1//===---- KCFI.cpp - Implements Kernel Control-Flow Integrity (KCFI) ------===//
2//
3// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4// See https://llvm.org/LICENSE.txt for license information.
5// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6//
7//===----------------------------------------------------------------------===//
8//
9// This pass implements Kernel Control-Flow Integrity (KCFI) indirect call
10// check lowering. For each call instruction with a cfi-type attribute, it
11// emits an arch-specific check before the call, and bundles the check and
12// the call to prevent unintentional modifications.
13//
14//===----------------------------------------------------------------------===//
15
16#include "llvm/CodeGen/KCFI.h"
17#include "llvm/ADT/Statistic.h"
18#include "llvm/CodeGen/MachineFunctionPass.h"
19#include "llvm/CodeGen/MachineInstrBundle.h"
20#include "llvm/CodeGen/MachineModuleInfo.h"
21#include "llvm/CodeGen/RegisterClassInfo.h"
22#include "llvm/CodeGen/TargetInstrInfo.h"
23#include "llvm/CodeGen/TargetLowering.h"
24#include "llvm/CodeGen/TargetSubtargetInfo.h"
25#include "llvm/IR/Module.h"
26#include "llvm/InitializePasses.h"
27
28using namespace llvm;
29
30#define DEBUG_TYPE "kcfi"
31#define KCFI_PASS_NAME "Insert KCFI indirect call checks"
32
33STATISTIC(NumKCFIChecksAdded, "Number of indirect call checks added");
34
35namespace {
36class KCFI {
37public:
38 bool run(MachineFunction &MF);
39
40private:
41 /// Machine instruction info used throughout the class.
42 const TargetInstrInfo *TII = nullptr;
43
44 /// Target lowering for arch-specific parts.
45 const TargetLowering *TLI = nullptr;
46
47 /// Emits a KCFI check before an indirect call.
48 /// \returns true if the check was added and false otherwise.
49 bool emitCheck(MachineBasicBlock &MBB,
50 MachineBasicBlock::instr_iterator I) const;
51};
52
53class MachineKCFILegacy : public MachineFunctionPass {
54public:
55 static char ID;
56
57 MachineKCFILegacy() : MachineFunctionPass(ID) {}
58
59 StringRef getPassName() const override { return KCFI_PASS_NAME; }
60 bool runOnMachineFunction(MachineFunction &MF) override {
61 return KCFI().run(MF);
62 }
63
64 void getAnalysisUsage(AnalysisUsage &AU) const override {
65 AU.addPreserved<MachineRegisterClassInfoWrapperPass>();
66 MachineFunctionPass::getAnalysisUsage(AU);
67 }
68};
69
70char MachineKCFILegacy::ID = 0;
71} // end anonymous namespace
72
73INITIALIZE_PASS(MachineKCFILegacy, DEBUG_TYPE, KCFI_PASS_NAME, false, false)
74
75FunctionPass *llvm::createKCFIPass() { return new MachineKCFILegacy(); }
76
77PreservedAnalyses MachineKCFIPass::run(MachineFunction &MF,
78 MachineFunctionAnalysisManager &MFAM) {
79 if (!KCFI().run(MF))
80 return PreservedAnalyses::all();
81
82 PreservedAnalyses PA = getMachineFunctionPassPreservedAnalyses();
83 PA.preserveSet<CFGAnalyses>();
84 return PA;
85}
86
87bool KCFI::emitCheck(MachineBasicBlock &MBB,
88 MachineBasicBlock::instr_iterator MBBI) const {
89 assert(TII && "Target instruction info was not initialized");
90 assert(TLI && "Target lowering was not initialized");
91
92 // If the call instruction is bundled, we can only emit a check safely if
93 // it's the first instruction in the bundle.
94 if (MBBI->isBundled() && !std::prev(x: MBBI)->isBundle())
95 report_fatal_error(reason: "Cannot emit a KCFI check for a bundled call");
96
97 // Emit a KCFI check for the call instruction at MBBI. The implementation
98 // must unfold memory operands if applicable.
99 MachineInstr *Check = TLI->EmitKCFICheck(MBB, MBBI, TII);
100
101 // Clear the original call's CFI type.
102 assert(MBBI->isCall() && "Unexpected instruction type");
103 MBBI->setCFIType(MF&: *MBB.getParent(), Type: 0);
104
105 // If not already bundled, bundle the check and the call to prevent
106 // further changes.
107 if (!MBBI->isBundled())
108 finalizeBundle(MBB, FirstMI: Check->getIterator(), LastMI: std::next(x: MBBI->getIterator()));
109
110 ++NumKCFIChecksAdded;
111 return true;
112}
113
114bool KCFI::run(MachineFunction &MF) {
115 const Module *M = MF.getFunction().getParent();
116 if (!M->getModuleFlag(Key: "kcfi"))
117 return false;
118
119 const auto &SubTarget = MF.getSubtarget();
120 TII = SubTarget.getInstrInfo();
121 TLI = SubTarget.getTargetLowering();
122
123 bool Changed = false;
124 for (MachineBasicBlock &MBB : MF) {
125 // Use instr_iterator because we don't want to skip bundles.
126 for (MachineBasicBlock::instr_iterator MII = MBB.instr_begin(),
127 MIE = MBB.instr_end();
128 MII != MIE; ++MII) {
129 if (MII->isCall() && MII->getCFIType())
130 Changed |= emitCheck(MBB, MBBI: MII);
131 }
132 }
133
134 return Changed;
135}
136