[cfi-verify] Adds blacklist blame behaviour to cfi-verify.

[hctim]

Summary

Adds the blacklist behaviour to llvm-cfi-verify. Now will calculate which lines caused expected failures in the blacklist and reports the number of affected indirect CF instructions for each blacklist entry.

Also moved DWARF checking after instruction analysis to improve performance significantly - unrolling the inlining stack is expensive.

[hctim]

Rebased over master.

[vlad.tsyrklevich]

tools/llvm-cfi-verify/llvm-cfi-verify.cpp

103 ↗

(On Diff #121985)

Could we just unroll this loop? Seems a little clearer and it should be shorter too.

[hctim]

Unrolled the inner loop of blame checking and rebased against master.

llvm/trunk/test/tools/llvm-cfi-verify/X86/blacklist-expected-unprotected.s

 # RUN: llvm-mc %S/Inputs/unprotected-lineinfo.s -filetype obj \
 # RUN:         -triple x86_64-linux-elf -o %t.o
 # RUN: echo "src:*tiny*" > %t.blacklist.txt
 # RUN: llvm-cfi-verify %t.o %t.blacklist.txt | FileCheck %s
 
 # CHECK-LABEL: U
 # CHECK-NEXT: tiny.cc:11
-# CHECK-NEXT: BLACKLIST MATCH, 'src'
+# CHECK-NEXT: {{^Blacklist Match:.*blacklist\.txt:1$}}
 # CHECK-NEXT: ====> Expected Unprotected
 
 # CHECK: Expected Protected: 0 (0.00%)
 # CHECK: Unexpected Protected: 0 (0.00%)
 # CHECK: Expected Unprotected: 1 (100.00%)
 # CHECK: Unexpected Unprotected (BAD): 0 (0.00%)
 
 # Source: (blacklist.txt):
 #   src:*tiny*

llvm/trunk/test/tools/llvm-cfi-verify/X86/blacklist-match-fun.s

 # RUN: llvm-mc %S/Inputs/unprotected-fullinfo.s -filetype obj \
 # RUN:         -triple x86_64-linux-elf -o %t.o
 # RUN: echo "fun:*main*" > %t.blacklist.txt
 # RUN: llvm-cfi-verify %t.o %t.blacklist.txt | FileCheck %s
 
 # CHECK-LABEL: U
 # CHECK-NEXT: tiny.cc:11
-# CHECK-NEXT: BLACKLIST MATCH, 'fun'
+# CHECK-NEXT: {{^Blacklist Match:.*blacklist\.txt:1$}}
 # CHECK-NEXT: ====> Expected Unprotected
 
 # CHECK: Expected Protected: 0 (0.00%)
 # CHECK: Unexpected Protected: 0 (0.00%)
 # CHECK: Expected Unprotected: 1 (100.00%)
 # CHECK: Unexpected Unprotected (BAD): 0 (0.00%)
 
 # Source: (blacklist.txt):
 #   fun:*main*

llvm/trunk/test/tools/llvm-cfi-verify/X86/blacklist-unexpected-protected.s

 # RUN: llvm-mc %S/Inputs/protected-lineinfo.s -filetype obj \
 # RUN:         -triple x86_64-linux-elf -o %t.o
 # RUN: echo "src:*tiny*" > %t.blacklist.txt
 # RUN: llvm-cfi-verify %t.o %t.blacklist.txt | FileCheck %s
 
 # CHECK-LABEL: P
 # CHECK-NEXT: tiny.cc:11
-# CHECK-NEXT: BLACKLIST MATCH, 'src'
+# CHECK-NEXT: {{^Blacklist Match:.*blacklist\.txt:1$}}
 # CHECK-NEXT: ====> Unexpected Protected
 
 # CHECK: Expected Protected: 0 (0.00%)
 # CHECK: Unexpected Protected: 1 (100.00%)
 # CHECK: Expected Unprotected: 0 (0.00%)
 # CHECK: Unexpected Unprotected (BAD): 0 (0.00%)
 
 # Source: (blacklist.txt):
 #   src:*tiny*

llvm/trunk/tools/llvm-cfi-verify/lib/FileAnalysis.cpp

for (uint64_t Byte = 0; Byte < SectionBytes.size();) {
     Byte += InstructionSize;
 
     uint64_t VMAddress = SectionAddress + Byte - InstructionSize;
     InstrMeta.Instruction = Instruction;
     InstrMeta.VMAddress = VMAddress;
     InstrMeta.InstructionSize = InstructionSize;
     InstrMeta.Valid = ValidInstruction;
 
-    // Check if this instruction exists in the range of the DWARF metadata.
-    if (!IgnoreDWARFFlag) {
-      auto LineInfo =
-          Symbolizer->symbolizeCode(Object->getFileName(), VMAddress);
-      if (!LineInfo) {
-        handleAllErrors(LineInfo.takeError(), [](const ErrorInfoBase &E) {
-          errs() << "Symbolizer failed to get line: " << E.message() << "\n";
-        });
-        continue;
-      }
-
-      if (LineInfo->FileName == "<invalid>")
-        continue;
-    }
-
     addInstruction(InstrMeta);
 
     if (!ValidInstruction)
       continue;
 
     // Skip additional parsing for instructions that do not affect the control
     // flow.
     const auto &InstrDesc = MII->get(Instruction.getOpcode());
     if (!InstrDesc.mayAffectControlFlow(Instruction, *RegisterInfo))
       continue;
 
     uint64_t Target;
     if (MIA->evaluateBranch(Instruction, VMAddress, InstructionSize, Target)) {
       // If the target can be evaluated, it's not indirect.
       StaticBranchTargetings[Target].push_back(VMAddress);
       continue;
     }
 
     if (!usesRegisterOperand(InstrMeta))
       continue;
 
+    // Check if this instruction exists in the range of the DWARF metadata.
+    if (!IgnoreDWARFFlag) {
+      auto LineInfo =
+          Symbolizer->symbolizeCode(Object->getFileName(), VMAddress);
+      if (!LineInfo) {
+        handleAllErrors(LineInfo.takeError(), [](const ErrorInfoBase &E) {
+          errs() << "Symbolizer failed to get line: " << E.message() << "\n";
+        });
+        continue;
+      }
+
+      if (LineInfo->FileName == "<invalid>")
+        continue;
+    }
+
     IndirectInstructions.insert(VMAddress);
   }
 }
 
 void FileAnalysis::addInstruction(const Instr &Instruction) {
   const auto &KV =
       Instructions.insert(std::make_pair(Instruction.VMAddress, Instruction));
   if (!KV.second) {

llvm/trunk/tools/llvm-cfi-verify/llvm-cfi-verify.cpp

 void printIndirectCFInstructions(FileAnalysis &Analysis,
                                  const SpecialCaseList *SpecialCaseList) {
   uint64_t ExpectedProtected = 0;
   uint64_t UnexpectedProtected = 0;
   uint64_t ExpectedUnprotected = 0;
   uint64_t UnexpectedUnprotected = 0;
 
   symbolize::LLVMSymbolizer &Symbolizer = Analysis.getSymbolizer();
+  std::map<unsigned, uint64_t> BlameCounter;
 
   for (uint64_t Address : Analysis.getIndirectInstructions()) {
     const auto &InstrMeta = Analysis.getInstructionOrDie(Address);
 
     bool CFIProtected = Analysis.isIndirectInstructionCFIProtected(Address);
 
     if (CFIProtected)
       outs() << "P ";
for (uint64_t Address : Analysis.getIndirectInstructions()) {
     if (!SpecialCaseList) {
       if (CFIProtected)
         ExpectedProtected++;
       else
         UnexpectedUnprotected++;
       continue;
     }
 
-    bool MatchesBlacklistRule = false;
-    if (SpecialCaseList->inSection("cfi-icall", "src", LineInfo.FileName) ||
-        SpecialCaseList->inSection("cfi-vcall", "src", LineInfo.FileName)) {
-      outs() << "BLACKLIST MATCH, 'src'\n";
-      MatchesBlacklistRule = true;
+    unsigned BlameLine = 0;
+    for (auto &K : {"cfi-icall", "cfi-vcall"}) {
+      if (!BlameLine)
+        BlameLine =
+            SpecialCaseList->inSectionBlame(K, "src", LineInfo.FileName);
+      if (!BlameLine)
+        BlameLine =
+            SpecialCaseList->inSectionBlame(K, "fun", LineInfo.FunctionName);
     }
 
-    if (SpecialCaseList->inSection("cfi-icall", "fun", LineInfo.FunctionName) ||
-        SpecialCaseList->inSection("cfi-vcall", "fun", LineInfo.FunctionName)) {
-      outs() << "BLACKLIST MATCH, 'fun'\n";
-      MatchesBlacklistRule = true;
-    }
-
-    if (MatchesBlacklistRule) {
+    if (BlameLine) {
+      outs() << "Blacklist Match: " << BlacklistFilename << ":" << BlameLine
+             << "\n";
+      BlameCounter[BlameLine]++;
       if (CFIProtected) {
         UnexpectedProtected++;
         outs() << "====> Unexpected Protected\n";
       } else {
         ExpectedUnprotected++;
         outs() << "====> Expected Unprotected\n";
       }
     } else {
outs() << formatv("Expected Protected: {0} ({1:P})\n"
                     ExpectedProtected,
                     ((double)ExpectedProtected) / IndirectCFInstructions,
                     UnexpectedProtected,
                     ((double)UnexpectedProtected) / IndirectCFInstructions,
                     ExpectedUnprotected,
                     ((double)ExpectedUnprotected) / IndirectCFInstructions,
                     UnexpectedUnprotected,
                     ((double)UnexpectedUnprotected) / IndirectCFInstructions);
+
+  if (!SpecialCaseList)
+    return;
+
+  outs() << "Blacklist Results:\n";
+  for (const auto &KV : BlameCounter) {
+    outs() << "  " << BlacklistFilename << ":" << KV.first << " affects "
+           << KV.second << " indirect CF instructions.\n";
+  }
 }
 
 int main(int argc, char **argv) {
   cl::ParseCommandLineOptions(
       argc, argv,
       "Identifies whether Control Flow Integrity protects all indirect control "
       "flow instructions in the provided object file, DSO or binary.\nNote: "
       "Anything statically linked into the provided file *must* be compiled "