Index: tools/llvm-cfi-verify/FileAnalysis.h =================================================================== --- tools/llvm-cfi-verify/FileAnalysis.h +++ tools/llvm-cfi-verify/FileAnalysis.h @@ -65,6 +65,12 @@ FileAnalysis(const FileAnalysis &) = delete; FileAnalysis(FileAnalysis &&Other) = default; + // Check whether the provided instruction is CFI protected in this file. + // Returns false if this instruction doesn't exist in this file, if it's not + // an indirect control flow instruction, or isn't CFI protected. Returns true + // otherwise. + bool isCFIProtected(uint64_t Address) const; + // Returns the instruction at the provided address. Returns nullptr if there // is no instruction at the provided address. const Instr *getInstruction(uint64_t Address) const; @@ -88,6 +94,9 @@ // branches or calls. bool canFallThrough(const Instr &InstrMeta) const; + // Returns whether this instruction uses a register operand. + bool usesRegisterOperand(const Instr &InstrMeta) const; + // Returns the definitive next instruction. This is different from the next // instruction sequentially as it will follow unconditional branches (assuming // they can be resolved at compile time, i.e. not indirect). This method Index: tools/llvm-cfi-verify/FileAnalysis.cpp =================================================================== --- tools/llvm-cfi-verify/FileAnalysis.cpp +++ tools/llvm-cfi-verify/FileAnalysis.cpp @@ -8,6 +8,7 @@ //===----------------------------------------------------------------------===// #include "FileAnalysis.h" +#include "GraphBuilder.h" #include "llvm/BinaryFormat/ELF.h" #include "llvm/MC/MCAsmInfo.h" @@ -78,6 +79,33 @@ const SubtargetFeatures &Features) : ObjectTriple(ObjectTriple), Features(Features) {} +bool FileAnalysis::isCFIProtected(uint64_t Address) const { + const Instr *InstrMetaPtr = getInstruction(Address); + if (!InstrMetaPtr) + return false; + + const auto &InstrDesc = MII->get(InstrMetaPtr->Instruction.getOpcode()); + + if (!InstrDesc.mayAffectControlFlow(InstrMetaPtr->Instruction, *RegisterInfo)) + return false; + + if (!usesRegisterOperand(*InstrMetaPtr)) + return false; + + auto Flows = GraphBuilder::buildFlowGraph(*this, Address); + + if (!Flows.OrphanedNodes.empty()) + return false; + + for (const auto &BranchNode : Flows.BranchNodes) { + assert(BranchNode && "Branch node contained nullptr."); + if (!BranchNode->CFIProtection) + return false; + } + + return true; +} + const Instr * FileAnalysis::getPrevInstructionSequential(const Instr &InstrMeta) const { std::map::const_iterator KV = @@ -137,6 +165,14 @@ return true; } +bool FileAnalysis::usesRegisterOperand(const Instr& InstrMeta) const { + for (const auto &Operand : InstrMeta.Instruction) { + if (Operand.isReg()) + return true; + } + return false; +} + const Instr * FileAnalysis::getDefiniteNextInstruction(const Instr &InstrMeta) const { if (!InstrMeta.Valid) @@ -329,13 +365,7 @@ } // Skip instructions that do not operate on register operands. - bool UsesRegisterOperand = false; - for (const auto &Operand : Instruction) { - if (Operand.isReg()) - UsesRegisterOperand = true; - } - - if (!UsesRegisterOperand) + if (!usesRegisterOperand(InstrMeta)) continue; IndirectInstructions.insert(VMAddress); Index: tools/llvm-cfi-verify/llvm-cfi-verify.cpp =================================================================== --- tools/llvm-cfi-verify/llvm-cfi-verify.cpp +++ tools/llvm-cfi-verify/llvm-cfi-verify.cpp @@ -43,6 +43,7 @@ << " "; InstrMeta.Instruction.print(outs()); outs() << "\n"; + outs() << " Protected? " << Verifier.isCFIProtected(Address) << "\n"; } } Index: tools/llvm-cfi-verify/unittests/FileAnalysis.cpp =================================================================== --- tools/llvm-cfi-verify/unittests/FileAnalysis.cpp +++ tools/llvm-cfi-verify/unittests/FileAnalysis.cpp @@ -8,6 +8,7 @@ //===----------------------------------------------------------------------===// #include "../FileAnalysis.h" +#include "../GraphBuilder.h" #include "gmock/gmock.h" #include "gtest/gtest.h" @@ -461,6 +462,157 @@ EXPECT_TRUE(Analysis.getControlFlowXRefs(*InstrMetaPtr).empty()); } +TEST_F(BasicFileAnalysisTest, CFIProtectionInvalidTargets) { + Analysis.parseSectionContents( + { + 0x90, // 0: nop + 0x0f, 0x0b, // 1: ud2 + 0x75, 0x00, // 3: jne 5 [+0] + }, + 0xDEADBEEF); + EXPECT_FALSE(Analysis.isCFIProtected(0xDEADBEEF)); + EXPECT_FALSE(Analysis.isCFIProtected(0xDEADBEEF + 1)); + EXPECT_FALSE(Analysis.isCFIProtected(0xDEADBEEF + 3)); + EXPECT_FALSE(Analysis.isCFIProtected(0xDEADC0DE)); +} + +TEST_F(BasicFileAnalysisTest, CFIProtectionBasicFallthroughToUd2) { + Analysis.parseSectionContents( + { + 0x75, 0x02, // 0: jne 4 [+2] + 0x0f, 0x0b, // 2: ud2 + 0xff, 0x10, // 4: callq *(%rax) + }, + 0xDEADBEEF); + EXPECT_TRUE(Analysis.isCFIProtected(0xDEADBEEF + 4)); +} + +TEST_F(BasicFileAnalysisTest, CFIProtectionBasicJumpToUd2) { + Analysis.parseSectionContents( + { + 0x75, 0x02, // 0: jne 4 [+2] + 0xff, 0x10, // 2: callq *(%rax) + 0x0f, 0x0b, // 4: ud2 + }, + 0xDEADBEEF); + EXPECT_TRUE(Analysis.isCFIProtected(0xDEADBEEF + 2)); +} + +TEST_F(BasicFileAnalysisTest, CFIProtectionDualPathUd2) { + Analysis.parseSectionContents( + { + 0x75, 0x03, // 0: jne 5 [+3] + 0x90, // 2: nop + 0xff, 0x10, // 3: callq *(%rax) + 0x0f, 0x0b, // 5: ud2 + 0x75, 0xf9, // 7: jne 2 [-7] + 0x0f, 0x0b, // 9: ud2 + }, + 0xDEADBEEF); + EXPECT_TRUE(Analysis.isCFIProtected(0xDEADBEEF + 3)); +} + +TEST_F(BasicFileAnalysisTest, CFIProtectionDualPathSingleUd2) { + Analysis.parseSectionContents( + { + 0x75, 0x05, // 0: jne 7 [+5] + 0x90, // 2: nop + 0xff, 0x10, // 3: callq *(%rax) + 0x75, 0xfb, // 5: jne 2 [-5] + 0x0f, 0x0b, // 7: ud2 + }, + 0xDEADBEEF); + EXPECT_TRUE(Analysis.isCFIProtected(0xDEADBEEF + 3)); +} + +TEST_F(BasicFileAnalysisTest, CFIProtectionDualFailLimitUpwards) { + Analysis.parseSectionContents( + { + 0x75, 0x06, // 0: jne 8 [+6] + 0x90, // 2: nop + 0x90, // 3: nop + 0x90, // 4: nop + 0x90, // 5: nop + 0xff, 0x10, // 6: callq *(%rax) + 0x0f, 0x0b, // 8: ud2 + }, + 0xDEADBEEF); + uint64_t PrevSearchLengthForConditionalBranch = + SearchLengthForConditionalBranch; + SearchLengthForConditionalBranch = 2; + + EXPECT_FALSE(Analysis.isCFIProtected(0xDEADBEEF + 6)); + + SearchLengthForConditionalBranch = PrevSearchLengthForConditionalBranch; +} + +TEST_F(BasicFileAnalysisTest, CFIProtectionDualFailLimitDownwards) { + Analysis.parseSectionContents( + { + 0x75, 0x02, // 0: jne 4 [+2] + 0xff, 0x10, // 2: callq *(%rax) + 0x90, // 4: nop + 0x90, // 5: nop + 0x90, // 6: nop + 0x90, // 7: nop + 0x0f, 0x0b, // 8: ud2 + }, + 0xDEADBEEF); + uint64_t PrevSearchLengthForUndef = SearchLengthForUndef; + SearchLengthForUndef = 2; + + EXPECT_FALSE(Analysis.isCFIProtected(0xDEADBEEF + 2)); + + SearchLengthForUndef = PrevSearchLengthForUndef; +} + +TEST_F(BasicFileAnalysisTest, CFIProtectionGoodAndBadPaths) { + Analysis.parseSectionContents( + { + 0xeb, 0x02, // 0: jmp 4 [+2] + 0x75, 0x02, // 2: jne 6 [+2] + 0xff, 0x10, // 4: callq *(%rax) + 0x0f, 0x0b, // 6: ud2 + }, + 0xDEADBEEF); + EXPECT_FALSE(Analysis.isCFIProtected(0xDEADBEEF + 4)); +} + +TEST_F(BasicFileAnalysisTest, CFIProtectionWithUnconditionalJumpInFallthrough) { + Analysis.parseSectionContents( + { + 0x75, 0x04, // 0: jne 6 [+4] + 0xeb, 0x00, // 2: jmp 4 [+0] + 0xff, 0x10, // 4: callq *(%rax) + 0x0f, 0x0b, // 6: ud2 + }, + 0xDEADBEEF); + EXPECT_TRUE(Analysis.isCFIProtected(0xDEADBEEF + 4)); +} + +TEST_F(BasicFileAnalysisTest, CFIProtectionComplexExample) { + // See unittests/GraphBuilder.cpp::BuildFlowGraphComplexExample for this + // graph. + Analysis.parseSectionContents( + { + 0x75, 0x12, // 0: jne 20 [+18] + 0xeb, 0x03, // 2: jmp 7 [+3] + 0x75, 0x10, // 4: jne 22 [+16] + 0x90, // 6: nop + 0x90, // 7: nop + 0x90, // 8: nop + 0xff, 0x10, // 9: callq *(%rax) + 0xeb, 0xfc, // 11: jmp 9 [-4] + 0x75, 0xfa, // 13: jne 9 [-6] + 0xe8, 0x78, 0x56, 0x34, 0x12, // 15: callq OUTOFBOUNDS [+0x12345678] + 0x90, // 20: nop + 0x90, // 21: nop + 0x0f, 0x0b, // 22: ud2 + }, + 0xDEADBEEF); + EXPECT_FALSE(Analysis.isCFIProtected(0xDEADBEEF + 9)); +} + } // anonymous namespace } // end namespace cfi_verify } // end namespace llvm