1 //===-- ARMBranchTargets.cpp -- Harden code using v8.1-M BTI extension -----==// 2 // 3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions. 4 // See https://llvm.org/LICENSE.txt for license information. 5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception 6 // 7 //===----------------------------------------------------------------------===// 8 // 9 // This pass inserts BTI instructions at the start of every function and basic 10 // block which could be indirectly called. The hardware will (when enabled) 11 // trap when an indirect branch or call instruction targets an instruction 12 // which is not a valid BTI instruction. This is intended to guard against 13 // control-flow hijacking attacks. 14 // 15 //===----------------------------------------------------------------------===// 16 17 #include "ARM.h" 18 #include "ARMInstrInfo.h" 19 #include "ARMMachineFunctionInfo.h" 20 #include "llvm/CodeGen/MachineFunctionPass.h" 21 #include "llvm/CodeGen/MachineInstrBuilder.h" 22 #include "llvm/CodeGen/MachineJumpTableInfo.h" 23 #include "llvm/CodeGen/MachineModuleInfo.h" 24 #include "llvm/Support/Debug.h" 25 26 using namespace llvm; 27 28 #define DEBUG_TYPE "arm-branch-targets" 29 #define ARM_BRANCH_TARGETS_NAME "ARM Branch Targets" 30 31 namespace { 32 class ARMBranchTargets : public MachineFunctionPass { 33 public: 34 static char ID; 35 ARMBranchTargets() : MachineFunctionPass(ID) {} 36 void getAnalysisUsage(AnalysisUsage &AU) const override; 37 bool runOnMachineFunction(MachineFunction &MF) override; 38 StringRef getPassName() const override { return ARM_BRANCH_TARGETS_NAME; } 39 40 private: 41 void addBTI(const ARMInstrInfo &TII, MachineBasicBlock &MBB, bool IsFirstBB); 42 }; 43 } // end anonymous namespace 44 45 char ARMBranchTargets::ID = 0; 46 47 INITIALIZE_PASS(ARMBranchTargets, "arm-branch-targets", ARM_BRANCH_TARGETS_NAME, 48 false, false) 49 50 void ARMBranchTargets::getAnalysisUsage(AnalysisUsage &AU) const { 51 AU.setPreservesCFG(); 52 MachineFunctionPass::getAnalysisUsage(AU); 53 } 54 55 FunctionPass *llvm::createARMBranchTargetsPass() { 56 return new ARMBranchTargets(); 57 } 58 59 bool ARMBranchTargets::runOnMachineFunction(MachineFunction &MF) { 60 if (!MF.getInfo<ARMFunctionInfo>()->branchTargetEnforcement()) 61 return false; 62 63 LLVM_DEBUG(dbgs() << "********** ARM Branch Targets **********\n" 64 << "********** Function: " << MF.getName() << '\n'); 65 const ARMInstrInfo &TII = 66 *static_cast<const ARMInstrInfo *>(MF.getSubtarget().getInstrInfo()); 67 68 // LLVM does not consider basic blocks which are the targets of jump tables 69 // to be address-taken (the address can't escape anywhere else), but they are 70 // used for indirect branches, so need BTI instructions. 71 SmallPtrSet<const MachineBasicBlock *, 8> JumpTableTargets; 72 if (const MachineJumpTableInfo *JTI = MF.getJumpTableInfo()) 73 for (const MachineJumpTableEntry &JTE : JTI->getJumpTables()) 74 for (const MachineBasicBlock *MBB : JTE.MBBs) 75 JumpTableTargets.insert(MBB); 76 77 bool MadeChange = false; 78 for (MachineBasicBlock &MBB : MF) { 79 bool NeedBTI = false; 80 bool IsFirstBB = &MBB == &MF.front(); 81 82 // Every function can potentially be called indirectly (even if it has 83 // static linkage, due to linker-generated veneers). 84 if (IsFirstBB) 85 NeedBTI = true; 86 87 // If the block itself is address-taken, or is an exception landing pad, it 88 // could be indirectly branched to. 89 if (MBB.hasAddressTaken() || MBB.isEHPad() || JumpTableTargets.count(&MBB)) 90 NeedBTI = true; 91 92 if (NeedBTI) { 93 addBTI(TII, MBB, IsFirstBB); 94 MadeChange = true; 95 } 96 } 97 98 return MadeChange; 99 } 100 101 /// Insert a BTI/PACBTI instruction into a given basic block \c MBB. If 102 /// \c IsFirstBB is true (meaning that this is the first BB in a function) try 103 /// to find a PAC instruction and replace it with PACBTI. Otherwise just insert 104 /// a BTI instruction. 105 /// The point of insertion is in the beginning of the BB, immediately after meta 106 /// instructions (such labels in exception handling landing pads). 107 void ARMBranchTargets::addBTI(const ARMInstrInfo &TII, MachineBasicBlock &MBB, 108 bool IsFirstBB) { 109 // Which instruction to insert: BTI or PACBTI 110 unsigned OpCode = ARM::t2BTI; 111 unsigned MIFlags = 0; 112 113 // Skip meta instructions, including EH labels 114 auto MBBI = llvm::find_if_not(MBB.instrs(), [](const MachineInstr &MI) { 115 return MI.isMetaInstruction(); 116 }); 117 118 // If this is the first BB in a function, check if it starts with a PAC 119 // instruction and in that case remove the PAC instruction. 120 if (IsFirstBB) { 121 if (MBBI != MBB.instr_end() && MBBI->getOpcode() == ARM::t2PAC) { 122 LLVM_DEBUG(dbgs() << "Removing a 'PAC' instr from BB '" << MBB.getName() 123 << "' to replace with PACBTI\n"); 124 OpCode = ARM::t2PACBTI; 125 MIFlags = MachineInstr::FrameSetup; 126 auto NextMBBI = std::next(MBBI); 127 MBBI->eraseFromParent(); 128 MBBI = NextMBBI; 129 } 130 } 131 132 LLVM_DEBUG(dbgs() << "Inserting a '" 133 << (OpCode == ARM::t2BTI ? "BTI" : "PACBTI") 134 << "' instr into BB '" << MBB.getName() << "'\n"); 135 // Finally, insert a new instruction (either PAC or PACBTI) 136 BuildMI(MBB, MBBI, MBB.findDebugLoc(MBBI), TII.get(OpCode)) 137 .setMIFlags(MIFlags); 138 } 139