LLVM  15.0.0git
ARMBranchTargets.cpp
Go to the documentation of this file.
1 //===-- ARMBranchTargets.cpp -- Harden code using v8.1-M BTI extension -----==//
2 //
3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4 // See https://llvm.org/LICENSE.txt for license information.
5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6 //
7 //===----------------------------------------------------------------------===//
8 //
9 // This pass inserts BTI instructions at the start of every function and basic
10 // block which could be indirectly called. The hardware will (when enabled)
11 // trap when an indirect branch or call instruction targets an instruction
12 // which is not a valid BTI instruction. This is intended to guard against
13 // control-flow hijacking attacks.
14 //
15 //===----------------------------------------------------------------------===//
16 
17 #include "ARM.h"
18 #include "ARMInstrInfo.h"
19 #include "ARMMachineFunctionInfo.h"
24 #include "llvm/Support/Debug.h"
25 
26 using namespace llvm;
27 
28 #define DEBUG_TYPE "arm-branch-targets"
29 #define ARM_BRANCH_TARGETS_NAME "ARM Branch Targets"
30 
31 namespace {
32 class ARMBranchTargets : public MachineFunctionPass {
33 public:
34  static char ID;
35  ARMBranchTargets() : MachineFunctionPass(ID) {}
36  void getAnalysisUsage(AnalysisUsage &AU) const override;
37  bool runOnMachineFunction(MachineFunction &MF) override;
38  StringRef getPassName() const override { return ARM_BRANCH_TARGETS_NAME; }
39 
40 private:
41  void addBTI(const ARMInstrInfo &TII, MachineBasicBlock &MBB, bool IsFirstBB);
42 };
43 } // end anonymous namespace
44 
45 char ARMBranchTargets::ID = 0;
46 
47 INITIALIZE_PASS(ARMBranchTargets, "arm-branch-targets", ARM_BRANCH_TARGETS_NAME,
48  false, false)
49 
50 void ARMBranchTargets::getAnalysisUsage(AnalysisUsage &AU) const {
51  AU.setPreservesCFG();
53 }
54 
56  return new ARMBranchTargets();
57 }
58 
59 bool ARMBranchTargets::runOnMachineFunction(MachineFunction &MF) {
61  return false;
62 
63  LLVM_DEBUG(dbgs() << "********** ARM Branch Targets **********\n"
64  << "********** Function: " << MF.getName() << '\n');
65  const ARMInstrInfo &TII =
66  *static_cast<const ARMInstrInfo *>(MF.getSubtarget().getInstrInfo());
67 
68  // LLVM does not consider basic blocks which are the targets of jump tables
69  // to be address-taken (the address can't escape anywhere else), but they are
70  // used for indirect branches, so need BTI instructions.
72  if (const MachineJumpTableInfo *JTI = MF.getJumpTableInfo())
73  for (const MachineJumpTableEntry &JTE : JTI->getJumpTables())
74  for (const MachineBasicBlock *MBB : JTE.MBBs)
75  JumpTableTargets.insert(MBB);
76 
77  bool MadeChange = false;
78  for (MachineBasicBlock &MBB : MF) {
79  bool NeedBTI = false;
80  bool IsFirstBB = &MBB == &MF.front();
81 
82  // Every function can potentially be called indirectly (even if it has
83  // static linkage, due to linker-generated veneers).
84  if (IsFirstBB)
85  NeedBTI = true;
86 
87  // If the block itself is address-taken, or is an exception landing pad, it
88  // could be indirectly branched to.
89  if (MBB.hasAddressTaken() || MBB.isEHPad() || JumpTableTargets.count(&MBB))
90  NeedBTI = true;
91 
92  if (NeedBTI) {
93  addBTI(TII, MBB, IsFirstBB);
94  MadeChange = true;
95  }
96  }
97 
98  return MadeChange;
99 }
100 
101 /// Insert a BTI/PACBTI instruction into a given basic block \c MBB. If
102 /// \c IsFirstBB is true (meaning that this is the first BB in a function) try
103 /// to find a PAC instruction and replace it with PACBTI. Otherwise just insert
104 /// a BTI instruction.
105 /// The point of insertion is in the beginning of the BB, immediately after meta
106 /// instructions (such labels in exception handling landing pads).
107 void ARMBranchTargets::addBTI(const ARMInstrInfo &TII, MachineBasicBlock &MBB,
108  bool IsFirstBB) {
109  // Which instruction to insert: BTI or PACBTI
110  unsigned OpCode = ARM::t2BTI;
111  unsigned MIFlags = 0;
112 
113  // Skip meta instructions, including EH labels
114  auto MBBI = llvm::find_if_not(MBB.instrs(), [](const MachineInstr &MI) {
115  return MI.isMetaInstruction();
116  });
117 
118  // If this is the first BB in a function, check if it starts with a PAC
119  // instruction and in that case remove the PAC instruction.
120  if (IsFirstBB) {
121  if (MBBI != MBB.instr_end() && MBBI->getOpcode() == ARM::t2PAC) {
122  LLVM_DEBUG(dbgs() << "Removing a 'PAC' instr from BB '" << MBB.getName()
123  << "' to replace with PACBTI\n");
124  OpCode = ARM::t2PACBTI;
125  MIFlags = MachineInstr::FrameSetup;
126  auto NextMBBI = std::next(MBBI);
128  MBBI = NextMBBI;
129  }
130  }
131 
132  LLVM_DEBUG(dbgs() << "Inserting a '"
133  << (OpCode == ARM::t2BTI ? "BTI" : "PACBTI")
134  << "' instr into BB '" << MBB.getName() << "'\n");
135  // Finally, insert a new instruction (either PAC or PACBTI)
137  .setMIFlags(MIFlags);
138 }
llvm::ARMFunctionInfo
ARMFunctionInfo - This class is derived from MachineFunctionInfo and contains private ARM-specific in...
Definition: ARMMachineFunctionInfo.h:27
MI
IRTranslator LLVM IR MI
Definition: IRTranslator.cpp:104
llvm
This is an optimization pass for GlobalISel generic memory operations.
Definition: AddressRanges.h:17
llvm::TargetSubtargetInfo::getInstrInfo
virtual const TargetInstrInfo * getInstrInfo() const
Definition: TargetSubtargetInfo.h:93
llvm::MachineBasicBlock::instrs
instr_range instrs()
Definition: MachineBasicBlock.h:272
ARMMachineFunctionInfo.h
llvm::MachineFunctionPass
MachineFunctionPass - This class adapts the FunctionPass interface to allow convenient creation of pa...
Definition: MachineFunctionPass.h:30
llvm::MachineBasicBlock::findDebugLoc
DebugLoc findDebugLoc(instr_iterator MBBI)
Find the next valid DebugLoc starting at MBBI, skipping any DBG_VALUE and DBG_LABEL instructions.
Definition: MachineBasicBlock.cpp:1369
MachineJumpTableInfo.h
llvm::SmallPtrSet< const MachineBasicBlock *, 8 >
llvm::MachineFunctionPass::getAnalysisUsage
void getAnalysisUsage(AnalysisUsage &AU) const override
getAnalysisUsage - Subclasses that override getAnalysisUsage must call this.
Definition: MachineFunctionPass.cpp:103
LLVM_DEBUG
#define LLVM_DEBUG(X)
Definition: Debug.h:101
llvm::dbgs
raw_ostream & dbgs()
dbgs() - This returns a reference to a raw_ostream for debugging messages.
Definition: Debug.cpp:163
llvm::DXIL::OpCode
OpCode
Definition: DXILConstants.h:18
llvm::MachineFunction::getInfo
Ty * getInfo()
getInfo - Keep track of various per-function pieces of information for backends that would like to do...
Definition: MachineFunction.h:738
llvm::MachineBasicBlock::eraseFromParent
void eraseFromParent()
This method unlinks 'this' from the containing function and deletes it.
Definition: MachineBasicBlock.cpp:1328
llvm::AnalysisUsage
Represent the analysis usage information of a pass.
Definition: PassAnalysisSupport.h:47
TII
const HexagonInstrInfo * TII
Definition: HexagonCopyToCombine.cpp:127
llvm::MachineInstr::FrameSetup
@ FrameSetup
Definition: MachineInstr.h:84
llvm::createARMBranchTargetsPass
FunctionPass * createARMBranchTargetsPass()
llvm::CallingConv::ID
unsigned ID
LLVM IR allows to use arbitrary numbers as calling convention identifiers.
Definition: CallingConv.h:24
llvm::MachineBasicBlock
Definition: MachineBasicBlock.h:94
llvm::MachineFunction::getSubtarget
const TargetSubtargetInfo & getSubtarget() const
getSubtarget - Return the subtarget for which this machine code is being compiled.
Definition: MachineFunction.h:640
llvm::MachineInstr
Representation of each machine instruction.
Definition: MachineInstr.h:66
llvm::MachineBasicBlock::hasAddressTaken
bool hasAddressTaken() const
Test whether this block is potentially the target of an indirect branch.
Definition: MachineBasicBlock.h:220
llvm::ARMFunctionInfo::branchTargetEnforcement
bool branchTargetEnforcement() const
Definition: ARMMachineFunctionInfo.h:295
MachineFunctionPass.h
llvm::MachineFunction::getName
StringRef getName() const
getName - Return the name of the corresponding LLVM function.
Definition: MachineFunction.cpp:567
INITIALIZE_PASS
INITIALIZE_PASS(ARMBranchTargets, "arm-branch-targets", ARM_BRANCH_TARGETS_NAME, false, false) void ARMBranchTargets
Definition: ARMBranchTargets.cpp:47
MachineModuleInfo.h
ARM.h
llvm::SmallPtrSetImpl::count
size_type count(ConstPtrType Ptr) const
count - Return 1 if the specified pointer is in the set, 0 otherwise.
Definition: SmallPtrSet.h:383
llvm::MachineBasicBlock::instr_end
instr_iterator instr_end()
Definition: MachineBasicBlock.h:263
llvm::MachineFunction
Definition: MachineFunction.h:241
llvm::MachineBasicBlock::isEHPad
bool isEHPad() const
Returns true if the block is a landing pad.
Definition: MachineBasicBlock.h:548
llvm::StringRef
StringRef - Represent a constant reference to a string, i.e.
Definition: StringRef.h:58
MBBI
MachineBasicBlock MachineBasicBlock::iterator MBBI
Definition: AArch64SLSHardening.cpp:75
ARMInstrInfo.h
ARM_BRANCH_TARGETS_NAME
#define ARM_BRANCH_TARGETS_NAME
Definition: ARMBranchTargets.cpp:29
MBB
MachineBasicBlock & MBB
Definition: AArch64SLSHardening.cpp:74
llvm::MachineJumpTableEntry
MachineJumpTableEntry - One jump table in the jump table info.
Definition: MachineJumpTableInfo.h:34
llvm::MachineBasicBlock::front
MachineInstr & front()
Definition: MachineBasicBlock.h:256
llvm::ARMInstrInfo
Definition: ARMInstrInfo.h:22
MachineInstrBuilder.h
llvm::MachineInstrBuilder::setMIFlags
const MachineInstrBuilder & setMIFlags(unsigned Flags) const
Definition: MachineInstrBuilder.h:273
llvm::BuildMI
MachineInstrBuilder BuildMI(MachineFunction &MF, const DebugLoc &DL, const MCInstrDesc &MCID)
Builder interface. Specify how to create the initial instruction itself.
Definition: MachineInstrBuilder.h:328
llvm::FunctionPass
FunctionPass class - This class is used to implement most global optimizations.
Definition: Pass.h:308
llvm::MachineFunction::getJumpTableInfo
const MachineJumpTableInfo * getJumpTableInfo() const
getJumpTableInfo - Return the jump table info object for the current function.
Definition: MachineFunction.h:663
llvm::MachineJumpTableInfo
Definition: MachineJumpTableInfo.h:42
llvm::MachineBasicBlock::getName
StringRef getName() const
Return the name of the corresponding LLVM basic block, or an empty string.
Definition: MachineBasicBlock.cpp:310
Debug.h
llvm::find_if_not
auto find_if_not(R &&Range, UnaryPredicate P)
Definition: STLExtras.h:1639
llvm::SmallPtrSetImpl::insert
std::pair< iterator, bool > insert(PtrType Ptr)
Inserts Ptr if and only if there is no element in the container equal to Ptr.
Definition: SmallPtrSet.h:365
llvm::Intrinsic::ID
unsigned ID
Definition: TargetTransformInfo.h:37