summaryrefslogtreecommitdiffstats
path: root/gnu/llvm/lib/Target/X86 (follow)
Commit message (Collapse)AuthorAgeFilesLines
* Remove LLVM 8.0.1 files.patrick2020-08-03165-177799/+0
|
* Merge LLVM 8.0.1 release.patrick2019-09-011-1/+5
| | | | | | | Tested in snaps and package builds Tested on amd64 by naddy@ Tested on arm64 by patrick@ Tested on octeon by visa@
* Import LLVM 8.0.1 release including clang, lld and lldb.patrick2019-09-011-1/+1
|
* Merge LLVM 8.0.0 release.patrick2019-06-2315-4286/+6311
| | | | | | | | | Prepared with help from jsg@ and mortimer@ Tested on amd64 by bcallah@, krw@, naddy@ Tested on arm64 by patrick@ Tested on macppc by kettenis@ Tested on octeon by visa@ Tested on sparc64 by claudio@
* Import LLVM 8.0.0 release including clang, lld and lldb.patrick2019-06-2374-5099/+10377
|
* Emit variable length trap padding in retguard epilogue.mortimer2019-04-021-0/+21
| | | | | | | This adds more trap padding before the return while ensuring that the return is still in the same cache line. ok deraadt@
* Do not store the retguard cookie in frame in leaf functions if possible.mortimer2019-03-311-2/+5
| | | | | | | Makes things slightly faster and also improves security in these functions, since the retguard cookie can't leak via the stack. ok deraadt@
* Improve the X86FixupGadgets pass:mortimer2019-02-223-136/+598
| | | | | | | | | | - Target all four kinds of return bytes (c2, c3, ca, cb) - Fix up instructions using both ModR/M and SIB bytes - Force alignment before instructions with return bytes in immediates - Force alignment before instructions that have return bytes in their encoding - Add a command line switch to toggle the functionality. ok deraadt@
* Merge LLVM commits r340844, r353818 and r353819 from the 8.0 branchpatrick2019-02-1310-102/+151
| | | | | | | | | | to fix a regression in floating point operations. Bluhm noticed that the bc regression test has been failing after the upgrade to 7.0.1 because setting the floating point control register was in some cases reordered erroneously. Found and tested by bluhm@ ok bluhm@ kettenis@
* Zap unneeded argument to BuildMI().mortimer2019-02-051-1/+1
| | | | ok dlg@
* initialize SaveArgs variable in case neither -msave-args or -mno-save-args are on command-line.semarie2019-02-041-2/+2
| | | | | | and use a bool type for a boolean in C++. ok kettenis@ deraadt@
* implement -msave-args in clang/llvm, like the sun did for gccdlg2019-01-305-15/+98
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | this is a bit different to gcc as gcc likes to use movs to move stuff on and off the stack, and directly updates the stack pointers with add and sub instructions. llvm prefers to use push and pop instructions, is a lot more careful about keeping track of how much stuff is currently on the stack, and generally pops the frame pointer rather than do maths on it. -msave-args adds a bunch of pushes as the first thing a function prologue does. to keep the stack aligned, if there's an odd number of arguments to the function it pushes the first one again to put the frame back on a 16 byte boundary. to undo the pushes the frame pointer needs to be updated in function epilogues. clang emits a series of pops to fix up the registers on the way out, but popping saved arguments is a waste of time and harmful to actual data in the function. rather than add an offset to the stack pointer, -msave-args emits a leaveq operation to fix up the frame again. leaveq is effectively mov rbp,rsp; pop rbp, and is a single byte, meaning there's less potential for gadgets compared to a direct add to rsp, or an explicit mov rbp,rsp. the only thing missing compared to the gcc implementation is adding the SUN_amd64_parmdump dwarf flag to affected functions. if someone can tell me how to add that from the frame lowering code, let me know. when enabled in kernel builds again, this will provide useful arguments in ddb stack traces again.
* Tedu files that got removed in LLVM 7.0.1.patrick2019-01-273-551/+0
|
* Merge LLVM 7.0.1 release.patrick2019-01-2714-1060/+1652
| | | | | With fixes from mortimer@ (thanks!) Tested by many, especially naddy@ (thanks!)
* Import LLVM 7.0.1 release including clang, lld and lldb.patrick2019-01-27106-38524/+37028
|
* Turn on -mretpoline by default in clang on amd64, but turn it offguenther2018-12-302-0/+9
| | | | | | | explicitly in SMALL_KERNEL kernel builds. tweaks from jsg@ and tb@ ok deraadt@ kettenis@
* Refactor retguard to make adding additional arches easier.mortimer2018-08-124-208/+171
|
* Remove unused variable.mortimer2018-06-071-1/+0
| | | | Spotted by Nan Xiao.
* Add RETGUARD to clang for amd64. This security mechanism uses per-functionmortimer2018-06-064-0/+236
| | | | | | | | | | | | | | | | | | | | | | | | | random cookies to protect access to function return instructions, with the effect that the integrity of the return address is protected, and function return instructions are harder to use in ROP gadgets. On function entry the return address is combined with a per-function random cookie and stored in the stack frame. The integrity of this value is verified before function return, and if this check fails, the program aborts. In this way RETGUARD is an improved stack protector, since the cookies are per-function. The verification routine is constructed such that the binary space immediately before each ret instruction is padded with int03 instructions, which makes these return instructions difficult to use in ROP gadgets. In the kernel, this has the effect of removing approximately 50% of total ROP gadgets, and 15% of unique ROP gadgets compared to the 6.3 release kernel. Function epilogues are essentially gadget free, leaving only the polymorphic gadgets that result from jumping into the instruction stream partway through other instructions. Work to remove these gadgets will continue through other mechanisms. Remaining work includes adding this mechanism to assembly routines, which must be done by hand. Many thanks to all those who helped test and provide feedback, especially deaadt, tb, espie and naddy. ok deraadt@
* Add a clang pass that identifies potential ROP gadgets and replaces ROPmortimer2018-04-284-0/+273
| | | | | | | | friendly instructions with safe alternatives. This initial commit fixes 3 instruction forms that will lower to include a c3 (return) byte. Additional problematic instructions can be fixed incrementally using this framework. ok deraadt@
* more undos from the mistake this morningderaadt2018-04-213-56/+287
|
* oops, snapshot tests not ready yetderaadt2018-04-203-293/+56
|
* syncderaadt2018-04-203-0/+6
|
* Merge LLVM 6.0.0 release.patrick2018-04-065-171/+277
|
* Import LLVM 6.0.1 release including clang, lld and lldb.patrick2018-04-06110-12711/+41927
| | | | "where is the kaboom?" deraadt@
* Cherry-pick a change from LLVM that marks specific pseudo memorypatrick2017-12-261-4/+2
| | | | | | | | instructions to have side effects so the optimizer does not reorder them across fnstcw/fldcw sequences. Fixes a bug seen in sqlite3 on i386. ok kettenis@
* Import LLVM 5.0.1 release including clang, lld and lldb.patrick2017-12-241-0/+17
|
* The compiler is generally free to allocate general purpose registers in whatevermortimer2017-11-211-3/+3
| | | | | | | | | | | | | | | | | | | | | order it chooses. Reasons for choosing one register before another usually incl ude compiled instruction size (avoidance of REX prefixes, etc.) or usage convent ions, but somehow haven't included security implications in the compiled bytecod e. Some bytecode is more useful in polymorphic ROP sequences than others, so it seems prudent to try to avoid that bytecode when possible. This patch moves EBX/RBX towards the end of the allocation preference for 32 and 64 bit general purpose registers. Some instructions using RBX/EBX/BX/BL as a de stination register end up with a ModR/M byte of C3 or CB, which is often useful in ROP gadgets. Because these gadgets often occur in the middle of functions, th ey exhibit somewhat higher diversity than some other C3/CB terminated gadgets. T his change removes about 3% of total gadgets from the kernel, but about 6% of un ique gadgets. There are other possible changes in this direction. BX/BL are obvious next targe ts for avoidance, and MM3/XMM3 may also be useful to try to avoid if possible. ok deraadt@
* Tedu files that got removed in LLVM 5.0.0.patrick2017-10-041-1162/+0
|
* Merge LLVM 5.0.0 release.patrick2017-10-043-84/+318
|
* Import LLVM 5.0.0 release including clang, lld and lldb.patrick2017-10-0499-6375/+14889
|
* Use int3 trap padding between functions instead of trapsleds with a leading jump.mortimer2017-08-012-0/+8
| | | | ok deraadt@
* Fix trapsleds on i386mortimer2017-07-291-9/+0
| | | | ok deraadt@
* trapsleds for clang, similar to the change on gas side.deraadt2017-06-271-31/+15
| | | | | Also from Todd Mortimer tested by espie
* Import LLVM 4.0.0 release including clang and lld.patrick2017-03-147-261/+30
|
* Import LLVM 4.0.0 rc1 including clang and lld to help the currentpatrick2017-01-2484-8438/+18828
| | | | development effort on OpenBSD/arm64.
* Merge LLVM 3.9.1patrick2017-01-1410-490/+0
|
* Import LLVM 3.9.1 including clang and lld.patrick2017-01-1483-11733/+18908
|
* Use the space freed up by sparc and zaurus to import LLVM.pascal2016-09-03130-0/+117099
ok hackroom@
Copyright © 1996 – 2023 Jason A. Donenfeld. All Rights Reverse Engineered.