LLVM 20.0.0git
SafeStack.cpp
Go to the documentation of this file.
1//===- SafeStack.cpp - Safe Stack Insertion -------------------------------===//
2//
3// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4// See https://llvm.org/LICENSE.txt for license information.
5// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6//
7//===----------------------------------------------------------------------===//
8//
9// This pass splits the stack into the safe stack (kept as-is for LLVM backend)
10// and the unsafe stack (explicitly allocated and managed through the runtime
11// support library).
12//
13// http://clang.llvm.org/docs/SafeStack.html
14//
15//===----------------------------------------------------------------------===//
16
18#include "SafeStackLayout.h"
19#include "llvm/ADT/APInt.h"
20#include "llvm/ADT/ArrayRef.h"
23#include "llvm/ADT/Statistic.h"
36#include "llvm/IR/Argument.h"
37#include "llvm/IR/Attributes.h"
39#include "llvm/IR/Constants.h"
40#include "llvm/IR/DIBuilder.h"
41#include "llvm/IR/DataLayout.h"
43#include "llvm/IR/Dominators.h"
44#include "llvm/IR/Function.h"
45#include "llvm/IR/IRBuilder.h"
47#include "llvm/IR/Instruction.h"
50#include "llvm/IR/Intrinsics.h"
51#include "llvm/IR/MDBuilder.h"
52#include "llvm/IR/Metadata.h"
53#include "llvm/IR/Module.h"
54#include "llvm/IR/Type.h"
55#include "llvm/IR/Use.h"
56#include "llvm/IR/Value.h"
58#include "llvm/Pass.h"
60#include "llvm/Support/Debug.h"
68#include <algorithm>
69#include <cassert>
70#include <cstdint>
71#include <optional>
72#include <string>
73#include <utility>
74
75using namespace llvm;
76using namespace llvm::safestack;
77
78#define DEBUG_TYPE "safe-stack"
79
80namespace llvm {
81
82STATISTIC(NumFunctions, "Total number of functions");
83STATISTIC(NumUnsafeStackFunctions, "Number of functions with unsafe stack");
84STATISTIC(NumUnsafeStackRestorePointsFunctions,
85 "Number of functions that use setjmp or exceptions");
86
87STATISTIC(NumAllocas, "Total number of allocas");
88STATISTIC(NumUnsafeStaticAllocas, "Number of unsafe static allocas");
89STATISTIC(NumUnsafeDynamicAllocas, "Number of unsafe dynamic allocas");
90STATISTIC(NumUnsafeByValArguments, "Number of unsafe byval arguments");
91STATISTIC(NumUnsafeStackRestorePoints, "Number of setjmps and landingpads");
92
93} // namespace llvm
94
95/// Use __safestack_pointer_address even if the platform has a faster way of
96/// access safe stack pointer.
97static cl::opt<bool>
98 SafeStackUsePointerAddress("safestack-use-pointer-address",
99 cl::init(false), cl::Hidden);
100
101static cl::opt<bool> ClColoring("safe-stack-coloring",
102 cl::desc("enable safe stack coloring"),
103 cl::Hidden, cl::init(true));
104
105namespace {
106
107/// The SafeStack pass splits the stack of each function into the safe
108/// stack, which is only accessed through memory safe dereferences (as
109/// determined statically), and the unsafe stack, which contains all
110/// local variables that are accessed in ways that we can't prove to
111/// be safe.
112class SafeStack {
113 Function &F;
114 const TargetLoweringBase &TL;
115 const DataLayout &DL;
116 DomTreeUpdater *DTU;
117 ScalarEvolution &SE;
118
119 Type *StackPtrTy;
120 Type *IntPtrTy;
121 Type *Int32Ty;
122
123 Value *UnsafeStackPtr = nullptr;
124
125 /// Unsafe stack alignment. Each stack frame must ensure that the stack is
126 /// aligned to this value. We need to re-align the unsafe stack if the
127 /// alignment of any object on the stack exceeds this value.
128 ///
129 /// 16 seems like a reasonable upper bound on the alignment of objects that we
130 /// might expect to appear on the stack on most common targets.
131 static constexpr Align StackAlignment = Align::Constant<16>();
132
133 /// Return the value of the stack canary.
135
136 /// Load stack guard from the frame and check if it has changed.
137 void checkStackGuard(IRBuilder<> &IRB, Function &F, Instruction &RI,
138 AllocaInst *StackGuardSlot, Value *StackGuard);
139
140 /// Find all static allocas, dynamic allocas, return instructions and
141 /// stack restore points (exception unwind blocks and setjmp calls) in the
142 /// given function and append them to the respective vectors.
143 void findInsts(Function &F, SmallVectorImpl<AllocaInst *> &StaticAllocas,
144 SmallVectorImpl<AllocaInst *> &DynamicAllocas,
145 SmallVectorImpl<Argument *> &ByValArguments,
147 SmallVectorImpl<Instruction *> &StackRestorePoints);
148
149 /// Calculate the allocation size of a given alloca. Returns 0 if the
150 /// size can not be statically determined.
151 uint64_t getStaticAllocaAllocationSize(const AllocaInst* AI);
152
153 /// Allocate space for all static allocas in \p StaticAllocas,
154 /// replace allocas with pointers into the unsafe stack.
155 ///
156 /// \returns A pointer to the top of the unsafe stack after all unsafe static
157 /// allocas are allocated.
158 Value *moveStaticAllocasToUnsafeStack(IRBuilder<> &IRB, Function &F,
159 ArrayRef<AllocaInst *> StaticAllocas,
160 ArrayRef<Argument *> ByValArguments,
161 Instruction *BasePointer,
162 AllocaInst *StackGuardSlot);
163
164 /// Generate code to restore the stack after all stack restore points
165 /// in \p StackRestorePoints.
166 ///
167 /// \returns A local variable in which to maintain the dynamic top of the
168 /// unsafe stack if needed.
169 AllocaInst *
170 createStackRestorePoints(IRBuilder<> &IRB, Function &F,
171 ArrayRef<Instruction *> StackRestorePoints,
172 Value *StaticTop, bool NeedDynamicTop);
173
174 /// Replace all allocas in \p DynamicAllocas with code to allocate
175 /// space dynamically on the unsafe stack and store the dynamic unsafe stack
176 /// top to \p DynamicTop if non-null.
177 void moveDynamicAllocasToUnsafeStack(Function &F, Value *UnsafeStackPtr,
178 AllocaInst *DynamicTop,
179 ArrayRef<AllocaInst *> DynamicAllocas);
180
181 bool IsSafeStackAlloca(const Value *AllocaPtr, uint64_t AllocaSize);
182
183 bool IsMemIntrinsicSafe(const MemIntrinsic *MI, const Use &U,
184 const Value *AllocaPtr, uint64_t AllocaSize);
185 bool IsAccessSafe(Value *Addr, uint64_t Size, const Value *AllocaPtr,
186 uint64_t AllocaSize);
187
188 bool ShouldInlinePointerAddress(CallInst &CI);
189 void TryInlinePointerAddress();
190
191public:
192 SafeStack(Function &F, const TargetLoweringBase &TL, const DataLayout &DL,
194 : F(F), TL(TL), DL(DL), DTU(DTU), SE(SE),
195 StackPtrTy(PointerType::getUnqual(F.getContext())),
196 IntPtrTy(DL.getIntPtrType(F.getContext())),
197 Int32Ty(Type::getInt32Ty(F.getContext())) {}
198
199 // Run the transformation on the associated function.
200 // Returns whether the function was changed.
201 bool run();
202};
203
204constexpr Align SafeStack::StackAlignment;
205
206uint64_t SafeStack::getStaticAllocaAllocationSize(const AllocaInst* AI) {
207 uint64_t Size = DL.getTypeAllocSize(AI->getAllocatedType());
208 if (AI->isArrayAllocation()) {
209 auto C = dyn_cast<ConstantInt>(AI->getArraySize());
210 if (!C)
211 return 0;
212 Size *= C->getZExtValue();
213 }
214 return Size;
215}
216
217bool SafeStack::IsAccessSafe(Value *Addr, uint64_t AccessSize,
218 const Value *AllocaPtr, uint64_t AllocaSize) {
219 const SCEV *AddrExpr = SE.getSCEV(Addr);
220 const auto *Base = dyn_cast<SCEVUnknown>(SE.getPointerBase(AddrExpr));
221 if (!Base || Base->getValue() != AllocaPtr) {
223 dbgs() << "[SafeStack] "
224 << (isa<AllocaInst>(AllocaPtr) ? "Alloca " : "ByValArgument ")
225 << *AllocaPtr << "\n"
226 << "SCEV " << *AddrExpr << " not directly based on alloca\n");
227 return false;
228 }
229
230 const SCEV *Expr = SE.removePointerBase(AddrExpr);
231 uint64_t BitWidth = SE.getTypeSizeInBits(Expr->getType());
232 ConstantRange AccessStartRange = SE.getUnsignedRange(Expr);
233 ConstantRange SizeRange =
234 ConstantRange(APInt(BitWidth, 0), APInt(BitWidth, AccessSize));
235 ConstantRange AccessRange = AccessStartRange.add(SizeRange);
236 ConstantRange AllocaRange =
237 ConstantRange(APInt(BitWidth, 0), APInt(BitWidth, AllocaSize));
238 bool Safe = AllocaRange.contains(AccessRange);
239
241 dbgs() << "[SafeStack] "
242 << (isa<AllocaInst>(AllocaPtr) ? "Alloca " : "ByValArgument ")
243 << *AllocaPtr << "\n"
244 << " Access " << *Addr << "\n"
245 << " SCEV " << *Expr
246 << " U: " << SE.getUnsignedRange(Expr)
247 << ", S: " << SE.getSignedRange(Expr) << "\n"
248 << " Range " << AccessRange << "\n"
249 << " AllocaRange " << AllocaRange << "\n"
250 << " " << (Safe ? "safe" : "unsafe") << "\n");
251
252 return Safe;
253}
254
255bool SafeStack::IsMemIntrinsicSafe(const MemIntrinsic *MI, const Use &U,
256 const Value *AllocaPtr,
257 uint64_t AllocaSize) {
258 if (auto MTI = dyn_cast<MemTransferInst>(MI)) {
259 if (MTI->getRawSource() != U && MTI->getRawDest() != U)
260 return true;
261 } else {
262 if (MI->getRawDest() != U)
263 return true;
264 }
265
266 const auto *Len = dyn_cast<ConstantInt>(MI->getLength());
267 // Non-constant size => unsafe. FIXME: try SCEV getRange.
268 if (!Len) return false;
269 return IsAccessSafe(U, Len->getZExtValue(), AllocaPtr, AllocaSize);
270}
271
272/// Check whether a given allocation must be put on the safe
273/// stack or not. The function analyzes all uses of AI and checks whether it is
274/// only accessed in a memory safe way (as decided statically).
275bool SafeStack::IsSafeStackAlloca(const Value *AllocaPtr, uint64_t AllocaSize) {
276 // Go through all uses of this alloca and check whether all accesses to the
277 // allocated object are statically known to be memory safe and, hence, the
278 // object can be placed on the safe stack.
281 WorkList.push_back(AllocaPtr);
282
283 // A DFS search through all uses of the alloca in bitcasts/PHI/GEPs/etc.
284 while (!WorkList.empty()) {
285 const Value *V = WorkList.pop_back_val();
286 for (const Use &UI : V->uses()) {
287 auto I = cast<const Instruction>(UI.getUser());
288 assert(V == UI.get());
289
290 switch (I->getOpcode()) {
291 case Instruction::Load:
292 if (!IsAccessSafe(UI, DL.getTypeStoreSize(I->getType()), AllocaPtr,
293 AllocaSize))
294 return false;
295 break;
296
297 case Instruction::VAArg:
298 // "va-arg" from a pointer is safe.
299 break;
300 case Instruction::Store:
301 if (V == I->getOperand(0)) {
302 // Stored the pointer - conservatively assume it may be unsafe.
304 << "[SafeStack] Unsafe alloca: " << *AllocaPtr
305 << "\n store of address: " << *I << "\n");
306 return false;
307 }
308
309 if (!IsAccessSafe(UI, DL.getTypeStoreSize(I->getOperand(0)->getType()),
310 AllocaPtr, AllocaSize))
311 return false;
312 break;
313
314 case Instruction::Ret:
315 // Information leak.
316 return false;
317
318 case Instruction::Call:
319 case Instruction::Invoke: {
320 const CallBase &CS = *cast<CallBase>(I);
321
322 if (I->isLifetimeStartOrEnd())
323 continue;
324
325 if (const MemIntrinsic *MI = dyn_cast<MemIntrinsic>(I)) {
326 if (!IsMemIntrinsicSafe(MI, UI, AllocaPtr, AllocaSize)) {
328 << "[SafeStack] Unsafe alloca: " << *AllocaPtr
329 << "\n unsafe memintrinsic: " << *I << "\n");
330 return false;
331 }
332 continue;
333 }
334
335 // LLVM 'nocapture' attribute is only set for arguments whose address
336 // is not stored, passed around, or used in any other non-trivial way.
337 // We assume that passing a pointer to an object as a 'nocapture
338 // readnone' argument is safe.
339 // FIXME: a more precise solution would require an interprocedural
340 // analysis here, which would look at all uses of an argument inside
341 // the function being called.
342 auto B = CS.arg_begin(), E = CS.arg_end();
343 for (const auto *A = B; A != E; ++A)
344 if (A->get() == V)
345 if (!(CS.doesNotCapture(A - B) && (CS.doesNotAccessMemory(A - B) ||
346 CS.doesNotAccessMemory()))) {
347 LLVM_DEBUG(dbgs() << "[SafeStack] Unsafe alloca: " << *AllocaPtr
348 << "\n unsafe call: " << *I << "\n");
349 return false;
350 }
351 continue;
352 }
353
354 default:
355 if (Visited.insert(I).second)
356 WorkList.push_back(cast<const Instruction>(I));
357 }
358 }
359 }
360
361 // All uses of the alloca are safe, we can place it on the safe stack.
362 return true;
363}
364
365Value *SafeStack::getStackGuard(IRBuilder<> &IRB, Function &F) {
366 Value *StackGuardVar = TL.getIRStackGuard(IRB);
367 Module *M = F.getParent();
368
369 if (!StackGuardVar) {
370 TL.insertSSPDeclarations(*M);
371 return IRB.CreateCall(Intrinsic::getDeclaration(M, Intrinsic::stackguard));
372 }
373
374 return IRB.CreateLoad(StackPtrTy, StackGuardVar, "StackGuard");
375}
376
377void SafeStack::findInsts(Function &F,
378 SmallVectorImpl<AllocaInst *> &StaticAllocas,
379 SmallVectorImpl<AllocaInst *> &DynamicAllocas,
380 SmallVectorImpl<Argument *> &ByValArguments,
382 SmallVectorImpl<Instruction *> &StackRestorePoints) {
383 for (Instruction &I : instructions(&F)) {
384 if (auto AI = dyn_cast<AllocaInst>(&I)) {
385 ++NumAllocas;
386
387 uint64_t Size = getStaticAllocaAllocationSize(AI);
388 if (IsSafeStackAlloca(AI, Size))
389 continue;
390
391 if (AI->isStaticAlloca()) {
392 ++NumUnsafeStaticAllocas;
393 StaticAllocas.push_back(AI);
394 } else {
395 ++NumUnsafeDynamicAllocas;
396 DynamicAllocas.push_back(AI);
397 }
398 } else if (auto RI = dyn_cast<ReturnInst>(&I)) {
399 if (CallInst *CI = I.getParent()->getTerminatingMustTailCall())
400 Returns.push_back(CI);
401 else
402 Returns.push_back(RI);
403 } else if (auto CI = dyn_cast<CallInst>(&I)) {
404 // setjmps require stack restore.
405 if (CI->getCalledFunction() && CI->canReturnTwice())
406 StackRestorePoints.push_back(CI);
407 } else if (auto LP = dyn_cast<LandingPadInst>(&I)) {
408 // Exception landing pads require stack restore.
409 StackRestorePoints.push_back(LP);
410 } else if (auto II = dyn_cast<IntrinsicInst>(&I)) {
411 if (II->getIntrinsicID() == Intrinsic::gcroot)
413 "gcroot intrinsic not compatible with safestack attribute");
414 }
415 }
416 for (Argument &Arg : F.args()) {
417 if (!Arg.hasByValAttr())
418 continue;
419 uint64_t Size = DL.getTypeStoreSize(Arg.getParamByValType());
420 if (IsSafeStackAlloca(&Arg, Size))
421 continue;
422
423 ++NumUnsafeByValArguments;
424 ByValArguments.push_back(&Arg);
425 }
426}
427
429SafeStack::createStackRestorePoints(IRBuilder<> &IRB, Function &F,
430 ArrayRef<Instruction *> StackRestorePoints,
431 Value *StaticTop, bool NeedDynamicTop) {
432 assert(StaticTop && "The stack top isn't set.");
433
434 if (StackRestorePoints.empty())
435 return nullptr;
436
437 // We need the current value of the shadow stack pointer to restore
438 // after longjmp or exception catching.
439
440 // FIXME: On some platforms this could be handled by the longjmp/exception
441 // runtime itself.
442
443 AllocaInst *DynamicTop = nullptr;
444 if (NeedDynamicTop) {
445 // If we also have dynamic alloca's, the stack pointer value changes
446 // throughout the function. For now we store it in an alloca.
447 DynamicTop = IRB.CreateAlloca(StackPtrTy, /*ArraySize=*/nullptr,
448 "unsafe_stack_dynamic_ptr");
449 IRB.CreateStore(StaticTop, DynamicTop);
450 }
451
452 // Restore current stack pointer after longjmp/exception catch.
453 for (Instruction *I : StackRestorePoints) {
454 ++NumUnsafeStackRestorePoints;
455
456 IRB.SetInsertPoint(I->getNextNode());
457 Value *CurrentTop =
458 DynamicTop ? IRB.CreateLoad(StackPtrTy, DynamicTop) : StaticTop;
459 IRB.CreateStore(CurrentTop, UnsafeStackPtr);
460 }
461
462 return DynamicTop;
463}
464
465void SafeStack::checkStackGuard(IRBuilder<> &IRB, Function &F, Instruction &RI,
466 AllocaInst *StackGuardSlot, Value *StackGuard) {
467 Value *V = IRB.CreateLoad(StackPtrTy, StackGuardSlot);
468 Value *Cmp = IRB.CreateICmpNE(StackGuard, V);
469
472 MDNode *Weights = MDBuilder(F.getContext())
473 .createBranchWeights(SuccessProb.getNumerator(),
474 FailureProb.getNumerator());
475 Instruction *CheckTerm =
476 SplitBlockAndInsertIfThen(Cmp, &RI, /* Unreachable */ true, Weights, DTU);
477 IRBuilder<> IRBFail(CheckTerm);
478 // FIXME: respect -fsanitize-trap / -ftrap-function here?
479 FunctionCallee StackChkFail =
480 F.getParent()->getOrInsertFunction("__stack_chk_fail", IRB.getVoidTy());
481 IRBFail.CreateCall(StackChkFail, {});
482}
483
484/// We explicitly compute and set the unsafe stack layout for all unsafe
485/// static alloca instructions. We save the unsafe "base pointer" in the
486/// prologue into a local variable and restore it in the epilogue.
487Value *SafeStack::moveStaticAllocasToUnsafeStack(
488 IRBuilder<> &IRB, Function &F, ArrayRef<AllocaInst *> StaticAllocas,
489 ArrayRef<Argument *> ByValArguments, Instruction *BasePointer,
490 AllocaInst *StackGuardSlot) {
491 if (StaticAllocas.empty() && ByValArguments.empty())
492 return BasePointer;
493
494 DIBuilder DIB(*F.getParent());
495
496 StackLifetime SSC(F, StaticAllocas, StackLifetime::LivenessType::May);
497 static const StackLifetime::LiveRange NoColoringRange(1, true);
498 if (ClColoring)
499 SSC.run();
500
501 for (const auto *I : SSC.getMarkers()) {
502 auto *Op = dyn_cast<Instruction>(I->getOperand(1));
503 const_cast<IntrinsicInst *>(I)->eraseFromParent();
504 // Remove the operand bitcast, too, if it has no more uses left.
505 if (Op && Op->use_empty())
506 Op->eraseFromParent();
507 }
508
509 // Unsafe stack always grows down.
510 StackLayout SSL(StackAlignment);
511 if (StackGuardSlot) {
512 Type *Ty = StackGuardSlot->getAllocatedType();
513 Align Align = std::max(DL.getPrefTypeAlign(Ty), StackGuardSlot->getAlign());
514 SSL.addObject(StackGuardSlot, getStaticAllocaAllocationSize(StackGuardSlot),
515 Align, SSC.getFullLiveRange());
516 }
517
518 for (Argument *Arg : ByValArguments) {
519 Type *Ty = Arg->getParamByValType();
520 uint64_t Size = DL.getTypeStoreSize(Ty);
521 if (Size == 0)
522 Size = 1; // Don't create zero-sized stack objects.
523
524 // Ensure the object is properly aligned.
525 Align Align = DL.getPrefTypeAlign(Ty);
526 if (auto A = Arg->getParamAlign())
527 Align = std::max(Align, *A);
528 SSL.addObject(Arg, Size, Align, SSC.getFullLiveRange());
529 }
530
531 for (AllocaInst *AI : StaticAllocas) {
532 Type *Ty = AI->getAllocatedType();
533 uint64_t Size = getStaticAllocaAllocationSize(AI);
534 if (Size == 0)
535 Size = 1; // Don't create zero-sized stack objects.
536
537 // Ensure the object is properly aligned.
538 Align Align = std::max(DL.getPrefTypeAlign(Ty), AI->getAlign());
539
540 SSL.addObject(AI, Size, Align,
541 ClColoring ? SSC.getLiveRange(AI) : NoColoringRange);
542 }
543
544 SSL.computeLayout();
545 Align FrameAlignment = SSL.getFrameAlignment();
546
547 // FIXME: tell SSL that we start at a less-then-MaxAlignment aligned location
548 // (AlignmentSkew).
549 if (FrameAlignment > StackAlignment) {
550 // Re-align the base pointer according to the max requested alignment.
551 IRB.SetInsertPoint(BasePointer->getNextNode());
552 BasePointer = cast<Instruction>(IRB.CreateIntToPtr(
553 IRB.CreateAnd(
554 IRB.CreatePtrToInt(BasePointer, IntPtrTy),
555 ConstantInt::get(IntPtrTy, ~(FrameAlignment.value() - 1))),
556 StackPtrTy));
557 }
558
559 IRB.SetInsertPoint(BasePointer->getNextNode());
560
561 if (StackGuardSlot) {
562 unsigned Offset = SSL.getObjectOffset(StackGuardSlot);
563 Value *Off =
564 IRB.CreatePtrAdd(BasePointer, ConstantInt::get(Int32Ty, -Offset));
565 Value *NewAI =
566 IRB.CreateBitCast(Off, StackGuardSlot->getType(), "StackGuardSlot");
567
568 // Replace alloc with the new location.
569 StackGuardSlot->replaceAllUsesWith(NewAI);
570 StackGuardSlot->eraseFromParent();
571 }
572
573 for (Argument *Arg : ByValArguments) {
574 unsigned Offset = SSL.getObjectOffset(Arg);
575 MaybeAlign Align(SSL.getObjectAlignment(Arg));
576 Type *Ty = Arg->getParamByValType();
577
578 uint64_t Size = DL.getTypeStoreSize(Ty);
579 if (Size == 0)
580 Size = 1; // Don't create zero-sized stack objects.
581
582 Value *Off =
583 IRB.CreatePtrAdd(BasePointer, ConstantInt::get(Int32Ty, -Offset));
584 Value *NewArg = IRB.CreateBitCast(Off, Arg->getType(),
585 Arg->getName() + ".unsafe-byval");
586
587 // Replace alloc with the new location.
588 replaceDbgDeclare(Arg, BasePointer, DIB, DIExpression::ApplyOffset,
589 -Offset);
590 Arg->replaceAllUsesWith(NewArg);
591 IRB.SetInsertPoint(cast<Instruction>(NewArg)->getNextNode());
592 IRB.CreateMemCpy(Off, Align, Arg, Arg->getParamAlign(), Size);
593 }
594
595 // Allocate space for every unsafe static AllocaInst on the unsafe stack.
596 for (AllocaInst *AI : StaticAllocas) {
597 IRB.SetInsertPoint(AI);
598 unsigned Offset = SSL.getObjectOffset(AI);
599
600 replaceDbgDeclare(AI, BasePointer, DIB, DIExpression::ApplyOffset, -Offset);
601 replaceDbgValueForAlloca(AI, BasePointer, DIB, -Offset);
602
603 // Replace uses of the alloca with the new location.
604 // Insert address calculation close to each use to work around PR27844.
605 std::string Name = std::string(AI->getName()) + ".unsafe";
606 while (!AI->use_empty()) {
607 Use &U = *AI->use_begin();
608 Instruction *User = cast<Instruction>(U.getUser());
609
610 Instruction *InsertBefore;
611 if (auto *PHI = dyn_cast<PHINode>(User))
612 InsertBefore = PHI->getIncomingBlock(U)->getTerminator();
613 else
614 InsertBefore = User;
615
616 IRBuilder<> IRBUser(InsertBefore);
617 Value *Off =
618 IRBUser.CreatePtrAdd(BasePointer, ConstantInt::get(Int32Ty, -Offset));
619 Value *Replacement = IRBUser.CreateBitCast(Off, AI->getType(), Name);
620
621 if (auto *PHI = dyn_cast<PHINode>(User))
622 // PHI nodes may have multiple incoming edges from the same BB (why??),
623 // all must be updated at once with the same incoming value.
624 PHI->setIncomingValueForBlock(PHI->getIncomingBlock(U), Replacement);
625 else
626 U.set(Replacement);
627 }
628
629 AI->eraseFromParent();
630 }
631
632 // Re-align BasePointer so that our callees would see it aligned as
633 // expected.
634 // FIXME: no need to update BasePointer in leaf functions.
635 unsigned FrameSize = alignTo(SSL.getFrameSize(), StackAlignment);
636
637 MDBuilder MDB(F.getContext());
639 Data.push_back(MDB.createString("unsafe-stack-size"));
640 Data.push_back(MDB.createConstant(ConstantInt::get(Int32Ty, FrameSize)));
641 MDNode *MD = MDTuple::get(F.getContext(), Data);
642 F.setMetadata(LLVMContext::MD_annotation, MD);
643
644 // Update shadow stack pointer in the function epilogue.
645 IRB.SetInsertPoint(BasePointer->getNextNode());
646
647 Value *StaticTop =
648 IRB.CreatePtrAdd(BasePointer, ConstantInt::get(Int32Ty, -FrameSize),
649 "unsafe_stack_static_top");
650 IRB.CreateStore(StaticTop, UnsafeStackPtr);
651 return StaticTop;
652}
653
654void SafeStack::moveDynamicAllocasToUnsafeStack(
655 Function &F, Value *UnsafeStackPtr, AllocaInst *DynamicTop,
656 ArrayRef<AllocaInst *> DynamicAllocas) {
657 DIBuilder DIB(*F.getParent());
658
659 for (AllocaInst *AI : DynamicAllocas) {
660 IRBuilder<> IRB(AI);
661
662 // Compute the new SP value (after AI).
663 Value *ArraySize = AI->getArraySize();
664 if (ArraySize->getType() != IntPtrTy)
665 ArraySize = IRB.CreateIntCast(ArraySize, IntPtrTy, false);
666
667 Type *Ty = AI->getAllocatedType();
668 uint64_t TySize = DL.getTypeAllocSize(Ty);
669 Value *Size = IRB.CreateMul(ArraySize, ConstantInt::get(IntPtrTy, TySize));
670
671 Value *SP = IRB.CreatePtrToInt(IRB.CreateLoad(StackPtrTy, UnsafeStackPtr),
672 IntPtrTy);
673 SP = IRB.CreateSub(SP, Size);
674
675 // Align the SP value to satisfy the AllocaInst, type and stack alignments.
676 auto Align = std::max(std::max(DL.getPrefTypeAlign(Ty), AI->getAlign()),
677 StackAlignment);
678
679 Value *NewTop = IRB.CreateIntToPtr(
680 IRB.CreateAnd(SP,
681 ConstantInt::get(IntPtrTy, ~uint64_t(Align.value() - 1))),
682 StackPtrTy);
683
684 // Save the stack pointer.
685 IRB.CreateStore(NewTop, UnsafeStackPtr);
686 if (DynamicTop)
687 IRB.CreateStore(NewTop, DynamicTop);
688
689 Value *NewAI = IRB.CreatePointerCast(NewTop, AI->getType());
690 if (AI->hasName() && isa<Instruction>(NewAI))
691 NewAI->takeName(AI);
692
694 AI->replaceAllUsesWith(NewAI);
695 AI->eraseFromParent();
696 }
697
698 if (!DynamicAllocas.empty()) {
699 // Now go through the instructions again, replacing stacksave/stackrestore.
701 auto *II = dyn_cast<IntrinsicInst>(&I);
702 if (!II)
703 continue;
704
705 if (II->getIntrinsicID() == Intrinsic::stacksave) {
706 IRBuilder<> IRB(II);
707 Instruction *LI = IRB.CreateLoad(StackPtrTy, UnsafeStackPtr);
708 LI->takeName(II);
709 II->replaceAllUsesWith(LI);
710 II->eraseFromParent();
711 } else if (II->getIntrinsicID() == Intrinsic::stackrestore) {
712 IRBuilder<> IRB(II);
713 Instruction *SI = IRB.CreateStore(II->getArgOperand(0), UnsafeStackPtr);
714 SI->takeName(II);
715 assert(II->use_empty());
716 II->eraseFromParent();
717 }
718 }
719 }
720}
721
722bool SafeStack::ShouldInlinePointerAddress(CallInst &CI) {
724 if (CI.hasFnAttr(Attribute::AlwaysInline) &&
725 isInlineViable(*Callee).isSuccess())
726 return true;
727 if (Callee->isInterposable() || Callee->hasFnAttribute(Attribute::NoInline) ||
728 CI.isNoInline())
729 return false;
730 return true;
731}
732
733void SafeStack::TryInlinePointerAddress() {
734 auto *CI = dyn_cast<CallInst>(UnsafeStackPtr);
735 if (!CI)
736 return;
737
738 if(F.hasOptNone())
739 return;
740
742 if (!Callee || Callee->isDeclaration())
743 return;
744
745 if (!ShouldInlinePointerAddress(*CI))
746 return;
747
749 InlineFunction(*CI, IFI);
750}
751
752bool SafeStack::run() {
753 assert(F.hasFnAttribute(Attribute::SafeStack) &&
754 "Can't run SafeStack on a function without the attribute");
755 assert(!F.isDeclaration() && "Can't run SafeStack on a function declaration");
756
757 ++NumFunctions;
758
759 SmallVector<AllocaInst *, 16> StaticAllocas;
760 SmallVector<AllocaInst *, 4> DynamicAllocas;
761 SmallVector<Argument *, 4> ByValArguments;
763
764 // Collect all points where stack gets unwound and needs to be restored
765 // This is only necessary because the runtime (setjmp and unwind code) is
766 // not aware of the unsafe stack and won't unwind/restore it properly.
767 // To work around this problem without changing the runtime, we insert
768 // instrumentation to restore the unsafe stack pointer when necessary.
769 SmallVector<Instruction *, 4> StackRestorePoints;
770
771 // Find all static and dynamic alloca instructions that must be moved to the
772 // unsafe stack, all return instructions and stack restore points.
773 findInsts(F, StaticAllocas, DynamicAllocas, ByValArguments, Returns,
774 StackRestorePoints);
775
776 if (StaticAllocas.empty() && DynamicAllocas.empty() &&
777 ByValArguments.empty() && StackRestorePoints.empty())
778 return false; // Nothing to do in this function.
779
780 if (!StaticAllocas.empty() || !DynamicAllocas.empty() ||
781 !ByValArguments.empty())
782 ++NumUnsafeStackFunctions; // This function has the unsafe stack.
783
784 if (!StackRestorePoints.empty())
785 ++NumUnsafeStackRestorePointsFunctions;
786
787 IRBuilder<> IRB(&F.front(), F.begin()->getFirstInsertionPt());
788 // Calls must always have a debug location, or else inlining breaks. So
789 // we explicitly set a artificial debug location here.
790 if (DISubprogram *SP = F.getSubprogram())
792 DILocation::get(SP->getContext(), SP->getScopeLine(), 0, SP));
794 FunctionCallee Fn = F.getParent()->getOrInsertFunction(
795 "__safestack_pointer_address", IRB.getPtrTy(0));
796 UnsafeStackPtr = IRB.CreateCall(Fn);
797 } else {
798 UnsafeStackPtr = TL.getSafeStackPointerLocation(IRB);
799 }
800
801 // Load the current stack pointer (we'll also use it as a base pointer).
802 // FIXME: use a dedicated register for it ?
803 Instruction *BasePointer =
804 IRB.CreateLoad(StackPtrTy, UnsafeStackPtr, false, "unsafe_stack_ptr");
805 assert(BasePointer->getType() == StackPtrTy);
806
807 AllocaInst *StackGuardSlot = nullptr;
808 // FIXME: implement weaker forms of stack protector.
809 if (F.hasFnAttribute(Attribute::StackProtect) ||
810 F.hasFnAttribute(Attribute::StackProtectStrong) ||
811 F.hasFnAttribute(Attribute::StackProtectReq)) {
812 Value *StackGuard = getStackGuard(IRB, F);
813 StackGuardSlot = IRB.CreateAlloca(StackPtrTy, nullptr);
814 IRB.CreateStore(StackGuard, StackGuardSlot);
815
816 for (Instruction *RI : Returns) {
817 IRBuilder<> IRBRet(RI);
818 checkStackGuard(IRBRet, F, *RI, StackGuardSlot, StackGuard);
819 }
820 }
821
822 // The top of the unsafe stack after all unsafe static allocas are
823 // allocated.
824 Value *StaticTop = moveStaticAllocasToUnsafeStack(
825 IRB, F, StaticAllocas, ByValArguments, BasePointer, StackGuardSlot);
826
827 // Safe stack object that stores the current unsafe stack top. It is updated
828 // as unsafe dynamic (non-constant-sized) allocas are allocated and freed.
829 // This is only needed if we need to restore stack pointer after longjmp
830 // or exceptions, and we have dynamic allocations.
831 // FIXME: a better alternative might be to store the unsafe stack pointer
832 // before setjmp / invoke instructions.
833 AllocaInst *DynamicTop = createStackRestorePoints(
834 IRB, F, StackRestorePoints, StaticTop, !DynamicAllocas.empty());
835
836 // Handle dynamic allocas.
837 moveDynamicAllocasToUnsafeStack(F, UnsafeStackPtr, DynamicTop,
838 DynamicAllocas);
839
840 // Restore the unsafe stack pointer before each return.
841 for (Instruction *RI : Returns) {
842 IRB.SetInsertPoint(RI);
843 IRB.CreateStore(BasePointer, UnsafeStackPtr);
844 }
845
846 TryInlinePointerAddress();
847
848 LLVM_DEBUG(dbgs() << "[SafeStack] safestack applied\n");
849 return true;
850}
851
852class SafeStackLegacyPass : public FunctionPass {
853 const TargetMachine *TM = nullptr;
854
855public:
856 static char ID; // Pass identification, replacement for typeid..
857
858 SafeStackLegacyPass() : FunctionPass(ID) {
860 }
861
862 void getAnalysisUsage(AnalysisUsage &AU) const override {
867 }
868
869 bool runOnFunction(Function &F) override {
870 LLVM_DEBUG(dbgs() << "[SafeStack] Function: " << F.getName() << "\n");
871
872 if (!F.hasFnAttribute(Attribute::SafeStack)) {
873 LLVM_DEBUG(dbgs() << "[SafeStack] safestack is not requested"
874 " for this function\n");
875 return false;
876 }
877
878 if (F.isDeclaration()) {
879 LLVM_DEBUG(dbgs() << "[SafeStack] function definition"
880 " is not available\n");
881 return false;
882 }
883
884 TM = &getAnalysis<TargetPassConfig>().getTM<TargetMachine>();
885 auto *TL = TM->getSubtargetImpl(F)->getTargetLowering();
886 if (!TL)
887 report_fatal_error("TargetLowering instance is required");
888
889 auto *DL = &F.getDataLayout();
890 auto &TLI = getAnalysis<TargetLibraryInfoWrapperPass>().getTLI(F);
891 auto &ACT = getAnalysis<AssumptionCacheTracker>().getAssumptionCache(F);
892
893 // Compute DT and LI only for functions that have the attribute.
894 // This is only useful because the legacy pass manager doesn't let us
895 // compute analyzes lazily.
896
897 DominatorTree *DT;
898 bool ShouldPreserveDominatorTree;
899 std::optional<DominatorTree> LazilyComputedDomTree;
900
901 // Do we already have a DominatorTree avaliable from the previous pass?
902 // Note that we should *NOT* require it, to avoid the case where we end up
903 // not needing it, but the legacy PM would have computed it for us anyways.
904 if (auto *DTWP = getAnalysisIfAvailable<DominatorTreeWrapperPass>()) {
905 DT = &DTWP->getDomTree();
906 ShouldPreserveDominatorTree = true;
907 } else {
908 // Otherwise, we need to compute it.
909 LazilyComputedDomTree.emplace(F);
910 DT = &*LazilyComputedDomTree;
911 ShouldPreserveDominatorTree = false;
912 }
913
914 // Likewise, lazily compute loop info.
915 LoopInfo LI(*DT);
916
917 DomTreeUpdater DTU(DT, DomTreeUpdater::UpdateStrategy::Lazy);
918
919 ScalarEvolution SE(F, TLI, ACT, *DT, LI);
920
921 return SafeStack(F, *TL, *DL, ShouldPreserveDominatorTree ? &DTU : nullptr,
922 SE)
923 .run();
924 }
925};
926
927} // end anonymous namespace
928
931 LLVM_DEBUG(dbgs() << "[SafeStack] Function: " << F.getName() << "\n");
932
933 if (!F.hasFnAttribute(Attribute::SafeStack)) {
934 LLVM_DEBUG(dbgs() << "[SafeStack] safestack is not requested"
935 " for this function\n");
936 return PreservedAnalyses::all();
937 }
938
939 if (F.isDeclaration()) {
940 LLVM_DEBUG(dbgs() << "[SafeStack] function definition"
941 " is not available\n");
942 return PreservedAnalyses::all();
943 }
944
945 auto *TL = TM->getSubtargetImpl(F)->getTargetLowering();
946 if (!TL)
947 report_fatal_error("TargetLowering instance is required");
948
949 auto &DL = F.getDataLayout();
950
951 // preserve DominatorTree
954 DomTreeUpdater DTU(DT, DomTreeUpdater::UpdateStrategy::Lazy);
955
956 bool Changed = SafeStack(F, *TL, DL, &DTU, SE).run();
957
958 if (!Changed)
959 return PreservedAnalyses::all();
962 return PA;
963}
964
965char SafeStackLegacyPass::ID = 0;
966
968 "Safe Stack instrumentation pass", false, false)
971INITIALIZE_PASS_END(SafeStackLegacyPass, DEBUG_TYPE,
973
974FunctionPass *llvm::createSafeStackPass() { return new SafeStackLegacyPass(); }
Rewrite undef for PHI
This file implements a class to represent arbitrary precision integral constant values and operations...
MachineBasicBlock MachineBasicBlock::iterator DebugLoc DL
VarLocInsertPt getNextNode(const DbgRecord *DVR)
Expand Atomic instructions
This file contains the simple types necessary to represent the attributes associated with functions a...
static GCRegistry::Add< OcamlGC > B("ocaml", "ocaml 3.10-compatible GC")
static GCRegistry::Add< ErlangGC > A("erlang", "erlang-compatible garbage collector")
This file contains the declarations for the subclasses of Constant, which represent the different fla...
#define LLVM_DEBUG(X)
Definition: Debug.h:101
uint64_t Addr
std::string Name
uint64_t Size
#define DEBUG_TYPE
IRTranslator LLVM IR MI
This defines the Use class.
#define F(x, y, z)
Definition: MD5.cpp:55
#define I(x, y, z)
Definition: MD5.cpp:58
This file contains the declarations for metadata subclasses.
Module.h This file contains the declarations for the Module class.
modulo schedule Modulo Schedule test pass
uint64_t IntrinsicInst * II
FunctionAnalysisManager FAM
#define INITIALIZE_PASS_DEPENDENCY(depName)
Definition: PassSupport.h:55
#define INITIALIZE_PASS_END(passName, arg, name, cfg, analysis)
Definition: PassSupport.h:57
#define INITIALIZE_PASS_BEGIN(passName, arg, name, cfg, analysis)
Definition: PassSupport.h:52
assert(ImpDefSCC.getReg()==AMDGPU::SCC &&ImpDefSCC.isDef())
static cl::opt< bool > SafeStackUsePointerAddress("safestack-use-pointer-address", cl::init(false), cl::Hidden)
Use __safestack_pointer_address even if the platform has a faster way of access safe stack pointer.
static cl::opt< bool > ClColoring("safe-stack-coloring", cl::desc("enable safe stack coloring"), cl::Hidden, cl::init(true))
This file defines the SmallPtrSet class.
This file defines the SmallVector class.
static Value * getStackGuard(const TargetLoweringBase *TLI, Module *M, IRBuilder<> &B, bool *SupportsSelectionDAGSP=nullptr)
Create a stack guard loading and populate whether SelectionDAG SSP is supported.
This file defines the 'Statistic' class, which is designed to be an easy way to expose various metric...
#define STATISTIC(VARNAME, DESC)
Definition: Statistic.h:166
This file describes how to lower LLVM code to machine code.
Target-Independent Code Generator Pass Configuration Options pass.
xray instrumentation
Class for arbitrary precision integers.
Definition: APInt.h:78
an instruction to allocate memory on the stack
Definition: Instructions.h:61
bool isStaticAlloca() const
Return true if this alloca is in the entry block of the function and is a constant size.
Align getAlign() const
Return the alignment of the memory that is being allocated by the instruction.
Definition: Instructions.h:122
PointerType * getType() const
Overload to return most specific pointer type.
Definition: Instructions.h:97
Type * getAllocatedType() const
Return the type that is being allocated by the instruction.
Definition: Instructions.h:115
bool isArrayAllocation() const
Return true if there is an allocation size parameter to the allocation instruction that is not 1.
const Value * getArraySize() const
Get the number of elements allocated.
Definition: Instructions.h:93
A container for analyses that lazily runs them and caches their results.
Definition: PassManager.h:253
PassT::Result & getResult(IRUnitT &IR, ExtraArgTs... ExtraArgs)
Get the result of an analysis pass for a given IR unit.
Definition: PassManager.h:405
Represent the analysis usage information of a pass.
AnalysisUsage & addRequired()
AnalysisUsage & addPreserved()
Add the specified Pass class to the set of analyses preserved by this pass.
This class represents an incoming formal argument to a Function.
Definition: Argument.h:31
ArrayRef - Represent a constant reference to an array (0 or more elements consecutively in memory),...
Definition: ArrayRef.h:41
bool empty() const
empty - Check if the array is empty.
Definition: ArrayRef.h:160
An immutable pass that tracks lazily created AssumptionCache objects.
static BranchProbability getBranchProbStackProtector(bool IsLikely)
Base class for all callable instructions (InvokeInst and CallInst) Holds everything related to callin...
Definition: InstrTypes.h:1236
bool doesNotCapture(unsigned OpNo) const
Determine whether this data operand is not captured.
Definition: InstrTypes.h:1769
Function * getCalledFunction() const
Returns the function called, or null if this is an indirect function invocation or the function signa...
Definition: InstrTypes.h:1465
bool doesNotAccessMemory(unsigned OpNo) const
Definition: InstrTypes.h:1810
bool hasFnAttr(Attribute::AttrKind Kind) const
Determine whether this call has the given attribute.
Definition: InstrTypes.h:1551
User::op_iterator arg_begin()
Return the iterator pointing to the beginning of the argument list.
Definition: InstrTypes.h:1385
bool isNoInline() const
Return true if the call should not be inlined.
Definition: InstrTypes.h:1974
User::op_iterator arg_end()
Return the iterator pointing to the end of the argument list.
Definition: InstrTypes.h:1391
This class represents a function call, abstracting a target machine's calling convention.
This class represents a range of values.
Definition: ConstantRange.h:47
ConstantRange add(const ConstantRange &Other) const
Return a new range representing the possible values resulting from an addition of a value in this ran...
bool contains(const APInt &Val) const
Return true if the specified value is in the set.
Subprogram description.
This class represents an Operation in the Expression.
A parsed version of the target data layout string in and methods for querying it.
Definition: DataLayout.h:63
Analysis pass which computes a DominatorTree.
Definition: Dominators.h:279
Legacy analysis pass which computes a DominatorTree.
Definition: Dominators.h:317
Concrete subclass of DominatorTreeBase that is used to compute a normal dominator tree.
Definition: Dominators.h:162
A handy container for a FunctionType+Callee-pointer pair, which can be passed around as a single enti...
Definition: DerivedTypes.h:168
FunctionPass class - This class is used to implement most global optimizations.
Definition: Pass.h:310
virtual bool runOnFunction(Function &F)=0
runOnFunction - Virtual method overriden by subclasses to do the per-function processing of the pass.
AllocaInst * CreateAlloca(Type *Ty, unsigned AddrSpace, Value *ArraySize=nullptr, const Twine &Name="")
Definition: IRBuilder.h:1790
Value * CreatePointerCast(Value *V, Type *DestTy, const Twine &Name="")
Definition: IRBuilder.h:2190
Value * CreateIntToPtr(Value *V, Type *DestTy, const Twine &Name="")
Definition: IRBuilder.h:2142
Value * CreatePtrAdd(Value *Ptr, Value *Offset, const Twine &Name="", GEPNoWrapFlags NW=GEPNoWrapFlags::none())
Definition: IRBuilder.h:1996
void SetCurrentDebugLocation(DebugLoc L)
Set location information used by debugging information.
Definition: IRBuilder.h:217
Value * CreateICmpNE(Value *LHS, Value *RHS, const Twine &Name="")
Definition: IRBuilder.h:2265
Value * CreateSub(Value *LHS, Value *RHS, const Twine &Name="", bool HasNUW=false, bool HasNSW=false)
Definition: IRBuilder.h:1361
Value * CreateBitCast(Value *V, Type *DestTy, const Twine &Name="")
Definition: IRBuilder.h:2147
LoadInst * CreateLoad(Type *Ty, Value *Ptr, const char *Name)
Provided to resolve 'CreateLoad(Ty, Ptr, "...")' correctly, instead of converting the string to 'bool...
Definition: IRBuilder.h:1807
Value * CreateAnd(Value *LHS, Value *RHS, const Twine &Name="")
Definition: IRBuilder.h:1492
StoreInst * CreateStore(Value *Val, Value *Ptr, bool isVolatile=false)
Definition: IRBuilder.h:1820
Value * CreatePtrToInt(Value *V, Type *DestTy, const Twine &Name="")
Definition: IRBuilder.h:2137
PointerType * getPtrTy(unsigned AddrSpace=0)
Fetch the type representing a pointer.
Definition: IRBuilder.h:566
Value * CreateIntCast(Value *V, Type *DestTy, bool isSigned, const Twine &Name="")
Definition: IRBuilder.h:2216
void SetInsertPoint(BasicBlock *TheBB)
This specifies that created instructions should be appended to the end of the specified block.
Definition: IRBuilder.h:177
Type * getVoidTy()
Fetch the type representing void.
Definition: IRBuilder.h:561
CallInst * CreateCall(FunctionType *FTy, Value *Callee, ArrayRef< Value * > Args=std::nullopt, const Twine &Name="", MDNode *FPMathTag=nullptr)
Definition: IRBuilder.h:2432
CallInst * CreateMemCpy(Value *Dst, MaybeAlign DstAlign, Value *Src, MaybeAlign SrcAlign, uint64_t Size, bool isVolatile=false, MDNode *TBAATag=nullptr, MDNode *TBAAStructTag=nullptr, MDNode *ScopeTag=nullptr, MDNode *NoAliasTag=nullptr)
Create and insert a memcpy between the specified pointers.
Definition: IRBuilder.h:656
Value * CreateMul(Value *LHS, Value *RHS, const Twine &Name="", bool HasNUW=false, bool HasNSW=false)
Definition: IRBuilder.h:1378
This provides a uniform API for creating instructions and inserting them into a basic block: either a...
Definition: IRBuilder.h:2686
This class captures the data input to the InlineFunction call, and records the auxiliary results prod...
Definition: Cloning.h:203
bool isSuccess() const
Definition: InlineCost.h:189
InstListType::iterator eraseFromParent()
This method unlinks 'this' from the containing basic block and deletes it.
Definition: Instruction.cpp:92
A wrapper class for inspecting calls to intrinsic functions.
Definition: IntrinsicInst.h:48
MDNode * createBranchWeights(uint32_t TrueWeight, uint32_t FalseWeight, bool IsExpected=false)
Return metadata containing two branch weights.
Definition: MDBuilder.cpp:37
Metadata node.
Definition: Metadata.h:1069
static MDTuple * get(LLVMContext &Context, ArrayRef< Metadata * > MDs)
Definition: Metadata.h:1499
This is the common base class for memset/memcpy/memmove.
A Module instance is used to store all the information related to an LLVM module.
Definition: Module.h:65
static PassRegistry * getPassRegistry()
getPassRegistry - Access the global registry object, which is automatically initialized at applicatio...
virtual void getAnalysisUsage(AnalysisUsage &) const
getAnalysisUsage - This function should be overriden by passes that need analysis information to do t...
Definition: Pass.cpp:98
A set of analyses that are preserved following a run of a transformation pass.
Definition: Analysis.h:111
static PreservedAnalyses all()
Construct a special preserved set that preserves all passes.
Definition: Analysis.h:117
void preserve()
Mark an analysis as preserved.
Definition: Analysis.h:131
This class represents an analyzed expression in the program.
Type * getType() const
Return the LLVM type of this SCEV expression.
PreservedAnalyses run(Function &F, FunctionAnalysisManager &FAM)
Definition: SafeStack.cpp:929
Analysis pass that exposes the ScalarEvolution for a function.
The main scalar evolution driver.
std::pair< iterator, bool > insert(PtrType Ptr)
Inserts Ptr if and only if there is no element in the container equal to Ptr.
Definition: SmallPtrSet.h:367
SmallPtrSet - This class implements a set which is optimized for holding SmallSize or less elements.
Definition: SmallPtrSet.h:502
bool empty() const
Definition: SmallVector.h:94
This class consists of common code factored out of the SmallVector class to reduce code duplication b...
Definition: SmallVector.h:586
void push_back(const T &Elt)
Definition: SmallVector.h:426
This is a 'vector' (really, a variable-sized array), optimized for the case when the array is small.
Definition: SmallVector.h:1209
This class represents a set of interesting instructions where an alloca is live.
Definition: StackLifetime.h:63
Compute live ranges of allocas.
Definition: StackLifetime.h:37
This base class for TargetLowering contains the SelectionDAG-independent parts that can be used from ...
Primary interface to the complete machine description for the target machine.
Definition: TargetMachine.h:77
Target-Independent Code Generator Pass Configuration Options.
The instances of the Type class are immutable: once they are created, they are never changed.
Definition: Type.h:45
A Use represents the edge between a Value definition and its users.
Definition: Use.h:43
LLVM Value Representation.
Definition: Value.h:74
Type * getType() const
All values are typed, get the type of this value.
Definition: Value.h:255
void replaceAllUsesWith(Value *V)
Change all uses of this to point to a new Value.
Definition: Value.cpp:534
use_iterator use_begin()
Definition: Value.h:360
bool use_empty() const
Definition: Value.h:344
LLVMContext & getContext() const
All values hold a context through their type.
Definition: Value.cpp:1075
bool hasName() const
Definition: Value.h:261
StringRef getName() const
Return a constant reference to the value's name.
Definition: Value.cpp:309
void takeName(Value *V)
Transfer the name from V to this value.
Definition: Value.cpp:383
NodeTy * getNextNode()
Get the next node, or nullptr for the list tail.
Definition: ilist_node.h:353
Compute the layout of an unsafe stack frame.
unsigned ID
LLVM IR allows to use arbitrary numbers as calling convention identifiers.
Definition: CallingConv.h:24
@ C
The default llvm calling convention, compatible with C.
Definition: CallingConv.h:34
Function * getDeclaration(Module *M, ID id, ArrayRef< Type * > Tys=std::nullopt)
Create or insert an LLVM Function declaration for an intrinsic, and return it.
Definition: Function.cpp:1539
initializer< Ty > init(const Ty &Val)
Definition: CommandLine.h:443
PointerTypeMap run(const Module &M)
Compute the PointerTypeMap for the module M.
This is an optimization pass for GlobalISel generic memory operations.
Definition: AddressRanges.h:18
@ Offset
Definition: DWP.cpp:480
FunctionPass * createSafeStackPass()
This pass splits the stack into a safe stack and an unsafe stack to protect against stack-based overf...
Definition: SafeStack.cpp:974
iterator_range< early_inc_iterator_impl< detail::IterOfRange< RangeT > > > make_early_inc_range(RangeT &&Range)
Make a range that does early increment to allow mutation of the underlying range without disrupting i...
Definition: STLExtras.h:656
InlineResult isInlineViable(Function &Callee)
Minimal filter to detect invalid constructs for inlining.
raw_ostream & dbgs()
dbgs() - This returns a reference to a raw_ostream for debugging messages.
Definition: Debug.cpp:163
void report_fatal_error(Error Err, bool gen_crash_diag=true)
Report a serious error, calling any installed error handler.
Definition: Error.cpp:167
uint64_t alignTo(uint64_t Size, Align A)
Returns a multiple of A needed to store Size bytes.
Definition: Alignment.h:155
void initializeSafeStackLegacyPassPass(PassRegistry &)
InlineResult InlineFunction(CallBase &CB, InlineFunctionInfo &IFI, bool MergeAttributes=false, AAResults *CalleeAAR=nullptr, bool InsertLifetime=true, Function *ForwardVarArgsTo=nullptr)
This function inlines the called function into the basic block of the caller.
void replaceDbgValueForAlloca(AllocaInst *AI, Value *NewAllocaAddress, DIBuilder &Builder, int Offset=0)
Replaces multiple llvm.dbg.value instructions when the alloca it describes is replaced with a new val...
Definition: Local.cpp:2181
constexpr unsigned BitWidth
Definition: BitmaskEnum.h:191
Instruction * SplitBlockAndInsertIfThen(Value *Cond, BasicBlock::iterator SplitBefore, bool Unreachable, MDNode *BranchWeights=nullptr, DomTreeUpdater *DTU=nullptr, LoopInfo *LI=nullptr, BasicBlock *ThenBlock=nullptr)
Split the containing block at the specified instruction - everything before SplitBefore stays in the ...
bool replaceDbgDeclare(Value *Address, Value *NewAddress, DIBuilder &Builder, uint8_t DIExprFlags, int Offset)
Replaces llvm.dbg.declare instruction when the address it describes is replaced with a new value.
Definition: Local.cpp:2132
This struct is a compact representation of a valid (non-zero power of two) alignment.
Definition: Alignment.h:39
uint64_t value() const
This is a hole in the type system and should not be abused.
Definition: Alignment.h:85
This struct is a compact representation of a valid (power of two) or undefined (0) alignment.
Definition: Alignment.h:117