LLVM  14.0.0git
StackProtector.cpp
Go to the documentation of this file.
1 //===- StackProtector.cpp - Stack Protector Insertion ---------------------===//
2 //
3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4 // See https://llvm.org/LICENSE.txt for license information.
5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6 //
7 //===----------------------------------------------------------------------===//
8 //
9 // This pass inserts stack protectors into functions which need them. A variable
10 // with a random value in it is stored onto the stack before the local variables
11 // are allocated. Upon exiting the block, the stored value is checked. If it's
12 // changed, then there was some sort of violation and the program aborts.
13 //
14 //===----------------------------------------------------------------------===//
15 
17 #include "llvm/ADT/SmallPtrSet.h"
18 #include "llvm/ADT/Statistic.h"
23 #include "llvm/CodeGen/Passes.h"
27 #include "llvm/IR/Attributes.h"
28 #include "llvm/IR/BasicBlock.h"
29 #include "llvm/IR/Constants.h"
30 #include "llvm/IR/DataLayout.h"
31 #include "llvm/IR/DebugInfo.h"
32 #include "llvm/IR/DebugLoc.h"
33 #include "llvm/IR/DerivedTypes.h"
34 #include "llvm/IR/Dominators.h"
35 #include "llvm/IR/Function.h"
36 #include "llvm/IR/IRBuilder.h"
37 #include "llvm/IR/Instruction.h"
38 #include "llvm/IR/Instructions.h"
39 #include "llvm/IR/IntrinsicInst.h"
40 #include "llvm/IR/Intrinsics.h"
41 #include "llvm/IR/MDBuilder.h"
42 #include "llvm/IR/Module.h"
43 #include "llvm/IR/Type.h"
44 #include "llvm/IR/User.h"
45 #include "llvm/InitializePasses.h"
46 #include "llvm/Pass.h"
47 #include "llvm/Support/Casting.h"
51 #include <utility>
52 
53 using namespace llvm;
54 
55 #define DEBUG_TYPE "stack-protector"
56 
57 STATISTIC(NumFunProtected, "Number of functions protected");
58 STATISTIC(NumAddrTaken, "Number of local variables that have their address"
59  " taken.");
60 
61 static cl::opt<bool> EnableSelectionDAGSP("enable-selectiondag-sp",
62  cl::init(true), cl::Hidden);
63 
64 char StackProtector::ID = 0;
65 
68 }
69 
71  "Insert stack protectors", false, true)
75  "Insert stack protectors", false, true)
76 
78 
82 }
83 
85  F = &Fn;
86  M = F->getParent();
88  getAnalysisIfAvailable<DominatorTreeWrapperPass>();
89  DT = DTWP ? &DTWP->getDomTree() : nullptr;
90  TM = &getAnalysis<TargetPassConfig>().getTM<TargetMachine>();
91  Trip = TM->getTargetTriple();
92  TLI = TM->getSubtargetImpl(Fn)->getTargetLowering();
93  HasPrologue = false;
94  HasIRCheck = false;
95 
96  Attribute Attr = Fn.getFnAttribute("stack-protector-buffer-size");
97  if (Attr.isStringAttribute() &&
98  Attr.getValueAsString().getAsInteger(10, SSPBufferSize))
99  return false; // Invalid integer string
100 
101  if (!RequiresStackProtector())
102  return false;
103 
104  // TODO(etienneb): Functions with funclets are not correctly supported now.
105  // Do nothing if this is funclet-based personality.
106  if (Fn.hasPersonalityFn()) {
108  if (isFuncletEHPersonality(Personality))
109  return false;
110  }
111 
112  ++NumFunProtected;
113  return InsertStackProtectors();
114 }
115 
116 /// \param [out] IsLarge is set to true if a protectable array is found and
117 /// it is "large" ( >= ssp-buffer-size). In the case of a structure with
118 /// multiple arrays, this gets set if any of them is large.
119 bool StackProtector::ContainsProtectableArray(Type *Ty, bool &IsLarge,
120  bool Strong,
121  bool InStruct) const {
122  if (!Ty)
123  return false;
124  if (ArrayType *AT = dyn_cast<ArrayType>(Ty)) {
125  if (!AT->getElementType()->isIntegerTy(8)) {
126  // If we're on a non-Darwin platform or we're inside of a structure, don't
127  // add stack protectors unless the array is a character array.
128  // However, in strong mode any array, regardless of type and size,
129  // triggers a protector.
130  if (!Strong && (InStruct || !Trip.isOSDarwin()))
131  return false;
132  }
133 
134  // If an array has more than SSPBufferSize bytes of allocated space, then we
135  // emit stack protectors.
136  if (SSPBufferSize <= M->getDataLayout().getTypeAllocSize(AT)) {
137  IsLarge = true;
138  return true;
139  }
140 
141  if (Strong)
142  // Require a protector for all arrays in strong mode
143  return true;
144  }
145 
146  const StructType *ST = dyn_cast<StructType>(Ty);
147  if (!ST)
148  return false;
149 
150  bool NeedsProtector = false;
151  for (Type *ET : ST->elements())
152  if (ContainsProtectableArray(ET, IsLarge, Strong, true)) {
153  // If the element is a protectable array and is large (>= SSPBufferSize)
154  // then we are done. If the protectable array is not large, then
155  // keep looking in case a subsequent element is a large array.
156  if (IsLarge)
157  return true;
158  NeedsProtector = true;
159  }
160 
161  return NeedsProtector;
162 }
163 
164 bool StackProtector::HasAddressTaken(const Instruction *AI,
165  TypeSize AllocSize) {
166  const DataLayout &DL = M->getDataLayout();
167  for (const User *U : AI->users()) {
168  const auto *I = cast<Instruction>(U);
169  // If this instruction accesses memory make sure it doesn't access beyond
170  // the bounds of the allocated object.
172  if (MemLoc.hasValue() && MemLoc->Size.hasValue() &&
173  !TypeSize::isKnownGE(AllocSize,
174  TypeSize::getFixed(MemLoc->Size.getValue())))
175  return true;
176  switch (I->getOpcode()) {
177  case Instruction::Store:
178  if (AI == cast<StoreInst>(I)->getValueOperand())
179  return true;
180  break;
181  case Instruction::AtomicCmpXchg:
182  // cmpxchg conceptually includes both a load and store from the same
183  // location. So, like store, the value being stored is what matters.
184  if (AI == cast<AtomicCmpXchgInst>(I)->getNewValOperand())
185  return true;
186  break;
187  case Instruction::PtrToInt:
188  if (AI == cast<PtrToIntInst>(I)->getOperand(0))
189  return true;
190  break;
191  case Instruction::Call: {
192  // Ignore intrinsics that do not become real instructions.
193  // TODO: Narrow this to intrinsics that have store-like effects.
194  const auto *CI = cast<CallInst>(I);
195  if (!CI->isDebugOrPseudoInst() && !CI->isLifetimeStartOrEnd())
196  return true;
197  break;
198  }
199  case Instruction::Invoke:
200  return true;
201  case Instruction::GetElementPtr: {
202  // If the GEP offset is out-of-bounds, or is non-constant and so has to be
203  // assumed to be potentially out-of-bounds, then any memory access that
204  // would use it could also be out-of-bounds meaning stack protection is
205  // required.
206  const GetElementPtrInst *GEP = cast<GetElementPtrInst>(I);
207  unsigned IndexSize = DL.getIndexTypeSizeInBits(I->getType());
208  APInt Offset(IndexSize, 0);
209  if (!GEP->accumulateConstantOffset(DL, Offset))
210  return true;
211  TypeSize OffsetSize = TypeSize::Fixed(Offset.getLimitedValue());
212  if (!TypeSize::isKnownGT(AllocSize, OffsetSize))
213  return true;
214  // Adjust AllocSize to be the space remaining after this offset.
215  // We can't subtract a fixed size from a scalable one, so in that case
216  // assume the scalable value is of minimum size.
217  TypeSize NewAllocSize =
218  TypeSize::Fixed(AllocSize.getKnownMinValue()) - OffsetSize;
219  if (HasAddressTaken(I, NewAllocSize))
220  return true;
221  break;
222  }
223  case Instruction::BitCast:
224  case Instruction::Select:
225  case Instruction::AddrSpaceCast:
226  if (HasAddressTaken(I, AllocSize))
227  return true;
228  break;
229  case Instruction::PHI: {
230  // Keep track of what PHI nodes we have already visited to ensure
231  // they are only visited once.
232  const auto *PN = cast<PHINode>(I);
233  if (VisitedPHIs.insert(PN).second)
234  if (HasAddressTaken(PN, AllocSize))
235  return true;
236  break;
237  }
238  case Instruction::Load:
239  case Instruction::AtomicRMW:
240  case Instruction::Ret:
241  // These instructions take an address operand, but have load-like or
242  // other innocuous behavior that should not trigger a stack protector.
243  // atomicrmw conceptually has both load and store semantics, but the
244  // value being stored must be integer; so if a pointer is being stored,
245  // we'll catch it in the PtrToInt case above.
246  break;
247  default:
248  // Conservatively return true for any instruction that takes an address
249  // operand, but is not handled above.
250  return true;
251  }
252  }
253  return false;
254 }
255 
256 /// Search for the first call to the llvm.stackprotector intrinsic and return it
257 /// if present.
259  for (const BasicBlock &BB : F)
260  for (const Instruction &I : BB)
261  if (const auto *II = dyn_cast<IntrinsicInst>(&I))
262  if (II->getIntrinsicID() == Intrinsic::stackprotector)
263  return II;
264  return nullptr;
265 }
266 
267 /// Check whether or not this function needs a stack protector based
268 /// upon the stack protector level.
269 ///
270 /// We use two heuristics: a standard (ssp) and strong (sspstrong).
271 /// The standard heuristic which will add a guard variable to functions that
272 /// call alloca with a either a variable size or a size >= SSPBufferSize,
273 /// functions with character buffers larger than SSPBufferSize, and functions
274 /// with aggregates containing character buffers larger than SSPBufferSize. The
275 /// strong heuristic will add a guard variables to functions that call alloca
276 /// regardless of size, functions with any buffer regardless of type and size,
277 /// functions with aggregates that contain any buffer regardless of type and
278 /// size, and functions that contain stack-based variables that have had their
279 /// address taken.
280 bool StackProtector::RequiresStackProtector() {
281  bool Strong = false;
282  bool NeedsProtector = false;
283 
284  if (F->hasFnAttribute(Attribute::SafeStack))
285  return false;
286 
287  // We are constructing the OptimizationRemarkEmitter on the fly rather than
288  // using the analysis pass to avoid building DominatorTree and LoopInfo which
289  // are not available this late in the IR pipeline.
291 
292  if (F->hasFnAttribute(Attribute::StackProtectReq)) {
293  ORE.emit([&]() {
294  return OptimizationRemark(DEBUG_TYPE, "StackProtectorRequested", F)
295  << "Stack protection applied to function "
296  << ore::NV("Function", F)
297  << " due to a function attribute or command-line switch";
298  });
299  NeedsProtector = true;
300  Strong = true; // Use the same heuristic as strong to determine SSPLayout
301  } else if (F->hasFnAttribute(Attribute::StackProtectStrong))
302  Strong = true;
303  else if (!F->hasFnAttribute(Attribute::StackProtect))
304  return false;
305 
306  for (const BasicBlock &BB : *F) {
307  for (const Instruction &I : BB) {
308  if (const AllocaInst *AI = dyn_cast<AllocaInst>(&I)) {
309  if (AI->isArrayAllocation()) {
310  auto RemarkBuilder = [&]() {
311  return OptimizationRemark(DEBUG_TYPE, "StackProtectorAllocaOrArray",
312  &I)
313  << "Stack protection applied to function "
314  << ore::NV("Function", F)
315  << " due to a call to alloca or use of a variable length "
316  "array";
317  };
318  if (const auto *CI = dyn_cast<ConstantInt>(AI->getArraySize())) {
319  if (CI->getLimitedValue(SSPBufferSize) >= SSPBufferSize) {
320  // A call to alloca with size >= SSPBufferSize requires
321  // stack protectors.
322  Layout.insert(std::make_pair(AI,
324  ORE.emit(RemarkBuilder);
325  NeedsProtector = true;
326  } else if (Strong) {
327  // Require protectors for all alloca calls in strong mode.
328  Layout.insert(std::make_pair(AI,
330  ORE.emit(RemarkBuilder);
331  NeedsProtector = true;
332  }
333  } else {
334  // A call to alloca with a variable size requires protectors.
335  Layout.insert(std::make_pair(AI,
337  ORE.emit(RemarkBuilder);
338  NeedsProtector = true;
339  }
340  continue;
341  }
342 
343  bool IsLarge = false;
344  if (ContainsProtectableArray(AI->getAllocatedType(), IsLarge, Strong)) {
345  Layout.insert(std::make_pair(AI, IsLarge
348  ORE.emit([&]() {
349  return OptimizationRemark(DEBUG_TYPE, "StackProtectorBuffer", &I)
350  << "Stack protection applied to function "
351  << ore::NV("Function", F)
352  << " due to a stack allocated buffer or struct containing a "
353  "buffer";
354  });
355  NeedsProtector = true;
356  continue;
357  }
358 
359  if (Strong && HasAddressTaken(AI, M->getDataLayout().getTypeAllocSize(
360  AI->getAllocatedType()))) {
361  ++NumAddrTaken;
362  Layout.insert(std::make_pair(AI, MachineFrameInfo::SSPLK_AddrOf));
363  ORE.emit([&]() {
364  return OptimizationRemark(DEBUG_TYPE, "StackProtectorAddressTaken",
365  &I)
366  << "Stack protection applied to function "
367  << ore::NV("Function", F)
368  << " due to the address of a local variable being taken";
369  });
370  NeedsProtector = true;
371  }
372  // Clear any PHIs that we visited, to make sure we examine all uses of
373  // any subsequent allocas that we look at.
374  VisitedPHIs.clear();
375  }
376  }
377  }
378 
379  return NeedsProtector;
380 }
381 
382 /// Create a stack guard loading and populate whether SelectionDAG SSP is
383 /// supported.
385  IRBuilder<> &B,
386  bool *SupportsSelectionDAGSP = nullptr) {
387  Value *Guard = TLI->getIRStackGuard(B);
388  StringRef GuardMode = M->getStackProtectorGuard();
389  if ((GuardMode == "tls" || GuardMode.empty()) && Guard)
390  return B.CreateLoad(B.getInt8PtrTy(), Guard, true, "StackGuard");
391 
392  // Use SelectionDAG SSP handling, since there isn't an IR guard.
393  //
394  // This is more or less weird, since we optionally output whether we
395  // should perform a SelectionDAG SP here. The reason is that it's strictly
396  // defined as !TLI->getIRStackGuard(B), where getIRStackGuard is also
397  // mutating. There is no way to get this bit without mutating the IR, so
398  // getting this bit has to happen in this right time.
399  //
400  // We could have define a new function TLI::supportsSelectionDAGSP(), but that
401  // will put more burden on the backends' overriding work, especially when it
402  // actually conveys the same information getIRStackGuard() already gives.
403  if (SupportsSelectionDAGSP)
404  *SupportsSelectionDAGSP = true;
405  TLI->insertSSPDeclarations(*M);
406  return B.CreateCall(Intrinsic::getDeclaration(M, Intrinsic::stackguard));
407 }
408 
409 /// Insert code into the entry block that stores the stack guard
410 /// variable onto the stack:
411 ///
412 /// entry:
413 /// StackGuardSlot = alloca i8*
414 /// StackGuard = <stack guard>
415 /// call void @llvm.stackprotector(StackGuard, StackGuardSlot)
416 ///
417 /// Returns true if the platform/triple supports the stackprotectorcreate pseudo
418 /// node.
419 static bool CreatePrologue(Function *F, Module *M, ReturnInst *RI,
420  const TargetLoweringBase *TLI, AllocaInst *&AI) {
421  bool SupportsSelectionDAGSP = false;
422  IRBuilder<> B(&F->getEntryBlock().front());
423  PointerType *PtrTy = Type::getInt8PtrTy(RI->getContext());
424  AI = B.CreateAlloca(PtrTy, nullptr, "StackGuardSlot");
425 
426  Value *GuardSlot = getStackGuard(TLI, M, B, &SupportsSelectionDAGSP);
427  B.CreateCall(Intrinsic::getDeclaration(M, Intrinsic::stackprotector),
428  {GuardSlot, AI});
429  return SupportsSelectionDAGSP;
430 }
431 
432 /// InsertStackProtectors - Insert code into the prologue and epilogue of the
433 /// function.
434 ///
435 /// - The prologue code loads and stores the stack guard onto the stack.
436 /// - The epilogue checks the value stored in the prologue against the original
437 /// value. It calls __stack_chk_fail if they differ.
438 bool StackProtector::InsertStackProtectors() {
439  // If the target wants to XOR the frame pointer into the guard value, it's
440  // impossible to emit the check in IR, so the target *must* support stack
441  // protection in SDAG.
442  bool SupportsSelectionDAGSP =
443  TLI->useStackGuardXorFP() ||
445  AllocaInst *AI = nullptr; // Place on stack that stores the stack guard.
446 
448  ReturnInst *RI = dyn_cast<ReturnInst>(BB.getTerminator());
449  if (!RI)
450  continue;
451 
452  // Generate prologue instrumentation if not already generated.
453  if (!HasPrologue) {
454  HasPrologue = true;
455  SupportsSelectionDAGSP &= CreatePrologue(F, M, RI, TLI, AI);
456  }
457 
458  // SelectionDAG based code generation. Nothing else needs to be done here.
459  // The epilogue instrumentation is postponed to SelectionDAG.
460  if (SupportsSelectionDAGSP)
461  break;
462 
463  // Find the stack guard slot if the prologue was not created by this pass
464  // itself via a previous call to CreatePrologue().
465  if (!AI) {
466  const CallInst *SPCall = findStackProtectorIntrinsic(*F);
467  assert(SPCall && "Call to llvm.stackprotector is missing");
468  AI = cast<AllocaInst>(SPCall->getArgOperand(1));
469  }
470 
471  // Set HasIRCheck to true, so that SelectionDAG will not generate its own
472  // version. SelectionDAG called 'shouldEmitSDCheck' to check whether
473  // instrumentation has already been generated.
474  HasIRCheck = true;
475 
476  // If we're instrumenting a block with a musttail call, the check has to be
477  // inserted before the call rather than between it and the return. The
478  // verifier guarantees that a musttail call is either directly before the
479  // return or with a single correct bitcast of the return value in between so
480  // we don't need to worry about many situations here.
481  Instruction *CheckLoc = RI;
483  if (Prev && isa<CallInst>(Prev) && cast<CallInst>(Prev)->isMustTailCall())
484  CheckLoc = Prev;
485  else if (Prev) {
486  Prev = Prev->getPrevNonDebugInstruction();
487  if (Prev && isa<CallInst>(Prev) && cast<CallInst>(Prev)->isMustTailCall())
488  CheckLoc = Prev;
489  }
490 
491  // Generate epilogue instrumentation. The epilogue intrumentation can be
492  // function-based or inlined depending on which mechanism the target is
493  // providing.
494  if (Function *GuardCheck = TLI->getSSPStackGuardCheck(*M)) {
495  // Generate the function-based epilogue instrumentation.
496  // The target provides a guard check function, generate a call to it.
497  IRBuilder<> B(CheckLoc);
498  LoadInst *Guard = B.CreateLoad(B.getInt8PtrTy(), AI, true, "Guard");
499  CallInst *Call = B.CreateCall(GuardCheck, {Guard});
500  Call->setAttributes(GuardCheck->getAttributes());
501  Call->setCallingConv(GuardCheck->getCallingConv());
502  } else {
503  // Generate the epilogue with inline instrumentation.
504  // If we do not support SelectionDAG based calls, generate IR level
505  // calls.
506  //
507  // For each block with a return instruction, convert this:
508  //
509  // return:
510  // ...
511  // ret ...
512  //
513  // into this:
514  //
515  // return:
516  // ...
517  // %1 = <stack guard>
518  // %2 = load StackGuardSlot
519  // %3 = cmp i1 %1, %2
520  // br i1 %3, label %SP_return, label %CallStackCheckFailBlk
521  //
522  // SP_return:
523  // ret ...
524  //
525  // CallStackCheckFailBlk:
526  // call void @__stack_chk_fail()
527  // unreachable
528 
529  // Create the FailBB. We duplicate the BB every time since the MI tail
530  // merge pass will merge together all of the various BB into one including
531  // fail BB generated by the stack protector pseudo instruction.
532  BasicBlock *FailBB = CreateFailBB();
533 
534  // Split the basic block before the return instruction.
535  BasicBlock *NewBB =
536  BB.splitBasicBlock(CheckLoc->getIterator(), "SP_return");
537 
538  // Update the dominator tree if we need to.
539  if (DT && DT->isReachableFromEntry(&BB)) {
540  DT->addNewBlock(NewBB, &BB);
541  DT->addNewBlock(FailBB, &BB);
542  }
543 
544  // Remove default branch instruction to the new BB.
545  BB.getTerminator()->eraseFromParent();
546 
547  // Move the newly created basic block to the point right after the old
548  // basic block so that it's in the "fall through" position.
549  NewBB->moveAfter(&BB);
550 
551  // Generate the stack protector instructions in the old basic block.
552  IRBuilder<> B(&BB);
553  Value *Guard = getStackGuard(TLI, M, B);
554  LoadInst *LI2 = B.CreateLoad(B.getInt8PtrTy(), AI, true);
555  Value *Cmp = B.CreateICmpEQ(Guard, LI2);
556  auto SuccessProb =
558  auto FailureProb =
560  MDNode *Weights = MDBuilder(F->getContext())
561  .createBranchWeights(SuccessProb.getNumerator(),
562  FailureProb.getNumerator());
563  B.CreateCondBr(Cmp, NewBB, FailBB, Weights);
564  }
565  }
566 
567  // Return if we didn't modify any basic blocks. i.e., there are no return
568  // statements in the function.
569  return HasPrologue;
570 }
571 
572 /// CreateFailBB - Create a basic block to jump to when the stack protector
573 /// check fails.
574 BasicBlock *StackProtector::CreateFailBB() {
575  LLVMContext &Context = F->getContext();
576  BasicBlock *FailBB = BasicBlock::Create(Context, "CallStackCheckFailBlk", F);
577  IRBuilder<> B(FailBB);
578  if (F->getSubprogram())
579  B.SetCurrentDebugLocation(
580  DILocation::get(Context, 0, 0, F->getSubprogram()));
581  if (Trip.isOSOpenBSD()) {
582  FunctionCallee StackChkFail = M->getOrInsertFunction(
583  "__stack_smash_handler", Type::getVoidTy(Context),
585 
586  B.CreateCall(StackChkFail, B.CreateGlobalStringPtr(F->getName(), "SSH"));
587  } else {
588  FunctionCallee StackChkFail =
589  M->getOrInsertFunction("__stack_chk_fail", Type::getVoidTy(Context));
590 
591  B.CreateCall(StackChkFail, {});
592  }
593  B.CreateUnreachable();
594  return FailBB;
595 }
596 
598  return HasPrologue && !HasIRCheck && isa<ReturnInst>(BB.getTerminator());
599 }
600 
602  if (Layout.empty())
603  return;
604 
605  for (int I = 0, E = MFI.getObjectIndexEnd(); I != E; ++I) {
606  if (MFI.isDeadObjectIndex(I))
607  continue;
608 
609  const AllocaInst *AI = MFI.getObjectAllocation(I);
610  if (!AI)
611  continue;
612 
613  SSPLayoutMap::const_iterator LI = Layout.find(AI);
614  if (LI == Layout.end())
615  continue;
616 
617  MFI.setObjectSSPLayout(I, LI->second);
618  }
619 }
llvm::Instruction::getPrevNonDebugInstruction
const Instruction * getPrevNonDebugInstruction(bool SkipPseudoOp=false) const
Return a pointer to the previous non-debug instruction in the same basic block as 'this',...
Definition: Instruction.cpp:746
StackProtector.h
llvm
This is an optimization pass for GlobalISel generic memory operations.
Definition: AllocatorList.h:23
llvm::TargetLoweringBase
This base class for TargetLowering contains the SelectionDAG-independent parts that can be used from ...
Definition: TargetLowering.h:191
M
We currently emits eax Perhaps this is what we really should generate is Is imull three or four cycles eax eax The current instruction priority is based on pattern complexity The former is more complex because it folds a load so the latter will not be emitted Perhaps we should use AddedComplexity to give LEA32r a higher priority We should always try to match LEA first since the LEA matching code does some estimate to determine whether the match is profitable if we care more about code then imull is better It s two bytes shorter than movl leal On a Pentium M
Definition: README.txt:252
llvm::ReturnInst
Return a value (possibly void), from a function.
Definition: Instructions.h:3010
llvm::DataLayout
A parsed version of the target data layout string in and methods for querying it.
Definition: DataLayout.h:113
llvm::LinearPolySize< TypeSize >::isKnownGT
static bool isKnownGT(const LinearPolySize &LHS, const LinearPolySize &RHS)
Definition: TypeSize.h:334
llvm::Intrinsic::getDeclaration
Function * getDeclaration(Module *M, ID id, ArrayRef< Type * > Tys=None)
Create or insert an LLVM Function declaration for an intrinsic, and return it.
Definition: Function.cpp:1399
llvm::Type::getInt8PtrTy
static PointerType * getInt8PtrTy(LLVMContext &C, unsigned AS=0)
Definition: Type.cpp:293
IntrinsicInst.h
llvm::Function
Definition: Function.h:62
llvm::Attribute
Definition: Attributes.h:53
Pass.h
llvm::StackProtector::copyToMachineFrameInfo
void copyToMachineFrameInfo(MachineFrameInfo &MFI) const
Definition: StackProtector.cpp:601
llvm::StackProtector::runOnFunction
bool runOnFunction(Function &Fn) override
runOnFunction - Virtual method overriden by subclasses to do the per-function processing of the pass.
Definition: StackProtector.cpp:84
Statistic.h
llvm::IRBuilder<>
OptimizationRemarkEmitter.h
llvm::cl::Hidden
@ Hidden
Definition: CommandLine.h:143
INITIALIZE_PASS_BEGIN
INITIALIZE_PASS_BEGIN(StackProtector, DEBUG_TYPE, "Insert stack protectors", false, true) INITIALIZE_PASS_END(StackProtector
true
basic Basic Alias true
Definition: BasicAliasAnalysis.cpp:1886
llvm::DenseMapIterator
Definition: DenseMap.h:56
llvm::MemoryLocation::Size
LocationSize Size
The maximum size of the location, in address-units, or UnknownSize if the size is not known.
Definition: MemoryLocation.h:226
EnableSelectionDAGSP
static cl::opt< bool > EnableSelectionDAGSP("enable-selectiondag-sp", cl::init(true), cl::Hidden)
llvm::Type
The instances of the Type class are immutable: once they are created, they are never changed.
Definition: Type.h:45
Module.h
EHPersonalities.h
llvm::MachineFrameInfo::SSPLK_LargeArray
@ SSPLK_LargeArray
Array or nested array >= SSP-buffer-size.
Definition: MachineFrameInfo.h:114
llvm::Optional
Definition: APInt.h:33
Offset
uint64_t Offset
Definition: ELFObjHandler.cpp:80
llvm::Module::getOrInsertFunction
FunctionCallee getOrInsertFunction(StringRef Name, FunctionType *T, AttributeList AttributeList)
Look up the specified function in the module symbol table.
Definition: Module.cpp:147
llvm::ore::NV
DiagnosticInfoOptimizationBase::Argument NV
Definition: OptimizationRemarkEmitter.h:136
isMustTailCall
static bool isMustTailCall(Value *V)
Definition: InstructionCombining.cpp:2936
llvm::MipsISD::Ret
@ Ret
Definition: MipsISelLowering.h:116
llvm::ArrayType
Class to represent array types.
Definition: DerivedTypes.h:357
llvm::MachineFrameInfo::getObjectIndexEnd
int getObjectIndexEnd() const
Return one past the maximum frame object index.
Definition: MachineFrameInfo.h:393
llvm::StackProtector::ID
static char ID
Definition: StackProtector.h:105
llvm::MDNode::get
static MDTuple * get(LLVMContext &Context, ArrayRef< Metadata * > MDs)
Definition: Metadata.h:1233
F
#define F(x, y, z)
Definition: MD5.cpp:55
Context
ManagedStatic< detail::RecordContext > Context
Definition: Record.cpp:96
llvm::BasicBlock
LLVM Basic Block Representation.
Definition: BasicBlock.h:58
llvm::Optional::hasValue
constexpr bool hasValue() const
Definition: Optional.h:288
llvm::classifyEHPersonality
EHPersonality classifyEHPersonality(const Value *Pers)
See if the given exception handling personality function is one that we understand.
Definition: EHPersonalities.cpp:21
Instruction.h
CommandLine.h
TargetLowering.h
TargetMachine.h
llvm::PassRegistry::getPassRegistry
static PassRegistry * getPassRegistry()
getPassRegistry - Access the global registry object, which is automatically initialized at applicatio...
Definition: PassRegistry.cpp:31
Constants.h
E
static GCRegistry::Add< CoreCLRGC > E("coreclr", "CoreCLR-compatible GC")
llvm::Triple::isOSDarwin
bool isOSDarwin() const
Is this a "Darwin" OS (macOS, iOS, tvOS or watchOS).
Definition: Triple.h:468
llvm::User
Definition: User.h:44
llvm::MachineFrameInfo::setObjectSSPLayout
void setObjectSSPLayout(int ObjectIdx, SSPLayoutKind Kind)
Definition: MachineFrameInfo.h:542
Intrinsics.h
llvm::StackProtector
Definition: StackProtector.h:37
llvm::MDBuilder::createBranchWeights
MDNode * createBranchWeights(uint32_t TrueWeight, uint32_t FalseWeight)
Return metadata containing two branch weights.
Definition: MDBuilder.cpp:37
llvm::AnalysisUsage
Represent the analysis usage information of a pass.
Definition: PassAnalysisSupport.h:47
llvm::LocationSize::getValue
uint64_t getValue() const
Definition: MemoryLocation.h:158
false
Definition: StackSlotColoring.cpp:142
llvm::TypeSize::Fixed
static TypeSize Fixed(ScalarTy MinVal)
Definition: TypeSize.h:422
B
static GCRegistry::Add< OcamlGC > B("ocaml", "ocaml 3.10-compatible GC")
llvm::Function::getFnAttribute
Attribute getFnAttribute(Attribute::AttrKind Kind) const
Return the attribute for the given attribute kind.
Definition: Function.cpp:652
llvm::Instruction
Definition: Instruction.h:45
llvm::DominatorTreeWrapperPass
Legacy analysis pass which computes a DominatorTree.
Definition: Dominators.h:287
MDBuilder.h
llvm::STATISTIC
STATISTIC(NumFunctions, "Total number of functions")
llvm::Function::hasPersonalityFn
bool hasPersonalityFn() const
Check whether this function has a personality function.
Definition: Function.h:775
DebugLoc.h
SmallPtrSet.h
llvm::Attribute::isStringAttribute
bool isStringAttribute() const
Return true if the attribute is a string (target-dependent) attribute.
Definition: Attributes.cpp:268
llvm::TargetLoweringBase::insertSSPDeclarations
virtual void insertSSPDeclarations(Module &M) const
Inserts necessary declarations for SSP (stack protection) purpose.
Definition: TargetLoweringBase.cpp:1990
llvm::MCID::Call
@ Call
Definition: MCInstrDesc.h:153
llvm::Attribute::getValueAsString
StringRef getValueAsString() const
Return the attribute's value as a string.
Definition: Attributes.cpp:304
llvm::StringRef::getAsInteger
std::enable_if_t< std::numeric_limits< T >::is_signed, bool > getAsInteger(unsigned Radix, T &Result) const
Parse the current string as an integer of the specified radix.
Definition: StringRef.h:509
llvm::LinearPolySize< TypeSize >::getFixed
static TypeSize getFixed(ScalarTy MinVal)
Definition: TypeSize.h:283
llvm::BranchProbabilityInfo::getBranchProbStackProtector
static BranchProbability getBranchProbStackProtector(bool IsLikely)
Definition: BranchProbabilityInfo.h:194
Type.h
llvm::MachineFrameInfo::isDeadObjectIndex
bool isDeadObjectIndex(int ObjectIdx) const
Returns true if the specified index corresponds to a dead object.
Definition: MachineFrameInfo.h:713
INITIALIZE_PASS_END
#define INITIALIZE_PASS_END(passName, arg, name, cfg, analysis)
Definition: PassSupport.h:58
Passes.h
llvm::TargetPassConfig
Target-Independent Code Generator Pass Configuration Options.
Definition: TargetPassConfig.h:84
llvm::Function::hasFnAttribute
bool hasFnAttribute(Attribute::AttrKind Kind) const
Return true if the function has the attribute.
Definition: Function.cpp:626
BasicBlock.h
llvm::cl::opt< bool >
llvm::TargetLoweringBase::getIRStackGuard
virtual Value * getIRStackGuard(IRBuilderBase &IRB) const
If the target has a standard location for the stack protector guard, returns the address of that loca...
Definition: TargetLoweringBase.cpp:1976
BranchProbabilityInfo.h
llvm::MemoryLocation::getOrNone
static Optional< MemoryLocation > getOrNone(const Instruction *Inst)
Definition: MemoryLocation.cpp:78
llvm::StringRef::empty
constexpr LLVM_NODISCARD bool empty() const
empty - Check if the string is empty.
Definition: StringRef.h:152
llvm::StackProtector::StackProtector
StackProtector()
Definition: StackProtector.cpp:66
llvm::LocationSize::hasValue
bool hasValue() const
Definition: MemoryLocation.h:155
llvm::GlobalValue::getParent
Module * getParent()
Get the module that this global value is contained inside of...
Definition: GlobalValue.h:578
llvm::ARM_MB::ST
@ ST
Definition: ARMBaseInfo.h:73
llvm::StackProtector::getAnalysisUsage
void getAnalysisUsage(AnalysisUsage &AU) const override
getAnalysisUsage - This function should be overriden by passes that need analysis information to do t...
Definition: StackProtector.cpp:79
INITIALIZE_PASS_DEPENDENCY
INITIALIZE_PASS_DEPENDENCY(DominatorTreeWrapperPass)
llvm::LLVMContext
This is an important class for using LLVM in a threaded context.
Definition: LLVMContext.h:67
MemoryLocation.h
DebugInfo.h
llvm::Triple::isOSOpenBSD
bool isOSOpenBSD() const
Definition: Triple.h:490
I
#define I(x, y, z)
Definition: MD5.cpp:58
llvm::GetElementPtrInst
an instruction for type-safe pointer arithmetic to access elements of arrays and structs
Definition: Instructions.h:933
llvm::cl::init
initializer< Ty > init(const Ty &Val)
Definition: CommandLine.h:441
llvm::make_early_inc_range
iterator_range< early_inc_iterator_impl< detail::IterOfRange< RangeT > > > make_early_inc_range(RangeT &&Range)
Make a range that does early increment to allow mutation of the underlying range without disrupting i...
Definition: STLExtras.h:642
llvm::PointerType
Class to represent pointers.
Definition: DerivedTypes.h:632
TargetPassConfig.h
llvm::DenseMapBase::find
iterator find(const_arg_type_t< KeyT > Val)
Definition: DenseMap.h:150
llvm::TargetMachine::Options
TargetOptions Options
Definition: TargetMachine.h:121
IRBuilder.h
assert
assert(ImpDefSCC.getReg()==AMDGPU::SCC &&ImpDefSCC.isDef())
llvm::TargetMachine
Primary interface to the complete machine description for the target machine.
Definition: TargetMachine.h:80
llvm::DominatorTree::isReachableFromEntry
bool isReachableFromEntry(const Use &U) const
Provide an overload for a Use.
Definition: Dominators.cpp:328
llvm::LinearPolySize< TypeSize >::isKnownGE
static bool isKnownGE(const LinearPolySize &LHS, const LinearPolySize &RHS)
Definition: TypeSize.h:346
llvm::Module
A Module instance is used to store all the information related to an LLVM module.
Definition: Module.h:65
llvm::MDNode
Metadata node.
Definition: Metadata.h:906
llvm::LinearPolySize::getKnownMinValue
ScalarTy getKnownMinValue() const
Returns the minimum value this size can represent.
Definition: TypeSize.h:296
llvm::TargetOptions::EnableFastISel
unsigned EnableFastISel
EnableFastISel - This flag enables fast-path instruction selection which trades away generated code q...
Definition: TargetOptions.h:230
llvm::TargetLoweringBase::useStackGuardXorFP
virtual bool useStackGuardXorFP() const
If this function returns true, stack protection checks should XOR the frame pointer (or whichever poi...
Definition: TargetLowering.h:1832
llvm::APInt
Class for arbitrary precision integers.
Definition: APInt.h:75
TargetOptions.h
llvm::StackProtector::shouldEmitSDCheck
bool shouldEmitSDCheck(const BasicBlock &BB) const
Definition: StackProtector.cpp:597
llvm::OptimizationRemarkEmitter
The optimization diagnostic interface.
Definition: OptimizationRemarkEmitter.h:33
llvm::BasicBlock::moveAfter
void moveAfter(BasicBlock *MovePos)
Unlink this basic block from its current function and insert it right after MovePos in the function M...
Definition: BasicBlock.cpp:142
DataLayout.h
llvm::StructType
Class to represent struct types.
Definition: DerivedTypes.h:213
llvm::StringRef
StringRef - Represent a constant reference to a string, i.e.
Definition: StringRef.h:57
llvm::AnalysisUsage::addPreserved
AnalysisUsage & addPreserved()
Add the specified Pass class to the set of analyses preserved by this pass.
Definition: PassAnalysisSupport.h:98
llvm::BasicBlock::Create
static BasicBlock * Create(LLVMContext &Context, const Twine &Name="", Function *Parent=nullptr, BasicBlock *InsertBefore=nullptr)
Creates a new BasicBlock.
Definition: BasicBlock.h:100
llvm::Value::getContext
LLVMContext & getContext() const
All values hold a context through their type.
Definition: Value.cpp:991
llvm::ilist_node_impl::getIterator
self_iterator getIterator()
Definition: ilist_node.h:81
TargetSubtargetInfo.h
DL
MachineBasicBlock MachineBasicBlock::iterator DebugLoc DL
Definition: AArch64SLSHardening.cpp:76
CreatePrologue
static bool CreatePrologue(Function *F, Module *M, ReturnInst *RI, const TargetLoweringBase *TLI, AllocaInst *&AI)
Insert code into the entry block that stores the stack guard variable onto the stack:
Definition: StackProtector.cpp:419
llvm::LoadInst
An instruction for reading from memory.
Definition: Instructions.h:180
llvm::DenseMapBase::insert
std::pair< iterator, bool > insert(const std::pair< KeyT, ValueT > &KV)
Definition: DenseMap.h:207
llvm::EHPersonality
EHPersonality
Definition: EHPersonalities.h:22
llvm::DominatorTreeBase::addNewBlock
DomTreeNodeBase< NodeT > * addNewBlock(NodeT *BB, NodeT *DomBB)
Add a new node to the dominator tree information.
Definition: GenericDomTree.h:619
llvm::DenseMapBase::empty
LLVM_NODISCARD bool empty() const
Definition: DenseMap.h:97
llvm::MCID::Select
@ Select
Definition: MCInstrDesc.h:162
Attributes.h
llvm::TargetLoweringBase::getSSPStackGuardCheck
virtual Function * getSSPStackGuardCheck(const Module &M) const
If the target has a standard stack protection check function that performs validation and error handl...
Definition: TargetLoweringBase.cpp:2010
llvm::DenseMapBase::end
iterator end()
Definition: DenseMap.h:83
llvm::X86::FirstMacroFusionInstKind::Cmp
@ Cmp
llvm::TypeSize
Definition: TypeSize.h:416
Casting.h
Function.h
llvm::DominatorTreeWrapperPass::getDomTree
DominatorTree & getDomTree()
Definition: Dominators.h:295
llvm::Function::getPersonalityFn
Constant * getPersonalityFn() const
Get the personality function associated with this function.
Definition: Function.cpp:1844
llvm::SPII::Load
@ Load
Definition: SparcInstrInfo.h:32
protectors
Insert stack protectors
Definition: StackProtector.cpp:75
llvm::MDBuilder
Definition: MDBuilder.h:35
llvm::Type::getVoidTy
static Type * getVoidTy(LLVMContext &C)
Definition: Type.cpp:224
llvm::MachineFrameInfo
The MachineFrameInfo class represents an abstract stack frame until prolog/epilog code is inserted.
Definition: MachineFrameInfo.h:107
llvm::OptimizationRemark
Diagnostic information for applied optimization remarks.
Definition: DiagnosticInfo.h:685
llvm::SPII::Store
@ Store
Definition: SparcInstrInfo.h:33
Instructions.h
llvm::TargetSubtargetInfo::getTargetLowering
virtual const TargetLowering * getTargetLowering() const
Definition: TargetSubtargetInfo.h:96
llvm::TargetMachine::getSubtargetImpl
virtual const TargetSubtargetInfo * getSubtargetImpl(const Function &) const
Virtual method implemented by subclasses that returns a reference to that target's TargetSubtargetInf...
Definition: TargetMachine.h:136
User.h
llvm::MachineFrameInfo::SSPLK_AddrOf
@ SSPLK_AddrOf
The address of this allocation is exposed and triggered protection.
Definition: MachineFrameInfo.h:118
Dominators.h
llvm::CallBase::getArgOperand
Value * getArgOperand(unsigned i) const
Definition: InstrTypes.h:1343
llvm::TargetMachine::getTargetTriple
const Triple & getTargetTriple() const
Definition: TargetMachine.h:129
llvm::MachineFrameInfo::SSPLK_SmallArray
@ SSPLK_SmallArray
Array or nested array < SSP-buffer-size.
Definition: MachineFrameInfo.h:116
stack
S is passed via registers r2 But gcc stores them to the stack
Definition: README.txt:189
DEBUG_TYPE
#define DEBUG_TYPE
Definition: StackProtector.cpp:55
llvm::FunctionCallee
A handy container for a FunctionType+Callee-pointer pair, which can be passed around as a single enti...
Definition: DerivedTypes.h:165
llvm::Module::getDataLayout
const DataLayout & getDataLayout() const
Get the data layout for the module's target platform.
Definition: Module.cpp:401
DerivedTypes.h
llvm::FunctionPass
FunctionPass class - This class is used to implement most global optimizations.
Definition: Pass.h:298
getStackGuard
static Value * getStackGuard(const TargetLoweringBase *TLI, Module *M, IRBuilder<> &B, bool *SupportsSelectionDAGSP=nullptr)
Create a stack guard loading and populate whether SelectionDAG SSP is supported.
Definition: StackProtector.cpp:384
llvm::CallInst
This class represents a function call, abstracting a target machine's calling convention.
Definition: Instructions.h:1478
BB
Common register allocation spilling lr str ldr sxth r3 ldr mla r4 can lr mov lr str ldr sxth r3 mla r4 and then merge mul and lr str ldr sxth r3 mla r4 It also increase the likelihood the store may become dead bb27 Successors according to LLVM BB
Definition: README.txt:39
GEP
Hexagon Common GEP
Definition: HexagonCommonGEP.cpp:172
llvm::AnalysisUsage::addRequired
AnalysisUsage & addRequired()
Definition: PassAnalysisSupport.h:75
llvm::initializeStackProtectorPass
void initializeStackProtectorPass(PassRegistry &)
llvm::AllocaInst
an instruction to allocate memory on the stack
Definition: Instructions.h:62
findStackProtectorIntrinsic
static const CallInst * findStackProtectorIntrinsic(Function &F)
Search for the first call to the llvm.stackprotector intrinsic and return it if present.
Definition: StackProtector.cpp:258
InitializePasses.h
llvm::Value
LLVM Value Representation.
Definition: Value.h:74
llvm::Value::users
iterator_range< user_iterator > users()
Definition: Value.h:421
llvm::isFuncletEHPersonality
bool isFuncletEHPersonality(EHPersonality Pers)
Returns true if this is a personality function that invokes handler funclets (which must return to it...
Definition: EHPersonalities.h:65
llvm::createStackProtectorPass
FunctionPass * createStackProtectorPass()
createStackProtectorPass - This pass adds stack protectors to functions.
Definition: StackProtector.cpp:77
llvm::Intrinsic::ID
unsigned ID
Definition: TargetTransformInfo.h:38
llvm::MachineFrameInfo::getObjectAllocation
const AllocaInst * getObjectAllocation(int ObjectIdx) const
Return the underlying Alloca of the specified stack object if it exists.
Definition: MachineFrameInfo.h:486
llvm::DataLayout::getTypeAllocSize
TypeSize getTypeAllocSize(Type *Ty) const
Returns the offset in bytes between successive objects of the specified type, including alignment pad...
Definition: DataLayout.h:506