//===-- ARMBranchTargets.cpp -- Harden code using v8.1-M BTI extension -----==// // // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions. // See https://llvm.org/LICENSE.txt for license information. // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception // //===----------------------------------------------------------------------===// // // This pass inserts BTI instructions at the start of every function and basic // block which could be indirectly called. The hardware will (when enabled) // trap when an indirect branch or call instruction targets an instruction // which is not a valid BTI instruction. This is intended to guard against // control-flow hijacking attacks. // //===----------------------------------------------------------------------===// #include "ARM.h" #include "ARMInstrInfo.h" #include "ARMMachineFunctionInfo.h" #include "llvm/CodeGen/MachineFunctionPass.h" #include "llvm/CodeGen/MachineInstrBuilder.h" #include "llvm/CodeGen/MachineJumpTableInfo.h" #include "llvm/CodeGen/MachineModuleInfo.h" #include "llvm/Support/Debug.h" usingnamespacellvm; #define DEBUG_TYPE … #define ARM_BRANCH_TARGETS_NAME … namespace { class ARMBranchTargets : public MachineFunctionPass { … }; } // end anonymous namespace char ARMBranchTargets::ID = …; INITIALIZE_PASS(…) void ARMBranchTargets::getAnalysisUsage(AnalysisUsage &AU) const { … } FunctionPass *llvm::createARMBranchTargetsPass() { … } bool ARMBranchTargets::runOnMachineFunction(MachineFunction &MF) { … } /// Insert a BTI/PACBTI instruction into a given basic block \c MBB. If /// \c IsFirstBB is true (meaning that this is the first BB in a function) try /// to find a PAC instruction and replace it with PACBTI. Otherwise just insert /// a BTI instruction. /// The point of insertion is in the beginning of the BB, immediately after meta /// instructions (such labels in exception handling landing pads). void ARMBranchTargets::addBTI(const ARMInstrInfo &TII, MachineBasicBlock &MBB, bool IsFirstBB) { … }