[X86][CET] Changing -fcf-protection behavior to comply with gcc (LLVM part)

[mike.dvoretsky]

Summary

This patch aims to match the changes introduced in gcc by https://gcc.gnu.org/ml/gcc-cvs/2018-04/msg00534.html. The IBT feature definition is removed, with the IBT instructions being freely available on all X86 targets. The shadow stack instructions are also being made freely available, and the use of all these CET instructions is controlled by the module flags derived from the -fcf-protection clang option. The hasSHSTK option remains since clang uses it to determine availability of shadow stack instruction intrinsics, but it is no longer directly used.

Comes with a clang patch (D46881).

[craig.topper]

Do we need to do something for the FIXMEs?

[mike.dvoretsky]

Replaced FIXMEs with more appropriate cautionary comments. They do not need to be addressed directly by any patches, so much as they served to warn about using the instructions carelessly now that there is no longer a simple way to restrict their usage.

[craig.topper]

LGTM if you remove that one FIXME that's still in there.

llvm/lib/Target/X86/X86InstrControl.td

329 ↗

(On Diff #147004)

Please replace this FIXME before commit.

[mike.dvoretsky]

Removed the missed FIXME.

[rja]

LG

llvm/trunk/lib/Support/Host.cpp

bool sys::getHostCPUFeatures(StringMap<bool> &Features) {
   Features["avx512vnni"]      = HasLeaf7 && ((ECX >> 11) & 1) && HasAVX512Save;
   Features["avx512bitalg"]    = HasLeaf7 && ((ECX >> 12) & 1) && HasAVX512Save;
   Features["avx512vpopcntdq"] = HasLeaf7 && ((ECX >> 14) & 1) && HasAVX512Save;
   Features["rdpid"]           = HasLeaf7 && ((ECX >> 22) & 1);
   Features["cldemote"]        = HasLeaf7 && ((ECX >> 25) & 1);
   Features["movdiri"]         = HasLeaf7 && ((ECX >> 27) & 1);
   Features["movdir64b"]       = HasLeaf7 && ((ECX >> 28) & 1);
 
-  Features["ibt"] = HasLeaf7 && ((EDX >> 20) & 1);
-
   // There are two CPUID leafs which information associated with the pconfig
   // instruction:
   // EAX=0x7, ECX=0x0 indicates the availability of the instruction (via the 18th
   // bit of EDX), while the EAX=0x1b leaf returns information on the
   // availability of specific pconfig leafs.
   // The target feature here only refers to the the first of these two.
   // Users might need to check for the availability of specific pconfig
   // leaves using cpuid, since that information is ignored while

llvm/trunk/lib/Target/X86/X86.td

def FeatureRTM     : SubtargetFeature<"rtm", "HasRTM", "true",
                                       "Support RTM instructions">;
 def FeatureADX     : SubtargetFeature<"adx", "HasADX", "true",
                                       "Support ADX instructions">;
 def FeatureSHA     : SubtargetFeature<"sha", "HasSHA", "true",
                                       "Enable SHA instructions",
                                       [FeatureSSE2]>;
 def FeatureSHSTK   : SubtargetFeature<"shstk", "HasSHSTK", "true",
                        "Support CET Shadow-Stack instructions">;
-def FeatureIBT     : SubtargetFeature<"ibt", "HasIBT", "true",
-                       "Support CET Indirect-Branch-Tracking instructions">;
 def FeaturePRFCHW  : SubtargetFeature<"prfchw", "HasPRFCHW", "true",
                                       "Support PRFCHW instructions">;
 def FeatureRDSEED  : SubtargetFeature<"rdseed", "HasRDSEED", "true",
                                       "Support RDSEED instruction">;
 def FeatureLAHFSAHF : SubtargetFeature<"sahf", "HasLAHFSAHF", "true",
                                        "Support LAHF and SAHF instructions">;
 def FeatureMWAITX  : SubtargetFeature<"mwaitx", "HasMWAITX", "true",
                                       "Enable MONITORX/MWAITX timer functionality">;

llvm/trunk/lib/Target/X86/X86IndirectBranchTracking.cpp

bool X86IndirectBranchTrackingPass::addENDBR(MachineBasicBlock &MBB) const {
   }
 
   return false;
 }
 
 bool X86IndirectBranchTrackingPass::runOnMachineFunction(MachineFunction &MF) {
   const X86Subtarget &SubTarget = MF.getSubtarget<X86Subtarget>();
 
-  // Make sure that the target supports IBT instruction.
-  if (!SubTarget.hasIBT())
-    return false;
-
   // Check that the cf-protection-branch is enabled.
   Metadata *isCFProtectionSupported =
       MF.getMMI().getModule()->getModuleFlag("cf-protection-branch");
   if (!isCFProtectionSupported && !IndirectBranchTracking)
     return false;
 
   // True if the current MF was changed and false otherwise.
   bool Changed = false;

llvm/trunk/lib/Target/X86/X86InstrControl.td

let isBranch = 1, isTerminator = 1, isBarrier = 1, isIndirectBranch = 1 in {
 
   def JMP64r     : I<0xFF, MRM4r, (outs), (ins GR64:$dst), "jmp{q}\t{*}$dst",
                      [(brind GR64:$dst)]>, Requires<[In64BitMode]>,
                      Sched<[WriteJump]>;
   def JMP64m     : I<0xFF, MRM4m, (outs), (ins i64mem:$dst), "jmp{q}\t{*}$dst",
                      [(brind (loadi64 addr:$dst))]>, Requires<[In64BitMode]>,
                      Sched<[WriteJumpLd]>;
 
-  let isCodeGenOnly = 1, Predicates = [HasIBT] in {
+  // Non-tracking jumps for IBT, use with caution.
+  let isCodeGenOnly = 1 in {
     def JMP16r_NT : I<0xFF, MRM4r, (outs), (ins GR16 : $dst), "jmp{w}\t{*}$dst",
                       [(X86NoTrackBrind GR16 : $dst)]>, Requires<[Not64BitMode]>,
                       OpSize16, Sched<[WriteJump]>, NOTRACK;
 
     def JMP16m_NT : I<0xFF, MRM4m, (outs), (ins i16mem : $dst), "jmp{w}\t{*}$dst",
                       [(X86NoTrackBrind (loadi16 addr : $dst))]>,
                       Requires<[Not64BitMode]>, OpSize16, Sched<[WriteJumpLd]>,
                       NOTRACK;
def CALL32r     : I<0xFF, MRM2r, (outs), (ins GR32:$dst),
                         "call{l}\t{*}$dst", [(X86call GR32:$dst)]>, OpSize32,
                         Requires<[Not64BitMode,NotUseRetpoline]>, Sched<[WriteJump]>;
     def CALL32m     : I<0xFF, MRM2m, (outs), (ins i32mem:$dst),
                         "call{l}\t{*}$dst", [(X86call (loadi32 addr:$dst))]>,
                         OpSize32,
                         Requires<[Not64BitMode,FavorMemIndirectCall,NotUseRetpoline]>,
                         Sched<[WriteJumpLd]>;
 
-    let isCodeGenOnly = 1, Predicates = [HasIBT] in {
+    // Non-tracking calls for IBT, use with caution.
+    let isCodeGenOnly = 1 in {
       def CALL16r_NT : I<0xFF, MRM2r, (outs), (ins GR16 : $dst),
                         "call{w}\t{*}$dst",[(X86NoTrackCall GR16 : $dst)]>,
                         OpSize16, Requires<[Not64BitMode]>, Sched<[WriteJump]>, NOTRACK;
       def CALL16m_NT : I<0xFF, MRM2m, (outs), (ins i16mem : $dst),
                         "call{w}\t{*}$dst",[(X86NoTrackCall(loadi16 addr : $dst))]>,
                         OpSize16, Requires<[Not64BitMode,FavorMemIndirectCall]>,
                         Sched<[WriteJumpLd]>, NOTRACK;
       def CALL32r_NT : I<0xFF, MRM2r, (outs), (ins GR32 : $dst),
let isCall = 1, Uses = [RSP, SSP], SchedRW = [WriteJump] in {
   def CALL64r       : I<0xFF, MRM2r, (outs), (ins GR64:$dst),
                         "call{q}\t{*}$dst", [(X86call GR64:$dst)]>,
                       Requires<[In64BitMode,NotUseRetpoline]>;
   def CALL64m       : I<0xFF, MRM2m, (outs), (ins i64mem:$dst),
                         "call{q}\t{*}$dst", [(X86call (loadi64 addr:$dst))]>,
                       Requires<[In64BitMode,FavorMemIndirectCall,
                                 NotUseRetpoline]>;
 
-  let isCodeGenOnly = 1, Predicates = [HasIBT] in{
+  // Non-tracking calls for IBT, use with caution.
+  let isCodeGenOnly = 1 in {
     def CALL64r_NT : I<0xFF, MRM2r, (outs), (ins GR64 : $dst),
                       "call{q}\t{*}$dst",[(X86NoTrackCall GR64 : $dst)]>,
                       Requires<[In64BitMode]>, NOTRACK;
     def CALL64m_NT : I<0xFF, MRM2m, (outs), (ins i64mem : $dst),
                        "call{q}\t{*}$dst",
                        [(X86NoTrackCall(loadi64 addr : $dst))]>,
                        Requires<[In64BitMode,FavorMemIndirectCall]>, NOTRACK;
   }

llvm/trunk/lib/Target/X86/X86InstrInfo.td

 def HasCLDEMOTE  : Predicate<"Subtarget->hasCLDEMOTE()">;
 def HasMOVDIRI   : Predicate<"Subtarget->hasMOVDIRI()">;
 def HasMOVDIR64B : Predicate<"Subtarget->hasMOVDIR64B()">;
 def HasPTWRITE   : Predicate<"Subtarget->hasPTWRITE()">;
 def FPStackf32   : Predicate<"!Subtarget->hasSSE1()">;
 def FPStackf64   : Predicate<"!Subtarget->hasSSE2()">;
 def HasMPX       : Predicate<"Subtarget->hasMPX()">;
 def HasSHSTK     : Predicate<"Subtarget->hasSHSTK()">;
-def HasIBT       : Predicate<"Subtarget->hasIBT()">;
 def HasCLFLUSHOPT : Predicate<"Subtarget->hasCLFLUSHOPT()">;
 def HasCLWB      : Predicate<"Subtarget->hasCLWB()">;
 def HasWBNOINVD  : Predicate<"Subtarget->hasWBNOINVD()">;
 def HasRDPID     : Predicate<"Subtarget->hasRDPID()">;
 def HasWAITPKG   : Predicate<"Subtarget->hasWAITPKG()">;
 def HasCmpxchg16b: Predicate<"Subtarget->hasCmpxchg16b()">;
 def HasPCONFIG   : Predicate<"Subtarget->hasPCONFIG()">;
 def Not64BitMode : Predicate<"!Subtarget->is64Bit()">,

llvm/trunk/lib/Target/X86/X86InstrSystem.td

 // encoding: like wbinvd + an 0xF3 prefix
 def WBNOINVD : I<0x09, RawFrm, (outs), (ins), "wbnoinvd",
                  [(int_x86_wbnoinvd)]>, XS,
                  Requires<[HasWBNOINVD]>;
 } // SchedRW
 
 //===----------------------------------------------------------------------===//
 // CET instructions
-let SchedRW = [WriteSystem], Predicates = [HasSHSTK]  in{
+// Use with caution, availability is not predicated on features.
+let SchedRW = [WriteSystem] in {
   let Uses = [SSP] in {
     let Defs = [SSP] in {
       def INCSSPD : I<0xAE, MRM5r, (outs), (ins GR32:$src), "incsspd\t$src",
                        [(int_x86_incsspd GR32:$src)]>, XS;
       def INCSSPQ : RI<0xAE, MRM5r, (outs), (ins GR64:$src), "incsspq\t$src",
                        [(int_x86_incsspq GR64:$src)]>, XS;
     } // Defs SSP
 
let Uses = [SSP] in {
         def SETSSBSY : I<0x01, MRM_E8, (outs), (ins), "setssbsy",
                          [(int_x86_setssbsy)]>, XS;
     } // Uses SSP
 
     def CLRSSBSY : I<0xAE, MRM6m, (outs), (ins i32mem:$src),
                      "clrssbsy\t$src",
                      [(int_x86_clrssbsy addr:$src)]>, XS;
   } // Defs SSP
-} // SchedRW && HasSHSTK
+} // SchedRW
 
-let SchedRW = [WriteSystem], Predicates = [HasIBT]  in {
+let SchedRW = [WriteSystem] in {
     def ENDBR64 : I<0x1E, MRM_FA, (outs), (ins), "endbr64", []>, XS;
     def ENDBR32 : I<0x1E, MRM_FB, (outs), (ins), "endbr32", []>, XS;
-} // SchedRW && HasIBT
+} // SchedRW
 
 //===----------------------------------------------------------------------===//
 // XSAVE instructions
 let SchedRW = [WriteSystem] in {
 let Predicates = [HasXSAVE] in {
 let Defs = [EDX, EAX], Uses = [ECX] in
   def XGETBV : I<0x01, MRM_D0, (outs), (ins), "xgetbv", []>, TB;
 

llvm/trunk/lib/Target/X86/X86Subtarget.h

protected:
 
   /// Processor supports MPX - Memory Protection Extensions
   bool HasMPX;
 
   /// Processor supports CET SHSTK - Control-Flow Enforcement Technology
   /// using Shadow Stack
   bool HasSHSTK;
 
-  /// Processor supports CET IBT - Control-Flow Enforcement Technology
-  /// using Indirect Branch Tracking
-  bool HasIBT;
-
   /// Processor has Software Guard Extensions
   bool HasSGX;
 
   /// Processor supports Flush Cache Line instruction
   bool HasCLFLUSHOPT;
 
   /// Processor supports Cache Line Write Back instruction
   bool HasCLWB;
public:
   bool hasDQI() const { return HasDQI; }
   bool hasBWI() const { return HasBWI; }
   bool hasVLX() const { return HasVLX; }
   bool hasPKU() const { return HasPKU; }
   bool hasVNNI() const { return HasVNNI; }
   bool hasBITALG() const { return HasBITALG; }
   bool hasMPX() const { return HasMPX; }
   bool hasSHSTK() const { return HasSHSTK; }
-  bool hasIBT() const { return HasIBT; }
   bool hasCLFLUSHOPT() const { return HasCLFLUSHOPT; }
   bool hasCLWB() const { return HasCLWB; }
   bool hasWBNOINVD() const { return HasWBNOINVD; }
   bool hasRDPID() const { return HasRDPID; }
   bool hasWAITPKG() const { return HasWAITPKG; }
   bool hasPCONFIG() const { return HasPCONFIG; }
   bool hasSGX() const { return HasSGX; }
   bool useRetpoline() const { return UseRetpoline; }

llvm/trunk/lib/Target/X86/X86Subtarget.cpp

void X86Subtarget::initializeEnvironment() {
   HasMWAITX = false;
   HasCLZERO = false;
   HasCLDEMOTE = false;
   HasMOVDIRI = false;
   HasMOVDIR64B = false;
   HasPTWRITE = false;
   HasMPX = false;
   HasSHSTK = false;
-  HasIBT = false;
   HasSGX = false;
   HasPCONFIG = false;
   HasCLFLUSHOPT = false;
   HasCLWB = false;
   HasWBNOINVD = false;
   HasRDPID = false;
   HasWAITPKG = false;
   UseRetpoline = false;

llvm/trunk/test/CodeGen/X86/indirect-branch-tracking.ll

-; RUN: llc -mtriple=x86_64-unknown-unknown -mattr=+ibt < %s | FileCheck %s --check-prefix=ALL --check-prefix=X86_64
-; RUN: llc -mtriple=i386-unknown-unknown -mattr=+ibt < %s | FileCheck %s --check-prefix=ALL --check-prefix=X86
-; RUN: llc -mtriple i386-windows-gnu -mattr=+ibt -exception-model sjlj < %s | FileCheck %s --check-prefix=SJLJ
+; RUN: llc -mtriple=x86_64-unknown-unknown < %s | FileCheck %s --check-prefix=ALL --check-prefix=X86_64
+; RUN: llc -mtriple=i386-unknown-unknown < %s | FileCheck %s --check-prefix=ALL --check-prefix=X86
+; RUN: llc -mtriple i386-windows-gnu -exception-model sjlj < %s | FileCheck %s --check-prefix=SJLJ
 
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;; Test1
 ;; -----
 ;; Checks ENDBR insertion in case of switch case statement.
 ;; Also since the function is not internal, make sure that endbr32/64 was 
 ;; added at the beginning of the function.
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
lpad:
   br label %try.cont
 
 try.cont:
   ret void
 }
 
 !llvm.module.flags = !{!0}
 
-!0 = !{i32 4, !"cf-protection-branch", i32 1}
+!0 = !{i32 4, !"cf-protection-branch", i32 1}
 

llvm/trunk/test/CodeGen/X86/nocf_check.ll

-; RUN: llc -mtriple=x86_64-unknown-unknown -mattr=+ibt -x86-indirect-branch-tracking < %s | FileCheck %s
+; RUN: llc -mtriple=x86_64-unknown-unknown -x86-indirect-branch-tracking < %s | FileCheck %s
 
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;; This test verify the handling of ''nocf_check'' attribute by the backend. ;;
 ;; The file was generated using the following C code:                        ;;
 ;;                                                                           ;;
 ;; void __attribute__((nocf_check)) NoCfCheckFunc(void) {}                   ;;
 ;;                                                                           ;;
 ;; typedef void(*FuncPointer)(void);                                         ;;

llvm/trunk/test/CodeGen/X86/x32-cet-intrinsics.ll

 ; NOTE: Assertions have been autogenerated by utils/update_llc_test_checks.py
-; RUN: llc < %s -mtriple=i386-apple-darwin -mattr=+shstk -mattr=+ibt | FileCheck %s
+; RUN: llc < %s -mtriple=i386-apple-darwin -mattr=+shstk | FileCheck %s
 
 define void @test_incsspd(i32 %a) local_unnamed_addr {
 ; CHECK-LABEL: test_incsspd:
 ; CHECK:       ## %bb.0: ## %entry
 ; CHECK-NEXT:    movl {{[0-9]+}}(%esp), %eax
 ; CHECK-NEXT:    incsspd %eax
 ; CHECK-NEXT:    retl
 entry:

llvm/trunk/test/CodeGen/X86/x64-cet-intrinsics.ll

 ; NOTE: Assertions have been autogenerated by utils/update_llc_test_checks.py
-; RUN: llc < %s -mtriple=x86_64-apple-darwin -mattr=+shstk -mattr=+ibt | FileCheck %s
+; RUN: llc < %s -mtriple=x86_64-apple-darwin -mattr=+shstk | FileCheck %s
 
 define void @test_incsspd(i32 %a) local_unnamed_addr {
 ; CHECK-LABEL: test_incsspd:
 ; CHECK:       ## %bb.0: ## %entry
 ; CHECK-NEXT:    incsspd %edi
 ; CHECK-NEXT:    retq
 entry:
   tail call void @llvm.x86.incsspd(i32 %a)

llvm/trunk/test/Transforms/LoopVectorize/X86/pr23997.ll

loop:
   %indvars.iv.next4 = add nuw nsw i64 %indvars.iv3, 1
   %.21 = icmp ult i64 %indvars.iv.next4, %2
   br i1 %.21, label %loop, label %loopexit
 
 loopexit:
   ret void
 }
 
-attributes #0 = { uwtable "target-cpu"="skylake" "target-features"="+sse2,+cx16,+sahf,-tbm,-avx512ifma,-sha,-gfni,-fma4,-vpclmulqdq,+prfchw,+bmi2,-cldemote,+fsgsbase,+xsavec,+popcnt,+aes,-avx512bitalg,+xsaves,-avx512er,-avx512vnni,-avx512vpopcntdq,-clwb,-avx512f,-clzero,-pku,+mmx,-lwp,-rdpid,-xop,+rdseed,-waitpkg,-ibt,-sse4a,-avx512bw,+clflushopt,+xsave,-avx512vbmi2,-avx512vl,-avx512cd,+avx,-vaes,+rtm,+fma,+bmi,+rdrnd,-mwaitx,+sse4.1,+sse4.2,+avx2,-wbnoinvd,+sse,+lzcnt,+pclmul,-prefetchwt1,+f16c,+ssse3,+sgx,-shstk,+cmov,-avx512vbmi,+movbe,+xsaveopt,-avx512dq,+adx,-avx512pf,+sse3" }
+attributes #0 = { uwtable "target-cpu"="skylake" "target-features"="+sse2,+cx16,+sahf,-tbm,-avx512ifma,-sha,-gfni,-fma4,-vpclmulqdq,+prfchw,+bmi2,-cldemote,+fsgsbase,+xsavec,+popcnt,+aes,-avx512bitalg,+xsaves,-avx512er,-avx512vnni,-avx512vpopcntdq,-clwb,-avx512f,-clzero,-pku,+mmx,-lwp,-rdpid,-xop,+rdseed,-waitpkg,-sse4a,-avx512bw,+clflushopt,+xsave,-avx512vbmi2,-avx512vl,-avx512cd,+avx,-vaes,+rtm,+fma,+bmi,+rdrnd,-mwaitx,+sse4.1,+sse4.2,+avx2,-wbnoinvd,+sse,+lzcnt,+pclmul,-prefetchwt1,+f16c,+ssse3,+sgx,-shstk,+cmov,-avx512vbmi,+movbe,+xsaveopt,-avx512dq,+adx,-avx512pf,+sse3" }
 
 !0 = !{i32 0, i32 2147483646}
 !1 = !{}