1 //===-- IRDynamicChecks.cpp -----------------------------------------------===//
2 //
3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4 // See https://llvm.org/LICENSE.txt for license information.
5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6 //
7 //===----------------------------------------------------------------------===//
8 
9 #include "llvm/IR/Constants.h"
10 #include "llvm/IR/DataLayout.h"
11 #include "llvm/IR/Function.h"
12 #include "llvm/IR/Instructions.h"
13 #include "llvm/IR/Module.h"
14 #include "llvm/IR/Value.h"
15 #include "llvm/Support/raw_ostream.h"
16 
17 #include "IRDynamicChecks.h"
18 
19 #include "lldb/Expression/UtilityFunction.h"
20 #include "lldb/Target/ExecutionContext.h"
21 #include "lldb/Target/Process.h"
22 #include "lldb/Target/StackFrame.h"
23 #include "lldb/Target/Target.h"
24 #include "lldb/Utility/ConstString.h"
25 #include "lldb/Utility/LLDBLog.h"
26 #include "lldb/Utility/Log.h"
27 
28 #include "Plugins/LanguageRuntime/ObjC/ObjCLanguageRuntime.h"
29 
30 using namespace llvm;
31 using namespace lldb_private;
32 
33 static char ID;
34 
35 #define VALID_POINTER_CHECK_NAME "_$__lldb_valid_pointer_check"
36 #define VALID_OBJC_OBJECT_CHECK_NAME "$__lldb_objc_object_check"
37 
38 static const char g_valid_pointer_check_text[] =
39     "extern \"C\" void\n"
40     "_$__lldb_valid_pointer_check (unsigned char *$__lldb_arg_ptr)\n"
41     "{\n"
42     "    unsigned char $__lldb_local_val = *$__lldb_arg_ptr;\n"
43     "}";
44 
ClangDynamicCheckerFunctions()45 ClangDynamicCheckerFunctions::ClangDynamicCheckerFunctions()
46     : DynamicCheckerFunctions(DCF_Clang) {}
47 
48 ClangDynamicCheckerFunctions::~ClangDynamicCheckerFunctions() = default;
49 
Install(DiagnosticManager & diagnostic_manager,ExecutionContext & exe_ctx)50 llvm::Error ClangDynamicCheckerFunctions::Install(
51     DiagnosticManager &diagnostic_manager, ExecutionContext &exe_ctx) {
52   Expected<std::unique_ptr<UtilityFunction>> utility_fn =
53       exe_ctx.GetTargetRef().CreateUtilityFunction(
54           g_valid_pointer_check_text, VALID_POINTER_CHECK_NAME,
55           lldb::eLanguageTypeC, exe_ctx);
56   if (!utility_fn)
57     return utility_fn.takeError();
58   m_valid_pointer_check = std::move(*utility_fn);
59 
60   if (Process *process = exe_ctx.GetProcessPtr()) {
61     ObjCLanguageRuntime *objc_language_runtime =
62         ObjCLanguageRuntime::Get(*process);
63 
64     if (objc_language_runtime) {
65       Expected<std::unique_ptr<UtilityFunction>> checker_fn =
66           objc_language_runtime->CreateObjectChecker(VALID_OBJC_OBJECT_CHECK_NAME, exe_ctx);
67       if (!checker_fn)
68         return checker_fn.takeError();
69       m_objc_object_check = std::move(*checker_fn);
70     }
71   }
72 
73   return Error::success();
74 }
75 
DoCheckersExplainStop(lldb::addr_t addr,Stream & message)76 bool ClangDynamicCheckerFunctions::DoCheckersExplainStop(lldb::addr_t addr,
77                                                          Stream &message) {
78   // FIXME: We have to get the checkers to know why they scotched the call in
79   // more detail,
80   // so we can print a better message here.
81   if (m_valid_pointer_check && m_valid_pointer_check->ContainsAddress(addr)) {
82     message.Printf("Attempted to dereference an invalid pointer.");
83     return true;
84   } else if (m_objc_object_check &&
85              m_objc_object_check->ContainsAddress(addr)) {
86     message.Printf("Attempted to dereference an invalid ObjC Object or send it "
87                    "an unrecognized selector");
88     return true;
89   }
90   return false;
91 }
92 
PrintValue(llvm::Value * V,bool truncate=false)93 static std::string PrintValue(llvm::Value *V, bool truncate = false) {
94   std::string s;
95   raw_string_ostream rso(s);
96   V->print(rso);
97   rso.flush();
98   if (truncate)
99     s.resize(s.length() - 1);
100   return s;
101 }
102 
103 /// \class Instrumenter IRDynamicChecks.cpp
104 /// Finds and instruments individual LLVM IR instructions
105 ///
106 /// When instrumenting LLVM IR, it is frequently desirable to first search for
107 /// instructions, and then later modify them.  This way iterators remain
108 /// intact, and multiple passes can look at the same code base without
109 /// treading on each other's toes.
110 ///
111 /// The Instrumenter class implements this functionality.  A client first
112 /// calls Inspect on a function, which populates a list of instructions to be
113 /// instrumented.  Then, later, when all passes' Inspect functions have been
114 /// called, the client calls Instrument, which adds the desired
115 /// instrumentation.
116 ///
117 /// A subclass of Instrumenter must override InstrumentInstruction, which
118 /// is responsible for adding whatever instrumentation is necessary.
119 ///
120 /// A subclass of Instrumenter may override:
121 ///
122 /// - InspectInstruction [default: does nothing]
123 ///
124 /// - InspectBasicBlock [default: iterates through the instructions in a
125 ///   basic block calling InspectInstruction]
126 ///
127 /// - InspectFunction [default: iterates through the basic blocks in a
128 ///   function calling InspectBasicBlock]
129 class Instrumenter {
130 public:
131   /// Constructor
132   ///
133   /// \param[in] module
134   ///     The module being instrumented.
Instrumenter(llvm::Module & module,std::shared_ptr<UtilityFunction> checker_function)135   Instrumenter(llvm::Module &module,
136                std::shared_ptr<UtilityFunction> checker_function)
137       : m_module(module), m_checker_function(checker_function) {}
138 
139   virtual ~Instrumenter() = default;
140 
141   /// Inspect a function to find instructions to instrument
142   ///
143   /// \param[in] function
144   ///     The function to inspect.
145   ///
146   /// \return
147   ///     True on success; false on error.
Inspect(llvm::Function & function)148   bool Inspect(llvm::Function &function) { return InspectFunction(function); }
149 
150   /// Instrument all the instructions found by Inspect()
151   ///
152   /// \return
153   ///     True on success; false on error.
Instrument()154   bool Instrument() {
155     for (InstIterator ii = m_to_instrument.begin(),
156                       last_ii = m_to_instrument.end();
157          ii != last_ii; ++ii) {
158       if (!InstrumentInstruction(*ii))
159         return false;
160     }
161 
162     return true;
163   }
164 
165 protected:
166   /// Add instrumentation to a single instruction
167   ///
168   /// \param[in] inst
169   ///     The instruction to be instrumented.
170   ///
171   /// \return
172   ///     True on success; false otherwise.
173   virtual bool InstrumentInstruction(llvm::Instruction *inst) = 0;
174 
175   /// Register a single instruction to be instrumented
176   ///
177   /// \param[in] inst
178   ///     The instruction to be instrumented.
RegisterInstruction(llvm::Instruction & inst)179   void RegisterInstruction(llvm::Instruction &inst) {
180     m_to_instrument.push_back(&inst);
181   }
182 
183   /// Determine whether a single instruction is interesting to instrument,
184   /// and, if so, call RegisterInstruction
185   ///
186   /// \param[in] i
187   ///     The instruction to be inspected.
188   ///
189   /// \return
190   ///     False if there was an error scanning; true otherwise.
InspectInstruction(llvm::Instruction & i)191   virtual bool InspectInstruction(llvm::Instruction &i) { return true; }
192 
193   /// Scan a basic block to see if any instructions are interesting
194   ///
195   /// \param[in] bb
196   ///     The basic block to be inspected.
197   ///
198   /// \return
199   ///     False if there was an error scanning; true otherwise.
InspectBasicBlock(llvm::BasicBlock & bb)200   virtual bool InspectBasicBlock(llvm::BasicBlock &bb) {
201     for (llvm::BasicBlock::iterator ii = bb.begin(), last_ii = bb.end();
202          ii != last_ii; ++ii) {
203       if (!InspectInstruction(*ii))
204         return false;
205     }
206 
207     return true;
208   }
209 
210   /// Scan a function to see if any instructions are interesting
211   ///
212   /// \param[in] f
213   ///     The function to be inspected.
214   ///
215   /// \return
216   ///     False if there was an error scanning; true otherwise.
InspectFunction(llvm::Function & f)217   virtual bool InspectFunction(llvm::Function &f) {
218     for (llvm::Function::iterator bbi = f.begin(), last_bbi = f.end();
219          bbi != last_bbi; ++bbi) {
220       if (!InspectBasicBlock(*bbi))
221         return false;
222     }
223 
224     return true;
225   }
226 
227   /// Build a function pointer for a function with signature void
228   /// (*)(uint8_t*) with a given address
229   ///
230   /// \param[in] start_address
231   ///     The address of the function.
232   ///
233   /// \return
234   ///     The function pointer, for use in a CallInst.
BuildPointerValidatorFunc(lldb::addr_t start_address)235   llvm::FunctionCallee BuildPointerValidatorFunc(lldb::addr_t start_address) {
236     llvm::Type *param_array[1];
237 
238     param_array[0] = const_cast<llvm::PointerType *>(GetI8PtrTy());
239 
240     ArrayRef<llvm::Type *> params(param_array, 1);
241 
242     FunctionType *fun_ty = FunctionType::get(
243         llvm::Type::getVoidTy(m_module.getContext()), params, true);
244     PointerType *fun_ptr_ty = PointerType::getUnqual(fun_ty);
245     Constant *fun_addr_int =
246         ConstantInt::get(GetIntptrTy(), start_address, false);
247     return {fun_ty, ConstantExpr::getIntToPtr(fun_addr_int, fun_ptr_ty)};
248   }
249 
250   /// Build a function pointer for a function with signature void
251   /// (*)(uint8_t*, uint8_t*) with a given address
252   ///
253   /// \param[in] start_address
254   ///     The address of the function.
255   ///
256   /// \return
257   ///     The function pointer, for use in a CallInst.
BuildObjectCheckerFunc(lldb::addr_t start_address)258   llvm::FunctionCallee BuildObjectCheckerFunc(lldb::addr_t start_address) {
259     llvm::Type *param_array[2];
260 
261     param_array[0] = const_cast<llvm::PointerType *>(GetI8PtrTy());
262     param_array[1] = const_cast<llvm::PointerType *>(GetI8PtrTy());
263 
264     ArrayRef<llvm::Type *> params(param_array, 2);
265 
266     FunctionType *fun_ty = FunctionType::get(
267         llvm::Type::getVoidTy(m_module.getContext()), params, true);
268     PointerType *fun_ptr_ty = PointerType::getUnqual(fun_ty);
269     Constant *fun_addr_int =
270         ConstantInt::get(GetIntptrTy(), start_address, false);
271     return {fun_ty, ConstantExpr::getIntToPtr(fun_addr_int, fun_ptr_ty)};
272   }
273 
GetI8PtrTy()274   PointerType *GetI8PtrTy() {
275     if (!m_i8ptr_ty)
276       m_i8ptr_ty = llvm::PointerType::getUnqual(m_module.getContext());
277 
278     return m_i8ptr_ty;
279   }
280 
GetIntptrTy()281   IntegerType *GetIntptrTy() {
282     if (!m_intptr_ty) {
283       llvm::DataLayout data_layout(&m_module);
284 
285       m_intptr_ty = llvm::Type::getIntNTy(m_module.getContext(),
286                                           data_layout.getPointerSizeInBits());
287     }
288 
289     return m_intptr_ty;
290   }
291 
292   typedef std::vector<llvm::Instruction *> InstVector;
293   typedef InstVector::iterator InstIterator;
294 
295   InstVector m_to_instrument; ///< List of instructions the inspector found
296   llvm::Module &m_module;     ///< The module which is being instrumented
297   std::shared_ptr<UtilityFunction>
298       m_checker_function; ///< The dynamic checker function for the process
299 
300 private:
301   PointerType *m_i8ptr_ty = nullptr;
302   IntegerType *m_intptr_ty = nullptr;
303 };
304 
305 class ValidPointerChecker : public Instrumenter {
306 public:
ValidPointerChecker(llvm::Module & module,std::shared_ptr<UtilityFunction> checker_function)307   ValidPointerChecker(llvm::Module &module,
308                       std::shared_ptr<UtilityFunction> checker_function)
309       : Instrumenter(module, checker_function),
310         m_valid_pointer_check_func(nullptr) {}
311 
312   ~ValidPointerChecker() override = default;
313 
314 protected:
InstrumentInstruction(llvm::Instruction * inst)315   bool InstrumentInstruction(llvm::Instruction *inst) override {
316     Log *log = GetLog(LLDBLog::Expressions);
317 
318     LLDB_LOGF(log, "Instrumenting load/store instruction: %s\n",
319               PrintValue(inst).c_str());
320 
321     if (!m_valid_pointer_check_func)
322       m_valid_pointer_check_func =
323           BuildPointerValidatorFunc(m_checker_function->StartAddress());
324 
325     llvm::Value *dereferenced_ptr = nullptr;
326 
327     if (llvm::LoadInst *li = dyn_cast<llvm::LoadInst>(inst))
328       dereferenced_ptr = li->getPointerOperand();
329     else if (llvm::StoreInst *si = dyn_cast<llvm::StoreInst>(inst))
330       dereferenced_ptr = si->getPointerOperand();
331     else
332       return false;
333 
334     // Insert an instruction to call the helper with the result
335     CallInst::Create(m_valid_pointer_check_func, dereferenced_ptr, "", inst);
336 
337     return true;
338   }
339 
InspectInstruction(llvm::Instruction & i)340   bool InspectInstruction(llvm::Instruction &i) override {
341     if (isa<llvm::LoadInst>(&i) || isa<llvm::StoreInst>(&i))
342       RegisterInstruction(i);
343 
344     return true;
345   }
346 
347 private:
348   llvm::FunctionCallee m_valid_pointer_check_func;
349 };
350 
351 class ObjcObjectChecker : public Instrumenter {
352 public:
ObjcObjectChecker(llvm::Module & module,std::shared_ptr<UtilityFunction> checker_function)353   ObjcObjectChecker(llvm::Module &module,
354                     std::shared_ptr<UtilityFunction> checker_function)
355       : Instrumenter(module, checker_function),
356         m_objc_object_check_func(nullptr) {}
357 
358   ~ObjcObjectChecker() override = default;
359 
360   enum msgSend_type {
361     eMsgSend = 0,
362     eMsgSendSuper,
363     eMsgSendSuper_stret,
364     eMsgSend_fpret,
365     eMsgSend_stret
366   };
367 
368   std::map<llvm::Instruction *, msgSend_type> msgSend_types;
369 
370 protected:
InstrumentInstruction(llvm::Instruction * inst)371   bool InstrumentInstruction(llvm::Instruction *inst) override {
372     CallInst *call_inst = dyn_cast<CallInst>(inst);
373 
374     if (!call_inst)
375       return false; // call_inst really shouldn't be nullptr, because otherwise
376                     // InspectInstruction wouldn't have registered it
377 
378     if (!m_objc_object_check_func)
379       m_objc_object_check_func =
380           BuildObjectCheckerFunc(m_checker_function->StartAddress());
381 
382     // id objc_msgSend(id theReceiver, SEL theSelector, ...)
383 
384     llvm::Value *target_object;
385     llvm::Value *selector;
386 
387     switch (msgSend_types[inst]) {
388     case eMsgSend:
389     case eMsgSend_fpret:
390       // On arm64, clang uses objc_msgSend for scalar and struct return
391       // calls.  The call instruction will record which was used.
392       if (call_inst->hasStructRetAttr()) {
393         target_object = call_inst->getArgOperand(1);
394         selector = call_inst->getArgOperand(2);
395       } else {
396         target_object = call_inst->getArgOperand(0);
397         selector = call_inst->getArgOperand(1);
398       }
399       break;
400     case eMsgSend_stret:
401       target_object = call_inst->getArgOperand(1);
402       selector = call_inst->getArgOperand(2);
403       break;
404     case eMsgSendSuper:
405     case eMsgSendSuper_stret:
406       return true;
407     }
408 
409     // These objects should always be valid according to Sean Calannan
410     assert(target_object);
411     assert(selector);
412 
413     // Insert an instruction to call the helper with the result
414 
415     llvm::Value *arg_array[2];
416 
417     arg_array[0] = target_object;
418     arg_array[1] = selector;
419 
420     ArrayRef<llvm::Value *> args(arg_array, 2);
421 
422     CallInst::Create(m_objc_object_check_func, args, "", inst);
423 
424     return true;
425   }
426 
GetFunction(llvm::Value * value)427   static llvm::Function *GetFunction(llvm::Value *value) {
428     if (llvm::Function *function = llvm::dyn_cast<llvm::Function>(value)) {
429       return function;
430     }
431 
432     if (llvm::ConstantExpr *const_expr =
433             llvm::dyn_cast<llvm::ConstantExpr>(value)) {
434       switch (const_expr->getOpcode()) {
435       default:
436         return nullptr;
437       case llvm::Instruction::BitCast:
438         return GetFunction(const_expr->getOperand(0));
439       }
440     }
441 
442     return nullptr;
443   }
444 
GetCalledFunction(llvm::CallInst * inst)445   static llvm::Function *GetCalledFunction(llvm::CallInst *inst) {
446     return GetFunction(inst->getCalledOperand());
447   }
448 
InspectInstruction(llvm::Instruction & i)449   bool InspectInstruction(llvm::Instruction &i) override {
450     Log *log = GetLog(LLDBLog::Expressions);
451 
452     CallInst *call_inst = dyn_cast<CallInst>(&i);
453 
454     if (call_inst) {
455       const llvm::Function *called_function = GetCalledFunction(call_inst);
456 
457       if (!called_function)
458         return true;
459 
460       std::string name_str = called_function->getName().str();
461       const char *name_cstr = name_str.c_str();
462 
463       LLDB_LOGF(log, "Found call to %s: %s\n", name_cstr,
464                 PrintValue(call_inst).c_str());
465 
466       if (name_str.find("objc_msgSend") == std::string::npos)
467         return true;
468 
469       if (!strcmp(name_cstr, "objc_msgSend")) {
470         RegisterInstruction(i);
471         msgSend_types[&i] = eMsgSend;
472         return true;
473       }
474 
475       if (!strcmp(name_cstr, "objc_msgSend_stret")) {
476         RegisterInstruction(i);
477         msgSend_types[&i] = eMsgSend_stret;
478         return true;
479       }
480 
481       if (!strcmp(name_cstr, "objc_msgSend_fpret")) {
482         RegisterInstruction(i);
483         msgSend_types[&i] = eMsgSend_fpret;
484         return true;
485       }
486 
487       if (!strcmp(name_cstr, "objc_msgSendSuper")) {
488         RegisterInstruction(i);
489         msgSend_types[&i] = eMsgSendSuper;
490         return true;
491       }
492 
493       if (!strcmp(name_cstr, "objc_msgSendSuper_stret")) {
494         RegisterInstruction(i);
495         msgSend_types[&i] = eMsgSendSuper_stret;
496         return true;
497       }
498 
499       LLDB_LOGF(log,
500                 "Function name '%s' contains 'objc_msgSend' but is not handled",
501                 name_str.c_str());
502 
503       return true;
504     }
505 
506     return true;
507   }
508 
509 private:
510   llvm::FunctionCallee m_objc_object_check_func;
511 };
512 
IRDynamicChecks(ClangDynamicCheckerFunctions & checker_functions,const char * func_name)513 IRDynamicChecks::IRDynamicChecks(
514     ClangDynamicCheckerFunctions &checker_functions, const char *func_name)
515     : ModulePass(ID), m_func_name(func_name),
516       m_checker_functions(checker_functions) {}
517 
518 IRDynamicChecks::~IRDynamicChecks() = default;
519 
runOnModule(llvm::Module & M)520 bool IRDynamicChecks::runOnModule(llvm::Module &M) {
521   Log *log = GetLog(LLDBLog::Expressions);
522 
523   llvm::Function *function = M.getFunction(StringRef(m_func_name));
524 
525   if (!function) {
526     LLDB_LOGF(log, "Couldn't find %s() in the module", m_func_name.c_str());
527 
528     return false;
529   }
530 
531   if (m_checker_functions.m_valid_pointer_check) {
532     ValidPointerChecker vpc(M, m_checker_functions.m_valid_pointer_check);
533 
534     if (!vpc.Inspect(*function))
535       return false;
536 
537     if (!vpc.Instrument())
538       return false;
539   }
540 
541   if (m_checker_functions.m_objc_object_check) {
542     ObjcObjectChecker ooc(M, m_checker_functions.m_objc_object_check);
543 
544     if (!ooc.Inspect(*function))
545       return false;
546 
547     if (!ooc.Instrument())
548       return false;
549   }
550 
551   if (log && log->GetVerbose()) {
552     std::string s;
553     raw_string_ostream oss(s);
554 
555     M.print(oss, nullptr);
556 
557     oss.flush();
558 
559     LLDB_LOGF(log, "Module after dynamic checks: \n%s", s.c_str());
560   }
561 
562   return true;
563 }
564 
assignPassManager(PMStack & PMS,PassManagerType T)565 void IRDynamicChecks::assignPassManager(PMStack &PMS, PassManagerType T) {}
566 
getPotentialPassManagerType() const567 PassManagerType IRDynamicChecks::getPotentialPassManagerType() const {
568   return PMT_ModulePassManager;
569 }
570