2240d72f15
Adds support for:
* `-mfunction-return=<value>` command line flag, and
* `__attribute__((function_return("<value>")))` function attribute
Where the supported <value>s are:
* keep (disable)
* thunk-extern (enable)
thunk-extern enables clang to change ret instructions into jmps to an
external symbol named __x86_return_thunk, implemented as a new
MachineFunctionPass named "x86-return-thunks", keyed off the new IR
attribute fn_ret_thunk_extern.
The symbol __x86_return_thunk is expected to be provided by the runtime
the compiled code is linked against and is not defined by the compiler.
Enabling this option alone doesn't provide mitigations without
corresponding definitions of __x86_return_thunk!
This new MachineFunctionPass is very similar to "x86-lvi-ret".
The <value>s "thunk" and "thunk-inline" are currently unsupported. It's
not clear yet that they are necessary: whether the thunk pattern they
would emit is beneficial or used anywhere.
Should the <value>s "thunk" and "thunk-inline" become necessary,
x86-return-thunks could probably be merged into x86-retpoline-thunks
which has pre-existing machinery for emitting thunks (which could be
used to implement the <value> "thunk").
Has been found to build+boot with corresponding Linux
kernel patches. This helps the Linux kernel mitigate RETBLEED.
* CVE-2022-23816
* CVE-2022-28693
* CVE-2022-29901
See also:
* "RETBLEED: Arbitrary Speculative Code Execution with Return
Instructions."
* AMD SECURITY NOTICE AMD-SN-1037: AMD CPU Branch Type Confusion
* TECHNICAL GUIDANCE FOR MITIGATING BRANCH TYPE CONFUSION REVISION 1.0
2022-07-12
* Return Stack Buffer Underflow / Return Stack Buffer Underflow /
CVE-2022-29901, CVE-2022-28693 / INTEL-SA-00702
SystemZ may eventually want to support "thunk-extern" and "thunk"; both
options are used by the Linux kernel's CONFIG_EXPOLINE.
This functionality has been available in GCC since the 8.1 release, and
was backported to the 7.3 release.
Many thanks for folks that provided discrete review off list due to the
embargoed nature of this hardware vulnerability. Many Bothans died to
bring us this information.
Link: https://www.youtube.com/watch?v=IF6HbCKQHK8
Link: https://github.com/llvm/llvm-project/issues/54404
Link: https://gcc.gnu.org/legacy-ml/gcc-patches/2018-01/msg01197.html
Link: https://www.intel.com/content/www/us/en/developer/articles/technical/software-security-guidance/advisory-guidance/return-stack-buffer-underflow.html
Link: https://arstechnica.com/information-technology/2022/07/intel-and-amd-cpus-vulnerable-to-a-new-speculative-execution-attack/?comments=1
Link: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=ce114c866860aa9eae3f50974efc68241186ba60
Link: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00702.html
Link: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00707.html
Reviewed By: aaron.ballman, craig.topper
Differential Revision: https://reviews.llvm.org/D129572
97 lines
3.5 KiB
C
97 lines
3.5 KiB
C
// RUN: %clang_cc1 -std=gnu2x -triple x86_64-linux-gnu %s -emit-llvm -o - \
|
|
// RUN: | FileCheck %s --check-prefixes=CHECK,CHECK-NOM
|
|
// RUN: %clang_cc1 -std=gnu2x -triple x86_64-linux-gnu %s -emit-llvm -o - \
|
|
// RUN: -mfunction-return=keep | FileCheck %s \
|
|
// RUN: --check-prefixes=CHECK,CHECK-KEEP
|
|
// RUN: %clang_cc1 -std=gnu2x -triple x86_64-linux-gnu %s -emit-llvm -o - \
|
|
// RUN: -mfunction-return=thunk-extern | FileCheck %s \
|
|
// RUN: --check-prefixes=CHECK,CHECK-EXTERN
|
|
|
|
#if !__has_attribute(function_return)
|
|
#error "missing attribute support for function_return"
|
|
#endif
|
|
|
|
// CHECK: @keep() [[KEEP:#[0-9]+]]
|
|
__attribute__((function_return("keep"))) void keep(void) {}
|
|
|
|
// CHECK: @keep2() [[KEEP:#[0-9]+]]
|
|
[[gnu::function_return("keep")]] void keep2(void) {}
|
|
|
|
// CHECK: @thunk_extern() [[EXTERN:#[0-9]+]]
|
|
__attribute__((function_return("thunk-extern"))) void thunk_extern(void) {}
|
|
|
|
// CHECK: @thunk_extern2() [[EXTERN:#[0-9]+]]
|
|
[[gnu::function_return("thunk-extern")]] void thunk_extern2(void) {}
|
|
|
|
// CHECK: @double_thunk_keep() [[KEEP]]
|
|
// clang-format off
|
|
__attribute__((function_return("thunk-extern")))
|
|
__attribute__((function_return("keep")))
|
|
void double_thunk_keep(void) {}
|
|
|
|
// CHECK: @double_thunk_keep2() [[KEEP]]
|
|
[[gnu::function_return("thunk-extern")]][[gnu::function_return("keep")]]
|
|
void double_thunk_keep2(void) {}
|
|
|
|
// CHECK: @double_keep_thunk() [[EXTERN]]
|
|
__attribute__((function_return("keep")))
|
|
__attribute__((function_return("thunk-extern")))
|
|
void double_keep_thunk(void) {}
|
|
|
|
// CHECK: @double_keep_thunk2() [[EXTERN]]
|
|
[[gnu::function_return("thunk-keep")]][[gnu::function_return("thunk-extern")]]
|
|
void double_keep_thunk2(void) {}
|
|
|
|
// CHECK: @thunk_keep() [[KEEP]]
|
|
__attribute__((function_return("thunk-extern"), function_return("keep")))
|
|
void thunk_keep(void) {}
|
|
|
|
// CHECK: @thunk_keep2() [[KEEP]]
|
|
[[gnu::function_return("thunk-extern"), gnu::function_return("keep")]]
|
|
void thunk_keep2(void) {}
|
|
|
|
// CHECK: @keep_thunk() [[EXTERN]]
|
|
__attribute__((function_return("keep"), function_return("thunk-extern")))
|
|
void keep_thunk(void) {}
|
|
|
|
// CHECK: @keep_thunk2() [[EXTERN]]
|
|
[[gnu::function_return("keep"), gnu::function_return("thunk-extern")]]
|
|
void keep_thunk2(void) {}
|
|
// clang-format on
|
|
|
|
void undef(void);
|
|
// CHECK: @undef() [[KEEP]]
|
|
__attribute__((function_return("keep"))) void undef(void) {}
|
|
|
|
void undef2(void);
|
|
// CHECK: @undef2() [[EXTERN]]
|
|
__attribute__((function_return("thunk-extern"))) void undef2(void) {}
|
|
|
|
__attribute__((function_return("thunk-extern"))) void change_def(void);
|
|
// CHECK: @change_def() [[KEEP]]
|
|
__attribute__((function_return("keep"))) void change_def(void) {}
|
|
|
|
__attribute__((function_return("keep"))) void change_def2(void);
|
|
// CHECK: @change_def2() [[EXTERN]]
|
|
__attribute__((function_return("thunk-extern"))) void change_def2(void) {}
|
|
|
|
__attribute__((function_return("thunk-extern"))) void change_def3(void);
|
|
// CHECK: @change_def3() [[KEEP]]
|
|
[[gnu::function_return("keep")]] void change_def3(void) {}
|
|
|
|
[[gnu::function_return("keep")]] void change_def4(void);
|
|
// CHECK: @change_def4() [[EXTERN]]
|
|
__attribute__((function_return("thunk-extern"))) void change_def4(void) {}
|
|
|
|
// When there is no -mfunction-return= flag set (NOM) or it's set to keep,
|
|
// we don't emit anything into the IR for unattributed functions.
|
|
|
|
// CHECK-NOM: @no_attrs() [[NOATTR:#[0-9]+]]
|
|
// CHECK-KEEP: @no_attrs() [[NOATTR:#[0-9]+]]
|
|
// CHECK-EXTERN: @no_attrs() [[EXTERN]]
|
|
void no_attrs(void) {}
|
|
|
|
// CHECK-NOM-NOT: [[NOATTR]] = {{.*}}fn_ret_thunk_extern
|
|
// CHECK-KEEP-NOT: [[NOATTR]] = {{.*}}fn_ret_thunk_extern
|
|
// CHECK: [[EXTERN]] = {{.*}}fn_ret_thunk_extern
|