1 | //===-- CodeGen/AsmPrinter/WinCFGuard.cpp - Control Flow Guard Impl ------===// |
2 | // |
3 | // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions. |
4 | // See https://llvm.org/LICENSE.txt for license information. |
5 | // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception |
6 | // |
7 | //===----------------------------------------------------------------------===// |
8 | // |
9 | // This file contains support for writing the metadata for Windows Control Flow |
10 | // Guard, including address-taken functions and valid longjmp targets. |
11 | // |
12 | //===----------------------------------------------------------------------===// |
13 | |
14 | #include "WinCFGuard.h" |
15 | #include "llvm/CodeGen/AsmPrinter.h" |
16 | #include "llvm/CodeGen/MachineFunction.h" |
17 | #include "llvm/CodeGen/MachineModuleInfo.h" |
18 | #include "llvm/IR/Constants.h" |
19 | #include "llvm/IR/InstrTypes.h" |
20 | #include "llvm/MC/MCObjectFileInfo.h" |
21 | #include "llvm/MC/MCStreamer.h" |
22 | |
23 | #include <vector> |
24 | |
25 | using namespace llvm; |
26 | |
27 | WinCFGuard::WinCFGuard(AsmPrinter *A) : Asm(A) {} |
28 | |
29 | WinCFGuard::~WinCFGuard() = default; |
30 | |
31 | void WinCFGuard::endFunction(const MachineFunction *MF) { |
32 | |
33 | // Skip functions without any longjmp targets. |
34 | if (MF->getLongjmpTargets().empty()) |
35 | return; |
36 | |
37 | // Copy the function's longjmp targets to a module-level list. |
38 | llvm::append_range(C&: LongjmpTargets, R: MF->getLongjmpTargets()); |
39 | } |
40 | |
41 | /// Returns true if this function's address is escaped in a way that might make |
42 | /// it an indirect call target. Function::hasAddressTaken gives different |
43 | /// results when a function is called directly with a function prototype |
44 | /// mismatch, which requires a cast. |
45 | static bool isPossibleIndirectCallTarget(const Function *F) { |
46 | SmallVector<const Value *, 4> Users{F}; |
47 | while (!Users.empty()) { |
48 | const Value *FnOrCast = Users.pop_back_val(); |
49 | for (const Use &U : FnOrCast->uses()) { |
50 | const User *FnUser = U.getUser(); |
51 | if (isa<BlockAddress>(Val: FnUser)) |
52 | continue; |
53 | if (const auto *Call = dyn_cast<CallBase>(Val: FnUser)) { |
54 | if (!Call->isCallee(U: &U)) |
55 | return true; |
56 | } else if (isa<Instruction>(Val: FnUser)) { |
57 | // Consider any other instruction to be an escape. This has some weird |
58 | // consequences like no-op intrinsics being an escape or a store *to* a |
59 | // function address being an escape. |
60 | return true; |
61 | } else if (const auto *C = dyn_cast<Constant>(Val: FnUser)) { |
62 | // If this is a constant pointer cast of the function, don't consider |
63 | // this escape. Analyze the uses of the cast as well. This ensures that |
64 | // direct calls with mismatched prototypes don't end up in the CFG |
65 | // table. Consider other constants, such as vtable initializers, to |
66 | // escape the function. |
67 | if (C->stripPointerCasts() == F) |
68 | Users.push_back(Elt: FnUser); |
69 | else |
70 | return true; |
71 | } |
72 | } |
73 | } |
74 | return false; |
75 | } |
76 | |
77 | MCSymbol *WinCFGuard::lookupImpSymbol(const MCSymbol *Sym) { |
78 | if (Sym->getName().starts_with(Prefix: "__imp_" )) |
79 | return nullptr; |
80 | return Asm->OutContext.lookupSymbol(Name: Twine("__imp_" ) + Sym->getName()); |
81 | } |
82 | |
83 | void WinCFGuard::endModule() { |
84 | const Module *M = Asm->MMI->getModule(); |
85 | std::vector<const MCSymbol *> GFIDsEntries; |
86 | std::vector<const MCSymbol *> GIATsEntries; |
87 | for (const Function &F : *M) { |
88 | if (isPossibleIndirectCallTarget(F: &F)) { |
89 | // If F is a dllimport and has an "__imp_" symbol already defined, add the |
90 | // "__imp_" symbol to the .giats section. |
91 | if (F.hasDLLImportStorageClass()) { |
92 | if (MCSymbol *impSym = lookupImpSymbol(Sym: Asm->getSymbol(GV: &F))) { |
93 | GIATsEntries.push_back(x: impSym); |
94 | } |
95 | } |
96 | // Add the function's symbol to the .gfids section. |
97 | // Note: For dllimport functions, MSVC sometimes does not add this symbol |
98 | // to the .gfids section, but only adds the corresponding "__imp_" symbol |
99 | // to the .giats section. Here we always add the symbol to the .gfids |
100 | // section, since this does not introduce security risks. |
101 | GFIDsEntries.push_back(x: Asm->getSymbol(GV: &F)); |
102 | } |
103 | } |
104 | |
105 | if (GFIDsEntries.empty() && GIATsEntries.empty() && LongjmpTargets.empty()) |
106 | return; |
107 | |
108 | // Emit the symbol index of each GFIDs entry to form the .gfids section. |
109 | auto &OS = *Asm->OutStreamer; |
110 | OS.switchSection(Section: Asm->OutContext.getObjectFileInfo()->getGFIDsSection()); |
111 | for (const MCSymbol *S : GFIDsEntries) |
112 | OS.emitCOFFSymbolIndex(Symbol: S); |
113 | |
114 | // Emit the symbol index of each GIATs entry to form the .giats section. |
115 | OS.switchSection(Section: Asm->OutContext.getObjectFileInfo()->getGIATsSection()); |
116 | for (const MCSymbol *S : GIATsEntries) { |
117 | OS.emitCOFFSymbolIndex(Symbol: S); |
118 | } |
119 | |
120 | // Emit the symbol index of each longjmp target to form the .gljmp section. |
121 | OS.switchSection(Section: Asm->OutContext.getObjectFileInfo()->getGLJMPSection()); |
122 | for (const MCSymbol *S : LongjmpTargets) { |
123 | OS.emitCOFFSymbolIndex(Symbol: S); |
124 | } |
125 | } |
126 | |