1//===-- CodeGen/AsmPrinter/WinCFGuard.cpp - Control Flow Guard Impl ------===//
2//
3// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4// See https://llvm.org/LICENSE.txt for license information.
5// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6//
7//===----------------------------------------------------------------------===//
8//
9// This file contains support for writing the metadata for Windows Control Flow
10// Guard, including address-taken functions, and valid longjmp targets.
11//
12//===----------------------------------------------------------------------===//
13
14#include "WinCFGuard.h"
15#include "llvm/CodeGen/AsmPrinter.h"
16#include "llvm/CodeGen/MachineFunction.h"
17#include "llvm/CodeGen/MachineModuleInfo.h"
18#include "llvm/CodeGen/MachineOperand.h"
19#include "llvm/IR/Constants.h"
20#include "llvm/IR/Metadata.h"
21#include "llvm/IR/Instructions.h"
22#include "llvm/MC/MCAsmInfo.h"
23#include "llvm/MC/MCObjectFileInfo.h"
24#include "llvm/MC/MCStreamer.h"
25
26#include <vector>
27
28using namespace llvm;
29
30WinCFGuard::WinCFGuard(AsmPrinter *A) : AsmPrinterHandler(), Asm(A) {}
31
32WinCFGuard::~WinCFGuard() {}
33
34void WinCFGuard::endFunction(const MachineFunction *MF) {
35
36  // Skip functions without any longjmp targets.
37  if (MF->getLongjmpTargets().empty())
38    return;
39
40  // Copy the function's longjmp targets to a module-level list.
41  LongjmpTargets.insert(LongjmpTargets.end(), MF->getLongjmpTargets().begin(),
42                        MF->getLongjmpTargets().end());
43}
44
45/// Returns true if this function's address is escaped in a way that might make
46/// it an indirect call target. Function::hasAddressTaken gives different
47/// results when a function is called directly with a function prototype
48/// mismatch, which requires a cast.
49static bool isPossibleIndirectCallTarget(const Function *F) {
50  SmallVector<const Value *, 4> Users{F};
51  while (!Users.empty()) {
52    const Value *FnOrCast = Users.pop_back_val();
53    for (const Use &U : FnOrCast->uses()) {
54      const User *FnUser = U.getUser();
55      if (isa<BlockAddress>(FnUser))
56        continue;
57      if (const auto *Call = dyn_cast<CallBase>(FnUser)) {
58        if (!Call->isCallee(&U))
59          return true;
60      } else if (isa<Instruction>(FnUser)) {
61        // Consider any other instruction to be an escape. This has some weird
62        // consequences like no-op intrinsics being an escape or a store *to* a
63        // function address being an escape.
64        return true;
65      } else if (const auto *C = dyn_cast<Constant>(FnUser)) {
66        // If this is a constant pointer cast of the function, don't consider
67        // this escape. Analyze the uses of the cast as well. This ensures that
68        // direct calls with mismatched prototypes don't end up in the CFG
69        // table. Consider other constants, such as vtable initializers, to
70        // escape the function.
71        if (C->stripPointerCasts() == F)
72          Users.push_back(FnUser);
73        else
74          return true;
75      }
76    }
77  }
78  return false;
79}
80
81void WinCFGuard::endModule() {
82  const Module *M = Asm->MMI->getModule();
83  std::vector<const Function *> Functions;
84  for (const Function &F : *M)
85    if (isPossibleIndirectCallTarget(&F))
86      Functions.push_back(&F);
87  if (Functions.empty() && LongjmpTargets.empty())
88    return;
89  auto &OS = *Asm->OutStreamer;
90  OS.SwitchSection(Asm->OutContext.getObjectFileInfo()->getGFIDsSection());
91  for (const Function *F : Functions)
92    OS.EmitCOFFSymbolIndex(Asm->getSymbol(F));
93
94  // Emit the symbol index of each longjmp target.
95  OS.SwitchSection(Asm->OutContext.getObjectFileInfo()->getGLJMPSection());
96  for (const MCSymbol *S : LongjmpTargets) {
97    OS.EmitCOFFSymbolIndex(S);
98  }
99}
100