1 //===-- CrossDSOCFI.cpp - Externalize this module's CFI checks ------------===//
2 //
3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4 // See https://llvm.org/LICENSE.txt for license information.
5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6 //
7 //===----------------------------------------------------------------------===//
8 //
9 // This pass exports all llvm.bitset's found in the module in the form of a
10 // __cfi_check function, which can be used to verify cross-DSO call targets.
11 //
12 //===----------------------------------------------------------------------===//
13
14 #include "llvm/Transforms/IPO/CrossDSOCFI.h"
15 #include "llvm/ADT/SetVector.h"
16 #include "llvm/ADT/Statistic.h"
17 #include "llvm/IR/Constants.h"
18 #include "llvm/IR/Function.h"
19 #include "llvm/IR/GlobalObject.h"
20 #include "llvm/IR/IRBuilder.h"
21 #include "llvm/IR/Instructions.h"
22 #include "llvm/IR/Intrinsics.h"
23 #include "llvm/IR/MDBuilder.h"
24 #include "llvm/IR/Module.h"
25 #include "llvm/TargetParser/Triple.h"
26
27 using namespace llvm;
28
29 #define DEBUG_TYPE "cross-dso-cfi"
30
31 STATISTIC(NumTypeIds, "Number of unique type identifiers");
32
33 namespace {
34
35 struct CrossDSOCFI {
36 MDNode *VeryLikelyWeights;
37
38 ConstantInt *extractNumericTypeId(MDNode *MD);
39 void buildCFICheck(Module &M);
40 bool runOnModule(Module &M);
41 };
42
43 } // anonymous namespace
44
45 /// Extracts a numeric type identifier from an MDNode containing type metadata.
extractNumericTypeId(MDNode * MD)46 ConstantInt *CrossDSOCFI::extractNumericTypeId(MDNode *MD) {
47 // This check excludes vtables for classes inside anonymous namespaces.
48 auto TM = dyn_cast<ValueAsMetadata>(MD->getOperand(1));
49 if (!TM)
50 return nullptr;
51 auto C = dyn_cast_or_null<ConstantInt>(TM->getValue());
52 if (!C) return nullptr;
53 // We are looking for i64 constants.
54 if (C->getBitWidth() != 64) return nullptr;
55
56 return C;
57 }
58
59 /// buildCFICheck - emits __cfi_check for the current module.
buildCFICheck(Module & M)60 void CrossDSOCFI::buildCFICheck(Module &M) {
61 // FIXME: verify that __cfi_check ends up near the end of the code section,
62 // but before the jump slots created in LowerTypeTests.
63 SetVector<uint64_t> TypeIds;
64 SmallVector<MDNode *, 2> Types;
65 for (GlobalObject &GO : M.global_objects()) {
66 Types.clear();
67 GO.getMetadata(LLVMContext::MD_type, Types);
68 for (MDNode *Type : Types)
69 if (ConstantInt *TypeId = extractNumericTypeId(Type))
70 TypeIds.insert(TypeId->getZExtValue());
71 }
72
73 NamedMDNode *CfiFunctionsMD = M.getNamedMetadata("cfi.functions");
74 if (CfiFunctionsMD) {
75 for (auto *Func : CfiFunctionsMD->operands()) {
76 assert(Func->getNumOperands() >= 2);
77 for (unsigned I = 2; I < Func->getNumOperands(); ++I)
78 if (ConstantInt *TypeId =
79 extractNumericTypeId(cast<MDNode>(Func->getOperand(I).get())))
80 TypeIds.insert(TypeId->getZExtValue());
81 }
82 }
83
84 LLVMContext &Ctx = M.getContext();
85 FunctionCallee C = M.getOrInsertFunction(
86 "__cfi_check", Type::getVoidTy(Ctx), Type::getInt64Ty(Ctx),
87 PointerType::getUnqual(Ctx), PointerType::getUnqual(Ctx));
88 Function *F = cast<Function>(C.getCallee());
89 // Take over the existing function. The frontend emits a weak stub so that the
90 // linker knows about the symbol; this pass replaces the function body.
91 F->deleteBody();
92 F->setAlignment(Align(4096));
93
94 Triple T(M.getTargetTriple());
95 if (T.isARM() || T.isThumb())
96 F->addFnAttr("target-features", "+thumb-mode");
97
98 auto args = F->arg_begin();
99 Value &CallSiteTypeId = *(args++);
100 CallSiteTypeId.setName("CallSiteTypeId");
101 Value &Addr = *(args++);
102 Addr.setName("Addr");
103 Value &CFICheckFailData = *(args++);
104 CFICheckFailData.setName("CFICheckFailData");
105 assert(args == F->arg_end());
106
107 BasicBlock *BB = BasicBlock::Create(Ctx, "entry", F);
108 BasicBlock *ExitBB = BasicBlock::Create(Ctx, "exit", F);
109
110 BasicBlock *TrapBB = BasicBlock::Create(Ctx, "fail", F);
111 IRBuilder<> IRBFail(TrapBB);
112 FunctionCallee CFICheckFailFn = M.getOrInsertFunction(
113 "__cfi_check_fail", Type::getVoidTy(Ctx), PointerType::getUnqual(Ctx),
114 PointerType::getUnqual(Ctx));
115 IRBFail.CreateCall(CFICheckFailFn, {&CFICheckFailData, &Addr});
116 IRBFail.CreateBr(ExitBB);
117
118 IRBuilder<> IRBExit(ExitBB);
119 IRBExit.CreateRetVoid();
120
121 IRBuilder<> IRB(BB);
122 SwitchInst *SI = IRB.CreateSwitch(&CallSiteTypeId, TrapBB, TypeIds.size());
123 for (uint64_t TypeId : TypeIds) {
124 ConstantInt *CaseTypeId = ConstantInt::get(Type::getInt64Ty(Ctx), TypeId);
125 BasicBlock *TestBB = BasicBlock::Create(Ctx, "test", F);
126 IRBuilder<> IRBTest(TestBB);
127
128 Value *Test = IRBTest.CreateIntrinsic(
129 Intrinsic::type_test,
130 {&Addr,
131 MetadataAsValue::get(Ctx, ConstantAsMetadata::get(CaseTypeId))});
132 BranchInst *BI = IRBTest.CreateCondBr(Test, ExitBB, TrapBB);
133 BI->setMetadata(LLVMContext::MD_prof, VeryLikelyWeights);
134
135 SI->addCase(CaseTypeId, TestBB);
136 ++NumTypeIds;
137 }
138 }
139
runOnModule(Module & M)140 bool CrossDSOCFI::runOnModule(Module &M) {
141 VeryLikelyWeights = MDBuilder(M.getContext()).createLikelyBranchWeights();
142 if (M.getModuleFlag("Cross-DSO CFI") == nullptr)
143 return false;
144 buildCFICheck(M);
145 return true;
146 }
147
run(Module & M,ModuleAnalysisManager & AM)148 PreservedAnalyses CrossDSOCFIPass::run(Module &M, ModuleAnalysisManager &AM) {
149 CrossDSOCFI Impl;
150 bool Changed = Impl.runOnModule(M);
151 if (!Changed)
152 return PreservedAnalyses::all();
153 return PreservedAnalyses::none();
154 }
155