llvm/lib/Target/AArch64/AArch64BranchTargets.cpp

   1 //===-- AArch64BranchTargets.cpp -- Harden code using v8.5-A BTI extension -==//
   2 //
   3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
   4 // See https://llvm.org/LICENSE.txt for license information.
   5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
   6 //
   7 //===----------------------------------------------------------------------===//
   8 //
   9 // This pass inserts BTI instructions at the start of every function and basic
  10 // block which could be indirectly called. The hardware will (when enabled)
  11 // trap when an indirect branch or call instruction targets an instruction
  12 // which is not a valid BTI instruction. This is intended to guard against
  13 // control-flow hijacking attacks. Note that this does not do anything for RET
  14 // instructions, as they can be more precisely protected by return address
  15 // signing.
  16 //
  17 //===----------------------------------------------------------------------===//
  18
  19 #include "AArch64MachineFunctionInfo.h"
  20 #include "AArch64Subtarget.h"
  21 #include "llvm/CodeGen/MachineFunctionPass.h"
  22 #include "llvm/CodeGen/MachineInstrBuilder.h"
  23 #include "llvm/CodeGen/MachineJumpTableInfo.h"
  24 #include "llvm/CodeGen/MachineModuleInfo.h"
  25 #include "llvm/Support/Debug.h"
  26
  27 using namespace llvm;
  28
  29 #define DEBUG_TYPE "aarch64-branch-targets"
  30 #define AARCH64_BRANCH_TARGETS_NAME "AArch64 Branch Targets"
  31
  32 namespace {
  33 class AArch64BranchTargets : public MachineFunctionPass {
  34 public:
  35   static char ID;
  36   AArch64BranchTargets() : MachineFunctionPass(ID) {}
  37   void getAnalysisUsage(AnalysisUsage &AU) const override;
  38   bool runOnMachineFunction(MachineFunction &MF) override;
  39   StringRef getPassName() const override { return AARCH64_BRANCH_TARGETS_NAME; }
  40
  41 private:
  42   void addBTI(MachineBasicBlock &MBB, bool CouldCall, bool CouldJump,
  43               bool NeedsWinCFI);
  44 };
  45 } // end anonymous namespace
  46
  47 char AArch64BranchTargets::ID = 0;
  48
  49 INITIALIZE_PASS(AArch64BranchTargets, "aarch64-branch-targets",
  50                 AARCH64_BRANCH_TARGETS_NAME, false, false)
  51
  52 void AArch64BranchTargets::getAnalysisUsage(AnalysisUsage &AU) const {
  53   AU.setPreservesCFG();
  54   MachineFunctionPass::getAnalysisUsage(AU);
  55 }
  56
  57 FunctionPass *llvm::createAArch64BranchTargetsPass() {
  58   return new AArch64BranchTargets();
  59 }
  60
  61 bool AArch64BranchTargets::runOnMachineFunction(MachineFunction &MF) {
  62   if (!MF.getInfo<AArch64FunctionInfo>()->branchTargetEnforcement())
  63     return false;
  64
  65   LLVM_DEBUG(
  66       dbgs() << "********** AArch64 Branch Targets  **********\n"
  67              << "********** Function: " << MF.getName() << '\n');
  68
  69   // LLVM does not consider basic blocks which are the targets of jump tables
  70   // to be address-taken (the address can't escape anywhere else), but they are
  71   // used for indirect branches, so need BTI instructions.
  72   SmallPtrSet<MachineBasicBlock *, 8> JumpTableTargets;
  73   if (auto *JTI = MF.getJumpTableInfo())
  74     for (auto &JTE : JTI->getJumpTables())
  75       for (auto *MBB : JTE.MBBs)
  76         JumpTableTargets.insert(MBB);
  77
  78   bool MadeChange = false;
  79   bool HasWinCFI = MF.hasWinCFI();
  80   for (MachineBasicBlock &MBB : MF) {
  81     bool CouldCall = false, CouldJump = false;
  82     // Even in cases where a function has internal linkage and is only called
  83     // directly in its translation unit, it can still be called indirectly if
  84     // the linker decides to add a thunk to it for whatever reason (say, for
  85     // example, if it is finally placed far from its call site and a BL is not
  86     // long-range enough). PLT entries and tail-calls use BR, but when they are
  87     // are in guarded pages should all use x16 or x17 to hold the called
  88     // address, so we don't need to set CouldJump here. BR instructions in
  89     // non-guarded pages (which might be non-BTI-aware code) are allowed to
  90     // branch to a "BTI c" using any register.
  91     if (&MBB == &*MF.begin())
  92       CouldCall = true;
  93
  94     // If the block itself is address-taken, it could be indirectly branched
  95     // to, but not called.
  96     if (MBB.hasAddressTaken() || JumpTableTargets.count(&MBB))
  97       CouldJump = true;
  98
  99     if (CouldCall || CouldJump) {
 100       addBTI(MBB, CouldCall, CouldJump, HasWinCFI);
 101       MadeChange = true;
 102     }
 103   }
 104
 105   return MadeChange;
 106 }
 107
 108 void AArch64BranchTargets::addBTI(MachineBasicBlock &MBB, bool CouldCall,
 109                                   bool CouldJump, bool HasWinCFI) {
 110   LLVM_DEBUG(dbgs() << "Adding BTI " << (CouldJump ? "j" : "")
 111                     << (CouldCall ? "c" : "") << " to " << MBB.getName()
 112                     << "\n");
 113
 114   const AArch64InstrInfo *TII = static_cast<const AArch64InstrInfo *>(
 115       MBB.getParent()->getSubtarget().getInstrInfo());
 116
 117   unsigned HintNum = 32;
 118   if (CouldCall)
 119     HintNum |= 2;
 120   if (CouldJump)
 121     HintNum |= 4;
 122   assert(HintNum != 32 && "No target kinds!");
 123
 124   auto MBBI = MBB.begin();
 125
 126   // Skip the meta instructions, those will be removed anyway.
 127   for (; MBBI != MBB.end() &&
 128          (MBBI->isMetaInstruction() || MBBI->getOpcode() == AArch64::EMITBKEY);
 129        ++MBBI)
 130     ;
 131
 132   // SCTLR_EL1.BT[01] is set to 0 by default which means
 133   // PACI[AB]SP are implicitly BTI C so no BTI C instruction is needed there.
 134   if (MBBI != MBB.end() && HintNum == 34 &&
 135       (MBBI->getOpcode() == AArch64::PACIASP ||
 136        MBBI->getOpcode() == AArch64::PACIBSP))
 137     return;
 138
 139   if (HasWinCFI && MBBI->getFlag(MachineInstr::FrameSetup)) {
 140     BuildMI(MBB, MBB.begin(), MBB.findDebugLoc(MBB.begin()),
 141             TII->get(AArch64::SEH_Nop));
 142   }
 143   BuildMI(MBB, MBB.begin(), MBB.findDebugLoc(MBB.begin()),
 144           TII->get(AArch64::HINT))
 145       .addImm(HintNum);
 146 }