Coverage Report

Created: 2019-07-24 05:18

/Users/buildslave/jenkins/workspace/clang-stage2-coverage-R/llvm/lib/Target/X86/X86IndirectBranchTracking.cpp
Line
Count
Source (jump to first uncovered line)
1
//===---- X86IndirectBranchTracking.cpp - Enables CET IBT mechanism -------===//
2
//
3
// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4
// See https://llvm.org/LICENSE.txt for license information.
5
// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6
//
7
//===----------------------------------------------------------------------===//
8
//
9
// This file defines a pass that enables Indirect Branch Tracking (IBT) as part
10
// of Control-Flow Enforcement Technology (CET).
11
// The pass adds ENDBR (End Branch) machine instructions at the beginning of
12
// each basic block or function that is referenced by an indrect jump/call
13
// instruction.
14
// The ENDBR instructions have a NOP encoding and as such are ignored in
15
// targets that do not support CET IBT mechanism.
16
//===----------------------------------------------------------------------===//
17
18
#include "X86.h"
19
#include "X86InstrInfo.h"
20
#include "X86Subtarget.h"
21
#include "llvm/ADT/Statistic.h"
22
#include "llvm/CodeGen/MachineFunctionPass.h"
23
#include "llvm/CodeGen/MachineInstrBuilder.h"
24
#include "llvm/CodeGen/MachineModuleInfo.h"
25
26
using namespace llvm;
27
28
#define DEBUG_TYPE "x86-indirect-branch-tracking"
29
30
static cl::opt<bool> IndirectBranchTracking(
31
    "x86-indirect-branch-tracking", cl::init(false), cl::Hidden,
32
    cl::desc("Enable X86 indirect branch tracking pass."));
33
34
STATISTIC(NumEndBranchAdded, "Number of ENDBR instructions added");
35
36
namespace {
37
class X86IndirectBranchTrackingPass : public MachineFunctionPass {
38
public:
39
12.2k
  X86IndirectBranchTrackingPass() : MachineFunctionPass(ID) {}
40
41
150k
  StringRef getPassName() const override {
42
150k
    return "X86 Indirect Branch Tracking";
43
150k
  }
44
45
  bool runOnMachineFunction(MachineFunction &MF) override;
46
47
private:
48
  static char ID;
49
50
  /// Machine instruction info used throughout the class.
51
  const X86InstrInfo *TII;
52
53
  /// Endbr opcode for the current machine function.
54
  unsigned int EndbrOpcode;
55
56
  /// Adds a new ENDBR instruction to the begining of the MBB.
57
  /// The function will not add it if already exists.
58
  /// It will add ENDBR32 or ENDBR64 opcode, depending on the target.
59
  /// \returns true if the ENDBR was added and false otherwise.
60
  bool addENDBR(MachineBasicBlock &MBB, MachineBasicBlock::iterator I) const;
61
};
62
63
} // end anonymous namespace
64
65
char X86IndirectBranchTrackingPass::ID = 0;
66
67
12.2k
FunctionPass *llvm::createX86IndirectBranchTrackingPass() {
68
12.2k
  return new X86IndirectBranchTrackingPass();
69
12.2k
}
70
71
bool X86IndirectBranchTrackingPass::addENDBR(
72
43
    MachineBasicBlock &MBB, MachineBasicBlock::iterator I) const {
73
43
  assert(TII && "Target instruction info was not initialized");
74
43
  assert((X86::ENDBR64 == EndbrOpcode || X86::ENDBR32 == EndbrOpcode) &&
75
43
         "Unexpected Endbr opcode");
76
43
77
43
  // If the MBB/I is empty or the current instruction is not ENDBR,
78
43
  // insert ENDBR instruction to the location of I.
79
43
  if (I == MBB.end() || I->getOpcode() != EndbrOpcode) {
80
43
    BuildMI(MBB, I, MBB.findDebugLoc(I), TII->get(EndbrOpcode));
81
43
    ++NumEndBranchAdded;
82
43
    return true;
83
43
  }
84
0
  return false;
85
0
}
86
87
31
bool IsCallReturnTwice(llvm::MachineOperand &MOp) {
88
31
  if (!MOp.isGlobal())
89
4
    return false;
90
27
  auto *CalleeFn = dyn_cast<Function>(MOp.getGlobal());
91
27
  if (!CalleeFn)
92
0
    return false;
93
27
  AttributeList Attrs = CalleeFn->getAttributes();
94
27
  if (Attrs.hasAttribute(AttributeList::FunctionIndex, Attribute::ReturnsTwice))
95
10
    return true;
96
17
  return false;
97
17
}
98
99
137k
bool X86IndirectBranchTrackingPass::runOnMachineFunction(MachineFunction &MF) {
100
137k
  const X86Subtarget &SubTarget = MF.getSubtarget<X86Subtarget>();
101
137k
102
137k
  // Check that the cf-protection-branch is enabled.
103
137k
  Metadata *isCFProtectionSupported =
104
137k
      MF.getMMI().getModule()->getModuleFlag("cf-protection-branch");
105
137k
  if (!isCFProtectionSupported && 
!IndirectBranchTracking137k
)
106
137k
    return false;
107
38
108
38
  // True if the current MF was changed and false otherwise.
109
38
  bool Changed = false;
110
38
111
38
  TII = SubTarget.getInstrInfo();
112
38
  EndbrOpcode = SubTarget.is64Bit() ? 
X86::ENDBR6411
:
X86::ENDBR3227
;
113
38
114
38
  // Non-internal function or function whose address was taken, can be
115
38
  // accessed through indirect calls. Mark the first BB with ENDBR instruction
116
38
  // unless nocf_check attribute is used.
117
38
  if ((MF.getFunction().hasAddressTaken() ||
118
38
       
!MF.getFunction().hasLocalLinkage()25
) &&
119
38
      
!MF.getFunction().doesNoCfCheck()25
) {
120
24
    auto MBB = MF.begin();
121
24
    Changed |= addENDBR(*MBB, MBB->begin());
122
24
  }
123
38
124
76
  for (auto &MBB : MF) {
125
76
    // Find all basic blocks that their address was taken (for example
126
76
    // in the case of indirect jump) and add ENDBR instruction.
127
76
    if (MBB.hasAddressTaken())
128
9
      Changed |= addENDBR(MBB, MBB.begin());
129
76
130
479
    for (MachineBasicBlock::iterator I = MBB.begin(); I != MBB.end(); 
++I403
) {
131
403
      if (!I->isCall())
132
372
        continue;
133
31
      if (IsCallReturnTwice(I->getOperand(0)))
134
10
        Changed |= addENDBR(MBB, std::next(I));
135
31
    }
136
76
  }
137
38
  return Changed;
138
38
}