Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
23 changes: 12 additions & 11 deletions bolt/docs/PacRetDesign.md
Original file line number Diff line number Diff line change
Expand Up @@ -104,9 +104,9 @@ negate-ra-state CFIs will become invalid during BasicBlock reordering.
## Solution design

The implementation introduces two new passes:
1. `MarkRAStatesPass`: assigns the RA state to each instruction based on the CFIs
in the input binary
2. `InsertNegateRAStatePass`: reads those assigned instruction RA states after
1. `PointerAuthCFIAnalyzer`: assigns the RA state to each instruction based on
the CFIs in the input binary
2. `PointerAuthCFIFixup`: reads those assigned instruction RA states after
optimizations, and emits `DW_CFA_AARCH64_negate_ra_state` CFIs at the correct
places: wherever there is a state change between two consecutive instructions
in the layout order.
Expand All @@ -129,7 +129,7 @@ instruction.
This special case is handled by adding an `initialRAState` bool to each BinaryFunction.
If the `Offset` the CFI refers to is zero, we don't store an annotation, but set
the `initialRAState` in `FillCFIInfoFor`. This information is then used in
`MarkRAStates`.
`PointerAuthCFIAnalyzer`.

### Binaries without DWARF info

Expand All @@ -146,7 +146,7 @@ In summary:
- pointer auth is used, and we have DWARF CFIs: passes run, and rewrite the
negate-ra-state CFI.

### MarkRAStates pass
### PointerAuthCFIAnalyzer pass

This pass runs before optimizations reorder anything.

Expand All @@ -173,9 +173,9 @@ what we have before the pass, and after it.
| autiasp | negate-ra-state | signed |
| ret | | unsigned |

##### Error handling in MarkRAState Pass:
##### Error handling in PointerAuthCFIAnalyzer pass:

Whenever the MarkRAStates pass finds inconsistencies in the current
Whenever the PointerAuthCFIAnalyzer pass finds inconsistencies in the current
BinaryFunction, it marks the function as ignored using `BF.setIgnored()`. BOLT
will not optimize this function but will emit it unchanged in the original section
(`.bolt.org.text`).
Expand All @@ -188,16 +188,17 @@ The inconsistencies are as follows:
Users will be informed about the number of ignored functions in the pass, the
exact functions ignored, and the found inconsistency.

### InsertNegateRAStatePass
### PointerAuthCFIFixup

This pass runs after optimizations. It performns the _inverse_ of MarkRAState pa s:
This pass runs after optimizations. It performs the _inverse_ of PointerAuthCFIAnalyzer
pass:
1. it reads the RA state annotations attached to the instructions, and
2. whenever the state changes, it adds a PseudoInstruction that holds an
OpNegateRAState CFI.

##### Covering newly generated instructions:

Some BOLT passes can add new Instructions. In InsertNegateRAStatePass, we have
Some BOLT passes can add new Instructions. In PointerAuthCFIFixup, we have
to know what RA state these have.

> [!important]
Expand Down Expand Up @@ -230,7 +231,7 @@ freely. The only special case is function splitting. When a function is split,
the split part becomes a new function in the emitted binary. For unwinding to
work, it needs to "replay" all CFIs that lead up to the split point. BOLT does
this for other CFIs. As negate-ra-state is not read (only stored as an Annotation),
we have to do this manually in InsertNegateRAStatePass. Here, if the split part
we have to do this manually in PointerAuthCFIFixup. Here, if the split part
starts with an instruction that has Signed RA state, we add a negate-ra-state CFI
to indicate this.

Expand Down
Original file line number Diff line number Diff line change
@@ -1,32 +1,32 @@
//===- bolt/Passes/MarkRAStates.cpp ---------------------------------===//
//===- bolt/Passes/PointerAuthCFIAnalyzer.h -------------------------------===//
//
// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
// See https://llvm.org/LICENSE.txt for license information.
// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
//
//===----------------------------------------------------------------------===//
//
// This file implements the MarkRAStates class.
// This file implements the PointerAuthCFIAnalyzer class.
//
//===----------------------------------------------------------------------===//
#ifndef BOLT_PASSES_MARK_RA_STATES
#define BOLT_PASSES_MARK_RA_STATES
#ifndef BOLT_PASSES_POINTER_AUTH_CFI_ANALYZER
#define BOLT_PASSES_POINTER_AUTH_CFI_ANALYZER

#include "bolt/Passes/BinaryPasses.h"
#include <mutex>

namespace llvm {
namespace bolt {

class MarkRAStates : public BinaryFunctionPass {
class PointerAuthCFIAnalyzer : public BinaryFunctionPass {
// setIgnored() is not thread-safe, but the pass is running on functions in
// parallel.
std::mutex IgnoreMutex;

public:
explicit MarkRAStates() : BinaryFunctionPass(false) {}
explicit PointerAuthCFIAnalyzer() : BinaryFunctionPass(false) {}

const char *getName() const override { return "mark-ra-states"; }
const char *getName() const override { return "pointer-auth-cfi-analyzer"; }

/// Pass entry point
Error runOnFunctions(BinaryContext &BC) override;
Expand Down
Original file line number Diff line number Diff line change
@@ -1,27 +1,27 @@
//===- bolt/Passes/InsertNegateRAStatePass.h ------------------------------===//
//===- bolt/Passes/PointerAuthCFIFixup.h ----------------------------------===//
//
// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
// See https://llvm.org/LICENSE.txt for license information.
// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
//
//===----------------------------------------------------------------------===//
//
// This file implements the InsertNegateRAStatePass class.
// This file implements the PointerAuthCFIFixup class.
//
//===----------------------------------------------------------------------===//
#ifndef BOLT_PASSES_INSERT_NEGATE_RA_STATE_PASS
#define BOLT_PASSES_INSERT_NEGATE_RA_STATE_PASS
#ifndef BOLT_PASSES_POINTER_AUTH_CFI_FIXUP
#define BOLT_PASSES_POINTER_AUTH_CFI_FIXUP

#include "bolt/Passes/BinaryPasses.h"

namespace llvm {
namespace bolt {

class InsertNegateRAState : public BinaryFunctionPass {
class PointerAuthCFIFixup : public BinaryFunctionPass {
public:
explicit InsertNegateRAState() : BinaryFunctionPass(false) {}
explicit PointerAuthCFIFixup() : BinaryFunctionPass(false) {}

const char *getName() const override { return "insert-negate-ra-state-pass"; }
const char *getName() const override { return "pointer-auth-cfi-fixup"; }

/// Pass entry point
Error runOnFunctions(BinaryContext &BC) override;
Expand Down
8 changes: 4 additions & 4 deletions bolt/lib/Core/Exceptions.cpp
Original file line number Diff line number Diff line change
Expand Up @@ -572,7 +572,7 @@ bool CFIReaderWriter::fillCFIInfoFor(BinaryFunction &Function) const {
if (Function.getBinaryContext().isAArch64()) {
// Support for pointer authentication:
// We need to annotate instructions that modify the RA State, to work
// out the state of each instruction in MarkRAStates Pass.
// out the state of each instruction in PointerAuthCFIAnalyzer Pass.
if (Offset != 0)
Function.setInstModifiesRAState(DW_CFA_remember_state, Offset);
}
Expand All @@ -583,7 +583,7 @@ bool CFIReaderWriter::fillCFIInfoFor(BinaryFunction &Function) const {
if (Function.getBinaryContext().isAArch64()) {
// Support for pointer authentication:
// We need to annotate instructions that modify the RA State, to work
// out the state of each instruction in MarkRAStates Pass.
// out the state of each instruction in PointerAuthCFIAnalyzer Pass.
if (Offset != 0)
Function.setInstModifiesRAState(DW_CFA_restore_state, Offset);
}
Expand Down Expand Up @@ -652,15 +652,15 @@ bool CFIReaderWriter::fillCFIInfoFor(BinaryFunction &Function) const {
// BasicBlocks, which changes during optimizations. Instead of adding
// OpNegateRAState CFIs, an annotation is added to the instruction, to
// mark that the instruction modifies the RA State. The actual state for
// instructions are worked out in MarkRAStates based on these
// instructions are worked out in PointerAuthCFIAnalyzer based on these
// annotations.
if (Offset != 0)
Function.setInstModifiesRAState(DW_CFA_AARCH64_negate_ra_state,
Offset);
else
// We cannot Annotate an instruction at Offset == 0.
// Instead, we save the initial (Signed) state, and push it to
// MarkRAStates' RAStateStack.
// PointerAuthCFIAnalyzer's RAStateStack.
Function.setInitialRAState(true);
break;
}
Expand Down
4 changes: 2 additions & 2 deletions bolt/lib/Passes/CMakeLists.txt
Original file line number Diff line number Diff line change
Expand Up @@ -17,18 +17,18 @@ add_llvm_library(LLVMBOLTPasses
IdenticalCodeFolding.cpp
IndirectCallPromotion.cpp
Inliner.cpp
InsertNegateRAStatePass.cpp
Instrumentation.cpp
JTFootprintReduction.cpp
LongJmp.cpp
LoopInversionPass.cpp
LivenessAnalysis.cpp
MCF.cpp
MarkRAStates.cpp
PatchEntries.cpp
PAuthGadgetScanner.cpp
PettisAndHansen.cpp
PLTCall.cpp
PointerAuthCFIAnalyzer.cpp
PointerAuthCFIFixup.cpp
ProfileQualityStats.cpp
RegAnalysis.cpp
RegReAssign.cpp
Expand Down
Original file line number Diff line number Diff line change
@@ -1,12 +1,12 @@
//===- bolt/Passes/MarkRAStates.cpp ---------------------------------===//
//===- bolt/Passes/PointerAuthCFIAnalyzer.cpp -----------------------------===//
//
// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
// See https://llvm.org/LICENSE.txt for license information.
// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
//
//===----------------------------------------------------------------------===//
//
// This file implements the MarkRAStates class.
// This file implements the PointerAuthCFIAnalyzer class.
// Three CFIs have an influence on the RA State of an instruction:
// - NegateRAState flips the RA State,
// - RememberState pushes the RA State to a stack,
Expand All @@ -16,10 +16,10 @@
// the RA State of each instruction, and save it as new MCAnnotations. The new
// annotations are Signing, Signed, Authenticating and Unsigned. After
// optimizations, .cfi_negate_ra_state CFIs are added to the places where the
// state changes in InsertNegateRAStatePass.
// state changes in PointerAuthCFIFixup.
//
//===----------------------------------------------------------------------===//
#include "bolt/Passes/MarkRAStates.h"
#include "bolt/Passes/PointerAuthCFIAnalyzer.h"
#include "bolt/Core/BinaryFunction.h"
#include "bolt/Core/ParallelUtilities.h"
#include <cstdlib>
Expand All @@ -31,7 +31,7 @@ using namespace llvm;
namespace llvm {
namespace bolt {

bool MarkRAStates::runOnFunction(BinaryFunction &BF) {
bool PointerAuthCFIAnalyzer::runOnFunction(BinaryFunction &BF) {

BinaryContext &BC = BF.getBinaryContext();

Expand Down Expand Up @@ -110,7 +110,7 @@ bool MarkRAStates::runOnFunction(BinaryFunction &BF) {
return true;
}

Error MarkRAStates::runOnFunctions(BinaryContext &BC) {
Error PointerAuthCFIAnalyzer::runOnFunctions(BinaryContext &BC) {
std::atomic<uint64_t> FunctionsIgnored{0};
ParallelUtilities::WorkFuncTy WorkFun = [&](BinaryFunction &BF) {
if (!runOnFunction(BF)) {
Expand All @@ -132,8 +132,8 @@ Error MarkRAStates::runOnFunctions(BinaryContext &BC) {

ParallelUtilities::runOnEachFunction(
BC, ParallelUtilities::SchedulingPolicy::SP_INST_LINEAR, WorkFun,
SkipPredicate, "MarkRAStates");
BC.outs() << "BOLT-INFO: MarkRAStates ran on " << Total
SkipPredicate, "PointerAuthCFIAnalyzer");
BC.outs() << "BOLT-INFO: PointerAuthCFIAnalyzer ran on " << Total
<< " functions. Ignored " << FunctionsIgnored << " functions "
<< format("(%.2lf%%)", (100.0 * FunctionsIgnored) / Total)
<< " because of CFI inconsistencies\n";
Expand Down
Original file line number Diff line number Diff line change
@@ -1,17 +1,17 @@
//===- bolt/Passes/InsertNegateRAStatePass.cpp ----------------------------===//
//===- bolt/Passes/PointerAuthCFIFixup.cpp --------------------------------===//
//
// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
// See https://llvm.org/LICENSE.txt for license information.
// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
//
//===----------------------------------------------------------------------===//
//
// This file implements the InsertNegateRAStatePass class. It inserts
// This file implements the PointerAuthCFIFixup class. It inserts
// OpNegateRAState CFIs to places where the state of two consecutive
// instructions are different.
//
//===----------------------------------------------------------------------===//
#include "bolt/Passes/InsertNegateRAStatePass.h"
#include "bolt/Passes/PointerAuthCFIFixup.h"
#include "bolt/Core/BinaryFunction.h"
#include "bolt/Core/ParallelUtilities.h"
#include <cstdlib>
Expand All @@ -23,7 +23,7 @@ namespace bolt {

static bool PassFailed = false;

void InsertNegateRAState::runOnFunction(BinaryFunction &BF) {
void PointerAuthCFIFixup::runOnFunction(BinaryFunction &BF) {
if (PassFailed)
return;

Expand All @@ -35,7 +35,7 @@ void InsertNegateRAState::runOnFunction(BinaryFunction &BF) {
if (BF.getState() != BinaryFunction::State::CFG &&
BF.getState() != BinaryFunction::State::CFG_Finalized) {
BC.outs() << "BOLT-INFO: no CFG for " << BF.getPrintName()
<< " in InsertNegateRAStatePass\n";
<< " in PointerAuthCFIFixup\n";
return;
}

Expand Down Expand Up @@ -74,7 +74,7 @@ void InsertNegateRAState::runOnFunction(BinaryFunction &BF) {
}
}

void InsertNegateRAState::inferUnknownStates(BinaryFunction &BF) {
void PointerAuthCFIFixup::inferUnknownStates(BinaryFunction &BF) {
BinaryContext &BC = BF.getBinaryContext();

// Fill in missing RAStates in simple cases (inside BBs).
Expand All @@ -88,7 +88,7 @@ void InsertNegateRAState::inferUnknownStates(BinaryFunction &BF) {
fillUnknownBlocksInCFG(BF);
}

void InsertNegateRAState::coverFunctionFragmentStart(BinaryFunction &BF,
void PointerAuthCFIFixup::coverFunctionFragmentStart(BinaryFunction &BF,
FunctionFragment &FF) {
BinaryContext &BC = BF.getBinaryContext();
if (FF.empty())
Expand Down Expand Up @@ -119,7 +119,7 @@ void InsertNegateRAState::coverFunctionFragmentStart(BinaryFunction &BF,
}

std::optional<bool>
InsertNegateRAState::getFirstKnownRAState(BinaryContext &BC,
PointerAuthCFIFixup::getFirstKnownRAState(BinaryContext &BC,
BinaryBasicBlock &BB) {
for (const MCInst &Inst : BB) {
if (BC.MIB->isCFI(Inst))
Expand All @@ -131,7 +131,7 @@ InsertNegateRAState::getFirstKnownRAState(BinaryContext &BC,
return std::nullopt;
}

void InsertNegateRAState::fillUnknownStateInBB(BinaryContext &BC,
void PointerAuthCFIFixup::fillUnknownStateInBB(BinaryContext &BC,
BinaryBasicBlock &BB) {

auto First = BB.getFirstNonPseudo();
Expand Down Expand Up @@ -173,7 +173,7 @@ void InsertNegateRAState::fillUnknownStateInBB(BinaryContext &BC,
}
}

bool InsertNegateRAState::isUnknownBlock(BinaryContext &BC,
bool PointerAuthCFIFixup::isUnknownBlock(BinaryContext &BC,
BinaryBasicBlock &BB) {
for (const MCInst &Inst : BB) {
if (BC.MIB->isCFI(Inst))
Expand All @@ -185,7 +185,7 @@ bool InsertNegateRAState::isUnknownBlock(BinaryContext &BC,
return true;
}

void InsertNegateRAState::markUnknownBlock(BinaryContext &BC,
void PointerAuthCFIFixup::markUnknownBlock(BinaryContext &BC,
BinaryBasicBlock &BB, bool State) {
// If we call this when an Instruction has either kRASigned or kRAUnsigned
// annotation, setRASigned or setRAUnsigned would fail.
Expand All @@ -198,7 +198,7 @@ void InsertNegateRAState::markUnknownBlock(BinaryContext &BC,
}
}

std::optional<bool> InsertNegateRAState::getRAStateByCFG(BinaryBasicBlock &BB,
std::optional<bool> PointerAuthCFIFixup::getRAStateByCFG(BinaryBasicBlock &BB,
BinaryFunction &BF) {
BinaryContext &BC = BF.getBinaryContext();

Expand Down Expand Up @@ -244,7 +244,7 @@ std::optional<bool> InsertNegateRAState::getRAStateByCFG(BinaryBasicBlock &BB,
return NeighborRAState;
}

void InsertNegateRAState::fillUnknownStubs(BinaryFunction &BF) {
void PointerAuthCFIFixup::fillUnknownStubs(BinaryFunction &BF) {
BinaryContext &BC = BF.getBinaryContext();
bool FirstIter = true;
MCInst PrevInst;
Expand Down Expand Up @@ -281,7 +281,7 @@ void InsertNegateRAState::fillUnknownStubs(BinaryFunction &BF) {
}
}
}
void InsertNegateRAState::fillUnknownBlocksInCFG(BinaryFunction &BF) {
void PointerAuthCFIFixup::fillUnknownBlocksInCFG(BinaryFunction &BF) {
BinaryContext &BC = BF.getBinaryContext();

auto fillUnknowns = [&](BinaryFunction &BF) -> std::pair<int, bool> {
Expand Down Expand Up @@ -317,7 +317,7 @@ void InsertNegateRAState::fillUnknownBlocksInCFG(BinaryFunction &BF) {
}
}

Error InsertNegateRAState::runOnFunctions(BinaryContext &BC) {
Error PointerAuthCFIFixup::runOnFunctions(BinaryContext &BC) {
std::atomic<uint64_t> FunctionsModified{0};
ParallelUtilities::WorkFuncTy WorkFun = [&](BinaryFunction &BF) {
FunctionsModified++;
Expand All @@ -334,7 +334,7 @@ Error InsertNegateRAState::runOnFunctions(BinaryContext &BC) {

ParallelUtilities::runOnEachFunction(
BC, ParallelUtilities::SchedulingPolicy::SP_INST_LINEAR, WorkFun,
SkipPredicate, "InsertNegateRAStatePass");
SkipPredicate, "PointerAuthCFIFixup");

BC.outs() << "BOLT-INFO: rewritten pac-ret DWARF info in "
<< FunctionsModified << " out of " << BC.getBinaryFunctions().size()
Expand Down
Loading
Loading