1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
|
; NOTE: Assertions have been autogenerated by utils/update_llc_test_checks.py
; RUN: llc -mtriple x86_64-apple-macosx10.13.0 < %s | FileCheck %s --check-prefix=X86_64
; RUN: llc -mtriple i386-apple-macosx10.13.0 < %s | FileCheck %s --check-prefix=X86
; The MacOS tripples are used to get trapping behavior on the "unreachable" IR
; instruction, so that the placement of the ud2 instruction could be verified.
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
;; The IR was created using the following C code:
;; typedef ptr jmp_buf;
;; jmp_buf buf;
;;
;; __attribute__((noinline)) int bar(int i) {
;; int j = i - 111;
;; __builtin_longjmp(&buf, 1);
;; return j;
;; }
;;
;; int foo(int i) {
;; int j = i * 11;
;; if (!__builtin_setjmp(&buf)) {
;; j += 33 + bar(j);
;; }
;; return j + i;
;; }
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
@buf = common local_unnamed_addr global ptr null, align 8
; Functions that use LongJmp should fix the Shadow Stack using previosuly saved
; ShadowStackPointer in the input buffer.
; The fix requires unwinding the shadow stack to the last SSP.
define i32 @bar(i32 %i) local_unnamed_addr {
; X86_64-LABEL: bar:
; X86_64: ## %bb.0: ## %entry
; X86_64-NEXT: pushq %rbp
; X86_64-NEXT: .cfi_def_cfa_offset 16
; X86_64-NEXT: .cfi_offset %rbp, -16
; X86_64-NEXT: movq _buf@GOTPCREL(%rip), %rax
; X86_64-NEXT: movq (%rax), %rax
; X86_64-NEXT: xorl %edx, %edx
; X86_64-NEXT: rdsspq %rdx
; X86_64-NEXT: testq %rdx, %rdx
; X86_64-NEXT: je LBB0_5
; X86_64-NEXT: ## %bb.1: ## %entry
; X86_64-NEXT: movq 24(%rax), %rcx
; X86_64-NEXT: subq %rdx, %rcx
; X86_64-NEXT: jbe LBB0_5
; X86_64-NEXT: ## %bb.2: ## %entry
; X86_64-NEXT: shrq $3, %rcx
; X86_64-NEXT: incsspq %rcx
; X86_64-NEXT: shrq $8, %rcx
; X86_64-NEXT: je LBB0_5
; X86_64-NEXT: ## %bb.3: ## %entry
; X86_64-NEXT: shlq %rcx
; X86_64-NEXT: movq $128, %rdx
; X86_64-NEXT: LBB0_4: ## %entry
; X86_64-NEXT: ## =>This Inner Loop Header: Depth=1
; X86_64-NEXT: incsspq %rdx
; X86_64-NEXT: decq %rcx
; X86_64-NEXT: jne LBB0_4
; X86_64-NEXT: LBB0_5: ## %entry
; X86_64-NEXT: movq (%rax), %rbp
; X86_64-NEXT: movq 8(%rax), %rcx
; X86_64-NEXT: movq 16(%rax), %rsp
; X86_64-NEXT: jmpq *%rcx
;
; X86-LABEL: bar:
; X86: ## %bb.0: ## %entry
; X86-NEXT: pushl %ebp
; X86-NEXT: .cfi_def_cfa_offset 8
; X86-NEXT: .cfi_offset %ebp, -8
; X86-NEXT: movl L_buf$non_lazy_ptr, %eax
; X86-NEXT: movl (%eax), %eax
; X86-NEXT: xorl %edx, %edx
; X86-NEXT: rdsspd %edx
; X86-NEXT: testl %edx, %edx
; X86-NEXT: je LBB0_5
; X86-NEXT: ## %bb.1: ## %entry
; X86-NEXT: movl 12(%eax), %ecx
; X86-NEXT: subl %edx, %ecx
; X86-NEXT: jbe LBB0_5
; X86-NEXT: ## %bb.2: ## %entry
; X86-NEXT: shrl $2, %ecx
; X86-NEXT: incsspd %ecx
; X86-NEXT: shrl $8, %ecx
; X86-NEXT: je LBB0_5
; X86-NEXT: ## %bb.3: ## %entry
; X86-NEXT: shll %ecx
; X86-NEXT: movl $128, %edx
; X86-NEXT: LBB0_4: ## %entry
; X86-NEXT: ## =>This Inner Loop Header: Depth=1
; X86-NEXT: incsspd %edx
; X86-NEXT: decl %ecx
; X86-NEXT: jne LBB0_4
; X86-NEXT: LBB0_5: ## %entry
; X86-NEXT: movl (%eax), %ebp
; X86-NEXT: movl 4(%eax), %ecx
; X86-NEXT: movl 8(%eax), %esp
; X86-NEXT: jmpl *%ecx
entry:
%0 = load ptr, ptr @buf, align 8
tail call void @llvm.eh.sjlj.longjmp(ptr %0)
unreachable
}
declare void @llvm.eh.sjlj.longjmp(ptr)
; Functions that call SetJmp should save the current ShadowStackPointer for
; future fixing of the Shadow Stack.
define i32 @foo(i32 %i) local_unnamed_addr {
; X86_64-LABEL: foo:
; X86_64: ## %bb.0: ## %entry
; X86_64-NEXT: pushq %rbp
; X86_64-NEXT: .cfi_def_cfa_offset 16
; X86_64-NEXT: .cfi_offset %rbp, -16
; X86_64-NEXT: movq %rsp, %rbp
; X86_64-NEXT: .cfi_def_cfa_register %rbp
; X86_64-NEXT: pushq %r15
; X86_64-NEXT: pushq %r14
; X86_64-NEXT: pushq %r13
; X86_64-NEXT: pushq %r12
; X86_64-NEXT: pushq %rbx
; X86_64-NEXT: pushq %rax
; X86_64-NEXT: .cfi_offset %rbx, -56
; X86_64-NEXT: .cfi_offset %r12, -48
; X86_64-NEXT: .cfi_offset %r13, -40
; X86_64-NEXT: .cfi_offset %r14, -32
; X86_64-NEXT: .cfi_offset %r15, -24
; X86_64-NEXT: ## kill: def $edi killed $edi def $rdi
; X86_64-NEXT: movq %rdi, {{[-0-9]+}}(%r{{[sb]}}p) ## 8-byte Spill
; X86_64-NEXT: movq _buf@GOTPCREL(%rip), %rax
; X86_64-NEXT: movq (%rax), %rax
; X86_64-NEXT: movq %rbp, (%rax)
; X86_64-NEXT: movq %rsp, 16(%rax)
; X86_64-NEXT: leaq LBB1_4(%rip), %rcx
; X86_64-NEXT: movq %rcx, 8(%rax)
; X86_64-NEXT: xorq %rcx, %rcx
; X86_64-NEXT: rdsspq %rcx
; X86_64-NEXT: movq %rcx, 24(%rax)
; X86_64-NEXT: #EH_SjLj_Setup LBB1_4
; X86_64-NEXT: ## %bb.1: ## %entry
; X86_64-NEXT: xorl %eax, %eax
; X86_64-NEXT: jmp LBB1_2
; X86_64-NEXT: LBB1_4: ## Block address taken
; X86_64-NEXT: ## %entry
; X86_64-NEXT: movl $1, %eax
; X86_64-NEXT: LBB1_2: ## %entry
; X86_64-NEXT: testl %eax, %eax
; X86_64-NEXT: je LBB1_5
; X86_64-NEXT: ## %bb.3: ## %if.end
; X86_64-NEXT: movq {{[-0-9]+}}(%r{{[sb]}}p), %rax ## 8-byte Reload
; X86_64-NEXT: shll $2, %eax
; X86_64-NEXT: leal (%rax,%rax,2), %eax
; X86_64-NEXT: addq $8, %rsp
; X86_64-NEXT: popq %rbx
; X86_64-NEXT: popq %r12
; X86_64-NEXT: popq %r13
; X86_64-NEXT: popq %r14
; X86_64-NEXT: popq %r15
; X86_64-NEXT: popq %rbp
; X86_64-NEXT: retq
; X86_64-NEXT: LBB1_5: ## %if.then
; X86_64-NEXT: callq _bar
; X86_64-NEXT: ud2
;
; X86-LABEL: foo:
; X86: ## %bb.0: ## %entry
; X86-NEXT: pushl %ebp
; X86-NEXT: .cfi_def_cfa_offset 8
; X86-NEXT: .cfi_offset %ebp, -8
; X86-NEXT: movl %esp, %ebp
; X86-NEXT: .cfi_def_cfa_register %ebp
; X86-NEXT: pushl %ebx
; X86-NEXT: pushl %edi
; X86-NEXT: pushl %esi
; X86-NEXT: subl $12, %esp
; X86-NEXT: .cfi_offset %esi, -20
; X86-NEXT: .cfi_offset %edi, -16
; X86-NEXT: .cfi_offset %ebx, -12
; X86-NEXT: movl L_buf$non_lazy_ptr, %eax
; X86-NEXT: movl (%eax), %eax
; X86-NEXT: movl %ebp, (%eax)
; X86-NEXT: movl %esp, 16(%eax)
; X86-NEXT: movl $LBB1_4, 4(%eax)
; X86-NEXT: xorl %ecx, %ecx
; X86-NEXT: rdsspd %ecx
; X86-NEXT: movl %ecx, 12(%eax)
; X86-NEXT: #EH_SjLj_Setup LBB1_4
; X86-NEXT: ## %bb.1: ## %entry
; X86-NEXT: xorl %eax, %eax
; X86-NEXT: jmp LBB1_2
; X86-NEXT: LBB1_4: ## Block address taken
; X86-NEXT: ## %entry
; X86-NEXT: movl $1, %eax
; X86-NEXT: LBB1_2: ## %entry
; X86-NEXT: testl %eax, %eax
; X86-NEXT: je LBB1_5
; X86-NEXT: ## %bb.3: ## %if.end
; X86-NEXT: movl 8(%ebp), %eax
; X86-NEXT: shll $2, %eax
; X86-NEXT: leal (%eax,%eax,2), %eax
; X86-NEXT: addl $12, %esp
; X86-NEXT: popl %esi
; X86-NEXT: popl %edi
; X86-NEXT: popl %ebx
; X86-NEXT: popl %ebp
; X86-NEXT: retl
; X86-NEXT: LBB1_5: ## %if.then
; X86-NEXT: calll _bar
; X86-NEXT: ud2
entry:
%0 = load ptr, ptr @buf, align 8
%1 = tail call ptr @llvm.frameaddress(i32 0)
store ptr %1, ptr %0, align 8
%2 = tail call ptr @llvm.stacksave()
%3 = getelementptr inbounds i8, ptr %0, i64 16
store ptr %2, ptr %3, align 8
%4 = tail call i32 @llvm.eh.sjlj.setjmp(ptr %0)
%tobool = icmp eq i32 %4, 0
br i1 %tobool, label %if.then, label %if.end
if.then: ; preds = %entry
%call = tail call i32 @bar(i32 undef)
unreachable
if.end: ; preds = %entry
%add2 = mul nsw i32 %i, 12
ret i32 %add2
}
declare ptr @llvm.frameaddress(i32)
declare ptr @llvm.stacksave()
declare i32 @llvm.eh.sjlj.setjmp(ptr)
!llvm.module.flags = !{!0}
!0 = !{i32 8, !"cf-protection-return", i32 1}
|
