1 //===-- ARMBranchTargets.cpp -- Harden code using v8.1-M BTI extension -----==//
2 //
3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4 // See https://llvm.org/LICENSE.txt for license information.
5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6 //
7 //===----------------------------------------------------------------------===//
8 //
9 // This pass inserts BTI instructions at the start of every function and basic
10 // block which could be indirectly called. The hardware will (when enabled)
11 // trap when an indirect branch or call instruction targets an instruction
12 // which is not a valid BTI instruction. This is intended to guard against
13 // control-flow hijacking attacks.
14 //
15 //===----------------------------------------------------------------------===//
16
17 #include "ARM.h"
18 #include "ARMInstrInfo.h"
19 #include "ARMMachineFunctionInfo.h"
20 #include "llvm/CodeGen/MachineFunctionPass.h"
21 #include "llvm/CodeGen/MachineInstrBuilder.h"
22 #include "llvm/CodeGen/MachineJumpTableInfo.h"
23 #include "llvm/CodeGen/MachineModuleInfo.h"
24 #include "llvm/Support/Debug.h"
25
26 using namespace llvm;
27
28 #define DEBUG_TYPE "arm-branch-targets"
29 #define ARM_BRANCH_TARGETS_NAME "ARM Branch Targets"
30
31 namespace {
32 class ARMBranchTargets : public MachineFunctionPass {
33 public:
34 static char ID;
ARMBranchTargets()35 ARMBranchTargets() : MachineFunctionPass(ID) {}
36 void getAnalysisUsage(AnalysisUsage &AU) const override;
37 bool runOnMachineFunction(MachineFunction &MF) override;
getPassName() const38 StringRef getPassName() const override { return ARM_BRANCH_TARGETS_NAME; }
39
40 private:
41 void addBTI(const ARMInstrInfo &TII, MachineBasicBlock &MBB, bool IsFirstBB);
42 };
43 } // end anonymous namespace
44
45 char ARMBranchTargets::ID = 0;
46
47 INITIALIZE_PASS(ARMBranchTargets, "arm-branch-targets", ARM_BRANCH_TARGETS_NAME,
48 false, false)
49
getAnalysisUsage(AnalysisUsage & AU) const50 void ARMBranchTargets::getAnalysisUsage(AnalysisUsage &AU) const {
51 AU.setPreservesCFG();
52 MachineFunctionPass::getAnalysisUsage(AU);
53 }
54
createARMBranchTargetsPass()55 FunctionPass *llvm::createARMBranchTargetsPass() {
56 return new ARMBranchTargets();
57 }
58
runOnMachineFunction(MachineFunction & MF)59 bool ARMBranchTargets::runOnMachineFunction(MachineFunction &MF) {
60 if (!MF.getInfo<ARMFunctionInfo>()->branchTargetEnforcement())
61 return false;
62
63 LLVM_DEBUG(dbgs() << "********** ARM Branch Targets **********\n"
64 << "********** Function: " << MF.getName() << '\n');
65 const ARMInstrInfo &TII =
66 *static_cast<const ARMInstrInfo *>(MF.getSubtarget().getInstrInfo());
67
68 // LLVM does not consider basic blocks which are the targets of jump tables
69 // to be address-taken (the address can't escape anywhere else), but they are
70 // used for indirect branches, so need BTI instructions.
71 SmallPtrSet<const MachineBasicBlock *, 8> JumpTableTargets;
72 if (const MachineJumpTableInfo *JTI = MF.getJumpTableInfo())
73 for (const MachineJumpTableEntry &JTE : JTI->getJumpTables())
74 for (const MachineBasicBlock *MBB : JTE.MBBs)
75 JumpTableTargets.insert(MBB);
76
77 bool MadeChange = false;
78 for (MachineBasicBlock &MBB : MF) {
79 bool NeedBTI = false;
80 bool IsFirstBB = &MBB == &MF.front();
81
82 // Every function can potentially be called indirectly (even if it has
83 // static linkage, due to linker-generated veneers).
84 if (IsFirstBB)
85 NeedBTI = true;
86
87 // If the block itself is address-taken, or is an exception landing pad, it
88 // could be indirectly branched to.
89 if (MBB.hasAddressTaken() || MBB.isEHPad() || JumpTableTargets.count(&MBB))
90 NeedBTI = true;
91
92 if (NeedBTI) {
93 addBTI(TII, MBB, IsFirstBB);
94 MadeChange = true;
95 }
96 }
97
98 return MadeChange;
99 }
100
101 /// Insert a BTI/PACBTI instruction into a given basic block \c MBB. If
102 /// \c IsFirstBB is true (meaning that this is the first BB in a function) try
103 /// to find a PAC instruction and replace it with PACBTI. Otherwise just insert
104 /// a BTI instruction.
105 /// The point of insertion is in the beginning of the BB, immediately after meta
106 /// instructions (such labels in exception handling landing pads).
addBTI(const ARMInstrInfo & TII,MachineBasicBlock & MBB,bool IsFirstBB)107 void ARMBranchTargets::addBTI(const ARMInstrInfo &TII, MachineBasicBlock &MBB,
108 bool IsFirstBB) {
109 // Which instruction to insert: BTI or PACBTI
110 unsigned OpCode = ARM::t2BTI;
111 unsigned MIFlags = 0;
112
113 // Skip meta instructions, including EH labels
114 auto MBBI = llvm::find_if_not(MBB.instrs(), [](const MachineInstr &MI) {
115 return MI.isMetaInstruction();
116 });
117
118 // If this is the first BB in a function, check if it starts with a PAC
119 // instruction and in that case remove the PAC instruction.
120 if (IsFirstBB) {
121 if (MBBI != MBB.instr_end() && MBBI->getOpcode() == ARM::t2PAC) {
122 LLVM_DEBUG(dbgs() << "Removing a 'PAC' instr from BB '" << MBB.getName()
123 << "' to replace with PACBTI\n");
124 OpCode = ARM::t2PACBTI;
125 MIFlags = MachineInstr::FrameSetup;
126 auto NextMBBI = std::next(MBBI);
127 MBBI->eraseFromParent();
128 MBBI = NextMBBI;
129 }
130 }
131
132 LLVM_DEBUG(dbgs() << "Inserting a '"
133 << (OpCode == ARM::t2BTI ? "BTI" : "PACBTI")
134 << "' instr into BB '" << MBB.getName() << "'\n");
135 // Finally, insert a new instruction (either PAC or PACBTI)
136 BuildMI(MBB, MBBI, MBB.findDebugLoc(MBBI), TII.get(OpCode))
137 .setMIFlags(MIFlags);
138 }
139