ranges instead of having to pass begin/end explicitly...
Definition: STLExtras.h:1961
uint64_t alignTo(uint64_t Size, Align A)
Returns a multiple of A needed to store Size bytes.
Definition: Alignment.h:155
FunctionPass * createAArch64StackTaggingPass(bool IsOptNone)
bool isNoModRef(const ModRefInfo MRI)
Definition: ModRef.h:39
This struct is a compact representation of a valid (non-zero power of two) alignment.
Definition: Alignment.h:39
MapVector< AllocaInst *, AllocaInfo > AllocasToInstrument
SmallVector< Instruction *, 4 > UnrecognizedLifetimes
SmallVector< Instruction *, 8 > RetVec