1 //===-- CodeGen/AsmPrinter/WinCFGuard.cpp - Control Flow Guard Impl ------===// 2 // 3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions. 4 // See https://llvm.org/LICENSE.txt for license information. 5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception 6 // 7 //===----------------------------------------------------------------------===// 8 // 9 // This file contains support for writing the metadata for Windows Control Flow 10 // Guard, including address-taken functions and valid longjmp targets. 11 // 12 //===----------------------------------------------------------------------===// 13 14 #include "WinCFGuard.h" 15 #include "llvm/CodeGen/AsmPrinter.h" 16 #include "llvm/CodeGen/MachineFunction.h" 17 #include "llvm/CodeGen/MachineModuleInfo.h" 18 #include "llvm/IR/Constants.h" 19 #include "llvm/IR/InstrTypes.h" 20 #include "llvm/IR/Module.h" 21 #include "llvm/MC/MCObjectFileInfo.h" 22 #include "llvm/MC/MCStreamer.h" 23 24 #include <vector> 25 26 using namespace llvm; 27 28 WinCFGuard::WinCFGuard(AsmPrinter *A) : Asm(A) {} 29 30 WinCFGuard::~WinCFGuard() = default; 31 32 void WinCFGuard::endFunction(const MachineFunction *MF) { 33 34 // Skip functions without any longjmp targets. 35 if (MF->getLongjmpTargets().empty()) 36 return; 37 38 // Copy the function's longjmp targets to a module-level list. 39 llvm::append_range(LongjmpTargets, MF->getLongjmpTargets()); 40 } 41 42 /// Returns true if this function's address is escaped in a way that might make 43 /// it an indirect call target. Function::hasAddressTaken gives different 44 /// results when a function is called directly with a function prototype 45 /// mismatch, which requires a cast. 46 static bool isPossibleIndirectCallTarget(const Function *F) { 47 SmallVector<const Value *, 4> Users{F}; 48 while (!Users.empty()) { 49 const Value *FnOrCast = Users.pop_back_val(); 50 for (const Use &U : FnOrCast->uses()) { 51 const User *FnUser = U.getUser(); 52 if (isa<BlockAddress>(FnUser)) { 53 // Block addresses are illegal to call. 54 continue; 55 } 56 if (const auto *Call = dyn_cast<CallBase>(FnUser)) { 57 if ((!Call->isCallee(&U) || U.get() != F) && 58 !Call->getFunction()->getName().ends_with("$exit_thunk")) { 59 // Passing a function pointer to a call may lead to an indirect 60 // call. As an exception, ignore ARM64EC exit thunks. 61 return true; 62 } 63 } else if (isa<Instruction>(FnUser)) { 64 // Consider any other instruction to be an escape. This has some weird 65 // consequences like no-op intrinsics being an escape or a store *to* a 66 // function address being an escape. 67 return true; 68 } else if (const auto *G = dyn_cast<GlobalValue>(FnUser)) { 69 // Ignore llvm.arm64ec.symbolmap; it doesn't lower to an actual address. 70 if (G->getName() == "llvm.arm64ec.symbolmap") 71 continue; 72 // Globals (for example, vtables) are escapes. 73 return true; 74 } else if (isa<Constant>(FnUser)) { 75 // Constants which aren't a global are intermediate values; recursively 76 // analyze the users to see if they actually escape. 77 Users.push_back(FnUser); 78 } 79 } 80 } 81 return false; 82 } 83 84 MCSymbol *WinCFGuard::lookupImpSymbol(const MCSymbol *Sym) { 85 if (Sym->getName().starts_with("__imp_")) 86 return nullptr; 87 return Asm->OutContext.lookupSymbol(Twine("__imp_") + Sym->getName()); 88 } 89 90 void WinCFGuard::endModule() { 91 const Module *M = Asm->MMI->getModule(); 92 std::vector<const MCSymbol *> GFIDsEntries; 93 std::vector<const MCSymbol *> GIATsEntries; 94 for (const Function &F : *M) { 95 if (isPossibleIndirectCallTarget(&F)) { 96 // If F is a dllimport and has an "__imp_" symbol already defined, add the 97 // "__imp_" symbol to the .giats section. 98 if (F.hasDLLImportStorageClass()) { 99 if (MCSymbol *impSym = lookupImpSymbol(Asm->getSymbol(&F))) { 100 GIATsEntries.push_back(impSym); 101 } 102 } 103 // Add the function's symbol to the .gfids section. 104 // Note: For dllimport functions, MSVC sometimes does not add this symbol 105 // to the .gfids section, but only adds the corresponding "__imp_" symbol 106 // to the .giats section. Here we always add the symbol to the .gfids 107 // section, since this does not introduce security risks. 108 GFIDsEntries.push_back(Asm->getSymbol(&F)); 109 } 110 } 111 112 if (GFIDsEntries.empty() && GIATsEntries.empty() && LongjmpTargets.empty()) 113 return; 114 115 // Emit the symbol index of each GFIDs entry to form the .gfids section. 116 auto &OS = *Asm->OutStreamer; 117 OS.switchSection(Asm->OutContext.getObjectFileInfo()->getGFIDsSection()); 118 for (const MCSymbol *S : GFIDsEntries) 119 OS.emitCOFFSymbolIndex(S); 120 121 // Emit the symbol index of each GIATs entry to form the .giats section. 122 OS.switchSection(Asm->OutContext.getObjectFileInfo()->getGIATsSection()); 123 for (const MCSymbol *S : GIATsEntries) { 124 OS.emitCOFFSymbolIndex(S); 125 } 126 127 // Emit the symbol index of each longjmp target to form the .gljmp section. 128 OS.switchSection(Asm->OutContext.getObjectFileInfo()->getGLJMPSection()); 129 for (const MCSymbol *S : LongjmpTargets) { 130 OS.emitCOFFSymbolIndex(S); 131 } 132 } 133