LLVM  9.0.0svn
AArch64BranchTargets.cpp
Go to the documentation of this file.
1 //===-- AArch64BranchTargets.cpp -- Harden code using v8.5-A BTI extension -==//
2 //
3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4 // See https://llvm.org/LICENSE.txt for license information.
5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6 //
7 //===----------------------------------------------------------------------===//
8 //
9 // This pass inserts BTI instructions at the start of every function and basic
10 // block which could be indirectly called. The hardware will (when enabled)
11 // trap when an indirect branch or call instruction targets an instruction
12 // which is not a valid BTI instruction. This is intended to guard against
13 // control-flow hijacking attacks. Note that this does not do anything for RET
14 // instructions, as they can be more precisely protected by return address
15 // signing.
16 //
17 //===----------------------------------------------------------------------===//
18 
19 #include "AArch64Subtarget.h"
24 #include "llvm/Support/Debug.h"
25 
26 using namespace llvm;
27 
28 #define DEBUG_TYPE "aarch64-branch-targets"
29 #define AARCH64_BRANCH_TARGETS_NAME "AArch64 Branch Targets"
30 
31 namespace {
32 class AArch64BranchTargets : public MachineFunctionPass {
33 public:
34  static char ID;
35  AArch64BranchTargets() : MachineFunctionPass(ID) {}
36  void getAnalysisUsage(AnalysisUsage &AU) const override;
37  bool runOnMachineFunction(MachineFunction &MF) override;
38  StringRef getPassName() const override { return AARCH64_BRANCH_TARGETS_NAME; }
39 
40 private:
41  void addBTI(MachineBasicBlock &MBB, bool CouldCall, bool CouldJump);
42 };
43 } // end anonymous namespace
44 
46 
47 INITIALIZE_PASS(AArch64BranchTargets, "aarch64-branch-targets",
48  AARCH64_BRANCH_TARGETS_NAME, false, false)
49 
50 void AArch64BranchTargets::getAnalysisUsage(AnalysisUsage &AU) const {
51  AU.setPreservesCFG();
53 }
54 
56  return new AArch64BranchTargets();
57 }
58 
59 bool AArch64BranchTargets::runOnMachineFunction(MachineFunction &MF) {
60  const Function &F = MF.getFunction();
61  if (!F.hasFnAttribute("branch-target-enforcement"))
62  return false;
63 
64  LLVM_DEBUG(
65  dbgs() << "********** AArch64 Branch Targets **********\n"
66  << "********** Function: " << MF.getName() << '\n');
67 
68  // LLVM does not consider basic blocks which are the targets of jump tables
69  // to be address-taken (the address can't escape anywhere else), but they are
70  // used for indirect branches, so need BTI instructions.
71  SmallPtrSet<MachineBasicBlock *, 8> JumpTableTargets;
72  if (auto *JTI = MF.getJumpTableInfo())
73  for (auto &JTE : JTI->getJumpTables())
74  for (auto *MBB : JTE.MBBs)
75  JumpTableTargets.insert(MBB);
76 
77  bool MadeChange = false;
78  for (MachineBasicBlock &MBB : MF) {
79  bool CouldCall = false, CouldJump = false;
80  // If the function is address-taken or externally-visible, it could be
81  // indirectly called. PLT entries and tail-calls use BR, but when they are
82  // are in guarded pages should all use x16 or x17 to hold the called
83  // address, so we don't need to set CouldJump here. BR instructions in
84  // non-guarded pages (which might be non-BTI-aware code) are allowed to
85  // branch to a "BTI c" using any register.
86  if (&MBB == &*MF.begin() && (F.hasAddressTaken() || !F.hasLocalLinkage()))
87  CouldCall = true;
88 
89  // If the block itself is address-taken, it could be indirectly branched
90  // to, but not called.
91  if (MBB.hasAddressTaken() || JumpTableTargets.count(&MBB))
92  CouldJump = true;
93 
94  if (CouldCall || CouldJump) {
95  addBTI(MBB, CouldCall, CouldJump);
96  MadeChange = true;
97  }
98  }
99 
100  return MadeChange;
101 }
102 
103 void AArch64BranchTargets::addBTI(MachineBasicBlock &MBB, bool CouldCall,
104  bool CouldJump) {
105  LLVM_DEBUG(dbgs() << "Adding BTI " << (CouldJump ? "j" : "")
106  << (CouldCall ? "c" : "") << " to " << MBB.getName()
107  << "\n");
108 
109  const AArch64InstrInfo *TII = static_cast<const AArch64InstrInfo *>(
110  MBB.getParent()->getSubtarget().getInstrInfo());
111 
112  unsigned HintNum = 32;
113  if (CouldCall)
114  HintNum |= 2;
115  if (CouldJump)
116  HintNum |= 4;
117  assert(HintNum != 32 && "No target kinds!");
118 
119  auto MBBI = MBB.begin();
120 
121  // PACI[AB]SP are implicitly BTI JC, so no BTI instruction needed there.
122  if (MBBI != MBB.end() && (MBBI->getOpcode() == AArch64::PACIASP ||
123  MBBI->getOpcode() == AArch64::PACIBSP))
124  return;
125 
126  BuildMI(MBB, MBB.begin(), MBB.findDebugLoc(MBB.begin()),
127  TII->get(AArch64::HINT))
128  .addImm(HintNum);
129 }
bool hasLocalLinkage() const
Definition: GlobalValue.h:435
This class represents lattice values for constants.
Definition: AllocatorList.h:23
bool hasFnAttribute(Attribute::AttrKind Kind) const
Return true if the function has the attribute.
Definition: Function.h:320
F(f)
MachineFunctionPass - This class adapts the FunctionPass interface to allow convenient creation of pa...
const HexagonInstrInfo * TII
virtual const TargetInstrInfo * getInstrInfo() const
StringRef getName() const
getName - Return the name of the corresponding LLVM function.
MachineInstrBuilder BuildMI(MachineFunction &MF, const DebugLoc &DL, const MCInstrDesc &MCID)
Builder interface. Specify how to create the initial instruction itself.
static MDTuple * get(LLVMContext &Context, ArrayRef< Metadata *> MDs)
Definition: Metadata.h:1165
StringRef getName() const
Return the name of the corresponding LLVM basic block, or an empty string.
const TargetSubtargetInfo & getSubtarget() const
getSubtarget - Return the subtarget for which this machine code is being compiled.
void getAnalysisUsage(AnalysisUsage &AU) const override
getAnalysisUsage - Subclasses that override getAnalysisUsage must call this.
DebugLoc findDebugLoc(instr_iterator MBBI)
Find the next valid DebugLoc starting at MBBI, skipping any DBG_VALUE and DBG_LABEL instructions...
std::pair< iterator, bool > insert(PtrType Ptr)
Inserts Ptr if and only if there is no element in the container equal to Ptr.
Definition: SmallPtrSet.h:370
Represent the analysis usage information of a pass.
FunctionPass class - This class is used to implement most global optimizations.
Definition: Pass.h:284
SmallPtrSet - This class implements a set which is optimized for holding SmallSize or less elements...
Definition: SmallPtrSet.h:417
#define AARCH64_BRANCH_TARGETS_NAME
const Function & getFunction() const
Return the LLVM function that this machine code represents.
raw_ostream & dbgs()
dbgs() - This returns a reference to a raw_ostream for debugging messages.
Definition: Debug.cpp:132
INITIALIZE_PASS(AArch64BranchTargets, "aarch64-branch-targets", AARCH64_BRANCH_TARGETS_NAME, false, false) void AArch64BranchTargets
const MachineFunction * getParent() const
Return the MachineFunction containing this basic block.
FunctionPass * createAArch64BranchTargetsPass()
bool hasAddressTaken(const User **=nullptr) const
hasAddressTaken - returns true if there are any uses of this function other than direct calls or invo...
Definition: Function.cpp:1257
assert(ImpDefSCC.getReg()==AMDGPU::SCC &&ImpDefSCC.isDef())
StringRef - Represent a constant reference to a string, i.e.
Definition: StringRef.h:48
#define LLVM_DEBUG(X)
Definition: Debug.h:122
const MachineJumpTableInfo * getJumpTableInfo() const
getJumpTableInfo - Return the jump table info object for the current function.