270 lines · plain
1; RUN: llc < %s -mtriple=i686-pc-windows-msvc | FileCheck %s -check-prefix=X862; RUN: llc < %s -mtriple=x86_64-pc-windows-msvc | FileCheck %s -check-prefixes=X64,X64_MSVC3; RUN: llc < %s -mtriple=i686-w64-windows-gnu | FileCheck %s -check-prefixes=X86,X86_MINGW4; RUN: llc < %s -mtriple=x86_64-w64-windows-gnu | FileCheck %s -check-prefixes=X64,X64_MINGW5; Control Flow Guard is currently only available on Windows6 7; Test that Control Flow Guard checks are correctly added when required.8 9 10declare i32 @target_func()11 12 13; Test that Control Flow Guard checks are not added on calls with the "guard_nocf" attribute.14define i32 @func_guard_nocf() {15entry:16 %func_ptr = alloca ptr, align 817 store ptr @target_func, ptr %func_ptr, align 818 %0 = load ptr, ptr %func_ptr, align 819 %1 = call i32 %0() #020 ret i32 %121 22 ; X86-LABEL: func_guard_nocf23 ; X86: movl $_target_func, %eax24 ; X86-NOT: __guard_check_icall_fptr25 ; X86: calll *%eax26 27 ; X64-LABEL: func_guard_nocf28 ; X64: leaq target_func(%rip), %rax29 ; X64-NOT: __guard_dispatch_icall_fptr30 ; X64: callq *%rax31}32attributes #0 = { "guard_nocf" }33 34 35; Test that Control Flow Guard checks are added even at -O0.36; FIXME Ideally these checks should be added as a single call instruction, as in the optimized case.37define i32 @func_optnone_cf() #1 {38entry:39 %func_ptr = alloca ptr, align 840 store ptr @target_func, ptr %func_ptr, align 841 %0 = load ptr, ptr %func_ptr, align 842 %1 = call i32 %0()43 ret i32 %144 45 ; On i686, the call to __guard_check_icall_fptr should come immediately before the call to the target function.46 ; X86-LABEL: func_optnone_cf47 ; X86: leal _target_func, %eax48 ; X86: movl %eax, (%esp)49 ; X86: movl (%esp), %ecx50 ; X86: calll *___guard_check_icall_fptr51 ; X86-NEXT: calll *%ecx52 53 ; On x86_64, __guard_dispatch_icall_fptr tail calls the function, so there should be only one call instruction.54 ; X64-LABEL: func_optnone_cf55 ; X64: leaq target_func(%rip), %rax56 ; X64: movq __guard_dispatch_icall_fptr(%rip), %rcx57 ; X64: callq *%rcx58 ; X64-NOT: callq59}60attributes #1 = { noinline optnone }61 62 63; Test that Control Flow Guard checks are correctly added in optimized code (common case).64define i32 @func_cf() {65entry:66 %func_ptr = alloca ptr, align 867 store ptr @target_func, ptr %func_ptr, align 868 %0 = load ptr, ptr %func_ptr, align 869 %1 = call i32 %0()70 ret i32 %171 72 ; On i686, the call to __guard_check_icall_fptr should come immediately before the call to the target function.73 ; X86-LABEL: func_cf74 ; X86: movl $_target_func, %esi75 ; X86: movl $_target_func, %ecx76 ; X86: calll *___guard_check_icall_fptr77 ; X86-NEXT: calll *%esi78 79 ; On x86_64, __guard_dispatch_icall_fptr tail calls the function, so there should be only one call instruction.80 ; X64-LABEL: func_cf81 ; X64: leaq target_func(%rip), %rax82 ; X64: callq *__guard_dispatch_icall_fptr(%rip)83 ; X64-NOT: callq84}85 86 87; Test that Control Flow Guard checks are correctly added on invoke instructions.88define i32 @func_cf_invoke() personality ptr @h {89entry:90 %0 = alloca i32, align 491 %func_ptr = alloca ptr, align 892 store ptr @target_func, ptr %func_ptr, align 893 %1 = load ptr, ptr %func_ptr, align 894 %2 = invoke i32 %1()95 to label %invoke.cont unwind label %lpad96invoke.cont: ; preds = %entry97 ret i32 %298 99lpad: ; preds = %entry100 %tmp = landingpad { ptr, i32 }101 catch ptr null102 ret i32 -1103 104 ; On i686, the call to __guard_check_icall_fptr should come immediately before the call to the target function.105 ; X86-LABEL: func_cf_invoke106 ; X86: movl $_target_func, %esi107 ; X86: movl $_target_func, %ecx108 ; X86: calll *___guard_check_icall_fptr109 ; X86_MINGW-NEXT: Ltmp0:110 ; X86-NEXT: calll *%esi111 ; X86: # %invoke.cont112 ; X86: # %lpad113 114 ; On x86_64, __guard_dispatch_icall_fptr tail calls the function, so there should be only one call instruction.115 ; X64-LABEL: func_cf_invoke116 ; X64: leaq target_func(%rip), %rax117 ; X64: callq *__guard_dispatch_icall_fptr(%rip)118 ; X64-NOT: callq119 ; X64: # %invoke.cont120 ; X64: # %lpad121}122 123declare void @h()124 125 126; Test that Control Flow Guard preserves floating point arguments.127declare double @target_func_doubles(double, double, double, double)128 129define double @func_cf_doubles() {130entry:131 %func_ptr = alloca ptr, align 8132 store ptr @target_func_doubles, ptr %func_ptr, align 8133 %0 = load ptr, ptr %func_ptr, align 8134 %1 = call double %0(double 1.000000e+00, double 2.000000e+00, double 3.000000e+00, double 4.000000e+00)135 ret double %1136 137 ; On i686, the call to __guard_check_icall_fptr should come immediately before the call to the target function.138 ; X86-LABEL: func_cf_doubles139 ; X86: movl $_target_func_doubles, %esi140 ; X86: movl $_target_func_doubles, %ecx141 ; X86: calll *___guard_check_icall_fptr142 ; X86: calll *%esi143 144 145 ; On x86_64, __guard_dispatch_icall_fptr tail calls the function, so there should be only one call instruction.146 ; X64-LABEL: func_cf_doubles147 ; X64: leaq target_func_doubles(%rip), %rax148 ; X64_MSVC: movsd __real@3ff0000000000000(%rip), %xmm0149 ; X64_MSVC: movsd __real@4000000000000000(%rip), %xmm1150 ; X64_MSVC: movsd __real@4008000000000000(%rip), %xmm2151 ; X64_MSVC: movsd __real@4010000000000000(%rip), %xmm3152 ; X64_MINGW: movsd .LCPI4_0(%rip), %xmm0153 ; X64_MINGW: movsd .LCPI4_1(%rip), %xmm1154 ; X64_MINGW: movsd .LCPI4_2(%rip), %xmm2155 ; X64_MINGW: movsd .LCPI4_3(%rip), %xmm3156 ; X64: callq *__guard_dispatch_icall_fptr(%rip)157 ; X64-NOT: callq158 159}160 161 162; Test that Control Flow Guard checks are correctly added for tail calls.163define i32 @func_cf_tail() {164entry:165 %func_ptr = alloca ptr, align 8166 store ptr @target_func, ptr %func_ptr, align 8167 %0 = load ptr, ptr %func_ptr, align 8168 %1 = musttail call i32 %0()169 ret i32 %1170 171 ; On i686, the call to __guard_check_icall_fptr should come immediately before the call to the target function.172 ; X86-LABEL: func_cf_tail173 ; X86: movl $_target_func, %ecx174 ; X86: calll *___guard_check_icall_fptr175 ; X86: movl $_target_func, %eax176 ; X86: jmpl *%eax # TAILCALL177 ; X86-NOT: calll178 179 ; X64-LABEL: func_cf_tail180 ; X64: leaq target_func(%rip), %rax181 ; X64: rex64 jmpq *__guard_dispatch_icall_fptr(%rip) # TAILCALL182 ; X64-NOT: callq183}184 185 186%struct.Foo = type { ptr }187 188; Test that Control Flow Guard checks are correctly added for variadic musttail189; calls. These are used for MS C++ ABI virtual member pointer thunks.190; PR44049191define i32 @vmptr_thunk(ptr inreg %p) {192entry:193 %vptr = load ptr, ptr %p194 %slot = getelementptr inbounds ptr, ptr %vptr, i32 1195 %vmethod = load ptr, ptr %slot196 %rv = musttail call i32 %vmethod(ptr inreg %p)197 ret i32 %rv198 199 ; On i686, the call to __guard_check_icall_fptr should come immediately before the call to the target function.200 ; X86-LABEL: _vmptr_thunk:201 ; X86: movl %eax, %esi202 ; X86: movl (%eax), %eax203 ; X86: movl 4(%eax), %ecx204 ; X86: calll *___guard_check_icall_fptr205 ; X86: movl %esi, %eax206 ; X86: jmpl *%ecx # TAILCALL207 ; X86-NOT: calll208 209 ; Use NEXT here because we previously had an extra instruction in this sequence.210 ; X64-LABEL: vmptr_thunk:211 ; X64: movq (%rcx), %rax212 ; X64-NEXT: movq 8(%rax), %rax213 ; X64-NEXT: movq __guard_dispatch_icall_fptr(%rip), %rdx214 ; X64-NEXT: rex64 jmpq *%rdx # TAILCALL215 ; X64-NOT: callq216}217 218; Test that longjmp targets have public labels and are included in the .gljmp section.219%struct._SETJMP_FLOAT128 = type { [2 x i64] }220@buf1 = internal global [16 x %struct._SETJMP_FLOAT128] zeroinitializer, align 16221 222define i32 @func_cf_setjmp() {223 %1 = alloca i32, align 4224 %2 = alloca i32, align 4225 store i32 0, ptr %1, align 4226 store i32 -1, ptr %2, align 4227 %3 = call ptr @llvm.frameaddress(i32 0)228 %4 = call i32 @_setjmp(ptr @buf1, ptr %3) #2229 230 ; X86-LABEL: func_cf_setjmp231 ; X86: calll __setjmp232 ; X86-NEXT: $cfgsj_func_cf_setjmp0:233 234 ; X64-LABEL: func_cf_setjmp235 ; X64: callq _setjmp236 ; X64-NEXT: $cfgsj_func_cf_setjmp0:237 238 %5 = call ptr @llvm.frameaddress(i32 0)239 %6 = call i32 @_setjmp(ptr @buf1, ptr %5) #2240 241 ; X86: calll __setjmp242 ; X86-NEXT: $cfgsj_func_cf_setjmp1:243 244 ; X64: callq _setjmp245 ; X64-NEXT: $cfgsj_func_cf_setjmp1:246 247 store i32 1, ptr %2, align 4248 %7 = load i32, ptr %2, align 4249 ret i32 %7250 251 ; X86: .section .gljmp$y,"dr"252 ; X86-NEXT: .symidx $cfgsj_func_cf_setjmp0253 ; X86-NEXT: .symidx $cfgsj_func_cf_setjmp1254 255 ; X64: .section .gljmp$y,"dr"256 ; X64-NEXT: .symidx $cfgsj_func_cf_setjmp0257 ; X64-NEXT: .symidx $cfgsj_func_cf_setjmp1258}259 260declare ptr @llvm.frameaddress(i32)261 262; Function Attrs: returns_twice263declare dso_local i32 @_setjmp(ptr, ptr) #2264 265attributes #2 = { returns_twice }266 267 268!llvm.module.flags = !{!0}269!0 = !{i32 2, !"cfguard", i32 2}270