LLVM  14.0.0git
SafeStack.cpp
Go to the documentation of this file.
1 //===- SafeStack.cpp - Safe Stack Insertion -------------------------------===//
2 //
3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4 // See https://llvm.org/LICENSE.txt for license information.
5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6 //
7 //===----------------------------------------------------------------------===//
8 //
9 // This pass splits the stack into the safe stack (kept as-is for LLVM backend)
10 // and the unsafe stack (explicitly allocated and managed through the runtime
11 // support library).
12 //
13 // http://clang.llvm.org/docs/SafeStack.html
14 //
15 //===----------------------------------------------------------------------===//
16 
17 #include "SafeStackLayout.h"
18 #include "llvm/ADT/APInt.h"
19 #include "llvm/ADT/ArrayRef.h"
20 #include "llvm/ADT/BitVector.h"
21 #include "llvm/ADT/SmallPtrSet.h"
22 #include "llvm/ADT/SmallVector.h"
23 #include "llvm/ADT/Statistic.h"
28 #include "llvm/Analysis/LoopInfo.h"
36 #include "llvm/IR/Argument.h"
37 #include "llvm/IR/Attributes.h"
38 #include "llvm/IR/ConstantRange.h"
39 #include "llvm/IR/Constants.h"
40 #include "llvm/IR/DIBuilder.h"
41 #include "llvm/IR/DataLayout.h"
42 #include "llvm/IR/DerivedTypes.h"
43 #include "llvm/IR/Dominators.h"
44 #include "llvm/IR/Function.h"
45 #include "llvm/IR/IRBuilder.h"
46 #include "llvm/IR/InstIterator.h"
47 #include "llvm/IR/Instruction.h"
48 #include "llvm/IR/Instructions.h"
49 #include "llvm/IR/IntrinsicInst.h"
50 #include "llvm/IR/Intrinsics.h"
51 #include "llvm/IR/MDBuilder.h"
52 #include "llvm/IR/Module.h"
53 #include "llvm/IR/Type.h"
54 #include "llvm/IR/Use.h"
55 #include "llvm/IR/User.h"
56 #include "llvm/IR/Value.h"
57 #include "llvm/InitializePasses.h"
58 #include "llvm/Pass.h"
59 #include "llvm/Support/Casting.h"
60 #include "llvm/Support/Debug.h"
68 #include <algorithm>
69 #include <cassert>
70 #include <cstdint>
71 #include <string>
72 #include <utility>
73 
74 using namespace llvm;
75 using namespace llvm::safestack;
76 
77 #define DEBUG_TYPE "safe-stack"
78 
79 namespace llvm {
80 
81 STATISTIC(NumFunctions, "Total number of functions");
82 STATISTIC(NumUnsafeStackFunctions, "Number of functions with unsafe stack");
83 STATISTIC(NumUnsafeStackRestorePointsFunctions,
84  "Number of functions that use setjmp or exceptions");
85 
86 STATISTIC(NumAllocas, "Total number of allocas");
87 STATISTIC(NumUnsafeStaticAllocas, "Number of unsafe static allocas");
88 STATISTIC(NumUnsafeDynamicAllocas, "Number of unsafe dynamic allocas");
89 STATISTIC(NumUnsafeByValArguments, "Number of unsafe byval arguments");
90 STATISTIC(NumUnsafeStackRestorePoints, "Number of setjmps and landingpads");
91 
92 } // namespace llvm
93 
94 /// Use __safestack_pointer_address even if the platform has a faster way of
95 /// access safe stack pointer.
96 static cl::opt<bool>
97  SafeStackUsePointerAddress("safestack-use-pointer-address",
98  cl::init(false), cl::Hidden);
99 
100 // Disabled by default due to PR32143.
101 static cl::opt<bool> ClColoring("safe-stack-coloring",
102  cl::desc("enable safe stack coloring"),
103  cl::Hidden, cl::init(false));
104 
105 namespace {
106 
107 /// Rewrite an SCEV expression for a memory access address to an expression that
108 /// represents offset from the given alloca.
109 ///
110 /// The implementation simply replaces all mentions of the alloca with zero.
111 class AllocaOffsetRewriter : public SCEVRewriteVisitor<AllocaOffsetRewriter> {
112  const Value *AllocaPtr;
113 
114 public:
115  AllocaOffsetRewriter(ScalarEvolution &SE, const Value *AllocaPtr)
116  : SCEVRewriteVisitor(SE), AllocaPtr(AllocaPtr) {}
117 
118  const SCEV *visitUnknown(const SCEVUnknown *Expr) {
119  if (Expr->getValue() == AllocaPtr)
120  return SE.getZero(Expr->getType());
121  return Expr;
122  }
123 };
124 
125 /// The SafeStack pass splits the stack of each function into the safe
126 /// stack, which is only accessed through memory safe dereferences (as
127 /// determined statically), and the unsafe stack, which contains all
128 /// local variables that are accessed in ways that we can't prove to
129 /// be safe.
130 class SafeStack {
131  Function &F;
132  const TargetLoweringBase &TL;
133  const DataLayout &DL;
134  DomTreeUpdater *DTU;
135  ScalarEvolution &SE;
136 
137  Type *StackPtrTy;
138  Type *IntPtrTy;
139  Type *Int32Ty;
140  Type *Int8Ty;
141 
142  Value *UnsafeStackPtr = nullptr;
143 
144  /// Unsafe stack alignment. Each stack frame must ensure that the stack is
145  /// aligned to this value. We need to re-align the unsafe stack if the
146  /// alignment of any object on the stack exceeds this value.
147  ///
148  /// 16 seems like a reasonable upper bound on the alignment of objects that we
149  /// might expect to appear on the stack on most common targets.
150  enum { StackAlignment = 16 };
151 
152  /// Return the value of the stack canary.
154 
155  /// Load stack guard from the frame and check if it has changed.
156  void checkStackGuard(IRBuilder<> &IRB, Function &F, Instruction &RI,
157  AllocaInst *StackGuardSlot, Value *StackGuard);
158 
159  /// Find all static allocas, dynamic allocas, return instructions and
160  /// stack restore points (exception unwind blocks and setjmp calls) in the
161  /// given function and append them to the respective vectors.
162  void findInsts(Function &F, SmallVectorImpl<AllocaInst *> &StaticAllocas,
163  SmallVectorImpl<AllocaInst *> &DynamicAllocas,
164  SmallVectorImpl<Argument *> &ByValArguments,
166  SmallVectorImpl<Instruction *> &StackRestorePoints);
167 
168  /// Calculate the allocation size of a given alloca. Returns 0 if the
169  /// size can not be statically determined.
170  uint64_t getStaticAllocaAllocationSize(const AllocaInst* AI);
171 
172  /// Allocate space for all static allocas in \p StaticAllocas,
173  /// replace allocas with pointers into the unsafe stack.
174  ///
175  /// \returns A pointer to the top of the unsafe stack after all unsafe static
176  /// allocas are allocated.
177  Value *moveStaticAllocasToUnsafeStack(IRBuilder<> &IRB, Function &F,
178  ArrayRef<AllocaInst *> StaticAllocas,
179  ArrayRef<Argument *> ByValArguments,
180  Instruction *BasePointer,
181  AllocaInst *StackGuardSlot);
182 
183  /// Generate code to restore the stack after all stack restore points
184  /// in \p StackRestorePoints.
185  ///
186  /// \returns A local variable in which to maintain the dynamic top of the
187  /// unsafe stack if needed.
188  AllocaInst *
189  createStackRestorePoints(IRBuilder<> &IRB, Function &F,
190  ArrayRef<Instruction *> StackRestorePoints,
191  Value *StaticTop, bool NeedDynamicTop);
192 
193  /// Replace all allocas in \p DynamicAllocas with code to allocate
194  /// space dynamically on the unsafe stack and store the dynamic unsafe stack
195  /// top to \p DynamicTop if non-null.
196  void moveDynamicAllocasToUnsafeStack(Function &F, Value *UnsafeStackPtr,
197  AllocaInst *DynamicTop,
198  ArrayRef<AllocaInst *> DynamicAllocas);
199 
200  bool IsSafeStackAlloca(const Value *AllocaPtr, uint64_t AllocaSize);
201 
202  bool IsMemIntrinsicSafe(const MemIntrinsic *MI, const Use &U,
203  const Value *AllocaPtr, uint64_t AllocaSize);
204  bool IsAccessSafe(Value *Addr, uint64_t Size, const Value *AllocaPtr,
205  uint64_t AllocaSize);
206 
207  bool ShouldInlinePointerAddress(CallInst &CI);
208  void TryInlinePointerAddress();
209 
210 public:
211  SafeStack(Function &F, const TargetLoweringBase &TL, const DataLayout &DL,
213  : F(F), TL(TL), DL(DL), DTU(DTU), SE(SE),
214  StackPtrTy(Type::getInt8PtrTy(F.getContext())),
215  IntPtrTy(DL.getIntPtrType(F.getContext())),
216  Int32Ty(Type::getInt32Ty(F.getContext())),
217  Int8Ty(Type::getInt8Ty(F.getContext())) {}
218 
219  // Run the transformation on the associated function.
220  // Returns whether the function was changed.
221  bool run();
222 };
223 
224 uint64_t SafeStack::getStaticAllocaAllocationSize(const AllocaInst* AI) {
225  uint64_t Size = DL.getTypeAllocSize(AI->getAllocatedType());
226  if (AI->isArrayAllocation()) {
227  auto C = dyn_cast<ConstantInt>(AI->getArraySize());
228  if (!C)
229  return 0;
230  Size *= C->getZExtValue();
231  }
232  return Size;
233 }
234 
235 bool SafeStack::IsAccessSafe(Value *Addr, uint64_t AccessSize,
236  const Value *AllocaPtr, uint64_t AllocaSize) {
237  AllocaOffsetRewriter Rewriter(SE, AllocaPtr);
238  const SCEV *Expr = Rewriter.visit(SE.getSCEV(Addr));
239 
240  uint64_t BitWidth = SE.getTypeSizeInBits(Expr->getType());
241  ConstantRange AccessStartRange = SE.getUnsignedRange(Expr);
242  ConstantRange SizeRange =
243  ConstantRange(APInt(BitWidth, 0), APInt(BitWidth, AccessSize));
244  ConstantRange AccessRange = AccessStartRange.add(SizeRange);
245  ConstantRange AllocaRange =
246  ConstantRange(APInt(BitWidth, 0), APInt(BitWidth, AllocaSize));
247  bool Safe = AllocaRange.contains(AccessRange);
248 
249  LLVM_DEBUG(
250  dbgs() << "[SafeStack] "
251  << (isa<AllocaInst>(AllocaPtr) ? "Alloca " : "ByValArgument ")
252  << *AllocaPtr << "\n"
253  << " Access " << *Addr << "\n"
254  << " SCEV " << *Expr
255  << " U: " << SE.getUnsignedRange(Expr)
256  << ", S: " << SE.getSignedRange(Expr) << "\n"
257  << " Range " << AccessRange << "\n"
258  << " AllocaRange " << AllocaRange << "\n"
259  << " " << (Safe ? "safe" : "unsafe") << "\n");
260 
261  return Safe;
262 }
263 
264 bool SafeStack::IsMemIntrinsicSafe(const MemIntrinsic *MI, const Use &U,
265  const Value *AllocaPtr,
266  uint64_t AllocaSize) {
267  if (auto MTI = dyn_cast<MemTransferInst>(MI)) {
268  if (MTI->getRawSource() != U && MTI->getRawDest() != U)
269  return true;
270  } else {
271  if (MI->getRawDest() != U)
272  return true;
273  }
274 
275  const auto *Len = dyn_cast<ConstantInt>(MI->getLength());
276  // Non-constant size => unsafe. FIXME: try SCEV getRange.
277  if (!Len) return false;
278  return IsAccessSafe(U, Len->getZExtValue(), AllocaPtr, AllocaSize);
279 }
280 
281 /// Check whether a given allocation must be put on the safe
282 /// stack or not. The function analyzes all uses of AI and checks whether it is
283 /// only accessed in a memory safe way (as decided statically).
284 bool SafeStack::IsSafeStackAlloca(const Value *AllocaPtr, uint64_t AllocaSize) {
285  // Go through all uses of this alloca and check whether all accesses to the
286  // allocated object are statically known to be memory safe and, hence, the
287  // object can be placed on the safe stack.
290  WorkList.push_back(AllocaPtr);
291 
292  // A DFS search through all uses of the alloca in bitcasts/PHI/GEPs/etc.
293  while (!WorkList.empty()) {
294  const Value *V = WorkList.pop_back_val();
295  for (const Use &UI : V->uses()) {
296  auto I = cast<const Instruction>(UI.getUser());
297  assert(V == UI.get());
298 
299  switch (I->getOpcode()) {
300  case Instruction::Load:
301  if (!IsAccessSafe(UI, DL.getTypeStoreSize(I->getType()), AllocaPtr,
302  AllocaSize))
303  return false;
304  break;
305 
306  case Instruction::VAArg:
307  // "va-arg" from a pointer is safe.
308  break;
309  case Instruction::Store:
310  if (V == I->getOperand(0)) {
311  // Stored the pointer - conservatively assume it may be unsafe.
312  LLVM_DEBUG(dbgs()
313  << "[SafeStack] Unsafe alloca: " << *AllocaPtr
314  << "\n store of address: " << *I << "\n");
315  return false;
316  }
317 
318  if (!IsAccessSafe(UI, DL.getTypeStoreSize(I->getOperand(0)->getType()),
319  AllocaPtr, AllocaSize))
320  return false;
321  break;
322 
323  case Instruction::Ret:
324  // Information leak.
325  return false;
326 
327  case Instruction::Call:
328  case Instruction::Invoke: {
329  const CallBase &CS = *cast<CallBase>(I);
330 
331  if (I->isLifetimeStartOrEnd())
332  continue;
333 
334  if (const MemIntrinsic *MI = dyn_cast<MemIntrinsic>(I)) {
335  if (!IsMemIntrinsicSafe(MI, UI, AllocaPtr, AllocaSize)) {
336  LLVM_DEBUG(dbgs()
337  << "[SafeStack] Unsafe alloca: " << *AllocaPtr
338  << "\n unsafe memintrinsic: " << *I << "\n");
339  return false;
340  }
341  continue;
342  }
343 
344  // LLVM 'nocapture' attribute is only set for arguments whose address
345  // is not stored, passed around, or used in any other non-trivial way.
346  // We assume that passing a pointer to an object as a 'nocapture
347  // readnone' argument is safe.
348  // FIXME: a more precise solution would require an interprocedural
349  // analysis here, which would look at all uses of an argument inside
350  // the function being called.
351  auto B = CS.arg_begin(), E = CS.arg_end();
352  for (auto A = B; A != E; ++A)
353  if (A->get() == V)
354  if (!(CS.doesNotCapture(A - B) && (CS.doesNotAccessMemory(A - B) ||
355  CS.doesNotAccessMemory()))) {
356  LLVM_DEBUG(dbgs() << "[SafeStack] Unsafe alloca: " << *AllocaPtr
357  << "\n unsafe call: " << *I << "\n");
358  return false;
359  }
360  continue;
361  }
362 
363  default:
364  if (Visited.insert(I).second)
365  WorkList.push_back(cast<const Instruction>(I));
366  }
367  }
368  }
369 
370  // All uses of the alloca are safe, we can place it on the safe stack.
371  return true;
372 }
373 
375  Value *StackGuardVar = TL.getIRStackGuard(IRB);
376  Module *M = F.getParent();
377 
378  if (!StackGuardVar) {
379  TL.insertSSPDeclarations(*M);
380  return IRB.CreateCall(Intrinsic::getDeclaration(M, Intrinsic::stackguard));
381  }
382 
383  return IRB.CreateLoad(StackPtrTy, StackGuardVar, "StackGuard");
384 }
385 
386 void SafeStack::findInsts(Function &F,
387  SmallVectorImpl<AllocaInst *> &StaticAllocas,
388  SmallVectorImpl<AllocaInst *> &DynamicAllocas,
389  SmallVectorImpl<Argument *> &ByValArguments,
391  SmallVectorImpl<Instruction *> &StackRestorePoints) {
392  for (Instruction &I : instructions(&F)) {
393  if (auto AI = dyn_cast<AllocaInst>(&I)) {
394  ++NumAllocas;
395 
396  uint64_t Size = getStaticAllocaAllocationSize(AI);
397  if (IsSafeStackAlloca(AI, Size))
398  continue;
399 
400  if (AI->isStaticAlloca()) {
401  ++NumUnsafeStaticAllocas;
402  StaticAllocas.push_back(AI);
403  } else {
404  ++NumUnsafeDynamicAllocas;
405  DynamicAllocas.push_back(AI);
406  }
407  } else if (auto RI = dyn_cast<ReturnInst>(&I)) {
408  if (CallInst *CI = I.getParent()->getTerminatingMustTailCall())
409  Returns.push_back(CI);
410  else
411  Returns.push_back(RI);
412  } else if (auto CI = dyn_cast<CallInst>(&I)) {
413  // setjmps require stack restore.
414  if (CI->getCalledFunction() && CI->canReturnTwice())
415  StackRestorePoints.push_back(CI);
416  } else if (auto LP = dyn_cast<LandingPadInst>(&I)) {
417  // Exception landing pads require stack restore.
418  StackRestorePoints.push_back(LP);
419  } else if (auto II = dyn_cast<IntrinsicInst>(&I)) {
420  if (II->getIntrinsicID() == Intrinsic::gcroot)
422  "gcroot intrinsic not compatible with safestack attribute");
423  }
424  }
425  for (Argument &Arg : F.args()) {
426  if (!Arg.hasByValAttr())
427  continue;
428  uint64_t Size = DL.getTypeStoreSize(Arg.getParamByValType());
429  if (IsSafeStackAlloca(&Arg, Size))
430  continue;
431 
432  ++NumUnsafeByValArguments;
433  ByValArguments.push_back(&Arg);
434  }
435 }
436 
437 AllocaInst *
438 SafeStack::createStackRestorePoints(IRBuilder<> &IRB, Function &F,
439  ArrayRef<Instruction *> StackRestorePoints,
440  Value *StaticTop, bool NeedDynamicTop) {
441  assert(StaticTop && "The stack top isn't set.");
442 
443  if (StackRestorePoints.empty())
444  return nullptr;
445 
446  // We need the current value of the shadow stack pointer to restore
447  // after longjmp or exception catching.
448 
449  // FIXME: On some platforms this could be handled by the longjmp/exception
450  // runtime itself.
451 
452  AllocaInst *DynamicTop = nullptr;
453  if (NeedDynamicTop) {
454  // If we also have dynamic alloca's, the stack pointer value changes
455  // throughout the function. For now we store it in an alloca.
456  DynamicTop = IRB.CreateAlloca(StackPtrTy, /*ArraySize=*/nullptr,
457  "unsafe_stack_dynamic_ptr");
458  IRB.CreateStore(StaticTop, DynamicTop);
459  }
460 
461  // Restore current stack pointer after longjmp/exception catch.
462  for (Instruction *I : StackRestorePoints) {
463  ++NumUnsafeStackRestorePoints;
464 
465  IRB.SetInsertPoint(I->getNextNode());
466  Value *CurrentTop =
467  DynamicTop ? IRB.CreateLoad(StackPtrTy, DynamicTop) : StaticTop;
468  IRB.CreateStore(CurrentTop, UnsafeStackPtr);
469  }
470 
471  return DynamicTop;
472 }
473 
474 void SafeStack::checkStackGuard(IRBuilder<> &IRB, Function &F, Instruction &RI,
475  AllocaInst *StackGuardSlot, Value *StackGuard) {
476  Value *V = IRB.CreateLoad(StackPtrTy, StackGuardSlot);
477  Value *Cmp = IRB.CreateICmpNE(StackGuard, V);
478 
480  auto FailureProb = BranchProbabilityInfo::getBranchProbStackProtector(false);
481  MDNode *Weights = MDBuilder(F.getContext())
482  .createBranchWeights(SuccessProb.getNumerator(),
483  FailureProb.getNumerator());
484  Instruction *CheckTerm =
485  SplitBlockAndInsertIfThen(Cmp, &RI, /* Unreachable */ true, Weights, DTU);
486  IRBuilder<> IRBFail(CheckTerm);
487  // FIXME: respect -fsanitize-trap / -ftrap-function here?
488  FunctionCallee StackChkFail =
489  F.getParent()->getOrInsertFunction("__stack_chk_fail", IRB.getVoidTy());
490  IRBFail.CreateCall(StackChkFail, {});
491 }
492 
493 /// We explicitly compute and set the unsafe stack layout for all unsafe
494 /// static alloca instructions. We save the unsafe "base pointer" in the
495 /// prologue into a local variable and restore it in the epilogue.
496 Value *SafeStack::moveStaticAllocasToUnsafeStack(
497  IRBuilder<> &IRB, Function &F, ArrayRef<AllocaInst *> StaticAllocas,
498  ArrayRef<Argument *> ByValArguments, Instruction *BasePointer,
499  AllocaInst *StackGuardSlot) {
500  if (StaticAllocas.empty() && ByValArguments.empty())
501  return BasePointer;
502 
503  DIBuilder DIB(*F.getParent());
504 
505  StackLifetime SSC(F, StaticAllocas, StackLifetime::LivenessType::May);
506  static const StackLifetime::LiveRange NoColoringRange(1, true);
507  if (ClColoring)
508  SSC.run();
509 
510  for (auto *I : SSC.getMarkers()) {
511  auto *Op = dyn_cast<Instruction>(I->getOperand(1));
512  const_cast<IntrinsicInst *>(I)->eraseFromParent();
513  // Remove the operand bitcast, too, if it has no more uses left.
514  if (Op && Op->use_empty())
515  Op->eraseFromParent();
516  }
517 
518  // Unsafe stack always grows down.
519  StackLayout SSL(StackAlignment);
520  if (StackGuardSlot) {
521  Type *Ty = StackGuardSlot->getAllocatedType();
522  unsigned Align =
523  std::max(DL.getPrefTypeAlignment(Ty), StackGuardSlot->getAlignment());
524  SSL.addObject(StackGuardSlot, getStaticAllocaAllocationSize(StackGuardSlot),
525  Align, SSC.getFullLiveRange());
526  }
527 
528  for (Argument *Arg : ByValArguments) {
529  Type *Ty = Arg->getParamByValType();
530  uint64_t Size = DL.getTypeStoreSize(Ty);
531  if (Size == 0)
532  Size = 1; // Don't create zero-sized stack objects.
533 
534  // Ensure the object is properly aligned.
535  unsigned Align = std::max((unsigned)DL.getPrefTypeAlignment(Ty),
536  Arg->getParamAlignment());
537  SSL.addObject(Arg, Size, Align, SSC.getFullLiveRange());
538  }
539 
540  for (AllocaInst *AI : StaticAllocas) {
541  Type *Ty = AI->getAllocatedType();
542  uint64_t Size = getStaticAllocaAllocationSize(AI);
543  if (Size == 0)
544  Size = 1; // Don't create zero-sized stack objects.
545 
546  // Ensure the object is properly aligned.
547  unsigned Align =
548  std::max((unsigned)DL.getPrefTypeAlignment(Ty), AI->getAlignment());
549 
550  SSL.addObject(AI, Size, Align,
551  ClColoring ? SSC.getLiveRange(AI) : NoColoringRange);
552  }
553 
554  SSL.computeLayout();
555  unsigned FrameAlignment = SSL.getFrameAlignment();
556 
557  // FIXME: tell SSL that we start at a less-then-MaxAlignment aligned location
558  // (AlignmentSkew).
559  if (FrameAlignment > StackAlignment) {
560  // Re-align the base pointer according to the max requested alignment.
561  assert(isPowerOf2_32(FrameAlignment));
562  IRB.SetInsertPoint(BasePointer->getNextNode());
563  BasePointer = cast<Instruction>(IRB.CreateIntToPtr(
564  IRB.CreateAnd(IRB.CreatePtrToInt(BasePointer, IntPtrTy),
565  ConstantInt::get(IntPtrTy, ~uint64_t(FrameAlignment - 1))),
566  StackPtrTy));
567  }
568 
569  IRB.SetInsertPoint(BasePointer->getNextNode());
570 
571  if (StackGuardSlot) {
572  unsigned Offset = SSL.getObjectOffset(StackGuardSlot);
573  Value *Off = IRB.CreateGEP(Int8Ty, BasePointer, // BasePointer is i8*
575  Value *NewAI =
576  IRB.CreateBitCast(Off, StackGuardSlot->getType(), "StackGuardSlot");
577 
578  // Replace alloc with the new location.
579  StackGuardSlot->replaceAllUsesWith(NewAI);
580  StackGuardSlot->eraseFromParent();
581  }
582 
583  for (Argument *Arg : ByValArguments) {
584  unsigned Offset = SSL.getObjectOffset(Arg);
585  MaybeAlign Align(SSL.getObjectAlignment(Arg));
586  Type *Ty = Arg->getParamByValType();
587 
588  uint64_t Size = DL.getTypeStoreSize(Ty);
589  if (Size == 0)
590  Size = 1; // Don't create zero-sized stack objects.
591 
592  Value *Off = IRB.CreateGEP(Int8Ty, BasePointer, // BasePointer is i8*
594  Value *NewArg = IRB.CreateBitCast(Off, Arg->getType(),
595  Arg->getName() + ".unsafe-byval");
596 
597  // Replace alloc with the new location.
599  -Offset);
600  Arg->replaceAllUsesWith(NewArg);
601  IRB.SetInsertPoint(cast<Instruction>(NewArg)->getNextNode());
602  IRB.CreateMemCpy(Off, Align, Arg, Arg->getParamAlign(), Size);
603  }
604 
605  // Allocate space for every unsafe static AllocaInst on the unsafe stack.
606  for (AllocaInst *AI : StaticAllocas) {
607  IRB.SetInsertPoint(AI);
608  unsigned Offset = SSL.getObjectOffset(AI);
609 
610  replaceDbgDeclare(AI, BasePointer, DIB, DIExpression::ApplyOffset, -Offset);
611  replaceDbgValueForAlloca(AI, BasePointer, DIB, -Offset);
612 
613  // Replace uses of the alloca with the new location.
614  // Insert address calculation close to each use to work around PR27844.
615  std::string Name = std::string(AI->getName()) + ".unsafe";
616  while (!AI->use_empty()) {
617  Use &U = *AI->use_begin();
618  Instruction *User = cast<Instruction>(U.getUser());
619 
620  Instruction *InsertBefore;
621  if (auto *PHI = dyn_cast<PHINode>(User))
622  InsertBefore = PHI->getIncomingBlock(U)->getTerminator();
623  else
624  InsertBefore = User;
625 
626  IRBuilder<> IRBUser(InsertBefore);
627  Value *Off = IRBUser.CreateGEP(Int8Ty, BasePointer, // BasePointer is i8*
629  Value *Replacement = IRBUser.CreateBitCast(Off, AI->getType(), Name);
630 
631  if (auto *PHI = dyn_cast<PHINode>(User))
632  // PHI nodes may have multiple incoming edges from the same BB (why??),
633  // all must be updated at once with the same incoming value.
634  PHI->setIncomingValueForBlock(PHI->getIncomingBlock(U), Replacement);
635  else
636  U.set(Replacement);
637  }
638 
639  AI->eraseFromParent();
640  }
641 
642  // Re-align BasePointer so that our callees would see it aligned as
643  // expected.
644  // FIXME: no need to update BasePointer in leaf functions.
645  unsigned FrameSize = alignTo(SSL.getFrameSize(), StackAlignment);
646 
647  // Update shadow stack pointer in the function epilogue.
648  IRB.SetInsertPoint(BasePointer->getNextNode());
649 
650  Value *StaticTop =
651  IRB.CreateGEP(Int8Ty, BasePointer, ConstantInt::get(Int32Ty, -FrameSize),
652  "unsafe_stack_static_top");
653  IRB.CreateStore(StaticTop, UnsafeStackPtr);
654  return StaticTop;
655 }
656 
657 void SafeStack::moveDynamicAllocasToUnsafeStack(
658  Function &F, Value *UnsafeStackPtr, AllocaInst *DynamicTop,
659  ArrayRef<AllocaInst *> DynamicAllocas) {
660  DIBuilder DIB(*F.getParent());
661 
662  for (AllocaInst *AI : DynamicAllocas) {
663  IRBuilder<> IRB(AI);
664 
665  // Compute the new SP value (after AI).
666  Value *ArraySize = AI->getArraySize();
667  if (ArraySize->getType() != IntPtrTy)
668  ArraySize = IRB.CreateIntCast(ArraySize, IntPtrTy, false);
669 
670  Type *Ty = AI->getAllocatedType();
671  uint64_t TySize = DL.getTypeAllocSize(Ty);
672  Value *Size = IRB.CreateMul(ArraySize, ConstantInt::get(IntPtrTy, TySize));
673 
674  Value *SP = IRB.CreatePtrToInt(IRB.CreateLoad(StackPtrTy, UnsafeStackPtr),
675  IntPtrTy);
676  SP = IRB.CreateSub(SP, Size);
677 
678  // Align the SP value to satisfy the AllocaInst, type and stack alignments.
679  unsigned Align = std::max(
680  std::max((unsigned)DL.getPrefTypeAlignment(Ty), AI->getAlignment()),
681  (unsigned)StackAlignment);
682 
684  Value *NewTop = IRB.CreateIntToPtr(
685  IRB.CreateAnd(SP, ConstantInt::get(IntPtrTy, ~uint64_t(Align - 1))),
686  StackPtrTy);
687 
688  // Save the stack pointer.
689  IRB.CreateStore(NewTop, UnsafeStackPtr);
690  if (DynamicTop)
691  IRB.CreateStore(NewTop, DynamicTop);
692 
693  Value *NewAI = IRB.CreatePointerCast(NewTop, AI->getType());
694  if (AI->hasName() && isa<Instruction>(NewAI))
695  NewAI->takeName(AI);
696 
697  replaceDbgDeclare(AI, NewAI, DIB, DIExpression::ApplyOffset, 0);
698  AI->replaceAllUsesWith(NewAI);
699  AI->eraseFromParent();
700  }
701 
702  if (!DynamicAllocas.empty()) {
703  // Now go through the instructions again, replacing stacksave/stackrestore.
704  for (inst_iterator It = inst_begin(&F), Ie = inst_end(&F); It != Ie;) {
705  Instruction *I = &*(It++);
706  auto II = dyn_cast<IntrinsicInst>(I);
707  if (!II)
708  continue;
709 
710  if (II->getIntrinsicID() == Intrinsic::stacksave) {
711  IRBuilder<> IRB(II);
712  Instruction *LI = IRB.CreateLoad(StackPtrTy, UnsafeStackPtr);
713  LI->takeName(II);
714  II->replaceAllUsesWith(LI);
715  II->eraseFromParent();
716  } else if (II->getIntrinsicID() == Intrinsic::stackrestore) {
717  IRBuilder<> IRB(II);
718  Instruction *SI = IRB.CreateStore(II->getArgOperand(0), UnsafeStackPtr);
719  SI->takeName(II);
720  assert(II->use_empty());
721  II->eraseFromParent();
722  }
723  }
724  }
725 }
726 
727 bool SafeStack::ShouldInlinePointerAddress(CallInst &CI) {
729  if (CI.hasFnAttr(Attribute::AlwaysInline) &&
730  isInlineViable(*Callee).isSuccess())
731  return true;
732  if (Callee->isInterposable() || Callee->hasFnAttribute(Attribute::NoInline) ||
733  CI.isNoInline())
734  return false;
735  return true;
736 }
737 
738 void SafeStack::TryInlinePointerAddress() {
739  auto *CI = dyn_cast<CallInst>(UnsafeStackPtr);
740  if (!CI)
741  return;
742 
743  if(F.hasOptNone())
744  return;
745 
747  if (!Callee || Callee->isDeclaration())
748  return;
749 
750  if (!ShouldInlinePointerAddress(*CI))
751  return;
752 
753  InlineFunctionInfo IFI;
754  InlineFunction(*CI, IFI);
755 }
756 
757 bool SafeStack::run() {
758  assert(F.hasFnAttribute(Attribute::SafeStack) &&
759  "Can't run SafeStack on a function without the attribute");
760  assert(!F.isDeclaration() && "Can't run SafeStack on a function declaration");
761 
762  ++NumFunctions;
763 
764  SmallVector<AllocaInst *, 16> StaticAllocas;
765  SmallVector<AllocaInst *, 4> DynamicAllocas;
766  SmallVector<Argument *, 4> ByValArguments;
768 
769  // Collect all points where stack gets unwound and needs to be restored
770  // This is only necessary because the runtime (setjmp and unwind code) is
771  // not aware of the unsafe stack and won't unwind/restore it properly.
772  // To work around this problem without changing the runtime, we insert
773  // instrumentation to restore the unsafe stack pointer when necessary.
774  SmallVector<Instruction *, 4> StackRestorePoints;
775 
776  // Find all static and dynamic alloca instructions that must be moved to the
777  // unsafe stack, all return instructions and stack restore points.
778  findInsts(F, StaticAllocas, DynamicAllocas, ByValArguments, Returns,
779  StackRestorePoints);
780 
781  if (StaticAllocas.empty() && DynamicAllocas.empty() &&
782  ByValArguments.empty() && StackRestorePoints.empty())
783  return false; // Nothing to do in this function.
784 
785  if (!StaticAllocas.empty() || !DynamicAllocas.empty() ||
786  !ByValArguments.empty())
787  ++NumUnsafeStackFunctions; // This function has the unsafe stack.
788 
789  if (!StackRestorePoints.empty())
790  ++NumUnsafeStackRestorePointsFunctions;
791 
792  IRBuilder<> IRB(&F.front(), F.begin()->getFirstInsertionPt());
793  // Calls must always have a debug location, or else inlining breaks. So
794  // we explicitly set a artificial debug location here.
795  if (DISubprogram *SP = F.getSubprogram())
797  DILocation::get(SP->getContext(), SP->getScopeLine(), 0, SP));
799  FunctionCallee Fn = F.getParent()->getOrInsertFunction(
800  "__safestack_pointer_address", StackPtrTy->getPointerTo(0));
801  UnsafeStackPtr = IRB.CreateCall(Fn);
802  } else {
803  UnsafeStackPtr = TL.getSafeStackPointerLocation(IRB);
804  }
805 
806  // Load the current stack pointer (we'll also use it as a base pointer).
807  // FIXME: use a dedicated register for it ?
808  Instruction *BasePointer =
809  IRB.CreateLoad(StackPtrTy, UnsafeStackPtr, false, "unsafe_stack_ptr");
810  assert(BasePointer->getType() == StackPtrTy);
811 
812  AllocaInst *StackGuardSlot = nullptr;
813  // FIXME: implement weaker forms of stack protector.
814  if (F.hasFnAttribute(Attribute::StackProtect) ||
815  F.hasFnAttribute(Attribute::StackProtectStrong) ||
816  F.hasFnAttribute(Attribute::StackProtectReq)) {
817  Value *StackGuard = getStackGuard(IRB, F);
818  StackGuardSlot = IRB.CreateAlloca(StackPtrTy, nullptr);
819  IRB.CreateStore(StackGuard, StackGuardSlot);
820 
821  for (Instruction *RI : Returns) {
822  IRBuilder<> IRBRet(RI);
823  checkStackGuard(IRBRet, F, *RI, StackGuardSlot, StackGuard);
824  }
825  }
826 
827  // The top of the unsafe stack after all unsafe static allocas are
828  // allocated.
829  Value *StaticTop = moveStaticAllocasToUnsafeStack(
830  IRB, F, StaticAllocas, ByValArguments, BasePointer, StackGuardSlot);
831 
832  // Safe stack object that stores the current unsafe stack top. It is updated
833  // as unsafe dynamic (non-constant-sized) allocas are allocated and freed.
834  // This is only needed if we need to restore stack pointer after longjmp
835  // or exceptions, and we have dynamic allocations.
836  // FIXME: a better alternative might be to store the unsafe stack pointer
837  // before setjmp / invoke instructions.
838  AllocaInst *DynamicTop = createStackRestorePoints(
839  IRB, F, StackRestorePoints, StaticTop, !DynamicAllocas.empty());
840 
841  // Handle dynamic allocas.
842  moveDynamicAllocasToUnsafeStack(F, UnsafeStackPtr, DynamicTop,
843  DynamicAllocas);
844 
845  // Restore the unsafe stack pointer before each return.
846  for (Instruction *RI : Returns) {
847  IRB.SetInsertPoint(RI);
848  IRB.CreateStore(BasePointer, UnsafeStackPtr);
849  }
850 
851  TryInlinePointerAddress();
852 
853  LLVM_DEBUG(dbgs() << "[SafeStack] safestack applied\n");
854  return true;
855 }
856 
857 class SafeStackLegacyPass : public FunctionPass {
858  const TargetMachine *TM = nullptr;
859 
860 public:
861  static char ID; // Pass identification, replacement for typeid..
862 
863  SafeStackLegacyPass() : FunctionPass(ID) {
865  }
866 
867  void getAnalysisUsage(AnalysisUsage &AU) const override {
872  }
873 
874  bool runOnFunction(Function &F) override {
875  LLVM_DEBUG(dbgs() << "[SafeStack] Function: " << F.getName() << "\n");
876 
877  if (!F.hasFnAttribute(Attribute::SafeStack)) {
878  LLVM_DEBUG(dbgs() << "[SafeStack] safestack is not requested"
879  " for this function\n");
880  return false;
881  }
882 
883  if (F.isDeclaration()) {
884  LLVM_DEBUG(dbgs() << "[SafeStack] function definition"
885  " is not available\n");
886  return false;
887  }
888 
889  TM = &getAnalysis<TargetPassConfig>().getTM<TargetMachine>();
890  auto *TL = TM->getSubtargetImpl(F)->getTargetLowering();
891  if (!TL)
892  report_fatal_error("TargetLowering instance is required");
893 
894  auto *DL = &F.getParent()->getDataLayout();
895  auto &TLI = getAnalysis<TargetLibraryInfoWrapperPass>().getTLI(F);
896  auto &ACT = getAnalysis<AssumptionCacheTracker>().getAssumptionCache(F);
897 
898  // Compute DT and LI only for functions that have the attribute.
899  // This is only useful because the legacy pass manager doesn't let us
900  // compute analyzes lazily.
901 
902  DominatorTree *DT;
903  bool ShouldPreserveDominatorTree;
904  Optional<DominatorTree> LazilyComputedDomTree;
905 
906  // Do we already have a DominatorTree avaliable from the previous pass?
907  // Note that we should *NOT* require it, to avoid the case where we end up
908  // not needing it, but the legacy PM would have computed it for us anyways.
909  if (auto *DTWP = getAnalysisIfAvailable<DominatorTreeWrapperPass>()) {
910  DT = &DTWP->getDomTree();
911  ShouldPreserveDominatorTree = true;
912  } else {
913  // Otherwise, we need to compute it.
914  LazilyComputedDomTree.emplace(F);
915  DT = LazilyComputedDomTree.getPointer();
916  ShouldPreserveDominatorTree = false;
917  }
918 
919  // Likewise, lazily compute loop info.
920  LoopInfo LI(*DT);
921 
923 
924  ScalarEvolution SE(F, TLI, ACT, *DT, LI);
925 
926  return SafeStack(F, *TL, *DL, ShouldPreserveDominatorTree ? &DTU : nullptr,
927  SE)
928  .run();
929  }
930 };
931 
932 } // end anonymous namespace
933 
934 char SafeStackLegacyPass::ID = 0;
935 
936 INITIALIZE_PASS_BEGIN(SafeStackLegacyPass, DEBUG_TYPE,
937  "Safe Stack instrumentation pass", false, false)
940 INITIALIZE_PASS_END(SafeStackLegacyPass, DEBUG_TYPE,
941  "Safe Stack instrumentation pass", false, false)
942 
943 FunctionPass *llvm::createSafeStackPass() { return new SafeStackLegacyPass(); }
llvm::Check::Size
@ Size
Definition: FileCheck.h:73
llvm::alignTo
uint64_t alignTo(uint64_t Size, Align A)
Returns a multiple of A needed to store Size bytes.
Definition: Alignment.h:148
Int32Ty
IntegerType * Int32Ty
Definition: NVVMIntrRange.cpp:67
llvm::Argument
This class represents an incoming formal argument to a Function.
Definition: Argument.h:29
AssumptionCache.h
llvm::IRBuilderBase::CreateIntCast
Value * CreateIntCast(Value *V, Type *DestTy, bool isSigned, const Twine &Name="")
Definition: IRBuilder.h:2182
llvm::IRBuilderBase::CreateStore
StoreInst * CreateStore(Value *Val, Value *Ptr, bool isVolatile=false)
Definition: IRBuilder.h:1695
instrumentation
xray instrumentation
Definition: XRayInstrumentation.cpp:267
MI
IRTranslator LLVM IR MI
Definition: IRTranslator.cpp:102
MathExtras.h
llvm::IRBuilderBase::SetInsertPoint
void SetInsertPoint(BasicBlock *TheBB)
This specifies that created instructions should be appended to the end of the specified block.
Definition: IRBuilder.h:184
llvm
---------------------— PointerInfo ------------------------------------—
Definition: AllocatorList.h:23
llvm::TargetLoweringBase
This base class for TargetLowering contains the SelectionDAG-independent parts that can be used from ...
Definition: TargetLowering.h:191
M
We currently emits eax Perhaps this is what we really should generate is Is imull three or four cycles eax eax The current instruction priority is based on pattern complexity The former is more complex because it folds a load so the latter will not be emitted Perhaps we should use AddedComplexity to give LEA32r a higher priority We should always try to match LEA first since the LEA matching code does some estimate to determine whether the match is profitable if we care more about code then imull is better It s two bytes shorter than movl leal On a Pentium M
Definition: README.txt:252
llvm::DataLayout
A parsed version of the target data layout string in and methods for querying it.
Definition: DataLayout.h:112
llvm::Intrinsic::getDeclaration
Function * getDeclaration(Module *M, ID id, ArrayRef< Type * > Tys=None)
Create or insert an LLVM Function declaration for an intrinsic, and return it.
Definition: Function.cpp:1336
IntrinsicInst.h
llvm::DIBuilder
Definition: DIBuilder.h:41
InstIterator.h
llvm::Function
Definition: Function.h:61
llvm::IRBuilderBase::CreatePtrToInt
Value * CreatePtrToInt(Value *V, Type *DestTy, const Twine &Name="")
Definition: IRBuilder.h:2103
Pass.h
llvm::AllocaInst::getType
PointerType * getType() const
Overload to return most specific pointer type.
Definition: Instructions.h:104
llvm::ilist_node_with_parent::getNextNode
NodeTy * getNextNode()
Get the next node, or nullptr for the list tail.
Definition: ilist_node.h:288
llvm::SmallVector
This is a 'vector' (really, a variable-sized array), optimized for the case when the array is small.
Definition: SmallVector.h:1168
Statistic.h
llvm::Value::hasName
bool hasName() const
Definition: Value.h:262
ErrorHandling.h
llvm::IRBuilder<>
DomTreeUpdater.h
llvm::ScalarEvolution
The main scalar evolution driver.
Definition: ScalarEvolution.h:443
Local.h
llvm::DominatorTree
Concrete subclass of DominatorTreeBase that is used to compute a normal dominator tree.
Definition: Dominators.h:151
llvm::CallBase::hasFnAttr
bool hasFnAttr(Attribute::AttrKind Kind) const
Determine whether this call has the given attribute.
Definition: InstrTypes.h:1477
llvm::cl::Hidden
@ Hidden
Definition: CommandLine.h:143
APInt.h
ScalarEvolution.h
llvm::Type
The instances of the Type class are immutable: once they are created, they are never changed.
Definition: Type.h:45
Module.h
llvm::MemIntrinsic
This is the common base class for memset/memcpy/memmove.
Definition: IntrinsicInst.h:852
llvm::Optional
Definition: APInt.h:33
llvm::isInlineViable
InlineResult isInlineViable(Function &Callee)
Minimal filter to detect invalid constructs for inlining.
Definition: InlineCost.cpp:2861
Offset
uint64_t Offset
Definition: ELFObjHandler.cpp:81
llvm::SmallPtrSet
SmallPtrSet - This class implements a set which is optimized for holding SmallSize or less elements.
Definition: SmallPtrSet.h:449
llvm::MipsISD::Ret
@ Ret
Definition: MipsISelLowering.h:116
llvm::CallBase::arg_begin
User::op_iterator arg_begin()
Return the iterator pointing to the beginning of the argument list.
Definition: InstrTypes.h:1303
llvm::SmallVectorImpl::pop_back_val
LLVM_NODISCARD T pop_back_val()
Definition: SmallVector.h:635
llvm::isPowerOf2_32
constexpr bool isPowerOf2_32(uint32_t Value)
Return true if the argument is a power of two > 0.
Definition: MathExtras.h:491
llvm::safestack::StackLayout
Compute the layout of an unsafe stack frame.
Definition: SafeStackLayout.h:24
llvm::IRBuilderBase::CreateAlloca
AllocaInst * CreateAlloca(Type *Ty, unsigned AddrSpace, Value *ArraySize=nullptr, const Twine &Name="")
Definition: IRBuilder.h:1639
Use.h
llvm::IRBuilderBase::CreateIntToPtr
Value * CreateIntToPtr(Value *V, Type *DestTy, const Twine &Name="")
Definition: IRBuilder.h:2108
llvm::ArrayRef::empty
bool empty() const
empty - Check if the array is empty.
Definition: ArrayRef.h:160
LLVM_DEBUG
#define LLVM_DEBUG(X)
Definition: Debug.h:122
llvm::MDNode::get
static MDTuple * get(LLVMContext &Context, ArrayRef< Metadata * > MDs)
Definition: Metadata.h:1198
F
#define F(x, y, z)
Definition: MD5.cpp:56
llvm::DomTreeUpdater::UpdateStrategy::Lazy
@ Lazy
llvm::Optional::getPointer
constexpr const T * getPointer() const
Definition: Optional.h:280
llvm::dbgs
raw_ostream & dbgs()
dbgs() - This returns a reference to a raw_ostream for debugging messages.
Definition: Debug.cpp:163
Arg
amdgpu Simplify well known AMD library false FunctionCallee Value * Arg
Definition: AMDGPULibCalls.cpp:206
Instruction.h
TargetLowering.h
llvm::AllocaInst::isStaticAlloca
bool isStaticAlloca() const
Return true if this alloca is in the entry block of the function and is a constant size.
Definition: Instructions.cpp:1387
llvm::initializeSafeStackLegacyPassPass
void initializeSafeStackLegacyPassPass(PassRegistry &)
llvm::SCEVUnknown::getType
Type * getType() const
Definition: ScalarEvolutionExpressions.h:565
llvm::IRBuilderBase::CreateMul
Value * CreateMul(Value *LHS, Value *RHS, const Twine &Name="", bool HasNUW=false, bool HasNSW=false)
Definition: IRBuilder.h:1242
StackLifetime.h
TargetMachine.h
llvm::SPII::Load
@ Load
Definition: SparcInstrInfo.h:32
llvm::PassRegistry::getPassRegistry
static PassRegistry * getPassRegistry()
getPassRegistry - Access the global registry object, which is automatically initialized at applicatio...
Definition: PassRegistry.cpp:31
Rewriter
Virtual Register Rewriter
Definition: VirtRegMap.cpp:237
Constants.h
llvm::AllocaInst::getAllocatedType
Type * getAllocatedType() const
Return the type that is being allocated by the instruction.
Definition: Instructions.h:113
E
static GCRegistry::Add< CoreCLRGC > E("coreclr", "CoreCLR-compatible GC")
llvm::DIExpression::ApplyOffset
@ ApplyOffset
Definition: DebugInfoMetadata.h:2764
llvm::User
Definition: User.h:44
Intrinsics.h
C
(vector float) vec_cmpeq(*A, *B) C
Definition: README_ALTIVEC.txt:86
SafeStackUsePointerAddress
static cl::opt< bool > SafeStackUsePointerAddress("safestack-use-pointer-address", cl::init(false), cl::Hidden)
Use __safestack_pointer_address even if the platform has a faster way of access safe stack pointer.
llvm::ARM_PROC::A
@ A
Definition: ARMBaseInfo.h:34
llvm::CallBase::getCalledFunction
Function * getCalledFunction() const
Returns the function called, or null if this is an indirect function invocation.
Definition: InstrTypes.h:1393
llvm::IRBuilderBase::CreateLoad
LoadInst * CreateLoad(Type *Ty, Value *Ptr, const char *Name)
Provided to resolve 'CreateLoad(Ty, Ptr, "...")' correctly, instead of converting the string to 'bool...
Definition: IRBuilder.h:1656
llvm::MDBuilder::createBranchWeights
MDNode * createBranchWeights(uint32_t TrueWeight, uint32_t FalseWeight)
Return metadata containing two branch weights.
Definition: MDBuilder.cpp:37
llvm::AnalysisUsage
Represent the analysis usage information of a pass.
Definition: PassAnalysisSupport.h:47
TargetLibraryInfo.h
llvm::Value::uses
iterator_range< use_iterator > uses()
Definition: Value.h:377
false
Definition: StackSlotColoring.cpp:142
llvm::IRBuilderBase::SetCurrentDebugLocation
void SetCurrentDebugLocation(DebugLoc L)
Set location information used by debugging information.
Definition: IRBuilder.h:208
llvm::MaybeAlign
This struct is a compact representation of a valid (power of two) or undefined (0) alignment.
Definition: Alignment.h:109
B
static GCRegistry::Add< OcamlGC > B("ocaml", "ocaml 3.10-compatible GC")
llvm::Instruction
Definition: Instruction.h:45
llvm::DominatorTreeWrapperPass
Legacy analysis pass which computes a DominatorTree.
Definition: Dominators.h:281
MDBuilder.h
llvm::AllocaInst::getArraySize
const Value * getArraySize() const
Get the number of elements allocated.
Definition: Instructions.h:100
llvm::report_fatal_error
void report_fatal_error(Error Err, bool gen_crash_diag=true)
Report a serious error, calling any installed error handler.
Definition: Error.cpp:140
llvm::STATISTIC
STATISTIC(NumFunctions, "Total number of functions")
llvm::InlineResult::isSuccess
bool isSuccess() const
Definition: InlineCost.h:168
llvm::DomTreeUpdater
Definition: DomTreeUpdater.h:28
BitVector.h
llvm::ConstantInt::get
static Constant * get(Type *Ty, uint64_t V, bool IsSigned=false)
If Ty is a vector type, return a Constant with a splat of the given value.
Definition: Constants.cpp:899
llvm::Use::getUser
User * getUser() const
Returns the User that contains this Use.
Definition: Use.h:73
SmallPtrSet.h
ClColoring
static cl::opt< bool > ClColoring("safe-stack-coloring", cl::desc("enable safe stack coloring"), cl::Hidden, cl::init(false))
llvm::ConstantRange::add
ConstantRange add(const ConstantRange &Other) const
Return a new range representing the possible values resulting from an addition of a value in this ran...
Definition: ConstantRange.cpp:908
Align
uint64_t Align
Definition: ELFObjHandler.cpp:83
llvm::Align
This struct is a compact representation of a valid (non-zero power of two) alignment.
Definition: Alignment.h:39
llvm::MCID::Call
@ Call
Definition: MCInstrDesc.h:153
llvm::Value::use_empty
bool use_empty() const
Definition: Value.h:345
llvm::SCEVUnknown::getValue
Value * getValue() const
Definition: ScalarEvolutionExpressions.h:551
llvm::BranchProbabilityInfo::getBranchProbStackProtector
static BranchProbability getBranchProbStackProtector(bool IsLikely)
Definition: BranchProbabilityInfo.h:194
Type.h
llvm::IRBuilderBase::CreateAnd
Value * CreateAnd(Value *LHS, Value *RHS, const Twine &Name="")
Definition: IRBuilder.h:1358
llvm::IRBuilderBase::CreatePointerCast
Value * CreatePointerCast(Value *V, Type *DestTy, const Twine &Name="")
Definition: IRBuilder.h:2159
INITIALIZE_PASS_END
#define INITIALIZE_PASS_END(passName, arg, name, cfg, analysis)
Definition: PassSupport.h:58
LoopInfo.h
llvm::TargetPassConfig
Target-Independent Code Generator Pass Configuration Options.
Definition: TargetPassConfig.h:84
llvm::StackLifetime::LivenessType::May
@ May
llvm::Use::set
void set(Value *Val)
Definition: Value.h:860
llvm::cl::opt< bool >
llvm::SCEV
This class represents an analyzed expression in the program.
Definition: ScalarEvolution.h:78
llvm::instructions
inst_range instructions(Function *F)
Definition: InstIterator.h:133
llvm::IRBuilderBase::CreateBitCast
Value * CreateBitCast(Value *V, Type *DestTy, const Twine &Name="")
Definition: IRBuilder.h:2113
llvm::Instruction::eraseFromParent
SymbolTableList< Instruction >::iterator eraseFromParent()
This method unlinks 'this' from the containing basic block and deletes it.
Definition: Instruction.cpp:78
BranchProbabilityInfo.h
llvm::CallBase::doesNotAccessMemory
bool doesNotAccessMemory(unsigned OpNo) const
Definition: InstrTypes.h:1687
llvm::TargetLibraryInfoWrapperPass
Definition: TargetLibraryInfo.h:463
Addr
uint64_t Addr
Definition: ELFObjHandler.cpp:80
INITIALIZE_PASS_DEPENDENCY
INITIALIZE_PASS_DEPENDENCY(DominatorTreeWrapperPass)
llvm::Optional::emplace
void emplace(ArgTypes &&... Args)
Create a new object by constructing it in place with the given arguments.
Definition: Optional.h:264
I
#define I(x, y, z)
Definition: MD5.cpp:59
Cloning.h
llvm::cl::init
initializer< Ty > init(const Ty &Val)
Definition: CommandLine.h:443
DIBuilder.h
llvm::StackLifetime
Compute live ranges of allocas.
Definition: StackLifetime.h:38
llvm::SCEVRewriteVisitor
This visitor recursively visits a SCEV expression and re-writes it.
Definition: ScalarEvolutionExpressions.h:714
ArrayRef.h
llvm::CallBase::doesNotCapture
bool doesNotCapture(unsigned OpNo) const
Determine whether this data operand is not captured.
Definition: InstrTypes.h:1646
TargetPassConfig.h
IRBuilder.h
assert
assert(ImpDefSCC.getReg()==AMDGPU::SCC &&ImpDefSCC.isDef())
llvm::TargetMachine
Primary interface to the complete machine description for the target machine.
Definition: TargetMachine.h:77
SI
StandardInstrumentations SI(Debug, VerifyEach)
InlineCost.h
llvm::Value::use_begin
use_iterator use_begin()
Definition: Value.h:361
llvm::Module
A Module instance is used to store all the information related to an LLVM module.
Definition: Module.h:67
llvm::MDNode
Metadata node.
Definition: Metadata.h:897
llvm::safestack
Definition: SafeStackLayout.h:21
llvm::AMDGPU::IsaInfo::TargetIDSetting::Off
@ Off
llvm::CallBase::arg_end
User::op_iterator arg_end()
Return the iterator pointing to the end of the argument list.
Definition: InstrTypes.h:1309
llvm::APInt
Class for arbitrary precision integers.
Definition: APInt.h:70
llvm::AssumptionCacheTracker
An immutable pass that tracks lazily created AssumptionCache objects.
Definition: AssumptionCache.h:200
llvm::ArrayRef
ArrayRef - Represent a constant reference to an array (0 or more elements consecutively in memory),...
Definition: APInt.h:32
llvm::LoopInfo
Definition: LoopInfo.h:1083
DataLayout.h
llvm::StackLifetime::LiveRange
This class represents a set of interesting instructions where an alloca is live.
Definition: StackLifetime.h:64
llvm::Value::getType
Type * getType() const
All values are typed, get the type of this value.
Definition: Value.h:256
llvm::SPII::Store
@ Store
Definition: SparcInstrInfo.h:33
llvm::AnalysisUsage::addPreserved
AnalysisUsage & addPreserved()
Add the specified Pass class to the set of analyses preserved by this pass.
Definition: PassAnalysisSupport.h:98
llvm::Value::replaceAllUsesWith
void replaceAllUsesWith(Value *V)
Change all uses of this to point to a new Value.
Definition: Value.cpp:520
llvm::AllocaInst::getAlignment
unsigned getAlignment() const
Definition: Instructions.h:129
llvm::Value::getContext
LLVMContext & getContext() const
All values hold a context through their type.
Definition: Value.cpp:979
llvm::AllocaInst::isArrayAllocation
bool isArrayAllocation() const
Return true if there is an allocation size parameter to the allocation instruction that is not 1.
Definition: Instructions.cpp:1378
TargetSubtargetInfo.h
DL
MachineBasicBlock MachineBasicBlock::iterator DebugLoc DL
Definition: AArch64SLSHardening.cpp:76
ConstantRange.h
INITIALIZE_PASS_BEGIN
INITIALIZE_PASS_BEGIN(SafeStackLegacyPass, DEBUG_TYPE, "Safe Stack instrumentation pass", false, false) INITIALIZE_PASS_END(SafeStackLegacyPass
llvm::Value::getName
StringRef getName() const
Return a constant reference to the value's name.
Definition: Value.cpp:297
llvm::IRBuilderBase::CreateGEP
Value * CreateGEP(Type *Ty, Value *Ptr, ArrayRef< Value * > IdxList, const Twine &Name="")
Definition: IRBuilder.h:1795
pass
Safe Stack instrumentation pass
Definition: SafeStack.cpp:941
llvm::replaceDbgValueForAlloca
void replaceDbgValueForAlloca(AllocaInst *AI, Value *NewAllocaAddress, DIBuilder &Builder, int Offset=0)
Replaces multiple llvm.dbg.value instructions when the alloca it describes is replaced with a new val...
Definition: Local.cpp:1717
Argument.h
Callee
amdgpu Simplify well known AMD library false FunctionCallee Callee
Definition: AMDGPULibCalls.cpp:206
Attributes.h
runOnFunction
static bool runOnFunction(Function &F, bool PostInlining)
Definition: EntryExitInstrumenter.cpp:69
llvm::GraphProgram::Name
Name
Definition: GraphWriter.h:52
llvm::IRBuilderBase::CreateMemCpy
CallInst * CreateMemCpy(Value *Dst, MaybeAlign DstAlign, Value *Src, MaybeAlign SrcAlign, uint64_t Size, bool isVolatile=false, MDNode *TBAATag=nullptr, MDNode *TBAAStructTag=nullptr, MDNode *ScopeTag=nullptr, MDNode *NoAliasTag=nullptr)
Create and insert a memcpy between the specified pointers.
Definition: IRBuilder.h:622
llvm::AMDGPU::SendMsg::Op
Op
Definition: SIDefines.h:314
llvm::CallBase::isNoInline
bool isNoInline() const
Return true if the call should not be inlined.
Definition: InstrTypes.h:1781
llvm::X86::FirstMacroFusionInstKind::Cmp
@ Cmp
Casting.h
Function.h
llvm::BitWidth
constexpr unsigned BitWidth
Definition: BitmaskEnum.h:147
llvm::SCEVUnknown
This means that we are dealing with an entirely unknown SCEV value, and only represent it as its LLVM...
Definition: ScalarEvolutionExpressions.h:530
llvm::inst_end
inst_iterator inst_end(Function *F)
Definition: InstIterator.h:132
llvm::InlineFunctionInfo
This class captures the data input to the InlineFunction call, and records the auxiliary results prod...
Definition: Cloning.h:201
llvm::ConstantRange::contains
bool contains(const APInt &Val) const
Return true if the specified value is in the set.
Definition: ConstantRange.cpp:394
llvm::ConstantRange
This class represents a range of values.
Definition: ConstantRange.h:47
llvm::IntrinsicInst
A wrapper class for inspecting calls to intrinsic functions.
Definition: IntrinsicInst.h:45
llvm::MDBuilder
Definition: MDBuilder.h:35
ScalarEvolutionExpressions.h
Instructions.h
SmallVector.h
User.h
Dominators.h
llvm::max
Align max(MaybeAlign Lhs, Align Rhs)
Definition: Alignment.h:340
llvm::FunctionCallee
A handy container for a FunctionType+Callee-pointer pair, which can be passed around as a single enti...
Definition: DerivedTypes.h:164
llvm::DISubprogram
Subprogram description.
Definition: DebugInfoMetadata.h:1802
llvm::SmallVectorImpl
This class consists of common code factored out of the SmallVector class to reduce code duplication b...
Definition: APFloat.h:43
llvm::InlineFunction
InlineResult InlineFunction(CallBase &CB, InlineFunctionInfo &IFI, AAResults *CalleeAAR=nullptr, bool InsertLifetime=true, Function *ForwardVarArgsTo=nullptr)
This function inlines the called function into the basic block of the caller.
Definition: InlineFunction.cpp:1758
llvm::CallBase
Base class for all callable instructions (InvokeInst and CallInst) Holds everything related to callin...
Definition: InstrTypes.h:1161
DerivedTypes.h
llvm::SCEV::getType
Type * getType() const
Return the LLVM type of this SCEV expression.
Definition: ScalarEvolution.cpp:379
TM
const char LLVMTargetMachineRef TM
Definition: PassBuilderBindings.cpp:47
llvm::FunctionPass
FunctionPass class - This class is used to implement most global optimizations.
Definition: Pass.h:298
getStackGuard
static Value * getStackGuard(const TargetLoweringBase *TLI, Module *M, IRBuilder<> &B, bool *SupportsSelectionDAGSP=nullptr)
Create a stack guard loading and populate whether SelectionDAG SSP is supported.
Definition: StackProtector.cpp:379
llvm::CallInst
This class represents a function call, abstracting a target machine's calling convention.
Definition: Instructions.h:1475
llvm::IRBuilderBase::getVoidTy
Type * getVoidTy()
Fetch the type representing void.
Definition: IRBuilder.h:556
llvm::inst_begin
inst_iterator inst_begin(Function *F)
Definition: InstIterator.h:131
llvm::IRBuilderBase::CreateICmpNE
Value * CreateICmpNE(Value *LHS, Value *RHS, const Twine &Name="")
Definition: IRBuilder.h:2231
DEBUG_TYPE
#define DEBUG_TYPE
Definition: SafeStack.cpp:77
llvm::AnalysisUsage::addRequired
AnalysisUsage & addRequired()
Definition: PassAnalysisSupport.h:75
llvm::IRBuilderBase::CreateSub
Value * CreateSub(Value *LHS, Value *RHS, const Twine &Name="", bool HasNUW=false, bool HasNSW=false)
Definition: IRBuilder.h:1225
llvm::Value::takeName
void takeName(Value *V)
Transfer the name from V to this value.
Definition: Value.cpp:370
llvm::SplitBlockAndInsertIfThen
Instruction * SplitBlockAndInsertIfThen(Value *Cond, Instruction *SplitBefore, bool Unreachable, MDNode *BranchWeights, DominatorTree *DT, LoopInfo *LI=nullptr, BasicBlock *ThenBlock=nullptr)
Split the containing block at the specified instruction - everything before SplitBefore stays in the ...
Definition: BasicBlockUtils.cpp:1418
SafeStackLayout.h
llvm::AllocaInst
an instruction to allocate memory on the stack
Definition: Instructions.h:62
llvm::cl::desc
Definition: CommandLine.h:414
llvm::InstIterator
Definition: InstIterator.h:32
raw_ostream.h
BasicBlockUtils.h
llvm::createSafeStackPass
FunctionPass * createSafeStackPass()
This pass splits the stack into a safe stack and an unsafe stack to protect against stack-based overf...
Definition: SafeStack.cpp:943
llvm::replaceDbgDeclare
bool replaceDbgDeclare(Value *Address, Value *NewAddress, DIBuilder &Builder, uint8_t DIExprFlags, int Offset)
Replaces llvm.dbg.declare instruction when the address it describes is replaced with a new value.
Definition: Local.cpp:1676
Value.h
InitializePasses.h
llvm::Value
LLVM Value Representation.
Definition: Value.h:75
Debug.h
llvm::IRBuilderBase::CreateCall
CallInst * CreateCall(FunctionType *FTy, Value *Callee, ArrayRef< Value * > Args=None, const Twine &Name="", MDNode *FPMathTag=nullptr)
Definition: IRBuilder.h:2391
llvm::Use
A Use represents the edge between a Value definition and its users.
Definition: Use.h:44
llvm::SmallPtrSetImpl::insert
std::pair< iterator, bool > insert(PtrType Ptr)
Inserts Ptr if and only if there is no element in the container equal to Ptr.
Definition: SmallPtrSet.h:364
llvm::Intrinsic::ID
unsigned ID
Definition: TargetTransformInfo.h:38