|
| 1 | +//===--- MitigationTagging.cpp - Emit LLVM Code from ASTs for a Module ----===// |
| 2 | +// |
| 3 | +// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions. |
| 4 | +// See https://llvm.org/LICENSE.txt for license information. |
| 5 | +// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception |
| 6 | +// |
| 7 | +//===----------------------------------------------------------------------===// |
| 8 | +// |
| 9 | +// This enables tagging functions with metadata to indicate mitigations are |
| 10 | +// applied to them. |
| 11 | +// |
| 12 | +//===----------------------------------------------------------------------===// |
| 13 | + |
| 14 | +#include "MitigationTagging.h" |
| 15 | +#include "llvm/IR/Constants.h" |
| 16 | +#include "llvm/IR/LLVMContext.h" |
| 17 | +#include "llvm/IR/Metadata.h" |
| 18 | + |
| 19 | +#include <string> |
| 20 | +#include <vector> |
| 21 | + |
| 22 | +namespace clang { |
| 23 | +namespace CodeGen { |
| 24 | + |
| 25 | +inline static std::string |
| 26 | +MitigationKeyToString(enum MitigationKey key) noexcept { |
| 27 | + switch (key) { |
| 28 | + case MitigationKey::AUTO_VAR_INIT: |
| 29 | + return "auto-var-init"; |
| 30 | + case MitigationKey::STACK_CLASH_PROTECTION: |
| 31 | + return "stack-clash-protection"; |
| 32 | + case MitigationKey::STACK_PROTECTOR: |
| 33 | + return "stack-protector"; |
| 34 | + case MitigationKey::STACK_PROTECTOR_STRONG: |
| 35 | + return "stack-protector-strong"; |
| 36 | + case MitigationKey::STACK_PROTECTOR_ALL: |
| 37 | + return "stack-protector-all"; |
| 38 | + case MitigationKey::CFI_VCALL: |
| 39 | + return "cfi-vcall"; |
| 40 | + case MitigationKey::CFI_ICALL: |
| 41 | + return "cfi-icall"; |
| 42 | + case MitigationKey::CFI_NVCALL: |
| 43 | + return "cfi-nvcall"; |
| 44 | + } |
| 45 | +} |
| 46 | + |
| 47 | +void AttachMitigationMetadataToFunction(llvm::Function &F, |
| 48 | + enum MitigationKey key, bool enabled) { |
| 49 | + llvm::LLVMContext &Context = F.getContext(); |
| 50 | + |
| 51 | + unsigned kindID = Context.getMDKindID("security_mitigations"); |
| 52 | + |
| 53 | + llvm::Metadata *ValueMD = llvm::ConstantAsMetadata::get( |
| 54 | + llvm::ConstantInt::get(llvm::Type::getInt1Ty(Context), enabled)); |
| 55 | + llvm::MDString *KeyMD = |
| 56 | + llvm::MDString::get(Context, MitigationKeyToString(key)); |
| 57 | + |
| 58 | + llvm::MDNode *NewMD = llvm::MDNode::get(Context, {KeyMD, ValueMD}); |
| 59 | + llvm::MDNode *ExistingMD = F.getMetadata(kindID); |
| 60 | + |
| 61 | + if (ExistingMD) { |
| 62 | + std::vector<llvm::Metadata *> MDs; |
| 63 | + for (unsigned i = 0, e = ExistingMD->getNumOperands(); i != e; ++i) { |
| 64 | + MDs.push_back(ExistingMD->getOperand(i)); |
| 65 | + } |
| 66 | + MDs.push_back(NewMD); |
| 67 | + |
| 68 | + llvm::MDNode *CombinedMD = llvm::MDNode::get(Context, MDs); |
| 69 | + F.setMetadata(kindID, CombinedMD); |
| 70 | + } else { |
| 71 | + F.setMetadata(kindID, NewMD); |
| 72 | + } |
| 73 | +} |
| 74 | + |
| 75 | +void AttachMitigationMetadataToFunction(CodeGenFunction &CGF, |
| 76 | + enum MitigationKey key, bool enabled) { |
| 77 | + if (!CGF.CGM.getCodeGenOpts().MitigationAnalysis) { |
| 78 | + return; |
| 79 | + } |
| 80 | + AttachMitigationMetadataToFunction(*(CGF.CurFn), key, enabled); |
| 81 | +} |
| 82 | + |
| 83 | +} // namespace CodeGen |
| 84 | +} // namespace clang |
0 commit comments