[cfi-verify] Made FileAnalysis operate on a GraphResult rather than build one and validate it.

[hctim]

Summary

Refactors the behaviour of building graphs out of FileAnalysis, allowing for analysis of the GraphResult by the callee without having to rebuild the graph. Means when we want to analyse the constructed graph (planned for later revisions), we don't do repeated work.

Also makes CFI verification in FileAnalysis now return an enum that allows us to differentiate why something failed, not just that it did/didn't fail.

[hctim]

Made unit tests not use a helper, they should explicitly individually check the result against the expected enum.

[hctim]

Finally - rebase against the parent revision.

[vlad.tsyrklevich]

tools/llvm-cfi-verify/lib/FileAnalysis.cpp

70 ↗

(On Diff #122159)

This should be an llvm_unreachable()

tools/llvm-cfi-verify/lib/FileAnalysis.h

52 ↗

(On Diff #122159)

Could we move the comments above the entries?

59 ↗

(On Diff #122159)

This is only returned in one place so why not make it a specific error, rather than a generic catch-all?

unittests/tools/llvm-cfi-verify/FileAnalysis.cpp

502 ↗

(On Diff #122159)

Could we make this an easier to differentiate constant? Took me a second to understand why this was failing on not finding the instruction

[hctim]

Updated with Vlad's comments, changed some enum values/comments, and merged in master.

[vlad.tsyrklevich]

tools/llvm-cfi-verify/lib/FileAnalysis.h

51 ↗

(On Diff #122332)

Lets make this an enum class.

unittests/tools/llvm-cfi-verify/FileAnalysis.cpp

502 ↗

(On Diff #122159)

This one still looks open.

[hctim]

Updated with Vlad's comments, classified the enum, and changed the constant for the unknown instruction to be more obvious at a glance.

[hctim]

unittests/tools/llvm-cfi-verify/FileAnalysis.cpp

502 ↗

(On Diff #122159)

Oh sorry, I thought you were referring to the enum's name...

Done.

[hctim]

Merged with master in preparation for submission.

llvm/trunk/tools/llvm-cfi-verify/lib/FileAnalysis.h

 #include <functional>
 #include <set>
 #include <string>
 #include <unordered_map>
 
 namespace llvm {
 namespace cfi_verify {
 
+struct GraphResult;
+
 extern bool IgnoreDWARFFlag;
 
+enum class CFIProtectionStatus {
+  // This instruction is protected by CFI.
+  PROTECTED,
+  // The instruction is not an indirect control flow instruction, and thus
+  // shouldn't be protected.
+  FAIL_NOT_INDIRECT_CF,
+  // There is a path to the instruction that was unexpected.
+  FAIL_ORPHANS,
+  // There is a path to the instruction from a conditional branch that does not
+  // properly check the destination for this vcall/icall.
+  FAIL_BAD_CONDITIONAL_BRANCH,
+  // The instruction referenced does not exist. This normally indicates an
+  // error in the program, where you try and validate a graph that was created
+  // in a different FileAnalysis object.
+  FAIL_INVALID_INSTRUCTION,
+};
+
+StringRef stringCFIProtectionStatus(CFIProtectionStatus Status);
+
 // Disassembler and analysis tool for machine code files. Keeps track of non-
 // sequential control flows, including indirect control flow instructions.
 class FileAnalysis {
 public:
   // A metadata struct for an instruction.
   struct Instr {
     uint64_t VMAddress;       // Virtual memory address of this instruction.
     MCInst Instruction;       // Instruction.
     uint64_t InstructionSize; // Size of this instruction.
     bool Valid; // Is this a valid instruction? If false, Instr::Instruction is
                 // undefined.
   };
 
   // Construct a FileAnalysis from a file path.
   static Expected<FileAnalysis> Create(StringRef Filename);
 
   // Construct and take ownership of the supplied object. Do not use this
   // constructor, prefer to use FileAnalysis::Create instead.
   FileAnalysis(object::OwningBinary<object::Binary> Binary);
   FileAnalysis() = delete;
   FileAnalysis(const FileAnalysis &) = delete;
   FileAnalysis(FileAnalysis &&Other) = default;
 
-  // Check whether the provided instruction is CFI protected in this file.
-  // Returns false if this instruction doesn't exist in this file, if it's not
-  // an indirect control flow instruction, or isn't CFI protected. Returns true
-  // otherwise.
-  bool isIndirectInstructionCFIProtected(uint64_t Address) const;
-
   // Returns the instruction at the provided address. Returns nullptr if there
   // is no instruction at the provided address.
   const Instr *getInstruction(uint64_t Address) const;
 
   // Returns the instruction at the provided adress, dying if the instruction is
   // not found.
   const Instr &getInstructionOrDie(uint64_t Address) const;
 
public:
   bool usesRegisterOperand(const Instr &InstrMeta) const;
 
   // Returns the list of indirect instructions.
   const std::set<uint64_t> &getIndirectInstructions() const;
 
   const MCRegisterInfo *getRegisterInfo() const;
   const MCInstrInfo *getMCInstrInfo() const;
   const MCInstrAnalysis *getMCInstrAnalysis() const;
-  symbolize::LLVMSymbolizer &getSymbolizer();
 
-  // Returns true if this class is using DWARF line tables for elimination.
-  bool hasLineTableInfo() const;
+  // Returns the inlining information for the provided address.
+  Expected<DIInliningInfo> symbolizeInlinedCode(uint64_t Address);
 
-  // Returns the line table information for the range {Address +-
-  // DWARFSearchRange}. Returns an empty table if the address has no valid line
-  // table information, or this analysis object has DWARF handling disabled.
-  DILineInfoTable getLineInfoForAddressRange(uint64_t Address);
-
-  // Returns whether the provided address has valid line information for
-  // instructions in the range of Address +- DWARFSearchRange.
-  bool hasValidLineInfoForAddressRange(uint64_t Address);
+  // Returns whether the provided Graph represents a protected indirect control
+  // flow instruction in this file.
+  CFIProtectionStatus validateCFIProtection(const GraphResult &Graph) const;
 
 protected:
   // Construct a blank object with the provided triple and features. Used in
   // testing, where a sub class will dependency inject protected methods to
   // allow analysis of raw binary, without requiring a fully valid ELF file.
   FileAnalysis(const Triple &ObjectTriple, const SubtargetFeatures &Features);
 
   // Add an instruction to this object.

llvm/trunk/tools/llvm-cfi-verify/lib/FileAnalysis.cpp

 static cl::opt<bool, true> IgnoreDWARFArg(
     "ignore-dwarf",
     cl::desc(
         "Ignore all DWARF data. This relaxes the requirements for all "
         "statically linked libraries to have been compiled with '-g', but "
         "will result in false positives for 'CFI unprotected' instructions."),
     cl::location(IgnoreDWARFFlag), cl::init(false));
 
+StringRef stringCFIProtectionStatus(CFIProtectionStatus Status) {
+  switch (Status) {
+  case CFIProtectionStatus::PROTECTED:
+    return "PROTECTED";
+  case CFIProtectionStatus::FAIL_NOT_INDIRECT_CF:
+    return "FAIL_NOT_INDIRECT_CF";
+  case CFIProtectionStatus::FAIL_ORPHANS:
+    return "FAIL_ORPHANS";
+  case CFIProtectionStatus::FAIL_BAD_CONDITIONAL_BRANCH:
+    return "FAIL_BAD_CONDITIONAL_BRANCH";
+  case CFIProtectionStatus::FAIL_INVALID_INSTRUCTION:
+    return "FAIL_INVALID_INSTRUCTION";
+  }
+  llvm_unreachable("Attempted to stringify an unknown enum value.");
+}
+
 Expected<FileAnalysis> FileAnalysis::Create(StringRef Filename) {
   // Open the filename provided.
   Expected<object::OwningBinary<object::Binary>> BinaryOrErr =
       object::createBinary(Filename);
   if (!BinaryOrErr)
     return BinaryOrErr.takeError();
 
   // Construct the object and allow it to take ownership of the binary.

 
 FileAnalysis::FileAnalysis(object::OwningBinary<object::Binary> Binary)
     : Binary(std::move(Binary)) {}
 
 FileAnalysis::FileAnalysis(const Triple &ObjectTriple,
                            const SubtargetFeatures &Features)
     : ObjectTriple(ObjectTriple), Features(Features) {}
 
-bool FileAnalysis::isIndirectInstructionCFIProtected(uint64_t Address) const {
-  const Instr *InstrMetaPtr = getInstruction(Address);
-  if (!InstrMetaPtr)
-    return false;
-
-  const auto &InstrDesc = MII->get(InstrMetaPtr->Instruction.getOpcode());
-
-  if (!InstrDesc.mayAffectControlFlow(InstrMetaPtr->Instruction, *RegisterInfo))
-    return false;
-
-  if (!usesRegisterOperand(*InstrMetaPtr))
-    return false;
-
-  auto Flows = GraphBuilder::buildFlowGraph(*this, Address);
-
-  if (!Flows.OrphanedNodes.empty())
-    return false;
-
-  for (const auto &BranchNode : Flows.ConditionalBranchNodes) {
-    if (!BranchNode.CFIProtection)
-      return false;
-  }
-
-  return true;
-}
-
 const Instr *
 FileAnalysis::getPrevInstructionSequential(const Instr &InstrMeta) const {
   std::map<uint64_t, Instr>::const_iterator KV =
       Instructions.find(InstrMeta.VMAddress);
   if (KV == Instructions.end() || KV == Instructions.begin())
     return nullptr;
 
   if (!(--KV)->second.Valid)

 }
 
 const MCInstrInfo *FileAnalysis::getMCInstrInfo() const { return MII.get(); }
 
 const MCInstrAnalysis *FileAnalysis::getMCInstrAnalysis() const {
   return MIA.get();
 }
 
-LLVMSymbolizer &FileAnalysis::getSymbolizer() { return *Symbolizer; }
+Expected<DIInliningInfo> FileAnalysis::symbolizeInlinedCode(uint64_t Address) {
+  assert(Symbolizer != nullptr && "Symbolizer is invalid.");
+  return Symbolizer->symbolizeInlinedCode(Object->getFileName(), Address);
+}
+
+CFIProtectionStatus
+FileAnalysis::validateCFIProtection(const GraphResult &Graph) const {
+  const Instr *InstrMetaPtr = getInstruction(Graph.BaseAddress);
+  if (!InstrMetaPtr)
+    return CFIProtectionStatus::FAIL_INVALID_INSTRUCTION;
+
+  const auto &InstrDesc = MII->get(InstrMetaPtr->Instruction.getOpcode());
+  if (!InstrDesc.mayAffectControlFlow(InstrMetaPtr->Instruction, *RegisterInfo))
+    return CFIProtectionStatus::FAIL_NOT_INDIRECT_CF;
+
+  if (!usesRegisterOperand(*InstrMetaPtr))
+    return CFIProtectionStatus::FAIL_NOT_INDIRECT_CF;
+
+  if (!Graph.OrphanedNodes.empty())
+    return CFIProtectionStatus::FAIL_ORPHANS;
+
+  for (const auto &BranchNode : Graph.ConditionalBranchNodes) {
+    if (!BranchNode.CFIProtection)
+      return CFIProtectionStatus::FAIL_BAD_CONDITIONAL_BRANCH;
+  }
+
+  return CFIProtectionStatus::PROTECTED;
+}
 
 Error FileAnalysis::initialiseDisassemblyMembers() {
   std::string TripleName = ObjectTriple.getTriple();
   ArchName = "";
   MCPU = "";
   std::string ErrorString;
 
   Symbolizer.reset(new LLVMSymbolizer());

llvm/trunk/tools/llvm-cfi-verify/llvm-cfi-verify.cpp

 //
 // This tool is currently incomplete. It currently only does disassembly for
 // object files, and searches through the code for indirect control flow
 // instructions, printing them once found.
 //
 //===----------------------------------------------------------------------===//
 
 #include "lib/FileAnalysis.h"
+#include "lib/GraphBuilder.h"
 
 #include "llvm/BinaryFormat/ELF.h"
 #include "llvm/Support/CommandLine.h"
 #include "llvm/Support/Error.h"
 #include "llvm/Support/FormatVariadic.h"
 #include "llvm/Support/SpecialCaseList.h"
 
 #include <cstdlib>

 
 void printIndirectCFInstructions(FileAnalysis &Analysis,
                                  const SpecialCaseList *SpecialCaseList) {
   uint64_t ExpectedProtected = 0;
   uint64_t UnexpectedProtected = 0;
   uint64_t ExpectedUnprotected = 0;
   uint64_t UnexpectedUnprotected = 0;
 
-  symbolize::LLVMSymbolizer &Symbolizer = Analysis.getSymbolizer();
   std::map<unsigned, uint64_t> BlameCounter;
 
   for (uint64_t Address : Analysis.getIndirectInstructions()) {
     const auto &InstrMeta = Analysis.getInstructionOrDie(Address);
+    GraphResult Graph = GraphBuilder::buildFlowGraph(Analysis, Address);
 
-    bool CFIProtected = Analysis.isIndirectInstructionCFIProtected(Address);
+    CFIProtectionStatus ProtectionStatus =
+        Analysis.validateCFIProtection(Graph);
+    bool CFIProtected = (ProtectionStatus == CFIProtectionStatus::PROTECTED);
 
     if (CFIProtected)
       outs() << "P ";
     else
       outs() << "U ";
 
     outs() << format_hex(Address, 2) << " | "
            << Analysis.getMCInstrInfo()->getName(
                   InstrMeta.Instruction.getOpcode())
            << " \n";
 
     if (IgnoreDWARFFlag) {
       if (CFIProtected)
         ExpectedProtected++;
       else
         UnexpectedUnprotected++;
       continue;
     }
 
-    auto InliningInfo = Symbolizer.symbolizeInlinedCode(InputFilename, Address);
+    auto InliningInfo = Analysis.symbolizeInlinedCode(Address);
     if (!InliningInfo || InliningInfo->getNumberOfFrames() == 0) {
       errs() << "Failed to symbolise " << format_hex(Address, 2)
              << " with line tables from " << InputFilename << "\n";
       exit(EXIT_FAILURE);
     }
 
     const auto &LineInfo =
         InliningInfo->getFrame(InliningInfo->getNumberOfFrames() - 1);

llvm/trunk/unittests/tools/llvm-cfi-verify/FileAnalysis.cpp

if (!SuccessfullyInitialised)
     return;
   Analysis.parseSectionContents(
       {
           0x90,       // 0: nop
           0x0f, 0x0b, // 1: ud2
           0x75, 0x00, // 3: jne 5 [+0]
       },
       0xDEADBEEF);
-  EXPECT_FALSE(Analysis.isIndirectInstructionCFIProtected(0xDEADBEEF));
-  EXPECT_FALSE(Analysis.isIndirectInstructionCFIProtected(0xDEADBEEF + 1));
-  EXPECT_FALSE(Analysis.isIndirectInstructionCFIProtected(0xDEADBEEF + 3));
-  EXPECT_FALSE(Analysis.isIndirectInstructionCFIProtected(0xDEADC0DE));
+  GraphResult Result = GraphBuilder::buildFlowGraph(Analysis, 0xDEADBEEF);
+  EXPECT_EQ(CFIProtectionStatus::FAIL_NOT_INDIRECT_CF,
+            Analysis.validateCFIProtection(Result));
+  Result = GraphBuilder::buildFlowGraph(Analysis, 0xDEADBEEF + 1);
+  EXPECT_EQ(CFIProtectionStatus::FAIL_NOT_INDIRECT_CF,
+            Analysis.validateCFIProtection(Result));
+  Result = GraphBuilder::buildFlowGraph(Analysis, 0xDEADBEEF + 3);
+  EXPECT_EQ(CFIProtectionStatus::FAIL_NOT_INDIRECT_CF,
+            Analysis.validateCFIProtection(Result));
+  Result = GraphBuilder::buildFlowGraph(Analysis, 0x12345678);
+  EXPECT_EQ(CFIProtectionStatus::FAIL_INVALID_INSTRUCTION,
+            Analysis.validateCFIProtection(Result));
 }
 
 TEST_F(BasicFileAnalysisTest, CFIProtectionBasicFallthroughToUd2) {
   if (!SuccessfullyInitialised)
     return;
   Analysis.parseSectionContents(
       {
           0x75, 0x02, // 0: jne 4 [+2]
           0x0f, 0x0b, // 2: ud2
           0xff, 0x10, // 4: callq *(%rax)
       },
       0xDEADBEEF);
-  EXPECT_TRUE(Analysis.isIndirectInstructionCFIProtected(0xDEADBEEF + 4));
+  GraphResult Result = GraphBuilder::buildFlowGraph(Analysis, 0xDEADBEEF + 4);
+  EXPECT_EQ(CFIProtectionStatus::PROTECTED,
+            Analysis.validateCFIProtection(Result));
 }
 
 TEST_F(BasicFileAnalysisTest, CFIProtectionBasicJumpToUd2) {
   if (!SuccessfullyInitialised)
     return;
   Analysis.parseSectionContents(
       {
           0x75, 0x02, // 0: jne 4 [+2]
           0xff, 0x10, // 2: callq *(%rax)
           0x0f, 0x0b, // 4: ud2
       },
       0xDEADBEEF);
-  EXPECT_TRUE(Analysis.isIndirectInstructionCFIProtected(0xDEADBEEF + 2));
+  GraphResult Result = GraphBuilder::buildFlowGraph(Analysis, 0xDEADBEEF + 2);
+  EXPECT_EQ(CFIProtectionStatus::PROTECTED,
+            Analysis.validateCFIProtection(Result));
 }
 
 TEST_F(BasicFileAnalysisTest, CFIProtectionDualPathUd2) {
   if (!SuccessfullyInitialised)
     return;
   Analysis.parseSectionContents(
       {
           0x75, 0x03, // 0: jne 5 [+3]
           0x90,       // 2: nop
           0xff, 0x10, // 3: callq *(%rax)
           0x0f, 0x0b, // 5: ud2
           0x75, 0xf9, // 7: jne 2 [-7]
           0x0f, 0x0b, // 9: ud2
       },
       0xDEADBEEF);
-  EXPECT_TRUE(Analysis.isIndirectInstructionCFIProtected(0xDEADBEEF + 3));
+  GraphResult Result = GraphBuilder::buildFlowGraph(Analysis, 0xDEADBEEF + 3);
+  EXPECT_EQ(CFIProtectionStatus::PROTECTED,
+            Analysis.validateCFIProtection(Result));
 }
 
 TEST_F(BasicFileAnalysisTest, CFIProtectionDualPathSingleUd2) {
   if (!SuccessfullyInitialised)
     return;
   Analysis.parseSectionContents(
       {
           0x75, 0x05, // 0: jne 7 [+5]
           0x90,       // 2: nop
           0xff, 0x10, // 3: callq *(%rax)
           0x75, 0xfb, // 5: jne 2 [-5]
           0x0f, 0x0b, // 7: ud2
       },
       0xDEADBEEF);
-  EXPECT_TRUE(Analysis.isIndirectInstructionCFIProtected(0xDEADBEEF + 3));
+  GraphResult Result = GraphBuilder::buildFlowGraph(Analysis, 0xDEADBEEF + 3);
+  EXPECT_EQ(CFIProtectionStatus::PROTECTED,
+            Analysis.validateCFIProtection(Result));
 }
 
 TEST_F(BasicFileAnalysisTest, CFIProtectionDualFailLimitUpwards) {
   if (!SuccessfullyInitialised)
     return;
   Analysis.parseSectionContents(
       {
           0x75, 0x06, // 0: jne 8 [+6]
           0x90,       // 2: nop
           0x90,       // 3: nop
           0x90,       // 4: nop
           0x90,       // 5: nop
           0xff, 0x10, // 6: callq *(%rax)
           0x0f, 0x0b, // 8: ud2
       },
       0xDEADBEEF);
   uint64_t PrevSearchLengthForConditionalBranch =
       SearchLengthForConditionalBranch;
   SearchLengthForConditionalBranch = 2;
 
-  EXPECT_FALSE(Analysis.isIndirectInstructionCFIProtected(0xDEADBEEF + 6));
+  GraphResult Result = GraphBuilder::buildFlowGraph(Analysis, 0xDEADBEEF + 6);
+  EXPECT_EQ(CFIProtectionStatus::FAIL_ORPHANS,
+            Analysis.validateCFIProtection(Result));
 
   SearchLengthForConditionalBranch = PrevSearchLengthForConditionalBranch;
 }
 
 TEST_F(BasicFileAnalysisTest, CFIProtectionDualFailLimitDownwards) {
   if (!SuccessfullyInitialised)
     return;
   Analysis.parseSectionContents(
       {
           0x75, 0x02, // 0: jne 4 [+2]
           0xff, 0x10, // 2: callq *(%rax)
           0x90,       // 4: nop
           0x90,       // 5: nop
           0x90,       // 6: nop
           0x90,       // 7: nop
           0x0f, 0x0b, // 8: ud2
       },
       0xDEADBEEF);
   uint64_t PrevSearchLengthForUndef = SearchLengthForUndef;
   SearchLengthForUndef = 2;
 
-  EXPECT_FALSE(Analysis.isIndirectInstructionCFIProtected(0xDEADBEEF + 2));
+  GraphResult Result = GraphBuilder::buildFlowGraph(Analysis, 0xDEADBEEF + 2);
+  EXPECT_EQ(CFIProtectionStatus::FAIL_BAD_CONDITIONAL_BRANCH,
+            Analysis.validateCFIProtection(Result));
 
   SearchLengthForUndef = PrevSearchLengthForUndef;
 }
 
 TEST_F(BasicFileAnalysisTest, CFIProtectionGoodAndBadPaths) {
   if (!SuccessfullyInitialised)
     return;
   Analysis.parseSectionContents(
       {
           0xeb, 0x02, // 0: jmp 4 [+2]
           0x75, 0x02, // 2: jne 6 [+2]
           0xff, 0x10, // 4: callq *(%rax)
           0x0f, 0x0b, // 6: ud2
       },
       0xDEADBEEF);
-  EXPECT_FALSE(Analysis.isIndirectInstructionCFIProtected(0xDEADBEEF + 4));
+  GraphResult Result = GraphBuilder::buildFlowGraph(Analysis, 0xDEADBEEF + 4);
+  EXPECT_EQ(CFIProtectionStatus::FAIL_ORPHANS,
+            Analysis.validateCFIProtection(Result));
 }
 
 TEST_F(BasicFileAnalysisTest, CFIProtectionWithUnconditionalJumpInFallthrough) {
   if (!SuccessfullyInitialised)
     return;
   Analysis.parseSectionContents(
       {
           0x75, 0x04, // 0: jne 6 [+4]
           0xeb, 0x00, // 2: jmp 4 [+0]
           0xff, 0x10, // 4: callq *(%rax)
           0x0f, 0x0b, // 6: ud2
       },
       0xDEADBEEF);
-  EXPECT_TRUE(Analysis.isIndirectInstructionCFIProtected(0xDEADBEEF + 4));
+  GraphResult Result = GraphBuilder::buildFlowGraph(Analysis, 0xDEADBEEF + 4);
+  EXPECT_EQ(CFIProtectionStatus::PROTECTED,
+            Analysis.validateCFIProtection(Result));
 }
 
 TEST_F(BasicFileAnalysisTest, CFIProtectionComplexExample) {
   if (!SuccessfullyInitialised)
     return;
   // See unittests/GraphBuilder.cpp::BuildFlowGraphComplexExample for this
   // graph.
   Analysis.parseSectionContents(
Analysis.parseSectionContents(
           0xe8, 0x78, 0x56, 0x34, 0x12, // 15: callq OUTOFBOUNDS [+0x12345678]
           0x90,                         // 20: nop
           0x90,                         // 21: nop
           0x0f, 0x0b,                   // 22: ud2
       },
       0xDEADBEEF);
   uint64_t PrevSearchLengthForUndef = SearchLengthForUndef;
   SearchLengthForUndef = 5;
-  EXPECT_FALSE(Analysis.isIndirectInstructionCFIProtected(0xDEADBEEF + 9));
+  GraphResult Result = GraphBuilder::buildFlowGraph(Analysis, 0xDEADBEEF + 9);
+  EXPECT_EQ(CFIProtectionStatus::FAIL_ORPHANS,
+            Analysis.validateCFIProtection(Result));
   SearchLengthForUndef = PrevSearchLengthForUndef;
 }
 
 TEST_F(BasicFileAnalysisTest, UndefSearchLengthOneTest) {
   Analysis.parseSectionContents(
       {
           0x77, 0x0d,                   // 0x688118: ja 0x688127 [+12]
           0x48, 0x89, 0xdf,             // 0x68811a: mov %rbx, %rdi
           0xff, 0xd0,                   // 0x68811d: callq *%rax
           0x48, 0x89, 0xdf,             // 0x68811f: mov %rbx, %rdi
           0xe8, 0x09, 0x00, 0x00, 0x00, // 0x688122: callq 0x688130
           0x0f, 0x0b,                   // 0x688127: ud2
       },
       0x688118);
   uint64_t PrevSearchLengthForUndef = SearchLengthForUndef;
   SearchLengthForUndef = 1;
-  EXPECT_TRUE(Analysis.isIndirectInstructionCFIProtected(0x68811d));
+  GraphResult Result = GraphBuilder::buildFlowGraph(Analysis, 0x68811d);
+  EXPECT_EQ(CFIProtectionStatus::PROTECTED,
+            Analysis.validateCFIProtection(Result));
   SearchLengthForUndef = PrevSearchLengthForUndef;
 }
 
 TEST_F(BasicFileAnalysisTest, UndefSearchLengthOneTestFarAway) {
   Analysis.parseSectionContents(
       {
           0x74, 0x73,                         // 0x7759eb: je 0x775a60
           0xe9, 0x1c, 0x04, 0x00, 0x00, 0x00, // 0x7759ed: jmpq 0x775e0e
TEST_F(BasicFileAnalysisTest, UndefSearchLengthOneTestFarAway) {
 
   Analysis.parseSectionContents(
       {
           0x0f, 0x0b, // 0x775e0e: ud2
       },
       0x775e0e);
   uint64_t PrevSearchLengthForUndef = SearchLengthForUndef;
   SearchLengthForUndef = 1;
-  EXPECT_FALSE(Analysis.isIndirectInstructionCFIProtected(0x775a68));
+  GraphResult Result = GraphBuilder::buildFlowGraph(Analysis, 0x775a68);
+  EXPECT_EQ(CFIProtectionStatus::FAIL_BAD_CONDITIONAL_BRANCH,
+            Analysis.validateCFIProtection(Result));
   SearchLengthForUndef = 2;
-  EXPECT_TRUE(Analysis.isIndirectInstructionCFIProtected(0x775a68));
+  Result = GraphBuilder::buildFlowGraph(Analysis, 0x775a68);
+  EXPECT_EQ(CFIProtectionStatus::PROTECTED,
+            Analysis.validateCFIProtection(Result));
   SearchLengthForUndef = 3;
-  EXPECT_TRUE(Analysis.isIndirectInstructionCFIProtected(0x775a68));
+  Result = GraphBuilder::buildFlowGraph(Analysis, 0x775a68);
+  EXPECT_EQ(CFIProtectionStatus::PROTECTED,
+            Analysis.validateCFIProtection(Result));
   SearchLengthForUndef = PrevSearchLengthForUndef;
 }
 
 } // anonymous namespace
 } // end namespace cfi_verify
 } // end namespace llvm
 
 int main(int argc, char **argv) {