This is an archive of the discontinued LLVM Phabricator instance.

Introduce the VTable interleaving scheme to the CFI design documentation
ClosedPublic

Authored by zhaomo on Aug 6 2018, 6:45 PM.

Details

Summary

Dimitar et. al. in [1] proposed a novel VTable layout scheme that enables efficient implementation of virtual call CFI.

This patch adds an introduction of this scheme to the CFI design documentation.

[1] Protecting C++ Dynamic Dispatch Through VTable Interleaving. Dimitar Bounov, Rami Gökhan Kıcı, Sorin Lerner. https://cseweb.ucsd.edu/~lerner/papers/ivtbl-ndss16.pdf

Diff Detail

Repository
rC Clang

Event Timeline

zhaomo created this revision.Aug 6 2018, 6:45 PM
pcc added a comment.Aug 6 2018, 7:36 PM

Please upload patches with context. arc diff will do this for you.

clang/docs/ControlFlowIntegrityDesign.rst
277 ↗(On Diff #159439)

I would add this as a subsection of "Forward-Edge CFI for Virtual Calls".

286 ↗(On Diff #159439)

On the high level -> At a high level

322 ↗(On Diff #159439)

I would move this sentence to the start of the subsection because it isn't specific to your example and clarify that although GlobalLayoutBuilder tries to place compatible vtables consecutively (but doesn't always succeed because the Itanium ABI glues vtables together), this algorithm requires them to appear consecutively.

331 ↗(On Diff #159439)

funtion -> function

339 ↗(On Diff #159439)

This layout isn't necessarily going to work with traditional RTTI because the __dynamic_cast function is allowed to assume that the rtti and offset-to-top fields appear at the offsets behind the address point that the ABI says that they will appear at. Indeed, the libcxxabi implementation makes that assumption:

https://github.com/llvm-mirror/libcxxabi/blob/master/src/private_typeinfo.cpp#L627

It's probably more something to keep in mind for the implementation, but I think we at least need to mention the RTTI incompatibility here.

clang/docs/ControlFlowIntegrityDesign.rst
283 ↗(On Diff #159439)

simplified to a range check -> always a range check

zhaomo updated this revision to Diff 159606.Aug 7 2018, 3:40 PM

Updated version of the patch

zhaomo updated this revision to Diff 159636.Aug 7 2018, 6:58 PM

Fix mistakes and provide more information about the interleaving algorithm

pcc accepted this revision.Aug 15 2018, 3:51 PM

LGTM except for a few spelling/grammar nits.

clang/docs/ControlFlowIntegrityDesign.rst
361 ↗(On Diff #159636)

initialized

374 ↗(On Diff #159636)

function

375 ↗(On Diff #159636)

related

395 ↗(On Diff #159636)

appends

396 ↗(On Diff #159636)

lists are left

This revision is now accepted and ready to land.Aug 15 2018, 3:51 PM
pcc added a comment.Sep 11 2018, 1:19 PM

Can you update this patch please? Then I will commit.

zhaomo updated this revision to Diff 164964.Sep 11 2018, 1:35 PM

Fixed typos pointed out by pcc.

This revision was automatically updated to reflect the committed changes.