Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

llvm_verify_x86 fails to find struct field name that llvm_verify can find #1533

Closed
RyanGlScott opened this issue Dec 6, 2021 · 1 comment · Fixed by #1534
Closed

llvm_verify_x86 fails to find struct field name that llvm_verify can find #1533

RyanGlScott opened this issue Dec 6, 2021 · 1 comment · Fixed by #1534
Labels
subsystem: crucible-llvm Issues related to LLVM bitcode verification with crucible-llvm subsystem: x86 Issues related to verifying x86 binaries via Macaw type: bug Issues reporting bugs or unexpected/unwanted behavior

Comments

@RyanGlScott
Copy link
Contributor

RyanGlScott commented Dec 6, 2021

Given this C code:

#include <stdint.h>

struct s {
  uint8_t x1;
  uint8_t x2;
};

uint8_t get_x2(struct s *ss) {
  return ss->x2;
}

int main() {
  return 0;
}

And this SAW specification:

enable_experimental;

let get_x2_spec = do {
  ss <- llvm_alloc (llvm_alias "struct.s");
  z <- llvm_fresh_var "z" (llvm_int 8);
  llvm_points_to (llvm_field ss "x2") (llvm_term z);
  llvm_execute_func [ss];
  llvm_return (llvm_term z);
};

m <- llvm_load_module "test.bc";

llvm_verify     m              "get_x2" [] false get_x2_spec (w4_unint_z3 []);
llvm_verify_x86 m "./test.exe" "get_x2" [] false get_x2_spec (w4_unint_z3 []);

I would expect both the llvm_verify and llvm_verify_x86 invocations to succeed. In practice, however, only the former succeeds:

$ clang -g -frecord-command-line -O0 -c -emit-llvm test.c -o test.bc
$ clang -g -frecord-command-line -O0 -c test.c -o test.o
$ clang -g -frecord-command-line -O0 test.o -o test.exe
$ ~/Software/saw-0.9/bin/saw test.saw


[18:08:37.673] Loading file "/home/rscott/Documents/Hacking/C/test_bitfield_x86/test.saw"
[18:08:37.695] Verifying get_x2 ...
[18:08:37.695] Simulating get_x2 ...
[18:08:37.695] Checking proof obligations get_x2 ...
[18:08:37.695] Proof succeeded! get_x2
[18:08:37.696] Finding symbol for "get_x2"
[18:08:37.697] Found symbol at address 0x401110, building CFG
[18:08:39.232] Simulating function "get_x2" (at address 0x401110)
[18:08:39.232] Examining specification to determine preconditions
[18:08:39.234] Stack trace:
"llvm_verify_x86" (/home/rscott/Documents/Hacking/C/test_bitfield_x86/test.saw:14:1-14:16):
Unable to resolve field name: "x2"
No field names were found for this struct
@RyanGlScott RyanGlScott added type: bug Issues reporting bugs or unexpected/unwanted behavior subsystem: crucible-llvm Issues related to LLVM bitcode verification with crucible-llvm subsystem: x86 Issues related to verifying x86 binaries via Macaw labels Dec 6, 2021
@RyanGlScott
Copy link
Contributor Author

Ah, I think I see why this is happening. Patch incoming.

RyanGlScott added a commit that referenced this issue Dec 6, 2021
Previously, `resolvePtrSetupValue` would pass an empty `Map` of `Ident` to
`resolveSetupVal`, which prevented SAW from lookup up struct field names
properly. The fix is quite straightforward, luckily enough.

Fixes #1533.
@mergify mergify bot closed this as completed in #1534 Dec 7, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
subsystem: crucible-llvm Issues related to LLVM bitcode verification with crucible-llvm subsystem: x86 Issues related to verifying x86 binaries via Macaw type: bug Issues reporting bugs or unexpected/unwanted behavior
Projects
None yet
Development

Successfully merging a pull request may close this issue.

1 participant