mirror of
https://github.com/c64scene-ar/llvm-6502.git
synced 2025-01-09 10:31:14 +00:00
7ffec838a2
This patch adds the safe stack instrumentation pass to LLVM, which separates the program stack into a safe stack, which stores return addresses, register spills, and local variables that are statically verified to be accessed in a safe way, and the unsafe stack, which stores everything else. Such separation makes it much harder for an attacker to corrupt objects on the safe stack, including function pointers stored in spilled registers and return addresses. You can find more information about the safe stack, as well as other parts of or control-flow hijack protection technique in our OSDI paper on code-pointer integrity (http://dslab.epfl.ch/pubs/cpi.pdf) and our project website (http://levee.epfl.ch). The overhead of our implementation of the safe stack is very close to zero (0.01% on the Phoronix benchmarks). This is lower than the overhead of stack cookies, which are supported by LLVM and are commonly used today, yet the security guarantees of the safe stack are strictly stronger than stack cookies. In some cases, the safe stack improves performance due to better cache locality. Our current implementation of the safe stack is stable and robust, we used it to recompile multiple projects on Linux including Chromium, and we also recompiled the entire FreeBSD user-space system and more than 100 packages. We ran unit tests on the FreeBSD system and many of the packages and observed no errors caused by the safe stack. The safe stack is also fully binary compatible with non-instrumented code and can be applied to parts of a program selectively. This patch is our implementation of the safe stack on top of LLVM. The patches make the following changes: - Add the safestack function attribute, similar to the ssp, sspstrong and sspreq attributes. - Add the SafeStack instrumentation pass that applies the safe stack to all functions that have the safestack attribute. This pass moves all unsafe local variables to the unsafe stack with a separate stack pointer, whereas all safe variables remain on the regular stack that is managed by LLVM as usual. - Invoke the pass as the last stage before code generation (at the same time the existing cookie-based stack protector pass is invoked). - Add unit tests for the safe stack. Original patch by Volodymyr Kuznetsov and others at the Dependable Systems Lab at EPFL; updates and upstreaming by myself. Differential Revision: http://reviews.llvm.org/D6094 git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@239761 91177308-0d34-0410-b5e6-96231b3b80d8
142 lines
4.5 KiB
C++
142 lines
4.5 KiB
C++
//===- Transforms/Instrumentation.h - Instrumentation passes ----*- C++ -*-===//
|
|
//
|
|
// The LLVM Compiler Infrastructure
|
|
//
|
|
// This file is distributed under the University of Illinois Open Source
|
|
// License. See LICENSE.TXT for details.
|
|
//
|
|
//===----------------------------------------------------------------------===//
|
|
//
|
|
// This file defines constructor functions for instrumentation passes.
|
|
//
|
|
//===----------------------------------------------------------------------===//
|
|
|
|
#ifndef LLVM_TRANSFORMS_INSTRUMENTATION_H
|
|
#define LLVM_TRANSFORMS_INSTRUMENTATION_H
|
|
|
|
#include "llvm/ADT/StringRef.h"
|
|
#include <vector>
|
|
|
|
#if defined(__GNUC__) && defined(__linux__) && !defined(ANDROID)
|
|
inline void *getDFSanArgTLSPtrForJIT() {
|
|
extern __thread __attribute__((tls_model("initial-exec")))
|
|
void *__dfsan_arg_tls;
|
|
return (void *)&__dfsan_arg_tls;
|
|
}
|
|
|
|
inline void *getDFSanRetValTLSPtrForJIT() {
|
|
extern __thread __attribute__((tls_model("initial-exec")))
|
|
void *__dfsan_retval_tls;
|
|
return (void *)&__dfsan_retval_tls;
|
|
}
|
|
#endif
|
|
|
|
namespace llvm {
|
|
|
|
class ModulePass;
|
|
class FunctionPass;
|
|
|
|
// Insert GCOV profiling instrumentation
|
|
struct GCOVOptions {
|
|
static GCOVOptions getDefault();
|
|
|
|
// Specify whether to emit .gcno files.
|
|
bool EmitNotes;
|
|
|
|
// Specify whether to modify the program to emit .gcda files when run.
|
|
bool EmitData;
|
|
|
|
// A four-byte version string. The meaning of a version string is described in
|
|
// gcc's gcov-io.h
|
|
char Version[4];
|
|
|
|
// Emit a "cfg checksum" that follows the "line number checksum" of a
|
|
// function. This affects both .gcno and .gcda files.
|
|
bool UseCfgChecksum;
|
|
|
|
// Add the 'noredzone' attribute to added runtime library calls.
|
|
bool NoRedZone;
|
|
|
|
// Emit the name of the function in the .gcda files. This is redundant, as
|
|
// the function identifier can be used to find the name from the .gcno file.
|
|
bool FunctionNamesInData;
|
|
|
|
// Emit the exit block immediately after the start block, rather than after
|
|
// all of the function body's blocks.
|
|
bool ExitBlockBeforeBody;
|
|
};
|
|
ModulePass *createGCOVProfilerPass(const GCOVOptions &Options =
|
|
GCOVOptions::getDefault());
|
|
|
|
/// Options for the frontend instrumentation based profiling pass.
|
|
struct InstrProfOptions {
|
|
InstrProfOptions() : NoRedZone(false) {}
|
|
|
|
// Add the 'noredzone' attribute to added runtime library calls.
|
|
bool NoRedZone;
|
|
|
|
// Name of the profile file to use as output
|
|
std::string InstrProfileOutput;
|
|
};
|
|
|
|
/// Insert frontend instrumentation based profiling.
|
|
ModulePass *createInstrProfilingPass(
|
|
const InstrProfOptions &Options = InstrProfOptions());
|
|
|
|
// Insert AddressSanitizer (address sanity checking) instrumentation
|
|
FunctionPass *createAddressSanitizerFunctionPass();
|
|
ModulePass *createAddressSanitizerModulePass();
|
|
|
|
// Insert MemorySanitizer instrumentation (detection of uninitialized reads)
|
|
FunctionPass *createMemorySanitizerPass(int TrackOrigins = 0);
|
|
|
|
// Insert ThreadSanitizer (race detection) instrumentation
|
|
FunctionPass *createThreadSanitizerPass();
|
|
|
|
// Insert DataFlowSanitizer (dynamic data flow analysis) instrumentation
|
|
ModulePass *createDataFlowSanitizerPass(
|
|
const std::vector<std::string> &ABIListFiles = std::vector<std::string>(),
|
|
void *(*getArgTLS)() = nullptr, void *(*getRetValTLS)() = nullptr);
|
|
|
|
// Options for sanitizer coverage instrumentation.
|
|
struct SanitizerCoverageOptions {
|
|
SanitizerCoverageOptions()
|
|
: CoverageType(SCK_None), IndirectCalls(false), TraceBB(false),
|
|
TraceCmp(false), Use8bitCounters(false) {}
|
|
|
|
enum Type {
|
|
SCK_None = 0,
|
|
SCK_Function,
|
|
SCK_BB,
|
|
SCK_Edge
|
|
} CoverageType;
|
|
bool IndirectCalls;
|
|
bool TraceBB;
|
|
bool TraceCmp;
|
|
bool Use8bitCounters;
|
|
};
|
|
|
|
// Insert SanitizerCoverage instrumentation.
|
|
ModulePass *createSanitizerCoverageModulePass(
|
|
const SanitizerCoverageOptions &Options = SanitizerCoverageOptions());
|
|
|
|
#if defined(__GNUC__) && defined(__linux__) && !defined(ANDROID)
|
|
inline ModulePass *createDataFlowSanitizerPassForJIT(
|
|
const std::vector<std::string> &ABIListFiles = std::vector<std::string>()) {
|
|
return createDataFlowSanitizerPass(ABIListFiles, getDFSanArgTLSPtrForJIT,
|
|
getDFSanRetValTLSPtrForJIT);
|
|
}
|
|
#endif
|
|
|
|
// BoundsChecking - This pass instruments the code to perform run-time bounds
|
|
// checking on loads, stores, and other memory intrinsics.
|
|
FunctionPass *createBoundsCheckingPass();
|
|
|
|
/// \brief This pass splits the stack into a safe stack and an unsafe stack to
|
|
/// protect against stack-based overflow vulnerabilities.
|
|
FunctionPass *createSafeStackPass();
|
|
|
|
} // End llvm namespace
|
|
|
|
#endif
|