1 //===-- KCFI.cpp - Generic KCFI operand bundle lowering ---------*- C++ -*-===// 2 // 3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions. 4 // See https://llvm.org/LICENSE.txt for license information. 5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception 6 // 7 //===----------------------------------------------------------------------===// 8 // 9 // This pass emits generic KCFI indirect call checks for targets that don't 10 // support lowering KCFI operand bundles in the back-end. 11 // 12 //===----------------------------------------------------------------------===// 13 14 #include "llvm/Transforms/Instrumentation/KCFI.h" 15 #include "llvm/ADT/Statistic.h" 16 #include "llvm/IR/Constants.h" 17 #include "llvm/IR/DiagnosticInfo.h" 18 #include "llvm/IR/DiagnosticPrinter.h" 19 #include "llvm/IR/Function.h" 20 #include "llvm/IR/GlobalObject.h" 21 #include "llvm/IR/IRBuilder.h" 22 #include "llvm/IR/InstIterator.h" 23 #include "llvm/IR/Instructions.h" 24 #include "llvm/IR/Intrinsics.h" 25 #include "llvm/IR/MDBuilder.h" 26 #include "llvm/IR/Module.h" 27 #include "llvm/Target/TargetMachine.h" 28 #include "llvm/Transforms/Utils/BasicBlockUtils.h" 29 30 using namespace llvm; 31 32 #define DEBUG_TYPE "kcfi" 33 34 STATISTIC(NumKCFIChecks, "Number of kcfi operands transformed into checks"); 35 36 namespace { 37 class DiagnosticInfoKCFI : public DiagnosticInfo { 38 const Twine &Msg; 39 40 public: 41 DiagnosticInfoKCFI(const Twine &DiagMsg, 42 DiagnosticSeverity Severity = DS_Error) 43 : DiagnosticInfo(DK_Linker, Severity), Msg(DiagMsg) {} 44 void print(DiagnosticPrinter &DP) const override { DP << Msg; } 45 }; 46 } // namespace 47 48 PreservedAnalyses KCFIPass::run(Function &F, FunctionAnalysisManager &AM) { 49 Module &M = *F.getParent(); 50 if (!M.getModuleFlag("kcfi")) 51 return PreservedAnalyses::all(); 52 53 // Find call instructions with KCFI operand bundles. 54 SmallVector<CallInst *> KCFICalls; 55 for (Instruction &I : instructions(F)) { 56 if (auto *CI = dyn_cast<CallInst>(&I)) 57 if (CI->getOperandBundle(LLVMContext::OB_kcfi)) 58 KCFICalls.push_back(CI); 59 } 60 61 if (KCFICalls.empty()) 62 return PreservedAnalyses::all(); 63 64 LLVMContext &Ctx = M.getContext(); 65 // patchable-function-prefix emits nops between the KCFI type identifier 66 // and the function start. As we don't know the size of the emitted nops, 67 // don't allow this attribute with generic lowering. 68 if (F.hasFnAttribute("patchable-function-prefix")) 69 Ctx.diagnose( 70 DiagnosticInfoKCFI("-fpatchable-function-entry=N,M, where M>0 is not " 71 "compatible with -fsanitize=kcfi on this target")); 72 73 IntegerType *Int32Ty = Type::getInt32Ty(Ctx); 74 MDNode *VeryUnlikelyWeights = 75 MDBuilder(Ctx).createBranchWeights(1, (1U << 20) - 1); 76 Triple T(M.getTargetTriple()); 77 78 for (CallInst *CI : KCFICalls) { 79 // Get the expected hash value. 80 const uint32_t ExpectedHash = 81 cast<ConstantInt>(CI->getOperandBundle(LLVMContext::OB_kcfi)->Inputs[0]) 82 ->getZExtValue(); 83 84 // Drop the KCFI operand bundle. 85 CallBase *Call = 86 CallBase::removeOperandBundle(CI, LLVMContext::OB_kcfi, CI); 87 assert(Call != CI); 88 Call->copyMetadata(*CI); 89 CI->replaceAllUsesWith(Call); 90 CI->eraseFromParent(); 91 92 if (!Call->isIndirectCall()) 93 continue; 94 95 // Emit a check and trap if the target hash doesn't match. 96 IRBuilder<> Builder(Call); 97 Value *FuncPtr = Call->getCalledOperand(); 98 // ARM uses the least significant bit of the function pointer to select 99 // between ARM and Thumb modes for the callee. Instructions are always 100 // at least 16-bit aligned, so clear the LSB before we compute the hash 101 // location. 102 if (T.isARM() || T.isThumb()) { 103 FuncPtr = Builder.CreateIntToPtr( 104 Builder.CreateAnd(Builder.CreatePtrToInt(FuncPtr, Int32Ty), 105 ConstantInt::get(Int32Ty, -2)), 106 FuncPtr->getType()); 107 } 108 Value *HashPtr = Builder.CreateConstInBoundsGEP1_32(Int32Ty, FuncPtr, -1); 109 Value *Test = Builder.CreateICmpNE(Builder.CreateLoad(Int32Ty, HashPtr), 110 ConstantInt::get(Int32Ty, ExpectedHash)); 111 Instruction *ThenTerm = 112 SplitBlockAndInsertIfThen(Test, Call, false, VeryUnlikelyWeights); 113 Builder.SetInsertPoint(ThenTerm); 114 Builder.CreateCall(Intrinsic::getDeclaration(&M, Intrinsic::debugtrap)); 115 ++NumKCFIChecks; 116 } 117 118 return PreservedAnalyses::none(); 119 } 120