1//===-- CodeGen/AsmPrinter/WinCFGuard.cpp - Control Flow Guard Impl ------===//
2//
3// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4// See https://llvm.org/LICENSE.txt for license information.
5// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6//
7//===----------------------------------------------------------------------===//
8//
9// This file contains support for writing the metadata for Windows Control Flow
10// Guard, including address-taken functions and valid longjmp targets.
11//
12//===----------------------------------------------------------------------===//
13
14#include "WinCFGuard.h"
15#include "llvm/CodeGen/AsmPrinter.h"
16#include "llvm/CodeGen/MachineFunction.h"
17#include "llvm/CodeGen/MachineModuleInfo.h"
18#include "llvm/IR/InstrTypes.h"
19#include "llvm/IR/Module.h"
20#include "llvm/MC/MCObjectFileInfo.h"
21#include "llvm/MC/MCStreamer.h"
22
23#include <vector>
24
25using namespace llvm;
26
27WinCFGuard::WinCFGuard(AsmPrinter *A) : Asm(A) {}
28
29WinCFGuard::~WinCFGuard() = default;
30
31void WinCFGuard::endFunction(const MachineFunction *MF) {
32
33 // Skip functions without any longjmp targets.
34 if (MF->getLongjmpTargets().empty())
35 return;
36
37 // Copy the function's longjmp targets to a module-level list.
38 llvm::append_range(C&: LongjmpTargets, R: MF->getLongjmpTargets());
39}
40
41/// Returns true if this function's address is escaped in a way that might make
42/// it an indirect call target. Function::hasAddressTaken gives different
43/// results when a function is called directly with a function prototype
44/// mismatch, which requires a cast.
45static bool isPossibleIndirectCallTarget(const GlobalValue *GV) {
46 SmallVector<const Value *, 4> Users{GV};
47 while (!Users.empty()) {
48 const Value *FnOrCast = Users.pop_back_val();
49 for (const Use &U : FnOrCast->uses()) {
50 const User *FnUser = U.getUser();
51 if (const auto *Call = dyn_cast<CallBase>(Val: FnUser)) {
52 if ((!Call->isCallee(U: &U) || U.get() != GV) &&
53 !Call->getFunction()->getName().ends_with(Suffix: "$exit_thunk")) {
54 // Passing a function pointer to a call may lead to an indirect
55 // call. As an exception, ignore ARM64EC exit thunks.
56 return true;
57 }
58 } else if (isa<Instruction>(Val: FnUser)) {
59 // Consider any other instruction to be an escape. This has some weird
60 // consequences like no-op intrinsics being an escape or a store *to* a
61 // function address being an escape.
62 return true;
63 } else if (isa<GlobalAlias>(Val: FnUser)) {
64 // If the function is used via the alias, it's really the alias that's
65 // a possible call target. See "Consider aliases" in endModule().
66 continue;
67 } else if (const auto *G = dyn_cast<GlobalValue>(Val: FnUser)) {
68 // Ignore llvm.arm64ec.symbolmap; it doesn't lower to an actual address.
69 if (G->getName() == "llvm.arm64ec.symbolmap")
70 continue;
71 // Globals (for example, vtables) are escapes.
72 return true;
73 } else if (isa<Constant>(Val: FnUser)) {
74 // Constants which aren't a global are intermediate values; recursively
75 // analyze the users to see if they actually escape.
76 Users.push_back(Elt: FnUser);
77 }
78 }
79 }
80 return false;
81}
82
83MCSymbol *WinCFGuard::lookupImpSymbol(const MCSymbol *Sym) {
84 if (Sym->getName().starts_with(Prefix: "__imp_"))
85 return nullptr;
86 return Asm->OutContext.lookupSymbol(Name: Twine("__imp_") + Sym->getName());
87}
88
89void WinCFGuard::endModule() {
90 const Module *M = Asm->MMI->getModule();
91 std::vector<const MCSymbol *> GFIDsEntries;
92 std::vector<const MCSymbol *> GIATsEntries;
93 for (const Function &F : *M) {
94 if (isPossibleIndirectCallTarget(GV: &F)) {
95 // If F is a dllimport and has an "__imp_" symbol already defined, add the
96 // "__imp_" symbol to the .giats section.
97 if (F.hasDLLImportStorageClass()) {
98 if (MCSymbol *impSym = lookupImpSymbol(Sym: Asm->getSymbol(GV: &F))) {
99 GIATsEntries.push_back(x: impSym);
100 }
101 }
102 // Add the function's symbol to the .gfids section.
103 // Note: For dllimport functions, MSVC sometimes does not add this symbol
104 // to the .gfids section, but only adds the corresponding "__imp_" symbol
105 // to the .giats section. Here we always add the symbol to the .gfids
106 // section, since this does not introduce security risks.
107 GFIDsEntries.push_back(x: Asm->getSymbol(GV: &F));
108 }
109 }
110
111 for (const GlobalAlias &GA : M->aliases()) {
112 // Consider aliases to functions as possible call targets.
113 const GlobalObject *Aliasee = GA.getAliaseeObject();
114 if (Aliasee && isa<Function>(Val: Aliasee) && isPossibleIndirectCallTarget(GV: &GA))
115 GFIDsEntries.push_back(x: Asm->getSymbol(GV: &GA));
116 }
117
118 if (GFIDsEntries.empty() && GIATsEntries.empty() && LongjmpTargets.empty())
119 return;
120
121 // Emit the symbol index of each GFIDs entry to form the .gfids section.
122 auto &OS = *Asm->OutStreamer;
123 OS.switchSection(Section: Asm->OutContext.getObjectFileInfo()->getGFIDsSection());
124 for (const MCSymbol *S : GFIDsEntries)
125 OS.emitCOFFSymbolIndex(Symbol: S);
126
127 // Emit the symbol index of each GIATs entry to form the .giats section.
128 OS.switchSection(Section: Asm->OutContext.getObjectFileInfo()->getGIATsSection());
129 for (const MCSymbol *S : GIATsEntries) {
130 OS.emitCOFFSymbolIndex(Symbol: S);
131 }
132
133 // Emit the symbol index of each longjmp target to form the .gljmp section.
134 OS.switchSection(Section: Asm->OutContext.getObjectFileInfo()->getGLJMPSection());
135 for (const MCSymbol *S : LongjmpTargets) {
136 OS.emitCOFFSymbolIndex(Symbol: S);
137 }
138}
139