1 //===---- AArch64KCFI.cpp - Implements KCFI -------------------------------===//
2 //
3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4 // See https://llvm.org/LICENSE.txt for license information.
5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6 //
7 //===----------------------------------------------------------------------===//
8 //
9 // This file implements KCFI indirect call checking.
10 //
11 //===----------------------------------------------------------------------===//
12
13 #include "AArch64.h"
14 #include "AArch64InstrInfo.h"
15 #include "AArch64Subtarget.h"
16 #include "AArch64TargetMachine.h"
17 #include "llvm/ADT/Statistic.h"
18 #include "llvm/CodeGen/MachineFunctionPass.h"
19 #include "llvm/CodeGen/MachineInstrBuilder.h"
20 #include "llvm/CodeGen/MachineInstrBundle.h"
21 #include "llvm/CodeGen/MachineModuleInfo.h"
22
23 using namespace llvm;
24
25 #define DEBUG_TYPE "aarch64-kcfi"
26 #define AARCH64_KCFI_PASS_NAME "Insert KCFI indirect call checks"
27
28 STATISTIC(NumKCFIChecksAdded, "Number of indirect call checks added");
29
30 namespace {
31 class AArch64KCFI : public MachineFunctionPass {
32 public:
33 static char ID;
34
AArch64KCFI()35 AArch64KCFI() : MachineFunctionPass(ID) {}
36
getPassName() const37 StringRef getPassName() const override { return AARCH64_KCFI_PASS_NAME; }
38 bool runOnMachineFunction(MachineFunction &MF) override;
39
40 private:
41 /// Machine instruction info used throughout the class.
42 const AArch64InstrInfo *TII = nullptr;
43
44 /// Emits a KCFI check before an indirect call.
45 /// \returns true if the check was added and false otherwise.
46 bool emitCheck(MachineBasicBlock &MBB,
47 MachineBasicBlock::instr_iterator I) const;
48 };
49
50 char AArch64KCFI::ID = 0;
51 } // end anonymous namespace
52
INITIALIZE_PASS(AArch64KCFI,DEBUG_TYPE,AARCH64_KCFI_PASS_NAME,false,false)53 INITIALIZE_PASS(AArch64KCFI, DEBUG_TYPE, AARCH64_KCFI_PASS_NAME, false, false)
54
55 FunctionPass *llvm::createAArch64KCFIPass() { return new AArch64KCFI(); }
56
emitCheck(MachineBasicBlock & MBB,MachineBasicBlock::instr_iterator MBBI) const57 bool AArch64KCFI::emitCheck(MachineBasicBlock &MBB,
58 MachineBasicBlock::instr_iterator MBBI) const {
59 assert(TII && "Target instruction info was not initialized");
60
61 // If the call instruction is bundled, we can only emit a check safely if
62 // it's the first instruction in the bundle.
63 if (MBBI->isBundled() && !std::prev(MBBI)->isBundle())
64 report_fatal_error("Cannot emit a KCFI check for a bundled call");
65
66 switch (MBBI->getOpcode()) {
67 case AArch64::BLR:
68 case AArch64::BLRNoIP:
69 case AArch64::TCRETURNri:
70 case AArch64::TCRETURNriBTI:
71 break;
72 default:
73 llvm_unreachable("Unexpected CFI call opcode");
74 }
75
76 MachineOperand &Target = MBBI->getOperand(0);
77 assert(Target.isReg() && "Invalid target operand for an indirect call");
78 Target.setIsRenamable(false);
79
80 MachineInstr *Check =
81 BuildMI(MBB, MBBI, MBBI->getDebugLoc(), TII->get(AArch64::KCFI_CHECK))
82 .addReg(Target.getReg())
83 .addImm(MBBI->getCFIType())
84 .getInstr();
85 MBBI->setCFIType(*MBB.getParent(), 0);
86
87 // If not already bundled, bundle the check and the call to prevent
88 // further changes.
89 if (!MBBI->isBundled())
90 finalizeBundle(MBB, Check->getIterator(), std::next(MBBI->getIterator()));
91
92 ++NumKCFIChecksAdded;
93 return true;
94 }
95
runOnMachineFunction(MachineFunction & MF)96 bool AArch64KCFI::runOnMachineFunction(MachineFunction &MF) {
97 const Module *M = MF.getMMI().getModule();
98 if (!M->getModuleFlag("kcfi"))
99 return false;
100
101 const auto &SubTarget = MF.getSubtarget<AArch64Subtarget>();
102 TII = SubTarget.getInstrInfo();
103
104 bool Changed = false;
105 for (MachineBasicBlock &MBB : MF) {
106 for (MachineBasicBlock::instr_iterator MII = MBB.instr_begin(),
107 MIE = MBB.instr_end();
108 MII != MIE; ++MII) {
109 if (MII->isCall() && MII->getCFIType())
110 Changed |= emitCheck(MBB, MII);
111 }
112 }
113
114 return Changed;
115 }
116