LLVM 19.0.0git
KCFI.cpp
Go to the documentation of this file.
1//===-- KCFI.cpp - Generic KCFI operand bundle lowering ---------*- C++ -*-===//
2//
3// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4// See https://llvm.org/LICENSE.txt for license information.
5// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6//
7//===----------------------------------------------------------------------===//
8//
9// This pass emits generic KCFI indirect call checks for targets that don't
10// support lowering KCFI operand bundles in the back-end.
11//
12//===----------------------------------------------------------------------===//
13
15#include "llvm/ADT/Statistic.h"
16#include "llvm/IR/Constants.h"
19#include "llvm/IR/Function.h"
21#include "llvm/IR/IRBuilder.h"
24#include "llvm/IR/Intrinsics.h"
25#include "llvm/IR/MDBuilder.h"
26#include "llvm/IR/Module.h"
29
30using namespace llvm;
31
32#define DEBUG_TYPE "kcfi"
33
34STATISTIC(NumKCFIChecks, "Number of kcfi operands transformed into checks");
35
36namespace {
37class DiagnosticInfoKCFI : public DiagnosticInfo {
38 const Twine &Msg;
39
40public:
41 DiagnosticInfoKCFI(const Twine &DiagMsg,
43 : DiagnosticInfo(DK_Linker, Severity), Msg(DiagMsg) {}
44 void print(DiagnosticPrinter &DP) const override { DP << Msg; }
45};
46} // namespace
47
49 Module &M = *F.getParent();
50 if (!M.getModuleFlag("kcfi"))
52
53 // Find call instructions with KCFI operand bundles.
55 for (Instruction &I : instructions(F)) {
56 if (auto *CI = dyn_cast<CallInst>(&I))
57 if (CI->getOperandBundle(LLVMContext::OB_kcfi))
58 KCFICalls.push_back(CI);
59 }
60
61 if (KCFICalls.empty())
63
64 LLVMContext &Ctx = M.getContext();
65 // patchable-function-prefix emits nops between the KCFI type identifier
66 // and the function start. As we don't know the size of the emitted nops,
67 // don't allow this attribute with generic lowering.
68 if (F.hasFnAttribute("patchable-function-prefix"))
69 Ctx.diagnose(
70 DiagnosticInfoKCFI("-fpatchable-function-entry=N,M, where M>0 is not "
71 "compatible with -fsanitize=kcfi on this target"));
72
74 MDNode *VeryUnlikelyWeights =
75 MDBuilder(Ctx).createBranchWeights(1, (1U << 20) - 1);
76 Triple T(M.getTargetTriple());
77
78 for (CallInst *CI : KCFICalls) {
79 // Get the expected hash value.
80 const uint32_t ExpectedHash =
81 cast<ConstantInt>(CI->getOperandBundle(LLVMContext::OB_kcfi)->Inputs[0])
82 ->getZExtValue();
83
84 // Drop the KCFI operand bundle.
85 CallBase *Call =
87 assert(Call != CI);
88 Call->copyMetadata(*CI);
89 CI->replaceAllUsesWith(Call);
90 CI->eraseFromParent();
91
92 if (!Call->isIndirectCall())
93 continue;
94
95 // Emit a check and trap if the target hash doesn't match.
96 IRBuilder<> Builder(Call);
97 Value *FuncPtr = Call->getCalledOperand();
98 // ARM uses the least significant bit of the function pointer to select
99 // between ARM and Thumb modes for the callee. Instructions are always
100 // at least 16-bit aligned, so clear the LSB before we compute the hash
101 // location.
102 if (T.isARM() || T.isThumb()) {
103 FuncPtr = Builder.CreateIntToPtr(
104 Builder.CreateAnd(Builder.CreatePtrToInt(FuncPtr, Int32Ty),
105 ConstantInt::get(Int32Ty, -2)),
106 FuncPtr->getType());
107 }
108 Value *HashPtr = Builder.CreateConstInBoundsGEP1_32(Int32Ty, FuncPtr, -1);
109 Value *Test = Builder.CreateICmpNE(Builder.CreateLoad(Int32Ty, HashPtr),
110 ConstantInt::get(Int32Ty, ExpectedHash));
111 Instruction *ThenTerm =
112 SplitBlockAndInsertIfThen(Test, Call, false, VeryUnlikelyWeights);
113 Builder.SetInsertPoint(ThenTerm);
114 Builder.CreateCall(Intrinsic::getDeclaration(&M, Intrinsic::debugtrap));
115 ++NumKCFIChecks;
116 }
117
119}
Expand Atomic instructions
This file contains the declarations for the subclasses of Constant, which represent the different fla...
#define F(x, y, z)
Definition: MD5.cpp:55
#define I(x, y, z)
Definition: MD5.cpp:58
Module.h This file contains the declarations for the Module class.
IntegerType * Int32Ty
assert(ImpDefSCC.getReg()==AMDGPU::SCC &&ImpDefSCC.isDef())
This file defines the 'Statistic' class, which is designed to be an easy way to expose various metric...
#define STATISTIC(VARNAME, DESC)
Definition: Statistic.h:167
A container for analyses that lazily runs them and caches their results.
Definition: PassManager.h:348
Base class for all callable instructions (InvokeInst and CallInst) Holds everything related to callin...
Definition: InstrTypes.h:1455
static CallBase * removeOperandBundle(CallBase *CB, uint32_t ID, Instruction *InsertPt=nullptr)
Create a clone of CB with operand bundle ID removed.
This class represents a function call, abstracting a target machine's calling convention.
This is the base abstract class for diagnostic reporting in the backend.
virtual void print(DiagnosticPrinter &DP) const =0
Print using the given DP a user-friendly message.
Interface for custom diagnostic printing.
Value * CreateIntToPtr(Value *V, Type *DestTy, const Twine &Name="")
Definition: IRBuilder.h:2105
Value * CreateConstInBoundsGEP1_32(Type *Ty, Value *Ptr, unsigned Idx0, const Twine &Name="")
Definition: IRBuilder.h:1890
Value * CreateICmpNE(Value *LHS, Value *RHS, const Twine &Name="")
Definition: IRBuilder.h:2228
LoadInst * CreateLoad(Type *Ty, Value *Ptr, const char *Name)
Provided to resolve 'CreateLoad(Ty, Ptr, "...")' correctly, instead of converting the string to 'bool...
Definition: IRBuilder.h:1789
Value * CreateAnd(Value *LHS, Value *RHS, const Twine &Name="")
Definition: IRBuilder.h:1469
Value * CreatePtrToInt(Value *V, Type *DestTy, const Twine &Name="")
Definition: IRBuilder.h:2100
void SetInsertPoint(BasicBlock *TheBB)
This specifies that created instructions should be appended to the end of the specified block.
Definition: IRBuilder.h:180
CallInst * CreateCall(FunctionType *FTy, Value *Callee, ArrayRef< Value * > Args=std::nullopt, const Twine &Name="", MDNode *FPMathTag=nullptr)
Definition: IRBuilder.h:2395
This provides a uniform API for creating instructions and inserting them into a basic block: either a...
Definition: IRBuilder.h:2649
Class to represent integer types.
Definition: DerivedTypes.h:40
PreservedAnalyses run(Function &F, FunctionAnalysisManager &AM)
Definition: KCFI.cpp:48
This is an important class for using LLVM in a threaded context.
Definition: LLVMContext.h:67
void diagnose(const DiagnosticInfo &DI)
Report a message to the currently installed diagnostic handler.
MDNode * createBranchWeights(uint32_t TrueWeight, uint32_t FalseWeight)
Return metadata containing two branch weights.
Definition: MDBuilder.cpp:37
Metadata node.
Definition: Metadata.h:1067
A Module instance is used to store all the information related to an LLVM module.
Definition: Module.h:65
A set of analyses that are preserved following a run of a transformation pass.
Definition: Analysis.h:109
static PreservedAnalyses none()
Convenience factory function for the empty preserved set.
Definition: Analysis.h:112
static PreservedAnalyses all()
Construct a special preserved set that preserves all passes.
Definition: Analysis.h:115
bool empty() const
Definition: SmallVector.h:94
void push_back(const T &Elt)
Definition: SmallVector.h:426
This is a 'vector' (really, a variable-sized array), optimized for the case when the array is small.
Definition: SmallVector.h:1209
Triple - Helper class for working with autoconf configuration names.
Definition: Triple.h:44
Twine - A lightweight data structure for efficiently representing the concatenation of temporary valu...
Definition: Twine.h:81
static IntegerType * getInt32Ty(LLVMContext &C)
LLVM Value Representation.
Definition: Value.h:74
Type * getType() const
All values are typed, get the type of this value.
Definition: Value.h:255
const CustomOperand< const MCSubtargetInfo & > Msg[]
Function * getDeclaration(Module *M, ID id, ArrayRef< Type * > Tys=std::nullopt)
Create or insert an LLVM Function declaration for an intrinsic, and return it.
Definition: Function.cpp:1447
This is an optimization pass for GlobalISel generic memory operations.
Definition: AddressRanges.h:18
@ DK_Linker
DiagnosticSeverity
Defines the different supported severity of a diagnostic.
@ DS_Error
Instruction * SplitBlockAndInsertIfThen(Value *Cond, BasicBlock::iterator SplitBefore, bool Unreachable, MDNode *BranchWeights=nullptr, DomTreeUpdater *DTU=nullptr, LoopInfo *LI=nullptr, BasicBlock *ThenBlock=nullptr)
Split the containing block at the specified instruction - everything before SplitBefore stays in the ...