1 /* 2 * Copyright (C) 2015-2017 Josh Poimboeuf <jpoimboe@redhat.com> 3 * 4 * This program is free software; you can redistribute it and/or 5 * modify it under the terms of the GNU General Public License 6 * as published by the Free Software Foundation; either version 2 7 * of the License, or (at your option) any later version. 8 * 9 * This program is distributed in the hope that it will be useful, 10 * but WITHOUT ANY WARRANTY; without even the implied warranty of 11 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 12 * GNU General Public License for more details. 13 * 14 * You should have received a copy of the GNU General Public License 15 * along with this program; if not, see <http://www.gnu.org/licenses/>. 16 */ 17 18 #include <string.h> 19 #include <stdlib.h> 20 21 #include "check.h" 22 #include "elf.h" 23 #include "special.h" 24 #include "arch.h" 25 #include "warn.h" 26 27 #include <linux/hashtable.h> 28 #include <linux/kernel.h> 29 30 struct alternative { 31 struct list_head list; 32 struct instruction *insn; 33 }; 34 35 const char *objname; 36 static bool no_fp; 37 struct cfi_state initial_func_cfi; 38 39 struct instruction *find_insn(struct objtool_file *file, 40 struct section *sec, unsigned long offset) 41 { 42 struct instruction *insn; 43 44 hash_for_each_possible(file->insn_hash, insn, hash, offset) 45 if (insn->sec == sec && insn->offset == offset) 46 return insn; 47 48 return NULL; 49 } 50 51 static struct instruction *next_insn_same_sec(struct objtool_file *file, 52 struct instruction *insn) 53 { 54 struct instruction *next = list_next_entry(insn, list); 55 56 if (!next || &next->list == &file->insn_list || next->sec != insn->sec) 57 return NULL; 58 59 return next; 60 } 61 62 #define func_for_each_insn(file, func, insn) \ 63 for (insn = find_insn(file, func->sec, func->offset); \ 64 insn && &insn->list != &file->insn_list && \ 65 insn->sec == func->sec && \ 66 insn->offset < func->offset + func->len; \ 67 insn = list_next_entry(insn, list)) 68 69 #define func_for_each_insn_continue_reverse(file, func, insn) \ 70 for (insn = list_prev_entry(insn, list); \ 71 &insn->list != &file->insn_list && \ 72 insn->sec == func->sec && insn->offset >= func->offset; \ 73 insn = list_prev_entry(insn, list)) 74 75 #define sec_for_each_insn_from(file, insn) \ 76 for (; insn; insn = next_insn_same_sec(file, insn)) 77 78 #define sec_for_each_insn_continue(file, insn) \ 79 for (insn = next_insn_same_sec(file, insn); insn; \ 80 insn = next_insn_same_sec(file, insn)) 81 82 /* 83 * Check if the function has been manually whitelisted with the 84 * STACK_FRAME_NON_STANDARD macro, or if it should be automatically whitelisted 85 * due to its use of a context switching instruction. 86 */ 87 static bool ignore_func(struct objtool_file *file, struct symbol *func) 88 { 89 struct rela *rela; 90 91 /* check for STACK_FRAME_NON_STANDARD */ 92 if (file->whitelist && file->whitelist->rela) 93 list_for_each_entry(rela, &file->whitelist->rela->rela_list, list) { 94 if (rela->sym->type == STT_SECTION && 95 rela->sym->sec == func->sec && 96 rela->addend == func->offset) 97 return true; 98 if (rela->sym->type == STT_FUNC && rela->sym == func) 99 return true; 100 } 101 102 return false; 103 } 104 105 /* 106 * This checks to see if the given function is a "noreturn" function. 107 * 108 * For global functions which are outside the scope of this object file, we 109 * have to keep a manual list of them. 110 * 111 * For local functions, we have to detect them manually by simply looking for 112 * the lack of a return instruction. 113 * 114 * Returns: 115 * -1: error 116 * 0: no dead end 117 * 1: dead end 118 */ 119 static int __dead_end_function(struct objtool_file *file, struct symbol *func, 120 int recursion) 121 { 122 int i; 123 struct instruction *insn; 124 bool empty = true; 125 126 /* 127 * Unfortunately these have to be hard coded because the noreturn 128 * attribute isn't provided in ELF data. 129 */ 130 static const char * const global_noreturns[] = { 131 "__stack_chk_fail", 132 "panic", 133 "do_exit", 134 "do_task_dead", 135 "__module_put_and_exit", 136 "complete_and_exit", 137 "kvm_spurious_fault", 138 "__reiserfs_panic", 139 "lbug_with_loc", 140 "fortify_panic", 141 "usercopy_abort", 142 }; 143 144 if (func->bind == STB_WEAK) 145 return 0; 146 147 if (func->bind == STB_GLOBAL) 148 for (i = 0; i < ARRAY_SIZE(global_noreturns); i++) 149 if (!strcmp(func->name, global_noreturns[i])) 150 return 1; 151 152 if (!func->sec) 153 return 0; 154 155 func_for_each_insn(file, func, insn) { 156 empty = false; 157 158 if (insn->type == INSN_RETURN) 159 return 0; 160 } 161 162 if (empty) 163 return 0; 164 165 /* 166 * A function can have a sibling call instead of a return. In that 167 * case, the function's dead-end status depends on whether the target 168 * of the sibling call returns. 169 */ 170 func_for_each_insn(file, func, insn) { 171 if (insn->sec != func->sec || 172 insn->offset >= func->offset + func->len) 173 break; 174 175 if (insn->type == INSN_JUMP_UNCONDITIONAL) { 176 struct instruction *dest = insn->jump_dest; 177 struct symbol *dest_func; 178 179 if (!dest) 180 /* sibling call to another file */ 181 return 0; 182 183 if (dest->sec != func->sec || 184 dest->offset < func->offset || 185 dest->offset >= func->offset + func->len) { 186 /* local sibling call */ 187 dest_func = find_symbol_by_offset(dest->sec, 188 dest->offset); 189 if (!dest_func) 190 continue; 191 192 if (recursion == 5) { 193 WARN_FUNC("infinite recursion (objtool bug!)", 194 dest->sec, dest->offset); 195 return -1; 196 } 197 198 return __dead_end_function(file, dest_func, 199 recursion + 1); 200 } 201 } 202 203 if (insn->type == INSN_JUMP_DYNAMIC && list_empty(&insn->alts)) 204 /* sibling call */ 205 return 0; 206 } 207 208 return 1; 209 } 210 211 static int dead_end_function(struct objtool_file *file, struct symbol *func) 212 { 213 return __dead_end_function(file, func, 0); 214 } 215 216 static void clear_insn_state(struct insn_state *state) 217 { 218 int i; 219 220 memset(state, 0, sizeof(*state)); 221 state->cfa.base = CFI_UNDEFINED; 222 for (i = 0; i < CFI_NUM_REGS; i++) { 223 state->regs[i].base = CFI_UNDEFINED; 224 state->vals[i].base = CFI_UNDEFINED; 225 } 226 state->drap_reg = CFI_UNDEFINED; 227 state->drap_offset = -1; 228 } 229 230 /* 231 * Call the arch-specific instruction decoder for all the instructions and add 232 * them to the global instruction list. 233 */ 234 static int decode_instructions(struct objtool_file *file) 235 { 236 struct section *sec; 237 struct symbol *func; 238 unsigned long offset; 239 struct instruction *insn; 240 int ret; 241 242 for_each_sec(file, sec) { 243 244 if (!(sec->sh.sh_flags & SHF_EXECINSTR)) 245 continue; 246 247 if (strcmp(sec->name, ".altinstr_replacement") && 248 strcmp(sec->name, ".altinstr_aux") && 249 strncmp(sec->name, ".discard.", 9)) 250 sec->text = true; 251 252 for (offset = 0; offset < sec->len; offset += insn->len) { 253 insn = malloc(sizeof(*insn)); 254 if (!insn) { 255 WARN("malloc failed"); 256 return -1; 257 } 258 memset(insn, 0, sizeof(*insn)); 259 INIT_LIST_HEAD(&insn->alts); 260 clear_insn_state(&insn->state); 261 262 insn->sec = sec; 263 insn->offset = offset; 264 265 ret = arch_decode_instruction(file->elf, sec, offset, 266 sec->len - offset, 267 &insn->len, &insn->type, 268 &insn->immediate, 269 &insn->stack_op); 270 if (ret) 271 goto err; 272 273 if (!insn->type || insn->type > INSN_LAST) { 274 WARN_FUNC("invalid instruction type %d", 275 insn->sec, insn->offset, insn->type); 276 ret = -1; 277 goto err; 278 } 279 280 hash_add(file->insn_hash, &insn->hash, insn->offset); 281 list_add_tail(&insn->list, &file->insn_list); 282 } 283 284 list_for_each_entry(func, &sec->symbol_list, list) { 285 if (func->type != STT_FUNC) 286 continue; 287 288 if (!find_insn(file, sec, func->offset)) { 289 WARN("%s(): can't find starting instruction", 290 func->name); 291 return -1; 292 } 293 294 func_for_each_insn(file, func, insn) 295 if (!insn->func) 296 insn->func = func; 297 } 298 } 299 300 return 0; 301 302 err: 303 free(insn); 304 return ret; 305 } 306 307 /* 308 * Mark "ud2" instructions and manually annotated dead ends. 309 */ 310 static int add_dead_ends(struct objtool_file *file) 311 { 312 struct section *sec; 313 struct rela *rela; 314 struct instruction *insn; 315 bool found; 316 317 /* 318 * By default, "ud2" is a dead end unless otherwise annotated, because 319 * GCC 7 inserts it for certain divide-by-zero cases. 320 */ 321 for_each_insn(file, insn) 322 if (insn->type == INSN_BUG) 323 insn->dead_end = true; 324 325 /* 326 * Check for manually annotated dead ends. 327 */ 328 sec = find_section_by_name(file->elf, ".rela.discard.unreachable"); 329 if (!sec) 330 goto reachable; 331 332 list_for_each_entry(rela, &sec->rela_list, list) { 333 if (rela->sym->type != STT_SECTION) { 334 WARN("unexpected relocation symbol type in %s", sec->name); 335 return -1; 336 } 337 insn = find_insn(file, rela->sym->sec, rela->addend); 338 if (insn) 339 insn = list_prev_entry(insn, list); 340 else if (rela->addend == rela->sym->sec->len) { 341 found = false; 342 list_for_each_entry_reverse(insn, &file->insn_list, list) { 343 if (insn->sec == rela->sym->sec) { 344 found = true; 345 break; 346 } 347 } 348 349 if (!found) { 350 WARN("can't find unreachable insn at %s+0x%x", 351 rela->sym->sec->name, rela->addend); 352 return -1; 353 } 354 } else { 355 WARN("can't find unreachable insn at %s+0x%x", 356 rela->sym->sec->name, rela->addend); 357 return -1; 358 } 359 360 insn->dead_end = true; 361 } 362 363 reachable: 364 /* 365 * These manually annotated reachable checks are needed for GCC 4.4, 366 * where the Linux unreachable() macro isn't supported. In that case 367 * GCC doesn't know the "ud2" is fatal, so it generates code as if it's 368 * not a dead end. 369 */ 370 sec = find_section_by_name(file->elf, ".rela.discard.reachable"); 371 if (!sec) 372 return 0; 373 374 list_for_each_entry(rela, &sec->rela_list, list) { 375 if (rela->sym->type != STT_SECTION) { 376 WARN("unexpected relocation symbol type in %s", sec->name); 377 return -1; 378 } 379 insn = find_insn(file, rela->sym->sec, rela->addend); 380 if (insn) 381 insn = list_prev_entry(insn, list); 382 else if (rela->addend == rela->sym->sec->len) { 383 found = false; 384 list_for_each_entry_reverse(insn, &file->insn_list, list) { 385 if (insn->sec == rela->sym->sec) { 386 found = true; 387 break; 388 } 389 } 390 391 if (!found) { 392 WARN("can't find reachable insn at %s+0x%x", 393 rela->sym->sec->name, rela->addend); 394 return -1; 395 } 396 } else { 397 WARN("can't find reachable insn at %s+0x%x", 398 rela->sym->sec->name, rela->addend); 399 return -1; 400 } 401 402 insn->dead_end = false; 403 } 404 405 return 0; 406 } 407 408 /* 409 * Warnings shouldn't be reported for ignored functions. 410 */ 411 static void add_ignores(struct objtool_file *file) 412 { 413 struct instruction *insn; 414 struct section *sec; 415 struct symbol *func; 416 417 for_each_sec(file, sec) { 418 list_for_each_entry(func, &sec->symbol_list, list) { 419 if (func->type != STT_FUNC) 420 continue; 421 422 if (!ignore_func(file, func)) 423 continue; 424 425 func_for_each_insn(file, func, insn) 426 insn->ignore = true; 427 } 428 } 429 } 430 431 /* 432 * FIXME: For now, just ignore any alternatives which add retpolines. This is 433 * a temporary hack, as it doesn't allow ORC to unwind from inside a retpoline. 434 * But it at least allows objtool to understand the control flow *around* the 435 * retpoline. 436 */ 437 static int add_nospec_ignores(struct objtool_file *file) 438 { 439 struct section *sec; 440 struct rela *rela; 441 struct instruction *insn; 442 443 sec = find_section_by_name(file->elf, ".rela.discard.nospec"); 444 if (!sec) 445 return 0; 446 447 list_for_each_entry(rela, &sec->rela_list, list) { 448 if (rela->sym->type != STT_SECTION) { 449 WARN("unexpected relocation symbol type in %s", sec->name); 450 return -1; 451 } 452 453 insn = find_insn(file, rela->sym->sec, rela->addend); 454 if (!insn) { 455 WARN("bad .discard.nospec entry"); 456 return -1; 457 } 458 459 insn->ignore_alts = true; 460 } 461 462 return 0; 463 } 464 465 /* 466 * Find the destination instructions for all jumps. 467 */ 468 static int add_jump_destinations(struct objtool_file *file) 469 { 470 struct instruction *insn; 471 struct rela *rela; 472 struct section *dest_sec; 473 unsigned long dest_off; 474 475 for_each_insn(file, insn) { 476 if (insn->type != INSN_JUMP_CONDITIONAL && 477 insn->type != INSN_JUMP_UNCONDITIONAL) 478 continue; 479 480 if (insn->ignore) 481 continue; 482 483 rela = find_rela_by_dest_range(insn->sec, insn->offset, 484 insn->len); 485 if (!rela) { 486 dest_sec = insn->sec; 487 dest_off = insn->offset + insn->len + insn->immediate; 488 } else if (rela->sym->type == STT_SECTION) { 489 dest_sec = rela->sym->sec; 490 dest_off = rela->addend + 4; 491 } else if (rela->sym->sec->idx) { 492 dest_sec = rela->sym->sec; 493 dest_off = rela->sym->sym.st_value + rela->addend + 4; 494 } else if (strstr(rela->sym->name, "_indirect_thunk_")) { 495 /* 496 * Retpoline jumps are really dynamic jumps in 497 * disguise, so convert them accordingly. 498 */ 499 insn->type = INSN_JUMP_DYNAMIC; 500 continue; 501 } else { 502 /* sibling call */ 503 insn->jump_dest = 0; 504 continue; 505 } 506 507 insn->jump_dest = find_insn(file, dest_sec, dest_off); 508 if (!insn->jump_dest) { 509 510 /* 511 * This is a special case where an alt instruction 512 * jumps past the end of the section. These are 513 * handled later in handle_group_alt(). 514 */ 515 if (!strcmp(insn->sec->name, ".altinstr_replacement")) 516 continue; 517 518 WARN_FUNC("can't find jump dest instruction at %s+0x%lx", 519 insn->sec, insn->offset, dest_sec->name, 520 dest_off); 521 return -1; 522 } 523 } 524 525 return 0; 526 } 527 528 /* 529 * Find the destination instructions for all calls. 530 */ 531 static int add_call_destinations(struct objtool_file *file) 532 { 533 struct instruction *insn; 534 unsigned long dest_off; 535 struct rela *rela; 536 537 for_each_insn(file, insn) { 538 if (insn->type != INSN_CALL) 539 continue; 540 541 rela = find_rela_by_dest_range(insn->sec, insn->offset, 542 insn->len); 543 if (!rela) { 544 dest_off = insn->offset + insn->len + insn->immediate; 545 insn->call_dest = find_symbol_by_offset(insn->sec, 546 dest_off); 547 548 if (!insn->call_dest && !insn->ignore) { 549 WARN_FUNC("unsupported intra-function call", 550 insn->sec, insn->offset); 551 WARN("If this is a retpoline, please patch it in with alternatives and annotate it with ANNOTATE_NOSPEC_ALTERNATIVE."); 552 return -1; 553 } 554 555 } else if (rela->sym->type == STT_SECTION) { 556 insn->call_dest = find_symbol_by_offset(rela->sym->sec, 557 rela->addend+4); 558 if (!insn->call_dest || 559 insn->call_dest->type != STT_FUNC) { 560 WARN_FUNC("can't find call dest symbol at %s+0x%x", 561 insn->sec, insn->offset, 562 rela->sym->sec->name, 563 rela->addend + 4); 564 return -1; 565 } 566 } else 567 insn->call_dest = rela->sym; 568 } 569 570 return 0; 571 } 572 573 /* 574 * The .alternatives section requires some extra special care, over and above 575 * what other special sections require: 576 * 577 * 1. Because alternatives are patched in-place, we need to insert a fake jump 578 * instruction at the end so that validate_branch() skips all the original 579 * replaced instructions when validating the new instruction path. 580 * 581 * 2. An added wrinkle is that the new instruction length might be zero. In 582 * that case the old instructions are replaced with noops. We simulate that 583 * by creating a fake jump as the only new instruction. 584 * 585 * 3. In some cases, the alternative section includes an instruction which 586 * conditionally jumps to the _end_ of the entry. We have to modify these 587 * jumps' destinations to point back to .text rather than the end of the 588 * entry in .altinstr_replacement. 589 * 590 * 4. It has been requested that we don't validate the !POPCNT feature path 591 * which is a "very very small percentage of machines". 592 */ 593 static int handle_group_alt(struct objtool_file *file, 594 struct special_alt *special_alt, 595 struct instruction *orig_insn, 596 struct instruction **new_insn) 597 { 598 struct instruction *last_orig_insn, *last_new_insn, *insn, *fake_jump = NULL; 599 unsigned long dest_off; 600 601 last_orig_insn = NULL; 602 insn = orig_insn; 603 sec_for_each_insn_from(file, insn) { 604 if (insn->offset >= special_alt->orig_off + special_alt->orig_len) 605 break; 606 607 if (special_alt->skip_orig) 608 insn->type = INSN_NOP; 609 610 insn->alt_group = true; 611 last_orig_insn = insn; 612 } 613 614 if (next_insn_same_sec(file, last_orig_insn)) { 615 fake_jump = malloc(sizeof(*fake_jump)); 616 if (!fake_jump) { 617 WARN("malloc failed"); 618 return -1; 619 } 620 memset(fake_jump, 0, sizeof(*fake_jump)); 621 INIT_LIST_HEAD(&fake_jump->alts); 622 clear_insn_state(&fake_jump->state); 623 624 fake_jump->sec = special_alt->new_sec; 625 fake_jump->offset = -1; 626 fake_jump->type = INSN_JUMP_UNCONDITIONAL; 627 fake_jump->jump_dest = list_next_entry(last_orig_insn, list); 628 fake_jump->ignore = true; 629 } 630 631 if (!special_alt->new_len) { 632 if (!fake_jump) { 633 WARN("%s: empty alternative at end of section", 634 special_alt->orig_sec->name); 635 return -1; 636 } 637 638 *new_insn = fake_jump; 639 return 0; 640 } 641 642 last_new_insn = NULL; 643 insn = *new_insn; 644 sec_for_each_insn_from(file, insn) { 645 if (insn->offset >= special_alt->new_off + special_alt->new_len) 646 break; 647 648 last_new_insn = insn; 649 650 insn->ignore = orig_insn->ignore_alts; 651 652 if (insn->type != INSN_JUMP_CONDITIONAL && 653 insn->type != INSN_JUMP_UNCONDITIONAL) 654 continue; 655 656 if (!insn->immediate) 657 continue; 658 659 dest_off = insn->offset + insn->len + insn->immediate; 660 if (dest_off == special_alt->new_off + special_alt->new_len) { 661 if (!fake_jump) { 662 WARN("%s: alternative jump to end of section", 663 special_alt->orig_sec->name); 664 return -1; 665 } 666 insn->jump_dest = fake_jump; 667 } 668 669 if (!insn->jump_dest) { 670 WARN_FUNC("can't find alternative jump destination", 671 insn->sec, insn->offset); 672 return -1; 673 } 674 } 675 676 if (!last_new_insn) { 677 WARN_FUNC("can't find last new alternative instruction", 678 special_alt->new_sec, special_alt->new_off); 679 return -1; 680 } 681 682 if (fake_jump) 683 list_add(&fake_jump->list, &last_new_insn->list); 684 685 return 0; 686 } 687 688 /* 689 * A jump table entry can either convert a nop to a jump or a jump to a nop. 690 * If the original instruction is a jump, make the alt entry an effective nop 691 * by just skipping the original instruction. 692 */ 693 static int handle_jump_alt(struct objtool_file *file, 694 struct special_alt *special_alt, 695 struct instruction *orig_insn, 696 struct instruction **new_insn) 697 { 698 if (orig_insn->type == INSN_NOP) 699 return 0; 700 701 if (orig_insn->type != INSN_JUMP_UNCONDITIONAL) { 702 WARN_FUNC("unsupported instruction at jump label", 703 orig_insn->sec, orig_insn->offset); 704 return -1; 705 } 706 707 *new_insn = list_next_entry(orig_insn, list); 708 return 0; 709 } 710 711 /* 712 * Read all the special sections which have alternate instructions which can be 713 * patched in or redirected to at runtime. Each instruction having alternate 714 * instruction(s) has them added to its insn->alts list, which will be 715 * traversed in validate_branch(). 716 */ 717 static int add_special_section_alts(struct objtool_file *file) 718 { 719 struct list_head special_alts; 720 struct instruction *orig_insn, *new_insn; 721 struct special_alt *special_alt, *tmp; 722 struct alternative *alt; 723 int ret; 724 725 ret = special_get_alts(file->elf, &special_alts); 726 if (ret) 727 return ret; 728 729 list_for_each_entry_safe(special_alt, tmp, &special_alts, list) { 730 731 orig_insn = find_insn(file, special_alt->orig_sec, 732 special_alt->orig_off); 733 if (!orig_insn) { 734 WARN_FUNC("special: can't find orig instruction", 735 special_alt->orig_sec, special_alt->orig_off); 736 ret = -1; 737 goto out; 738 } 739 740 new_insn = NULL; 741 if (!special_alt->group || special_alt->new_len) { 742 new_insn = find_insn(file, special_alt->new_sec, 743 special_alt->new_off); 744 if (!new_insn) { 745 WARN_FUNC("special: can't find new instruction", 746 special_alt->new_sec, 747 special_alt->new_off); 748 ret = -1; 749 goto out; 750 } 751 } 752 753 if (special_alt->group) { 754 ret = handle_group_alt(file, special_alt, orig_insn, 755 &new_insn); 756 if (ret) 757 goto out; 758 } else if (special_alt->jump_or_nop) { 759 ret = handle_jump_alt(file, special_alt, orig_insn, 760 &new_insn); 761 if (ret) 762 goto out; 763 } 764 765 alt = malloc(sizeof(*alt)); 766 if (!alt) { 767 WARN("malloc failed"); 768 ret = -1; 769 goto out; 770 } 771 772 alt->insn = new_insn; 773 list_add_tail(&alt->list, &orig_insn->alts); 774 775 list_del(&special_alt->list); 776 free(special_alt); 777 } 778 779 out: 780 return ret; 781 } 782 783 static int add_switch_table(struct objtool_file *file, struct symbol *func, 784 struct instruction *insn, struct rela *table, 785 struct rela *next_table) 786 { 787 struct rela *rela = table; 788 struct instruction *alt_insn; 789 struct alternative *alt; 790 791 list_for_each_entry_from(rela, &file->rodata->rela->rela_list, list) { 792 if (rela == next_table) 793 break; 794 795 if (rela->sym->sec != insn->sec || 796 rela->addend <= func->offset || 797 rela->addend >= func->offset + func->len) 798 break; 799 800 alt_insn = find_insn(file, insn->sec, rela->addend); 801 if (!alt_insn) { 802 WARN("%s: can't find instruction at %s+0x%x", 803 file->rodata->rela->name, insn->sec->name, 804 rela->addend); 805 return -1; 806 } 807 808 alt = malloc(sizeof(*alt)); 809 if (!alt) { 810 WARN("malloc failed"); 811 return -1; 812 } 813 814 alt->insn = alt_insn; 815 list_add_tail(&alt->list, &insn->alts); 816 } 817 818 return 0; 819 } 820 821 /* 822 * find_switch_table() - Given a dynamic jump, find the switch jump table in 823 * .rodata associated with it. 824 * 825 * There are 3 basic patterns: 826 * 827 * 1. jmpq *[rodata addr](,%reg,8) 828 * 829 * This is the most common case by far. It jumps to an address in a simple 830 * jump table which is stored in .rodata. 831 * 832 * 2. jmpq *[rodata addr](%rip) 833 * 834 * This is caused by a rare GCC quirk, currently only seen in three driver 835 * functions in the kernel, only with certain obscure non-distro configs. 836 * 837 * As part of an optimization, GCC makes a copy of an existing switch jump 838 * table, modifies it, and then hard-codes the jump (albeit with an indirect 839 * jump) to use a single entry in the table. The rest of the jump table and 840 * some of its jump targets remain as dead code. 841 * 842 * In such a case we can just crudely ignore all unreachable instruction 843 * warnings for the entire object file. Ideally we would just ignore them 844 * for the function, but that would require redesigning the code quite a 845 * bit. And honestly that's just not worth doing: unreachable instruction 846 * warnings are of questionable value anyway, and this is such a rare issue. 847 * 848 * 3. mov [rodata addr],%reg1 849 * ... some instructions ... 850 * jmpq *(%reg1,%reg2,8) 851 * 852 * This is a fairly uncommon pattern which is new for GCC 6. As of this 853 * writing, there are 11 occurrences of it in the allmodconfig kernel. 854 * 855 * As of GCC 7 there are quite a few more of these and the 'in between' code 856 * is significant. Esp. with KASAN enabled some of the code between the mov 857 * and jmpq uses .rodata itself, which can confuse things. 858 * 859 * TODO: Once we have DWARF CFI and smarter instruction decoding logic, 860 * ensure the same register is used in the mov and jump instructions. 861 * 862 * NOTE: RETPOLINE made it harder still to decode dynamic jumps. 863 */ 864 static struct rela *find_switch_table(struct objtool_file *file, 865 struct symbol *func, 866 struct instruction *insn) 867 { 868 struct rela *text_rela, *rodata_rela; 869 struct instruction *orig_insn = insn; 870 871 text_rela = find_rela_by_dest_range(insn->sec, insn->offset, insn->len); 872 if (text_rela && text_rela->sym == file->rodata->sym) { 873 /* case 1 */ 874 rodata_rela = find_rela_by_dest(file->rodata, 875 text_rela->addend); 876 if (rodata_rela) 877 return rodata_rela; 878 879 /* case 2 */ 880 rodata_rela = find_rela_by_dest(file->rodata, 881 text_rela->addend + 4); 882 if (!rodata_rela) 883 return NULL; 884 885 file->ignore_unreachables = true; 886 return rodata_rela; 887 } 888 889 /* case 3 */ 890 /* 891 * Backward search using the @first_jump_src links, these help avoid 892 * much of the 'in between' code. Which avoids us getting confused by 893 * it. 894 */ 895 for (insn = list_prev_entry(insn, list); 896 897 &insn->list != &file->insn_list && 898 insn->sec == func->sec && 899 insn->offset >= func->offset; 900 901 insn = insn->first_jump_src ?: list_prev_entry(insn, list)) { 902 903 if (insn->type == INSN_JUMP_DYNAMIC) 904 break; 905 906 /* allow small jumps within the range */ 907 if (insn->type == INSN_JUMP_UNCONDITIONAL && 908 insn->jump_dest && 909 (insn->jump_dest->offset <= insn->offset || 910 insn->jump_dest->offset > orig_insn->offset)) 911 break; 912 913 /* look for a relocation which references .rodata */ 914 text_rela = find_rela_by_dest_range(insn->sec, insn->offset, 915 insn->len); 916 if (!text_rela || text_rela->sym != file->rodata->sym) 917 continue; 918 919 /* 920 * Make sure the .rodata address isn't associated with a 921 * symbol. gcc jump tables are anonymous data. 922 */ 923 if (find_symbol_containing(file->rodata, text_rela->addend)) 924 continue; 925 926 return find_rela_by_dest(file->rodata, text_rela->addend); 927 } 928 929 return NULL; 930 } 931 932 933 static int add_func_switch_tables(struct objtool_file *file, 934 struct symbol *func) 935 { 936 struct instruction *insn, *last = NULL, *prev_jump = NULL; 937 struct rela *rela, *prev_rela = NULL; 938 int ret; 939 940 func_for_each_insn(file, func, insn) { 941 if (!last) 942 last = insn; 943 944 /* 945 * Store back-pointers for unconditional forward jumps such 946 * that find_switch_table() can back-track using those and 947 * avoid some potentially confusing code. 948 */ 949 if (insn->type == INSN_JUMP_UNCONDITIONAL && insn->jump_dest && 950 insn->offset > last->offset && 951 insn->jump_dest->offset > insn->offset && 952 !insn->jump_dest->first_jump_src) { 953 954 insn->jump_dest->first_jump_src = insn; 955 last = insn->jump_dest; 956 } 957 958 if (insn->type != INSN_JUMP_DYNAMIC) 959 continue; 960 961 rela = find_switch_table(file, func, insn); 962 if (!rela) 963 continue; 964 965 /* 966 * We found a switch table, but we don't know yet how big it 967 * is. Don't add it until we reach the end of the function or 968 * the beginning of another switch table in the same function. 969 */ 970 if (prev_jump) { 971 ret = add_switch_table(file, func, prev_jump, prev_rela, 972 rela); 973 if (ret) 974 return ret; 975 } 976 977 prev_jump = insn; 978 prev_rela = rela; 979 } 980 981 if (prev_jump) { 982 ret = add_switch_table(file, func, prev_jump, prev_rela, NULL); 983 if (ret) 984 return ret; 985 } 986 987 return 0; 988 } 989 990 /* 991 * For some switch statements, gcc generates a jump table in the .rodata 992 * section which contains a list of addresses within the function to jump to. 993 * This finds these jump tables and adds them to the insn->alts lists. 994 */ 995 static int add_switch_table_alts(struct objtool_file *file) 996 { 997 struct section *sec; 998 struct symbol *func; 999 int ret; 1000 1001 if (!file->rodata || !file->rodata->rela) 1002 return 0; 1003 1004 for_each_sec(file, sec) { 1005 list_for_each_entry(func, &sec->symbol_list, list) { 1006 if (func->type != STT_FUNC) 1007 continue; 1008 1009 ret = add_func_switch_tables(file, func); 1010 if (ret) 1011 return ret; 1012 } 1013 } 1014 1015 return 0; 1016 } 1017 1018 static int read_unwind_hints(struct objtool_file *file) 1019 { 1020 struct section *sec, *relasec; 1021 struct rela *rela; 1022 struct unwind_hint *hint; 1023 struct instruction *insn; 1024 struct cfi_reg *cfa; 1025 int i; 1026 1027 sec = find_section_by_name(file->elf, ".discard.unwind_hints"); 1028 if (!sec) 1029 return 0; 1030 1031 relasec = sec->rela; 1032 if (!relasec) { 1033 WARN("missing .rela.discard.unwind_hints section"); 1034 return -1; 1035 } 1036 1037 if (sec->len % sizeof(struct unwind_hint)) { 1038 WARN("struct unwind_hint size mismatch"); 1039 return -1; 1040 } 1041 1042 file->hints = true; 1043 1044 for (i = 0; i < sec->len / sizeof(struct unwind_hint); i++) { 1045 hint = (struct unwind_hint *)sec->data->d_buf + i; 1046 1047 rela = find_rela_by_dest(sec, i * sizeof(*hint)); 1048 if (!rela) { 1049 WARN("can't find rela for unwind_hints[%d]", i); 1050 return -1; 1051 } 1052 1053 insn = find_insn(file, rela->sym->sec, rela->addend); 1054 if (!insn) { 1055 WARN("can't find insn for unwind_hints[%d]", i); 1056 return -1; 1057 } 1058 1059 cfa = &insn->state.cfa; 1060 1061 if (hint->type == UNWIND_HINT_TYPE_SAVE) { 1062 insn->save = true; 1063 continue; 1064 1065 } else if (hint->type == UNWIND_HINT_TYPE_RESTORE) { 1066 insn->restore = true; 1067 insn->hint = true; 1068 continue; 1069 } 1070 1071 insn->hint = true; 1072 1073 switch (hint->sp_reg) { 1074 case ORC_REG_UNDEFINED: 1075 cfa->base = CFI_UNDEFINED; 1076 break; 1077 case ORC_REG_SP: 1078 cfa->base = CFI_SP; 1079 break; 1080 case ORC_REG_BP: 1081 cfa->base = CFI_BP; 1082 break; 1083 case ORC_REG_SP_INDIRECT: 1084 cfa->base = CFI_SP_INDIRECT; 1085 break; 1086 case ORC_REG_R10: 1087 cfa->base = CFI_R10; 1088 break; 1089 case ORC_REG_R13: 1090 cfa->base = CFI_R13; 1091 break; 1092 case ORC_REG_DI: 1093 cfa->base = CFI_DI; 1094 break; 1095 case ORC_REG_DX: 1096 cfa->base = CFI_DX; 1097 break; 1098 default: 1099 WARN_FUNC("unsupported unwind_hint sp base reg %d", 1100 insn->sec, insn->offset, hint->sp_reg); 1101 return -1; 1102 } 1103 1104 cfa->offset = hint->sp_offset; 1105 insn->state.type = hint->type; 1106 } 1107 1108 return 0; 1109 } 1110 1111 static int decode_sections(struct objtool_file *file) 1112 { 1113 int ret; 1114 1115 ret = decode_instructions(file); 1116 if (ret) 1117 return ret; 1118 1119 ret = add_dead_ends(file); 1120 if (ret) 1121 return ret; 1122 1123 add_ignores(file); 1124 1125 ret = add_nospec_ignores(file); 1126 if (ret) 1127 return ret; 1128 1129 ret = add_jump_destinations(file); 1130 if (ret) 1131 return ret; 1132 1133 ret = add_special_section_alts(file); 1134 if (ret) 1135 return ret; 1136 1137 ret = add_call_destinations(file); 1138 if (ret) 1139 return ret; 1140 1141 ret = add_switch_table_alts(file); 1142 if (ret) 1143 return ret; 1144 1145 ret = read_unwind_hints(file); 1146 if (ret) 1147 return ret; 1148 1149 return 0; 1150 } 1151 1152 static bool is_fentry_call(struct instruction *insn) 1153 { 1154 if (insn->type == INSN_CALL && 1155 insn->call_dest->type == STT_NOTYPE && 1156 !strcmp(insn->call_dest->name, "__fentry__")) 1157 return true; 1158 1159 return false; 1160 } 1161 1162 static bool has_modified_stack_frame(struct insn_state *state) 1163 { 1164 int i; 1165 1166 if (state->cfa.base != initial_func_cfi.cfa.base || 1167 state->cfa.offset != initial_func_cfi.cfa.offset || 1168 state->stack_size != initial_func_cfi.cfa.offset || 1169 state->drap) 1170 return true; 1171 1172 for (i = 0; i < CFI_NUM_REGS; i++) 1173 if (state->regs[i].base != initial_func_cfi.regs[i].base || 1174 state->regs[i].offset != initial_func_cfi.regs[i].offset) 1175 return true; 1176 1177 return false; 1178 } 1179 1180 static bool has_valid_stack_frame(struct insn_state *state) 1181 { 1182 if (state->cfa.base == CFI_BP && state->regs[CFI_BP].base == CFI_CFA && 1183 state->regs[CFI_BP].offset == -16) 1184 return true; 1185 1186 if (state->drap && state->regs[CFI_BP].base == CFI_BP) 1187 return true; 1188 1189 return false; 1190 } 1191 1192 static int update_insn_state_regs(struct instruction *insn, struct insn_state *state) 1193 { 1194 struct cfi_reg *cfa = &state->cfa; 1195 struct stack_op *op = &insn->stack_op; 1196 1197 if (cfa->base != CFI_SP) 1198 return 0; 1199 1200 /* push */ 1201 if (op->dest.type == OP_DEST_PUSH) 1202 cfa->offset += 8; 1203 1204 /* pop */ 1205 if (op->src.type == OP_SRC_POP) 1206 cfa->offset -= 8; 1207 1208 /* add immediate to sp */ 1209 if (op->dest.type == OP_DEST_REG && op->src.type == OP_SRC_ADD && 1210 op->dest.reg == CFI_SP && op->src.reg == CFI_SP) 1211 cfa->offset -= op->src.offset; 1212 1213 return 0; 1214 } 1215 1216 static void save_reg(struct insn_state *state, unsigned char reg, int base, 1217 int offset) 1218 { 1219 if (arch_callee_saved_reg(reg) && 1220 state->regs[reg].base == CFI_UNDEFINED) { 1221 state->regs[reg].base = base; 1222 state->regs[reg].offset = offset; 1223 } 1224 } 1225 1226 static void restore_reg(struct insn_state *state, unsigned char reg) 1227 { 1228 state->regs[reg].base = CFI_UNDEFINED; 1229 state->regs[reg].offset = 0; 1230 } 1231 1232 /* 1233 * A note about DRAP stack alignment: 1234 * 1235 * GCC has the concept of a DRAP register, which is used to help keep track of 1236 * the stack pointer when aligning the stack. r10 or r13 is used as the DRAP 1237 * register. The typical DRAP pattern is: 1238 * 1239 * 4c 8d 54 24 08 lea 0x8(%rsp),%r10 1240 * 48 83 e4 c0 and $0xffffffffffffffc0,%rsp 1241 * 41 ff 72 f8 pushq -0x8(%r10) 1242 * 55 push %rbp 1243 * 48 89 e5 mov %rsp,%rbp 1244 * (more pushes) 1245 * 41 52 push %r10 1246 * ... 1247 * 41 5a pop %r10 1248 * (more pops) 1249 * 5d pop %rbp 1250 * 49 8d 62 f8 lea -0x8(%r10),%rsp 1251 * c3 retq 1252 * 1253 * There are some variations in the epilogues, like: 1254 * 1255 * 5b pop %rbx 1256 * 41 5a pop %r10 1257 * 41 5c pop %r12 1258 * 41 5d pop %r13 1259 * 41 5e pop %r14 1260 * c9 leaveq 1261 * 49 8d 62 f8 lea -0x8(%r10),%rsp 1262 * c3 retq 1263 * 1264 * and: 1265 * 1266 * 4c 8b 55 e8 mov -0x18(%rbp),%r10 1267 * 48 8b 5d e0 mov -0x20(%rbp),%rbx 1268 * 4c 8b 65 f0 mov -0x10(%rbp),%r12 1269 * 4c 8b 6d f8 mov -0x8(%rbp),%r13 1270 * c9 leaveq 1271 * 49 8d 62 f8 lea -0x8(%r10),%rsp 1272 * c3 retq 1273 * 1274 * Sometimes r13 is used as the DRAP register, in which case it's saved and 1275 * restored beforehand: 1276 * 1277 * 41 55 push %r13 1278 * 4c 8d 6c 24 10 lea 0x10(%rsp),%r13 1279 * 48 83 e4 f0 and $0xfffffffffffffff0,%rsp 1280 * ... 1281 * 49 8d 65 f0 lea -0x10(%r13),%rsp 1282 * 41 5d pop %r13 1283 * c3 retq 1284 */ 1285 static int update_insn_state(struct instruction *insn, struct insn_state *state) 1286 { 1287 struct stack_op *op = &insn->stack_op; 1288 struct cfi_reg *cfa = &state->cfa; 1289 struct cfi_reg *regs = state->regs; 1290 1291 /* stack operations don't make sense with an undefined CFA */ 1292 if (cfa->base == CFI_UNDEFINED) { 1293 if (insn->func) { 1294 WARN_FUNC("undefined stack state", insn->sec, insn->offset); 1295 return -1; 1296 } 1297 return 0; 1298 } 1299 1300 if (state->type == ORC_TYPE_REGS || state->type == ORC_TYPE_REGS_IRET) 1301 return update_insn_state_regs(insn, state); 1302 1303 switch (op->dest.type) { 1304 1305 case OP_DEST_REG: 1306 switch (op->src.type) { 1307 1308 case OP_SRC_REG: 1309 if (op->src.reg == CFI_SP && op->dest.reg == CFI_BP && 1310 cfa->base == CFI_SP && 1311 regs[CFI_BP].base == CFI_CFA && 1312 regs[CFI_BP].offset == -cfa->offset) { 1313 1314 /* mov %rsp, %rbp */ 1315 cfa->base = op->dest.reg; 1316 state->bp_scratch = false; 1317 } 1318 1319 else if (op->src.reg == CFI_SP && 1320 op->dest.reg == CFI_BP && state->drap) { 1321 1322 /* drap: mov %rsp, %rbp */ 1323 regs[CFI_BP].base = CFI_BP; 1324 regs[CFI_BP].offset = -state->stack_size; 1325 state->bp_scratch = false; 1326 } 1327 1328 else if (op->src.reg == CFI_SP && cfa->base == CFI_SP) { 1329 1330 /* 1331 * mov %rsp, %reg 1332 * 1333 * This is needed for the rare case where GCC 1334 * does: 1335 * 1336 * mov %rsp, %rax 1337 * ... 1338 * mov %rax, %rsp 1339 */ 1340 state->vals[op->dest.reg].base = CFI_CFA; 1341 state->vals[op->dest.reg].offset = -state->stack_size; 1342 } 1343 1344 else if (op->dest.reg == cfa->base) { 1345 1346 /* mov %reg, %rsp */ 1347 if (cfa->base == CFI_SP && 1348 state->vals[op->src.reg].base == CFI_CFA) { 1349 1350 /* 1351 * This is needed for the rare case 1352 * where GCC does something dumb like: 1353 * 1354 * lea 0x8(%rsp), %rcx 1355 * ... 1356 * mov %rcx, %rsp 1357 */ 1358 cfa->offset = -state->vals[op->src.reg].offset; 1359 state->stack_size = cfa->offset; 1360 1361 } else { 1362 cfa->base = CFI_UNDEFINED; 1363 cfa->offset = 0; 1364 } 1365 } 1366 1367 break; 1368 1369 case OP_SRC_ADD: 1370 if (op->dest.reg == CFI_SP && op->src.reg == CFI_SP) { 1371 1372 /* add imm, %rsp */ 1373 state->stack_size -= op->src.offset; 1374 if (cfa->base == CFI_SP) 1375 cfa->offset -= op->src.offset; 1376 break; 1377 } 1378 1379 if (op->dest.reg == CFI_SP && op->src.reg == CFI_BP) { 1380 1381 /* lea disp(%rbp), %rsp */ 1382 state->stack_size = -(op->src.offset + regs[CFI_BP].offset); 1383 break; 1384 } 1385 1386 if (op->src.reg == CFI_SP && cfa->base == CFI_SP) { 1387 1388 /* drap: lea disp(%rsp), %drap */ 1389 state->drap_reg = op->dest.reg; 1390 1391 /* 1392 * lea disp(%rsp), %reg 1393 * 1394 * This is needed for the rare case where GCC 1395 * does something dumb like: 1396 * 1397 * lea 0x8(%rsp), %rcx 1398 * ... 1399 * mov %rcx, %rsp 1400 */ 1401 state->vals[op->dest.reg].base = CFI_CFA; 1402 state->vals[op->dest.reg].offset = \ 1403 -state->stack_size + op->src.offset; 1404 1405 break; 1406 } 1407 1408 if (state->drap && op->dest.reg == CFI_SP && 1409 op->src.reg == state->drap_reg) { 1410 1411 /* drap: lea disp(%drap), %rsp */ 1412 cfa->base = CFI_SP; 1413 cfa->offset = state->stack_size = -op->src.offset; 1414 state->drap_reg = CFI_UNDEFINED; 1415 state->drap = false; 1416 break; 1417 } 1418 1419 if (op->dest.reg == state->cfa.base) { 1420 WARN_FUNC("unsupported stack register modification", 1421 insn->sec, insn->offset); 1422 return -1; 1423 } 1424 1425 break; 1426 1427 case OP_SRC_AND: 1428 if (op->dest.reg != CFI_SP || 1429 (state->drap_reg != CFI_UNDEFINED && cfa->base != CFI_SP) || 1430 (state->drap_reg == CFI_UNDEFINED && cfa->base != CFI_BP)) { 1431 WARN_FUNC("unsupported stack pointer realignment", 1432 insn->sec, insn->offset); 1433 return -1; 1434 } 1435 1436 if (state->drap_reg != CFI_UNDEFINED) { 1437 /* drap: and imm, %rsp */ 1438 cfa->base = state->drap_reg; 1439 cfa->offset = state->stack_size = 0; 1440 state->drap = true; 1441 } 1442 1443 /* 1444 * Older versions of GCC (4.8ish) realign the stack 1445 * without DRAP, with a frame pointer. 1446 */ 1447 1448 break; 1449 1450 case OP_SRC_POP: 1451 if (!state->drap && op->dest.type == OP_DEST_REG && 1452 op->dest.reg == cfa->base) { 1453 1454 /* pop %rbp */ 1455 cfa->base = CFI_SP; 1456 } 1457 1458 if (state->drap && cfa->base == CFI_BP_INDIRECT && 1459 op->dest.type == OP_DEST_REG && 1460 op->dest.reg == state->drap_reg && 1461 state->drap_offset == -state->stack_size) { 1462 1463 /* drap: pop %drap */ 1464 cfa->base = state->drap_reg; 1465 cfa->offset = 0; 1466 state->drap_offset = -1; 1467 1468 } else if (regs[op->dest.reg].offset == -state->stack_size) { 1469 1470 /* pop %reg */ 1471 restore_reg(state, op->dest.reg); 1472 } 1473 1474 state->stack_size -= 8; 1475 if (cfa->base == CFI_SP) 1476 cfa->offset -= 8; 1477 1478 break; 1479 1480 case OP_SRC_REG_INDIRECT: 1481 if (state->drap && op->src.reg == CFI_BP && 1482 op->src.offset == state->drap_offset) { 1483 1484 /* drap: mov disp(%rbp), %drap */ 1485 cfa->base = state->drap_reg; 1486 cfa->offset = 0; 1487 state->drap_offset = -1; 1488 } 1489 1490 if (state->drap && op->src.reg == CFI_BP && 1491 op->src.offset == regs[op->dest.reg].offset) { 1492 1493 /* drap: mov disp(%rbp), %reg */ 1494 restore_reg(state, op->dest.reg); 1495 1496 } else if (op->src.reg == cfa->base && 1497 op->src.offset == regs[op->dest.reg].offset + cfa->offset) { 1498 1499 /* mov disp(%rbp), %reg */ 1500 /* mov disp(%rsp), %reg */ 1501 restore_reg(state, op->dest.reg); 1502 } 1503 1504 break; 1505 1506 default: 1507 WARN_FUNC("unknown stack-related instruction", 1508 insn->sec, insn->offset); 1509 return -1; 1510 } 1511 1512 break; 1513 1514 case OP_DEST_PUSH: 1515 state->stack_size += 8; 1516 if (cfa->base == CFI_SP) 1517 cfa->offset += 8; 1518 1519 if (op->src.type != OP_SRC_REG) 1520 break; 1521 1522 if (state->drap) { 1523 if (op->src.reg == cfa->base && op->src.reg == state->drap_reg) { 1524 1525 /* drap: push %drap */ 1526 cfa->base = CFI_BP_INDIRECT; 1527 cfa->offset = -state->stack_size; 1528 1529 /* save drap so we know when to restore it */ 1530 state->drap_offset = -state->stack_size; 1531 1532 } else if (op->src.reg == CFI_BP && cfa->base == state->drap_reg) { 1533 1534 /* drap: push %rbp */ 1535 state->stack_size = 0; 1536 1537 } else if (regs[op->src.reg].base == CFI_UNDEFINED) { 1538 1539 /* drap: push %reg */ 1540 save_reg(state, op->src.reg, CFI_BP, -state->stack_size); 1541 } 1542 1543 } else { 1544 1545 /* push %reg */ 1546 save_reg(state, op->src.reg, CFI_CFA, -state->stack_size); 1547 } 1548 1549 /* detect when asm code uses rbp as a scratch register */ 1550 if (!no_fp && insn->func && op->src.reg == CFI_BP && 1551 cfa->base != CFI_BP) 1552 state->bp_scratch = true; 1553 break; 1554 1555 case OP_DEST_REG_INDIRECT: 1556 1557 if (state->drap) { 1558 if (op->src.reg == cfa->base && op->src.reg == state->drap_reg) { 1559 1560 /* drap: mov %drap, disp(%rbp) */ 1561 cfa->base = CFI_BP_INDIRECT; 1562 cfa->offset = op->dest.offset; 1563 1564 /* save drap offset so we know when to restore it */ 1565 state->drap_offset = op->dest.offset; 1566 } 1567 1568 else if (regs[op->src.reg].base == CFI_UNDEFINED) { 1569 1570 /* drap: mov reg, disp(%rbp) */ 1571 save_reg(state, op->src.reg, CFI_BP, op->dest.offset); 1572 } 1573 1574 } else if (op->dest.reg == cfa->base) { 1575 1576 /* mov reg, disp(%rbp) */ 1577 /* mov reg, disp(%rsp) */ 1578 save_reg(state, op->src.reg, CFI_CFA, 1579 op->dest.offset - state->cfa.offset); 1580 } 1581 1582 break; 1583 1584 case OP_DEST_LEAVE: 1585 if ((!state->drap && cfa->base != CFI_BP) || 1586 (state->drap && cfa->base != state->drap_reg)) { 1587 WARN_FUNC("leave instruction with modified stack frame", 1588 insn->sec, insn->offset); 1589 return -1; 1590 } 1591 1592 /* leave (mov %rbp, %rsp; pop %rbp) */ 1593 1594 state->stack_size = -state->regs[CFI_BP].offset - 8; 1595 restore_reg(state, CFI_BP); 1596 1597 if (!state->drap) { 1598 cfa->base = CFI_SP; 1599 cfa->offset -= 8; 1600 } 1601 1602 break; 1603 1604 case OP_DEST_MEM: 1605 if (op->src.type != OP_SRC_POP) { 1606 WARN_FUNC("unknown stack-related memory operation", 1607 insn->sec, insn->offset); 1608 return -1; 1609 } 1610 1611 /* pop mem */ 1612 state->stack_size -= 8; 1613 if (cfa->base == CFI_SP) 1614 cfa->offset -= 8; 1615 1616 break; 1617 1618 default: 1619 WARN_FUNC("unknown stack-related instruction", 1620 insn->sec, insn->offset); 1621 return -1; 1622 } 1623 1624 return 0; 1625 } 1626 1627 static bool insn_state_match(struct instruction *insn, struct insn_state *state) 1628 { 1629 struct insn_state *state1 = &insn->state, *state2 = state; 1630 int i; 1631 1632 if (memcmp(&state1->cfa, &state2->cfa, sizeof(state1->cfa))) { 1633 WARN_FUNC("stack state mismatch: cfa1=%d%+d cfa2=%d%+d", 1634 insn->sec, insn->offset, 1635 state1->cfa.base, state1->cfa.offset, 1636 state2->cfa.base, state2->cfa.offset); 1637 1638 } else if (memcmp(&state1->regs, &state2->regs, sizeof(state1->regs))) { 1639 for (i = 0; i < CFI_NUM_REGS; i++) { 1640 if (!memcmp(&state1->regs[i], &state2->regs[i], 1641 sizeof(struct cfi_reg))) 1642 continue; 1643 1644 WARN_FUNC("stack state mismatch: reg1[%d]=%d%+d reg2[%d]=%d%+d", 1645 insn->sec, insn->offset, 1646 i, state1->regs[i].base, state1->regs[i].offset, 1647 i, state2->regs[i].base, state2->regs[i].offset); 1648 break; 1649 } 1650 1651 } else if (state1->type != state2->type) { 1652 WARN_FUNC("stack state mismatch: type1=%d type2=%d", 1653 insn->sec, insn->offset, state1->type, state2->type); 1654 1655 } else if (state1->drap != state2->drap || 1656 (state1->drap && state1->drap_reg != state2->drap_reg) || 1657 (state1->drap && state1->drap_offset != state2->drap_offset)) { 1658 WARN_FUNC("stack state mismatch: drap1=%d(%d,%d) drap2=%d(%d,%d)", 1659 insn->sec, insn->offset, 1660 state1->drap, state1->drap_reg, state1->drap_offset, 1661 state2->drap, state2->drap_reg, state2->drap_offset); 1662 1663 } else 1664 return true; 1665 1666 return false; 1667 } 1668 1669 /* 1670 * Follow the branch starting at the given instruction, and recursively follow 1671 * any other branches (jumps). Meanwhile, track the frame pointer state at 1672 * each instruction and validate all the rules described in 1673 * tools/objtool/Documentation/stack-validation.txt. 1674 */ 1675 static int validate_branch(struct objtool_file *file, struct instruction *first, 1676 struct insn_state state) 1677 { 1678 struct alternative *alt; 1679 struct instruction *insn, *next_insn; 1680 struct section *sec; 1681 struct symbol *func = NULL; 1682 int ret; 1683 1684 insn = first; 1685 sec = insn->sec; 1686 1687 if (insn->alt_group && list_empty(&insn->alts)) { 1688 WARN_FUNC("don't know how to handle branch to middle of alternative instruction group", 1689 sec, insn->offset); 1690 return 1; 1691 } 1692 1693 while (1) { 1694 next_insn = next_insn_same_sec(file, insn); 1695 1696 1697 if (file->c_file && func && insn->func && func != insn->func) { 1698 WARN("%s() falls through to next function %s()", 1699 func->name, insn->func->name); 1700 return 1; 1701 } 1702 1703 if (insn->func) 1704 func = insn->func; 1705 1706 if (func && insn->ignore) { 1707 WARN_FUNC("BUG: why am I validating an ignored function?", 1708 sec, insn->offset); 1709 return 1; 1710 } 1711 1712 if (insn->visited) { 1713 if (!insn->hint && !insn_state_match(insn, &state)) 1714 return 1; 1715 1716 return 0; 1717 } 1718 1719 if (insn->hint) { 1720 if (insn->restore) { 1721 struct instruction *save_insn, *i; 1722 1723 i = insn; 1724 save_insn = NULL; 1725 func_for_each_insn_continue_reverse(file, func, i) { 1726 if (i->save) { 1727 save_insn = i; 1728 break; 1729 } 1730 } 1731 1732 if (!save_insn) { 1733 WARN_FUNC("no corresponding CFI save for CFI restore", 1734 sec, insn->offset); 1735 return 1; 1736 } 1737 1738 if (!save_insn->visited) { 1739 /* 1740 * Oops, no state to copy yet. 1741 * Hopefully we can reach this 1742 * instruction from another branch 1743 * after the save insn has been 1744 * visited. 1745 */ 1746 if (insn == first) 1747 return 0; 1748 1749 WARN_FUNC("objtool isn't smart enough to handle this CFI save/restore combo", 1750 sec, insn->offset); 1751 return 1; 1752 } 1753 1754 insn->state = save_insn->state; 1755 } 1756 1757 state = insn->state; 1758 1759 } else 1760 insn->state = state; 1761 1762 insn->visited = true; 1763 1764 if (!insn->ignore_alts) { 1765 list_for_each_entry(alt, &insn->alts, list) { 1766 ret = validate_branch(file, alt->insn, state); 1767 if (ret) 1768 return 1; 1769 } 1770 } 1771 1772 switch (insn->type) { 1773 1774 case INSN_RETURN: 1775 if (func && has_modified_stack_frame(&state)) { 1776 WARN_FUNC("return with modified stack frame", 1777 sec, insn->offset); 1778 return 1; 1779 } 1780 1781 if (state.bp_scratch) { 1782 WARN("%s uses BP as a scratch register", 1783 insn->func->name); 1784 return 1; 1785 } 1786 1787 return 0; 1788 1789 case INSN_CALL: 1790 if (is_fentry_call(insn)) 1791 break; 1792 1793 ret = dead_end_function(file, insn->call_dest); 1794 if (ret == 1) 1795 return 0; 1796 if (ret == -1) 1797 return 1; 1798 1799 /* fallthrough */ 1800 case INSN_CALL_DYNAMIC: 1801 if (!no_fp && func && !has_valid_stack_frame(&state)) { 1802 WARN_FUNC("call without frame pointer save/setup", 1803 sec, insn->offset); 1804 return 1; 1805 } 1806 break; 1807 1808 case INSN_JUMP_CONDITIONAL: 1809 case INSN_JUMP_UNCONDITIONAL: 1810 if (insn->jump_dest && 1811 (!func || !insn->jump_dest->func || 1812 func == insn->jump_dest->func)) { 1813 ret = validate_branch(file, insn->jump_dest, 1814 state); 1815 if (ret) 1816 return 1; 1817 1818 } else if (func && has_modified_stack_frame(&state)) { 1819 WARN_FUNC("sibling call from callable instruction with modified stack frame", 1820 sec, insn->offset); 1821 return 1; 1822 } 1823 1824 if (insn->type == INSN_JUMP_UNCONDITIONAL) 1825 return 0; 1826 1827 break; 1828 1829 case INSN_JUMP_DYNAMIC: 1830 if (func && list_empty(&insn->alts) && 1831 has_modified_stack_frame(&state)) { 1832 WARN_FUNC("sibling call from callable instruction with modified stack frame", 1833 sec, insn->offset); 1834 return 1; 1835 } 1836 1837 return 0; 1838 1839 case INSN_CONTEXT_SWITCH: 1840 if (func && (!next_insn || !next_insn->hint)) { 1841 WARN_FUNC("unsupported instruction in callable function", 1842 sec, insn->offset); 1843 return 1; 1844 } 1845 return 0; 1846 1847 case INSN_STACK: 1848 if (update_insn_state(insn, &state)) 1849 return 1; 1850 1851 break; 1852 1853 default: 1854 break; 1855 } 1856 1857 if (insn->dead_end) 1858 return 0; 1859 1860 if (!next_insn) { 1861 if (state.cfa.base == CFI_UNDEFINED) 1862 return 0; 1863 WARN("%s: unexpected end of section", sec->name); 1864 return 1; 1865 } 1866 1867 insn = next_insn; 1868 } 1869 1870 return 0; 1871 } 1872 1873 static int validate_unwind_hints(struct objtool_file *file) 1874 { 1875 struct instruction *insn; 1876 int ret, warnings = 0; 1877 struct insn_state state; 1878 1879 if (!file->hints) 1880 return 0; 1881 1882 clear_insn_state(&state); 1883 1884 for_each_insn(file, insn) { 1885 if (insn->hint && !insn->visited) { 1886 ret = validate_branch(file, insn, state); 1887 warnings += ret; 1888 } 1889 } 1890 1891 return warnings; 1892 } 1893 1894 static bool is_kasan_insn(struct instruction *insn) 1895 { 1896 return (insn->type == INSN_CALL && 1897 !strcmp(insn->call_dest->name, "__asan_handle_no_return")); 1898 } 1899 1900 static bool is_ubsan_insn(struct instruction *insn) 1901 { 1902 return (insn->type == INSN_CALL && 1903 !strcmp(insn->call_dest->name, 1904 "__ubsan_handle_builtin_unreachable")); 1905 } 1906 1907 static bool ignore_unreachable_insn(struct instruction *insn) 1908 { 1909 int i; 1910 1911 if (insn->ignore || insn->type == INSN_NOP) 1912 return true; 1913 1914 /* 1915 * Ignore any unused exceptions. This can happen when a whitelisted 1916 * function has an exception table entry. 1917 * 1918 * Also ignore alternative replacement instructions. This can happen 1919 * when a whitelisted function uses one of the ALTERNATIVE macros. 1920 */ 1921 if (!strcmp(insn->sec->name, ".fixup") || 1922 !strcmp(insn->sec->name, ".altinstr_replacement") || 1923 !strcmp(insn->sec->name, ".altinstr_aux")) 1924 return true; 1925 1926 /* 1927 * Check if this (or a subsequent) instruction is related to 1928 * CONFIG_UBSAN or CONFIG_KASAN. 1929 * 1930 * End the search at 5 instructions to avoid going into the weeds. 1931 */ 1932 if (!insn->func) 1933 return false; 1934 for (i = 0; i < 5; i++) { 1935 1936 if (is_kasan_insn(insn) || is_ubsan_insn(insn)) 1937 return true; 1938 1939 if (insn->type == INSN_JUMP_UNCONDITIONAL) { 1940 if (insn->jump_dest && 1941 insn->jump_dest->func == insn->func) { 1942 insn = insn->jump_dest; 1943 continue; 1944 } 1945 1946 break; 1947 } 1948 1949 if (insn->offset + insn->len >= insn->func->offset + insn->func->len) 1950 break; 1951 1952 insn = list_next_entry(insn, list); 1953 } 1954 1955 return false; 1956 } 1957 1958 static int validate_functions(struct objtool_file *file) 1959 { 1960 struct section *sec; 1961 struct symbol *func; 1962 struct instruction *insn; 1963 struct insn_state state; 1964 int ret, warnings = 0; 1965 1966 clear_insn_state(&state); 1967 1968 state.cfa = initial_func_cfi.cfa; 1969 memcpy(&state.regs, &initial_func_cfi.regs, 1970 CFI_NUM_REGS * sizeof(struct cfi_reg)); 1971 state.stack_size = initial_func_cfi.cfa.offset; 1972 1973 for_each_sec(file, sec) { 1974 list_for_each_entry(func, &sec->symbol_list, list) { 1975 if (func->type != STT_FUNC) 1976 continue; 1977 1978 insn = find_insn(file, sec, func->offset); 1979 if (!insn || insn->ignore) 1980 continue; 1981 1982 ret = validate_branch(file, insn, state); 1983 warnings += ret; 1984 } 1985 } 1986 1987 return warnings; 1988 } 1989 1990 static int validate_reachable_instructions(struct objtool_file *file) 1991 { 1992 struct instruction *insn; 1993 1994 if (file->ignore_unreachables) 1995 return 0; 1996 1997 for_each_insn(file, insn) { 1998 if (insn->visited || ignore_unreachable_insn(insn)) 1999 continue; 2000 2001 WARN_FUNC("unreachable instruction", insn->sec, insn->offset); 2002 return 1; 2003 } 2004 2005 return 0; 2006 } 2007 2008 static void cleanup(struct objtool_file *file) 2009 { 2010 struct instruction *insn, *tmpinsn; 2011 struct alternative *alt, *tmpalt; 2012 2013 list_for_each_entry_safe(insn, tmpinsn, &file->insn_list, list) { 2014 list_for_each_entry_safe(alt, tmpalt, &insn->alts, list) { 2015 list_del(&alt->list); 2016 free(alt); 2017 } 2018 list_del(&insn->list); 2019 hash_del(&insn->hash); 2020 free(insn); 2021 } 2022 elf_close(file->elf); 2023 } 2024 2025 int check(const char *_objname, bool _no_fp, bool no_unreachable, bool orc) 2026 { 2027 struct objtool_file file; 2028 int ret, warnings = 0; 2029 2030 objname = _objname; 2031 no_fp = _no_fp; 2032 2033 file.elf = elf_open(objname, orc ? O_RDWR : O_RDONLY); 2034 if (!file.elf) 2035 return 1; 2036 2037 INIT_LIST_HEAD(&file.insn_list); 2038 hash_init(file.insn_hash); 2039 file.whitelist = find_section_by_name(file.elf, ".discard.func_stack_frame_non_standard"); 2040 file.rodata = find_section_by_name(file.elf, ".rodata"); 2041 file.c_file = find_section_by_name(file.elf, ".comment"); 2042 file.ignore_unreachables = no_unreachable; 2043 file.hints = false; 2044 2045 arch_initial_func_cfi_state(&initial_func_cfi); 2046 2047 ret = decode_sections(&file); 2048 if (ret < 0) 2049 goto out; 2050 warnings += ret; 2051 2052 if (list_empty(&file.insn_list)) 2053 goto out; 2054 2055 ret = validate_functions(&file); 2056 if (ret < 0) 2057 goto out; 2058 warnings += ret; 2059 2060 ret = validate_unwind_hints(&file); 2061 if (ret < 0) 2062 goto out; 2063 warnings += ret; 2064 2065 if (!warnings) { 2066 ret = validate_reachable_instructions(&file); 2067 if (ret < 0) 2068 goto out; 2069 warnings += ret; 2070 } 2071 2072 if (orc) { 2073 ret = create_orc(&file); 2074 if (ret < 0) 2075 goto out; 2076 2077 ret = create_orc_sections(&file); 2078 if (ret < 0) 2079 goto out; 2080 2081 ret = elf_write(file.elf); 2082 if (ret < 0) 2083 goto out; 2084 } 2085 2086 out: 2087 cleanup(&file); 2088 2089 /* ignore warnings for now until we get all the code cleaned up */ 2090 if (ret || warnings) 2091 return 0; 2092 return 0; 2093 } 2094