[cfi-verify] Support AArch64.

This patch adds support for AArch64 to cfi-verify.

This required three changes to cfi-verify.  First, it generalizes checking if an instruction is a trap by adding a new isTrap flag to TableGen (and defining it for x86 and AArch64).  Second, the code that ensures that the operand register is not clobbered between the CFI check and the indirect call needs to allow a single dereference (in x86 this happens as part of the jump instruction).  Third, we needed to ensure that return instructions are not counted as indirect branches.  Technically, returns are indirect branches and can be covered by CFI, but LLVM's forward-edge CFI does not protect them, and x86 does not consider them, so we keep that behavior.

In addition, we had to improve AArch64's code to evaluate the branch target of a MCInst to handle calls where the destination is not the first operand (which it often is not).

Differential Revision: https://reviews.llvm.org/D48836

llvm-svn: 337007

1 files changed, 7 insertions, 4 deletions

diff --git a/llvm/tools/llvm-cfi-verify/lib/FileAnalysis.h b/llvm/tools/llvm-cfi-verify/lib/FileAnalysis.h
index ce81f8bfbe3..3f0a7048788 100644
--- a/llvm/tools/llvm-cfi-verify/lib/FileAnalysis.h
+++ b/llvm/tools/llvm-cfi-verify/lib/FileAnalysis.h
@@ -149,10 +149,13 @@ public:
   CFIProtectionStatus validateCFIProtection(const GraphResult &Graph) const;
 
   // Returns the first place the operand register is clobbered between the CFI-
-  // check and the indirect CF instruction execution. If the register is not
-  // modified, returns the address of the indirect CF instruction. The result is
-  // undefined if the provided graph does not fall under either the
-  // FAIL_REGISTER_CLOBBERED or PROTECTED status (see CFIProtectionStatus).
+  // check and the indirect CF instruction execution. We do this by walking
+  // backwards from the indirect CF and ensuring there is at most one load
+  // involving the operand register (which is the indirect CF itself on x86).
+  // If the register is not modified, returns the address of the indirect CF
+  // instruction. The result is undefined if the provided graph does not fall
+  // under either the FAIL_REGISTER_CLOBBERED or PROTECTED status (see
+  // CFIProtectionStatus).
   uint64_t indirectCFOperandClobber(const GraphResult& Graph) const;
 
   // Prints an instruction to the provided stream using this object's pretty-