1//===-- CodeGen/AsmPrinter/WinCFGuard.cpp - Control Flow Guard Impl ------===// 2// 3// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions. 4// See https://llvm.org/LICENSE.txt for license information. 5// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception 6// 7//===----------------------------------------------------------------------===// 8// 9// This file contains support for writing the metadata for Windows Control Flow 10// Guard, including address-taken functions and valid longjmp targets. 11// 12//===----------------------------------------------------------------------===// 13 14#include "WinCFGuard.h" 15#include "llvm/CodeGen/AsmPrinter.h" 16#include "llvm/CodeGen/MachineFunction.h" 17#include "llvm/CodeGen/MachineModuleInfo.h" 18#include "llvm/IR/Constants.h" 19#include "llvm/IR/InstrTypes.h" 20#include "llvm/MC/MCObjectFileInfo.h" 21#include "llvm/MC/MCStreamer.h" 22 23#include <vector> 24 25using namespace llvm; 26 27WinCFGuard::WinCFGuard(AsmPrinter *A) : Asm(A) {} 28 29WinCFGuard::~WinCFGuard() = default; 30 31void WinCFGuard::endFunction(const MachineFunction *MF) { 32 33 // Skip functions without any longjmp targets. 34 if (MF->getLongjmpTargets().empty()) 35 return; 36 37 // Copy the function's longjmp targets to a module-level list. 38 llvm::append_range(LongjmpTargets, MF->getLongjmpTargets()); 39} 40 41/// Returns true if this function's address is escaped in a way that might make 42/// it an indirect call target. Function::hasAddressTaken gives different 43/// results when a function is called directly with a function prototype 44/// mismatch, which requires a cast. 45static bool isPossibleIndirectCallTarget(const Function *F) { 46 SmallVector<const Value *, 4> Users{F}; 47 while (!Users.empty()) { 48 const Value *FnOrCast = Users.pop_back_val(); 49 for (const Use &U : FnOrCast->uses()) { 50 const User *FnUser = U.getUser(); 51 if (isa<BlockAddress>(FnUser)) 52 continue; 53 if (const auto *Call = dyn_cast<CallBase>(FnUser)) { 54 if (!Call->isCallee(&U)) 55 return true; 56 } else if (isa<Instruction>(FnUser)) { 57 // Consider any other instruction to be an escape. This has some weird 58 // consequences like no-op intrinsics being an escape or a store *to* a 59 // function address being an escape. 60 return true; 61 } else if (const auto *C = dyn_cast<Constant>(FnUser)) { 62 // If this is a constant pointer cast of the function, don't consider 63 // this escape. Analyze the uses of the cast as well. This ensures that 64 // direct calls with mismatched prototypes don't end up in the CFG 65 // table. Consider other constants, such as vtable initializers, to 66 // escape the function. 67 if (C->stripPointerCasts() == F) 68 Users.push_back(FnUser); 69 else 70 return true; 71 } 72 } 73 } 74 return false; 75} 76 77MCSymbol *WinCFGuard::lookupImpSymbol(const MCSymbol *Sym) { 78 if (Sym->getName().starts_with("__imp_")) 79 return nullptr; 80 return Asm->OutContext.lookupSymbol(Twine("__imp_") + Sym->getName()); 81} 82 83void WinCFGuard::endModule() { 84 const Module *M = Asm->MMI->getModule(); 85 std::vector<const MCSymbol *> GFIDsEntries; 86 std::vector<const MCSymbol *> GIATsEntries; 87 for (const Function &F : *M) { 88 if (isPossibleIndirectCallTarget(&F)) { 89 // If F is a dllimport and has an "__imp_" symbol already defined, add the 90 // "__imp_" symbol to the .giats section. 91 if (F.hasDLLImportStorageClass()) { 92 if (MCSymbol *impSym = lookupImpSymbol(Asm->getSymbol(&F))) { 93 GIATsEntries.push_back(impSym); 94 } 95 } 96 // Add the function's symbol to the .gfids section. 97 // Note: For dllimport functions, MSVC sometimes does not add this symbol 98 // to the .gfids section, but only adds the corresponding "__imp_" symbol 99 // to the .giats section. Here we always add the symbol to the .gfids 100 // section, since this does not introduce security risks. 101 GFIDsEntries.push_back(Asm->getSymbol(&F)); 102 } 103 } 104 105 if (GFIDsEntries.empty() && GIATsEntries.empty() && LongjmpTargets.empty()) 106 return; 107 108 // Emit the symbol index of each GFIDs entry to form the .gfids section. 109 auto &OS = *Asm->OutStreamer; 110 OS.switchSection(Asm->OutContext.getObjectFileInfo()->getGFIDsSection()); 111 for (const MCSymbol *S : GFIDsEntries) 112 OS.emitCOFFSymbolIndex(S); 113 114 // Emit the symbol index of each GIATs entry to form the .giats section. 115 OS.switchSection(Asm->OutContext.getObjectFileInfo()->getGIATsSection()); 116 for (const MCSymbol *S : GIATsEntries) { 117 OS.emitCOFFSymbolIndex(S); 118 } 119 120 // Emit the symbol index of each longjmp target to form the .gljmp section. 121 OS.switchSection(Asm->OutContext.getObjectFileInfo()->getGLJMPSection()); 122 for (const MCSymbol *S : LongjmpTargets) { 123 OS.emitCOFFSymbolIndex(S); 124 } 125} 126