llvm dev - Feb 2019 - Implement CET in LLD for X86 target

Control-flow Enforcement Technology (CET)

provides the following capabilities to defend against ROP/JOP style control-flow
subversion attacks:

Shadow Stack (SHSTK) - return address protection to defend against Return
Oriented Programming,

A shadow stack is a second stack for the program that is used exclusively for
control transfer operations.
This stack is separate from the data stack and can be enabled for operation
individually in user mode or supervisor mode.
When shadow stacks are enabled, the CALL instruction pushes the return address
on both the data and shadow stack.
The RET instruction pops the return address from both stacks and compares them.
If the return addresses from the two stacks do not match, the processor signals
a control protection exception (#CP).

Indirect branch tracking (IBT) - free branch protection to defend against
Jump/Call Oriented Programming.

The ENDBRANCH is a new instruction that is used to mark valid indirect call/jump
targets in the program.
This instruction opcode is selected to be one that is a NOP on legacy machines
such that programs compiled with ENDBRANCH new instruction continue to function
on old machines without the CET enforcement.
On processors that support CET the ENDBRANCH is still a NOP and is primarily
used as a marker instruction by the in-order part of the processor pipeline to
detect control flow violations.
The CPU implements a state machine that tracks indirect jump and call
instructions. When one of these instructions is seen, the state machine moves
from IDLE to WAIT_FOR_ENDBRANCH state.
In WAIT_FOR_ENDBRANCH state the next instruction in the program stream must be
an ENDBRANCH.
If an ENDBRANCH is not seen the processor causes a control protection fault else
the state machine moves back to IDLE state.

Work flow of CET:

A CET supported executable file will contain the CET flags in its
.note.gnu.property section.
(The flags of SHSTK or IBT will be set at the GNU_PROPERTY_X86_FEATURE_1_AND
property in .note.gnu.property section if the CET is enabled.)
When run the executable file, CET-enabled OS will check these flags in the
related segment, and run the feature accordingly on supported hardware.
If it run on unsupported machines, These CET flags or ENDBRANCH will be ignore.

The key implement of the feature in LLD:

LLD will first check if all the relocatable object files contain the
.note.gnu.property section and if there is GNU_PROPERTY_X86_FEATURE_1_AND
property in this section.
If it finds the GNU_PROPERTY_X86_FEATURE_1_AND property in all the relocatable
object files,
it will handle the flags in these properties and sections, create the resulting
.note.gnu.property section in output file if necessary.
Because the IBT feature needs to insert an endbr* instruction at the end of
indirect jump, LLD also deals with the lazy binding by adding a second PLT
called SPLT.
Recording to https://github.com/hjl-tools/x86-psABI/wiki/x86-64-psABI-draft.pdf
13.2 DynamicLinking



if you have any question about the ABI, please discuss at: 
https://groups.google.com/forum/#!forum/x86-64-abi



I have sent the patch to:

https://reviews.llvm.org/D58102


-------------- next part --------------
An HTML attachment was scrubbed...
URL:
<http://lists.llvm.org/pipermail/llvm-dev/attachments/20190226/094ba5ec/attachment-0001.html>