LLVM 17.0.0git
AArch64BranchTargets.cpp
Go to the documentation of this file.
1//===-- AArch64BranchTargets.cpp -- Harden code using v8.5-A BTI extension -==//
2//
3// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4// See https://llvm.org/LICENSE.txt for license information.
5// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6//
7//===----------------------------------------------------------------------===//
8//
9// This pass inserts BTI instructions at the start of every function and basic
10// block which could be indirectly called. The hardware will (when enabled)
11// trap when an indirect branch or call instruction targets an instruction
12// which is not a valid BTI instruction. This is intended to guard against
13// control-flow hijacking attacks. Note that this does not do anything for RET
14// instructions, as they can be more precisely protected by return address
15// signing.
16//
17//===----------------------------------------------------------------------===//
18
20#include "AArch64Subtarget.h"
25#include "llvm/Support/Debug.h"
26
27using namespace llvm;
28
29#define DEBUG_TYPE "aarch64-branch-targets"
30#define AARCH64_BRANCH_TARGETS_NAME "AArch64 Branch Targets"
31
32namespace {
33class AArch64BranchTargets : public MachineFunctionPass {
34public:
35 static char ID;
36 AArch64BranchTargets() : MachineFunctionPass(ID) {}
37 void getAnalysisUsage(AnalysisUsage &AU) const override;
38 bool runOnMachineFunction(MachineFunction &MF) override;
39 StringRef getPassName() const override { return AARCH64_BRANCH_TARGETS_NAME; }
40
41private:
42 void addBTI(MachineBasicBlock &MBB, bool CouldCall, bool CouldJump,
43 bool NeedsWinCFI);
44};
45} // end anonymous namespace
46
47char AArch64BranchTargets::ID = 0;
48
49INITIALIZE_PASS(AArch64BranchTargets, "aarch64-branch-targets",
50 AARCH64_BRANCH_TARGETS_NAME, false, false)
51
52void AArch64BranchTargets::getAnalysisUsage(AnalysisUsage &AU) const {
53 AU.setPreservesCFG();
55}
56
58 return new AArch64BranchTargets();
59}
60
61bool AArch64BranchTargets::runOnMachineFunction(MachineFunction &MF) {
63 return false;
64
66 dbgs() << "********** AArch64 Branch Targets **********\n"
67 << "********** Function: " << MF.getName() << '\n');
68
69 // LLVM does not consider basic blocks which are the targets of jump tables
70 // to be address-taken (the address can't escape anywhere else), but they are
71 // used for indirect branches, so need BTI instructions.
73 if (auto *JTI = MF.getJumpTableInfo())
74 for (auto &JTE : JTI->getJumpTables())
75 for (auto *MBB : JTE.MBBs)
76 JumpTableTargets.insert(MBB);
77
78 bool MadeChange = false;
79 bool HasWinCFI = MF.hasWinCFI();
80 for (MachineBasicBlock &MBB : MF) {
81 bool CouldCall = false, CouldJump = false;
82 // Even in cases where a function has internal linkage and is only called
83 // directly in its translation unit, it can still be called indirectly if
84 // the linker decides to add a thunk to it for whatever reason (say, for
85 // example, if it is finally placed far from its call site and a BL is not
86 // long-range enough). PLT entries and tail-calls use BR, but when they are
87 // are in guarded pages should all use x16 or x17 to hold the called
88 // address, so we don't need to set CouldJump here. BR instructions in
89 // non-guarded pages (which might be non-BTI-aware code) are allowed to
90 // branch to a "BTI c" using any register.
91 if (&MBB == &*MF.begin())
92 CouldCall = true;
93
94 // If the block itself is address-taken, it could be indirectly branched
95 // to, but not called.
96 if (MBB.hasAddressTaken() || JumpTableTargets.count(&MBB))
97 CouldJump = true;
98
99 if (CouldCall || CouldJump) {
100 addBTI(MBB, CouldCall, CouldJump, HasWinCFI);
101 MadeChange = true;
102 }
103 }
104
105 return MadeChange;
106}
107
108void AArch64BranchTargets::addBTI(MachineBasicBlock &MBB, bool CouldCall,
109 bool CouldJump, bool HasWinCFI) {
110 LLVM_DEBUG(dbgs() << "Adding BTI " << (CouldJump ? "j" : "")
111 << (CouldCall ? "c" : "") << " to " << MBB.getName()
112 << "\n");
113
114 const AArch64InstrInfo *TII = static_cast<const AArch64InstrInfo *>(
116
117 unsigned HintNum = 32;
118 if (CouldCall)
119 HintNum |= 2;
120 if (CouldJump)
121 HintNum |= 4;
122 assert(HintNum != 32 && "No target kinds!");
123
124 auto MBBI = MBB.begin();
125
126 // Skip the meta instructions, those will be removed anyway.
127 for (; MBBI != MBB.end() &&
128 (MBBI->isMetaInstruction() || MBBI->getOpcode() == AArch64::EMITBKEY);
129 ++MBBI)
130 ;
131
132 // SCTLR_EL1.BT[01] is set to 0 by default which means
133 // PACI[AB]SP are implicitly BTI C so no BTI C instruction is needed there.
134 if (MBBI != MBB.end() && HintNum == 34 &&
135 (MBBI->getOpcode() == AArch64::PACIASP ||
136 MBBI->getOpcode() == AArch64::PACIBSP))
137 return;
138
139 if (HasWinCFI && MBBI->getFlag(MachineInstr::FrameSetup)) {
141 TII->get(AArch64::SEH_Nop));
142 }
144 TII->get(AArch64::HINT))
145 .addImm(HintNum);
146}
#define AARCH64_BRANCH_TARGETS_NAME
MachineBasicBlock & MBB
MachineBasicBlock MachineBasicBlock::iterator MBBI
#define LLVM_DEBUG(X)
Definition: Debug.h:101
const HexagonInstrInfo * TII
#define INITIALIZE_PASS(passName, arg, name, cfg, analysis)
Definition: PassSupport.h:38
assert(ImpDefSCC.getReg()==AMDGPU::SCC &&ImpDefSCC.isDef())
AArch64FunctionInfo - This class is derived from MachineFunctionInfo and contains private AArch64-spe...
Represent the analysis usage information of a pass.
FunctionPass class - This class is used to implement most global optimizations.
Definition: Pass.h:308
bool hasAddressTaken() const
Test whether this block is used as as something other than the target of a terminator,...
DebugLoc findDebugLoc(instr_iterator MBBI)
Find the next valid DebugLoc starting at MBBI, skipping any DBG_VALUE and DBG_LABEL instructions.
const MachineFunction * getParent() const
Return the MachineFunction containing this basic block.
StringRef getName() const
Return the name of the corresponding LLVM basic block, or an empty string.
MachineFunctionPass - This class adapts the FunctionPass interface to allow convenient creation of pa...
void getAnalysisUsage(AnalysisUsage &AU) const override
getAnalysisUsage - Subclasses that override getAnalysisUsage must call this.
virtual bool runOnMachineFunction(MachineFunction &MF)=0
runOnMachineFunction - This method must be overloaded to perform the desired machine code transformat...
const TargetSubtargetInfo & getSubtarget() const
getSubtarget - Return the subtarget for which this machine code is being compiled.
StringRef getName() const
getName - Return the name of the corresponding LLVM function.
Ty * getInfo()
getInfo - Keep track of various per-function pieces of information for backends that would like to do...
const MachineJumpTableInfo * getJumpTableInfo() const
getJumpTableInfo - Return the jump table info object for the current function.
const MachineInstrBuilder & addImm(int64_t Val) const
Add a new immediate operand.
virtual StringRef getPassName() const
getPassName - Return a nice clean name for a pass.
Definition: Pass.cpp:81
size_type count(ConstPtrType Ptr) const
count - Return 1 if the specified pointer is in the set, 0 otherwise.
Definition: SmallPtrSet.h:383
std::pair< iterator, bool > insert(PtrType Ptr)
Inserts Ptr if and only if there is no element in the container equal to Ptr.
Definition: SmallPtrSet.h:365
SmallPtrSet - This class implements a set which is optimized for holding SmallSize or less elements.
Definition: SmallPtrSet.h:450
StringRef - Represent a constant reference to a string, i.e.
Definition: StringRef.h:50
virtual const TargetInstrInfo * getInstrInfo() const
unsigned ID
LLVM IR allows to use arbitrary numbers as calling convention identifiers.
Definition: CallingConv.h:24
This is an optimization pass for GlobalISel generic memory operations.
Definition: AddressRanges.h:18
MachineInstrBuilder BuildMI(MachineFunction &MF, const MIMetadata &MIMD, const MCInstrDesc &MCID)
Builder interface. Specify how to create the initial instruction itself.
raw_ostream & dbgs()
dbgs() - This returns a reference to a raw_ostream for debugging messages.
Definition: Debug.cpp:163
FunctionPass * createAArch64BranchTargetsPass()