Evgeniy Stepanov | 67849d5 | 2015-12-15 23:00:08 +0000 | [diff] [blame] | 1 | //===-- CrossDSOCFI.cpp - Externalize this module's CFI checks ------------===// |
| 2 | // |
Chandler Carruth | 2946cd7 | 2019-01-19 08:50:56 +0000 | [diff] [blame] | 3 | // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions. |
| 4 | // See https://llvm.org/LICENSE.txt for license information. |
| 5 | // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception |
Evgeniy Stepanov | 67849d5 | 2015-12-15 23:00:08 +0000 | [diff] [blame] | 6 | // |
| 7 | //===----------------------------------------------------------------------===// |
| 8 | // |
| 9 | // This pass exports all llvm.bitset's found in the module in the form of a |
| 10 | // __cfi_check function, which can be used to verify cross-DSO call targets. |
| 11 | // |
| 12 | //===----------------------------------------------------------------------===// |
| 13 | |
Davide Italiano | 92b933a | 2016-07-09 03:25:35 +0000 | [diff] [blame] | 14 | #include "llvm/Transforms/IPO/CrossDSOCFI.h" |
Mandeep Singh Grang | e3bbb68 | 2017-08-30 04:47:21 +0000 | [diff] [blame] | 15 | #include "llvm/ADT/SetVector.h" |
Evgeniy Stepanov | 67849d5 | 2015-12-15 23:00:08 +0000 | [diff] [blame] | 16 | #include "llvm/ADT/Statistic.h" |
Evgeniy Stepanov | 4731ad81 | 2017-08-29 22:29:15 +0000 | [diff] [blame] | 17 | #include "llvm/ADT/Triple.h" |
Evgeniy Stepanov | 67849d5 | 2015-12-15 23:00:08 +0000 | [diff] [blame] | 18 | #include "llvm/IR/Constant.h" |
| 19 | #include "llvm/IR/Constants.h" |
| 20 | #include "llvm/IR/Function.h" |
| 21 | #include "llvm/IR/GlobalObject.h" |
| 22 | #include "llvm/IR/GlobalVariable.h" |
| 23 | #include "llvm/IR/IRBuilder.h" |
| 24 | #include "llvm/IR/Instructions.h" |
| 25 | #include "llvm/IR/Intrinsics.h" |
| 26 | #include "llvm/IR/MDBuilder.h" |
| 27 | #include "llvm/IR/Module.h" |
| 28 | #include "llvm/IR/Operator.h" |
Reid Kleckner | 05da2fe | 2019-11-13 13:15:01 -0800 | [diff] [blame^] | 29 | #include "llvm/InitializePasses.h" |
Evgeniy Stepanov | 67849d5 | 2015-12-15 23:00:08 +0000 | [diff] [blame] | 30 | #include "llvm/Pass.h" |
| 31 | #include "llvm/Support/Debug.h" |
| 32 | #include "llvm/Support/raw_ostream.h" |
Davide Italiano | 92b933a | 2016-07-09 03:25:35 +0000 | [diff] [blame] | 33 | #include "llvm/Transforms/IPO.h" |
Evgeniy Stepanov | 67849d5 | 2015-12-15 23:00:08 +0000 | [diff] [blame] | 34 | |
| 35 | using namespace llvm; |
| 36 | |
| 37 | #define DEBUG_TYPE "cross-dso-cfi" |
| 38 | |
Peter Collingbourne | 7efd7506 | 2016-06-24 21:21:32 +0000 | [diff] [blame] | 39 | STATISTIC(NumTypeIds, "Number of unique type identifiers"); |
Evgeniy Stepanov | 67849d5 | 2015-12-15 23:00:08 +0000 | [diff] [blame] | 40 | |
| 41 | namespace { |
| 42 | |
| 43 | struct CrossDSOCFI : public ModulePass { |
| 44 | static char ID; |
| 45 | CrossDSOCFI() : ModulePass(ID) { |
| 46 | initializeCrossDSOCFIPass(*PassRegistry::getPassRegistry()); |
| 47 | } |
| 48 | |
Evgeniy Stepanov | 67849d5 | 2015-12-15 23:00:08 +0000 | [diff] [blame] | 49 | MDNode *VeryLikelyWeights; |
| 50 | |
Peter Collingbourne | 7efd7506 | 2016-06-24 21:21:32 +0000 | [diff] [blame] | 51 | ConstantInt *extractNumericTypeId(MDNode *MD); |
Davide Italiano | b4b9db8 | 2016-07-08 19:30:06 +0000 | [diff] [blame] | 52 | void buildCFICheck(Module &M); |
Evgeniy Stepanov | 67849d5 | 2015-12-15 23:00:08 +0000 | [diff] [blame] | 53 | bool runOnModule(Module &M) override; |
| 54 | }; |
| 55 | |
| 56 | } // anonymous namespace |
| 57 | |
| 58 | INITIALIZE_PASS_BEGIN(CrossDSOCFI, "cross-dso-cfi", "Cross-DSO CFI", false, |
| 59 | false) |
| 60 | INITIALIZE_PASS_END(CrossDSOCFI, "cross-dso-cfi", "Cross-DSO CFI", false, false) |
| 61 | char CrossDSOCFI::ID = 0; |
| 62 | |
| 63 | ModulePass *llvm::createCrossDSOCFIPass() { return new CrossDSOCFI; } |
| 64 | |
Peter Collingbourne | 7efd7506 | 2016-06-24 21:21:32 +0000 | [diff] [blame] | 65 | /// Extracts a numeric type identifier from an MDNode containing type metadata. |
| 66 | ConstantInt *CrossDSOCFI::extractNumericTypeId(MDNode *MD) { |
Evgeniy Stepanov | 67849d5 | 2015-12-15 23:00:08 +0000 | [diff] [blame] | 67 | // This check excludes vtables for classes inside anonymous namespaces. |
Peter Collingbourne | 7efd7506 | 2016-06-24 21:21:32 +0000 | [diff] [blame] | 68 | auto TM = dyn_cast<ValueAsMetadata>(MD->getOperand(1)); |
Evgeniy Stepanov | 67849d5 | 2015-12-15 23:00:08 +0000 | [diff] [blame] | 69 | if (!TM) |
| 70 | return nullptr; |
| 71 | auto C = dyn_cast_or_null<ConstantInt>(TM->getValue()); |
| 72 | if (!C) return nullptr; |
| 73 | // We are looking for i64 constants. |
| 74 | if (C->getBitWidth() != 64) return nullptr; |
| 75 | |
Evgeniy Stepanov | 67849d5 | 2015-12-15 23:00:08 +0000 | [diff] [blame] | 76 | return C; |
| 77 | } |
| 78 | |
| 79 | /// buildCFICheck - emits __cfi_check for the current module. |
Davide Italiano | b4b9db8 | 2016-07-08 19:30:06 +0000 | [diff] [blame] | 80 | void CrossDSOCFI::buildCFICheck(Module &M) { |
Evgeniy Stepanov | 67849d5 | 2015-12-15 23:00:08 +0000 | [diff] [blame] | 81 | // FIXME: verify that __cfi_check ends up near the end of the code section, |
Peter Collingbourne | 7efd7506 | 2016-06-24 21:21:32 +0000 | [diff] [blame] | 82 | // but before the jump slots created in LowerTypeTests. |
Mandeep Singh Grang | e3bbb68 | 2017-08-30 04:47:21 +0000 | [diff] [blame] | 83 | SetVector<uint64_t> TypeIds; |
Peter Collingbourne | 7efd7506 | 2016-06-24 21:21:32 +0000 | [diff] [blame] | 84 | SmallVector<MDNode *, 2> Types; |
Davide Italiano | b4b9db8 | 2016-07-08 19:30:06 +0000 | [diff] [blame] | 85 | for (GlobalObject &GO : M.global_objects()) { |
Peter Collingbourne | 7efd7506 | 2016-06-24 21:21:32 +0000 | [diff] [blame] | 86 | Types.clear(); |
| 87 | GO.getMetadata(LLVMContext::MD_type, Types); |
Peter Collingbourne | 0e497d1 | 2019-08-09 22:31:59 +0000 | [diff] [blame] | 88 | for (MDNode *Type : Types) |
Peter Collingbourne | 7efd7506 | 2016-06-24 21:21:32 +0000 | [diff] [blame] | 89 | if (ConstantInt *TypeId = extractNumericTypeId(Type)) |
| 90 | TypeIds.insert(TypeId->getZExtValue()); |
Peter Collingbourne | 7efd7506 | 2016-06-24 21:21:32 +0000 | [diff] [blame] | 91 | } |
Evgeniy Stepanov | 67849d5 | 2015-12-15 23:00:08 +0000 | [diff] [blame] | 92 | |
Evgeniy Stepanov | 4d4ee93 | 2017-06-16 00:18:29 +0000 | [diff] [blame] | 93 | NamedMDNode *CfiFunctionsMD = M.getNamedMetadata("cfi.functions"); |
| 94 | if (CfiFunctionsMD) { |
| 95 | for (auto Func : CfiFunctionsMD->operands()) { |
| 96 | assert(Func->getNumOperands() >= 2); |
| 97 | for (unsigned I = 2; I < Func->getNumOperands(); ++I) |
| 98 | if (ConstantInt *TypeId = |
| 99 | extractNumericTypeId(cast<MDNode>(Func->getOperand(I).get()))) |
| 100 | TypeIds.insert(TypeId->getZExtValue()); |
| 101 | } |
| 102 | } |
| 103 | |
Davide Italiano | b4b9db8 | 2016-07-08 19:30:06 +0000 | [diff] [blame] | 104 | LLVMContext &Ctx = M.getContext(); |
James Y Knight | 1368022 | 2019-02-01 02:28:03 +0000 | [diff] [blame] | 105 | FunctionCallee C = M.getOrInsertFunction( |
Evgeniy Stepanov | fbc3da5 | 2016-01-25 23:35:03 +0000 | [diff] [blame] | 106 | "__cfi_check", Type::getVoidTy(Ctx), Type::getInt64Ty(Ctx), |
Serge Guelton | 59a2d7b | 2017-04-11 15:01:18 +0000 | [diff] [blame] | 107 | Type::getInt8PtrTy(Ctx), Type::getInt8PtrTy(Ctx)); |
Simon Pilgrim | 10d4b75 | 2019-10-21 17:15:25 +0000 | [diff] [blame] | 108 | Function *F = cast<Function>(C.getCallee()); |
Evgeniy Stepanov | 349adba | 2017-04-07 23:00:20 +0000 | [diff] [blame] | 109 | // Take over the existing function. The frontend emits a weak stub so that the |
| 110 | // linker knows about the symbol; this pass replaces the function body. |
| 111 | F->deleteBody(); |
Guillaume Chatelet | 0e62011 | 2019-10-15 11:24:36 +0000 | [diff] [blame] | 112 | F->setAlignment(Align(4096)); |
Evgeniy Stepanov | 4731ad81 | 2017-08-29 22:29:15 +0000 | [diff] [blame] | 113 | |
| 114 | Triple T(M.getTargetTriple()); |
| 115 | if (T.isARM() || T.isThumb()) |
| 116 | F->addFnAttr("target-features", "+thumb-mode"); |
| 117 | |
Evgeniy Stepanov | 67849d5 | 2015-12-15 23:00:08 +0000 | [diff] [blame] | 118 | auto args = F->arg_begin(); |
Evgeniy Stepanov | fbc3da5 | 2016-01-25 23:35:03 +0000 | [diff] [blame] | 119 | Value &CallSiteTypeId = *(args++); |
Evgeniy Stepanov | 67849d5 | 2015-12-15 23:00:08 +0000 | [diff] [blame] | 120 | CallSiteTypeId.setName("CallSiteTypeId"); |
Evgeniy Stepanov | fbc3da5 | 2016-01-25 23:35:03 +0000 | [diff] [blame] | 121 | Value &Addr = *(args++); |
Evgeniy Stepanov | 67849d5 | 2015-12-15 23:00:08 +0000 | [diff] [blame] | 122 | Addr.setName("Addr"); |
Evgeniy Stepanov | fbc3da5 | 2016-01-25 23:35:03 +0000 | [diff] [blame] | 123 | Value &CFICheckFailData = *(args++); |
| 124 | CFICheckFailData.setName("CFICheckFailData"); |
Evgeniy Stepanov | 67849d5 | 2015-12-15 23:00:08 +0000 | [diff] [blame] | 125 | assert(args == F->arg_end()); |
| 126 | |
| 127 | BasicBlock *BB = BasicBlock::Create(Ctx, "entry", F); |
Evgeniy Stepanov | 67849d5 | 2015-12-15 23:00:08 +0000 | [diff] [blame] | 128 | BasicBlock *ExitBB = BasicBlock::Create(Ctx, "exit", F); |
Evgeniy Stepanov | fbc3da5 | 2016-01-25 23:35:03 +0000 | [diff] [blame] | 129 | |
| 130 | BasicBlock *TrapBB = BasicBlock::Create(Ctx, "fail", F); |
| 131 | IRBuilder<> IRBFail(TrapBB); |
James Y Knight | 1368022 | 2019-02-01 02:28:03 +0000 | [diff] [blame] | 132 | FunctionCallee CFICheckFailFn = |
| 133 | M.getOrInsertFunction("__cfi_check_fail", Type::getVoidTy(Ctx), |
| 134 | Type::getInt8PtrTy(Ctx), Type::getInt8PtrTy(Ctx)); |
Evgeniy Stepanov | fbc3da5 | 2016-01-25 23:35:03 +0000 | [diff] [blame] | 135 | IRBFail.CreateCall(CFICheckFailFn, {&CFICheckFailData, &Addr}); |
| 136 | IRBFail.CreateBr(ExitBB); |
| 137 | |
Evgeniy Stepanov | 67849d5 | 2015-12-15 23:00:08 +0000 | [diff] [blame] | 138 | IRBuilder<> IRBExit(ExitBB); |
| 139 | IRBExit.CreateRetVoid(); |
| 140 | |
| 141 | IRBuilder<> IRB(BB); |
Peter Collingbourne | 7efd7506 | 2016-06-24 21:21:32 +0000 | [diff] [blame] | 142 | SwitchInst *SI = IRB.CreateSwitch(&CallSiteTypeId, TrapBB, TypeIds.size()); |
| 143 | for (uint64_t TypeId : TypeIds) { |
Evgeniy Stepanov | 67849d5 | 2015-12-15 23:00:08 +0000 | [diff] [blame] | 144 | ConstantInt *CaseTypeId = ConstantInt::get(Type::getInt64Ty(Ctx), TypeId); |
| 145 | BasicBlock *TestBB = BasicBlock::Create(Ctx, "test", F); |
| 146 | IRBuilder<> IRBTest(TestBB); |
Davide Italiano | b4b9db8 | 2016-07-08 19:30:06 +0000 | [diff] [blame] | 147 | Function *BitsetTestFn = Intrinsic::getDeclaration(&M, Intrinsic::type_test); |
Evgeniy Stepanov | 67849d5 | 2015-12-15 23:00:08 +0000 | [diff] [blame] | 148 | |
| 149 | Value *Test = IRBTest.CreateCall( |
| 150 | BitsetTestFn, {&Addr, MetadataAsValue::get( |
| 151 | Ctx, ConstantAsMetadata::get(CaseTypeId))}); |
| 152 | BranchInst *BI = IRBTest.CreateCondBr(Test, ExitBB, TrapBB); |
| 153 | BI->setMetadata(LLVMContext::MD_prof, VeryLikelyWeights); |
| 154 | |
| 155 | SI->addCase(CaseTypeId, TestBB); |
Peter Collingbourne | 7efd7506 | 2016-06-24 21:21:32 +0000 | [diff] [blame] | 156 | ++NumTypeIds; |
Evgeniy Stepanov | 67849d5 | 2015-12-15 23:00:08 +0000 | [diff] [blame] | 157 | } |
| 158 | } |
| 159 | |
| 160 | bool CrossDSOCFI::runOnModule(Module &M) { |
Davide Italiano | b4b9db8 | 2016-07-08 19:30:06 +0000 | [diff] [blame] | 161 | VeryLikelyWeights = |
| 162 | MDBuilder(M.getContext()).createBranchWeights((1U << 20) - 1, 1); |
Evgeniy Stepanov | 67849d5 | 2015-12-15 23:00:08 +0000 | [diff] [blame] | 163 | if (M.getModuleFlag("Cross-DSO CFI") == nullptr) |
| 164 | return false; |
Davide Italiano | b4b9db8 | 2016-07-08 19:30:06 +0000 | [diff] [blame] | 165 | buildCFICheck(M); |
Evgeniy Stepanov | 67849d5 | 2015-12-15 23:00:08 +0000 | [diff] [blame] | 166 | return true; |
| 167 | } |
Davide Italiano | 92b933a | 2016-07-09 03:25:35 +0000 | [diff] [blame] | 168 | |
Sean Silva | fd03ac6 | 2016-08-09 00:28:38 +0000 | [diff] [blame] | 169 | PreservedAnalyses CrossDSOCFIPass::run(Module &M, ModuleAnalysisManager &AM) { |
Davide Italiano | 92b933a | 2016-07-09 03:25:35 +0000 | [diff] [blame] | 170 | CrossDSOCFI Impl; |
| 171 | bool Changed = Impl.runOnModule(M); |
| 172 | if (!Changed) |
| 173 | return PreservedAnalyses::all(); |
| 174 | return PreservedAnalyses::none(); |
| 175 | } |