mirror of
https://github.com/RPCSX/llvm.git
synced 2025-02-20 21:14:28 +00:00

Summary: This patch is adding support for the MSVC buffer security check implementation The buffer security check is turned on with the '/GS' compiler switch. * https://msdn.microsoft.com/en-us/library/8dbf701c.aspx * To be added to clang here: http://reviews.llvm.org/D20347 Some overview of buffer security check feature and implementation: * https://msdn.microsoft.com/en-us/library/aa290051(VS.71).aspx * http://www.ksyash.com/2011/01/buffer-overflow-protection-3/ * http://blog.osom.info/2012/02/understanding-vs-c-compilers-buffer.html For the following example: ``` int example(int offset, int index) { char buffer[10]; memset(buffer, 0xCC, index); return buffer[index]; } ``` The MSVC compiler is adding these instructions to perform stack integrity check: ``` push ebp mov ebp,esp sub esp,50h [1] mov eax,dword ptr [__security_cookie (01068024h)] [2] xor eax,ebp [3] mov dword ptr [ebp-4],eax push ebx push esi push edi mov eax,dword ptr [index] push eax push 0CCh lea ecx,[buffer] push ecx call _memset (010610B9h) add esp,0Ch mov eax,dword ptr [index] movsx eax,byte ptr buffer[eax] pop edi pop esi pop ebx [4] mov ecx,dword ptr [ebp-4] [5] xor ecx,ebp [6] call @__security_check_cookie@4 (01061276h) mov esp,ebp pop ebp ret ``` The instrumentation above is: * [1] is loading the global security canary, * [3] is storing the local computed ([2]) canary to the guard slot, * [4] is loading the guard slot and ([5]) re-compute the global canary, * [6] is validating the resulting canary with the '__security_check_cookie' and performs error handling. Overview of the current stack-protection implementation: * lib/CodeGen/StackProtector.cpp * There is a default stack-protection implementation applied on intermediate representation. * The target can overload 'getIRStackGuard' method if it has a standard location for the stack protector cookie. * An intrinsic 'Intrinsic::stackprotector' is added to the prologue. It will be expanded by the instruction selection pass (DAG or Fast). * Basic Blocks are added to every instrumented function to receive the code for handling stack guard validation and errors handling. * Guard manipulation and comparison are added directly to the intermediate representation. * lib/CodeGen/SelectionDAG/SelectionDAGISel.cpp * lib/CodeGen/SelectionDAG/SelectionDAGBuilder.cpp * There is an implementation that adds instrumentation during instruction selection (for better handling of sibbling calls). * see long comment above 'class StackProtectorDescriptor' declaration. * The target needs to override 'getSDagStackGuard' to activate SDAG stack protection generation. (note: getIRStackGuard MUST be nullptr). * 'getSDagStackGuard' returns the appropriate stack guard (security cookie) * The code is generated by 'SelectionDAGBuilder.cpp' and 'SelectionDAGISel.cpp'. * include/llvm/Target/TargetLowering.h * Contains function to retrieve the default Guard 'Value'; should be overriden by each target to select which implementation is used and provide Guard 'Value'. * lib/Target/X86/X86ISelLowering.cpp * Contains the x86 specialisation; Guard 'Value' used by the SelectionDAG algorithm. Function-based Instrumentation: * The MSVC doesn't inline the stack guard comparison in every function. Instead, a call to '__security_check_cookie' is added to the epilogue before every return instructions. * To support function-based instrumentation, this patch is * adding a function to get the function-based check (llvm 'Value', see include/llvm/Target/TargetLowering.h), * If provided, the stack protection instrumentation won't be inlined and a call to that function will be added to the prologue. * modifying (SelectionDAGISel.cpp) do avoid producing basic blocks used for inline instrumentation, * generating the function-based instrumentation during the ISEL pass (SelectionDAGBuilder.cpp), * if FastISEL (not SelectionDAG), using the fallback which rely on the same function-based implemented over intermediate representation (StackProtector.cpp). Modifications * adding support for MSVC (lib/Target/X86/X86ISelLowering.cpp) * adding support function-based instrumentation (lib/CodeGen/SelectionDAG/SelectionDAGBuilder.cpp, .h) Results * IR generated instrumentation: ``` clang-cl /GS test.cc /Od /c -mllvm -print-isel-input ``` ``` *** Final LLVM Code input to ISel *** ; Function Attrs: nounwind sspstrong define i32 @"\01?example@@YAHHH@Z"(i32 %offset, i32 %index) #0 { entry: %StackGuardSlot = alloca i8* <<<-- Allocated guard slot %0 = call i8* @llvm.stackguard() <<<-- Loading Stack Guard value call void @llvm.stackprotector(i8* %0, i8** %StackGuardSlot) <<<-- Prologue intrinsic call (store to Guard slot) %index.addr = alloca i32, align 4 %offset.addr = alloca i32, align 4 %buffer = alloca [10 x i8], align 1 store i32 %index, i32* %index.addr, align 4 store i32 %offset, i32* %offset.addr, align 4 %arraydecay = getelementptr inbounds [10 x i8], [10 x i8]* %buffer, i32 0, i32 0 %1 = load i32, i32* %index.addr, align 4 call void @llvm.memset.p0i8.i32(i8* %arraydecay, i8 -52, i32 %1, i32 1, i1 false) %2 = load i32, i32* %index.addr, align 4 %arrayidx = getelementptr inbounds [10 x i8], [10 x i8]* %buffer, i32 0, i32 %2 %3 = load i8, i8* %arrayidx, align 1 %conv = sext i8 %3 to i32 %4 = load volatile i8*, i8** %StackGuardSlot <<<-- Loading Guard slot call void @__security_check_cookie(i8* %4) <<<-- Epilogue function-based check ret i32 %conv } ``` * SelectionDAG generated instrumentation: ``` clang-cl /GS test.cc /O1 /c /FA ``` ``` "?example@@YAHHH@Z": # @"\01?example@@YAHHH@Z" # BB#0: # %entry pushl %esi subl $16, %esp movl ___security_cookie, %eax <<<-- Loading Stack Guard value movl 28(%esp), %esi movl %eax, 12(%esp) <<<-- Store to Guard slot leal 2(%esp), %eax pushl %esi pushl $204 pushl %eax calll _memset addl $12, %esp movsbl 2(%esp,%esi), %esi movl 12(%esp), %ecx <<<-- Loading Guard slot calll @__security_check_cookie@4 <<<-- Epilogue function-based check movl %esi, %eax addl $16, %esp popl %esi retl ``` Reviewers: kcc, pcc, eugenis, rnk Subscribers: majnemer, llvm-commits, hans, thakis, rnk Differential Revision: http://reviews.llvm.org/D20346 git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@272053 91177308-0d34-0410-b5e6-96231b3b80d8
//===---------------------------------------------------------------------===// Common register allocation / spilling problem: mul lr, r4, lr str lr, [sp, #+52] ldr lr, [r1, #+32] sxth r3, r3 ldr r4, [sp, #+52] mla r4, r3, lr, r4 can be: mul lr, r4, lr mov r4, lr str lr, [sp, #+52] ldr lr, [r1, #+32] sxth r3, r3 mla r4, r3, lr, r4 and then "merge" mul and mov: mul r4, r4, lr str r4, [sp, #+52] ldr lr, [r1, #+32] sxth r3, r3 mla r4, r3, lr, r4 It also increase the likelihood the store may become dead. //===---------------------------------------------------------------------===// bb27 ... ... %reg1037 = ADDri %reg1039, 1 %reg1038 = ADDrs %reg1032, %reg1039, %NOREG, 10 Successors according to CFG: 0x8b03bf0 (#5) bb76 (0x8b03bf0, LLVM BB @0x8b032d0, ID#5): Predecessors according to CFG: 0x8b0c5f0 (#3) 0x8b0a7c0 (#4) %reg1039 = PHI %reg1070, mbb<bb76.outer,0x8b0c5f0>, %reg1037, mbb<bb27,0x8b0a7c0> Note ADDri is not a two-address instruction. However, its result %reg1037 is an operand of the PHI node in bb76 and its operand %reg1039 is the result of the PHI node. We should treat it as a two-address code and make sure the ADDri is scheduled after any node that reads %reg1039. //===---------------------------------------------------------------------===// Use local info (i.e. register scavenger) to assign it a free register to allow reuse: ldr r3, [sp, #+4] add r3, r3, #3 ldr r2, [sp, #+8] add r2, r2, #2 ldr r1, [sp, #+4] <== add r1, r1, #1 ldr r0, [sp, #+4] add r0, r0, #2 //===---------------------------------------------------------------------===// LLVM aggressively lift CSE out of loop. Sometimes this can be negative side- effects: R1 = X + 4 R2 = X + 7 R3 = X + 15 loop: load [i + R1] ... load [i + R2] ... load [i + R3] Suppose there is high register pressure, R1, R2, R3, can be spilled. We need to implement proper re-materialization to handle this: R1 = X + 4 R2 = X + 7 R3 = X + 15 loop: R1 = X + 4 @ re-materialized load [i + R1] ... R2 = X + 7 @ re-materialized load [i + R2] ... R3 = X + 15 @ re-materialized load [i + R3] Furthermore, with re-association, we can enable sharing: R1 = X + 4 R2 = X + 7 R3 = X + 15 loop: T = i + X load [T + 4] ... load [T + 7] ... load [T + 15] //===---------------------------------------------------------------------===// It's not always a good idea to choose rematerialization over spilling. If all the load / store instructions would be folded then spilling is cheaper because it won't require new live intervals / registers. See 2003-05-31-LongShifts for an example. //===---------------------------------------------------------------------===// With a copying garbage collector, derived pointers must not be retained across collector safe points; the collector could move the objects and invalidate the derived pointer. This is bad enough in the first place, but safe points can crop up unpredictably. Consider: %array = load { i32, [0 x %obj] }** %array_addr %nth_el = getelementptr { i32, [0 x %obj] }* %array, i32 0, i32 %n %old = load %obj** %nth_el %z = div i64 %x, %y store %obj* %new, %obj** %nth_el If the i64 division is lowered to a libcall, then a safe point will (must) appear for the call site. If a collection occurs, %array and %nth_el no longer point into the correct object. The fix for this is to copy address calculations so that dependent pointers are never live across safe point boundaries. But the loads cannot be copied like this if there was an intervening store, so may be hard to get right. Only a concurrent mutator can trigger a collection at the libcall safe point. So single-threaded programs do not have this requirement, even with a copying collector. Still, LLVM optimizations would probably undo a front-end's careful work. //===---------------------------------------------------------------------===// The ocaml frametable structure supports liveness information. It would be good to support it. //===---------------------------------------------------------------------===// The FIXME in ComputeCommonTailLength in BranchFolding.cpp needs to be revisited. The check is there to work around a misuse of directives in inline assembly. //===---------------------------------------------------------------------===// It would be good to detect collector/target compatibility instead of silently doing the wrong thing. //===---------------------------------------------------------------------===// It would be really nice to be able to write patterns in .td files for copies, which would eliminate a bunch of explicit predicates on them (e.g. no side effects). Once this is in place, it would be even better to have tblgen synthesize the various copy insertion/inspection methods in TargetInstrInfo. //===---------------------------------------------------------------------===// Stack coloring improvements: 1. Do proper LiveStackAnalysis on all stack objects including those which are not spill slots. 2. Reorder objects to fill in gaps between objects. e.g. 4, 1, <gap>, 4, 1, 1, 1, <gap>, 4 => 4, 1, 1, 1, 1, 4, 4 //===---------------------------------------------------------------------===// The scheduler should be able to sort nearby instructions by their address. For example, in an expanded memset sequence it's not uncommon to see code like this: movl $0, 4(%rdi) movl $0, 8(%rdi) movl $0, 12(%rdi) movl $0, 0(%rdi) Each of the stores is independent, and the scheduler is currently making an arbitrary decision about the order. //===---------------------------------------------------------------------===// Another opportunitiy in this code is that the $0 could be moved to a register: movl $0, 4(%rdi) movl $0, 8(%rdi) movl $0, 12(%rdi) movl $0, 0(%rdi) This would save substantial code size, especially for longer sequences like this. It would be easy to have a rule telling isel to avoid matching MOV32mi if the immediate has more than some fixed number of uses. It's more involved to teach the register allocator how to do late folding to recover from excessive register pressure.