Index: tools/llvm-cfi-verify/FileAnalysis.h
===================================================================
--- tools/llvm-cfi-verify/FileAnalysis.h
+++ tools/llvm-cfi-verify/FileAnalysis.h
@@ -65,6 +65,12 @@
FileAnalysis(const FileAnalysis &) = delete;
FileAnalysis(FileAnalysis &&Other) = default;
+ // Check whether the provided instruction is CFI protected in this file.
+ // Returns false if this instruction doesn't exist in this file, if it's not
+ // an indirect control flow instruction, or isn't CFI protected. Returns true
+ // otherwise.
+ bool isCFIProtected(uint64_t Address) const;
+
// Returns the instruction at the provided address. Returns nullptr if there
// is no instruction at the provided address.
const Instr *getInstruction(uint64_t Address) const;
@@ -88,6 +94,9 @@
// branches or calls.
bool canFallThrough(const Instr &InstrMeta) const;
+ // Returns whether this instruction uses a register operand.
+ bool usesRegisterOperand(const Instr &InstrMeta) const;
+
// Returns the definitive next instruction. This is different from the next
// instruction sequentially as it will follow unconditional branches (assuming
// they can be resolved at compile time, i.e. not indirect). This method
@@ -103,9 +112,6 @@
std::set<const Instr *>
getDirectControlFlowXRefs(const Instr &InstrMeta) const;
- // Returns whether this instruction uses a register operand.
- bool usesRegisterOperand(const Instr &InstrMeta) const;
-
// Returns the list of indirect instructions.
const std::set<uint64_t> &getIndirectInstructions() const;
Index: tools/llvm-cfi-verify/FileAnalysis.cpp
===================================================================
--- tools/llvm-cfi-verify/FileAnalysis.cpp
+++ tools/llvm-cfi-verify/FileAnalysis.cpp
@@ -8,6 +8,7 @@
//===----------------------------------------------------------------------===//
#include "FileAnalysis.h"
+#include "GraphBuilder.h"
#include "llvm/BinaryFormat/ELF.h"
#include "llvm/MC/MCAsmInfo.h"
@@ -76,6 +77,32 @@
const SubtargetFeatures &Features)
: ObjectTriple(ObjectTriple), Features(Features) {}
+bool FileAnalysis::isCFIProtected(uint64_t Address) const {
+ const Instr *InstrMetaPtr = getInstruction(Address);
+ if (!InstrMetaPtr)
+ return false;
+
+ const auto &InstrDesc = MII->get(InstrMetaPtr->Instruction.getOpcode());
+
+ if (!InstrDesc.mayAffectControlFlow(InstrMetaPtr->Instruction, *RegisterInfo))
+ return false;
+
+ if (!usesRegisterOperand(*InstrMetaPtr))
+ return false;
+
+ auto Flows = GraphBuilder::buildFlowGraph(*this, Address);
+
+ if (!Flows.OrphanedNodes.empty())
+ return false;
+
+ for (const auto &BranchNode : Flows.BranchNodes) {
+ if (!BranchNode.CFIProtection)
+ return false;
+ }
+
+ return true;
+}
+
const Instr *
FileAnalysis::getPrevInstructionSequential(const Instr &InstrMeta) const {
std::map<uint64_t, Instr>::const_iterator KV =
@@ -102,7 +129,7 @@
return &KV->second;
}
-bool FileAnalysis::usesRegisterOperand(const Instr& InstrMeta) const {
+bool FileAnalysis::usesRegisterOperand(const Instr &InstrMeta) const {
for (const auto &Operand : InstrMeta.Instruction) {
if (Operand.isReg())
return true;
Index: tools/llvm-cfi-verify/llvm-cfi-verify.cpp
===================================================================
--- tools/llvm-cfi-verify/llvm-cfi-verify.cpp
+++ tools/llvm-cfi-verify/llvm-cfi-verify.cpp
@@ -43,6 +43,7 @@
<< " ";
InstrMeta.Instruction.print(outs());
outs() << "\n";
+ outs() << " Protected? " << Verifier.isCFIProtected(Address) << "\n";
}
}
Index: tools/llvm-cfi-verify/unittests/FileAnalysis.cpp
===================================================================
--- tools/llvm-cfi-verify/unittests/FileAnalysis.cpp
+++ tools/llvm-cfi-verify/unittests/FileAnalysis.cpp
@@ -8,6 +8,7 @@
//===----------------------------------------------------------------------===//
#include "../FileAnalysis.h"
+#include "../GraphBuilder.h"
#include "gmock/gmock.h"
#include "gtest/gtest.h"
@@ -462,6 +463,157 @@
EXPECT_TRUE(Analysis.getDirectControlFlowXRefs(*InstrMetaPtr).empty());
}
+TEST_F(BasicFileAnalysisTest, CFIProtectionInvalidTargets) {
+ Analysis.parseSectionContents(
+ {
+ 0x90, // 0: nop
+ 0x0f, 0x0b, // 1: ud2
+ 0x75, 0x00, // 3: jne 5 [+0]
+ },
+ 0xDEADBEEF);
+ EXPECT_FALSE(Analysis.isCFIProtected(0xDEADBEEF));
+ EXPECT_FALSE(Analysis.isCFIProtected(0xDEADBEEF + 1));
+ EXPECT_FALSE(Analysis.isCFIProtected(0xDEADBEEF + 3));
+ EXPECT_FALSE(Analysis.isCFIProtected(0xDEADC0DE));
+}
+
+TEST_F(BasicFileAnalysisTest, CFIProtectionBasicFallthroughToUd2) {
+ Analysis.parseSectionContents(
+ {
+ 0x75, 0x02, // 0: jne 4 [+2]
+ 0x0f, 0x0b, // 2: ud2
+ 0xff, 0x10, // 4: callq *(%rax)
+ },
+ 0xDEADBEEF);
+ EXPECT_TRUE(Analysis.isCFIProtected(0xDEADBEEF + 4));
+}
+
+TEST_F(BasicFileAnalysisTest, CFIProtectionBasicJumpToUd2) {
+ Analysis.parseSectionContents(
+ {
+ 0x75, 0x02, // 0: jne 4 [+2]
+ 0xff, 0x10, // 2: callq *(%rax)
+ 0x0f, 0x0b, // 4: ud2
+ },
+ 0xDEADBEEF);
+ EXPECT_TRUE(Analysis.isCFIProtected(0xDEADBEEF + 2));
+}
+
+TEST_F(BasicFileAnalysisTest, CFIProtectionDualPathUd2) {
+ Analysis.parseSectionContents(
+ {
+ 0x75, 0x03, // 0: jne 5 [+3]
+ 0x90, // 2: nop
+ 0xff, 0x10, // 3: callq *(%rax)
+ 0x0f, 0x0b, // 5: ud2
+ 0x75, 0xf9, // 7: jne 2 [-7]
+ 0x0f, 0x0b, // 9: ud2
+ },
+ 0xDEADBEEF);
+ EXPECT_TRUE(Analysis.isCFIProtected(0xDEADBEEF + 3));
+}
+
+TEST_F(BasicFileAnalysisTest, CFIProtectionDualPathSingleUd2) {
+ Analysis.parseSectionContents(
+ {
+ 0x75, 0x05, // 0: jne 7 [+5]
+ 0x90, // 2: nop
+ 0xff, 0x10, // 3: callq *(%rax)
+ 0x75, 0xfb, // 5: jne 2 [-5]
+ 0x0f, 0x0b, // 7: ud2
+ },
+ 0xDEADBEEF);
+ EXPECT_TRUE(Analysis.isCFIProtected(0xDEADBEEF + 3));
+}
+
+TEST_F(BasicFileAnalysisTest, CFIProtectionDualFailLimitUpwards) {
+ Analysis.parseSectionContents(
+ {
+ 0x75, 0x06, // 0: jne 8 [+6]
+ 0x90, // 2: nop
+ 0x90, // 3: nop
+ 0x90, // 4: nop
+ 0x90, // 5: nop
+ 0xff, 0x10, // 6: callq *(%rax)
+ 0x0f, 0x0b, // 8: ud2
+ },
+ 0xDEADBEEF);
+ uint64_t PrevSearchLengthForConditionalBranch =
+ SearchLengthForConditionalBranch;
+ SearchLengthForConditionalBranch = 2;
+
+ EXPECT_FALSE(Analysis.isCFIProtected(0xDEADBEEF + 6));
+
+ SearchLengthForConditionalBranch = PrevSearchLengthForConditionalBranch;
+}
+
+TEST_F(BasicFileAnalysisTest, CFIProtectionDualFailLimitDownwards) {
+ Analysis.parseSectionContents(
+ {
+ 0x75, 0x02, // 0: jne 4 [+2]
+ 0xff, 0x10, // 2: callq *(%rax)
+ 0x90, // 4: nop
+ 0x90, // 5: nop
+ 0x90, // 6: nop
+ 0x90, // 7: nop
+ 0x0f, 0x0b, // 8: ud2
+ },
+ 0xDEADBEEF);
+ uint64_t PrevSearchLengthForUndef = SearchLengthForUndef;
+ SearchLengthForUndef = 2;
+
+ EXPECT_FALSE(Analysis.isCFIProtected(0xDEADBEEF + 2));
+
+ SearchLengthForUndef = PrevSearchLengthForUndef;
+}
+
+TEST_F(BasicFileAnalysisTest, CFIProtectionGoodAndBadPaths) {
+ Analysis.parseSectionContents(
+ {
+ 0xeb, 0x02, // 0: jmp 4 [+2]
+ 0x75, 0x02, // 2: jne 6 [+2]
+ 0xff, 0x10, // 4: callq *(%rax)
+ 0x0f, 0x0b, // 6: ud2
+ },
+ 0xDEADBEEF);
+ EXPECT_FALSE(Analysis.isCFIProtected(0xDEADBEEF + 4));
+}
+
+TEST_F(BasicFileAnalysisTest, CFIProtectionWithUnconditionalJumpInFallthrough) {
+ Analysis.parseSectionContents(
+ {
+ 0x75, 0x04, // 0: jne 6 [+4]
+ 0xeb, 0x00, // 2: jmp 4 [+0]
+ 0xff, 0x10, // 4: callq *(%rax)
+ 0x0f, 0x0b, // 6: ud2
+ },
+ 0xDEADBEEF);
+ EXPECT_TRUE(Analysis.isCFIProtected(0xDEADBEEF + 4));
+}
+
+TEST_F(BasicFileAnalysisTest, CFIProtectionComplexExample) {
+ // See unittests/GraphBuilder.cpp::BuildFlowGraphComplexExample for this
+ // graph.
+ Analysis.parseSectionContents(
+ {
+ 0x75, 0x12, // 0: jne 20 [+18]
+ 0xeb, 0x03, // 2: jmp 7 [+3]
+ 0x75, 0x10, // 4: jne 22 [+16]
+ 0x90, // 6: nop
+ 0x90, // 7: nop
+ 0x90, // 8: nop
+ 0xff, 0x10, // 9: callq *(%rax)
+ 0xeb, 0xfc, // 11: jmp 9 [-4]
+ 0x75, 0xfa, // 13: jne 9 [-6]
+ 0xe8, 0x78, 0x56, 0x34, 0x12, // 15: callq OUTOFBOUNDS [+0x12345678]
+ 0x90, // 20: nop
+ 0x90, // 21: nop
+ 0x0f, 0x0b, // 22: ud2
+ },
+ 0xDEADBEEF);
+ EXPECT_FALSE(Analysis.isCFIProtected(0xDEADBEEF + 9));
+}
+
} // anonymous namespace
} // end namespace cfi_verify
} // end namespace llvm