X-Git-Url: http://demsky.eecs.uci.edu/git/?a=blobdiff_plain;f=lib%2FCodeGen%2FStackProtector.cpp;h=31e9ec0ac0b9751361a75a97c3d537b34847be51;hb=7d2f2496c1d263eecdc104fd72e847a31d8695b9;hp=f409fbdd4ff9556283e5d718e132d6f09c74977e;hpb=2b58ce5ab4e22e796303d68fb246d4031cb5d4ca;p=oota-llvm.git diff --git a/lib/CodeGen/StackProtector.cpp b/lib/CodeGen/StackProtector.cpp index f409fbdd4ff..31e9ec0ac0b 100644 --- a/lib/CodeGen/StackProtector.cpp +++ b/lib/CodeGen/StackProtector.cpp @@ -7,222 +7,277 @@ // //===----------------------------------------------------------------------===// // -// This pass inserts stack protectors into functions which need them. The stack -// protectors this uses are the type that ProPolice used. A variable with a -// random value in it is stored onto the stack before the local variables are -// allocated. Upon exitting the block, the stored value is checked. If it's +// This pass inserts stack protectors into functions which need them. A variable +// with a random value in it is stored onto the stack before the local variables +// are allocated. Upon exiting the block, the stored value is checked. If it's // changed, then there was some sort of violation and the program aborts. // //===----------------------------------------------------------------------===// #define DEBUG_TYPE "stack-protector" #include "llvm/CodeGen/Passes.h" +#include "llvm/Analysis/Dominators.h" +#include "llvm/Attributes.h" #include "llvm/Constants.h" #include "llvm/DerivedTypes.h" #include "llvm/Function.h" #include "llvm/Instructions.h" +#include "llvm/Intrinsics.h" #include "llvm/Module.h" #include "llvm/Pass.h" -#include "llvm/ADT/APInt.h" #include "llvm/Support/CommandLine.h" +#include "llvm/DataLayout.h" +#include "llvm/Target/TargetLowering.h" +#include "llvm/Target/TargetOptions.h" +#include "llvm/ADT/Triple.h" using namespace llvm; -// Enable stack protectors. -static cl::opt -SSPBufferSize("ssp-buffer-size", cl::init(8), - cl::desc("The lower bound for a buffer to be considered for " - "stack smashing protection.")); - namespace { - class VISIBILITY_HIDDEN StackProtector : public FunctionPass { - // Level == 0 -- Stack protectors are off. - // Level == 1 -- Stack protectors are on only for some functions. - // Level == 2 -- Stack protectors are on for all functions. - int Level; - - /// FailBB - Holds the basic block to jump to when the stack protector check - /// fails. - BasicBlock *FailBB; - - /// StackProtFrameSlot - The place on the stack that the stack protector - /// guard is kept. - AllocaInst *StackProtFrameSlot; - - /// StackGuardVar - The global variable for the stack guard. - GlobalVariable *StackGuardVar; + class StackProtector : public FunctionPass { + /// TLI - Keep a pointer of a TargetLowering to consult for determining + /// target type sizes. + const TargetLowering *TLI; Function *F; Module *M; - /// InsertStackProtectorPrologue - Insert code into the entry block that - /// stores the __stack_chk_guard variable onto the stack. - void InsertStackProtectorPrologue(); + DominatorTree *DT; - /// InsertStackProtectorEpilogue - Insert code before the return - /// instructions checking the stack value that was stored in the - /// prologue. If it isn't the same as the original value, then call a - /// "failure" function. - void InsertStackProtectorEpilogue(); + /// InsertStackProtectors - Insert code into the prologue and epilogue of + /// the function. + /// + /// - The prologue code loads and stores the stack guard onto the stack. + /// - The epilogue checks the value stored in the prologue against the + /// original value. It calls __stack_chk_fail if they differ. + bool InsertStackProtectors(); /// CreateFailBB - Create a basic block to jump to when the stack protector /// check fails. - void CreateFailBB(); + BasicBlock *CreateFailBB(); + + /// ContainsProtectableArray - Check whether the type either is an array or + /// contains an array of sufficient size so that we need stack protectors + /// for it. + bool ContainsProtectableArray(Type *Ty, bool InStruct = false) const; /// RequiresStackProtector - Check whether or not this function needs a /// stack protector based upon the stack protector level. - bool RequiresStackProtector(); + bool RequiresStackProtector() const; public: static char ID; // Pass identification, replacement for typeid. - StackProtector(int lvl = 0) : FunctionPass(&ID), Level(lvl), FailBB(0) {} + StackProtector() : FunctionPass(ID), TLI(0) { + initializeStackProtectorPass(*PassRegistry::getPassRegistry()); + } + StackProtector(const TargetLowering *tli) + : FunctionPass(ID), TLI(tli) { + initializeStackProtectorPass(*PassRegistry::getPassRegistry()); + } + + virtual void getAnalysisUsage(AnalysisUsage &AU) const { + AU.addPreserved(); + } virtual bool runOnFunction(Function &Fn); }; } // end anonymous namespace char StackProtector::ID = 0; -static RegisterPass -X("stack-protector", "Insert stack protectors"); +INITIALIZE_PASS(StackProtector, "stack-protector", + "Insert stack protectors", false, false) -FunctionPass *llvm::createStackProtectorPass(int lvl) { - return new StackProtector(lvl); +FunctionPass *llvm::createStackProtectorPass(const TargetLowering *tli) { + return new StackProtector(tli); } bool StackProtector::runOnFunction(Function &Fn) { F = &Fn; M = F->getParent(); + DT = getAnalysisIfAvailable(); if (!RequiresStackProtector()) return false; - - InsertStackProtectorPrologue(); - InsertStackProtectorEpilogue(); - - // Cleanup. - FailBB = 0; - StackProtFrameSlot = 0; - StackGuardVar = 0; - return true; + + return InsertStackProtectors(); } -/// InsertStackProtectorPrologue - Insert code into the entry block that stores -/// the __stack_chk_guard variable onto the stack. -void StackProtector::InsertStackProtectorPrologue() { - BasicBlock &Entry = F->getEntryBlock(); - Instruction &InsertPt = Entry.front(); +/// ContainsProtectableArray - Check whether the type either is an array or +/// contains a char array of sufficient size so that we need stack protectors +/// for it. +bool StackProtector::ContainsProtectableArray(Type *Ty, bool InStruct) const { + if (!Ty) return false; + if (ArrayType *AT = dyn_cast(Ty)) { + const TargetMachine &TM = TLI->getTargetMachine(); + if (!AT->getElementType()->isIntegerTy(8)) { + Triple Trip(TM.getTargetTriple()); + + // If we're on a non-Darwin platform or we're inside of a structure, don't + // add stack protectors unless the array is a character array. + if (InStruct || !Trip.isOSDarwin()) + return false; + } - const char *StackGuardStr = "__stack_chk_guard"; - StackGuardVar = M->getNamedGlobal(StackGuardStr); + // If an array has more than SSPBufferSize bytes of allocated space, then we + // emit stack protectors. + if (TM.Options.SSPBufferSize <= TLI->getDataLayout()->getTypeAllocSize(AT)) + return true; + } + + const StructType *ST = dyn_cast(Ty); + if (!ST) return false; - if (!StackGuardVar) - StackGuardVar = new GlobalVariable(PointerType::getUnqual(Type::Int8Ty), - false, GlobalValue::ExternalLinkage, - 0, StackGuardStr, M); + for (StructType::element_iterator I = ST->element_begin(), + E = ST->element_end(); I != E; ++I) + if (ContainsProtectableArray(*I, true)) + return true; - StackProtFrameSlot = new AllocaInst(PointerType::getUnqual(Type::Int8Ty), - "StackProt_Frame", &InsertPt); - LoadInst *LI = new LoadInst(StackGuardVar, "StackGuard", true, &InsertPt); - new StoreInst(LI, StackProtFrameSlot, true, &InsertPt); + return false; } -/// InsertStackProtectorEpilogue - Insert code before the return instructions -/// checking the stack value that was stored in the prologue. If it isn't the -/// same as the original value, then call a "failure" function. -void StackProtector::InsertStackProtectorEpilogue() { - // Create the basic block to jump to when the guard check fails. - CreateFailBB(); - - Function::iterator I = F->begin(), E = F->end(); - std::vector ReturnBBs; - ReturnBBs.reserve(F->size()); - - for (; I != E; ++I) - if (isa((*I).getTerminator())) - ReturnBBs.push_back(I); - - if (ReturnBBs.empty()) return; // Odd, but could happen. . . - - // Loop through the basic blocks that have return instructions. Convert this: - // - // return: - // ... - // ret ... - // - // into this: - // - // return: - // ... - // %1 = load __stack_chk_guard - // %2 = load - // %3 = cmp i1 %1, %2 - // br i1 %3, label %SPRet, label %CallStackCheckFailBlk - // - // SPRet: - // ret ... - // - // CallStackCheckFailBlk: - // call void @__stack_chk_fail() - // unreachable - // - for (std::vector::iterator - II = ReturnBBs.begin(), IE = ReturnBBs.end(); II != IE; ++II) { - BasicBlock *BB = *II; - ReturnInst *RI = cast(BB->getTerminator()); - Function::iterator InsPt = BB; ++InsPt; // Insertion point for new BB. - - BasicBlock *NewBB = BasicBlock::Create("SPRet", F, InsPt); - - // Move the return instruction into the new basic block. - RI->removeFromParent(); - NewBB->getInstList().insert(NewBB->begin(), RI); - - LoadInst *LI2 = new LoadInst(StackGuardVar, "", false, BB); - LoadInst *LI1 = new LoadInst(StackProtFrameSlot, "", true, BB); - ICmpInst *Cmp = new ICmpInst(CmpInst::ICMP_EQ, LI1, LI2, "", BB); - BranchInst::Create(NewBB, FailBB, Cmp, BB); +/// RequiresStackProtector - Check whether or not this function needs a stack +/// protector based upon the stack protector level. The heuristic we use is to +/// add a guard variable to functions that call alloca, and functions with +/// buffers larger than SSPBufferSize bytes. +bool StackProtector::RequiresStackProtector() const { + if (F->getFnAttributes().hasAttribute(Attributes::StackProtectReq)) + return true; + + if (!F->getFnAttributes().hasAttribute(Attributes::StackProtect)) + return false; + + for (Function::iterator I = F->begin(), E = F->end(); I != E; ++I) { + BasicBlock *BB = I; + + for (BasicBlock::iterator + II = BB->begin(), IE = BB->end(); II != IE; ++II) + if (AllocaInst *AI = dyn_cast(II)) { + if (AI->isArrayAllocation()) + // This is a call to alloca with a variable size. Emit stack + // protectors. + return true; + + if (ContainsProtectableArray(AI->getAllocatedType())) + return true; + } } -} -/// CreateFailBB - Create a basic block to jump to when the stack protector -/// check fails. -void StackProtector::CreateFailBB() { - assert(!FailBB && "Failure basic block already created?!"); - FailBB = BasicBlock::Create("CallStackCheckFailBlk", F); - std::vector Params; - Constant *StackChkFail = - M->getOrInsertFunction("__stack_chk_fail", - FunctionType::get(Type::VoidTy, Params, false)); - CallInst::Create(StackChkFail, "", FailBB); - new UnreachableInst(FailBB); + return false; } -/// RequiresStackProtector - Check whether or not this function needs a stack -/// protector based upon the stack protector level. -bool StackProtector::RequiresStackProtector() { - switch (Level) { - default: return false; - case 2: return true; - case 1: { - // If the size of the local variables allocated on the stack is greater than - // SSPBufferSize, then we require a stack protector. - uint64_t StackSize = 0; - - for (Function::iterator I = F->begin(), E = F->end(); I != E; ++I) { - BasicBlock *BB = I; - - for (BasicBlock::iterator - II = BB->begin(), IE = BB->end(); II != IE; ++II) - if (AllocaInst *AI = dyn_cast(II)) - if (ConstantInt *CI = dyn_cast(AI->getArraySize())) { - const APInt &Size = CI->getValue(); - StackSize += Size.getZExtValue() * 8; - } +/// InsertStackProtectors - Insert code into the prologue and epilogue of the +/// function. +/// +/// - The prologue code loads and stores the stack guard onto the stack. +/// - The epilogue checks the value stored in the prologue against the original +/// value. It calls __stack_chk_fail if they differ. +bool StackProtector::InsertStackProtectors() { + BasicBlock *FailBB = 0; // The basic block to jump to if check fails. + BasicBlock *FailBBDom = 0; // FailBB's dominator. + AllocaInst *AI = 0; // Place on stack that stores the stack guard. + Value *StackGuardVar = 0; // The stack guard variable. + + for (Function::iterator I = F->begin(), E = F->end(); I != E; ) { + BasicBlock *BB = I++; + ReturnInst *RI = dyn_cast(BB->getTerminator()); + if (!RI) continue; + + if (!FailBB) { + // Insert code into the entry block that stores the __stack_chk_guard + // variable onto the stack: + // + // entry: + // StackGuardSlot = alloca i8* + // StackGuard = load __stack_chk_guard + // call void @llvm.stackprotect.create(StackGuard, StackGuardSlot) + // + PointerType *PtrTy = Type::getInt8PtrTy(RI->getContext()); + unsigned AddressSpace, Offset; + if (TLI->getStackCookieLocation(AddressSpace, Offset)) { + Constant *OffsetVal = + ConstantInt::get(Type::getInt32Ty(RI->getContext()), Offset); + + StackGuardVar = ConstantExpr::getIntToPtr(OffsetVal, + PointerType::get(PtrTy, AddressSpace)); + } else { + StackGuardVar = M->getOrInsertGlobal("__stack_chk_guard", PtrTy); + } + + BasicBlock &Entry = F->getEntryBlock(); + Instruction *InsPt = &Entry.front(); + + AI = new AllocaInst(PtrTy, "StackGuardSlot", InsPt); + LoadInst *LI = new LoadInst(StackGuardVar, "StackGuard", false, InsPt); + + Value *Args[] = { LI, AI }; + CallInst:: + Create(Intrinsic::getDeclaration(M, Intrinsic::stackprotector), + Args, "", InsPt); + + // Create the basic block to jump to when the guard check fails. + FailBB = CreateFailBB(); } - if (SSPBufferSize <= StackSize) - return true; + // For each block with a return instruction, convert this: + // + // return: + // ... + // ret ... + // + // into this: + // + // return: + // ... + // %1 = load __stack_chk_guard + // %2 = load StackGuardSlot + // %3 = cmp i1 %1, %2 + // br i1 %3, label %SP_return, label %CallStackCheckFailBlk + // + // SP_return: + // ret ... + // + // CallStackCheckFailBlk: + // call void @__stack_chk_fail() + // unreachable + + // Split the basic block before the return instruction. + BasicBlock *NewBB = BB->splitBasicBlock(RI, "SP_return"); + + if (DT && DT->isReachableFromEntry(BB)) { + DT->addNewBlock(NewBB, BB); + FailBBDom = FailBBDom ? DT->findNearestCommonDominator(FailBBDom, BB) :BB; + } - return false; - } + // Remove default branch instruction to the new BB. + BB->getTerminator()->eraseFromParent(); + + // Move the newly created basic block to the point right after the old basic + // block so that it's in the "fall through" position. + NewBB->moveAfter(BB); + + // Generate the stack protector instructions in the old basic block. + LoadInst *LI1 = new LoadInst(StackGuardVar, "", false, BB); + LoadInst *LI2 = new LoadInst(AI, "", true, BB); + ICmpInst *Cmp = new ICmpInst(*BB, CmpInst::ICMP_EQ, LI1, LI2, ""); + BranchInst::Create(NewBB, FailBB, Cmp, BB); } + + // Return if we didn't modify any basic blocks. I.e., there are no return + // statements in the function. + if (!FailBB) return false; + + if (DT && FailBBDom) + DT->addNewBlock(FailBB, FailBBDom); + + return true; } -// [EOF] StackProtector.cpp +/// CreateFailBB - Create a basic block to jump to when the stack protector +/// check fails. +BasicBlock *StackProtector::CreateFailBB() { + BasicBlock *FailBB = BasicBlock::Create(F->getContext(), + "CallStackCheckFailBlk", F); + Constant *StackChkFail = + M->getOrInsertFunction("__stack_chk_fail", + Type::getVoidTy(F->getContext()), NULL); + CallInst::Create(StackChkFail, "", FailBB); + new UnreachableInst(F->getContext(), FailBB); + return FailBB; +}