1 //===-- CrossDSOCFI.cpp - Externalize this module's CFI checks ------------===//
2 //
3 // The LLVM Compiler Infrastructure
4 //
5 // This file is distributed under the University of Illinois Open Source
6 // License. See LICENSE.TXT for details.
7 //
8 //===----------------------------------------------------------------------===//
9 //
10 // This pass exports all llvm.bitset's found in the module in the form of a
11 // __cfi_check function, which can be used to verify cross-DSO call targets.
12 //
13 //===----------------------------------------------------------------------===//
14
15 #include "llvm/Transforms/IPO/CrossDSOCFI.h"
16 #include "llvm/ADT/SetVector.h"
17 #include "llvm/ADT/Statistic.h"
18 #include "llvm/ADT/Triple.h"
19 #include "llvm/IR/Constant.h"
20 #include "llvm/IR/Constants.h"
21 #include "llvm/IR/Function.h"
22 #include "llvm/IR/GlobalObject.h"
23 #include "llvm/IR/GlobalVariable.h"
24 #include "llvm/IR/IRBuilder.h"
25 #include "llvm/IR/Instructions.h"
26 #include "llvm/IR/Intrinsics.h"
27 #include "llvm/IR/MDBuilder.h"
28 #include "llvm/IR/Module.h"
29 #include "llvm/IR/Operator.h"
30 #include "llvm/Pass.h"
31 #include "llvm/Support/Debug.h"
32 #include "llvm/Support/raw_ostream.h"
33 #include "llvm/Transforms/IPO.h"
34
35 using namespace llvm;
36
37 #define DEBUG_TYPE "cross-dso-cfi"
38
39 STATISTIC(NumTypeIds, "Number of unique type identifiers");
40
41 namespace {
42
43 struct CrossDSOCFI : public ModulePass {
44 static char ID;
CrossDSOCFI__anon71f115810111::CrossDSOCFI45 CrossDSOCFI() : ModulePass(ID) {
46 initializeCrossDSOCFIPass(*PassRegistry::getPassRegistry());
47 }
48
49 MDNode *VeryLikelyWeights;
50
51 ConstantInt *extractNumericTypeId(MDNode *MD);
52 void buildCFICheck(Module &M);
53 bool runOnModule(Module &M) override;
54 };
55
56 } // anonymous namespace
57
58 INITIALIZE_PASS_BEGIN(CrossDSOCFI, "cross-dso-cfi", "Cross-DSO CFI", false,
59 false)
60 INITIALIZE_PASS_END(CrossDSOCFI, "cross-dso-cfi", "Cross-DSO CFI", false, false)
61 char CrossDSOCFI::ID = 0;
62
createCrossDSOCFIPass()63 ModulePass *llvm::createCrossDSOCFIPass() { return new CrossDSOCFI; }
64
65 /// Extracts a numeric type identifier from an MDNode containing type metadata.
extractNumericTypeId(MDNode * MD)66 ConstantInt *CrossDSOCFI::extractNumericTypeId(MDNode *MD) {
67 // This check excludes vtables for classes inside anonymous namespaces.
68 auto TM = dyn_cast<ValueAsMetadata>(MD->getOperand(1));
69 if (!TM)
70 return nullptr;
71 auto C = dyn_cast_or_null<ConstantInt>(TM->getValue());
72 if (!C) return nullptr;
73 // We are looking for i64 constants.
74 if (C->getBitWidth() != 64) return nullptr;
75
76 return C;
77 }
78
79 /// buildCFICheck - emits __cfi_check for the current module.
buildCFICheck(Module & M)80 void CrossDSOCFI::buildCFICheck(Module &M) {
81 // FIXME: verify that __cfi_check ends up near the end of the code section,
82 // but before the jump slots created in LowerTypeTests.
83 SetVector<uint64_t> TypeIds;
84 SmallVector<MDNode *, 2> Types;
85 for (GlobalObject &GO : M.global_objects()) {
86 Types.clear();
87 GO.getMetadata(LLVMContext::MD_type, Types);
88 for (MDNode *Type : Types) {
89 // Sanity check. GO must not be a function declaration.
90 assert(!isa<Function>(&GO) || !cast<Function>(&GO)->isDeclaration());
91
92 if (ConstantInt *TypeId = extractNumericTypeId(Type))
93 TypeIds.insert(TypeId->getZExtValue());
94 }
95 }
96
97 NamedMDNode *CfiFunctionsMD = M.getNamedMetadata("cfi.functions");
98 if (CfiFunctionsMD) {
99 for (auto Func : CfiFunctionsMD->operands()) {
100 assert(Func->getNumOperands() >= 2);
101 for (unsigned I = 2; I < Func->getNumOperands(); ++I)
102 if (ConstantInt *TypeId =
103 extractNumericTypeId(cast<MDNode>(Func->getOperand(I).get())))
104 TypeIds.insert(TypeId->getZExtValue());
105 }
106 }
107
108 LLVMContext &Ctx = M.getContext();
109 Constant *C = M.getOrInsertFunction(
110 "__cfi_check", Type::getVoidTy(Ctx), Type::getInt64Ty(Ctx),
111 Type::getInt8PtrTy(Ctx), Type::getInt8PtrTy(Ctx));
112 Function *F = dyn_cast<Function>(C);
113 // Take over the existing function. The frontend emits a weak stub so that the
114 // linker knows about the symbol; this pass replaces the function body.
115 F->deleteBody();
116 F->setAlignment(4096);
117
118 Triple T(M.getTargetTriple());
119 if (T.isARM() || T.isThumb())
120 F->addFnAttr("target-features", "+thumb-mode");
121
122 auto args = F->arg_begin();
123 Value &CallSiteTypeId = *(args++);
124 CallSiteTypeId.setName("CallSiteTypeId");
125 Value &Addr = *(args++);
126 Addr.setName("Addr");
127 Value &CFICheckFailData = *(args++);
128 CFICheckFailData.setName("CFICheckFailData");
129 assert(args == F->arg_end());
130
131 BasicBlock *BB = BasicBlock::Create(Ctx, "entry", F);
132 BasicBlock *ExitBB = BasicBlock::Create(Ctx, "exit", F);
133
134 BasicBlock *TrapBB = BasicBlock::Create(Ctx, "fail", F);
135 IRBuilder<> IRBFail(TrapBB);
136 Constant *CFICheckFailFn = M.getOrInsertFunction(
137 "__cfi_check_fail", Type::getVoidTy(Ctx), Type::getInt8PtrTy(Ctx),
138 Type::getInt8PtrTy(Ctx));
139 IRBFail.CreateCall(CFICheckFailFn, {&CFICheckFailData, &Addr});
140 IRBFail.CreateBr(ExitBB);
141
142 IRBuilder<> IRBExit(ExitBB);
143 IRBExit.CreateRetVoid();
144
145 IRBuilder<> IRB(BB);
146 SwitchInst *SI = IRB.CreateSwitch(&CallSiteTypeId, TrapBB, TypeIds.size());
147 for (uint64_t TypeId : TypeIds) {
148 ConstantInt *CaseTypeId = ConstantInt::get(Type::getInt64Ty(Ctx), TypeId);
149 BasicBlock *TestBB = BasicBlock::Create(Ctx, "test", F);
150 IRBuilder<> IRBTest(TestBB);
151 Function *BitsetTestFn = Intrinsic::getDeclaration(&M, Intrinsic::type_test);
152
153 Value *Test = IRBTest.CreateCall(
154 BitsetTestFn, {&Addr, MetadataAsValue::get(
155 Ctx, ConstantAsMetadata::get(CaseTypeId))});
156 BranchInst *BI = IRBTest.CreateCondBr(Test, ExitBB, TrapBB);
157 BI->setMetadata(LLVMContext::MD_prof, VeryLikelyWeights);
158
159 SI->addCase(CaseTypeId, TestBB);
160 ++NumTypeIds;
161 }
162 }
163
runOnModule(Module & M)164 bool CrossDSOCFI::runOnModule(Module &M) {
165 VeryLikelyWeights =
166 MDBuilder(M.getContext()).createBranchWeights((1U << 20) - 1, 1);
167 if (M.getModuleFlag("Cross-DSO CFI") == nullptr)
168 return false;
169 buildCFICheck(M);
170 return true;
171 }
172
run(Module & M,ModuleAnalysisManager & AM)173 PreservedAnalyses CrossDSOCFIPass::run(Module &M, ModuleAnalysisManager &AM) {
174 CrossDSOCFI Impl;
175 bool Changed = Impl.runOnModule(M);
176 if (!Changed)
177 return PreservedAnalyses::all();
178 return PreservedAnalyses::none();
179 }
180