46#include "llvm/IR/IntrinsicsAArch64.h"
63#define DEBUG_TYPE "aarch64-stack-tagging"
67 cl::desc(
"merge stack variable initializers with tagging when possible"));
72 cl::desc(
"Use Stack Safety analysis results"));
84 cl::desc(
"How many lifetime ends to handle for a single alloca."),
99 "stack-tagging-record-stack-history",
100 cl::desc(
"Record stack frames with tagged allocations in a thread-local "
104 "storing into the stack ring buffer")),
111class InitializerBuilder {
127 std::map<uint64_t, Value *> Out;
134 SetTagZeroFn(SetTagZeroFn), StgpFn(StgpFn) {}
150 int64_t StoreSize =
DL->getTypeStoreSize(
SI->getOperand(0)->getType());
164 cast<ConstantInt>(MSI->
getValue()));
176 uint64_t Cst = 0x0101010101010101UL;
177 int LowBits =
Offset < Start ? (Start -
Offset) * 8 : 0;
179 Cst = (Cst >> LowBits) << LowBits;
182 Cst = (Cst << HighBits) >> HighBits;
184 ConstantInt::get(IRB.
getInt64Ty(), Cst *
V->getZExtValue());
211 Value *StoredValue) {
212 StoredValue = flatten(IRB, StoredValue);
214 Value *
V = sliceValue(IRB, StoredValue,
Offset - Start);
219 CurrentV = IRB.
CreateOr(CurrentV, V);
228 emitUndef(IRB, 0, Size);
238 auto I2 = Out.find(
Offset + 8);
239 if (I1 == Out.end() && I2 == Out.end())
243 emitZeroes(IRB, LastOffset,
Offset - LastOffset);
249 emitPair(IRB,
Offset, Store1, Store2);
255 if (LastOffset < Size)
256 emitZeroes(IRB, LastOffset, Size - LastOffset);
258 for (
const auto &R : Ranges) {
259 R.Inst->eraseFromParent();
292 if (
V->getType()->isIntegerTy())
295 if (
VectorType *VecTy = dyn_cast<VectorType>(
V->getType())) {
297 Type *EltTy = VecTy->getElementType();
299 uint32_t EltSize =
DL->getTypeSizeInBits(EltTy);
307 V, IRB.
getIntNTy(
DL->getTypeStoreSize(
V->getType()) * 8));
312 const bool MergeInit;
313 const bool UseStackSafety;
318 AArch64StackTagging(
bool IsOptNone =
false)
359char AArch64StackTagging::ID = 0;
369 return new AArch64StackTagging(IsOptNone);
375 InitializerBuilder &IB) {
381 for (; Count <
ClScanLimit && !BI->isTerminator(); ++BI) {
382 if (!isa<DbgInfoIntrinsic>(*BI))
388 if (!isa<StoreInst>(BI) && !isa<MemSetInst>(BI)) {
392 if (BI->mayWriteToMemory() || BI->mayReadFromMemory())
397 if (
StoreInst *NextStore = dyn_cast<StoreInst>(BI)) {
398 if (!NextStore->isSimple())
402 std::optional<int64_t>
Offset =
403 NextStore->getPointerOperand()->getPointerOffsetFrom(StartPtr, *
DL);
409 LastInst = NextStore;
416 if (!isa<ConstantInt>(MSI->
getValue()))
420 std::optional<int64_t>
Offset =
435 auto SetTagZeroFunc =
440 InitializerBuilder
IB(
Size,
DL,
Ptr, SetTagFunc, SetTagZeroFunc, StgpFunc);
444 if (MergeInit && !
F->hasOptNone() && LittleEndian &&
447 <<
", size = " <<
Size <<
"\n");
448 InsertBefore = collectInitializers(InsertBefore,
Ptr,
Size, IB);
462Instruction *AArch64StackTagging::insertBaseTaggedPointer(
468 for (
auto &
I : AllocasToInstrument) {
484 Base->setName(
"basetag");
485 auto TargetTriple =
Triple(
M.getTargetTriple());
491 TargetTriple.isAArch64() && !TargetTriple.isAndroidVersionLT(10000) &&
492 !AllocasToInstrument.empty()) {
493 constexpr int StackMteSlot = -3;
494 constexpr uint64_t TagMask = 0xFULL << 56;
498 auto *ThreadLong = IRB.
CreateLoad(IntptrTy, SlotPtr);
515 ConstantInt::get(IntptrTy, (
uint64_t)-1));
517 IRB.
CreateAdd(ThreadLong, ConstantInt::get(IntptrTy, 16)), WrapMask);
524bool AArch64StackTagging::runOnFunction(
Function &Fn) {
529 SSI = &getAnalysis<StackSafetyGlobalInfoWrapperPass>().getResult();
533 AA = &getAnalysis<AAResultsWrapperPass>().getAAResults();
543 std::unique_ptr<DominatorTree> DeleteDT;
545 if (
auto *
P = getAnalysisIfAvailable<DominatorTreeWrapperPass>())
546 DT = &
P->getDomTree();
549 DeleteDT = std::make_unique<DominatorTree>(*
F);
553 std::unique_ptr<PostDominatorTree> DeletePDT;
555 if (
auto *
P = getAnalysisIfAvailable<PostDominatorTreeWrapperPass>())
556 PDT = &
P->getPostDomTree();
558 if (PDT ==
nullptr) {
559 DeletePDT = std::make_unique<PostDominatorTree>(*
F);
560 PDT = DeletePDT.get();
563 std::unique_ptr<LoopInfo> DeleteLI;
565 if (
auto *LIWP = getAnalysisIfAvailable<LoopInfoWrapperPass>()) {
566 LI = &LIWP->getLoopInfo();
568 DeleteLI = std::make_unique<LoopInfo>(*DT);
585 NextTag = (NextTag + 1) % 16;
589 F->getParent(), Intrinsic::aarch64_tagp, {Info.AI->getType()});
593 if (
Info.AI->hasName())
596 Info.AI->replaceUsesWithIf(TagPCall, [&](
const Use &U) {
605 bool StandardLifetime =
610 if (StandardLifetime) {
613 cast<ConstantInt>(Start->getArgOperand(0))->getZExtValue();
615 tagAlloca(AI, Start->getNextNode(), TagPCall,
Size);
621 for (
auto *
End :
Info.LifetimeEnd)
622 End->eraseFromParent();
628 for (
auto *RI : SInfo.
RetVec) {
629 untagAlloca(AI, RI,
Size);
633 for (
auto *
II :
Info.LifetimeStart)
634 II->eraseFromParent();
635 for (
auto *
II :
Info.LifetimeEnd)
636 II->eraseFromParent();
645 I->eraseFromParent();
static cl::opt< bool > ClMergeInit("stack-tagging-merge-init", cl::Hidden, cl::init(true), cl::desc("merge stack variable initializers with tagging when possible"))
StackTaggingRecordStackHistoryMode
static cl::opt< unsigned > ClMergeInitSizeLimit("stack-tagging-merge-init-size-limit", cl::init(272), cl::Hidden)
static cl::opt< unsigned > ClScanLimit("stack-tagging-merge-init-scan-limit", cl::init(40), cl::Hidden)
static cl::opt< bool > ClUseStackSafety("stack-tagging-use-stack-safety", cl::Hidden, cl::init(true), cl::desc("Use Stack Safety analysis results"))
static cl::opt< size_t > ClMaxLifetimes("stack-tagging-max-lifetimes-for-alloca", cl::Hidden, cl::init(3), cl::ReallyHidden, cl::desc("How many lifetime ends to handle for a single alloca."), cl::Optional)
static const Align kTagGranuleSize
static cl::opt< StackTaggingRecordStackHistoryMode > ClRecordStackHistory("stack-tagging-record-stack-history", cl::desc("Record stack frames with tagged allocations in a thread-local " "ring buffer"), cl::values(clEnumVal(none, "Do not record stack ring history"), clEnumVal(instr, "Insert instructions into the prologue for " "storing into the stack ring buffer")), cl::Hidden, cl::init(none))
This file implements a class to represent arbitrary precision integral constant values and operations...
MachineBasicBlock MachineBasicBlock::iterator DebugLoc DL
Expand Atomic instructions
static GCRegistry::Add< OcamlGC > B("ocaml", "ocaml 3.10-compatible GC")
static GCRegistry::Add< ErlangGC > A("erlang", "erlang-compatible garbage collector")
Analysis containing CSE Info
#define clEnumVal(ENUMVAL, DESC)
This file contains constants used for implementing Dwarf debug support.
This file implements a map that provides insertion order iteration.
ConstantRange Range(APInt(BitWidth, Low), APInt(BitWidth, High))
uint64_t IntrinsicInst * II
#define INITIALIZE_PASS_DEPENDENCY(depName)
#define INITIALIZE_PASS_END(passName, arg, name, cfg, analysis)
#define INITIALIZE_PASS_BEGIN(passName, arg, name, cfg, analysis)
assert(ImpDefSCC.getReg()==AMDGPU::SCC &&ImpDefSCC.isDef())
static unsigned getNumElements(Type *Ty)
This file defines the SmallVector class.
This file defines the 'Statistic' class, which is designed to be an easy way to expose various metric...
Target-Independent Code Generator Pass Configuration Options pass.
A wrapper pass to provide the legacy pass manager access to a suitably prepared AAResults object.
ModRefInfo getModRefInfo(const Instruction *I, const std::optional< MemoryLocation > &OptLoc)
Check whether or not an instruction may read or write the optionally specified memory location.
an instruction to allocate memory on the stack
Represent the analysis usage information of a pass.
AnalysisUsage & addRequired()
void setPreservesCFG()
This function should be called by the pass, iff they do not:
LLVM Basic Block Representation.
const Instruction & front() const
InstListType::iterator iterator
Instruction iterators...
This is the shared class of boolean and integer constants.
static Constant * getNullValue(Type *Ty)
Constructor to create a '0' constant of arbitrary type.
A parsed version of the target data layout string in and methods for querying it.
Concrete subclass of DominatorTreeBase that is used to compute a normal dominator tree.
Instruction * findNearestCommonDominator(Instruction *I1, Instruction *I2) const
Find the nearest instruction I that dominates both I1 and I2, in the sense that a result produced bef...
static FixedVectorType * get(Type *ElementType, unsigned NumElts)
FunctionPass class - This class is used to implement most global optimizations.
virtual bool runOnFunction(Function &F)=0
runOnFunction - Virtual method overriden by subclasses to do the per-function processing of the pass.
const DataLayout & getDataLayout() const
Get the data layout of the module this function belongs to.
bool hasFnAttribute(Attribute::AttrKind Kind) const
Return true if the function has the attribute.
Module * getParent()
Get the module that this global value is contained inside of...
Value * CreateConstGEP1_64(Type *Ty, Value *Ptr, uint64_t Idx0, const Twine &Name="")
Value * CreateConstGEP1_32(Type *Ty, Value *Ptr, unsigned Idx0, const Twine &Name="")
IntegerType * getIntNTy(unsigned N)
Fetch the type representing an N-bit integer.
Value * CreateZExtOrTrunc(Value *V, Type *DestTy, const Twine &Name="")
Create a ZExt or Trunc from the integer value V to DestTy.
Value * CreatePointerCast(Value *V, Type *DestTy, const Twine &Name="")
BasicBlock::iterator GetInsertPoint() const
Value * CreateIntToPtr(Value *V, Type *DestTy, const Twine &Name="")
Value * CreateLShr(Value *LHS, Value *RHS, const Twine &Name="", bool isExact=false)
IntegerType * getIntPtrTy(const DataLayout &DL, unsigned AddrSpace=0)
Fetch the type of an integer with size at least as big as that of a pointer in the given address spac...
IntegerType * getInt64Ty()
Fetch the type representing a 64-bit integer.
Value * CreateBitOrPointerCast(Value *V, Type *DestTy, const Twine &Name="")
LoadInst * CreateLoad(Type *Ty, Value *Ptr, const char *Name)
Provided to resolve 'CreateLoad(Ty, Ptr, "...")' correctly, instead of converting the string to 'bool...
Value * CreateShl(Value *LHS, Value *RHS, const Twine &Name="", bool HasNUW=false, bool HasNSW=false)
LLVMContext & getContext() const
Value * CreateAnd(Value *LHS, Value *RHS, const Twine &Name="")
StoreInst * CreateStore(Value *Val, Value *Ptr, bool isVolatile=false)
Value * CreateAdd(Value *LHS, Value *RHS, const Twine &Name="", bool HasNUW=false, bool HasNSW=false)
Value * CreatePtrToInt(Value *V, Type *DestTy, const Twine &Name="")
Value * CreateOr(Value *LHS, Value *RHS, const Twine &Name="")
PointerType * getPtrTy(unsigned AddrSpace=0)
Fetch the type representing a pointer.
CallInst * CreateCall(FunctionType *FTy, Value *Callee, ArrayRef< Value * > Args=std::nullopt, const Twine &Name="", MDNode *FPMathTag=nullptr)
Value * CreateAShr(Value *LHS, Value *RHS, const Twine &Name="", bool isExact=false)
Value * CreateXor(Value *LHS, Value *RHS, const Twine &Name="")
IntegerType * getInt8Ty()
Fetch the type representing an 8-bit integer.
This provides a uniform API for creating instructions and inserting them into a basic block: either a...
const Module * getModule() const
Return the module owning the function this instruction belongs to or nullptr it the function does not...
static IntegerType * get(LLVMContext &C, unsigned NumBits)
This static method is the primary way of constructing an IntegerType.
A wrapper class for inspecting calls to intrinsic functions.
This is an important class for using LLVM in a threaded context.
This class implements a map that also provides access to all stored values in a deterministic order.
Value * getLength() const
Value * getDest() const
This is just like getRawDest, but it strips off any cast instructions (including addrspacecast) that ...
This class wraps the llvm.memset and llvm.memset.inline intrinsics.
Representation for a specific memory location.
A Module instance is used to store all the information related to an LLVM module.
const std::string & getTargetTriple() const
Get the target triple which is a string describing the target host.
static PassRegistry * getPassRegistry()
getPassRegistry - Access the global registry object, which is automatically initialized at applicatio...
virtual void getAnalysisUsage(AnalysisUsage &) const
getAnalysisUsage - This function should be overriden by passes that need analysis information to do t...
virtual StringRef getPassName() const
getPassName - Return a nice clean name for a pass.
PostDominatorTree Class - Concrete subclass of DominatorTree that is used to compute the post-dominat...
This is a 'vector' (really, a variable-sized array), optimized for the case when the array is small.
This pass performs the global (interprocedural) stack safety analysis (legacy pass manager).
An instruction for storing to memory.
StringRef - Represent a constant reference to a string, i.e.
Triple - Helper class for working with autoconf configuration names.
bool isLittleEndian() const
Tests whether the target triple is little endian.
The instances of the Type class are immutable: once they are created, they are never changed.
bool isPointerTy() const
True if this is an instance of PointerType.
A Use represents the edge between a Value definition and its users.
void setOperand(unsigned i, Value *Val)
LLVM Value Representation.
void setName(const Twine &Name)
Change the name of the value.
std::optional< int64_t > getPointerOffsetFrom(const Value *Other, const DataLayout &DL) const
If this ptr is provably equal to Other plus a constant offset, return that offset in bytes.
const ParentTy * getParent() const
unsigned ID
LLVM IR allows to use arbitrary numbers as calling convention identifiers.
@ C
The default llvm calling convention, compatible with C.
Function * getDeclaration(Module *M, ID id, ArrayRef< Type * > Tys=std::nullopt)
Create or insert an LLVM Function declaration for an intrinsic, and return it.
ValuesClass values(OptsTy... Options)
Helper to build a ValuesClass by forwarding a variable number of arguments as an initializer list to ...
initializer< Ty > init(const Ty &Val)
Value * getFP(IRBuilder<> &IRB)
bool isStandardLifetime(const SmallVectorImpl< IntrinsicInst * > &LifetimeStart, const SmallVectorImpl< IntrinsicInst * > &LifetimeEnd, const DominatorTree *DT, const LoopInfo *LI, size_t MaxLifetimes)
bool forAllReachableExits(const DominatorTree &DT, const PostDominatorTree &PDT, const LoopInfo &LI, const Instruction *Start, const SmallVectorImpl< IntrinsicInst * > &Ends, const SmallVectorImpl< Instruction * > &RetVec, llvm::function_ref< void(Instruction *)> Callback)
Value * getAndroidSlotPtr(IRBuilder<> &IRB, int Slot)
void annotateDebugRecords(AllocaInfo &Info, unsigned int Tag)
void alignAndPadAlloca(memtag::AllocaInfo &Info, llvm::Align Align)
Value * getPC(const Triple &TargetTriple, IRBuilder<> &IRB)
bool isLifetimeIntrinsic(Value *V)
This is an optimization pass for GlobalISel generic memory operations.
void initializeAArch64StackTaggingPass(PassRegistry &)
raw_ostream & dbgs()
dbgs() - This returns a reference to a raw_ostream for debugging messages.
auto lower_bound(R &&Range, T &&Value)
Provide wrappers to std::lower_bound which take ranges instead of having to pass begin/end explicitly...
uint64_t alignTo(uint64_t Size, Align A)
Returns a multiple of A needed to store Size bytes.
FunctionPass * createAArch64StackTaggingPass(bool IsOptNone)
bool isNoModRef(const ModRefInfo MRI)
This struct is a compact representation of a valid (non-zero power of two) alignment.
MapVector< AllocaInst *, AllocaInfo > AllocasToInstrument
SmallVector< Instruction *, 4 > UnrecognizedLifetimes
SmallVector< Instruction *, 8 > RetVec