[PATCH] D119296: KCFI sanitizer

[Joao Moreira via Phabricator via cfe-commits]

joaomoreira added inline comments.


================
Comment at: llvm/lib/Target/X86/X86AsmPrinter.cpp:121
+    if (N == Value)
+      return ~Value;
+  }
----------------
Can we use another constant blinding scheme, such as a Value++ or anything else? This way, we would prevent endbrs from being emitted in the indirect branch guards too.

Since we are using Value (prologue) and ~Value (caller/guard) for doing the checks, we also need to check if ~ENDBR was picked as a KCFIType, otherwise ENDBR will be emitted in the ibranch guards.


================
Comment at: llvm/test/CodeGen/X86/kcfi.ll:91
+
+;; Ensure we emit ~Type for unwanted values (e.g. endbr64 == 4196274163).
+; ASM-LABEL: __cfi_f5:
----------------
We need to also ensure/test that these are not emitted in the caller/indirect branch guards.

I assume that in the current scheme (blinding with ~Value) would be unfeasible to do this, so maybe we need a different approach for masking (as suggested above).


Repository:
  rG LLVM Github Monorepo

CHANGES SINCE LAST ACTION
  https://reviews.llvm.org/D119296/new/

https://reviews.llvm.org/D119296