[LLD] Implement /guard:[no]longjmp

[rnk]

Summary

This protects calls to longjmp from transferring control to arbitrary
program points. Instead, longjmp calls are limited to the set of
registered setjmp return addresses.

This also implements /guard:nolongjmp to allow users to link in object
files that call setjmp that weren't compiled with /guard:cf. In this
case, the linker will approximate the set of address taken functions,
but it will leave longjmp unprotected.

I used the following program to test, compiling it with different -guard
flags:

$ cl -c t.c -guard:cf
$ lld-link t.obj -guard:cf

#include <setjmp.h>
#include <stdio.h>
jmp_buf buf;
void g() {
  printf("before longjmp\n");
  fflush(stdout);
  longjmp(buf, 1);
}
void f() {
  if (setjmp(buf)) {
    printf("setjmp returned non-zero\n");
    return;
  }
  g();
}
int main() {
  f();
  printf("hello world\n");
}

In particular, the program aborts when the code is compiled *without*
-guard:cf and linked with -guard:cf. That indicates that longjmps are
protected.

[ruiu]

Overall looking pretty good. A few minor comments.

lld/COFF/Config.h

75

Since we are using enum class above, I'd use enum class too.

lld/COFF/DriverUtils.cpp

135

I'd write these if-else-ifs in the same order as the enum values. I.e. no, nolongjmp and full.

137–139

I'd combine the two else ifs like Args.equals_lower() || Args.equals_lower()

lld/COFF/Writer.cpp

925

This is the same as Config->GuardCF == Full?

[rnk]

Thanks, done

[rnk]

• switch enum style and comparisons

[ruiu]

LGTM

lld/COFF/Config.h

75

I don't think you need uint8_t anymore because you are not using these enum values as integers.

76–78

I'd remove = 0, = 1 and = 2 because they are not compared by < nor >.

[rnk]

• fixup boolean logic error

lld/COFF/Config.h

 
 enum class DebugType {
   None  = 0x0,
   CV    = 0x1,  /// CodeView
   PData = 0x2,  /// Procedure Data
   Fixup = 0x4,  /// Relocation Table
 };
 
+enum class GuardCFLevel : uint8_t {
+  Off = 0,
+  NoLongJmp = 1, // Emit gfids but no longjmp tables
+  Full = 2,      // Enable all protections.
+};
+
 // Global configuration.
 struct Configuration {
   enum ManifestKind { SideBySide, Embed, No };
   bool is64() { return Machine == AMD64 || Machine == ARM64; }
 
   llvm::COFF::MachineTypes Machine = IMAGE_FILE_MACHINE_UNKNOWN;
   bool Verbose = false;
   WindowsSubsystem Subsystem = llvm::COFF::IMAGE_SUBSYSTEM_UNKNOWN;
struct Configuration {
   std::vector<Export> Exports;
   std::set<std::string> DelayLoads;
   std::map<std::string, int> DLLOrder;
   Symbol *DelayLoadHelper = nullptr;
 
   bool SaveTemps = false;
 
   // /guard:cf
-  bool GuardCF;
+  GuardCFLevel GuardCF = GuardCFLevel::Off;
 
   // Used for SafeSEH.
   Symbol *SEHTable = nullptr;
   Symbol *SEHCount = nullptr;
 
   // Used for /opt:lldlto=N
   unsigned LTOOptLevel = 2;
 

lld/COFF/DriverUtils.cpp

void parseVersion(StringRef Arg, uint32_t *Major, uint32_t *Minor) {
   std::tie(S1, S2) = Arg.split('.');
   if (S1.getAsInteger(0, *Major))
     fatal("invalid number: " + S1);
   *Minor = 0;
   if (!S2.empty() && S2.getAsInteger(0, *Minor))
     fatal("invalid number: " + S2);
 }
 
-void parseGuard(StringRef Arg) {
+void parseGuard(StringRef FullArg) {
+  SmallVector<StringRef, 1> SplitArgs;
+  FullArg.split(SplitArgs, ",");
+  for (StringRef Arg : SplitArgs) {
     if (Arg.equals_lower("no"))
-    Config->GuardCF = false;
-  else if (Arg.equals_lower("cf"))
-    Config->GuardCF = true;
+      Config->GuardCF = GuardCFLevel::Off;
+    else if (Arg.equals_lower("nolongjmp"))
+      Config->GuardCF = GuardCFLevel::NoLongJmp;
+    else if (Arg.equals_lower("cf") || Arg.equals_lower("longjmp"))
+      Config->GuardCF = GuardCFLevel::Full;
     else
       fatal("invalid argument to /GUARD: " + Arg);
   }
+}
 
 // Parses a string in the form of "<subsystem>[,<integer>[.<integer>]]".
 void parseSubsystem(StringRef Arg, WindowsSubsystem *Sys, uint32_t *Major,
                     uint32_t *Minor) {
   StringRef SysStr, Ver;
   std::tie(SysStr, Ver) = Arg.split(',');
   *Sys = StringSwitch<WindowsSubsystem>(SysStr.lower())
     .Case("boot_application", IMAGE_SUBSYSTEM_WINDOWS_BOOT_APPLICATION)

lld/COFF/InputFiles.h

public:
   explicit ObjFile(MemoryBufferRef M) : InputFile(ObjectKind, M) {}
   static bool classof(const InputFile *F) { return F->kind() == ObjectKind; }
   void parse() override;
   MachineTypes getMachineType() override;
   ArrayRef<Chunk *> getChunks() { return Chunks; }
   ArrayRef<SectionChunk *> getDebugChunks() { return DebugChunks; }
   ArrayRef<SectionChunk *> getSXDataChunks() { return SXDataChunks; }
   ArrayRef<SectionChunk *> getGuardFidChunks() { return GuardFidChunks; }
+  ArrayRef<SectionChunk *> getGuardLJmpChunks() { return GuardLJmpChunks; }
   ArrayRef<Symbol *> getSymbols() { return Symbols; }
 
   // Returns a Symbol object for the SymbolIndex'th symbol in the
   // underlying object file.
   Symbol *getSymbol(uint32_t SymbolIndex) {
     return Symbols[SymbolIndex];
   }
 
private:
 
   // CodeView debug info sections.
   std::vector<SectionChunk *> DebugChunks;
 
   // Chunks containing symbol table indices of exception handlers. Only used for
   // 32-bit x86.
   std::vector<SectionChunk *> SXDataChunks;
 
-  // Chunks containing symbol table indices of address taken symbols.  These are
-  // not linked into the final binary when /guard:cf is set.
+  // Chunks containing symbol table indices of address taken symbols and longjmp
+  // targets.  These are not linked into the final binary when /guard:cf is set.
   std::vector<SectionChunk *> GuardFidChunks;
+  std::vector<SectionChunk *> GuardLJmpChunks;
 
   // This vector contains the same chunks as Chunks, but they are
   // indexed such that you can get a SectionChunk by section index.
   // Nonexistent section indices are filled with null pointers.
   // (Because section number is 1-based, the first slot is always a
   // null pointer.)
   std::vector<SectionChunk *> SparseChunks;
 

lld/COFF/InputFiles.cpp

SectionChunk *ObjFile::readSection(uint32_t SectionNumber,
   auto *C = make<SectionChunk>(this, Sec);
   if (Def)
     C->Checksum = Def->CheckSum;
 
   // CodeView sections are stored to a different vector because they are not
   // linked in the regular manner.
   if (C->isCodeView())
     DebugChunks.push_back(C);
-  else if (Config->GuardCF && Name == ".gfids$y")
+  else if (Config->GuardCF != GuardCFLevel::Off) {
+    if (Name == ".gfids$y")
       GuardFidChunks.push_back(C);
-  else if (Name == ".sxdata")
+    if (Name == ".gljmp$y")
+      GuardLJmpChunks.push_back(C);
+  } else if (Name == ".sxdata")
     SXDataChunks.push_back(C);
   else
     Chunks.push_back(C);
 
   return C;
 }
 
 void ObjFile::readAssociativeDefinition(

lld/COFF/Writer.cpp

private:
   void createImportTables();
   void createExportTable();
   void assignAddresses();
   void removeEmptySections();
   void createSymbolAndStringTable();
   void openFile(StringRef OutputPath);
   template <typename PEHeaderTy> void writeHeader();
   void createSEHTable(OutputSection *RData);
-  void createGFIDTable(OutputSection *RData);
+  void createGuardCFTables(OutputSection *RData);
+  void createGLJmpTable(OutputSection *RData);
   void markSymbolsForRVATable(ObjFile *File,
                               ArrayRef<SectionChunk *> SymIdxChunks,
                               SymbolRVASet &TableSymbols);
   void maybeAddRVATable(OutputSection *RData, SymbolRVASet TableSymbols,
                         StringRef TableSym, StringRef CountSym);
   void setSectionPermissions();
   void writeSections();
   void writeBuildId();
if (Config->Debug) {
     for (Chunk *C : DebugRecords)
       RData->addChunk(C);
   }
 
   // Create SEH table. x86-only.
   if (Config->Machine == I386)
     createSEHTable(RData);
 
-  // Create the guard function id table if requested.
-  if (Config->GuardCF)
-    createGFIDTable(RData);
+  // Create /guard:cf tables if requested.
+  if (Config->GuardCF != GuardCFLevel::Off)
+    createGuardCFTables(RData);
 }
 
 // Create .idata section for the DLL-imported symbol table.
 // The format of this section is inherently Windows-specific.
 // IdataContents class abstracted away the details for us,
 // so we just let it create chunks and add them to the section.
 void Writer::createImportTables() {
   if (ImportFile::Instances.empty())
template <typename PEHeaderTy> void Writer::writeHeader() {
   if (Config->HighEntropyVA)
     PE->DLLCharacteristics |= IMAGE_DLL_CHARACTERISTICS_HIGH_ENTROPY_VA;
   if (!Config->AllowBind)
     PE->DLLCharacteristics |= IMAGE_DLL_CHARACTERISTICS_NO_BIND;
   if (Config->NxCompat)
     PE->DLLCharacteristics |= IMAGE_DLL_CHARACTERISTICS_NX_COMPAT;
   if (!Config->AllowIsolation)
     PE->DLLCharacteristics |= IMAGE_DLL_CHARACTERISTICS_NO_ISOLATION;
-  if (Config->GuardCF)
+  if (Config->GuardCF != GuardCFLevel::Off)
     PE->DLLCharacteristics |= IMAGE_DLL_CHARACTERISTICS_GUARD_CF;
   if (Config->Machine == I386 && !SEHTable &&
       !Symtab->findUnderscore("_load_config_used"))
     PE->DLLCharacteristics |= IMAGE_DLL_CHARACTERISTICS_NO_SEH;
   if (Config->TerminalServerAware)
     PE->DLLCharacteristics |= IMAGE_DLL_CHARACTERISTICS_TERMINAL_SERVER_AWARE;
   PE->NumberOfRvaAndSize = NumberfOfDataDirectory;
   if (OutputSection *Text = findSection(".text")) {
for (Symbol *Ref : SC->symbols()) {
       }
     }
   }
 }
 
 // Create the guard function id table. This is a table of RVAs of all
 // address-taken functions. It is sorted and uniqued, just like the safe SEH
 // table.
-void Writer::createGFIDTable(OutputSection *RData) {
+void Writer::createGuardCFTables(OutputSection *RData) {
   SymbolRVASet AddressTakenSyms;
+  SymbolRVASet LongJmpTargets;
   for (ObjFile *File : ObjFile::Instances) {
-    // If the object was compiled with /guard:cf, the address taken symbols are
-    // in the .gfids$y sections. Otherwise, we approximate the set of address
-    // taken symbols by checking which symbols were used by relocations in live
-    // sections.
-    if (File->hasGuardCF())
+    // If the object was compiled with /guard:cf, the address taken symbols
+    // are in .gfids$y sections, and the longjmp targets are in .gljmp$y
+    // sections. If the object was not compiled with /guard:cf, we assume there
+    // were no setjmp targets, and that all code symbols with relocations are
+    // possibly address-taken.
+    if (File->hasGuardCF()) {
       markSymbolsForRVATable(File, File->getGuardFidChunks(), AddressTakenSyms);
-    else
+      markSymbolsForRVATable(File, File->getGuardLJmpChunks(), LongJmpTargets);
+    } else {
       markSymbolsWithRelocations(File, AddressTakenSyms);
     }
+  }
 
   // Mark the image entry as address-taken.
   if (Config->Entry)
     addSymbolToRVASet(AddressTakenSyms, cast<Defined>(Config->Entry));
 
   maybeAddRVATable(RData, std::move(AddressTakenSyms), "__guard_fids_table",
                    "__guard_fids_count");
 
+  // Add the longjmp target table unless the user told us not to.
+  if (Config->GuardCF == GuardCFLevel::Full)
+    maybeAddRVATable(RData, std::move(LongJmpTargets), "__guard_longjmp_table",
+                     "__guard_longjmp_count");
+
   // Set __guard_flags, which will be used in the load config to indicate that
   // /guard:cf was enabled.
   uint32_t GuardFlags = uint32_t(coff_guard_flags::CFInstrumented) |
                         uint32_t(coff_guard_flags::HasFidTable);
+  if (Config->GuardCF == GuardCFLevel::Full)
+    GuardFlags |= uint32_t(coff_guard_flags::HasLongJmpTable);
   Symbol *FlagSym = Symtab->findUnderscore("__guard_flags");
   cast<DefinedAbsolute>(FlagSym)->setVA(GuardFlags);
 }
 
 // Take a list of input sections containing symbol table indices and add those
 // symbols to an RVA table. The challenge is that symbol RVAs are not known and
 // depend on the table size, so we can't directly build a set of integers.
 void Writer::markSymbolsForRVATable(ObjFile *File,

lld/test/COFF/gfids-corrupt.s

 # RUN: llvm-mc -triple x86_64-windows-msvc %s -filetype=obj -o %t.obj
-# RUN: lld-link %t.obj -opt:noref -guard:cf -out:%t.exe -entry:main 2>&1 | FileCheck %s --check-prefix=ERRS
+# RUN: lld-link %t.obj -opt:noref -guard:nolongjmp -out:%t.exe -entry:main 2>&1 | FileCheck %s --check-prefix=ERRS
 # RUN: llvm-readobj -file-headers -coff-load-config %t.exe | FileCheck %s
 
 # ERRS: warning: ignoring .gfids$y symbol table index section in object {{.*}}gfids-corrupt{{.*}}
 # ERRS: warning: ignoring invalid symbol table index in section .gfids$y in object {{.*}}gfids-corrupt{{.*}}
 
 # The table is arbitrary, really.
 # CHECK: ImageBase: 0x140000000
 # CHECK: LoadConfig [

lld/test/COFF/gfids-fallback.s

 # RUN: grep -B99999 [S]PLITMARKER %s | llvm-mc -triple x86_64-windows-msvc -filetype=obj -o %t1.obj
 # RUN: grep -A99999 [S]PLITMARKER %s | llvm-mc -triple x86_64-windows-msvc -filetype=obj -o %t2.obj
-# RUN: lld-link %t1.obj %t2.obj -guard:cf -out:%t.exe -entry:main -opt:noref
+# RUN: lld-link %t1.obj %t2.obj -guard:nolongjmp -out:%t.exe -entry:main -opt:noref
 # RUN: llvm-readobj -file-headers -coff-load-config %t.exe | FileCheck %s
 
 # CHECK: ImageBase: 0x140000000
 # CHECK: LoadConfig [
 # CHECK:   SEHandlerTable: 0x0
 # CHECK:   SEHandlerCount: 0
 # CHECK:   GuardCFCheckFunction: 0x0
 # CHECK:   GuardCFCheckDispatch: 0x0

lld/test/COFF/gfids-gc.s

 # RUN: llvm-mc -triple x86_64-windows-msvc %s -filetype=obj -o %t.obj
-# RUN: lld-link %t.obj -guard:cf -out:%t.exe -opt:noref -entry:main
+# RUN: lld-link %t.obj -guard:nolongjmp -out:%t.exe -opt:noref -entry:main
 # RUN: llvm-readobj -file-headers -coff-load-config %t.exe | FileCheck %s --check-prefix=CHECK-NOGC
-# RUN: lld-link %t.obj -guard:cf -out:%t.exe -opt:ref -entry:main
+# RUN: lld-link %t.obj -guard:nolongjmp -out:%t.exe -opt:ref -entry:main
 # RUN: llvm-readobj -file-headers -coff-load-config %t.exe | FileCheck %s --check-prefix=CHECK-GC
 
 # This assembly is meant to mimic what CL emits for this kind of C code when
 # /Gw (-fdata-sections) is enabled:
 # int f() { return 42; }
 # int g() { return 13; }
 # int (*fp1)() = &f;
 # int (*fp2)() = &g;

lld/test/COFF/gfids-icf.s

 # RUN: llvm-mc -triple x86_64-windows-msvc %s -filetype=obj -o %t.obj
-# RUN: lld-link %t.obj -guard:cf -out:%t.exe -opt:icf -entry:main
+# RUN: lld-link %t.obj -guard:nolongjmp -out:%t.exe -opt:icf -entry:main
 # RUN: llvm-readobj -file-headers -coff-load-config %t.exe | FileCheck %s --check-prefix=CHECK
 
 # This assembly is meant to mimic what CL emits for this kind of C code:
 # int icf1() { return 42; }
 # int icf2() { return 42; }
 # int (*fp1)() = &icf1;
 # int (*fp2)() = &icf2;
 # int main() {

lld/test/COFF/guard-longjmp.s

+# RUN: llvm-mc -triple x86_64-windows-msvc %s -filetype=obj -o %t.obj
+# RUN: lld-link %t.obj -guard:cf -out:%t.exe -entry:main
+# RUN: llvm-readobj -file-headers -coff-load-config %t.exe | FileCheck %s
+
+# CHECK: ImageBase: 0x140000000
+# CHECK: LoadConfig [
+# CHECK:   SEHandlerTable: 0x0
+# CHECK:   SEHandlerCount: 0
+# CHECK:   GuardCFCheckFunction: 0x0
+# CHECK:   GuardCFCheckDispatch: 0x0
+# CHECK:   GuardCFFunctionTable: 0x14000{{.*}}
+# CHECK:   GuardCFFunctionCount: 1
+# CHECK:   GuardFlags: 0x10500
+# CHECK:   GuardAddressTakenIatEntryTable: 0x0
+# CHECK:   GuardAddressTakenIatEntryCount: 0
+# CHECK:   GuardLongJumpTargetTable: 0x14000{{.*}}
+# CHECK:   GuardLongJumpTargetCount: 1
+# CHECK: ]
+# CHECK:      GuardLJmpTable [
+# CHECK-NEXT:   0x14000{{.*}}
+# CHECK-NEXT: ]
+
+
+# This assembly is reduced from C code like:
+# #include <setjmp.h>
+# jmp_buf buf;
+# void g() { longjmp(buf, 1); }
+# void f() {
+#   if (setjmp(buf))
+#     return;
+#   g();
+# }
+# int main() { f(); }
+
+# We need @feat.00 to have 0x800 to indicate /guard:cf.
+        .def     @feat.00;
+        .scl    3;
+        .type   0;
+        .endef
+        .globl  @feat.00
+@feat.00 = 0x801
+        .def     f; .scl    2; .type   32; .endef
+        .globl  f
+f:
+        pushq   %rbp
+        subq    $32, %rsp
+        leaq    32(%rsp), %rbp
+        leaq    buf(%rip), %rcx
+        leaq    -32(%rbp), %rdx
+        callq   _setjmp
+.Lljmp1:
+        testl   %eax, %eax
+        je      .LBB1_1
+        addq    $32, %rsp
+        popq    %rbp
+        retq
+.LBB1_1:                                # %if.end
+        leaq    buf(%rip), %rcx
+        movl    $1, %edx
+        callq   longjmp
+        ud2
+
+        # Record the longjmp target.
+        .section        .gljmp$y,"dr"
+        .symidx .Lljmp1
+        .text
+
+        # Provide setjmp/longjmp stubs.
+        .def     _setjmp; .scl    2; .type   32; .endef
+        .globl  _setjmp
+_setjmp:
+        retq
+
+        .def     longjmp; .scl    2; .type   32; .endef
+        .globl  longjmp
+longjmp:
+        retq
+
+        .def     main; .scl    2; .type   32; .endef
+        .globl  main                    # -- Begin function main
+main:                                   # @main
+        subq    $40, %rsp
+        callq   f
+        xorl    %eax, %eax
+        addq    $40, %rsp
+        retq
+
+        .comm   buf,256,4               # @buf
+
+        .section .rdata,"dr"
+.globl _load_config_used
+_load_config_used:
+        .long 256
+        .fill 124, 1, 0
+        .quad __guard_fids_table
+        .quad __guard_fids_count
+        .long __guard_flags
+        .fill 12, 1, 0
+        .quad __guard_iat_table
+        .quad __guard_iat_count
+        .quad __guard_longjmp_table
+        .quad __guard_fids_count
+        .fill 84, 1, 0

llvm/tools/llvm-readobj/COFFDumper.cpp

 namespace {
 
 struct LoadConfigTables {
   uint64_t SEHTableVA = 0;
   uint64_t SEHTableCount = 0;
   uint32_t GuardFlags = 0;
   uint64_t GuardFidTableVA = 0;
   uint64_t GuardFidTableCount = 0;
+  uint64_t GuardLJmpTableVA = 0;
+  uint64_t GuardLJmpTableCount = 0;
 };
 
 class COFFDumper : public ObjDumper {
 public:
   friend class COFFObjectDumpDelegate;
   COFFDumper(const llvm::object::COFFObjectFile *Obj, ScopedPrinter &Writer)
       : ObjDumper(Writer), Obj(Obj), Writer(Writer), Types(100) {}
 
if (Tables.GuardFlags & uint32_t(coff_guard_flags::FidTableHasFlags)) {
           OS << " flags " << utohexstr(Flags);
       };
       printRVATable(Tables.GuardFidTableVA, Tables.GuardFidTableCount, 5,
                     PrintGuardFlags);
     } else {
       printRVATable(Tables.GuardFidTableVA, Tables.GuardFidTableCount, 4);
     }
   }
+
+  if (Tables.GuardLJmpTableVA) {
+    ListScope LS(W, "GuardLJmpTable");
+    printRVATable(Tables.GuardLJmpTableVA, Tables.GuardLJmpTableCount, 4);
+  }
 }
 
 template <typename T>
 void COFFDumper::printCOFFLoadConfig(const T *Conf, LoadConfigTables &Tables) {
   if (!Conf)
     return;
 
   ListScope LS(W, "LoadConfig");
W.printHex("GuardRFFailureRoutineFunctionPointer",
              Conf->GuardRFFailureRoutineFunctionPointer);
   W.printHex("DynamicValueRelocTableOffset",
              Conf->DynamicValueRelocTableOffset);
   W.printNumber("DynamicValueRelocTableSection",
                 Conf->DynamicValueRelocTableSection);
   W.printHex("GuardRFVerifyStackPointerFunctionPointer",
              Conf->GuardRFVerifyStackPointerFunctionPointer);
   W.printHex("HotPatchTableOffset", Conf->HotPatchTableOffset);
+
+  Tables.GuardLJmpTableVA = Conf->GuardLongJumpTargetTable;
+  Tables.GuardLJmpTableCount = Conf->GuardLongJumpTargetCount;
 }
 
 void COFFDumper::printBaseOfDataField(const pe32_header *Hdr) {
   W.printHex("BaseOfData", Hdr->BaseOfData);
 }
 
 void COFFDumper::printBaseOfDataField(const pe32plus_header *) {}