1894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman//===-- StackProtector.cpp - Stack Protector Insertion --------------------===// 2894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman// 3894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman// The LLVM Compiler Infrastructure 4894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman// 5894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman// This file is distributed under the University of Illinois Open Source 6894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman// License. See LICENSE.TXT for details. 7894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman// 8894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman//===----------------------------------------------------------------------===// 9894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman// 10894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman// This pass inserts stack protectors into functions which need them. A variable 11894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman// with a random value in it is stored onto the stack before the local variables 12894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman// are allocated. Upon exiting the block, the stored value is checked. If it's 13894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman// changed, then there was some sort of violation and the program aborts. 14894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman// 15894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman//===----------------------------------------------------------------------===// 16894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman 17894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman#define DEBUG_TYPE "stack-protector" 18894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman#include "llvm/CodeGen/Passes.h" 1919bac1e08be200c31efd26f0f5fd144c9b3eefd3John Bauman#include "llvm/Analysis/Dominators.h" 20894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman#include "llvm/Attributes.h" 21894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman#include "llvm/Constants.h" 22894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman#include "llvm/DerivedTypes.h" 23894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman#include "llvm/Function.h" 24894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman#include "llvm/Instructions.h" 25894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman#include "llvm/Intrinsics.h" 26894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman#include "llvm/Module.h" 27894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman#include "llvm/Pass.h" 28894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman#include "llvm/Support/CommandLine.h" 29894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman#include "llvm/Target/TargetData.h" 30894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman#include "llvm/Target/TargetLowering.h" 31894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Baumanusing namespace llvm; 32894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman 33894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman// SSPBufferSize - The lower bound for a buffer to be considered for stack 34894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman// smashing protection. 35894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Baumanstatic cl::opt<unsigned> 36894018228b0e0bdbd7aa7e8f47d4a9458789ca82John BaumanSSPBufferSize("stack-protector-buffer-size", cl::init(8), 37894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman cl::desc("Lower bound for a buffer to be considered for " 38894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman "stack protection")); 39894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman 40894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Baumannamespace { 41894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman class StackProtector : public FunctionPass { 42894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman /// TLI - Keep a pointer of a TargetLowering to consult for determining 43894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman /// target type sizes. 44894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman const TargetLowering *TLI; 45894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman 46894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman Function *F; 47894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman Module *M; 48894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman 4919bac1e08be200c31efd26f0f5fd144c9b3eefd3John Bauman DominatorTree* DT; 5019bac1e08be200c31efd26f0f5fd144c9b3eefd3John Bauman 51894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman /// InsertStackProtectors - Insert code into the prologue and epilogue of 52894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman /// the function. 53894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman /// 54894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman /// - The prologue code loads and stores the stack guard onto the stack. 55894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman /// - The epilogue checks the value stored in the prologue against the 56894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman /// original value. It calls __stack_chk_fail if they differ. 57894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman bool InsertStackProtectors(); 58894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman 59894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman /// CreateFailBB - Create a basic block to jump to when the stack protector 60894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman /// check fails. 61894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman BasicBlock *CreateFailBB(); 62894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman 63894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman /// RequiresStackProtector - Check whether or not this function needs a 64894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman /// stack protector based upon the stack protector level. 65894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman bool RequiresStackProtector() const; 66894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman public: 67894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman static char ID; // Pass identification, replacement for typeid. 6819bac1e08be200c31efd26f0f5fd144c9b3eefd3John Bauman StackProtector() : FunctionPass(ID), TLI(0) { 6919bac1e08be200c31efd26f0f5fd144c9b3eefd3John Bauman initializeStackProtectorPass(*PassRegistry::getPassRegistry()); 7019bac1e08be200c31efd26f0f5fd144c9b3eefd3John Bauman } 71894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman StackProtector(const TargetLowering *tli) 7219bac1e08be200c31efd26f0f5fd144c9b3eefd3John Bauman : FunctionPass(ID), TLI(tli) { 7319bac1e08be200c31efd26f0f5fd144c9b3eefd3John Bauman initializeStackProtectorPass(*PassRegistry::getPassRegistry()); 7419bac1e08be200c31efd26f0f5fd144c9b3eefd3John Bauman } 7519bac1e08be200c31efd26f0f5fd144c9b3eefd3John Bauman 7619bac1e08be200c31efd26f0f5fd144c9b3eefd3John Bauman virtual void getAnalysisUsage(AnalysisUsage &AU) const { 7719bac1e08be200c31efd26f0f5fd144c9b3eefd3John Bauman AU.addPreserved<DominatorTree>(); 7819bac1e08be200c31efd26f0f5fd144c9b3eefd3John Bauman } 79894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman 80894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman virtual bool runOnFunction(Function &Fn); 81894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman }; 82894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman} // end anonymous namespace 83894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman 84894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Baumanchar StackProtector::ID = 0; 85894018228b0e0bdbd7aa7e8f47d4a9458789ca82John BaumanINITIALIZE_PASS(StackProtector, "stack-protector", 8619bac1e08be200c31efd26f0f5fd144c9b3eefd3John Bauman "Insert stack protectors", false, false) 87894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman 88894018228b0e0bdbd7aa7e8f47d4a9458789ca82John BaumanFunctionPass *llvm::createStackProtectorPass(const TargetLowering *tli) { 89894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman return new StackProtector(tli); 90894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman} 91894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman 92894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Baumanbool StackProtector::runOnFunction(Function &Fn) { 93894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman F = &Fn; 94894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman M = F->getParent(); 9519bac1e08be200c31efd26f0f5fd144c9b3eefd3John Bauman DT = getAnalysisIfAvailable<DominatorTree>(); 96894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman 97894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman if (!RequiresStackProtector()) return false; 98894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman 99894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman return InsertStackProtectors(); 100894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman} 101894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman 102894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman/// RequiresStackProtector - Check whether or not this function needs a stack 103894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman/// protector based upon the stack protector level. The heuristic we use is to 104894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman/// add a guard variable to functions that call alloca, and functions with 105894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman/// buffers larger than SSPBufferSize bytes. 106894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Baumanbool StackProtector::RequiresStackProtector() const { 107894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman if (F->hasFnAttr(Attribute::StackProtectReq)) 108894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman return true; 109894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman 110894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman if (!F->hasFnAttr(Attribute::StackProtect)) 111894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman return false; 112894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman 113894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman const TargetData *TD = TLI->getTargetData(); 114894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman 115894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman for (Function::iterator I = F->begin(), E = F->end(); I != E; ++I) { 116894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman BasicBlock *BB = I; 117894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman 118894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman for (BasicBlock::iterator 119894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman II = BB->begin(), IE = BB->end(); II != IE; ++II) 120894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman if (AllocaInst *AI = dyn_cast<AllocaInst>(II)) { 121894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman if (AI->isArrayAllocation()) 122894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman // This is a call to alloca with a variable size. Emit stack 123894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman // protectors. 124894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman return true; 125894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman 12619bac1e08be200c31efd26f0f5fd144c9b3eefd3John Bauman if (ArrayType *AT = dyn_cast<ArrayType>(AI->getAllocatedType())) { 127894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman // We apparently only care about character arrays. 128894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman if (!AT->getElementType()->isIntegerTy(8)) 129894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman continue; 130894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman 131894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman // If an array has more than SSPBufferSize bytes of allocated space, 132894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman // then we emit stack protectors. 133894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman if (SSPBufferSize <= TD->getTypeAllocSize(AT)) 134894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman return true; 135894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman } 136894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman } 137894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman } 138894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman 139894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman return false; 140894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman} 141894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman 142894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman/// InsertStackProtectors - Insert code into the prologue and epilogue of the 143894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman/// function. 144894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman/// 145894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman/// - The prologue code loads and stores the stack guard onto the stack. 146894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman/// - The epilogue checks the value stored in the prologue against the original 147894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman/// value. It calls __stack_chk_fail if they differ. 148894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Baumanbool StackProtector::InsertStackProtectors() { 149894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman BasicBlock *FailBB = 0; // The basic block to jump to if check fails. 15019bac1e08be200c31efd26f0f5fd144c9b3eefd3John Bauman BasicBlock *FailBBDom = 0; // FailBB's dominator. 151894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman AllocaInst *AI = 0; // Place on stack that stores the stack guard. 152894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman Value *StackGuardVar = 0; // The stack guard variable. 153894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman 154894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman for (Function::iterator I = F->begin(), E = F->end(); I != E; ) { 155894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman BasicBlock *BB = I++; 156894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman ReturnInst *RI = dyn_cast<ReturnInst>(BB->getTerminator()); 157894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman if (!RI) continue; 158894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman 159894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman if (!FailBB) { 160894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman // Insert code into the entry block that stores the __stack_chk_guard 161894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman // variable onto the stack: 162894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman // 163894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman // entry: 164894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman // StackGuardSlot = alloca i8* 165894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman // StackGuard = load __stack_chk_guard 166894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman // call void @llvm.stackprotect.create(StackGuard, StackGuardSlot) 167894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman // 16819bac1e08be200c31efd26f0f5fd144c9b3eefd3John Bauman PointerType *PtrTy = Type::getInt8PtrTy(RI->getContext()); 169894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman unsigned AddressSpace, Offset; 170894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman if (TLI->getStackCookieLocation(AddressSpace, Offset)) { 171894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman Constant *OffsetVal = 172894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman ConstantInt::get(Type::getInt32Ty(RI->getContext()), Offset); 173894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman 174894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman StackGuardVar = ConstantExpr::getIntToPtr(OffsetVal, 175894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman PointerType::get(PtrTy, AddressSpace)); 176894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman } else { 177894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman StackGuardVar = M->getOrInsertGlobal("__stack_chk_guard", PtrTy); 178894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman } 179894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman 180894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman BasicBlock &Entry = F->getEntryBlock(); 181894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman Instruction *InsPt = &Entry.front(); 182894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman 18319bac1e08be200c31efd26f0f5fd144c9b3eefd3John Bauman AI = new AllocaInst(PtrTy, "StackGuardSlot", InsPt); 18419bac1e08be200c31efd26f0f5fd144c9b3eefd3John Bauman LoadInst *LI = new LoadInst(StackGuardVar, "StackGuard", false, InsPt); 185894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman 186894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman Value *Args[] = { LI, AI }; 187894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman CallInst:: 188894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman Create(Intrinsic::getDeclaration(M, Intrinsic::stackprotector), 18919bac1e08be200c31efd26f0f5fd144c9b3eefd3John Bauman Args, "", InsPt); 190894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman 191894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman // Create the basic block to jump to when the guard check fails. 192894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman FailBB = CreateFailBB(); 193894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman } 194894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman 195894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman // For each block with a return instruction, convert this: 196894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman // 197894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman // return: 198894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman // ... 199894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman // ret ... 200894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman // 201894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman // into this: 202894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman // 203894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman // return: 204894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman // ... 205894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman // %1 = load __stack_chk_guard 206894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman // %2 = load StackGuardSlot 207894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman // %3 = cmp i1 %1, %2 208894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman // br i1 %3, label %SP_return, label %CallStackCheckFailBlk 209894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman // 210894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman // SP_return: 211894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman // ret ... 212894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman // 213894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman // CallStackCheckFailBlk: 214894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman // call void @__stack_chk_fail() 215894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman // unreachable 216894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman 217894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman // Split the basic block before the return instruction. 21819bac1e08be200c31efd26f0f5fd144c9b3eefd3John Bauman BasicBlock *NewBB = BB->splitBasicBlock(RI, "SP_return"); 21919bac1e08be200c31efd26f0f5fd144c9b3eefd3John Bauman 22019bac1e08be200c31efd26f0f5fd144c9b3eefd3John Bauman if (DT && DT->isReachableFromEntry(BB)) { 22119bac1e08be200c31efd26f0f5fd144c9b3eefd3John Bauman DT->addNewBlock(NewBB, BB); 22219bac1e08be200c31efd26f0f5fd144c9b3eefd3John Bauman FailBBDom = FailBBDom ? DT->findNearestCommonDominator(FailBBDom, BB) :BB; 22319bac1e08be200c31efd26f0f5fd144c9b3eefd3John Bauman } 224894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman 225894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman // Remove default branch instruction to the new BB. 226894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman BB->getTerminator()->eraseFromParent(); 227894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman 228894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman // Move the newly created basic block to the point right after the old basic 229894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman // block so that it's in the "fall through" position. 230894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman NewBB->moveAfter(BB); 231894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman 232894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman // Generate the stack protector instructions in the old basic block. 233894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman LoadInst *LI1 = new LoadInst(StackGuardVar, "", false, BB); 234894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman LoadInst *LI2 = new LoadInst(AI, "", true, BB); 23519bac1e08be200c31efd26f0f5fd144c9b3eefd3John Bauman ICmpInst *Cmp = new ICmpInst(*BB, CmpInst::ICMP_EQ, LI1, LI2, ""); 236894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman BranchInst::Create(NewBB, FailBB, Cmp, BB); 237894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman } 238894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman 239894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman // Return if we didn't modify any basic blocks. I.e., there are no return 240894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman // statements in the function. 241894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman if (!FailBB) return false; 242894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman 24319bac1e08be200c31efd26f0f5fd144c9b3eefd3John Bauman if (DT && FailBBDom) 24419bac1e08be200c31efd26f0f5fd144c9b3eefd3John Bauman DT->addNewBlock(FailBB, FailBBDom); 24519bac1e08be200c31efd26f0f5fd144c9b3eefd3John Bauman 246894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman return true; 247894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman} 248894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman 249894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman/// CreateFailBB - Create a basic block to jump to when the stack protector 250894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman/// check fails. 251894018228b0e0bdbd7aa7e8f47d4a9458789ca82John BaumanBasicBlock *StackProtector::CreateFailBB() { 252894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman BasicBlock *FailBB = BasicBlock::Create(F->getContext(), 25319bac1e08be200c31efd26f0f5fd144c9b3eefd3John Bauman "CallStackCheckFailBlk", F); 254894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman Constant *StackChkFail = 255894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman M->getOrInsertFunction("__stack_chk_fail", 256894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman Type::getVoidTy(F->getContext()), NULL); 257894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman CallInst::Create(StackChkFail, "", FailBB); 258894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman new UnreachableInst(F->getContext(), FailBB); 259894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman return FailBB; 260894018228b0e0bdbd7aa7e8f47d4a9458789ca82John Bauman} 261