1 //===-- CodeGen/AsmPrinter/WinCFGuard.cpp - Control Flow Guard Impl ------===//
2 //
3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4 // See https://llvm.org/LICENSE.txt for license information.
5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6 //
7 //===----------------------------------------------------------------------===//
8 //
9 // This file contains support for writing the metadata for Windows Control Flow
10 // Guard, including address-taken functions, and valid longjmp targets.
11 //
12 //===----------------------------------------------------------------------===//
13 
14 #include "WinCFGuard.h"
15 #include "llvm/CodeGen/AsmPrinter.h"
16 #include "llvm/CodeGen/MachineFunction.h"
17 #include "llvm/CodeGen/MachineModuleInfo.h"
18 #include "llvm/CodeGen/MachineOperand.h"
19 #include "llvm/IR/Constants.h"
20 #include "llvm/IR/Instructions.h"
21 #include "llvm/IR/Metadata.h"
22 #include "llvm/IR/Module.h"
23 #include "llvm/MC/MCAsmInfo.h"
24 #include "llvm/MC/MCObjectFileInfo.h"
25 #include "llvm/MC/MCStreamer.h"
26 
27 #include <vector>
28 
29 using namespace llvm;
30 
31 WinCFGuard::WinCFGuard(AsmPrinter *A) : AsmPrinterHandler(), Asm(A) {}
32 
33 WinCFGuard::~WinCFGuard() {}
34 
35 void WinCFGuard::endFunction(const MachineFunction *MF) {
36 
37   // Skip functions without any longjmp targets.
38   if (MF->getLongjmpTargets().empty())
39     return;
40 
41   // Copy the function's longjmp targets to a module-level list.
42   LongjmpTargets.insert(LongjmpTargets.end(), MF->getLongjmpTargets().begin(),
43                         MF->getLongjmpTargets().end());
44 }
45 
46 /// Returns true if this function's address is escaped in a way that might make
47 /// it an indirect call target. Function::hasAddressTaken gives different
48 /// results when a function is called directly with a function prototype
49 /// mismatch, which requires a cast.
50 static bool isPossibleIndirectCallTarget(const Function *F) {
51   SmallVector<const Value *, 4> Users{F};
52   while (!Users.empty()) {
53     const Value *FnOrCast = Users.pop_back_val();
54     for (const Use &U : FnOrCast->uses()) {
55       const User *FnUser = U.getUser();
56       if (isa<BlockAddress>(FnUser))
57         continue;
58       if (const auto *Call = dyn_cast<CallBase>(FnUser)) {
59         if (!Call->isCallee(&U))
60           return true;
61       } else if (isa<Instruction>(FnUser)) {
62         // Consider any other instruction to be an escape. This has some weird
63         // consequences like no-op intrinsics being an escape or a store *to* a
64         // function address being an escape.
65         return true;
66       } else if (const auto *C = dyn_cast<Constant>(FnUser)) {
67         // If this is a constant pointer cast of the function, don't consider
68         // this escape. Analyze the uses of the cast as well. This ensures that
69         // direct calls with mismatched prototypes don't end up in the CFG
70         // table. Consider other constants, such as vtable initializers, to
71         // escape the function.
72         if (C->stripPointerCasts() == F)
73           Users.push_back(FnUser);
74         else
75           return true;
76       }
77     }
78   }
79   return false;
80 }
81 
82 void WinCFGuard::endModule() {
83   const Module *M = Asm->MMI->getModule();
84   std::vector<const Function *> Functions;
85   for (const Function &F : *M)
86     if (isPossibleIndirectCallTarget(&F))
87       Functions.push_back(&F);
88   if (Functions.empty() && LongjmpTargets.empty())
89     return;
90   auto &OS = *Asm->OutStreamer;
91   OS.SwitchSection(Asm->OutContext.getObjectFileInfo()->getGFIDsSection());
92   for (const Function *F : Functions)
93     OS.EmitCOFFSymbolIndex(Asm->getSymbol(F));
94 
95   // Emit the symbol index of each longjmp target.
96   OS.SwitchSection(Asm->OutContext.getObjectFileInfo()->getGLJMPSection());
97   for (const MCSymbol *S : LongjmpTargets) {
98     OS.EmitCOFFSymbolIndex(S);
99   }
100 }
101