1c31e4b83SQuentin Casasnovas#! /bin/bash 2b2441318SGreg Kroah-Hartman# SPDX-License-Identifier: GPL-2.0 3c31e4b83SQuentin Casasnovas# (c) 2015, Quentin Casasnovas <quentin.casasnovas@oracle.com> 4c31e4b83SQuentin Casasnovas 5c31e4b83SQuentin Casasnovasobj=$1 6c31e4b83SQuentin Casasnovas 7*b285437dSRandy Dunlapfile ${obj} | grep -q ELF || (echo "${obj} is not an ELF file." 1>&2 ; exit 0) 8c31e4b83SQuentin Casasnovas 9c31e4b83SQuentin Casasnovas# Bail out early if there isn't an __ex_table section in this object file. 10c31e4b83SQuentin Casasnovasobjdump -hj __ex_table ${obj} 2> /dev/null > /dev/null 11c31e4b83SQuentin Casasnovas[ $? -ne 0 ] && exit 0 12c31e4b83SQuentin Casasnovas 13c31e4b83SQuentin Casasnovaswhite_list=.text,.fixup 14c31e4b83SQuentin Casasnovas 15c31e4b83SQuentin Casasnovassuspicious_relocs=$(objdump -rj __ex_table ${obj} | tail -n +6 | 16c31e4b83SQuentin Casasnovas grep -v $(eval echo -e{${white_list}}) | awk '{print $3}') 17c31e4b83SQuentin Casasnovas 18c31e4b83SQuentin Casasnovas# No suspicious relocs in __ex_table, jobs a good'un 19c31e4b83SQuentin Casasnovas[ -z "${suspicious_relocs}" ] && exit 0 20c31e4b83SQuentin Casasnovas 21c31e4b83SQuentin Casasnovas 22c31e4b83SQuentin Casasnovas# After this point, something is seriously wrong since we just found out we 23c31e4b83SQuentin Casasnovas# have some relocations in __ex_table which point to sections which aren't 24c31e4b83SQuentin Casasnovas# white listed. If you're adding a new section in the Linux kernel, and 25c31e4b83SQuentin Casasnovas# you're expecting this section to contain code which can fault (i.e. the 26c31e4b83SQuentin Casasnovas# __ex_table relocation to your new section is expected), simply add your 27c31e4b83SQuentin Casasnovas# new section to the white_list variable above. If not, you're probably 28c31e4b83SQuentin Casasnovas# doing something wrong and the rest of this code is just trying to print 29c31e4b83SQuentin Casasnovas# you more information about it. 30c31e4b83SQuentin Casasnovas 31c31e4b83SQuentin Casasnovasfunction find_section_offset_from_symbol() 32c31e4b83SQuentin Casasnovas{ 33c31e4b83SQuentin Casasnovas eval $(objdump -t ${obj} | grep ${1} | sed 's/\([0-9a-f]\+\) .\{7\} \([^ \t]\+\).*/section="\2"; section_offset="0x\1" /') 34c31e4b83SQuentin Casasnovas 35c31e4b83SQuentin Casasnovas # addr2line takes addresses in hexadecimal... 36c31e4b83SQuentin Casasnovas section_offset=$(printf "0x%016x" $(( ${section_offset} + $2 )) ) 37c31e4b83SQuentin Casasnovas} 38c31e4b83SQuentin Casasnovas 39c31e4b83SQuentin Casasnovasfunction find_symbol_and_offset_from_reloc() 40c31e4b83SQuentin Casasnovas{ 41c31e4b83SQuentin Casasnovas # Extract symbol and offset from the objdump output 42c31e4b83SQuentin Casasnovas eval $(echo $reloc | sed 's/\([^+]\+\)+\?\(0x[0-9a-f]\+\)\?/symbol="\1"; symbol_offset="\2"/') 43c31e4b83SQuentin Casasnovas 44c31e4b83SQuentin Casasnovas # When the relocation points to the begining of a symbol or section, it 45c31e4b83SQuentin Casasnovas # won't print the offset since it is zero. 46c31e4b83SQuentin Casasnovas if [ -z "${symbol_offset}" ]; then 47c31e4b83SQuentin Casasnovas symbol_offset=0x0 48c31e4b83SQuentin Casasnovas fi 49c31e4b83SQuentin Casasnovas} 50c31e4b83SQuentin Casasnovas 51c31e4b83SQuentin Casasnovasfunction find_alt_replacement_target() 52c31e4b83SQuentin Casasnovas{ 53c31e4b83SQuentin Casasnovas # The target of the .altinstr_replacement is the relocation just before 54c31e4b83SQuentin Casasnovas # the .altinstr_replacement one. 55c31e4b83SQuentin Casasnovas eval $(objdump -rj .altinstructions ${obj} | grep -B1 "${section}+${section_offset}" | head -n1 | awk '{print $3}' | 56c31e4b83SQuentin Casasnovas sed 's/\([^+]\+\)+\(0x[0-9a-f]\+\)/alt_target_section="\1"; alt_target_offset="\2"/') 57c31e4b83SQuentin Casasnovas} 58c31e4b83SQuentin Casasnovas 59c31e4b83SQuentin Casasnovasfunction handle_alt_replacement_reloc() 60c31e4b83SQuentin Casasnovas{ 61c31e4b83SQuentin Casasnovas # This will define alt_target_section and alt_target_section_offset 62c31e4b83SQuentin Casasnovas find_alt_replacement_target ${section} ${section_offset} 63c31e4b83SQuentin Casasnovas 64c31e4b83SQuentin Casasnovas echo "Error: found a reference to .altinstr_replacement in __ex_table:" 65c31e4b83SQuentin Casasnovas addr2line -fip -j ${alt_target_section} -e ${obj} ${alt_target_offset} | awk '{print "\t" $0}' 66c31e4b83SQuentin Casasnovas 67c31e4b83SQuentin Casasnovas error=true 68c31e4b83SQuentin Casasnovas} 69c31e4b83SQuentin Casasnovas 70c31e4b83SQuentin Casasnovasfunction is_executable_section() 71c31e4b83SQuentin Casasnovas{ 72c31e4b83SQuentin Casasnovas objdump -hwj ${section} ${obj} | grep -q CODE 73c31e4b83SQuentin Casasnovas return $? 74c31e4b83SQuentin Casasnovas} 75c31e4b83SQuentin Casasnovas 76c31e4b83SQuentin Casasnovasfunction handle_suspicious_generic_reloc() 77c31e4b83SQuentin Casasnovas{ 78c31e4b83SQuentin Casasnovas if is_executable_section ${section}; then 79c31e4b83SQuentin Casasnovas # We've got a relocation to a non white listed _executable_ 80c31e4b83SQuentin Casasnovas # section, print a warning so the developper adds the section to 81c31e4b83SQuentin Casasnovas # the white list or fix his code. We try to pretty-print the file 82c31e4b83SQuentin Casasnovas # and line number where that relocation was added. 83c31e4b83SQuentin Casasnovas echo "Warning: found a reference to section \"${section}\" in __ex_table:" 84c31e4b83SQuentin Casasnovas addr2line -fip -j ${section} -e ${obj} ${section_offset} | awk '{print "\t" $0}' 85c31e4b83SQuentin Casasnovas else 86c31e4b83SQuentin Casasnovas # Something is definitively wrong here since we've got a relocation 87c31e4b83SQuentin Casasnovas # to a non-executable section, there's no way this would ever be 88c31e4b83SQuentin Casasnovas # running in the kernel. 89c31e4b83SQuentin Casasnovas echo "Error: found a reference to non-executable section \"${section}\" in __ex_table at offset ${section_offset}" 90c31e4b83SQuentin Casasnovas error=true 91c31e4b83SQuentin Casasnovas fi 92c31e4b83SQuentin Casasnovas} 93c31e4b83SQuentin Casasnovas 94c31e4b83SQuentin Casasnovasfunction handle_suspicious_reloc() 95c31e4b83SQuentin Casasnovas{ 96c31e4b83SQuentin Casasnovas case "${section}" in 97c31e4b83SQuentin Casasnovas ".altinstr_replacement") 98c31e4b83SQuentin Casasnovas handle_alt_replacement_reloc ${section} ${section_offset} 99c31e4b83SQuentin Casasnovas ;; 100c31e4b83SQuentin Casasnovas *) 101c31e4b83SQuentin Casasnovas handle_suspicious_generic_reloc ${section} ${section_offset} 102c31e4b83SQuentin Casasnovas ;; 103c31e4b83SQuentin Casasnovas esac 104c31e4b83SQuentin Casasnovas} 105c31e4b83SQuentin Casasnovas 106c31e4b83SQuentin Casasnovasfunction diagnose() 107c31e4b83SQuentin Casasnovas{ 108c31e4b83SQuentin Casasnovas 109c31e4b83SQuentin Casasnovas for reloc in ${suspicious_relocs}; do 110c31e4b83SQuentin Casasnovas # Let's find out where the target of the relocation in __ex_table 111c31e4b83SQuentin Casasnovas # is, this will define ${symbol} and ${symbol_offset} 112c31e4b83SQuentin Casasnovas find_symbol_and_offset_from_reloc ${reloc} 113c31e4b83SQuentin Casasnovas 114c31e4b83SQuentin Casasnovas # When there's a global symbol at the place of the relocation, 115c31e4b83SQuentin Casasnovas # objdump will use it instead of giving us a section+offset, so 116c31e4b83SQuentin Casasnovas # let's find out which section is this symbol in and the total 117c31e4b83SQuentin Casasnovas # offset withing that section. 118c31e4b83SQuentin Casasnovas find_section_offset_from_symbol ${symbol} ${symbol_offset} 119c31e4b83SQuentin Casasnovas 120c31e4b83SQuentin Casasnovas # In this case objdump was presenting us with a reloc to a symbol 121c31e4b83SQuentin Casasnovas # rather than a section. Now that we've got the actual section, 122c31e4b83SQuentin Casasnovas # we can skip it if it's in the white_list. 123c31e4b83SQuentin Casasnovas if [ -z "$( echo $section | grep -v $(eval echo -e{${white_list}}))" ]; then 124c31e4b83SQuentin Casasnovas continue; 125c31e4b83SQuentin Casasnovas fi 126c31e4b83SQuentin Casasnovas 127c31e4b83SQuentin Casasnovas # Will either print a warning if the relocation happens to be in a 128c31e4b83SQuentin Casasnovas # section we do not know but has executable bit set, or error out. 129c31e4b83SQuentin Casasnovas handle_suspicious_reloc 130c31e4b83SQuentin Casasnovas done 131c31e4b83SQuentin Casasnovas} 132c31e4b83SQuentin Casasnovas 133c31e4b83SQuentin Casasnovasfunction check_debug_info() { 134c31e4b83SQuentin Casasnovas objdump -hj .debug_info ${obj} 2> /dev/null > /dev/null || 135c31e4b83SQuentin Casasnovas echo -e "${obj} does not contain debug information, the addr2line output will be limited.\n" \ 136c31e4b83SQuentin Casasnovas "Recompile ${obj} with CONFIG_DEBUG_INFO to get a more useful output." 137c31e4b83SQuentin Casasnovas} 138c31e4b83SQuentin Casasnovas 139c31e4b83SQuentin Casasnovascheck_debug_info 140c31e4b83SQuentin Casasnovas 141c31e4b83SQuentin Casasnovasdiagnose 142c31e4b83SQuentin Casasnovas 143c31e4b83SQuentin Casasnovasif [ "${error}" ]; then 144c31e4b83SQuentin Casasnovas exit 1 145c31e4b83SQuentin Casasnovasfi 146c31e4b83SQuentin Casasnovas 147c31e4b83SQuentin Casasnovasexit 0 148