llvm/lib/CodeGen/AsmPrinter/WinCFGuard.cpp

   1 //===-- CodeGen/AsmPrinter/WinCFGuard.cpp - Control Flow Guard Impl ------===//
   2 //
   3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
   4 // See https://llvm.org/LICENSE.txt for license information.
   5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
   6 //
   7 //===----------------------------------------------------------------------===//
   8 //
   9 // This file contains support for writing the metadata for Windows Control Flow
  10 // Guard, including address-taken functions and valid longjmp targets.
  11 //
  12 //===----------------------------------------------------------------------===//
  13
  14 #include "WinCFGuard.h"
  15 #include "llvm/CodeGen/AsmPrinter.h"
  16 #include "llvm/CodeGen/MachineFunction.h"
  17 #include "llvm/CodeGen/MachineModuleInfo.h"
  18 #include "llvm/CodeGen/MachineOperand.h"
  19 #include "llvm/IR/Constants.h"
  20 #include "llvm/IR/Instructions.h"
  21 #include "llvm/IR/Metadata.h"
  22 #include "llvm/MC/MCAsmInfo.h"
  23 #include "llvm/MC/MCObjectFileInfo.h"
  24 #include "llvm/MC/MCStreamer.h"
  25
  26 #include <vector>
  27
  28 using namespace llvm;
  29
  30 WinCFGuard::WinCFGuard(AsmPrinter *A) : Asm(A) {}
  31
  32 WinCFGuard::~WinCFGuard() {}
  33
  34 void WinCFGuard::endFunction(const MachineFunction *MF) {
  35
  36   // Skip functions without any longjmp targets.
  37   if (MF->getLongjmpTargets().empty())
  38     return;
  39
  40   // Copy the function's longjmp targets to a module-level list.
  41   llvm::append_range(LongjmpTargets, MF->getLongjmpTargets());
  42 }
  43
  44 /// Returns true if this function's address is escaped in a way that might make
  45 /// it an indirect call target. Function::hasAddressTaken gives different
  46 /// results when a function is called directly with a function prototype
  47 /// mismatch, which requires a cast.
  48 static bool isPossibleIndirectCallTarget(const Function *F) {
  49   SmallVector<const Value *, 4> Users{F};
  50   while (!Users.empty()) {
  51     const Value *FnOrCast = Users.pop_back_val();
  52     for (const Use &U : FnOrCast->uses()) {
  53       const User *FnUser = U.getUser();
  54       if (isa<BlockAddress>(FnUser))
  55         continue;
  56       if (const auto *Call = dyn_cast<CallBase>(FnUser)) {
  57         if (!Call->isCallee(&U))
  58           return true;
  59       } else if (isa<Instruction>(FnUser)) {
  60         // Consider any other instruction to be an escape. This has some weird
  61         // consequences like no-op intrinsics being an escape or a store *to* a
  62         // function address being an escape.
  63         return true;
  64       } else if (const auto *C = dyn_cast<Constant>(FnUser)) {
  65         // If this is a constant pointer cast of the function, don't consider
  66         // this escape. Analyze the uses of the cast as well. This ensures that
  67         // direct calls with mismatched prototypes don't end up in the CFG
  68         // table. Consider other constants, such as vtable initializers, to
  69         // escape the function.
  70         if (C->stripPointerCasts() == F)
  71           Users.push_back(FnUser);
  72         else
  73           return true;
  74       }
  75     }
  76   }
  77   return false;
  78 }
  79
  80 MCSymbol *WinCFGuard::lookupImpSymbol(const MCSymbol *Sym) {
  81   if (Sym->getName().startswith("__imp_"))
  82     return nullptr;
  83   return Asm->OutContext.lookupSymbol(Twine("__imp_") + Sym->getName());
  84 }
  85
  86 void WinCFGuard::endModule() {
  87   const Module *M = Asm->MMI->getModule();
  88   std::vector<const MCSymbol *> GFIDsEntries;
  89   std::vector<const MCSymbol *> GIATsEntries;
  90   for (const Function &F : *M) {
  91     if (isPossibleIndirectCallTarget(&F)) {
  92       // If F is a dllimport and has an "__imp_" symbol already defined, add the
  93       // "__imp_" symbol to the .giats section.
  94       if (F.hasDLLImportStorageClass()) {
  95         if (MCSymbol *impSym = lookupImpSymbol(Asm->getSymbol(&F))) {
  96           GIATsEntries.push_back(impSym);
  97         }
  98       }
  99       // Add the function's symbol to the .gfids section.
 100       // Note: For dllimport functions, MSVC sometimes does not add this symbol
 101       // to the .gfids section, but only adds the corresponding "__imp_" symbol
 102       // to the .giats section. Here we always add the symbol to the .gfids
 103       // section, since this does not introduce security risks.
 104       GFIDsEntries.push_back(Asm->getSymbol(&F));
 105     }
 106   }
 107
 108   if (GFIDsEntries.empty() && GIATsEntries.empty() && LongjmpTargets.empty())
 109     return;
 110
 111   // Emit the symbol index of each GFIDs entry to form the .gfids section.
 112   auto &OS = *Asm->OutStreamer;
 113   OS.SwitchSection(Asm->OutContext.getObjectFileInfo()->getGFIDsSection());
 114   for (const MCSymbol *S : GFIDsEntries)
 115     OS.EmitCOFFSymbolIndex(S);
 116
 117   // Emit the symbol index of each GIATs entry to form the .giats section.
 118   OS.SwitchSection(Asm->OutContext.getObjectFileInfo()->getGIATsSection());
 119   for (const MCSymbol *S : GIATsEntries) {
 120     OS.EmitCOFFSymbolIndex(S);
 121   }
 122
 123   // Emit the symbol index of each longjmp target to form the .gljmp section.
 124   OS.SwitchSection(Asm->OutContext.getObjectFileInfo()->getGLJMPSection());
 125   for (const MCSymbol *S : LongjmpTargets) {
 126     OS.EmitCOFFSymbolIndex(S);
 127   }
 128 }