blob: 2fe9a59ad210ed7780972504d6b7b03ea88fa43e [file] [log] [blame]
Evgeniy Stepanov67849d52015-12-15 23:00:08 +00001//===-- CrossDSOCFI.cpp - Externalize this module's CFI checks ------------===//
2//
Chandler Carruth2946cd72019-01-19 08:50:56 +00003// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4// See https://llvm.org/LICENSE.txt for license information.
5// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
Evgeniy Stepanov67849d52015-12-15 23:00:08 +00006//
7//===----------------------------------------------------------------------===//
8//
9// This pass exports all llvm.bitset's found in the module in the form of a
10// __cfi_check function, which can be used to verify cross-DSO call targets.
11//
12//===----------------------------------------------------------------------===//
13
Davide Italiano92b933a2016-07-09 03:25:35 +000014#include "llvm/Transforms/IPO/CrossDSOCFI.h"
Mandeep Singh Grange3bbb682017-08-30 04:47:21 +000015#include "llvm/ADT/SetVector.h"
Evgeniy Stepanov67849d52015-12-15 23:00:08 +000016#include "llvm/ADT/Statistic.h"
Evgeniy Stepanov4731ad812017-08-29 22:29:15 +000017#include "llvm/ADT/Triple.h"
Evgeniy Stepanov67849d52015-12-15 23:00:08 +000018#include "llvm/IR/Constant.h"
19#include "llvm/IR/Constants.h"
20#include "llvm/IR/Function.h"
21#include "llvm/IR/GlobalObject.h"
22#include "llvm/IR/GlobalVariable.h"
23#include "llvm/IR/IRBuilder.h"
24#include "llvm/IR/Instructions.h"
25#include "llvm/IR/Intrinsics.h"
26#include "llvm/IR/MDBuilder.h"
27#include "llvm/IR/Module.h"
28#include "llvm/IR/Operator.h"
Reid Kleckner05da2fe2019-11-13 13:15:01 -080029#include "llvm/InitializePasses.h"
Evgeniy Stepanov67849d52015-12-15 23:00:08 +000030#include "llvm/Pass.h"
31#include "llvm/Support/Debug.h"
32#include "llvm/Support/raw_ostream.h"
Davide Italiano92b933a2016-07-09 03:25:35 +000033#include "llvm/Transforms/IPO.h"
Evgeniy Stepanov67849d52015-12-15 23:00:08 +000034
35using namespace llvm;
36
37#define DEBUG_TYPE "cross-dso-cfi"
38
Peter Collingbourne7efd75062016-06-24 21:21:32 +000039STATISTIC(NumTypeIds, "Number of unique type identifiers");
Evgeniy Stepanov67849d52015-12-15 23:00:08 +000040
41namespace {
42
43struct CrossDSOCFI : public ModulePass {
44 static char ID;
45 CrossDSOCFI() : ModulePass(ID) {
46 initializeCrossDSOCFIPass(*PassRegistry::getPassRegistry());
47 }
48
Evgeniy Stepanov67849d52015-12-15 23:00:08 +000049 MDNode *VeryLikelyWeights;
50
Peter Collingbourne7efd75062016-06-24 21:21:32 +000051 ConstantInt *extractNumericTypeId(MDNode *MD);
Davide Italianob4b9db82016-07-08 19:30:06 +000052 void buildCFICheck(Module &M);
Evgeniy Stepanov67849d52015-12-15 23:00:08 +000053 bool runOnModule(Module &M) override;
54};
55
56} // anonymous namespace
57
58INITIALIZE_PASS_BEGIN(CrossDSOCFI, "cross-dso-cfi", "Cross-DSO CFI", false,
59 false)
60INITIALIZE_PASS_END(CrossDSOCFI, "cross-dso-cfi", "Cross-DSO CFI", false, false)
61char CrossDSOCFI::ID = 0;
62
63ModulePass *llvm::createCrossDSOCFIPass() { return new CrossDSOCFI; }
64
Peter Collingbourne7efd75062016-06-24 21:21:32 +000065/// Extracts a numeric type identifier from an MDNode containing type metadata.
66ConstantInt *CrossDSOCFI::extractNumericTypeId(MDNode *MD) {
Evgeniy Stepanov67849d52015-12-15 23:00:08 +000067 // This check excludes vtables for classes inside anonymous namespaces.
Peter Collingbourne7efd75062016-06-24 21:21:32 +000068 auto TM = dyn_cast<ValueAsMetadata>(MD->getOperand(1));
Evgeniy Stepanov67849d52015-12-15 23:00:08 +000069 if (!TM)
70 return nullptr;
71 auto C = dyn_cast_or_null<ConstantInt>(TM->getValue());
72 if (!C) return nullptr;
73 // We are looking for i64 constants.
74 if (C->getBitWidth() != 64) return nullptr;
75
Evgeniy Stepanov67849d52015-12-15 23:00:08 +000076 return C;
77}
78
79/// buildCFICheck - emits __cfi_check for the current module.
Davide Italianob4b9db82016-07-08 19:30:06 +000080void CrossDSOCFI::buildCFICheck(Module &M) {
Evgeniy Stepanov67849d52015-12-15 23:00:08 +000081 // FIXME: verify that __cfi_check ends up near the end of the code section,
Peter Collingbourne7efd75062016-06-24 21:21:32 +000082 // but before the jump slots created in LowerTypeTests.
Mandeep Singh Grange3bbb682017-08-30 04:47:21 +000083 SetVector<uint64_t> TypeIds;
Peter Collingbourne7efd75062016-06-24 21:21:32 +000084 SmallVector<MDNode *, 2> Types;
Davide Italianob4b9db82016-07-08 19:30:06 +000085 for (GlobalObject &GO : M.global_objects()) {
Peter Collingbourne7efd75062016-06-24 21:21:32 +000086 Types.clear();
87 GO.getMetadata(LLVMContext::MD_type, Types);
Peter Collingbourne0e497d12019-08-09 22:31:59 +000088 for (MDNode *Type : Types)
Peter Collingbourne7efd75062016-06-24 21:21:32 +000089 if (ConstantInt *TypeId = extractNumericTypeId(Type))
90 TypeIds.insert(TypeId->getZExtValue());
Peter Collingbourne7efd75062016-06-24 21:21:32 +000091 }
Evgeniy Stepanov67849d52015-12-15 23:00:08 +000092
Evgeniy Stepanov4d4ee932017-06-16 00:18:29 +000093 NamedMDNode *CfiFunctionsMD = M.getNamedMetadata("cfi.functions");
94 if (CfiFunctionsMD) {
95 for (auto Func : CfiFunctionsMD->operands()) {
96 assert(Func->getNumOperands() >= 2);
97 for (unsigned I = 2; I < Func->getNumOperands(); ++I)
98 if (ConstantInt *TypeId =
99 extractNumericTypeId(cast<MDNode>(Func->getOperand(I).get())))
100 TypeIds.insert(TypeId->getZExtValue());
101 }
102 }
103
Davide Italianob4b9db82016-07-08 19:30:06 +0000104 LLVMContext &Ctx = M.getContext();
James Y Knight13680222019-02-01 02:28:03 +0000105 FunctionCallee C = M.getOrInsertFunction(
Evgeniy Stepanovfbc3da52016-01-25 23:35:03 +0000106 "__cfi_check", Type::getVoidTy(Ctx), Type::getInt64Ty(Ctx),
Serge Guelton59a2d7b2017-04-11 15:01:18 +0000107 Type::getInt8PtrTy(Ctx), Type::getInt8PtrTy(Ctx));
Simon Pilgrim10d4b752019-10-21 17:15:25 +0000108 Function *F = cast<Function>(C.getCallee());
Evgeniy Stepanov349adba2017-04-07 23:00:20 +0000109 // Take over the existing function. The frontend emits a weak stub so that the
110 // linker knows about the symbol; this pass replaces the function body.
111 F->deleteBody();
Guillaume Chatelet0e620112019-10-15 11:24:36 +0000112 F->setAlignment(Align(4096));
Evgeniy Stepanov4731ad812017-08-29 22:29:15 +0000113
114 Triple T(M.getTargetTriple());
115 if (T.isARM() || T.isThumb())
116 F->addFnAttr("target-features", "+thumb-mode");
117
Evgeniy Stepanov67849d52015-12-15 23:00:08 +0000118 auto args = F->arg_begin();
Evgeniy Stepanovfbc3da52016-01-25 23:35:03 +0000119 Value &CallSiteTypeId = *(args++);
Evgeniy Stepanov67849d52015-12-15 23:00:08 +0000120 CallSiteTypeId.setName("CallSiteTypeId");
Evgeniy Stepanovfbc3da52016-01-25 23:35:03 +0000121 Value &Addr = *(args++);
Evgeniy Stepanov67849d52015-12-15 23:00:08 +0000122 Addr.setName("Addr");
Evgeniy Stepanovfbc3da52016-01-25 23:35:03 +0000123 Value &CFICheckFailData = *(args++);
124 CFICheckFailData.setName("CFICheckFailData");
Evgeniy Stepanov67849d52015-12-15 23:00:08 +0000125 assert(args == F->arg_end());
126
127 BasicBlock *BB = BasicBlock::Create(Ctx, "entry", F);
Evgeniy Stepanov67849d52015-12-15 23:00:08 +0000128 BasicBlock *ExitBB = BasicBlock::Create(Ctx, "exit", F);
Evgeniy Stepanovfbc3da52016-01-25 23:35:03 +0000129
130 BasicBlock *TrapBB = BasicBlock::Create(Ctx, "fail", F);
131 IRBuilder<> IRBFail(TrapBB);
James Y Knight13680222019-02-01 02:28:03 +0000132 FunctionCallee CFICheckFailFn =
133 M.getOrInsertFunction("__cfi_check_fail", Type::getVoidTy(Ctx),
134 Type::getInt8PtrTy(Ctx), Type::getInt8PtrTy(Ctx));
Evgeniy Stepanovfbc3da52016-01-25 23:35:03 +0000135 IRBFail.CreateCall(CFICheckFailFn, {&CFICheckFailData, &Addr});
136 IRBFail.CreateBr(ExitBB);
137
Evgeniy Stepanov67849d52015-12-15 23:00:08 +0000138 IRBuilder<> IRBExit(ExitBB);
139 IRBExit.CreateRetVoid();
140
141 IRBuilder<> IRB(BB);
Peter Collingbourne7efd75062016-06-24 21:21:32 +0000142 SwitchInst *SI = IRB.CreateSwitch(&CallSiteTypeId, TrapBB, TypeIds.size());
143 for (uint64_t TypeId : TypeIds) {
Evgeniy Stepanov67849d52015-12-15 23:00:08 +0000144 ConstantInt *CaseTypeId = ConstantInt::get(Type::getInt64Ty(Ctx), TypeId);
145 BasicBlock *TestBB = BasicBlock::Create(Ctx, "test", F);
146 IRBuilder<> IRBTest(TestBB);
Davide Italianob4b9db82016-07-08 19:30:06 +0000147 Function *BitsetTestFn = Intrinsic::getDeclaration(&M, Intrinsic::type_test);
Evgeniy Stepanov67849d52015-12-15 23:00:08 +0000148
149 Value *Test = IRBTest.CreateCall(
150 BitsetTestFn, {&Addr, MetadataAsValue::get(
151 Ctx, ConstantAsMetadata::get(CaseTypeId))});
152 BranchInst *BI = IRBTest.CreateCondBr(Test, ExitBB, TrapBB);
153 BI->setMetadata(LLVMContext::MD_prof, VeryLikelyWeights);
154
155 SI->addCase(CaseTypeId, TestBB);
Peter Collingbourne7efd75062016-06-24 21:21:32 +0000156 ++NumTypeIds;
Evgeniy Stepanov67849d52015-12-15 23:00:08 +0000157 }
158}
159
160bool CrossDSOCFI::runOnModule(Module &M) {
Davide Italianob4b9db82016-07-08 19:30:06 +0000161 VeryLikelyWeights =
162 MDBuilder(M.getContext()).createBranchWeights((1U << 20) - 1, 1);
Evgeniy Stepanov67849d52015-12-15 23:00:08 +0000163 if (M.getModuleFlag("Cross-DSO CFI") == nullptr)
164 return false;
Davide Italianob4b9db82016-07-08 19:30:06 +0000165 buildCFICheck(M);
Evgeniy Stepanov67849d52015-12-15 23:00:08 +0000166 return true;
167}
Davide Italiano92b933a2016-07-09 03:25:35 +0000168
Sean Silvafd03ac62016-08-09 00:28:38 +0000169PreservedAnalyses CrossDSOCFIPass::run(Module &M, ModuleAnalysisManager &AM) {
Davide Italiano92b933a2016-07-09 03:25:35 +0000170 CrossDSOCFI Impl;
171 bool Changed = Impl.runOnModule(M);
172 if (!Changed)
173 return PreservedAnalyses::all();
174 return PreservedAnalyses::none();
175}