Parse DWARF information to reduce false positives.

[hctim]

Summary

Help differentiate code and data by parsing DWARF information. This will reduce false positive rates where data is placed in executable sections and is mistakenly parsed as code, resulting in an inflation in the number of indirect CF instructions (and hence an inflation of the number of unprotected).

Also prints the DWARF line data around the region of each indirect CF instruction.

[hctim]

backported a clang-format

[hctim]

Merged previous changes in the stack.

[probinson]

tools/llvm-cfi-verify/FileAnalysis.cpp

325

Does this tool run only on .o files, and not on executables? Because this decides line info is valid if any CU has a non-empty line table. If you are looking at a linked executable, one might have been compiled -g and another not, and this check will still succeed.

331

Type units can have an associated line table, but that's just to provide filespecs for DW_AT_file. There should never be any Rows in a type unit's line table.

[hctim]

• Modified tool to ensure that users are aware that all statically linked libraries are required to be compiled with '-g'.
• Removed type unit check (thanks probison)!
• Changed opt<uint64_t> to opt<unsigned long long> (known issue with opt<uint64_t>).
• Lexicographically sorted library names.

tools/llvm-cfi-verify/FileAnalysis.cpp

325

The goal for this tool is to run on both.

Thanks for reminding me :) I've had discussions with people about this exact topic offline, but forgot to update the commits.

The consensus we reached was in order to do elimination-by-dwarf (i.e. having --ignore-dwarf=false), anything that is statically linked into this binary is required to be compiled with -g. I'll update the documentation for this tool soon and add a comment around this section.

331

Thanks for the information, will remove the redundant check.

[hctim]

Patched from upstream.

[pcc]

tools/llvm-cfi-verify/lib/FileAnalysis.cpp

54 ↗

(On Diff #119937)

I don't think you need cl::location or the external declaration of IgnoreDWARF, because this flag is only used in this file.

unittests/tools/llvm-cfi-verify/FileAnalysis.cpp

485 ↗

(On Diff #119937)

Am I missing something, or should these new tests include DWARF information?

[hctim]

• Fixed diff to be against the correct changelist (prev in stack instead of master).
• Removed external declaration of command line flag .

[pcc]

Should this include a test case?

[hctim]

• Moved DWARF handlers into virtual functions for mocking.
• Added unit tests for line table based instruction exclusion.

[hctim]

• Removed dependency injection onto DWARF lookups from unit tests.
• Added lit test suite for integration testing.
• Added lit tests for checking line table information.

[hctim]

Fixed small formatting issue from revert of dependency injection changes.

[hctim]

Removed tests that require clang with plugin/LTO support. Made the tests build from the supplied assembly instead.

[pcc]

test/tools/llvm-cfi-verify/X86/protected-lineinfo.s

21 ↗

(On Diff #120899)

I'd prefer if the output were smaller. Do you get a smaller output if you compile with -gmlt?

[hctim]

Compiled integration tests with -gmlt instead of -g

[pcc]

I'd expect there to be a test which makes sure that a jump with no line info in a file with line info doesn't count as an unprotected jump. Can you add one?

test/tools/llvm-cfi-verify/X86/protected-nolineinfo.s

1 ↗

(On Diff #121020)

I don't think you need more than one test for the line table check. I'd drop this one and keep the other one.

[hctim]

Added test where a file contains line table information, but an indirect CF instruction is not covered by the LT information.

[pcc]

LGTM

tools/llvm-cfi-verify/CMakeLists.txt

 set(LLVM_LINK_COMPONENTS
   AllTargetsAsmPrinters
   AllTargetsAsmParsers
   AllTargetsDescs
   AllTargetsDisassemblers
   AllTargetsInfos
   MC
   Object
   MCParser
   Object
   Support
+  DebugInfoDWARF
   )
 
 add_llvm_tool(llvm-cfi-verify
   llvm-cfi-verify.cpp
   GraphBuilder.cpp
   FileAnalysis.cpp
   )

tools/llvm-cfi-verify/FileAnalysis.h

 //===- FileAnalysis.h -------------------------------------------*- C++ -*-===//
 //
 //                      The LLVM Compiler Infrastructure
 //
 // This file is distributed under the University of Illinois Open Source
 // License. See LICENSE.TXT for details.
 //
 //===----------------------------------------------------------------------===//
 
 #ifndef LLVM_CFI_VERIFY_FILE_ANALYSIS_H
 #define LLVM_CFI_VERIFY_FILE_ANALYSIS_H
 
 #include "llvm/BinaryFormat/ELF.h"
+#include "llvm/DebugInfo/DWARF/DWARFContext.h"
 #include "llvm/MC/MCAsmInfo.h"
 #include "llvm/MC/MCContext.h"
 #include "llvm/MC/MCDisassembler/MCDisassembler.h"
 #include "llvm/MC/MCInst.h"
 #include "llvm/MC/MCInstPrinter.h"
 #include "llvm/MC/MCInstrAnalysis.h"
 #include "llvm/MC/MCInstrDesc.h"
 #include "llvm/MC/MCInstrInfo.h"

 #include <functional>
 #include <set>
 #include <string>
 #include <unordered_map>
 
 namespace llvm {
 namespace cfi_verify {
 
+extern bool IgnoreDWARF;
+
 // Disassembler and analysis tool for machine code files. Keeps track of non-
 // sequential control flows, including indirect control flow instructions.
 class FileAnalysis {
 public:
   // A metadata struct for an instruction.
   struct Instr {
     uint64_t VMAddress;       // Virtual memory address of this instruction.
     MCInst Instruction;       // Instruction.
public:
   std::set<const Instr *> getControlFlowXRefs(const Instr &InstrMeta) const;
 
   const std::set<uint64_t> &getIndirectInstructions() const;
 
   const MCRegisterInfo *getRegisterInfo() const;
   const MCInstrInfo *getMCInstrInfo() const;
   const MCInstrAnalysis *getMCInstrAnalysis() const;
 
+  DWARFContext *getDWARF();
+
 protected:
   // Construct a blank object with the provided triple and features. Used in
   // testing, where a sub class will dependency inject protected methods to
   // allow analysis of raw binary, without requiring a fully valid ELF file.
   FileAnalysis(const Triple &ObjectTriple, const SubtargetFeatures &Features);
 
   // Add an instruction to this object.
   void addInstruction(const Instr &Instruction);
private:
   std::unique_ptr<MCSubtargetInfo> SubtargetInfo;
   std::unique_ptr<const MCInstrInfo> MII;
   MCObjectFileInfo MOFI;
   std::unique_ptr<MCContext> Context;
   std::unique_ptr<const MCDisassembler> Disassembler;
   std::unique_ptr<const MCInstrAnalysis> MIA;
   std::unique_ptr<MCInstPrinter> Printer;
 
+  // DWARF debug information.
+  std::unique_ptr<DWARFContext> DWARF;
+
   // A mapping between the virtual memory address to the instruction metadata
-  // struct.
+  // struct. TODO(hctim): Reimplement this as a sorted vector to avoid per-
+  // insertion allocation.
   std::map<uint64_t, Instr> Instructions;
 
   // Contains a mapping between a specific address, and a list of instructions
   // that use this address as a branch target (including call instructions).
   std::unordered_map<uint64_t, std::vector<uint64_t>> StaticBranchTargetings;
 
   // A list of addresses of indirect control flow instructions.
   std::set<uint64_t> IndirectInstructions;

tools/llvm-cfi-verify/FileAnalysis.cpp

 //===- FileAnalysis.cpp -----------------------------------------*- C++ -*-===//
 //
 //                      The LLVM Compiler Infrastructure
 //
 // This file is distributed under the University of Illinois Open Source
 // License. See LICENSE.TXT for details.
 //
 //===----------------------------------------------------------------------===//
 
 #include "FileAnalysis.h"
 #include "GraphBuilder.h"
 
 #include "llvm/BinaryFormat/ELF.h"
+#include "llvm/DebugInfo/DWARF/DWARFContext.h"
 #include "llvm/MC/MCAsmInfo.h"
 #include "llvm/MC/MCContext.h"
 #include "llvm/MC/MCDisassembler/MCDisassembler.h"
 #include "llvm/MC/MCInst.h"
 #include "llvm/MC/MCInstPrinter.h"
 #include "llvm/MC/MCInstrAnalysis.h"
 #include "llvm/MC/MCInstrDesc.h"
 #include "llvm/MC/MCInstrInfo.h"

 
 #include <functional>
 
 using Instr = llvm::cfi_verify::FileAnalysis::Instr;
 
 namespace llvm {
 namespace cfi_verify {
 
+bool IgnoreDWARF;
+
+static cl::opt<bool, true> IgnoreDWARFArg(
+    "ignore-dwarf",
+    cl::desc("Ignore all DWARF data (warning: may generate false positives)."),
+    cl::location(IgnoreDWARF), cl::init(false));
+
+cl::opt<uint64_t> DWARFSearchRange(
+    "dwarf-search-range",
+    cl::desc("Address search range used to determine if instruction is valid."),
+    cl::init(0x10));
+
 Expected<FileAnalysis> FileAnalysis::Create(StringRef Filename) {
   // Open the filename provided.
   Expected<object::OwningBinary<object::Binary>> BinaryOrErr =
       object::createBinary(Filename);
   if (!BinaryOrErr)
     return BinaryOrErr.takeError();
 
   // Construct the object and allow it to take ownership of the binary.

 }
 
 const MCInstrInfo *FileAnalysis::getMCInstrInfo() const { return MII.get(); }
 
 const MCInstrAnalysis *FileAnalysis::getMCInstrAnalysis() const {
   return MIA.get();
 }
 
+DWARFContext *FileAnalysis::getDWARF() {
+  return DWARF.get();
+}
+
 Error FileAnalysis::initialiseDisassemblyMembers() {
   std::string TripleName = ObjectTriple.getTriple();
   ArchName = "";
   MCPU = "";
 
   std::string ErrorString;
 
   ObjectTarget =
if (!Disassembler)
     return make_error<StringError>("No disassembler available for target",
                                    inconvertibleErrorCode());
 
   MIA.reset(ObjectTarget->createMCInstrAnalysis(MII.get()));
 
   Printer.reset(ObjectTarget->createMCInstPrinter(
       ObjectTriple, AsmInfo->getAssemblerDialect(), *AsmInfo, *MII,
       *RegisterInfo));
 
   return Error::success();
 }
 
 Error FileAnalysis::parseCodeSections() {
+  if (!IgnoreDWARF) {
+    DWARF.reset(DWARFContext::create(*Object).release());
+    if (!DWARF)
+      return make_error<StringError>("Could not create DWARF information.",
+                                     inconvertibleErrorCode());
+
+    bool LineInfoValid = false;
+
+    for (auto &Unit : DWARF->compile_units()) {
+      const auto &LineTable = DWARF->getLineTableForUnit(Unit.get());
+      if (LineTable && !LineTable->Rows.empty()) {
+        LineInfoValid = true;
+        break;
+      }
+    }
+
+    if (!LineInfoValid) {
+      for (auto &Range : DWARF->type_unit_sections()) {
+        for (auto &Unit : Range) {
+          const auto &LineTable = DWARF->getLineTableForUnit(Unit.get());
+          if (LineTable && !LineTable->Rows.empty()) {
+            LineInfoValid = true;
+            break;
+          }
+        }
+      }
+    }
+
+    if (!LineInfoValid)
+      return make_error<StringError>(
+          "DWARF line information missing. Did you compile with '-g'?",
+          inconvertibleErrorCode());
+  }
+
   for (const object::SectionRef &Section : Object->sections()) {
     // Ensure only executable sections get analysed.
     if (!(object::ELFSectionRef(Section).getFlags() & ELF::SHF_EXECINSTR))
       continue;
 
     StringRef SectionContents;
     if (Section.getContents(SectionContents))
       return make_error<StringError>("Failed to retrieve section contents",
for (uint64_t Byte = 0; Byte < SectionBytes.size();) {
 
     Byte += InstructionSize;
 
     uint64_t VMAddress = SectionAddress + Byte - InstructionSize;
     InstrMeta.Instruction = Instruction;
     InstrMeta.VMAddress = VMAddress;
     InstrMeta.InstructionSize = InstructionSize;
     InstrMeta.Valid = ValidInstruction;
+
+    // Check if this instruction exists in the range of the DWARF metadata.
+    if (DWARF &&
+        DWARF->getLineInfoForAddressRange(InstrMeta.VMAddress, DWARFSearchRange)
+            .empty())
+      continue;
+
     addInstruction(InstrMeta);
 
     if (!ValidInstruction)
       continue;
 
     // Skip additional parsing for instructions that do not affect the control
     // flow.
     const auto &InstrDesc = MII->get(Instruction.getOpcode());

tools/llvm-cfi-verify/GraphBuilder.cpp

if (!ParentDesc.mayAffectControlFlow(ParentMeta.Instruction,
               ParentMeta.Instruction, ParentMeta.VMAddress,
               ParentMeta.InstructionSize, BranchTarget)) {
         errs() << "Failed to evaluate branch target for instruction at address "
                << format_hex(ParentMeta.VMAddress, 2) << ".\n";
         OrphanedNodes->push_back(createParentNode(ParentMeta, ChildNode));
         continue;
       }
 
+      // Call instructions are not valid in the upwards traversal.
+      if (ParentDesc.isCall()) {
+        OrphanedNodes->push_back(createParentNode(ParentMeta, ChildNode));
+        continue;
+      }
+
       // Allow unconditional branches to be part of the upwards traversal.
       // Ensures that the unconditional branch is actually an XRef to the child.
       if (ParentDesc.isUnconditionalBranch()) {
         if (BranchTarget == ChildMeta.VMAddress) {
           // Ensure the unconditional branch can't fall back on itself. Check
           // the current tree.
           bool IsUniqueInTree = true;
           for (const auto &InstructionAddressInTree :
if (!ParentDesc.mayAffectControlFlow(ParentMeta.Instruction,
           OrphanedNodes->push_back(createParentNode(ParentMeta, ChildNode));
           continue;
         }
       }
 
       // Ensure that any unknown CFs are caught.
       if (!ParentDesc.isConditionalBranch()) {
         errs() << "Unknown control flow encountered when building graph at "
-               << format_hex(ChildMeta.VMAddress, 2) << "\n.";
-        OrphanedNodes->push_back(createParentNode(ParentMeta, ChildNode));
+               << format_hex(ParentMeta.VMAddress, 2) << ".\n";
+        const auto& ParentNode = createParentNode(ParentMeta, ChildNode);
+        OrphanedNodes->push_back(ParentNode);
+        ParentNode->printControlFlowNode(1, errs());
         continue;
       }
 
       // Only direct conditional branches should be present at this point. Setup
       // a conditional branch node and build flows to the ud2.
       ConditionalBranchNode *BranchNode = new ConditionalBranchNode();
       BranchNode->InstructionAddress = ParentMeta.VMAddress;
       BranchNode->Target = nullptr;

tools/llvm-cfi-verify/LLVMBuild.txt

 ;   http://llvm.org/docs/LLVMBuild.html
 ;
 ;===------------------------------------------------------------------------===;
 
 [component_0]
 type = Tool
 name = llvm-cfi-verify
 parent = Tools
-required_libraries = MC MCDisassembler MCParser Support all-targets
+required_libraries = MC MCDisassembler MCParser Support all-targets DebugInfoDWARF

tools/llvm-cfi-verify/llvm-cfi-verify.cpp

 //
 //===----------------------------------------------------------------------===//
 
 #include "FileAnalysis.h"
 
 #include "llvm/BinaryFormat/ELF.h"
 #include "llvm/Support/CommandLine.h"
 #include "llvm/Support/Error.h"
+#include "llvm/Support/FormatVariadic.h"
 
 #include <cstdlib>
 
 using namespace llvm;
 using namespace llvm::object;
 using namespace llvm::cfi_verify;
 
 cl::opt<std::string> InputFilename(cl::Positional, cl::desc("<input file>"),
                                    cl::Required);
 
 ExitOnError ExitOnErr;
 
-void printIndirectCFInstructions(const FileAnalysis &Verifier) {
-  for (uint64_t Address : Verifier.getIndirectInstructions()) {
-    const auto &InstrMeta = Verifier.getInstructionOrDie(Address);
-    outs() << format_hex(Address, 2) << " |"
-           << Verifier.getMCInstrInfo()->getName(
+void printIndirectCFInstructions(FileAnalysis &Analysis) {
+  uint64_t ProtectedCount = 0;
+  uint64_t UnprotectedCount = 0;
+  DWARFContext *DWARF = Analysis.getDWARF();
+
+  for (uint64_t Address : Analysis.getIndirectInstructions()) {
+    const auto &InstrMeta = Analysis.getInstructionOrDie(Address);
+
+    if (Analysis.isCFIProtected(Address)) {
+      outs() << "P ";
+      ProtectedCount++;
+    } else {
+      outs() << "U ";
+      UnprotectedCount++;
+    }
+
+    outs() << format_hex(Address, 2) << " | "
+           << Analysis.getMCInstrInfo()->getName(
                   InstrMeta.Instruction.getOpcode())
            << " ";
-    InstrMeta.Instruction.print(outs());
     outs() << "\n";
-    outs() << "  Protected? " << Verifier.isCFIProtected(Address) << "\n";
+
+    if (DWARF) {
+      for (const auto &LineKV :
+           DWARF->getLineInfoForAddressRange(Address, 0x10)) {
+        outs() << "  " << format_hex(LineKV.first, 2) << " = "
+               << LineKV.second.FileName << ":" << LineKV.second.Line << ":"
+               << LineKV.second.Column << " ("
+               << LineKV.second.FunctionName << ")\n";
       }
     }
+  }
+
+  if (ProtectedCount || UnprotectedCount)
+    outs() << formatv(
+        "Unprotected: {0} ({1:P}), Protected: {2} ({3:P})\n", UnprotectedCount,
+        (((double)UnprotectedCount) / (UnprotectedCount + ProtectedCount)),
+        ProtectedCount,
+        (((double)ProtectedCount) / (UnprotectedCount + ProtectedCount)));
+  else
+    outs() << "No indirect CF instructions found.\n";
+}
 
 int main(int argc, char **argv) {
   cl::ParseCommandLineOptions(argc, argv);
 
   InitializeAllTargetInfos();
   InitializeAllTargetMCs();
   InitializeAllAsmParsers();
   InitializeAllDisassemblers();
 
-  FileAnalysis Verifier = ExitOnErr(FileAnalysis::Create(InputFilename));
-  printIndirectCFInstructions(Verifier);
+  FileAnalysis Analysis = ExitOnErr(FileAnalysis::Create(InputFilename));
+  printIndirectCFInstructions(Analysis);
 
   return EXIT_SUCCESS;
 }

tools/llvm-cfi-verify/unittests/CMakeLists.txt

 set(LLVM_LINK_COMPONENTS
   AllTargetsAsmPrinters
   AllTargetsAsmParsers
   AllTargetsDescs
   AllTargetsDisassemblers
   AllTargetsInfos
   MC
   Object
   MCParser
   Object
   Support
+  DebugInfoDWARF
   )
 
 add_llvm_unittest(CFIVerifyTests
   FileAnalysis.cpp
   GraphBuilder.cpp
   ../GraphBuilder.cpp
   ../FileAnalysis.cpp)