<div dir="ltr"><br><br><div class="gmail_quote"><div dir="ltr">On Fri, Oct 13, 2017 at 2:50 PM Vedant Kumar <<a href="mailto:vsk@apple.com">vsk@apple.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div style="word-wrap:break-word"><div><blockquote type="cite"><div>On Oct 13, 2017, at 1:44 PM, Eric Christopher <<a href="mailto:echristo@gmail.com" target="_blank">echristo@gmail.com</a>> wrote:</div><br class="m_2234658512918948257Apple-interchange-newline"><div><div dir="ltr"><br><br><div class="gmail_quote"><div dir="ltr">On Fri, Oct 13, 2017 at 1:42 PM Vedant Kumar <<a href="mailto:vsk@apple.com" target="_blank">vsk@apple.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div style="word-wrap:break-word"><div><blockquote type="cite"><div>On Oct 13, 2017, at 1:39 PM, Vedant Kumar <<a href="mailto:vsk@apple.com" target="_blank">vsk@apple.com</a>> wrote:</div><br class="m_2234658512918948257m_-5414524569825149145Apple-interchange-newline"><div><div style="word-wrap:break-word"><div>Hey Eric,</div><div><br></div><div>I'm sorry for the breakage. I made sure to check the run-time tests in compiler-rt but we could have missing coverage there.</div><div><br></div><div>The original version of this patch restricted the prologue data changes to Darwin only. We can switch back to that easily, just let me know.</div></div></div></blockquote><div><br></div></div></div><div style="word-wrap:break-word"><div>Actually I'll go ahead and work a patch up.</div></div><div style="word-wrap:break-word"><div><br></div></div></blockquote><div><br></div><div>Appreciated :)</div><div><br></div><div>Basically we were getting an error of:</div><div><br></div><div><span style="color:rgb(33,33,33);font-size:13px">error: Cannot represent a difference across sections</span><br style="color:rgb(33,33,33);font-size:13px"></div><div><span style="color:rgb(33,33,33);font-size:13px"><br></span></div><div><span style="color:rgb(33,33,33);font-size:13px">trying to compile things with the current code.</span></div></div></div></div></blockquote><div><br></div></div></div><div style="word-wrap:break-word"><div><div>Oh I see.. well, we started using a difference between the address of a function and the address of a global, so the error makes sense.</div><div><br></div><div>I'd be interested in any factors that could narrow the problem down (e.g using a specific linker, using -ffunction-sections, using data-sections, etc). Basically I'm not sure why this would work on some Linux setups but not others.</div><div><br></div></div></div></blockquote><div><br></div><div>Definitely using the latter two options and gold as a linker. I'll see what Han can come up with.</div><div> </div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div style="word-wrap:break-word"><div><div></div><div>While we figure that out here's a patch to limit the impact on non-Darwin platforms:</div><div><a href="https://reviews.llvm.org/D38903" target="_blank">https://reviews.llvm.org/D38903</a></div></div></div></blockquote><div><br></div><div>*goes a looking*</div><div><br></div><div>Thanks!</div><div><br></div><div>-eric </div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div style="word-wrap:break-word"><div><div><br></div><div>vedant</div></div></div><div style="word-wrap:break-word"><div><br><blockquote type="cite"><div><div dir="ltr"><div class="gmail_quote"><div><span style="color:rgb(33,33,33);font-size:13px"><br></span></div><div><span style="color:rgb(33,33,33);font-size:13px">Thanks!</span></div><div><br></div><div><font color="#212121">-eric</font></div><div> </div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div style="word-wrap:break-word"><div></div><div>vedant</div></div><div style="word-wrap:break-word"><div><br><blockquote type="cite"><div><div style="word-wrap:break-word"><div><br></div><div>vedant</div><div><br></div><br><div><blockquote type="cite"><div>On Oct 13, 2017, at 1:33 PM, Eric Christopher <<a href="mailto:echristo@gmail.com" target="_blank">echristo@gmail.com</a>> wrote:</div><br class="m_2234658512918948257m_-5414524569825149145Apple-interchange-newline"><div><div dir="ltr">Hi Vedant,<div><br></div><div>So this actually broke -fsanitize=function on linux. Han is working up a testcase for it, but letting you know for now that we'll probably need some change here.</div><div><br></div><div>-eric<br><br><div class="gmail_quote"><div dir="ltr">On Tue, Sep 12, 2017 at 5:05 PM Vedant Kumar via cfe-commits <<a href="mailto:cfe-commits@lists.llvm.org" target="_blank">cfe-commits@lists.llvm.org</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Author: vedantk<br>
Date: Tue Sep 12 17:04:35 2017<br>
New Revision: 313096<br>
<br>
URL: <a href="http://llvm.org/viewvc/llvm-project?rev=313096&view=rev" rel="noreferrer" target="_blank">http://llvm.org/viewvc/llvm-project?rev=313096&view=rev</a><br>
Log:<br>
[ubsan] Function Sanitizer: Don't require writable text segments<br>
<br>
This change will make it possible to use -fsanitize=function on Darwin and<br>
possibly on other platforms. It fixes an issue with the way RTTI is stored into<br>
function prologue data.<br>
<br>
On Darwin, addresses stored in prologue data can't require run-time fixups and<br>
must be PC-relative. Run-time fixups are undesirable because they necessitate<br>
writable text segments, which can lead to security issues. And absolute<br>
addresses are undesirable because they break PIE mode.<br>
<br>
The fix is to create a private global which points to the RTTI, and then to<br>
encode a PC-relative reference to the global into prologue data.<br>
<br>
Differential Revision: <a href="https://reviews.llvm.org/D37597" rel="noreferrer" target="_blank">https://reviews.llvm.org/D37597</a><br>
<br>
Modified:<br>
cfe/trunk/lib/CodeGen/CGExpr.cpp<br>
cfe/trunk/lib/CodeGen/CodeGenFunction.cpp<br>
cfe/trunk/lib/CodeGen/CodeGenFunction.h<br>
cfe/trunk/lib/CodeGen/TargetInfo.cpp<br>
cfe/trunk/test/CodeGenCXX/catch-undef-behavior.cpp<br>
<br>
Modified: cfe/trunk/lib/CodeGen/CGExpr.cpp<br>
URL: <a href="http://llvm.org/viewvc/llvm-project/cfe/trunk/lib/CodeGen/CGExpr.cpp?rev=313096&r1=313095&r2=313096&view=diff" rel="noreferrer" target="_blank">http://llvm.org/viewvc/llvm-project/cfe/trunk/lib/CodeGen/CGExpr.cpp?rev=313096&r1=313095&r2=313096&view=diff</a><br>
==============================================================================<br>
--- cfe/trunk/lib/CodeGen/CGExpr.cpp (original)<br>
+++ cfe/trunk/lib/CodeGen/CGExpr.cpp Tue Sep 12 17:04:35 2017<br>
@@ -4409,10 +4409,7 @@ RValue CodeGenFunction::EmitCall(QualTyp<br>
SanitizerScope SanScope(this);<br>
llvm::Constant *FTRTTIConst =<br>
CGM.GetAddrOfRTTIDescriptor(QualType(FnType, 0), /*ForEH=*/true);<br>
- llvm::Type *PrefixStructTyElems[] = {<br>
- PrefixSig->getType(),<br>
- FTRTTIConst->getType()<br>
- };<br>
+ llvm::Type *PrefixStructTyElems[] = {PrefixSig->getType(), Int32Ty};<br>
llvm::StructType *PrefixStructTy = llvm::StructType::get(<br>
CGM.getLLVMContext(), PrefixStructTyElems, /*isPacked=*/true);<br>
<br>
@@ -4433,8 +4430,10 @@ RValue CodeGenFunction::EmitCall(QualTyp<br>
EmitBlock(TypeCheck);<br>
llvm::Value *CalleeRTTIPtr =<br>
Builder.CreateConstGEP2_32(PrefixStructTy, CalleePrefixStruct, 0, 1);<br>
- llvm::Value *CalleeRTTI =<br>
+ llvm::Value *CalleeRTTIEncoded =<br>
Builder.CreateAlignedLoad(CalleeRTTIPtr, getPointerAlign());<br>
+ llvm::Value *CalleeRTTI =<br>
+ DecodeAddrUsedInPrologue(CalleePtr, CalleeRTTIEncoded);<br>
llvm::Value *CalleeRTTIMatch =<br>
Builder.CreateICmpEQ(CalleeRTTI, FTRTTIConst);<br>
llvm::Constant *StaticData[] = {<br>
<br>
Modified: cfe/trunk/lib/CodeGen/CodeGenFunction.cpp<br>
URL: <a href="http://llvm.org/viewvc/llvm-project/cfe/trunk/lib/CodeGen/CodeGenFunction.cpp?rev=313096&r1=313095&r2=313096&view=diff" rel="noreferrer" target="_blank">http://llvm.org/viewvc/llvm-project/cfe/trunk/lib/CodeGen/CodeGenFunction.cpp?rev=313096&r1=313095&r2=313096&view=diff</a><br>
==============================================================================<br>
--- cfe/trunk/lib/CodeGen/CodeGenFunction.cpp (original)<br>
+++ cfe/trunk/lib/CodeGen/CodeGenFunction.cpp Tue Sep 12 17:04:35 2017<br>
@@ -429,6 +429,43 @@ bool CodeGenFunction::ShouldXRayInstrume<br>
return CGM.getCodeGenOpts().XRayInstrumentFunctions;<br>
}<br>
<br>
+llvm::Constant *<br>
+CodeGenFunction::EncodeAddrForUseInPrologue(llvm::Function *F,<br>
+ llvm::Constant *Addr) {<br>
+ // Addresses stored in prologue data can't require run-time fixups and must<br>
+ // be PC-relative. Run-time fixups are undesirable because they necessitate<br>
+ // writable text segments, which are unsafe. And absolute addresses are<br>
+ // undesirable because they break PIE mode.<br>
+<br>
+ // Add a layer of indirection through a private global. Taking its address<br>
+ // won't result in a run-time fixup, even if Addr has linkonce_odr linkage.<br>
+ auto *GV = new llvm::GlobalVariable(CGM.getModule(), Addr->getType(),<br>
+ /*isConstant=*/true,<br>
+ llvm::GlobalValue::PrivateLinkage, Addr);<br>
+<br>
+ // Create a PC-relative address.<br>
+ auto *GOTAsInt = llvm::ConstantExpr::getPtrToInt(GV, IntPtrTy);<br>
+ auto *FuncAsInt = llvm::ConstantExpr::getPtrToInt(F, IntPtrTy);<br>
+ auto *PCRelAsInt = llvm::ConstantExpr::getSub(GOTAsInt, FuncAsInt);<br>
+ return (IntPtrTy == Int32Ty)<br>
+ ? PCRelAsInt<br>
+ : llvm::ConstantExpr::getTrunc(PCRelAsInt, Int32Ty);<br>
+}<br>
+<br>
+llvm::Value *<br>
+CodeGenFunction::DecodeAddrUsedInPrologue(llvm::Value *F,<br>
+ llvm::Value *EncodedAddr) {<br>
+ // Reconstruct the address of the global.<br>
+ auto *PCRelAsInt = Builder.CreateSExt(EncodedAddr, IntPtrTy);<br>
+ auto *FuncAsInt = Builder.CreatePtrToInt(F, IntPtrTy, "<a href="http://func_addr.int/" rel="noreferrer" target="_blank">func_addr.int</a>");<br>
+ auto *GOTAsInt = Builder.CreateAdd(PCRelAsInt, FuncAsInt, "<a href="http://global_addr.int/" rel="noreferrer" target="_blank">global_addr.int</a>");<br>
+ auto *GOTAddr = Builder.CreateIntToPtr(GOTAsInt, Int8PtrPtrTy, "global_addr");<br>
+<br>
+ // Load the original pointer through the global.<br>
+ return Builder.CreateLoad(Address(GOTAddr, getPointerAlign()),<br>
+ "decoded_addr");<br>
+}<br>
+<br>
/// EmitFunctionInstrumentation - Emit LLVM code to call the specified<br>
/// instrumentation function with the current function and the call site, if<br>
/// function instrumentation is enabled.<br>
@@ -856,7 +893,10 @@ void CodeGenFunction::StartFunction(Glob<br>
CGM.getTargetCodeGenInfo().getUBSanFunctionSignature(CGM)) {<br>
llvm::Constant *FTRTTIConst =<br>
CGM.GetAddrOfRTTIDescriptor(FD->getType(), /*ForEH=*/true);<br>
- llvm::Constant *PrologueStructElems[] = { PrologueSig, FTRTTIConst };<br>
+ llvm::Constant *FTRTTIConstEncoded =<br>
+ EncodeAddrForUseInPrologue(Fn, FTRTTIConst);<br>
+ llvm::Constant *PrologueStructElems[] = {PrologueSig,<br>
+ FTRTTIConstEncoded};<br>
llvm::Constant *PrologueStructConst =<br>
llvm::ConstantStruct::getAnon(PrologueStructElems, /*Packed=*/true);<br>
Fn->setPrologueData(PrologueStructConst);<br>
<br>
Modified: cfe/trunk/lib/CodeGen/CodeGenFunction.h<br>
URL: <a href="http://llvm.org/viewvc/llvm-project/cfe/trunk/lib/CodeGen/CodeGenFunction.h?rev=313096&r1=313095&r2=313096&view=diff" rel="noreferrer" target="_blank">http://llvm.org/viewvc/llvm-project/cfe/trunk/lib/CodeGen/CodeGenFunction.h?rev=313096&r1=313095&r2=313096&view=diff</a><br>
==============================================================================<br>
--- cfe/trunk/lib/CodeGen/CodeGenFunction.h (original)<br>
+++ cfe/trunk/lib/CodeGen/CodeGenFunction.h Tue Sep 12 17:04:35 2017<br>
@@ -1776,6 +1776,15 @@ public:<br>
/// EmitMCountInstrumentation - Emit call to .mcount.<br>
void EmitMCountInstrumentation();<br>
<br>
+ /// Encode an address into a form suitable for use in a function prologue.<br>
+ llvm::Constant *EncodeAddrForUseInPrologue(llvm::Function *F,<br>
+ llvm::Constant *Addr);<br>
+<br>
+ /// Decode an address used in a function prologue, encoded by \c<br>
+ /// EncodeAddrForUseInPrologue.<br>
+ llvm::Value *DecodeAddrUsedInPrologue(llvm::Value *F,<br>
+ llvm::Value *EncodedAddr);<br>
+<br>
/// EmitFunctionProlog - Emit the target specific LLVM code to load the<br>
/// arguments for the given function. This is also responsible for naming the<br>
/// LLVM function arguments.<br>
<br>
Modified: cfe/trunk/lib/CodeGen/TargetInfo.cpp<br>
URL: <a href="http://llvm.org/viewvc/llvm-project/cfe/trunk/lib/CodeGen/TargetInfo.cpp?rev=313096&r1=313095&r2=313096&view=diff" rel="noreferrer" target="_blank">http://llvm.org/viewvc/llvm-project/cfe/trunk/lib/CodeGen/TargetInfo.cpp?rev=313096&r1=313095&r2=313096&view=diff</a><br>
==============================================================================<br>
--- cfe/trunk/lib/CodeGen/TargetInfo.cpp (original)<br>
+++ cfe/trunk/lib/CodeGen/TargetInfo.cpp Tue Sep 12 17:04:35 2017<br>
@@ -1086,8 +1086,8 @@ public:<br>
getUBSanFunctionSignature(CodeGen::CodeGenModule &CGM) const override {<br>
unsigned Sig = (0xeb << 0) | // jmp rel8<br>
(0x06 << 8) | // .+0x08<br>
- ('F' << 16) |<br>
- ('T' << 24);<br>
+ ('v' << 16) |<br>
+ ('2' << 24);<br>
return llvm::ConstantInt::get(CGM.Int32Ty, Sig);<br>
}<br>
<br>
@@ -2277,17 +2277,10 @@ public:<br>
<br>
llvm::Constant *<br>
getUBSanFunctionSignature(CodeGen::CodeGenModule &CGM) const override {<br>
- unsigned Sig;<br>
- if (getABIInfo().has64BitPointers())<br>
- Sig = (0xeb << 0) | // jmp rel8<br>
- (0x0a << 8) | // .+0x0c<br>
- ('F' << 16) |<br>
- ('T' << 24);<br>
- else<br>
- Sig = (0xeb << 0) | // jmp rel8<br>
- (0x06 << 8) | // .+0x08<br>
- ('F' << 16) |<br>
- ('T' << 24);<br>
+ unsigned Sig = (0xeb << 0) | // jmp rel8<br>
+ (0x06 << 8) | // .+0x08<br>
+ ('v' << 16) |<br>
+ ('2' << 24);<br>
return llvm::ConstantInt::get(CGM.Int32Ty, Sig);<br>
}<br>
<br>
<br>
Modified: cfe/trunk/test/CodeGenCXX/catch-undef-behavior.cpp<br>
URL: <a href="http://llvm.org/viewvc/llvm-project/cfe/trunk/test/CodeGenCXX/catch-undef-behavior.cpp?rev=313096&r1=313095&r2=313096&view=diff" rel="noreferrer" target="_blank">http://llvm.org/viewvc/llvm-project/cfe/trunk/test/CodeGenCXX/catch-undef-behavior.cpp?rev=313096&r1=313095&r2=313096&view=diff</a><br>
==============================================================================<br>
--- cfe/trunk/test/CodeGenCXX/catch-undef-behavior.cpp (original)<br>
+++ cfe/trunk/test/CodeGenCXX/catch-undef-behavior.cpp Tue Sep 12 17:04:35 2017<br>
@@ -16,6 +16,10 @@ struct S {<br>
// Check that type mismatch handler is not modified by ASan.<br>
// CHECK-ASAN: private unnamed_addr global { { [{{.*}} x i8]*, i32, i32 }, { i16, i16, [4 x i8] }*, i8*, i8 } { {{.*}}, { i16, i16, [4 x i8] }* [[TYPE_DESCR]], {{.*}} }<br>
<br>
+// CHECK: [[IndirectRTTI_ZTIFvPFviEE:@.+]] = private constant i8* bitcast ({ i8*, i8* }* @_ZTIFvPFviEE to i8*)<br>
+// CHECK-X86: [[IndirectRTTI_ZTIFvPFviEE:@.+]] = private constant i8* bitcast ({ i8*, i8* }* @_ZTIFvPFviEE to i8*)<br>
+// CHECK-X32: [[IndirectRTTI_ZTIFvPFviEE:@.+]] = private constant i8* bitcast ({ i8*, i8* }* @_ZTIFvPFviEE to i8*)<br>
+<br>
struct T : S {};<br>
<br>
// CHECK-LABEL: @_Z17reference_binding<br>
@@ -395,23 +399,30 @@ void downcast_reference(B &b) {<br>
// CHECK-NEXT: br i1 [[AND]]<br>
}<br>
<br>
-// CHECK-LABEL: @_Z22indirect_function_callPFviE({{.*}} prologue <{ i32, i8* }> <{ i32 1413876459, i8* bitcast ({ i8*, i8* }* @_ZTIFvPFviEE to i8*) }><br>
-// CHECK-X32: @_Z22indirect_function_callPFviE({{.*}} prologue <{ i32, i8* }> <{ i32 1413875435, i8* bitcast ({ i8*, i8* }* @_ZTIFvPFviEE to i8*) }><br>
-// CHECK-X86: @_Z22indirect_function_callPFviE({{.*}} prologue <{ i32, i8* }> <{ i32 1413875435, i8* bitcast ({ i8*, i8* }* @_ZTIFvPFviEE to i8*) }><br>
+//<br>
+// CHECK-LABEL: @_Z22indirect_function_callPFviE({{.*}} prologue <{ i32, i32 }> <{ i32 846595819, i32 trunc (i64 sub (i64 ptrtoint (i8** {{.*}} to i64), i64 ptrtoint (void (void (i32)*)* @_Z22indirect_function_callPFviE to i64)) to i32) }><br>
+// CHECK-X32: @_Z22indirect_function_callPFviE({{.*}} prologue <{ i32, i32 }> <{ i32 846595819, i32 sub (i32 ptrtoint (i8** [[IndirectRTTI_ZTIFvPFviEE]] to i32), i32 ptrtoint (void (void (i32)*)* @_Z22indirect_function_callPFviE to i32)) }><br>
+// CHECK-X86: @_Z22indirect_function_callPFviE({{.*}} prologue <{ i32, i32 }> <{ i32 846595819, i32 sub (i32 ptrtoint (i8** [[IndirectRTTI_ZTIFvPFviEE]] to i32), i32 ptrtoint (void (void (i32)*)* @_Z22indirect_function_callPFviE to i32)) }><br>
void indirect_function_call(void (*p)(int)) {<br>
- // CHECK: [[PTR:%.+]] = bitcast void (i32)* {{.*}} to <{ i32, i8* }>*<br>
+ // CHECK: [[PTR:%.+]] = bitcast void (i32)* {{.*}} to <{ i32, i32 }>*<br>
<br>
// Signature check<br>
- // CHECK-NEXT: [[SIGPTR:%.+]] = getelementptr <{ i32, i8* }>, <{ i32, i8* }>* [[PTR]], i32 0, i32 0<br>
+ // CHECK-NEXT: [[SIGPTR:%.+]] = getelementptr <{ i32, i32 }>, <{ i32, i32 }>* [[PTR]], i32 0, i32 0<br>
// CHECK-NEXT: [[SIG:%.+]] = load i32, i32* [[SIGPTR]]<br>
- // CHECK-NEXT: [[SIGCMP:%.+]] = icmp eq i32 [[SIG]], 1413876459<br>
+ // CHECK-NEXT: [[SIGCMP:%.+]] = icmp eq i32 [[SIG]], 846595819<br>
// CHECK-NEXT: br i1 [[SIGCMP]]<br>
<br>
// RTTI pointer check<br>
- // CHECK: [[RTTIPTR:%.+]] = getelementptr <{ i32, i8* }>, <{ i32, i8* }>* [[PTR]], i32 0, i32 1<br>
- // CHECK-NEXT: [[RTTI:%.+]] = load i8*, i8** [[RTTIPTR]]<br>
+ // CHECK: [[RTTIPTR:%.+]] = getelementptr <{ i32, i32 }>, <{ i32, i32 }>* [[PTR]], i32 0, i32 1<br>
+ // CHECK-NEXT: [[RTTIEncIntTrunc:%.+]] = load i32, i32* [[RTTIPTR]]<br>
+ // CHECK-NEXT: [[RTTIEncInt:%.+]] = sext i32 [[RTTIEncIntTrunc]] to i64<br>
+ // CHECK-NEXT: [[FuncAddrInt:%.+]] = ptrtoint void (i32)* {{.*}} to i64<br>
+ // CHECK-NEXT: [[IndirectGVInt:%.+]] = add i64 [[RTTIEncInt]], [[FuncAddrInt]]<br>
+ // CHECK-NEXT: [[IndirectGV:%.+]] = inttoptr i64 [[IndirectGVInt]] to i8**<br>
+ // CHECK-NEXT: [[RTTI:%.+]] = load i8*, i8** [[IndirectGV]], align 8<br>
// CHECK-NEXT: [[RTTICMP:%.+]] = icmp eq i8* [[RTTI]], bitcast ({ i8*, i8* }* @_ZTIFviE to i8*)<br>
// CHECK-NEXT: br i1 [[RTTICMP]]<br>
+<br>
p(42);<br>
}<br>
<br>
<br>
<br>
_______________________________________________<br>
cfe-commits mailing list<br>
<a href="mailto:cfe-commits@lists.llvm.org" target="_blank">cfe-commits@lists.llvm.org</a><br>
<a href="http://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits" rel="noreferrer" target="_blank">http://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits</a><br>
</blockquote></div></div></div>
</div></blockquote></div><br></div></div></blockquote></div><br></div></blockquote></div></div>
</div></blockquote></div></div></blockquote></div></div>