1 /* 2 * Copyright (C) 2015-2017 Josh Poimboeuf <jpoimboe@redhat.com> 3 * 4 * This program is free software; you can redistribute it and/or 5 * modify it under the terms of the GNU General Public License 6 * as published by the Free Software Foundation; either version 2 7 * of the License, or (at your option) any later version. 8 * 9 * This program is distributed in the hope that it will be useful, 10 * but WITHOUT ANY WARRANTY; without even the implied warranty of 11 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 12 * GNU General Public License for more details. 13 * 14 * You should have received a copy of the GNU General Public License 15 * along with this program; if not, see <http://www.gnu.org/licenses/>. 16 */ 17 18 #include <string.h> 19 #include <stdlib.h> 20 21 #include "builtin.h" 22 #include "check.h" 23 #include "elf.h" 24 #include "special.h" 25 #include "arch.h" 26 #include "warn.h" 27 28 #include <linux/hashtable.h> 29 #include <linux/kernel.h> 30 31 struct alternative { 32 struct list_head list; 33 struct instruction *insn; 34 }; 35 36 const char *objname; 37 struct cfi_state initial_func_cfi; 38 39 struct instruction *find_insn(struct objtool_file *file, 40 struct section *sec, unsigned long offset) 41 { 42 struct instruction *insn; 43 44 hash_for_each_possible(file->insn_hash, insn, hash, offset) 45 if (insn->sec == sec && insn->offset == offset) 46 return insn; 47 48 return NULL; 49 } 50 51 static struct instruction *next_insn_same_sec(struct objtool_file *file, 52 struct instruction *insn) 53 { 54 struct instruction *next = list_next_entry(insn, list); 55 56 if (!next || &next->list == &file->insn_list || next->sec != insn->sec) 57 return NULL; 58 59 return next; 60 } 61 62 static struct instruction *next_insn_same_func(struct objtool_file *file, 63 struct instruction *insn) 64 { 65 struct instruction *next = list_next_entry(insn, list); 66 struct symbol *func = insn->func; 67 68 if (!func) 69 return NULL; 70 71 if (&next->list != &file->insn_list && next->func == func) 72 return next; 73 74 /* Check if we're already in the subfunction: */ 75 if (func == func->cfunc) 76 return NULL; 77 78 /* Move to the subfunction: */ 79 return find_insn(file, func->cfunc->sec, func->cfunc->offset); 80 } 81 82 #define func_for_each_insn_all(file, func, insn) \ 83 for (insn = find_insn(file, func->sec, func->offset); \ 84 insn; \ 85 insn = next_insn_same_func(file, insn)) 86 87 #define func_for_each_insn(file, func, insn) \ 88 for (insn = find_insn(file, func->sec, func->offset); \ 89 insn && &insn->list != &file->insn_list && \ 90 insn->sec == func->sec && \ 91 insn->offset < func->offset + func->len; \ 92 insn = list_next_entry(insn, list)) 93 94 #define func_for_each_insn_continue_reverse(file, func, insn) \ 95 for (insn = list_prev_entry(insn, list); \ 96 &insn->list != &file->insn_list && \ 97 insn->sec == func->sec && insn->offset >= func->offset; \ 98 insn = list_prev_entry(insn, list)) 99 100 #define sec_for_each_insn_from(file, insn) \ 101 for (; insn; insn = next_insn_same_sec(file, insn)) 102 103 #define sec_for_each_insn_continue(file, insn) \ 104 for (insn = next_insn_same_sec(file, insn); insn; \ 105 insn = next_insn_same_sec(file, insn)) 106 107 /* 108 * Check if the function has been manually whitelisted with the 109 * STACK_FRAME_NON_STANDARD macro, or if it should be automatically whitelisted 110 * due to its use of a context switching instruction. 111 */ 112 static bool ignore_func(struct objtool_file *file, struct symbol *func) 113 { 114 struct rela *rela; 115 116 /* check for STACK_FRAME_NON_STANDARD */ 117 if (file->whitelist && file->whitelist->rela) 118 list_for_each_entry(rela, &file->whitelist->rela->rela_list, list) { 119 if (rela->sym->type == STT_SECTION && 120 rela->sym->sec == func->sec && 121 rela->addend == func->offset) 122 return true; 123 if (rela->sym->type == STT_FUNC && rela->sym == func) 124 return true; 125 } 126 127 return false; 128 } 129 130 /* 131 * This checks to see if the given function is a "noreturn" function. 132 * 133 * For global functions which are outside the scope of this object file, we 134 * have to keep a manual list of them. 135 * 136 * For local functions, we have to detect them manually by simply looking for 137 * the lack of a return instruction. 138 * 139 * Returns: 140 * -1: error 141 * 0: no dead end 142 * 1: dead end 143 */ 144 static int __dead_end_function(struct objtool_file *file, struct symbol *func, 145 int recursion) 146 { 147 int i; 148 struct instruction *insn; 149 bool empty = true; 150 151 /* 152 * Unfortunately these have to be hard coded because the noreturn 153 * attribute isn't provided in ELF data. 154 */ 155 static const char * const global_noreturns[] = { 156 "__stack_chk_fail", 157 "panic", 158 "do_exit", 159 "do_task_dead", 160 "__module_put_and_exit", 161 "complete_and_exit", 162 "kvm_spurious_fault", 163 "__reiserfs_panic", 164 "lbug_with_loc", 165 "fortify_panic", 166 "usercopy_abort", 167 }; 168 169 if (func->bind == STB_WEAK) 170 return 0; 171 172 if (func->bind == STB_GLOBAL) 173 for (i = 0; i < ARRAY_SIZE(global_noreturns); i++) 174 if (!strcmp(func->name, global_noreturns[i])) 175 return 1; 176 177 if (!func->len) 178 return 0; 179 180 insn = find_insn(file, func->sec, func->offset); 181 if (!insn->func) 182 return 0; 183 184 func_for_each_insn_all(file, func, insn) { 185 empty = false; 186 187 if (insn->type == INSN_RETURN) 188 return 0; 189 } 190 191 if (empty) 192 return 0; 193 194 /* 195 * A function can have a sibling call instead of a return. In that 196 * case, the function's dead-end status depends on whether the target 197 * of the sibling call returns. 198 */ 199 func_for_each_insn_all(file, func, insn) { 200 if (insn->type == INSN_JUMP_UNCONDITIONAL) { 201 struct instruction *dest = insn->jump_dest; 202 203 if (!dest) 204 /* sibling call to another file */ 205 return 0; 206 207 if (dest->func && dest->func->pfunc != insn->func->pfunc) { 208 209 /* local sibling call */ 210 if (recursion == 5) { 211 /* 212 * Infinite recursion: two functions 213 * have sibling calls to each other. 214 * This is a very rare case. It means 215 * they aren't dead ends. 216 */ 217 return 0; 218 } 219 220 return __dead_end_function(file, dest->func, 221 recursion + 1); 222 } 223 } 224 225 if (insn->type == INSN_JUMP_DYNAMIC && list_empty(&insn->alts)) 226 /* sibling call */ 227 return 0; 228 } 229 230 return 1; 231 } 232 233 static int dead_end_function(struct objtool_file *file, struct symbol *func) 234 { 235 return __dead_end_function(file, func, 0); 236 } 237 238 static void clear_insn_state(struct insn_state *state) 239 { 240 int i; 241 242 memset(state, 0, sizeof(*state)); 243 state->cfa.base = CFI_UNDEFINED; 244 for (i = 0; i < CFI_NUM_REGS; i++) { 245 state->regs[i].base = CFI_UNDEFINED; 246 state->vals[i].base = CFI_UNDEFINED; 247 } 248 state->drap_reg = CFI_UNDEFINED; 249 state->drap_offset = -1; 250 } 251 252 /* 253 * Call the arch-specific instruction decoder for all the instructions and add 254 * them to the global instruction list. 255 */ 256 static int decode_instructions(struct objtool_file *file) 257 { 258 struct section *sec; 259 struct symbol *func; 260 unsigned long offset; 261 struct instruction *insn; 262 int ret; 263 264 for_each_sec(file, sec) { 265 266 if (!(sec->sh.sh_flags & SHF_EXECINSTR)) 267 continue; 268 269 if (strcmp(sec->name, ".altinstr_replacement") && 270 strcmp(sec->name, ".altinstr_aux") && 271 strncmp(sec->name, ".discard.", 9)) 272 sec->text = true; 273 274 for (offset = 0; offset < sec->len; offset += insn->len) { 275 insn = malloc(sizeof(*insn)); 276 if (!insn) { 277 WARN("malloc failed"); 278 return -1; 279 } 280 memset(insn, 0, sizeof(*insn)); 281 INIT_LIST_HEAD(&insn->alts); 282 clear_insn_state(&insn->state); 283 284 insn->sec = sec; 285 insn->offset = offset; 286 287 ret = arch_decode_instruction(file->elf, sec, offset, 288 sec->len - offset, 289 &insn->len, &insn->type, 290 &insn->immediate, 291 &insn->stack_op); 292 if (ret) 293 goto err; 294 295 if (!insn->type || insn->type > INSN_LAST) { 296 WARN_FUNC("invalid instruction type %d", 297 insn->sec, insn->offset, insn->type); 298 ret = -1; 299 goto err; 300 } 301 302 hash_add(file->insn_hash, &insn->hash, insn->offset); 303 list_add_tail(&insn->list, &file->insn_list); 304 } 305 306 list_for_each_entry(func, &sec->symbol_list, list) { 307 if (func->type != STT_FUNC) 308 continue; 309 310 if (!find_insn(file, sec, func->offset)) { 311 WARN("%s(): can't find starting instruction", 312 func->name); 313 return -1; 314 } 315 316 func_for_each_insn(file, func, insn) 317 if (!insn->func) 318 insn->func = func; 319 } 320 } 321 322 return 0; 323 324 err: 325 free(insn); 326 return ret; 327 } 328 329 /* 330 * Mark "ud2" instructions and manually annotated dead ends. 331 */ 332 static int add_dead_ends(struct objtool_file *file) 333 { 334 struct section *sec; 335 struct rela *rela; 336 struct instruction *insn; 337 bool found; 338 339 /* 340 * By default, "ud2" is a dead end unless otherwise annotated, because 341 * GCC 7 inserts it for certain divide-by-zero cases. 342 */ 343 for_each_insn(file, insn) 344 if (insn->type == INSN_BUG) 345 insn->dead_end = true; 346 347 /* 348 * Check for manually annotated dead ends. 349 */ 350 sec = find_section_by_name(file->elf, ".rela.discard.unreachable"); 351 if (!sec) 352 goto reachable; 353 354 list_for_each_entry(rela, &sec->rela_list, list) { 355 if (rela->sym->type != STT_SECTION) { 356 WARN("unexpected relocation symbol type in %s", sec->name); 357 return -1; 358 } 359 insn = find_insn(file, rela->sym->sec, rela->addend); 360 if (insn) 361 insn = list_prev_entry(insn, list); 362 else if (rela->addend == rela->sym->sec->len) { 363 found = false; 364 list_for_each_entry_reverse(insn, &file->insn_list, list) { 365 if (insn->sec == rela->sym->sec) { 366 found = true; 367 break; 368 } 369 } 370 371 if (!found) { 372 WARN("can't find unreachable insn at %s+0x%x", 373 rela->sym->sec->name, rela->addend); 374 return -1; 375 } 376 } else { 377 WARN("can't find unreachable insn at %s+0x%x", 378 rela->sym->sec->name, rela->addend); 379 return -1; 380 } 381 382 insn->dead_end = true; 383 } 384 385 reachable: 386 /* 387 * These manually annotated reachable checks are needed for GCC 4.4, 388 * where the Linux unreachable() macro isn't supported. In that case 389 * GCC doesn't know the "ud2" is fatal, so it generates code as if it's 390 * not a dead end. 391 */ 392 sec = find_section_by_name(file->elf, ".rela.discard.reachable"); 393 if (!sec) 394 return 0; 395 396 list_for_each_entry(rela, &sec->rela_list, list) { 397 if (rela->sym->type != STT_SECTION) { 398 WARN("unexpected relocation symbol type in %s", sec->name); 399 return -1; 400 } 401 insn = find_insn(file, rela->sym->sec, rela->addend); 402 if (insn) 403 insn = list_prev_entry(insn, list); 404 else if (rela->addend == rela->sym->sec->len) { 405 found = false; 406 list_for_each_entry_reverse(insn, &file->insn_list, list) { 407 if (insn->sec == rela->sym->sec) { 408 found = true; 409 break; 410 } 411 } 412 413 if (!found) { 414 WARN("can't find reachable insn at %s+0x%x", 415 rela->sym->sec->name, rela->addend); 416 return -1; 417 } 418 } else { 419 WARN("can't find reachable insn at %s+0x%x", 420 rela->sym->sec->name, rela->addend); 421 return -1; 422 } 423 424 insn->dead_end = false; 425 } 426 427 return 0; 428 } 429 430 /* 431 * Warnings shouldn't be reported for ignored functions. 432 */ 433 static void add_ignores(struct objtool_file *file) 434 { 435 struct instruction *insn; 436 struct section *sec; 437 struct symbol *func; 438 439 for_each_sec(file, sec) { 440 list_for_each_entry(func, &sec->symbol_list, list) { 441 if (func->type != STT_FUNC) 442 continue; 443 444 if (!ignore_func(file, func)) 445 continue; 446 447 func_for_each_insn_all(file, func, insn) 448 insn->ignore = true; 449 } 450 } 451 } 452 453 /* 454 * FIXME: For now, just ignore any alternatives which add retpolines. This is 455 * a temporary hack, as it doesn't allow ORC to unwind from inside a retpoline. 456 * But it at least allows objtool to understand the control flow *around* the 457 * retpoline. 458 */ 459 static int add_nospec_ignores(struct objtool_file *file) 460 { 461 struct section *sec; 462 struct rela *rela; 463 struct instruction *insn; 464 465 sec = find_section_by_name(file->elf, ".rela.discard.nospec"); 466 if (!sec) 467 return 0; 468 469 list_for_each_entry(rela, &sec->rela_list, list) { 470 if (rela->sym->type != STT_SECTION) { 471 WARN("unexpected relocation symbol type in %s", sec->name); 472 return -1; 473 } 474 475 insn = find_insn(file, rela->sym->sec, rela->addend); 476 if (!insn) { 477 WARN("bad .discard.nospec entry"); 478 return -1; 479 } 480 481 insn->ignore_alts = true; 482 } 483 484 return 0; 485 } 486 487 /* 488 * Find the destination instructions for all jumps. 489 */ 490 static int add_jump_destinations(struct objtool_file *file) 491 { 492 struct instruction *insn; 493 struct rela *rela; 494 struct section *dest_sec; 495 unsigned long dest_off; 496 497 for_each_insn(file, insn) { 498 if (insn->type != INSN_JUMP_CONDITIONAL && 499 insn->type != INSN_JUMP_UNCONDITIONAL) 500 continue; 501 502 if (insn->ignore) 503 continue; 504 505 rela = find_rela_by_dest_range(insn->sec, insn->offset, 506 insn->len); 507 if (!rela) { 508 dest_sec = insn->sec; 509 dest_off = insn->offset + insn->len + insn->immediate; 510 } else if (rela->sym->type == STT_SECTION) { 511 dest_sec = rela->sym->sec; 512 dest_off = rela->addend + 4; 513 } else if (rela->sym->sec->idx) { 514 dest_sec = rela->sym->sec; 515 dest_off = rela->sym->sym.st_value + rela->addend + 4; 516 } else if (strstr(rela->sym->name, "_indirect_thunk_")) { 517 /* 518 * Retpoline jumps are really dynamic jumps in 519 * disguise, so convert them accordingly. 520 */ 521 insn->type = INSN_JUMP_DYNAMIC; 522 insn->retpoline_safe = true; 523 continue; 524 } else { 525 /* sibling call */ 526 insn->jump_dest = 0; 527 continue; 528 } 529 530 insn->jump_dest = find_insn(file, dest_sec, dest_off); 531 if (!insn->jump_dest) { 532 533 /* 534 * This is a special case where an alt instruction 535 * jumps past the end of the section. These are 536 * handled later in handle_group_alt(). 537 */ 538 if (!strcmp(insn->sec->name, ".altinstr_replacement")) 539 continue; 540 541 WARN_FUNC("can't find jump dest instruction at %s+0x%lx", 542 insn->sec, insn->offset, dest_sec->name, 543 dest_off); 544 return -1; 545 } 546 547 /* 548 * For GCC 8+, create parent/child links for any cold 549 * subfunctions. This is _mostly_ redundant with a similar 550 * initialization in read_symbols(). 551 * 552 * If a function has aliases, we want the *first* such function 553 * in the symbol table to be the subfunction's parent. In that 554 * case we overwrite the initialization done in read_symbols(). 555 * 556 * However this code can't completely replace the 557 * read_symbols() code because this doesn't detect the case 558 * where the parent function's only reference to a subfunction 559 * is through a switch table. 560 */ 561 if (insn->func && insn->jump_dest->func && 562 insn->func != insn->jump_dest->func && 563 !strstr(insn->func->name, ".cold.") && 564 strstr(insn->jump_dest->func->name, ".cold.")) { 565 insn->func->cfunc = insn->jump_dest->func; 566 insn->jump_dest->func->pfunc = insn->func; 567 } 568 } 569 570 return 0; 571 } 572 573 /* 574 * Find the destination instructions for all calls. 575 */ 576 static int add_call_destinations(struct objtool_file *file) 577 { 578 struct instruction *insn; 579 unsigned long dest_off; 580 struct rela *rela; 581 582 for_each_insn(file, insn) { 583 if (insn->type != INSN_CALL) 584 continue; 585 586 rela = find_rela_by_dest_range(insn->sec, insn->offset, 587 insn->len); 588 if (!rela) { 589 dest_off = insn->offset + insn->len + insn->immediate; 590 insn->call_dest = find_symbol_by_offset(insn->sec, 591 dest_off); 592 593 if (!insn->call_dest && !insn->ignore) { 594 WARN_FUNC("unsupported intra-function call", 595 insn->sec, insn->offset); 596 if (retpoline) 597 WARN("If this is a retpoline, please patch it in with alternatives and annotate it with ANNOTATE_NOSPEC_ALTERNATIVE."); 598 return -1; 599 } 600 601 } else if (rela->sym->type == STT_SECTION) { 602 insn->call_dest = find_symbol_by_offset(rela->sym->sec, 603 rela->addend+4); 604 if (!insn->call_dest || 605 insn->call_dest->type != STT_FUNC) { 606 WARN_FUNC("can't find call dest symbol at %s+0x%x", 607 insn->sec, insn->offset, 608 rela->sym->sec->name, 609 rela->addend + 4); 610 return -1; 611 } 612 } else 613 insn->call_dest = rela->sym; 614 } 615 616 return 0; 617 } 618 619 /* 620 * The .alternatives section requires some extra special care, over and above 621 * what other special sections require: 622 * 623 * 1. Because alternatives are patched in-place, we need to insert a fake jump 624 * instruction at the end so that validate_branch() skips all the original 625 * replaced instructions when validating the new instruction path. 626 * 627 * 2. An added wrinkle is that the new instruction length might be zero. In 628 * that case the old instructions are replaced with noops. We simulate that 629 * by creating a fake jump as the only new instruction. 630 * 631 * 3. In some cases, the alternative section includes an instruction which 632 * conditionally jumps to the _end_ of the entry. We have to modify these 633 * jumps' destinations to point back to .text rather than the end of the 634 * entry in .altinstr_replacement. 635 * 636 * 4. It has been requested that we don't validate the !POPCNT feature path 637 * which is a "very very small percentage of machines". 638 */ 639 static int handle_group_alt(struct objtool_file *file, 640 struct special_alt *special_alt, 641 struct instruction *orig_insn, 642 struct instruction **new_insn) 643 { 644 struct instruction *last_orig_insn, *last_new_insn, *insn, *fake_jump = NULL; 645 unsigned long dest_off; 646 647 last_orig_insn = NULL; 648 insn = orig_insn; 649 sec_for_each_insn_from(file, insn) { 650 if (insn->offset >= special_alt->orig_off + special_alt->orig_len) 651 break; 652 653 if (special_alt->skip_orig) 654 insn->type = INSN_NOP; 655 656 insn->alt_group = true; 657 last_orig_insn = insn; 658 } 659 660 if (next_insn_same_sec(file, last_orig_insn)) { 661 fake_jump = malloc(sizeof(*fake_jump)); 662 if (!fake_jump) { 663 WARN("malloc failed"); 664 return -1; 665 } 666 memset(fake_jump, 0, sizeof(*fake_jump)); 667 INIT_LIST_HEAD(&fake_jump->alts); 668 clear_insn_state(&fake_jump->state); 669 670 fake_jump->sec = special_alt->new_sec; 671 fake_jump->offset = -1; 672 fake_jump->type = INSN_JUMP_UNCONDITIONAL; 673 fake_jump->jump_dest = list_next_entry(last_orig_insn, list); 674 fake_jump->ignore = true; 675 } 676 677 if (!special_alt->new_len) { 678 if (!fake_jump) { 679 WARN("%s: empty alternative at end of section", 680 special_alt->orig_sec->name); 681 return -1; 682 } 683 684 *new_insn = fake_jump; 685 return 0; 686 } 687 688 last_new_insn = NULL; 689 insn = *new_insn; 690 sec_for_each_insn_from(file, insn) { 691 if (insn->offset >= special_alt->new_off + special_alt->new_len) 692 break; 693 694 last_new_insn = insn; 695 696 insn->ignore = orig_insn->ignore_alts; 697 698 if (insn->type != INSN_JUMP_CONDITIONAL && 699 insn->type != INSN_JUMP_UNCONDITIONAL) 700 continue; 701 702 if (!insn->immediate) 703 continue; 704 705 dest_off = insn->offset + insn->len + insn->immediate; 706 if (dest_off == special_alt->new_off + special_alt->new_len) { 707 if (!fake_jump) { 708 WARN("%s: alternative jump to end of section", 709 special_alt->orig_sec->name); 710 return -1; 711 } 712 insn->jump_dest = fake_jump; 713 } 714 715 if (!insn->jump_dest) { 716 WARN_FUNC("can't find alternative jump destination", 717 insn->sec, insn->offset); 718 return -1; 719 } 720 } 721 722 if (!last_new_insn) { 723 WARN_FUNC("can't find last new alternative instruction", 724 special_alt->new_sec, special_alt->new_off); 725 return -1; 726 } 727 728 if (fake_jump) 729 list_add(&fake_jump->list, &last_new_insn->list); 730 731 return 0; 732 } 733 734 /* 735 * A jump table entry can either convert a nop to a jump or a jump to a nop. 736 * If the original instruction is a jump, make the alt entry an effective nop 737 * by just skipping the original instruction. 738 */ 739 static int handle_jump_alt(struct objtool_file *file, 740 struct special_alt *special_alt, 741 struct instruction *orig_insn, 742 struct instruction **new_insn) 743 { 744 if (orig_insn->type == INSN_NOP) 745 return 0; 746 747 if (orig_insn->type != INSN_JUMP_UNCONDITIONAL) { 748 WARN_FUNC("unsupported instruction at jump label", 749 orig_insn->sec, orig_insn->offset); 750 return -1; 751 } 752 753 *new_insn = list_next_entry(orig_insn, list); 754 return 0; 755 } 756 757 /* 758 * Read all the special sections which have alternate instructions which can be 759 * patched in or redirected to at runtime. Each instruction having alternate 760 * instruction(s) has them added to its insn->alts list, which will be 761 * traversed in validate_branch(). 762 */ 763 static int add_special_section_alts(struct objtool_file *file) 764 { 765 struct list_head special_alts; 766 struct instruction *orig_insn, *new_insn; 767 struct special_alt *special_alt, *tmp; 768 struct alternative *alt; 769 int ret; 770 771 ret = special_get_alts(file->elf, &special_alts); 772 if (ret) 773 return ret; 774 775 list_for_each_entry_safe(special_alt, tmp, &special_alts, list) { 776 777 orig_insn = find_insn(file, special_alt->orig_sec, 778 special_alt->orig_off); 779 if (!orig_insn) { 780 WARN_FUNC("special: can't find orig instruction", 781 special_alt->orig_sec, special_alt->orig_off); 782 ret = -1; 783 goto out; 784 } 785 786 new_insn = NULL; 787 if (!special_alt->group || special_alt->new_len) { 788 new_insn = find_insn(file, special_alt->new_sec, 789 special_alt->new_off); 790 if (!new_insn) { 791 WARN_FUNC("special: can't find new instruction", 792 special_alt->new_sec, 793 special_alt->new_off); 794 ret = -1; 795 goto out; 796 } 797 } 798 799 if (special_alt->group) { 800 ret = handle_group_alt(file, special_alt, orig_insn, 801 &new_insn); 802 if (ret) 803 goto out; 804 } else if (special_alt->jump_or_nop) { 805 ret = handle_jump_alt(file, special_alt, orig_insn, 806 &new_insn); 807 if (ret) 808 goto out; 809 } 810 811 alt = malloc(sizeof(*alt)); 812 if (!alt) { 813 WARN("malloc failed"); 814 ret = -1; 815 goto out; 816 } 817 818 alt->insn = new_insn; 819 list_add_tail(&alt->list, &orig_insn->alts); 820 821 list_del(&special_alt->list); 822 free(special_alt); 823 } 824 825 out: 826 return ret; 827 } 828 829 static int add_switch_table(struct objtool_file *file, struct instruction *insn, 830 struct rela *table, struct rela *next_table) 831 { 832 struct rela *rela = table; 833 struct instruction *alt_insn; 834 struct alternative *alt; 835 struct symbol *pfunc = insn->func->pfunc; 836 unsigned int prev_offset = 0; 837 838 list_for_each_entry_from(rela, &file->rodata->rela->rela_list, list) { 839 if (rela == next_table) 840 break; 841 842 /* Make sure the switch table entries are consecutive: */ 843 if (prev_offset && rela->offset != prev_offset + 8) 844 break; 845 846 /* Detect function pointers from contiguous objects: */ 847 if (rela->sym->sec == pfunc->sec && 848 rela->addend == pfunc->offset) 849 break; 850 851 alt_insn = find_insn(file, rela->sym->sec, rela->addend); 852 if (!alt_insn) 853 break; 854 855 /* Make sure the jmp dest is in the function or subfunction: */ 856 if (alt_insn->func->pfunc != pfunc) 857 break; 858 859 alt = malloc(sizeof(*alt)); 860 if (!alt) { 861 WARN("malloc failed"); 862 return -1; 863 } 864 865 alt->insn = alt_insn; 866 list_add_tail(&alt->list, &insn->alts); 867 prev_offset = rela->offset; 868 } 869 870 if (!prev_offset) { 871 WARN_FUNC("can't find switch jump table", 872 insn->sec, insn->offset); 873 return -1; 874 } 875 876 return 0; 877 } 878 879 /* 880 * find_switch_table() - Given a dynamic jump, find the switch jump table in 881 * .rodata associated with it. 882 * 883 * There are 3 basic patterns: 884 * 885 * 1. jmpq *[rodata addr](,%reg,8) 886 * 887 * This is the most common case by far. It jumps to an address in a simple 888 * jump table which is stored in .rodata. 889 * 890 * 2. jmpq *[rodata addr](%rip) 891 * 892 * This is caused by a rare GCC quirk, currently only seen in three driver 893 * functions in the kernel, only with certain obscure non-distro configs. 894 * 895 * As part of an optimization, GCC makes a copy of an existing switch jump 896 * table, modifies it, and then hard-codes the jump (albeit with an indirect 897 * jump) to use a single entry in the table. The rest of the jump table and 898 * some of its jump targets remain as dead code. 899 * 900 * In such a case we can just crudely ignore all unreachable instruction 901 * warnings for the entire object file. Ideally we would just ignore them 902 * for the function, but that would require redesigning the code quite a 903 * bit. And honestly that's just not worth doing: unreachable instruction 904 * warnings are of questionable value anyway, and this is such a rare issue. 905 * 906 * 3. mov [rodata addr],%reg1 907 * ... some instructions ... 908 * jmpq *(%reg1,%reg2,8) 909 * 910 * This is a fairly uncommon pattern which is new for GCC 6. As of this 911 * writing, there are 11 occurrences of it in the allmodconfig kernel. 912 * 913 * As of GCC 7 there are quite a few more of these and the 'in between' code 914 * is significant. Esp. with KASAN enabled some of the code between the mov 915 * and jmpq uses .rodata itself, which can confuse things. 916 * 917 * TODO: Once we have DWARF CFI and smarter instruction decoding logic, 918 * ensure the same register is used in the mov and jump instructions. 919 * 920 * NOTE: RETPOLINE made it harder still to decode dynamic jumps. 921 */ 922 static struct rela *find_switch_table(struct objtool_file *file, 923 struct symbol *func, 924 struct instruction *insn) 925 { 926 struct rela *text_rela, *rodata_rela; 927 struct instruction *orig_insn = insn; 928 unsigned long table_offset; 929 930 /* 931 * Backward search using the @first_jump_src links, these help avoid 932 * much of the 'in between' code. Which avoids us getting confused by 933 * it. 934 */ 935 for (; 936 &insn->list != &file->insn_list && 937 insn->sec == func->sec && 938 insn->offset >= func->offset; 939 940 insn = insn->first_jump_src ?: list_prev_entry(insn, list)) { 941 942 if (insn != orig_insn && insn->type == INSN_JUMP_DYNAMIC) 943 break; 944 945 /* allow small jumps within the range */ 946 if (insn->type == INSN_JUMP_UNCONDITIONAL && 947 insn->jump_dest && 948 (insn->jump_dest->offset <= insn->offset || 949 insn->jump_dest->offset > orig_insn->offset)) 950 break; 951 952 /* look for a relocation which references .rodata */ 953 text_rela = find_rela_by_dest_range(insn->sec, insn->offset, 954 insn->len); 955 if (!text_rela || text_rela->sym != file->rodata->sym) 956 continue; 957 958 table_offset = text_rela->addend; 959 if (text_rela->type == R_X86_64_PC32) 960 table_offset += 4; 961 962 /* 963 * Make sure the .rodata address isn't associated with a 964 * symbol. gcc jump tables are anonymous data. 965 */ 966 if (find_symbol_containing(file->rodata, table_offset)) 967 continue; 968 969 rodata_rela = find_rela_by_dest(file->rodata, table_offset); 970 if (rodata_rela) { 971 /* 972 * Use of RIP-relative switch jumps is quite rare, and 973 * indicates a rare GCC quirk/bug which can leave dead 974 * code behind. 975 */ 976 if (text_rela->type == R_X86_64_PC32) 977 file->ignore_unreachables = true; 978 979 return rodata_rela; 980 } 981 } 982 983 return NULL; 984 } 985 986 987 static int add_func_switch_tables(struct objtool_file *file, 988 struct symbol *func) 989 { 990 struct instruction *insn, *last = NULL, *prev_jump = NULL; 991 struct rela *rela, *prev_rela = NULL; 992 int ret; 993 994 func_for_each_insn_all(file, func, insn) { 995 if (!last) 996 last = insn; 997 998 /* 999 * Store back-pointers for unconditional forward jumps such 1000 * that find_switch_table() can back-track using those and 1001 * avoid some potentially confusing code. 1002 */ 1003 if (insn->type == INSN_JUMP_UNCONDITIONAL && insn->jump_dest && 1004 insn->offset > last->offset && 1005 insn->jump_dest->offset > insn->offset && 1006 !insn->jump_dest->first_jump_src) { 1007 1008 insn->jump_dest->first_jump_src = insn; 1009 last = insn->jump_dest; 1010 } 1011 1012 if (insn->type != INSN_JUMP_DYNAMIC) 1013 continue; 1014 1015 rela = find_switch_table(file, func, insn); 1016 if (!rela) 1017 continue; 1018 1019 /* 1020 * We found a switch table, but we don't know yet how big it 1021 * is. Don't add it until we reach the end of the function or 1022 * the beginning of another switch table in the same function. 1023 */ 1024 if (prev_jump) { 1025 ret = add_switch_table(file, prev_jump, prev_rela, rela); 1026 if (ret) 1027 return ret; 1028 } 1029 1030 prev_jump = insn; 1031 prev_rela = rela; 1032 } 1033 1034 if (prev_jump) { 1035 ret = add_switch_table(file, prev_jump, prev_rela, NULL); 1036 if (ret) 1037 return ret; 1038 } 1039 1040 return 0; 1041 } 1042 1043 /* 1044 * For some switch statements, gcc generates a jump table in the .rodata 1045 * section which contains a list of addresses within the function to jump to. 1046 * This finds these jump tables and adds them to the insn->alts lists. 1047 */ 1048 static int add_switch_table_alts(struct objtool_file *file) 1049 { 1050 struct section *sec; 1051 struct symbol *func; 1052 int ret; 1053 1054 if (!file->rodata || !file->rodata->rela) 1055 return 0; 1056 1057 for_each_sec(file, sec) { 1058 list_for_each_entry(func, &sec->symbol_list, list) { 1059 if (func->type != STT_FUNC) 1060 continue; 1061 1062 ret = add_func_switch_tables(file, func); 1063 if (ret) 1064 return ret; 1065 } 1066 } 1067 1068 return 0; 1069 } 1070 1071 static int read_unwind_hints(struct objtool_file *file) 1072 { 1073 struct section *sec, *relasec; 1074 struct rela *rela; 1075 struct unwind_hint *hint; 1076 struct instruction *insn; 1077 struct cfi_reg *cfa; 1078 int i; 1079 1080 sec = find_section_by_name(file->elf, ".discard.unwind_hints"); 1081 if (!sec) 1082 return 0; 1083 1084 relasec = sec->rela; 1085 if (!relasec) { 1086 WARN("missing .rela.discard.unwind_hints section"); 1087 return -1; 1088 } 1089 1090 if (sec->len % sizeof(struct unwind_hint)) { 1091 WARN("struct unwind_hint size mismatch"); 1092 return -1; 1093 } 1094 1095 file->hints = true; 1096 1097 for (i = 0; i < sec->len / sizeof(struct unwind_hint); i++) { 1098 hint = (struct unwind_hint *)sec->data->d_buf + i; 1099 1100 rela = find_rela_by_dest(sec, i * sizeof(*hint)); 1101 if (!rela) { 1102 WARN("can't find rela for unwind_hints[%d]", i); 1103 return -1; 1104 } 1105 1106 insn = find_insn(file, rela->sym->sec, rela->addend); 1107 if (!insn) { 1108 WARN("can't find insn for unwind_hints[%d]", i); 1109 return -1; 1110 } 1111 1112 cfa = &insn->state.cfa; 1113 1114 if (hint->type == UNWIND_HINT_TYPE_SAVE) { 1115 insn->save = true; 1116 continue; 1117 1118 } else if (hint->type == UNWIND_HINT_TYPE_RESTORE) { 1119 insn->restore = true; 1120 insn->hint = true; 1121 continue; 1122 } 1123 1124 insn->hint = true; 1125 1126 switch (hint->sp_reg) { 1127 case ORC_REG_UNDEFINED: 1128 cfa->base = CFI_UNDEFINED; 1129 break; 1130 case ORC_REG_SP: 1131 cfa->base = CFI_SP; 1132 break; 1133 case ORC_REG_BP: 1134 cfa->base = CFI_BP; 1135 break; 1136 case ORC_REG_SP_INDIRECT: 1137 cfa->base = CFI_SP_INDIRECT; 1138 break; 1139 case ORC_REG_R10: 1140 cfa->base = CFI_R10; 1141 break; 1142 case ORC_REG_R13: 1143 cfa->base = CFI_R13; 1144 break; 1145 case ORC_REG_DI: 1146 cfa->base = CFI_DI; 1147 break; 1148 case ORC_REG_DX: 1149 cfa->base = CFI_DX; 1150 break; 1151 default: 1152 WARN_FUNC("unsupported unwind_hint sp base reg %d", 1153 insn->sec, insn->offset, hint->sp_reg); 1154 return -1; 1155 } 1156 1157 cfa->offset = hint->sp_offset; 1158 insn->state.type = hint->type; 1159 } 1160 1161 return 0; 1162 } 1163 1164 static int read_retpoline_hints(struct objtool_file *file) 1165 { 1166 struct section *sec; 1167 struct instruction *insn; 1168 struct rela *rela; 1169 1170 sec = find_section_by_name(file->elf, ".rela.discard.retpoline_safe"); 1171 if (!sec) 1172 return 0; 1173 1174 list_for_each_entry(rela, &sec->rela_list, list) { 1175 if (rela->sym->type != STT_SECTION) { 1176 WARN("unexpected relocation symbol type in %s", sec->name); 1177 return -1; 1178 } 1179 1180 insn = find_insn(file, rela->sym->sec, rela->addend); 1181 if (!insn) { 1182 WARN("bad .discard.retpoline_safe entry"); 1183 return -1; 1184 } 1185 1186 if (insn->type != INSN_JUMP_DYNAMIC && 1187 insn->type != INSN_CALL_DYNAMIC) { 1188 WARN_FUNC("retpoline_safe hint not an indirect jump/call", 1189 insn->sec, insn->offset); 1190 return -1; 1191 } 1192 1193 insn->retpoline_safe = true; 1194 } 1195 1196 return 0; 1197 } 1198 1199 static int decode_sections(struct objtool_file *file) 1200 { 1201 int ret; 1202 1203 ret = decode_instructions(file); 1204 if (ret) 1205 return ret; 1206 1207 ret = add_dead_ends(file); 1208 if (ret) 1209 return ret; 1210 1211 add_ignores(file); 1212 1213 ret = add_nospec_ignores(file); 1214 if (ret) 1215 return ret; 1216 1217 ret = add_jump_destinations(file); 1218 if (ret) 1219 return ret; 1220 1221 ret = add_special_section_alts(file); 1222 if (ret) 1223 return ret; 1224 1225 ret = add_call_destinations(file); 1226 if (ret) 1227 return ret; 1228 1229 ret = add_switch_table_alts(file); 1230 if (ret) 1231 return ret; 1232 1233 ret = read_unwind_hints(file); 1234 if (ret) 1235 return ret; 1236 1237 ret = read_retpoline_hints(file); 1238 if (ret) 1239 return ret; 1240 1241 return 0; 1242 } 1243 1244 static bool is_fentry_call(struct instruction *insn) 1245 { 1246 if (insn->type == INSN_CALL && 1247 insn->call_dest->type == STT_NOTYPE && 1248 !strcmp(insn->call_dest->name, "__fentry__")) 1249 return true; 1250 1251 return false; 1252 } 1253 1254 static bool has_modified_stack_frame(struct insn_state *state) 1255 { 1256 int i; 1257 1258 if (state->cfa.base != initial_func_cfi.cfa.base || 1259 state->cfa.offset != initial_func_cfi.cfa.offset || 1260 state->stack_size != initial_func_cfi.cfa.offset || 1261 state->drap) 1262 return true; 1263 1264 for (i = 0; i < CFI_NUM_REGS; i++) 1265 if (state->regs[i].base != initial_func_cfi.regs[i].base || 1266 state->regs[i].offset != initial_func_cfi.regs[i].offset) 1267 return true; 1268 1269 return false; 1270 } 1271 1272 static bool has_valid_stack_frame(struct insn_state *state) 1273 { 1274 if (state->cfa.base == CFI_BP && state->regs[CFI_BP].base == CFI_CFA && 1275 state->regs[CFI_BP].offset == -16) 1276 return true; 1277 1278 if (state->drap && state->regs[CFI_BP].base == CFI_BP) 1279 return true; 1280 1281 return false; 1282 } 1283 1284 static int update_insn_state_regs(struct instruction *insn, struct insn_state *state) 1285 { 1286 struct cfi_reg *cfa = &state->cfa; 1287 struct stack_op *op = &insn->stack_op; 1288 1289 if (cfa->base != CFI_SP) 1290 return 0; 1291 1292 /* push */ 1293 if (op->dest.type == OP_DEST_PUSH) 1294 cfa->offset += 8; 1295 1296 /* pop */ 1297 if (op->src.type == OP_SRC_POP) 1298 cfa->offset -= 8; 1299 1300 /* add immediate to sp */ 1301 if (op->dest.type == OP_DEST_REG && op->src.type == OP_SRC_ADD && 1302 op->dest.reg == CFI_SP && op->src.reg == CFI_SP) 1303 cfa->offset -= op->src.offset; 1304 1305 return 0; 1306 } 1307 1308 static void save_reg(struct insn_state *state, unsigned char reg, int base, 1309 int offset) 1310 { 1311 if (arch_callee_saved_reg(reg) && 1312 state->regs[reg].base == CFI_UNDEFINED) { 1313 state->regs[reg].base = base; 1314 state->regs[reg].offset = offset; 1315 } 1316 } 1317 1318 static void restore_reg(struct insn_state *state, unsigned char reg) 1319 { 1320 state->regs[reg].base = CFI_UNDEFINED; 1321 state->regs[reg].offset = 0; 1322 } 1323 1324 /* 1325 * A note about DRAP stack alignment: 1326 * 1327 * GCC has the concept of a DRAP register, which is used to help keep track of 1328 * the stack pointer when aligning the stack. r10 or r13 is used as the DRAP 1329 * register. The typical DRAP pattern is: 1330 * 1331 * 4c 8d 54 24 08 lea 0x8(%rsp),%r10 1332 * 48 83 e4 c0 and $0xffffffffffffffc0,%rsp 1333 * 41 ff 72 f8 pushq -0x8(%r10) 1334 * 55 push %rbp 1335 * 48 89 e5 mov %rsp,%rbp 1336 * (more pushes) 1337 * 41 52 push %r10 1338 * ... 1339 * 41 5a pop %r10 1340 * (more pops) 1341 * 5d pop %rbp 1342 * 49 8d 62 f8 lea -0x8(%r10),%rsp 1343 * c3 retq 1344 * 1345 * There are some variations in the epilogues, like: 1346 * 1347 * 5b pop %rbx 1348 * 41 5a pop %r10 1349 * 41 5c pop %r12 1350 * 41 5d pop %r13 1351 * 41 5e pop %r14 1352 * c9 leaveq 1353 * 49 8d 62 f8 lea -0x8(%r10),%rsp 1354 * c3 retq 1355 * 1356 * and: 1357 * 1358 * 4c 8b 55 e8 mov -0x18(%rbp),%r10 1359 * 48 8b 5d e0 mov -0x20(%rbp),%rbx 1360 * 4c 8b 65 f0 mov -0x10(%rbp),%r12 1361 * 4c 8b 6d f8 mov -0x8(%rbp),%r13 1362 * c9 leaveq 1363 * 49 8d 62 f8 lea -0x8(%r10),%rsp 1364 * c3 retq 1365 * 1366 * Sometimes r13 is used as the DRAP register, in which case it's saved and 1367 * restored beforehand: 1368 * 1369 * 41 55 push %r13 1370 * 4c 8d 6c 24 10 lea 0x10(%rsp),%r13 1371 * 48 83 e4 f0 and $0xfffffffffffffff0,%rsp 1372 * ... 1373 * 49 8d 65 f0 lea -0x10(%r13),%rsp 1374 * 41 5d pop %r13 1375 * c3 retq 1376 */ 1377 static int update_insn_state(struct instruction *insn, struct insn_state *state) 1378 { 1379 struct stack_op *op = &insn->stack_op; 1380 struct cfi_reg *cfa = &state->cfa; 1381 struct cfi_reg *regs = state->regs; 1382 1383 /* stack operations don't make sense with an undefined CFA */ 1384 if (cfa->base == CFI_UNDEFINED) { 1385 if (insn->func) { 1386 WARN_FUNC("undefined stack state", insn->sec, insn->offset); 1387 return -1; 1388 } 1389 return 0; 1390 } 1391 1392 if (state->type == ORC_TYPE_REGS || state->type == ORC_TYPE_REGS_IRET) 1393 return update_insn_state_regs(insn, state); 1394 1395 switch (op->dest.type) { 1396 1397 case OP_DEST_REG: 1398 switch (op->src.type) { 1399 1400 case OP_SRC_REG: 1401 if (op->src.reg == CFI_SP && op->dest.reg == CFI_BP && 1402 cfa->base == CFI_SP && 1403 regs[CFI_BP].base == CFI_CFA && 1404 regs[CFI_BP].offset == -cfa->offset) { 1405 1406 /* mov %rsp, %rbp */ 1407 cfa->base = op->dest.reg; 1408 state->bp_scratch = false; 1409 } 1410 1411 else if (op->src.reg == CFI_SP && 1412 op->dest.reg == CFI_BP && state->drap) { 1413 1414 /* drap: mov %rsp, %rbp */ 1415 regs[CFI_BP].base = CFI_BP; 1416 regs[CFI_BP].offset = -state->stack_size; 1417 state->bp_scratch = false; 1418 } 1419 1420 else if (op->src.reg == CFI_SP && cfa->base == CFI_SP) { 1421 1422 /* 1423 * mov %rsp, %reg 1424 * 1425 * This is needed for the rare case where GCC 1426 * does: 1427 * 1428 * mov %rsp, %rax 1429 * ... 1430 * mov %rax, %rsp 1431 */ 1432 state->vals[op->dest.reg].base = CFI_CFA; 1433 state->vals[op->dest.reg].offset = -state->stack_size; 1434 } 1435 1436 else if (op->src.reg == CFI_BP && op->dest.reg == CFI_SP && 1437 cfa->base == CFI_BP) { 1438 1439 /* 1440 * mov %rbp, %rsp 1441 * 1442 * Restore the original stack pointer (Clang). 1443 */ 1444 state->stack_size = -state->regs[CFI_BP].offset; 1445 } 1446 1447 else if (op->dest.reg == cfa->base) { 1448 1449 /* mov %reg, %rsp */ 1450 if (cfa->base == CFI_SP && 1451 state->vals[op->src.reg].base == CFI_CFA) { 1452 1453 /* 1454 * This is needed for the rare case 1455 * where GCC does something dumb like: 1456 * 1457 * lea 0x8(%rsp), %rcx 1458 * ... 1459 * mov %rcx, %rsp 1460 */ 1461 cfa->offset = -state->vals[op->src.reg].offset; 1462 state->stack_size = cfa->offset; 1463 1464 } else { 1465 cfa->base = CFI_UNDEFINED; 1466 cfa->offset = 0; 1467 } 1468 } 1469 1470 break; 1471 1472 case OP_SRC_ADD: 1473 if (op->dest.reg == CFI_SP && op->src.reg == CFI_SP) { 1474 1475 /* add imm, %rsp */ 1476 state->stack_size -= op->src.offset; 1477 if (cfa->base == CFI_SP) 1478 cfa->offset -= op->src.offset; 1479 break; 1480 } 1481 1482 if (op->dest.reg == CFI_SP && op->src.reg == CFI_BP) { 1483 1484 /* lea disp(%rbp), %rsp */ 1485 state->stack_size = -(op->src.offset + regs[CFI_BP].offset); 1486 break; 1487 } 1488 1489 if (op->src.reg == CFI_SP && cfa->base == CFI_SP) { 1490 1491 /* drap: lea disp(%rsp), %drap */ 1492 state->drap_reg = op->dest.reg; 1493 1494 /* 1495 * lea disp(%rsp), %reg 1496 * 1497 * This is needed for the rare case where GCC 1498 * does something dumb like: 1499 * 1500 * lea 0x8(%rsp), %rcx 1501 * ... 1502 * mov %rcx, %rsp 1503 */ 1504 state->vals[op->dest.reg].base = CFI_CFA; 1505 state->vals[op->dest.reg].offset = \ 1506 -state->stack_size + op->src.offset; 1507 1508 break; 1509 } 1510 1511 if (state->drap && op->dest.reg == CFI_SP && 1512 op->src.reg == state->drap_reg) { 1513 1514 /* drap: lea disp(%drap), %rsp */ 1515 cfa->base = CFI_SP; 1516 cfa->offset = state->stack_size = -op->src.offset; 1517 state->drap_reg = CFI_UNDEFINED; 1518 state->drap = false; 1519 break; 1520 } 1521 1522 if (op->dest.reg == state->cfa.base) { 1523 WARN_FUNC("unsupported stack register modification", 1524 insn->sec, insn->offset); 1525 return -1; 1526 } 1527 1528 break; 1529 1530 case OP_SRC_AND: 1531 if (op->dest.reg != CFI_SP || 1532 (state->drap_reg != CFI_UNDEFINED && cfa->base != CFI_SP) || 1533 (state->drap_reg == CFI_UNDEFINED && cfa->base != CFI_BP)) { 1534 WARN_FUNC("unsupported stack pointer realignment", 1535 insn->sec, insn->offset); 1536 return -1; 1537 } 1538 1539 if (state->drap_reg != CFI_UNDEFINED) { 1540 /* drap: and imm, %rsp */ 1541 cfa->base = state->drap_reg; 1542 cfa->offset = state->stack_size = 0; 1543 state->drap = true; 1544 } 1545 1546 /* 1547 * Older versions of GCC (4.8ish) realign the stack 1548 * without DRAP, with a frame pointer. 1549 */ 1550 1551 break; 1552 1553 case OP_SRC_POP: 1554 if (!state->drap && op->dest.type == OP_DEST_REG && 1555 op->dest.reg == cfa->base) { 1556 1557 /* pop %rbp */ 1558 cfa->base = CFI_SP; 1559 } 1560 1561 if (state->drap && cfa->base == CFI_BP_INDIRECT && 1562 op->dest.type == OP_DEST_REG && 1563 op->dest.reg == state->drap_reg && 1564 state->drap_offset == -state->stack_size) { 1565 1566 /* drap: pop %drap */ 1567 cfa->base = state->drap_reg; 1568 cfa->offset = 0; 1569 state->drap_offset = -1; 1570 1571 } else if (regs[op->dest.reg].offset == -state->stack_size) { 1572 1573 /* pop %reg */ 1574 restore_reg(state, op->dest.reg); 1575 } 1576 1577 state->stack_size -= 8; 1578 if (cfa->base == CFI_SP) 1579 cfa->offset -= 8; 1580 1581 break; 1582 1583 case OP_SRC_REG_INDIRECT: 1584 if (state->drap && op->src.reg == CFI_BP && 1585 op->src.offset == state->drap_offset) { 1586 1587 /* drap: mov disp(%rbp), %drap */ 1588 cfa->base = state->drap_reg; 1589 cfa->offset = 0; 1590 state->drap_offset = -1; 1591 } 1592 1593 if (state->drap && op->src.reg == CFI_BP && 1594 op->src.offset == regs[op->dest.reg].offset) { 1595 1596 /* drap: mov disp(%rbp), %reg */ 1597 restore_reg(state, op->dest.reg); 1598 1599 } else if (op->src.reg == cfa->base && 1600 op->src.offset == regs[op->dest.reg].offset + cfa->offset) { 1601 1602 /* mov disp(%rbp), %reg */ 1603 /* mov disp(%rsp), %reg */ 1604 restore_reg(state, op->dest.reg); 1605 } 1606 1607 break; 1608 1609 default: 1610 WARN_FUNC("unknown stack-related instruction", 1611 insn->sec, insn->offset); 1612 return -1; 1613 } 1614 1615 break; 1616 1617 case OP_DEST_PUSH: 1618 state->stack_size += 8; 1619 if (cfa->base == CFI_SP) 1620 cfa->offset += 8; 1621 1622 if (op->src.type != OP_SRC_REG) 1623 break; 1624 1625 if (state->drap) { 1626 if (op->src.reg == cfa->base && op->src.reg == state->drap_reg) { 1627 1628 /* drap: push %drap */ 1629 cfa->base = CFI_BP_INDIRECT; 1630 cfa->offset = -state->stack_size; 1631 1632 /* save drap so we know when to restore it */ 1633 state->drap_offset = -state->stack_size; 1634 1635 } else if (op->src.reg == CFI_BP && cfa->base == state->drap_reg) { 1636 1637 /* drap: push %rbp */ 1638 state->stack_size = 0; 1639 1640 } else if (regs[op->src.reg].base == CFI_UNDEFINED) { 1641 1642 /* drap: push %reg */ 1643 save_reg(state, op->src.reg, CFI_BP, -state->stack_size); 1644 } 1645 1646 } else { 1647 1648 /* push %reg */ 1649 save_reg(state, op->src.reg, CFI_CFA, -state->stack_size); 1650 } 1651 1652 /* detect when asm code uses rbp as a scratch register */ 1653 if (!no_fp && insn->func && op->src.reg == CFI_BP && 1654 cfa->base != CFI_BP) 1655 state->bp_scratch = true; 1656 break; 1657 1658 case OP_DEST_REG_INDIRECT: 1659 1660 if (state->drap) { 1661 if (op->src.reg == cfa->base && op->src.reg == state->drap_reg) { 1662 1663 /* drap: mov %drap, disp(%rbp) */ 1664 cfa->base = CFI_BP_INDIRECT; 1665 cfa->offset = op->dest.offset; 1666 1667 /* save drap offset so we know when to restore it */ 1668 state->drap_offset = op->dest.offset; 1669 } 1670 1671 else if (regs[op->src.reg].base == CFI_UNDEFINED) { 1672 1673 /* drap: mov reg, disp(%rbp) */ 1674 save_reg(state, op->src.reg, CFI_BP, op->dest.offset); 1675 } 1676 1677 } else if (op->dest.reg == cfa->base) { 1678 1679 /* mov reg, disp(%rbp) */ 1680 /* mov reg, disp(%rsp) */ 1681 save_reg(state, op->src.reg, CFI_CFA, 1682 op->dest.offset - state->cfa.offset); 1683 } 1684 1685 break; 1686 1687 case OP_DEST_LEAVE: 1688 if ((!state->drap && cfa->base != CFI_BP) || 1689 (state->drap && cfa->base != state->drap_reg)) { 1690 WARN_FUNC("leave instruction with modified stack frame", 1691 insn->sec, insn->offset); 1692 return -1; 1693 } 1694 1695 /* leave (mov %rbp, %rsp; pop %rbp) */ 1696 1697 state->stack_size = -state->regs[CFI_BP].offset - 8; 1698 restore_reg(state, CFI_BP); 1699 1700 if (!state->drap) { 1701 cfa->base = CFI_SP; 1702 cfa->offset -= 8; 1703 } 1704 1705 break; 1706 1707 case OP_DEST_MEM: 1708 if (op->src.type != OP_SRC_POP) { 1709 WARN_FUNC("unknown stack-related memory operation", 1710 insn->sec, insn->offset); 1711 return -1; 1712 } 1713 1714 /* pop mem */ 1715 state->stack_size -= 8; 1716 if (cfa->base == CFI_SP) 1717 cfa->offset -= 8; 1718 1719 break; 1720 1721 default: 1722 WARN_FUNC("unknown stack-related instruction", 1723 insn->sec, insn->offset); 1724 return -1; 1725 } 1726 1727 return 0; 1728 } 1729 1730 static bool insn_state_match(struct instruction *insn, struct insn_state *state) 1731 { 1732 struct insn_state *state1 = &insn->state, *state2 = state; 1733 int i; 1734 1735 if (memcmp(&state1->cfa, &state2->cfa, sizeof(state1->cfa))) { 1736 WARN_FUNC("stack state mismatch: cfa1=%d%+d cfa2=%d%+d", 1737 insn->sec, insn->offset, 1738 state1->cfa.base, state1->cfa.offset, 1739 state2->cfa.base, state2->cfa.offset); 1740 1741 } else if (memcmp(&state1->regs, &state2->regs, sizeof(state1->regs))) { 1742 for (i = 0; i < CFI_NUM_REGS; i++) { 1743 if (!memcmp(&state1->regs[i], &state2->regs[i], 1744 sizeof(struct cfi_reg))) 1745 continue; 1746 1747 WARN_FUNC("stack state mismatch: reg1[%d]=%d%+d reg2[%d]=%d%+d", 1748 insn->sec, insn->offset, 1749 i, state1->regs[i].base, state1->regs[i].offset, 1750 i, state2->regs[i].base, state2->regs[i].offset); 1751 break; 1752 } 1753 1754 } else if (state1->type != state2->type) { 1755 WARN_FUNC("stack state mismatch: type1=%d type2=%d", 1756 insn->sec, insn->offset, state1->type, state2->type); 1757 1758 } else if (state1->drap != state2->drap || 1759 (state1->drap && state1->drap_reg != state2->drap_reg) || 1760 (state1->drap && state1->drap_offset != state2->drap_offset)) { 1761 WARN_FUNC("stack state mismatch: drap1=%d(%d,%d) drap2=%d(%d,%d)", 1762 insn->sec, insn->offset, 1763 state1->drap, state1->drap_reg, state1->drap_offset, 1764 state2->drap, state2->drap_reg, state2->drap_offset); 1765 1766 } else 1767 return true; 1768 1769 return false; 1770 } 1771 1772 /* 1773 * Follow the branch starting at the given instruction, and recursively follow 1774 * any other branches (jumps). Meanwhile, track the frame pointer state at 1775 * each instruction and validate all the rules described in 1776 * tools/objtool/Documentation/stack-validation.txt. 1777 */ 1778 static int validate_branch(struct objtool_file *file, struct instruction *first, 1779 struct insn_state state) 1780 { 1781 struct alternative *alt; 1782 struct instruction *insn, *next_insn; 1783 struct section *sec; 1784 struct symbol *func = NULL; 1785 int ret; 1786 1787 insn = first; 1788 sec = insn->sec; 1789 1790 if (insn->alt_group && list_empty(&insn->alts)) { 1791 WARN_FUNC("don't know how to handle branch to middle of alternative instruction group", 1792 sec, insn->offset); 1793 return 1; 1794 } 1795 1796 while (1) { 1797 next_insn = next_insn_same_sec(file, insn); 1798 1799 if (file->c_file && func && insn->func && func != insn->func->pfunc) { 1800 WARN("%s() falls through to next function %s()", 1801 func->name, insn->func->name); 1802 return 1; 1803 } 1804 1805 func = insn->func ? insn->func->pfunc : NULL; 1806 1807 if (func && insn->ignore) { 1808 WARN_FUNC("BUG: why am I validating an ignored function?", 1809 sec, insn->offset); 1810 return 1; 1811 } 1812 1813 if (insn->visited) { 1814 if (!insn->hint && !insn_state_match(insn, &state)) 1815 return 1; 1816 1817 return 0; 1818 } 1819 1820 if (insn->hint) { 1821 if (insn->restore) { 1822 struct instruction *save_insn, *i; 1823 1824 i = insn; 1825 save_insn = NULL; 1826 func_for_each_insn_continue_reverse(file, insn->func, i) { 1827 if (i->save) { 1828 save_insn = i; 1829 break; 1830 } 1831 } 1832 1833 if (!save_insn) { 1834 WARN_FUNC("no corresponding CFI save for CFI restore", 1835 sec, insn->offset); 1836 return 1; 1837 } 1838 1839 if (!save_insn->visited) { 1840 /* 1841 * Oops, no state to copy yet. 1842 * Hopefully we can reach this 1843 * instruction from another branch 1844 * after the save insn has been 1845 * visited. 1846 */ 1847 if (insn == first) 1848 return 0; 1849 1850 WARN_FUNC("objtool isn't smart enough to handle this CFI save/restore combo", 1851 sec, insn->offset); 1852 return 1; 1853 } 1854 1855 insn->state = save_insn->state; 1856 } 1857 1858 state = insn->state; 1859 1860 } else 1861 insn->state = state; 1862 1863 insn->visited = true; 1864 1865 if (!insn->ignore_alts) { 1866 list_for_each_entry(alt, &insn->alts, list) { 1867 ret = validate_branch(file, alt->insn, state); 1868 if (ret) 1869 return 1; 1870 } 1871 } 1872 1873 switch (insn->type) { 1874 1875 case INSN_RETURN: 1876 if (func && has_modified_stack_frame(&state)) { 1877 WARN_FUNC("return with modified stack frame", 1878 sec, insn->offset); 1879 return 1; 1880 } 1881 1882 if (state.bp_scratch) { 1883 WARN("%s uses BP as a scratch register", 1884 insn->func->name); 1885 return 1; 1886 } 1887 1888 return 0; 1889 1890 case INSN_CALL: 1891 if (is_fentry_call(insn)) 1892 break; 1893 1894 ret = dead_end_function(file, insn->call_dest); 1895 if (ret == 1) 1896 return 0; 1897 if (ret == -1) 1898 return 1; 1899 1900 /* fallthrough */ 1901 case INSN_CALL_DYNAMIC: 1902 if (!no_fp && func && !has_valid_stack_frame(&state)) { 1903 WARN_FUNC("call without frame pointer save/setup", 1904 sec, insn->offset); 1905 return 1; 1906 } 1907 break; 1908 1909 case INSN_JUMP_CONDITIONAL: 1910 case INSN_JUMP_UNCONDITIONAL: 1911 if (insn->jump_dest && 1912 (!func || !insn->jump_dest->func || 1913 insn->jump_dest->func->pfunc == func)) { 1914 ret = validate_branch(file, insn->jump_dest, 1915 state); 1916 if (ret) 1917 return 1; 1918 1919 } else if (func && has_modified_stack_frame(&state)) { 1920 WARN_FUNC("sibling call from callable instruction with modified stack frame", 1921 sec, insn->offset); 1922 return 1; 1923 } 1924 1925 if (insn->type == INSN_JUMP_UNCONDITIONAL) 1926 return 0; 1927 1928 break; 1929 1930 case INSN_JUMP_DYNAMIC: 1931 if (func && list_empty(&insn->alts) && 1932 has_modified_stack_frame(&state)) { 1933 WARN_FUNC("sibling call from callable instruction with modified stack frame", 1934 sec, insn->offset); 1935 return 1; 1936 } 1937 1938 return 0; 1939 1940 case INSN_CONTEXT_SWITCH: 1941 if (func && (!next_insn || !next_insn->hint)) { 1942 WARN_FUNC("unsupported instruction in callable function", 1943 sec, insn->offset); 1944 return 1; 1945 } 1946 return 0; 1947 1948 case INSN_STACK: 1949 if (update_insn_state(insn, &state)) 1950 return 1; 1951 1952 break; 1953 1954 default: 1955 break; 1956 } 1957 1958 if (insn->dead_end) 1959 return 0; 1960 1961 if (!next_insn) { 1962 if (state.cfa.base == CFI_UNDEFINED) 1963 return 0; 1964 WARN("%s: unexpected end of section", sec->name); 1965 return 1; 1966 } 1967 1968 insn = next_insn; 1969 } 1970 1971 return 0; 1972 } 1973 1974 static int validate_unwind_hints(struct objtool_file *file) 1975 { 1976 struct instruction *insn; 1977 int ret, warnings = 0; 1978 struct insn_state state; 1979 1980 if (!file->hints) 1981 return 0; 1982 1983 clear_insn_state(&state); 1984 1985 for_each_insn(file, insn) { 1986 if (insn->hint && !insn->visited) { 1987 ret = validate_branch(file, insn, state); 1988 warnings += ret; 1989 } 1990 } 1991 1992 return warnings; 1993 } 1994 1995 static int validate_retpoline(struct objtool_file *file) 1996 { 1997 struct instruction *insn; 1998 int warnings = 0; 1999 2000 for_each_insn(file, insn) { 2001 if (insn->type != INSN_JUMP_DYNAMIC && 2002 insn->type != INSN_CALL_DYNAMIC) 2003 continue; 2004 2005 if (insn->retpoline_safe) 2006 continue; 2007 2008 /* 2009 * .init.text code is ran before userspace and thus doesn't 2010 * strictly need retpolines, except for modules which are 2011 * loaded late, they very much do need retpoline in their 2012 * .init.text 2013 */ 2014 if (!strcmp(insn->sec->name, ".init.text") && !module) 2015 continue; 2016 2017 WARN_FUNC("indirect %s found in RETPOLINE build", 2018 insn->sec, insn->offset, 2019 insn->type == INSN_JUMP_DYNAMIC ? "jump" : "call"); 2020 2021 warnings++; 2022 } 2023 2024 return warnings; 2025 } 2026 2027 static bool is_kasan_insn(struct instruction *insn) 2028 { 2029 return (insn->type == INSN_CALL && 2030 !strcmp(insn->call_dest->name, "__asan_handle_no_return")); 2031 } 2032 2033 static bool is_ubsan_insn(struct instruction *insn) 2034 { 2035 return (insn->type == INSN_CALL && 2036 !strcmp(insn->call_dest->name, 2037 "__ubsan_handle_builtin_unreachable")); 2038 } 2039 2040 static bool ignore_unreachable_insn(struct instruction *insn) 2041 { 2042 int i; 2043 2044 if (insn->ignore || insn->type == INSN_NOP) 2045 return true; 2046 2047 /* 2048 * Ignore any unused exceptions. This can happen when a whitelisted 2049 * function has an exception table entry. 2050 * 2051 * Also ignore alternative replacement instructions. This can happen 2052 * when a whitelisted function uses one of the ALTERNATIVE macros. 2053 */ 2054 if (!strcmp(insn->sec->name, ".fixup") || 2055 !strcmp(insn->sec->name, ".altinstr_replacement") || 2056 !strcmp(insn->sec->name, ".altinstr_aux")) 2057 return true; 2058 2059 /* 2060 * Check if this (or a subsequent) instruction is related to 2061 * CONFIG_UBSAN or CONFIG_KASAN. 2062 * 2063 * End the search at 5 instructions to avoid going into the weeds. 2064 */ 2065 if (!insn->func) 2066 return false; 2067 for (i = 0; i < 5; i++) { 2068 2069 if (is_kasan_insn(insn) || is_ubsan_insn(insn)) 2070 return true; 2071 2072 if (insn->type == INSN_JUMP_UNCONDITIONAL) { 2073 if (insn->jump_dest && 2074 insn->jump_dest->func == insn->func) { 2075 insn = insn->jump_dest; 2076 continue; 2077 } 2078 2079 break; 2080 } 2081 2082 if (insn->offset + insn->len >= insn->func->offset + insn->func->len) 2083 break; 2084 2085 insn = list_next_entry(insn, list); 2086 } 2087 2088 return false; 2089 } 2090 2091 static int validate_functions(struct objtool_file *file) 2092 { 2093 struct section *sec; 2094 struct symbol *func; 2095 struct instruction *insn; 2096 struct insn_state state; 2097 int ret, warnings = 0; 2098 2099 clear_insn_state(&state); 2100 2101 state.cfa = initial_func_cfi.cfa; 2102 memcpy(&state.regs, &initial_func_cfi.regs, 2103 CFI_NUM_REGS * sizeof(struct cfi_reg)); 2104 state.stack_size = initial_func_cfi.cfa.offset; 2105 2106 for_each_sec(file, sec) { 2107 list_for_each_entry(func, &sec->symbol_list, list) { 2108 if (func->type != STT_FUNC || func->pfunc != func) 2109 continue; 2110 2111 insn = find_insn(file, sec, func->offset); 2112 if (!insn || insn->ignore) 2113 continue; 2114 2115 ret = validate_branch(file, insn, state); 2116 warnings += ret; 2117 } 2118 } 2119 2120 return warnings; 2121 } 2122 2123 static int validate_reachable_instructions(struct objtool_file *file) 2124 { 2125 struct instruction *insn; 2126 2127 if (file->ignore_unreachables) 2128 return 0; 2129 2130 for_each_insn(file, insn) { 2131 if (insn->visited || ignore_unreachable_insn(insn)) 2132 continue; 2133 2134 WARN_FUNC("unreachable instruction", insn->sec, insn->offset); 2135 return 1; 2136 } 2137 2138 return 0; 2139 } 2140 2141 static void cleanup(struct objtool_file *file) 2142 { 2143 struct instruction *insn, *tmpinsn; 2144 struct alternative *alt, *tmpalt; 2145 2146 list_for_each_entry_safe(insn, tmpinsn, &file->insn_list, list) { 2147 list_for_each_entry_safe(alt, tmpalt, &insn->alts, list) { 2148 list_del(&alt->list); 2149 free(alt); 2150 } 2151 list_del(&insn->list); 2152 hash_del(&insn->hash); 2153 free(insn); 2154 } 2155 elf_close(file->elf); 2156 } 2157 2158 int check(const char *_objname, bool orc) 2159 { 2160 struct objtool_file file; 2161 int ret, warnings = 0; 2162 2163 objname = _objname; 2164 2165 file.elf = elf_open(objname, orc ? O_RDWR : O_RDONLY); 2166 if (!file.elf) 2167 return 1; 2168 2169 INIT_LIST_HEAD(&file.insn_list); 2170 hash_init(file.insn_hash); 2171 file.whitelist = find_section_by_name(file.elf, ".discard.func_stack_frame_non_standard"); 2172 file.rodata = find_section_by_name(file.elf, ".rodata"); 2173 file.c_file = find_section_by_name(file.elf, ".comment"); 2174 file.ignore_unreachables = no_unreachable; 2175 file.hints = false; 2176 2177 arch_initial_func_cfi_state(&initial_func_cfi); 2178 2179 ret = decode_sections(&file); 2180 if (ret < 0) 2181 goto out; 2182 warnings += ret; 2183 2184 if (list_empty(&file.insn_list)) 2185 goto out; 2186 2187 if (retpoline) { 2188 ret = validate_retpoline(&file); 2189 if (ret < 0) 2190 return ret; 2191 warnings += ret; 2192 } 2193 2194 ret = validate_functions(&file); 2195 if (ret < 0) 2196 goto out; 2197 warnings += ret; 2198 2199 ret = validate_unwind_hints(&file); 2200 if (ret < 0) 2201 goto out; 2202 warnings += ret; 2203 2204 if (!warnings) { 2205 ret = validate_reachable_instructions(&file); 2206 if (ret < 0) 2207 goto out; 2208 warnings += ret; 2209 } 2210 2211 if (orc) { 2212 ret = create_orc(&file); 2213 if (ret < 0) 2214 goto out; 2215 2216 ret = create_orc_sections(&file); 2217 if (ret < 0) 2218 goto out; 2219 2220 ret = elf_write(file.elf); 2221 if (ret < 0) 2222 goto out; 2223 } 2224 2225 out: 2226 cleanup(&file); 2227 2228 /* ignore warnings for now until we get all the code cleaned up */ 2229 if (ret || warnings) 2230 return 0; 2231 return 0; 2232 } 2233