Page MenuHomePhabricator

[X86] Control-Flow Enforcement Technology - Shadow Stack support (LLVM side)
ClosedPublic

Authored by oren_ben_simhon on Nov 19 2017, 5:15 AM.

Details

Summary

Control Flow Enforcement Technology (CET) provides HW capabilities to defend against Return Oriented Programming (ROP) attack and similarly Call/Jmp Oriented Programming (COP/JOP) attack.

Control flow subversion attacks are handled using two CET’s mechanisms:

  1. Shadow Stack (SHSTK) – return address protection to defend against ROP.
  2. Indirect Branch Tracking (IBT) – free branch protection to defend against JOP/COP.

Shadow stack solution introduces a new stack for return addresses only. The HW has a Shadow Stack Pointer (SSP) that points to the next return address. If we return to a different address, an exception is triggered.
The shadow stack is managed using a series of intrinsics that are introduced in this patch as well as the new register (SSP). The intrinsics are mapped to new instruction set that implements CET mechanism.
The patch also includes initial infrastructure support for IBT.

For more information, please see the following:
https://software.intel.com/sites/default/files/managed/4d/2a/control-flow-enforcement-technology-preview.pdf

Diff Detail

Repository
rL LLVM

Event Timeline

craig.topper added inline comments.Nov 19 2017, 3:07 PM
lib/Support/Host.cpp
1251 ↗(On Diff #123496)

Please keep the leaf7 ECX bits with the others at line 1262.

lib/Target/X86/X86InstrSystem.td
506 ↗(On Diff #123496)

Please limit lines to 80 columns.

oren_ben_simhon marked 2 inline comments as done.

Implemented comments posted until 11/19 (Thanks Craig)

Removed redundant FeatureCET flag.

craig.topper added inline comments.Nov 21 2017, 8:38 PM
lib/Support/Host.cpp
1264 ↗(On Diff #123837)

This section needs to be rebased. Just make sure you put the bits in order when you do.

lib/Target/X86/X86InstrInfo.td
875 ↗(On Diff #123837)

I don't think there's any need for the AssemblerPredicates. We don't do fine grained feature enabling for the assembler.

lib/Target/X86/X86InstrSystem.td
496 ↗(On Diff #123837)

Don't put spaces around the color between GR32 and $src. Same with all the places below this.

oren_ben_simhon marked 3 inline comments as done.Nov 22 2017, 6:57 AM

Implemented comments posted until 11/21 (Thanks Craig)

This revision is now accepted and ready to land.Nov 22 2017, 9:47 AM
This revision was automatically updated to reflect the committed changes.

Following comments by Craig and Simon, is it possible to add the MC tests for CET 32bit?
You can use the 32bit tests in https://reviews.llvm.org/D41329