mirror of
https://github.com/RPCS3/llvm-mirror.git
synced 2024-10-22 04:22:57 +02:00
9efb6203d0
This patch aims to match the changes introduced in gcc by https://gcc.gnu.org/ml/gcc-cvs/2018-04/msg00534.html. The IBT feature definition is removed, with the IBT instructions being freely available on all X86 targets. The shadow stack instructions are also being made freely available, and the use of all these CET instructions is controlled by the module flags derived from the -fcf-protection clang option. The hasSHSTK option remains since clang uses it to determine availability of shadow stack instruction intrinsics, but it is no longer directly used. Comes with a clang patch (D46881). Patch by mike.dvoretsky Differential Revision: https://reviews.llvm.org/D46882 llvm-svn: 332705
122 lines
4.1 KiB
C++
122 lines
4.1 KiB
C++
//===---- X86IndirectBranchTracking.cpp - Enables CET IBT mechanism -------===//
|
|
//
|
|
// The LLVM Compiler Infrastructure
|
|
//
|
|
// This file is distributed under the University of Illinois Open Source
|
|
// License. See LICENSE.TXT for details.
|
|
//
|
|
//===----------------------------------------------------------------------===//
|
|
//
|
|
// This file defines a pass that enables Indirect Branch Tracking (IBT) as part
|
|
// of Control-Flow Enforcement Technology (CET).
|
|
// The pass adds ENDBR (End Branch) machine instructions at the beginning of
|
|
// each basic block or function that is referenced by an indrect jump/call
|
|
// instruction.
|
|
// The ENDBR instructions have a NOP encoding and as such are ignored in
|
|
// targets that do not support CET IBT mechanism.
|
|
//===----------------------------------------------------------------------===//
|
|
|
|
#include "X86.h"
|
|
#include "X86InstrInfo.h"
|
|
#include "X86Subtarget.h"
|
|
#include "llvm/ADT/Statistic.h"
|
|
#include "llvm/CodeGen/MachineFunctionPass.h"
|
|
#include "llvm/CodeGen/MachineInstrBuilder.h"
|
|
#include "llvm/CodeGen/MachineModuleInfo.h"
|
|
|
|
using namespace llvm;
|
|
|
|
#define DEBUG_TYPE "x86-indirect-branch-tracking"
|
|
|
|
static cl::opt<bool> IndirectBranchTracking(
|
|
"x86-indirect-branch-tracking", cl::init(false), cl::Hidden,
|
|
cl::desc("Enable X86 indirect branch tracking pass."));
|
|
|
|
STATISTIC(NumEndBranchAdded, "Number of ENDBR instructions added");
|
|
|
|
namespace {
|
|
class X86IndirectBranchTrackingPass : public MachineFunctionPass {
|
|
public:
|
|
X86IndirectBranchTrackingPass() : MachineFunctionPass(ID) {}
|
|
|
|
StringRef getPassName() const override {
|
|
return "X86 Indirect Branch Tracking";
|
|
}
|
|
|
|
bool runOnMachineFunction(MachineFunction &MF) override;
|
|
|
|
private:
|
|
static char ID;
|
|
|
|
/// Machine instruction info used throughout the class.
|
|
const X86InstrInfo *TII;
|
|
|
|
/// Endbr opcode for the current machine function.
|
|
unsigned int EndbrOpcode;
|
|
|
|
/// Adds a new ENDBR instruction to the begining of the MBB.
|
|
/// The function will not add it if already exists.
|
|
/// It will add ENDBR32 or ENDBR64 opcode, depending on the target.
|
|
/// \returns true if the ENDBR was added and false otherwise.
|
|
bool addENDBR(MachineBasicBlock &MBB) const;
|
|
};
|
|
|
|
} // end anonymous namespace
|
|
|
|
char X86IndirectBranchTrackingPass::ID = 0;
|
|
|
|
FunctionPass *llvm::createX86IndirectBranchTrackingPass() {
|
|
return new X86IndirectBranchTrackingPass();
|
|
}
|
|
|
|
bool X86IndirectBranchTrackingPass::addENDBR(MachineBasicBlock &MBB) const {
|
|
assert(TII && "Target instruction info was not initialized");
|
|
assert((X86::ENDBR64 == EndbrOpcode || X86::ENDBR32 == EndbrOpcode) &&
|
|
"Unexpected Endbr opcode");
|
|
|
|
auto MI = MBB.begin();
|
|
// If the MBB is empty or the first instruction is not ENDBR,
|
|
// add the ENDBR instruction to the beginning of the MBB.
|
|
if (MI == MBB.end() || EndbrOpcode != MI->getOpcode()) {
|
|
BuildMI(MBB, MI, MBB.findDebugLoc(MI), TII->get(EndbrOpcode));
|
|
NumEndBranchAdded++;
|
|
return true;
|
|
}
|
|
|
|
return false;
|
|
}
|
|
|
|
bool X86IndirectBranchTrackingPass::runOnMachineFunction(MachineFunction &MF) {
|
|
const X86Subtarget &SubTarget = MF.getSubtarget<X86Subtarget>();
|
|
|
|
// Check that the cf-protection-branch is enabled.
|
|
Metadata *isCFProtectionSupported =
|
|
MF.getMMI().getModule()->getModuleFlag("cf-protection-branch");
|
|
if (!isCFProtectionSupported && !IndirectBranchTracking)
|
|
return false;
|
|
|
|
// True if the current MF was changed and false otherwise.
|
|
bool Changed = false;
|
|
|
|
TII = SubTarget.getInstrInfo();
|
|
EndbrOpcode = SubTarget.is64Bit() ? X86::ENDBR64 : X86::ENDBR32;
|
|
|
|
// Non-internal function or function whose address was taken, can be
|
|
// accessed through indirect calls. Mark the first BB with ENDBR instruction
|
|
// unless nocf_check attribute is used.
|
|
if ((MF.getFunction().hasAddressTaken() ||
|
|
!MF.getFunction().hasLocalLinkage()) &&
|
|
!MF.getFunction().doesNoCfCheck()) {
|
|
auto MBB = MF.begin();
|
|
Changed |= addENDBR(*MBB);
|
|
}
|
|
|
|
for (auto &MBB : MF)
|
|
// Find all basic blocks that their address was taken (for example
|
|
// in the case of indirect jump) and add ENDBR instruction.
|
|
if (MBB.hasAddressTaken())
|
|
Changed |= addENDBR(MBB);
|
|
|
|
return Changed;
|
|
}
|