mono/linux-packaging-mono
0
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Imported Upstream version 5.18.0.167

Browse Source 
Former-commit-id: 289509151e0fee68a1b591a20c9f109c3c789d3a
This commit is contained in:
Xamarin Public Jenkins (auto-signing)
2018-10-20 08:25:10 +00:00
parent e19d552987
commit b084638f15
28489 changed files with 184 additions and 3866856 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
external/llvm/tools/llvm-cfi-verify/CMakeLists.txt vendored
View File

@ -1,18 +0,0 @@
set(LLVM_LINK_COMPONENTS
AllTargetsAsmPrinters
AllTargetsAsmParsers
AllTargetsDescs
AllTargetsDisassemblers
AllTargetsInfos
MC
MCParser
Object
Support
Symbolize
)
add_llvm_tool(llvm-cfi-verify
llvm-cfi-verify.cpp)
add_subdirectory(lib)
target_link_libraries(llvm-cfi-verify PRIVATE LLVMCFIVerify)

22
external/llvm/tools/llvm-cfi-verify/LLVMBuild.txt vendored
View File

@ -1,22 +0,0 @@
;===- ./tools/llvm-cfi-verify/LLVMBuild.txt --------------------*- Conf -*--===;
;
; The LLVM Compiler Infrastructure
;
; This file is distributed under the University of Illinois Open Source
; License. See LICENSE.TXT for details.
;
;===------------------------------------------------------------------------===;
;
; This is an LLVMBuild description file for the components in this subdirectory.
;
; For more information on the LLVMBuild system, please see:
;
; http://llvm.org/docs/LLVMBuild.html
;
;===------------------------------------------------------------------------===;
[component_0]
type = Tool
name = llvm-cfi-verify
parent = Tools
required_libraries = all-targets MC MCDisassembler MCParser Support Symbolize

17
external/llvm/tools/llvm-cfi-verify/lib/CMakeLists.txt vendored
View File

@ -1,17 +0,0 @@
add_library(LLVMCFIVerify
STATIC
FileAnalysis.cpp
FileAnalysis.h
GraphBuilder.cpp
GraphBuilder.h)
llvm_update_compile_flags(LLVMCFIVerify)
llvm_map_components_to_libnames(libs
DebugInfoDWARF
MC
MCParser
Object
Support
Symbolize)
target_link_libraries(LLVMCFIVerify ${libs})
set_target_properties(LLVMCFIVerify PROPERTIES FOLDER "Libraries")

501
external/llvm/tools/llvm-cfi-verify/lib/FileAnalysis.cpp vendored
View File

File diff suppressed because it is too large Load Diff

234
external/llvm/tools/llvm-cfi-verify/lib/FileAnalysis.h vendored
View File

@ -1,234 +0,0 @@
//===- FileAnalysis.h -------------------------------------------*- C++ -*-===//
//
// The LLVM Compiler Infrastructure
//
// This file is distributed under the University of Illinois Open Source
// License. See LICENSE.TXT for details.
//
//===----------------------------------------------------------------------===//
#ifndef LLVM_CFI_VERIFY_FILE_ANALYSIS_H
#define LLVM_CFI_VERIFY_FILE_ANALYSIS_H
#include "llvm/ADT/DenseMap.h"
#include "llvm/BinaryFormat/ELF.h"
#include "llvm/DebugInfo/Symbolize/Symbolize.h"
#include "llvm/MC/MCAsmInfo.h"
#include "llvm/MC/MCContext.h"
#include "llvm/MC/MCDisassembler/MCDisassembler.h"
#include "llvm/MC/MCInst.h"
#include "llvm/MC/MCInstPrinter.h"
#include "llvm/MC/MCInstrAnalysis.h"
#include "llvm/MC/MCInstrDesc.h"
#include "llvm/MC/MCInstrInfo.h"
#include "llvm/MC/MCObjectFileInfo.h"
#include "llvm/MC/MCRegisterInfo.h"
#include "llvm/MC/MCSubtargetInfo.h"
#include "llvm/Object/Binary.h"
#include "llvm/Object/COFF.h"
#include "llvm/Object/ELFObjectFile.h"
#include "llvm/Object/ObjectFile.h"
#include "llvm/Support/Casting.h"
#include "llvm/Support/CommandLine.h"
#include "llvm/Support/Error.h"
#include "llvm/Support/MemoryBuffer.h"
#include "llvm/Support/TargetRegistry.h"
#include "llvm/Support/TargetSelect.h"
#include "llvm/Support/raw_ostream.h"
#include <functional>
#include <set>
#include <string>
#include <unordered_map>
namespace llvm {
namespace cfi_verify {
struct GraphResult;
extern bool IgnoreDWARFFlag;
enum class CFIProtectionStatus {
// This instruction is protected by CFI.
PROTECTED,
// The instruction is not an indirect control flow instruction, and thus
// shouldn't be protected.
FAIL_NOT_INDIRECT_CF,
// There is a path to the instruction that was unexpected.
FAIL_ORPHANS,
// There is a path to the instruction from a conditional branch that does not
// properly check the destination for this vcall/icall.
FAIL_BAD_CONDITIONAL_BRANCH,
// One of the operands of the indirect CF instruction is modified between the
// CFI-check and execution.
FAIL_REGISTER_CLOBBERED,
// The instruction referenced does not exist. This normally indicates an
// error in the program, where you try and validate a graph that was created
// in a different FileAnalysis object.
FAIL_INVALID_INSTRUCTION,
};
StringRef stringCFIProtectionStatus(CFIProtectionStatus Status);
// Disassembler and analysis tool for machine code files. Keeps track of non-
// sequential control flows, including indirect control flow instructions.
class FileAnalysis {
public:
// A metadata struct for an instruction.
struct Instr {
uint64_t VMAddress; // Virtual memory address of this instruction.
MCInst Instruction; // Instruction.
uint64_t InstructionSize; // Size of this instruction.
bool Valid; // Is this a valid instruction? If false, Instr::Instruction is
// undefined.
};
// Construct a FileAnalysis from a file path.
static Expected<FileAnalysis> Create(StringRef Filename);
// Construct and take ownership of the supplied object. Do not use this
// constructor, prefer to use FileAnalysis::Create instead.
FileAnalysis(object::OwningBinary<object::Binary> Binary);
FileAnalysis() = delete;
FileAnalysis(const FileAnalysis &) = delete;
FileAnalysis(FileAnalysis &&Other) = default;
// Returns the instruction at the provided address. Returns nullptr if there
// is no instruction at the provided address.
const Instr *getInstruction(uint64_t Address) const;
// Returns the instruction at the provided adress, dying if the instruction is
// not found.
const Instr &getInstructionOrDie(uint64_t Address) const;
// Returns a pointer to the previous/next instruction in sequence,
// respectively. Returns nullptr if the next/prev instruction doesn't exist,
// or if the provided instruction doesn't exist.
const Instr *getPrevInstructionSequential(const Instr &InstrMeta) const;
const Instr *getNextInstructionSequential(const Instr &InstrMeta) const;
// Returns whether this instruction is used by CFI to trap the program.
bool isCFITrap(const Instr &InstrMeta) const;
// Returns whether this function can fall through to the next instruction.
// Undefined (and bad) instructions cannot fall through, and instruction that
// modify the control flow can only fall through if they are conditional
// branches or calls.
bool canFallThrough(const Instr &InstrMeta) const;
// Returns the definitive next instruction. This is different from the next
// instruction sequentially as it will follow unconditional branches (assuming
// they can be resolved at compile time, i.e. not indirect). This method
// returns nullptr if the provided instruction does not transfer control flow
// to exactly one instruction that is known deterministically at compile time.
// Also returns nullptr if the deterministic target does not exist in this
// file.
const Instr *getDefiniteNextInstruction(const Instr &InstrMeta) const;
// Get a list of deterministic control flows that lead to the provided
// instruction. This list includes all static control flow cross-references as
// well as the previous instruction if it can fall through.
std::set<const Instr *>
getDirectControlFlowXRefs(const Instr &InstrMeta) const;
// Returns whether this instruction uses a register operand.
bool usesRegisterOperand(const Instr &InstrMeta) const;
// Returns the list of indirect instructions.
const std::set<uint64_t> &getIndirectInstructions() const;
const MCRegisterInfo *getRegisterInfo() const;
const MCInstrInfo *getMCInstrInfo() const;
const MCInstrAnalysis *getMCInstrAnalysis() const;
// Returns the inlining information for the provided address.
Expected<DIInliningInfo> symbolizeInlinedCode(uint64_t Address);
// Returns whether the provided Graph represents a protected indirect control
// flow instruction in this file.
CFIProtectionStatus validateCFIProtection(const GraphResult &Graph) const;
// Returns the first place the operand register is clobbered between the CFI-
// check and the indirect CF instruction execution. If the register is not
// modified, returns the address of the indirect CF instruction. The result is
// undefined if the provided graph does not fall under either the
// FAIL_REGISTER_CLOBBERED or PROTECTED status (see CFIProtectionStatus).
uint64_t indirectCFOperandClobber(const GraphResult& Graph) const;
// Prints an instruction to the provided stream using this object's pretty-
// printers.
void printInstruction(const Instr &InstrMeta, raw_ostream &OS) const;
protected:
// Construct a blank object with the provided triple and features. Used in
// testing, where a sub class will dependency inject protected methods to
// allow analysis of raw binary, without requiring a fully valid ELF file.
FileAnalysis(const Triple &ObjectTriple, const SubtargetFeatures &Features);
// Add an instruction to this object.
void addInstruction(const Instr &Instruction);
// Disassemble and parse the provided bytes into this object. Instruction
// address calculation is done relative to the provided SectionAddress.
void parseSectionContents(ArrayRef<uint8_t> SectionBytes,
uint64_t SectionAddress);
// Constructs and initialises members required for disassembly.
Error initialiseDisassemblyMembers();
// Parses code sections from the internal object file. Saves them into the
// internal members. Should only be called once by Create().
Error parseCodeSections();
private:
// Members that describe the input file.
object::OwningBinary<object::Binary> Binary;
const object::ObjectFile *Object = nullptr;
Triple ObjectTriple;
std::string ArchName;
std::string MCPU;
const Target *ObjectTarget = nullptr;
SubtargetFeatures Features;
// Members required for disassembly.
std::unique_ptr<const MCRegisterInfo> RegisterInfo;
std::unique_ptr<const MCAsmInfo> AsmInfo;
std::unique_ptr<MCSubtargetInfo> SubtargetInfo;
std::unique_ptr<const MCInstrInfo> MII;
MCObjectFileInfo MOFI;
std::unique_ptr<MCContext> Context;
std::unique_ptr<const MCDisassembler> Disassembler;
std::unique_ptr<const MCInstrAnalysis> MIA;
std::unique_ptr<MCInstPrinter> Printer;
// Symbolizer used for debug information parsing.
std::unique_ptr<symbolize::LLVMSymbolizer> Symbolizer;
// A mapping between the virtual memory address to the instruction metadata
// struct. TODO(hctim): Reimplement this as a sorted vector to avoid per-
// insertion allocation.
std::map<uint64_t, Instr> Instructions;
// Contains a mapping between a specific address, and a list of instructions
// that use this address as a branch target (including call instructions).
DenseMap<uint64_t, std::vector<uint64_t>> StaticBranchTargetings;
// A list of addresses of indirect control flow instructions.
std::set<uint64_t> IndirectInstructions;
};
class UnsupportedDisassembly : public ErrorInfo<UnsupportedDisassembly> {
public:
static char ID;
std::string Text;
UnsupportedDisassembly(StringRef Text);
void log(raw_ostream &OS) const override;
std::error_code convertToErrorCode() const override;
};
} // namespace cfi_verify
} // namespace llvm
#endif // LLVM_CFI_VERIFY_FILE_ANALYSIS_H

321
external/llvm/tools/llvm-cfi-verify/lib/GraphBuilder.cpp vendored
View File

@ -1,321 +0,0 @@
//===- GraphBuilder.cpp -----------------------------------------*- C++ -*-===//
//
// The LLVM Compiler Infrastructure
//
// This file is distributed under the University of Illinois Open Source
// License. See LICENSE.TXT for details.
//
//===----------------------------------------------------------------------===//
#include "GraphBuilder.h"
#include "llvm/BinaryFormat/ELF.h"
#include "llvm/MC/MCAsmInfo.h"
#include "llvm/MC/MCContext.h"
#include "llvm/MC/MCDisassembler/MCDisassembler.h"
#include "llvm/MC/MCInst.h"
#include "llvm/MC/MCInstPrinter.h"
#include "llvm/MC/MCInstrAnalysis.h"
#include "llvm/MC/MCInstrDesc.h"
#include "llvm/MC/MCInstrInfo.h"
#include "llvm/MC/MCObjectFileInfo.h"
#include "llvm/MC/MCRegisterInfo.h"
#include "llvm/MC/MCSubtargetInfo.h"
#include "llvm/Object/Binary.h"
#include "llvm/Object/COFF.h"
#include "llvm/Object/ELFObjectFile.h"
#include "llvm/Object/ObjectFile.h"
#include "llvm/Support/Casting.h"
#include "llvm/Support/CommandLine.h"
#include "llvm/Support/Error.h"
#include "llvm/Support/MemoryBuffer.h"
#include "llvm/Support/TargetRegistry.h"
#include "llvm/Support/TargetSelect.h"
#include "llvm/Support/raw_ostream.h"
using Instr = llvm::cfi_verify::FileAnalysis::Instr;
namespace llvm {
namespace cfi_verify {
unsigned long long SearchLengthForUndef;
unsigned long long SearchLengthForConditionalBranch;
static cl::opt<unsigned long long, true> SearchLengthForUndefArg(
"search-length-undef",
cl::desc("Specify the maximum amount of instructions "
"to inspect when searching for an undefined "
"instruction from a conditional branch."),
cl::location(SearchLengthForUndef), cl::init(2));
static cl::opt<unsigned long long, true> SearchLengthForConditionalBranchArg(
"search-length-cb",
cl::desc("Specify the maximum amount of instructions "
"to inspect when searching for a conditional "
"branch from an indirect control flow."),
cl::location(SearchLengthForConditionalBranch), cl::init(20));
std::vector<uint64_t> GraphResult::flattenAddress(uint64_t Address) const {
std::vector<uint64_t> Addresses;
auto It = IntermediateNodes.find(Address);
Addresses.push_back(Address);
while (It != IntermediateNodes.end()) {
Addresses.push_back(It->second);
It = IntermediateNodes.find(It->second);
}
return Addresses;
}
void printPairToDOT(const FileAnalysis &Analysis, raw_ostream &OS,
uint64_t From, uint64_t To) {
OS << " \"" << format_hex(From, 2) << ": ";
Analysis.printInstruction(Analysis.getInstructionOrDie(From), OS);
OS << "\" -> \"" << format_hex(To, 2) << ": ";
Analysis.printInstruction(Analysis.getInstructionOrDie(To), OS);
OS << "\"\n";
}
void GraphResult::printToDOT(const FileAnalysis &Analysis,
raw_ostream &OS) const {
std::map<uint64_t, uint64_t> SortedIntermediateNodes(
IntermediateNodes.begin(), IntermediateNodes.end());
OS << "digraph graph_" << format_hex(BaseAddress, 2) << " {\n";
for (const auto &KV : SortedIntermediateNodes)
printPairToDOT(Analysis, OS, KV.first, KV.second);
for (auto &BranchNode : ConditionalBranchNodes) {
for (auto &V : {BranchNode.Target, BranchNode.Fallthrough})
printPairToDOT(Analysis, OS, BranchNode.Address, V);
}
OS << "}\n";
}
GraphResult GraphBuilder::buildFlowGraph(const FileAnalysis &Analysis,
uint64_t Address) {
GraphResult Result;
Result.BaseAddress = Address;
DenseSet<uint64_t> OpenedNodes;
const auto &IndirectInstructions = Analysis.getIndirectInstructions();
if (IndirectInstructions.find(Address) == IndirectInstructions.end())
return Result;
buildFlowGraphImpl(Analysis, OpenedNodes, Result, Address, 0);
return Result;
}
void GraphBuilder::buildFlowsToUndefined(const FileAnalysis &Analysis,
GraphResult &Result,
ConditionalBranchNode &BranchNode,
const Instr &BranchInstrMeta) {
assert(SearchLengthForUndef > 0 &&
"Search length for undefined flow must be greater than zero.");
// Start setting up the next node in the block.
uint64_t NextAddress = 0;
const Instr *NextMetaPtr;
// Find out the next instruction in the block and add it to the new
// node.
if (BranchNode.Target && !BranchNode.Fallthrough) {
// We know the target of the branch, find the fallthrough.
NextMetaPtr = Analysis.getNextInstructionSequential(BranchInstrMeta);
if (!NextMetaPtr) {
errs() << "Failed to get next instruction from "
<< format_hex(BranchNode.Address, 2) << ".\n";
return;
}
NextAddress = NextMetaPtr->VMAddress;
BranchNode.Fallthrough =
NextMetaPtr->VMAddress; // Add the new node to the branch head.
} else if (BranchNode.Fallthrough && !BranchNode.Target) {
// We already know the fallthrough, evaluate the target.
uint64_t Target;
if (!Analysis.getMCInstrAnalysis()->evaluateBranch(
BranchInstrMeta.Instruction, BranchInstrMeta.VMAddress,
BranchInstrMeta.InstructionSize, Target)) {
errs() << "Failed to get branch target for conditional branch at address "
<< format_hex(BranchInstrMeta.VMAddress, 2) << ".\n";
return;
}
// Resolve the meta pointer for the target of this branch.
NextMetaPtr = Analysis.getInstruction(Target);
if (!NextMetaPtr) {
errs() << "Failed to find instruction at address "
<< format_hex(Target, 2) << ".\n";
return;
}
NextAddress = Target;
BranchNode.Target =
NextMetaPtr->VMAddress; // Add the new node to the branch head.
} else {
errs() << "ControlBranchNode supplied to buildFlowsToUndefined should "
"provide Target xor Fallthrough.\n";
return;
}
uint64_t CurrentAddress = NextAddress;
const Instr *CurrentMetaPtr = NextMetaPtr;
// Now the branch head has been set properly, complete the rest of the block.
for (uint64_t i = 1; i < SearchLengthForUndef; ++i) {
// Check to see whether the block should die.
if (Analysis.isCFITrap(*CurrentMetaPtr)) {
BranchNode.CFIProtection = true;
return;
}
// Find the metadata of the next instruction.
NextMetaPtr = Analysis.getDefiniteNextInstruction(*CurrentMetaPtr);
if (!NextMetaPtr)
return;
// Setup the next node.
NextAddress = NextMetaPtr->VMAddress;
// Add this as an intermediate.
Result.IntermediateNodes[CurrentAddress] = NextAddress;
// Move the 'current' pointers to the new tail of the block.
CurrentMetaPtr = NextMetaPtr;
CurrentAddress = NextAddress;
}
// Final check of the last thing we added to the block.
if (Analysis.isCFITrap(*CurrentMetaPtr))
BranchNode.CFIProtection = true;
}
void GraphBuilder::buildFlowGraphImpl(const FileAnalysis &Analysis,
DenseSet<uint64_t> &OpenedNodes,
GraphResult &Result, uint64_t Address,
uint64_t Depth) {
// If we've exceeded the flow length, terminate.
if (Depth >= SearchLengthForConditionalBranch) {
Result.OrphanedNodes.push_back(Address);
return;
}
// Ensure this flow is acyclic.
if (OpenedNodes.count(Address))
Result.OrphanedNodes.push_back(Address);
// If this flow is already explored, stop here.
if (Result.IntermediateNodes.count(Address))
return;
// Get the metadata for the node instruction.
const auto &InstrMetaPtr = Analysis.getInstruction(Address);
if (!InstrMetaPtr) {
errs() << "Failed to build flow graph for instruction at address "
<< format_hex(Address, 2) << ".\n";
Result.OrphanedNodes.push_back(Address);
return;
}
const auto &ChildMeta = *InstrMetaPtr;
OpenedNodes.insert(Address);
std::set<const Instr *> CFCrossRefs =
Analysis.getDirectControlFlowXRefs(ChildMeta);
bool HasValidCrossRef = false;
for (const auto *ParentMetaPtr : CFCrossRefs) {
assert(ParentMetaPtr && "CFCrossRefs returned nullptr.");
const auto &ParentMeta = *ParentMetaPtr;
const auto &ParentDesc =
Analysis.getMCInstrInfo()->get(ParentMeta.Instruction.getOpcode());
if (!ParentDesc.mayAffectControlFlow(ParentMeta.Instruction,
*Analysis.getRegisterInfo())) {
// If this cross reference doesn't affect CF, continue the graph.
buildFlowGraphImpl(Analysis, OpenedNodes, Result, ParentMeta.VMAddress,
Depth + 1);
Result.IntermediateNodes[ParentMeta.VMAddress] = Address;
HasValidCrossRef = true;
continue;
}
// Call instructions are not valid in the upwards traversal.
if (ParentDesc.isCall()) {
Result.IntermediateNodes[ParentMeta.VMAddress] = Address;
Result.OrphanedNodes.push_back(ParentMeta.VMAddress);
continue;
}
// Evaluate the branch target to ascertain whether this XRef is the result
// of a fallthrough or the target of a branch.
uint64_t BranchTarget;
if (!Analysis.getMCInstrAnalysis()->evaluateBranch(
ParentMeta.Instruction, ParentMeta.VMAddress,
ParentMeta.InstructionSize, BranchTarget)) {
errs() << "Failed to evaluate branch target for instruction at address "
<< format_hex(ParentMeta.VMAddress, 2) << ".\n";
Result.IntermediateNodes[ParentMeta.VMAddress] = Address;
Result.OrphanedNodes.push_back(ParentMeta.VMAddress);
continue;
}
// Allow unconditional branches to be part of the upwards traversal.
if (ParentDesc.isUnconditionalBranch()) {
// Ensures that the unconditional branch is actually an XRef to the child.
if (BranchTarget != Address) {
errs() << "Control flow to " << format_hex(Address, 2)
<< ", but target resolution of "
<< format_hex(ParentMeta.VMAddress, 2)
<< " is not this address?\n";
Result.IntermediateNodes[ParentMeta.VMAddress] = Address;
Result.OrphanedNodes.push_back(ParentMeta.VMAddress);
continue;
}
buildFlowGraphImpl(Analysis, OpenedNodes, Result, ParentMeta.VMAddress,
Depth + 1);
Result.IntermediateNodes[ParentMeta.VMAddress] = Address;
HasValidCrossRef = true;
continue;
}
// Ensure that any unknown CFs are caught.
if (!ParentDesc.isConditionalBranch()) {
errs() << "Unknown control flow encountered when building graph at "
<< format_hex(Address, 2) << "\n.";
Result.IntermediateNodes[ParentMeta.VMAddress] = Address;
Result.OrphanedNodes.push_back(ParentMeta.VMAddress);
continue;
}
// Only direct conditional branches should be present at this point. Setup
// a conditional branch node and build flows to the ud2.
ConditionalBranchNode BranchNode;
BranchNode.Address = ParentMeta.VMAddress;
BranchNode.Target = 0;
BranchNode.Fallthrough = 0;
BranchNode.CFIProtection = false;
BranchNode.IndirectCFIsOnTargetPath = (BranchTarget == Address);
if (BranchTarget == Address)
BranchNode.Target = Address;
else
BranchNode.Fallthrough = Address;
HasValidCrossRef = true;
buildFlowsToUndefined(Analysis, Result, BranchNode, ParentMeta);
Result.ConditionalBranchNodes.push_back(BranchNode);
}
if (!HasValidCrossRef)
Result.OrphanedNodes.push_back(Address);
OpenedNodes.erase(Address);
}
} // namespace cfi_verify
} // namespace llvm

137
external/llvm/tools/llvm-cfi-verify/lib/GraphBuilder.h vendored
View File

@ -1,137 +0,0 @@
//===- GraphBuilder.h -------------------------------------------*- C++ -*-===//
//
// The LLVM Compiler Infrastructure
//
// This file is distributed under the University of Illinois Open Source
// License. See LICENSE.TXT for details.
//
//===----------------------------------------------------------------------===//
#ifndef LLVM_CFI_VERIFY_GRAPH_BUILDER_H
#define LLVM_CFI_VERIFY_GRAPH_BUILDER_H
#include "FileAnalysis.h"
#include "llvm/ADT/DenseMap.h"
#include "llvm/BinaryFormat/ELF.h"
#include "llvm/MC/MCAsmInfo.h"
#include "llvm/MC/MCContext.h"
#include "llvm/MC/MCDisassembler/MCDisassembler.h"
#include "llvm/MC/MCInst.h"
#include "llvm/MC/MCInstPrinter.h"
#include "llvm/MC/MCInstrAnalysis.h"
#include "llvm/MC/MCInstrDesc.h"
#include "llvm/MC/MCInstrInfo.h"
#include "llvm/MC/MCObjectFileInfo.h"
#include "llvm/MC/MCRegisterInfo.h"
#include "llvm/MC/MCSubtargetInfo.h"
#include "llvm/Object/Binary.h"
#include "llvm/Object/COFF.h"
#include "llvm/Object/ELFObjectFile.h"
#include "llvm/Object/ObjectFile.h"
#include "llvm/Support/Casting.h"
#include "llvm/Support/CommandLine.h"
#include "llvm/Support/Error.h"
#include "llvm/Support/MemoryBuffer.h"
#include "llvm/Support/TargetRegistry.h"
#include "llvm/Support/TargetSelect.h"
#include "llvm/Support/raw_ostream.h"
#include <functional>
#include <set>
#include <string>
#include <unordered_map>
using Instr = llvm::cfi_verify::FileAnalysis::Instr;
namespace llvm {
namespace cfi_verify {
extern unsigned long long SearchLengthForUndef;
extern unsigned long long SearchLengthForConditionalBranch;
struct ConditionalBranchNode {
uint64_t Address;
uint64_t Target;
uint64_t Fallthrough;
// Does this conditional branch look like it's used for CFI protection? i.e.
// - The exit point of a basic block whos entry point is {target|fallthrough}
// is a CFI trap, and...
// - The exit point of the other basic block is an undirect CF instruction.
bool CFIProtection;
bool IndirectCFIsOnTargetPath;
};
// The canonical graph result structure returned by GraphBuilder. The members
// in this structure encapsulate all possible code paths to the instruction
// located at `BaseAddress`.
struct GraphResult {
uint64_t BaseAddress;
// Map between an instruction address, and the address of the next instruction
// that will be executed. This map will contain all keys in the range:
// - [orphaned node, base address)
// - [conditional branch node {target|fallthrough}, base address)
DenseMap<uint64_t, uint64_t> IntermediateNodes;
// A list of orphaned nodes. A node is an 'orphan' if it meets any of the
// following criteria:
// - The length of the path from the base to this node has exceeded
// `SearchLengthForConditionalBranch`.
// - The node has no cross references to it.
// - The path from the base to this node is cyclic.
std::vector<uint64_t> OrphanedNodes;
// A list of top-level conditional branches that exist at the top of any
// non-orphan paths from the base.
std::vector<ConditionalBranchNode> ConditionalBranchNodes;
// Returns an in-order list of the path between the address provided and the
// base. The provided address must be part of this graph, and must not be a
// conditional branch.
std::vector<uint64_t> flattenAddress(uint64_t Address) const;
// Print the DOT representation of this result.
void printToDOT(const FileAnalysis &Analysis, raw_ostream &OS) const;
};
class GraphBuilder {
public:
// Build the control flow graph for a provided control flow node. This method
// will enumerate all branch nodes that can lead to this node, and place them
// into GraphResult::ConditionalBranchNodes. It will also provide any orphaned
// (i.e. the upwards traversal did not make it to a branch node) flows to the
// provided node in GraphResult::OrphanedNodes.
static GraphResult buildFlowGraph(const FileAnalysis &Analysis,
uint64_t Address);
private:
// Implementation function that actually builds the flow graph. Retrieves a
// list of cross references to instruction referenced in `Address`. If any of
// these XRefs are conditional branches, it will build the other potential
// path (fallthrough or target) using `buildFlowsToUndefined`. Otherwise, this
// function will recursively call itself where `Address` in the recursive call
// is now the XRef. If any XRef is an orphan, it is added to
// `Result.OrphanedNodes`. `OpenedNodes` keeps track of the list of nodes
// in the current path and is used for cycle-checking. If the path is found
// to be cyclic, it will be added to `Result.OrphanedNodes`.
static void buildFlowGraphImpl(const FileAnalysis &Analysis,
DenseSet<uint64_t> &OpenedNodes,
GraphResult &Result, uint64_t Address,
uint64_t Depth);
// Utilised by buildFlowGraphImpl to build the tree out from the provided
// conditional branch node to an undefined instruction. The provided
// conditional branch node must have exactly one of its subtrees set, and will
// update the node's CFIProtection field if a deterministic flow can be found
// to an undefined instruction.
static void buildFlowsToUndefined(const FileAnalysis &Analysis,
GraphResult &Result,
ConditionalBranchNode &BranchNode,
const Instr &BranchInstrMeta);
};
} // end namespace cfi_verify
} // end namespace llvm
#endif // LLVM_CFI_VERIFY_GRAPH_BUILDER_H

22
external/llvm/tools/llvm-cfi-verify/lib/LLVMBuild.txt vendored
View File

@ -1,22 +0,0 @@
;===- ./tools/llvm-cfi-verify/lib/LLVMBuild.txt ----------------*- Conf -*--===;
;
; The LLVM Compiler Infrastructure
;
; This file is distributed under the University of Illinois Open Source
; License. See LICENSE.TXT for details.
;
;===------------------------------------------------------------------------===;
;
; This is an LLVMBuild description file for the components in this subdirectory.
;
; For more information on the LLVMBuild system, please see:
;
; http://llvm.org/docs/LLVMBuild.html
;
;===------------------------------------------------------------------------===;
[component_0]
type = Library
name = CFIVerify
parent = Libraries
required_libraries = DebugInfoDWARF MC MCDisassembler MCParser Support Symbolize

200
external/llvm/tools/llvm-cfi-verify/llvm-cfi-verify.cpp vendored
View File

@ -1,200 +0,0 @@
//===-- llvm-cfi-verify.cpp - CFI Verification tool for LLVM --------------===//
//
// The LLVM Compiler Infrastructure
//
// This file is distributed under the University of Illinois Open Source
// License. See LICENSE.TXT for details.
//
//===----------------------------------------------------------------------===//
//
// This tool verifies Control Flow Integrity (CFI) instrumentation by static
// binary anaylsis. See the design document in /docs/CFIVerify.rst for more
// information.
//
// This tool is currently incomplete. It currently only does disassembly for
// object files, and searches through the code for indirect control flow
// instructions, printing them once found.
//
//===----------------------------------------------------------------------===//
#include "lib/FileAnalysis.h"
#include "lib/GraphBuilder.h"
#include "llvm/BinaryFormat/ELF.h"
#include "llvm/Support/CommandLine.h"
#include "llvm/Support/Error.h"
#include "llvm/Support/FormatVariadic.h"
#include "llvm/Support/SpecialCaseList.h"
#include <cstdlib>
using namespace llvm;
using namespace llvm::object;
using namespace llvm::cfi_verify;
cl::opt<std::string> InputFilename(cl::Positional, cl::desc("<input file>"),
cl::Required);
cl::opt<std::string> BlacklistFilename(cl::Positional,
cl::desc("[blacklist file]"),
cl::init("-"));
cl::opt<bool> PrintGraphs(
"print-graphs",
cl::desc("Print graphs around indirect CF instructions in DOT format."),
cl::init(false));
ExitOnError ExitOnErr;
void printIndirectCFInstructions(FileAnalysis &Analysis,
const SpecialCaseList *SpecialCaseList) {
uint64_t ExpectedProtected = 0;
uint64_t UnexpectedProtected = 0;
uint64_t ExpectedUnprotected = 0;
uint64_t UnexpectedUnprotected = 0;
std::map<unsigned, uint64_t> BlameCounter;
for (uint64_t Address : Analysis.getIndirectInstructions()) {
const auto &InstrMeta = Analysis.getInstructionOrDie(Address);
GraphResult Graph = GraphBuilder::buildFlowGraph(Analysis, Address);
CFIProtectionStatus ProtectionStatus =
Analysis.validateCFIProtection(Graph);
bool CFIProtected = (ProtectionStatus == CFIProtectionStatus::PROTECTED);
if (CFIProtected)
outs() << "P ";
else
outs() << "U ";
outs() << format_hex(Address, 2) << " | ";
Analysis.printInstruction(InstrMeta, outs());
outs() << " \n";
if (PrintGraphs)
Graph.printToDOT(Analysis, outs());
if (IgnoreDWARFFlag) {
if (CFIProtected)
ExpectedProtected++;
else
UnexpectedUnprotected++;
continue;
}
auto InliningInfo = Analysis.symbolizeInlinedCode(Address);
if (!InliningInfo || InliningInfo->getNumberOfFrames() == 0) {
errs() << "Failed to symbolise " << format_hex(Address, 2)
<< " with line tables from " << InputFilename << "\n";
exit(EXIT_FAILURE);
}
const auto &LineInfo =
InliningInfo->getFrame(InliningInfo->getNumberOfFrames() - 1);
// Print the inlining symbolisation of this instruction.
for (uint32_t i = 0; i < InliningInfo->getNumberOfFrames(); ++i) {
const auto &Line = InliningInfo->getFrame(i);
outs() << " " << format_hex(Address, 2) << " = " << Line.FileName << ":"
<< Line.Line << ":" << Line.Column << " (" << Line.FunctionName
<< ")\n";
}
if (!SpecialCaseList) {
if (CFIProtected)
ExpectedProtected++;
else
UnexpectedUnprotected++;
continue;
}
unsigned BlameLine = 0;
for (auto &K : {"cfi-icall", "cfi-vcall"}) {
if (!BlameLine)
BlameLine =
SpecialCaseList->inSectionBlame(K, "src", LineInfo.FileName);
if (!BlameLine)
BlameLine =
SpecialCaseList->inSectionBlame(K, "fun", LineInfo.FunctionName);
}
if (BlameLine) {
outs() << "Blacklist Match: " << BlacklistFilename << ":" << BlameLine
<< "\n";
BlameCounter[BlameLine]++;
if (CFIProtected) {
UnexpectedProtected++;
outs() << "====> Unexpected Protected\n";
} else {
ExpectedUnprotected++;
outs() << "====> Expected Unprotected\n";
}
} else {
if (CFIProtected) {
ExpectedProtected++;
outs() << "====> Expected Protected\n";
} else {
UnexpectedUnprotected++;
outs() << "====> Unexpected Unprotected\n";
}
}
}
uint64_t IndirectCFInstructions = ExpectedProtected + UnexpectedProtected +
ExpectedUnprotected + UnexpectedUnprotected;
if (IndirectCFInstructions == 0) {
outs() << "No indirect CF instructions found.\n";
return;
}
outs() << formatv("Expected Protected: {0} ({1:P})\n"
"Unexpected Protected: {2} ({3:P})\n"
"Expected Unprotected: {4} ({5:P})\n"
"Unexpected Unprotected (BAD): {6} ({7:P})\n",
ExpectedProtected,
((double)ExpectedProtected) / IndirectCFInstructions,
UnexpectedProtected,
((double)UnexpectedProtected) / IndirectCFInstructions,
ExpectedUnprotected,
((double)ExpectedUnprotected) / IndirectCFInstructions,
UnexpectedUnprotected,
((double)UnexpectedUnprotected) / IndirectCFInstructions);
if (!SpecialCaseList)
return;
outs() << "Blacklist Results:\n";
for (const auto &KV : BlameCounter) {
outs() << " " << BlacklistFilename << ":" << KV.first << " affects "
<< KV.second << " indirect CF instructions.\n";
}
}
int main(int argc, char **argv) {
cl::ParseCommandLineOptions(
argc, argv,
"Identifies whether Control Flow Integrity protects all indirect control "
"flow instructions in the provided object file, DSO or binary.\nNote: "
"Anything statically linked into the provided file *must* be compiled "
"with '-g'. This can be relaxed through the '--ignore-dwarf' flag.");
InitializeAllTargetInfos();
InitializeAllTargetMCs();
InitializeAllAsmParsers();
InitializeAllDisassemblers();
std::unique_ptr<SpecialCaseList> SpecialCaseList;
if (BlacklistFilename != "-") {
std::string Error;
SpecialCaseList = SpecialCaseList::create({BlacklistFilename}, Error);
if (!SpecialCaseList) {
errs() << "Failed to get blacklist: " << Error << "\n";
exit(EXIT_FAILURE);
}
}
FileAnalysis Analysis = ExitOnErr(FileAnalysis::Create(InputFilename));
printIndirectCFInstructions(Analysis, SpecialCaseList.get());
return EXIT_SUCCESS;
}