LLVM  15.0.0git
StackProtector.cpp
Go to the documentation of this file.
1 //===- StackProtector.cpp - Stack Protector Insertion ---------------------===//
2 //
3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4 // See https://llvm.org/LICENSE.txt for license information.
5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6 //
7 //===----------------------------------------------------------------------===//
8 //
9 // This pass inserts stack protectors into functions which need them. A variable
10 // with a random value in it is stored onto the stack before the local variables
11 // are allocated. Upon exiting the block, the stored value is checked. If it's
12 // changed, then there was some sort of violation and the program aborts.
13 //
14 //===----------------------------------------------------------------------===//
15 
17 #include "llvm/ADT/SmallPtrSet.h"
18 #include "llvm/ADT/Statistic.h"
23 #include "llvm/CodeGen/Passes.h"
27 #include "llvm/IR/Attributes.h"
28 #include "llvm/IR/BasicBlock.h"
29 #include "llvm/IR/Constants.h"
30 #include "llvm/IR/DataLayout.h"
31 #include "llvm/IR/DerivedTypes.h"
32 #include "llvm/IR/Dominators.h"
33 #include "llvm/IR/Function.h"
34 #include "llvm/IR/IRBuilder.h"
35 #include "llvm/IR/Instruction.h"
36 #include "llvm/IR/Instructions.h"
37 #include "llvm/IR/IntrinsicInst.h"
38 #include "llvm/IR/Intrinsics.h"
39 #include "llvm/IR/MDBuilder.h"
40 #include "llvm/IR/Module.h"
41 #include "llvm/IR/Type.h"
42 #include "llvm/IR/User.h"
43 #include "llvm/InitializePasses.h"
44 #include "llvm/Pass.h"
45 #include "llvm/Support/Casting.h"
49 #include <utility>
50 
51 using namespace llvm;
52 
53 #define DEBUG_TYPE "stack-protector"
54 
55 STATISTIC(NumFunProtected, "Number of functions protected");
56 STATISTIC(NumAddrTaken, "Number of local variables that have their address"
57  " taken.");
58 
59 static cl::opt<bool> EnableSelectionDAGSP("enable-selectiondag-sp",
60  cl::init(true), cl::Hidden);
61 
62 char StackProtector::ID = 0;
63 
66 }
67 
69  "Insert stack protectors", false, true)
73  "Insert stack protectors", false, true)
74 
76 
80 }
81 
83  F = &Fn;
84  M = F->getParent();
86  getAnalysisIfAvailable<DominatorTreeWrapperPass>();
87  DT = DTWP ? &DTWP->getDomTree() : nullptr;
88  TM = &getAnalysis<TargetPassConfig>().getTM<TargetMachine>();
89  Trip = TM->getTargetTriple();
90  TLI = TM->getSubtargetImpl(Fn)->getTargetLowering();
91  HasPrologue = false;
92  HasIRCheck = false;
93 
94  Attribute Attr = Fn.getFnAttribute("stack-protector-buffer-size");
95  if (Attr.isStringAttribute() &&
96  Attr.getValueAsString().getAsInteger(10, SSPBufferSize))
97  return false; // Invalid integer string
98 
99  if (!RequiresStackProtector())
100  return false;
101 
102  // TODO(etienneb): Functions with funclets are not correctly supported now.
103  // Do nothing if this is funclet-based personality.
104  if (Fn.hasPersonalityFn()) {
106  if (isFuncletEHPersonality(Personality))
107  return false;
108  }
109 
110  ++NumFunProtected;
111  return InsertStackProtectors();
112 }
113 
114 /// \param [out] IsLarge is set to true if a protectable array is found and
115 /// it is "large" ( >= ssp-buffer-size). In the case of a structure with
116 /// multiple arrays, this gets set if any of them is large.
117 bool StackProtector::ContainsProtectableArray(Type *Ty, bool &IsLarge,
118  bool Strong,
119  bool InStruct) const {
120  if (!Ty)
121  return false;
122  if (ArrayType *AT = dyn_cast<ArrayType>(Ty)) {
123  if (!AT->getElementType()->isIntegerTy(8)) {
124  // If we're on a non-Darwin platform or we're inside of a structure, don't
125  // add stack protectors unless the array is a character array.
126  // However, in strong mode any array, regardless of type and size,
127  // triggers a protector.
128  if (!Strong && (InStruct || !Trip.isOSDarwin()))
129  return false;
130  }
131 
132  // If an array has more than SSPBufferSize bytes of allocated space, then we
133  // emit stack protectors.
134  if (SSPBufferSize <= M->getDataLayout().getTypeAllocSize(AT)) {
135  IsLarge = true;
136  return true;
137  }
138 
139  if (Strong)
140  // Require a protector for all arrays in strong mode
141  return true;
142  }
143 
144  const StructType *ST = dyn_cast<StructType>(Ty);
145  if (!ST)
146  return false;
147 
148  bool NeedsProtector = false;
149  for (Type *ET : ST->elements())
150  if (ContainsProtectableArray(ET, IsLarge, Strong, true)) {
151  // If the element is a protectable array and is large (>= SSPBufferSize)
152  // then we are done. If the protectable array is not large, then
153  // keep looking in case a subsequent element is a large array.
154  if (IsLarge)
155  return true;
156  NeedsProtector = true;
157  }
158 
159  return NeedsProtector;
160 }
161 
162 bool StackProtector::HasAddressTaken(const Instruction *AI,
163  TypeSize AllocSize) {
164  const DataLayout &DL = M->getDataLayout();
165  for (const User *U : AI->users()) {
166  const auto *I = cast<Instruction>(U);
167  // If this instruction accesses memory make sure it doesn't access beyond
168  // the bounds of the allocated object.
170  if (MemLoc && MemLoc->Size.hasValue() &&
171  !TypeSize::isKnownGE(AllocSize,
172  TypeSize::getFixed(MemLoc->Size.getValue())))
173  return true;
174  switch (I->getOpcode()) {
175  case Instruction::Store:
176  if (AI == cast<StoreInst>(I)->getValueOperand())
177  return true;
178  break;
179  case Instruction::AtomicCmpXchg:
180  // cmpxchg conceptually includes both a load and store from the same
181  // location. So, like store, the value being stored is what matters.
182  if (AI == cast<AtomicCmpXchgInst>(I)->getNewValOperand())
183  return true;
184  break;
185  case Instruction::PtrToInt:
186  if (AI == cast<PtrToIntInst>(I)->getOperand(0))
187  return true;
188  break;
189  case Instruction::Call: {
190  // Ignore intrinsics that do not become real instructions.
191  // TODO: Narrow this to intrinsics that have store-like effects.
192  const auto *CI = cast<CallInst>(I);
193  if (!CI->isDebugOrPseudoInst() && !CI->isLifetimeStartOrEnd())
194  return true;
195  break;
196  }
197  case Instruction::Invoke:
198  return true;
199  case Instruction::GetElementPtr: {
200  // If the GEP offset is out-of-bounds, or is non-constant and so has to be
201  // assumed to be potentially out-of-bounds, then any memory access that
202  // would use it could also be out-of-bounds meaning stack protection is
203  // required.
204  const GetElementPtrInst *GEP = cast<GetElementPtrInst>(I);
205  unsigned IndexSize = DL.getIndexTypeSizeInBits(I->getType());
206  APInt Offset(IndexSize, 0);
207  if (!GEP->accumulateConstantOffset(DL, Offset))
208  return true;
209  TypeSize OffsetSize = TypeSize::Fixed(Offset.getLimitedValue());
210  if (!TypeSize::isKnownGT(AllocSize, OffsetSize))
211  return true;
212  // Adjust AllocSize to be the space remaining after this offset.
213  // We can't subtract a fixed size from a scalable one, so in that case
214  // assume the scalable value is of minimum size.
215  TypeSize NewAllocSize =
216  TypeSize::Fixed(AllocSize.getKnownMinValue()) - OffsetSize;
217  if (HasAddressTaken(I, NewAllocSize))
218  return true;
219  break;
220  }
221  case Instruction::BitCast:
222  case Instruction::Select:
223  case Instruction::AddrSpaceCast:
224  if (HasAddressTaken(I, AllocSize))
225  return true;
226  break;
227  case Instruction::PHI: {
228  // Keep track of what PHI nodes we have already visited to ensure
229  // they are only visited once.
230  const auto *PN = cast<PHINode>(I);
231  if (VisitedPHIs.insert(PN).second)
232  if (HasAddressTaken(PN, AllocSize))
233  return true;
234  break;
235  }
236  case Instruction::Load:
237  case Instruction::AtomicRMW:
238  case Instruction::Ret:
239  // These instructions take an address operand, but have load-like or
240  // other innocuous behavior that should not trigger a stack protector.
241  // atomicrmw conceptually has both load and store semantics, but the
242  // value being stored must be integer; so if a pointer is being stored,
243  // we'll catch it in the PtrToInt case above.
244  break;
245  default:
246  // Conservatively return true for any instruction that takes an address
247  // operand, but is not handled above.
248  return true;
249  }
250  }
251  return false;
252 }
253 
254 /// Search for the first call to the llvm.stackprotector intrinsic and return it
255 /// if present.
257  for (const BasicBlock &BB : F)
258  for (const Instruction &I : BB)
259  if (const auto *II = dyn_cast<IntrinsicInst>(&I))
260  if (II->getIntrinsicID() == Intrinsic::stackprotector)
261  return II;
262  return nullptr;
263 }
264 
265 /// Check whether or not this function needs a stack protector based
266 /// upon the stack protector level.
267 ///
268 /// We use two heuristics: a standard (ssp) and strong (sspstrong).
269 /// The standard heuristic which will add a guard variable to functions that
270 /// call alloca with a either a variable size or a size >= SSPBufferSize,
271 /// functions with character buffers larger than SSPBufferSize, and functions
272 /// with aggregates containing character buffers larger than SSPBufferSize. The
273 /// strong heuristic will add a guard variables to functions that call alloca
274 /// regardless of size, functions with any buffer regardless of type and size,
275 /// functions with aggregates that contain any buffer regardless of type and
276 /// size, and functions that contain stack-based variables that have had their
277 /// address taken.
278 bool StackProtector::RequiresStackProtector() {
279  bool Strong = false;
280  bool NeedsProtector = false;
281 
282  if (F->hasFnAttribute(Attribute::SafeStack))
283  return false;
284 
285  // We are constructing the OptimizationRemarkEmitter on the fly rather than
286  // using the analysis pass to avoid building DominatorTree and LoopInfo which
287  // are not available this late in the IR pipeline.
289 
290  if (F->hasFnAttribute(Attribute::StackProtectReq)) {
291  ORE.emit([&]() {
292  return OptimizationRemark(DEBUG_TYPE, "StackProtectorRequested", F)
293  << "Stack protection applied to function "
294  << ore::NV("Function", F)
295  << " due to a function attribute or command-line switch";
296  });
297  NeedsProtector = true;
298  Strong = true; // Use the same heuristic as strong to determine SSPLayout
299  } else if (F->hasFnAttribute(Attribute::StackProtectStrong))
300  Strong = true;
301  else if (!F->hasFnAttribute(Attribute::StackProtect))
302  return false;
303 
304  for (const BasicBlock &BB : *F) {
305  for (const Instruction &I : BB) {
306  if (const AllocaInst *AI = dyn_cast<AllocaInst>(&I)) {
307  if (AI->isArrayAllocation()) {
308  auto RemarkBuilder = [&]() {
309  return OptimizationRemark(DEBUG_TYPE, "StackProtectorAllocaOrArray",
310  &I)
311  << "Stack protection applied to function "
312  << ore::NV("Function", F)
313  << " due to a call to alloca or use of a variable length "
314  "array";
315  };
316  if (const auto *CI = dyn_cast<ConstantInt>(AI->getArraySize())) {
317  if (CI->getLimitedValue(SSPBufferSize) >= SSPBufferSize) {
318  // A call to alloca with size >= SSPBufferSize requires
319  // stack protectors.
320  Layout.insert(std::make_pair(AI,
322  ORE.emit(RemarkBuilder);
323  NeedsProtector = true;
324  } else if (Strong) {
325  // Require protectors for all alloca calls in strong mode.
326  Layout.insert(std::make_pair(AI,
328  ORE.emit(RemarkBuilder);
329  NeedsProtector = true;
330  }
331  } else {
332  // A call to alloca with a variable size requires protectors.
333  Layout.insert(std::make_pair(AI,
335  ORE.emit(RemarkBuilder);
336  NeedsProtector = true;
337  }
338  continue;
339  }
340 
341  bool IsLarge = false;
342  if (ContainsProtectableArray(AI->getAllocatedType(), IsLarge, Strong)) {
343  Layout.insert(std::make_pair(AI, IsLarge
346  ORE.emit([&]() {
347  return OptimizationRemark(DEBUG_TYPE, "StackProtectorBuffer", &I)
348  << "Stack protection applied to function "
349  << ore::NV("Function", F)
350  << " due to a stack allocated buffer or struct containing a "
351  "buffer";
352  });
353  NeedsProtector = true;
354  continue;
355  }
356 
357  if (Strong && HasAddressTaken(AI, M->getDataLayout().getTypeAllocSize(
358  AI->getAllocatedType()))) {
359  ++NumAddrTaken;
360  Layout.insert(std::make_pair(AI, MachineFrameInfo::SSPLK_AddrOf));
361  ORE.emit([&]() {
362  return OptimizationRemark(DEBUG_TYPE, "StackProtectorAddressTaken",
363  &I)
364  << "Stack protection applied to function "
365  << ore::NV("Function", F)
366  << " due to the address of a local variable being taken";
367  });
368  NeedsProtector = true;
369  }
370  // Clear any PHIs that we visited, to make sure we examine all uses of
371  // any subsequent allocas that we look at.
372  VisitedPHIs.clear();
373  }
374  }
375  }
376 
377  return NeedsProtector;
378 }
379 
380 /// Create a stack guard loading and populate whether SelectionDAG SSP is
381 /// supported.
383  IRBuilder<> &B,
384  bool *SupportsSelectionDAGSP = nullptr) {
385  Value *Guard = TLI->getIRStackGuard(B);
386  StringRef GuardMode = M->getStackProtectorGuard();
387  if ((GuardMode == "tls" || GuardMode.empty()) && Guard)
388  return B.CreateLoad(B.getInt8PtrTy(), Guard, true, "StackGuard");
389 
390  // Use SelectionDAG SSP handling, since there isn't an IR guard.
391  //
392  // This is more or less weird, since we optionally output whether we
393  // should perform a SelectionDAG SP here. The reason is that it's strictly
394  // defined as !TLI->getIRStackGuard(B), where getIRStackGuard is also
395  // mutating. There is no way to get this bit without mutating the IR, so
396  // getting this bit has to happen in this right time.
397  //
398  // We could have define a new function TLI::supportsSelectionDAGSP(), but that
399  // will put more burden on the backends' overriding work, especially when it
400  // actually conveys the same information getIRStackGuard() already gives.
401  if (SupportsSelectionDAGSP)
402  *SupportsSelectionDAGSP = true;
403  TLI->insertSSPDeclarations(*M);
404  return B.CreateCall(Intrinsic::getDeclaration(M, Intrinsic::stackguard));
405 }
406 
407 /// Insert code into the entry block that stores the stack guard
408 /// variable onto the stack:
409 ///
410 /// entry:
411 /// StackGuardSlot = alloca i8*
412 /// StackGuard = <stack guard>
413 /// call void @llvm.stackprotector(StackGuard, StackGuardSlot)
414 ///
415 /// Returns true if the platform/triple supports the stackprotectorcreate pseudo
416 /// node.
417 static bool CreatePrologue(Function *F, Module *M, ReturnInst *RI,
418  const TargetLoweringBase *TLI, AllocaInst *&AI) {
419  bool SupportsSelectionDAGSP = false;
420  IRBuilder<> B(&F->getEntryBlock().front());
421  PointerType *PtrTy = Type::getInt8PtrTy(RI->getContext());
422  AI = B.CreateAlloca(PtrTy, nullptr, "StackGuardSlot");
423 
424  Value *GuardSlot = getStackGuard(TLI, M, B, &SupportsSelectionDAGSP);
425  B.CreateCall(Intrinsic::getDeclaration(M, Intrinsic::stackprotector),
426  {GuardSlot, AI});
427  return SupportsSelectionDAGSP;
428 }
429 
430 /// InsertStackProtectors - Insert code into the prologue and epilogue of the
431 /// function.
432 ///
433 /// - The prologue code loads and stores the stack guard onto the stack.
434 /// - The epilogue checks the value stored in the prologue against the original
435 /// value. It calls __stack_chk_fail if they differ.
436 bool StackProtector::InsertStackProtectors() {
437  // If the target wants to XOR the frame pointer into the guard value, it's
438  // impossible to emit the check in IR, so the target *must* support stack
439  // protection in SDAG.
440  bool SupportsSelectionDAGSP =
441  TLI->useStackGuardXorFP() ||
443  AllocaInst *AI = nullptr; // Place on stack that stores the stack guard.
444 
446  ReturnInst *RI = dyn_cast<ReturnInst>(BB.getTerminator());
447  if (!RI)
448  continue;
449 
450  // Generate prologue instrumentation if not already generated.
451  if (!HasPrologue) {
452  HasPrologue = true;
453  SupportsSelectionDAGSP &= CreatePrologue(F, M, RI, TLI, AI);
454  }
455 
456  // SelectionDAG based code generation. Nothing else needs to be done here.
457  // The epilogue instrumentation is postponed to SelectionDAG.
458  if (SupportsSelectionDAGSP)
459  break;
460 
461  // Find the stack guard slot if the prologue was not created by this pass
462  // itself via a previous call to CreatePrologue().
463  if (!AI) {
464  const CallInst *SPCall = findStackProtectorIntrinsic(*F);
465  assert(SPCall && "Call to llvm.stackprotector is missing");
466  AI = cast<AllocaInst>(SPCall->getArgOperand(1));
467  }
468 
469  // Set HasIRCheck to true, so that SelectionDAG will not generate its own
470  // version. SelectionDAG called 'shouldEmitSDCheck' to check whether
471  // instrumentation has already been generated.
472  HasIRCheck = true;
473 
474  // If we're instrumenting a block with a musttail call, the check has to be
475  // inserted before the call rather than between it and the return. The
476  // verifier guarantees that a musttail call is either directly before the
477  // return or with a single correct bitcast of the return value in between so
478  // we don't need to worry about many situations here.
479  Instruction *CheckLoc = RI;
481  if (Prev && isa<CallInst>(Prev) && cast<CallInst>(Prev)->isMustTailCall())
482  CheckLoc = Prev;
483  else if (Prev) {
484  Prev = Prev->getPrevNonDebugInstruction();
485  if (Prev && isa<CallInst>(Prev) && cast<CallInst>(Prev)->isMustTailCall())
486  CheckLoc = Prev;
487  }
488 
489  // Generate epilogue instrumentation. The epilogue intrumentation can be
490  // function-based or inlined depending on which mechanism the target is
491  // providing.
492  if (Function *GuardCheck = TLI->getSSPStackGuardCheck(*M)) {
493  // Generate the function-based epilogue instrumentation.
494  // The target provides a guard check function, generate a call to it.
495  IRBuilder<> B(CheckLoc);
496  LoadInst *Guard = B.CreateLoad(B.getInt8PtrTy(), AI, true, "Guard");
497  CallInst *Call = B.CreateCall(GuardCheck, {Guard});
498  Call->setAttributes(GuardCheck->getAttributes());
499  Call->setCallingConv(GuardCheck->getCallingConv());
500  } else {
501  // Generate the epilogue with inline instrumentation.
502  // If we do not support SelectionDAG based calls, generate IR level
503  // calls.
504  //
505  // For each block with a return instruction, convert this:
506  //
507  // return:
508  // ...
509  // ret ...
510  //
511  // into this:
512  //
513  // return:
514  // ...
515  // %1 = <stack guard>
516  // %2 = load StackGuardSlot
517  // %3 = cmp i1 %1, %2
518  // br i1 %3, label %SP_return, label %CallStackCheckFailBlk
519  //
520  // SP_return:
521  // ret ...
522  //
523  // CallStackCheckFailBlk:
524  // call void @__stack_chk_fail()
525  // unreachable
526 
527  // Create the FailBB. We duplicate the BB every time since the MI tail
528  // merge pass will merge together all of the various BB into one including
529  // fail BB generated by the stack protector pseudo instruction.
530  BasicBlock *FailBB = CreateFailBB();
531 
532  // Split the basic block before the return instruction.
533  BasicBlock *NewBB =
534  BB.splitBasicBlock(CheckLoc->getIterator(), "SP_return");
535 
536  // Update the dominator tree if we need to.
537  if (DT && DT->isReachableFromEntry(&BB)) {
538  DT->addNewBlock(NewBB, &BB);
539  DT->addNewBlock(FailBB, &BB);
540  }
541 
542  // Remove default branch instruction to the new BB.
543  BB.getTerminator()->eraseFromParent();
544 
545  // Move the newly created basic block to the point right after the old
546  // basic block so that it's in the "fall through" position.
547  NewBB->moveAfter(&BB);
548 
549  // Generate the stack protector instructions in the old basic block.
550  IRBuilder<> B(&BB);
551  Value *Guard = getStackGuard(TLI, M, B);
552  LoadInst *LI2 = B.CreateLoad(B.getInt8PtrTy(), AI, true);
553  Value *Cmp = B.CreateICmpEQ(Guard, LI2);
554  auto SuccessProb =
556  auto FailureProb =
558  MDNode *Weights = MDBuilder(F->getContext())
559  .createBranchWeights(SuccessProb.getNumerator(),
560  FailureProb.getNumerator());
561  B.CreateCondBr(Cmp, NewBB, FailBB, Weights);
562  }
563  }
564 
565  // Return if we didn't modify any basic blocks. i.e., there are no return
566  // statements in the function.
567  return HasPrologue;
568 }
569 
570 /// CreateFailBB - Create a basic block to jump to when the stack protector
571 /// check fails.
572 BasicBlock *StackProtector::CreateFailBB() {
573  LLVMContext &Context = F->getContext();
574  BasicBlock *FailBB = BasicBlock::Create(Context, "CallStackCheckFailBlk", F);
575  IRBuilder<> B(FailBB);
576  if (F->getSubprogram())
577  B.SetCurrentDebugLocation(
578  DILocation::get(Context, 0, 0, F->getSubprogram()));
579  if (Trip.isOSOpenBSD()) {
580  FunctionCallee StackChkFail = M->getOrInsertFunction(
581  "__stack_smash_handler", Type::getVoidTy(Context),
583 
584  B.CreateCall(StackChkFail, B.CreateGlobalStringPtr(F->getName(), "SSH"));
585  } else {
586  FunctionCallee StackChkFail =
587  M->getOrInsertFunction("__stack_chk_fail", Type::getVoidTy(Context));
588 
589  B.CreateCall(StackChkFail, {});
590  }
591  B.CreateUnreachable();
592  return FailBB;
593 }
594 
596  return HasPrologue && !HasIRCheck && isa<ReturnInst>(BB.getTerminator());
597 }
598 
600  if (Layout.empty())
601  return;
602 
603  for (int I = 0, E = MFI.getObjectIndexEnd(); I != E; ++I) {
604  if (MFI.isDeadObjectIndex(I))
605  continue;
606 
607  const AllocaInst *AI = MFI.getObjectAllocation(I);
608  if (!AI)
609  continue;
610 
611  SSPLayoutMap::const_iterator LI = Layout.find(AI);
612  if (LI == Layout.end())
613  continue;
614 
615  MFI.setObjectSSPLayout(I, LI->second);
616  }
617 }
llvm::Instruction::getPrevNonDebugInstruction
const Instruction * getPrevNonDebugInstruction(bool SkipPseudoOp=false) const
Return a pointer to the previous non-debug instruction in the same basic block as 'this',...
Definition: Instruction.cpp:748
StackProtector.h
llvm
This is an optimization pass for GlobalISel generic memory operations.
Definition: AddressRanges.h:17
llvm::TargetLoweringBase
This base class for TargetLowering contains the SelectionDAG-independent parts that can be used from ...
Definition: TargetLowering.h:191
M
We currently emits eax Perhaps this is what we really should generate is Is imull three or four cycles eax eax The current instruction priority is based on pattern complexity The former is more complex because it folds a load so the latter will not be emitted Perhaps we should use AddedComplexity to give LEA32r a higher priority We should always try to match LEA first since the LEA matching code does some estimate to determine whether the match is profitable if we care more about code then imull is better It s two bytes shorter than movl leal On a Pentium M
Definition: README.txt:252
llvm::ReturnInst
Return a value (possibly void), from a function.
Definition: Instructions.h:3004
llvm::DataLayout
A parsed version of the target data layout string in and methods for querying it.
Definition: DataLayout.h:113
llvm::LinearPolySize< TypeSize >::isKnownGT
static bool isKnownGT(const LinearPolySize &LHS, const LinearPolySize &RHS)
Definition: TypeSize.h:334
llvm::Intrinsic::getDeclaration
Function * getDeclaration(Module *M, ID id, ArrayRef< Type * > Tys=None)
Create or insert an LLVM Function declaration for an intrinsic, and return it.
Definition: Function.cpp:1418
llvm::Type::getInt8PtrTy
static PointerType * getInt8PtrTy(LLVMContext &C, unsigned AS=0)
Definition: Type.cpp:291
IntrinsicInst.h
llvm::Function
Definition: Function.h:60
llvm::Attribute
Definition: Attributes.h:65
Pass.h
llvm::StackProtector::copyToMachineFrameInfo
void copyToMachineFrameInfo(MachineFrameInfo &MFI) const
Definition: StackProtector.cpp:599
llvm::StackProtector::runOnFunction
bool runOnFunction(Function &Fn) override
runOnFunction - Virtual method overriden by subclasses to do the per-function processing of the pass.
Definition: StackProtector.cpp:82
Statistic.h
llvm::IRBuilder<>
OptimizationRemarkEmitter.h
llvm::cl::Hidden
@ Hidden
Definition: CommandLine.h:139
INITIALIZE_PASS_BEGIN
INITIALIZE_PASS_BEGIN(StackProtector, DEBUG_TYPE, "Insert stack protectors", false, true) INITIALIZE_PASS_END(StackProtector
true
basic Basic Alias true
Definition: BasicAliasAnalysis.cpp:1886
llvm::DenseMapIterator
Definition: DenseMap.h:57
llvm::MemoryLocation::Size
LocationSize Size
The maximum size of the location, in address-units, or UnknownSize if the size is not known.
Definition: MemoryLocation.h:227
EnableSelectionDAGSP
static cl::opt< bool > EnableSelectionDAGSP("enable-selectiondag-sp", cl::init(true), cl::Hidden)
llvm::Type
The instances of the Type class are immutable: once they are created, they are never changed.
Definition: Type.h:45
Module.h
EHPersonalities.h
llvm::MachineFrameInfo::SSPLK_LargeArray
@ SSPLK_LargeArray
Array or nested array >= SSP-buffer-size.
Definition: MachineFrameInfo.h:112
llvm::Optional
Definition: APInt.h:33
llvm::Module::getOrInsertFunction
FunctionCallee getOrInsertFunction(StringRef Name, FunctionType *T, AttributeList AttributeList)
Look up the specified function in the module symbol table.
Definition: Module.cpp:144
llvm::ore::NV
DiagnosticInfoOptimizationBase::Argument NV
Definition: OptimizationRemarkEmitter.h:136
isMustTailCall
static bool isMustTailCall(Value *V)
Definition: InstructionCombining.cpp:3050
llvm::MipsISD::Ret
@ Ret
Definition: MipsISelLowering.h:119
llvm::ArrayType
Class to represent array types.
Definition: DerivedTypes.h:357
llvm::MachineFrameInfo::getObjectIndexEnd
int getObjectIndexEnd() const
Return one past the maximum frame object index.
Definition: MachineFrameInfo.h:409
llvm::StackProtector::ID
static char ID
Definition: StackProtector.h:104
llvm::MDNode::get
static MDTuple * get(LLVMContext &Context, ArrayRef< Metadata * > MDs)
Definition: Metadata.h:1384
F
#define F(x, y, z)
Definition: MD5.cpp:55
llvm::BasicBlock
LLVM Basic Block Representation.
Definition: BasicBlock.h:55
Context
LLVMContext & Context
Definition: NVVMIntrRange.cpp:66
llvm::classifyEHPersonality
EHPersonality classifyEHPersonality(const Value *Pers)
See if the given exception handling personality function is one that we understand.
Definition: EHPersonalities.cpp:22
Instruction.h
CommandLine.h
llvm::SPII::Load
@ Load
Definition: SparcInstrInfo.h:32
TargetLowering.h
TargetMachine.h
llvm::PassRegistry::getPassRegistry
static PassRegistry * getPassRegistry()
getPassRegistry - Access the global registry object, which is automatically initialized at applicatio...
Definition: PassRegistry.cpp:31
Constants.h
E
static GCRegistry::Add< CoreCLRGC > E("coreclr", "CoreCLR-compatible GC")
llvm::Triple::isOSDarwin
bool isOSDarwin() const
Is this a "Darwin" OS (macOS, iOS, tvOS, watchOS, or DriverKit).
Definition: Triple.h:508
llvm::User
Definition: User.h:44
llvm::MachineFrameInfo::setObjectSSPLayout
void setObjectSSPLayout(int ObjectIdx, SSPLayoutKind Kind)
Definition: MachineFrameInfo.h:566
Intrinsics.h
llvm::StackProtector
Definition: StackProtector.h:36
llvm::MDBuilder::createBranchWeights
MDNode * createBranchWeights(uint32_t TrueWeight, uint32_t FalseWeight)
Return metadata containing two branch weights.
Definition: MDBuilder.cpp:37
llvm::AnalysisUsage
Represent the analysis usage information of a pass.
Definition: PassAnalysisSupport.h:47
llvm::LocationSize::getValue
uint64_t getValue() const
Definition: MemoryLocation.h:159
false
Definition: StackSlotColoring.cpp:141
llvm::TypeSize::Fixed
static TypeSize Fixed(ScalarTy MinVal)
Definition: TypeSize.h:441
B
static GCRegistry::Add< OcamlGC > B("ocaml", "ocaml 3.10-compatible GC")
llvm::Function::getFnAttribute
Attribute getFnAttribute(Attribute::AttrKind Kind) const
Return the attribute for the given attribute kind.
Definition: Function.cpp:651
llvm::Instruction
Definition: Instruction.h:42
llvm::DominatorTreeWrapperPass
Legacy analysis pass which computes a DominatorTree.
Definition: Dominators.h:302
MDBuilder.h
llvm::STATISTIC
STATISTIC(NumFunctions, "Total number of functions")
llvm::Function::hasPersonalityFn
bool hasPersonalityFn() const
Check whether this function has a personality function.
Definition: Function.h:778
SmallPtrSet.h
llvm::Attribute::isStringAttribute
bool isStringAttribute() const
Return true if the attribute is a string (target-dependent) attribute.
Definition: Attributes.cpp:268
llvm::TargetLoweringBase::insertSSPDeclarations
virtual void insertSSPDeclarations(Module &M) const
Inserts necessary declarations for SSP (stack protection) purpose.
Definition: TargetLoweringBase.cpp:1989
llvm::MCID::Call
@ Call
Definition: MCInstrDesc.h:155
llvm::SPII::Store
@ Store
Definition: SparcInstrInfo.h:33
llvm::Attribute::getValueAsString
StringRef getValueAsString() const
Return the attribute's value as a string.
Definition: Attributes.cpp:304
llvm::StringRef::getAsInteger
std::enable_if_t< std::numeric_limits< T >::is_signed, bool > getAsInteger(unsigned Radix, T &Result) const
Parse the current string as an integer of the specified radix.
Definition: StringRef.h:514
llvm::LinearPolySize< TypeSize >::getFixed
static TypeSize getFixed(ScalarTy MinVal)
Definition: TypeSize.h:283
llvm::CallingConv::ID
unsigned ID
LLVM IR allows to use arbitrary numbers as calling convention identifiers.
Definition: CallingConv.h:24
llvm::BranchProbabilityInfo::getBranchProbStackProtector
static BranchProbability getBranchProbStackProtector(bool IsLikely)
Definition: BranchProbabilityInfo.h:192
Type.h
llvm::MachineFrameInfo::isDeadObjectIndex
bool isDeadObjectIndex(int ObjectIdx) const
Returns true if the specified index corresponds to a dead object.
Definition: MachineFrameInfo.h:737
INITIALIZE_PASS_END
#define INITIALIZE_PASS_END(passName, arg, name, cfg, analysis)
Definition: PassSupport.h:58
Passes.h
llvm::TargetPassConfig
Target-Independent Code Generator Pass Configuration Options.
Definition: TargetPassConfig.h:84
llvm::Function::hasFnAttribute
bool hasFnAttribute(Attribute::AttrKind Kind) const
Return true if the function has the attribute.
Definition: Function.cpp:625
BasicBlock.h
llvm::cl::opt< bool >
llvm::TargetLoweringBase::getIRStackGuard
virtual Value * getIRStackGuard(IRBuilderBase &IRB) const
If the target has a standard location for the stack protector guard, returns the address of that loca...
Definition: TargetLoweringBase.cpp:1975
BranchProbabilityInfo.h
llvm::AMDGPU::Hwreg::Offset
Offset
Definition: SIDefines.h:413
llvm::MemoryLocation::getOrNone
static Optional< MemoryLocation > getOrNone(const Instruction *Inst)
Definition: MemoryLocation.cpp:76
llvm::StringRef::empty
constexpr LLVM_NODISCARD bool empty() const
empty - Check if the string is empty.
Definition: StringRef.h:153
llvm::StackProtector::StackProtector
StackProtector()
Definition: StackProtector.cpp:64
llvm::LocationSize::hasValue
bool hasValue() const
Definition: MemoryLocation.h:156
llvm::GlobalValue::getParent
Module * getParent()
Get the module that this global value is contained inside of...
Definition: GlobalValue.h:620
llvm::ARM_MB::ST
@ ST
Definition: ARMBaseInfo.h:73
llvm::StackProtector::getAnalysisUsage
void getAnalysisUsage(AnalysisUsage &AU) const override
getAnalysisUsage - This function should be overriden by passes that need analysis information to do t...
Definition: StackProtector.cpp:77
INITIALIZE_PASS_DEPENDENCY
INITIALIZE_PASS_DEPENDENCY(DominatorTreeWrapperPass)
llvm::LLVMContext
This is an important class for using LLVM in a threaded context.
Definition: LLVMContext.h:68
MemoryLocation.h
llvm::Triple::isOSOpenBSD
bool isOSOpenBSD() const
Definition: Triple.h:530
I
#define I(x, y, z)
Definition: MD5.cpp:58
llvm::GetElementPtrInst
an instruction for type-safe pointer arithmetic to access elements of arrays and structs
Definition: Instructions.h:916
llvm::cl::init
initializer< Ty > init(const Ty &Val)
Definition: CommandLine.h:432
llvm::make_early_inc_range
iterator_range< early_inc_iterator_impl< detail::IterOfRange< RangeT > > > make_early_inc_range(RangeT &&Range)
Make a range that does early increment to allow mutation of the underlying range without disrupting i...
Definition: STLExtras.h:618
llvm::PointerType
Class to represent pointers.
Definition: DerivedTypes.h:632
TargetPassConfig.h
llvm::DenseMapBase::find
iterator find(const_arg_type_t< KeyT > Val)
Definition: DenseMap.h:152
llvm::TargetMachine::Options
TargetOptions Options
Definition: TargetMachine.h:118
IRBuilder.h
assert
assert(ImpDefSCC.getReg()==AMDGPU::SCC &&ImpDefSCC.isDef())
llvm::TargetMachine
Primary interface to the complete machine description for the target machine.
Definition: TargetMachine.h:77
llvm::DominatorTree::isReachableFromEntry
bool isReachableFromEntry(const Use &U) const
Provide an overload for a Use.
Definition: Dominators.cpp:335
llvm::LinearPolySize< TypeSize >::isKnownGE
static bool isKnownGE(const LinearPolySize &LHS, const LinearPolySize &RHS)
Definition: TypeSize.h:346
llvm::Module
A Module instance is used to store all the information related to an LLVM module.
Definition: Module.h:65
llvm::MDNode
Metadata node.
Definition: Metadata.h:944
llvm::LinearPolySize::getKnownMinValue
ScalarTy getKnownMinValue() const
Returns the minimum value this size can represent.
Definition: TypeSize.h:296
llvm::TargetOptions::EnableFastISel
unsigned EnableFastISel
EnableFastISel - This flag enables fast-path instruction selection which trades away generated code q...
Definition: TargetOptions.h:232
llvm::TargetLoweringBase::useStackGuardXorFP
virtual bool useStackGuardXorFP() const
If this function returns true, stack protection checks should XOR the frame pointer (or whichever poi...
Definition: TargetLowering.h:1852
llvm::APInt
Class for arbitrary precision integers.
Definition: APInt.h:75
TargetOptions.h
llvm::StackProtector::shouldEmitSDCheck
bool shouldEmitSDCheck(const BasicBlock &BB) const
Definition: StackProtector.cpp:595
llvm::OptimizationRemarkEmitter
The optimization diagnostic interface.
Definition: OptimizationRemarkEmitter.h:33
llvm::BasicBlock::moveAfter
void moveAfter(BasicBlock *MovePos)
Unlink this basic block from its current function and insert it right after MovePos in the function M...
Definition: BasicBlock.cpp:141
DataLayout.h
llvm::StructType
Class to represent struct types.
Definition: DerivedTypes.h:213
llvm::StringRef
StringRef - Represent a constant reference to a string, i.e.
Definition: StringRef.h:58
llvm::AnalysisUsage::addPreserved
AnalysisUsage & addPreserved()
Add the specified Pass class to the set of analyses preserved by this pass.
Definition: PassAnalysisSupport.h:98
llvm::BasicBlock::Create
static BasicBlock * Create(LLVMContext &Context, const Twine &Name="", Function *Parent=nullptr, BasicBlock *InsertBefore=nullptr)
Creates a new BasicBlock.
Definition: BasicBlock.h:97
llvm::Value::getContext
LLVMContext & getContext() const
All values hold a context through their type.
Definition: Value.cpp:991
llvm::ilist_node_impl::getIterator
self_iterator getIterator()
Definition: ilist_node.h:82
TargetSubtargetInfo.h
DL
MachineBasicBlock MachineBasicBlock::iterator DebugLoc DL
Definition: AArch64SLSHardening.cpp:76
CreatePrologue
static bool CreatePrologue(Function *F, Module *M, ReturnInst *RI, const TargetLoweringBase *TLI, AllocaInst *&AI)
Insert code into the entry block that stores the stack guard variable onto the stack:
Definition: StackProtector.cpp:417
llvm::LoadInst
An instruction for reading from memory.
Definition: Instructions.h:173
llvm::DenseMapBase::insert
std::pair< iterator, bool > insert(const std::pair< KeyT, ValueT > &KV)
Definition: DenseMap.h:209
llvm::EHPersonality
EHPersonality
Definition: EHPersonalities.h:21
llvm::DominatorTreeBase::addNewBlock
DomTreeNodeBase< NodeT > * addNewBlock(NodeT *BB, NodeT *DomBB)
Add a new node to the dominator tree information.
Definition: GenericDomTree.h:619
llvm::DenseMapBase::empty
LLVM_NODISCARD bool empty() const
Definition: DenseMap.h:98
llvm::MCID::Select
@ Select
Definition: MCInstrDesc.h:164
Attributes.h
llvm::TargetLoweringBase::getSSPStackGuardCheck
virtual Function * getSSPStackGuardCheck(const Module &M) const
If the target has a standard stack protection check function that performs validation and error handl...
Definition: TargetLoweringBase.cpp:2009
llvm::DenseMapBase::end
iterator end()
Definition: DenseMap.h:84
llvm::X86::FirstMacroFusionInstKind::Cmp
@ Cmp
llvm::TypeSize
Definition: TypeSize.h:435
Casting.h
Function.h
llvm::DominatorTreeWrapperPass::getDomTree
DominatorTree & getDomTree()
Definition: Dominators.h:310
llvm::Function::getPersonalityFn
Constant * getPersonalityFn() const
Get the personality function associated with this function.
Definition: Function.cpp:1906
protectors
Insert stack protectors
Definition: StackProtector.cpp:73
llvm::MDBuilder
Definition: MDBuilder.h:35
llvm::Type::getVoidTy
static Type * getVoidTy(LLVMContext &C)
Definition: Type.cpp:222
llvm::MachineFrameInfo
The MachineFrameInfo class represents an abstract stack frame until prolog/epilog code is inserted.
Definition: MachineFrameInfo.h:105
llvm::OptimizationRemark
Diagnostic information for applied optimization remarks.
Definition: DiagnosticInfo.h:690
Instructions.h
llvm::TargetSubtargetInfo::getTargetLowering
virtual const TargetLowering * getTargetLowering() const
Definition: TargetSubtargetInfo.h:97
llvm::TargetMachine::getSubtargetImpl
virtual const TargetSubtargetInfo * getSubtargetImpl(const Function &) const
Virtual method implemented by subclasses that returns a reference to that target's TargetSubtargetInf...
Definition: TargetMachine.h:133
User.h
llvm::MachineFrameInfo::SSPLK_AddrOf
@ SSPLK_AddrOf
The address of this allocation is exposed and triggered protection.
Definition: MachineFrameInfo.h:116
Dominators.h
llvm::CallBase::getArgOperand
Value * getArgOperand(unsigned i) const
Definition: InstrTypes.h:1341
llvm::TargetMachine::getTargetTriple
const Triple & getTargetTriple() const
Definition: TargetMachine.h:126
llvm::MachineFrameInfo::SSPLK_SmallArray
@ SSPLK_SmallArray
Array or nested array < SSP-buffer-size.
Definition: MachineFrameInfo.h:114
stack
S is passed via registers r2 But gcc stores them to the stack
Definition: README.txt:189
DEBUG_TYPE
#define DEBUG_TYPE
Definition: StackProtector.cpp:53
llvm::FunctionCallee
A handy container for a FunctionType+Callee-pointer pair, which can be passed around as a single enti...
Definition: DerivedTypes.h:165
llvm::Module::getDataLayout
const DataLayout & getDataLayout() const
Get the data layout for the module's target platform.
Definition: Module.cpp:398
DerivedTypes.h
llvm::FunctionPass
FunctionPass class - This class is used to implement most global optimizations.
Definition: Pass.h:308
getStackGuard
static Value * getStackGuard(const TargetLoweringBase *TLI, Module *M, IRBuilder<> &B, bool *SupportsSelectionDAGSP=nullptr)
Create a stack guard loading and populate whether SelectionDAG SSP is supported.
Definition: StackProtector.cpp:382
llvm::CallInst
This class represents a function call, abstracting a target machine's calling convention.
Definition: Instructions.h:1461
BB
Common register allocation spilling lr str ldr sxth r3 ldr mla r4 can lr mov lr str ldr sxth r3 mla r4 and then merge mul and lr str ldr sxth r3 mla r4 It also increase the likelihood the store may become dead bb27 Successors according to LLVM BB
Definition: README.txt:39
GEP
Hexagon Common GEP
Definition: HexagonCommonGEP.cpp:171
llvm::AnalysisUsage::addRequired
AnalysisUsage & addRequired()
Definition: PassAnalysisSupport.h:75
llvm::initializeStackProtectorPass
void initializeStackProtectorPass(PassRegistry &)
llvm::AllocaInst
an instruction to allocate memory on the stack
Definition: Instructions.h:58
findStackProtectorIntrinsic
static const CallInst * findStackProtectorIntrinsic(Function &F)
Search for the first call to the llvm.stackprotector intrinsic and return it if present.
Definition: StackProtector.cpp:256
InitializePasses.h
llvm::Value
LLVM Value Representation.
Definition: Value.h:74
llvm::Value::users
iterator_range< user_iterator > users()
Definition: Value.h:421
llvm::isFuncletEHPersonality
bool isFuncletEHPersonality(EHPersonality Pers)
Returns true if this is a personality function that invokes handler funclets (which must return to it...
Definition: EHPersonalities.h:64
llvm::createStackProtectorPass
FunctionPass * createStackProtectorPass()
createStackProtectorPass - This pass adds stack protectors to functions.
Definition: StackProtector.cpp:75
llvm::MachineFrameInfo::getObjectAllocation
const AllocaInst * getObjectAllocation(int ObjectIdx) const
Return the underlying Alloca of the specified stack object if it exists.
Definition: MachineFrameInfo.h:502
llvm::DataLayout::getTypeAllocSize
TypeSize getTypeAllocSize(Type *Ty) const
Returns the offset in bytes between successive objects of the specified type, including alignment pad...
Definition: DataLayout.h:506