|
| 1 | +/** |
| 2 | + * This file has no copyright assigned and is placed in the Public Domain. |
| 3 | + * This file is part of the mingw-w64 runtime package. |
| 4 | + * No warranty is given; refer to the file DISCLAIMER.PD within this package. |
| 5 | + */ |
| 6 | + |
| 7 | +// This source file defines the function pointers required to support Control |
| 8 | +// Flow Guard. They shall be included even if CFGuard is disabled when building |
| 9 | +// mingw-w64-crt itself, to allow linking to objects/libraries compiled with |
| 10 | +// CFGuard. |
| 11 | + |
| 12 | +#if defined(__x86_64__) |
| 13 | + |
| 14 | +// The target address is passed as a parameter in an arch-specific manner, |
| 15 | +// however it is not specified how on x86_64 because __guard_dispatch_icall_fptr |
| 16 | +// is used instead. My guess would be that it's passed on %rcx, but it doesn't |
| 17 | +// really matter here because this is a no-op anyway. |
| 18 | +static void __guard_check_icall_dummy(void) {} |
| 19 | + |
| 20 | +// When CFGuard is not active, directly tail-call the target address, which |
| 21 | +// is passed via %rax. |
| 22 | +__asm__( |
| 23 | + ".globl __guard_dispatch_icall_dummy\n" |
| 24 | + "__guard_dispatch_icall_dummy:\n" |
| 25 | + " jmp *%rax\n" |
| 26 | +); |
| 27 | + |
| 28 | +// This is intentionally declared as _not_ a function pointer, so that the |
| 29 | +// jmp instruction is not included as a valid call target for CFGuard. |
| 30 | +extern void *__guard_dispatch_icall_dummy; |
| 31 | + |
| 32 | +#elif defined(__i386__) || defined(__aarch64__) || defined(__arm__) |
| 33 | + |
| 34 | +// The target address is passed via %ecx (x86), X15 (aarch64) or R0 (arm), |
| 35 | +// but it doesn't really matter here because this is a no-op anyway. |
| 36 | +static void __guard_check_icall_dummy(void) {} |
| 37 | + |
| 38 | +#else |
| 39 | +# error "CFGuard support is unimplemented for the current architecture." |
| 40 | +#endif |
| 41 | + |
| 42 | +// I am not sure about the `.00cfg` section. This is just an attempt to follow |
| 43 | +// what VC runtime defines -- it places all the guard check function pointers |
| 44 | +// inside this section. The MSVC linker appears to merge this section into |
| 45 | +// `.rdata`, but LLD does not do this at the time of writing. |
| 46 | +// This section should be readonly data. The only thing that modifies these |
| 47 | +// pointers is the PE image loader. |
| 48 | + |
| 49 | +__asm__(".section .00cfg,\"dr\""); |
| 50 | + |
| 51 | +__attribute__(( section (".00cfg") )) |
| 52 | +void *__guard_check_icall_fptr = &__guard_check_icall_dummy; |
| 53 | + |
| 54 | +#if defined(__x86_64__) |
| 55 | + |
| 56 | +__attribute__(( section (".00cfg") )) |
| 57 | +void *__guard_dispatch_icall_fptr = &__guard_dispatch_icall_dummy; |
| 58 | + |
| 59 | +#endif |
0 commit comments