1 //===---- KCFI.cpp - Implements Kernel Control-Flow Integrity (KCFI) ------===//
2 //
3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4 // See https://llvm.org/LICENSE.txt for license information.
5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6 //
7 //===----------------------------------------------------------------------===//
8 //
9 // This pass implements Kernel Control-Flow Integrity (KCFI) indirect call
10 // check lowering. For each call instruction with a cfi-type attribute, it
11 // emits an arch-specific check before the call, and bundles the check and
12 // the call to prevent unintentional modifications.
13 //
14 //===----------------------------------------------------------------------===//
15
16 #include "llvm/ADT/Statistic.h"
17 #include "llvm/CodeGen/MachineFunctionPass.h"
18 #include "llvm/CodeGen/MachineInstrBuilder.h"
19 #include "llvm/CodeGen/MachineInstrBundle.h"
20 #include "llvm/CodeGen/MachineModuleInfo.h"
21 #include "llvm/CodeGen/TargetInstrInfo.h"
22 #include "llvm/CodeGen/TargetLowering.h"
23 #include "llvm/CodeGen/TargetSubtargetInfo.h"
24 #include "llvm/IR/Module.h"
25 #include "llvm/InitializePasses.h"
26
27 using namespace llvm;
28
29 #define DEBUG_TYPE "kcfi"
30 #define KCFI_PASS_NAME "Insert KCFI indirect call checks"
31
32 STATISTIC(NumKCFIChecksAdded, "Number of indirect call checks added");
33
34 namespace {
35 class KCFI : public MachineFunctionPass {
36 public:
37 static char ID;
38
KCFI()39 KCFI() : MachineFunctionPass(ID) {}
40
getPassName() const41 StringRef getPassName() const override { return KCFI_PASS_NAME; }
42 bool runOnMachineFunction(MachineFunction &MF) override;
43
44 private:
45 /// Machine instruction info used throughout the class.
46 const TargetInstrInfo *TII = nullptr;
47
48 /// Target lowering for arch-specific parts.
49 const TargetLowering *TLI = nullptr;
50
51 /// Emits a KCFI check before an indirect call.
52 /// \returns true if the check was added and false otherwise.
53 bool emitCheck(MachineBasicBlock &MBB,
54 MachineBasicBlock::instr_iterator I) const;
55 };
56
57 char KCFI::ID = 0;
58 } // end anonymous namespace
59
INITIALIZE_PASS(KCFI,DEBUG_TYPE,KCFI_PASS_NAME,false,false)60 INITIALIZE_PASS(KCFI, DEBUG_TYPE, KCFI_PASS_NAME, false, false)
61
62 FunctionPass *llvm::createKCFIPass() { return new KCFI(); }
63
emitCheck(MachineBasicBlock & MBB,MachineBasicBlock::instr_iterator MBBI) const64 bool KCFI::emitCheck(MachineBasicBlock &MBB,
65 MachineBasicBlock::instr_iterator MBBI) const {
66 assert(TII && "Target instruction info was not initialized");
67 assert(TLI && "Target lowering was not initialized");
68
69 // If the call instruction is bundled, we can only emit a check safely if
70 // it's the first instruction in the bundle.
71 if (MBBI->isBundled() && !std::prev(MBBI)->isBundle())
72 report_fatal_error("Cannot emit a KCFI check for a bundled call");
73
74 // Emit a KCFI check for the call instruction at MBBI. The implementation
75 // must unfold memory operands if applicable.
76 MachineInstr *Check = TLI->EmitKCFICheck(MBB, MBBI, TII);
77
78 // Clear the original call's CFI type.
79 assert(MBBI->isCall() && "Unexpected instruction type");
80 MBBI->setCFIType(*MBB.getParent(), 0);
81
82 // If not already bundled, bundle the check and the call to prevent
83 // further changes.
84 if (!MBBI->isBundled())
85 finalizeBundle(MBB, Check->getIterator(), std::next(MBBI->getIterator()));
86
87 ++NumKCFIChecksAdded;
88 return true;
89 }
90
runOnMachineFunction(MachineFunction & MF)91 bool KCFI::runOnMachineFunction(MachineFunction &MF) {
92 const Module *M = MF.getFunction().getParent();
93 if (!M->getModuleFlag("kcfi"))
94 return false;
95
96 const auto &SubTarget = MF.getSubtarget();
97 TII = SubTarget.getInstrInfo();
98 TLI = SubTarget.getTargetLowering();
99
100 bool Changed = false;
101 for (MachineBasicBlock &MBB : MF) {
102 // Use instr_iterator because we don't want to skip bundles.
103 for (MachineBasicBlock::instr_iterator MII = MBB.instr_begin(),
104 MIE = MBB.instr_end();
105 MII != MIE; ++MII) {
106 if (MII->isCall() && MII->getCFIType())
107 Changed |= emitCheck(MBB, MII);
108 }
109 }
110
111 return Changed;
112 }
113