[cfi-verify] Support AArch64.

[jgalenson]

Summary

This patch adds support for AArch64 to cfi-verify.

This required three changes to cfi-verify. First, it generalizes checking if an instruction is a trap by adding a new isTrap flag to TableGen (and defining it for x86 and AArch64).

Second, the code that ensures that the operand register is not clobbered between the CFI check and the indirect call needs to allow a single dereference (in x86 this happens as part of the jump instruction, but not in AArch64). So I modified the code to walk backwards from the indirect call and look for multiple loads.

Third, we needed to ensure that return instructions are not counted as indirect branches. Technically, returns are indirect branches and can be covered by CFI, but LLVM's forward-edge CFI does not protect them, and x86 does not consider them, so we keep that behavior (this might also be worth discussing, however).

In addition, we had to improve AArch64's code to evaluate the branch target of a MCInst to handle calls where the destination is not the first operand (which it often is not).

[vlad.tsyrklevich]

Hi Joel, thanks for taking this on! Other than the comments mentioned inline, I'd also like to see a couple more tests, in particular:

• Currently there is a CFI-protected tiny.cc example, you should also an unprotected example.
• Given the special handling for vtable loads, it would be good to add a similar simple 'vtable.cc' example with a protected and an unprotected test to make sure that logic doesn't regress.

There are also unittests for llvm-cfi-verify. It would be worth adding a couple of tests for the 'can load' vtable logic to the FileAnalysis tests.

tools/llvm-cfi-verify/lib/FileAnalysis.cpp

157–158

Instead of doing string comparisons here for every valid value, lets define a TrapOpcode variable during initialization to X86::TRAP / AArch64::BRK depending on the target. (We can bail on other architectures that we haven't explicitly tested on to avoid confusing users who might otherwise believe the results.)

280

Update the header comment for this to mention the new clobber evaluation logic.

301

I believe the loop to compute this below can be replaced by Graph.flattenAddress(Node)

313–315

Any reason to not use a range-for here?

318

Invert the if condition here so that it's

if (...)
  return
....

319

This variable is set outside of the for loop so it will still be false for the next conditional branch node we iterate over. Please add a test for this case.

[pcc]

tools/llvm-cfi-verify/lib/FileAnalysis.cpp

157–158

I don't think we can access backend-specific things like X86::TRAP here though. It might be worth adding an interface to MCInstrAnalysis for asking what the trap instruction is and have that assert on architectures that we don't support yet.

[jgalenson]

Thanks for the comments! I'll try to update the patch on Friday.

Sorry for the lack of tests; I was having trouble compiling testcases the right way, but I think I have it figured out now.

tools/llvm-cfi-verify/lib/FileAnalysis.cpp

157–158

I had envisioned adding a new entry to MCID::Flag so that instruction definitions in .td files could contain IsTrap = 1 on the trap instructions. And as I said, that seemed the cleanest and most correct option but was quite a large change, especially if we only ever need two architectures. Adding a new method to MCInstrAnalysis seems a lot simpler, although I like it slightly less than my way. Any preferences?

301

Ah, that looks like just what I want. Thanks!

313–315

The reason is that on line 326 when I removed the defined register from the target set I needed an iterator not the value, and it seemed more efficient to reuse an iterator than call find. I'd be happy to lose a bit of performance to improve readability if you'd prefer me to use a foreach loop.

319

Good point, I'll move the definition inside the outermost for loop.

The reason I didn't write a testcase for this was that I wasn't sure how to construct one. Are there existing tests that create this pattern, or should I write a unit test, which is presumably simpler to create?

[vlad.tsyrklevich]

tools/llvm-cfi-verify/lib/FileAnalysis.cpp

157–158

I don't have a preference between the two.

313–315

Ah, I missed that. That's fine then.

319

I think this would make sense for either a unit or a lit test, either way you'll need to either hand-write assembly cases or reuse cases from a CFI-verified binary that this logic fixes.

[jgalenson]

I believe this addresses all of the existing comments except for how to handle detecting traps. I see Vlad just commented that he doesn't have an opinion, so if there are no further opinions I'll just play around and do what I feel is best. The current approach should still work, of course.

However, I was not sure how to create a vtable.cc lit-based regression test. When I compile my simple virtual call test, it creates separate sections for main and each virtual method, each of which starts at 0. This means that FileAnalysis::parseSectionContents will complain because multiple instructions have address 0. This happens even on x86, so I don't think it's AArch64-specific. I think the problem is that llvm-mc isn't producing a fully valid ELF file, but I'm not sure how to do that without a linker. For now I added a number of unit tests to test this case instead.

[jgalenson]

tools/llvm-cfi-verify/lib/FileAnalysis.cpp

157–158

I ended up going the TableGen route since it seemed more correct to me (all the other MCInstrAnalysis methods default to calling the MCInstrDesc method anyway). I'm not sure how to test it by itself, but I couldn't find tests for another of the flags, so hopefully this is good enough.

[vlad.tsyrklevich]

Changes seem reasonable to me modulo the one nit, though I'd give @pcc a chance to look at it as well if he has any feedback.

tools/llvm-cfi-verify/lib/FileAnalysis.h

152

This is true for AArch64 but not x86.

[jgalenson]

Thanks. I'll wait a bit to see if there are any more comments.

tools/llvm-cfi-verify/lib/FileAnalysis.h

152

The way I meant it, this actually included x86 since there the load happens on the indirect branch itself. I can change this to make that more clear, though.

[jgalenson]

Updated a comment.

[pcc]

LGTM

tools/llvm-cfi-verify/lib/FileAnalysis.cpp

157–158

Well, if this will only ever work on two architectures, wouldn't it be better to implement it on MCInstrAnalysis rather than in tablegen so that we will assert on the unsupported architectures instead of potentially giving an incorrect result? I don't feel too strongly about that, though.

[jgalenson]

tools/llvm-cfi-verify/lib/FileAnalysis.cpp

157–158

That makes sense, but other similar MCID properties seem to work only one some arches (e.g., isAdd only works on ARM and Hexagon). And the current behavior of cfi-verify on unsupported arches is to give an incorrect result, so at least this isn't a regression. :) If we want this, I'd say we could just add an architecture check at the beginning of this tool.

[pcc]

tools/llvm-cfi-verify/lib/FileAnalysis.cpp

157–158

I was mostly not thinking about llvm-cfi-verify but other tools or parts of the compiler that might end up trying to use the isTrap bit thinking that it would work on all architectures. But since those users are hypothetical maybe that's not too much of a concern.

Now that you point it out the architecture check might be a nice thing to have anyway.

include/llvm/MC/MCInstrDesc.h

enum Flag {
   Rematerializable,
   CheapAsAMove,
   ExtraSrcRegAllocReq,
   ExtraDefRegAllocReq,
   RegSequence,
   ExtractSubreg,
   InsertSubreg,
   Convergent,
-  Add
+  Add,
+  Trap
 };
 }
 
 /// Describe properties that are true of each instruction in the target
 /// description file.  This captures information about side effects, register
 /// use and many other things.  There is one instance of this struct for each
 /// target instruction class, and the MachineInstr class points to this struct
 /// directly to describe itself.
public:
   bool isPseudo() const { return Flags & (1ULL << MCID::Pseudo); }
 
   /// Return true if the instruction is a return.
   bool isReturn() const { return Flags & (1ULL << MCID::Return); }
 
   /// Return true if the instruction is an add instruction.
   bool isAdd() const { return Flags & (1ULL << MCID::Add); }
 
+  /// Return true if this instruction is a trap.
+  bool isTrap() const { return Flags & (1ULL << MCID::Trap); }
+
   /// Return true if the instruction is a register to register move.
   bool isMoveReg() const { return Flags & (1ULL << MCID::MoveReg); }
 
   ///  Return true if the instruction is a call.
   bool isCall() const { return Flags & (1ULL << MCID::Call); }
 
   /// Returns true if the specified instruction stops control flow
   /// from executing the instruction immediately following it.  Examples include

include/llvm/Target/Target.td

class Instruction {
   bit isCompare    = 0;     // Is this instruction a comparison instruction?
   bit isMoveImm    = 0;     // Is this instruction a move immediate instruction?
   bit isMoveReg    = 0;     // Is this instruction a move register instruction?
   bit isBitcast    = 0;     // Is this instruction a bitcast instruction?
   bit isSelect     = 0;     // Is this instruction a select instruction?
   bit isBarrier    = 0;     // Can control flow fall through this instruction?
   bit isCall       = 0;     // Is this instruction a call instruction?
   bit isAdd        = 0;     // Is this instruction an add instruction?
+  bit isTrap       = 0;     // Is this instruction a trap instruction?
   bit canFoldAsLoad = 0;    // Can this be folded as a simple memory operand?
   bit mayLoad      = ?;     // Is it possible for this inst to read memory?
   bit mayStore     = ?;     // Is it possible for this inst to write memory?
   bit isConvertibleToThreeAddress = 0;  // Can this 2-addr instruction promote?
   bit isCommutable = 0;     // Is this 3 operand instruction commutable?
   bit isTerminator = 0;     // Is this part of the terminator for a basic block?
   bit isReMaterializable = 0; // Is this instruction re-materializable?
   bit isPredicable = 0;     // Is this instruction predicable?

lib/Target/AArch64/AArch64InstrInfo.td

 let isCall = 1, Defs = [LR], Uses = [SP] in {
 def BL : CallImm<1, "bl", [(AArch64call tglobaladdr:$addr)]>;
 } // isCall
 def : Pat<(AArch64call texternalsym:$func), (BL texternalsym:$func)>;
 
 //===----------------------------------------------------------------------===//
 // Exception generation instructions.
 //===----------------------------------------------------------------------===//
+let isTrap = 1 in {
 def BRK   : ExceptionGeneration<0b001, 0b00, "brk">;
+}
 def DCPS1 : ExceptionGeneration<0b101, 0b01, "dcps1">;
 def DCPS2 : ExceptionGeneration<0b101, 0b10, "dcps2">;
 def DCPS3 : ExceptionGeneration<0b101, 0b11, "dcps3">;
 def HLT   : ExceptionGeneration<0b010, 0b00, "hlt">;
 def HVC   : ExceptionGeneration<0b000, 0b10, "hvc">;
 def SMC   : ExceptionGeneration<0b000, 0b11, "smc">;
 def SVC   : ExceptionGeneration<0b000, 0b01, "svc">;
 

lib/Target/AArch64/MCTargetDesc/AArch64MCTargetDesc.cpp

 namespace {
 
 class AArch64MCInstrAnalysis : public MCInstrAnalysis {
 public:
   AArch64MCInstrAnalysis(const MCInstrInfo *Info) : MCInstrAnalysis(Info) {}
 
   bool evaluateBranch(const MCInst &Inst, uint64_t Addr, uint64_t Size,
                       uint64_t &Target) const override {
-    if (Inst.getNumOperands() == 0 ||
-        Info->get(Inst.getOpcode()).OpInfo[0].OperandType !=
-            MCOI::OPERAND_PCREL)
-      return false;
-
-    int64_t Imm = Inst.getOperand(0).getImm() * 4;
+    // Search for a PC-relative argument.
+    // This will handle instructions like bcc (where the first argument is the
+    // condition code) and cbz (where it is a register).
+    const auto &Desc = Info->get(Inst.getOpcode());
+    for (unsigned i = 0, e = Inst.getNumOperands(); i != e; i++) {
+      if (Desc.OpInfo[i].OperandType == MCOI::OPERAND_PCREL) {
+        int64_t Imm = Inst.getOperand(i).getImm() * 4;
         Target = Addr + Imm;
         return true;
       }
+    }
+    return false;
+  }
 };
 
 } // end anonymous namespace
 
 static MCInstrAnalysis *createAArch64InstrAnalysis(const MCInstrInfo *Info) {
   return new AArch64MCInstrAnalysis(Info);
 }
 

lib/Target/X86/X86InstrSystem.td

 let Defs = [RAX, RDX] in
   def RDTSC : I<0x31, RawFrm, (outs), (ins), "rdtsc", [(X86rdtsc)]>, TB;
 
 let Defs = [RAX, RCX, RDX] in
   def RDTSCP : I<0x01, MRM_F9, (outs), (ins), "rdtscp", [(X86rdtscp)]>, TB;
 
 // CPU flow control instructions
 
-let mayLoad = 1, mayStore = 0, hasSideEffects = 1 in {
+let mayLoad = 1, mayStore = 0, hasSideEffects = 1, isTrap = 1 in {
   def TRAP    : I<0x0B, RawFrm, (outs), (ins), "ud2", [(trap)]>, TB;
   def UD2B    : I<0xB9, RawFrm, (outs), (ins), "ud2b", []>, TB;
 }
 
 def HLT : I<0xF4, RawFrm, (outs), (ins), "hlt", []>;
 def RSM : I<0xAA, RawFrm, (outs), (ins), "rsm", []>, TB;
 
 // Interrupt and SysCall Instructions.

test/tools/llvm-cfi-verify/AArch64/protected-lineinfo.s

+# RUN: llvm-mc %s -filetype obj -triple aarch64-- -o %t.o
+# RUN: llvm-cfi-verify %t.o | FileCheck %s
+
+# CHECK-LABEL: {{^Instruction: .* \(PROTECTED\)}}
+# CHECK-NEXT: tiny.cc:9
+
+# CHECK: Expected Protected: 1 (100.00%)
+# CHECK: Unexpected Protected: 0 (0.00%)
+# CHECK: Expected Unprotected: 0 (0.00%)
+# CHECK: Unexpected Unprotected (BAD): 0 (0.00%)
+
+# Source (tiny.cc):
+#   int a() { return 42; }
+#   int b() { return 137; }
+#   int main(int argc, char** argv) {
+#     int(*ptr)();
+#     if (argc == 1)
+#       ptr = &a;
+#     else
+#       ptr = &b;
+#     return ptr();
+#   }
+  .text
+  .file "ld-temp.o"
+  .p2align  2
+  .type _Z1av.cfi,@function
+_Z1av.cfi:
+.Lfunc_begin0:
+  .file 1 "/tmp/tiny.cc"
+  .loc  1 1 0
+  .cfi_startproc
+  .loc  1 1 11 prologue_end
+  mov w0, #42
+  ret
+.Ltmp0:
+.Lfunc_end0:
+  .size _Z1av.cfi, .Lfunc_end0-_Z1av.cfi
+  .cfi_endproc
+
+  .p2align  2
+  .type _Z1bv.cfi,@function
+_Z1bv.cfi:
+.Lfunc_begin1:
+  .loc  1 2 0
+  .cfi_startproc
+  .loc  1 2 11 prologue_end
+  mov w0, #137
+  ret
+.Ltmp1:
+.Lfunc_end1:
+  .size _Z1bv.cfi, .Lfunc_end1-_Z1bv.cfi
+  .cfi_endproc
+
+  .p2align  2
+  .type main,@function
+main:
+.Lfunc_begin2:
+  .loc  1 3 0
+  .cfi_startproc
+  sub sp, sp, #48
+  stp  x29, x30, [sp, #32]
+  add x29, sp, #32
+  .cfi_def_cfa w29, 16
+  .cfi_offset w30, -8
+  .cfi_offset w29, -16
+  stur  wzr, [x29, #-4]
+  stur  w0, [x29, #-8]
+  str x1, [sp, #16]
+.Ltmp2:
+  .loc  1 5 7 prologue_end
+  ldur  w8, [x29, #-8]
+  cmp w8, #1
+  b.ne  .LBB2_2
+  .loc  1 0 7 is_stmt 0
+  adrp  x8, _Z1av
+  add x8, x8, :lo12:_Z1av
+  .loc  1 6 9 is_stmt 1
+  str x8, [sp, #8]
+  .loc  1 6 5 is_stmt 0
+  b .LBB2_3
+.LBB2_2:
+  .loc  1 0 5
+  adrp  x8, _Z1bv
+  add x8, x8, :lo12:_Z1bv
+  .loc  1 8 9 is_stmt 1
+  str x8, [sp, #8]
+.LBB2_3:
+  .loc  1 0 9 is_stmt 0
+  adrp  x8, .L.cfi.jumptable
+  add x9, x8, :lo12:.L.cfi.jumptable
+  .loc  1 9 10 is_stmt 1
+  ldr x8, [sp, #8]
+  sub x9, x8, x9
+  lsr x10, x9, #2
+  orr x9, x10, x9, lsl #62
+  cmp x9, #1
+  b.ls  .LBB2_5
+  brk #0x1
+.LBB2_5:
+  blr x8
+  .loc  1 9 3 is_stmt 0
+  ldp  x29, x30, [sp, #32]
+  add sp, sp, #48
+  ret
+.Ltmp3:
+.Lfunc_end2:
+  .size main, .Lfunc_end2-main
+  .cfi_endproc
+
+  .p2align  2
+  .type .L.cfi.jumptable,@function
+.L.cfi.jumptable:
+.Lfunc_begin3:
+  .cfi_startproc
+  //APP
+  b _Z1av.cfi
+  b _Z1bv.cfi
+
+  //NO_APP
+.Lfunc_end3:
+  .size .L.cfi.jumptable, .Lfunc_end3-.L.cfi.jumptable
+  .cfi_endproc
+
+  .type .L__unnamed_1,@object
+  .section  .rodata,"a",@progbits
+  .p2align  2
+.L__unnamed_1:
+  .size .L__unnamed_1, 0
+
+  .section  .debug_str,"MS",@progbits,1
+.Linfo_string0:
+  .asciz  "clang version 7.0.0 (trunk 335774) (llvm/trunk 335775)"
+.Linfo_string1:
+  .asciz  "tiny.cc"
+.Linfo_string2:
+  .asciz  ""
+  .section  .debug_abbrev,"",@progbits
+  .byte 1
+  .byte 17
+  .byte 0
+  .byte 37
+  .byte 14
+  .byte 19
+  .byte 5
+  .byte 3
+  .byte 14
+  .byte 16
+  .byte 23
+  .byte 27
+  .byte 14
+  .byte 17
+  .byte 1
+  .byte 18
+  .byte 6
+  .byte 0
+  .byte 0
+  .byte 0
+  .section  .debug_info,"",@progbits
+.Lcu_begin0:
+  .word 38
+  .hword  4
+  .word .debug_abbrev
+  .byte 8
+  .byte 1
+  .word .Linfo_string0
+  .hword  4
+  .word .Linfo_string1
+  .word .Lline_table_start0
+  .word .Linfo_string2
+  .xword  .Lfunc_begin0
+  .word .Lfunc_end2-.Lfunc_begin0
+  .section  .debug_ranges,"",@progbits
+  .section  .debug_macinfo,"",@progbits
+  .byte 0
+
+  .type _Z1av,@function
+.set _Z1av, .L.cfi.jumptable
+  .type _Z1bv,@function
+.set _Z1bv, .L.cfi.jumptable+4
+  .ident  "clang version 7.0.0 (trunk 335774) (llvm/trunk 335775)"
+  .section  ".note.GNU-stack","",@progbits
+  .section  .debug_line,"",@progbits
+.Lline_table_start0:

test/tools/llvm-cfi-verify/AArch64/unprotected-lineinfo.s

+# RUN: llvm-mc %s -filetype obj -triple aarch64-- -o %t.o
+# RUN: llvm-cfi-verify %t.o | FileCheck %s
+
+# CHECK-LABEL: {{^Instruction: .* \(FAIL_BAD_CONDITIONAL_BRANCH\)}}
+# CHECK-NEXT: tiny.cc:9
+
+# CHECK: Expected Protected: 0 (0.00%)
+# CHECK: Unexpected Protected: 0 (0.00%)
+# CHECK: Expected Unprotected: 0 (0.00%)
+# CHECK: Unexpected Unprotected (BAD): 1 (100.00%)
+
+# Source (tiny.cc):
+#   int a() { return 42; }
+#   int b() { return 137; }
+#   int main(int argc, char** argv) {
+#     int(*ptr)();
+#     if (argc == 1)
+#       ptr = &a;
+#     else
+#       ptr = &b;
+#     return ptr();
+#   }
+# Compile with:
+#    clang++ -target aarch64-- -gmlt tiny.cc -S -o tiny.s
+  .text
+  .file "tiny.cc"
+  .globl  _Z1av
+  .p2align  2
+  .type _Z1av,@function
+_Z1av:                                  // @_Z1av
+.Lfunc_begin0:
+  .file 1 "tiny.cc"
+  .loc  1 1 0                   // tiny.cc:1:0
+  .cfi_startproc
+// BB#0:
+  mov w0, #42
+.Ltmp0:
+  .loc  1 1 11 prologue_end     // tiny.cc:1:11
+  ret
+.Ltmp1:
+.Lfunc_end0:
+  .size _Z1av, .Lfunc_end0-_Z1av
+  .cfi_endproc
+
+  .globl  _Z1bv
+  .p2align  2
+  .type _Z1bv,@function
+_Z1bv:                                  // @_Z1bv
+.Lfunc_begin1:
+  .loc  1 2 0                   // tiny.cc:2:0
+  .cfi_startproc
+// BB#0:
+  mov w0, #137
+.Ltmp2:
+  .loc  1 2 11 prologue_end     // tiny.cc:2:11
+  ret
+.Ltmp3:
+.Lfunc_end1:
+  .size _Z1bv, .Lfunc_end1-_Z1bv
+  .cfi_endproc
+
+  .globl  main
+  .p2align  2
+  .type main,@function
+main:                                   // @main
+.Lfunc_begin2:
+  .loc  1 3 0                   // tiny.cc:3:0
+  .cfi_startproc
+// BB#0:
+  sub sp, sp, #48             // =48
+  stp  x29, x30, [sp, #32]     // 8-byte Folded Spill
+  add x29, sp, #32            // =32
+.Lcfi0:
+  .cfi_def_cfa w29, 16
+.Lcfi1:
+  .cfi_offset w30, -8
+.Lcfi2:
+  .cfi_offset w29, -16
+  stur  wzr, [x29, #-4]
+  stur  w0, [x29, #-8]
+  str x1, [sp, #16]
+.Ltmp4:
+  .loc  1 5 7 prologue_end      // tiny.cc:5:7
+  ldur  w0, [x29, #-8]
+  cmp   w0, #1          // =1
+  b.ne  .LBB2_2
+// BB#1:
+  .loc  1 0 7 is_stmt 0         // tiny.cc:0:7
+  adrp  x8, _Z1av
+  add x8, x8, :lo12:_Z1av
+  .loc  1 6 9 is_stmt 1         // tiny.cc:6:9
+  str x8, [sp, #8]
+  .loc  1 6 5 is_stmt 0         // tiny.cc:6:5
+  b .LBB2_3
+.LBB2_2:
+  .loc  1 0 5                   // tiny.cc:0:5
+  adrp  x8, _Z1bv
+  add x8, x8, :lo12:_Z1bv
+  .loc  1 8 9 is_stmt 1         // tiny.cc:8:9
+  str x8, [sp, #8]
+.LBB2_3:
+  .loc  1 9 10                  // tiny.cc:9:10
+  ldr x8, [sp, #8]
+  blr x8
+  .loc  1 9 3 is_stmt 0         // tiny.cc:9:3
+  ldp  x29, x30, [sp, #32]     // 8-byte Folded Reload
+  add sp, sp, #48             // =48
+  ret
+.Ltmp5:
+.Lfunc_end2:
+  .size main, .Lfunc_end2-main
+  .cfi_endproc
+
+  .section  .debug_str,"MS",@progbits,1
+.Linfo_string0:
+  .asciz  "clang version 4.0.1-10 (tags/RELEASE_401/final)" // string offset=0
+.Linfo_string1:
+  .asciz  "tiny.cc"               // string offset=48
+.Linfo_string2:
+  .asciz  "/tmp"                  // string offset=56
+  .section  .debug_loc,"",@progbits
+  .section  .debug_abbrev,"",@progbits
+.Lsection_abbrev:
+  .byte 1                       // Abbreviation Code
+  .byte 17                      // DW_TAG_compile_unit
+  .byte 0                       // DW_CHILDREN_no
+  .byte 37                      // DW_AT_producer
+  .byte 14                      // DW_FORM_strp
+  .byte 19                      // DW_AT_language
+  .byte 5                       // DW_FORM_data2
+  .byte 3                       // DW_AT_name
+  .byte 14                      // DW_FORM_strp
+  .byte 16                      // DW_AT_stmt_list
+  .byte 23                      // DW_FORM_sec_offset
+  .byte 27                      // DW_AT_comp_dir
+  .byte 14                      // DW_FORM_strp
+  .byte 17                      // DW_AT_low_pc
+  .byte 1                       // DW_FORM_addr
+  .byte 18                      // DW_AT_high_pc
+  .byte 6                       // DW_FORM_data4
+  .byte 0                       // EOM(1)
+  .byte 0                       // EOM(2)
+  .byte 0                       // EOM(3)
+  .section  .debug_info,"",@progbits
+.Lsection_info:
+.Lcu_begin0:
+  .word 38                      // Length of Unit
+  .hword  4                       // DWARF version number
+  .word .Lsection_abbrev        // Offset Into Abbrev. Section
+  .byte 8                       // Address Size (in bytes)
+  .byte 1                       // Abbrev [1] 0xb:0x1f DW_TAG_compile_unit
+  .word .Linfo_string0          // DW_AT_producer
+  .hword  4                       // DW_AT_language
+  .word .Linfo_string1          // DW_AT_name
+  .word .Lline_table_start0     // DW_AT_stmt_list
+  .word .Linfo_string2          // DW_AT_comp_dir
+  .xword  .Lfunc_begin0           // DW_AT_low_pc
+  .word .Lfunc_end2-.Lfunc_begin0 // DW_AT_high_pc
+  .section  .debug_ranges,"",@progbits
+.Ldebug_range:
+  .section  .debug_macinfo,"",@progbits
+.Ldebug_macinfo:
+.Lcu_macro_begin0:
+  .byte 0                       // End Of Macro List Mark
+
+  .ident  "clang version 4.0.1-10 (tags/RELEASE_401/final)"
+  .section  ".note.GNU-stack","",@progbits
+  .section  .debug_line,"",@progbits
+.Lline_table_start0:

tools/llvm-cfi-verify/lib/FileAnalysis.h

public:
   // Returns the inlining information for the provided address.
   Expected<DIInliningInfo> symbolizeInlinedCode(uint64_t Address);
 
   // Returns whether the provided Graph represents a protected indirect control
   // flow instruction in this file.
   CFIProtectionStatus validateCFIProtection(const GraphResult &Graph) const;
 
   // Returns the first place the operand register is clobbered between the CFI-
-  // check and the indirect CF instruction execution. If the register is not
-  // modified, returns the address of the indirect CF instruction. The result is
-  // undefined if the provided graph does not fall under either the
-  // FAIL_REGISTER_CLOBBERED or PROTECTED status (see CFIProtectionStatus).
+  // check and the indirect CF instruction execution. We do this by walking
+  // backwards from the indirect CF and ensuring there is at most one load
+  // involving the operand register. If the register is not modified, returns
+  // the address of the indirect CF instruction. The result is undefined if the
+  // provided graph does not fall under either the FAIL_REGISTER_CLOBBERED or
+  // PROTECTED status (see CFIProtectionStatus).
   uint64_t indirectCFOperandClobber(const GraphResult& Graph) const;
 
   // Prints an instruction to the provided stream using this object's pretty-
   // printers.
   void printInstruction(const Instr &InstrMeta, raw_ostream &OS) const;
 
 protected:
   // Construct a blank object with the provided triple and features. Used in

tools/llvm-cfi-verify/lib/FileAnalysis.cpp

 
 const Instr &FileAnalysis::getInstructionOrDie(uint64_t Address) const {
   const auto &InstrKV = Instructions.find(Address);
   assert(InstrKV != Instructions.end() && "Address doesn't exist.");
   return InstrKV->second;
 }
 
 bool FileAnalysis::isCFITrap(const Instr &InstrMeta) const {
-  return MII->getName(InstrMeta.Instruction.getOpcode()) == "TRAP";
+  const auto &InstrDesc = MII->get(InstrMeta.Instruction.getOpcode());
+  return InstrDesc.isTrap();
 }
 
 bool FileAnalysis::canFallThrough(const Instr &InstrMeta) const {
   if (!InstrMeta.Valid)
     return false;
 
   if (isCFITrap(InstrMeta))
     return false;
FileAnalysis::validateCFIProtection(const GraphResult &Graph) const {
   }
 
   if (indirectCFOperandClobber(Graph) != Graph.BaseAddress)
     return CFIProtectionStatus::FAIL_REGISTER_CLOBBERED;
 
   return CFIProtectionStatus::PROTECTED;
 }
 
 uint64_t FileAnalysis::indirectCFOperandClobber(const GraphResult &Graph) const {
   assert(Graph.OrphanedNodes.empty() && "Orphaned nodes should be empty.");
 
   // Get the set of registers we must check to ensure they're not clobbered.
   const Instr &IndirectCF = getInstructionOrDie(Graph.BaseAddress);
   DenseSet<unsigned> RegisterNumbers;
   for (const auto &Operand : IndirectCF.Instruction) {
     if (Operand.isReg())
       RegisterNumbers.insert(Operand.getReg());
   }
   assert(RegisterNumbers.size() && "Zero register operands on indirect CF.");
 
   // Now check all branches to indirect CFs and ensure no clobbering happens.
   for (const auto &Branch : Graph.ConditionalBranchNodes) {
     uint64_t Node;
     if (Branch.IndirectCFIsOnTargetPath)
       Node = Branch.Target;
     else
       Node = Branch.Fallthrough;
 
-    while (Node != Graph.BaseAddress) {
+    // Some architectures (e.g., AArch64) cannot load in an indirect branch, so
+    // we allow them one load.
+    bool canLoad = !MII->get(IndirectCF.Instruction.getOpcode()).mayLoad();
+
+    // We walk backwards from the indirect CF.  It is the last node returned by
+    // Graph.flattenAddress, so we skip it since we already handled it.
+    DenseSet<unsigned> CurRegisterNumbers = RegisterNumbers;
+    std::vector<uint64_t> Nodes = Graph.flattenAddress(Node);
+    for (auto I = Nodes.rbegin() + 1, E = Nodes.rend(); I != E; ++I) {
+      Node = *I;
       const Instr &NodeInstr = getInstructionOrDie(Node);
       const auto &InstrDesc = MII->get(NodeInstr.Instruction.getOpcode());
 
-      for (unsigned RegNum : RegisterNumbers) {
+      for (auto RI = CurRegisterNumbers.begin(), RE = CurRegisterNumbers.end();
+           RI != RE; ++RI) {
+        unsigned RegNum = *RI;
         if (InstrDesc.hasDefOfPhysReg(NodeInstr.Instruction, RegNum,
-                                      *RegisterInfo))
+                                      *RegisterInfo)) {
+          if (!canLoad || !InstrDesc.mayLoad())
             return Node;
+          canLoad = false;
+          CurRegisterNumbers.erase(RI);
+          // Add the registers this load reads to those we check for clobbers.
+          for (unsigned i = InstrDesc.getNumDefs(),
+                        e = InstrDesc.getNumOperands(); i != e; i++) {
+            const auto Operand = NodeInstr.Instruction.getOperand(i);
+            if (Operand.isReg())
+              CurRegisterNumbers.insert(Operand.getReg());
+          }
+          break;
+        }
       }
-
-      const auto &KV = Graph.IntermediateNodes.find(Node);
-      assert((KV != Graph.IntermediateNodes.end()) &&
-             "Could not get next node.");
-      Node = KV->second;
     }
   }
 
   return Graph.BaseAddress;
 }
 
 void FileAnalysis::printInstruction(const Instr &InstrMeta,
                                     raw_ostream &OS) const {
if (MIA->evaluateBranch(Instruction, VMAddress, InstructionSize, Target)) {
       // If the target can be evaluated, it's not indirect.
       StaticBranchTargetings[Target].push_back(VMAddress);
       continue;
     }
 
     if (!usesRegisterOperand(InstrMeta))
       continue;
 
+    if (InstrDesc.isReturn())
+      continue;
+
     // Check if this instruction exists in the range of the DWARF metadata.
     if (!IgnoreDWARFFlag) {
       auto LineInfo =
           Symbolizer->symbolizeCode(Object->getFileName(), VMAddress);
       if (!LineInfo) {
         handleAllErrors(LineInfo.takeError(), [](const ErrorInfoBase &E) {
           errs() << "Symbolizer failed to get line: " << E.message() << "\n";
         });

unittests/tools/llvm-cfi-verify/FileAnalysis.cpp

 
 using Instr = ::llvm::cfi_verify::FileAnalysis::Instr;
 using ::testing::Eq;
 using ::testing::Field;
 
 namespace llvm {
 namespace cfi_verify {
 namespace {
-class ELFx86TestFileAnalysis : public FileAnalysis {
+class ELFTestFileAnalysis : public FileAnalysis {
 public:
-  ELFx86TestFileAnalysis()
-      : FileAnalysis(Triple("x86_64--"), SubtargetFeatures()) {}
+  ELFTestFileAnalysis(StringRef Trip)
+      : FileAnalysis(Triple(Trip), SubtargetFeatures()) {}
 
   // Expose this method publicly for testing.
   void parseSectionContents(ArrayRef<uint8_t> SectionBytes,
                             uint64_t SectionAddress) {
     FileAnalysis::parseSectionContents(SectionBytes, SectionAddress);
   }
 
   Error initialiseDisassemblyMembers() {
     return FileAnalysis::initialiseDisassemblyMembers();
   }
 };
 
 class BasicFileAnalysisTest : public ::testing::Test {
+public:
+  BasicFileAnalysisTest(StringRef Trip) : Analysis(Trip) {}
 protected:
   virtual void SetUp() {
     IgnoreDWARFFlag = true;
     SuccessfullyInitialised = true;
     if (auto Err = Analysis.initialiseDisassemblyMembers()) {
       handleAllErrors(std::move(Err), [&](const UnsupportedDisassembly &E) {
         SuccessfullyInitialised = false;
         outs()
-            << "Note: CFIVerifyTests are disabled due to lack of x86 support "
+            << "Note: CFIVerifyTests are disabled due to lack of support "
                "on this build.\n";
       });
     }
   }
 
   bool SuccessfullyInitialised;
-  ELFx86TestFileAnalysis Analysis;
+  ELFTestFileAnalysis Analysis;
+};
+
+class BasicX86FileAnalysisTest : public BasicFileAnalysisTest {
+public:
+  BasicX86FileAnalysisTest() : BasicFileAnalysisTest("x86_64--") {}
+};
+
+class BasicAArch64FileAnalysisTest : public BasicFileAnalysisTest {
+public:
+  BasicAArch64FileAnalysisTest() : BasicFileAnalysisTest("aarch64--") {}
 };
 
-TEST_F(BasicFileAnalysisTest, BasicDisassemblyTraversalTest) {
+TEST_F(BasicX86FileAnalysisTest, BasicDisassemblyTraversalTest) {
   if (!SuccessfullyInitialised)
     return;
   Analysis.parseSectionContents(
       {
           0x90,                   // 0: nop
           0xb0, 0x00,             // 1: mov $0x0, %al
           0x48, 0x89, 0xe5,       // 3: mov %rsp, %rbp
           0x48, 0x83, 0xec, 0x18, // 6: sub $0x18, %rsp
TEST_F(BasicX86FileAnalysisTest, BasicDisassemblyTraversalTest) {
   EXPECT_EQ(0xDEADBEEF + 23, InstrMeta->VMAddress);
   EXPECT_EQ(5u, InstrMeta->InstructionSize);
   EXPECT_FALSE(InstrMeta->Valid);
 
   EXPECT_EQ(nullptr, Analysis.getNextInstructionSequential(*InstrMeta));
   EXPECT_EQ(nullptr, Analysis.getPrevInstructionSequential(*InstrMeta));
 }
 
-TEST_F(BasicFileAnalysisTest, PrevAndNextFromBadInst) {
+TEST_F(BasicX86FileAnalysisTest, PrevAndNextFromBadInst) {
   if (!SuccessfullyInitialised)
     return;
   Analysis.parseSectionContents(
       {
           0x90, // 0: nop
           0x2f, // 1: (bad)
           0x90  // 2: nop
       },
       0xDEADBEEF);
   const auto &BadInstrMeta = Analysis.getInstructionOrDie(0xDEADBEEF + 1);
   const auto *GoodInstrMeta =
       Analysis.getPrevInstructionSequential(BadInstrMeta);
   EXPECT_NE(nullptr, GoodInstrMeta);
   EXPECT_EQ(0xDEADBEEF, GoodInstrMeta->VMAddress);
   EXPECT_EQ(1u, GoodInstrMeta->InstructionSize);
 
   GoodInstrMeta = Analysis.getNextInstructionSequential(BadInstrMeta);
   EXPECT_NE(nullptr, GoodInstrMeta);
   EXPECT_EQ(0xDEADBEEF + 2, GoodInstrMeta->VMAddress);
   EXPECT_EQ(1u, GoodInstrMeta->InstructionSize);
 }
 
-TEST_F(BasicFileAnalysisTest, CFITrapTest) {
+TEST_F(BasicX86FileAnalysisTest, CFITrapTest) {
   if (!SuccessfullyInitialised)
     return;
   Analysis.parseSectionContents(
       {
           0x90,                   // 0: nop
           0xb0, 0x00,             // 1: mov $0x0, %al
           0x48, 0x89, 0xe5,       // 3: mov %rsp, %rbp
           0x48, 0x83, 0xec, 0x18, // 6: sub $0x18, %rsp
TEST_F(BasicX86FileAnalysisTest, CFITrapTest) {
   EXPECT_FALSE(
       Analysis.isCFITrap(Analysis.getInstructionOrDie(0xDEADBEEF + 21)));
   EXPECT_FALSE(
       Analysis.isCFITrap(Analysis.getInstructionOrDie(0xDEADBEEF + 23)));
   EXPECT_TRUE(
       Analysis.isCFITrap(Analysis.getInstructionOrDie(0xDEADBEEF + 28)));
 }
 
-TEST_F(BasicFileAnalysisTest, FallThroughTest) {
+TEST_F(BasicX86FileAnalysisTest, FallThroughTest) {
   if (!SuccessfullyInitialised)
     return;
   Analysis.parseSectionContents(
       {
           0x90,                         // 0: nop
           0xb0, 0x00,                   // 1: mov $0x0, %al
           0x2f,                         // 3: (bad)
           0x0f, 0x0b,                   // 4: ud2
TEST_F(BasicX86FileAnalysisTest, FallThroughTest) {
   EXPECT_FALSE(
       Analysis.canFallThrough(Analysis.getInstructionOrDie(0xDEADBEEF + 15)));
   EXPECT_TRUE(
       Analysis.canFallThrough(Analysis.getInstructionOrDie(0xDEADBEEF + 17)));
   EXPECT_FALSE(
       Analysis.canFallThrough(Analysis.getInstructionOrDie(0xDEADBEEF + 19)));
 }
 
-TEST_F(BasicFileAnalysisTest, DefiniteNextInstructionTest) {
+TEST_F(BasicX86FileAnalysisTest, DefiniteNextInstructionTest) {
   if (!SuccessfullyInitialised)
     return;
   Analysis.parseSectionContents(
       {
           0x90,                         // 0: nop
           0xb0, 0x00,                   // 1: mov $0x0, %al
           0x2f,                         // 3: (bad)
           0x0f, 0x0b,                   // 4: ud2
TEST_F(BasicX86FileAnalysisTest, DefiniteNextInstructionTest) {
   EXPECT_EQ(nullptr, Analysis.getDefiniteNextInstruction(*Current));
 
   Current = Analysis.getInstruction(0xDEADBEEF + 38);
   Next = Analysis.getDefiniteNextInstruction(*Current);
   EXPECT_NE(nullptr, Next);
   EXPECT_EQ(0xDEADBEEF + 4, Next->VMAddress);
 }
 
-TEST_F(BasicFileAnalysisTest, ControlFlowXRefsTest) {
+TEST_F(BasicX86FileAnalysisTest, ControlFlowXRefsTest) {
   if (!SuccessfullyInitialised)
     return;
   Analysis.parseSectionContents(
       {
           0x90,                         // 0: nop
           0xb0, 0x00,                   // 1: mov $0x0, %al
           0x2f,                         // 3: (bad)
           0x0f, 0x0b,                   // 4: ud2
TEST_F(BasicX86FileAnalysisTest, ControlFlowXRefsTest) {
   XRefs = Analysis.getDirectControlFlowXRefs(*InstrMetaPtr);
   EXPECT_TRUE(Analysis.getDirectControlFlowXRefs(*InstrMetaPtr).empty());
 
   InstrMetaPtr = &Analysis.getInstructionOrDie(0xDEADBEEF + 38);
   XRefs = Analysis.getDirectControlFlowXRefs(*InstrMetaPtr);
   EXPECT_TRUE(Analysis.getDirectControlFlowXRefs(*InstrMetaPtr).empty());
 }
 
-TEST_F(BasicFileAnalysisTest, CFIProtectionInvalidTargets) {
+TEST_F(BasicX86FileAnalysisTest, CFIProtectionInvalidTargets) {
   if (!SuccessfullyInitialised)
     return;
   Analysis.parseSectionContents(
       {
           0x90,       // 0: nop
           0x0f, 0x0b, // 1: ud2
           0x75, 0x00, // 3: jne 5 [+0]
       },
       0xDEADBEEF);
   GraphResult Result = GraphBuilder::buildFlowGraph(Analysis, 0xDEADBEEF);
   EXPECT_EQ(CFIProtectionStatus::FAIL_NOT_INDIRECT_CF,
             Analysis.validateCFIProtection(Result));
   Result = GraphBuilder::buildFlowGraph(Analysis, 0xDEADBEEF + 1);
   EXPECT_EQ(CFIProtectionStatus::FAIL_NOT_INDIRECT_CF,
             Analysis.validateCFIProtection(Result));
   Result = GraphBuilder::buildFlowGraph(Analysis, 0xDEADBEEF + 3);
   EXPECT_EQ(CFIProtectionStatus::FAIL_NOT_INDIRECT_CF,
             Analysis.validateCFIProtection(Result));
   Result = GraphBuilder::buildFlowGraph(Analysis, 0x12345678);
   EXPECT_EQ(CFIProtectionStatus::FAIL_INVALID_INSTRUCTION,
             Analysis.validateCFIProtection(Result));
 }
 
-TEST_F(BasicFileAnalysisTest, CFIProtectionBasicFallthroughToUd2) {
+TEST_F(BasicX86FileAnalysisTest, CFIProtectionBasicFallthroughToUd2) {
   if (!SuccessfullyInitialised)
     return;
   Analysis.parseSectionContents(
       {
           0x75, 0x02, // 0: jne 4 [+2]
           0x0f, 0x0b, // 2: ud2
           0xff, 0x10, // 4: callq *(%rax)
       },
       0xDEADBEEF);
   GraphResult Result = GraphBuilder::buildFlowGraph(Analysis, 0xDEADBEEF + 4);
   EXPECT_EQ(CFIProtectionStatus::PROTECTED,
             Analysis.validateCFIProtection(Result));
 }
 
-TEST_F(BasicFileAnalysisTest, CFIProtectionBasicJumpToUd2) {
+TEST_F(BasicX86FileAnalysisTest, CFIProtectionBasicJumpToUd2) {
   if (!SuccessfullyInitialised)
     return;
   Analysis.parseSectionContents(
       {
           0x75, 0x02, // 0: jne 4 [+2]
           0xff, 0x10, // 2: callq *(%rax)
           0x0f, 0x0b, // 4: ud2
       },
       0xDEADBEEF);
   GraphResult Result = GraphBuilder::buildFlowGraph(Analysis, 0xDEADBEEF + 2);
   EXPECT_EQ(CFIProtectionStatus::PROTECTED,
             Analysis.validateCFIProtection(Result));
 }
 
-TEST_F(BasicFileAnalysisTest, CFIProtectionDualPathUd2) {
+TEST_F(BasicX86FileAnalysisTest, CFIProtectionDualPathUd2) {
   if (!SuccessfullyInitialised)
     return;
   Analysis.parseSectionContents(
       {
           0x75, 0x03, // 0: jne 5 [+3]
           0x90,       // 2: nop
           0xff, 0x10, // 3: callq *(%rax)
           0x0f, 0x0b, // 5: ud2
           0x75, 0xf9, // 7: jne 2 [-7]
           0x0f, 0x0b, // 9: ud2
       },
       0xDEADBEEF);
   GraphResult Result = GraphBuilder::buildFlowGraph(Analysis, 0xDEADBEEF + 3);
   EXPECT_EQ(CFIProtectionStatus::PROTECTED,
             Analysis.validateCFIProtection(Result));
 }
 
-TEST_F(BasicFileAnalysisTest, CFIProtectionDualPathSingleUd2) {
+TEST_F(BasicX86FileAnalysisTest, CFIProtectionDualPathSingleUd2) {
   if (!SuccessfullyInitialised)
     return;
   Analysis.parseSectionContents(
       {
           0x75, 0x05, // 0: jne 7 [+5]
           0x90,       // 2: nop
           0xff, 0x10, // 3: callq *(%rax)
           0x75, 0xfb, // 5: jne 2 [-5]
           0x0f, 0x0b, // 7: ud2
       },
       0xDEADBEEF);
   GraphResult Result = GraphBuilder::buildFlowGraph(Analysis, 0xDEADBEEF + 3);
   EXPECT_EQ(CFIProtectionStatus::PROTECTED,
             Analysis.validateCFIProtection(Result));
 }
 
-TEST_F(BasicFileAnalysisTest, CFIProtectionDualFailLimitUpwards) {
+TEST_F(BasicX86FileAnalysisTest, CFIProtectionDualFailLimitUpwards) {
   if (!SuccessfullyInitialised)
     return;
   Analysis.parseSectionContents(
       {
           0x75, 0x06, // 0: jne 8 [+6]
           0x90,       // 2: nop
           0x90,       // 3: nop
           0x90,       // 4: nop
           0x90,       // 5: nop
           0xff, 0x10, // 6: callq *(%rax)
           0x0f, 0x0b, // 8: ud2
       },
       0xDEADBEEF);
   uint64_t PrevSearchLengthForConditionalBranch =
       SearchLengthForConditionalBranch;
   SearchLengthForConditionalBranch = 2;
 
   GraphResult Result = GraphBuilder::buildFlowGraph(Analysis, 0xDEADBEEF + 6);
   EXPECT_EQ(CFIProtectionStatus::FAIL_ORPHANS,
             Analysis.validateCFIProtection(Result));
 
   SearchLengthForConditionalBranch = PrevSearchLengthForConditionalBranch;
 }
 
-TEST_F(BasicFileAnalysisTest, CFIProtectionDualFailLimitDownwards) {
+TEST_F(BasicX86FileAnalysisTest, CFIProtectionDualFailLimitDownwards) {
   if (!SuccessfullyInitialised)
     return;
   Analysis.parseSectionContents(
       {
           0x75, 0x02, // 0: jne 4 [+2]
           0xff, 0x10, // 2: callq *(%rax)
           0x90,       // 4: nop
           0x90,       // 5: nop
           0x90,       // 6: nop
           0x90,       // 7: nop
           0x0f, 0x0b, // 8: ud2
       },
       0xDEADBEEF);
   uint64_t PrevSearchLengthForUndef = SearchLengthForUndef;
   SearchLengthForUndef = 2;
 
   GraphResult Result = GraphBuilder::buildFlowGraph(Analysis, 0xDEADBEEF + 2);
   EXPECT_EQ(CFIProtectionStatus::FAIL_BAD_CONDITIONAL_BRANCH,
             Analysis.validateCFIProtection(Result));
 
   SearchLengthForUndef = PrevSearchLengthForUndef;
 }
 
-TEST_F(BasicFileAnalysisTest, CFIProtectionGoodAndBadPaths) {
+TEST_F(BasicX86FileAnalysisTest, CFIProtectionGoodAndBadPaths) {
   if (!SuccessfullyInitialised)
     return;
   Analysis.parseSectionContents(
       {
           0xeb, 0x02, // 0: jmp 4 [+2]
           0x75, 0x02, // 2: jne 6 [+2]
           0xff, 0x10, // 4: callq *(%rax)
           0x0f, 0x0b, // 6: ud2
       },
       0xDEADBEEF);
   GraphResult Result = GraphBuilder::buildFlowGraph(Analysis, 0xDEADBEEF + 4);
   EXPECT_EQ(CFIProtectionStatus::FAIL_ORPHANS,
             Analysis.validateCFIProtection(Result));
 }
 
-TEST_F(BasicFileAnalysisTest, CFIProtectionWithUnconditionalJumpInFallthrough) {
+TEST_F(BasicX86FileAnalysisTest, CFIProtectionWithUnconditionalJumpInFallthrough) {
   if (!SuccessfullyInitialised)
     return;
   Analysis.parseSectionContents(
       {
           0x75, 0x04, // 0: jne 6 [+4]
           0xeb, 0x00, // 2: jmp 4 [+0]
           0xff, 0x10, // 4: callq *(%rax)
           0x0f, 0x0b, // 6: ud2
       },
       0xDEADBEEF);
   GraphResult Result = GraphBuilder::buildFlowGraph(Analysis, 0xDEADBEEF + 4);
   EXPECT_EQ(CFIProtectionStatus::PROTECTED,
             Analysis.validateCFIProtection(Result));
 }
 
-TEST_F(BasicFileAnalysisTest, CFIProtectionComplexExample) {
+TEST_F(BasicX86FileAnalysisTest, CFIProtectionComplexExample) {
   if (!SuccessfullyInitialised)
     return;
   // See unittests/GraphBuilder.cpp::BuildFlowGraphComplexExample for this
   // graph.
   Analysis.parseSectionContents(
       {
           0x75, 0x12,                   // 0: jne 20 [+18]
           0xeb, 0x03,                   // 2: jmp 7 [+3]
TEST_F(BasicX86FileAnalysisTest, CFIProtectionComplexExample) {
   uint64_t PrevSearchLengthForUndef = SearchLengthForUndef;
   SearchLengthForUndef = 5;
   GraphResult Result = GraphBuilder::buildFlowGraph(Analysis, 0xDEADBEEF + 9);
   EXPECT_EQ(CFIProtectionStatus::FAIL_ORPHANS,
             Analysis.validateCFIProtection(Result));
   SearchLengthForUndef = PrevSearchLengthForUndef;
 }
 
-TEST_F(BasicFileAnalysisTest, UndefSearchLengthOneTest) {
+TEST_F(BasicX86FileAnalysisTest, UndefSearchLengthOneTest) {
   Analysis.parseSectionContents(
       {
           0x77, 0x0d,                   // 0x688118: ja 0x688127 [+12]
           0x48, 0x89, 0xdf,             // 0x68811a: mov %rbx, %rdi
           0xff, 0xd0,                   // 0x68811d: callq *%rax
           0x48, 0x89, 0xdf,             // 0x68811f: mov %rbx, %rdi
           0xe8, 0x09, 0x00, 0x00, 0x00, // 0x688122: callq 0x688130
           0x0f, 0x0b,                   // 0x688127: ud2
       },
       0x688118);
   uint64_t PrevSearchLengthForUndef = SearchLengthForUndef;
   SearchLengthForUndef = 1;
   GraphResult Result = GraphBuilder::buildFlowGraph(Analysis, 0x68811d);
   EXPECT_EQ(CFIProtectionStatus::PROTECTED,
             Analysis.validateCFIProtection(Result));
   SearchLengthForUndef = PrevSearchLengthForUndef;
 }
 
-TEST_F(BasicFileAnalysisTest, UndefSearchLengthOneTestFarAway) {
+TEST_F(BasicX86FileAnalysisTest, UndefSearchLengthOneTestFarAway) {
   Analysis.parseSectionContents(
       {
           0x74, 0x73,                         // 0x7759eb: je 0x775a60
           0xe9, 0x1c, 0x04, 0x00, 0x00, 0x00, // 0x7759ed: jmpq 0x775e0e
       },
       0x7759eb);
 
   Analysis.parseSectionContents(
EXPECT_EQ(CFIProtectionStatus::PROTECTED,
             Analysis.validateCFIProtection(Result));
   SearchLengthForUndef = 3;
   Result = GraphBuilder::buildFlowGraph(Analysis, 0x775a68);
   EXPECT_EQ(CFIProtectionStatus::PROTECTED,
             Analysis.validateCFIProtection(Result));
   SearchLengthForUndef = PrevSearchLengthForUndef;
 }
 
-TEST_F(BasicFileAnalysisTest, CFIProtectionClobberSinglePathExplicit) {
+TEST_F(BasicX86FileAnalysisTest, CFIProtectionClobberSinglePathExplicit) {
   if (!SuccessfullyInitialised)
     return;
   Analysis.parseSectionContents(
       {
           0x75, 0x02,                         // 0: jne 4 [+2]
           0x0f, 0x0b,                         // 2: ud2
           0x48, 0x05, 0x00, 0x00, 0x00, 0x00, // 4: add $0x0, %rax
           0xff, 0x10,                         // 10: callq *(%rax)
       },
       0xDEADBEEF);
   GraphResult Result = GraphBuilder::buildFlowGraph(Analysis, 0xDEADBEEF + 10);
   EXPECT_EQ(CFIProtectionStatus::FAIL_REGISTER_CLOBBERED,
             Analysis.validateCFIProtection(Result));
 }
 
-TEST_F(BasicFileAnalysisTest, CFIProtectionClobberSinglePathExplicit2) {
+TEST_F(BasicX86FileAnalysisTest, CFIProtectionClobberSinglePathExplicit2) {
   if (!SuccessfullyInitialised)
     return;
   Analysis.parseSectionContents(
       {
           0x75, 0x02,             // 0: jne 4 [+2]
           0x0f, 0x0b,             // 2: ud2
           0x48, 0x83, 0xc0, 0x00, // 4: add $0x0, %rax
           0xff, 0x10,             // 8: callq *(%rax)
       },
       0xDEADBEEF);
   GraphResult Result = GraphBuilder::buildFlowGraph(Analysis, 0xDEADBEEF + 8);
   EXPECT_EQ(CFIProtectionStatus::FAIL_REGISTER_CLOBBERED,
             Analysis.validateCFIProtection(Result));
 }
 
-TEST_F(BasicFileAnalysisTest, CFIProtectionClobberSinglePathImplicit) {
+TEST_F(BasicX86FileAnalysisTest, CFIProtectionClobberSinglePathImplicit) {
   if (!SuccessfullyInitialised)
     return;
   Analysis.parseSectionContents(
       {
           0x75, 0x02,                   // 0: jne 4 [+2]
           0x0f, 0x0b,                   // 2: ud2
           0x05, 0x00, 0x00, 0x00, 0x00, // 4: add $0x0, %eax
           0xff, 0x10,                   // 9: callq *(%rax)
       },
       0xDEADBEEF);
   GraphResult Result = GraphBuilder::buildFlowGraph(Analysis, 0xDEADBEEF + 9);
   EXPECT_EQ(CFIProtectionStatus::FAIL_REGISTER_CLOBBERED,
             Analysis.validateCFIProtection(Result));
 }
 
-TEST_F(BasicFileAnalysisTest, CFIProtectionClobberDualPathImplicit) {
+TEST_F(BasicX86FileAnalysisTest, CFIProtectionClobberDualPathImplicit) {
   if (!SuccessfullyInitialised)
     return;
   Analysis.parseSectionContents(
       {
           0x75, 0x04, // 0: jne 6 [+4]
           0x0f, 0x31, // 2: rdtsc (note: affects eax)
           0xff, 0x10, // 4: callq *(%rax)
           0x0f, 0x0b, // 6: ud2
           0x75, 0xf9, // 8: jne 2 [-7]
           0x0f, 0x0b, // 10: ud2
       },
       0xDEADBEEF);
   GraphResult Result = GraphBuilder::buildFlowGraph(Analysis, 0xDEADBEEF + 4);
   EXPECT_EQ(CFIProtectionStatus::FAIL_REGISTER_CLOBBERED,
             Analysis.validateCFIProtection(Result));
 }
 
+TEST_F(BasicAArch64FileAnalysisTest, AArch64BasicUnprotected) {
+  if (!SuccessfullyInitialised)
+    return;
+  Analysis.parseSectionContents(
+      {
+          0x00, 0x01, 0x3f, 0xd6, // 0: blr x8
+      },
+      0xDEADBEEF);
+  GraphResult Result = GraphBuilder::buildFlowGraph(Analysis, 0xDEADBEEF);
+  EXPECT_EQ(CFIProtectionStatus::FAIL_ORPHANS,
+            Analysis.validateCFIProtection(Result));
+}
+
+TEST_F(BasicAArch64FileAnalysisTest, AArch64BasicProtected) {
+  if (!SuccessfullyInitialised)
+    return;
+  Analysis.parseSectionContents(
+      {
+          0x49, 0x00, 0x00, 0x54, // 0: b.ls 8
+          0x20, 0x00, 0x20, 0xd4, // 4: brk #0x1
+          0x00, 0x01, 0x3f, 0xd6, // 8: blr x8
+      },
+      0xDEADBEEF);
+  GraphResult Result = GraphBuilder::buildFlowGraph(Analysis, 0xDEADBEEF + 8);
+  EXPECT_EQ(CFIProtectionStatus::PROTECTED,
+            Analysis.validateCFIProtection(Result));
+}
+
+TEST_F(BasicAArch64FileAnalysisTest, AArch64ClobberBasic) {
+  if (!SuccessfullyInitialised)
+    return;
+  Analysis.parseSectionContents(
+      {
+          0x49, 0x00, 0x00, 0x54, // 0: b.ls 8
+          0x20, 0x00, 0x20, 0xd4, // 4: brk #0x1
+          0x08, 0x05, 0x00, 0x91, // 8: add x8, x8, #1
+          0x00, 0x01, 0x3f, 0xd6, // 12: blr x8
+      },
+      0xDEADBEEF);
+  GraphResult Result = GraphBuilder::buildFlowGraph(Analysis, 0xDEADBEEF + 12);
+  EXPECT_EQ(CFIProtectionStatus::FAIL_REGISTER_CLOBBERED,
+            Analysis.validateCFIProtection(Result));
+}
+
+TEST_F(BasicAArch64FileAnalysisTest, AArch64ClobberOneLoad) {
+  if (!SuccessfullyInitialised)
+    return;
+  Analysis.parseSectionContents(
+      {
+          0x49, 0x00, 0x00, 0x54, // 0: b.ls 8
+          0x20, 0x00, 0x20, 0xd4, // 4: brk #0x1
+          0x21, 0x09, 0x40, 0xf9, // 8: ldr x1, [x9,#16]
+          0x20, 0x00, 0x1f, 0xd6, // 12: br x1
+      },
+      0xDEADBEEF);
+  GraphResult Result = GraphBuilder::buildFlowGraph(Analysis, 0xDEADBEEF + 12);
+  EXPECT_EQ(CFIProtectionStatus::PROTECTED,
+            Analysis.validateCFIProtection(Result));
+}
+
+TEST_F(BasicAArch64FileAnalysisTest, AArch64ClobberLoadAddGood) {
+  if (!SuccessfullyInitialised)
+    return;
+  Analysis.parseSectionContents(
+      {
+          0x49, 0x00, 0x00, 0x54, // 0: b.ls 8
+          0x20, 0x00, 0x20, 0xd4, // 4: brk #0x1
+          0x21, 0x04, 0x00, 0x91, // 8: add x1, x1, #1
+          0x21, 0x09, 0x40, 0xf9, // 12: ldr x1, [x9,#16]
+          0x20, 0x00, 0x1f, 0xd6, // 16: br x1
+      },
+      0xDEADBEEF);
+  GraphResult Result = GraphBuilder::buildFlowGraph(Analysis, 0xDEADBEEF + 16);
+  EXPECT_EQ(CFIProtectionStatus::PROTECTED,
+            Analysis.validateCFIProtection(Result));
+}
+
+TEST_F(BasicAArch64FileAnalysisTest, AArch64ClobberLoadAddBad) {
+  if (!SuccessfullyInitialised)
+    return;
+  Analysis.parseSectionContents(
+      {
+          0x49, 0x00, 0x00, 0x54, // 0: b.ls 8
+          0x20, 0x00, 0x20, 0xd4, // 4: brk #0x1
+          0x21, 0x09, 0x40, 0xf9, // 8: ldr x1, [x9,#16]
+          0x21, 0x04, 0x00, 0x91, // 12: add x1, x1, #1
+          0x20, 0x00, 0x1f, 0xd6, // 16: br x1
+      },
+      0xDEADBEEF);
+  GraphResult Result = GraphBuilder::buildFlowGraph(Analysis, 0xDEADBEEF + 16);
+  EXPECT_EQ(CFIProtectionStatus::FAIL_REGISTER_CLOBBERED,
+            Analysis.validateCFIProtection(Result));
+}
+
+TEST_F(BasicAArch64FileAnalysisTest, AArch64ClobberLoadAddBad2) {
+  if (!SuccessfullyInitialised)
+    return;
+  Analysis.parseSectionContents(
+      {
+          0x49, 0x00, 0x00, 0x54, // 0: b.ls 8
+          0x20, 0x00, 0x20, 0xd4, // 4: brk #0x1
+          0x29, 0x04, 0x00, 0x91, // 16: add x9, x1, #1
+          0x21, 0x09, 0x40, 0xf9, // 12: ldr x1, [x9,#16]
+          0x20, 0x00, 0x1f, 0xd6, // 16: br x1
+      },
+      0xDEADBEEF);
+  GraphResult Result = GraphBuilder::buildFlowGraph(Analysis, 0xDEADBEEF + 16);
+  EXPECT_EQ(CFIProtectionStatus::FAIL_REGISTER_CLOBBERED,
+            Analysis.validateCFIProtection(Result));
+}
+
+TEST_F(BasicAArch64FileAnalysisTest, AArch64ClobberTwoLoads) {
+  if (!SuccessfullyInitialised)
+    return;
+  Analysis.parseSectionContents(
+      {
+          0x49, 0x00, 0x00, 0x54, // 0: b.ls 8
+          0x20, 0x00, 0x20, 0xd4, // 4: brk #0x1
+          0x21, 0x09, 0x40, 0xf9, // 8: ldr x1, [x9,#16]
+          0x21, 0x08, 0x40, 0xf9, // 12: ldr x1, [x1,#16]
+          0x20, 0x00, 0x1f, 0xd6, // 16: br x1
+      },
+      0xDEADBEEF);
+  GraphResult Result = GraphBuilder::buildFlowGraph(Analysis, 0xDEADBEEF + 16);
+  EXPECT_EQ(CFIProtectionStatus::FAIL_REGISTER_CLOBBERED,
+            Analysis.validateCFIProtection(Result));
+}
+
+TEST_F(BasicAArch64FileAnalysisTest, AArch64ClobberUnrelatedSecondLoad) {
+  if (!SuccessfullyInitialised)
+    return;
+  Analysis.parseSectionContents(
+      {
+          0x49, 0x00, 0x00, 0x54, // 0: b.ls 8
+          0x20, 0x00, 0x20, 0xd4, // 4: brk #0x1
+          0x21, 0x09, 0x40, 0xf9, // 8: ldr x1, [x9,#16]
+          0x21, 0x09, 0x40, 0xf9, // 12: ldr x1, [x9,#16]
+          0x20, 0x00, 0x1f, 0xd6, // 16: br x1
+      },
+      0xDEADBEEF);
+  GraphResult Result = GraphBuilder::buildFlowGraph(Analysis, 0xDEADBEEF + 16);
+  EXPECT_EQ(CFIProtectionStatus::PROTECTED,
+            Analysis.validateCFIProtection(Result));
+}
+
+TEST_F(BasicAArch64FileAnalysisTest, AArch64ClobberUnrelatedLoads) {
+  if (!SuccessfullyInitialised)
+    return;
+  Analysis.parseSectionContents(
+      {
+          0x49, 0x00, 0x00, 0x54, // 0: b.ls 8
+          0x20, 0x00, 0x20, 0xd4, // 4: brk #0x1
+          0x22, 0x09, 0x40, 0xf9, // 8: ldr x2, [x9,#16]
+          0x22, 0x08, 0x40, 0xf9, // 12: ldr x2, [x1,#16]
+          0x20, 0x00, 0x1f, 0xd6, // 16: br x1
+      },
+      0xDEADBEEF);
+  GraphResult Result = GraphBuilder::buildFlowGraph(Analysis, 0xDEADBEEF + 16);
+  EXPECT_EQ(CFIProtectionStatus::PROTECTED,
+            Analysis.validateCFIProtection(Result));
+}
+
+TEST_F(BasicAArch64FileAnalysisTest, AArch64GoodAndBadPaths) {
+  if (!SuccessfullyInitialised)
+    return;
+  Analysis.parseSectionContents(
+      {
+          0x03, 0x00, 0x00, 0x14, // 0: b 12
+          0x49, 0x00, 0x00, 0x54, // 4: b.ls 8
+          0x20, 0x00, 0x20, 0xd4, // 8: brk #0x1
+          0x20, 0x00, 0x1f, 0xd6, // 12: br x1
+      },
+      0xDEADBEEF);
+  GraphResult Result = GraphBuilder::buildFlowGraph(Analysis, 0xDEADBEEF + 12);
+  EXPECT_EQ(CFIProtectionStatus::FAIL_ORPHANS,
+            Analysis.validateCFIProtection(Result));
+}
+
+TEST_F(BasicAArch64FileAnalysisTest, AArch64TwoPaths) {
+  if (!SuccessfullyInitialised)
+    return;
+  Analysis.parseSectionContents(
+      {
+          0xc9, 0x00, 0x00, 0x54, // 0: b.ls 24
+          0x21, 0x08, 0x40, 0xf9, // 4: ldr x1, [x1,#16]
+          0x03, 0x00, 0x00, 0x14, // 8: b 12
+          0x69, 0x00, 0x00, 0x54, // 12: b.ls 12
+          0x21, 0x08, 0x40, 0xf9, // 16: ldr x1, [x1,#16]
+          0x20, 0x00, 0x1f, 0xd6, // 20: br x1
+          0x20, 0x00, 0x20, 0xd4, // 24: brk #0x1
+      },
+      0xDEADBEEF);
+  GraphResult Result = GraphBuilder::buildFlowGraph(Analysis, 0xDEADBEEF + 20);
+  EXPECT_EQ(CFIProtectionStatus::PROTECTED,
+            Analysis.validateCFIProtection(Result));
+}
+
+TEST_F(BasicAArch64FileAnalysisTest, AArch64TwoPathsBadLoad1) {
+  if (!SuccessfullyInitialised)
+    return;
+  Analysis.parseSectionContents(
+      {
+          0xe9, 0x00, 0x00, 0x54, // 0: b.ls 28
+          0x21, 0x08, 0x40, 0xf9, // 4: ldr x1, [x1,#16]
+          0x21, 0x08, 0x40, 0xf9, // 8: ldr x1, [x1,#16]
+          0x03, 0x00, 0x00, 0x14, // 12: b 12
+          0x69, 0x00, 0x00, 0x54, // 16: b.ls 12
+          0x21, 0x08, 0x40, 0xf9, // 20: ldr x1, [x1,#16]
+          0x20, 0x00, 0x1f, 0xd6, // 24: br x1
+          0x20, 0x00, 0x20, 0xd4, // 28: brk #0x1
+      },
+      0xDEADBEEF);
+  GraphResult Result = GraphBuilder::buildFlowGraph(Analysis, 0xDEADBEEF + 24);
+  EXPECT_EQ(CFIProtectionStatus::FAIL_REGISTER_CLOBBERED,
+            Analysis.validateCFIProtection(Result));
+}
+
+TEST_F(BasicAArch64FileAnalysisTest, AArch64TwoPathsBadLoad2) {
+  if (!SuccessfullyInitialised)
+    return;
+  Analysis.parseSectionContents(
+      {
+          0xe9, 0x00, 0x00, 0x54, // 0: b.ls 28
+          0x21, 0x08, 0x40, 0xf9, // 4: ldr x1, [x1,#16]
+          0x03, 0x00, 0x00, 0x14, // 8: b 12
+          0x89, 0x00, 0x00, 0x54, // 12: b.ls 16
+          0x21, 0x08, 0x40, 0xf9, // 16: ldr x1, [x1,#16]
+          0x21, 0x08, 0x40, 0xf9, // 20: ldr x1, [x1,#16]
+          0x20, 0x00, 0x1f, 0xd6, // 24: br x1
+          0x20, 0x00, 0x20, 0xd4, // 28: brk #0x1
+      },
+      0xDEADBEEF);
+  GraphResult Result = GraphBuilder::buildFlowGraph(Analysis, 0xDEADBEEF + 24);
+  EXPECT_EQ(CFIProtectionStatus::FAIL_REGISTER_CLOBBERED,
+            Analysis.validateCFIProtection(Result));
+}
+
 } // anonymous namespace
 } // end namespace cfi_verify
 } // end namespace llvm
 
 int main(int argc, char **argv) {
   ::testing::InitGoogleTest(&argc, argv);
   llvm::cl::ParseCommandLineOptions(argc, argv);
 
   llvm::InitializeAllTargetInfos();
   llvm::InitializeAllTargetMCs();
   llvm::InitializeAllAsmParsers();
   llvm::InitializeAllDisassemblers();
 
   return RUN_ALL_TESTS();
 }

utils/TableGen/CodeGenInstruction.h

public:
     bool isCompare : 1;
     bool isMoveImm : 1;
     bool isMoveReg : 1;
     bool isBitcast : 1;
     bool isSelect : 1;
     bool isBarrier : 1;
     bool isCall : 1;
     bool isAdd : 1;
+    bool isTrap : 1;
     bool canFoldAsLoad : 1;
     bool mayLoad : 1;
     bool mayLoad_Unset : 1;
     bool mayStore : 1;
     bool mayStore_Unset : 1;
     bool isPredicable : 1;
     bool isConvertibleToThreeAddress : 1;
     bool isCommutable : 1;

utils/TableGen/CodeGenInstruction.cpp

CodeGenInstruction::CodeGenInstruction(Record *R)
   isCompare    = R->getValueAsBit("isCompare");
   isMoveImm    = R->getValueAsBit("isMoveImm");
   isMoveReg    = R->getValueAsBit("isMoveReg");
   isBitcast    = R->getValueAsBit("isBitcast");
   isSelect     = R->getValueAsBit("isSelect");
   isBarrier    = R->getValueAsBit("isBarrier");
   isCall       = R->getValueAsBit("isCall");
   isAdd        = R->getValueAsBit("isAdd");
+  isTrap       = R->getValueAsBit("isTrap");
   canFoldAsLoad = R->getValueAsBit("canFoldAsLoad");
   isPredicable = Operands.isPredicable || R->getValueAsBit("isPredicable");
   isConvertibleToThreeAddress = R->getValueAsBit("isConvertibleToThreeAddress");
   isCommutable = R->getValueAsBit("isCommutable");
   isTerminator = R->getValueAsBit("isTerminator");
   isReMaterializable = R->getValueAsBit("isReMaterializable");
   hasDelaySlot = R->getValueAsBit("hasDelaySlot");
   usesCustomInserter = R->getValueAsBit("usesCustomInserter");

utils/TableGen/InstrDocsEmitter.cpp

#define FLAG(f) if (II->f) { FlagStrings.push_back(str(f)); }
     FLAG(isIndirectBranch)
     FLAG(isCompare)
     FLAG(isMoveImm)
     FLAG(isBitcast)
     FLAG(isSelect)
     FLAG(isBarrier)
     FLAG(isCall)
     FLAG(isAdd)
+    FLAG(isTrap)
     FLAG(canFoldAsLoad)
     FLAG(mayLoad)
     //FLAG(mayLoad_Unset) // Deliberately omitted.
     FLAG(mayStore)
     //FLAG(mayStore_Unset) // Deliberately omitted.
     FLAG(isPredicable)
     FLAG(isConvertibleToThreeAddress)
     FLAG(isCommutable)

utils/TableGen/InstrInfoEmitter.cpp

void InstrInfoEmitter::emitRecord(const CodeGenInstruction &Inst, unsigned Num,
   if (Inst.isReturn)           OS << "|(1ULL<<MCID::Return)";
   if (Inst.isBranch)           OS << "|(1ULL<<MCID::Branch)";
   if (Inst.isIndirectBranch)   OS << "|(1ULL<<MCID::IndirectBranch)";
   if (Inst.isCompare)          OS << "|(1ULL<<MCID::Compare)";
   if (Inst.isMoveImm)          OS << "|(1ULL<<MCID::MoveImm)";
   if (Inst.isMoveReg)          OS << "|(1ULL<<MCID::MoveReg)";
   if (Inst.isBitcast)          OS << "|(1ULL<<MCID::Bitcast)";
   if (Inst.isAdd)              OS << "|(1ULL<<MCID::Add)";
+  if (Inst.isTrap)             OS << "|(1ULL<<MCID::Trap)";
   if (Inst.isSelect)           OS << "|(1ULL<<MCID::Select)";
   if (Inst.isBarrier)          OS << "|(1ULL<<MCID::Barrier)";
   if (Inst.hasDelaySlot)       OS << "|(1ULL<<MCID::DelaySlot)";
   if (Inst.isCall)             OS << "|(1ULL<<MCID::Call)";
   if (Inst.canFoldAsLoad)      OS << "|(1ULL<<MCID::FoldableAsLoad)";
   if (Inst.mayLoad)            OS << "|(1ULL<<MCID::MayLoad)";
   if (Inst.mayStore)           OS << "|(1ULL<<MCID::MayStore)";
   if (Inst.isPredicable)       OS << "|(1ULL<<MCID::Predicable)";