1 //===-- IRDynamicChecks.cpp -------------------------------------*- C++ -*-===//
3 // The LLVM Compiler Infrastructure
5 // This file is distributed under the University of Illinois Open Source
6 // License. See LICENSE.TXT for details.
8 //===----------------------------------------------------------------------===//
12 // Other libraries and framework includes
13 #include "llvm/IR/Constants.h"
14 #include "llvm/IR/DataLayout.h"
15 #include "llvm/IR/Function.h"
16 #include "llvm/IR/Instructions.h"
17 #include "llvm/IR/Module.h"
18 #include "llvm/IR/Value.h"
19 #include "llvm/Support/raw_ostream.h"
22 #include "lldb/Expression/IRDynamicChecks.h"
24 #include "lldb/Expression/UtilityFunction.h"
25 #include "lldb/Target/ExecutionContext.h"
26 #include "lldb/Target/ObjCLanguageRuntime.h"
27 #include "lldb/Target/Process.h"
28 #include "lldb/Target/StackFrame.h"
29 #include "lldb/Target/Target.h"
30 #include "lldb/Utility/ConstString.h"
31 #include "lldb/Utility/Log.h"
34 using namespace lldb_private;
38 #define VALID_POINTER_CHECK_NAME "_$__lldb_valid_pointer_check"
39 #define VALID_OBJC_OBJECT_CHECK_NAME "$__lldb_objc_object_check"
41 static const char g_valid_pointer_check_text[] =
43 "_$__lldb_valid_pointer_check (unsigned char *$__lldb_arg_ptr)\n"
45 " unsigned char $__lldb_local_val = *$__lldb_arg_ptr;\n"
48 DynamicCheckerFunctions::DynamicCheckerFunctions() = default;
50 DynamicCheckerFunctions::~DynamicCheckerFunctions() = default;
52 bool DynamicCheckerFunctions::Install(DiagnosticManager &diagnostic_manager,
53 ExecutionContext &exe_ctx) {
55 m_valid_pointer_check.reset(
56 exe_ctx.GetTargetRef().GetUtilityFunctionForLanguage(
57 g_valid_pointer_check_text, lldb::eLanguageTypeC,
58 VALID_POINTER_CHECK_NAME, error));
62 if (!m_valid_pointer_check->Install(diagnostic_manager, exe_ctx))
65 Process *process = exe_ctx.GetProcessPtr();
68 ObjCLanguageRuntime *objc_language_runtime =
69 process->GetObjCLanguageRuntime();
71 if (objc_language_runtime) {
72 m_objc_object_check.reset(objc_language_runtime->CreateObjectChecker(
73 VALID_OBJC_OBJECT_CHECK_NAME));
75 if (!m_objc_object_check->Install(diagnostic_manager, exe_ctx))
83 bool DynamicCheckerFunctions::DoCheckersExplainStop(lldb::addr_t addr,
85 // FIXME: We have to get the checkers to know why they scotched the call in
87 // so we can print a better message here.
88 if (m_valid_pointer_check && m_valid_pointer_check->ContainsAddress(addr)) {
89 message.Printf("Attempted to dereference an invalid pointer.");
91 } else if (m_objc_object_check &&
92 m_objc_object_check->ContainsAddress(addr)) {
93 message.Printf("Attempted to dereference an invalid ObjC Object or send it "
94 "an unrecognized selector");
100 static std::string PrintValue(llvm::Value *V, bool truncate = false) {
102 raw_string_ostream rso(s);
106 s.resize(s.length() - 1);
110 //----------------------------------------------------------------------
111 /// @class Instrumenter IRDynamicChecks.cpp
112 /// @brief Finds and instruments individual LLVM IR instructions
114 /// When instrumenting LLVM IR, it is frequently desirable to first search
115 /// for instructions, and then later modify them. This way iterators
116 /// remain intact, and multiple passes can look at the same code base without
117 /// treading on each other's toes.
119 /// The Instrumenter class implements this functionality. A client first
120 /// calls Inspect on a function, which populates a list of instructions to
121 /// be instrumented. Then, later, when all passes' Inspect functions have
122 /// been called, the client calls Instrument, which adds the desired
125 /// A subclass of Instrumenter must override InstrumentInstruction, which
126 /// is responsible for adding whatever instrumentation is necessary.
128 /// A subclass of Instrumenter may override:
130 /// - InspectInstruction [default: does nothing]
132 /// - InspectBasicBlock [default: iterates through the instructions in a
133 /// basic block calling InspectInstruction]
135 /// - InspectFunction [default: iterates through the basic blocks in a
136 /// function calling InspectBasicBlock]
137 //----------------------------------------------------------------------
140 //------------------------------------------------------------------
143 /// @param[in] module
144 /// The module being instrumented.
145 //------------------------------------------------------------------
146 Instrumenter(llvm::Module &module, DynamicCheckerFunctions &checker_functions)
147 : m_module(module), m_checker_functions(checker_functions),
148 m_i8ptr_ty(nullptr), m_intptr_ty(nullptr) {}
150 virtual ~Instrumenter() = default;
152 //------------------------------------------------------------------
153 /// Inspect a function to find instructions to instrument
155 /// @param[in] function
156 /// The function to inspect.
159 /// True on success; false on error.
160 //------------------------------------------------------------------
161 bool Inspect(llvm::Function &function) { return InspectFunction(function); }
163 //------------------------------------------------------------------
164 /// Instrument all the instructions found by Inspect()
167 /// True on success; false on error.
168 //------------------------------------------------------------------
170 for (InstIterator ii = m_to_instrument.begin(),
171 last_ii = m_to_instrument.end();
172 ii != last_ii; ++ii) {
173 if (!InstrumentInstruction(*ii))
181 //------------------------------------------------------------------
182 /// Add instrumentation to a single instruction
185 /// The instruction to be instrumented.
188 /// True on success; false otherwise.
189 //------------------------------------------------------------------
190 virtual bool InstrumentInstruction(llvm::Instruction *inst) = 0;
192 //------------------------------------------------------------------
193 /// Register a single instruction to be instrumented
196 /// The instruction to be instrumented.
197 //------------------------------------------------------------------
198 void RegisterInstruction(llvm::Instruction &i) {
199 m_to_instrument.push_back(&i);
202 //------------------------------------------------------------------
203 /// Determine whether a single instruction is interesting to
204 /// instrument, and, if so, call RegisterInstruction
207 /// The instruction to be inspected.
210 /// False if there was an error scanning; true otherwise.
211 //------------------------------------------------------------------
212 virtual bool InspectInstruction(llvm::Instruction &i) { return true; }
214 //------------------------------------------------------------------
215 /// Scan a basic block to see if any instructions are interesting
218 /// The basic block to be inspected.
221 /// False if there was an error scanning; true otherwise.
222 //------------------------------------------------------------------
223 virtual bool InspectBasicBlock(llvm::BasicBlock &bb) {
224 for (llvm::BasicBlock::iterator ii = bb.begin(), last_ii = bb.end();
225 ii != last_ii; ++ii) {
226 if (!InspectInstruction(*ii))
233 //------------------------------------------------------------------
234 /// Scan a function to see if any instructions are interesting
237 /// The function to be inspected.
240 /// False if there was an error scanning; true otherwise.
241 //------------------------------------------------------------------
242 virtual bool InspectFunction(llvm::Function &f) {
243 for (llvm::Function::iterator bbi = f.begin(), last_bbi = f.end();
244 bbi != last_bbi; ++bbi) {
245 if (!InspectBasicBlock(*bbi))
252 //------------------------------------------------------------------
253 /// Build a function pointer for a function with signature
254 /// void (*)(uint8_t*) with a given address
256 /// @param[in] start_address
257 /// The address of the function.
260 /// The function pointer, for use in a CallInst.
261 //------------------------------------------------------------------
262 llvm::Value *BuildPointerValidatorFunc(lldb::addr_t start_address) {
263 llvm::Type *param_array[1];
265 param_array[0] = const_cast<llvm::PointerType *>(GetI8PtrTy());
267 ArrayRef<llvm::Type *> params(param_array, 1);
269 FunctionType *fun_ty = FunctionType::get(
270 llvm::Type::getVoidTy(m_module.getContext()), params, true);
271 PointerType *fun_ptr_ty = PointerType::getUnqual(fun_ty);
272 Constant *fun_addr_int =
273 ConstantInt::get(GetIntptrTy(), start_address, false);
274 return ConstantExpr::getIntToPtr(fun_addr_int, fun_ptr_ty);
277 //------------------------------------------------------------------
278 /// Build a function pointer for a function with signature
279 /// void (*)(uint8_t*, uint8_t*) with a given address
281 /// @param[in] start_address
282 /// The address of the function.
285 /// The function pointer, for use in a CallInst.
286 //------------------------------------------------------------------
287 llvm::Value *BuildObjectCheckerFunc(lldb::addr_t start_address) {
288 llvm::Type *param_array[2];
290 param_array[0] = const_cast<llvm::PointerType *>(GetI8PtrTy());
291 param_array[1] = const_cast<llvm::PointerType *>(GetI8PtrTy());
293 ArrayRef<llvm::Type *> params(param_array, 2);
295 FunctionType *fun_ty = FunctionType::get(
296 llvm::Type::getVoidTy(m_module.getContext()), params, true);
297 PointerType *fun_ptr_ty = PointerType::getUnqual(fun_ty);
298 Constant *fun_addr_int =
299 ConstantInt::get(GetIntptrTy(), start_address, false);
300 return ConstantExpr::getIntToPtr(fun_addr_int, fun_ptr_ty);
303 PointerType *GetI8PtrTy() {
305 m_i8ptr_ty = llvm::Type::getInt8PtrTy(m_module.getContext());
310 IntegerType *GetIntptrTy() {
312 llvm::DataLayout data_layout(&m_module);
314 m_intptr_ty = llvm::Type::getIntNTy(m_module.getContext(),
315 data_layout.getPointerSizeInBits());
321 typedef std::vector<llvm::Instruction *> InstVector;
322 typedef InstVector::iterator InstIterator;
324 InstVector m_to_instrument; ///< List of instructions the inspector found
325 llvm::Module &m_module; ///< The module which is being instrumented
326 DynamicCheckerFunctions
327 &m_checker_functions; ///< The dynamic checker functions for the process
330 PointerType *m_i8ptr_ty;
331 IntegerType *m_intptr_ty;
334 class ValidPointerChecker : public Instrumenter {
336 ValidPointerChecker(llvm::Module &module,
337 DynamicCheckerFunctions &checker_functions)
338 : Instrumenter(module, checker_functions),
339 m_valid_pointer_check_func(nullptr) {}
341 ~ValidPointerChecker() override = default;
344 bool InstrumentInstruction(llvm::Instruction *inst) override {
345 Log *log(lldb_private::GetLogIfAllCategoriesSet(LIBLLDB_LOG_EXPRESSIONS));
348 log->Printf("Instrumenting load/store instruction: %s\n",
349 PrintValue(inst).c_str());
351 if (!m_valid_pointer_check_func)
352 m_valid_pointer_check_func = BuildPointerValidatorFunc(
353 m_checker_functions.m_valid_pointer_check->StartAddress());
355 llvm::Value *dereferenced_ptr = nullptr;
357 if (llvm::LoadInst *li = dyn_cast<llvm::LoadInst>(inst))
358 dereferenced_ptr = li->getPointerOperand();
359 else if (llvm::StoreInst *si = dyn_cast<llvm::StoreInst>(inst))
360 dereferenced_ptr = si->getPointerOperand();
364 // Insert an instruction to cast the loaded value to int8_t*
366 BitCastInst *bit_cast =
367 new BitCastInst(dereferenced_ptr, GetI8PtrTy(), "", inst);
369 // Insert an instruction to call the helper with the result
371 llvm::Value *arg_array[1];
373 arg_array[0] = bit_cast;
375 llvm::ArrayRef<llvm::Value *> args(arg_array, 1);
377 CallInst::Create(m_valid_pointer_check_func, args, "", inst);
382 bool InspectInstruction(llvm::Instruction &i) override {
383 if (dyn_cast<llvm::LoadInst>(&i) || dyn_cast<llvm::StoreInst>(&i))
384 RegisterInstruction(i);
390 llvm::Value *m_valid_pointer_check_func;
393 class ObjcObjectChecker : public Instrumenter {
395 ObjcObjectChecker(llvm::Module &module,
396 DynamicCheckerFunctions &checker_functions)
397 : Instrumenter(module, checker_functions),
398 m_objc_object_check_func(nullptr) {}
400 ~ObjcObjectChecker() override = default;
410 std::map<llvm::Instruction *, msgSend_type> msgSend_types;
413 bool InstrumentInstruction(llvm::Instruction *inst) override {
414 CallInst *call_inst = dyn_cast<CallInst>(inst);
417 return false; // call_inst really shouldn't be nullptr, because otherwise
418 // InspectInstruction wouldn't have registered it
420 if (!m_objc_object_check_func)
421 m_objc_object_check_func = BuildObjectCheckerFunc(
422 m_checker_functions.m_objc_object_check->StartAddress());
424 // id objc_msgSend(id theReceiver, SEL theSelector, ...)
426 llvm::Value *target_object;
427 llvm::Value *selector;
429 switch (msgSend_types[inst]) {
432 target_object = call_inst->getArgOperand(0);
433 selector = call_inst->getArgOperand(1);
436 target_object = call_inst->getArgOperand(1);
437 selector = call_inst->getArgOperand(2);
440 case eMsgSendSuper_stret:
444 // These objects should always be valid according to Sean Calannan
445 assert(target_object);
448 // Insert an instruction to cast the receiver id to int8_t*
450 BitCastInst *bit_cast =
451 new BitCastInst(target_object, GetI8PtrTy(), "", inst);
453 // Insert an instruction to call the helper with the result
455 llvm::Value *arg_array[2];
457 arg_array[0] = bit_cast;
458 arg_array[1] = selector;
460 ArrayRef<llvm::Value *> args(arg_array, 2);
462 CallInst::Create(m_objc_object_check_func, args, "", inst);
467 static llvm::Function *GetFunction(llvm::Value *value) {
468 if (llvm::Function *function = llvm::dyn_cast<llvm::Function>(value)) {
472 if (llvm::ConstantExpr *const_expr =
473 llvm::dyn_cast<llvm::ConstantExpr>(value)) {
474 switch (const_expr->getOpcode()) {
477 case llvm::Instruction::BitCast:
478 return GetFunction(const_expr->getOperand(0));
485 static llvm::Function *GetCalledFunction(llvm::CallInst *inst) {
486 return GetFunction(inst->getCalledValue());
489 bool InspectInstruction(llvm::Instruction &i) override {
490 Log *log(lldb_private::GetLogIfAllCategoriesSet(LIBLLDB_LOG_EXPRESSIONS));
492 CallInst *call_inst = dyn_cast<CallInst>(&i);
495 const llvm::Function *called_function = GetCalledFunction(call_inst);
497 if (!called_function)
500 std::string name_str = called_function->getName().str();
501 const char *name_cstr = name_str.c_str();
504 log->Printf("Found call to %s: %s\n", name_cstr,
505 PrintValue(call_inst).c_str());
507 if (name_str.find("objc_msgSend") == std::string::npos)
510 if (!strcmp(name_cstr, "objc_msgSend")) {
511 RegisterInstruction(i);
512 msgSend_types[&i] = eMsgSend;
516 if (!strcmp(name_cstr, "objc_msgSend_stret")) {
517 RegisterInstruction(i);
518 msgSend_types[&i] = eMsgSend_stret;
522 if (!strcmp(name_cstr, "objc_msgSend_fpret")) {
523 RegisterInstruction(i);
524 msgSend_types[&i] = eMsgSend_fpret;
528 if (!strcmp(name_cstr, "objc_msgSendSuper")) {
529 RegisterInstruction(i);
530 msgSend_types[&i] = eMsgSendSuper;
534 if (!strcmp(name_cstr, "objc_msgSendSuper_stret")) {
535 RegisterInstruction(i);
536 msgSend_types[&i] = eMsgSendSuper_stret;
542 "Function name '%s' contains 'objc_msgSend' but is not handled",
552 llvm::Value *m_objc_object_check_func;
555 IRDynamicChecks::IRDynamicChecks(DynamicCheckerFunctions &checker_functions,
556 const char *func_name)
557 : ModulePass(ID), m_func_name(func_name),
558 m_checker_functions(checker_functions) {}
560 IRDynamicChecks::~IRDynamicChecks() = default;
562 bool IRDynamicChecks::runOnModule(llvm::Module &M) {
563 Log *log(lldb_private::GetLogIfAllCategoriesSet(LIBLLDB_LOG_EXPRESSIONS));
565 llvm::Function *function = M.getFunction(StringRef(m_func_name));
569 log->Printf("Couldn't find %s() in the module", m_func_name.c_str());
574 if (m_checker_functions.m_valid_pointer_check) {
575 ValidPointerChecker vpc(M, m_checker_functions);
577 if (!vpc.Inspect(*function))
580 if (!vpc.Instrument())
584 if (m_checker_functions.m_objc_object_check) {
585 ObjcObjectChecker ooc(M, m_checker_functions);
587 if (!ooc.Inspect(*function))
590 if (!ooc.Instrument())
594 if (log && log->GetVerbose()) {
596 raw_string_ostream oss(s);
598 M.print(oss, nullptr);
602 log->Printf("Module after dynamic checks: \n%s", s.c_str());
608 void IRDynamicChecks::assignPassManager(PMStack &PMS, PassManagerType T) {}
610 PassManagerType IRDynamicChecks::getPotentialPassManagerType() const {
611 return PMT_ModulePassManager;