8000 KCFI sanitizer · llvm/llvm-project@cff5bef · GitHub
[go: up one dir, main page]
Skip to content

Commit cff5bef

Browse files
samitolvanensamitolvanen
committed
KCFI sanitizer
The KCFI sanitizer, enabled with `-fsanitize=kcfi`, implements a forward-edge control flow integrity scheme for indirect calls. It uses a !kcfi_type metadata node to attach a type identifier for each function and injects verification code before indirect calls. Unlike the current CFI schemes implemented in LLVM, KCFI does not require LTO, does not alter function references to point to a jump table, and never breaks function address equality. KCFI is intended to be used in low-level code, such as operating system kernels, where the existing schemes can cause undue complications because of the aforementioned properties. However, unlike the existing schemes, KCFI is limited to validating only function pointers and is not compatible with executable-only memory. KCFI does not provide runtime support, but always traps when a type mismatch is encountered. Users of the scheme are expected to handle the trap. With `-fsanitize=kcfi`, Clang emits a `kcfi` operand bundle to indirect calls, and LLVM lowers this to a known architecture-specific sequence of instructions for each callsite to make runtime patching easier for users who require this functionality. A KCFI type identifier is a 32-bit constant produced by taking the lower half of xxHash64 from a C++ mangled typename. If a program contains indirect calls to assembly functions, they must be manually annotated with the expected type identifiers to prevent errors. To make this easier, Clang generates a weak SHN_ABS `__kcfi_typeid_<function>` symbol for each address-taken function declaration, which can be used to annotate functions in assembly as long as at least one C translation unit linked into the program takes the function address. For example on AArch64, we might have the following code: ``` .c: int f(void); int (*p)(void) = f; p(); .s: .4byte __kcfi_typeid_f .global f f: ... ``` Note that X86 uses a different preamble format for compatibility with Linux kernel tooling. See the comments in `X86AsmPrinter::emitKCFITypeId` for details. As users of KCFI may need to locate trap locations for binary validation and error handling, LLVM can additionally emit the locations of traps to a `.kcfi_traps` section. Similarly to other sanitizers, KCFI checking can be disabled for a function with a `no_sanitize("kcfi")` function attribute. Relands 67504c9 with a fix for 32-bit builds. Reviewed By: nickdesaulniers, kees, joaomoreira, MaskRay Differential Revision: https://reviews.llvm.org/D119296
1 parent 03798f2 commit cff5bef
  • X86ISelLowering.cpp
  • X86ISelLowering.h
  • X86InstrCompiler.td
  • X86KCFI.cpp
  • X86MCInstLower.cpp
  • X86TargetMachine.cpp
  • Transforms
  • test
  • utils/gn/secondary/llvm/lib/Target

    • Some content is hidden

    Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

    81 files changed

    +1596
    -49
    lines changed

    ‎clang/docs/ControlFlowIntegrity.rst

    Lines changed: 13 additions & 0 deletions
    Original file line numberDiff line numberDiff line change
    @@ -306,6 +306,19 @@ the identity of function pointers is maintained, and calls across shared
    306306
    library boundaries are no different from calls within a single program or
    307307
    shared library.
    308308

    309+
    .. _kcfi:
    310+
    311+
    ``-fsanitize=kcfi``
    312+
    -------------------
    313+
    314+
    This is an alternative indirect call control-flow integrity scheme designed
    315+
    for low-level system software, such as operating system kernels. Unlike
    316+
    ``-fsanitize=cfi-icall``, it doesn't require ``-flto``, won't result in
    317+
    function pointers being replaced with jump table references, and never breaks
    318+
    cross-DSO function address equality. These properties make KCFI easier to
    319+
    adopt in low-level software. KCFI is limited to checking only function
    320+
    pointers, and isn't compatible with executable-only memory.
    321+
    309322
    Member Function Pointer Call Checking
    310323
    =====================================
    311324

    ‎clang/docs/UsersManual.rst

    Lines changed: 2 additions & 0 deletions
    Original file line numberDiff line numberDiff line change
    @@ -1720,6 +1720,8 @@ are listed below.
    17201720
    flow analysis.
    17211721
    - ``-fsanitize=cfi``: :doc:`control flow integrity <ControlFlowIntegrity>`
    17221722
    checks. Requires ``-flto``.
    1723+
    - ``-fsanitize=kcfi``: kernel indirect call forward-edge control flow
    1724+
    integrity.
    17231725
    - ``-fsanitize=safe-stack``: :doc:`safe stack <SafeStack>`
    17241726
    protection against stack-based memory corruption errors.
    17251727

    ‎clang/include/clang/Basic/Features.def

    Lines changed: 1 addition & 0 deletions
    Original file line numberDiff line numberDiff line change
    @@ -228,6 +228,7 @@ FEATURE(is_trivially_assignable, LangOpts.CPlusPlus)
    228228
    FEATURE(is_trivially_constructible, LangOpts.CPlusPlus)
    229229
    FEATURE(is_trivially_copyable, LangOpts.CPlusPlus)
    230230
    FEATURE(is_union, LangOpts.CPlusPlus)
    231+
    FEATURE(kcfi, LangOpts.Sanitize.has(SanitizerKind::KCFI))
    231232
    FEATURE(modules, LangOpts.Modules)
    232233
    FEATURE(safe_stack, LangOpts.Sanitize.has(SanitizerKind::SafeStack))
    233234
    FEATURE(shadow_call_stack,

    ‎clang/include/clang/Basic/Sanitizers.def

    Lines changed: 3 additions & 0 deletions
    Original file line numberDiff line numberDiff line change
    @@ -127,6 +127,9 @@ SANITIZER_GROUP("cfi", CFI,
    127127
    CFIDerivedCast | CFIICall | CFIMFCall | CFIUnrelatedCast |
    128128
    CFINVCall | CFIVCall)
    129129

    130+
    // Kernel Control Flow Integrity
    131+
    SANITIZER("kcfi", KCFI)
    132+
    130133
    // Safe Stack
    131134
    SANITIZER("safe-stack", SafeStack)
    132135

    ‎clang/lib/CodeGen/CGCall.cpp

    Lines changed: 4 additions & 0 deletions
    Original file line numberDiff line numberDiff line change
    @@ -5368,6 +5368,10 @@ RValue CodeGenFunction::EmitCall(const CGFunctionInfo &CallInfo,
    53685368
    SmallVector<llvm::OperandBundleDef, 1> BundleList =
    53695369
    getBundlesForFunclet(CalleePtr);
    53705370

    5371+
    if (SanOpts.has(SanitizerKind::KCFI) &&
    5372+
    !isa_and_nonnull<FunctionDecl>(TargetDecl))
    5373+
    EmitKCFIOperandBundle(ConcreteCallee, BundleList);
    5374+
    53715375
    if (const FunctionDecl *FD = dyn_cast_or_null<FunctionDecl>(CurFuncDecl))
    53725376
    if (FD->hasAttr<StrictFPAttr>())
    53735377
    // All calls within a strictfp function are marked strictfp

    ‎clang/lib/CodeGen/CodeGenFunction.cpp

    Lines changed: 8 additions & 0 deletions
    Original file line numberDiff line numberDiff line change
    @@ -2606,6 +2606,14 @@ void CodeGenFunction::EmitSanitizerStatReport(llvm::SanitizerStatKind SSK) {
    26062606
    CGM.getSanStats().create(IRB, SSK);
    26072607
    }
    26082608

    2609+
    void CodeGenFunction::EmitKCFIOperandBundle(
    2610+
    const CGCallee &Callee, SmallVectorImpl<llvm::OperandBundleDef> &Bundles) {
    2611+
    const FunctionProtoType *FP =
    2612+
    Callee.getAbstractInfo().getCalleeFunctionProtoType();
    2613+
    if (FP)
    2614+
    Bundles.emplace_back("kcfi", CGM.CreateKCFITypeId(FP->desugar()));
    2615+
    }
    2616+
    26092617
    llvm::Value *
    26102618
    CodeGenFunction::FormResolverCondition(const MultiVersionResolverOption &RO) {
    26112619
    llvm::Value *Condition = nullptr;

    ‎clang/lib/CodeGen/CodeGenFunction.h

    Lines changed: 3 additions & 0 deletions
    Original file line numberDiff line numberDiff line change
    @@ -4612,6 +4612,9 @@ class CodeGenFunction : public CodeGenTypeCache {
    46124612
    /// passing to a runtime sanitizer handler.
    46134613
    llvm::Constant *EmitCheckSourceLocation(SourceLocation Loc);
    46144614

    4615+
    void EmitKCFIOperandBundle(const CGCallee &Callee,
    4616+
    SmallVectorImpl<llvm::OperandBundleDef> &Bundles);
    4617+
    46154618
    /// Create a basic block that will either trap or call a handler function in
    46164619
    /// the UBSan runtime with the provided arguments, and create a conditional
    46174620
    /// branch to it.

    ‎clang/lib/CodeGen/CodeGenModule.cpp

    Lines changed: 75 additions & 0 deletions
    Original file line numberDiff line numberDiff line change
    @@ -48,6 +48,7 @@
    4848
    #include "clang/CodeGen/ConstantInitBuilder.h"
    4949
    #include "clang/Frontend/FrontendDiagnostic.h"
    5050
    #include "llvm/ADT/STLExtras.h"
    51+
    #include "llvm/ADT/StringExtras.h"
    5152
    #include "llvm/ADT/StringSwitch.h"
    5253
    #include "llvm/ADT/Triple.h"
    5354
    #include "llvm/Analysis/TargetLibraryInfo.h"
    @@ -67,6 +68,7 @@
    6768
    #include "llvm/Support/MD5.h"
    6869
    #include "llvm/Support/TimeProfiler.h"
    6970
    #include "llvm/Support/X86TargetParser.h"
    71+
    #include "llvm/Support/xxhash.h"
    7072

    7173
    using namespace clang;
    7274
    using namespace CodeGen;
    @@ -577,6 +579,8 @@ void CodeGenModule::Release() {
    577579
    CodeGenFunction(*this).EmitCfiCheckFail();
    578580
    CodeGenFunction(*this).EmitCfiCheckStub();
    579581
    }
    582+
    if (LangOpts.Sanitize.has(SanitizerKind::KCFI))
    583+
    finalizeKCFITypes();
    580584
    emitAtAvailableLinkGuard();
    581585
    if (Context.getTargetInfo().getTriple().isWasm())
    582586
    EmitMainVoidAlias();
    @@ -759,6 +763,9 @@ void CodeGenModule::Release() {
    759763
    CodeGenOpts.SanitizeCfiCanonicalJumpTables);
    760764
    }
    761765

    766+
    if (LangOpts.Sanitize.has(SanitizerKind::KCFI))
    767+
    getModule().addModuleFlag(llvm::Module::Override, "kcfi", 1);
    768+
    762769
    if (CodeGenOpts.CFProtectionReturn &&
    763770
    Target.checkCFProtectionReturnSupported(getDiags())) {
    764771
    // Indicate that we want to instrument return control flow protection.
    @@ -1669,6 +1676,20 @@ llvm::ConstantInt *CodeGenModule::CreateCrossDsoCfiTypeId(llvm::Metadata *MD) {
    16691676
    return llvm::ConstantInt::get(Int64Ty, llvm::MD5Hash(MDS->getString()));
    16701677
    }
    16711678

    1679+
    llvm::ConstantInt *CodeGenModule::CreateKCFITypeId(QualType T) {
    1680+
    if (auto *FnType = T->getAs<FunctionProtoType>())
    1681+
    T = getContext().getFunctionType(
    1682+
    FnType->getReturnType(), FnType->getParamTypes(),
    1683+
    FnType->getExtProtoInfo().withExceptionSpec(EST_None));
    1684+
    1685+
    std::string OutName;
    1686+
    llvm::raw_string_ostream Out(OutName);
    1687+
    getCXXABI().getMangleContext().mangleTypeName(T, Out);
    1688+
    1689+
    return llvm::ConstantInt::get(Int32Ty,
    1690+
    static_cast<uint32_t>(llvm::xxHash64(OutName)));
    1691+
    }
    1692+
    16721693
    void CodeGenModule::SetLLVMFunctionAttributes(GlobalDecl GD,
    16731694
    const CGFunctionInfo &Info,
    16741695
    llvm::Function *F, bool IsThunk) {
    @@ -2287,6 +2308,57 @@ void CodeGenModule::CreateFunctionTypeMetadataForIcall(const FunctionDecl *FD,
    22872308
    F->addTypeMetadata(0, llvm::ConstantAsMetadata::get(CrossDsoTypeId));
    22882309
    }
    22892310

    2311+
    void CodeGenModule::setKCFIType(const FunctionDecl *FD, llvm::Function *F) {
    2312+
    if (isa<CXXMethodDecl>(FD) && !cast<CXXMethodDecl>(FD)->isStatic())
    2313+
    return;
    2314+
    2315+
    llvm::LLVMContext &Ctx = F->getContext();
    2316+
    llvm::MDBuilder MDB(Ctx);
    2317+
    F->setMetadata(llvm::LLVMContext::MD_kcfi_type,
    2318+
    llvm::MDNode::get(
    2319+
    Ctx, MDB.createConstant(CreateKCFITypeId(FD->getType()))));
    2320+
    }
    2321+
    2322+
    static bool allowKCFIIdentifier(StringRef Name) {
    2323+
    // KCFI type identifier constants are only necessary for external assembly
    2324+
    // functions, which means it's safe to skip unusual names. Subset of
    2325+
    // MCAsmInfo::isAcceptableChar() and MCAsmInfoXCOFF::isAcceptableChar().
    2326+
    return llvm::all_of(Name, [](const char &C) {
    2327+
    return llvm::isAlnum(C) || C == '_' || C == '.';
    2328+
    });
    2329+
    }
    2330+
    2331+
    void CodeGenModule::finalizeKCFITypes() {
    2332+
    llvm::Module &M = getModule();
    2333+
    for (auto &F : M.functions()) {
    2334+
    // Remove KCFI type metadata from non-address-taken local functions.
    2335+
    bool AddressTaken = F.hasAddressTaken();
    2336+
    if (!AddressTaken && F.hasLocalLinkage())
    2337+
    F.eraseMetadata(llvm::LLVMContext::MD_kcfi_type);
    2338+
    2339+
    // Generate a constant with the expected KCFI type identifier for all
    2340+
    // address-taken function declarations to support annotating indirectly
    2341+
    // called assembly functions.
    2342+
    if (!AddressTaken || !F.isDeclaration())
    2343+
    continue;
    2344+
    2345+
    const llvm::ConstantInt *Type;
    2346+
    if (const llvm::MDNode *MD = F.getMetadata(llvm::LLVMContext::MD_kcfi_type))
    2347+
    Type = llvm::mdconst::extract<llvm::ConstantInt>(MD->getOperand(0));
    2348+
    else
    2349+
    continue;
    2350+
    2351+
    StringRef Name = F.getName();
    2352+
    if (!allowKCFIIdentifier(Name))
    2353+
    continue;
    2354+
    2355+
    std::string Asm = (".weak __kcfi_typeid_" + Name + "\n.set __kcfi_typeid_" +
    2356+
    Name + ", " + Twine(Type->getZExtValue()) + "\n")
    2357+
    .str();
    2358+
    M.appendModuleInlineAsm(Asm);
    2359+
    }
    2360+
    }
    2361+
    22902362
    void CodeGenModule::SetFunctionAttributes(GlobalDecl GD, llvm::Function *F,
    22912363
    bool IsIncompleteFunction,
    22922364
    bool IsThunk) {
    @@ -2369,6 +2441,9 @@ void CodeGenModule::SetFunctionAttributes(GlobalDecl GD, llvm::Function *F,
    23692441
    !CodeGenOpts.SanitizeCfiCanonicalJumpTables)
    23702442
    CreateFunctionTypeMetadataForIcall(FD, F);< 2540 /div>
    23712443

    2444+
    if (LangOpts.Sanitize.has(SanitizerKind::KCFI))
    2445+
    setKCFIType(FD, F);
    2446+
    23722447
    if (getLangOpts().OpenMP && FD->hasAttr<OMPDeclareSimdDeclAttr>())
    23732448
    getOpenMPRuntime().emitDeclareSimdFunction(FD, F);
    23742449

    ‎clang/lib/CodeGen/CodeGenModule.h

    Lines changed: 9 additions & 0 deletions
    Original file line numberDiff line numberDiff line change
    @@ -1440,6 +1440,9 @@ class CodeGenModule : public CodeGenTypeCache {
    14401440
    /// Generate a cross-DSO type identifier for MD.
    14411441
    llvm::ConstantInt *CreateCrossDsoCfiTypeId(llvm::Metadata *MD);
    14421442

    1443+
    /// Generate a KCFI type identifier for T.
    1444+
    llvm::ConstantInt *CreateKCFITypeId(QualType T);
    1445+
    14431446
    /// Create a metadata identifier for the given type. This may either be an
    14441447
    /// MDString (for external identifiers) or a distinct unnamed MDNode (for
    14451448
    /// internal identifiers).
    @@ -1458,6 +1461,12 @@ class CodeGenModule : public CodeGenTypeCache {
    14581461
    void CreateFunctionTypeMetadataForIcall(const FunctionDecl *FD,
    14591462
    llvm::Function *F);
    14601463

    1464+
    /// Set type metadata to the given function.
    1465+
    void setKCFIType(const FunctionDecl *FD, llvm::Function *F);
    1466+
    1467+
    /// Emit KCFI type identifier constants and remove unused identifiers.
    1468+
    void finalizeKCFITypes();
    1469+
    14611470
    /// Whether this function's return type has no side effects, and thus may
    14621471
    /// be trivially discarded if it is unused.
    14631472
    bool MayDropFunctionReturn(const ASTContext &Context, QualType ReturnType);

    ‎clang/lib/Driver/SanitizerArgs.cpp

    Lines changed: 12 additions & 3 deletions
    Original file line numberDiff line numberDiff line change
    @@ -37,7 +37,8 @@ static const SanitizerMask NotAllowedWithTrap = SanitizerKind::Vptr;
    3737
    static const SanitizerMask NotAllowedWithMinimalRuntime =
    3838
    SanitizerKind::Function | SanitizerKind::Vptr;
    3939
    static const SanitizerMask RequiresPIE =
    40-
    SanitizerKind::DataFlow | SanitizerKind::HWAddress | SanitizerKind::Scudo;
    40+
    SanitizerKind::DataFlow | SanitizerKind::HWAddress | SanitizerKind::Scudo |
    41+
    SanitizerKind::KCFI;
    4142
    static const SanitizerMask NeedsUnwindTables =
    4243
    SanitizerKind::Address | SanitizerKind::HWAddress | SanitizerKind::Thread |
    4344
    SanitizerKind::Memory | SanitizerKind::DataFlow;
    @@ -59,8 +60,9 @@ static const SanitizerMask RecoverableByDefault =
    5960
    SanitizerKind::FloatDivideByZero | SanitizerKind::ObjCCast;
    6061
    static const SanitizerMask Unrecoverable =
    6162
    SanitizerKind::Unreachable | SanitizerKind::Return;
    62-
    static const SanitizerMask AlwaysRecoverable =
    63-
    SanitizerKind::KernelAddress | SanitizerKind::KernelHWAddress;
    63+
    static const SanitizerMask AlwaysRecoverable = SanitizerKind::KernelAddress |
    64+
    SanitizerKind::KernelHWAddress |
    65+
    SanitizerKind::KCFI;
    6466
    static const SanitizerMask NeedsLTO = SanitizerKind::CFI;
    6567
    static const SanitizerMask TrappingSupported =
    6668
    (SanitizerKind::Undefined & ~SanitizerKind::Vptr) | SanitizerKind::Integer |
    @@ -712,6 +714,13 @@ SanitizerArgs::SanitizerArgs(const ToolChain &TC,
    712714
    options::OPT_fno_sanitize_cfi_canonical_jump_tables, true);
    713715
    }
    714716

    717+
    if (AllAddedKinds & SanitizerKind::KCFI && DiagnoseErrors) {
    718+
    if (AllAddedKinds & SanitizerKind::CFI)
    719+
    D.Diag(diag::err_drv_argument_not_allowed_with)
    720+
    << "-fsanitize=kcfi"
    721+
    << lastArgumentForMask(D, Args, SanitizerKind::CFI);
    722+
    }
    723+
    715724
    Stats = Args.hasFlag(options::OPT_fsanitize_stats,
    716725
    options::OPT_fno_sanitize_stats, false);
    717726

    0 commit comments

    Comments
     (0)
    0