56#define DEBUG_TYPE "stack-protector"
58STATISTIC(NumFunProtected,
"Number of functions protected");
59STATISTIC(NumAddrTaken,
"Number of local variables that have their address"
74 "Insert stack protectors",
false,
true)
90 if (
auto *DTWP = getAnalysisIfAvailable<DominatorTreeWrapperPass>())
99 "stack-protector-buffer-size", DefaultSSPBufferSize);
112 bool Changed = InsertStackProtectors();
113#ifdef EXPENSIVE_CHECKS
115 DTU->getDomTree().verify(DominatorTree::VerificationLevel::Full)) &&
116 "Failed to maintain validity of domtree!");
126 bool &IsLarge,
bool Strong,
130 if (
ArrayType *AT = dyn_cast<ArrayType>(Ty)) {
131 if (!AT->getElementType()->isIntegerTy(8)) {
142 if (SSPBufferSize <= M->getDataLayout().getTypeAllocSize(AT)) {
152 const StructType *ST = dyn_cast<StructType>(Ty);
156 bool NeedsProtector =
false;
157 for (
Type *ET : ST->elements())
164 NeedsProtector =
true;
167 return NeedsProtector;
176 const auto *
I = cast<Instruction>(U);
180 if (MemLoc && MemLoc->Size.hasValue() &&
184 switch (
I->getOpcode()) {
185 case Instruction::Store:
186 if (AI == cast<StoreInst>(
I)->getValueOperand())
189 case Instruction::AtomicCmpXchg:
192 if (AI == cast<AtomicCmpXchgInst>(
I)->getNewValOperand())
195 case Instruction::PtrToInt:
196 if (AI == cast<PtrToIntInst>(
I)->getOperand(0))
199 case Instruction::Call: {
202 const auto *CI = cast<CallInst>(
I);
203 if (!CI->isDebugOrPseudoInst() && !CI->isLifetimeStartOrEnd())
207 case Instruction::Invoke:
209 case Instruction::GetElementPtr: {
215 unsigned IndexSize =
DL.getIndexTypeSizeInBits(
I->getType());
231 case Instruction::BitCast:
232 case Instruction::Select:
233 case Instruction::AddrSpaceCast:
237 case Instruction::PHI: {
240 const auto *PN = cast<PHINode>(
I);
241 if (VisitedPHIs.
insert(PN).second)
246 case Instruction::Load:
247 case Instruction::AtomicRMW:
248 case Instruction::Ret:
269 if (
const auto *II = dyn_cast<IntrinsicInst>(&
I))
270 if (II->getIntrinsicID() == Intrinsic::stackprotector)
291 bool NeedsProtector =
false;
298 unsigned SSPBufferSize =
F->getFnAttributeAsParsedInteger(
299 "stack-protector-buffer-size", DefaultSSPBufferSize);
301 if (
F->hasFnAttribute(Attribute::SafeStack))
309 if (
F->hasFnAttribute(Attribute::StackProtectReq)) {
314 <<
"Stack protection applied to function "
316 <<
" due to a function attribute or command-line switch";
318 NeedsProtector =
true;
320 }
else if (
F->hasFnAttribute(Attribute::StackProtectStrong))
322 else if (!
F->hasFnAttribute(Attribute::StackProtect))
327 if (
const AllocaInst *AI = dyn_cast<AllocaInst>(&
I)) {
328 if (AI->isArrayAllocation()) {
329 auto RemarkBuilder = [&]() {
332 <<
"Stack protection applied to function "
334 <<
" due to a call to alloca or use of a variable length "
337 if (
const auto *CI = dyn_cast<ConstantInt>(AI->getArraySize())) {
338 if (CI->getLimitedValue(SSPBufferSize) >= SSPBufferSize) {
345 ORE.
emit(RemarkBuilder);
346 NeedsProtector =
true;
353 ORE.
emit(RemarkBuilder);
354 NeedsProtector =
true;
362 ORE.
emit(RemarkBuilder);
363 NeedsProtector =
true;
368 bool IsLarge =
false;
370 IsLarge, Strong,
false)) {
373 Layout->
insert(std::make_pair(
378 <<
"Stack protection applied to function "
380 <<
" due to a stack allocated buffer or struct containing a "
383 NeedsProtector =
true;
389 AI, M->getDataLayout().getTypeAllocSize(AI->getAllocatedType()),
398 <<
"Stack protection applied to function "
400 <<
" due to the address of a local variable being taken";
402 NeedsProtector =
true;
411 return NeedsProtector;
418 bool *SupportsSelectionDAGSP =
nullptr) {
420 StringRef GuardMode = M->getStackProtectorGuard();
421 if ((GuardMode ==
"tls" || GuardMode.
empty()) && Guard)
422 return B.CreateLoad(
B.getInt8PtrTy(), Guard,
true,
"StackGuard");
435 if (SupportsSelectionDAGSP)
436 *SupportsSelectionDAGSP =
true;
453 bool SupportsSelectionDAGSP =
false;
456 AI =
B.CreateAlloca(PtrTy,
nullptr,
"StackGuardSlot");
461 return SupportsSelectionDAGSP;
470bool StackProtector::InsertStackProtectors() {
474 bool SupportsSelectionDAGSP =
484 Instruction *CheckLoc = dyn_cast<ReturnInst>(BB.getTerminator());
486 for (
auto &Inst : BB)
487 if (
auto *CB = dyn_cast<CallBase>(&Inst))
490 if (CB->doesNotReturn() && !CB->doesNotThrow()) {
501 SupportsSelectionDAGSP &=
CreatePrologue(F, M, CheckLoc, TLI, AI);
506 if (SupportsSelectionDAGSP)
513 assert(SPCall &&
"Call to llvm.stackprotector is missing");
528 if (Prev && isa<CallInst>(Prev) && cast<CallInst>(Prev)->isTailCall())
532 if (Prev && isa<CallInst>(Prev) && cast<CallInst>(Prev)->isTailCall())
543 LoadInst *Guard =
B.CreateLoad(
B.getInt8PtrTy(), AI,
true,
"Guard");
545 Call->setAttributes(GuardCheck->getAttributes());
546 Call->setCallingConv(GuardCheck->getCallingConv());
578 FailBB = CreateFailBB();
582 LoadInst *LI2 =
B.CreateLoad(
B.getInt8PtrTy(), AI,
true);
583 auto *
Cmp = cast<ICmpInst>(
B.CreateICmpNE(Guard, LI2));
590 SuccessProb.getNumerator());
594 DTU ? &*DTU :
nullptr,
597 auto *BI = cast<BranchInst>(
Cmp->getParent()->getTerminator());
602 Cmp->setPredicate(
Cmp->getInversePredicate());
603 BI->swapSuccessors();
619 B.SetCurrentDebugLocation(
627 Args.push_back(
B.CreateGlobalStringPtr(F->
getName(),
"SSH"));
632 cast<Function>(StackChkFail.
getCallee())->addFnAttr(Attribute::NoReturn);
633 B.CreateCall(StackChkFail, Args);
634 B.CreateUnreachable();
639 return HasPrologue && !HasIRCheck && isa<ReturnInst>(BB.
getTerminator());
655 if (LI == Layout.
end())
MachineBasicBlock MachineBasicBlock::iterator DebugLoc DL
This file contains the simple types necessary to represent the attributes associated with functions a...
static GCRegistry::Add< OcamlGC > B("ocaml", "ocaml 3.10-compatible GC")
static GCRegistry::Add< CoreCLRGC > E("coreclr", "CoreCLR-compatible GC")
This file contains the declarations for the subclasses of Constant, which represent the different fla...
This file provides utility analysis objects describing memory locations.
Module.h This file contains the declarations for the Module class.
#define INITIALIZE_PASS_DEPENDENCY(depName)
#define INITIALIZE_PASS_END(passName, arg, name, cfg, analysis)
#define INITIALIZE_PASS_BEGIN(passName, arg, name, cfg, analysis)
assert(ImpDefSCC.getReg()==AMDGPU::SCC &&ImpDefSCC.isDef())
This file defines the SmallPtrSet class.
This file defines the SmallVector class.
static bool HasAddressTaken(const Instruction *AI, TypeSize AllocSize, Module *M, SmallPtrSet< const PHINode *, 16 > &VisitedPHIs)
Check whether a stack allocation has its address taken.
static Value * getStackGuard(const TargetLoweringBase *TLI, Module *M, IRBuilder<> &B, bool *SupportsSelectionDAGSP=nullptr)
Create a stack guard loading and populate whether SelectionDAG SSP is supported.
static cl::opt< bool > DisableCheckNoReturn("disable-check-noreturn-call", cl::init(false), cl::Hidden)
static bool CreatePrologue(Function *F, Module *M, Instruction *CheckLoc, const TargetLoweringBase *TLI, AllocaInst *&AI)
Insert code into the entry block that stores the stack guard variable onto the stack:
static bool ContainsProtectableArray(Type *Ty, Module *M, unsigned SSPBufferSize, bool &IsLarge, bool Strong, bool InStruct)
static cl::opt< bool > EnableSelectionDAGSP("enable-selectiondag-sp", cl::init(true), cl::Hidden)
static const CallInst * findStackProtectorIntrinsic(Function &F)
Search for the first call to the llvm.stackprotector intrinsic and return it if present.
This file defines the 'Statistic' class, which is designed to be an easy way to expose various metric...
#define STATISTIC(VARNAME, DESC)
This file describes how to lower LLVM code to machine code.
Target-Independent Code Generator Pass Configuration Options pass.
Class for arbitrary precision integers.
an instruction to allocate memory on the stack
Represent the analysis usage information of a pass.
AnalysisUsage & addRequired()
AnalysisUsage & addPreserved()
Add the specified Pass class to the set of analyses preserved by this pass.
LLVM Basic Block Representation.
static BasicBlock * Create(LLVMContext &Context, const Twine &Name="", Function *Parent=nullptr, BasicBlock *InsertBefore=nullptr)
Creates a new BasicBlock.
void moveAfter(BasicBlock *MovePos)
Unlink this basic block from its current function and insert it right after MovePos in the function M...
const Instruction * getTerminator() const LLVM_READONLY
Returns the terminator instruction if the block is well formed or null if the block is not well forme...
static BranchProbability getBranchProbStackProtector(bool IsLikely)
Value * getArgOperand(unsigned i) const
This class represents a function call, abstracting a target machine's calling convention.
A parsed version of the target data layout string in and methods for querying it.
iterator find(const_arg_type_t< KeyT > Val)
std::pair< iterator, bool > insert(const std::pair< KeyT, ValueT > &KV)
Legacy analysis pass which computes a DominatorTree.
A handy container for a FunctionType+Callee-pointer pair, which can be passed around as a single enti...
FunctionPass class - This class is used to implement most global optimizations.
uint64_t getFnAttributeAsParsedInteger(StringRef Kind, uint64_t Default=0) const
For a string attribute Kind, parse attribute as an integer.
DISubprogram * getSubprogram() const
Get the attached subprogram.
bool hasPersonalityFn() const
Check whether this function has a personality function.
Constant * getPersonalityFn() const
Get the personality function associated with this function.
LLVMContext & getContext() const
getContext - Return a reference to the LLVMContext associated with this function.
an instruction for type-safe pointer arithmetic to access elements of arrays and structs
Module * getParent()
Get the module that this global value is contained inside of...
This provides a uniform API for creating instructions and inserting them into a basic block: either a...
const Instruction * getPrevNonDebugInstruction(bool SkipPseudoOp=false) const
Return a pointer to the previous non-debug instruction in the same basic block as 'this',...
This is an important class for using LLVM in a threaded context.
An instruction for reading from memory.
MDNode * createBranchWeights(uint32_t TrueWeight, uint32_t FalseWeight)
Return metadata containing two branch weights.
static MDTuple * get(LLVMContext &Context, ArrayRef< Metadata * > MDs)
The MachineFrameInfo class represents an abstract stack frame until prolog/epilog code is inserted.
const AllocaInst * getObjectAllocation(int ObjectIdx) const
Return the underlying Alloca of the specified stack object if it exists.
@ SSPLK_SmallArray
Array or nested array < SSP-buffer-size.
@ SSPLK_LargeArray
Array or nested array >= SSP-buffer-size.
@ SSPLK_AddrOf
The address of this allocation is exposed and triggered protection.
void setObjectSSPLayout(int ObjectIdx, SSPLayoutKind Kind)
int getObjectIndexEnd() const
Return one past the maximum frame object index.
bool isDeadObjectIndex(int ObjectIdx) const
Returns true if the specified index corresponds to a dead object.
static std::optional< MemoryLocation > getOrNone(const Instruction *Inst)
A Module instance is used to store all the information related to an LLVM module.
FunctionCallee getOrInsertFunction(StringRef Name, FunctionType *T, AttributeList AttributeList)
Look up the specified function in the module symbol table.
static PassRegistry * getPassRegistry()
getPassRegistry - Access the global registry object, which is automatically initialized at applicatio...
std::pair< iterator, bool > insert(PtrType Ptr)
Inserts Ptr if and only if there is no element in the container equal to Ptr.
SmallPtrSet - This class implements a set which is optimized for holding SmallSize or less elements.
This is a 'vector' (really, a variable-sized array), optimized for the case when the array is small.
void getAnalysisUsage(AnalysisUsage &AU) const override
getAnalysisUsage - This function should be overriden by passes that need analysis information to do t...
bool shouldEmitSDCheck(const BasicBlock &BB) const
void copyToMachineFrameInfo(MachineFrameInfo &MFI) const
static bool requiresStackProtector(Function *F, SSPLayoutMap *Layout=nullptr)
Check whether or not F needs a stack protector based upon the stack protector level.
bool runOnFunction(Function &Fn) override
runOnFunction - Virtual method overriden by subclasses to do the per-function processing of the pass.
StringRef - Represent a constant reference to a string, i.e.
constexpr bool empty() const
empty - Check if the string is empty.
Class to represent struct types.
This base class for TargetLowering contains the SelectionDAG-independent parts that can be used from ...
virtual bool useStackGuardXorFP() const
If this function returns true, stack protection checks should XOR the frame pointer (or whichever poi...
virtual Function * getSSPStackGuardCheck(const Module &M) const
If the target has a standard stack protection check function that performs validation and error handl...
virtual Value * getIRStackGuard(IRBuilderBase &IRB) const
If the target has a standard location for the stack protector guard, returns the address of that loca...
virtual void insertSSPDeclarations(Module &M) const
Inserts necessary declarations for SSP (stack protection) purpose.
Primary interface to the complete machine description for the target machine.
const Triple & getTargetTriple() const
virtual const TargetSubtargetInfo * getSubtargetImpl(const Function &) const
Virtual method implemented by subclasses that returns a reference to that target's TargetSubtargetInf...
unsigned EnableFastISel
EnableFastISel - This flag enables fast-path instruction selection which trades away generated code q...
Target-Independent Code Generator Pass Configuration Options.
virtual const TargetLowering * getTargetLowering() const
Triple - Helper class for working with autoconf configuration names.
bool isOSDarwin() const
Is this a "Darwin" OS (macOS, iOS, tvOS, watchOS, or DriverKit).
static constexpr TypeSize getFixed(ScalarTy ExactSize)
static constexpr TypeSize Fixed(ScalarTy ExactSize)
The instances of the Type class are immutable: once they are created, they are never changed.
static Type * getVoidTy(LLVMContext &C)
static PointerType * getInt8PtrTy(LLVMContext &C, unsigned AS=0)
LLVM Value Representation.
void setName(const Twine &Name)
Change the name of the value.
iterator_range< user_iterator > users()
LLVMContext & getContext() const
All values hold a context through their type.
StringRef getName() const
Return a constant reference to the value's name.
constexpr ScalarTy getKnownMinValue() const
Returns the minimum value this quantity can represent.
static constexpr bool isKnownGT(const FixedOrScalableQuantity &LHS, const FixedOrScalableQuantity &RHS)
static constexpr bool isKnownGE(const FixedOrScalableQuantity &LHS, const FixedOrScalableQuantity &RHS)
constexpr char Args[]
Key for Kernel::Metadata::mArgs.
Function * getDeclaration(Module *M, ID id, ArrayRef< Type * > Tys=std::nullopt)
Create or insert an LLVM Function declaration for an intrinsic, and return it.
initializer< Ty > init(const Ty &Val)
DiagnosticInfoOptimizationBase::Argument NV
This is an optimization pass for GlobalISel generic memory operations.
Instruction * SplitBlockAndInsertIfThen(Value *Cond, Instruction *SplitBefore, bool Unreachable, MDNode *BranchWeights=nullptr, DomTreeUpdater *DTU=nullptr, LoopInfo *LI=nullptr, BasicBlock *ThenBlock=nullptr)
Split the containing block at the specified instruction - everything before SplitBefore stays in the ...
iterator_range< early_inc_iterator_impl< detail::IterOfRange< RangeT > > > make_early_inc_range(RangeT &&Range)
Make a range that does early increment to allow mutation of the underlying range without disrupting i...
FunctionPass * createStackProtectorPass()
createStackProtectorPass - This pass adds stack protectors to functions.
void initializeStackProtectorPass(PassRegistry &)
EHPersonality classifyEHPersonality(const Value *Pers)
See if the given exception handling personality function is one that we understand.
bool isFuncletEHPersonality(EHPersonality Pers)
Returns true if this is a personality function that invokes handler funclets (which must return to it...