LLVM 18.0.0git
CFGuard.cpp
Go to the documentation of this file.
1//===-- CFGuard.cpp - Control Flow Guard checks -----------------*- C++ -*-===//
2//
3// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4// See https://llvm.org/LICENSE.txt for license information.
5// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6//
7//===----------------------------------------------------------------------===//
8///
9/// \file
10/// This file contains the IR transform to add Microsoft's Control Flow Guard
11/// checks on Windows targets.
12///
13//===----------------------------------------------------------------------===//
14
17#include "llvm/ADT/Statistic.h"
18#include "llvm/IR/CallingConv.h"
19#include "llvm/IR/IRBuilder.h"
20#include "llvm/IR/Instruction.h"
22#include "llvm/Pass.h"
24
25using namespace llvm;
26
28
29#define DEBUG_TYPE "cfguard"
30
31STATISTIC(CFGuardCounter, "Number of Control Flow Guard checks added");
32
33namespace {
34
35/// Adds Control Flow Guard (CFG) checks on indirect function calls/invokes.
36/// These checks ensure that the target address corresponds to the start of an
37/// address-taken function. X86_64 targets use the CF_Dispatch mechanism. X86,
38/// ARM, and AArch64 targets use the CF_Check machanism.
39class CFGuard : public FunctionPass {
40public:
41 static char ID;
42
43 enum Mechanism { CF_Check, CF_Dispatch };
44
45 // Default constructor required for the INITIALIZE_PASS macro.
46 CFGuard() : FunctionPass(ID) {
48 // By default, use the guard check mechanism.
49 GuardMechanism = CF_Check;
50 }
51
52 // Recommended constructor used to specify the type of guard mechanism.
53 CFGuard(Mechanism Var) : FunctionPass(ID) {
55 GuardMechanism = Var;
56 }
57
58 /// Inserts a Control Flow Guard (CFG) check on an indirect call using the CFG
59 /// check mechanism. When the image is loaded, the loader puts the appropriate
60 /// guard check function pointer in the __guard_check_icall_fptr global
61 /// symbol. This checks that the target address is a valid address-taken
62 /// function. The address of the target function is passed to the guard check
63 /// function in an architecture-specific register (e.g. ECX on 32-bit X86,
64 /// X15 on Aarch64, and R0 on ARM). The guard check function has no return
65 /// value (if the target is invalid, the guard check funtion will raise an
66 /// error).
67 ///
68 /// For example, the following LLVM IR:
69 /// \code
70 /// %func_ptr = alloca i32 ()*, align 8
71 /// store i32 ()* @target_func, i32 ()** %func_ptr, align 8
72 /// %0 = load i32 ()*, i32 ()** %func_ptr, align 8
73 /// %1 = call i32 %0()
74 /// \endcode
75 ///
76 /// is transformed to:
77 /// \code
78 /// %func_ptr = alloca i32 ()*, align 8
79 /// store i32 ()* @target_func, i32 ()** %func_ptr, align 8
80 /// %0 = load i32 ()*, i32 ()** %func_ptr, align 8
81 /// %1 = load void (i8*)*, void (i8*)** @__guard_check_icall_fptr
82 /// %2 = bitcast i32 ()* %0 to i8*
83 /// call cfguard_checkcc void %1(i8* %2)
84 /// %3 = call i32 %0()
85 /// \endcode
86 ///
87 /// For example, the following X86 assembly code:
88 /// \code
89 /// movl $_target_func, %eax
90 /// calll *%eax
91 /// \endcode
92 ///
93 /// is transformed to:
94 /// \code
95 /// movl $_target_func, %ecx
96 /// calll *___guard_check_icall_fptr
97 /// calll *%ecx
98 /// \endcode
99 ///
100 /// \param CB indirect call to instrument.
101 void insertCFGuardCheck(CallBase *CB);
102
103 /// Inserts a Control Flow Guard (CFG) check on an indirect call using the CFG
104 /// dispatch mechanism. When the image is loaded, the loader puts the
105 /// appropriate guard check function pointer in the
106 /// __guard_dispatch_icall_fptr global symbol. This checks that the target
107 /// address is a valid address-taken function and, if so, tail calls the
108 /// target. The target address is passed in an architecture-specific register
109 /// (e.g. RAX on X86_64), with all other arguments for the target function
110 /// passed as usual.
111 ///
112 /// For example, the following LLVM IR:
113 /// \code
114 /// %func_ptr = alloca i32 ()*, align 8
115 /// store i32 ()* @target_func, i32 ()** %func_ptr, align 8
116 /// %0 = load i32 ()*, i32 ()** %func_ptr, align 8
117 /// %1 = call i32 %0()
118 /// \endcode
119 ///
120 /// is transformed to:
121 /// \code
122 /// %func_ptr = alloca i32 ()*, align 8
123 /// store i32 ()* @target_func, i32 ()** %func_ptr, align 8
124 /// %0 = load i32 ()*, i32 ()** %func_ptr, align 8
125 /// %1 = load i32 ()*, i32 ()** @__guard_dispatch_icall_fptr
126 /// %2 = call i32 %1() [ "cfguardtarget"(i32 ()* %0) ]
127 /// \endcode
128 ///
129 /// For example, the following X86_64 assembly code:
130 /// \code
131 /// leaq target_func(%rip), %rax
132 /// callq *%rax
133 /// \endcode
134 ///
135 /// is transformed to:
136 /// \code
137 /// leaq target_func(%rip), %rax
138 /// callq *__guard_dispatch_icall_fptr(%rip)
139 /// \endcode
140 ///
141 /// \param CB indirect call to instrument.
142 void insertCFGuardDispatch(CallBase *CB);
143
144 bool doInitialization(Module &M) override;
145 bool runOnFunction(Function &F) override;
146
147private:
148 // Only add checks if the module has the cfguard=2 flag.
149 int cfguard_module_flag = 0;
150 Mechanism GuardMechanism = CF_Check;
151 FunctionType *GuardFnType = nullptr;
152 PointerType *GuardFnPtrType = nullptr;
153 Constant *GuardFnGlobal = nullptr;
154};
155
156} // end anonymous namespace
157
158void CFGuard::insertCFGuardCheck(CallBase *CB) {
159
161 "Only applicable for Windows targets");
162 assert(CB->isIndirectCall() &&
163 "Control Flow Guard checks can only be added to indirect calls");
164
165 IRBuilder<> B(CB);
166 Value *CalledOperand = CB->getCalledOperand();
167
168 // If the indirect call is called within catchpad or cleanuppad,
169 // we need to copy "funclet" bundle of the call.
171 if (auto Bundle = CB->getOperandBundle(LLVMContext::OB_funclet))
172 Bundles.push_back(OperandBundleDef(*Bundle));
173
174 // Load the global symbol as a pointer to the check function.
175 LoadInst *GuardCheckLoad = B.CreateLoad(GuardFnPtrType, GuardFnGlobal);
176
177 // Create new call instruction. The CFGuard check should always be a call,
178 // even if the original CallBase is an Invoke or CallBr instruction.
179 CallInst *GuardCheck =
180 B.CreateCall(GuardFnType, GuardCheckLoad, {CalledOperand}, Bundles);
181
182 // Ensure that the first argument is passed in the correct register
183 // (e.g. ECX on 32-bit X86 targets).
185}
186
187void CFGuard::insertCFGuardDispatch(CallBase *CB) {
188
190 "Only applicable for Windows targets");
191 assert(CB->isIndirectCall() &&
192 "Control Flow Guard checks can only be added to indirect calls");
193
194 IRBuilder<> B(CB);
195 Value *CalledOperand = CB->getCalledOperand();
196 Type *CalledOperandType = CalledOperand->getType();
197
198 // Load the global as a pointer to a function of the same type.
199 LoadInst *GuardDispatchLoad = B.CreateLoad(CalledOperandType, GuardFnGlobal);
200
201 // Add the original call target as a cfguardtarget operand bundle.
203 CB->getOperandBundlesAsDefs(Bundles);
204 Bundles.emplace_back("cfguardtarget", CalledOperand);
205
206 // Create a copy of the call/invoke instruction and add the new bundle.
207 assert((isa<CallInst>(CB) || isa<InvokeInst>(CB)) &&
208 "Unknown indirect call type");
209 CallBase *NewCB = CallBase::Create(CB, Bundles, CB);
210
211 // Change the target of the call to be the guard dispatch function.
212 NewCB->setCalledOperand(GuardDispatchLoad);
213
214 // Replace the original call/invoke with the new instruction.
215 CB->replaceAllUsesWith(NewCB);
216
217 // Delete the original call/invoke.
218 CB->eraseFromParent();
219}
220
221bool CFGuard::doInitialization(Module &M) {
222
223 // Check if this module has the cfguard flag and read its value.
224 if (auto *MD =
225 mdconst::extract_or_null<ConstantInt>(M.getModuleFlag("cfguard")))
226 cfguard_module_flag = MD->getZExtValue();
227
228 // Skip modules for which CFGuard checks have been disabled.
229 if (cfguard_module_flag != 2)
230 return false;
231
232 // Set up prototypes for the guard check and dispatch functions.
233 GuardFnType =
234 FunctionType::get(Type::getVoidTy(M.getContext()),
235 {PointerType::getUnqual(M.getContext())}, false);
236 GuardFnPtrType = PointerType::get(GuardFnType, 0);
237
238 // Get or insert the guard check or dispatch global symbols.
239 llvm::StringRef GuardFnName;
240 if (GuardMechanism == CF_Check) {
241 GuardFnName = "__guard_check_icall_fptr";
242 } else if (GuardMechanism == CF_Dispatch) {
243 GuardFnName = "__guard_dispatch_icall_fptr";
244 } else {
245 assert(false && "Invalid CFGuard mechanism");
246 }
247 GuardFnGlobal = M.getOrInsertGlobal(GuardFnName, GuardFnPtrType, [&] {
248 auto *Var = new GlobalVariable(M, GuardFnPtrType, false,
249 GlobalVariable::ExternalLinkage, nullptr,
250 GuardFnName);
251 Var->setDSOLocal(true);
252 return Var;
253 });
254
255 return true;
256}
257
258bool CFGuard::runOnFunction(Function &F) {
259
260 // Skip modules for which CFGuard checks have been disabled.
261 if (cfguard_module_flag != 2)
262 return false;
263
264 SmallVector<CallBase *, 8> IndirectCalls;
265
266 // Iterate over the instructions to find all indirect call/invoke/callbr
267 // instructions. Make a separate list of pointers to indirect
268 // call/invoke/callbr instructions because the original instructions will be
269 // deleted as the checks are added.
270 for (BasicBlock &BB : F) {
271 for (Instruction &I : BB) {
272 auto *CB = dyn_cast<CallBase>(&I);
273 if (CB && CB->isIndirectCall() && !CB->hasFnAttr("guard_nocf")) {
274 IndirectCalls.push_back(CB);
275 CFGuardCounter++;
276 }
277 }
278 }
279
280 // If no checks are needed, return early.
281 if (IndirectCalls.empty()) {
282 return false;
283 }
284
285 // For each indirect call/invoke, add the appropriate dispatch or check.
286 if (GuardMechanism == CF_Dispatch) {
287 for (CallBase *CB : IndirectCalls) {
288 insertCFGuardDispatch(CB);
289 }
290 } else {
291 for (CallBase *CB : IndirectCalls) {
292 insertCFGuardCheck(CB);
293 }
294 }
295
296 return true;
297}
298
299char CFGuard::ID = 0;
300INITIALIZE_PASS(CFGuard, "CFGuard", "CFGuard", false, false)
301
303 return new CFGuard(CFGuard::CF_Check);
304}
305
307 return new CFGuard(CFGuard::CF_Dispatch);
308}
static GCRegistry::Add< OcamlGC > B("ocaml", "ocaml 3.10-compatible GC")
OperandBundleDefT< Value * > OperandBundleDef
Definition: CFGuard.cpp:27
#define F(x, y, z)
Definition: MD5.cpp:55
#define I(x, y, z)
Definition: MD5.cpp:58
#define INITIALIZE_PASS(passName, arg, name, cfg, analysis)
Definition: PassSupport.h:38
assert(ImpDefSCC.getReg()==AMDGPU::SCC &&ImpDefSCC.isDef())
This file defines the SmallVector class.
This file defines the 'Statistic' class, which is designed to be an easy way to expose various metric...
#define STATISTIC(VARNAME, DESC)
Definition: Statistic.h:167
LLVM Basic Block Representation.
Definition: BasicBlock.h:60
Base class for all callable instructions (InvokeInst and CallInst) Holds everything related to callin...
Definition: InstrTypes.h:1259
void setCallingConv(CallingConv::ID CC)
Definition: InstrTypes.h:1543
void getOperandBundlesAsDefs(SmallVectorImpl< OperandBundleDef > &Defs) const
Return the list of operand bundles attached to this instruction as a vector of OperandBundleDefs.
std::optional< OperandBundleUse > getOperandBundle(StringRef Name) const
Return an operand bundle by name, if present.
Definition: InstrTypes.h:2123
bool hasFnAttr(Attribute::AttrKind Kind) const
Determine whether this call has the given attribute.
Definition: InstrTypes.h:1567
bool isIndirectCall() const
Return true if the callsite is an indirect call.
static CallBase * Create(CallBase *CB, ArrayRef< OperandBundleDef > Bundles, Instruction *InsertPt=nullptr)
Create a clone of CB with a different set of operand bundles and insert it before InsertPt.
Value * getCalledOperand() const
Definition: InstrTypes.h:1474
void setCalledOperand(Value *V)
Definition: InstrTypes.h:1517
This class represents a function call, abstracting a target machine's calling convention.
This is an important base class in LLVM.
Definition: Constant.h:41
FunctionPass class - This class is used to implement most global optimizations.
Definition: Pass.h:311
virtual bool runOnFunction(Function &F)=0
runOnFunction - Virtual method overriden by subclasses to do the per-function processing of the pass.
This provides a uniform API for creating instructions and inserting them into a basic block: either a...
Definition: IRBuilder.h:2639
const Module * getModule() const
Return the module owning the function this instruction belongs to or nullptr it the function does not...
Definition: Instruction.cpp:71
InstListType::iterator eraseFromParent()
This method unlinks 'this' from the containing basic block and deletes it.
Definition: Instruction.cpp:93
An instruction for reading from memory.
Definition: Instructions.h:177
A Module instance is used to store all the information related to an LLVM module.
Definition: Module.h:65
const std::string & getTargetTriple() const
Get the target triple which is a string describing the target host.
Definition: Module.h:279
A container for an operand bundle being viewed as a set of values rather than a set of uses.
Definition: InstrTypes.h:1212
static PassRegistry * getPassRegistry()
getPassRegistry - Access the global registry object, which is automatically initialized at applicatio...
virtual bool doInitialization(Module &)
doInitialization - Virtual method overridden by subclasses to do any necessary initialization before ...
Definition: Pass.h:119
bool empty() const
Definition: SmallVector.h:94
reference emplace_back(ArgTypes &&... Args)
Definition: SmallVector.h:941
void push_back(const T &Elt)
Definition: SmallVector.h:416
This is a 'vector' (really, a variable-sized array), optimized for the case when the array is small.
Definition: SmallVector.h:1200
StringRef - Represent a constant reference to a string, i.e.
Definition: StringRef.h:50
Triple - Helper class for working with autoconf configuration names.
Definition: Triple.h:44
bool isOSWindows() const
Tests whether the OS is Windows.
Definition: Triple.h:583
The instances of the Type class are immutable: once they are created, they are never changed.
Definition: Type.h:45
static Type * getVoidTy(LLVMContext &C)
LLVM Value Representation.
Definition: Value.h:74
Type * getType() const
All values are typed, get the type of this value.
Definition: Value.h:255
void replaceAllUsesWith(Value *V)
Change all uses of this to point to a new Value.
Definition: Value.cpp:534
unsigned ID
LLVM IR allows to use arbitrary numbers as calling convention identifiers.
Definition: CallingConv.h:24
@ CFGuard_Check
Special calling convention on Windows for calling the Control Guard Check ICall funtion.
Definition: CallingConv.h:82
This is an optimization pass for GlobalISel generic memory operations.
Definition: AddressRanges.h:18
FunctionPass * createCFGuardDispatchPass()
Insert Control FLow Guard dispatches on indirect function calls.
Definition: CFGuard.cpp:306
void initializeCFGuardPass(PassRegistry &)
FunctionPass * createCFGuardCheckPass()
Insert Control FLow Guard checks on indirect function calls.
Definition: CFGuard.cpp:302