LLVM 19.0.0git
ARMBranchTargets.cpp
Go to the documentation of this file.
1//===-- ARMBranchTargets.cpp -- Harden code using v8.1-M BTI extension -----==//
2//
3// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4// See https://llvm.org/LICENSE.txt for license information.
5// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6//
7//===----------------------------------------------------------------------===//
8//
9// This pass inserts BTI instructions at the start of every function and basic
10// block which could be indirectly called. The hardware will (when enabled)
11// trap when an indirect branch or call instruction targets an instruction
12// which is not a valid BTI instruction. This is intended to guard against
13// control-flow hijacking attacks.
14//
15//===----------------------------------------------------------------------===//
16
17#include "ARM.h"
18#include "ARMInstrInfo.h"
24#include "llvm/Support/Debug.h"
25
26using namespace llvm;
27
28#define DEBUG_TYPE "arm-branch-targets"
29#define ARM_BRANCH_TARGETS_NAME "ARM Branch Targets"
30
31namespace {
32class ARMBranchTargets : public MachineFunctionPass {
33public:
34 static char ID;
35 ARMBranchTargets() : MachineFunctionPass(ID) {}
36 void getAnalysisUsage(AnalysisUsage &AU) const override;
37 bool runOnMachineFunction(MachineFunction &MF) override;
38 StringRef getPassName() const override { return ARM_BRANCH_TARGETS_NAME; }
39
40private:
41 void addBTI(const ARMInstrInfo &TII, MachineBasicBlock &MBB, bool IsFirstBB);
42};
43} // end anonymous namespace
44
45char ARMBranchTargets::ID = 0;
46
47INITIALIZE_PASS(ARMBranchTargets, "arm-branch-targets", ARM_BRANCH_TARGETS_NAME,
48 false, false)
49
50void ARMBranchTargets::getAnalysisUsage(AnalysisUsage &AU) const {
51 AU.setPreservesCFG();
53}
54
56 return new ARMBranchTargets();
57}
58
59bool ARMBranchTargets::runOnMachineFunction(MachineFunction &MF) {
61 return false;
62
63 LLVM_DEBUG(dbgs() << "********** ARM Branch Targets **********\n"
64 << "********** Function: " << MF.getName() << '\n');
65 const ARMInstrInfo &TII =
66 *static_cast<const ARMInstrInfo *>(MF.getSubtarget().getInstrInfo());
67
68 bool MadeChange = false;
69 for (MachineBasicBlock &MBB : MF) {
70 bool IsFirstBB = &MBB == &MF.front();
71
72 // Every function can potentially be called indirectly (even if it has
73 // static linkage, due to linker-generated veneers).
74 // If the block itself is address-taken, or is an exception landing pad, it
75 // could be indirectly branched to.
76 // Jump tables only emit indirect jumps (JUMPTABLE_ADDRS) in ARM or Thumb1
77 // modes. These modes do not support PACBTI. As a result, BTI instructions
78 // are not added in the destination blocks.
79
80 if (IsFirstBB || MBB.hasAddressTaken() || MBB.isEHPad()) {
81 addBTI(TII, MBB, IsFirstBB);
82 MadeChange = true;
83 }
84 }
85
86 return MadeChange;
87}
88
89/// Insert a BTI/PACBTI instruction into a given basic block \c MBB. If
90/// \c IsFirstBB is true (meaning that this is the first BB in a function) try
91/// to find a PAC instruction and replace it with PACBTI. Otherwise just insert
92/// a BTI instruction.
93/// The point of insertion is in the beginning of the BB, immediately after meta
94/// instructions (such labels in exception handling landing pads).
95void ARMBranchTargets::addBTI(const ARMInstrInfo &TII, MachineBasicBlock &MBB,
96 bool IsFirstBB) {
97 // Which instruction to insert: BTI or PACBTI
98 unsigned OpCode = ARM::t2BTI;
99 unsigned MIFlags = 0;
100
101 // Skip meta instructions, including EH labels
102 auto MBBI = llvm::find_if_not(MBB.instrs(), [](const MachineInstr &MI) {
103 return MI.isMetaInstruction();
104 });
105
106 // If this is the first BB in a function, check if it starts with a PAC
107 // instruction and in that case remove the PAC instruction.
108 if (IsFirstBB) {
109 if (MBBI != MBB.instr_end() && MBBI->getOpcode() == ARM::t2PAC) {
110 LLVM_DEBUG(dbgs() << "Removing a 'PAC' instr from BB '" << MBB.getName()
111 << "' to replace with PACBTI\n");
112 OpCode = ARM::t2PACBTI;
113 MIFlags = MachineInstr::FrameSetup;
114 auto NextMBBI = std::next(MBBI);
116 MBBI = NextMBBI;
117 }
118 }
119
120 LLVM_DEBUG(dbgs() << "Inserting a '"
121 << (OpCode == ARM::t2BTI ? "BTI" : "PACBTI")
122 << "' instr into BB '" << MBB.getName() << "'\n");
123 // Finally, insert a new instruction (either PAC or PACBTI)
124 BuildMI(MBB, MBBI, MBB.findDebugLoc(MBBI), TII.get(OpCode))
125 .setMIFlags(MIFlags);
126}
MachineBasicBlock & MBB
MachineBasicBlock MachineBasicBlock::iterator MBBI
#define ARM_BRANCH_TARGETS_NAME
#define LLVM_DEBUG(X)
Definition: Debug.h:101
const HexagonInstrInfo * TII
IRTranslator LLVM IR MI
#define INITIALIZE_PASS(passName, arg, name, cfg, analysis)
Definition: PassSupport.h:38
ARMFunctionInfo - This class is derived from MachineFunctionInfo and contains private ARM-specific in...
Represent the analysis usage information of a pass.
FunctionPass class - This class is used to implement most global optimizations.
Definition: Pass.h:311
bool isEHPad() const
Returns true if the block is a landing pad.
bool hasAddressTaken() const
Test whether this block is used as something other than the target of a terminator,...
DebugLoc findDebugLoc(instr_iterator MBBI)
Find the next valid DebugLoc starting at MBBI, skipping any debug instructions.
void eraseFromParent()
This method unlinks 'this' from the containing function and deletes it.
instr_iterator instr_end()
StringRef getName() const
Return the name of the corresponding LLVM basic block, or an empty string.
MachineFunctionPass - This class adapts the FunctionPass interface to allow convenient creation of pa...
void getAnalysisUsage(AnalysisUsage &AU) const override
getAnalysisUsage - Subclasses that override getAnalysisUsage must call this.
virtual bool runOnMachineFunction(MachineFunction &MF)=0
runOnMachineFunction - This method must be overloaded to perform the desired machine code transformat...
const TargetSubtargetInfo & getSubtarget() const
getSubtarget - Return the subtarget for which this machine code is being compiled.
StringRef getName() const
getName - Return the name of the corresponding LLVM function.
Ty * getInfo()
getInfo - Keep track of various per-function pieces of information for backends that would like to do...
const MachineInstrBuilder & setMIFlags(unsigned Flags) const
Representation of each machine instruction.
Definition: MachineInstr.h:69
virtual StringRef getPassName() const
getPassName - Return a nice clean name for a pass.
Definition: Pass.cpp:81
StringRef - Represent a constant reference to a string, i.e.
Definition: StringRef.h:50
virtual const TargetInstrInfo * getInstrInfo() const
unsigned ID
LLVM IR allows to use arbitrary numbers as calling convention identifiers.
Definition: CallingConv.h:24
This is an optimization pass for GlobalISel generic memory operations.
Definition: AddressRanges.h:18
MachineInstrBuilder BuildMI(MachineFunction &MF, const MIMetadata &MIMD, const MCInstrDesc &MCID)
Builder interface. Specify how to create the initial instruction itself.
FunctionPass * createARMBranchTargetsPass()
auto find_if_not(R &&Range, UnaryPredicate P)
Definition: STLExtras.h:1763
raw_ostream & dbgs()
dbgs() - This returns a reference to a raw_ostream for debugging messages.
Definition: Debug.cpp:163