LLVM  14.0.0git
SafeStack.cpp
Go to the documentation of this file.
1 //===- SafeStack.cpp - Safe Stack Insertion -------------------------------===//
2 //
3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4 // See https://llvm.org/LICENSE.txt for license information.
5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6 //
7 //===----------------------------------------------------------------------===//
8 //
9 // This pass splits the stack into the safe stack (kept as-is for LLVM backend)
10 // and the unsafe stack (explicitly allocated and managed through the runtime
11 // support library).
12 //
13 // http://clang.llvm.org/docs/SafeStack.html
14 //
15 //===----------------------------------------------------------------------===//
16 
17 #include "SafeStackLayout.h"
18 #include "llvm/ADT/APInt.h"
19 #include "llvm/ADT/ArrayRef.h"
20 #include "llvm/ADT/BitVector.h"
21 #include "llvm/ADT/SmallPtrSet.h"
22 #include "llvm/ADT/SmallVector.h"
23 #include "llvm/ADT/Statistic.h"
28 #include "llvm/Analysis/LoopInfo.h"
36 #include "llvm/IR/Argument.h"
37 #include "llvm/IR/Attributes.h"
38 #include "llvm/IR/ConstantRange.h"
39 #include "llvm/IR/Constants.h"
40 #include "llvm/IR/DIBuilder.h"
41 #include "llvm/IR/DataLayout.h"
42 #include "llvm/IR/DerivedTypes.h"
43 #include "llvm/IR/Dominators.h"
44 #include "llvm/IR/Function.h"
45 #include "llvm/IR/IRBuilder.h"
46 #include "llvm/IR/InstIterator.h"
47 #include "llvm/IR/Instruction.h"
48 #include "llvm/IR/Instructions.h"
49 #include "llvm/IR/IntrinsicInst.h"
50 #include "llvm/IR/Intrinsics.h"
51 #include "llvm/IR/MDBuilder.h"
52 #include "llvm/IR/Module.h"
53 #include "llvm/IR/Type.h"
54 #include "llvm/IR/Use.h"
55 #include "llvm/IR/User.h"
56 #include "llvm/IR/Value.h"
57 #include "llvm/InitializePasses.h"
58 #include "llvm/Pass.h"
59 #include "llvm/Support/Casting.h"
60 #include "llvm/Support/Debug.h"
68 #include <algorithm>
69 #include <cassert>
70 #include <cstdint>
71 #include <string>
72 #include <utility>
73 
74 using namespace llvm;
75 using namespace llvm::safestack;
76 
77 #define DEBUG_TYPE "safe-stack"
78 
79 namespace llvm {
80 
81 STATISTIC(NumFunctions, "Total number of functions");
82 STATISTIC(NumUnsafeStackFunctions, "Number of functions with unsafe stack");
83 STATISTIC(NumUnsafeStackRestorePointsFunctions,
84  "Number of functions that use setjmp or exceptions");
85 
86 STATISTIC(NumAllocas, "Total number of allocas");
87 STATISTIC(NumUnsafeStaticAllocas, "Number of unsafe static allocas");
88 STATISTIC(NumUnsafeDynamicAllocas, "Number of unsafe dynamic allocas");
89 STATISTIC(NumUnsafeByValArguments, "Number of unsafe byval arguments");
90 STATISTIC(NumUnsafeStackRestorePoints, "Number of setjmps and landingpads");
91 
92 } // namespace llvm
93 
94 /// Use __safestack_pointer_address even if the platform has a faster way of
95 /// access safe stack pointer.
96 static cl::opt<bool>
97  SafeStackUsePointerAddress("safestack-use-pointer-address",
98  cl::init(false), cl::Hidden);
99 
100 // Disabled by default due to PR32143.
101 static cl::opt<bool> ClColoring("safe-stack-coloring",
102  cl::desc("enable safe stack coloring"),
103  cl::Hidden, cl::init(false));
104 
105 namespace {
106 
107 /// Rewrite an SCEV expression for a memory access address to an expression that
108 /// represents offset from the given alloca.
109 ///
110 /// The implementation simply replaces all mentions of the alloca with zero.
111 class AllocaOffsetRewriter : public SCEVRewriteVisitor<AllocaOffsetRewriter> {
112  const Value *AllocaPtr;
113 
114 public:
115  AllocaOffsetRewriter(ScalarEvolution &SE, const Value *AllocaPtr)
116  : SCEVRewriteVisitor(SE), AllocaPtr(AllocaPtr) {}
117 
118  const SCEV *visitUnknown(const SCEVUnknown *Expr) {
119  if (Expr->getValue() == AllocaPtr)
120  return SE.getZero(Expr->getType());
121  return Expr;
122  }
123 };
124 
125 /// The SafeStack pass splits the stack of each function into the safe
126 /// stack, which is only accessed through memory safe dereferences (as
127 /// determined statically), and the unsafe stack, which contains all
128 /// local variables that are accessed in ways that we can't prove to
129 /// be safe.
130 class SafeStack {
131  Function &F;
132  const TargetLoweringBase &TL;
133  const DataLayout &DL;
134  DomTreeUpdater *DTU;
135  ScalarEvolution &SE;
136 
137  Type *StackPtrTy;
138  Type *IntPtrTy;
139  Type *Int32Ty;
140  Type *Int8Ty;
141 
142  Value *UnsafeStackPtr = nullptr;
143 
144  /// Unsafe stack alignment. Each stack frame must ensure that the stack is
145  /// aligned to this value. We need to re-align the unsafe stack if the
146  /// alignment of any object on the stack exceeds this value.
147  ///
148  /// 16 seems like a reasonable upper bound on the alignment of objects that we
149  /// might expect to appear on the stack on most common targets.
150  static constexpr uint64_t StackAlignment = 16;
151 
152  /// Return the value of the stack canary.
154 
155  /// Load stack guard from the frame and check if it has changed.
156  void checkStackGuard(IRBuilder<> &IRB, Function &F, Instruction &RI,
157  AllocaInst *StackGuardSlot, Value *StackGuard);
158 
159  /// Find all static allocas, dynamic allocas, return instructions and
160  /// stack restore points (exception unwind blocks and setjmp calls) in the
161  /// given function and append them to the respective vectors.
162  void findInsts(Function &F, SmallVectorImpl<AllocaInst *> &StaticAllocas,
163  SmallVectorImpl<AllocaInst *> &DynamicAllocas,
164  SmallVectorImpl<Argument *> &ByValArguments,
166  SmallVectorImpl<Instruction *> &StackRestorePoints);
167 
168  /// Calculate the allocation size of a given alloca. Returns 0 if the
169  /// size can not be statically determined.
170  uint64_t getStaticAllocaAllocationSize(const AllocaInst* AI);
171 
172  /// Allocate space for all static allocas in \p StaticAllocas,
173  /// replace allocas with pointers into the unsafe stack.
174  ///
175  /// \returns A pointer to the top of the unsafe stack after all unsafe static
176  /// allocas are allocated.
177  Value *moveStaticAllocasToUnsafeStack(IRBuilder<> &IRB, Function &F,
178  ArrayRef<AllocaInst *> StaticAllocas,
179  ArrayRef<Argument *> ByValArguments,
180  Instruction *BasePointer,
181  AllocaInst *StackGuardSlot);
182 
183  /// Generate code to restore the stack after all stack restore points
184  /// in \p StackRestorePoints.
185  ///
186  /// \returns A local variable in which to maintain the dynamic top of the
187  /// unsafe stack if needed.
188  AllocaInst *
189  createStackRestorePoints(IRBuilder<> &IRB, Function &F,
190  ArrayRef<Instruction *> StackRestorePoints,
191  Value *StaticTop, bool NeedDynamicTop);
192 
193  /// Replace all allocas in \p DynamicAllocas with code to allocate
194  /// space dynamically on the unsafe stack and store the dynamic unsafe stack
195  /// top to \p DynamicTop if non-null.
196  void moveDynamicAllocasToUnsafeStack(Function &F, Value *UnsafeStackPtr,
197  AllocaInst *DynamicTop,
198  ArrayRef<AllocaInst *> DynamicAllocas);
199 
200  bool IsSafeStackAlloca(const Value *AllocaPtr, uint64_t AllocaSize);
201 
202  bool IsMemIntrinsicSafe(const MemIntrinsic *MI, const Use &U,
203  const Value *AllocaPtr, uint64_t AllocaSize);
204  bool IsAccessSafe(Value *Addr, uint64_t Size, const Value *AllocaPtr,
205  uint64_t AllocaSize);
206 
207  bool ShouldInlinePointerAddress(CallInst &CI);
208  void TryInlinePointerAddress();
209 
210 public:
211  SafeStack(Function &F, const TargetLoweringBase &TL, const DataLayout &DL,
213  : F(F), TL(TL), DL(DL), DTU(DTU), SE(SE),
214  StackPtrTy(Type::getInt8PtrTy(F.getContext())),
215  IntPtrTy(DL.getIntPtrType(F.getContext())),
216  Int32Ty(Type::getInt32Ty(F.getContext())),
217  Int8Ty(Type::getInt8Ty(F.getContext())) {}
218 
219  // Run the transformation on the associated function.
220  // Returns whether the function was changed.
221  bool run();
222 };
223 
224 constexpr uint64_t SafeStack::StackAlignment;
225 
226 uint64_t SafeStack::getStaticAllocaAllocationSize(const AllocaInst* AI) {
227  uint64_t Size = DL.getTypeAllocSize(AI->getAllocatedType());
228  if (AI->isArrayAllocation()) {
229  auto C = dyn_cast<ConstantInt>(AI->getArraySize());
230  if (!C)
231  return 0;
232  Size *= C->getZExtValue();
233  }
234  return Size;
235 }
236 
237 bool SafeStack::IsAccessSafe(Value *Addr, uint64_t AccessSize,
238  const Value *AllocaPtr, uint64_t AllocaSize) {
239  AllocaOffsetRewriter Rewriter(SE, AllocaPtr);
240  const SCEV *Expr = Rewriter.visit(SE.getSCEV(Addr));
241 
242  uint64_t BitWidth = SE.getTypeSizeInBits(Expr->getType());
243  ConstantRange AccessStartRange = SE.getUnsignedRange(Expr);
244  ConstantRange SizeRange =
245  ConstantRange(APInt(BitWidth, 0), APInt(BitWidth, AccessSize));
246  ConstantRange AccessRange = AccessStartRange.add(SizeRange);
247  ConstantRange AllocaRange =
248  ConstantRange(APInt(BitWidth, 0), APInt(BitWidth, AllocaSize));
249  bool Safe = AllocaRange.contains(AccessRange);
250 
251  LLVM_DEBUG(
252  dbgs() << "[SafeStack] "
253  << (isa<AllocaInst>(AllocaPtr) ? "Alloca " : "ByValArgument ")
254  << *AllocaPtr << "\n"
255  << " Access " << *Addr << "\n"
256  << " SCEV " << *Expr
257  << " U: " << SE.getUnsignedRange(Expr)
258  << ", S: " << SE.getSignedRange(Expr) << "\n"
259  << " Range " << AccessRange << "\n"
260  << " AllocaRange " << AllocaRange << "\n"
261  << " " << (Safe ? "safe" : "unsafe") << "\n");
262 
263  return Safe;
264 }
265 
266 bool SafeStack::IsMemIntrinsicSafe(const MemIntrinsic *MI, const Use &U,
267  const Value *AllocaPtr,
268  uint64_t AllocaSize) {
269  if (auto MTI = dyn_cast<MemTransferInst>(MI)) {
270  if (MTI->getRawSource() != U && MTI->getRawDest() != U)
271  return true;
272  } else {
273  if (MI->getRawDest() != U)
274  return true;
275  }
276 
277  const auto *Len = dyn_cast<ConstantInt>(MI->getLength());
278  // Non-constant size => unsafe. FIXME: try SCEV getRange.
279  if (!Len) return false;
280  return IsAccessSafe(U, Len->getZExtValue(), AllocaPtr, AllocaSize);
281 }
282 
283 /// Check whether a given allocation must be put on the safe
284 /// stack or not. The function analyzes all uses of AI and checks whether it is
285 /// only accessed in a memory safe way (as decided statically).
286 bool SafeStack::IsSafeStackAlloca(const Value *AllocaPtr, uint64_t AllocaSize) {
287  // Go through all uses of this alloca and check whether all accesses to the
288  // allocated object are statically known to be memory safe and, hence, the
289  // object can be placed on the safe stack.
292  WorkList.push_back(AllocaPtr);
293 
294  // A DFS search through all uses of the alloca in bitcasts/PHI/GEPs/etc.
295  while (!WorkList.empty()) {
296  const Value *V = WorkList.pop_back_val();
297  for (const Use &UI : V->uses()) {
298  auto I = cast<const Instruction>(UI.getUser());
299  assert(V == UI.get());
300 
301  switch (I->getOpcode()) {
302  case Instruction::Load:
303  if (!IsAccessSafe(UI, DL.getTypeStoreSize(I->getType()), AllocaPtr,
304  AllocaSize))
305  return false;
306  break;
307 
308  case Instruction::VAArg:
309  // "va-arg" from a pointer is safe.
310  break;
311  case Instruction::Store:
312  if (V == I->getOperand(0)) {
313  // Stored the pointer - conservatively assume it may be unsafe.
314  LLVM_DEBUG(dbgs()
315  << "[SafeStack] Unsafe alloca: " << *AllocaPtr
316  << "\n store of address: " << *I << "\n");
317  return false;
318  }
319 
320  if (!IsAccessSafe(UI, DL.getTypeStoreSize(I->getOperand(0)->getType()),
321  AllocaPtr, AllocaSize))
322  return false;
323  break;
324 
325  case Instruction::Ret:
326  // Information leak.
327  return false;
328 
329  case Instruction::Call:
330  case Instruction::Invoke: {
331  const CallBase &CS = *cast<CallBase>(I);
332 
333  if (I->isLifetimeStartOrEnd())
334  continue;
335 
336  if (const MemIntrinsic *MI = dyn_cast<MemIntrinsic>(I)) {
337  if (!IsMemIntrinsicSafe(MI, UI, AllocaPtr, AllocaSize)) {
338  LLVM_DEBUG(dbgs()
339  << "[SafeStack] Unsafe alloca: " << *AllocaPtr
340  << "\n unsafe memintrinsic: " << *I << "\n");
341  return false;
342  }
343  continue;
344  }
345 
346  // LLVM 'nocapture' attribute is only set for arguments whose address
347  // is not stored, passed around, or used in any other non-trivial way.
348  // We assume that passing a pointer to an object as a 'nocapture
349  // readnone' argument is safe.
350  // FIXME: a more precise solution would require an interprocedural
351  // analysis here, which would look at all uses of an argument inside
352  // the function being called.
353  auto B = CS.arg_begin(), E = CS.arg_end();
354  for (auto A = B; A != E; ++A)
355  if (A->get() == V)
356  if (!(CS.doesNotCapture(A - B) && (CS.doesNotAccessMemory(A - B) ||
357  CS.doesNotAccessMemory()))) {
358  LLVM_DEBUG(dbgs() << "[SafeStack] Unsafe alloca: " << *AllocaPtr
359  << "\n unsafe call: " << *I << "\n");
360  return false;
361  }
362  continue;
363  }
364 
365  default:
366  if (Visited.insert(I).second)
367  WorkList.push_back(cast<const Instruction>(I));
368  }
369  }
370  }
371 
372  // All uses of the alloca are safe, we can place it on the safe stack.
373  return true;
374 }
375 
377  Value *StackGuardVar = TL.getIRStackGuard(IRB);
378  Module *M = F.getParent();
379 
380  if (!StackGuardVar) {
381  TL.insertSSPDeclarations(*M);
382  return IRB.CreateCall(Intrinsic::getDeclaration(M, Intrinsic::stackguard));
383  }
384 
385  return IRB.CreateLoad(StackPtrTy, StackGuardVar, "StackGuard");
386 }
387 
388 void SafeStack::findInsts(Function &F,
389  SmallVectorImpl<AllocaInst *> &StaticAllocas,
390  SmallVectorImpl<AllocaInst *> &DynamicAllocas,
391  SmallVectorImpl<Argument *> &ByValArguments,
393  SmallVectorImpl<Instruction *> &StackRestorePoints) {
394  for (Instruction &I : instructions(&F)) {
395  if (auto AI = dyn_cast<AllocaInst>(&I)) {
396  ++NumAllocas;
397 
398  uint64_t Size = getStaticAllocaAllocationSize(AI);
399  if (IsSafeStackAlloca(AI, Size))
400  continue;
401 
402  if (AI->isStaticAlloca()) {
403  ++NumUnsafeStaticAllocas;
404  StaticAllocas.push_back(AI);
405  } else {
406  ++NumUnsafeDynamicAllocas;
407  DynamicAllocas.push_back(AI);
408  }
409  } else if (auto RI = dyn_cast<ReturnInst>(&I)) {
410  if (CallInst *CI = I.getParent()->getTerminatingMustTailCall())
411  Returns.push_back(CI);
412  else
413  Returns.push_back(RI);
414  } else if (auto CI = dyn_cast<CallInst>(&I)) {
415  // setjmps require stack restore.
416  if (CI->getCalledFunction() && CI->canReturnTwice())
417  StackRestorePoints.push_back(CI);
418  } else if (auto LP = dyn_cast<LandingPadInst>(&I)) {
419  // Exception landing pads require stack restore.
420  StackRestorePoints.push_back(LP);
421  } else if (auto II = dyn_cast<IntrinsicInst>(&I)) {
422  if (II->getIntrinsicID() == Intrinsic::gcroot)
424  "gcroot intrinsic not compatible with safestack attribute");
425  }
426  }
427  for (Argument &Arg : F.args()) {
428  if (!Arg.hasByValAttr())
429  continue;
430  uint64_t Size = DL.getTypeStoreSize(Arg.getParamByValType());
431  if (IsSafeStackAlloca(&Arg, Size))
432  continue;
433 
434  ++NumUnsafeByValArguments;
435  ByValArguments.push_back(&Arg);
436  }
437 }
438 
439 AllocaInst *
440 SafeStack::createStackRestorePoints(IRBuilder<> &IRB, Function &F,
441  ArrayRef<Instruction *> StackRestorePoints,
442  Value *StaticTop, bool NeedDynamicTop) {
443  assert(StaticTop && "The stack top isn't set.");
444 
445  if (StackRestorePoints.empty())
446  return nullptr;
447 
448  // We need the current value of the shadow stack pointer to restore
449  // after longjmp or exception catching.
450 
451  // FIXME: On some platforms this could be handled by the longjmp/exception
452  // runtime itself.
453 
454  AllocaInst *DynamicTop = nullptr;
455  if (NeedDynamicTop) {
456  // If we also have dynamic alloca's, the stack pointer value changes
457  // throughout the function. For now we store it in an alloca.
458  DynamicTop = IRB.CreateAlloca(StackPtrTy, /*ArraySize=*/nullptr,
459  "unsafe_stack_dynamic_ptr");
460  IRB.CreateStore(StaticTop, DynamicTop);
461  }
462 
463  // Restore current stack pointer after longjmp/exception catch.
464  for (Instruction *I : StackRestorePoints) {
465  ++NumUnsafeStackRestorePoints;
466 
467  IRB.SetInsertPoint(I->getNextNode());
468  Value *CurrentTop =
469  DynamicTop ? IRB.CreateLoad(StackPtrTy, DynamicTop) : StaticTop;
470  IRB.CreateStore(CurrentTop, UnsafeStackPtr);
471  }
472 
473  return DynamicTop;
474 }
475 
476 void SafeStack::checkStackGuard(IRBuilder<> &IRB, Function &F, Instruction &RI,
477  AllocaInst *StackGuardSlot, Value *StackGuard) {
478  Value *V = IRB.CreateLoad(StackPtrTy, StackGuardSlot);
479  Value *Cmp = IRB.CreateICmpNE(StackGuard, V);
480 
482  auto FailureProb = BranchProbabilityInfo::getBranchProbStackProtector(false);
483  MDNode *Weights = MDBuilder(F.getContext())
484  .createBranchWeights(SuccessProb.getNumerator(),
485  FailureProb.getNumerator());
486  Instruction *CheckTerm =
487  SplitBlockAndInsertIfThen(Cmp, &RI, /* Unreachable */ true, Weights, DTU);
488  IRBuilder<> IRBFail(CheckTerm);
489  // FIXME: respect -fsanitize-trap / -ftrap-function here?
490  FunctionCallee StackChkFail =
491  F.getParent()->getOrInsertFunction("__stack_chk_fail", IRB.getVoidTy());
492  IRBFail.CreateCall(StackChkFail, {});
493 }
494 
495 /// We explicitly compute and set the unsafe stack layout for all unsafe
496 /// static alloca instructions. We save the unsafe "base pointer" in the
497 /// prologue into a local variable and restore it in the epilogue.
498 Value *SafeStack::moveStaticAllocasToUnsafeStack(
499  IRBuilder<> &IRB, Function &F, ArrayRef<AllocaInst *> StaticAllocas,
500  ArrayRef<Argument *> ByValArguments, Instruction *BasePointer,
501  AllocaInst *StackGuardSlot) {
502  if (StaticAllocas.empty() && ByValArguments.empty())
503  return BasePointer;
504 
505  DIBuilder DIB(*F.getParent());
506 
507  StackLifetime SSC(F, StaticAllocas, StackLifetime::LivenessType::May);
508  static const StackLifetime::LiveRange NoColoringRange(1, true);
509  if (ClColoring)
510  SSC.run();
511 
512  for (auto *I : SSC.getMarkers()) {
513  auto *Op = dyn_cast<Instruction>(I->getOperand(1));
514  const_cast<IntrinsicInst *>(I)->eraseFromParent();
515  // Remove the operand bitcast, too, if it has no more uses left.
516  if (Op && Op->use_empty())
517  Op->eraseFromParent();
518  }
519 
520  // Unsafe stack always grows down.
521  StackLayout SSL(StackAlignment);
522  if (StackGuardSlot) {
523  Type *Ty = StackGuardSlot->getAllocatedType();
524  uint64_t Align =
525  std::max(DL.getPrefTypeAlignment(Ty), StackGuardSlot->getAlignment());
526  SSL.addObject(StackGuardSlot, getStaticAllocaAllocationSize(StackGuardSlot),
527  Align, SSC.getFullLiveRange());
528  }
529 
530  for (Argument *Arg : ByValArguments) {
531  Type *Ty = Arg->getParamByValType();
532  uint64_t Size = DL.getTypeStoreSize(Ty);
533  if (Size == 0)
534  Size = 1; // Don't create zero-sized stack objects.
535 
536  // Ensure the object is properly aligned.
537  uint64_t Align =
538  std::max(DL.getPrefTypeAlignment(Ty), Arg->getParamAlignment());
539  SSL.addObject(Arg, Size, Align, SSC.getFullLiveRange());
540  }
541 
542  for (AllocaInst *AI : StaticAllocas) {
543  Type *Ty = AI->getAllocatedType();
544  uint64_t Size = getStaticAllocaAllocationSize(AI);
545  if (Size == 0)
546  Size = 1; // Don't create zero-sized stack objects.
547 
548  // Ensure the object is properly aligned.
549  uint64_t Align = std::max(DL.getPrefTypeAlignment(Ty), AI->getAlignment());
550 
551  SSL.addObject(AI, Size, Align,
552  ClColoring ? SSC.getLiveRange(AI) : NoColoringRange);
553  }
554 
555  SSL.computeLayout();
556  uint64_t FrameAlignment = SSL.getFrameAlignment();
557 
558  // FIXME: tell SSL that we start at a less-then-MaxAlignment aligned location
559  // (AlignmentSkew).
560  if (FrameAlignment > StackAlignment) {
561  // Re-align the base pointer according to the max requested alignment.
562  assert(isPowerOf2_64(FrameAlignment));
563  IRB.SetInsertPoint(BasePointer->getNextNode());
564  BasePointer = cast<Instruction>(IRB.CreateIntToPtr(
565  IRB.CreateAnd(IRB.CreatePtrToInt(BasePointer, IntPtrTy),
566  ConstantInt::get(IntPtrTy, ~uint64_t(FrameAlignment - 1))),
567  StackPtrTy));
568  }
569 
570  IRB.SetInsertPoint(BasePointer->getNextNode());
571 
572  if (StackGuardSlot) {
573  unsigned Offset = SSL.getObjectOffset(StackGuardSlot);
574  Value *Off = IRB.CreateGEP(Int8Ty, BasePointer, // BasePointer is i8*
576  Value *NewAI =
577  IRB.CreateBitCast(Off, StackGuardSlot->getType(), "StackGuardSlot");
578 
579  // Replace alloc with the new location.
580  StackGuardSlot->replaceAllUsesWith(NewAI);
581  StackGuardSlot->eraseFromParent();
582  }
583 
584  for (Argument *Arg : ByValArguments) {
585  unsigned Offset = SSL.getObjectOffset(Arg);
586  MaybeAlign Align(SSL.getObjectAlignment(Arg));
587  Type *Ty = Arg->getParamByValType();
588 
589  uint64_t Size = DL.getTypeStoreSize(Ty);
590  if (Size == 0)
591  Size = 1; // Don't create zero-sized stack objects.
592 
593  Value *Off = IRB.CreateGEP(Int8Ty, BasePointer, // BasePointer is i8*
595  Value *NewArg = IRB.CreateBitCast(Off, Arg->getType(),
596  Arg->getName() + ".unsafe-byval");
597 
598  // Replace alloc with the new location.
600  -Offset);
601  Arg->replaceAllUsesWith(NewArg);
602  IRB.SetInsertPoint(cast<Instruction>(NewArg)->getNextNode());
603  IRB.CreateMemCpy(Off, Align, Arg, Arg->getParamAlign(), Size);
604  }
605 
606  // Allocate space for every unsafe static AllocaInst on the unsafe stack.
607  for (AllocaInst *AI : StaticAllocas) {
608  IRB.SetInsertPoint(AI);
609  unsigned Offset = SSL.getObjectOffset(AI);
610 
611  replaceDbgDeclare(AI, BasePointer, DIB, DIExpression::ApplyOffset, -Offset);
612  replaceDbgValueForAlloca(AI, BasePointer, DIB, -Offset);
613 
614  // Replace uses of the alloca with the new location.
615  // Insert address calculation close to each use to work around PR27844.
616  std::string Name = std::string(AI->getName()) + ".unsafe";
617  while (!AI->use_empty()) {
618  Use &U = *AI->use_begin();
619  Instruction *User = cast<Instruction>(U.getUser());
620 
621  Instruction *InsertBefore;
622  if (auto *PHI = dyn_cast<PHINode>(User))
623  InsertBefore = PHI->getIncomingBlock(U)->getTerminator();
624  else
625  InsertBefore = User;
626 
627  IRBuilder<> IRBUser(InsertBefore);
628  Value *Off = IRBUser.CreateGEP(Int8Ty, BasePointer, // BasePointer is i8*
630  Value *Replacement = IRBUser.CreateBitCast(Off, AI->getType(), Name);
631 
632  if (auto *PHI = dyn_cast<PHINode>(User))
633  // PHI nodes may have multiple incoming edges from the same BB (why??),
634  // all must be updated at once with the same incoming value.
635  PHI->setIncomingValueForBlock(PHI->getIncomingBlock(U), Replacement);
636  else
637  U.set(Replacement);
638  }
639 
640  AI->eraseFromParent();
641  }
642 
643  // Re-align BasePointer so that our callees would see it aligned as
644  // expected.
645  // FIXME: no need to update BasePointer in leaf functions.
646  unsigned FrameSize = alignTo(SSL.getFrameSize(), StackAlignment);
647 
648  // Update shadow stack pointer in the function epilogue.
649  IRB.SetInsertPoint(BasePointer->getNextNode());
650 
651  Value *StaticTop =
652  IRB.CreateGEP(Int8Ty, BasePointer, ConstantInt::get(Int32Ty, -FrameSize),
653  "unsafe_stack_static_top");
654  IRB.CreateStore(StaticTop, UnsafeStackPtr);
655  return StaticTop;
656 }
657 
658 void SafeStack::moveDynamicAllocasToUnsafeStack(
659  Function &F, Value *UnsafeStackPtr, AllocaInst *DynamicTop,
660  ArrayRef<AllocaInst *> DynamicAllocas) {
661  DIBuilder DIB(*F.getParent());
662 
663  for (AllocaInst *AI : DynamicAllocas) {
664  IRBuilder<> IRB(AI);
665 
666  // Compute the new SP value (after AI).
667  Value *ArraySize = AI->getArraySize();
668  if (ArraySize->getType() != IntPtrTy)
669  ArraySize = IRB.CreateIntCast(ArraySize, IntPtrTy, false);
670 
671  Type *Ty = AI->getAllocatedType();
672  uint64_t TySize = DL.getTypeAllocSize(Ty);
673  Value *Size = IRB.CreateMul(ArraySize, ConstantInt::get(IntPtrTy, TySize));
674 
675  Value *SP = IRB.CreatePtrToInt(IRB.CreateLoad(StackPtrTy, UnsafeStackPtr),
676  IntPtrTy);
677  SP = IRB.CreateSub(SP, Size);
678 
679  // Align the SP value to satisfy the AllocaInst, type and stack alignments.
680  uint64_t Align =
681  std::max(std::max(DL.getPrefTypeAlignment(Ty), AI->getAlignment()),
682  StackAlignment);
683 
685  Value *NewTop = IRB.CreateIntToPtr(
686  IRB.CreateAnd(SP, ConstantInt::get(IntPtrTy, ~uint64_t(Align - 1))),
687  StackPtrTy);
688 
689  // Save the stack pointer.
690  IRB.CreateStore(NewTop, UnsafeStackPtr);
691  if (DynamicTop)
692  IRB.CreateStore(NewTop, DynamicTop);
693 
694  Value *NewAI = IRB.CreatePointerCast(NewTop, AI->getType());
695  if (AI->hasName() && isa<Instruction>(NewAI))
696  NewAI->takeName(AI);
697 
698  replaceDbgDeclare(AI, NewAI, DIB, DIExpression::ApplyOffset, 0);
699  AI->replaceAllUsesWith(NewAI);
700  AI->eraseFromParent();
701  }
702 
703  if (!DynamicAllocas.empty()) {
704  // Now go through the instructions again, replacing stacksave/stackrestore.
705  for (inst_iterator It = inst_begin(&F), Ie = inst_end(&F); It != Ie;) {
706  Instruction *I = &*(It++);
707  auto II = dyn_cast<IntrinsicInst>(I);
708  if (!II)
709  continue;
710 
711  if (II->getIntrinsicID() == Intrinsic::stacksave) {
712  IRBuilder<> IRB(II);
713  Instruction *LI = IRB.CreateLoad(StackPtrTy, UnsafeStackPtr);
714  LI->takeName(II);
715  II->replaceAllUsesWith(LI);
716  II->eraseFromParent();
717  } else if (II->getIntrinsicID() == Intrinsic::stackrestore) {
718  IRBuilder<> IRB(II);
719  Instruction *SI = IRB.CreateStore(II->getArgOperand(0), UnsafeStackPtr);
720  SI->takeName(II);
721  assert(II->use_empty());
722  II->eraseFromParent();
723  }
724  }
725  }
726 }
727 
728 bool SafeStack::ShouldInlinePointerAddress(CallInst &CI) {
730  if (CI.hasFnAttr(Attribute::AlwaysInline) &&
731  isInlineViable(*Callee).isSuccess())
732  return true;
733  if (Callee->isInterposable() || Callee->hasFnAttribute(Attribute::NoInline) ||
734  CI.isNoInline())
735  return false;
736  return true;
737 }
738 
739 void SafeStack::TryInlinePointerAddress() {
740  auto *CI = dyn_cast<CallInst>(UnsafeStackPtr);
741  if (!CI)
742  return;
743 
744  if(F.hasOptNone())
745  return;
746 
748  if (!Callee || Callee->isDeclaration())
749  return;
750 
751  if (!ShouldInlinePointerAddress(*CI))
752  return;
753 
754  InlineFunctionInfo IFI;
755  InlineFunction(*CI, IFI);
756 }
757 
758 bool SafeStack::run() {
759  assert(F.hasFnAttribute(Attribute::SafeStack) &&
760  "Can't run SafeStack on a function without the attribute");
761  assert(!F.isDeclaration() && "Can't run SafeStack on a function declaration");
762 
763  ++NumFunctions;
764 
765  SmallVector<AllocaInst *, 16> StaticAllocas;
766  SmallVector<AllocaInst *, 4> DynamicAllocas;
767  SmallVector<Argument *, 4> ByValArguments;
769 
770  // Collect all points where stack gets unwound and needs to be restored
771  // This is only necessary because the runtime (setjmp and unwind code) is
772  // not aware of the unsafe stack and won't unwind/restore it properly.
773  // To work around this problem without changing the runtime, we insert
774  // instrumentation to restore the unsafe stack pointer when necessary.
775  SmallVector<Instruction *, 4> StackRestorePoints;
776 
777  // Find all static and dynamic alloca instructions that must be moved to the
778  // unsafe stack, all return instructions and stack restore points.
779  findInsts(F, StaticAllocas, DynamicAllocas, ByValArguments, Returns,
780  StackRestorePoints);
781 
782  if (StaticAllocas.empty() && DynamicAllocas.empty() &&
783  ByValArguments.empty() && StackRestorePoints.empty())
784  return false; // Nothing to do in this function.
785 
786  if (!StaticAllocas.empty() || !DynamicAllocas.empty() ||
787  !ByValArguments.empty())
788  ++NumUnsafeStackFunctions; // This function has the unsafe stack.
789 
790  if (!StackRestorePoints.empty())
791  ++NumUnsafeStackRestorePointsFunctions;
792 
793  IRBuilder<> IRB(&F.front(), F.begin()->getFirstInsertionPt());
794  // Calls must always have a debug location, or else inlining breaks. So
795  // we explicitly set a artificial debug location here.
796  if (DISubprogram *SP = F.getSubprogram())
798  DILocation::get(SP->getContext(), SP->getScopeLine(), 0, SP));
800  FunctionCallee Fn = F.getParent()->getOrInsertFunction(
801  "__safestack_pointer_address", StackPtrTy->getPointerTo(0));
802  UnsafeStackPtr = IRB.CreateCall(Fn);
803  } else {
804  UnsafeStackPtr = TL.getSafeStackPointerLocation(IRB);
805  }
806 
807  // Load the current stack pointer (we'll also use it as a base pointer).
808  // FIXME: use a dedicated register for it ?
809  Instruction *BasePointer =
810  IRB.CreateLoad(StackPtrTy, UnsafeStackPtr, false, "unsafe_stack_ptr");
811  assert(BasePointer->getType() == StackPtrTy);
812 
813  AllocaInst *StackGuardSlot = nullptr;
814  // FIXME: implement weaker forms of stack protector.
815  if (F.hasFnAttribute(Attribute::StackProtect) ||
816  F.hasFnAttribute(Attribute::StackProtectStrong) ||
817  F.hasFnAttribute(Attribute::StackProtectReq)) {
818  Value *StackGuard = getStackGuard(IRB, F);
819  StackGuardSlot = IRB.CreateAlloca(StackPtrTy, nullptr);
820  IRB.CreateStore(StackGuard, StackGuardSlot);
821 
822  for (Instruction *RI : Returns) {
823  IRBuilder<> IRBRet(RI);
824  checkStackGuard(IRBRet, F, *RI, StackGuardSlot, StackGuard);
825  }
826  }
827 
828  // The top of the unsafe stack after all unsafe static allocas are
829  // allocated.
830  Value *StaticTop = moveStaticAllocasToUnsafeStack(
831  IRB, F, StaticAllocas, ByValArguments, BasePointer, StackGuardSlot);
832 
833  // Safe stack object that stores the current unsafe stack top. It is updated
834  // as unsafe dynamic (non-constant-sized) allocas are allocated and freed.
835  // This is only needed if we need to restore stack pointer after longjmp
836  // or exceptions, and we have dynamic allocations.
837  // FIXME: a better alternative might be to store the unsafe stack pointer
838  // before setjmp / invoke instructions.
839  AllocaInst *DynamicTop = createStackRestorePoints(
840  IRB, F, StackRestorePoints, StaticTop, !DynamicAllocas.empty());
841 
842  // Handle dynamic allocas.
843  moveDynamicAllocasToUnsafeStack(F, UnsafeStackPtr, DynamicTop,
844  DynamicAllocas);
845 
846  // Restore the unsafe stack pointer before each return.
847  for (Instruction *RI : Returns) {
848  IRB.SetInsertPoint(RI);
849  IRB.CreateStore(BasePointer, UnsafeStackPtr);
850  }
851 
852  TryInlinePointerAddress();
853 
854  LLVM_DEBUG(dbgs() << "[SafeStack] safestack applied\n");
855  return true;
856 }
857 
858 class SafeStackLegacyPass : public FunctionPass {
859  const TargetMachine *TM = nullptr;
860 
861 public:
862  static char ID; // Pass identification, replacement for typeid..
863 
864  SafeStackLegacyPass() : FunctionPass(ID) {
866  }
867 
868  void getAnalysisUsage(AnalysisUsage &AU) const override {
873  }
874 
875  bool runOnFunction(Function &F) override {
876  LLVM_DEBUG(dbgs() << "[SafeStack] Function: " << F.getName() << "\n");
877 
878  if (!F.hasFnAttribute(Attribute::SafeStack)) {
879  LLVM_DEBUG(dbgs() << "[SafeStack] safestack is not requested"
880  " for this function\n");
881  return false;
882  }
883 
884  if (F.isDeclaration()) {
885  LLVM_DEBUG(dbgs() << "[SafeStack] function definition"
886  " is not available\n");
887  return false;
888  }
889 
890  TM = &getAnalysis<TargetPassConfig>().getTM<TargetMachine>();
891  auto *TL = TM->getSubtargetImpl(F)->getTargetLowering();
892  if (!TL)
893  report_fatal_error("TargetLowering instance is required");
894 
895  auto *DL = &F.getParent()->getDataLayout();
896  auto &TLI = getAnalysis<TargetLibraryInfoWrapperPass>().getTLI(F);
897  auto &ACT = getAnalysis<AssumptionCacheTracker>().getAssumptionCache(F);
898 
899  // Compute DT and LI only for functions that have the attribute.
900  // This is only useful because the legacy pass manager doesn't let us
901  // compute analyzes lazily.
902 
903  DominatorTree *DT;
904  bool ShouldPreserveDominatorTree;
905  Optional<DominatorTree> LazilyComputedDomTree;
906 
907  // Do we already have a DominatorTree avaliable from the previous pass?
908  // Note that we should *NOT* require it, to avoid the case where we end up
909  // not needing it, but the legacy PM would have computed it for us anyways.
910  if (auto *DTWP = getAnalysisIfAvailable<DominatorTreeWrapperPass>()) {
911  DT = &DTWP->getDomTree();
912  ShouldPreserveDominatorTree = true;
913  } else {
914  // Otherwise, we need to compute it.
915  LazilyComputedDomTree.emplace(F);
916  DT = LazilyComputedDomTree.getPointer();
917  ShouldPreserveDominatorTree = false;
918  }
919 
920  // Likewise, lazily compute loop info.
921  LoopInfo LI(*DT);
922 
924 
925  ScalarEvolution SE(F, TLI, ACT, *DT, LI);
926 
927  return SafeStack(F, *TL, *DL, ShouldPreserveDominatorTree ? &DTU : nullptr,
928  SE)
929  .run();
930  }
931 };
932 
933 } // end anonymous namespace
934 
935 char SafeStackLegacyPass::ID = 0;
936 
937 INITIALIZE_PASS_BEGIN(SafeStackLegacyPass, DEBUG_TYPE,
938  "Safe Stack instrumentation pass", false, false)
941 INITIALIZE_PASS_END(SafeStackLegacyPass, DEBUG_TYPE,
942  "Safe Stack instrumentation pass", false, false)
943 
944 FunctionPass *llvm::createSafeStackPass() { return new SafeStackLegacyPass(); }
llvm::Check::Size
@ Size
Definition: FileCheck.h:73
llvm::alignTo
uint64_t alignTo(uint64_t Size, Align A)
Returns a multiple of A needed to store Size bytes.
Definition: Alignment.h:148
Int32Ty
IntegerType * Int32Ty
Definition: NVVMIntrRange.cpp:67
llvm::Argument
This class represents an incoming formal argument to a Function.
Definition: Argument.h:29
AssumptionCache.h
llvm::IRBuilderBase::CreateIntCast
Value * CreateIntCast(Value *V, Type *DestTy, bool isSigned, const Twine &Name="")
Definition: IRBuilder.h:2186
llvm::IRBuilderBase::CreateStore
StoreInst * CreateStore(Value *Val, Value *Ptr, bool isVolatile=false)
Definition: IRBuilder.h:1699
instrumentation
xray instrumentation
Definition: XRayInstrumentation.cpp:267
MI
IRTranslator LLVM IR MI
Definition: IRTranslator.cpp:105
MathExtras.h
llvm::IRBuilderBase::SetInsertPoint
void SetInsertPoint(BasicBlock *TheBB)
This specifies that created instructions should be appended to the end of the specified block.
Definition: IRBuilder.h:184
llvm
This file implements support for optimizing divisions by a constant.
Definition: AllocatorList.h:23
llvm::TargetLoweringBase
This base class for TargetLowering contains the SelectionDAG-independent parts that can be used from ...
Definition: TargetLowering.h:192
M
We currently emits eax Perhaps this is what we really should generate is Is imull three or four cycles eax eax The current instruction priority is based on pattern complexity The former is more complex because it folds a load so the latter will not be emitted Perhaps we should use AddedComplexity to give LEA32r a higher priority We should always try to match LEA first since the LEA matching code does some estimate to determine whether the match is profitable if we care more about code then imull is better It s two bytes shorter than movl leal On a Pentium M
Definition: README.txt:252
llvm::DataLayout
A parsed version of the target data layout string in and methods for querying it.
Definition: DataLayout.h:113
llvm::Intrinsic::getDeclaration
Function * getDeclaration(Module *M, ID id, ArrayRef< Type * > Tys=None)
Create or insert an LLVM Function declaration for an intrinsic, and return it.
Definition: Function.cpp:1379
IntrinsicInst.h
llvm::DIBuilder
Definition: DIBuilder.h:41
InstIterator.h
llvm::Function
Definition: Function.h:62
llvm::IRBuilderBase::CreatePtrToInt
Value * CreatePtrToInt(Value *V, Type *DestTy, const Twine &Name="")
Definition: IRBuilder.h:2107
Pass.h
llvm::AllocaInst::getType
PointerType * getType() const
Overload to return most specific pointer type.
Definition: Instructions.h:104
llvm::ilist_node_with_parent::getNextNode
NodeTy * getNextNode()
Get the next node, or nullptr for the list tail.
Definition: ilist_node.h:288
llvm::SmallVector
This is a 'vector' (really, a variable-sized array), optimized for the case when the array is small.
Definition: SmallVector.h:1168
Statistic.h
llvm::Value::hasName
bool hasName() const
Definition: Value.h:262
ErrorHandling.h
llvm::IRBuilder<>
DomTreeUpdater.h
llvm::ScalarEvolution
The main scalar evolution driver.
Definition: ScalarEvolution.h:460
Local.h
llvm::DominatorTree
Concrete subclass of DominatorTreeBase that is used to compute a normal dominator tree.
Definition: Dominators.h:151
llvm::CallBase::hasFnAttr
bool hasFnAttr(Attribute::AttrKind Kind) const
Determine whether this call has the given attribute.
Definition: InstrTypes.h:1467
llvm::cl::Hidden
@ Hidden
Definition: CommandLine.h:143
APInt.h
llvm::SPII::Load
@ Load
Definition: SparcInstrInfo.h:32
ScalarEvolution.h
llvm::Type
The instances of the Type class are immutable: once they are created, they are never changed.
Definition: Type.h:45
Module.h
llvm::MemIntrinsic
This is the common base class for memset/memcpy/memmove.
Definition: IntrinsicInst.h:874
llvm::Optional
Definition: APInt.h:33
llvm::isInlineViable
InlineResult isInlineViable(Function &Callee)
Minimal filter to detect invalid constructs for inlining.
Definition: InlineCost.cpp:2960
Offset
uint64_t Offset
Definition: ELFObjHandler.cpp:81
llvm::SmallPtrSet
SmallPtrSet - This class implements a set which is optimized for holding SmallSize or less elements.
Definition: SmallPtrSet.h:449
llvm::MipsISD::Ret
@ Ret
Definition: MipsISelLowering.h:116
llvm::CallBase::arg_begin
User::op_iterator arg_begin()
Return the iterator pointing to the beginning of the argument list.
Definition: InstrTypes.h:1303
llvm::SmallVectorImpl::pop_back_val
LLVM_NODISCARD T pop_back_val()
Definition: SmallVector.h:635
llvm::isPowerOf2_32
constexpr bool isPowerOf2_32(uint32_t Value)
Return true if the argument is a power of two > 0.
Definition: MathExtras.h:491
llvm::safestack::StackLayout
Compute the layout of an unsafe stack frame.
Definition: SafeStackLayout.h:24
llvm::IRBuilderBase::CreateAlloca
AllocaInst * CreateAlloca(Type *Ty, unsigned AddrSpace, Value *ArraySize=nullptr, const Twine &Name="")
Definition: IRBuilder.h:1643
Use.h
llvm::IRBuilderBase::CreateIntToPtr
Value * CreateIntToPtr(Value *V, Type *DestTy, const Twine &Name="")
Definition: IRBuilder.h:2112
llvm::ArrayRef::empty
bool empty() const
empty - Check if the array is empty.
Definition: ArrayRef.h:160
LLVM_DEBUG
#define LLVM_DEBUG(X)
Definition: Debug.h:101
llvm::MDNode::get
static MDTuple * get(LLVMContext &Context, ArrayRef< Metadata * > MDs)
Definition: Metadata.h:1233
F
#define F(x, y, z)
Definition: MD5.cpp:56
llvm::DomTreeUpdater::UpdateStrategy::Lazy
@ Lazy
llvm::Optional::getPointer
constexpr const T * getPointer() const
Definition: Optional.h:280
llvm::dbgs
raw_ostream & dbgs()
dbgs() - This returns a reference to a raw_ostream for debugging messages.
Definition: Debug.cpp:163
Arg
amdgpu Simplify well known AMD library false FunctionCallee Value * Arg
Definition: AMDGPULibCalls.cpp:206
Instruction.h
TargetLowering.h
llvm::AllocaInst::isStaticAlloca
bool isStaticAlloca() const
Return true if this alloca is in the entry block of the function and is a constant size.
Definition: Instructions.cpp:1397
llvm::initializeSafeStackLegacyPassPass
void initializeSafeStackLegacyPassPass(PassRegistry &)
llvm::SCEVUnknown::getType
Type * getType() const
Definition: ScalarEvolutionExpressions.h:565
llvm::IRBuilderBase::CreateMul
Value * CreateMul(Value *LHS, Value *RHS, const Twine &Name="", bool HasNUW=false, bool HasNSW=false)
Definition: IRBuilder.h:1246
StackLifetime.h
TargetMachine.h
llvm::PassRegistry::getPassRegistry
static PassRegistry * getPassRegistry()
getPassRegistry - Access the global registry object, which is automatically initialized at applicatio...
Definition: PassRegistry.cpp:31
Rewriter
Virtual Register Rewriter
Definition: VirtRegMap.cpp:237
Constants.h
llvm::AllocaInst::getAllocatedType
Type * getAllocatedType() const
Return the type that is being allocated by the instruction.
Definition: Instructions.h:113
E
static GCRegistry::Add< CoreCLRGC > E("coreclr", "CoreCLR-compatible GC")
llvm::DIExpression::ApplyOffset
@ ApplyOffset
Definition: DebugInfoMetadata.h:2793
llvm::User
Definition: User.h:44
Intrinsics.h
C
(vector float) vec_cmpeq(*A, *B) C
Definition: README_ALTIVEC.txt:86
SafeStackUsePointerAddress
static cl::opt< bool > SafeStackUsePointerAddress("safestack-use-pointer-address", cl::init(false), cl::Hidden)
Use __safestack_pointer_address even if the platform has a faster way of access safe stack pointer.
llvm::ARM_PROC::A
@ A
Definition: ARMBaseInfo.h:34
llvm::CallBase::getCalledFunction
Function * getCalledFunction() const
Returns the function called, or null if this is an indirect function invocation.
Definition: InstrTypes.h:1383
llvm::IRBuilderBase::CreateLoad
LoadInst * CreateLoad(Type *Ty, Value *Ptr, const char *Name)
Provided to resolve 'CreateLoad(Ty, Ptr, "...")' correctly, instead of converting the string to 'bool...
Definition: IRBuilder.h:1660
llvm::MDBuilder::createBranchWeights
MDNode * createBranchWeights(uint32_t TrueWeight, uint32_t FalseWeight)
Return metadata containing two branch weights.
Definition: MDBuilder.cpp:37
llvm::AnalysisUsage
Represent the analysis usage information of a pass.
Definition: PassAnalysisSupport.h:47
TargetLibraryInfo.h
llvm::Value::uses
iterator_range< use_iterator > uses()
Definition: Value.h:377
false
Definition: StackSlotColoring.cpp:142
llvm::IRBuilderBase::SetCurrentDebugLocation
void SetCurrentDebugLocation(DebugLoc L)
Set location information used by debugging information.
Definition: IRBuilder.h:208
llvm::MaybeAlign
This struct is a compact representation of a valid (power of two) or undefined (0) alignment.
Definition: Alignment.h:109
B
static GCRegistry::Add< OcamlGC > B("ocaml", "ocaml 3.10-compatible GC")
llvm::Instruction
Definition: Instruction.h:45
llvm::DominatorTreeWrapperPass
Legacy analysis pass which computes a DominatorTree.
Definition: Dominators.h:287
MDBuilder.h
llvm::AllocaInst::getArraySize
const Value * getArraySize() const
Get the number of elements allocated.
Definition: Instructions.h:100
llvm::report_fatal_error
void report_fatal_error(Error Err, bool gen_crash_diag=true)
Report a serious error, calling any installed error handler.
Definition: Error.cpp:140
llvm::STATISTIC
STATISTIC(NumFunctions, "Total number of functions")
llvm::InlineResult::isSuccess
bool isSuccess() const
Definition: InlineCost.h:168
llvm::DomTreeUpdater
Definition: DomTreeUpdater.h:28
BitVector.h
llvm::ConstantInt::get
static Constant * get(Type *Ty, uint64_t V, bool IsSigned=false)
If Ty is a vector type, return a Constant with a splat of the given value.
Definition: Constants.cpp:925
llvm::Use::getUser
User * getUser() const
Returns the User that contains this Use.
Definition: Use.h:73
SmallPtrSet.h
ClColoring
static cl::opt< bool > ClColoring("safe-stack-coloring", cl::desc("enable safe stack coloring"), cl::Hidden, cl::init(false))
llvm::ConstantRange::add
ConstantRange add(const ConstantRange &Other) const
Return a new range representing the possible values resulting from an addition of a value in this ran...
Definition: ConstantRange.cpp:907
Align
uint64_t Align
Definition: ELFObjHandler.cpp:83
llvm::Align
This struct is a compact representation of a valid (non-zero power of two) alignment.
Definition: Alignment.h:39
llvm::MCID::Call
@ Call
Definition: MCInstrDesc.h:153
llvm::Value::use_empty
bool use_empty() const
Definition: Value.h:345
llvm::SCEVUnknown::getValue
Value * getValue() const
Definition: ScalarEvolutionExpressions.h:551
llvm::BranchProbabilityInfo::getBranchProbStackProtector
static BranchProbability getBranchProbStackProtector(bool IsLikely)
Definition: BranchProbabilityInfo.h:194
Type.h
llvm::IRBuilderBase::CreateAnd
Value * CreateAnd(Value *LHS, Value *RHS, const Twine &Name="")
Definition: IRBuilder.h:1362
llvm::IRBuilderBase::CreatePointerCast
Value * CreatePointerCast(Value *V, Type *DestTy, const Twine &Name="")
Definition: IRBuilder.h:2163
INITIALIZE_PASS_END
#define INITIALIZE_PASS_END(passName, arg, name, cfg, analysis)
Definition: PassSupport.h:58
LoopInfo.h
llvm::TargetPassConfig
Target-Independent Code Generator Pass Configuration Options.
Definition: TargetPassConfig.h:84
llvm::StackLifetime::LivenessType::May
@ May
llvm::Use::set
void set(Value *Val)
Definition: Value.h:864
llvm::cl::opt< bool >
llvm::SCEV
This class represents an analyzed expression in the program.
Definition: ScalarEvolution.h:77
llvm::instructions
inst_range instructions(Function *F)
Definition: InstIterator.h:133
llvm::IRBuilderBase::CreateBitCast
Value * CreateBitCast(Value *V, Type *DestTy, const Twine &Name="")
Definition: IRBuilder.h:2117
llvm::Instruction::eraseFromParent
SymbolTableList< Instruction >::iterator eraseFromParent()
This method unlinks 'this' from the containing basic block and deletes it.
Definition: Instruction.cpp:78
BranchProbabilityInfo.h
llvm::CallBase::doesNotAccessMemory
bool doesNotAccessMemory(unsigned OpNo) const
Definition: InstrTypes.h:1692
llvm::TargetLibraryInfoWrapperPass
Definition: TargetLibraryInfo.h:465
uint64_t
Addr
uint64_t Addr
Definition: ELFObjHandler.cpp:80
INITIALIZE_PASS_DEPENDENCY
INITIALIZE_PASS_DEPENDENCY(DominatorTreeWrapperPass)
llvm::Optional::emplace
void emplace(ArgTypes &&... Args)
Create a new object by constructing it in place with the given arguments.
Definition: Optional.h:264
I
#define I(x, y, z)
Definition: MD5.cpp:59
Cloning.h
llvm::cl::init
initializer< Ty > init(const Ty &Val)
Definition: CommandLine.h:441
DIBuilder.h
llvm::StackLifetime
Compute live ranges of allocas.
Definition: StackLifetime.h:38
llvm::SCEVRewriteVisitor
This visitor recursively visits a SCEV expression and re-writes it.
Definition: ScalarEvolutionExpressions.h:714
ArrayRef.h
llvm::CallBase::doesNotCapture
bool doesNotCapture(unsigned OpNo) const
Determine whether this data operand is not captured.
Definition: InstrTypes.h:1651
TargetPassConfig.h
llvm::SPII::Store
@ Store
Definition: SparcInstrInfo.h:33
IRBuilder.h
assert
assert(ImpDefSCC.getReg()==AMDGPU::SCC &&ImpDefSCC.isDef())
llvm::TargetMachine
Primary interface to the complete machine description for the target machine.
Definition: TargetMachine.h:79
SI
StandardInstrumentations SI(Debug, VerifyEach)
llvm::AllocaInst::getAlignment
uint64_t getAlignment() const
Definition: Instructions.h:129
InlineCost.h
llvm::Value::use_begin
use_iterator use_begin()
Definition: Value.h:361
llvm::Module
A Module instance is used to store all the information related to an LLVM module.
Definition: Module.h:67
llvm::MDNode
Metadata node.
Definition: Metadata.h:906
llvm::safestack
Definition: SafeStackLayout.h:21
llvm::AMDGPU::IsaInfo::TargetIDSetting::Off
@ Off
llvm::CallBase::arg_end
User::op_iterator arg_end()
Return the iterator pointing to the end of the argument list.
Definition: InstrTypes.h:1309
llvm::APInt
Class for arbitrary precision integers.
Definition: APInt.h:75
llvm::AssumptionCacheTracker
An immutable pass that tracks lazily created AssumptionCache objects.
Definition: AssumptionCache.h:200
llvm::ArrayRef
ArrayRef - Represent a constant reference to an array (0 or more elements consecutively in memory),...
Definition: APInt.h:32
llvm::LoopInfo
Definition: LoopInfo.h:1083
DataLayout.h
llvm::StackLifetime::LiveRange
This class represents a set of interesting instructions where an alloca is live.
Definition: StackLifetime.h:64
llvm::Value::getType
Type * getType() const
All values are typed, get the type of this value.
Definition: Value.h:256
llvm::AnalysisUsage::addPreserved
AnalysisUsage & addPreserved()
Add the specified Pass class to the set of analyses preserved by this pass.
Definition: PassAnalysisSupport.h:98
llvm::Value::replaceAllUsesWith
void replaceAllUsesWith(Value *V)
Change all uses of this to point to a new Value.
Definition: Value.cpp:532
llvm::Value::getContext
LLVMContext & getContext() const
All values hold a context through their type.
Definition: Value.cpp:990
llvm::AllocaInst::isArrayAllocation
bool isArrayAllocation() const
Return true if there is an allocation size parameter to the allocation instruction that is not 1.
Definition: Instructions.cpp:1388
TargetSubtargetInfo.h
DL
MachineBasicBlock MachineBasicBlock::iterator DebugLoc DL
Definition: AArch64SLSHardening.cpp:76
ConstantRange.h
INITIALIZE_PASS_BEGIN
INITIALIZE_PASS_BEGIN(SafeStackLegacyPass, DEBUG_TYPE, "Safe Stack instrumentation pass", false, false) INITIALIZE_PASS_END(SafeStackLegacyPass
llvm::Value::getName
StringRef getName() const
Return a constant reference to the value's name.
Definition: Value.cpp:309
llvm::IRBuilderBase::CreateGEP
Value * CreateGEP(Type *Ty, Value *Ptr, ArrayRef< Value * > IdxList, const Twine &Name="")
Definition: IRBuilder.h:1799
pass
Safe Stack instrumentation pass
Definition: SafeStack.cpp:942
llvm::replaceDbgValueForAlloca
void replaceDbgValueForAlloca(AllocaInst *AI, Value *NewAllocaAddress, DIBuilder &Builder, int Offset=0)
Replaces multiple llvm.dbg.value instructions when the alloca it describes is replaced with a new val...
Definition: Local.cpp:1715
Argument.h
Callee
amdgpu Simplify well known AMD library false FunctionCallee Callee
Definition: AMDGPULibCalls.cpp:206
Attributes.h
runOnFunction
static bool runOnFunction(Function &F, bool PostInlining)
Definition: EntryExitInstrumenter.cpp:69
llvm::GraphProgram::Name
Name
Definition: GraphWriter.h:52
llvm::IRBuilderBase::CreateMemCpy
CallInst * CreateMemCpy(Value *Dst, MaybeAlign DstAlign, Value *Src, MaybeAlign SrcAlign, uint64_t Size, bool isVolatile=false, MDNode *TBAATag=nullptr, MDNode *TBAAStructTag=nullptr, MDNode *ScopeTag=nullptr, MDNode *NoAliasTag=nullptr)
Create and insert a memcpy between the specified pointers.
Definition: IRBuilder.h:622
llvm::AMDGPU::SendMsg::Op
Op
Definition: SIDefines.h:324
llvm::CallBase::isNoInline
bool isNoInline() const
Return true if the call should not be inlined.
Definition: InstrTypes.h:1798
llvm::X86::FirstMacroFusionInstKind::Cmp
@ Cmp
Casting.h
Function.h
llvm::BitWidth
constexpr unsigned BitWidth
Definition: BitmaskEnum.h:147
llvm::SCEVUnknown
This means that we are dealing with an entirely unknown SCEV value, and only represent it as its LLVM...
Definition: ScalarEvolutionExpressions.h:530
llvm::inst_end
inst_iterator inst_end(Function *F)
Definition: InstIterator.h:132
llvm::InlineFunctionInfo
This class captures the data input to the InlineFunction call, and records the auxiliary results prod...
Definition: Cloning.h:201
llvm::ConstantRange::contains
bool contains(const APInt &Val) const
Return true if the specified value is in the set.
Definition: ConstantRange.cpp:393
llvm::ConstantRange
This class represents a range of values.
Definition: ConstantRange.h:47
llvm::IntrinsicInst
A wrapper class for inspecting calls to intrinsic functions.
Definition: IntrinsicInst.h:45
llvm::MDBuilder
Definition: MDBuilder.h:35
ScalarEvolutionExpressions.h
Instructions.h
SmallVector.h
User.h
Dominators.h
llvm::max
Align max(MaybeAlign Lhs, Align Rhs)
Definition: Alignment.h:340
llvm::FunctionCallee
A handy container for a FunctionType+Callee-pointer pair, which can be passed around as a single enti...
Definition: DerivedTypes.h:165
llvm::DISubprogram
Subprogram description.
Definition: DebugInfoMetadata.h:1820
llvm::SmallVectorImpl
This class consists of common code factored out of the SmallVector class to reduce code duplication b...
Definition: APFloat.h:43
llvm::InlineFunction
InlineResult InlineFunction(CallBase &CB, InlineFunctionInfo &IFI, AAResults *CalleeAAR=nullptr, bool InsertLifetime=true, Function *ForwardVarArgsTo=nullptr)
This function inlines the called function into the basic block of the caller.
Definition: InlineFunction.cpp:1754
llvm::CallBase
Base class for all callable instructions (InvokeInst and CallInst) Holds everything related to callin...
Definition: InstrTypes.h:1161
DerivedTypes.h
llvm::SCEV::getType
Type * getType() const
Return the LLVM type of this SCEV expression.
Definition: ScalarEvolution.cpp:379
TM
const char LLVMTargetMachineRef TM
Definition: PassBuilderBindings.cpp:47
llvm::FunctionPass
FunctionPass class - This class is used to implement most global optimizations.
Definition: Pass.h:298
getStackGuard
static Value * getStackGuard(const TargetLoweringBase *TLI, Module *M, IRBuilder<> &B, bool *SupportsSelectionDAGSP=nullptr)
Create a stack guard loading and populate whether SelectionDAG SSP is supported.
Definition: StackProtector.cpp:379
llvm::CallInst
This class represents a function call, abstracting a target machine's calling convention.
Definition: Instructions.h:1475
llvm::IRBuilderBase::getVoidTy
Type * getVoidTy()
Fetch the type representing void.
Definition: IRBuilder.h:556
llvm::inst_begin
inst_iterator inst_begin(Function *F)
Definition: InstIterator.h:131
llvm::IRBuilderBase::CreateICmpNE
Value * CreateICmpNE(Value *LHS, Value *RHS, const Twine &Name="")
Definition: IRBuilder.h:2235
DEBUG_TYPE
#define DEBUG_TYPE
Definition: SafeStack.cpp:77
llvm::AnalysisUsage::addRequired
AnalysisUsage & addRequired()
Definition: PassAnalysisSupport.h:75
llvm::IRBuilderBase::CreateSub
Value * CreateSub(Value *LHS, Value *RHS, const Twine &Name="", bool HasNUW=false, bool HasNSW=false)
Definition: IRBuilder.h:1229
llvm::Value::takeName
void takeName(Value *V)
Transfer the name from V to this value.
Definition: Value.cpp:382
llvm::SplitBlockAndInsertIfThen
Instruction * SplitBlockAndInsertIfThen(Value *Cond, Instruction *SplitBefore, bool Unreachable, MDNode *BranchWeights, DominatorTree *DT, LoopInfo *LI=nullptr, BasicBlock *ThenBlock=nullptr)
Split the containing block at the specified instruction - everything before SplitBefore stays in the ...
Definition: BasicBlockUtils.cpp:1418
SafeStackLayout.h
llvm::AllocaInst
an instruction to allocate memory on the stack
Definition: Instructions.h:62
llvm::cl::desc
Definition: CommandLine.h:412
llvm::InstIterator
Definition: InstIterator.h:32
raw_ostream.h
BasicBlockUtils.h
llvm::createSafeStackPass
FunctionPass * createSafeStackPass()
This pass splits the stack into a safe stack and an unsafe stack to protect against stack-based overf...
Definition: SafeStack.cpp:944
llvm::isPowerOf2_64
constexpr bool isPowerOf2_64(uint64_t Value)
Return true if the argument is a power of two > 0 (64 bit edition.)
Definition: MathExtras.h:496
llvm::replaceDbgDeclare
bool replaceDbgDeclare(Value *Address, Value *NewAddress, DIBuilder &Builder, uint8_t DIExprFlags, int Offset)
Replaces llvm.dbg.declare instruction when the address it describes is replaced with a new value.
Definition: Local.cpp:1674
Value.h
InitializePasses.h
llvm::Value
LLVM Value Representation.
Definition: Value.h:75
Debug.h
llvm::IRBuilderBase::CreateCall
CallInst * CreateCall(FunctionType *FTy, Value *Callee, ArrayRef< Value * > Args=None, const Twine &Name="", MDNode *FPMathTag=nullptr)
Definition: IRBuilder.h:2395
llvm::Use
A Use represents the edge between a Value definition and its users.
Definition: Use.h:44
llvm::SmallPtrSetImpl::insert
std::pair< iterator, bool > insert(PtrType Ptr)
Inserts Ptr if and only if there is no element in the container equal to Ptr.
Definition: SmallPtrSet.h:364
llvm::Intrinsic::ID
unsigned ID
Definition: TargetTransformInfo.h:37