AArch64BranchTargets.cpp revision 363496 
1//===-- AArch64BranchTargets.cpp -- Harden code using v8.5-A BTI extension -==//
2//
3// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4// See https://llvm.org/LICENSE.txt for license information.
5// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6//
7//===----------------------------------------------------------------------===//
8//
9// This pass inserts BTI instructions at the start of every function and basic
10// block which could be indirectly called. The hardware will (when enabled)
11// trap when an indirect branch or call instruction targets an instruction
12// which is not a valid BTI instruction. This is intended to guard against
13// control-flow hijacking attacks. Note that this does not do anything for RET
14// instructions, as they can be more precisely protected by return address
15// signing.
16//
17//===----------------------------------------------------------------------===//
18
19#include "AArch64Subtarget.h"
20#include "llvm/CodeGen/MachineFunctionPass.h"
21#include "llvm/CodeGen/MachineInstrBuilder.h"
22#include "llvm/CodeGen/MachineJumpTableInfo.h"
23#include "llvm/CodeGen/MachineModuleInfo.h"
24#include "llvm/Support/Debug.h"
25
26using namespace llvm;
27
28#define DEBUG_TYPE "aarch64-branch-targets"
29#define AARCH64_BRANCH_TARGETS_NAME "AArch64 Branch Targets"
30
31namespace {
32class AArch64BranchTargets : public MachineFunctionPass {
33public:
34  static char ID;
35  AArch64BranchTargets() : MachineFunctionPass(ID) {}
36  void getAnalysisUsage(AnalysisUsage &AU) const override;
37  bool runOnMachineFunction(MachineFunction &MF) override;
38  StringRef getPassName() const override { return AARCH64_BRANCH_TARGETS_NAME; }
39
40private:
41  void addBTI(MachineBasicBlock &MBB, bool CouldCall, bool CouldJump);
42};
43} // end anonymous namespace
44
45char AArch64BranchTargets::ID = 0;
46
47INITIALIZE_PASS(AArch64BranchTargets, "aarch64-branch-targets",
48                AARCH64_BRANCH_TARGETS_NAME, false, false)
49
50void AArch64BranchTargets::getAnalysisUsage(AnalysisUsage &AU) const {
51  AU.setPreservesCFG();
52  MachineFunctionPass::getAnalysisUsage(AU);
53}
54
55FunctionPass *llvm::createAArch64BranchTargetsPass() {
56  return new AArch64BranchTargets();
57}
58
59bool AArch64BranchTargets::runOnMachineFunction(MachineFunction &MF) {
60  const Function &F = MF.getFunction();
61  if (!F.hasFnAttribute("branch-target-enforcement"))
62    return false;
63
64  LLVM_DEBUG(
65      dbgs() << "********** AArch64 Branch Targets  **********\n"
66             << "********** Function: " << MF.getName() << '\n');
67
68  // LLVM does not consider basic blocks which are the targets of jump tables
69  // to be address-taken (the address can't escape anywhere else), but they are
70  // used for indirect branches, so need BTI instructions.
71  SmallPtrSet<MachineBasicBlock *, 8> JumpTableTargets;
72  if (auto *JTI = MF.getJumpTableInfo())
73    for (auto &JTE : JTI->getJumpTables())
74      for (auto *MBB : JTE.MBBs)
75        JumpTableTargets.insert(MBB);
76
77  bool MadeChange = false;
78  for (MachineBasicBlock &MBB : MF) {
79    bool CouldCall = false, CouldJump = false;
80    // If the function is address-taken or externally-visible, it could be
81    // indirectly called. PLT entries and tail-calls use BR, but when they are
82    // are in guarded pages should all use x16 or x17 to hold the called
83    // address, so we don't need to set CouldJump here. BR instructions in
84    // non-guarded pages (which might be non-BTI-aware code) are allowed to
85    // branch to a "BTI c" using any register.
86    if (&MBB == &*MF.begin() && (F.hasAddressTaken() || !F.hasLocalLinkage()))
87      CouldCall = true;
88
89    // If the block itself is address-taken, it could be indirectly branched
90    // to, but not called.
91    if (MBB.hasAddressTaken() || JumpTableTargets.count(&MBB))
92      CouldJump = true;
93
94    if (CouldCall || CouldJump) {
95      addBTI(MBB, CouldCall, CouldJump);
96      MadeChange = true;
97    }
98  }
99
100  return MadeChange;
101}
102
103void AArch64BranchTargets::addBTI(MachineBasicBlock &MBB, bool CouldCall,
104                                  bool CouldJump) {
105  LLVM_DEBUG(dbgs() << "Adding BTI " << (CouldJump ? "j" : "")
106                    << (CouldCall ? "c" : "") << " to " << MBB.getName()
107                    << "\n");
108
109  const AArch64InstrInfo *TII = static_cast<const AArch64InstrInfo *>(
110      MBB.getParent()->getSubtarget().getInstrInfo());
111
112  unsigned HintNum = 32;
113  if (CouldCall)
114    HintNum |= 2;
115  if (CouldJump)
116    HintNum |= 4;
117  assert(HintNum != 32 && "No target kinds!");
118
119  auto MBBI = MBB.begin();
120
121  // Skip the meta instuctions, those will be removed anyway.
122  for (; MBBI != MBB.end() && MBBI->isMetaInstruction(); ++MBBI)
123    ;
124
125  // SCTLR_EL1.BT[01] is set to 0 by default which means
126  // PACI[AB]SP are implicitly BTI C so no BTI C instruction is needed there.
127  if (MBBI != MBB.end() && HintNum == 34 &&
128      (MBBI->getOpcode() == AArch64::PACIASP ||
129       MBBI->getOpcode() == AArch64::PACIBSP))
130    return;
131
132  BuildMI(MBB, MBB.begin(), MBB.findDebugLoc(MBB.begin()),
133          TII->get(AArch64::HINT))
134      .addImm(HintNum);
135}
136