LLVM 17.0.0git
ARMSLSHardening.cpp
Go to the documentation of this file.
1//===- ARMSLSHardening.cpp - Harden Straight Line Missspeculation ---------===//
2//
3// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4// See https://llvm.org/LICENSE.txt for license information.
5// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6//
7//===----------------------------------------------------------------------===//
8//
9// This file contains a pass to insert code to mitigate against side channel
10// vulnerabilities that may happen under straight line miss-speculation.
11//
12//===----------------------------------------------------------------------===//
13
14#include "ARM.h"
15#include "ARMInstrInfo.h"
16#include "ARMSubtarget.h"
24#include "llvm/IR/DebugLoc.h"
25#include <cassert>
26
27using namespace llvm;
28
29#define DEBUG_TYPE "arm-sls-hardening"
30
31#define ARM_SLS_HARDENING_NAME "ARM sls hardening pass"
32
33namespace {
34
35class ARMSLSHardening : public MachineFunctionPass {
36public:
37 const TargetInstrInfo *TII;
38 const ARMSubtarget *ST;
39
40 static char ID;
41
42 ARMSLSHardening() : MachineFunctionPass(ID) {
44 }
45
46 bool runOnMachineFunction(MachineFunction &Fn) override;
47
48 StringRef getPassName() const override { return ARM_SLS_HARDENING_NAME; }
49
50 void getAnalysisUsage(AnalysisUsage &AU) const override {
51 AU.setPreservesCFG();
53 }
54
55private:
56 bool hardenReturnsAndBRs(MachineBasicBlock &MBB) const;
57 bool hardenIndirectCalls(MachineBasicBlock &MBB) const;
59 ConvertIndirectCallToIndirectJump(MachineBasicBlock &MBB,
61};
62
63} // end anonymous namespace
64
65char ARMSLSHardening::ID = 0;
66
67INITIALIZE_PASS(ARMSLSHardening, "arm-sls-hardening",
68 ARM_SLS_HARDENING_NAME, false, false)
69
70static void insertSpeculationBarrier(const ARMSubtarget *ST,
75 assert(MBBI != MBB.begin() &&
76 "Must not insert SpeculationBarrierEndBB as only instruction in MBB.");
77 assert(std::prev(MBBI)->isBarrier() &&
78 "SpeculationBarrierEndBB must only follow unconditional control flow "
79 "instructions.");
80 assert(std::prev(MBBI)->isTerminator() &&
81 "SpeculationBarrierEndBB must only follow terminators.");
82 const TargetInstrInfo *TII = ST->getInstrInfo();
83 assert(ST->hasDataBarrier() || ST->hasSB());
84 bool ProduceSB = ST->hasSB() && !AlwaysUseISBDSB;
85 unsigned BarrierOpc =
86 ProduceSB ? (ST->isThumb() ? ARM::t2SpeculationBarrierSBEndBB
87 : ARM::SpeculationBarrierSBEndBB)
88 : (ST->isThumb() ? ARM::t2SpeculationBarrierISBDSBEndBB
89 : ARM::SpeculationBarrierISBDSBEndBB);
90 if (MBBI == MBB.end() || !isSpeculationBarrierEndBBOpcode(MBBI->getOpcode()))
91 BuildMI(MBB, MBBI, DL, TII->get(BarrierOpc));
92}
93
94bool ARMSLSHardening::runOnMachineFunction(MachineFunction &MF) {
97
98 bool Modified = false;
99 for (auto &MBB : MF) {
100 Modified |= hardenReturnsAndBRs(MBB);
101 Modified |= hardenIndirectCalls(MBB);
102 }
103
104 return Modified;
105}
106
107bool ARMSLSHardening::hardenReturnsAndBRs(MachineBasicBlock &MBB) const {
108 if (!ST->hardenSlsRetBr())
109 return false;
110 assert(!ST->isThumb1Only());
111 bool Modified = false;
114 for (; MBBI != E; MBBI = NextMBBI) {
115 MachineInstr &MI = *MBBI;
116 NextMBBI = std::next(MBBI);
118 assert(MI.isTerminator());
120 insertSpeculationBarrier(ST, MBB, std::next(MBBI), MI.getDebugLoc());
121 Modified = true;
122 }
123 }
124 return Modified;
125}
126
127static const char SLSBLRNamePrefix[] = "__llvm_slsblr_thunk_";
128
129static const struct ThunkNameRegMode {
130 const char* Name;
133} SLSBLRThunks[] = {
134 {"__llvm_slsblr_thunk_arm_r0", ARM::R0, false},
135 {"__llvm_slsblr_thunk_arm_r1", ARM::R1, false},
136 {"__llvm_slsblr_thunk_arm_r2", ARM::R2, false},
137 {"__llvm_slsblr_thunk_arm_r3", ARM::R3, false},
138 {"__llvm_slsblr_thunk_arm_r4", ARM::R4, false},
139 {"__llvm_slsblr_thunk_arm_r5", ARM::R5, false},
140 {"__llvm_slsblr_thunk_arm_r6", ARM::R6, false},
141 {"__llvm_slsblr_thunk_arm_r7", ARM::R7, false},
142 {"__llvm_slsblr_thunk_arm_r8", ARM::R8, false},
143 {"__llvm_slsblr_thunk_arm_r9", ARM::R9, false},
144 {"__llvm_slsblr_thunk_arm_r10", ARM::R10, false},
145 {"__llvm_slsblr_thunk_arm_r11", ARM::R11, false},
146 {"__llvm_slsblr_thunk_arm_sp", ARM::SP, false},
147 {"__llvm_slsblr_thunk_arm_pc", ARM::PC, false},
148 {"__llvm_slsblr_thunk_thumb_r0", ARM::R0, true},
149 {"__llvm_slsblr_thunk_thumb_r1", ARM::R1, true},
150 {"__llvm_slsblr_thunk_thumb_r2", ARM::R2, true},
151 {"__llvm_slsblr_thunk_thumb_r3", ARM::R3, true},
152 {"__llvm_slsblr_thunk_thumb_r4", ARM::R4, true},
153 {"__llvm_slsblr_thunk_thumb_r5", ARM::R5, true},
154 {"__llvm_slsblr_thunk_thumb_r6", ARM::R6, true},
155 {"__llvm_slsblr_thunk_thumb_r7", ARM::R7, true},
156 {"__llvm_slsblr_thunk_thumb_r8", ARM::R8, true},
157 {"__llvm_slsblr_thunk_thumb_r9", ARM::R9, true},
158 {"__llvm_slsblr_thunk_thumb_r10", ARM::R10, true},
159 {"__llvm_slsblr_thunk_thumb_r11", ARM::R11, true},
160 {"__llvm_slsblr_thunk_thumb_sp", ARM::SP, true},
161 {"__llvm_slsblr_thunk_thumb_pc", ARM::PC, true},
163
164// An enum for tracking whether Arm and Thumb thunks have been inserted into the
165// current module so far.
167
170 return X = static_cast<ArmInsertedThunks>(X | Y);
171}
172
173namespace {
174struct SLSBLRThunkInserter
175 : ThunkInserter<SLSBLRThunkInserter, ArmInsertedThunks> {
176 const char *getThunkPrefix() { return SLSBLRNamePrefix; }
177 bool mayUseThunk(const MachineFunction &MF,
178 ArmInsertedThunks InsertedThunks) {
179 if ((InsertedThunks & ArmThunk &&
180 !MF.getSubtarget<ARMSubtarget>().isThumb()) ||
181 (InsertedThunks & ThumbThunk &&
182 MF.getSubtarget<ARMSubtarget>().isThumb()))
183 return false;
184 ComdatThunks &= !MF.getSubtarget<ARMSubtarget>().hardenSlsNoComdat();
185 // FIXME: This could also check if there are any indirect calls in the
186 // function to more accurately reflect if a thunk will be needed.
187 return MF.getSubtarget<ARMSubtarget>().hardenSlsBlr();
188 }
190 void populateThunk(MachineFunction &MF);
191
192private:
193 bool ComdatThunks = true;
194};
195} // namespace
196
197ArmInsertedThunks SLSBLRThunkInserter::insertThunks(MachineModuleInfo &MMI,
198 MachineFunction &MF) {
199 // FIXME: It probably would be possible to filter which thunks to produce
200 // based on which registers are actually used in indirect calls in this
201 // function. But would that be a worthwhile optimization?
203 for (auto T : SLSBLRThunks)
204 if (ST->isThumb() == T.isThumb)
205 createThunkFunction(MMI, T.Name, ComdatThunks);
206 return ST->isThumb() ? ThumbThunk : ArmThunk;
207}
208
209void SLSBLRThunkInserter::populateThunk(MachineFunction &MF) {
210 // FIXME: How to better communicate Register number, rather than through
211 // name and lookup table?
212 assert(MF.getName().startswith(getThunkPrefix()));
213 auto ThunkIt = llvm::find_if(
214 SLSBLRThunks, [&MF](auto T) { return T.Name == MF.getName(); });
215 assert(ThunkIt != std::end(SLSBLRThunks));
216 Register ThunkReg = ThunkIt->Reg;
217 bool isThumb = ThunkIt->isThumb;
218
219 const TargetInstrInfo *TII = MF.getSubtarget<ARMSubtarget>().getInstrInfo();
220 MachineBasicBlock *Entry = &MF.front();
221 Entry->clear();
222
223 // These thunks need to consist of the following instructions:
224 // __llvm_slsblr_thunk_(arm/thumb)_rN:
225 // bx rN
226 // barrierInsts
227 Entry->addLiveIn(ThunkReg);
228 if (isThumb)
229 BuildMI(Entry, DebugLoc(), TII->get(ARM::tBX))
230 .addReg(ThunkReg)
232 else
233 BuildMI(Entry, DebugLoc(), TII->get(ARM::BX))
234 .addReg(ThunkReg);
235
236 // Make sure the thunks do not make use of the SB extension in case there is
237 // a function somewhere that will call to it that for some reason disabled
238 // the SB extension locally on that function, even though it's enabled for
239 // the module otherwise. Therefore set AlwaysUseISBSDB to true.
240 insertSpeculationBarrier(&MF.getSubtarget<ARMSubtarget>(), *Entry,
241 Entry->end(), DebugLoc(), true /*AlwaysUseISBDSB*/);
242}
243
244MachineBasicBlock &ARMSLSHardening::ConvertIndirectCallToIndirectJump(
246 // Transform an indirect call to an indirect jump as follows:
247 // Before:
248 // |-----------------------------|
249 // | ... |
250 // | instI |
251 // | BLX rN |
252 // | instJ |
253 // | ... |
254 // |-----------------------------|
255 //
256 // After:
257 // |---------- -------------------------|
258 // | ... |
259 // | instI |
260 // | *call* __llvm_slsblr_thunk_mode_xN |
261 // | instJ |
262 // | ... |
263 // |--------------------------------------|
264 //
265 // __llvm_slsblr_thunk_mode_xN:
266 // |-----------------------------|
267 // | BX rN |
268 // | barrierInsts |
269 // |-----------------------------|
270 //
271 // The __llvm_slsblr_thunk_mode_xN thunks are created by the
272 // SLSBLRThunkInserter.
273 // This function merely needs to transform an indirect call to a direct call
274 // to __llvm_slsblr_thunk_xN.
277 int RegOpIdxOnIndirectCall = -1;
278 bool isThumb;
279 switch (IndirectCall.getOpcode()) {
280 case ARM::BLX: // !isThumb2
281 case ARM::BLX_noip: // !isThumb2
282 isThumb = false;
283 RegOpIdxOnIndirectCall = 0;
284 break;
285 case ARM::tBLXr: // isThumb2
286 case ARM::tBLXr_noip: // isThumb2
287 isThumb = true;
288 RegOpIdxOnIndirectCall = 2;
289 break;
290 default:
291 llvm_unreachable("unhandled Indirect Call");
292 }
293
294 Register Reg = IndirectCall.getOperand(RegOpIdxOnIndirectCall).getReg();
295 // Since linkers are allowed to clobber R12 on function calls, the above
296 // mitigation only works if the original indirect call instruction was not
297 // using R12. Code generation before must make sure that no indirect call
298 // using R12 was produced if the mitigation is enabled.
299 // Also, the transformation is incorrect if the indirect call uses LR, so
300 // also have to avoid that.
301 assert(Reg != ARM::R12 && Reg != ARM::LR);
302 bool RegIsKilled = IndirectCall.getOperand(RegOpIdxOnIndirectCall).isKill();
303
304 DebugLoc DL = IndirectCall.getDebugLoc();
305
306 MachineFunction &MF = *MBBI->getMF();
307 auto ThunkIt = llvm::find_if(SLSBLRThunks, [Reg, isThumb](auto T) {
308 return T.Reg == Reg && T.isThumb == isThumb;
309 });
310 assert(ThunkIt != std::end(SLSBLRThunks));
311 Module *M = MF.getFunction().getParent();
312 const GlobalValue *GV = cast<GlobalValue>(M->getNamedValue(ThunkIt->Name));
313
315 isThumb ? BuildMI(MBB, MBBI, DL, TII->get(ARM::tBL))
316 .addImm(IndirectCall.getOperand(0).getImm())
317 .addReg(IndirectCall.getOperand(1).getReg())
319 : BuildMI(MBB, MBBI, DL, TII->get(ARM::BL)).addGlobalAddress(GV);
320
321 // Now copy the implicit operands from IndirectCall to BL and copy other
322 // necessary info.
323 // However, both IndirectCall and BL instructions implictly use SP and
324 // implicitly define LR. Blindly copying implicit operands would result in SP
325 // and LR operands to be present multiple times. While this may not be too
326 // much of an issue, let's avoid that for cleanliness, by removing those
327 // implicit operands from the BL created above before we copy over all
328 // implicit operands from the IndirectCall.
329 int ImpLROpIdx = -1;
330 int ImpSPOpIdx = -1;
331 for (unsigned OpIdx = BL->getNumExplicitOperands();
332 OpIdx < BL->getNumOperands(); OpIdx++) {
333 MachineOperand Op = BL->getOperand(OpIdx);
334 if (!Op.isReg())
335 continue;
336 if (Op.getReg() == ARM::LR && Op.isDef())
337 ImpLROpIdx = OpIdx;
338 if (Op.getReg() == ARM::SP && !Op.isDef())
339 ImpSPOpIdx = OpIdx;
340 }
341 assert(ImpLROpIdx != -1);
342 assert(ImpSPOpIdx != -1);
343 int FirstOpIdxToRemove = std::max(ImpLROpIdx, ImpSPOpIdx);
344 int SecondOpIdxToRemove = std::min(ImpLROpIdx, ImpSPOpIdx);
345 BL->removeOperand(FirstOpIdxToRemove);
346 BL->removeOperand(SecondOpIdxToRemove);
347 // Now copy over the implicit operands from the original IndirectCall
348 BL->copyImplicitOps(MF, IndirectCall);
350 // Also add the register called in the IndirectCall as being used in the
351 // called thunk.
352 BL->addOperand(MachineOperand::CreateReg(Reg, false /*isDef*/, true /*isImp*/,
353 RegIsKilled /*isKill*/));
354 // Remove IndirectCallinstruction
355 MBB.erase(MBBI);
356 return MBB;
357}
358
359bool ARMSLSHardening::hardenIndirectCalls(MachineBasicBlock &MBB) const {
360 if (!ST->hardenSlsBlr())
361 return false;
362 bool Modified = false;
365 for (; MBBI != E; MBBI = NextMBBI) {
366 MachineInstr &MI = *MBBI;
367 NextMBBI = std::next(MBBI);
368 // Tail calls are both indirect calls and "returns".
369 // They are also indirect jumps, so should be handled by sls-harden-retbr,
370 // rather than sls-harden-blr.
371 if (isIndirectCall(MI) && !MI.isReturn()) {
372 ConvertIndirectCallToIndirectJump(MBB, MBBI);
373 Modified = true;
374 }
375 }
376 return Modified;
377}
378
379
380
382 return new ARMSLSHardening();
383}
384
385namespace {
386class ARMIndirectThunks : public MachineFunctionPass {
387public:
388 static char ID;
389
390 ARMIndirectThunks() : MachineFunctionPass(ID) {}
391
392 StringRef getPassName() const override { return "ARM Indirect Thunks"; }
393
394 bool doInitialization(Module &M) override;
395 bool runOnMachineFunction(MachineFunction &MF) override;
396
397 void getAnalysisUsage(AnalysisUsage &AU) const override {
401 }
402
403private:
404 std::tuple<SLSBLRThunkInserter> TIs;
405
406 // FIXME: When LLVM moves to C++17, these can become folds
407 template <typename... ThunkInserterT>
408 static void initTIs(Module &M,
409 std::tuple<ThunkInserterT...> &ThunkInserters) {
410 (void)std::initializer_list<int>{
411 (std::get<ThunkInserterT>(ThunkInserters).init(M), 0)...};
412 }
413 template <typename... ThunkInserterT>
414 static bool runTIs(MachineModuleInfo &MMI, MachineFunction &MF,
415 std::tuple<ThunkInserterT...> &ThunkInserters) {
416 bool Modified = false;
417 (void)std::initializer_list<int>{
418 Modified |= std::get<ThunkInserterT>(ThunkInserters).run(MMI, MF)...};
419 return Modified;
420 }
421};
422
423} // end anonymous namespace
424
425char ARMIndirectThunks::ID = 0;
426
428 return new ARMIndirectThunks();
429}
430
431bool ARMIndirectThunks::doInitialization(Module &M) {
432 initTIs(M, TIs);
433 return false;
434}
435
436bool ARMIndirectThunks::runOnMachineFunction(MachineFunction &MF) {
437 LLVM_DEBUG(dbgs() << getPassName() << '\n');
438 auto &MMI = getAnalysis<MachineModuleInfoWrapperPass>().getMMI();
439 return runTIs(MMI, MF, TIs);
440}
aarch64 promote const
static bool isThumb(const MCSubtargetInfo &STI)
MachineBasicBlock & MBB
ArmInsertedThunks & operator|=(ArmInsertedThunks &X, ArmInsertedThunks Y)
MachineBasicBlock MachineBasicBlock::iterator DebugLoc bool AlwaysUseISBDSB
#define ARM_SLS_HARDENING_NAME
ArmInsertedThunks
@ ArmThunk
@ ThumbThunk
MachineBasicBlock MachineBasicBlock::iterator DebugLoc DL
MachineBasicBlock MachineBasicBlock::iterator MBBI
static const struct ThunkNameRegMode SLSBLRThunks[]
static GCRegistry::Add< CoreCLRGC > E("coreclr", "CoreCLR-compatible GC")
#define LLVM_DEBUG(X)
Definition: Debug.h:101
static GCMetadataPrinterRegistry::Add< ErlangGCPrinter > X("erlang", "erlang-compatible garbage collector")
const HexagonInstrInfo * TII
IRTranslator LLVM IR MI
Contains a base class for Passes that inject an MI thunk.
static GCMetadataPrinterRegistry::Add< OcamlGCMetadataPrinter > Y("ocaml", "ocaml 3.10-compatible collector")
#define INITIALIZE_PASS(passName, arg, name, cfg, analysis)
Definition: PassSupport.h:38
assert(ImpDefSCC.getReg()==AMDGPU::SCC &&ImpDefSCC.isDef())
Represent the analysis usage information of a pass.
AnalysisUsage & addRequired()
AnalysisUsage & addPreserved()
Add the specified Pass class to the set of analyses preserved by this pass.
void setPreservesCFG()
This function should be called by the pass, iff they do not:
Definition: Pass.cpp:265
A debug info location.
Definition: DebugLoc.h:33
FunctionPass class - This class is used to implement most global optimizations.
Definition: Pass.h:308
Module * getParent()
Get the module that this global value is contained inside of...
Definition: GlobalValue.h:652
bool isPredicated(const MachineInstr &MI) const override
Returns true if the instruction is already predicated.
iterator getFirstTerminator()
Returns an iterator to the first terminator instruction of this basic block.
instr_iterator erase(instr_iterator I)
Remove an instruction from the instruction list and delete it.
MachineFunctionPass - This class adapts the FunctionPass interface to allow convenient creation of pa...
bool doInitialization(Module &) override
doInitialization - Virtual method overridden by subclasses to do any necessary initialization before ...
void getAnalysisUsage(AnalysisUsage &AU) const override
getAnalysisUsage - Subclasses that override getAnalysisUsage must call this.
virtual bool runOnMachineFunction(MachineFunction &MF)=0
runOnMachineFunction - This method must be overloaded to perform the desired machine code transformat...
const TargetSubtargetInfo & getSubtarget() const
getSubtarget - Return the subtarget for which this machine code is being compiled.
StringRef getName() const
getName - Return the name of the corresponding LLVM function.
Function & getFunction()
Return the LLVM function that this machine code represents.
const MachineBasicBlock & front() const
void moveCallSiteInfo(const MachineInstr *Old, const MachineInstr *New)
Move the call site info from Old to \New call site info.
const MachineInstrBuilder & addImm(int64_t Val) const
Add a new immediate operand.
const MachineInstrBuilder & add(const MachineOperand &MO) const
const MachineInstrBuilder & addGlobalAddress(const GlobalValue *GV, int64_t Offset=0, unsigned TargetFlags=0) const
const MachineInstrBuilder & addReg(Register RegNo, unsigned flags=0, unsigned SubReg=0) const
Add a new virtual register operand.
Representation of each machine instruction.
Definition: MachineInstr.h:68
This class contains meta information specific to a module.
MachineOperand class - Representation of each machine instruction operand.
static MachineOperand CreateReg(Register Reg, bool isDef, bool isImp=false, bool isKill=false, bool isDead=false, bool isUndef=false, bool isEarlyClobber=false, unsigned SubReg=0, bool isDebug=false, bool isInternalRead=false, bool isRenamable=false)
A Module instance is used to store all the information related to an LLVM module.
Definition: Module.h:65
static PassRegistry * getPassRegistry()
getPassRegistry - Access the global registry object, which is automatically initialized at applicatio...
virtual StringRef getPassName() const
getPassName - Return a nice clean name for a pass.
Definition: Pass.cpp:81
Wrapper class representing virtual and physical registers.
Definition: Register.h:19
StringRef - Represent a constant reference to a string, i.e.
Definition: StringRef.h:50
bool startswith(StringRef Prefix) const
Definition: StringRef.h:261
TargetInstrInfo - Interface to description of machine instruction set.
virtual const TargetInstrInfo * getInstrInfo() const
#define llvm_unreachable(msg)
Marks that the current location is not supposed to be reachable.
unsigned ID
LLVM IR allows to use arbitrary numbers as calling convention identifiers.
Definition: CallingConv.h:24
Reg
All possible values of the reg field in the ModR/M byte.
This is an optimization pass for GlobalISel generic memory operations.
Definition: AddressRanges.h:18
static bool isIndirectCall(const MachineInstr &MI)
MachineInstrBuilder BuildMI(MachineFunction &MF, const MIMetadata &MIMD, const MCInstrDesc &MCID)
Builder interface. Specify how to create the initial instruction itself.
static std::array< MachineOperand, 2 > predOps(ARMCC::CondCodes Pred, unsigned PredReg=0)
Get the operands corresponding to the given Pred value.
raw_ostream & dbgs()
dbgs() - This returns a reference to a raw_ostream for debugging messages.
Definition: Debug.cpp:163
void initializeARMSLSHardeningPass(PassRegistry &)
FunctionPass * createARMSLSHardeningPass()
static bool isIndirectControlFlowNotComingBack(const MachineInstr &MI)
auto find_if(R &&Range, UnaryPredicate P)
Provide wrappers to std::find_if which take ranges instead of having to pass begin/end explicitly.
Definition: STLExtras.h:1846
FunctionPass * createARMIndirectThunks()
static bool isSpeculationBarrierEndBBOpcode(int Opc)