LLVM  14.0.0git
AArch64BranchTargets.cpp
Go to the documentation of this file.
1 //===-- AArch64BranchTargets.cpp -- Harden code using v8.5-A BTI extension -==//
2 //
3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4 // See https://llvm.org/LICENSE.txt for license information.
5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6 //
7 //===----------------------------------------------------------------------===//
8 //
9 // This pass inserts BTI instructions at the start of every function and basic
10 // block which could be indirectly called. The hardware will (when enabled)
11 // trap when an indirect branch or call instruction targets an instruction
12 // which is not a valid BTI instruction. This is intended to guard against
13 // control-flow hijacking attacks. Note that this does not do anything for RET
14 // instructions, as they can be more precisely protected by return address
15 // signing.
16 //
17 //===----------------------------------------------------------------------===//
18 
20 #include "AArch64Subtarget.h"
25 #include "llvm/Support/Debug.h"
26 
27 using namespace llvm;
28 
29 #define DEBUG_TYPE "aarch64-branch-targets"
30 #define AARCH64_BRANCH_TARGETS_NAME "AArch64 Branch Targets"
31 
32 namespace {
33 class AArch64BranchTargets : public MachineFunctionPass {
34 public:
35  static char ID;
36  AArch64BranchTargets() : MachineFunctionPass(ID) {}
37  void getAnalysisUsage(AnalysisUsage &AU) const override;
38  bool runOnMachineFunction(MachineFunction &MF) override;
39  StringRef getPassName() const override { return AARCH64_BRANCH_TARGETS_NAME; }
40 
41 private:
42  void addBTI(MachineBasicBlock &MBB, bool CouldCall, bool CouldJump);
43 };
44 } // end anonymous namespace
45 
47 
48 INITIALIZE_PASS(AArch64BranchTargets, "aarch64-branch-targets",
49  AARCH64_BRANCH_TARGETS_NAME, false, false)
50 
51 void AArch64BranchTargets::getAnalysisUsage(AnalysisUsage &AU) const {
52  AU.setPreservesCFG();
54 }
55 
57  return new AArch64BranchTargets();
58 }
59 
60 bool AArch64BranchTargets::runOnMachineFunction(MachineFunction &MF) {
62  return false;
63 
64  LLVM_DEBUG(
65  dbgs() << "********** AArch64 Branch Targets **********\n"
66  << "********** Function: " << MF.getName() << '\n');
67 
68  // LLVM does not consider basic blocks which are the targets of jump tables
69  // to be address-taken (the address can't escape anywhere else), but they are
70  // used for indirect branches, so need BTI instructions.
71  SmallPtrSet<MachineBasicBlock *, 8> JumpTableTargets;
72  if (auto *JTI = MF.getJumpTableInfo())
73  for (auto &JTE : JTI->getJumpTables())
74  for (auto *MBB : JTE.MBBs)
75  JumpTableTargets.insert(MBB);
76 
77  bool MadeChange = false;
78  for (MachineBasicBlock &MBB : MF) {
79  bool CouldCall = false, CouldJump = false;
80  // Even in cases where a function has internal linkage and is only called
81  // directly in its translation unit, it can still be called indirectly if
82  // the linker decides to add a thunk to it for whatever reason (say, for
83  // example, if it is finally placed far from its call site and a BL is not
84  // long-range enough). PLT entries and tail-calls use BR, but when they are
85  // are in guarded pages should all use x16 or x17 to hold the called
86  // address, so we don't need to set CouldJump here. BR instructions in
87  // non-guarded pages (which might be non-BTI-aware code) are allowed to
88  // branch to a "BTI c" using any register.
89  if (&MBB == &*MF.begin())
90  CouldCall = true;
91 
92  // If the block itself is address-taken, it could be indirectly branched
93  // to, but not called.
94  if (MBB.hasAddressTaken() || JumpTableTargets.count(&MBB))
95  CouldJump = true;
96 
97  if (CouldCall || CouldJump) {
98  addBTI(MBB, CouldCall, CouldJump);
99  MadeChange = true;
100  }
101  }
102 
103  return MadeChange;
104 }
105 
106 void AArch64BranchTargets::addBTI(MachineBasicBlock &MBB, bool CouldCall,
107  bool CouldJump) {
108  LLVM_DEBUG(dbgs() << "Adding BTI " << (CouldJump ? "j" : "")
109  << (CouldCall ? "c" : "") << " to " << MBB.getName()
110  << "\n");
111 
112  const AArch64InstrInfo *TII = static_cast<const AArch64InstrInfo *>(
114 
115  unsigned HintNum = 32;
116  if (CouldCall)
117  HintNum |= 2;
118  if (CouldJump)
119  HintNum |= 4;
120  assert(HintNum != 32 && "No target kinds!");
121 
122  auto MBBI = MBB.begin();
123 
124  // Skip the meta instructions, those will be removed anyway.
125  for (; MBBI != MBB.end() &&
126  (MBBI->isMetaInstruction() || MBBI->getOpcode() == AArch64::EMITBKEY);
127  ++MBBI)
128  ;
129 
130  // SCTLR_EL1.BT[01] is set to 0 by default which means
131  // PACI[AB]SP are implicitly BTI C so no BTI C instruction is needed there.
132  if (MBBI != MBB.end() && HintNum == 34 &&
133  (MBBI->getOpcode() == AArch64::PACIASP ||
134  MBBI->getOpcode() == AArch64::PACIBSP))
135  return;
136 
138  TII->get(AArch64::HINT))
139  .addImm(HintNum);
140 }
llvm::MachineInstrBuilder::addImm
const MachineInstrBuilder & addImm(int64_t Val) const
Add a new immediate operand.
Definition: MachineInstrBuilder.h:131
llvm
This file implements support for optimizing divisions by a constant.
Definition: AllocatorList.h:23
AArch64MachineFunctionInfo.h
llvm::TargetSubtargetInfo::getInstrInfo
virtual const TargetInstrInfo * getInstrInfo() const
Definition: TargetSubtargetInfo.h:92
llvm::MachineFunctionPass
MachineFunctionPass - This class adapts the FunctionPass interface to allow convenient creation of pa...
Definition: MachineFunctionPass.h:30
llvm::createAArch64BranchTargetsPass
FunctionPass * createAArch64BranchTargetsPass()
llvm::MachineBasicBlock::findDebugLoc
DebugLoc findDebugLoc(instr_iterator MBBI)
Find the next valid DebugLoc starting at MBBI, skipping any DBG_VALUE and DBG_LABEL instructions.
Definition: MachineBasicBlock.cpp:1378
MachineJumpTableInfo.h
llvm::SmallPtrSet
SmallPtrSet - This class implements a set which is optimized for holding SmallSize or less elements.
Definition: SmallPtrSet.h:449
llvm::MachineFunctionPass::getAnalysisUsage
void getAnalysisUsage(AnalysisUsage &AU) const override
getAnalysisUsage - Subclasses that override getAnalysisUsage must call this.
Definition: MachineFunctionPass.cpp:102
LLVM_DEBUG
#define LLVM_DEBUG(X)
Definition: Debug.h:101
llvm::dbgs
raw_ostream & dbgs()
dbgs() - This returns a reference to a raw_ostream for debugging messages.
Definition: Debug.cpp:163
llvm::AArch64InstrInfo
Definition: AArch64InstrInfo.h:38
llvm::MachineFunction::getInfo
Ty * getInfo()
getInfo - Keep track of various per-function pieces of information for backends that would like to do...
Definition: MachineFunction.h:724
llvm::AnalysisUsage
Represent the analysis usage information of a pass.
Definition: PassAnalysisSupport.h:47
TII
const HexagonInstrInfo * TII
Definition: HexagonCopyToCombine.cpp:129
llvm::MachineBasicBlock
Definition: MachineBasicBlock.h:95
llvm::MachineFunction::getSubtarget
const TargetSubtargetInfo & getSubtarget() const
getSubtarget - Return the subtarget for which this machine code is being compiled.
Definition: MachineFunction.h:626
llvm::MachineBasicBlock::hasAddressTaken
bool hasAddressTaken() const
Test whether this block is potentially the target of an indirect branch.
Definition: MachineBasicBlock.h:211
llvm::AArch64FunctionInfo
AArch64FunctionInfo - This class is derived from MachineFunctionInfo and contains private AArch64-spe...
Definition: AArch64MachineFunctionInfo.h:37
MachineFunctionPass.h
llvm::MachineFunction::getName
StringRef getName() const
getName - Return the name of the corresponding LLVM function.
Definition: MachineFunction.cpp:541
assert
assert(ImpDefSCC.getReg()==AMDGPU::SCC &&ImpDefSCC.isDef())
llvm::MachineBasicBlock::getParent
const MachineFunction * getParent() const
Return the MachineFunction containing this basic block.
Definition: MachineBasicBlock.h:225
llvm::AArch64FunctionInfo::branchTargetEnforcement
bool branchTargetEnforcement() const
Definition: AArch64MachineFunctionInfo.h:399
MachineModuleInfo.h
llvm::SmallPtrSetImpl::count
size_type count(ConstPtrType Ptr) const
count - Return 1 if the specified pointer is in the set, 0 otherwise.
Definition: SmallPtrSet.h:382
llvm::MachineFunction
Definition: MachineFunction.h:230
llvm::StringRef
StringRef - Represent a constant reference to a string, i.e.
Definition: StringRef.h:58
MBBI
MachineBasicBlock MachineBasicBlock::iterator MBBI
Definition: AArch64SLSHardening.cpp:75
MBB
MachineBasicBlock & MBB
Definition: AArch64SLSHardening.cpp:74
INITIALIZE_PASS
INITIALIZE_PASS(AArch64BranchTargets, "aarch64-branch-targets", AARCH64_BRANCH_TARGETS_NAME, false, false) void AArch64BranchTargets
Definition: AArch64BranchTargets.cpp:48
AArch64Subtarget.h
llvm::MachineBasicBlock::begin
iterator begin()
Definition: MachineBasicBlock.h:268
MachineInstrBuilder.h
llvm::BuildMI
MachineInstrBuilder BuildMI(MachineFunction &MF, const DebugLoc &DL, const MCInstrDesc &MCID)
Builder interface. Specify how to create the initial instruction itself.
Definition: MachineInstrBuilder.h:328
llvm::FunctionPass
FunctionPass class - This class is used to implement most global optimizations.
Definition: Pass.h:298
llvm::MachineFunction::getJumpTableInfo
const MachineJumpTableInfo * getJumpTableInfo() const
getJumpTableInfo - Return the jump table info object for the current function.
Definition: MachineFunction.h:649
llvm::MachineBasicBlock::getName
StringRef getName() const
Return the name of the corresponding LLVM basic block, or an empty string.
Definition: MachineBasicBlock.cpp:314
Debug.h
llvm::MachineBasicBlock::end
iterator end()
Definition: MachineBasicBlock.h:270
AARCH64_BRANCH_TARGETS_NAME
#define AARCH64_BRANCH_TARGETS_NAME
Definition: AArch64BranchTargets.cpp:30
llvm::SmallPtrSetImpl::insert
std::pair< iterator, bool > insert(PtrType Ptr)
Inserts Ptr if and only if there is no element in the container equal to Ptr.
Definition: SmallPtrSet.h:364
llvm::Intrinsic::ID
unsigned ID
Definition: TargetTransformInfo.h:37