Coverage Report

Created: 2022-01-22 13:19

/Users/buildslave/jenkins/workspace/coverage/llvm-project/lldb/source/Plugins/ExpressionParser/Clang/IRDynamicChecks.cpp
Line
Count
Source (jump to first uncovered line)
1
//===-- IRDynamicChecks.cpp -----------------------------------------------===//
2
//
3
// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4
// See https://llvm.org/LICENSE.txt for license information.
5
// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6
//
7
//===----------------------------------------------------------------------===//
8
9
#include "llvm/IR/Constants.h"
10
#include "llvm/IR/DataLayout.h"
11
#include "llvm/IR/Function.h"
12
#include "llvm/IR/Instructions.h"
13
#include "llvm/IR/Module.h"
14
#include "llvm/IR/Value.h"
15
#include "llvm/Support/raw_ostream.h"
16
17
#include "IRDynamicChecks.h"
18
19
#include "lldb/Expression/UtilityFunction.h"
20
#include "lldb/Target/ExecutionContext.h"
21
#include "lldb/Target/Process.h"
22
#include "lldb/Target/StackFrame.h"
23
#include "lldb/Target/Target.h"
24
#include "lldb/Utility/ConstString.h"
25
#include "lldb/Utility/Log.h"
26
27
#include "Plugins/LanguageRuntime/ObjC/ObjCLanguageRuntime.h"
28
29
using namespace llvm;
30
using namespace lldb_private;
31
32
static char ID;
33
34
512
#define VALID_POINTER_CHECK_NAME "_$__lldb_valid_pointer_check"
35
512
#define VALID_OBJC_OBJECT_CHECK_NAME "$__lldb_objc_object_check"
36
37
static const char g_valid_pointer_check_text[] =
38
    "extern \"C\" void\n"
39
    "_$__lldb_valid_pointer_check (unsigned char *$__lldb_arg_ptr)\n"
40
    "{\n"
41
    "    unsigned char $__lldb_local_val = *$__lldb_arg_ptr;\n"
42
    "}";
43
44
ClangDynamicCheckerFunctions::ClangDynamicCheckerFunctions()
45
512
    : DynamicCheckerFunctions(DCF_Clang) {}
46
47
512
ClangDynamicCheckerFunctions::~ClangDynamicCheckerFunctions() = default;
48
49
bool ClangDynamicCheckerFunctions::Install(
50
512
    DiagnosticManager &diagnostic_manager, ExecutionContext &exe_ctx) {
51
512
  auto utility_fn_or_error = exe_ctx.GetTargetRef().CreateUtilityFunction(
52
512
      g_valid_pointer_check_text, VALID_POINTER_CHECK_NAME,
53
512
      lldb::eLanguageTypeC, exe_ctx);
54
512
  if (!utility_fn_or_error) {
55
0
    llvm::consumeError(utility_fn_or_error.takeError());
56
0
    return false;
57
0
  }
58
512
  m_valid_pointer_check = std::move(*utility_fn_or_error);
59
60
512
  if (Process *process = exe_ctx.GetProcessPtr()) {
61
512
    ObjCLanguageRuntime *objc_language_runtime =
62
512
        ObjCLanguageRuntime::Get(*process);
63
64
512
    if (objc_language_runtime) {
65
512
      auto utility_fn_or_error = objc_language_runtime->CreateObjectChecker(
66
512
          VALID_OBJC_OBJECT_CHECK_NAME, exe_ctx);
67
512
      if (!utility_fn_or_error) {
68
0
        llvm::consumeError(utility_fn_or_error.takeError());
69
0
        return false;
70
0
      }
71
512
      m_objc_object_check = std::move(*utility_fn_or_error);
72
512
    }
73
512
  }
74
75
512
  return true;
76
512
}
77
78
bool ClangDynamicCheckerFunctions::DoCheckersExplainStop(lldb::addr_t addr,
79
35
                                                         Stream &message) {
80
  // FIXME: We have to get the checkers to know why they scotched the call in
81
  // more detail,
82
  // so we can print a better message here.
83
35
  if (m_valid_pointer_check && m_valid_pointer_check->ContainsAddress(addr)) {
84
0
    message.Printf("Attempted to dereference an invalid pointer.");
85
0
    return true;
86
35
  } else if (m_objc_object_check &&
87
35
             m_objc_object_check->ContainsAddress(addr)) {
88
1
    message.Printf("Attempted to dereference an invalid ObjC Object or send it "
89
1
                   "an unrecognized selector");
90
1
    return true;
91
1
  }
92
34
  return false;
93
35
}
94
95
0
static std::string PrintValue(llvm::Value *V, bool truncate = false) {
96
0
  std::string s;
97
0
  raw_string_ostream rso(s);
98
0
  V->print(rso);
99
0
  rso.flush();
100
0
  if (truncate)
101
0
    s.resize(s.length() - 1);
102
0
  return s;
103
0
}
104
105
/// \class Instrumenter IRDynamicChecks.cpp
106
/// Finds and instruments individual LLVM IR instructions
107
///
108
/// When instrumenting LLVM IR, it is frequently desirable to first search for
109
/// instructions, and then later modify them.  This way iterators remain
110
/// intact, and multiple passes can look at the same code base without
111
/// treading on each other's toes.
112
///
113
/// The Instrumenter class implements this functionality.  A client first
114
/// calls Inspect on a function, which populates a list of instructions to be
115
/// instrumented.  Then, later, when all passes' Inspect functions have been
116
/// called, the client calls Instrument, which adds the desired
117
/// instrumentation.
118
///
119
/// A subclass of Instrumenter must override InstrumentInstruction, which
120
/// is responsible for adding whatever instrumentation is necessary.
121
///
122
/// A subclass of Instrumenter may override:
123
///
124
/// - InspectInstruction [default: does nothing]
125
///
126
/// - InspectBasicBlock [default: iterates through the instructions in a
127
///   basic block calling InspectInstruction]
128
///
129
/// - InspectFunction [default: iterates through the basic blocks in a
130
///   function calling InspectBasicBlock]
131
class Instrumenter {
132
public:
133
  /// Constructor
134
  ///
135
  /// \param[in] module
136
  ///     The module being instrumented.
137
  Instrumenter(llvm::Module &module,
138
               std::shared_ptr<UtilityFunction> checker_function)
139
      : m_module(module), m_checker_function(checker_function),
140
3.73k
        m_i8ptr_ty(nullptr), m_intptr_ty(nullptr) {}
141
142
3.73k
  virtual ~Instrumenter() = default;
143
144
  /// Inspect a function to find instructions to instrument
145
  ///
146
  /// \param[in] function
147
  ///     The function to inspect.
148
  ///
149
  /// \return
150
  ///     True on success; false on error.
151
3.73k
  bool Inspect(llvm::Function &function) { return InspectFunction(function); }
152
153
  /// Instrument all the instructions found by Inspect()
154
  ///
155
  /// \return
156
  ///     True on success; false on error.
157
3.73k
  bool Instrument() {
158
3.73k
    for (InstIterator ii = m_to_instrument.begin(),
159
3.73k
                      last_ii = m_to_instrument.end();
160
12.4k
         ii != last_ii; 
++ii8.75k
) {
161
8.75k
      if (!InstrumentInstruction(*ii))
162
0
        return false;
163
8.75k
    }
164
165
3.73k
    return true;
166
3.73k
  }
167
168
protected:
169
  /// Add instrumentation to a single instruction
170
  ///
171
  /// \param[in] inst
172
  ///     The instruction to be instrumented.
173
  ///
174
  /// \return
175
  ///     True on success; false otherwise.
176
  virtual bool InstrumentInstruction(llvm::Instruction *inst) = 0;
177
178
  /// Register a single instruction to be instrumented
179
  ///
180
  /// \param[in] inst
181
  ///     The instruction to be instrumented.
182
8.75k
  void RegisterInstruction(llvm::Instruction &inst) {
183
8.75k
    m_to_instrument.push_back(&inst);
184
8.75k
  }
185
186
  /// Determine whether a single instruction is interesting to instrument,
187
  /// and, if so, call RegisterInstruction
188
  ///
189
  /// \param[in] i
190
  ///     The instruction to be inspected.
191
  ///
192
  /// \return
193
  ///     False if there was an error scanning; true otherwise.
194
0
  virtual bool InspectInstruction(llvm::Instruction &i) { return true; }
195
196
  /// Scan a basic block to see if any instructions are interesting
197
  ///
198
  /// \param[in] bb
199
  ///     The basic block to be inspected.
200
  ///
201
  /// \return
202
  ///     False if there was an error scanning; true otherwise.
203
10.6k
  virtual bool InspectBasicBlock(llvm::BasicBlock &bb) {
204
10.6k
    for (llvm::BasicBlock::iterator ii = bb.begin(), last_ii = bb.end();
205
88.2k
         ii != last_ii; 
++ii77.5k
) {
206
77.5k
      if (!InspectInstruction(*ii))
207
0
        return false;
208
77.5k
    }
209
210
10.6k
    return true;
211
10.6k
  }
212
213
  /// Scan a function to see if any instructions are interesting
214
  ///
215
  /// \param[in] f
216
  ///     The function to be inspected.
217
  ///
218
  /// \return
219
  ///     False if there was an error scanning; true otherwise.
220
3.73k
  virtual bool InspectFunction(llvm::Function &f) {
221
3.73k
    for (llvm::Function::iterator bbi = f.begin(), last_bbi = f.end();
222
14.3k
         bbi != last_bbi; 
++bbi10.6k
) {
223
10.6k
      if (!InspectBasicBlock(*bbi))
224
0
        return false;
225
10.6k
    }
226
227
3.73k
    return true;
228
3.73k
  }
229
230
  /// Build a function pointer for a function with signature void
231
  /// (*)(uint8_t*) with a given address
232
  ///
233
  /// \param[in] start_address
234
  ///     The address of the function.
235
  ///
236
  /// \return
237
  ///     The function pointer, for use in a CallInst.
238
1.86k
  llvm::FunctionCallee BuildPointerValidatorFunc(lldb::addr_t start_address) {
239
1.86k
    llvm::Type *param_array[1];
240
241
1.86k
    param_array[0] = const_cast<llvm::PointerType *>(GetI8PtrTy());
242
243
1.86k
    ArrayRef<llvm::Type *> params(param_array, 1);
244
245
1.86k
    FunctionType *fun_ty = FunctionType::get(
246
1.86k
        llvm::Type::getVoidTy(m_module.getContext()), params, true);
247
1.86k
    PointerType *fun_ptr_ty = PointerType::getUnqual(fun_ty);
248
1.86k
    Constant *fun_addr_int =
249
1.86k
        ConstantInt::get(GetIntptrTy(), start_address, false);
250
1.86k
    return {fun_ty, ConstantExpr::getIntToPtr(fun_addr_int, fun_ptr_ty)};
251
1.86k
  }
252
253
  /// Build a function pointer for a function with signature void
254
  /// (*)(uint8_t*, uint8_t*) with a given address
255
  ///
256
  /// \param[in] start_address
257
  ///     The address of the function.
258
  ///
259
  /// \return
260
  ///     The function pointer, for use in a CallInst.
261
237
  llvm::FunctionCallee BuildObjectCheckerFunc(lldb::addr_t start_address) {
262
237
    llvm::Type *param_array[2];
263
264
237
    param_array[0] = const_cast<llvm::PointerType *>(GetI8PtrTy());
265
237
    param_array[1] = const_cast<llvm::PointerType *>(GetI8PtrTy());
266
267
237
    ArrayRef<llvm::Type *> params(param_array, 2);
268
269
237
    FunctionType *fun_ty = FunctionType::get(
270
237
        llvm::Type::getVoidTy(m_module.getContext()), params, true);
271
237
    PointerType *fun_ptr_ty = PointerType::getUnqual(fun_ty);
272
237
    Constant *fun_addr_int =
273
237
        ConstantInt::get(GetIntptrTy(), start_address, false);
274
237
    return {fun_ty, ConstantExpr::getIntToPtr(fun_addr_int, fun_ptr_ty)};
275
237
  }
276
277
11.0k
  PointerType *GetI8PtrTy() {
278
11.0k
    if (!m_i8ptr_ty)
279
2.10k
      m_i8ptr_ty = llvm::Type::getInt8PtrTy(m_module.getContext());
280
281
11.0k
    return m_i8ptr_ty;
282
11.0k
  }
283
284
2.10k
  IntegerType *GetIntptrTy() {
285
2.10k
    if (!m_intptr_ty) {
286
2.10k
      llvm::DataLayout data_layout(&m_module);
287
288
2.10k
      m_intptr_ty = llvm::Type::getIntNTy(m_module.getContext(),
289
2.10k
                                          data_layout.getPointerSizeInBits());
290
2.10k
    }
291
292
2.10k
    return m_intptr_ty;
293
2.10k
  }
294
295
  typedef std::vector<llvm::Instruction *> InstVector;
296
  typedef InstVector::iterator InstIterator;
297
298
  InstVector m_to_instrument; ///< List of instructions the inspector found
299
  llvm::Module &m_module;     ///< The module which is being instrumented
300
  std::shared_ptr<UtilityFunction>
301
      m_checker_function; ///< The dynamic checker function for the process
302
303
private:
304
  PointerType *m_i8ptr_ty;
305
  IntegerType *m_intptr_ty;
306
};
307
308
class ValidPointerChecker : public Instrumenter {
309
public:
310
  ValidPointerChecker(llvm::Module &module,
311
                      std::shared_ptr<UtilityFunction> checker_function)
312
      : Instrumenter(module, checker_function),
313
1.86k
        m_valid_pointer_check_func(nullptr) {}
314
315
1.86k
  ~ValidPointerChecker() override = default;
316
317
protected:
318
8.51k
  bool InstrumentInstruction(llvm::Instruction *inst) override {
319
8.51k
    Log *log(lldb_private::GetLogIfAllCategoriesSet(LIBLLDB_LOG_EXPRESSIONS));
320
321
8.51k
    LLDB_LOGF(log, "Instrumenting load/store instruction: %s\n",
322
8.51k
              PrintValue(inst).c_str());
323
324
8.51k
    if (!m_valid_pointer_check_func)
325
1.86k
      m_valid_pointer_check_func =
326
1.86k
          BuildPointerValidatorFunc(m_checker_function->StartAddress());
327
328
8.51k
    llvm::Value *dereferenced_ptr = nullptr;
329
330
8.51k
    if (llvm::LoadInst *li = dyn_cast<llvm::LoadInst>(inst))
331
3.68k
      dereferenced_ptr = li->getPointerOperand();
332
4.83k
    else if (llvm::StoreInst *si = dyn_cast<llvm::StoreInst>(inst))
333
4.83k
      dereferenced_ptr = si->getPointerOperand();
334
0
    else
335
0
      return false;
336
337
    // Insert an instruction to cast the loaded value to int8_t*
338
339
8.51k
    BitCastInst *bit_cast =
340
8.51k
        new BitCastInst(dereferenced_ptr, GetI8PtrTy(), "", inst);
341
342
    // Insert an instruction to call the helper with the result
343
344
8.51k
    llvm::Value *arg_array[1];
345
346
8.51k
    arg_array[0] = bit_cast;
347
348
8.51k
    llvm::ArrayRef<llvm::Value *> args(arg_array, 1);
349
350
8.51k
    CallInst::Create(m_valid_pointer_check_func, args, "", inst);
351
352
8.51k
    return true;
353
8.51k
  }
354
355
30.2k
  bool InspectInstruction(llvm::Instruction &i) override {
356
30.2k
    if (isa<llvm::LoadInst>(&i) || 
isa<llvm::StoreInst>(&i)26.6k
)
357
8.51k
      RegisterInstruction(i);
358
359
30.2k
    return true;
360
30.2k
  }
361
362
private:
363
  llvm::FunctionCallee m_valid_pointer_check_func;
364
};
365
366
class ObjcObjectChecker : public Instrumenter {
367
public:
368
  ObjcObjectChecker(llvm::Module &module,
369
                    std::shared_ptr<UtilityFunction> checker_function)
370
      : Instrumenter(module, checker_function),
371
1.86k
        m_objc_object_check_func(nullptr) {}
372
373
1.86k
  ~ObjcObjectChecker() override = default;
374
375
  enum msgSend_type {
376
    eMsgSend = 0,
377
    eMsgSendSuper,
378
    eMsgSendSuper_stret,
379
    eMsgSend_fpret,
380
    eMsgSend_stret
381
  };
382
383
  std::map<llvm::Instruction *, msgSend_type> msgSend_types;
384
385
protected:
386
243
  bool InstrumentInstruction(llvm::Instruction *inst) override {
387
243
    CallInst *call_inst = dyn_cast<CallInst>(inst);
388
389
243
    if (!call_inst)
390
0
      return false; // call_inst really shouldn't be nullptr, because otherwise
391
                    // InspectInstruction wouldn't have registered it
392
393
243
    if (!m_objc_object_check_func)
394
237
      m_objc_object_check_func =
395
237
          BuildObjectCheckerFunc(m_checker_function->StartAddress());
396
397
    // id objc_msgSend(id theReceiver, SEL theSelector, ...)
398
399
243
    llvm::Value *target_object;
400
243
    llvm::Value *selector;
401
402
243
    switch (msgSend_types[inst]) {
403
242
    case eMsgSend:
404
242
    case eMsgSend_fpret:
405
      // On arm64, clang uses objc_msgSend for scalar and struct return
406
      // calls.  The call instruction will record which was used.
407
242
      if (call_inst->hasStructRetAttr()) {
408
0
        target_object = call_inst->getArgOperand(1);
409
0
        selector = call_inst->getArgOperand(2);
410
242
      } else {
411
242
        target_object = call_inst->getArgOperand(0);
412
242
        selector = call_inst->getArgOperand(1);
413
242
      }
414
242
      break;
415
1
    case eMsgSend_stret:
416
1
      target_object = call_inst->getArgOperand(1);
417
1
      selector = call_inst->getArgOperand(2);
418
1
      break;
419
0
    case eMsgSendSuper:
420
0
    case eMsgSendSuper_stret:
421
0
      return true;
422
243
    }
423
424
    // These objects should always be valid according to Sean Calannan
425
243
    assert(target_object);
426
0
    assert(selector);
427
428
    // Insert an instruction to cast the receiver id to int8_t*
429
430
0
    BitCastInst *bit_cast =
431
243
        new BitCastInst(target_object, GetI8PtrTy(), "", inst);
432
433
    // Insert an instruction to call the helper with the result
434
435
243
    llvm::Value *arg_array[2];
436
437
243
    arg_array[0] = bit_cast;
438
243
    arg_array[1] = selector;
439
440
243
    ArrayRef<llvm::Value *> args(arg_array, 2);
441
442
243
    CallInst::Create(m_objc_object_check_func, args, "", inst);
443
444
243
    return true;
445
243
  }
446
447
11.3k
  static llvm::Function *GetFunction(llvm::Value *value) {
448
11.3k
    if (llvm::Function *function = llvm::dyn_cast<llvm::Function>(value)) {
449
2.06k
      return function;
450
2.06k
    }
451
452
9.24k
    if (llvm::ConstantExpr *const_expr =
453
9.24k
            llvm::dyn_cast<llvm::ConstantExpr>(value)) {
454
9.13k
      switch (const_expr->getOpcode()) {
455
8.84k
      default:
456
8.84k
        return nullptr;
457
288
      case llvm::Instruction::BitCast:
458
288
        return GetFunction(const_expr->getOperand(0));
459
9.13k
      }
460
9.13k
    }
461
462
112
    return nullptr;
463
9.24k
  }
464
465
11.0k
  static llvm::Function *GetCalledFunction(llvm::CallInst *inst) {
466
11.0k
    return GetFunction(inst->getCalledOperand());
467
11.0k
  }
468
469
47.3k
  bool InspectInstruction(llvm::Instruction &i) override {
470
47.3k
    Log *log(lldb_private::GetLogIfAllCategoriesSet(LIBLLDB_LOG_EXPRESSIONS));
471
472
47.3k
    CallInst *call_inst = dyn_cast<CallInst>(&i);
473
474
47.3k
    if (call_inst) {
475
11.0k
      const llvm::Function *called_function = GetCalledFunction(call_inst);
476
477
11.0k
      if (!called_function)
478
8.95k
        return true;
479
480
2.06k
      std::string name_str = called_function->getName().str();
481
2.06k
      const char *name_cstr = name_str.c_str();
482
483
2.06k
      LLDB_LOGF(log, "Found call to %s: %s\n", name_cstr,
484
2.06k
                PrintValue(call_inst).c_str());
485
486
2.06k
      if (name_str.find("objc_msgSend") == std::string::npos)
487
1.81k
        return true;
488
489
246
      if (!strcmp(name_cstr, "objc_msgSend")) {
490
242
        RegisterInstruction(i);
491
242
        msgSend_types[&i] = eMsgSend;
492
242
        return true;
493
242
      }
494
495
4
      if (!strcmp(name_cstr, "objc_msgSend_stret")) {
496
1
        RegisterInstruction(i);
497
1
        msgSend_types[&i] = eMsgSend_stret;
498
1
        return true;
499
1
      }
500
501
3
      if (!strcmp(name_cstr, "objc_msgSend_fpret")) {
502
0
        RegisterInstruction(i);
503
0
        msgSend_types[&i] = eMsgSend_fpret;
504
0
        return true;
505
0
      }
506
507
3
      if (!strcmp(name_cstr, "objc_msgSendSuper")) {
508
0
        RegisterInstruction(i);
509
0
        msgSend_types[&i] = eMsgSendSuper;
510
0
        return true;
511
0
      }
512
513
3
      if (!strcmp(name_cstr, "objc_msgSendSuper_stret")) {
514
0
        RegisterInstruction(i);
515
0
        msgSend_types[&i] = eMsgSendSuper_stret;
516
0
        return true;
517
0
      }
518
519
3
      LLDB_LOGF(log,
520
3
                "Function name '%s' contains 'objc_msgSend' but is not handled",
521
3
                name_str.c_str());
522
523
3
      return true;
524
3
    }
525
526
36.2k
    return true;
527
47.3k
  }
528
529
private:
530
  llvm::FunctionCallee m_objc_object_check_func;
531
};
532
533
IRDynamicChecks::IRDynamicChecks(
534
    ClangDynamicCheckerFunctions &checker_functions, const char *func_name)
535
    : ModulePass(ID), m_func_name(func_name),
536
1.86k
      m_checker_functions(checker_functions) {}
537
538
1.86k
IRDynamicChecks::~IRDynamicChecks() = default;
539
540
1.86k
bool IRDynamicChecks::runOnModule(llvm::Module &M) {
541
1.86k
  Log *log(lldb_private::GetLogIfAllCategoriesSet(LIBLLDB_LOG_EXPRESSIONS));
542
543
1.86k
  llvm::Function *function = M.getFunction(StringRef(m_func_name));
544
545
1.86k
  if (!function) {
546
0
    LLDB_LOGF(log, "Couldn't find %s() in the module", m_func_name.c_str());
547
548
0
    return false;
549
0
  }
550
551
1.86k
  if (m_checker_functions.m_valid_pointer_check) {
552
1.86k
    ValidPointerChecker vpc(M, m_checker_functions.m_valid_pointer_check);
553
554
1.86k
    if (!vpc.Inspect(*function))
555
0
      return false;
556
557
1.86k
    if (!vpc.Instrument())
558
0
      return false;
559
1.86k
  }
560
561
1.86k
  if (m_checker_functions.m_objc_object_check) {
562
1.86k
    ObjcObjectChecker ooc(M, m_checker_functions.m_objc_object_check);
563
564
1.86k
    if (!ooc.Inspect(*function))
565
0
      return false;
566
567
1.86k
    if (!ooc.Instrument())
568
0
      return false;
569
1.86k
  }
570
571
1.86k
  if (log && 
log->GetVerbose()0
) {
572
0
    std::string s;
573
0
    raw_string_ostream oss(s);
574
575
0
    M.print(oss, nullptr);
576
577
0
    oss.flush();
578
579
0
    LLDB_LOGF(log, "Module after dynamic checks: \n%s", s.c_str());
580
0
  }
581
582
1.86k
  return true;
583
1.86k
}
584
585
0
void IRDynamicChecks::assignPassManager(PMStack &PMS, PassManagerType T) {}
586
587
0
PassManagerType IRDynamicChecks::getPotentialPassManagerType() const {
588
0
  return PMT_ModulePassManager;
589
0
}