llvm.org GIT mirror llvm / fa601de
Graph builder implementation. Implement a localised graph builder for indirect control flow instructions. Main interface is through GraphBuilder::buildFlowGraph, which will build a flow graph around an indirect CF instruction. Various modifications to FileVerifier are also made to const-expose some members needed for machine code analysis done by the graph builder. Reviewers: vlad.tsyrklevich Reviewed By: vlad.tsyrklevich Subscribers: llvm-commits, kcc, pcc Differential Revision: https://reviews.llvm.org/D38427 git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@316372 91177308-0d34-0410-b5e6-96231b3b80d8 Mitch Phillips 1 year, 9 months ago
7 changed file(s) with 986 addition(s) and 7 deletion(s). Raw diff Collapse all Expand all
33 AllTargetsDescs
44 AllTargetsDisassemblers
55 AllTargetsInfos
6 CFIVerify
67 MC
78 MCParser
89 Object
1011 )
1112
1213 add_llvm_tool(llvm-cfi-verify
13 llvm-cfi-verify.cpp
14 lib/FileAnalysis.cpp
15 )
14 llvm-cfi-verify.cpp)
1615
1716 add_subdirectory(lib)
0 add_library(LLVMCFIVerify
11 STATIC
22 FileAnalysis.cpp
3 FileAnalysis.h)
3 FileAnalysis.h
4 GraphBuilder.cpp
5 GraphBuilder.h)
46
57 llvm_update_compile_flags(LLVMCFIVerify)
68 llvm_map_components_to_libnames(libs
99 #ifndef LLVM_CFI_VERIFY_FILE_ANALYSIS_H
1010 #define LLVM_CFI_VERIFY_FILE_ANALYSIS_H
1111
12 #include "llvm/ADT/DenseMap.h"
1213 #include "llvm/BinaryFormat/ELF.h"
1314 #include "llvm/MC/MCAsmInfo.h"
1415 #include "llvm/MC/MCContext.h"
160161
161162 // Contains a mapping between a specific address, and a list of instructions
162163 // that use this address as a branch target (including call instructions).
163 std::unordered_map> StaticBranchTargetings;
164 DenseMap> StaticBranchTargetings;
164165
165166 // A list of addresses of indirect control flow instructions.
166167 std::set IndirectInstructions;
0 //===- GraphBuilder.cpp -----------------------------------------*- C++ -*-===//
1 //
2 // The LLVM Compiler Infrastructure
3 //
4 // This file is distributed under the University of Illinois Open Source
5 // License. See LICENSE.TXT for details.
6 //
7 //===----------------------------------------------------------------------===//
8
9 #include "GraphBuilder.h"
10
11 #include "llvm/BinaryFormat/ELF.h"
12 #include "llvm/MC/MCAsmInfo.h"
13 #include "llvm/MC/MCContext.h"
14 #include "llvm/MC/MCDisassembler/MCDisassembler.h"
15 #include "llvm/MC/MCInst.h"
16 #include "llvm/MC/MCInstPrinter.h"
17 #include "llvm/MC/MCInstrAnalysis.h"
18 #include "llvm/MC/MCInstrDesc.h"
19 #include "llvm/MC/MCInstrInfo.h"
20 #include "llvm/MC/MCObjectFileInfo.h"
21 #include "llvm/MC/MCRegisterInfo.h"
22 #include "llvm/MC/MCSubtargetInfo.h"
23 #include "llvm/Object/Binary.h"
24 #include "llvm/Object/COFF.h"
25 #include "llvm/Object/ELFObjectFile.h"
26 #include "llvm/Object/ObjectFile.h"
27 #include "llvm/Support/Casting.h"
28 #include "llvm/Support/CommandLine.h"
29 #include "llvm/Support/Error.h"
30 #include "llvm/Support/FormatVariadic.h"
31 #include "llvm/Support/MemoryBuffer.h"
32 #include "llvm/Support/TargetRegistry.h"
33 #include "llvm/Support/TargetSelect.h"
34 #include "llvm/Support/raw_ostream.h"
35
36 #include
37
38 using Instr = llvm::cfi_verify::FileAnalysis::Instr;
39
40 namespace llvm {
41 namespace cfi_verify {
42
43 uint64_t SearchLengthForUndef;
44 uint64_t SearchLengthForConditionalBranch;
45
46 static cl::opt SearchLengthForUndefArg(
47 "search-length-undef",
48 cl::desc("Specify the maximum amount of instructions "
49 "to inspect when searching for an undefined "
50 "instruction from a conditional branch."),
51 cl::location(SearchLengthForUndef), cl::init(2));
52
53 static cl::opt SearchLengthForConditionalBranchArg(
54 "search-length-cb",
55 cl::desc("Specify the maximum amount of instructions "
56 "to inspect when searching for a conditional "
57 "branch from an indirect control flow."),
58 cl::location(SearchLengthForConditionalBranch), cl::init(20));
59
60 std::vector GraphResult::flattenAddress(uint64_t Address) const {
61 std::vector Addresses;
62
63 auto It = IntermediateNodes.find(Address);
64 Addresses.push_back(Address);
65
66 while (It != IntermediateNodes.end()) {
67 Addresses.push_back(It->second);
68 It = IntermediateNodes.find(It->second);
69 }
70 return Addresses;
71 }
72
73 GraphResult GraphBuilder::buildFlowGraph(const FileAnalysis &Analysis,
74 uint64_t Address) {
75 GraphResult Result;
76 Result.BaseAddress = Address;
77 DenseSet OpenedNodes;
78
79 const auto &IndirectInstructions = Analysis.getIndirectInstructions();
80
81 if (IndirectInstructions.find(Address) == IndirectInstructions.end())
82 return Result;
83
84 buildFlowGraphImpl(Analysis, OpenedNodes, Result, Address, 0);
85 return Result;
86 }
87
88 void GraphBuilder::buildFlowsToUndefined(const FileAnalysis &Analysis,
89 GraphResult &Result,
90 ConditionalBranchNode &BranchNode,
91 const Instr &BranchInstrMeta) {
92 assert(SearchLengthForUndef > 0 &&
93 "Search length for undefined flow must be greater than zero.");
94
95 // Start setting up the next node in the block.
96 uint64_t NextAddress = 0;
97 const Instr *NextMetaPtr;
98
99 // Find out the next instruction in the block and add it to the new
100 // node.
101 if (BranchNode.Target && !BranchNode.Fallthrough) {
102 // We know the target of the branch, find the fallthrough.
103 NextMetaPtr = Analysis.getNextInstructionSequential(BranchInstrMeta);
104 if (!NextMetaPtr) {
105 errs() << "Failed to get next instruction from "
106 << format_hex(BranchNode.Address, 2) << ".\n";
107 return;
108 }
109
110 NextAddress = NextMetaPtr->VMAddress;
111 BranchNode.Fallthrough =
112 NextMetaPtr->VMAddress; // Add the new node to the branch head.
113 } else if (BranchNode.Fallthrough && !BranchNode.Target) {
114 // We already know the fallthrough, evaluate the target.
115 uint64_t Target;
116 if (!Analysis.getMCInstrAnalysis()->evaluateBranch(
117 BranchInstrMeta.Instruction, BranchInstrMeta.VMAddress,
118 BranchInstrMeta.InstructionSize, Target)) {
119 errs() << "Failed to get branch target for conditional branch at address "
120 << format_hex(BranchInstrMeta.VMAddress, 2) << ".\n";
121 return;
122 }
123
124 // Resolve the meta pointer for the target of this branch.
125 NextMetaPtr = Analysis.getInstruction(Target);
126 if (!NextMetaPtr) {
127 errs() << "Failed to find instruction at address "
128 << format_hex(Target, 2) << ".\n";
129 return;
130 }
131
132 NextAddress = Target;
133 BranchNode.Target =
134 NextMetaPtr->VMAddress; // Add the new node to the branch head.
135 } else {
136 errs() << "ControlBranchNode supplied to buildFlowsToUndefined should "
137 "provide Target xor Fallthrough.\n";
138 return;
139 }
140
141 uint64_t CurrentAddress = NextAddress;
142 const Instr *CurrentMetaPtr = NextMetaPtr;
143
144 // Now the branch head has been set properly, complete the rest of the block.
145 for (uint64_t i = 1; i < SearchLengthForUndef; ++i) {
146 // Check to see whether the block should die.
147 if (Analysis.isCFITrap(*CurrentMetaPtr)) {
148 BranchNode.CFIProtection = true;
149 return;
150 }
151
152 // Find the metadata of the next instruction.
153 NextMetaPtr = Analysis.getDefiniteNextInstruction(*CurrentMetaPtr);
154 if (!NextMetaPtr)
155 return;
156
157 // Setup the next node.
158 NextAddress = NextMetaPtr->VMAddress;
159
160 // Add this as an intermediate.
161 Result.IntermediateNodes[CurrentAddress] = NextAddress;
162
163 // Move the 'current' pointers to the new tail of the block.
164 CurrentMetaPtr = NextMetaPtr;
165 CurrentAddress = NextAddress;
166 }
167
168 // Final check of the last thing we added to the block.
169 if (Analysis.isCFITrap(*CurrentMetaPtr))
170 BranchNode.CFIProtection = true;
171 }
172
173 void GraphBuilder::buildFlowGraphImpl(const FileAnalysis &Analysis,
174 DenseSet &OpenedNodes,
175 GraphResult &Result, uint64_t Address,
176 uint64_t Depth) {
177 // If we've exceeded the flow length, terminate.
178 if (Depth >= SearchLengthForConditionalBranch) {
179 Result.OrphanedNodes.push_back(Address);
180 return;
181 }
182
183 // Ensure this flow is acyclic.
184 if (OpenedNodes.count(Address))
185 Result.OrphanedNodes.push_back(Address);
186
187 // If this flow is already explored, stop here.
188 if (Result.IntermediateNodes.count(Address))
189 return;
190
191 // Get the metadata for the node instruction.
192 const auto &InstrMetaPtr = Analysis.getInstruction(Address);
193 if (!InstrMetaPtr) {
194 errs() << "Failed to build flow graph for instruction at address "
195 << format_hex(Address, 2) << ".\n";
196 Result.OrphanedNodes.push_back(Address);
197 return;
198 }
199 const auto &ChildMeta = *InstrMetaPtr;
200
201 OpenedNodes.insert(Address);
202 std::set CFCrossRefs =
203 Analysis.getDirectControlFlowXRefs(ChildMeta);
204
205 bool HasValidCrossRef = false;
206
207 for (const auto *ParentMetaPtr : CFCrossRefs) {
208 assert(ParentMetaPtr && "CFCrossRefs returned nullptr.");
209 const auto &ParentMeta = *ParentMetaPtr;
210 const auto &ParentDesc =
211 Analysis.getMCInstrInfo()->get(ParentMeta.Instruction.getOpcode());
212
213 if (!ParentDesc.mayAffectControlFlow(ParentMeta.Instruction,
214 *Analysis.getRegisterInfo())) {
215 // If this cross reference doesn't affect CF, continue the graph.
216 buildFlowGraphImpl(Analysis, OpenedNodes, Result, ParentMeta.VMAddress,
217 Depth + 1);
218 Result.IntermediateNodes[ParentMeta.VMAddress] = Address;
219 HasValidCrossRef = true;
220 continue;
221 }
222
223 // Evaluate the branch target to ascertain whether this XRef is the result
224 // of a fallthrough or the target of a branch.
225 uint64_t BranchTarget;
226 if (!Analysis.getMCInstrAnalysis()->evaluateBranch(
227 ParentMeta.Instruction, ParentMeta.VMAddress,
228 ParentMeta.InstructionSize, BranchTarget)) {
229 errs() << "Failed to evaluate branch target for instruction at address "
230 << format_hex(ParentMeta.VMAddress, 2) << ".\n";
231 Result.IntermediateNodes[ParentMeta.VMAddress] = Address;
232 Result.OrphanedNodes.push_back(ParentMeta.VMAddress);
233 continue;
234 }
235
236 // Allow unconditional branches to be part of the upwards traversal.
237 if (ParentDesc.isUnconditionalBranch()) {
238 // Ensures that the unconditional branch is actually an XRef to the child.
239 if (BranchTarget != Address) {
240 errs() << "Control flow to " << format_hex(Address, 2)
241 << ", but target resolution of "
242 << format_hex(ParentMeta.VMAddress, 2)
243 << " is not this address?\n";
244 Result.IntermediateNodes[ParentMeta.VMAddress] = Address;
245 Result.OrphanedNodes.push_back(ParentMeta.VMAddress);
246 continue;
247 }
248
249 buildFlowGraphImpl(Analysis, OpenedNodes, Result, ParentMeta.VMAddress,
250 Depth + 1);
251 Result.IntermediateNodes[ParentMeta.VMAddress] = Address;
252 HasValidCrossRef = true;
253 continue;
254 }
255
256 // Ensure that any unknown CFs are caught.
257 if (!ParentDesc.isConditionalBranch()) {
258 errs() << "Unknown control flow encountered when building graph at "
259 << format_hex(Address, 2) << "\n.";
260 Result.IntermediateNodes[ParentMeta.VMAddress] = Address;
261 Result.OrphanedNodes.push_back(ParentMeta.VMAddress);
262 continue;
263 }
264
265 // Only direct conditional branches should be present at this point. Setup
266 // a conditional branch node and build flows to the ud2.
267 ConditionalBranchNode BranchNode;
268 BranchNode.Address = ParentMeta.VMAddress;
269 BranchNode.Target = 0;
270 BranchNode.Fallthrough = 0;
271 BranchNode.CFIProtection = false;
272
273 if (BranchTarget == Address)
274 BranchNode.Target = Address;
275 else
276 BranchNode.Fallthrough = Address;
277
278 HasValidCrossRef = true;
279 buildFlowsToUndefined(Analysis, Result, BranchNode, ParentMeta);
280 Result.ConditionalBranchNodes.push_back(BranchNode);
281 }
282
283 if (!HasValidCrossRef)
284 Result.OrphanedNodes.push_back(Address);
285
286 OpenedNodes.erase(Address);
287 }
288
289 } // namespace cfi_verify
290 } // namespace llvm
0 //===- GraphBuilder.h -------------------------------------------*- C++ -*-===//
1 //
2 // The LLVM Compiler Infrastructure
3 //
4 // This file is distributed under the University of Illinois Open Source
5 // License. See LICENSE.TXT for details.
6 //
7 //===----------------------------------------------------------------------===//
8
9 #ifndef LLVM_CFI_VERIFY_GRAPH_BUILDER_H
10 #define LLVM_CFI_VERIFY_GRAPH_BUILDER_H
11
12 #include "FileAnalysis.h"
13
14 #include "llvm/ADT/DenseMap.h"
15 #include "llvm/BinaryFormat/ELF.h"
16 #include "llvm/MC/MCAsmInfo.h"
17 #include "llvm/MC/MCContext.h"
18 #include "llvm/MC/MCDisassembler/MCDisassembler.h"
19 #include "llvm/MC/MCInst.h"
20 #include "llvm/MC/MCInstPrinter.h"
21 #include "llvm/MC/MCInstrAnalysis.h"
22 #include "llvm/MC/MCInstrDesc.h"
23 #include "llvm/MC/MCInstrInfo.h"
24 #include "llvm/MC/MCObjectFileInfo.h"
25 #include "llvm/MC/MCRegisterInfo.h"
26 #include "llvm/MC/MCSubtargetInfo.h"
27 #include "llvm/Object/Binary.h"
28 #include "llvm/Object/COFF.h"
29 #include "llvm/Object/ELFObjectFile.h"
30 #include "llvm/Object/ObjectFile.h"
31 #include "llvm/Support/Casting.h"
32 #include "llvm/Support/CommandLine.h"
33 #include "llvm/Support/Error.h"
34 #include "llvm/Support/MemoryBuffer.h"
35 #include "llvm/Support/TargetRegistry.h"
36 #include "llvm/Support/TargetSelect.h"
37 #include "llvm/Support/raw_ostream.h"
38
39 #include
40 #include
41 #include
42 #include
43
44 using Instr = llvm::cfi_verify::FileAnalysis::Instr;
45
46 namespace llvm {
47 namespace cfi_verify {
48
49 extern uint64_t SearchLengthForUndef;
50 extern uint64_t SearchLengthForConditionalBranch;
51
52 struct ConditionalBranchNode {
53 uint64_t Address;
54 uint64_t Target;
55 uint64_t Fallthrough;
56 // Does this conditional branch look like it's used for CFI protection? i.e.
57 // - The exit point of a basic block whos entry point is {target|fallthrough}
58 // is a CFI trap, and...
59 // - The exit point of the other basic block is an undirect CF instruction.
60 bool CFIProtection;
61 };
62
63 // The canonical graph result structure returned by GraphBuilder. The members
64 // in this structure encapsulate all possible code paths to the instruction
65 // located at `BaseAddress`.
66 struct GraphResult {
67 uint64_t BaseAddress;
68
69 // Map between an instruction address, and the address of the next instruction
70 // that will be executed. This map will contain all keys in the range:
71 // - [orphaned node, base address)
72 // - [conditional branch node {target|fallthrough}, base address)
73 DenseMap IntermediateNodes;
74
75 // A list of orphaned nodes. A node is an 'orphan' if it meets any of the
76 // following criteria:
77 // - The length of the path from the base to this node has exceeded
78 // `SearchLengthForConditionalBranch`.
79 // - The node has no cross references to it.
80 // - The path from the base to this node is cyclic.
81 std::vector OrphanedNodes;
82
83 // A list of top-level conditional branches that exist at the top of any
84 // non-orphan paths from the base.
85 std::vector ConditionalBranchNodes;
86
87 // Returns an in-order list of the path between the address provided and the
88 // base. The provided address must be part of this graph, and must not be a
89 // conditional branch.
90 std::vector flattenAddress(uint64_t Address) const;
91 };
92
93 class GraphBuilder {
94 public:
95 // Build the control flow graph for a provided control flow node. This method
96 // will enumerate all branch nodes that can lead to this node, and place them
97 // into GraphResult::ConditionalBranchNodes. It will also provide any orphaned
98 // (i.e. the upwards traversal did not make it to a branch node) flows to the
99 // provided node in GraphResult::OrphanedNodes.
100 static GraphResult buildFlowGraph(const FileAnalysis &Analysis,
101 uint64_t Address);
102
103 private:
104 // Implementation function that actually builds the flow graph. Retrieves a
105 // list of cross references to instruction referenced in `Address`. If any of
106 // these XRefs are conditional branches, it will build the other potential
107 // path (fallthrough or target) using `buildFlowsToUndefined`. Otherwise, this
108 // function will recursively call itself where `Address` in the recursive call
109 // is now the XRef. If any XRef is an orphan, it is added to
110 // `Result.OrphanedNodes`. `OpenedNodes` keeps track of the list of nodes
111 // in the current path and is used for cycle-checking. If the path is found
112 // to be cyclic, it will be added to `Result.OrphanedNodes`.
113 static void buildFlowGraphImpl(const FileAnalysis &Analysis,
114 DenseSet &OpenedNodes,
115 GraphResult &Result, uint64_t Address,
116 uint64_t Depth);
117
118 // Utilised by buildFlowGraphImpl to build the tree out from the provided
119 // conditional branch node to an undefined instruction. The provided
120 // conditional branch node must have exactly one of its subtrees set, and will
121 // update the node's CFIProtection field if a deterministic flow can be found
122 // to an undefined instruction.
123 static void buildFlowsToUndefined(const FileAnalysis &Analysis,
124 GraphResult &Result,
125 ConditionalBranchNode &BranchNode,
126 const Instr &BranchInstrMeta);
127 };
128
129 } // end namespace cfi_verify
130 } // end namespace llvm
131
132 #endif // LLVM_CFI_VERIFY_GRAPH_BUILDER_H
33 AllTargetsDescs
44 AllTargetsDisassemblers
55 AllTargetsInfos
6 CFIVerify
67 MC
78 MCParser
89 Object
1213 list(FIND LLVM_TARGETS_TO_BUILD "X86" x86_idx)
1314 if (NOT x86_idx LESS 0)
1415 add_llvm_unittest(CFIVerifyTests
15 FileAnalysis.cpp)
16 target_link_libraries(CFIVerifyTests LLVMCFIVerify)
16 FileAnalysis.cpp
17 GraphBuilder.cpp)
1718 endif()
0 //===- llvm/unittests/llvm-cfi-verify/GraphBuilder.cpp --------------===//
1 //
2 // The LLVM Compiler Infrastructure
3 //
4 // This file is distributed under the University of Illinois Open Source
5 // License. See LICENSE.TXT for details.
6 //
7 //===----------------------------------------------------------------------===//
8
9 #include "../tools/llvm-cfi-verify/lib/GraphBuilder.h"
10 #include "../tools/llvm-cfi-verify/lib/FileAnalysis.h"
11 #include "gmock/gmock.h"
12 #include "gtest/gtest.h"
13
14 #include "llvm/BinaryFormat/ELF.h"
15 #include "llvm/MC/MCAsmInfo.h"
16 #include "llvm/MC/MCContext.h"
17 #include "llvm/MC/MCDisassembler/MCDisassembler.h"
18 #include "llvm/MC/MCInst.h"
19 #include "llvm/MC/MCInstPrinter.h"
20 #include "llvm/MC/MCInstrAnalysis.h"
21 #include "llvm/MC/MCInstrDesc.h"
22 #include "llvm/MC/MCInstrInfo.h"
23 #include "llvm/MC/MCObjectFileInfo.h"
24 #include "llvm/MC/MCRegisterInfo.h"
25 #include "llvm/MC/MCSubtargetInfo.h"
26 #include "llvm/Object/Binary.h"
27 #include "llvm/Object/COFF.h"
28 #include "llvm/Object/ELFObjectFile.h"
29 #include "llvm/Object/ObjectFile.h"
30 #include "llvm/Support/Casting.h"
31 #include "llvm/Support/CommandLine.h"
32 #include "llvm/Support/Error.h"
33 #include "llvm/Support/MemoryBuffer.h"
34 #include "llvm/Support/TargetRegistry.h"
35 #include "llvm/Support/TargetSelect.h"
36 #include "llvm/Support/raw_ostream.h"
37
38 #include
39 #include
40
41 using Instr = ::llvm::cfi_verify::FileAnalysis::Instr;
42 using ::testing::AllOf;
43 using ::testing::Each;
44 using ::testing::ElementsAre;
45 using ::testing::Eq;
46 using ::testing::Field;
47 using ::testing::IsEmpty;
48 using ::testing::Matches;
49 using ::testing::Pair;
50 using ::testing::PrintToString;
51 using ::testing::Property;
52 using ::testing::SizeIs;
53 using ::testing::UnorderedElementsAre;
54 using ::testing::Value;
55
56 namespace llvm {
57 namespace cfi_verify {
58 // Printing helpers for gtest.
59 std::string HexStringifyContainer(const std::vector &C) {
60 std::stringstream Stream;
61 if (C.empty()) {
62 return "{ }";
63 }
64
65 Stream << "{ ";
66 const auto &LastElemIt = std::end(C) - 1;
67
68 for (auto It = std::begin(C); It != LastElemIt; ++It) {
69 Stream << "0x" << std::hex << *It << ", ";
70 }
71 Stream << "0x" << std::hex << *LastElemIt << " }";
72 return Stream.str();
73 }
74
75 void PrintTo(const ConditionalBranchNode &BranchNode, ::std::ostream *os) {
76 *os << "ConditionalBranchNode
77 << ", Target: 0x" << BranchNode.Target << ", Fallthrough: 0x"
78 << BranchNode.Fallthrough
79 << ", CFIProtection: " << BranchNode.CFIProtection << ">";
80 }
81
82 void PrintTo(const GraphResult &Result, ::std::ostream *os) {
83 *os << "Result BaseAddress: 0x" << std::hex << Result.BaseAddress << "\n";
84
85 if (Result.ConditionalBranchNodes.empty())
86 *os << " (No conditional branch nodes)\n";
87
88 for (const auto &Node : Result.ConditionalBranchNodes) {
89 *os << " ";
90 PrintTo(Node, os);
91 *os << "\n Fallthrough Path: " << std::hex
92 << HexStringifyContainer(Result.flattenAddress(Node.Fallthrough))
93 << "\n";
94 *os << " Target Path: " << std::hex
95 << HexStringifyContainer(Result.flattenAddress(Node.Target)) << "\n";
96 }
97
98 if (Result.OrphanedNodes.empty())
99 *os << " (No orphaned nodes)";
100
101 for (const auto &Orphan : Result.OrphanedNodes) {
102 *os << " Orphan (0x" << std::hex << Orphan
103 << ") Path: " << HexStringifyContainer(Result.flattenAddress(Orphan))
104 << "\n";
105 }
106 }
107
108 namespace {
109 class ELFx86TestFileAnalysis : public FileAnalysis {
110 public:
111 ELFx86TestFileAnalysis()
112 : FileAnalysis(Triple("x86_64--"), SubtargetFeatures()) {}
113
114 // Expose this method publicly for testing.
115 void parseSectionContents(ArrayRef SectionBytes,
116 uint64_t SectionAddress) {
117 FileAnalysis::parseSectionContents(SectionBytes, SectionAddress);
118 }
119
120 Error initialiseDisassemblyMembers() {
121 return FileAnalysis::initialiseDisassemblyMembers();
122 }
123 };
124
125 class BasicGraphBuilderTest : public ::testing::Test {
126 protected:
127 virtual void SetUp() {
128 if (Analysis.initialiseDisassemblyMembers()) {
129 FAIL() << "Failed to initialise FileAnalysis.";
130 }
131 }
132
133 ELFx86TestFileAnalysis Analysis;
134 };
135
136 MATCHER_P2(HasPath, Result, Matcher, "has path " + PrintToString(Matcher)) {
137 const auto &Path = Result.flattenAddress(arg);
138 *result_listener << "the path is " << PrintToString(Path);
139 return Matches(Matcher)(Path);
140 }
141
142 TEST_F(BasicGraphBuilderTest, BuildFlowGraphTestSinglePathFallthroughUd2) {
143 Analysis.parseSectionContents(
144 {
145 0x75, 0x02, // 0: jne 4 [+2]
146 0x0f, 0x0b, // 2: ud2
147 0xff, 0x10, // 4: callq *(%rax)
148 },
149 0xDEADBEEF);
150 const auto Result = GraphBuilder::buildFlowGraph(Analysis, 0xDEADBEEF + 4);
151
152 EXPECT_THAT(Result.OrphanedNodes, IsEmpty());
153 EXPECT_THAT(Result.ConditionalBranchNodes, SizeIs(1));
154 EXPECT_THAT(Result.ConditionalBranchNodes,
155 Each(Field(&ConditionalBranchNode::CFIProtection, Eq(true))));
156 EXPECT_THAT(
157 Result.ConditionalBranchNodes,
158 Contains(AllOf(Field(&ConditionalBranchNode::Address, Eq(0xDEADBEEF)),
159 Field(&ConditionalBranchNode::Target,
160 HasPath(Result, ElementsAre(0xDEADBEEF + 4))),
161 Field(&ConditionalBranchNode::Fallthrough,
162 HasPath(Result, ElementsAre(0xDEADBEEF + 2))))))
163 << PrintToString(Result);
164 }
165
166 TEST_F(BasicGraphBuilderTest, BuildFlowGraphTestSinglePathJumpUd2) {
167 Analysis.parseSectionContents(
168 {
169 0x75, 0x02, // 0: jne 4 [+2]
170 0xff, 0x10, // 2: callq *(%rax)
171 0x0f, 0x0b, // 4: ud2
172 },
173 0xDEADBEEF);
174 const auto Result = GraphBuilder::buildFlowGraph(Analysis, 0xDEADBEEF + 2);
175
176 EXPECT_THAT(Result.OrphanedNodes, IsEmpty());
177 EXPECT_THAT(Result.ConditionalBranchNodes, SizeIs(1));
178 EXPECT_THAT(Result.ConditionalBranchNodes,
179 Each(Field(&ConditionalBranchNode::CFIProtection, Eq(true))));
180 EXPECT_THAT(
181 Result.ConditionalBranchNodes,
182 Contains(AllOf(Field(&ConditionalBranchNode::Address, Eq(0xDEADBEEF)),
183 Field(&ConditionalBranchNode::Target,
184 HasPath(Result, ElementsAre(0xDEADBEEF + 4))),
185 Field(&ConditionalBranchNode::Fallthrough,
186 HasPath(Result, ElementsAre(0xDEADBEEF + 2))))))
187 << PrintToString(Result);
188 }
189
190 TEST_F(BasicGraphBuilderTest, BuildFlowGraphTestDualPathDualUd2) {
191 Analysis.parseSectionContents(
192 {
193 0x75, 0x03, // 0: jne 5 [+3]
194 0x90, // 2: nop
195 0xff, 0x10, // 3: callq *(%rax)
196 0x0f, 0x0b, // 5: ud2
197 0x75, 0xf9, // 7: jne 2 [-7]
198 0x0f, 0x0b, // 9: ud2
199 },
200 0xDEADBEEF);
201 const auto Result = GraphBuilder::buildFlowGraph(Analysis, 0xDEADBEEF + 3);
202
203 EXPECT_THAT(Result.OrphanedNodes, IsEmpty());
204 EXPECT_THAT(Result.ConditionalBranchNodes, SizeIs(2));
205 EXPECT_THAT(Result.ConditionalBranchNodes,
206 Each(Field(&ConditionalBranchNode::CFIProtection, Eq(true))));
207 EXPECT_THAT(
208 Result.ConditionalBranchNodes,
209 Contains(AllOf(
210 Field(&ConditionalBranchNode::Address, Eq(0xDEADBEEF)),
211 Field(&ConditionalBranchNode::Fallthrough,
212 HasPath(Result, ElementsAre(0xDEADBEEF + 2, 0xDEADBEEF + 3))),
213 Field(&ConditionalBranchNode::Target,
214 HasPath(Result, ElementsAre(0xDEADBEEF + 5))))))
215 << PrintToString(Result);
216 EXPECT_THAT(
217 Result.ConditionalBranchNodes,
218 Contains(AllOf(
219 Field(&ConditionalBranchNode::Address, Eq(0xDEADBEEF + 7)),
220 Field(&ConditionalBranchNode::Fallthrough,
221 HasPath(Result, ElementsAre(0xDEADBEEF + 9))),
222 Field(&ConditionalBranchNode::Target,
223 HasPath(Result, ElementsAre(0xDEADBEEF + 2, 0xDEADBEEF + 3))))))
224 << PrintToString(Result);
225 }
226
227 TEST_F(BasicGraphBuilderTest, BuildFlowGraphTestDualPathSingleUd2) {
228 Analysis.parseSectionContents(
229 {
230 0x75, 0x05, // 0: jne 7 [+5]
231 0x90, // 2: nop
232 0xff, 0x10, // 3: callq *(%rax)
233 0x75, 0xfb, // 5: jne 2 [-5]
234 0x0f, 0x0b, // 7: ud2
235 },
236 0xDEADBEEF);
237 GraphResult Result = GraphBuilder::buildFlowGraph(Analysis, 0xDEADBEEF + 3);
238
239 EXPECT_THAT(Result.OrphanedNodes, IsEmpty());
240 EXPECT_THAT(Result.ConditionalBranchNodes, SizeIs(2));
241 EXPECT_THAT(Result.ConditionalBranchNodes,
242 Each(Field(&ConditionalBranchNode::CFIProtection, Eq(true))));
243 EXPECT_THAT(
244 Result.ConditionalBranchNodes,
245 Contains(AllOf(
246 Field(&ConditionalBranchNode::Address, Eq(0xDEADBEEF)),
247 Field(&ConditionalBranchNode::Fallthrough,
248 HasPath(Result, ElementsAre(0xDEADBEEF + 2, 0xDEADBEEF + 3))),
249 Field(&ConditionalBranchNode::Target,
250 HasPath(Result, ElementsAre(0xDEADBEEF + 7))))))
251 << PrintToString(Result);
252 EXPECT_THAT(
253 Result.ConditionalBranchNodes,
254 Contains(AllOf(
255 Field(&ConditionalBranchNode::Address, Eq(0xDEADBEEF + 5)),
256 Field(&ConditionalBranchNode::Fallthrough,
257 HasPath(Result, ElementsAre(0xDEADBEEF + 7))),
258 Field(&ConditionalBranchNode::Target,
259 HasPath(Result, ElementsAre(0xDEADBEEF + 2, 0xDEADBEEF + 3))))))
260 << PrintToString(Result);
261 }
262
263 TEST_F(BasicGraphBuilderTest, BuildFlowGraphFailures) {
264 Analysis.parseSectionContents(
265 {
266 0x90, // 0: nop
267 0x75, 0xfe, // 1: jne 1 [-2]
268 },
269 0xDEADBEEF);
270 GraphResult Result = GraphBuilder::buildFlowGraph(Analysis, 0xDEADBEEF);
271 EXPECT_THAT(Result.OrphanedNodes, IsEmpty());
272 EXPECT_THAT(Result.ConditionalBranchNodes, IsEmpty());
273
274 Result = GraphBuilder::buildFlowGraph(Analysis, 0xDEADBEEF + 1);
275 EXPECT_THAT(Result.OrphanedNodes, IsEmpty());
276 EXPECT_THAT(Result.ConditionalBranchNodes, IsEmpty());
277
278 Result = GraphBuilder::buildFlowGraph(Analysis, 0xDEADC0DE);
279 EXPECT_THAT(Result.OrphanedNodes, IsEmpty());
280 EXPECT_THAT(Result.ConditionalBranchNodes, IsEmpty());
281 }
282
283 TEST_F(BasicGraphBuilderTest, BuildFlowGraphNoXrefs) {
284 Analysis.parseSectionContents(
285 {
286 0xeb, 0xfe, // 0: jmp 0 [-2]
287 0xff, 0x10, // 2: callq *(%rax)
288 },
289 0xDEADBEEF);
290 GraphResult Result = GraphBuilder::buildFlowGraph(Analysis, 0xDEADBEEF + 2);
291 EXPECT_THAT(Result.ConditionalBranchNodes, IsEmpty());
292 EXPECT_THAT(Result.OrphanedNodes, ElementsAre(0xDEADBEEF + 2));
293 EXPECT_THAT(Result.IntermediateNodes, IsEmpty());
294 }
295
296 TEST_F(BasicGraphBuilderTest, BuildFlowGraphConditionalInfiniteLoop) {
297 Analysis.parseSectionContents(
298 {
299 0x75, 0xfe, // 0: jne 0 [-2]
300 0xff, 0x10, // 2: callq *(%rax)
301 },
302 0xDEADBEEF);
303 GraphResult Result = GraphBuilder::buildFlowGraph(Analysis, 0xDEADBEEF + 2);
304 EXPECT_THAT(Result.OrphanedNodes, IsEmpty());
305 EXPECT_THAT(Result.ConditionalBranchNodes, SizeIs(1));
306 EXPECT_THAT(
307 Result.ConditionalBranchNodes,
308 Each(AllOf(Field(&ConditionalBranchNode::CFIProtection, Eq(false)),
309 Field(&ConditionalBranchNode::Target,
310 HasPath(Result, ElementsAre(0xDEADBEEF))),
311 Field(&ConditionalBranchNode::Fallthrough,
312 HasPath(Result, ElementsAre(0xDEADBEEF + 2))))))
313 << PrintToString(Result);
314 }
315
316 TEST_F(BasicGraphBuilderTest, BuildFlowGraphUnconditionalInfiniteLoop) {
317 Analysis.parseSectionContents(
318 {
319 0x75, 0x02, // 0: jne 4 [+2]
320 0xeb, 0xfc, // 2: jmp 0 [-4]
321 0xff, 0x10, // 4: callq *(%rax)
322 },
323 0xDEADBEEF);
324 GraphResult Result = GraphBuilder::buildFlowGraph(Analysis, 0xDEADBEEF + 4);
325 EXPECT_THAT(Result.OrphanedNodes, IsEmpty());
326 EXPECT_THAT(Result.ConditionalBranchNodes, SizeIs(1));
327 EXPECT_THAT(
328 Result.ConditionalBranchNodes,
329 Contains(
330 AllOf(Field(&ConditionalBranchNode::Address, Eq(0xDEADBEEF)),
331 Field(&ConditionalBranchNode::Fallthrough,
332 HasPath(Result, ElementsAre(0xDEADBEEF + 2, 0xDEADBEEF))),
333 Field(&ConditionalBranchNode::Target,
334 HasPath(Result, ElementsAre(0xDEADBEEF + 4))))))
335 << PrintToString(Result);
336 }
337
338 TEST_F(BasicGraphBuilderTest, BuildFlowGraphNoFlowsToIndirection) {
339 Analysis.parseSectionContents(
340 {
341 0x75, 0x00, // 0: jne 2 [+0]
342 0xeb, 0xfc, // 2: jmp 0 [-4]
343 0xff, 0x10, // 4: callq *(%rax)
344 },
345 0xDEADBEEF);
346 GraphResult Result = GraphBuilder::buildFlowGraph(Analysis, 0xDEADBEEF + 4);
347 EXPECT_THAT(Result.OrphanedNodes, ElementsAre(0xDEADBEEF + 4));
348 EXPECT_THAT(Result.ConditionalBranchNodes, IsEmpty());
349 }
350
351 TEST_F(BasicGraphBuilderTest, BuildFlowGraphLengthExceededUpwards) {
352 Analysis.parseSectionContents(
353 {
354 0x75, 0x06, // 0: jne 8 [+6]
355 0x90, // 2: nop
356 0x90, // 3: nop
357 0x90, // 4: nop
358 0x90, // 5: nop
359 0xff, 0x10, // 6: callq *(%rax)
360 0x0f, 0x0b, // 8: ud2
361 },
362 0xDEADBEEF);
363 uint64_t PrevSearchLengthForConditionalBranch =
364 SearchLengthForConditionalBranch;
365 SearchLengthForConditionalBranch = 2;
366
367 GraphResult Result = GraphBuilder::buildFlowGraph(Analysis, 0xDEADBEEF + 6);
368 EXPECT_THAT(Result.OrphanedNodes, SizeIs(1));
369 EXPECT_THAT(Result.OrphanedNodes,
370 Each(HasPath(Result, ElementsAre(0xDEADBEEF + 4, 0xDEADBEEF + 5,
371 0xDEADBEEF + 6))))
372 << PrintToString(Result);
373 EXPECT_THAT(Result.ConditionalBranchNodes, IsEmpty());
374
375 SearchLengthForConditionalBranch = PrevSearchLengthForConditionalBranch;
376 }
377
378 TEST_F(BasicGraphBuilderTest, BuildFlowGraphLengthExceededDownwards) {
379 Analysis.parseSectionContents(
380 {
381 0x75, 0x02, // 0: jne 4 [+2]
382 0xff, 0x10, // 2: callq *(%rax)
383 0x90, // 4: nop
384 0x90, // 5: nop
385 0x90, // 6: nop
386 0x90, // 7: nop
387 0x0f, 0x0b, // 8: ud2
388 },
389 0xDEADBEEF);
390 uint64_t PrevSearchLengthForUndef = SearchLengthForUndef;
391 SearchLengthForUndef = 2;
392
393 GraphResult Result = GraphBuilder::buildFlowGraph(Analysis, 0xDEADBEEF + 2);
394 EXPECT_THAT(Result.OrphanedNodes, IsEmpty());
395 EXPECT_THAT(
396 Result.ConditionalBranchNodes,
397 Each(AllOf(
398 Field(&ConditionalBranchNode::CFIProtection, Eq(false)),
399 Field(&ConditionalBranchNode::Address, Eq(0xDEADBEEF)),
400 Field(&ConditionalBranchNode::Target,
401 HasPath(Result, ElementsAre(0xDEADBEEF + 4, 0xDEADBEEF + 5))),
402 Field(&ConditionalBranchNode::Fallthrough,
403 HasPath(Result, ElementsAre(0xDEADBEEF + 2))))))
404 << PrintToString(Result);
405
406 SearchLengthForUndef = PrevSearchLengthForUndef;
407 }
408
409 // This test ensures when avoiding doing repeated work we still generate the
410 // paths correctly. We don't need to recalculate the flow from 0x2 -> 0x3 as it
411 // should only need to be generated once.
412 TEST_F(BasicGraphBuilderTest, BuildFlowGraphWithRepeatedWork) {
413 Analysis.parseSectionContents(
414 {
415 0x75, 0x05, // 0: jne 7 [+5]
416 0x90, // 2: nop
417 0xff, 0x10, // 3: callq *(%rax)
418 0x75, 0xfb, // 5: jne 2 [-5]
419 0x0f, 0x0b, // 7: ud2
420 },
421 0xDEADBEEF);
422 GraphResult Result = GraphBuilder::buildFlowGraph(Analysis, 0xDEADBEEF + 3);
423 EXPECT_THAT(Result.OrphanedNodes, IsEmpty());
424 EXPECT_THAT(Result.ConditionalBranchNodes, SizeIs(2));
425 EXPECT_THAT(
426 Result.ConditionalBranchNodes,
427 Contains(AllOf(
428 Field(&ConditionalBranchNode::CFIProtection, Eq(true)),
429 Field(&ConditionalBranchNode::Address, Eq(0xDEADBEEF)),
430 Field(&ConditionalBranchNode::Target,
431 HasPath(Result, ElementsAre(0xDEADBEEF + 7))),
432 Field(&ConditionalBranchNode::Fallthrough,
433 HasPath(Result, ElementsAre(0xDEADBEEF + 2, 0xDEADBEEF + 3))))))
434 << PrintToString(Result);
435 EXPECT_THAT(
436 Result.ConditionalBranchNodes,
437 Contains(AllOf(
438 Field(&ConditionalBranchNode::CFIProtection, Eq(true)),
439 Field(&ConditionalBranchNode::Address, Eq(0xDEADBEEF + 5)),
440 Field(&ConditionalBranchNode::Target,
441 HasPath(Result, ElementsAre(0xDEADBEEF + 2, 0xDEADBEEF + 3))),
442 Field(&ConditionalBranchNode::Fallthrough,
443 HasPath(Result, ElementsAre(0xDEADBEEF + 7))))))
444 << PrintToString(Result);
445 EXPECT_THAT(Result.IntermediateNodes, SizeIs(1));
446 EXPECT_THAT(Result.IntermediateNodes,
447 UnorderedElementsAre(Pair(0xDEADBEEF + 2, 0xDEADBEEF + 3)));
448 }
449
450 TEST_F(BasicGraphBuilderTest, BuildFlowGraphComplexExample) {
451 // The following code has this graph:
452 // +----------+ +--------------+
453 // | 20 | <--- | 0 |
454 // +----------+ +--------------+
455 // | |
456 // v v
457 // +----------+ +--------------+
458 // | 21 | | 2 |
459 // +----------+ +--------------+
460 // | |
461 // v v
462 // +----------+ +--------------+
463 // | 22 (ud2) | +-> | 7 |
464 // +----------+ | +--------------+
465 // ^ | |
466 // | | v
467 // +----------+ | +--------------+
468 // | 4 | | | 8 |
469 // +----------+ | +--------------+
470 // | | |
471 // v | v
472 // +----------+ | +--------------+ +------------+
473 // | 6 | -+ | 9 (indirect) | <- | 13 |
474 // +----------+ +--------------+ +------------+
475 // ^ |
476 // | v
477 // +--------------+ +------------+
478 // | 11 | | 15 (error) |
479 // +--------------+ +------------+
480 // Or, in image format: https://i.imgur.com/aX5fCoi.png
481
482 Analysis.parseSectionContents(
483 {
484 0x75, 0x12, // 0: jne 20 [+18]
485 0xeb, 0x03, // 2: jmp 7 [+3]
486 0x75, 0x10, // 4: jne 22 [+16]
487 0x90, // 6: nop
488 0x90, // 7: nop
489 0x90, // 8: nop
490 0xff, 0x10, // 9: callq *(%rax)
491 0xeb, 0xfc, // 11: jmp 9 [-4]
492 0x75, 0xfa, // 13: jne 9 [-6]
493 0xe8, 0x78, 0x56, 0x34, 0x12, // 15: callq OUTOFBOUNDS [+0x12345678]
494 0x90, // 20: nop
495 0x90, // 21: nop
496 0x0f, 0x0b, // 22: ud2
497 },
498 0x1000);
499 uint64_t PrevSearchLengthForUndef = SearchLengthForUndef;
500 SearchLengthForUndef = 5;
501
502 GraphResult Result = GraphBuilder::buildFlowGraph(Analysis, 0x1000 + 9);
503
504 EXPECT_THAT(Result.OrphanedNodes, SizeIs(1));
505 EXPECT_THAT(Result.ConditionalBranchNodes, SizeIs(3));
506
507 EXPECT_THAT(
508 Result.OrphanedNodes,
509 Each(AllOf(Eq(0x1000u + 11),
510 HasPath(Result, ElementsAre(0x1000 + 11, 0x1000 + 9)))))
511 << PrintToString(Result);
512
513 EXPECT_THAT(Result.ConditionalBranchNodes,
514 Contains(AllOf(
515 Field(&ConditionalBranchNode::CFIProtection, Eq(true)),
516 Field(&ConditionalBranchNode::Address, Eq(0x1000u)),
517 Field(&ConditionalBranchNode::Target,
518 HasPath(Result, ElementsAre(0x1000 + 20, 0x1000 + 21,
519 0x1000 + 22))),
520 Field(&ConditionalBranchNode::Fallthrough,
521 HasPath(Result, ElementsAre(0x1000 + 2, 0x1000 + 7,
522 0x1000 + 8, 0x1000 + 9))))))
523 << PrintToString(Result);
524
525 EXPECT_THAT(Result.ConditionalBranchNodes,
526 Contains(AllOf(
527 Field(&ConditionalBranchNode::CFIProtection, Eq(true)),
528 Field(&ConditionalBranchNode::Address, Eq(0x1000u + 4)),
529 Field(&ConditionalBranchNode::Target,
530 HasPath(Result, ElementsAre(0x1000 + 22))),
531 Field(&ConditionalBranchNode::Fallthrough,
532 HasPath(Result, ElementsAre(0x1000 + 6, 0x1000 + 7,
533 0x1000 + 8, 0x1000 + 9))))))
534 << PrintToString(Result);
535
536 EXPECT_THAT(
537 Result.ConditionalBranchNodes,
538 Contains(AllOf(Field(&ConditionalBranchNode::CFIProtection, Eq(false)),
539 Field(&ConditionalBranchNode::Address, Eq(0x1000u + 13)),
540 Field(&ConditionalBranchNode::Target,
541 HasPath(Result, ElementsAre(0x1000 + 9))),
542 Field(&ConditionalBranchNode::Fallthrough,
543 HasPath(Result, ElementsAre(0x1000 + 15))))))
544 << PrintToString(Result);
545
546 SearchLengthForUndef = PrevSearchLengthForUndef;
547 }
548
549 } // anonymous namespace
550 } // end namespace cfi_verify
551 } // end namespace llvm