Skip to content

Commit 4885e37

Browse files
committed
[ARM][KCFI] Add backend support for Kernel Control-Flow Integrity
Implement KCFI (Kernel Control Flow Integrity) backend support for ARM32, Thumb2, and Thumb1. The Linux kernel has supported ARM KCFI via Clang's generic KCFI implementation, but this has finally started to [cause problems](ClangBuiltLinux/linux#2124) so it's time to get the KCFI operand bundle lowering working on ARM. Supports patchable-function-prefix with adjusted load offsets. Provides an instruction size worst case estimate of how large the KCFI bundle is so that range-limited instructions (e.g. cbz) know how big the indirect calls can become. ARM implementation notes: - Four-instruction EOR sequence builds the 32-bit type ID byte-by-byte to work within ARM's modified immediate encoding constraints. - Scratch register selection: r12 (IP) is preferred, r3 used as fallback when r12 holds the call target. r3 gets spilled/reloaded if it is being used as a call argument. - UDF trap encoding: 0x8000 | (0x1F << 5) | target_reg_index, similar to aarch64's trap encoding. Thumb2 implementation notes: - Logically the same as ARM - UDF trap encoding: 0x80 | target_reg_index Thumb1 implementation notes: - Due to register pressure, 2 scratch registers are needed: r3 and r2, which get spilled/reloaded if they are being used as call args. - Instead of EOR, add/lsl sequence to load immediate, followed by a compare. - No trap encoding. Update tests to validate all three sub targets.
1 parent 0319951 commit 4885e37

16 files changed

+1175
-29
lines changed

clang/lib/CodeGen/BackendUtil.cpp

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -687,7 +687,8 @@ static void addKCFIPass(const Triple &TargetTriple, const LangOptions &LangOpts,
687687
PassBuilder &PB) {
688688
// If the back-end supports KCFI operand bundle lowering, skip KCFIPass.
689689
if (TargetTriple.getArch() == llvm::Triple::x86_64 ||
690-
TargetTriple.isAArch64(64) || TargetTriple.isRISCV())
690+
TargetTriple.isAArch64(64) || TargetTriple.isRISCV() ||
691+
TargetTriple.isARM() || TargetTriple.isThumb())
691692
return;
692693

693694
// Ensure we lower KCFI operand bundles with -O0.

0 commit comments

Comments
 (0)