8e362e10c7
The AArch64 Pointer Authentication pass was emitting address materialization instructions that were never used. These instructions formed dead code and served no purpose in the final control flow. Remove the unnecessary ADRP/ADD sequence from the Pointer Auth codegen and update the corresponding test to reflect the simplified output. This avoids generating dead instructions and keeps the PAUTH LR sequence minimal and correct.
266 lines
9.2 KiB
C++
266 lines
9.2 KiB
C++
//===-- AArch64PointerAuth.cpp -- Harden code using PAuth ------------------==//
|
|
//
|
|
// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
|
|
// See https://llvm.org/LICENSE.txt for license information.
|
|
// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
|
|
//
|
|
//===----------------------------------------------------------------------===//
|
|
|
|
#include "AArch64PointerAuth.h"
|
|
|
|
#include "AArch64.h"
|
|
#include "AArch64InstrInfo.h"
|
|
#include "AArch64MachineFunctionInfo.h"
|
|
#include "AArch64Subtarget.h"
|
|
#include "llvm/CodeGen/CFIInstBuilder.h"
|
|
#include "llvm/CodeGen/MachineBasicBlock.h"
|
|
#include "llvm/CodeGen/MachineInstrBuilder.h"
|
|
#include "llvm/CodeGen/MachineModuleInfo.h"
|
|
|
|
using namespace llvm;
|
|
using namespace llvm::AArch64PAuth;
|
|
|
|
#define AARCH64_POINTER_AUTH_NAME "AArch64 Pointer Authentication"
|
|
|
|
namespace {
|
|
|
|
class AArch64PointerAuth : public MachineFunctionPass {
|
|
public:
|
|
static char ID;
|
|
|
|
AArch64PointerAuth() : MachineFunctionPass(ID) {}
|
|
|
|
bool runOnMachineFunction(MachineFunction &MF) override;
|
|
|
|
StringRef getPassName() const override { return AARCH64_POINTER_AUTH_NAME; }
|
|
|
|
private:
|
|
const AArch64Subtarget *Subtarget = nullptr;
|
|
const AArch64InstrInfo *TII = nullptr;
|
|
|
|
void signLR(MachineFunction &MF, MachineBasicBlock::iterator MBBI) const;
|
|
|
|
void authenticateLR(MachineFunction &MF,
|
|
MachineBasicBlock::iterator MBBI) const;
|
|
|
|
bool checkAuthenticatedLR(MachineBasicBlock::iterator TI) const;
|
|
};
|
|
|
|
} // end anonymous namespace
|
|
|
|
INITIALIZE_PASS(AArch64PointerAuth, "aarch64-ptrauth",
|
|
AARCH64_POINTER_AUTH_NAME, false, false)
|
|
|
|
FunctionPass *llvm::createAArch64PointerAuthPass() {
|
|
return new AArch64PointerAuth();
|
|
}
|
|
|
|
char AArch64PointerAuth::ID = 0;
|
|
|
|
static void emitPACSymOffsetIntoX16(const TargetInstrInfo &TII,
|
|
MachineBasicBlock &MBB,
|
|
MachineBasicBlock::iterator I, DebugLoc DL,
|
|
MCSymbol *PACSym) {
|
|
BuildMI(MBB, I, DL, TII.get(AArch64::ADRP), AArch64::X16)
|
|
.addSym(PACSym, AArch64II::MO_PAGE);
|
|
BuildMI(MBB, I, DL, TII.get(AArch64::ADDXri), AArch64::X16)
|
|
.addReg(AArch64::X16)
|
|
.addSym(PACSym, AArch64II::MO_PAGEOFF | AArch64II::MO_NC)
|
|
.addImm(0);
|
|
}
|
|
|
|
static void emitPACCFI(MachineBasicBlock &MBB, MachineBasicBlock::iterator MBBI,
|
|
MachineInstr::MIFlag Flags, bool EmitCFI) {
|
|
if (!EmitCFI)
|
|
return;
|
|
|
|
auto &MF = *MBB.getParent();
|
|
auto &MFnI = *MF.getInfo<AArch64FunctionInfo>();
|
|
|
|
CFIInstBuilder CFIBuilder(MBB, MBBI, Flags);
|
|
MFnI.branchProtectionPAuthLR() ? CFIBuilder.buildNegateRAStateWithPC()
|
|
: CFIBuilder.buildNegateRAState();
|
|
}
|
|
|
|
void AArch64PointerAuth::signLR(MachineFunction &MF,
|
|
MachineBasicBlock::iterator MBBI) const {
|
|
auto &MFnI = *MF.getInfo<AArch64FunctionInfo>();
|
|
bool UseBKey = MFnI.shouldSignWithBKey();
|
|
bool EmitCFI = MFnI.needsDwarfUnwindInfo(MF);
|
|
bool NeedsWinCFI = MF.hasWinCFI();
|
|
|
|
MachineBasicBlock &MBB = *MBBI->getParent();
|
|
|
|
// Debug location must be unknown, see AArch64FrameLowering::emitPrologue.
|
|
DebugLoc DL;
|
|
|
|
if (UseBKey) {
|
|
BuildMI(MBB, MBBI, DL, TII->get(AArch64::EMITBKEY))
|
|
.setMIFlag(MachineInstr::FrameSetup);
|
|
}
|
|
|
|
// PAuthLR authentication instructions need to know the value of PC at the
|
|
// point of signing (PACI*).
|
|
if (MFnI.branchProtectionPAuthLR()) {
|
|
MCSymbol *PACSym = MF.getContext().createTempSymbol();
|
|
MFnI.setSigningInstrLabel(PACSym);
|
|
}
|
|
|
|
// No SEH opcode for this one; it doesn't materialize into an
|
|
// instruction on Windows.
|
|
if (MFnI.branchProtectionPAuthLR() && Subtarget->hasPAuthLR()) {
|
|
emitPACCFI(MBB, MBBI, MachineInstr::FrameSetup, EmitCFI);
|
|
BuildMI(MBB, MBBI, DL,
|
|
TII->get(MFnI.shouldSignWithBKey() ? AArch64::PACIBSPPC
|
|
: AArch64::PACIASPPC))
|
|
.setMIFlag(MachineInstr::FrameSetup)
|
|
->setPreInstrSymbol(MF, MFnI.getSigningInstrLabel());
|
|
} else {
|
|
if (MFnI.branchProtectionPAuthLR()) {
|
|
BuildMI(MBB, MBBI, DL, TII->get(AArch64::PACM))
|
|
.setMIFlag(MachineInstr::FrameSetup);
|
|
emitPACCFI(MBB, MBBI, MachineInstr::FrameSetup, EmitCFI);
|
|
}
|
|
BuildMI(MBB, MBBI, DL,
|
|
TII->get(MFnI.shouldSignWithBKey() ? AArch64::PACIBSP
|
|
: AArch64::PACIASP))
|
|
.setMIFlag(MachineInstr::FrameSetup)
|
|
->setPreInstrSymbol(MF, MFnI.getSigningInstrLabel());
|
|
if (!MFnI.branchProtectionPAuthLR())
|
|
emitPACCFI(MBB, MBBI, MachineInstr::FrameSetup, EmitCFI);
|
|
}
|
|
|
|
if (!EmitCFI && NeedsWinCFI) {
|
|
BuildMI(MBB, MBBI, DL, TII->get(AArch64::SEH_PACSignLR))
|
|
.setMIFlag(MachineInstr::FrameSetup);
|
|
}
|
|
}
|
|
|
|
void AArch64PointerAuth::authenticateLR(
|
|
MachineFunction &MF, MachineBasicBlock::iterator MBBI) const {
|
|
const AArch64FunctionInfo *MFnI = MF.getInfo<AArch64FunctionInfo>();
|
|
bool UseBKey = MFnI->shouldSignWithBKey();
|
|
bool EmitAsyncCFI = MFnI->needsAsyncDwarfUnwindInfo(MF);
|
|
bool NeedsWinCFI = MF.hasWinCFI();
|
|
|
|
MachineBasicBlock &MBB = *MBBI->getParent();
|
|
DebugLoc DL = MBBI->getDebugLoc();
|
|
// MBBI points to a PAUTH_EPILOGUE instruction to be replaced and
|
|
// TI points to a terminator instruction that may or may not be combined.
|
|
// Note that inserting new instructions "before MBBI" and "before TI" is
|
|
// not the same because if ShadowCallStack is enabled, its instructions
|
|
// are placed between MBBI and TI.
|
|
MachineBasicBlock::iterator TI = MBB.getFirstInstrTerminator();
|
|
|
|
// The AUTIASP instruction assembles to a hint instruction before v8.3a so
|
|
// this instruction can safely used for any v8a architecture.
|
|
// From v8.3a onwards there are optimised authenticate LR and return
|
|
// instructions, namely RETA{A,B}, that can be used instead. In this case the
|
|
// DW_CFA_AARCH64_negate_ra_state can't be emitted.
|
|
bool TerminatorIsCombinable =
|
|
TI != MBB.end() && TI->getOpcode() == AArch64::RET;
|
|
MCSymbol *PACSym = MFnI->getSigningInstrLabel();
|
|
|
|
if (Subtarget->hasPAuth() && TerminatorIsCombinable && !NeedsWinCFI &&
|
|
!MF.getFunction().hasFnAttribute(Attribute::ShadowCallStack)) {
|
|
if (MFnI->branchProtectionPAuthLR() && Subtarget->hasPAuthLR()) {
|
|
assert(PACSym && "No PAC instruction to refer to");
|
|
BuildMI(MBB, TI, DL,
|
|
TII->get(UseBKey ? AArch64::RETABSPPCi : AArch64::RETAASPPCi))
|
|
.addSym(PACSym)
|
|
.copyImplicitOps(*MBBI)
|
|
.setMIFlag(MachineInstr::FrameDestroy);
|
|
} else {
|
|
if (MFnI->branchProtectionPAuthLR()) {
|
|
emitPACSymOffsetIntoX16(*TII, MBB, MBBI, DL, PACSym);
|
|
BuildMI(MBB, MBBI, DL, TII->get(AArch64::PACM))
|
|
.setMIFlag(MachineInstr::FrameDestroy);
|
|
}
|
|
BuildMI(MBB, TI, DL, TII->get(UseBKey ? AArch64::RETAB : AArch64::RETAA))
|
|
.copyImplicitOps(*MBBI)
|
|
.setMIFlag(MachineInstr::FrameDestroy);
|
|
}
|
|
MBB.erase(TI);
|
|
} else {
|
|
if (MFnI->branchProtectionPAuthLR() && Subtarget->hasPAuthLR()) {
|
|
assert(PACSym && "No PAC instruction to refer to");
|
|
emitPACCFI(MBB, MBBI, MachineInstr::FrameDestroy, EmitAsyncCFI);
|
|
BuildMI(MBB, MBBI, DL,
|
|
TII->get(UseBKey ? AArch64::AUTIBSPPCi : AArch64::AUTIASPPCi))
|
|
.addSym(PACSym)
|
|
.setMIFlag(MachineInstr::FrameDestroy);
|
|
} else {
|
|
if (MFnI->branchProtectionPAuthLR()) {
|
|
emitPACSymOffsetIntoX16(*TII, MBB, MBBI, DL, PACSym);
|
|
BuildMI(MBB, MBBI, DL, TII->get(AArch64::PACM))
|
|
.setMIFlag(MachineInstr::FrameDestroy);
|
|
emitPACCFI(MBB, MBBI, MachineInstr::FrameDestroy, EmitAsyncCFI);
|
|
}
|
|
BuildMI(MBB, MBBI, DL,
|
|
TII->get(UseBKey ? AArch64::AUTIBSP : AArch64::AUTIASP))
|
|
.setMIFlag(MachineInstr::FrameDestroy);
|
|
if (!MFnI->branchProtectionPAuthLR())
|
|
emitPACCFI(MBB, MBBI, MachineInstr::FrameDestroy, EmitAsyncCFI);
|
|
}
|
|
|
|
if (NeedsWinCFI) {
|
|
BuildMI(MBB, MBBI, DL, TII->get(AArch64::SEH_PACSignLR))
|
|
.setMIFlag(MachineInstr::FrameDestroy);
|
|
}
|
|
}
|
|
}
|
|
|
|
unsigned llvm::AArch64PAuth::getCheckerSizeInBytes(AuthCheckMethod Method) {
|
|
switch (Method) {
|
|
case AuthCheckMethod::None:
|
|
return 0;
|
|
case AuthCheckMethod::DummyLoad:
|
|
return 4;
|
|
case AuthCheckMethod::HighBitsNoTBI:
|
|
return 12;
|
|
case AuthCheckMethod::XPACHint:
|
|
case AuthCheckMethod::XPAC:
|
|
return 20;
|
|
}
|
|
llvm_unreachable("Unknown AuthCheckMethod enum");
|
|
}
|
|
|
|
bool AArch64PointerAuth::runOnMachineFunction(MachineFunction &MF) {
|
|
Subtarget = &MF.getSubtarget<AArch64Subtarget>();
|
|
TII = Subtarget->getInstrInfo();
|
|
|
|
SmallVector<MachineBasicBlock::instr_iterator> PAuthPseudoInstrs;
|
|
|
|
bool Modified = false;
|
|
|
|
for (auto &MBB : MF) {
|
|
for (auto &MI : MBB) {
|
|
switch (MI.getOpcode()) {
|
|
default:
|
|
break;
|
|
case AArch64::PAUTH_PROLOGUE:
|
|
case AArch64::PAUTH_EPILOGUE:
|
|
PAuthPseudoInstrs.push_back(MI.getIterator());
|
|
break;
|
|
}
|
|
}
|
|
}
|
|
|
|
for (auto It : PAuthPseudoInstrs) {
|
|
switch (It->getOpcode()) {
|
|
case AArch64::PAUTH_PROLOGUE:
|
|
signLR(MF, It);
|
|
break;
|
|
case AArch64::PAUTH_EPILOGUE:
|
|
authenticateLR(MF, It);
|
|
break;
|
|
default:
|
|
llvm_unreachable("Unhandled opcode");
|
|
}
|
|
It->eraseFromParent();
|
|
Modified = true;
|
|
}
|
|
|
|
return Modified;
|
|
}
|