[AArch64] - return address signing

[LukeCheeseman]

Summary

Add a command line options -msign-return-address to enable return address signing

• Armv8.3a added instructions to sign the return address to help mitigate against ROP attacks
• This patch adds command line options to generate function attributes that signal to the back whether return address signing instructions should be added

[javed.absar]

Maybe you can provide some more context to this patch (why you need this, or point to some document), if possible.

include/clang/Frontend/CodeGenOptions.h

111

Please conform this to the code around (i.e. each option on a separate line with comments explaining the option).

test/CodeGen/aarch64-sign-return-address.c

5

Can the label check not be under one 'CHECK' prefix?

[kcc]

include/clang/Frontend/CodeGenOptions.h

114

what's the purpose of signing LR if it is not spilled?

[LukeCheeseman]

Change codegen option partial to non-leaf to match msign-return-address scope values

[LukeCheeseman]

include/clang/Frontend/CodeGenOptions.h

114

Assuming you are in a context where you have managed to gain control of the flow of execution. If you don't sign functions that spill LR then those functions become good candidates for finding gadgets as now execution can start from any point in that function.

[LukeCheeseman]

Move -msign-return-address argument handling into AArch64TargetArgs

[LukeCheeseman]

ping

[olista01]

LGTM, thanks!

[hctim]

This comment was removed by hctim.

include/clang/Driver/Options.td

 def mno_fix_cortex_a53_835769 : Flag<["-"], "mno-fix-cortex-a53-835769">,
   Group<m_aarch64_Features_Group>,
   HelpText<"Don't workaround Cortex-A53 erratum 835769 (AArch64 only)">;
 def ffixed_x18 : Flag<["-"], "ffixed-x18">, Group<m_aarch64_Features_Group>,
   HelpText<"Reserve the x18 register (AArch64 only)">;
 def ffixed_x20 : Flag<["-"], "ffixed-x20">, Group<m_aarch64_Features_Group>,
   HelpText<"Reserve the x20 register (AArch64 only)">;
 
+def msign_return_address : Joined<["-"], "msign-return-address=">,
+  Flags<[CC1Option]>, Group<m_Group>,
+  HelpText<"Select return address signing scope">, Values<"none,all,non-leaf">;
+
 def msimd128 : Flag<["-"], "msimd128">, Group<m_wasm_Features_Group>;
 def mno_simd128 : Flag<["-"], "mno-simd128">, Group<m_wasm_Features_Group>;
 def mnontrapping_fptoint : Flag<["-"], "mnontrapping-fptoint">, Group<m_wasm_Features_Group>;
 def mno_nontrapping_fptoint : Flag<["-"], "mno-nontrapping-fptoint">, Group<m_wasm_Features_Group>;
 def msign_ext : Flag<["-"], "msign-ext">, Group<m_wasm_Features_Group>;
 def mno_sign_ext : Flag<["-"], "mno-sign-ext">, Group<m_wasm_Features_Group>;
 def mexception_handing : Flag<["-"], "mexception-handling">, Group<m_wasm_Features_Group>;
 def mno_exception_handing : Flag<["-"], "mno-exception-handling">, Group<m_wasm_Features_Group>;

include/clang/Frontend/CodeGenOptions.h

public:
 
   enum EmbedBitcodeKind {
     Embed_Off,      // No embedded bitcode.
     Embed_All,      // Embed both bitcode and commandline in the output.
     Embed_Bitcode,  // Embed just the bitcode in the output.
     Embed_Marker    // Embed a marker as a placeholder for bitcode.
   };
 
+  enum SignReturnAddressScope { None, Partial, All };
+
   /// The code model to use (-mcmodel).
   std::string CodeModel;
 
   /// The filename with path we use for coverage data files. The runtime
   /// allows further manipulation with the GCOV_PREFIX and GCOV_PREFIX_STRIP
   /// environment variables.
   std::string CoverageDataFile;
 
   /// The filename with path we use for coverage notes files.
   std::string CoverageNotesFile;

include/clang/Frontend/CodeGenOptions.def

 CODEGENOPT(EmbedSource, 1, 0)
 
 /// Whether to emit all vtables
 CODEGENOPT(ForceEmitVTables, 1, 0)
 
 /// Whether to emit an address-significance table into the object file.
 CODEGENOPT(Addrsig, 1, 0)
 
+ENUM_CODEGENOPT(SignReturnAddress, SignReturnAddressScope, 2, None)
 
 #undef CODEGENOPT
 #undef ENUM_CODEGENOPT
 #undef VALUE_CODEGENOPT
 

lib/CodeGen/TargetInfo.cpp

StringRef getARCRetainAutoreleasedReturnValueMarker() const override {
     return "mov\tfp, fp\t\t// marker for objc_retainAutoreleaseReturnValue";
   }
 
   int getDwarfEHStackPointer(CodeGen::CodeGenModule &M) const override {
     return 31;
   }
 
   bool doesReturnSlotInterfereWithArgs() const override { return false; }
+
+  void setTargetAttributes(const Decl *D, llvm::GlobalValue *GV,
+                           CodeGen::CodeGenModule &CGM) const override {
+    const FunctionDecl *FD = dyn_cast_or_null<FunctionDecl>(D);
+    if (!FD)
+      return;
+    llvm::Function *Fn = cast<llvm::Function>(GV);
+
+    auto Kind = CGM.getCodeGenOpts().getSignReturnAddress();
+    if (Kind == CodeGenOptions::SignReturnAddressScope::None)
+      return;
+
+    Fn->addFnAttr("sign-return-address",
+                  Kind == CodeGenOptions::SignReturnAddressScope::All
+                      ? "all"
+                      : "partial");
+  }
 };
 
 class WindowsAArch64TargetCodeGenInfo : public AArch64TargetCodeGenInfo {
 public:
   WindowsAArch64TargetCodeGenInfo(CodeGenTypes &CGT, AArch64ABIInfo::ABIKind K)
       : AArch64TargetCodeGenInfo(CGT, K) {}
 
   void getDependentLibraryOption(llvm::StringRef Lib,

lib/Driver/ToolChains/Clang.cpp

if (Args.hasArg(options::OPT_mstack_probe_size)) {
     else
       CmdArgs.push_back("-mstack-probe-size=0");
   }
 
   if (!Args.hasFlag(options::OPT_mstack_arg_probe,
                     options::OPT_mno_stack_arg_probe, true))
     CmdArgs.push_back(Args.MakeArgString("-mno-stack-arg-probe"));
 
+  if (Arg *A = Args.getLastArg(options::OPT_msign_return_address)) {
+    CmdArgs.push_back(
+        Args.MakeArgString(Twine("-msign-return-address=") + A->getValue()));
+  }
+
   if (Arg *A = Args.getLastArg(options::OPT_mrestrict_it,
                                options::OPT_mno_restrict_it)) {
     if (A->getOption().matches(options::OPT_mrestrict_it)) {
       CmdArgs.push_back("-mllvm");
       CmdArgs.push_back("-arm-restrict-it");
     } else {
       CmdArgs.push_back("-mllvm");
       CmdArgs.push_back("-arm-no-restrict-it");

lib/Frontend/CompilerInvocation.cpp

static bool ParseCodeGenArgs(CodeGenOptions &Opts, ArgList &Args, InputKind IK,
 
   Opts.EmitCheckPathComponentsToStrip = getLastArgIntValue(
       Args, OPT_fsanitize_undefined_strip_path_components_EQ, 0, Diags);
 
   Opts.EmitVersionIdentMetadata = Args.hasFlag(OPT_Qy, OPT_Qn, true);
 
   Opts.Addrsig = Args.hasArg(OPT_faddrsig);
 
+  if (Arg *A = Args.getLastArg(OPT_msign_return_address)) {
+    StringRef SignScope = A->getValue();
+    if (SignScope.equals_lower("none"))
+      Opts.setSignReturnAddress(CodeGenOptions::SignReturnAddressScope::None);
+    else if (SignScope.equals_lower("all"))
+      Opts.setSignReturnAddress(CodeGenOptions::SignReturnAddressScope::All);
+    else if (SignScope.equals_lower("non-leaf"))
+      Opts.setSignReturnAddress(CodeGenOptions::SignReturnAddressScope::Partial);
+    else
+      Diags.Report(diag::err_drv_invalid_value) << A->getAsString(Args)
+                                                << A->getValue();
+  }
+
   return Success;
 }
 
 static void ParseDependencyOutputArgs(DependencyOutputOptions &Opts,
                                       ArgList &Args) {
   Opts.OutputFile = Args.getLastArgValue(OPT_dependency_file);
   Opts.Targets = Args.getAllArgValues(OPT_MT);
   Opts.IncludeSystemHeaders = Args.hasArg(OPT_sys_header_deps);

test/CodeGen/aarch64-sign-return-address.c

+// RUN: %clang -target aarch64-arm-none-eabi -S -emit-llvm -o - -msign-return-address=none  %s | FileCheck %s --check-prefix=NONE
+// RUN: %clang -target aarch64-arm-none-eabi -S -emit-llvm -o - -msign-return-address=non-leaf %s | FileCheck %s --check-prefix=PARTIAL
+// RUN: %clang -target aarch64-arm-none-eabi -S -emit-llvm -o - -msign-return-address=all %s | FileCheck %s --check-prefix=ALL
+
+// NONE: @foo() #[[ATTR:[0-9]*]]
+// NONE-NOT: attributes #[[ATTR]] = { {{.*}} "sign-return-address"={{.*}} }
+
+// PARTIAL: @foo() #[[ATTR:[0-9]*]]
+// PARTIAL: attributes #[[ATTR]] = { {{.*}} "sign-return-address"="partial" {{.*}} }
+
+// ALL: @foo() #[[ATTR:[0-9]*]]
+// ALL: attributes #[[ATTR]] = { {{.*}} "sign-return-address"="all" {{.*}} }
+
+void foo() {}