1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
|
//===---- X86IndirectBranchTracking.cpp - Enables CET IBT mechanism -------===//
//
// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
// See https://llvm.org/LICENSE.txt for license information.
// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
//
//===----------------------------------------------------------------------===//
//
// This file defines a pass that enables Indirect Branch Tracking (IBT) as part
// of Control-Flow Enforcement Technology (CET).
// The pass adds ENDBR (End Branch) machine instructions at the beginning of
// each basic block or function that is referenced by an indrect jump/call
// instruction.
// The ENDBR instructions have a NOP encoding and as such are ignored in
// targets that do not support CET IBT mechanism.
//===----------------------------------------------------------------------===//
#include "X86.h"
#include "X86InstrInfo.h"
#include "X86Subtarget.h"
#include "X86TargetMachine.h"
#include "llvm/ADT/Statistic.h"
#include "llvm/CodeGen/MachineFunctionPass.h"
#include "llvm/CodeGen/MachineInstrBuilder.h"
#include "llvm/CodeGen/MachineModuleInfo.h"
using namespace llvm;
#define DEBUG_TYPE "x86-indirect-branch-tracking"
cl::opt<bool> IndirectBranchTracking(
"x86-indirect-branch-tracking", cl::init(false), cl::Hidden,
cl::desc("Enable X86 indirect branch tracking pass."));
STATISTIC(NumEndBranchAdded, "Number of ENDBR instructions added");
namespace {
class X86IndirectBranchTrackingPass : public MachineFunctionPass {
public:
X86IndirectBranchTrackingPass() : MachineFunctionPass(ID) {}
StringRef getPassName() const override {
return "X86 Indirect Branch Tracking";
}
bool runOnMachineFunction(MachineFunction &MF) override;
private:
static char ID;
/// Machine instruction info used throughout the class.
const X86InstrInfo *TII = nullptr;
/// Endbr opcode for the current machine function.
unsigned int EndbrOpcode = 0;
/// Adds a new ENDBR instruction to the beginning of the MBB.
/// The function will not add it if already exists.
/// It will add ENDBR32 or ENDBR64 opcode, depending on the target.
/// \returns true if the ENDBR was added and false otherwise.
bool addENDBR(MachineBasicBlock &MBB, MachineBasicBlock::iterator I) const;
};
} // end anonymous namespace
char X86IndirectBranchTrackingPass::ID = 0;
FunctionPass *llvm::createX86IndirectBranchTrackingPass() {
return new X86IndirectBranchTrackingPass();
}
bool X86IndirectBranchTrackingPass::addENDBR(
MachineBasicBlock &MBB, MachineBasicBlock::iterator I) const {
assert(TII && "Target instruction info was not initialized");
assert((X86::ENDBR64 == EndbrOpcode || X86::ENDBR32 == EndbrOpcode) &&
"Unexpected Endbr opcode");
// If the MBB/I is empty or the current instruction is not ENDBR,
// insert ENDBR instruction to the location of I.
if (I == MBB.end() || I->getOpcode() != EndbrOpcode) {
BuildMI(MBB, I, MBB.findDebugLoc(I), TII->get(EndbrOpcode));
++NumEndBranchAdded;
return true;
}
return false;
}
static bool IsCallReturnTwice(llvm::MachineOperand &MOp) {
if (!MOp.isGlobal())
return false;
auto *CalleeFn = dyn_cast<Function>(MOp.getGlobal());
if (!CalleeFn)
return false;
AttributeList Attrs = CalleeFn->getAttributes();
return Attrs.hasFnAttr(Attribute::ReturnsTwice);
}
// Checks if function should have an ENDBR in its prologue
static bool needsPrologueENDBR(MachineFunction &MF, const Module *M) {
Function &F = MF.getFunction();
if (F.doesNoCfCheck())
return false;
const X86TargetMachine *TM =
static_cast<const X86TargetMachine *>(&MF.getTarget());
Metadata *IBTSeal = M->getModuleFlag("ibt-seal");
switch (TM->getCodeModel()) {
// Large code model functions always reachable through indirect calls.
case CodeModel::Large:
return true;
// Only address taken functions in LTO'ed kernel are reachable indirectly.
// IBTSeal implies LTO, thus only check if function is address taken.
case CodeModel::Kernel:
// Check if ibt-seal was enabled (implies LTO is being used).
if (IBTSeal) {
return F.hasAddressTaken();
}
// if !IBTSeal, fall into default case.
LLVM_FALLTHROUGH;
// Address taken or externally linked functions may be reachable.
default:
return (F.hasAddressTaken() || !F.hasLocalLinkage());
}
}
bool X86IndirectBranchTrackingPass::runOnMachineFunction(MachineFunction &MF) {
const X86Subtarget &SubTarget = MF.getSubtarget<X86Subtarget>();
const Module *M = MF.getMMI().getModule();
// Check that the cf-protection-branch is enabled.
Metadata *isCFProtectionSupported = M->getModuleFlag("cf-protection-branch");
// NB: We need to enable IBT in jitted code if JIT compiler is CET
// enabled.
const X86TargetMachine *TM =
static_cast<const X86TargetMachine *>(&MF.getTarget());
#ifdef __CET__
bool isJITwithCET = TM->isJIT();
#else
bool isJITwithCET = false;
#endif
if (!isCFProtectionSupported && !IndirectBranchTracking && !isJITwithCET)
return false;
// True if the current MF was changed and false otherwise.
bool Changed = false;
TII = SubTarget.getInstrInfo();
EndbrOpcode = SubTarget.is64Bit() ? X86::ENDBR64 : X86::ENDBR32;
// If function is reachable indirectly, mark the first BB with ENDBR.
if (needsPrologueENDBR(MF, M)) {
auto MBB = MF.begin();
Changed |= addENDBR(*MBB, MBB->begin());
}
for (auto &MBB : MF) {
// Find all basic blocks that their address was taken (for example
// in the case of indirect jump) and add ENDBR instruction.
if (MBB.hasAddressTaken())
Changed |= addENDBR(MBB, MBB.begin());
for (MachineBasicBlock::iterator I = MBB.begin(); I != MBB.end(); ++I) {
if (I->isCall() && I->getNumOperands() > 0 &&
IsCallReturnTwice(I->getOperand(0))) {
Changed |= addENDBR(MBB, std::next(I));
}
}
// Exception handle may indirectly jump to catch pad, So we should add
// ENDBR before catch pad instructions. For SjLj exception model, it will
// create a new BB(new landingpad) indirectly jump to the old landingpad.
if (TM->Options.ExceptionModel == ExceptionHandling::SjLj) {
for (MachineBasicBlock::iterator I = MBB.begin(); I != MBB.end(); ++I) {
// New Landingpad BB without EHLabel.
if (MBB.isEHPad()) {
if (I->isDebugInstr())
continue;
Changed |= addENDBR(MBB, I);
break;
} else if (I->isEHLabel()) {
// Old Landingpad BB (is not Landingpad now) with
// the the old "callee" EHLabel.
MCSymbol *Sym = I->getOperand(0).getMCSymbol();
if (!MF.hasCallSiteLandingPad(Sym))
continue;
Changed |= addENDBR(MBB, std::next(I));
break;
}
}
} else if (MBB.isEHPad()){
for (MachineBasicBlock::iterator I = MBB.begin(); I != MBB.end(); ++I) {
if (!I->isEHLabel())
continue;
Changed |= addENDBR(MBB, std::next(I));
break;
}
}
}
return Changed;
}
|
