(original) (raw)

I�m a newbie here, working on a project to enforce Control Flow Integrity (CFI) on programs compiled with LLVM. We�re using LLVM 3.3 so we can leverage poolalloc's dsa analysis. Ideally this will be as target-independent as possible, but our primary target is ARM. One of our passes requires inserting different i32 IDs at various points into the code we�re compiling. As far as I can tell, it�s impossible to with just LLVM IR, so we�re looking into ways of getting these IDs through the CodeGen.

One thing that looked promising is the function �prefix� value in LLVM 3.4, which is able to emit a global value into the asm. This is the right idea except we need it at arbitrary points in code. We then looked at defining a custom intrinsic function (@llvm.cfiid) that we can insert into the IR and then lower to assembly. It didn�t seem like this was exactly what we wanted either, because the asm that is generated has to be target dependent. We�ve checked out the poolalloc/safecoode projects and there�s some helpful analysis tools, but didn�t find anything relevant to ID lowering.

Our current thrust is to define a custom target intrinsic function (@llvm.arm.cfiid) that we can insert into the IR and lower using a definition in the ARMInstrInfo.td file. Right now, I�m trying to define the pattern and instruction in that file. At first, I just inserted a pattern to lower our intrinsic into a �trap� instruction, which worked fine:

/\* Code in IR/IntrinsicsARM.td \*/

/\* Note, I�m not positive that IntrNoReturn is correct here, but IntrNoMem type wouldn�t lower to an SDNode because of lack of �results� \*/

def int\_arm\_cfiid : Intrinsic<\[\], \[llvm\_i32\_ty\], \[IntrNoReturn\]>;