1//===-- CodeGen/AsmPrinter/WinCFGuard.cpp - Control Flow Guard Impl ------===// 2// 3// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions. 4// See https://llvm.org/LICENSE.txt for license information. 5// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception 6// 7//===----------------------------------------------------------------------===// 8// 9// This file contains support for writing the metadata for Windows Control Flow 10// Guard, including address-taken functions, and valid longjmp targets. 11// 12//===----------------------------------------------------------------------===// 13 14#include "WinCFGuard.h" 15#include "llvm/CodeGen/AsmPrinter.h" 16#include "llvm/CodeGen/MachineFunction.h" 17#include "llvm/CodeGen/MachineModuleInfo.h" 18#include "llvm/CodeGen/MachineOperand.h" 19#include "llvm/IR/Constants.h" 20#include "llvm/IR/Metadata.h" 21#include "llvm/IR/Instructions.h" 22#include "llvm/MC/MCAsmInfo.h" 23#include "llvm/MC/MCObjectFileInfo.h" 24#include "llvm/MC/MCStreamer.h" 25 26#include <vector> 27 28using namespace llvm; 29 30WinCFGuard::WinCFGuard(AsmPrinter *A) : AsmPrinterHandler(), Asm(A) {} 31 32WinCFGuard::~WinCFGuard() {} 33 34void WinCFGuard::endFunction(const MachineFunction *MF) { 35 36 // Skip functions without any longjmp targets. 37 if (MF->getLongjmpTargets().empty()) 38 return; 39 40 // Copy the function's longjmp targets to a module-level list. 41 LongjmpTargets.insert(LongjmpTargets.end(), MF->getLongjmpTargets().begin(), 42 MF->getLongjmpTargets().end()); 43} 44 45/// Returns true if this function's address is escaped in a way that might make 46/// it an indirect call target. Function::hasAddressTaken gives different 47/// results when a function is called directly with a function prototype 48/// mismatch, which requires a cast. 49static bool isPossibleIndirectCallTarget(const Function *F) { 50 SmallVector<const Value *, 4> Users{F}; 51 while (!Users.empty()) { 52 const Value *FnOrCast = Users.pop_back_val(); 53 for (const Use &U : FnOrCast->uses()) { 54 const User *FnUser = U.getUser(); 55 if (isa<BlockAddress>(FnUser)) 56 continue; 57 if (const auto *Call = dyn_cast<CallBase>(FnUser)) { 58 if (!Call->isCallee(&U)) 59 return true; 60 } else if (isa<Instruction>(FnUser)) { 61 // Consider any other instruction to be an escape. This has some weird 62 // consequences like no-op intrinsics being an escape or a store *to* a 63 // function address being an escape. 64 return true; 65 } else if (const auto *C = dyn_cast<Constant>(FnUser)) { 66 // If this is a constant pointer cast of the function, don't consider 67 // this escape. Analyze the uses of the cast as well. This ensures that 68 // direct calls with mismatched prototypes don't end up in the CFG 69 // table. Consider other constants, such as vtable initializers, to 70 // escape the function. 71 if (C->stripPointerCasts() == F) 72 Users.push_back(FnUser); 73 else 74 return true; 75 } 76 } 77 } 78 return false; 79} 80 81void WinCFGuard::endModule() { 82 const Module *M = Asm->MMI->getModule(); 83 std::vector<const Function *> Functions; 84 for (const Function &F : *M) 85 if (isPossibleIndirectCallTarget(&F)) 86 Functions.push_back(&F); 87 if (Functions.empty() && LongjmpTargets.empty()) 88 return; 89 auto &OS = *Asm->OutStreamer; 90 OS.SwitchSection(Asm->OutContext.getObjectFileInfo()->getGFIDsSection()); 91 for (const Function *F : Functions) 92 OS.EmitCOFFSymbolIndex(Asm->getSymbol(F)); 93 94 // Emit the symbol index of each longjmp target. 95 OS.SwitchSection(Asm->OutContext.getObjectFileInfo()->getGLJMPSection()); 96 for (const MCSymbol *S : LongjmpTargets) { 97 OS.EmitCOFFSymbolIndex(S); 98 } 99} 100