1 //===-- CodeGen/AsmPrinter/WinCFGuard.cpp - Control Flow Guard Impl ------===//
2 //
3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4 // See https://llvm.org/LICENSE.txt for license information.
5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6 //
7 //===----------------------------------------------------------------------===//
8 //
9 // This file contains support for writing the metadata for Windows Control Flow
10 // Guard, including address-taken functions and valid longjmp targets.
11 //
12 //===----------------------------------------------------------------------===//
13 
14 #include "WinCFGuard.h"
15 #include "llvm/CodeGen/AsmPrinter.h"
16 #include "llvm/CodeGen/MachineFunction.h"
17 #include "llvm/CodeGen/MachineModuleInfo.h"
18 #include "llvm/CodeGen/MachineOperand.h"
19 #include "llvm/IR/Constants.h"
20 #include "llvm/IR/Instructions.h"
21 #include "llvm/IR/Metadata.h"
22 #include "llvm/MC/MCAsmInfo.h"
23 #include "llvm/MC/MCObjectFileInfo.h"
24 #include "llvm/MC/MCStreamer.h"
25 
26 #include <vector>
27 
28 using namespace llvm;
29 
30 WinCFGuard::WinCFGuard(AsmPrinter *A) : AsmPrinterHandler(), Asm(A) {}
31 
32 WinCFGuard::~WinCFGuard() {}
33 
34 void WinCFGuard::endFunction(const MachineFunction *MF) {
35 
36   // Skip functions without any longjmp targets.
37   if (MF->getLongjmpTargets().empty())
38     return;
39 
40   // Copy the function's longjmp targets to a module-level list.
41   LongjmpTargets.insert(LongjmpTargets.end(), MF->getLongjmpTargets().begin(),
42                         MF->getLongjmpTargets().end());
43 }
44 
45 /// Returns true if this function's address is escaped in a way that might make
46 /// it an indirect call target. Function::hasAddressTaken gives different
47 /// results when a function is called directly with a function prototype
48 /// mismatch, which requires a cast.
49 static bool isPossibleIndirectCallTarget(const Function *F) {
50   SmallVector<const Value *, 4> Users{F};
51   while (!Users.empty()) {
52     const Value *FnOrCast = Users.pop_back_val();
53     for (const Use &U : FnOrCast->uses()) {
54       const User *FnUser = U.getUser();
55       if (isa<BlockAddress>(FnUser))
56         continue;
57       if (const auto *Call = dyn_cast<CallBase>(FnUser)) {
58         if (!Call->isCallee(&U))
59           return true;
60       } else if (isa<Instruction>(FnUser)) {
61         // Consider any other instruction to be an escape. This has some weird
62         // consequences like no-op intrinsics being an escape or a store *to* a
63         // function address being an escape.
64         return true;
65       } else if (const auto *C = dyn_cast<Constant>(FnUser)) {
66         // If this is a constant pointer cast of the function, don't consider
67         // this escape. Analyze the uses of the cast as well. This ensures that
68         // direct calls with mismatched prototypes don't end up in the CFG
69         // table. Consider other constants, such as vtable initializers, to
70         // escape the function.
71         if (C->stripPointerCasts() == F)
72           Users.push_back(FnUser);
73         else
74           return true;
75       }
76     }
77   }
78   return false;
79 }
80 
81 MCSymbol *WinCFGuard::lookupImpSymbol(const MCSymbol *Sym) {
82   if (Sym->getName().startswith("__imp_"))
83     return nullptr;
84   return Asm->OutContext.lookupSymbol(Twine("__imp_") + Sym->getName());
85 }
86 
87 void WinCFGuard::endModule() {
88   const Module *M = Asm->MMI->getModule();
89   std::vector<const MCSymbol *> GFIDsEntries;
90   std::vector<const MCSymbol *> GIATsEntries;
91   for (const Function &F : *M) {
92     if (isPossibleIndirectCallTarget(&F)) {
93       // If F is a dllimport and has an "__imp_" symbol already defined, add the
94       // "__imp_" symbol to the .giats section.
95       if (F.hasDLLImportStorageClass()) {
96         if (MCSymbol *impSym = lookupImpSymbol(Asm->getSymbol(&F))) {
97           GIATsEntries.push_back(impSym);
98         }
99       }
100       // Add the function's symbol to the .gfids section.
101       // Note: For dllimport functions, MSVC sometimes does not add this symbol
102       // to the .gfids section, but only adds the corresponding "__imp_" symbol
103       // to the .giats section. Here we always add the symbol to the .gfids
104       // section, since this does not introduce security risks.
105       GFIDsEntries.push_back(Asm->getSymbol(&F));
106     }
107   }
108 
109   if (GFIDsEntries.empty() && GIATsEntries.empty() && LongjmpTargets.empty())
110     return;
111 
112   // Emit the symbol index of each GFIDs entry to form the .gfids section.
113   auto &OS = *Asm->OutStreamer;
114   OS.SwitchSection(Asm->OutContext.getObjectFileInfo()->getGFIDsSection());
115   for (const MCSymbol *S : GFIDsEntries)
116     OS.EmitCOFFSymbolIndex(S);
117 
118   // Emit the symbol index of each GIATs entry to form the .giats section.
119   OS.SwitchSection(Asm->OutContext.getObjectFileInfo()->getGIATsSection());
120   for (const MCSymbol *S : GIATsEntries) {
121     OS.EmitCOFFSymbolIndex(S);
122   }
123 
124   // Emit the symbol index of each longjmp target to form the .gljmp section.
125   OS.SwitchSection(Asm->OutContext.getObjectFileInfo()->getGLJMPSection());
126   for (const MCSymbol *S : LongjmpTargets) {
127     OS.EmitCOFFSymbolIndex(S);
128   }
129 }
130