128 lines · cpp
1//===-- CodeGen/AsmPrinter/WinCFGuard.cpp - Control Flow Guard Impl ------===//2//3// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.4// See https://llvm.org/LICENSE.txt for license information.5// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception6//7//===----------------------------------------------------------------------===//8//9// This file contains support for writing the metadata for Windows Control Flow10// Guard, including address-taken functions and valid longjmp targets.11//12//===----------------------------------------------------------------------===//13 14#include "WinCFGuard.h"15#include "llvm/CodeGen/AsmPrinter.h"16#include "llvm/CodeGen/MachineFunction.h"17#include "llvm/CodeGen/MachineModuleInfo.h"18#include "llvm/IR/InstrTypes.h"19#include "llvm/IR/Module.h"20#include "llvm/MC/MCObjectFileInfo.h"21#include "llvm/MC/MCStreamer.h"22 23#include <vector>24 25using namespace llvm;26 27WinCFGuard::WinCFGuard(AsmPrinter *A) : Asm(A) {}28 29WinCFGuard::~WinCFGuard() = default;30 31void WinCFGuard::endFunction(const MachineFunction *MF) {32 33 // Skip functions without any longjmp targets.34 if (MF->getLongjmpTargets().empty())35 return;36 37 // Copy the function's longjmp targets to a module-level list.38 llvm::append_range(LongjmpTargets, MF->getLongjmpTargets());39}40 41/// Returns true if this function's address is escaped in a way that might make42/// it an indirect call target. Function::hasAddressTaken gives different43/// results when a function is called directly with a function prototype44/// mismatch, which requires a cast.45static bool isPossibleIndirectCallTarget(const Function *F) {46 SmallVector<const Value *, 4> Users{F};47 while (!Users.empty()) {48 const Value *FnOrCast = Users.pop_back_val();49 for (const Use &U : FnOrCast->uses()) {50 const User *FnUser = U.getUser();51 if (const auto *Call = dyn_cast<CallBase>(FnUser)) {52 if ((!Call->isCallee(&U) || U.get() != F) &&53 !Call->getFunction()->getName().ends_with("$exit_thunk")) {54 // Passing a function pointer to a call may lead to an indirect55 // call. As an exception, ignore ARM64EC exit thunks.56 return true;57 }58 } else if (isa<Instruction>(FnUser)) {59 // Consider any other instruction to be an escape. This has some weird60 // consequences like no-op intrinsics being an escape or a store *to* a61 // function address being an escape.62 return true;63 } else if (const auto *G = dyn_cast<GlobalValue>(FnUser)) {64 // Ignore llvm.arm64ec.symbolmap; it doesn't lower to an actual address.65 if (G->getName() == "llvm.arm64ec.symbolmap")66 continue;67 // Globals (for example, vtables) are escapes.68 return true;69 } else if (isa<Constant>(FnUser)) {70 // Constants which aren't a global are intermediate values; recursively71 // analyze the users to see if they actually escape.72 Users.push_back(FnUser);73 }74 }75 }76 return false;77}78 79MCSymbol *WinCFGuard::lookupImpSymbol(const MCSymbol *Sym) {80 if (Sym->getName().starts_with("__imp_"))81 return nullptr;82 return Asm->OutContext.lookupSymbol(Twine("__imp_") + Sym->getName());83}84 85void WinCFGuard::endModule() {86 const Module *M = Asm->MMI->getModule();87 std::vector<const MCSymbol *> GFIDsEntries;88 std::vector<const MCSymbol *> GIATsEntries;89 for (const Function &F : *M) {90 if (isPossibleIndirectCallTarget(&F)) {91 // If F is a dllimport and has an "__imp_" symbol already defined, add the92 // "__imp_" symbol to the .giats section.93 if (F.hasDLLImportStorageClass()) {94 if (MCSymbol *impSym = lookupImpSymbol(Asm->getSymbol(&F))) {95 GIATsEntries.push_back(impSym);96 }97 }98 // Add the function's symbol to the .gfids section.99 // Note: For dllimport functions, MSVC sometimes does not add this symbol100 // to the .gfids section, but only adds the corresponding "__imp_" symbol101 // to the .giats section. Here we always add the symbol to the .gfids102 // section, since this does not introduce security risks.103 GFIDsEntries.push_back(Asm->getSymbol(&F));104 }105 }106 107 if (GFIDsEntries.empty() && GIATsEntries.empty() && LongjmpTargets.empty())108 return;109 110 // Emit the symbol index of each GFIDs entry to form the .gfids section.111 auto &OS = *Asm->OutStreamer;112 OS.switchSection(Asm->OutContext.getObjectFileInfo()->getGFIDsSection());113 for (const MCSymbol *S : GFIDsEntries)114 OS.emitCOFFSymbolIndex(S);115 116 // Emit the symbol index of each GIATs entry to form the .giats section.117 OS.switchSection(Asm->OutContext.getObjectFileInfo()->getGIATsSection());118 for (const MCSymbol *S : GIATsEntries) {119 OS.emitCOFFSymbolIndex(S);120 }121 122 // Emit the symbol index of each longjmp target to form the .gljmp section.123 OS.switchSection(Asm->OutContext.getObjectFileInfo()->getGLJMPSection());124 for (const MCSymbol *S : LongjmpTargets) {125 OS.emitCOFFSymbolIndex(S);126 }127}128