LLVM  15.0.0git
SafeStack.cpp
Go to the documentation of this file.
1 //===- SafeStack.cpp - Safe Stack Insertion -------------------------------===//
2 //
3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4 // See https://llvm.org/LICENSE.txt for license information.
5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6 //
7 //===----------------------------------------------------------------------===//
8 //
9 // This pass splits the stack into the safe stack (kept as-is for LLVM backend)
10 // and the unsafe stack (explicitly allocated and managed through the runtime
11 // support library).
12 //
13 // http://clang.llvm.org/docs/SafeStack.html
14 //
15 //===----------------------------------------------------------------------===//
16 
17 #include "SafeStackLayout.h"
18 #include "llvm/ADT/APInt.h"
19 #include "llvm/ADT/ArrayRef.h"
20 #include "llvm/ADT/SmallPtrSet.h"
21 #include "llvm/ADT/SmallVector.h"
22 #include "llvm/ADT/Statistic.h"
27 #include "llvm/Analysis/LoopInfo.h"
35 #include "llvm/IR/Argument.h"
36 #include "llvm/IR/Attributes.h"
37 #include "llvm/IR/ConstantRange.h"
38 #include "llvm/IR/Constants.h"
39 #include "llvm/IR/DIBuilder.h"
40 #include "llvm/IR/DataLayout.h"
41 #include "llvm/IR/DerivedTypes.h"
42 #include "llvm/IR/Dominators.h"
43 #include "llvm/IR/Function.h"
44 #include "llvm/IR/IRBuilder.h"
45 #include "llvm/IR/InstIterator.h"
46 #include "llvm/IR/Instruction.h"
47 #include "llvm/IR/Instructions.h"
48 #include "llvm/IR/IntrinsicInst.h"
49 #include "llvm/IR/Intrinsics.h"
50 #include "llvm/IR/MDBuilder.h"
51 #include "llvm/IR/Metadata.h"
52 #include "llvm/IR/Module.h"
53 #include "llvm/IR/Type.h"
54 #include "llvm/IR/Use.h"
55 #include "llvm/IR/Value.h"
56 #include "llvm/InitializePasses.h"
57 #include "llvm/Pass.h"
58 #include "llvm/Support/Casting.h"
59 #include "llvm/Support/Debug.h"
67 #include <algorithm>
68 #include <cassert>
69 #include <cstdint>
70 #include <string>
71 #include <utility>
72 
73 using namespace llvm;
74 using namespace llvm::safestack;
75 
76 #define DEBUG_TYPE "safe-stack"
77 
78 namespace llvm {
79 
80 STATISTIC(NumFunctions, "Total number of functions");
81 STATISTIC(NumUnsafeStackFunctions, "Number of functions with unsafe stack");
82 STATISTIC(NumUnsafeStackRestorePointsFunctions,
83  "Number of functions that use setjmp or exceptions");
84 
85 STATISTIC(NumAllocas, "Total number of allocas");
86 STATISTIC(NumUnsafeStaticAllocas, "Number of unsafe static allocas");
87 STATISTIC(NumUnsafeDynamicAllocas, "Number of unsafe dynamic allocas");
88 STATISTIC(NumUnsafeByValArguments, "Number of unsafe byval arguments");
89 STATISTIC(NumUnsafeStackRestorePoints, "Number of setjmps and landingpads");
90 
91 } // namespace llvm
92 
93 /// Use __safestack_pointer_address even if the platform has a faster way of
94 /// access safe stack pointer.
95 static cl::opt<bool>
96  SafeStackUsePointerAddress("safestack-use-pointer-address",
97  cl::init(false), cl::Hidden);
98 
99 static cl::opt<bool> ClColoring("safe-stack-coloring",
100  cl::desc("enable safe stack coloring"),
101  cl::Hidden, cl::init(true));
102 
103 namespace {
104 
105 /// The SafeStack pass splits the stack of each function into the safe
106 /// stack, which is only accessed through memory safe dereferences (as
107 /// determined statically), and the unsafe stack, which contains all
108 /// local variables that are accessed in ways that we can't prove to
109 /// be safe.
110 class SafeStack {
111  Function &F;
112  const TargetLoweringBase &TL;
113  const DataLayout &DL;
114  DomTreeUpdater *DTU;
115  ScalarEvolution &SE;
116 
117  Type *StackPtrTy;
118  Type *IntPtrTy;
119  Type *Int32Ty;
120  Type *Int8Ty;
121 
122  Value *UnsafeStackPtr = nullptr;
123 
124  /// Unsafe stack alignment. Each stack frame must ensure that the stack is
125  /// aligned to this value. We need to re-align the unsafe stack if the
126  /// alignment of any object on the stack exceeds this value.
127  ///
128  /// 16 seems like a reasonable upper bound on the alignment of objects that we
129  /// might expect to appear on the stack on most common targets.
130  static constexpr Align StackAlignment = Align::Constant<16>();
131 
132  /// Return the value of the stack canary.
134 
135  /// Load stack guard from the frame and check if it has changed.
136  void checkStackGuard(IRBuilder<> &IRB, Function &F, Instruction &RI,
137  AllocaInst *StackGuardSlot, Value *StackGuard);
138 
139  /// Find all static allocas, dynamic allocas, return instructions and
140  /// stack restore points (exception unwind blocks and setjmp calls) in the
141  /// given function and append them to the respective vectors.
142  void findInsts(Function &F, SmallVectorImpl<AllocaInst *> &StaticAllocas,
143  SmallVectorImpl<AllocaInst *> &DynamicAllocas,
144  SmallVectorImpl<Argument *> &ByValArguments,
146  SmallVectorImpl<Instruction *> &StackRestorePoints);
147 
148  /// Calculate the allocation size of a given alloca. Returns 0 if the
149  /// size can not be statically determined.
150  uint64_t getStaticAllocaAllocationSize(const AllocaInst* AI);
151 
152  /// Allocate space for all static allocas in \p StaticAllocas,
153  /// replace allocas with pointers into the unsafe stack.
154  ///
155  /// \returns A pointer to the top of the unsafe stack after all unsafe static
156  /// allocas are allocated.
157  Value *moveStaticAllocasToUnsafeStack(IRBuilder<> &IRB, Function &F,
158  ArrayRef<AllocaInst *> StaticAllocas,
159  ArrayRef<Argument *> ByValArguments,
160  Instruction *BasePointer,
161  AllocaInst *StackGuardSlot);
162 
163  /// Generate code to restore the stack after all stack restore points
164  /// in \p StackRestorePoints.
165  ///
166  /// \returns A local variable in which to maintain the dynamic top of the
167  /// unsafe stack if needed.
168  AllocaInst *
169  createStackRestorePoints(IRBuilder<> &IRB, Function &F,
170  ArrayRef<Instruction *> StackRestorePoints,
171  Value *StaticTop, bool NeedDynamicTop);
172 
173  /// Replace all allocas in \p DynamicAllocas with code to allocate
174  /// space dynamically on the unsafe stack and store the dynamic unsafe stack
175  /// top to \p DynamicTop if non-null.
176  void moveDynamicAllocasToUnsafeStack(Function &F, Value *UnsafeStackPtr,
177  AllocaInst *DynamicTop,
178  ArrayRef<AllocaInst *> DynamicAllocas);
179 
180  bool IsSafeStackAlloca(const Value *AllocaPtr, uint64_t AllocaSize);
181 
182  bool IsMemIntrinsicSafe(const MemIntrinsic *MI, const Use &U,
183  const Value *AllocaPtr, uint64_t AllocaSize);
184  bool IsAccessSafe(Value *Addr, uint64_t Size, const Value *AllocaPtr,
185  uint64_t AllocaSize);
186 
187  bool ShouldInlinePointerAddress(CallInst &CI);
188  void TryInlinePointerAddress();
189 
190 public:
191  SafeStack(Function &F, const TargetLoweringBase &TL, const DataLayout &DL,
193  : F(F), TL(TL), DL(DL), DTU(DTU), SE(SE),
194  StackPtrTy(Type::getInt8PtrTy(F.getContext())),
195  IntPtrTy(DL.getIntPtrType(F.getContext())),
196  Int32Ty(Type::getInt32Ty(F.getContext())),
197  Int8Ty(Type::getInt8Ty(F.getContext())) {}
198 
199  // Run the transformation on the associated function.
200  // Returns whether the function was changed.
201  bool run();
202 };
203 
204 constexpr Align SafeStack::StackAlignment;
205 
206 uint64_t SafeStack::getStaticAllocaAllocationSize(const AllocaInst* AI) {
207  uint64_t Size = DL.getTypeAllocSize(AI->getAllocatedType());
208  if (AI->isArrayAllocation()) {
209  auto C = dyn_cast<ConstantInt>(AI->getArraySize());
210  if (!C)
211  return 0;
212  Size *= C->getZExtValue();
213  }
214  return Size;
215 }
216 
217 bool SafeStack::IsAccessSafe(Value *Addr, uint64_t AccessSize,
218  const Value *AllocaPtr, uint64_t AllocaSize) {
219  const SCEV *AddrExpr = SE.getSCEV(Addr);
220  const auto *Base = dyn_cast<SCEVUnknown>(SE.getPointerBase(AddrExpr));
221  if (!Base || Base->getValue() != AllocaPtr) {
222  LLVM_DEBUG(
223  dbgs() << "[SafeStack] "
224  << (isa<AllocaInst>(AllocaPtr) ? "Alloca " : "ByValArgument ")
225  << *AllocaPtr << "\n"
226  << "SCEV " << *AddrExpr << " not directly based on alloca\n");
227  return false;
228  }
229 
230  const SCEV *Expr = SE.removePointerBase(AddrExpr);
231  uint64_t BitWidth = SE.getTypeSizeInBits(Expr->getType());
232  ConstantRange AccessStartRange = SE.getUnsignedRange(Expr);
233  ConstantRange SizeRange =
234  ConstantRange(APInt(BitWidth, 0), APInt(BitWidth, AccessSize));
235  ConstantRange AccessRange = AccessStartRange.add(SizeRange);
236  ConstantRange AllocaRange =
237  ConstantRange(APInt(BitWidth, 0), APInt(BitWidth, AllocaSize));
238  bool Safe = AllocaRange.contains(AccessRange);
239 
240  LLVM_DEBUG(
241  dbgs() << "[SafeStack] "
242  << (isa<AllocaInst>(AllocaPtr) ? "Alloca " : "ByValArgument ")
243  << *AllocaPtr << "\n"
244  << " Access " << *Addr << "\n"
245  << " SCEV " << *Expr
246  << " U: " << SE.getUnsignedRange(Expr)
247  << ", S: " << SE.getSignedRange(Expr) << "\n"
248  << " Range " << AccessRange << "\n"
249  << " AllocaRange " << AllocaRange << "\n"
250  << " " << (Safe ? "safe" : "unsafe") << "\n");
251 
252  return Safe;
253 }
254 
255 bool SafeStack::IsMemIntrinsicSafe(const MemIntrinsic *MI, const Use &U,
256  const Value *AllocaPtr,
257  uint64_t AllocaSize) {
258  if (auto MTI = dyn_cast<MemTransferInst>(MI)) {
259  if (MTI->getRawSource() != U && MTI->getRawDest() != U)
260  return true;
261  } else {
262  if (MI->getRawDest() != U)
263  return true;
264  }
265 
266  const auto *Len = dyn_cast<ConstantInt>(MI->getLength());
267  // Non-constant size => unsafe. FIXME: try SCEV getRange.
268  if (!Len) return false;
269  return IsAccessSafe(U, Len->getZExtValue(), AllocaPtr, AllocaSize);
270 }
271 
272 /// Check whether a given allocation must be put on the safe
273 /// stack or not. The function analyzes all uses of AI and checks whether it is
274 /// only accessed in a memory safe way (as decided statically).
275 bool SafeStack::IsSafeStackAlloca(const Value *AllocaPtr, uint64_t AllocaSize) {
276  // Go through all uses of this alloca and check whether all accesses to the
277  // allocated object are statically known to be memory safe and, hence, the
278  // object can be placed on the safe stack.
281  WorkList.push_back(AllocaPtr);
282 
283  // A DFS search through all uses of the alloca in bitcasts/PHI/GEPs/etc.
284  while (!WorkList.empty()) {
285  const Value *V = WorkList.pop_back_val();
286  for (const Use &UI : V->uses()) {
287  auto I = cast<const Instruction>(UI.getUser());
288  assert(V == UI.get());
289 
290  switch (I->getOpcode()) {
291  case Instruction::Load:
292  if (!IsAccessSafe(UI, DL.getTypeStoreSize(I->getType()), AllocaPtr,
293  AllocaSize))
294  return false;
295  break;
296 
297  case Instruction::VAArg:
298  // "va-arg" from a pointer is safe.
299  break;
300  case Instruction::Store:
301  if (V == I->getOperand(0)) {
302  // Stored the pointer - conservatively assume it may be unsafe.
303  LLVM_DEBUG(dbgs()
304  << "[SafeStack] Unsafe alloca: " << *AllocaPtr
305  << "\n store of address: " << *I << "\n");
306  return false;
307  }
308 
309  if (!IsAccessSafe(UI, DL.getTypeStoreSize(I->getOperand(0)->getType()),
310  AllocaPtr, AllocaSize))
311  return false;
312  break;
313 
314  case Instruction::Ret:
315  // Information leak.
316  return false;
317 
318  case Instruction::Call:
319  case Instruction::Invoke: {
320  const CallBase &CS = *cast<CallBase>(I);
321 
322  if (I->isLifetimeStartOrEnd())
323  continue;
324 
325  if (const MemIntrinsic *MI = dyn_cast<MemIntrinsic>(I)) {
326  if (!IsMemIntrinsicSafe(MI, UI, AllocaPtr, AllocaSize)) {
327  LLVM_DEBUG(dbgs()
328  << "[SafeStack] Unsafe alloca: " << *AllocaPtr
329  << "\n unsafe memintrinsic: " << *I << "\n");
330  return false;
331  }
332  continue;
333  }
334 
335  // LLVM 'nocapture' attribute is only set for arguments whose address
336  // is not stored, passed around, or used in any other non-trivial way.
337  // We assume that passing a pointer to an object as a 'nocapture
338  // readnone' argument is safe.
339  // FIXME: a more precise solution would require an interprocedural
340  // analysis here, which would look at all uses of an argument inside
341  // the function being called.
342  auto B = CS.arg_begin(), E = CS.arg_end();
343  for (auto A = B; A != E; ++A)
344  if (A->get() == V)
345  if (!(CS.doesNotCapture(A - B) && (CS.doesNotAccessMemory(A - B) ||
346  CS.doesNotAccessMemory()))) {
347  LLVM_DEBUG(dbgs() << "[SafeStack] Unsafe alloca: " << *AllocaPtr
348  << "\n unsafe call: " << *I << "\n");
349  return false;
350  }
351  continue;
352  }
353 
354  default:
355  if (Visited.insert(I).second)
356  WorkList.push_back(cast<const Instruction>(I));
357  }
358  }
359  }
360 
361  // All uses of the alloca are safe, we can place it on the safe stack.
362  return true;
363 }
364 
366  Value *StackGuardVar = TL.getIRStackGuard(IRB);
367  Module *M = F.getParent();
368 
369  if (!StackGuardVar) {
370  TL.insertSSPDeclarations(*M);
371  return IRB.CreateCall(Intrinsic::getDeclaration(M, Intrinsic::stackguard));
372  }
373 
374  return IRB.CreateLoad(StackPtrTy, StackGuardVar, "StackGuard");
375 }
376 
377 void SafeStack::findInsts(Function &F,
378  SmallVectorImpl<AllocaInst *> &StaticAllocas,
379  SmallVectorImpl<AllocaInst *> &DynamicAllocas,
380  SmallVectorImpl<Argument *> &ByValArguments,
382  SmallVectorImpl<Instruction *> &StackRestorePoints) {
383  for (Instruction &I : instructions(&F)) {
384  if (auto AI = dyn_cast<AllocaInst>(&I)) {
385  ++NumAllocas;
386 
387  uint64_t Size = getStaticAllocaAllocationSize(AI);
388  if (IsSafeStackAlloca(AI, Size))
389  continue;
390 
391  if (AI->isStaticAlloca()) {
392  ++NumUnsafeStaticAllocas;
393  StaticAllocas.push_back(AI);
394  } else {
395  ++NumUnsafeDynamicAllocas;
396  DynamicAllocas.push_back(AI);
397  }
398  } else if (auto RI = dyn_cast<ReturnInst>(&I)) {
399  if (CallInst *CI = I.getParent()->getTerminatingMustTailCall())
400  Returns.push_back(CI);
401  else
402  Returns.push_back(RI);
403  } else if (auto CI = dyn_cast<CallInst>(&I)) {
404  // setjmps require stack restore.
405  if (CI->getCalledFunction() && CI->canReturnTwice())
406  StackRestorePoints.push_back(CI);
407  } else if (auto LP = dyn_cast<LandingPadInst>(&I)) {
408  // Exception landing pads require stack restore.
409  StackRestorePoints.push_back(LP);
410  } else if (auto II = dyn_cast<IntrinsicInst>(&I)) {
411  if (II->getIntrinsicID() == Intrinsic::gcroot)
413  "gcroot intrinsic not compatible with safestack attribute");
414  }
415  }
416  for (Argument &Arg : F.args()) {
417  if (!Arg.hasByValAttr())
418  continue;
419  uint64_t Size = DL.getTypeStoreSize(Arg.getParamByValType());
420  if (IsSafeStackAlloca(&Arg, Size))
421  continue;
422 
423  ++NumUnsafeByValArguments;
424  ByValArguments.push_back(&Arg);
425  }
426 }
427 
428 AllocaInst *
429 SafeStack::createStackRestorePoints(IRBuilder<> &IRB, Function &F,
430  ArrayRef<Instruction *> StackRestorePoints,
431  Value *StaticTop, bool NeedDynamicTop) {
432  assert(StaticTop && "The stack top isn't set.");
433 
434  if (StackRestorePoints.empty())
435  return nullptr;
436 
437  // We need the current value of the shadow stack pointer to restore
438  // after longjmp or exception catching.
439 
440  // FIXME: On some platforms this could be handled by the longjmp/exception
441  // runtime itself.
442 
443  AllocaInst *DynamicTop = nullptr;
444  if (NeedDynamicTop) {
445  // If we also have dynamic alloca's, the stack pointer value changes
446  // throughout the function. For now we store it in an alloca.
447  DynamicTop = IRB.CreateAlloca(StackPtrTy, /*ArraySize=*/nullptr,
448  "unsafe_stack_dynamic_ptr");
449  IRB.CreateStore(StaticTop, DynamicTop);
450  }
451 
452  // Restore current stack pointer after longjmp/exception catch.
453  for (Instruction *I : StackRestorePoints) {
454  ++NumUnsafeStackRestorePoints;
455 
456  IRB.SetInsertPoint(I->getNextNode());
457  Value *CurrentTop =
458  DynamicTop ? IRB.CreateLoad(StackPtrTy, DynamicTop) : StaticTop;
459  IRB.CreateStore(CurrentTop, UnsafeStackPtr);
460  }
461 
462  return DynamicTop;
463 }
464 
465 void SafeStack::checkStackGuard(IRBuilder<> &IRB, Function &F, Instruction &RI,
466  AllocaInst *StackGuardSlot, Value *StackGuard) {
467  Value *V = IRB.CreateLoad(StackPtrTy, StackGuardSlot);
468  Value *Cmp = IRB.CreateICmpNE(StackGuard, V);
469 
471  auto FailureProb = BranchProbabilityInfo::getBranchProbStackProtector(false);
472  MDNode *Weights = MDBuilder(F.getContext())
473  .createBranchWeights(SuccessProb.getNumerator(),
474  FailureProb.getNumerator());
475  Instruction *CheckTerm =
476  SplitBlockAndInsertIfThen(Cmp, &RI, /* Unreachable */ true, Weights, DTU);
477  IRBuilder<> IRBFail(CheckTerm);
478  // FIXME: respect -fsanitize-trap / -ftrap-function here?
479  FunctionCallee StackChkFail =
480  F.getParent()->getOrInsertFunction("__stack_chk_fail", IRB.getVoidTy());
481  IRBFail.CreateCall(StackChkFail, {});
482 }
483 
484 /// We explicitly compute and set the unsafe stack layout for all unsafe
485 /// static alloca instructions. We save the unsafe "base pointer" in the
486 /// prologue into a local variable and restore it in the epilogue.
487 Value *SafeStack::moveStaticAllocasToUnsafeStack(
488  IRBuilder<> &IRB, Function &F, ArrayRef<AllocaInst *> StaticAllocas,
489  ArrayRef<Argument *> ByValArguments, Instruction *BasePointer,
490  AllocaInst *StackGuardSlot) {
491  if (StaticAllocas.empty() && ByValArguments.empty())
492  return BasePointer;
493 
494  DIBuilder DIB(*F.getParent());
495 
496  StackLifetime SSC(F, StaticAllocas, StackLifetime::LivenessType::May);
497  static const StackLifetime::LiveRange NoColoringRange(1, true);
498  if (ClColoring)
499  SSC.run();
500 
501  for (auto *I : SSC.getMarkers()) {
502  auto *Op = dyn_cast<Instruction>(I->getOperand(1));
503  const_cast<IntrinsicInst *>(I)->eraseFromParent();
504  // Remove the operand bitcast, too, if it has no more uses left.
505  if (Op && Op->use_empty())
506  Op->eraseFromParent();
507  }
508 
509  // Unsafe stack always grows down.
510  StackLayout SSL(StackAlignment);
511  if (StackGuardSlot) {
512  Type *Ty = StackGuardSlot->getAllocatedType();
513  Align Align = std::max(DL.getPrefTypeAlign(Ty), StackGuardSlot->getAlign());
514  SSL.addObject(StackGuardSlot, getStaticAllocaAllocationSize(StackGuardSlot),
515  Align, SSC.getFullLiveRange());
516  }
517 
518  for (Argument *Arg : ByValArguments) {
519  Type *Ty = Arg->getParamByValType();
520  uint64_t Size = DL.getTypeStoreSize(Ty);
521  if (Size == 0)
522  Size = 1; // Don't create zero-sized stack objects.
523 
524  // Ensure the object is properly aligned.
525  Align Align = DL.getPrefTypeAlign(Ty);
526  if (auto A = Arg->getParamAlign())
527  Align = std::max(Align, *A);
528  SSL.addObject(Arg, Size, Align, SSC.getFullLiveRange());
529  }
530 
531  for (AllocaInst *AI : StaticAllocas) {
532  Type *Ty = AI->getAllocatedType();
533  uint64_t Size = getStaticAllocaAllocationSize(AI);
534  if (Size == 0)
535  Size = 1; // Don't create zero-sized stack objects.
536 
537  // Ensure the object is properly aligned.
538  Align Align = std::max(DL.getPrefTypeAlign(Ty), AI->getAlign());
539 
540  SSL.addObject(AI, Size, Align,
541  ClColoring ? SSC.getLiveRange(AI) : NoColoringRange);
542  }
543 
544  SSL.computeLayout();
545  Align FrameAlignment = SSL.getFrameAlignment();
546 
547  // FIXME: tell SSL that we start at a less-then-MaxAlignment aligned location
548  // (AlignmentSkew).
549  if (FrameAlignment > StackAlignment) {
550  // Re-align the base pointer according to the max requested alignment.
551  IRB.SetInsertPoint(BasePointer->getNextNode());
552  BasePointer = cast<Instruction>(IRB.CreateIntToPtr(
553  IRB.CreateAnd(
554  IRB.CreatePtrToInt(BasePointer, IntPtrTy),
555  ConstantInt::get(IntPtrTy, ~(FrameAlignment.value() - 1))),
556  StackPtrTy));
557  }
558 
559  IRB.SetInsertPoint(BasePointer->getNextNode());
560 
561  if (StackGuardSlot) {
562  unsigned Offset = SSL.getObjectOffset(StackGuardSlot);
563  Value *Off = IRB.CreateGEP(Int8Ty, BasePointer, // BasePointer is i8*
564  ConstantInt::get(Int32Ty, -Offset));
565  Value *NewAI =
566  IRB.CreateBitCast(Off, StackGuardSlot->getType(), "StackGuardSlot");
567 
568  // Replace alloc with the new location.
569  StackGuardSlot->replaceAllUsesWith(NewAI);
570  StackGuardSlot->eraseFromParent();
571  }
572 
573  for (Argument *Arg : ByValArguments) {
574  unsigned Offset = SSL.getObjectOffset(Arg);
575  MaybeAlign Align(SSL.getObjectAlignment(Arg));
576  Type *Ty = Arg->getParamByValType();
577 
578  uint64_t Size = DL.getTypeStoreSize(Ty);
579  if (Size == 0)
580  Size = 1; // Don't create zero-sized stack objects.
581 
582  Value *Off = IRB.CreateGEP(Int8Ty, BasePointer, // BasePointer is i8*
583  ConstantInt::get(Int32Ty, -Offset));
584  Value *NewArg = IRB.CreateBitCast(Off, Arg->getType(),
585  Arg->getName() + ".unsafe-byval");
586 
587  // Replace alloc with the new location.
589  -Offset);
590  Arg->replaceAllUsesWith(NewArg);
591  IRB.SetInsertPoint(cast<Instruction>(NewArg)->getNextNode());
592  IRB.CreateMemCpy(Off, Align, Arg, Arg->getParamAlign(), Size);
593  }
594 
595  // Allocate space for every unsafe static AllocaInst on the unsafe stack.
596  for (AllocaInst *AI : StaticAllocas) {
597  IRB.SetInsertPoint(AI);
598  unsigned Offset = SSL.getObjectOffset(AI);
599 
600  replaceDbgDeclare(AI, BasePointer, DIB, DIExpression::ApplyOffset, -Offset);
601  replaceDbgValueForAlloca(AI, BasePointer, DIB, -Offset);
602 
603  // Replace uses of the alloca with the new location.
604  // Insert address calculation close to each use to work around PR27844.
605  std::string Name = std::string(AI->getName()) + ".unsafe";
606  while (!AI->use_empty()) {
607  Use &U = *AI->use_begin();
608  Instruction *User = cast<Instruction>(U.getUser());
609 
610  Instruction *InsertBefore;
611  if (auto *PHI = dyn_cast<PHINode>(User))
612  InsertBefore = PHI->getIncomingBlock(U)->getTerminator();
613  else
614  InsertBefore = User;
615 
616  IRBuilder<> IRBUser(InsertBefore);
617  Value *Off = IRBUser.CreateGEP(Int8Ty, BasePointer, // BasePointer is i8*
618  ConstantInt::get(Int32Ty, -Offset));
619  Value *Replacement = IRBUser.CreateBitCast(Off, AI->getType(), Name);
620 
621  if (auto *PHI = dyn_cast<PHINode>(User))
622  // PHI nodes may have multiple incoming edges from the same BB (why??),
623  // all must be updated at once with the same incoming value.
624  PHI->setIncomingValueForBlock(PHI->getIncomingBlock(U), Replacement);
625  else
626  U.set(Replacement);
627  }
628 
629  AI->eraseFromParent();
630  }
631 
632  // Re-align BasePointer so that our callees would see it aligned as
633  // expected.
634  // FIXME: no need to update BasePointer in leaf functions.
635  unsigned FrameSize = alignTo(SSL.getFrameSize(), StackAlignment);
636 
637  MDBuilder MDB(F.getContext());
639  Data.push_back(MDB.createString("unsafe-stack-size"));
640  Data.push_back(MDB.createConstant(ConstantInt::get(Int32Ty, FrameSize)));
641  MDNode *MD = MDTuple::get(F.getContext(), Data);
642  F.setMetadata(LLVMContext::MD_annotation, MD);
643 
644  // Update shadow stack pointer in the function epilogue.
645  IRB.SetInsertPoint(BasePointer->getNextNode());
646 
647  Value *StaticTop =
648  IRB.CreateGEP(Int8Ty, BasePointer, ConstantInt::get(Int32Ty, -FrameSize),
649  "unsafe_stack_static_top");
650  IRB.CreateStore(StaticTop, UnsafeStackPtr);
651  return StaticTop;
652 }
653 
654 void SafeStack::moveDynamicAllocasToUnsafeStack(
655  Function &F, Value *UnsafeStackPtr, AllocaInst *DynamicTop,
656  ArrayRef<AllocaInst *> DynamicAllocas) {
657  DIBuilder DIB(*F.getParent());
658 
659  for (AllocaInst *AI : DynamicAllocas) {
660  IRBuilder<> IRB(AI);
661 
662  // Compute the new SP value (after AI).
663  Value *ArraySize = AI->getArraySize();
664  if (ArraySize->getType() != IntPtrTy)
665  ArraySize = IRB.CreateIntCast(ArraySize, IntPtrTy, false);
666 
667  Type *Ty = AI->getAllocatedType();
668  uint64_t TySize = DL.getTypeAllocSize(Ty);
669  Value *Size = IRB.CreateMul(ArraySize, ConstantInt::get(IntPtrTy, TySize));
670 
671  Value *SP = IRB.CreatePtrToInt(IRB.CreateLoad(StackPtrTy, UnsafeStackPtr),
672  IntPtrTy);
673  SP = IRB.CreateSub(SP, Size);
674 
675  // Align the SP value to satisfy the AllocaInst, type and stack alignments.
676  auto Align = std::max(std::max(DL.getPrefTypeAlign(Ty), AI->getAlign()),
677  StackAlignment);
678 
679  Value *NewTop = IRB.CreateIntToPtr(
680  IRB.CreateAnd(SP,
681  ConstantInt::get(IntPtrTy, ~uint64_t(Align.value() - 1))),
682  StackPtrTy);
683 
684  // Save the stack pointer.
685  IRB.CreateStore(NewTop, UnsafeStackPtr);
686  if (DynamicTop)
687  IRB.CreateStore(NewTop, DynamicTop);
688 
689  Value *NewAI = IRB.CreatePointerCast(NewTop, AI->getType());
690  if (AI->hasName() && isa<Instruction>(NewAI))
691  NewAI->takeName(AI);
692 
693  replaceDbgDeclare(AI, NewAI, DIB, DIExpression::ApplyOffset, 0);
694  AI->replaceAllUsesWith(NewAI);
695  AI->eraseFromParent();
696  }
697 
698  if (!DynamicAllocas.empty()) {
699  // Now go through the instructions again, replacing stacksave/stackrestore.
701  auto *II = dyn_cast<IntrinsicInst>(&I);
702  if (!II)
703  continue;
704 
705  if (II->getIntrinsicID() == Intrinsic::stacksave) {
706  IRBuilder<> IRB(II);
707  Instruction *LI = IRB.CreateLoad(StackPtrTy, UnsafeStackPtr);
708  LI->takeName(II);
709  II->replaceAllUsesWith(LI);
710  II->eraseFromParent();
711  } else if (II->getIntrinsicID() == Intrinsic::stackrestore) {
712  IRBuilder<> IRB(II);
713  Instruction *SI = IRB.CreateStore(II->getArgOperand(0), UnsafeStackPtr);
714  SI->takeName(II);
715  assert(II->use_empty());
716  II->eraseFromParent();
717  }
718  }
719  }
720 }
721 
722 bool SafeStack::ShouldInlinePointerAddress(CallInst &CI) {
724  if (CI.hasFnAttr(Attribute::AlwaysInline) &&
725  isInlineViable(*Callee).isSuccess())
726  return true;
727  if (Callee->isInterposable() || Callee->hasFnAttribute(Attribute::NoInline) ||
728  CI.isNoInline())
729  return false;
730  return true;
731 }
732 
733 void SafeStack::TryInlinePointerAddress() {
734  auto *CI = dyn_cast<CallInst>(UnsafeStackPtr);
735  if (!CI)
736  return;
737 
738  if(F.hasOptNone())
739  return;
740 
742  if (!Callee || Callee->isDeclaration())
743  return;
744 
745  if (!ShouldInlinePointerAddress(*CI))
746  return;
747 
748  InlineFunctionInfo IFI;
749  InlineFunction(*CI, IFI);
750 }
751 
752 bool SafeStack::run() {
753  assert(F.hasFnAttribute(Attribute::SafeStack) &&
754  "Can't run SafeStack on a function without the attribute");
755  assert(!F.isDeclaration() && "Can't run SafeStack on a function declaration");
756 
757  ++NumFunctions;
758 
759  SmallVector<AllocaInst *, 16> StaticAllocas;
760  SmallVector<AllocaInst *, 4> DynamicAllocas;
761  SmallVector<Argument *, 4> ByValArguments;
763 
764  // Collect all points where stack gets unwound and needs to be restored
765  // This is only necessary because the runtime (setjmp and unwind code) is
766  // not aware of the unsafe stack and won't unwind/restore it properly.
767  // To work around this problem without changing the runtime, we insert
768  // instrumentation to restore the unsafe stack pointer when necessary.
769  SmallVector<Instruction *, 4> StackRestorePoints;
770 
771  // Find all static and dynamic alloca instructions that must be moved to the
772  // unsafe stack, all return instructions and stack restore points.
773  findInsts(F, StaticAllocas, DynamicAllocas, ByValArguments, Returns,
774  StackRestorePoints);
775 
776  if (StaticAllocas.empty() && DynamicAllocas.empty() &&
777  ByValArguments.empty() && StackRestorePoints.empty())
778  return false; // Nothing to do in this function.
779 
780  if (!StaticAllocas.empty() || !DynamicAllocas.empty() ||
781  !ByValArguments.empty())
782  ++NumUnsafeStackFunctions; // This function has the unsafe stack.
783 
784  if (!StackRestorePoints.empty())
785  ++NumUnsafeStackRestorePointsFunctions;
786 
787  IRBuilder<> IRB(&F.front(), F.begin()->getFirstInsertionPt());
788  // Calls must always have a debug location, or else inlining breaks. So
789  // we explicitly set a artificial debug location here.
790  if (DISubprogram *SP = F.getSubprogram())
792  DILocation::get(SP->getContext(), SP->getScopeLine(), 0, SP));
794  FunctionCallee Fn = F.getParent()->getOrInsertFunction(
795  "__safestack_pointer_address", StackPtrTy->getPointerTo(0));
796  UnsafeStackPtr = IRB.CreateCall(Fn);
797  } else {
798  UnsafeStackPtr = TL.getSafeStackPointerLocation(IRB);
799  }
800 
801  // Load the current stack pointer (we'll also use it as a base pointer).
802  // FIXME: use a dedicated register for it ?
803  Instruction *BasePointer =
804  IRB.CreateLoad(StackPtrTy, UnsafeStackPtr, false, "unsafe_stack_ptr");
805  assert(BasePointer->getType() == StackPtrTy);
806 
807  AllocaInst *StackGuardSlot = nullptr;
808  // FIXME: implement weaker forms of stack protector.
809  if (F.hasFnAttribute(Attribute::StackProtect) ||
810  F.hasFnAttribute(Attribute::StackProtectStrong) ||
811  F.hasFnAttribute(Attribute::StackProtectReq)) {
812  Value *StackGuard = getStackGuard(IRB, F);
813  StackGuardSlot = IRB.CreateAlloca(StackPtrTy, nullptr);
814  IRB.CreateStore(StackGuard, StackGuardSlot);
815 
816  for (Instruction *RI : Returns) {
817  IRBuilder<> IRBRet(RI);
818  checkStackGuard(IRBRet, F, *RI, StackGuardSlot, StackGuard);
819  }
820  }
821 
822  // The top of the unsafe stack after all unsafe static allocas are
823  // allocated.
824  Value *StaticTop = moveStaticAllocasToUnsafeStack(
825  IRB, F, StaticAllocas, ByValArguments, BasePointer, StackGuardSlot);
826 
827  // Safe stack object that stores the current unsafe stack top. It is updated
828  // as unsafe dynamic (non-constant-sized) allocas are allocated and freed.
829  // This is only needed if we need to restore stack pointer after longjmp
830  // or exceptions, and we have dynamic allocations.
831  // FIXME: a better alternative might be to store the unsafe stack pointer
832  // before setjmp / invoke instructions.
833  AllocaInst *DynamicTop = createStackRestorePoints(
834  IRB, F, StackRestorePoints, StaticTop, !DynamicAllocas.empty());
835 
836  // Handle dynamic allocas.
837  moveDynamicAllocasToUnsafeStack(F, UnsafeStackPtr, DynamicTop,
838  DynamicAllocas);
839 
840  // Restore the unsafe stack pointer before each return.
841  for (Instruction *RI : Returns) {
842  IRB.SetInsertPoint(RI);
843  IRB.CreateStore(BasePointer, UnsafeStackPtr);
844  }
845 
846  TryInlinePointerAddress();
847 
848  LLVM_DEBUG(dbgs() << "[SafeStack] safestack applied\n");
849  return true;
850 }
851 
852 class SafeStackLegacyPass : public FunctionPass {
853  const TargetMachine *TM = nullptr;
854 
855 public:
856  static char ID; // Pass identification, replacement for typeid..
857 
858  SafeStackLegacyPass() : FunctionPass(ID) {
860  }
861 
862  void getAnalysisUsage(AnalysisUsage &AU) const override {
867  }
868 
869  bool runOnFunction(Function &F) override {
870  LLVM_DEBUG(dbgs() << "[SafeStack] Function: " << F.getName() << "\n");
871 
872  if (!F.hasFnAttribute(Attribute::SafeStack)) {
873  LLVM_DEBUG(dbgs() << "[SafeStack] safestack is not requested"
874  " for this function\n");
875  return false;
876  }
877 
878  if (F.isDeclaration()) {
879  LLVM_DEBUG(dbgs() << "[SafeStack] function definition"
880  " is not available\n");
881  return false;
882  }
883 
884  TM = &getAnalysis<TargetPassConfig>().getTM<TargetMachine>();
885  auto *TL = TM->getSubtargetImpl(F)->getTargetLowering();
886  if (!TL)
887  report_fatal_error("TargetLowering instance is required");
888 
889  auto *DL = &F.getParent()->getDataLayout();
890  auto &TLI = getAnalysis<TargetLibraryInfoWrapperPass>().getTLI(F);
891  auto &ACT = getAnalysis<AssumptionCacheTracker>().getAssumptionCache(F);
892 
893  // Compute DT and LI only for functions that have the attribute.
894  // This is only useful because the legacy pass manager doesn't let us
895  // compute analyzes lazily.
896 
897  DominatorTree *DT;
898  bool ShouldPreserveDominatorTree;
899  Optional<DominatorTree> LazilyComputedDomTree;
900 
901  // Do we already have a DominatorTree avaliable from the previous pass?
902  // Note that we should *NOT* require it, to avoid the case where we end up
903  // not needing it, but the legacy PM would have computed it for us anyways.
904  if (auto *DTWP = getAnalysisIfAvailable<DominatorTreeWrapperPass>()) {
905  DT = &DTWP->getDomTree();
906  ShouldPreserveDominatorTree = true;
907  } else {
908  // Otherwise, we need to compute it.
909  LazilyComputedDomTree.emplace(F);
910  DT = LazilyComputedDomTree.getPointer();
911  ShouldPreserveDominatorTree = false;
912  }
913 
914  // Likewise, lazily compute loop info.
915  LoopInfo LI(*DT);
916 
918 
919  ScalarEvolution SE(F, TLI, ACT, *DT, LI);
920 
921  return SafeStack(F, *TL, *DL, ShouldPreserveDominatorTree ? &DTU : nullptr,
922  SE)
923  .run();
924  }
925 };
926 
927 } // end anonymous namespace
928 
929 char SafeStackLegacyPass::ID = 0;
930 
931 INITIALIZE_PASS_BEGIN(SafeStackLegacyPass, DEBUG_TYPE,
932  "Safe Stack instrumentation pass", false, false)
935 INITIALIZE_PASS_END(SafeStackLegacyPass, DEBUG_TYPE,
936  "Safe Stack instrumentation pass", false, false)
937 
938 FunctionPass *llvm::createSafeStackPass() { return new SafeStackLegacyPass(); }
llvm::Check::Size
@ Size
Definition: FileCheck.h:77
llvm::alignTo
uint64_t alignTo(uint64_t Size, Align A)
Returns a multiple of A needed to store Size bytes.
Definition: Alignment.h:156
Int32Ty
IntegerType * Int32Ty
Definition: NVVMIntrRange.cpp:67
llvm::Argument
This class represents an incoming formal argument to a Function.
Definition: Argument.h:28
AssumptionCache.h
llvm::IRBuilderBase::CreateIntCast
Value * CreateIntCast(Value *V, Type *DestTy, bool isSigned, const Twine &Name="")
Definition: IRBuilder.h:2021
llvm::IRBuilderBase::CreateStore
StoreInst * CreateStore(Value *Val, Value *Ptr, bool isVolatile=false)
Definition: IRBuilder.h:1662
instrumentation
xray instrumentation
Definition: XRayInstrumentation.cpp:268
MI
IRTranslator LLVM IR MI
Definition: IRTranslator.cpp:104
MathExtras.h
llvm::IRBuilderBase::SetInsertPoint
void SetInsertPoint(BasicBlock *TheBB)
This specifies that created instructions should be appended to the end of the specified block.
Definition: IRBuilder.h:179
llvm
This is an optimization pass for GlobalISel generic memory operations.
Definition: AddressRanges.h:17
llvm::TargetLoweringBase
This base class for TargetLowering contains the SelectionDAG-independent parts that can be used from ...
Definition: TargetLowering.h:191
M
We currently emits eax Perhaps this is what we really should generate is Is imull three or four cycles eax eax The current instruction priority is based on pattern complexity The former is more complex because it folds a load so the latter will not be emitted Perhaps we should use AddedComplexity to give LEA32r a higher priority We should always try to match LEA first since the LEA matching code does some estimate to determine whether the match is profitable if we care more about code then imull is better It s two bytes shorter than movl leal On a Pentium M
Definition: README.txt:252
llvm::DataLayout
A parsed version of the target data layout string in and methods for querying it.
Definition: DataLayout.h:113
llvm::Intrinsic::getDeclaration
Function * getDeclaration(Module *M, ID id, ArrayRef< Type * > Tys=None)
Create or insert an LLVM Function declaration for an intrinsic, and return it.
Definition: Function.cpp:1419
Metadata.h
llvm::AllocaInst::getAlign
Align getAlign() const
Return the alignment of the memory that is being allocated by the instruction.
Definition: Instructions.h:121
IntrinsicInst.h
llvm::DIBuilder
Definition: DIBuilder.h:41
InstIterator.h
llvm::Function
Definition: Function.h:60
llvm::IRBuilderBase::CreatePtrToInt
Value * CreatePtrToInt(Value *V, Type *DestTy, const Twine &Name="")
Definition: IRBuilder.h:1942
Pass.h
llvm::AllocaInst::getType
PointerType * getType() const
Overload to return most specific pointer type.
Definition: Instructions.h:100
llvm::ilist_node_with_parent::getNextNode
NodeTy * getNextNode()
Get the next node, or nullptr for the list tail.
Definition: ilist_node.h:289
llvm::SmallVector
This is a 'vector' (really, a variable-sized array), optimized for the case when the array is small.
Definition: SmallVector.h:1185
Statistic.h
llvm::Value::hasName
bool hasName() const
Definition: Value.h:261
ErrorHandling.h
llvm::IRBuilder<>
DomTreeUpdater.h
llvm::ScalarEvolution
The main scalar evolution driver.
Definition: ScalarEvolution.h:449
Local.h
llvm::DominatorTree
Concrete subclass of DominatorTreeBase that is used to compute a normal dominator tree.
Definition: Dominators.h:166
llvm::CallBase::hasFnAttr
bool hasFnAttr(Attribute::AttrKind Kind) const
Determine whether this call has the given attribute.
Definition: InstrTypes.h:1483
llvm::cl::Hidden
@ Hidden
Definition: CommandLine.h:139
APInt.h
ScalarEvolution.h
llvm::Type
The instances of the Type class are immutable: once they are created, they are never changed.
Definition: Type.h:45
Module.h
llvm::MemIntrinsic
This is the common base class for memset/memcpy/memmove.
Definition: IntrinsicInst.h:957
llvm::Optional
Definition: APInt.h:33
llvm::isInlineViable
InlineResult isInlineViable(Function &Callee)
Minimal filter to detect invalid constructs for inlining.
Definition: InlineCost.cpp:2942
llvm::SmallPtrSet
SmallPtrSet - This class implements a set which is optimized for holding SmallSize or less elements.
Definition: SmallPtrSet.h:450
llvm::max
Expected< ExpressionValue > max(const ExpressionValue &Lhs, const ExpressionValue &Rhs)
Definition: FileCheck.cpp:337
llvm::MipsISD::Ret
@ Ret
Definition: MipsISelLowering.h:119
llvm::CallBase::arg_begin
User::op_iterator arg_begin()
Return the iterator pointing to the beginning of the argument list.
Definition: InstrTypes.h:1316
llvm::SmallVectorImpl::pop_back_val
LLVM_NODISCARD T pop_back_val()
Definition: SmallVector.h:654
llvm::safestack::StackLayout
Compute the layout of an unsafe stack frame.
Definition: SafeStackLayout.h:24
llvm::IRBuilderBase::CreateAlloca
AllocaInst * CreateAlloca(Type *Ty, unsigned AddrSpace, Value *ArraySize=nullptr, const Twine &Name="")
Definition: IRBuilder.h:1632
Use.h
llvm::Data
@ Data
Definition: SIMachineScheduler.h:55
llvm::IRBuilderBase::CreateIntToPtr
Value * CreateIntToPtr(Value *V, Type *DestTy, const Twine &Name="")
Definition: IRBuilder.h:1947
llvm::ArrayRef::empty
bool empty() const
empty - Check if the array is empty.
Definition: ArrayRef.h:159
LLVM_DEBUG
#define LLVM_DEBUG(X)
Definition: Debug.h:101
llvm::MDNode::get
static MDTuple * get(LLVMContext &Context, ArrayRef< Metadata * > MDs)
Definition: Metadata.h:1384
F
#define F(x, y, z)
Definition: MD5.cpp:55
llvm::DomTreeUpdater::UpdateStrategy::Lazy
@ Lazy
llvm::Optional::getPointer
constexpr const T * getPointer() const
Definition: Optional.h:303
llvm::dbgs
raw_ostream & dbgs()
dbgs() - This returns a reference to a raw_ostream for debugging messages.
Definition: Debug.cpp:163
Arg
amdgpu Simplify well known AMD library false FunctionCallee Value * Arg
Definition: AMDGPULibCalls.cpp:186
Instruction.h
llvm::SPII::Load
@ Load
Definition: SparcInstrInfo.h:32
TargetLowering.h
llvm::AllocaInst::isStaticAlloca
bool isStaticAlloca() const
Return true if this alloca is in the entry block of the function and is a constant size.
Definition: Instructions.cpp:1419
llvm::initializeSafeStackLegacyPassPass
void initializeSafeStackLegacyPassPass(PassRegistry &)
llvm::IRBuilderBase::CreateMul
Value * CreateMul(Value *LHS, Value *RHS, const Twine &Name="", bool HasNUW=false, bool HasNSW=false)
Definition: IRBuilder.h:1234
StackLifetime.h
TargetMachine.h
llvm::PassRegistry::getPassRegistry
static PassRegistry * getPassRegistry()
getPassRegistry - Access the global registry object, which is automatically initialized at applicatio...
Definition: PassRegistry.cpp:31
Constants.h
llvm::AllocaInst::getAllocatedType
Type * getAllocatedType() const
Return the type that is being allocated by the instruction.
Definition: Instructions.h:114
E
static GCRegistry::Add< CoreCLRGC > E("coreclr", "CoreCLR-compatible GC")
llvm::IRBuilderBase::CreateGEP
Value * CreateGEP(Type *Ty, Value *Ptr, ArrayRef< Value * > IdxList, const Twine &Name="", bool IsInBounds=false)
Definition: IRBuilder.h:1725
llvm::DIExpression::ApplyOffset
@ ApplyOffset
Definition: DebugInfoMetadata.h:2763
ClColoring
static cl::opt< bool > ClColoring("safe-stack-coloring", cl::desc("enable safe stack coloring"), cl::Hidden, cl::init(true))
llvm::User
Definition: User.h:44
Intrinsics.h
C
(vector float) vec_cmpeq(*A, *B) C
Definition: README_ALTIVEC.txt:86
SafeStackUsePointerAddress
static cl::opt< bool > SafeStackUsePointerAddress("safestack-use-pointer-address", cl::init(false), cl::Hidden)
Use __safestack_pointer_address even if the platform has a faster way of access safe stack pointer.
llvm::ARM_PROC::A
@ A
Definition: ARMBaseInfo.h:34
llvm::CallBase::getCalledFunction
Function * getCalledFunction() const
Returns the function called, or null if this is an indirect function invocation or the function signa...
Definition: InstrTypes.h:1396
llvm::IRBuilderBase::CreateLoad
LoadInst * CreateLoad(Type *Ty, Value *Ptr, const char *Name)
Provided to resolve 'CreateLoad(Ty, Ptr, "...")' correctly, instead of converting the string to 'bool...
Definition: IRBuilder.h:1649
llvm::MDBuilder::createBranchWeights
MDNode * createBranchWeights(uint32_t TrueWeight, uint32_t FalseWeight)
Return metadata containing two branch weights.
Definition: MDBuilder.cpp:37
llvm::AnalysisUsage
Represent the analysis usage information of a pass.
Definition: PassAnalysisSupport.h:47
TargetLibraryInfo.h
llvm::Value::uses
iterator_range< use_iterator > uses()
Definition: Value.h:376
false
Definition: StackSlotColoring.cpp:141
llvm::IRBuilderBase::SetCurrentDebugLocation
void SetCurrentDebugLocation(DebugLoc L)
Set location information used by debugging information.
Definition: IRBuilder.h:203
llvm::MaybeAlign
This struct is a compact representation of a valid (power of two) or undefined (0) alignment.
Definition: Alignment.h:117
B
static GCRegistry::Add< OcamlGC > B("ocaml", "ocaml 3.10-compatible GC")
llvm::Instruction
Definition: Instruction.h:42
llvm::DominatorTreeWrapperPass
Legacy analysis pass which computes a DominatorTree.
Definition: Dominators.h:302
MDBuilder.h
llvm::AllocaInst::getArraySize
const Value * getArraySize() const
Get the number of elements allocated.
Definition: Instructions.h:96
llvm::report_fatal_error
void report_fatal_error(Error Err, bool gen_crash_diag=true)
Report a serious error, calling any installed error handler.
Definition: Error.cpp:143
llvm::STATISTIC
STATISTIC(NumFunctions, "Total number of functions")
llvm::InlineResult::isSuccess
bool isSuccess() const
Definition: InlineCost.h:173
llvm::DomTreeUpdater
Definition: DomTreeUpdater.h:28
llvm::ConstantInt::get
static Constant * get(Type *Ty, uint64_t V, bool IsSigned=false)
If Ty is a vector type, return a Constant with a splat of the given value.
Definition: Constants.cpp:926
llvm::Use::getUser
User * getUser() const
Returns the User that contains this Use.
Definition: Use.h:72
SmallPtrSet.h
llvm::ConstantRange::add
ConstantRange add(const ConstantRange &Other) const
Return a new range representing the possible values resulting from an addition of a value in this ran...
Definition: ConstantRange.cpp:989
Align
uint64_t Align
Definition: ELFObjHandler.cpp:81
llvm::Align
This struct is a compact representation of a valid (non-zero power of two) alignment.
Definition: Alignment.h:39
llvm::MCID::Call
@ Call
Definition: MCInstrDesc.h:155
llvm::SPII::Store
@ Store
Definition: SparcInstrInfo.h:33
llvm::Value::use_empty
bool use_empty() const
Definition: Value.h:344
llvm::CallingConv::ID
unsigned ID
LLVM IR allows to use arbitrary numbers as calling convention identifiers.
Definition: CallingConv.h:24
llvm::BranchProbabilityInfo::getBranchProbStackProtector
static BranchProbability getBranchProbStackProtector(bool IsLikely)
Definition: BranchProbabilityInfo.h:192
Type.h
llvm::IRBuilderBase::CreateAnd
Value * CreateAnd(Value *LHS, Value *RHS, const Twine &Name="")
Definition: IRBuilder.h:1348
llvm::IRBuilderBase::CreatePointerCast
Value * CreatePointerCast(Value *V, Type *DestTy, const Twine &Name="")
Definition: IRBuilder.h:1998
INITIALIZE_PASS_END
#define INITIALIZE_PASS_END(passName, arg, name, cfg, analysis)
Definition: PassSupport.h:58
llvm::dxil::PointerTypeAnalysis::run
PointerTypeMap run(const Module &M)
Compute the PointerTypeMap for the module M.
Definition: PointerTypeAnalysis.cpp:101
LoopInfo.h
llvm::TargetPassConfig
Target-Independent Code Generator Pass Configuration Options.
Definition: TargetPassConfig.h:84
llvm::StackLifetime::LivenessType::May
@ May
llvm::Use::set
void set(Value *Val)
Definition: Value.h:868
llvm::cl::opt< bool >
llvm::SCEV
This class represents an analyzed expression in the program.
Definition: ScalarEvolution.h:75
llvm::instructions
inst_range instructions(Function *F)
Definition: InstIterator.h:133
llvm::IRBuilderBase::CreateBitCast
Value * CreateBitCast(Value *V, Type *DestTy, const Twine &Name="")
Definition: IRBuilder.h:1952
llvm::Instruction::eraseFromParent
SymbolTableList< Instruction >::iterator eraseFromParent()
This method unlinks 'this' from the containing basic block and deletes it.
Definition: Instruction.cpp:77
BranchProbabilityInfo.h
llvm::AMDGPU::Hwreg::Offset
Offset
Definition: SIDefines.h:416
llvm::CallBase::doesNotAccessMemory
bool doesNotAccessMemory(unsigned OpNo) const
Definition: InstrTypes.h:1714
llvm::TargetLibraryInfoWrapperPass
Definition: TargetLibraryInfo.h:468
uint64_t
Addr
uint64_t Addr
Definition: ELFObjHandler.cpp:78
INITIALIZE_PASS_DEPENDENCY
INITIALIZE_PASS_DEPENDENCY(DominatorTreeWrapperPass)
llvm::Optional::emplace
void emplace(ArgTypes &&... Args)
Create a new object by constructing it in place with the given arguments.
Definition: Optional.h:287
I
#define I(x, y, z)
Definition: MD5.cpp:58
Cloning.h
llvm::cl::init
initializer< Ty > init(const Ty &Val)
Definition: CommandLine.h:432
llvm::make_early_inc_range
iterator_range< early_inc_iterator_impl< detail::IterOfRange< RangeT > > > make_early_inc_range(RangeT &&Range)
Make a range that does early increment to allow mutation of the underlying range without disrupting i...
Definition: STLExtras.h:618
DIBuilder.h
llvm::StackLifetime
Compute live ranges of allocas.
Definition: StackLifetime.h:37
ArrayRef.h
llvm::CallBase::doesNotCapture
bool doesNotCapture(unsigned OpNo) const
Determine whether this data operand is not captured.
Definition: InstrTypes.h:1673
TargetPassConfig.h
IRBuilder.h
assert
assert(ImpDefSCC.getReg()==AMDGPU::SCC &&ImpDefSCC.isDef())
llvm::TargetMachine
Primary interface to the complete machine description for the target machine.
Definition: TargetMachine.h:77
SI
StandardInstrumentations SI(Debug, VerifyEach)
InlineCost.h
llvm::Value::use_begin
use_iterator use_begin()
Definition: Value.h:360
llvm::MDTuple::get
static MDTuple * get(LLVMContext &Context, ArrayRef< Metadata * > MDs)
Definition: Metadata.h:1341
llvm::Module
A Module instance is used to store all the information related to an LLVM module.
Definition: Module.h:65
llvm::MDNode
Metadata node.
Definition: Metadata.h:944
llvm::safestack
Definition: SafeStackLayout.h:21
llvm::AMDGPU::IsaInfo::TargetIDSetting::Off
@ Off
llvm::CallBase::arg_end
User::op_iterator arg_end()
Return the iterator pointing to the end of the argument list.
Definition: InstrTypes.h:1322
llvm::APInt
Class for arbitrary precision integers.
Definition: APInt.h:75
llvm::AssumptionCacheTracker
An immutable pass that tracks lazily created AssumptionCache objects.
Definition: AssumptionCache.h:202
llvm::ArrayRef
ArrayRef - Represent a constant reference to an array (0 or more elements consecutively in memory),...
Definition: APInt.h:32
llvm::LoopInfo
Definition: LoopInfo.h:1102
DataLayout.h
llvm::StackLifetime::LiveRange
This class represents a set of interesting instructions where an alloca is live.
Definition: StackLifetime.h:63
llvm::Value::getType
Type * getType() const
All values are typed, get the type of this value.
Definition: Value.h:255
llvm::AnalysisUsage::addPreserved
AnalysisUsage & addPreserved()
Add the specified Pass class to the set of analyses preserved by this pass.
Definition: PassAnalysisSupport.h:98
llvm::Value::replaceAllUsesWith
void replaceAllUsesWith(Value *V)
Change all uses of this to point to a new Value.
Definition: Value.cpp:529
llvm::Value::getContext
LLVMContext & getContext() const
All values hold a context through their type.
Definition: Value.cpp:991
llvm::AllocaInst::isArrayAllocation
bool isArrayAllocation() const
Return true if there is an allocation size parameter to the allocation instruction that is not 1.
Definition: Instructions.cpp:1410
TargetSubtargetInfo.h
DL
MachineBasicBlock MachineBasicBlock::iterator DebugLoc DL
Definition: AArch64SLSHardening.cpp:76
ConstantRange.h
INITIALIZE_PASS_BEGIN
INITIALIZE_PASS_BEGIN(SafeStackLegacyPass, DEBUG_TYPE, "Safe Stack instrumentation pass", false, false) INITIALIZE_PASS_END(SafeStackLegacyPass
llvm::Value::getName
StringRef getName() const
Return a constant reference to the value's name.
Definition: Value.cpp:305
pass
Safe Stack instrumentation pass
Definition: SafeStack.cpp:936
llvm::replaceDbgValueForAlloca
void replaceDbgValueForAlloca(AllocaInst *AI, Value *NewAllocaAddress, DIBuilder &Builder, int Offset=0)
Replaces multiple llvm.dbg.value instructions when the alloca it describes is replaced with a new val...
Definition: Local.cpp:1728
Argument.h
Callee
amdgpu Simplify well known AMD library false FunctionCallee Callee
Definition: AMDGPULibCalls.cpp:186
Attributes.h
runOnFunction
static bool runOnFunction(Function &F, bool PostInlining)
Definition: EntryExitInstrumenter.cpp:69
llvm::GraphProgram::Name
Name
Definition: GraphWriter.h:50
llvm::IRBuilderBase::CreateMemCpy
CallInst * CreateMemCpy(Value *Dst, MaybeAlign DstAlign, Value *Src, MaybeAlign SrcAlign, uint64_t Size, bool isVolatile=false, MDNode *TBAATag=nullptr, MDNode *TBAAStructTag=nullptr, MDNode *ScopeTag=nullptr, MDNode *NoAliasTag=nullptr)
Create and insert a memcpy between the specified pointers.
Definition: IRBuilder.h:616
llvm::AMDGPU::SendMsg::Op
Op
Definition: SIDefines.h:348
llvm::CallBase::isNoInline
bool isNoInline() const
Return true if the call should not be inlined.
Definition: InstrTypes.h:1848
llvm::X86::FirstMacroFusionInstKind::Cmp
@ Cmp
llvm::Align::value
uint64_t value() const
This is a hole in the type system and should not be abused.
Definition: Alignment.h:85
Casting.h
Function.h
llvm::BitWidth
constexpr unsigned BitWidth
Definition: BitmaskEnum.h:147
llvm::InlineFunctionInfo
This class captures the data input to the InlineFunction call, and records the auxiliary results prod...
Definition: Cloning.h:199
llvm::ConstantRange::contains
bool contains(const APInt &Val) const
Return true if the specified value is in the set.
Definition: ConstantRange.cpp:449
llvm::ConstantRange
This class represents a range of values.
Definition: ConstantRange.h:47
llvm::IntrinsicInst
A wrapper class for inspecting calls to intrinsic functions.
Definition: IntrinsicInst.h:46
llvm::MDBuilder
Definition: MDBuilder.h:35
ScalarEvolutionExpressions.h
Instructions.h
SmallVector.h
Dominators.h
llvm::FunctionCallee
A handy container for a FunctionType+Callee-pointer pair, which can be passed around as a single enti...
Definition: DerivedTypes.h:165
llvm::DISubprogram
Subprogram description.
Definition: DebugInfoMetadata.h:1803
llvm::SmallVectorImpl
This class consists of common code factored out of the SmallVector class to reduce code duplication b...
Definition: APFloat.h:42
llvm::InlineFunction
InlineResult InlineFunction(CallBase &CB, InlineFunctionInfo &IFI, AAResults *CalleeAAR=nullptr, bool InsertLifetime=true, Function *ForwardVarArgsTo=nullptr)
This function inlines the called function into the basic block of the caller.
Definition: InlineFunction.cpp:1757
llvm::CallBase
Base class for all callable instructions (InvokeInst and CallInst) Holds everything related to callin...
Definition: InstrTypes.h:1174
DerivedTypes.h
llvm::SCEV::getType
Type * getType() const
Return the LLVM type of this SCEV expression.
Definition: ScalarEvolution.cpp:392
TM
const char LLVMTargetMachineRef TM
Definition: PassBuilderBindings.cpp:47
llvm::FunctionPass
FunctionPass class - This class is used to implement most global optimizations.
Definition: Pass.h:308
getStackGuard
static Value * getStackGuard(const TargetLoweringBase *TLI, Module *M, IRBuilder<> &B, bool *SupportsSelectionDAGSP=nullptr)
Create a stack guard loading and populate whether SelectionDAG SSP is supported.
Definition: StackProtector.cpp:382
llvm::CallInst
This class represents a function call, abstracting a target machine's calling convention.
Definition: Instructions.h:1461
llvm::IRBuilderBase::getVoidTy
Type * getVoidTy()
Fetch the type representing void.
Definition: IRBuilder.h:539
llvm::IRBuilderBase::CreateICmpNE
Value * CreateICmpNE(Value *LHS, Value *RHS, const Twine &Name="")
Definition: IRBuilder.h:2070
DEBUG_TYPE
#define DEBUG_TYPE
Definition: SafeStack.cpp:76
llvm::AnalysisUsage::addRequired
AnalysisUsage & addRequired()
Definition: PassAnalysisSupport.h:75
llvm::IRBuilderBase::CreateSub
Value * CreateSub(Value *LHS, Value *RHS, const Twine &Name="", bool HasNUW=false, bool HasNSW=false)
Definition: IRBuilder.h:1217
llvm::Value::takeName
void takeName(Value *V)
Transfer the name from V to this value.
Definition: Value.cpp:378
llvm::SplitBlockAndInsertIfThen
Instruction * SplitBlockAndInsertIfThen(Value *Cond, Instruction *SplitBefore, bool Unreachable, MDNode *BranchWeights, DominatorTree *DT, LoopInfo *LI=nullptr, BasicBlock *ThenBlock=nullptr)
Split the containing block at the specified instruction - everything before SplitBefore stays in the ...
Definition: BasicBlockUtils.cpp:1446
SafeStackLayout.h
llvm::AllocaInst
an instruction to allocate memory on the stack
Definition: Instructions.h:58
llvm::cl::desc
Definition: CommandLine.h:405
raw_ostream.h
BasicBlockUtils.h
llvm::createSafeStackPass
FunctionPass * createSafeStackPass()
This pass splits the stack into a safe stack and an unsafe stack to protect against stack-based overf...
Definition: SafeStack.cpp:938
llvm::replaceDbgDeclare
bool replaceDbgDeclare(Value *Address, Value *NewAddress, DIBuilder &Builder, uint8_t DIExprFlags, int Offset)
Replaces llvm.dbg.declare instruction when the address it describes is replaced with a new value.
Definition: Local.cpp:1687
Value.h
InitializePasses.h
llvm::Value
LLVM Value Representation.
Definition: Value.h:74
Debug.h
llvm::IRBuilderBase::CreateCall
CallInst * CreateCall(FunctionType *FTy, Value *Callee, ArrayRef< Value * > Args=None, const Twine &Name="", MDNode *FPMathTag=nullptr)
Definition: IRBuilder.h:2229
llvm::sampleprof::Base
@ Base
Definition: Discriminator.h:58
llvm::Use
A Use represents the edge between a Value definition and its users.
Definition: Use.h:43
llvm::SmallPtrSetImpl::insert
std::pair< iterator, bool > insert(PtrType Ptr)
Inserts Ptr if and only if there is no element in the container equal to Ptr.
Definition: SmallPtrSet.h:365
llvm::Intrinsic::ID
unsigned ID
Definition: TargetTransformInfo.h:38