Skip to content

Commit 63c1be7

Browse files
authored
[llvm][fatlto] Add FatLTOCleanup pass (#125911)
When using FatLTO, it is common to want to enable certain types of whole program optimizations (WPD) or security transforms (CFI), so that they can be made available when performing LTO. However, these transforms should not be used when compiling the non-LTO object code. Since the frontend must emit different IR, we cannot simply clone the module and optimize the LTO section and non-LTO section differently to work around this. Instead, we need to remove any problematic instruction sequences. This patch adds a new pass whose responsibility is to clean up the IR in the FatLTO pipeline after creating the bitcode section, which is after running the pre-link pipeline but before running module optimization. This allows us to safely drop any conflicting instructions or IR constructs that are inappropriate for non-LTO compilation.
1 parent ecdfa36 commit 63c1be7

File tree

8 files changed

+296
-9
lines changed

8 files changed

+296
-9
lines changed

clang/test/CodeGen/fat-lto-objects-cfi.cpp

+53-9
Original file line numberDiff line numberDiff line change
@@ -1,21 +1,24 @@
11
// REQUIRES: x86-registered-target
22

3+
// RUN: rm -rf %t && split-file %s %t
34
// RUN: %clang_cc1 -triple x86_64-unknown-fuchsia -O2 -flto -ffat-lto-objects \
4-
// RUN: -fsanitize=cfi-icall -fsanitize-trap=cfi-icall -fvisibility=hidden -emit-llvm -o - %s \
5+
// RUN: -fsanitize=cfi-icall -fsanitize-trap=cfi-icall -fvisibility=hidden \
6+
// RUN: -emit-llvm -o - %t/a.cpp \
57
// RUN: | FileCheck %s --check-prefix=TYPE_TEST
68

9+
//--- a.cpp
710
// TYPE_TEST: llvm.embedded.object
811
// TYPE_TEST-SAME: section ".llvm.lto"
912

13+
// COM: The FatLTO pipeline should remove all llvm.type.test instructions.
1014
// TYPE_TEST-LABEL: define hidden void @foo
11-
// TYPE_TEST: entry:
12-
// TYPE_TEST-NEXT: %cmp14.not = icmp eq i64 %len, 0
13-
// TYPE_TEST-NEXT: br i1 %cmp14.not, label %for.end7, label %for.cond1.preheader.preheader
14-
// TYPE_TEST: for.cond1.preheader.preheader: ; preds = %entry
15-
// TYPE_TEST-NEXT: %arrayidx.1 = getelementptr inbounds nuw i8, ptr %ptr, i64 4
16-
// TYPE_TEST-NEXT: br label %for.cond1.preheader
17-
18-
// TYPE_TEST-NOT: @llvm.type.test
15+
// TYPE_TEST-NOT: @llvm.type.test
16+
// TYPE_TEST-NEXT: entry:
17+
// TYPE_TEST-NEXT: %cmp14.not = icmp eq i64 %len, 0
18+
// TYPE_TEST-NEXT: br i1 %cmp14.not, label %for.end7, label %for.cond1.preheader.preheader
19+
// TYPE_TEST-LABEL: for.cond1.preheader.preheader: ; preds = %entry
20+
// TYPE_TEST-NEXT: %arrayidx.1 = getelementptr inbounds nuw i8, ptr %ptr, i64 4
21+
// TYPE_TEST-NEXT: br label %for.cond1.preheader
1922

2023
// The code below is a reduced case from https://github.com/llvm/llvm-project/issues/112053
2124
#define __PRINTFLIKE(__fmt, __varargs) __attribute__((__format__(__printf__, __fmt, __varargs)))
@@ -44,3 +47,44 @@ void foo(const void* ptr, size_t len, long disp_addr,
4447
}
4548
}
4649

50+
//--- b.cpp
51+
// COM: Prior to the introduction of the FatLTO cleanup pass, this used to cause
52+
// COM: the backend to crash, either due to an assertion failure, or because
53+
// COM: the CFI instructions couldn't be correctly generated. So, check to make
54+
// COM: sure that the FatLTO pipeline used by clang does not regress.
55+
56+
// COM: Check the generated IR doesn't contain llvm.type.checked.load in the final IR.
57+
// RUN: %clang_cc1 -triple=x86_64-unknown-fuchsia -O1 -emit-llvm -o - \
58+
// RUN: -ffat-lto-objects -fvisibility=hidden \
59+
// RUN: -fno-rtti -fsanitize=cfi-icall,cfi-mfcall,cfi-nvcall,cfi-vcall \
60+
// RUN: -fsanitize-trap=cfi-icall,cfi-mfcall,cfi-nvcall,cfi-vcall \
61+
// RUN: -fwhole-program-vtables %t/b.cpp 2>&1 | FileCheck %s --check-prefix=NO_CHECKED_LOAD
62+
63+
// RUN: %clang_cc1 -triple=x86_64-unknown-fuchsia -O1 -emit-llvm -o - \
64+
// RUN: -ffat-lto-objects -fvisibility=hidden -fexperimental-relative-c++-abi-vtables \
65+
// RUN: -fno-rtti -fsanitize=cfi-icall,cfi-mfcall,cfi-nvcall,cfi-vcall \
66+
// RUN: -fsanitize-trap=cfi-icall,cfi-mfcall,cfi-nvcall,cfi-vcall \
67+
// RUN: -fwhole-program-vtables %t/b.cpp 2>&1 | FileCheck %s --check-prefix=NO_CHECKED_LOAD
68+
69+
// COM: Note that the embedded bitcode section will contain references to
70+
// COM: llvm.type.checked.load, so we need to match the function body first.
71+
// NO_CHECKED_LOAD-LABEL: entry:
72+
// NO_CHECKED_LOAD-NEXT: %vtable = load ptr, ptr %p1
73+
// NO_CHECKED_LOAD-NOT: llvm.type.checked.load
74+
// NO_CHECKED_LOAD-NEXT: %vfunc = load ptr, ptr %vtable
75+
// NO_CHECKED_LOAD-NEXT: %call = tail call {{.*}} %vfunc(ptr {{.*}} %p1)
76+
// NO_CHECKED_LOAD-NEXT: ret void
77+
78+
// COM: Ensure that we don't crash in the backend anymore when clang uses
79+
// COM: CFI checks with -ffat-lto-objects.
80+
// RUN: %clang_cc1 -triple=x86_64-unknown-fuchsia -O1 -emit-codegen-only \
81+
// RUN: -ffat-lto-objects -fvisibility=hidden \
82+
// RUN: -fno-rtti -fsanitize=cfi-icall,cfi-mfcall,cfi-nvcall,cfi-vcall \
83+
// RUN: -fsanitize-trap=cfi-icall,cfi-mfcall,cfi-nvcall,cfi-vcall \
84+
// RUN: -fwhole-program-vtables %t/b.cpp
85+
86+
class a {
87+
public:
88+
virtual long b();
89+
};
90+
void c(a &p1) { p1.b(); }
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
//===- FatLtoCleanup.h - clean up IR for the FatLTO pipeline ----*- C++ -*-===//
2+
//
3+
// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4+
// See https://llvm.org/LICENSE.txt for license information.
5+
// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6+
//
7+
//===----------------------------------------------------------------------===//
8+
//
9+
// This file defines operations used to clean up IR for the FatLTO pipeline.
10+
// Instrumentation that is beneficial for bitcode sections used in LTO may
11+
// need to be cleaned up to finish non-LTO compilation. llvm.checked.load is
12+
// an example of an instruction that we want to preserve for LTO, but is
13+
// incorrect to leave unchanged during the per-TU compilation in FatLTO.
14+
//
15+
//===----------------------------------------------------------------------===//
16+
17+
#ifndef LLVM_TRANSFORMS_IPO_FATLTOCLEANUP_H
18+
#define LLVM_TRANSFORMS_IPO_FATLTOCLEANUP_H
19+
20+
#include "llvm/IR/PassManager.h"
21+
22+
namespace llvm {
23+
24+
class Module;
25+
class ModuleSummaryIndex;
26+
27+
class FatLtoCleanup : public PassInfoMixin<FatLtoCleanup> {
28+
public:
29+
FatLtoCleanup() {}
30+
PreservedAnalyses run(Module &M, ModuleAnalysisManager &AM);
31+
static bool isRequired() { return true; }
32+
};
33+
34+
} // end namespace llvm
35+
36+
#endif // LLVM_TRANSFORMS_IPO_FATLTOCLEANUP_H

llvm/lib/Passes/PassBuilder.cpp

+1
Original file line numberDiff line numberDiff line change
@@ -184,6 +184,7 @@
184184
#include "llvm/Transforms/IPO/ElimAvailExtern.h"
185185
#include "llvm/Transforms/IPO/EmbedBitcodePass.h"
186186
#include "llvm/Transforms/IPO/ExpandVariadics.h"
187+
#include "llvm/Transforms/IPO/FatLTOCleanup.h"
187188
#include "llvm/Transforms/IPO/ForceFunctionAttrs.h"
188189
#include "llvm/Transforms/IPO/FunctionAttrs.h"
189190
#include "llvm/Transforms/IPO/FunctionImport.h"

llvm/lib/Passes/PassBuilderPipelines.cpp

+7
Original file line numberDiff line numberDiff line change
@@ -53,6 +53,7 @@
5353
#include "llvm/Transforms/IPO/ElimAvailExtern.h"
5454
#include "llvm/Transforms/IPO/EmbedBitcodePass.h"
5555
#include "llvm/Transforms/IPO/ExpandVariadics.h"
56+
#include "llvm/Transforms/IPO/FatLTOCleanup.h"
5657
#include "llvm/Transforms/IPO/ForceFunctionAttrs.h"
5758
#include "llvm/Transforms/IPO/FunctionAttrs.h"
5859
#include "llvm/Transforms/IPO/GlobalDCE.h"
@@ -1670,6 +1671,12 @@ PassBuilder::buildFatLTODefaultPipeline(OptimizationLevel Level, bool ThinLTO,
16701671
MPM.addPass(buildLTOPreLinkDefaultPipeline(Level));
16711672
MPM.addPass(EmbedBitcodePass(ThinLTO, EmitSummary));
16721673

1674+
// Perform any cleanups to the IR that aren't suitable for per TU compilation,
1675+
// like removing CFI/WPD related instructions. Note, we reuse
1676+
// LowerTypeTestsPass to clean up type tests rather than duplicate that logic
1677+
// in FatLtoCleanup.
1678+
MPM.addPass(FatLtoCleanup());
1679+
16731680
// If we're doing FatLTO w/ CFI enabled, we don't want the type tests in the
16741681
// object code, only in the bitcode section, so drop it before we run
16751682
// module optimization and generate machine code. If llvm.type.test() isn't in

llvm/lib/Passes/PassRegistry.def

+1
Original file line numberDiff line numberDiff line change
@@ -98,6 +98,7 @@ MODULE_PASS("lower-emutls", LowerEmuTLSPass())
9898
MODULE_PASS("lower-global-dtors", LowerGlobalDtorsPass())
9999
MODULE_PASS("lower-ifunc", LowerIFuncPass())
100100
MODULE_PASS("lowertypetests", LowerTypeTestsPass())
101+
MODULE_PASS("fatlto-cleanup", FatLtoCleanup())
101102
MODULE_PASS("pgo-force-function-attrs", PGOForceFunctionAttrsPass(PGOOpt ? PGOOpt->ColdOptType : PGOOptions::ColdFuncOpt::Default))
102103
MODULE_PASS("memprof-context-disambiguation", MemProfContextDisambiguation())
103104
MODULE_PASS("memprof-module", ModuleMemProfilerPass())

llvm/lib/Transforms/IPO/CMakeLists.txt

+1
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,7 @@ add_llvm_component_library(LLVMipo
1414
EmbedBitcodePass.cpp
1515
ExpandVariadics.cpp
1616
ExtractGV.cpp
17+
FatLTOCleanup.cpp
1718
ForceFunctionAttrs.cpp
1819
FunctionAttrs.cpp
1920
FunctionImport.cpp
+122
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,122 @@
1+
//===- FatLtoCleanup.cpp - clean up IR for the FatLTO pipeline --*- C++ -*-===//
2+
//
3+
// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4+
// See https://llvm.org/LICENSE.txt for license information.
5+
// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6+
//
7+
//===----------------------------------------------------------------------===//
8+
//
9+
// This file defines operations used to clean up IR for the FatLTO pipeline.
10+
// Instrumentation that is beneficial for bitcode sections used in LTO may
11+
// need to be cleaned up to finish non-LTO compilation. llvm.checked.load is
12+
// an example of an instruction that we want to preserve for LTO, but is
13+
// incorrect to leave unchanged during the per-TU compilation in FatLTO.
14+
//
15+
//===----------------------------------------------------------------------===//
16+
17+
#include "llvm/Transforms/IPO/FatLTOCleanup.h"
18+
#include "llvm/IR/Function.h"
19+
#include "llvm/IR/IRBuilder.h"
20+
#include "llvm/IR/Intrinsics.h"
21+
#include "llvm/IR/Module.h"
22+
#include "llvm/IR/PassManager.h"
23+
#include "llvm/IR/Use.h"
24+
#include "llvm/Support/Debug.h"
25+
26+
using namespace llvm;
27+
28+
#define DEBUG_TYPE "fatlto-cleanup"
29+
30+
namespace {
31+
// Replaces uses of llvm.type.checked.load instructions with unchecked loads.
32+
// In essence, we're undoing the frontends instrumentation, since it isn't
33+
// correct for the non-LTO part of a FatLTO object.
34+
//
35+
// llvm.type.checked.load instruction sequences always have a particular form:
36+
//
37+
// clang-format off
38+
//
39+
// %0 = tail call { ptr, i1 } @llvm.type.checked.load(ptr %vtable, i32 0, metadata !"foo"), !nosanitize !0
40+
// %1 = extractvalue { ptr, i1 } %0, 1, !nosanitize !0
41+
// br i1 %1, label %cont2, label %trap1, !nosanitize !0
42+
//
43+
// trap1: ; preds = %entry
44+
// tail call void @llvm.ubsantrap(i8 2) #3, !nosanitize !0
45+
// unreachable, !nosanitize !0
46+
//
47+
// cont2: ; preds = %entry
48+
// %2 = extractvalue { ptr, i1 } %0, 0, !nosanitize !0
49+
// %call = tail call noundef i64 %2(ptr noundef nonnull align 8 dereferenceable(8) %p1) #4
50+
//
51+
// clang-format on
52+
//
53+
// In this sequence, the vtable pointer is first loaded and checked against some
54+
// metadata. The result indicates failure, then the program traps. On the
55+
// success path, the pointer is used to make an indirect call to the function
56+
// pointer loaded from the vtable.
57+
//
58+
// Since we won't be able to lower this correctly later in non-LTO builds, we
59+
// need to drop the special load and trap, and emit a normal load of the
60+
// function pointer from the vtable.
61+
//
62+
// This is straight forward, since the checked load can be replaced w/ a load
63+
// of the vtable pointer and a GEP instruction to index into the vtable and get
64+
// the correct method/function pointer. We replace the "check" with a constant
65+
// indicating success, which allows later passes to simplify control flow and
66+
// remove any now dead instructions.
67+
//
68+
// This logic holds for both llvm.type.checked.load and
69+
// llvm.type.checked.load.relative instructions.
70+
static bool cleanUpTypeCheckedLoad(Module &M, Function &CheckedLoadFn,
71+
bool IsRelative) {
72+
bool Changed = false;
73+
for (User *User : llvm::make_early_inc_range(CheckedLoadFn.users())) {
74+
Instruction *I = dyn_cast<Instruction>(User);
75+
if (!I)
76+
continue;
77+
IRBuilder<> IRB(I);
78+
Value *Ptr = I->getOperand(0);
79+
Value *Offset = I->getOperand(1);
80+
Type *PtrTy = I->getType()->getStructElementType(0);
81+
ConstantInt *True = ConstantInt::getTrue(M.getContext());
82+
Instruction *Load;
83+
if (IsRelative) {
84+
Load =
85+
IRB.CreateIntrinsic(Intrinsic::load_relative, {Offset->getType()},
86+
{Ptr, Offset}, /*FMFSource=*/nullptr, "rel_load");
87+
} else {
88+
Value *PtrAdd = IRB.CreatePtrAdd(Ptr, Offset);
89+
Load = IRB.CreateLoad(PtrTy, PtrAdd, "vfunc");
90+
}
91+
92+
Value *Replacement = PoisonValue::get(I->getType());
93+
Replacement = IRB.CreateInsertValue(Replacement, True, {1});
94+
Replacement = IRB.CreateInsertValue(Replacement, Load, {0});
95+
I->replaceAllUsesWith(Replacement);
96+
97+
LLVM_DEBUG(dbgs() << DEBUG_TYPE << ": erase " << *I << "\n");
98+
I->eraseFromParent();
99+
Changed = true;
100+
}
101+
if (Changed)
102+
CheckedLoadFn.eraseFromParent();
103+
return Changed;
104+
}
105+
} // namespace
106+
107+
PreservedAnalyses FatLtoCleanup::run(Module &M, ModuleAnalysisManager &AM) {
108+
Function *TypeCheckedLoadFn =
109+
Intrinsic::getDeclarationIfExists(&M, Intrinsic::type_checked_load);
110+
Function *TypeCheckedLoadRelFn = Intrinsic::getDeclarationIfExists(
111+
&M, Intrinsic::type_checked_load_relative);
112+
113+
bool Changed = false;
114+
if (TypeCheckedLoadFn)
115+
Changed |= cleanUpTypeCheckedLoad(M, *TypeCheckedLoadFn, false);
116+
if (TypeCheckedLoadRelFn)
117+
Changed |= cleanUpTypeCheckedLoad(M, *TypeCheckedLoadRelFn, true);
118+
119+
if (Changed)
120+
return PreservedAnalyses::none();
121+
return PreservedAnalyses::all();
122+
}
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,75 @@
1+
; NOTE: Assertions have been autogenerated by utils/update_test_checks.py UTC_ARGS: --version 5
2+
3+
; RUN: opt -passes="fatlto-cleanup" < %s -S | FileCheck %s
4+
5+
declare void @llvm.ubsantrap(i8 immarg)
6+
declare { ptr, i1 } @llvm.type.checked.load(ptr, i32, metadata)
7+
declare { ptr, i1 } @llvm.type.checked.load.relative(ptr, i32, metadata)
8+
9+
define hidden void @foo(ptr %p1) {
10+
; CHECK-LABEL: define hidden void @foo(
11+
; CHECK-SAME: ptr [[P1:%.*]]) {
12+
; CHECK-NEXT: [[ENTRY:.*:]]
13+
; CHECK-NEXT: [[VTABLE:%.*]] = load ptr, ptr [[P1]], align 8
14+
; CHECK-NEXT: [[TMP0:%.*]] = getelementptr i8, ptr [[VTABLE]], i32 0
15+
; CHECK-NEXT: [[VFUNC:%.*]] = load ptr, ptr [[TMP0]], align 8
16+
; CHECK-NEXT: [[TMP2:%.*]] = insertvalue { ptr, i1 } { ptr poison, i1 true }, ptr [[VFUNC]], 0
17+
; CHECK-NEXT: [[TMP3:%.*]] = extractvalue { ptr, i1 } [[TMP2]], 1
18+
; CHECK-NEXT: br i1 [[TMP3]], label %[[CONT2:.*]], label %[[TRAP1:.*]]
19+
; CHECK: [[TRAP1]]:
20+
; CHECK-NEXT: tail call void @llvm.ubsantrap(i8 2)
21+
; CHECK-NEXT: unreachable
22+
; CHECK: [[CONT2]]:
23+
; CHECK-NEXT: [[TMP4:%.*]] = extractvalue { ptr, i1 } [[TMP2]], 0
24+
; CHECK-NEXT: [[CALL:%.*]] = tail call noundef i64 [[TMP4]](ptr noundef nonnull align 8 dereferenceable(8) [[P1]])
25+
; CHECK-NEXT: ret void
26+
;
27+
entry:
28+
%vtable = load ptr, ptr %p1, align 8
29+
%0 = tail call { ptr, i1 } @llvm.type.checked.load(ptr %vtable, i32 0, metadata !"_ZTS1a")
30+
%1 = extractvalue { ptr, i1 } %0, 1
31+
br i1 %1, label %cont2, label %trap1
32+
33+
trap1:
34+
tail call void @llvm.ubsantrap(i8 2)
35+
unreachable
36+
37+
cont2:
38+
%2 = extractvalue { ptr, i1 } %0, 0
39+
%call = tail call noundef i64 %2(ptr noundef nonnull align 8 dereferenceable(8) %p1)
40+
ret void
41+
}
42+
43+
define hidden void @relative.vtable(ptr %p1) {
44+
; CHECK-LABEL: define hidden void @relative.vtable(
45+
; CHECK-SAME: ptr [[P1:%.*]]) {
46+
; CHECK-NEXT: [[ENTRY:.*:]]
47+
; CHECK-NEXT: [[VTABLE:%.*]] = load ptr, ptr [[P1]], align 8
48+
; CHECK-NEXT: [[REL_LOAD:%.*]] = call ptr @llvm.load.relative.i32(ptr [[VTABLE]], i32 0)
49+
; CHECK-NEXT: [[TMP2:%.*]] = insertvalue { ptr, i1 } { ptr poison, i1 true }, ptr [[REL_LOAD]], 0
50+
; CHECK-NEXT: [[TMP3:%.*]] = extractvalue { ptr, i1 } [[TMP2]], 1
51+
; CHECK-NEXT: br i1 [[TMP3]], label %[[CONT2:.*]], label %[[TRAP1:.*]]
52+
; CHECK: [[TRAP1]]:
53+
; CHECK-NEXT: tail call void @llvm.ubsantrap(i8 2)
54+
; CHECK-NEXT: unreachable
55+
; CHECK: [[CONT2]]:
56+
; CHECK-NEXT: [[TMP4:%.*]] = extractvalue { ptr, i1 } [[TMP2]], 0
57+
; CHECK-NEXT: [[CALL:%.*]] = tail call noundef i64 [[TMP4]](ptr noundef nonnull align 8 dereferenceable(8) [[P1]])
58+
; CHECK-NEXT: ret void
59+
;
60+
entry:
61+
%vtable = load ptr, ptr %p1, align 8
62+
%0 = tail call { ptr, i1 } @llvm.type.checked.load.relative(ptr %vtable, i32 0, metadata !"rel.vtable.type")
63+
%1 = extractvalue { ptr, i1 } %0, 1
64+
br i1 %1, label %cont2, label %trap1
65+
66+
trap1:
67+
tail call void @llvm.ubsantrap(i8 2)
68+
unreachable
69+
70+
cont2:
71+
%2 = extractvalue { ptr, i1 } %0, 0
72+
%call = tail call noundef i64 %2(ptr noundef nonnull align 8 dereferenceable(8) %p1)
73+
ret void
74+
}
75+

0 commit comments

Comments
 (0)