46f366494f
Currently we use RTTI objects to check type compatibility. To support non-unique RTTI objects, commit5745eccef5added a `checkTypeInfoEquality` string matching to the runtime. The scheme is inefficient. ``` _Z1fv: .long 846595819 # jmp .long .L__llvm_rtti_proxy-_Z3funv ... main: ... # Load the second word (pointer to the RTTI object) and dereference it. movslq 4(%rsi), %rax movq (%rax,%rsi), %rdx # Is it the desired typeinfo object? leaq _ZTIFvvE(%rip), %rax # If not, call __ubsan_handle_function_type_mismatch_v1, which may recover if checkTypeInfoEquality allows cmpq %rax, %rdx jne .LBB1_2 ... .section .data.rel.ro,"aw",@progbits .p2align 3, 0x0 .L__llvm_rtti_proxy: .quad _ZTIFvvE ``` Let's replace the indirect `_ZTI` pointer with a type hash similar to `-fsanitize=kcfi`. ``` _Z1fv: .long 3238382334 .long 2772461324 # type hash main: ... # Load the second word (callee type hash) and check whether it is expected cmpl $-1522505972, -4(%rax) # If not, fail: call __ubsan_handle_function_type_mismatch jne .LBB2_2 ``` The RTTI object derives its name from `clang::MangleContext::mangleCXXRTTI`, which uses `mangleType`. `mangleTypeName` uses `mangleType` as well. So the type compatibility change is high-fidelity. Since we no longer need RTTI pointers in `__ubsan::__ubsan_handle_function_type_mismatch_v1`, let's switch it back to version 0, the original signature beforee215996a29(2019). `__ubsan::__ubsan_handle_function_type_mismatch_abort` is not recoverable, so we can revert some changes frome215996a29. Reviewed By: samitolvanen Differential Revision: https://reviews.llvm.org/D148785
107 lines
3.1 KiB
LLVM
107 lines
3.1 KiB
LLVM
; RUN: llc -mtriple=aarch64 %s -o - | FileCheck %s
|
|
|
|
define void @f0() "patchable-function-entry"="0" "branch-target-enforcement"="true" {
|
|
; CHECK-LABEL: f0:
|
|
; CHECK-NEXT: .Lfunc_begin0:
|
|
; CHECK: // %bb.0:
|
|
; CHECK-NEXT: hint #34
|
|
; CHECK-NEXT: ret
|
|
; CHECK-NOT: .section __patchable_function_entries
|
|
ret void
|
|
}
|
|
|
|
;; -fpatchable-function-entry=1 -mbranch-protection=bti
|
|
;; For M=0, place the label .Lpatch0 after the initial BTI.
|
|
define void @f1() "patchable-function-entry"="1" "branch-target-enforcement"="true" {
|
|
; CHECK-LABEL: f1:
|
|
; CHECK-NEXT: .Lfunc_begin1:
|
|
; CHECK-NEXT: .cfi_startproc
|
|
; CHECK-NEXT: // %bb.0:
|
|
; CHECK-NEXT: hint #34
|
|
; CHECK-NEXT: .Lpatch0:
|
|
; CHECK-NEXT: nop
|
|
; CHECK-NEXT: ret
|
|
; CHECK: .section __patchable_function_entries,"awo",@progbits,f1{{$}}
|
|
; CHECK-NEXT: .p2align 3
|
|
; CHECK-NEXT: .xword .Lpatch0
|
|
ret void
|
|
}
|
|
|
|
;; -fpatchable-function-entry=2,1 -mbranch-protection=bti
|
|
define void @f2_1() "patchable-function-entry"="1" "patchable-function-prefix"="1" "branch-target-enforcement"="true" {
|
|
; CHECK-LABEL: .type f2_1,@function
|
|
; CHECK-NEXT: .Ltmp0:
|
|
; CHECK-NEXT: nop
|
|
; CHECK-NEXT: f2_1:
|
|
; CHECK-NEXT: .Lfunc_begin2:
|
|
; CHECK-NEXT: .cfi_startproc
|
|
; CHECK-NEXT: // %bb.0:
|
|
; CHECK-NEXT: hint #34
|
|
; CHECK-NEXT: nop
|
|
; CHECK-NEXT: ret
|
|
; CHECK: .Lfunc_end2:
|
|
; CHECK-NEXT: .size f2_1, .Lfunc_end2-f2_1
|
|
; CHECK: .section __patchable_function_entries,"awo",@progbits,f2_1{{$}}
|
|
; CHECK-NEXT: .p2align 3
|
|
; CHECK-NEXT: .xword .Ltmp0
|
|
ret void
|
|
}
|
|
|
|
;; -fpatchable-function-entry=1 -mbranch-protection=bti
|
|
;; We add BTI c even when the function has internal linkage
|
|
define internal void @f1i(i64 %v) "patchable-function-entry"="1" "branch-target-enforcement"="true" {
|
|
; CHECK-LABEL: f1i:
|
|
; CHECK-NEXT: .Lfunc_begin3:
|
|
; CHECK: // %bb.0:
|
|
; CHECK-NEXT: hint #34
|
|
; CHECK-NEXT: .Lpatch1:
|
|
; CHECK-NEXT: nop
|
|
;; Other basic blocks have BTI, but they don't affect our decision to not create .Lpatch0
|
|
; CHECK: .LBB{{.+}} // %sw.bb1
|
|
; CHECK-NEXT: hint #36
|
|
; CHECK: .section __patchable_function_entries,"awo",@progbits,f1i{{$}}
|
|
; CHECK-NEXT: .p2align 3
|
|
; CHECK-NEXT: .xword .Lpatch1
|
|
entry:
|
|
switch i64 %v, label %sw.bb0 [
|
|
i64 1, label %sw.bb1
|
|
i64 2, label %sw.bb2
|
|
i64 3, label %sw.bb3
|
|
i64 4, label %sw.bb4
|
|
]
|
|
sw.bb0:
|
|
call void asm sideeffect "", ""()
|
|
ret void
|
|
sw.bb1:
|
|
call void asm sideeffect "", ""()
|
|
ret void
|
|
sw.bb2:
|
|
call void asm sideeffect "", ""()
|
|
ret void
|
|
sw.bb3:
|
|
call void asm sideeffect "", ""()
|
|
ret void
|
|
sw.bb4:
|
|
call void asm sideeffect "", ""()
|
|
ret void
|
|
}
|
|
|
|
;; Test the interaction with -fsanitize=function.
|
|
; CHECK: .type sanitize_function,@function
|
|
; CHECK-NEXT: .Ltmp{{.*}}:
|
|
; CHECK-NEXT: nop
|
|
; CHECK-NEXT: .word 3238382334 // 0xc105cafe
|
|
; CHECK-NEXT: .word 42
|
|
; CHECK-NEXT: sanitize_function:
|
|
; CHECK-NEXT: .Lfunc_begin{{.*}}:
|
|
; CHECK-NEXT: .cfi_startproc
|
|
; CHECK-NEXT: // %bb.0:
|
|
; CHECK-NEXT: hint #34
|
|
; CHECK-NEXT: nop
|
|
; CHECK-NEXT: ret
|
|
define void @sanitize_function(ptr noundef %x) "patchable-function-prefix"="1" "patchable-function-entry"="1" "branch-target-enforcement"="true" !func_sanitize !0 {
|
|
ret void
|
|
}
|
|
|
|
!0 = !{i32 3238382334, i32 42}
|