1 //===-- CodeGen/AsmPrinter/WinCFGuard.cpp - Control Flow Guard Impl ------===// 2 // 3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions. 4 // See https://llvm.org/LICENSE.txt for license information. 5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception 6 // 7 //===----------------------------------------------------------------------===// 8 // 9 // This file contains support for writing the metadata for Windows Control Flow 10 // Guard, including address-taken functions and valid longjmp targets. 11 // 12 //===----------------------------------------------------------------------===// 13 14 #include "WinCFGuard.h" 15 #include "llvm/CodeGen/AsmPrinter.h" 16 #include "llvm/CodeGen/MachineFunction.h" 17 #include "llvm/CodeGen/MachineModuleInfo.h" 18 #include "llvm/CodeGen/MachineOperand.h" 19 #include "llvm/IR/Constants.h" 20 #include "llvm/IR/Instructions.h" 21 #include "llvm/IR/Metadata.h" 22 #include "llvm/MC/MCAsmInfo.h" 23 #include "llvm/MC/MCObjectFileInfo.h" 24 #include "llvm/MC/MCStreamer.h" 25 26 #include <vector> 27 28 using namespace llvm; 29 30 WinCFGuard::WinCFGuard(AsmPrinter *A) : AsmPrinterHandler(), Asm(A) {} 31 32 WinCFGuard::~WinCFGuard() {} 33 34 void WinCFGuard::endFunction(const MachineFunction *MF) { 35 36 // Skip functions without any longjmp targets. 37 if (MF->getLongjmpTargets().empty()) 38 return; 39 40 // Copy the function's longjmp targets to a module-level list. 41 llvm::append_range(LongjmpTargets, MF->getLongjmpTargets()); 42 } 43 44 /// Returns true if this function's address is escaped in a way that might make 45 /// it an indirect call target. Function::hasAddressTaken gives different 46 /// results when a function is called directly with a function prototype 47 /// mismatch, which requires a cast. 48 static bool isPossibleIndirectCallTarget(const Function *F) { 49 SmallVector<const Value *, 4> Users{F}; 50 while (!Users.empty()) { 51 const Value *FnOrCast = Users.pop_back_val(); 52 for (const Use &U : FnOrCast->uses()) { 53 const User *FnUser = U.getUser(); 54 if (isa<BlockAddress>(FnUser)) 55 continue; 56 if (const auto *Call = dyn_cast<CallBase>(FnUser)) { 57 if (!Call->isCallee(&U)) 58 return true; 59 } else if (isa<Instruction>(FnUser)) { 60 // Consider any other instruction to be an escape. This has some weird 61 // consequences like no-op intrinsics being an escape or a store *to* a 62 // function address being an escape. 63 return true; 64 } else if (const auto *C = dyn_cast<Constant>(FnUser)) { 65 // If this is a constant pointer cast of the function, don't consider 66 // this escape. Analyze the uses of the cast as well. This ensures that 67 // direct calls with mismatched prototypes don't end up in the CFG 68 // table. Consider other constants, such as vtable initializers, to 69 // escape the function. 70 if (C->stripPointerCasts() == F) 71 Users.push_back(FnUser); 72 else 73 return true; 74 } 75 } 76 } 77 return false; 78 } 79 80 MCSymbol *WinCFGuard::lookupImpSymbol(const MCSymbol *Sym) { 81 if (Sym->getName().startswith("__imp_")) 82 return nullptr; 83 return Asm->OutContext.lookupSymbol(Twine("__imp_") + Sym->getName()); 84 } 85 86 void WinCFGuard::endModule() { 87 const Module *M = Asm->MMI->getModule(); 88 std::vector<const MCSymbol *> GFIDsEntries; 89 std::vector<const MCSymbol *> GIATsEntries; 90 for (const Function &F : *M) { 91 if (isPossibleIndirectCallTarget(&F)) { 92 // If F is a dllimport and has an "__imp_" symbol already defined, add the 93 // "__imp_" symbol to the .giats section. 94 if (F.hasDLLImportStorageClass()) { 95 if (MCSymbol *impSym = lookupImpSymbol(Asm->getSymbol(&F))) { 96 GIATsEntries.push_back(impSym); 97 } 98 } 99 // Add the function's symbol to the .gfids section. 100 // Note: For dllimport functions, MSVC sometimes does not add this symbol 101 // to the .gfids section, but only adds the corresponding "__imp_" symbol 102 // to the .giats section. Here we always add the symbol to the .gfids 103 // section, since this does not introduce security risks. 104 GFIDsEntries.push_back(Asm->getSymbol(&F)); 105 } 106 } 107 108 if (GFIDsEntries.empty() && GIATsEntries.empty() && LongjmpTargets.empty()) 109 return; 110 111 // Emit the symbol index of each GFIDs entry to form the .gfids section. 112 auto &OS = *Asm->OutStreamer; 113 OS.SwitchSection(Asm->OutContext.getObjectFileInfo()->getGFIDsSection()); 114 for (const MCSymbol *S : GFIDsEntries) 115 OS.EmitCOFFSymbolIndex(S); 116 117 // Emit the symbol index of each GIATs entry to form the .giats section. 118 OS.SwitchSection(Asm->OutContext.getObjectFileInfo()->getGIATsSection()); 119 for (const MCSymbol *S : GIATsEntries) { 120 OS.EmitCOFFSymbolIndex(S); 121 } 122 123 // Emit the symbol index of each longjmp target to form the .gljmp section. 124 OS.SwitchSection(Asm->OutContext.getObjectFileInfo()->getGLJMPSection()); 125 for (const MCSymbol *S : LongjmpTargets) { 126 OS.EmitCOFFSymbolIndex(S); 127 } 128 } 129