LLVM  14.0.0git
StackProtector.cpp
Go to the documentation of this file.
1 //===- StackProtector.cpp - Stack Protector Insertion ---------------------===//
2 //
3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4 // See https://llvm.org/LICENSE.txt for license information.
5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6 //
7 //===----------------------------------------------------------------------===//
8 //
9 // This pass inserts stack protectors into functions which need them. A variable
10 // with a random value in it is stored onto the stack before the local variables
11 // are allocated. Upon exiting the block, the stored value is checked. If it's
12 // changed, then there was some sort of violation and the program aborts.
13 //
14 //===----------------------------------------------------------------------===//
15 
17 #include "llvm/ADT/SmallPtrSet.h"
18 #include "llvm/ADT/Statistic.h"
23 #include "llvm/CodeGen/Passes.h"
27 #include "llvm/IR/Attributes.h"
28 #include "llvm/IR/BasicBlock.h"
29 #include "llvm/IR/Constants.h"
30 #include "llvm/IR/DataLayout.h"
31 #include "llvm/IR/DebugInfo.h"
32 #include "llvm/IR/DebugLoc.h"
33 #include "llvm/IR/DerivedTypes.h"
34 #include "llvm/IR/Dominators.h"
35 #include "llvm/IR/Function.h"
36 #include "llvm/IR/IRBuilder.h"
37 #include "llvm/IR/Instruction.h"
38 #include "llvm/IR/Instructions.h"
39 #include "llvm/IR/IntrinsicInst.h"
40 #include "llvm/IR/Intrinsics.h"
41 #include "llvm/IR/MDBuilder.h"
42 #include "llvm/IR/Module.h"
43 #include "llvm/IR/Type.h"
44 #include "llvm/IR/User.h"
45 #include "llvm/InitializePasses.h"
46 #include "llvm/Pass.h"
47 #include "llvm/Support/Casting.h"
51 #include <utility>
52 
53 using namespace llvm;
54 
55 #define DEBUG_TYPE "stack-protector"
56 
57 STATISTIC(NumFunProtected, "Number of functions protected");
58 STATISTIC(NumAddrTaken, "Number of local variables that have their address"
59  " taken.");
60 
61 static cl::opt<bool> EnableSelectionDAGSP("enable-selectiondag-sp",
62  cl::init(true), cl::Hidden);
63 
64 char StackProtector::ID = 0;
65 
68 }
69 
71  "Insert stack protectors", false, true)
75  "Insert stack protectors", false, true)
76 
78 
82 }
83 
85  F = &Fn;
86  M = F->getParent();
88  getAnalysisIfAvailable<DominatorTreeWrapperPass>();
89  DT = DTWP ? &DTWP->getDomTree() : nullptr;
90  TM = &getAnalysis<TargetPassConfig>().getTM<TargetMachine>();
91  Trip = TM->getTargetTriple();
92  TLI = TM->getSubtargetImpl(Fn)->getTargetLowering();
93  HasPrologue = false;
94  HasIRCheck = false;
95 
96  Attribute Attr = Fn.getFnAttribute("stack-protector-buffer-size");
97  if (Attr.isStringAttribute() &&
98  Attr.getValueAsString().getAsInteger(10, SSPBufferSize))
99  return false; // Invalid integer string
100 
101  if (!RequiresStackProtector())
102  return false;
103 
104  // TODO(etienneb): Functions with funclets are not correctly supported now.
105  // Do nothing if this is funclet-based personality.
106  if (Fn.hasPersonalityFn()) {
108  if (isFuncletEHPersonality(Personality))
109  return false;
110  }
111 
112  ++NumFunProtected;
113  return InsertStackProtectors();
114 }
115 
116 /// \param [out] IsLarge is set to true if a protectable array is found and
117 /// it is "large" ( >= ssp-buffer-size). In the case of a structure with
118 /// multiple arrays, this gets set if any of them is large.
119 bool StackProtector::ContainsProtectableArray(Type *Ty, bool &IsLarge,
120  bool Strong,
121  bool InStruct) const {
122  if (!Ty)
123  return false;
124  if (ArrayType *AT = dyn_cast<ArrayType>(Ty)) {
125  if (!AT->getElementType()->isIntegerTy(8)) {
126  // If we're on a non-Darwin platform or we're inside of a structure, don't
127  // add stack protectors unless the array is a character array.
128  // However, in strong mode any array, regardless of type and size,
129  // triggers a protector.
130  if (!Strong && (InStruct || !Trip.isOSDarwin()))
131  return false;
132  }
133 
134  // If an array has more than SSPBufferSize bytes of allocated space, then we
135  // emit stack protectors.
136  if (SSPBufferSize <= M->getDataLayout().getTypeAllocSize(AT)) {
137  IsLarge = true;
138  return true;
139  }
140 
141  if (Strong)
142  // Require a protector for all arrays in strong mode
143  return true;
144  }
145 
146  const StructType *ST = dyn_cast<StructType>(Ty);
147  if (!ST)
148  return false;
149 
150  bool NeedsProtector = false;
151  for (StructType::element_iterator I = ST->element_begin(),
152  E = ST->element_end();
153  I != E; ++I)
154  if (ContainsProtectableArray(*I, IsLarge, Strong, true)) {
155  // If the element is a protectable array and is large (>= SSPBufferSize)
156  // then we are done. If the protectable array is not large, then
157  // keep looking in case a subsequent element is a large array.
158  if (IsLarge)
159  return true;
160  NeedsProtector = true;
161  }
162 
163  return NeedsProtector;
164 }
165 
166 bool StackProtector::HasAddressTaken(const Instruction *AI,
167  uint64_t AllocSize) {
168  const DataLayout &DL = M->getDataLayout();
169  for (const User *U : AI->users()) {
170  const auto *I = cast<Instruction>(U);
171  // If this instruction accesses memory make sure it doesn't access beyond
172  // the bounds of the allocated object.
174  if (MemLoc.hasValue() && MemLoc->Size.hasValue() &&
175  MemLoc->Size.getValue() > AllocSize)
176  return true;
177  switch (I->getOpcode()) {
178  case Instruction::Store:
179  if (AI == cast<StoreInst>(I)->getValueOperand())
180  return true;
181  break;
182  case Instruction::AtomicCmpXchg:
183  // cmpxchg conceptually includes both a load and store from the same
184  // location. So, like store, the value being stored is what matters.
185  if (AI == cast<AtomicCmpXchgInst>(I)->getNewValOperand())
186  return true;
187  break;
188  case Instruction::PtrToInt:
189  if (AI == cast<PtrToIntInst>(I)->getOperand(0))
190  return true;
191  break;
192  case Instruction::Call: {
193  // Ignore intrinsics that do not become real instructions.
194  // TODO: Narrow this to intrinsics that have store-like effects.
195  const auto *CI = cast<CallInst>(I);
196  if (!CI->isDebugOrPseudoInst() && !CI->isLifetimeStartOrEnd())
197  return true;
198  break;
199  }
200  case Instruction::Invoke:
201  return true;
202  case Instruction::GetElementPtr: {
203  // If the GEP offset is out-of-bounds, or is non-constant and so has to be
204  // assumed to be potentially out-of-bounds, then any memory access that
205  // would use it could also be out-of-bounds meaning stack protection is
206  // required.
207  const GetElementPtrInst *GEP = cast<GetElementPtrInst>(I);
208  unsigned TypeSize = DL.getIndexTypeSizeInBits(I->getType());
209  APInt Offset(TypeSize, 0);
210  APInt MaxOffset(TypeSize, AllocSize);
211  if (!GEP->accumulateConstantOffset(DL, Offset) || Offset.ugt(MaxOffset))
212  return true;
213  // Adjust AllocSize to be the space remaining after this offset.
214  if (HasAddressTaken(I, AllocSize - Offset.getLimitedValue()))
215  return true;
216  break;
217  }
218  case Instruction::BitCast:
219  case Instruction::Select:
220  case Instruction::AddrSpaceCast:
221  if (HasAddressTaken(I, AllocSize))
222  return true;
223  break;
224  case Instruction::PHI: {
225  // Keep track of what PHI nodes we have already visited to ensure
226  // they are only visited once.
227  const auto *PN = cast<PHINode>(I);
228  if (VisitedPHIs.insert(PN).second)
229  if (HasAddressTaken(PN, AllocSize))
230  return true;
231  break;
232  }
233  case Instruction::Load:
234  case Instruction::AtomicRMW:
235  case Instruction::Ret:
236  // These instructions take an address operand, but have load-like or
237  // other innocuous behavior that should not trigger a stack protector.
238  // atomicrmw conceptually has both load and store semantics, but the
239  // value being stored must be integer; so if a pointer is being stored,
240  // we'll catch it in the PtrToInt case above.
241  break;
242  default:
243  // Conservatively return true for any instruction that takes an address
244  // operand, but is not handled above.
245  return true;
246  }
247  }
248  return false;
249 }
250 
251 /// Search for the first call to the llvm.stackprotector intrinsic and return it
252 /// if present.
254  for (const BasicBlock &BB : F)
255  for (const Instruction &I : BB)
256  if (const auto *II = dyn_cast<IntrinsicInst>(&I))
257  if (II->getIntrinsicID() == Intrinsic::stackprotector)
258  return II;
259  return nullptr;
260 }
261 
262 /// Check whether or not this function needs a stack protector based
263 /// upon the stack protector level.
264 ///
265 /// We use two heuristics: a standard (ssp) and strong (sspstrong).
266 /// The standard heuristic which will add a guard variable to functions that
267 /// call alloca with a either a variable size or a size >= SSPBufferSize,
268 /// functions with character buffers larger than SSPBufferSize, and functions
269 /// with aggregates containing character buffers larger than SSPBufferSize. The
270 /// strong heuristic will add a guard variables to functions that call alloca
271 /// regardless of size, functions with any buffer regardless of type and size,
272 /// functions with aggregates that contain any buffer regardless of type and
273 /// size, and functions that contain stack-based variables that have had their
274 /// address taken.
275 bool StackProtector::RequiresStackProtector() {
276  bool Strong = false;
277  bool NeedsProtector = false;
278 
279  if (F->hasFnAttribute(Attribute::SafeStack))
280  return false;
281 
282  // We are constructing the OptimizationRemarkEmitter on the fly rather than
283  // using the analysis pass to avoid building DominatorTree and LoopInfo which
284  // are not available this late in the IR pipeline.
286 
287  if (F->hasFnAttribute(Attribute::StackProtectReq)) {
288  ORE.emit([&]() {
289  return OptimizationRemark(DEBUG_TYPE, "StackProtectorRequested", F)
290  << "Stack protection applied to function "
291  << ore::NV("Function", F)
292  << " due to a function attribute or command-line switch";
293  });
294  NeedsProtector = true;
295  Strong = true; // Use the same heuristic as strong to determine SSPLayout
296  } else if (F->hasFnAttribute(Attribute::StackProtectStrong))
297  Strong = true;
298  else if (!F->hasFnAttribute(Attribute::StackProtect))
299  return false;
300 
301  for (const BasicBlock &BB : *F) {
302  for (const Instruction &I : BB) {
303  if (const AllocaInst *AI = dyn_cast<AllocaInst>(&I)) {
304  if (AI->isArrayAllocation()) {
305  auto RemarkBuilder = [&]() {
306  return OptimizationRemark(DEBUG_TYPE, "StackProtectorAllocaOrArray",
307  &I)
308  << "Stack protection applied to function "
309  << ore::NV("Function", F)
310  << " due to a call to alloca or use of a variable length "
311  "array";
312  };
313  if (const auto *CI = dyn_cast<ConstantInt>(AI->getArraySize())) {
314  if (CI->getLimitedValue(SSPBufferSize) >= SSPBufferSize) {
315  // A call to alloca with size >= SSPBufferSize requires
316  // stack protectors.
317  Layout.insert(std::make_pair(AI,
319  ORE.emit(RemarkBuilder);
320  NeedsProtector = true;
321  } else if (Strong) {
322  // Require protectors for all alloca calls in strong mode.
323  Layout.insert(std::make_pair(AI,
325  ORE.emit(RemarkBuilder);
326  NeedsProtector = true;
327  }
328  } else {
329  // A call to alloca with a variable size requires protectors.
330  Layout.insert(std::make_pair(AI,
332  ORE.emit(RemarkBuilder);
333  NeedsProtector = true;
334  }
335  continue;
336  }
337 
338  bool IsLarge = false;
339  if (ContainsProtectableArray(AI->getAllocatedType(), IsLarge, Strong)) {
340  Layout.insert(std::make_pair(AI, IsLarge
343  ORE.emit([&]() {
344  return OptimizationRemark(DEBUG_TYPE, "StackProtectorBuffer", &I)
345  << "Stack protection applied to function "
346  << ore::NV("Function", F)
347  << " due to a stack allocated buffer or struct containing a "
348  "buffer";
349  });
350  NeedsProtector = true;
351  continue;
352  }
353 
354  if (Strong && HasAddressTaken(AI, M->getDataLayout().getTypeAllocSize(
355  AI->getAllocatedType()))) {
356  ++NumAddrTaken;
357  Layout.insert(std::make_pair(AI, MachineFrameInfo::SSPLK_AddrOf));
358  ORE.emit([&]() {
359  return OptimizationRemark(DEBUG_TYPE, "StackProtectorAddressTaken",
360  &I)
361  << "Stack protection applied to function "
362  << ore::NV("Function", F)
363  << " due to the address of a local variable being taken";
364  });
365  NeedsProtector = true;
366  }
367  // Clear any PHIs that we visited, to make sure we examine all uses of
368  // any subsequent allocas that we look at.
369  VisitedPHIs.clear();
370  }
371  }
372  }
373 
374  return NeedsProtector;
375 }
376 
377 /// Create a stack guard loading and populate whether SelectionDAG SSP is
378 /// supported.
380  IRBuilder<> &B,
381  bool *SupportsSelectionDAGSP = nullptr) {
382  Value *Guard = TLI->getIRStackGuard(B);
383  StringRef GuardMode = M->getStackProtectorGuard();
384  if ((GuardMode == "tls" || GuardMode.empty()) && Guard)
385  return B.CreateLoad(B.getInt8PtrTy(), Guard, true, "StackGuard");
386 
387  // Use SelectionDAG SSP handling, since there isn't an IR guard.
388  //
389  // This is more or less weird, since we optionally output whether we
390  // should perform a SelectionDAG SP here. The reason is that it's strictly
391  // defined as !TLI->getIRStackGuard(B), where getIRStackGuard is also
392  // mutating. There is no way to get this bit without mutating the IR, so
393  // getting this bit has to happen in this right time.
394  //
395  // We could have define a new function TLI::supportsSelectionDAGSP(), but that
396  // will put more burden on the backends' overriding work, especially when it
397  // actually conveys the same information getIRStackGuard() already gives.
398  if (SupportsSelectionDAGSP)
399  *SupportsSelectionDAGSP = true;
400  TLI->insertSSPDeclarations(*M);
401  return B.CreateCall(Intrinsic::getDeclaration(M, Intrinsic::stackguard));
402 }
403 
404 /// Insert code into the entry block that stores the stack guard
405 /// variable onto the stack:
406 ///
407 /// entry:
408 /// StackGuardSlot = alloca i8*
409 /// StackGuard = <stack guard>
410 /// call void @llvm.stackprotector(StackGuard, StackGuardSlot)
411 ///
412 /// Returns true if the platform/triple supports the stackprotectorcreate pseudo
413 /// node.
414 static bool CreatePrologue(Function *F, Module *M, ReturnInst *RI,
415  const TargetLoweringBase *TLI, AllocaInst *&AI) {
416  bool SupportsSelectionDAGSP = false;
417  IRBuilder<> B(&F->getEntryBlock().front());
418  PointerType *PtrTy = Type::getInt8PtrTy(RI->getContext());
419  AI = B.CreateAlloca(PtrTy, nullptr, "StackGuardSlot");
420 
421  Value *GuardSlot = getStackGuard(TLI, M, B, &SupportsSelectionDAGSP);
422  B.CreateCall(Intrinsic::getDeclaration(M, Intrinsic::stackprotector),
423  {GuardSlot, AI});
424  return SupportsSelectionDAGSP;
425 }
426 
427 /// InsertStackProtectors - Insert code into the prologue and epilogue of the
428 /// function.
429 ///
430 /// - The prologue code loads and stores the stack guard onto the stack.
431 /// - The epilogue checks the value stored in the prologue against the original
432 /// value. It calls __stack_chk_fail if they differ.
433 bool StackProtector::InsertStackProtectors() {
434  // If the target wants to XOR the frame pointer into the guard value, it's
435  // impossible to emit the check in IR, so the target *must* support stack
436  // protection in SDAG.
437  bool SupportsSelectionDAGSP =
438  TLI->useStackGuardXorFP() ||
441  AllocaInst *AI = nullptr; // Place on stack that stores the stack guard.
442 
444  ReturnInst *RI = dyn_cast<ReturnInst>(BB.getTerminator());
445  if (!RI)
446  continue;
447 
448  // Generate prologue instrumentation if not already generated.
449  if (!HasPrologue) {
450  HasPrologue = true;
451  SupportsSelectionDAGSP &= CreatePrologue(F, M, RI, TLI, AI);
452  }
453 
454  // SelectionDAG based code generation. Nothing else needs to be done here.
455  // The epilogue instrumentation is postponed to SelectionDAG.
456  if (SupportsSelectionDAGSP)
457  break;
458 
459  // Find the stack guard slot if the prologue was not created by this pass
460  // itself via a previous call to CreatePrologue().
461  if (!AI) {
462  const CallInst *SPCall = findStackProtectorIntrinsic(*F);
463  assert(SPCall && "Call to llvm.stackprotector is missing");
464  AI = cast<AllocaInst>(SPCall->getArgOperand(1));
465  }
466 
467  // Set HasIRCheck to true, so that SelectionDAG will not generate its own
468  // version. SelectionDAG called 'shouldEmitSDCheck' to check whether
469  // instrumentation has already been generated.
470  HasIRCheck = true;
471 
472  // If we're instrumenting a block with a musttail call, the check has to be
473  // inserted before the call rather than between it and the return. The
474  // verifier guarantees that a musttail call is either directly before the
475  // return or with a single correct bitcast of the return value in between so
476  // we don't need to worry about many situations here.
477  Instruction *CheckLoc = RI;
479  if (Prev && isa<CallInst>(Prev) && cast<CallInst>(Prev)->isMustTailCall())
480  CheckLoc = Prev;
481  else if (Prev) {
482  Prev = Prev->getPrevNonDebugInstruction();
483  if (Prev && isa<CallInst>(Prev) && cast<CallInst>(Prev)->isMustTailCall())
484  CheckLoc = Prev;
485  }
486 
487  // Generate epilogue instrumentation. The epilogue intrumentation can be
488  // function-based or inlined depending on which mechanism the target is
489  // providing.
490  if (Function *GuardCheck = TLI->getSSPStackGuardCheck(*M)) {
491  // Generate the function-based epilogue instrumentation.
492  // The target provides a guard check function, generate a call to it.
493  IRBuilder<> B(CheckLoc);
494  LoadInst *Guard = B.CreateLoad(B.getInt8PtrTy(), AI, true, "Guard");
495  CallInst *Call = B.CreateCall(GuardCheck, {Guard});
496  Call->setAttributes(GuardCheck->getAttributes());
497  Call->setCallingConv(GuardCheck->getCallingConv());
498  } else {
499  // Generate the epilogue with inline instrumentation.
500  // If we do not support SelectionDAG based calls, generate IR level
501  // calls.
502  //
503  // For each block with a return instruction, convert this:
504  //
505  // return:
506  // ...
507  // ret ...
508  //
509  // into this:
510  //
511  // return:
512  // ...
513  // %1 = <stack guard>
514  // %2 = load StackGuardSlot
515  // %3 = cmp i1 %1, %2
516  // br i1 %3, label %SP_return, label %CallStackCheckFailBlk
517  //
518  // SP_return:
519  // ret ...
520  //
521  // CallStackCheckFailBlk:
522  // call void @__stack_chk_fail()
523  // unreachable
524 
525  // Create the FailBB. We duplicate the BB every time since the MI tail
526  // merge pass will merge together all of the various BB into one including
527  // fail BB generated by the stack protector pseudo instruction.
528  BasicBlock *FailBB = CreateFailBB();
529 
530  // Split the basic block before the return instruction.
531  BasicBlock *NewBB =
532  BB.splitBasicBlock(CheckLoc->getIterator(), "SP_return");
533 
534  // Update the dominator tree if we need to.
535  if (DT && DT->isReachableFromEntry(&BB)) {
536  DT->addNewBlock(NewBB, &BB);
537  DT->addNewBlock(FailBB, &BB);
538  }
539 
540  // Remove default branch instruction to the new BB.
541  BB.getTerminator()->eraseFromParent();
542 
543  // Move the newly created basic block to the point right after the old
544  // basic block so that it's in the "fall through" position.
545  NewBB->moveAfter(&BB);
546 
547  // Generate the stack protector instructions in the old basic block.
548  IRBuilder<> B(&BB);
549  Value *Guard = getStackGuard(TLI, M, B);
550  LoadInst *LI2 = B.CreateLoad(B.getInt8PtrTy(), AI, true);
551  Value *Cmp = B.CreateICmpEQ(Guard, LI2);
552  auto SuccessProb =
554  auto FailureProb =
556  MDNode *Weights = MDBuilder(F->getContext())
557  .createBranchWeights(SuccessProb.getNumerator(),
558  FailureProb.getNumerator());
559  B.CreateCondBr(Cmp, NewBB, FailBB, Weights);
560  }
561  }
562 
563  // Return if we didn't modify any basic blocks. i.e., there are no return
564  // statements in the function.
565  return HasPrologue;
566 }
567 
568 /// CreateFailBB - Create a basic block to jump to when the stack protector
569 /// check fails.
570 BasicBlock *StackProtector::CreateFailBB() {
571  LLVMContext &Context = F->getContext();
572  BasicBlock *FailBB = BasicBlock::Create(Context, "CallStackCheckFailBlk", F);
573  IRBuilder<> B(FailBB);
574  if (F->getSubprogram())
575  B.SetCurrentDebugLocation(
576  DILocation::get(Context, 0, 0, F->getSubprogram()));
577  if (Trip.isOSOpenBSD()) {
578  FunctionCallee StackChkFail = M->getOrInsertFunction(
579  "__stack_smash_handler", Type::getVoidTy(Context),
581 
582  B.CreateCall(StackChkFail, B.CreateGlobalStringPtr(F->getName(), "SSH"));
583  } else {
584  FunctionCallee StackChkFail =
585  M->getOrInsertFunction("__stack_chk_fail", Type::getVoidTy(Context));
586 
587  B.CreateCall(StackChkFail, {});
588  }
589  B.CreateUnreachable();
590  return FailBB;
591 }
592 
594  return HasPrologue && !HasIRCheck && isa<ReturnInst>(BB.getTerminator());
595 }
596 
598  if (Layout.empty())
599  return;
600 
601  for (int I = 0, E = MFI.getObjectIndexEnd(); I != E; ++I) {
602  if (MFI.isDeadObjectIndex(I))
603  continue;
604 
605  const AllocaInst *AI = MFI.getObjectAllocation(I);
606  if (!AI)
607  continue;
608 
609  SSPLayoutMap::const_iterator LI = Layout.find(AI);
610  if (LI == Layout.end())
611  continue;
612 
613  MFI.setObjectSSPLayout(I, LI->second);
614  }
615 }
llvm::Instruction::getPrevNonDebugInstruction
const Instruction * getPrevNonDebugInstruction(bool SkipPseudoOp=false) const
Return a pointer to the previous non-debug instruction in the same basic block as 'this',...
Definition: Instruction.cpp:736
StackProtector.h
llvm
---------------------— PointerInfo ------------------------------------—
Definition: AllocatorList.h:23
llvm::TargetLoweringBase
This base class for TargetLowering contains the SelectionDAG-independent parts that can be used from ...
Definition: TargetLowering.h:192
M
We currently emits eax Perhaps this is what we really should generate is Is imull three or four cycles eax eax The current instruction priority is based on pattern complexity The former is more complex because it folds a load so the latter will not be emitted Perhaps we should use AddedComplexity to give LEA32r a higher priority We should always try to match LEA first since the LEA matching code does some estimate to determine whether the match is profitable if we care more about code then imull is better It s two bytes shorter than movl leal On a Pentium M
Definition: README.txt:252
llvm::StringRef::empty
LLVM_NODISCARD bool empty() const
empty - Check if the string is empty.
Definition: StringRef.h:153
llvm::ReturnInst
Return a value (possibly void), from a function.
Definition: Instructions.h:2978
llvm::DataLayout
A parsed version of the target data layout string in and methods for querying it.
Definition: DataLayout.h:112
llvm::Intrinsic::getDeclaration
Function * getDeclaration(Module *M, ID id, ArrayRef< Type * > Tys=None)
Create or insert an LLVM Function declaration for an intrinsic, and return it.
Definition: Function.cpp:1379
llvm::Type::getInt8PtrTy
static PointerType * getInt8PtrTy(LLVMContext &C, unsigned AS=0)
Definition: Type.cpp:255
IntrinsicInst.h
llvm::Function
Definition: Function.h:61
llvm::Attribute
Definition: Attributes.h:52
Pass.h
llvm::StackProtector::copyToMachineFrameInfo
void copyToMachineFrameInfo(MachineFrameInfo &MFI) const
Definition: StackProtector.cpp:597
llvm::StructType::element_iterator
Type::subtype_iterator element_iterator
Definition: DerivedTypes.h:315
llvm::StackProtector::runOnFunction
bool runOnFunction(Function &Fn) override
runOnFunction - Virtual method overriden by subclasses to do the per-function processing of the pass.
Definition: StackProtector.cpp:84
Statistic.h
llvm::IRBuilder<>
OptimizationRemarkEmitter.h
llvm::cl::Hidden
@ Hidden
Definition: CommandLine.h:143
INITIALIZE_PASS_BEGIN
INITIALIZE_PASS_BEGIN(StackProtector, DEBUG_TYPE, "Insert stack protectors", false, true) INITIALIZE_PASS_END(StackProtector
llvm::DenseMapIterator
Definition: DenseMap.h:56
llvm::MemoryLocation::Size
LocationSize Size
The maximum size of the location, in address-units, or UnknownSize if the size is not known.
Definition: MemoryLocation.h:226
EnableSelectionDAGSP
static cl::opt< bool > EnableSelectionDAGSP("enable-selectiondag-sp", cl::init(true), cl::Hidden)
llvm::Type
The instances of the Type class are immutable: once they are created, they are never changed.
Definition: Type.h:45
Module.h
EHPersonalities.h
llvm::MachineFrameInfo::SSPLK_LargeArray
@ SSPLK_LargeArray
Array or nested array >= SSP-buffer-size.
Definition: MachineFrameInfo.h:114
llvm::Optional
Definition: APInt.h:33
Offset
uint64_t Offset
Definition: ELFObjHandler.cpp:81
llvm::Module::getOrInsertFunction
FunctionCallee getOrInsertFunction(StringRef Name, FunctionType *T, AttributeList AttributeList)
Look up the specified function in the module symbol table.
Definition: Module.cpp:147
llvm::ore::NV
DiagnosticInfoOptimizationBase::Argument NV
Definition: OptimizationRemarkEmitter.h:136
isMustTailCall
static bool isMustTailCall(Value *V)
Definition: InstructionCombining.cpp:2831
llvm::MipsISD::Ret
@ Ret
Definition: MipsISelLowering.h:116
llvm::ArrayType
Class to represent array types.
Definition: DerivedTypes.h:357
llvm::MachineFrameInfo::getObjectIndexEnd
int getObjectIndexEnd() const
Return one past the maximum frame object index.
Definition: MachineFrameInfo.h:393
llvm::StackProtector::ID
static char ID
Definition: StackProtector.h:105
llvm::MDNode::get
static MDTuple * get(LLVMContext &Context, ArrayRef< Metadata * > MDs)
Definition: Metadata.h:1203
F
#define F(x, y, z)
Definition: MD5.cpp:56
llvm::BasicBlock
LLVM Basic Block Representation.
Definition: BasicBlock.h:58
llvm::Optional::hasValue
constexpr bool hasValue() const
Definition: Optional.h:288
Context
LLVMContext & Context
Definition: NVVMIntrRange.cpp:66
llvm::classifyEHPersonality
EHPersonality classifyEHPersonality(const Value *Pers)
See if the given exception handling personality function is one that we understand.
Definition: EHPersonalities.cpp:21
Instruction.h
CommandLine.h
TargetLowering.h
TargetMachine.h
llvm::PassRegistry::getPassRegistry
static PassRegistry * getPassRegistry()
getPassRegistry - Access the global registry object, which is automatically initialized at applicatio...
Definition: PassRegistry.cpp:31
Constants.h
E
static GCRegistry::Add< CoreCLRGC > E("coreclr", "CoreCLR-compatible GC")
llvm::Triple::isOSDarwin
bool isOSDarwin() const
isOSDarwin - Is this a "Darwin" OS (macOS, iOS, tvOS or watchOS).
Definition: Triple.h:484
llvm::User
Definition: User.h:44
llvm::MachineFrameInfo::setObjectSSPLayout
void setObjectSSPLayout(int ObjectIdx, SSPLayoutKind Kind)
Definition: MachineFrameInfo.h:542
Intrinsics.h
llvm::StackProtector
Definition: StackProtector.h:37
llvm::MDBuilder::createBranchWeights
MDNode * createBranchWeights(uint32_t TrueWeight, uint32_t FalseWeight)
Return metadata containing two branch weights.
Definition: MDBuilder.cpp:37
llvm::AnalysisUsage
Represent the analysis usage information of a pass.
Definition: PassAnalysisSupport.h:47
llvm::LocationSize::getValue
uint64_t getValue() const
Definition: MemoryLocation.h:158
false
Definition: StackSlotColoring.cpp:142
B
static GCRegistry::Add< OcamlGC > B("ocaml", "ocaml 3.10-compatible GC")
llvm::Function::getFnAttribute
Attribute getFnAttribute(Attribute::AttrKind Kind) const
Return the attribute for the given attribute kind.
Definition: Function.cpp:652
llvm::Instruction
Definition: Instruction.h:45
llvm::DominatorTreeWrapperPass
Legacy analysis pass which computes a DominatorTree.
Definition: Dominators.h:287
MDBuilder.h
llvm::STATISTIC
STATISTIC(NumFunctions, "Total number of functions")
llvm::Function::hasPersonalityFn
bool hasPersonalityFn() const
Check whether this function has a personality function.
Definition: Function.h:785
DebugLoc.h
SmallPtrSet.h
llvm::Attribute::isStringAttribute
bool isStringAttribute() const
Return true if the attribute is a string (target-dependent) attribute.
Definition: Attributes.cpp:265
llvm::TargetLoweringBase::insertSSPDeclarations
virtual void insertSSPDeclarations(Module &M) const
Inserts necessary declarations for SSP (stack protection) purpose.
Definition: TargetLoweringBase.cpp:1980
llvm::MCID::Call
@ Call
Definition: MCInstrDesc.h:153
llvm::SPII::Load
@ Load
Definition: SparcInstrInfo.h:32
llvm::Attribute::getValueAsString
StringRef getValueAsString() const
Return the attribute's value as a string.
Definition: Attributes.cpp:301
llvm::StringRef::getAsInteger
std::enable_if_t< std::numeric_limits< T >::is_signed, bool > getAsInteger(unsigned Radix, T &Result) const
Parse the current string as an integer of the specified radix.
Definition: StringRef.h:510
llvm::BranchProbabilityInfo::getBranchProbStackProtector
static BranchProbability getBranchProbStackProtector(bool IsLikely)
Definition: BranchProbabilityInfo.h:194
Type.h
llvm::MachineFrameInfo::isDeadObjectIndex
bool isDeadObjectIndex(int ObjectIdx) const
Returns true if the specified index corresponds to a dead object.
Definition: MachineFrameInfo.h:713
INITIALIZE_PASS_END
#define INITIALIZE_PASS_END(passName, arg, name, cfg, analysis)
Definition: PassSupport.h:58
Passes.h
llvm::TargetPassConfig
Target-Independent Code Generator Pass Configuration Options.
Definition: TargetPassConfig.h:84
llvm::Function::hasFnAttribute
bool hasFnAttribute(Attribute::AttrKind Kind) const
Return true if the function has the attribute.
Definition: Function.cpp:626
BasicBlock.h
llvm::cl::opt< bool >
llvm::TargetOptions::EnableGlobalISel
unsigned EnableGlobalISel
EnableGlobalISel - This flag enables global instruction selection.
Definition: TargetOptions.h:227
llvm::TargetLoweringBase::getIRStackGuard
virtual Value * getIRStackGuard(IRBuilderBase &IRB) const
If the target has a standard location for the stack protector guard, returns the address of that loca...
Definition: TargetLoweringBase.cpp:1966
BranchProbabilityInfo.h
llvm::MemoryLocation::getOrNone
static Optional< MemoryLocation > getOrNone(const Instruction *Inst)
Definition: MemoryLocation.cpp:78
llvm::StackProtector::StackProtector
StackProtector()
Definition: StackProtector.cpp:66
uint64_t
llvm::LocationSize::hasValue
bool hasValue() const
Definition: MemoryLocation.h:155
llvm::GlobalValue::getParent
Module * getParent()
Get the module that this global value is contained inside of...
Definition: GlobalValue.h:572
llvm::ARM_MB::ST
@ ST
Definition: ARMBaseInfo.h:73
llvm::StackProtector::getAnalysisUsage
void getAnalysisUsage(AnalysisUsage &AU) const override
getAnalysisUsage - This function should be overriden by passes that need analysis information to do t...
Definition: StackProtector.cpp:79
INITIALIZE_PASS_DEPENDENCY
INITIALIZE_PASS_DEPENDENCY(DominatorTreeWrapperPass)
llvm::LLVMContext
This is an important class for using LLVM in a threaded context.
Definition: LLVMContext.h:68
MemoryLocation.h
DebugInfo.h
llvm::Triple::isOSOpenBSD
bool isOSOpenBSD() const
Definition: Triple.h:506
I
#define I(x, y, z)
Definition: MD5.cpp:59
llvm::GetElementPtrInst
an instruction for type-safe pointer arithmetic to access elements of arrays and structs
Definition: Instructions.h:928
llvm::cl::init
initializer< Ty > init(const Ty &Val)
Definition: CommandLine.h:443
llvm::make_early_inc_range
iterator_range< early_inc_iterator_impl< detail::IterOfRange< RangeT > > > make_early_inc_range(RangeT &&Range)
Make a range that does early increment to allow mutation of the underlying range without disrupting i...
Definition: STLExtras.h:572
llvm::PointerType
Class to represent pointers.
Definition: DerivedTypes.h:632
TargetPassConfig.h
llvm::DenseMapBase::find
iterator find(const_arg_type_t< KeyT > Val)
Definition: DenseMap.h:150
llvm::TargetMachine::Options
TargetOptions Options
Definition: TargetMachine.h:120
IRBuilder.h
assert
assert(ImpDefSCC.getReg()==AMDGPU::SCC &&ImpDefSCC.isDef())
llvm::TargetMachine
Primary interface to the complete machine description for the target machine.
Definition: TargetMachine.h:79
llvm::SPII::Store
@ Store
Definition: SparcInstrInfo.h:33
llvm::DominatorTree::isReachableFromEntry
bool isReachableFromEntry(const Use &U) const
Provide an overload for a Use.
Definition: Dominators.cpp:328
llvm::Module
A Module instance is used to store all the information related to an LLVM module.
Definition: Module.h:67
llvm::MDNode
Metadata node.
Definition: Metadata.h:901
llvm::TargetOptions::EnableFastISel
unsigned EnableFastISel
EnableFastISel - This flag enables fast-path instruction selection which trades away generated code q...
Definition: TargetOptions.h:224
llvm::TargetLoweringBase::useStackGuardXorFP
virtual bool useStackGuardXorFP() const
If this function returns true, stack protection checks should XOR the frame pointer (or whichever poi...
Definition: TargetLowering.h:1799
llvm::APInt
Class for arbitrary precision integers.
Definition: APInt.h:75
TargetOptions.h
llvm::StackProtector::shouldEmitSDCheck
bool shouldEmitSDCheck(const BasicBlock &BB) const
Definition: StackProtector.cpp:593
llvm::OptimizationRemarkEmitter
The optimization diagnostic interface.
Definition: OptimizationRemarkEmitter.h:33
llvm::BasicBlock::moveAfter
void moveAfter(BasicBlock *MovePos)
Unlink this basic block from its current function and insert it right after MovePos in the function M...
Definition: BasicBlock.cpp:138
DataLayout.h
llvm::StructType
Class to represent struct types.
Definition: DerivedTypes.h:213
llvm::StringRef
StringRef - Represent a constant reference to a string, i.e.
Definition: StringRef.h:58
llvm::AnalysisUsage::addPreserved
AnalysisUsage & addPreserved()
Add the specified Pass class to the set of analyses preserved by this pass.
Definition: PassAnalysisSupport.h:98
llvm::BasicBlock::Create
static BasicBlock * Create(LLVMContext &Context, const Twine &Name="", Function *Parent=nullptr, BasicBlock *InsertBefore=nullptr)
Creates a new BasicBlock.
Definition: BasicBlock.h:100
llvm::Value::getContext
LLVMContext & getContext() const
All values hold a context through their type.
Definition: Value.cpp:978
llvm::ilist_node_impl::getIterator
self_iterator getIterator()
Definition: ilist_node.h:81
TargetSubtargetInfo.h
DL
MachineBasicBlock MachineBasicBlock::iterator DebugLoc DL
Definition: AArch64SLSHardening.cpp:76
CreatePrologue
static bool CreatePrologue(Function *F, Module *M, ReturnInst *RI, const TargetLoweringBase *TLI, AllocaInst *&AI)
Insert code into the entry block that stores the stack guard variable onto the stack:
Definition: StackProtector.cpp:414
llvm::LoadInst
An instruction for reading from memory.
Definition: Instructions.h:175
llvm::DenseMapBase::insert
std::pair< iterator, bool > insert(const std::pair< KeyT, ValueT > &KV)
Definition: DenseMap.h:207
llvm::EHPersonality
EHPersonality
Definition: EHPersonalities.h:22
llvm::DominatorTreeBase::addNewBlock
DomTreeNodeBase< NodeT > * addNewBlock(NodeT *BB, NodeT *DomBB)
Add a new node to the dominator tree information.
Definition: GenericDomTree.h:619
llvm::DenseMapBase::empty
LLVM_NODISCARD bool empty() const
Definition: DenseMap.h:97
llvm::MCID::Select
@ Select
Definition: MCInstrDesc.h:162
Attributes.h
llvm::TargetLoweringBase::getSSPStackGuardCheck
virtual Function * getSSPStackGuardCheck(const Module &M) const
If the target has a standard stack protection check function that performs validation and error handl...
Definition: TargetLoweringBase.cpp:1997
llvm::DenseMapBase::end
iterator end()
Definition: DenseMap.h:83
llvm::X86::FirstMacroFusionInstKind::Cmp
@ Cmp
llvm::TypeSize
Definition: TypeSize.h:417
Casting.h
Function.h
llvm::DominatorTreeWrapperPass::getDomTree
DominatorTree & getDomTree()
Definition: Dominators.h:295
llvm::Function::getPersonalityFn
Constant * getPersonalityFn() const
Get the personality function associated with this function.
Definition: Function.cpp:1823
protectors
Insert stack protectors
Definition: StackProtector.cpp:75
llvm::MDBuilder
Definition: MDBuilder.h:35
llvm::Type::getVoidTy
static Type * getVoidTy(LLVMContext &C)
Definition: Type.cpp:186
llvm::MachineFrameInfo
The MachineFrameInfo class represents an abstract stack frame until prolog/epilog code is inserted.
Definition: MachineFrameInfo.h:107
llvm::OptimizationRemark
Diagnostic information for applied optimization remarks.
Definition: DiagnosticInfo.h:685
Instructions.h
llvm::TargetSubtargetInfo::getTargetLowering
virtual const TargetLowering * getTargetLowering() const
Definition: TargetSubtargetInfo.h:96
llvm::TargetMachine::getSubtargetImpl
virtual const TargetSubtargetInfo * getSubtargetImpl(const Function &) const
Virtual method implemented by subclasses that returns a reference to that target's TargetSubtargetInf...
Definition: TargetMachine.h:135
User.h
llvm::MachineFrameInfo::SSPLK_AddrOf
@ SSPLK_AddrOf
The address of this allocation is exposed and triggered protection.
Definition: MachineFrameInfo.h:118
Dominators.h
llvm::CallBase::getArgOperand
Value * getArgOperand(unsigned i) const
Definition: InstrTypes.h:1338
llvm::TargetMachine::getTargetTriple
const Triple & getTargetTriple() const
Definition: TargetMachine.h:128
llvm::MachineFrameInfo::SSPLK_SmallArray
@ SSPLK_SmallArray
Array or nested array < SSP-buffer-size.
Definition: MachineFrameInfo.h:116
stack
S is passed via registers r2 But gcc stores them to the stack
Definition: README.txt:189
DEBUG_TYPE
#define DEBUG_TYPE
Definition: StackProtector.cpp:55
llvm::FunctionCallee
A handy container for a FunctionType+Callee-pointer pair, which can be passed around as a single enti...
Definition: DerivedTypes.h:165
llvm::Module::getDataLayout
const DataLayout & getDataLayout() const
Get the data layout for the module's target platform.
Definition: Module.cpp:401
DerivedTypes.h
llvm::FunctionPass
FunctionPass class - This class is used to implement most global optimizations.
Definition: Pass.h:298
getStackGuard
static Value * getStackGuard(const TargetLoweringBase *TLI, Module *M, IRBuilder<> &B, bool *SupportsSelectionDAGSP=nullptr)
Create a stack guard loading and populate whether SelectionDAG SSP is supported.
Definition: StackProtector.cpp:379
llvm::CallInst
This class represents a function call, abstracting a target machine's calling convention.
Definition: Instructions.h:1475
BB
Common register allocation spilling lr str ldr sxth r3 ldr mla r4 can lr mov lr str ldr sxth r3 mla r4 and then merge mul and lr str ldr sxth r3 mla r4 It also increase the likelihood the store may become dead bb27 Successors according to LLVM BB
Definition: README.txt:39
GEP
Hexagon Common GEP
Definition: HexagonCommonGEP.cpp:172
llvm::AnalysisUsage::addRequired
AnalysisUsage & addRequired()
Definition: PassAnalysisSupport.h:75
llvm::initializeStackProtectorPass
void initializeStackProtectorPass(PassRegistry &)
llvm::AllocaInst
an instruction to allocate memory on the stack
Definition: Instructions.h:62
findStackProtectorIntrinsic
static const CallInst * findStackProtectorIntrinsic(Function &F)
Search for the first call to the llvm.stackprotector intrinsic and return it if present.
Definition: StackProtector.cpp:253
true
basic Basic Alias true
Definition: BasicAliasAnalysis.cpp:1815
InitializePasses.h
llvm::Value
LLVM Value Representation.
Definition: Value.h:75
llvm::Value::users
iterator_range< user_iterator > users()
Definition: Value.h:422
llvm::isFuncletEHPersonality
bool isFuncletEHPersonality(EHPersonality Pers)
Returns true if this is a personality function that invokes handler funclets (which must return to it...
Definition: EHPersonalities.h:65
llvm::createStackProtectorPass
FunctionPass * createStackProtectorPass()
createStackProtectorPass - This pass adds stack protectors to functions.
Definition: StackProtector.cpp:77
llvm::Intrinsic::ID
unsigned ID
Definition: TargetTransformInfo.h:37
llvm::MachineFrameInfo::getObjectAllocation
const AllocaInst * getObjectAllocation(int ObjectIdx) const
Return the underlying Alloca of the specified stack object if it exists.
Definition: MachineFrameInfo.h:486
llvm::DataLayout::getTypeAllocSize
TypeSize getTypeAllocSize(Type *Ty) const
Returns the offset in bytes between successive objects of the specified type, including alignment pad...
Definition: DataLayout.h:498