[CFGuard] Split into two passes and link into opt

[ajpaverd]

Summary

Split the CFGuard pass into two separate function passes: one using the "dispatch" mechanism (used on X86-64) and the other using the "check" mechanism (for all other supported targets). Link each of these passes into opt and add tests for the IR transform.

[ajpaverd]

[CFGuard] Split into two passes and link into opt

[ajpaverd]

Ping @mehdi_amini - is this what you were asking for the CFGuard pass?

[mehdi_amini]

LGTM, thanks.

[aeubanks]

this will need to be ported to the new pass manager at some point

llvm/include/llvm/InitializePasses.h

 void initializeBreakCriticalEdgesPass(PassRegistry&);
 void initializeBreakFalseDepsPass(PassRegistry&);
 void initializeCanonicalizeAliasesLegacyPassPass(PassRegistry &);
 void initializeCanonicalizeFreezeInLoopsPass(PassRegistry &);
 void initializeCFGOnlyPrinterLegacyPassPass(PassRegistry&);
 void initializeCFGOnlyViewerLegacyPassPass(PassRegistry&);
 void initializeCFGPrinterLegacyPassPass(PassRegistry&);
 void initializeCFGSimplifyPassPass(PassRegistry&);
-void initializeCFGuardPass(PassRegistry&);
+void initializeCFGuardCheckPass(PassRegistry &);
+void initializeCFGuardDispatchPass(PassRegistry &);
 void initializeCFGuardLongjmpPass(PassRegistry&);
 void initializeCFGViewerLegacyPassPass(PassRegistry&);
 void initializeCFIInstrInserterPass(PassRegistry&);
 void initializeCFLAndersAAWrapperPassPass(PassRegistry&);
 void initializeCFLSteensAAWrapperPassPass(PassRegistry&);
 void initializeCallGraphDOTPrinterPass(PassRegistry&);
 void initializeCallGraphPrinterLegacyPassPass(PassRegistry&);
 void initializeCallGraphViewerPass(PassRegistry&);

llvm/include/llvm/Transforms/CFGuard.h

 
 #ifndef LLVM_TRANSFORMS_CFGUARD_H
 #define LLVM_TRANSFORMS_CFGUARD_H
 
 namespace llvm {
 
 class FunctionPass;
 
-/// Insert Control FLow Guard checks on indirect function calls.
+/// Insert Control Flow Guard checks on indirect function calls.
 FunctionPass *createCFGuardCheckPass();
 
-/// Insert Control FLow Guard dispatches on indirect function calls.
+/// Insert Control Flow Guard dispatches on indirect function calls.
 FunctionPass *createCFGuardDispatchPass();
 
 } // namespace llvm
 
 #endif

llvm/lib/Transforms/CFGuard/CFGuard.cpp

 using OperandBundleDef = OperandBundleDefT<Value *>;
 
 #define DEBUG_TYPE "cfguard"
 
 STATISTIC(CFGuardCounter, "Number of Control Flow Guard checks added");
 
 namespace {
 
-/// Adds Control Flow Guard (CFG) checks on indirect function calls/invokes.
-/// These checks ensure that the target address corresponds to the start of an
-/// address-taken function. X86_64 targets use the CF_Dispatch mechanism. X86,
-/// ARM, and AArch64 targets use the CF_Check machanism.
-class CFGuard : public FunctionPass {
+/// Base class for adding Control Flow Guard (CFG) checks on indirect function
+/// calls/invokes. These checks ensure that the target address corresponds to
+/// the start of an address-taken function.
+template <class T> class CFGuardBase : public FunctionPass {
 public:
-  static char ID;
+  CFGuardBase() : FunctionPass(T::ID) { static_cast<T *>(this)->initialize(); }
 
-  enum Mechanism { CF_Check, CF_Dispatch };
+  bool doInitialization(Module &M) override;
+  bool runOnFunction(Function &F) override;
 
-  // Default constructor required for the INITIALIZE_PASS macro.
-  CFGuard() : FunctionPass(ID) {
-    initializeCFGuardPass(*PassRegistry::getPassRegistry());
-    // By default, use the guard check mechanism.
-    GuardMechanism = CF_Check;
-  }
+protected:
+  // Only add checks if the module has the cfguard=2 flag.
+  int CFGuardModuleFlag = 0;
+  FunctionType *GuardFnType = nullptr;
+  PointerType *GuardFnPtrType = nullptr;
+  Constant *GuardFnGlobal = nullptr;
+};
 
-  // Recommended constructor used to specify the type of guard mechanism.
-  CFGuard(Mechanism Var) : FunctionPass(ID) {
-    initializeCFGuardPass(*PassRegistry::getPassRegistry());
-    GuardMechanism = Var;
+/// Adds Control Flow Guard (CFG) checks on indirect function calls/invokes
+/// using the check mchanism. This is used on X86, ARM, and AArch64 targets.
+class CFGuardCheck : public CFGuardBase<CFGuardCheck> {
+public:
+  static char ID;
+  const StringRef GuardFnGlobalName = "__guard_check_icall_fptr";
+
+  void initialize() {
+    initializeCFGuardCheckPass(*PassRegistry::getPassRegistry());
   }
 
   /// Inserts a Control Flow Guard (CFG) check on an indirect call using the CFG
   /// check mechanism. When the image is loaded, the loader puts the appropriate
   /// guard check function pointer in the __guard_check_icall_fptr global
   /// symbol. This checks that the target address is a valid address-taken
   /// function. The address of the target function is passed to the guard check
   /// function in an architecture-specific register (e.g. ECX on 32-bit X86,
public:
   /// is transformed to:
   /// \code
   ///   movl  $_target_func, %ecx
   ///   calll *___guard_check_icall_fptr
   ///   calll *%ecx
   /// \endcode
   ///
   /// \param CB indirect call to instrument.
-  void insertCFGuardCheck(CallBase *CB);
+  void insertCFGuard(CallBase *CB);
+};
+
+/// Adds Control Flow Guard (CFG) checks on indirect function calls/invokes
+/// using the dispatch mchanism. This is used on X86_64 targets.
+class CFGuardDispatch : public CFGuardBase<CFGuardDispatch> {
+public:
+  static char ID;
+  const StringRef GuardFnGlobalName = "__guard_dispatch_icall_fptr";
+
+  void initialize() {
+    initializeCFGuardDispatchPass(*PassRegistry::getPassRegistry());
+  }
 
   /// Inserts a Control Flow Guard (CFG) check on an indirect call using the CFG
   /// dispatch mechanism. When the image is loaded, the loader puts the
   /// appropriate guard check function pointer in the
   /// __guard_dispatch_icall_fptr global symbol. This checks that the target
   /// address is a valid address-taken function and, if so, tail calls the
   /// target. The target address is passed in an architecture-specific register
   /// (e.g. RAX on X86_64), with all other arguments for the target function
public:
   ///
   /// is transformed to:
   /// \code
   ///   leaq   target_func(%rip), %rax
   ///   callq  *__guard_dispatch_icall_fptr(%rip)
   /// \endcode
   ///
   /// \param CB indirect call to instrument.
-  void insertCFGuardDispatch(CallBase *CB);
-
-  bool doInitialization(Module &M) override;
-  bool runOnFunction(Function &F) override;
-
-private:
-  // Only add checks if the module has the cfguard=2 flag.
-  int cfguard_module_flag = 0;
-  Mechanism GuardMechanism = CF_Check;
-  FunctionType *GuardFnType = nullptr;
-  PointerType *GuardFnPtrType = nullptr;
-  Constant *GuardFnGlobal = nullptr;
+  void insertCFGuard(CallBase *CB);
 };
 
 } // end anonymous namespace
 
-void CFGuard::insertCFGuardCheck(CallBase *CB) {
+void CFGuardCheck::insertCFGuard(CallBase *CB) {
 
-  assert(Triple(CB->getModule()->getTargetTriple()).isOSWindows() &&
-         "Only applicable for Windows targets");
   assert(CB->isIndirectCall() &&
          "Control Flow Guard checks can only be added to indirect calls");
 
   IRBuilder<> B(CB);
   Value *CalledOperand = CB->getCalledOperand();
 
   // Load the global symbol as a pointer to the check function.
   LoadInst *GuardCheckLoad = B.CreateLoad(GuardFnPtrType, GuardFnGlobal);
 
   // Create new call instruction. The CFGuard check should always be a call,
   // even if the original CallBase is an Invoke or CallBr instruction.
   CallInst *GuardCheck =
       B.CreateCall(GuardFnType, GuardCheckLoad,
                    {B.CreateBitCast(CalledOperand, B.getInt8PtrTy())});
 
   // Ensure that the first argument is passed in the correct register
   // (e.g. ECX on 32-bit X86 targets).
   GuardCheck->setCallingConv(CallingConv::CFGuard_Check);
 }
 
-void CFGuard::insertCFGuardDispatch(CallBase *CB) {
+void CFGuardDispatch::insertCFGuard(CallBase *CB) {
 
-  assert(Triple(CB->getModule()->getTargetTriple()).isOSWindows() &&
-         "Only applicable for Windows targets");
   assert(CB->isIndirectCall() &&
          "Control Flow Guard checks can only be added to indirect calls");
 
   IRBuilder<> B(CB);
   Value *CalledOperand = CB->getCalledOperand();
   Type *CalledOperandType = CalledOperand->getType();
 
   // Cast the guard dispatch global to the type of the called operand.
void CFGuardDispatch::insertCFGuard(CallBase *CB) {
 
   // Replace the original call/invoke with the new instruction.
   CB->replaceAllUsesWith(NewCB);
 
   // Delete the original call/invoke.
   CB->eraseFromParent();
 }
 
-bool CFGuard::doInitialization(Module &M) {
+template <class T> bool CFGuardBase<T>::doInitialization(Module &M) {
 
   // Check if this module has the cfguard flag and read its value.
   if (auto *MD =
           mdconst::extract_or_null<ConstantInt>(M.getModuleFlag("cfguard")))
-    cfguard_module_flag = MD->getZExtValue();
+    CFGuardModuleFlag = MD->getZExtValue();
 
   // Skip modules for which CFGuard checks have been disabled.
-  if (cfguard_module_flag != 2)
+  if (CFGuardModuleFlag != 2)
     return false;
 
   // Set up prototypes for the guard check and dispatch functions.
   GuardFnType = FunctionType::get(Type::getVoidTy(M.getContext()),
                                   {Type::getInt8PtrTy(M.getContext())}, false);
   GuardFnPtrType = PointerType::get(GuardFnType, 0);
 
   // Get or insert the guard check or dispatch global symbols.
-  if (GuardMechanism == CF_Check) {
-    GuardFnGlobal =
-        M.getOrInsertGlobal("__guard_check_icall_fptr", GuardFnPtrType);
-  } else {
-    assert(GuardMechanism == CF_Dispatch && "Invalid CFGuard mechanism");
-    GuardFnGlobal =
-        M.getOrInsertGlobal("__guard_dispatch_icall_fptr", GuardFnPtrType);
-  }
+  GuardFnGlobal = M.getOrInsertGlobal(static_cast<T *>(this)->GuardFnGlobalName,
+                                      GuardFnPtrType);
 
   return true;
 }
 
-bool CFGuard::runOnFunction(Function &F) {
+template <class T> bool CFGuardBase<T>::runOnFunction(Function &F) {
 
   // Skip modules for which CFGuard checks have been disabled.
-  if (cfguard_module_flag != 2)
+  if (CFGuardModuleFlag != 2)
     return false;
 
   SmallVector<CallBase *, 8> IndirectCalls;
 
   // Iterate over the instructions to find all indirect call/invoke/callbr
   // instructions. Make a separate list of pointers to indirect
   // call/invoke/callbr instructions because the original instructions will be
   // deleted as the checks are added.
   for (BasicBlock &BB : F.getBasicBlockList()) {
     for (Instruction &I : BB.getInstList()) {
       auto *CB = dyn_cast<CallBase>(&I);
       if (CB && CB->isIndirectCall() && !CB->hasFnAttr("guard_nocf")) {
         IndirectCalls.push_back(CB);
         CFGuardCounter++;
       }
     }
   }
 
   // If no checks are needed, return early.
   if (IndirectCalls.empty()) {
     return false;
   }
 
   // For each indirect call/invoke, add the appropriate dispatch or check.
-  if (GuardMechanism == CF_Dispatch) {
-    for (CallBase *CB : IndirectCalls) {
-      insertCFGuardDispatch(CB);
-    }
-  } else {
-    for (CallBase *CB : IndirectCalls) {
-      insertCFGuardCheck(CB);
-    }
+    static_cast<T *>(this)->insertCFGuard(CB);
   }
 
   return true;
 }
 
-char CFGuard::ID = 0;
-INITIALIZE_PASS(CFGuard, "CFGuard", "CFGuard", false, false)
+char CFGuardCheck::ID = 0;
 
-FunctionPass *llvm::createCFGuardCheckPass() {
-  return new CFGuard(CFGuard::CF_Check);
-}
+INITIALIZE_PASS(CFGuardCheck, "cfguard-check",
+                "Control Flow Guard: inserts checks before indirect branches",
+                false, false)
+
+FunctionPass *llvm::createCFGuardCheckPass() { return new CFGuardCheck(); }
+
+char CFGuardDispatch::ID = 0;
+
+INITIALIZE_PASS(CFGuardDispatch, "cfguard-dispatch",
+                "Control Flow Guard: inserts dispatches on indirect branches",
+                false, false)
 
 FunctionPass *llvm::createCFGuardDispatchPass() {
-  return new CFGuard(CFGuard::CF_Dispatch);
+  return new CFGuardDispatch();
 }

llvm/test/Transforms/CFGuard/cfguard-check-dispatch.ll

+; RUN: opt < %s -cfguard-check -S | FileCheck %s -check-prefix=CHK
+; RUN: opt < %s -cfguard-dispatch -S | FileCheck %s -check-prefix=DIS
+
+; Test the IR transforms for adding Control Flow Guard checks.
+
+
+declare i32 @target_func()
+
+; Test that Control Flow Guard checks are not added on calls with the "guard_nocf" attribute.
+define i32 @func_guard_nocf() {
+entry:
+  %func_ptr = alloca i32 ()*, align 8
+  store i32 ()* @target_func, i32 ()** %func_ptr, align 8
+  %0 = load i32 ()*, i32 ()** %func_ptr, align 8
+  %1 = call i32 %0() #0
+  ret i32 %1
+
+  ; CHK-LABEL:  func_guard_nocf
+  ; CHK-NOT:  __guard_check_icall_fptr
+
+  ; DIS-LABEL:  func_guard_nocf
+  ; DIS-NOT:  __guard_dispatch_icall_fptr
+}
+attributes #0 = { "guard_nocf" }
+
+; Test that Control Flow Guard checks are added even with optnone.
+define i32 @func_optnone_cf() #1 {
+entry:
+  %func_ptr = alloca i32 ()*, align 8
+  store i32 ()* @target_func, i32 ()** %func_ptr, align 8
+  %0 = load i32 ()*, i32 ()** %func_ptr, align 8
+  %1 = call i32 %0()
+  ret i32 %1
+
+  ; CHK-LABEL: func_optnone_cf
+  ; CHK:  [[TARGET:%.*]] = load i32 ()*, i32 ()** %func_ptr, align 8
+  ; CHK:  [[GUARD:%.*]] = load void (i8*)*, void (i8*)** @__guard_check_icall_fptr, align 8
+  ; CHK:  [[PTR:%.*]] = bitcast i32 ()* [[TARGET]] to i8*
+  ; CHK:  call cfguard_checkcc void [[GUARD]](i8* [[PTR]])
+  ; CHK:  call i32 [[TARGET]]()
+
+  ; DIS-LABEL: func_optnone_cf
+  ; DIS:  [[TARGET:%.*]] = load i32 ()*, i32 ()** %func_ptr, align 8
+  ; DIS:  [[GUARD:%.*]] = load i32 ()*, i32 ()** bitcast (void (i8*)** @__guard_dispatch_icall_fptr to i32 ()**), align 8
+  ; DIS:  call i32 [[GUARD]]() [ "cfguardtarget"(i32 ()* [[TARGET]]) ]
+}
+attributes #1 = { noinline optnone }
+
+; Test that Control Flow Guard checks are correctly added in optimized code (common case).
+define i32 @func_cf() {
+entry:
+  %func_ptr = alloca i32 ()*, align 8
+  store i32 ()* @target_func, i32 ()** %func_ptr, align 8
+  %0 = load i32 ()*, i32 ()** %func_ptr, align 8
+  %1 = call i32 %0()
+  ret i32 %1
+
+  ; CHK-LABEL: func_cf
+  ; CHK:  [[TARGET:%.*]] = load i32 ()*, i32 ()** %func_ptr, align 8
+  ; CHK:  [[GUARD:%.*]] = load void (i8*)*, void (i8*)** @__guard_check_icall_fptr, align 8
+  ; CHK:  [[PTR:%.*]] = bitcast i32 ()* [[TARGET]] to i8*
+  ; CHK:  call cfguard_checkcc void [[GUARD]](i8* [[PTR]])
+  ; CHK:  call i32 [[TARGET]]()
+
+  ; DIS-LABEL: func_cf
+  ; DIS:  [[TARGET:%.*]] = load i32 ()*, i32 ()** %func_ptr, align 8
+  ; DIS:  [[GUARD:%.*]] = load i32 ()*, i32 ()** bitcast (void (i8*)** @__guard_dispatch_icall_fptr to i32 ()**), align 8
+  ; DIS:  call i32 [[GUARD]]() [ "cfguardtarget"(i32 ()* [[TARGET]]) ]
+}
+
+; Test that Control Flow Guard checks are correctly added on invoke instructions.
+define i32 @func_cf_invoke() personality i8* bitcast (void ()* @h to i8*) {
+entry:
+  %0 = alloca i32, align 4
+  %func_ptr = alloca i32 ()*, align 8
+  store i32 ()* @target_func, i32 ()** %func_ptr, align 8
+  %1 = load i32 ()*, i32 ()** %func_ptr, align 8
+  %2 = invoke i32 %1()
+          to label %invoke.cont unwind label %lpad
+invoke.cont:                                      ; preds = %entry
+  ret i32 %2
+
+lpad:                                             ; preds = %entry
+  %tmp = landingpad { i8*, i32 }
+          catch i8* null
+  ret i32 -1
+
+  ; CHK-LABEL: func_cf_invoke
+  ; CHK:  [[TARGET:%.*]] = load i32 ()*, i32 ()** %func_ptr, align 8
+  ; CHK:  [[GUARD:%.*]] = load void (i8*)*, void (i8*)** @__guard_check_icall_fptr, align 8
+  ; CHK:  [[PTR:%.*]] = bitcast i32 ()* [[TARGET]] to i8* 
+  ; CHK:  call cfguard_checkcc void [[GUARD]](i8* [[PTR]])
+  ; CHK:  invoke i32 [[TARGET]]()
+
+  ; DIS-LABEL: func_cf_invoke
+  ; DIS:  [[TARGET:%.*]] = load i32 ()*, i32 ()** %func_ptr, align 8
+  ; DIS:  [[GUARD:%.*]] = load i32 ()*, i32 ()** bitcast (void (i8*)** @__guard_dispatch_icall_fptr to i32 ()**), align 8
+  ; DIS:  invoke i32 [[GUARD]]() [ "cfguardtarget"(i32 ()* [[TARGET]]) ]
+}
+
+declare void @h()
+
+; Test that Control Flow Guard preserves floating point arguments.
+declare double @target_func_doubles(double, double, double, double)
+
+define double @func_cf_doubles() {
+entry:
+  %func_ptr = alloca double (double, double, double, double)*, align 8
+  store double (double, double, double, double)* @target_func_doubles, double (double, double, double, double)** %func_ptr, align 8
+  %0 = load double (double, double, double, double)*, double (double, double, double, double)** %func_ptr, align 8
+  %1 = call double %0(double 1.000000e+00, double 2.000000e+00, double 3.000000e+00, double 4.000000e+00)
+  ret double %1
+
+  ; CHK-LABEL: func_cf_doubles
+  ; CHK:  [[TARGET:%.*]] = load double (double, double, double, double)*, double (double, double, double, double)** %func_ptr, align 8
+  ; CHK:  [[GUARD:%.*]] = load void (i8*)*, void (i8*)** @__guard_check_icall_fptr, align 8
+  ; CHK:  [[PTR:%.*]] = bitcast double (double, double, double, double)* [[TARGET]] to i8*
+  ; CHK:  call cfguard_checkcc void [[GUARD]](i8* [[PTR]])
+  ; CHK:  call double [[TARGET]](double 1.000000e+00, double 2.000000e+00, double 3.000000e+00, double 4.000000e+00)
+
+  ; DIS-LABEL: func_cf_doubles
+  ; DIS:  [[TARGET:%.*]] = load double (double, double, double, double)*, double (double, double, double, double)** %func_ptr, align 8
+  ; DIS:  [[GUARD:%.*]] = load double (double, double, double, double)*, double (double, double, double, double)** bitcast (void (i8*)** @__guard_dispatch_icall_fptr to double (double, double, double, double)**), align 8
+  ; DIS:  call double [[GUARD]](double 1.000000e+00, double 2.000000e+00, double 3.000000e+00, double 4.000000e+00) [ "cfguardtarget"(double (double, double, double, double)* [[TARGET]]) ]
+}
+
+; Test that Control Flow Guard checks are correctly added for tail calls.
+define i32 @func_cf_tail() {
+entry:
+  %func_ptr = alloca i32 ()*, align 8
+  store i32 ()* @target_func, i32 ()** %func_ptr, align 8
+  %0 = load i32 ()*, i32 ()** %func_ptr, align 8
+  %1 = musttail call i32 %0()
+  ret i32 %1
+
+  ; CHK-LABEL: func_cf_tail
+  ; CHK:  [[TARGET:%.*]] = load i32 ()*, i32 ()** %func_ptr, align 8
+  ; CHK:  [[GUARD:%.*]] = load void (i8*)*, void (i8*)** @__guard_check_icall_fptr, align 8
+  ; CHK:  [[PTR:%.*]] = bitcast i32 ()* [[TARGET]] to i8*
+  ; CHK:  call cfguard_checkcc void [[GUARD]](i8* [[PTR]])
+  ; CHK:  musttail call i32 [[TARGET]]()
+
+  ; DIS-LABEL: func_cf_tail
+  ; DIS:  [[TARGET:%.*]] = load i32 ()*, i32 ()** %func_ptr, align 8
+  ; DIS:  [[GUARD:%.*]] = load i32 ()*, i32 ()** bitcast (void (i8*)** @__guard_dispatch_icall_fptr to i32 ()**), align 8
+  ; DIS:  musttail call i32 [[GUARD]]() [ "cfguardtarget"(i32 ()* [[TARGET]]) ]
+}
+
+%struct.Foo = type { i32 (%struct.Foo*)** }
+
+; Test that Control Flow Guard checks are correctly added for variadic musttail
+; calls. These are used for MS C++ ABI virtual member pointer thunks.
+; PR44049
+define i32 @vmptr_thunk(%struct.Foo* inreg %p) {
+entry:
+  %vptr.addr = getelementptr inbounds %struct.Foo, %struct.Foo* %p, i32 0, i32 0
+  %vptr = load i32 (%struct.Foo*)**, i32 (%struct.Foo*)*** %vptr.addr
+  %slot = getelementptr inbounds i32 (%struct.Foo*)*, i32 (%struct.Foo*)** %vptr, i32 1
+  %vmethod = load i32 (%struct.Foo*)*, i32 (%struct.Foo*)** %slot
+  %rv = musttail call i32 %vmethod(%struct.Foo* inreg %p)
+  ret i32 %rv
+
+  ; CHK-LABEL: vmptr_thunk
+  ; CHK:  %vptr.addr = getelementptr inbounds %struct.Foo, %struct.Foo* %p, i32 0, i32 0
+  ; CHK:  %vptr = load i32 (%struct.Foo*)**, i32 (%struct.Foo*)*** %vptr.addr, align 8
+  ; CHK:  %slot = getelementptr inbounds i32 (%struct.Foo*)*, i32 (%struct.Foo*)** %vptr, i32 1
+  ; CHK:  %vmethod = load i32 (%struct.Foo*)*, i32 (%struct.Foo*)** %slot, align 8
+  ; CHK:  [[GUARD:%.*]] = load void (i8*)*, void (i8*)** @__guard_check_icall_fptr, align 8
+  ; CHK:  [[PTR:%.*]] = bitcast i32 (%struct.Foo*)* %vmethod to i8*
+  ; CHK:  call cfguard_checkcc void [[GUARD]](i8* [[PTR]])
+  ; CHK:  %rv = musttail call i32 %vmethod(%struct.Foo* inreg %p)
+
+  ; DIS-LABEL: vmptr_thunk
+  ; DIS:  %vptr.addr = getelementptr inbounds %struct.Foo, %struct.Foo* %p, i32 0, i32 0
+  ; DIS:  %vptr = load i32 (%struct.Foo*)**, i32 (%struct.Foo*)*** %vptr.addr, align 8
+  ; DIS:  %slot = getelementptr inbounds i32 (%struct.Foo*)*, i32 (%struct.Foo*)** %vptr, i32 1
+  ; DIS:  %vmethod = load i32 (%struct.Foo*)*, i32 (%struct.Foo*)** %slot, align 8
+  ; DIS:  [[GUARD:%.*]] = load i32 (%struct.Foo*)*, i32 (%struct.Foo*)** bitcast (void (i8*)** @__guard_dispatch_icall_fptr to i32 (%struct.Foo*)**), align 8
+  ; DIS:  %rv1 = musttail call i32 [[GUARD]](%struct.Foo* inreg %p) [ "cfguardtarget"(i32 (%struct.Foo*)* %vmethod) ]
+}
+
+
+!llvm.module.flags = !{!0}
+!0 = !{i32 2, !"cfguard", i32 2}

llvm/tools/opt/CMakeLists.txt

 set(LLVM_LINK_COMPONENTS
   AllTargetsAsmParsers
   AllTargetsCodeGens
   AllTargetsDescs
   AllTargetsInfos
   AggressiveInstCombine
   Analysis
   AsmParser
   BitWriter
+  CFGuard
   CodeGen
   Core
   Coroutines
   Extensions
   IPO
   IRReader
   InstCombine
   Instrumentation

llvm/tools/opt/LLVMBuild.txt

 [component_0]
 type = Tool
 name = opt
 parent = Tools
 required_libraries =
  AsmParser
  BitReader
  BitWriter
+ CFGuard
  CodeGen
  IRReader
  IPO
  Instrumentation
  Scalar
  ObjCARC
  Passes
  all-targets

llvm/tools/opt/opt.cpp

int main(int argc, char **argv) {
   InitializeAllTargets();
   InitializeAllTargetMCs();
   InitializeAllAsmPrinters();
   InitializeAllAsmParsers();
 
   // Initialize passes
   PassRegistry &Registry = *PassRegistry::getPassRegistry();
   initializeCore(Registry);
+  initializeCFGuardCheckPass(Registry);
+  initializeCFGuardDispatchPass(Registry);
   initializeCoroutines(Registry);
   initializeScalarOpts(Registry);
   initializeObjCARCOpts(Registry);
   initializeVectorization(Registry);
   initializeIPO(Registry);
   initializeAnalysis(Registry);
   initializeTransformUtils(Registry);
   initializeInstCombine(Registry);