<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:SimSun;
panose-1:2 1 6 0 3 1 1 1 1 1;}
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:"Segoe UI";
panose-1:2 11 5 2 4 2 4 2 2 3;}
@font-face
{font-family:"\@SimSun";
panose-1:2 1 6 0 3 1 1 1 1 1;}
@font-face
{font-family:Consolas;
panose-1:2 11 6 9 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
p
{mso-style-priority:99;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
pre
{mso-style-priority:99;
mso-style-link:"HTML Preformatted Char";
margin:0in;
margin-bottom:.0001pt;
font-size:10.0pt;
font-family:"Courier New";}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
span.HTMLPreformattedChar
{mso-style-name:"HTML Preformatted Char";
mso-style-priority:99;
mso-style-link:"HTML Preformatted";
font-family:"Courier New";}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<pre style="line-height:11.25pt;background:white"><span style="font-size:9.0pt;font-family:Consolas;color:black">Control-flow Enforcement Technology (CET)<o:p></o:p></span></pre>
<p style="mso-margin-top-alt:0in;margin-right:0in;margin-bottom:9.0pt;margin-left:0in;background:white;font-variant-ligatures: normal;font-variant-caps: normal;orphans: 2;widows: 2;-webkit-text-stroke-width: 0px;text-decoration-style: initial;text-decoration-color: initial;word-spacing:0px">
<span style="font-size:10.0pt;font-family:"Segoe UI",sans-serif;color:black">provides the following capabilities to defend against ROP/JOP style control-flow subversion attacks:<o:p></o:p></span></p>
<pre style="line-height:11.25pt;background:white rgba(71, 87, 120, 0.08);border-radius: 3px;white-space:pre-wrap;overflow:auto"><span style="font-size:9.0pt;font-family:Consolas;color:black">Shadow Stack (SHSTK) – return address protection to defend against Return Oriented Programming,<o:p></o:p></span></pre>
<p style="mso-margin-top-alt:0in;margin-right:0in;margin-bottom:9.0pt;margin-left:0in;background:white;font-variant-ligatures: normal;font-variant-caps: normal;orphans: 2;widows: 2;-webkit-text-stroke-width: 0px;text-decoration-style: initial;text-decoration-color: initial;word-spacing:0px">
<span style="font-size:10.0pt;font-family:"Segoe UI",sans-serif;color:black">A shadow stack is a second stack for the program that is used exclusively for control transfer operations. <br>
This stack is separate from the data stack and can be enabled for operation individually in user mode or supervisor mode.<br>
When shadow stacks are enabled, the CALL instruction pushes the return address on both the data and shadow stack. <br>
The RET instruction pops the return address from both stacks and compares them. <br>
If the return addresses from the two stacks do not match, the processor signals a control protection exception (#CP).<o:p></o:p></span></p>
<pre style="line-height:11.25pt;background:white rgba(71, 87, 120, 0.08);border-radius: 3px;white-space:pre-wrap;overflow:auto"><span style="font-size:9.0pt;font-family:Consolas;color:black">Indirect branch tracking (IBT) – free branch protection to defend against Jump/Call Oriented Programming.<o:p></o:p></span></pre>
<p style="mso-margin-top-alt:0in;margin-right:0in;margin-bottom:9.0pt;margin-left:0in;background:white;font-variant-ligatures: normal;font-variant-caps: normal;orphans: 2;widows: 2;-webkit-text-stroke-width: 0px;text-decoration-style: initial;text-decoration-color: initial;word-spacing:0px">
<span style="font-size:10.0pt;font-family:"Segoe UI",sans-serif;color:black">The ENDBRANCH is a new instruction that is used to mark valid indirect call/jump targets in the program.<br>
This instruction opcode is selected to be one that is a NOP on legacy machines such that programs compiled with ENDBRANCH new instruction continue to function on old machines without the CET enforcement.<br>
On processors that support CET the ENDBRANCH is still a NOP and is primarily used as a marker instruction by the in-order part of the processor pipeline to detect control flow violations.<br>
The CPU implements a state machine that tracks indirect jump and call instructions. When one of these instructions is seen, the state machine moves from IDLE to WAIT_FOR_ENDBRANCH state.<br>
In WAIT_FOR_ENDBRANCH state the next instruction in the program stream must be an ENDBRANCH.<br>
If an ENDBRANCH is not seen the processor causes a control protection fault else the state machine moves back to IDLE state.<o:p></o:p></span></p>
<pre style="line-height:11.25pt;background:white rgba(71, 87, 120, 0.08);border-radius: 3px;white-space:pre-wrap;overflow:auto"><span style="font-size:9.0pt;font-family:Consolas;color:black">Work flow of CET:<o:p></o:p></span></pre>
<p style="mso-margin-top-alt:0in;margin-right:0in;margin-bottom:9.0pt;margin-left:0in;background:white;font-variant-ligatures: normal;font-variant-caps: normal;orphans: 2;widows: 2;-webkit-text-stroke-width: 0px;text-decoration-style: initial;text-decoration-color: initial;word-spacing:0px">
<span style="font-size:10.0pt;font-family:"Segoe UI",sans-serif;color:black">A CET supported executable file will contain the CET flags in its .note.gnu.property section.<br>
(The flags of SHSTK or IBT will be set at the GNU_PROPERTY_X86_FEATURE_1_AND property in .note.gnu.property section if the CET is enabled.)<br>
When run the executable file, CET-enabled OS will check these flags in the related segment, and run the feature accordingly on supported hardware.<br>
If it run on unsupported machines, These CET flags or ENDBRANCH will be ignore.<o:p></o:p></span></p>
<pre style="line-height:11.25pt;background:white rgba(71, 87, 120, 0.08);border-radius: 3px;white-space:pre-wrap;overflow:auto"><span style="font-size:9.0pt;font-family:Consolas;color:black">The key implement of the feature in LLD:<o:p></o:p></span></pre>
<p style="margin:0in;margin-bottom:.0001pt;background:white;font-variant-ligatures: normal;font-variant-caps: normal;orphans: 2;widows: 2;-webkit-text-stroke-width: 0px;text-decoration-style: initial;text-decoration-color: initial;word-spacing:0px">
<span style="font-size:10.0pt;font-family:"Segoe UI",sans-serif;color:black">LLD will first check if all the relocatable object files contain the .note.gnu.property section and if there is GNU_PROPERTY_X86_FEATURE_1_AND property in this section.<br>
If it finds the GNU_PROPERTY_X86_FEATURE_1_AND property in all the relocatable object files,<br>
it will handle the flags in these properties and sections, create the resulting .note.gnu.property section in output file if necessary.<br>
Because the IBT feature needs to insert an endbr* instruction at the end of indirect jump, LLD also deals with the lazy binding by adding a second PLT called SPLT. <br>
Recording to <a href="https://github.com/hjl-tools/x86-psABI/wiki/x86-64-psABI-draft.pdf" target="_blank"><span style="color:#136CB2">https://github.com/hjl-tools/x86-psABI/wiki/x86-64-psABI-draft.pdf</span></a> 13.2 DynamicLinking<o:p></o:p></span></p>
<p style="margin:0in;margin-bottom:.0001pt;background:white"><span style="font-size:10.0pt;font-family:"Segoe UI",sans-serif;color:black"><o:p> </o:p></span></p>
<p style="margin:0in;margin-bottom:.0001pt;background:white"><span style="font-size:10.0pt;font-family:"Segoe UI",sans-serif;color:black">if you have any question about the ABI, please discuss at:
<span style="background:white"> </span></span><a href="https://groups.google.com/forum/#!forum/x86-64-abi" target="_blank"><span style="font-size:10.0pt;font-family:"Segoe UI",sans-serif;color:#136CB2;background:white;text-decoration:none">https://groups.google.com/forum/#!forum/x86-64-abi</span></a><span style="font-size:10.0pt;font-family:"Segoe UI",sans-serif;color:black"><o:p></o:p></span></p>
<p style="margin:0in;margin-bottom:.0001pt;background:white"><span style="font-size:10.0pt;font-family:"Segoe UI",sans-serif;color:black"><o:p> </o:p></span></p>
<p style="margin:0in;margin-bottom:.0001pt;background:white"><span style="font-size:10.0pt;font-family:SimSun;color:black">I have sent the patch to:<o:p></o:p></span></p>
<p style="margin:0in;margin-bottom:.0001pt;background:white"><span style="font-size:10.0pt;font-family:"Segoe UI",sans-serif;color:black">https://reviews.llvm.org/D58102<o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</body>
</html>