LLVM 19.0.0git
KCFI.cpp
Go to the documentation of this file.
1//===---- KCFI.cpp - Implements Kernel Control-Flow Integrity (KCFI) ------===//
2//
3// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4// See https://llvm.org/LICENSE.txt for license information.
5// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6//
7//===----------------------------------------------------------------------===//
8//
9// This pass implements Kernel Control-Flow Integrity (KCFI) indirect call
10// check lowering. For each call instruction with a cfi-type attribute, it
11// emits an arch-specific check before the call, and bundles the check and
12// the call to prevent unintentional modifications.
13//
14//===----------------------------------------------------------------------===//
15
16#include "llvm/ADT/Statistic.h"
24#include "llvm/IR/Module.h"
26
27using namespace llvm;
28
29#define DEBUG_TYPE "kcfi"
30#define KCFI_PASS_NAME "Insert KCFI indirect call checks"
31
32STATISTIC(NumKCFIChecksAdded, "Number of indirect call checks added");
33
34namespace {
35class KCFI : public MachineFunctionPass {
36public:
37 static char ID;
38
39 KCFI() : MachineFunctionPass(ID) {}
40
41 StringRef getPassName() const override { return KCFI_PASS_NAME; }
42 bool runOnMachineFunction(MachineFunction &MF) override;
43
44private:
45 /// Machine instruction info used throughout the class.
46 const TargetInstrInfo *TII = nullptr;
47
48 /// Target lowering for arch-specific parts.
49 const TargetLowering *TLI = nullptr;
50
51 /// Emits a KCFI check before an indirect call.
52 /// \returns true if the check was added and false otherwise.
53 bool emitCheck(MachineBasicBlock &MBB,
55};
56
57char KCFI::ID = 0;
58} // end anonymous namespace
59
60INITIALIZE_PASS(KCFI, DEBUG_TYPE, KCFI_PASS_NAME, false, false)
61
62FunctionPass *llvm::createKCFIPass() { return new KCFI(); }
63
64bool KCFI::emitCheck(MachineBasicBlock &MBB,
66 assert(TII && "Target instruction info was not initialized");
67 assert(TLI && "Target lowering was not initialized");
68
69 // If the call instruction is bundled, we can only emit a check safely if
70 // it's the first instruction in the bundle.
71 if (MBBI->isBundled() && !std::prev(MBBI)->isBundle())
72 report_fatal_error("Cannot emit a KCFI check for a bundled call");
73
74 // Emit a KCFI check for the call instruction at MBBI. The implementation
75 // must unfold memory operands if applicable.
76 MachineInstr *Check = TLI->EmitKCFICheck(MBB, MBBI, TII);
77
78 // Clear the original call's CFI type.
79 assert(MBBI->isCall() && "Unexpected instruction type");
80 MBBI->setCFIType(*MBB.getParent(), 0);
81
82 // If not already bundled, bundle the check and the call to prevent
83 // further changes.
84 if (!MBBI->isBundled())
85 finalizeBundle(MBB, Check->getIterator(), std::next(MBBI->getIterator()));
86
87 ++NumKCFIChecksAdded;
88 return true;
89}
90
91bool KCFI::runOnMachineFunction(MachineFunction &MF) {
92 const Module *M = MF.getFunction().getParent();
93 if (!M->getModuleFlag("kcfi"))
94 return false;
95
96 const auto &SubTarget = MF.getSubtarget();
97 TII = SubTarget.getInstrInfo();
98 TLI = SubTarget.getTargetLowering();
99
100 bool Changed = false;
101 for (MachineBasicBlock &MBB : MF) {
102 // Use instr_iterator because we don't want to skip bundles.
104 MIE = MBB.instr_end();
105 MII != MIE; ++MII) {
106 if (MII->isCall() && MII->getCFIType())
107 Changed |= emitCheck(MBB, MII);
108 }
109 }
110
111 return Changed;
112}
MachineBasicBlock & MBB
MachineBasicBlock MachineBasicBlock::iterator MBBI
#define KCFI_PASS_NAME
Definition: KCFI.cpp:30
#define DEBUG_TYPE
Definition: KCFI.cpp:29
#define Check(C,...)
const HexagonInstrInfo * TII
#define I(x, y, z)
Definition: MD5.cpp:58
Module.h This file contains the declarations for the Module class.
#define INITIALIZE_PASS(passName, arg, name, cfg, analysis)
Definition: PassSupport.h:38
assert(ImpDefSCC.getReg()==AMDGPU::SCC &&ImpDefSCC.isDef())
This file defines the 'Statistic' class, which is designed to be an easy way to expose various metric...
#define STATISTIC(VARNAME, DESC)
Definition: Statistic.h:167
This file describes how to lower LLVM code to machine code.
FunctionPass class - This class is used to implement most global optimizations.
Definition: Pass.h:311
Module * getParent()
Get the module that this global value is contained inside of...
Definition: GlobalValue.h:656
instr_iterator instr_begin()
Instructions::iterator instr_iterator
instr_iterator instr_end()
const MachineFunction * getParent() const
Return the MachineFunction containing this basic block.
MachineFunctionPass - This class adapts the FunctionPass interface to allow convenient creation of pa...
virtual bool runOnMachineFunction(MachineFunction &MF)=0
runOnMachineFunction - This method must be overloaded to perform the desired machine code transformat...
const TargetSubtargetInfo & getSubtarget() const
getSubtarget - Return the subtarget for which this machine code is being compiled.
Function & getFunction()
Return the LLVM function that this machine code represents.
Representation of each machine instruction.
Definition: MachineInstr.h:69
A Module instance is used to store all the information related to an LLVM module.
Definition: Module.h:65
virtual StringRef getPassName() const
getPassName - Return a nice clean name for a pass.
Definition: Pass.cpp:81
StringRef - Represent a constant reference to a string, i.e.
Definition: StringRef.h:50
TargetInstrInfo - Interface to description of machine instruction set.
This class defines information used to lower LLVM code to legal SelectionDAG operators that the targe...
self_iterator getIterator()
Definition: ilist_node.h:132
unsigned ID
LLVM IR allows to use arbitrary numbers as calling convention identifiers.
Definition: CallingConv.h:24
This is an optimization pass for GlobalISel generic memory operations.
Definition: AddressRanges.h:18
void finalizeBundle(MachineBasicBlock &MBB, MachineBasicBlock::instr_iterator FirstMI, MachineBasicBlock::instr_iterator LastMI)
finalizeBundle - Finalize a machine instruction bundle which includes a sequence of instructions star...
FunctionPass * createKCFIPass()
Lowers KCFI operand bundles for indirect calls.
Definition: KCFI.cpp:62
void report_fatal_error(Error Err, bool gen_crash_diag=true)
Report a serious error, calling any installed error handler.
Definition: Error.cpp:167