Coverage Report

Created: 2019-07-24 05:18

/Users/buildslave/jenkins/workspace/clang-stage2-coverage-R/llvm/lib/Target/AArch64/AArch64BranchTargets.cpp
Line
Count
Source
1
//===-- AArch64BranchTargets.cpp -- Harden code using v8.5-A BTI extension -==//
2
//
3
// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4
// See https://llvm.org/LICENSE.txt for license information.
5
// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6
//
7
//===----------------------------------------------------------------------===//
8
//
9
// This pass inserts BTI instructions at the start of every function and basic
10
// block which could be indirectly called. The hardware will (when enabled)
11
// trap when an indirect branch or call instruction targets an instruction
12
// which is not a valid BTI instruction. This is intended to guard against
13
// control-flow hijacking attacks. Note that this does not do anything for RET
14
// instructions, as they can be more precisely protected by return address
15
// signing.
16
//
17
//===----------------------------------------------------------------------===//
18
19
#include "AArch64Subtarget.h"
20
#include "llvm/CodeGen/MachineFunctionPass.h"
21
#include "llvm/CodeGen/MachineInstrBuilder.h"
22
#include "llvm/CodeGen/MachineJumpTableInfo.h"
23
#include "llvm/CodeGen/MachineModuleInfo.h"
24
#include "llvm/Support/Debug.h"
25
26
using namespace llvm;
27
28
#define DEBUG_TYPE "aarch64-branch-targets"
29
266k
#define AARCH64_BRANCH_TARGETS_NAME "AArch64 Branch Targets"
30
31
namespace {
32
class AArch64BranchTargets : public MachineFunctionPass {
33
public:
34
  static char ID;
35
8.78k
  AArch64BranchTargets() : MachineFunctionPass(ID) {}
36
  void getAnalysisUsage(AnalysisUsage &AU) const override;
37
  bool runOnMachineFunction(MachineFunction &MF) override;
38
266k
  StringRef getPassName() const override { return AARCH64_BRANCH_TARGETS_NAME; }
39
40
private:
41
  void addBTI(MachineBasicBlock &MBB, bool CouldCall, bool CouldJump);
42
};
43
} // end anonymous namespace
44
45
char AArch64BranchTargets::ID = 0;
46
47
INITIALIZE_PASS(AArch64BranchTargets, "aarch64-branch-targets",
48
                AARCH64_BRANCH_TARGETS_NAME, false, false)
49
50
8.72k
void AArch64BranchTargets::getAnalysisUsage(AnalysisUsage &AU) const {
51
8.72k
  AU.setPreservesCFG();
52
8.72k
  MachineFunctionPass::getAnalysisUsage(AU);
53
8.72k
}
54
55
8.78k
FunctionPass *llvm::createAArch64BranchTargetsPass() {
56
8.78k
  return new AArch64BranchTargets();
57
8.78k
}
58
59
257k
bool AArch64BranchTargets::runOnMachineFunction(MachineFunction &MF) {
60
257k
  const Function &F = MF.getFunction();
61
257k
  if (!F.hasFnAttribute("branch-target-enforcement"))
62
257k
    return false;
63
10
64
10
  LLVM_DEBUG(
65
10
      dbgs() << "********** AArch64 Branch Targets  **********\n"
66
10
             << "********** Function: " << MF.getName() << '\n');
67
10
68
10
  // LLVM does not consider basic blocks which are the targets of jump tables
69
10
  // to be address-taken (the address can't escape anywhere else), but they are
70
10
  // used for indirect branches, so need BTI instructions.
71
10
  SmallPtrSet<MachineBasicBlock *, 8> JumpTableTargets;
72
10
  if (auto *JTI = MF.getJumpTableInfo())
73
1
    for (auto &JTE : JTI->getJumpTables())
74
1
      for (auto *MBB : JTE.MBBs)
75
5
        JumpTableTargets.insert(MBB);
76
10
77
10
  bool MadeChange = false;
78
21
  for (MachineBasicBlock &MBB : MF) {
79
21
    bool CouldCall = false, CouldJump = false;
80
21
    // If the function is address-taken or externally-visible, it could be
81
21
    // indirectly called. PLT entries and tail-calls use BR, but when they are
82
21
    // are in guarded pages should all use x16 or x17 to hold the called
83
21
    // address, so we don't need to set CouldJump here. BR instructions in
84
21
    // non-guarded pages (which might be non-BTI-aware code) are allowed to
85
21
    // branch to a "BTI c" using any register.
86
21
    if (&MBB == &*MF.begin() && 
(10
F.hasAddressTaken()10
||
!F.hasLocalLinkage()10
))
87
9
      CouldCall = true;
88
21
89
21
    // If the block itself is address-taken, it could be indirectly branched
90
21
    // to, but not called.
91
21
    if (MBB.hasAddressTaken() || 
JumpTableTargets.count(&MBB)17
)
92
9
      CouldJump = true;
93
21
94
21
    if (CouldCall || 
CouldJump12
) {
95
17
      addBTI(MBB, CouldCall, CouldJump);
96
17
      MadeChange = true;
97
17
    }
98
21
  }
99
10
100
10
  return MadeChange;
101
10
}
102
103
void AArch64BranchTargets::addBTI(MachineBasicBlock &MBB, bool CouldCall,
104
17
                                  bool CouldJump) {
105
17
  LLVM_DEBUG(dbgs() << "Adding BTI " << (CouldJump ? "j" : "")
106
17
                    << (CouldCall ? "c" : "") << " to " << MBB.getName()
107
17
                    << "\n");
108
17
109
17
  const AArch64InstrInfo *TII = static_cast<const AArch64InstrInfo *>(
110
17
      MBB.getParent()->getSubtarget().getInstrInfo());
111
17
112
17
  unsigned HintNum = 32;
113
17
  if (CouldCall)
114
9
    HintNum |= 2;
115
17
  if (CouldJump)
116
9
    HintNum |= 4;
117
17
  assert(HintNum != 32 && "No target kinds!");
118
17
119
17
  auto MBBI = MBB.begin();
120
17
121
17
  // PACI[AB]SP are implicitly BTI JC, so no BTI instruction needed there.
122
17
  if (MBBI != MBB.end() && (MBBI->getOpcode() == AArch64::PACIASP ||
123
17
                            
MBBI->getOpcode() == AArch64::PACIBSP16
))
124
2
    return;
125
15
126
15
  BuildMI(MBB, MBB.begin(), MBB.findDebugLoc(MBB.begin()),
127
15
          TII->get(AArch64::HINT))
128
15
      .addImm(HintNum);
129
15
}