1 /* 2 * Copyright (C) 2015-2017 Josh Poimboeuf <jpoimboe@redhat.com> 3 * 4 * This program is free software; you can redistribute it and/or 5 * modify it under the terms of the GNU General Public License 6 * as published by the Free Software Foundation; either version 2 7 * of the License, or (at your option) any later version. 8 * 9 * This program is distributed in the hope that it will be useful, 10 * but WITHOUT ANY WARRANTY; without even the implied warranty of 11 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 12 * GNU General Public License for more details. 13 * 14 * You should have received a copy of the GNU General Public License 15 * along with this program; if not, see <http://www.gnu.org/licenses/>. 16 */ 17 18 #include <string.h> 19 #include <stdlib.h> 20 21 #include "builtin.h" 22 #include "check.h" 23 #include "elf.h" 24 #include "special.h" 25 #include "arch.h" 26 #include "warn.h" 27 28 #include <linux/hashtable.h> 29 #include <linux/kernel.h> 30 31 struct alternative { 32 struct list_head list; 33 struct instruction *insn; 34 }; 35 36 const char *objname; 37 struct cfi_state initial_func_cfi; 38 39 struct instruction *find_insn(struct objtool_file *file, 40 struct section *sec, unsigned long offset) 41 { 42 struct instruction *insn; 43 44 hash_for_each_possible(file->insn_hash, insn, hash, offset) 45 if (insn->sec == sec && insn->offset == offset) 46 return insn; 47 48 return NULL; 49 } 50 51 static struct instruction *next_insn_same_sec(struct objtool_file *file, 52 struct instruction *insn) 53 { 54 struct instruction *next = list_next_entry(insn, list); 55 56 if (!next || &next->list == &file->insn_list || next->sec != insn->sec) 57 return NULL; 58 59 return next; 60 } 61 62 #define func_for_each_insn(file, func, insn) \ 63 for (insn = find_insn(file, func->sec, func->offset); \ 64 insn && &insn->list != &file->insn_list && \ 65 insn->sec == func->sec && \ 66 insn->offset < func->offset + func->len; \ 67 insn = list_next_entry(insn, list)) 68 69 #define func_for_each_insn_continue_reverse(file, func, insn) \ 70 for (insn = list_prev_entry(insn, list); \ 71 &insn->list != &file->insn_list && \ 72 insn->sec == func->sec && insn->offset >= func->offset; \ 73 insn = list_prev_entry(insn, list)) 74 75 #define sec_for_each_insn_from(file, insn) \ 76 for (; insn; insn = next_insn_same_sec(file, insn)) 77 78 #define sec_for_each_insn_continue(file, insn) \ 79 for (insn = next_insn_same_sec(file, insn); insn; \ 80 insn = next_insn_same_sec(file, insn)) 81 82 /* 83 * Check if the function has been manually whitelisted with the 84 * STACK_FRAME_NON_STANDARD macro, or if it should be automatically whitelisted 85 * due to its use of a context switching instruction. 86 */ 87 static bool ignore_func(struct objtool_file *file, struct symbol *func) 88 { 89 struct rela *rela; 90 91 /* check for STACK_FRAME_NON_STANDARD */ 92 if (file->whitelist && file->whitelist->rela) 93 list_for_each_entry(rela, &file->whitelist->rela->rela_list, list) { 94 if (rela->sym->type == STT_SECTION && 95 rela->sym->sec == func->sec && 96 rela->addend == func->offset) 97 return true; 98 if (rela->sym->type == STT_FUNC && rela->sym == func) 99 return true; 100 } 101 102 return false; 103 } 104 105 /* 106 * This checks to see if the given function is a "noreturn" function. 107 * 108 * For global functions which are outside the scope of this object file, we 109 * have to keep a manual list of them. 110 * 111 * For local functions, we have to detect them manually by simply looking for 112 * the lack of a return instruction. 113 * 114 * Returns: 115 * -1: error 116 * 0: no dead end 117 * 1: dead end 118 */ 119 static int __dead_end_function(struct objtool_file *file, struct symbol *func, 120 int recursion) 121 { 122 int i; 123 struct instruction *insn; 124 bool empty = true; 125 126 /* 127 * Unfortunately these have to be hard coded because the noreturn 128 * attribute isn't provided in ELF data. 129 */ 130 static const char * const global_noreturns[] = { 131 "__stack_chk_fail", 132 "panic", 133 "do_exit", 134 "do_task_dead", 135 "__module_put_and_exit", 136 "complete_and_exit", 137 "kvm_spurious_fault", 138 "__reiserfs_panic", 139 "lbug_with_loc", 140 "fortify_panic", 141 "usercopy_abort", 142 }; 143 144 if (func->bind == STB_WEAK) 145 return 0; 146 147 if (func->bind == STB_GLOBAL) 148 for (i = 0; i < ARRAY_SIZE(global_noreturns); i++) 149 if (!strcmp(func->name, global_noreturns[i])) 150 return 1; 151 152 if (!func->sec) 153 return 0; 154 155 func_for_each_insn(file, func, insn) { 156 empty = false; 157 158 if (insn->type == INSN_RETURN) 159 return 0; 160 } 161 162 if (empty) 163 return 0; 164 165 /* 166 * A function can have a sibling call instead of a return. In that 167 * case, the function's dead-end status depends on whether the target 168 * of the sibling call returns. 169 */ 170 func_for_each_insn(file, func, insn) { 171 if (insn->sec != func->sec || 172 insn->offset >= func->offset + func->len) 173 break; 174 175 if (insn->type == INSN_JUMP_UNCONDITIONAL) { 176 struct instruction *dest = insn->jump_dest; 177 struct symbol *dest_func; 178 179 if (!dest) 180 /* sibling call to another file */ 181 return 0; 182 183 if (dest->sec != func->sec || 184 dest->offset < func->offset || 185 dest->offset >= func->offset + func->len) { 186 /* local sibling call */ 187 dest_func = find_symbol_by_offset(dest->sec, 188 dest->offset); 189 if (!dest_func) 190 continue; 191 192 if (recursion == 5) { 193 WARN_FUNC("infinite recursion (objtool bug!)", 194 dest->sec, dest->offset); 195 return -1; 196 } 197 198 return __dead_end_function(file, dest_func, 199 recursion + 1); 200 } 201 } 202 203 if (insn->type == INSN_JUMP_DYNAMIC && list_empty(&insn->alts)) 204 /* sibling call */ 205 return 0; 206 } 207 208 return 1; 209 } 210 211 static int dead_end_function(struct objtool_file *file, struct symbol *func) 212 { 213 return __dead_end_function(file, func, 0); 214 } 215 216 static void clear_insn_state(struct insn_state *state) 217 { 218 int i; 219 220 memset(state, 0, sizeof(*state)); 221 state->cfa.base = CFI_UNDEFINED; 222 for (i = 0; i < CFI_NUM_REGS; i++) { 223 state->regs[i].base = CFI_UNDEFINED; 224 state->vals[i].base = CFI_UNDEFINED; 225 } 226 state->drap_reg = CFI_UNDEFINED; 227 state->drap_offset = -1; 228 } 229 230 /* 231 * Call the arch-specific instruction decoder for all the instructions and add 232 * them to the global instruction list. 233 */ 234 static int decode_instructions(struct objtool_file *file) 235 { 236 struct section *sec; 237 struct symbol *func; 238 unsigned long offset; 239 struct instruction *insn; 240 int ret; 241 242 for_each_sec(file, sec) { 243 244 if (!(sec->sh.sh_flags & SHF_EXECINSTR)) 245 continue; 246 247 if (strcmp(sec->name, ".altinstr_replacement") && 248 strcmp(sec->name, ".altinstr_aux") && 249 strncmp(sec->name, ".discard.", 9)) 250 sec->text = true; 251 252 for (offset = 0; offset < sec->len; offset += insn->len) { 253 insn = malloc(sizeof(*insn)); 254 if (!insn) { 255 WARN("malloc failed"); 256 return -1; 257 } 258 memset(insn, 0, sizeof(*insn)); 259 INIT_LIST_HEAD(&insn->alts); 260 clear_insn_state(&insn->state); 261 262 insn->sec = sec; 263 insn->offset = offset; 264 265 ret = arch_decode_instruction(file->elf, sec, offset, 266 sec->len - offset, 267 &insn->len, &insn->type, 268 &insn->immediate, 269 &insn->stack_op); 270 if (ret) 271 goto err; 272 273 if (!insn->type || insn->type > INSN_LAST) { 274 WARN_FUNC("invalid instruction type %d", 275 insn->sec, insn->offset, insn->type); 276 ret = -1; 277 goto err; 278 } 279 280 hash_add(file->insn_hash, &insn->hash, insn->offset); 281 list_add_tail(&insn->list, &file->insn_list); 282 } 283 284 list_for_each_entry(func, &sec->symbol_list, list) { 285 if (func->type != STT_FUNC) 286 continue; 287 288 if (!find_insn(file, sec, func->offset)) { 289 WARN("%s(): can't find starting instruction", 290 func->name); 291 return -1; 292 } 293 294 func_for_each_insn(file, func, insn) 295 if (!insn->func) 296 insn->func = func; 297 } 298 } 299 300 return 0; 301 302 err: 303 free(insn); 304 return ret; 305 } 306 307 /* 308 * Mark "ud2" instructions and manually annotated dead ends. 309 */ 310 static int add_dead_ends(struct objtool_file *file) 311 { 312 struct section *sec; 313 struct rela *rela; 314 struct instruction *insn; 315 bool found; 316 317 /* 318 * By default, "ud2" is a dead end unless otherwise annotated, because 319 * GCC 7 inserts it for certain divide-by-zero cases. 320 */ 321 for_each_insn(file, insn) 322 if (insn->type == INSN_BUG) 323 insn->dead_end = true; 324 325 /* 326 * Check for manually annotated dead ends. 327 */ 328 sec = find_section_by_name(file->elf, ".rela.discard.unreachable"); 329 if (!sec) 330 goto reachable; 331 332 list_for_each_entry(rela, &sec->rela_list, list) { 333 if (rela->sym->type != STT_SECTION) { 334 WARN("unexpected relocation symbol type in %s", sec->name); 335 return -1; 336 } 337 insn = find_insn(file, rela->sym->sec, rela->addend); 338 if (insn) 339 insn = list_prev_entry(insn, list); 340 else if (rela->addend == rela->sym->sec->len) { 341 found = false; 342 list_for_each_entry_reverse(insn, &file->insn_list, list) { 343 if (insn->sec == rela->sym->sec) { 344 found = true; 345 break; 346 } 347 } 348 349 if (!found) { 350 WARN("can't find unreachable insn at %s+0x%x", 351 rela->sym->sec->name, rela->addend); 352 return -1; 353 } 354 } else { 355 WARN("can't find unreachable insn at %s+0x%x", 356 rela->sym->sec->name, rela->addend); 357 return -1; 358 } 359 360 insn->dead_end = true; 361 } 362 363 reachable: 364 /* 365 * These manually annotated reachable checks are needed for GCC 4.4, 366 * where the Linux unreachable() macro isn't supported. In that case 367 * GCC doesn't know the "ud2" is fatal, so it generates code as if it's 368 * not a dead end. 369 */ 370 sec = find_section_by_name(file->elf, ".rela.discard.reachable"); 371 if (!sec) 372 return 0; 373 374 list_for_each_entry(rela, &sec->rela_list, list) { 375 if (rela->sym->type != STT_SECTION) { 376 WARN("unexpected relocation symbol type in %s", sec->name); 377 return -1; 378 } 379 insn = find_insn(file, rela->sym->sec, rela->addend); 380 if (insn) 381 insn = list_prev_entry(insn, list); 382 else if (rela->addend == rela->sym->sec->len) { 383 found = false; 384 list_for_each_entry_reverse(insn, &file->insn_list, list) { 385 if (insn->sec == rela->sym->sec) { 386 found = true; 387 break; 388 } 389 } 390 391 if (!found) { 392 WARN("can't find reachable insn at %s+0x%x", 393 rela->sym->sec->name, rela->addend); 394 return -1; 395 } 396 } else { 397 WARN("can't find reachable insn at %s+0x%x", 398 rela->sym->sec->name, rela->addend); 399 return -1; 400 } 401 402 insn->dead_end = false; 403 } 404 405 return 0; 406 } 407 408 /* 409 * Warnings shouldn't be reported for ignored functions. 410 */ 411 static void add_ignores(struct objtool_file *file) 412 { 413 struct instruction *insn; 414 struct section *sec; 415 struct symbol *func; 416 417 for_each_sec(file, sec) { 418 list_for_each_entry(func, &sec->symbol_list, list) { 419 if (func->type != STT_FUNC) 420 continue; 421 422 if (!ignore_func(file, func)) 423 continue; 424 425 func_for_each_insn(file, func, insn) 426 insn->ignore = true; 427 } 428 } 429 } 430 431 /* 432 * FIXME: For now, just ignore any alternatives which add retpolines. This is 433 * a temporary hack, as it doesn't allow ORC to unwind from inside a retpoline. 434 * But it at least allows objtool to understand the control flow *around* the 435 * retpoline. 436 */ 437 static int add_nospec_ignores(struct objtool_file *file) 438 { 439 struct section *sec; 440 struct rela *rela; 441 struct instruction *insn; 442 443 sec = find_section_by_name(file->elf, ".rela.discard.nospec"); 444 if (!sec) 445 return 0; 446 447 list_for_each_entry(rela, &sec->rela_list, list) { 448 if (rela->sym->type != STT_SECTION) { 449 WARN("unexpected relocation symbol type in %s", sec->name); 450 return -1; 451 } 452 453 insn = find_insn(file, rela->sym->sec, rela->addend); 454 if (!insn) { 455 WARN("bad .discard.nospec entry"); 456 return -1; 457 } 458 459 insn->ignore_alts = true; 460 } 461 462 return 0; 463 } 464 465 /* 466 * Find the destination instructions for all jumps. 467 */ 468 static int add_jump_destinations(struct objtool_file *file) 469 { 470 struct instruction *insn; 471 struct rela *rela; 472 struct section *dest_sec; 473 unsigned long dest_off; 474 475 for_each_insn(file, insn) { 476 if (insn->type != INSN_JUMP_CONDITIONAL && 477 insn->type != INSN_JUMP_UNCONDITIONAL) 478 continue; 479 480 if (insn->ignore) 481 continue; 482 483 rela = find_rela_by_dest_range(insn->sec, insn->offset, 484 insn->len); 485 if (!rela) { 486 dest_sec = insn->sec; 487 dest_off = insn->offset + insn->len + insn->immediate; 488 } else if (rela->sym->type == STT_SECTION) { 489 dest_sec = rela->sym->sec; 490 dest_off = rela->addend + 4; 491 } else if (rela->sym->sec->idx) { 492 dest_sec = rela->sym->sec; 493 dest_off = rela->sym->sym.st_value + rela->addend + 4; 494 } else if (strstr(rela->sym->name, "_indirect_thunk_")) { 495 /* 496 * Retpoline jumps are really dynamic jumps in 497 * disguise, so convert them accordingly. 498 */ 499 insn->type = INSN_JUMP_DYNAMIC; 500 insn->retpoline_safe = true; 501 continue; 502 } else { 503 /* sibling call */ 504 insn->jump_dest = 0; 505 continue; 506 } 507 508 insn->jump_dest = find_insn(file, dest_sec, dest_off); 509 if (!insn->jump_dest) { 510 511 /* 512 * This is a special case where an alt instruction 513 * jumps past the end of the section. These are 514 * handled later in handle_group_alt(). 515 */ 516 if (!strcmp(insn->sec->name, ".altinstr_replacement")) 517 continue; 518 519 WARN_FUNC("can't find jump dest instruction at %s+0x%lx", 520 insn->sec, insn->offset, dest_sec->name, 521 dest_off); 522 return -1; 523 } 524 } 525 526 return 0; 527 } 528 529 /* 530 * Find the destination instructions for all calls. 531 */ 532 static int add_call_destinations(struct objtool_file *file) 533 { 534 struct instruction *insn; 535 unsigned long dest_off; 536 struct rela *rela; 537 538 for_each_insn(file, insn) { 539 if (insn->type != INSN_CALL) 540 continue; 541 542 rela = find_rela_by_dest_range(insn->sec, insn->offset, 543 insn->len); 544 if (!rela) { 545 dest_off = insn->offset + insn->len + insn->immediate; 546 insn->call_dest = find_symbol_by_offset(insn->sec, 547 dest_off); 548 549 if (!insn->call_dest && !insn->ignore) { 550 WARN_FUNC("unsupported intra-function call", 551 insn->sec, insn->offset); 552 if (retpoline) 553 WARN("If this is a retpoline, please patch it in with alternatives and annotate it with ANNOTATE_NOSPEC_ALTERNATIVE."); 554 return -1; 555 } 556 557 } else if (rela->sym->type == STT_SECTION) { 558 insn->call_dest = find_symbol_by_offset(rela->sym->sec, 559 rela->addend+4); 560 if (!insn->call_dest || 561 insn->call_dest->type != STT_FUNC) { 562 WARN_FUNC("can't find call dest symbol at %s+0x%x", 563 insn->sec, insn->offset, 564 rela->sym->sec->name, 565 rela->addend + 4); 566 return -1; 567 } 568 } else 569 insn->call_dest = rela->sym; 570 } 571 572 return 0; 573 } 574 575 /* 576 * The .alternatives section requires some extra special care, over and above 577 * what other special sections require: 578 * 579 * 1. Because alternatives are patched in-place, we need to insert a fake jump 580 * instruction at the end so that validate_branch() skips all the original 581 * replaced instructions when validating the new instruction path. 582 * 583 * 2. An added wrinkle is that the new instruction length might be zero. In 584 * that case the old instructions are replaced with noops. We simulate that 585 * by creating a fake jump as the only new instruction. 586 * 587 * 3. In some cases, the alternative section includes an instruction which 588 * conditionally jumps to the _end_ of the entry. We have to modify these 589 * jumps' destinations to point back to .text rather than the end of the 590 * entry in .altinstr_replacement. 591 * 592 * 4. It has been requested that we don't validate the !POPCNT feature path 593 * which is a "very very small percentage of machines". 594 */ 595 static int handle_group_alt(struct objtool_file *file, 596 struct special_alt *special_alt, 597 struct instruction *orig_insn, 598 struct instruction **new_insn) 599 { 600 struct instruction *last_orig_insn, *last_new_insn, *insn, *fake_jump = NULL; 601 unsigned long dest_off; 602 603 last_orig_insn = NULL; 604 insn = orig_insn; 605 sec_for_each_insn_from(file, insn) { 606 if (insn->offset >= special_alt->orig_off + special_alt->orig_len) 607 break; 608 609 if (special_alt->skip_orig) 610 insn->type = INSN_NOP; 611 612 insn->alt_group = true; 613 last_orig_insn = insn; 614 } 615 616 if (next_insn_same_sec(file, last_orig_insn)) { 617 fake_jump = malloc(sizeof(*fake_jump)); 618 if (!fake_jump) { 619 WARN("malloc failed"); 620 return -1; 621 } 622 memset(fake_jump, 0, sizeof(*fake_jump)); 623 INIT_LIST_HEAD(&fake_jump->alts); 624 clear_insn_state(&fake_jump->state); 625 626 fake_jump->sec = special_alt->new_sec; 627 fake_jump->offset = -1; 628 fake_jump->type = INSN_JUMP_UNCONDITIONAL; 629 fake_jump->jump_dest = list_next_entry(last_orig_insn, list); 630 fake_jump->ignore = true; 631 } 632 633 if (!special_alt->new_len) { 634 if (!fake_jump) { 635 WARN("%s: empty alternative at end of section", 636 special_alt->orig_sec->name); 637 return -1; 638 } 639 640 *new_insn = fake_jump; 641 return 0; 642 } 643 644 last_new_insn = NULL; 645 insn = *new_insn; 646 sec_for_each_insn_from(file, insn) { 647 if (insn->offset >= special_alt->new_off + special_alt->new_len) 648 break; 649 650 last_new_insn = insn; 651 652 insn->ignore = orig_insn->ignore_alts; 653 654 if (insn->type != INSN_JUMP_CONDITIONAL && 655 insn->type != INSN_JUMP_UNCONDITIONAL) 656 continue; 657 658 if (!insn->immediate) 659 continue; 660 661 dest_off = insn->offset + insn->len + insn->immediate; 662 if (dest_off == special_alt->new_off + special_alt->new_len) { 663 if (!fake_jump) { 664 WARN("%s: alternative jump to end of section", 665 special_alt->orig_sec->name); 666 return -1; 667 } 668 insn->jump_dest = fake_jump; 669 } 670 671 if (!insn->jump_dest) { 672 WARN_FUNC("can't find alternative jump destination", 673 insn->sec, insn->offset); 674 return -1; 675 } 676 } 677 678 if (!last_new_insn) { 679 WARN_FUNC("can't find last new alternative instruction", 680 special_alt->new_sec, special_alt->new_off); 681 return -1; 682 } 683 684 if (fake_jump) 685 list_add(&fake_jump->list, &last_new_insn->list); 686 687 return 0; 688 } 689 690 /* 691 * A jump table entry can either convert a nop to a jump or a jump to a nop. 692 * If the original instruction is a jump, make the alt entry an effective nop 693 * by just skipping the original instruction. 694 */ 695 static int handle_jump_alt(struct objtool_file *file, 696 struct special_alt *special_alt, 697 struct instruction *orig_insn, 698 struct instruction **new_insn) 699 { 700 if (orig_insn->type == INSN_NOP) 701 return 0; 702 703 if (orig_insn->type != INSN_JUMP_UNCONDITIONAL) { 704 WARN_FUNC("unsupported instruction at jump label", 705 orig_insn->sec, orig_insn->offset); 706 return -1; 707 } 708 709 *new_insn = list_next_entry(orig_insn, list); 710 return 0; 711 } 712 713 /* 714 * Read all the special sections which have alternate instructions which can be 715 * patched in or redirected to at runtime. Each instruction having alternate 716 * instruction(s) has them added to its insn->alts list, which will be 717 * traversed in validate_branch(). 718 */ 719 static int add_special_section_alts(struct objtool_file *file) 720 { 721 struct list_head special_alts; 722 struct instruction *orig_insn, *new_insn; 723 struct special_alt *special_alt, *tmp; 724 struct alternative *alt; 725 int ret; 726 727 ret = special_get_alts(file->elf, &special_alts); 728 if (ret) 729 return ret; 730 731 list_for_each_entry_safe(special_alt, tmp, &special_alts, list) { 732 733 orig_insn = find_insn(file, special_alt->orig_sec, 734 special_alt->orig_off); 735 if (!orig_insn) { 736 WARN_FUNC("special: can't find orig instruction", 737 special_alt->orig_sec, special_alt->orig_off); 738 ret = -1; 739 goto out; 740 } 741 742 new_insn = NULL; 743 if (!special_alt->group || special_alt->new_len) { 744 new_insn = find_insn(file, special_alt->new_sec, 745 special_alt->new_off); 746 if (!new_insn) { 747 WARN_FUNC("special: can't find new instruction", 748 special_alt->new_sec, 749 special_alt->new_off); 750 ret = -1; 751 goto out; 752 } 753 } 754 755 if (special_alt->group) { 756 ret = handle_group_alt(file, special_alt, orig_insn, 757 &new_insn); 758 if (ret) 759 goto out; 760 } else if (special_alt->jump_or_nop) { 761 ret = handle_jump_alt(file, special_alt, orig_insn, 762 &new_insn); 763 if (ret) 764 goto out; 765 } 766 767 alt = malloc(sizeof(*alt)); 768 if (!alt) { 769 WARN("malloc failed"); 770 ret = -1; 771 goto out; 772 } 773 774 alt->insn = new_insn; 775 list_add_tail(&alt->list, &orig_insn->alts); 776 777 list_del(&special_alt->list); 778 free(special_alt); 779 } 780 781 out: 782 return ret; 783 } 784 785 static int add_switch_table(struct objtool_file *file, struct symbol *func, 786 struct instruction *insn, struct rela *table, 787 struct rela *next_table) 788 { 789 struct rela *rela = table; 790 struct instruction *alt_insn; 791 struct alternative *alt; 792 793 list_for_each_entry_from(rela, &file->rodata->rela->rela_list, list) { 794 if (rela == next_table) 795 break; 796 797 if (rela->sym->sec != insn->sec || 798 rela->addend <= func->offset || 799 rela->addend >= func->offset + func->len) 800 break; 801 802 alt_insn = find_insn(file, insn->sec, rela->addend); 803 if (!alt_insn) { 804 WARN("%s: can't find instruction at %s+0x%x", 805 file->rodata->rela->name, insn->sec->name, 806 rela->addend); 807 return -1; 808 } 809 810 alt = malloc(sizeof(*alt)); 811 if (!alt) { 812 WARN("malloc failed"); 813 return -1; 814 } 815 816 alt->insn = alt_insn; 817 list_add_tail(&alt->list, &insn->alts); 818 } 819 820 return 0; 821 } 822 823 /* 824 * find_switch_table() - Given a dynamic jump, find the switch jump table in 825 * .rodata associated with it. 826 * 827 * There are 3 basic patterns: 828 * 829 * 1. jmpq *[rodata addr](,%reg,8) 830 * 831 * This is the most common case by far. It jumps to an address in a simple 832 * jump table which is stored in .rodata. 833 * 834 * 2. jmpq *[rodata addr](%rip) 835 * 836 * This is caused by a rare GCC quirk, currently only seen in three driver 837 * functions in the kernel, only with certain obscure non-distro configs. 838 * 839 * As part of an optimization, GCC makes a copy of an existing switch jump 840 * table, modifies it, and then hard-codes the jump (albeit with an indirect 841 * jump) to use a single entry in the table. The rest of the jump table and 842 * some of its jump targets remain as dead code. 843 * 844 * In such a case we can just crudely ignore all unreachable instruction 845 * warnings for the entire object file. Ideally we would just ignore them 846 * for the function, but that would require redesigning the code quite a 847 * bit. And honestly that's just not worth doing: unreachable instruction 848 * warnings are of questionable value anyway, and this is such a rare issue. 849 * 850 * 3. mov [rodata addr],%reg1 851 * ... some instructions ... 852 * jmpq *(%reg1,%reg2,8) 853 * 854 * This is a fairly uncommon pattern which is new for GCC 6. As of this 855 * writing, there are 11 occurrences of it in the allmodconfig kernel. 856 * 857 * As of GCC 7 there are quite a few more of these and the 'in between' code 858 * is significant. Esp. with KASAN enabled some of the code between the mov 859 * and jmpq uses .rodata itself, which can confuse things. 860 * 861 * TODO: Once we have DWARF CFI and smarter instruction decoding logic, 862 * ensure the same register is used in the mov and jump instructions. 863 * 864 * NOTE: RETPOLINE made it harder still to decode dynamic jumps. 865 */ 866 static struct rela *find_switch_table(struct objtool_file *file, 867 struct symbol *func, 868 struct instruction *insn) 869 { 870 struct rela *text_rela, *rodata_rela; 871 struct instruction *orig_insn = insn; 872 873 text_rela = find_rela_by_dest_range(insn->sec, insn->offset, insn->len); 874 if (text_rela && text_rela->sym == file->rodata->sym) { 875 /* case 1 */ 876 rodata_rela = find_rela_by_dest(file->rodata, 877 text_rela->addend); 878 if (rodata_rela) 879 return rodata_rela; 880 881 /* case 2 */ 882 rodata_rela = find_rela_by_dest(file->rodata, 883 text_rela->addend + 4); 884 if (!rodata_rela) 885 return NULL; 886 887 file->ignore_unreachables = true; 888 return rodata_rela; 889 } 890 891 /* case 3 */ 892 /* 893 * Backward search using the @first_jump_src links, these help avoid 894 * much of the 'in between' code. Which avoids us getting confused by 895 * it. 896 */ 897 for (insn = list_prev_entry(insn, list); 898 899 &insn->list != &file->insn_list && 900 insn->sec == func->sec && 901 insn->offset >= func->offset; 902 903 insn = insn->first_jump_src ?: list_prev_entry(insn, list)) { 904 905 if (insn->type == INSN_JUMP_DYNAMIC) 906 break; 907 908 /* allow small jumps within the range */ 909 if (insn->type == INSN_JUMP_UNCONDITIONAL && 910 insn->jump_dest && 911 (insn->jump_dest->offset <= insn->offset || 912 insn->jump_dest->offset > orig_insn->offset)) 913 break; 914 915 /* look for a relocation which references .rodata */ 916 text_rela = find_rela_by_dest_range(insn->sec, insn->offset, 917 insn->len); 918 if (!text_rela || text_rela->sym != file->rodata->sym) 919 continue; 920 921 /* 922 * Make sure the .rodata address isn't associated with a 923 * symbol. gcc jump tables are anonymous data. 924 */ 925 if (find_symbol_containing(file->rodata, text_rela->addend)) 926 continue; 927 928 rodata_rela = find_rela_by_dest(file->rodata, text_rela->addend); 929 if (!rodata_rela) 930 continue; 931 932 return rodata_rela; 933 } 934 935 return NULL; 936 } 937 938 939 static int add_func_switch_tables(struct objtool_file *file, 940 struct symbol *func) 941 { 942 struct instruction *insn, *last = NULL, *prev_jump = NULL; 943 struct rela *rela, *prev_rela = NULL; 944 int ret; 945 946 func_for_each_insn(file, func, insn) { 947 if (!last) 948 last = insn; 949 950 /* 951 * Store back-pointers for unconditional forward jumps such 952 * that find_switch_table() can back-track using those and 953 * avoid some potentially confusing code. 954 */ 955 if (insn->type == INSN_JUMP_UNCONDITIONAL && insn->jump_dest && 956 insn->offset > last->offset && 957 insn->jump_dest->offset > insn->offset && 958 !insn->jump_dest->first_jump_src) { 959 960 insn->jump_dest->first_jump_src = insn; 961 last = insn->jump_dest; 962 } 963 964 if (insn->type != INSN_JUMP_DYNAMIC) 965 continue; 966 967 rela = find_switch_table(file, func, insn); 968 if (!rela) 969 continue; 970 971 /* 972 * We found a switch table, but we don't know yet how big it 973 * is. Don't add it until we reach the end of the function or 974 * the beginning of another switch table in the same function. 975 */ 976 if (prev_jump) { 977 ret = add_switch_table(file, func, prev_jump, prev_rela, 978 rela); 979 if (ret) 980 return ret; 981 } 982 983 prev_jump = insn; 984 prev_rela = rela; 985 } 986 987 if (prev_jump) { 988 ret = add_switch_table(file, func, prev_jump, prev_rela, NULL); 989 if (ret) 990 return ret; 991 } 992 993 return 0; 994 } 995 996 /* 997 * For some switch statements, gcc generates a jump table in the .rodata 998 * section which contains a list of addresses within the function to jump to. 999 * This finds these jump tables and adds them to the insn->alts lists. 1000 */ 1001 static int add_switch_table_alts(struct objtool_file *file) 1002 { 1003 struct section *sec; 1004 struct symbol *func; 1005 int ret; 1006 1007 if (!file->rodata || !file->rodata->rela) 1008 return 0; 1009 1010 for_each_sec(file, sec) { 1011 list_for_each_entry(func, &sec->symbol_list, list) { 1012 if (func->type != STT_FUNC) 1013 continue; 1014 1015 ret = add_func_switch_tables(file, func); 1016 if (ret) 1017 return ret; 1018 } 1019 } 1020 1021 return 0; 1022 } 1023 1024 static int read_unwind_hints(struct objtool_file *file) 1025 { 1026 struct section *sec, *relasec; 1027 struct rela *rela; 1028 struct unwind_hint *hint; 1029 struct instruction *insn; 1030 struct cfi_reg *cfa; 1031 int i; 1032 1033 sec = find_section_by_name(file->elf, ".discard.unwind_hints"); 1034 if (!sec) 1035 return 0; 1036 1037 relasec = sec->rela; 1038 if (!relasec) { 1039 WARN("missing .rela.discard.unwind_hints section"); 1040 return -1; 1041 } 1042 1043 if (sec->len % sizeof(struct unwind_hint)) { 1044 WARN("struct unwind_hint size mismatch"); 1045 return -1; 1046 } 1047 1048 file->hints = true; 1049 1050 for (i = 0; i < sec->len / sizeof(struct unwind_hint); i++) { 1051 hint = (struct unwind_hint *)sec->data->d_buf + i; 1052 1053 rela = find_rela_by_dest(sec, i * sizeof(*hint)); 1054 if (!rela) { 1055 WARN("can't find rela for unwind_hints[%d]", i); 1056 return -1; 1057 } 1058 1059 insn = find_insn(file, rela->sym->sec, rela->addend); 1060 if (!insn) { 1061 WARN("can't find insn for unwind_hints[%d]", i); 1062 return -1; 1063 } 1064 1065 cfa = &insn->state.cfa; 1066 1067 if (hint->type == UNWIND_HINT_TYPE_SAVE) { 1068 insn->save = true; 1069 continue; 1070 1071 } else if (hint->type == UNWIND_HINT_TYPE_RESTORE) { 1072 insn->restore = true; 1073 insn->hint = true; 1074 continue; 1075 } 1076 1077 insn->hint = true; 1078 1079 switch (hint->sp_reg) { 1080 case ORC_REG_UNDEFINED: 1081 cfa->base = CFI_UNDEFINED; 1082 break; 1083 case ORC_REG_SP: 1084 cfa->base = CFI_SP; 1085 break; 1086 case ORC_REG_BP: 1087 cfa->base = CFI_BP; 1088 break; 1089 case ORC_REG_SP_INDIRECT: 1090 cfa->base = CFI_SP_INDIRECT; 1091 break; 1092 case ORC_REG_R10: 1093 cfa->base = CFI_R10; 1094 break; 1095 case ORC_REG_R13: 1096 cfa->base = CFI_R13; 1097 break; 1098 case ORC_REG_DI: 1099 cfa->base = CFI_DI; 1100 break; 1101 case ORC_REG_DX: 1102 cfa->base = CFI_DX; 1103 break; 1104 default: 1105 WARN_FUNC("unsupported unwind_hint sp base reg %d", 1106 insn->sec, insn->offset, hint->sp_reg); 1107 return -1; 1108 } 1109 1110 cfa->offset = hint->sp_offset; 1111 insn->state.type = hint->type; 1112 } 1113 1114 return 0; 1115 } 1116 1117 static int read_retpoline_hints(struct objtool_file *file) 1118 { 1119 struct section *sec, *relasec; 1120 struct instruction *insn; 1121 struct rela *rela; 1122 int i; 1123 1124 sec = find_section_by_name(file->elf, ".discard.retpoline_safe"); 1125 if (!sec) 1126 return 0; 1127 1128 relasec = sec->rela; 1129 if (!relasec) { 1130 WARN("missing .rela.discard.retpoline_safe section"); 1131 return -1; 1132 } 1133 1134 if (sec->len % sizeof(unsigned long)) { 1135 WARN("retpoline_safe size mismatch: %d %ld", sec->len, sizeof(unsigned long)); 1136 return -1; 1137 } 1138 1139 for (i = 0; i < sec->len / sizeof(unsigned long); i++) { 1140 rela = find_rela_by_dest(sec, i * sizeof(unsigned long)); 1141 if (!rela) { 1142 WARN("can't find rela for retpoline_safe[%d]", i); 1143 return -1; 1144 } 1145 1146 insn = find_insn(file, rela->sym->sec, rela->addend); 1147 if (!insn) { 1148 WARN("can't find insn for retpoline_safe[%d]", i); 1149 return -1; 1150 } 1151 1152 if (insn->type != INSN_JUMP_DYNAMIC && 1153 insn->type != INSN_CALL_DYNAMIC) { 1154 WARN_FUNC("retpoline_safe hint not a indirect jump/call", 1155 insn->sec, insn->offset); 1156 return -1; 1157 } 1158 1159 insn->retpoline_safe = true; 1160 } 1161 1162 return 0; 1163 } 1164 1165 static int decode_sections(struct objtool_file *file) 1166 { 1167 int ret; 1168 1169 ret = decode_instructions(file); 1170 if (ret) 1171 return ret; 1172 1173 ret = add_dead_ends(file); 1174 if (ret) 1175 return ret; 1176 1177 add_ignores(file); 1178 1179 ret = add_nospec_ignores(file); 1180 if (ret) 1181 return ret; 1182 1183 ret = add_jump_destinations(file); 1184 if (ret) 1185 return ret; 1186 1187 ret = add_special_section_alts(file); 1188 if (ret) 1189 return ret; 1190 1191 ret = add_call_destinations(file); 1192 if (ret) 1193 return ret; 1194 1195 ret = add_switch_table_alts(file); 1196 if (ret) 1197 return ret; 1198 1199 ret = read_unwind_hints(file); 1200 if (ret) 1201 return ret; 1202 1203 ret = read_retpoline_hints(file); 1204 if (ret) 1205 return ret; 1206 1207 return 0; 1208 } 1209 1210 static bool is_fentry_call(struct instruction *insn) 1211 { 1212 if (insn->type == INSN_CALL && 1213 insn->call_dest->type == STT_NOTYPE && 1214 !strcmp(insn->call_dest->name, "__fentry__")) 1215 return true; 1216 1217 return false; 1218 } 1219 1220 static bool has_modified_stack_frame(struct insn_state *state) 1221 { 1222 int i; 1223 1224 if (state->cfa.base != initial_func_cfi.cfa.base || 1225 state->cfa.offset != initial_func_cfi.cfa.offset || 1226 state->stack_size != initial_func_cfi.cfa.offset || 1227 state->drap) 1228 return true; 1229 1230 for (i = 0; i < CFI_NUM_REGS; i++) 1231 if (state->regs[i].base != initial_func_cfi.regs[i].base || 1232 state->regs[i].offset != initial_func_cfi.regs[i].offset) 1233 return true; 1234 1235 return false; 1236 } 1237 1238 static bool has_valid_stack_frame(struct insn_state *state) 1239 { 1240 if (state->cfa.base == CFI_BP && state->regs[CFI_BP].base == CFI_CFA && 1241 state->regs[CFI_BP].offset == -16) 1242 return true; 1243 1244 if (state->drap && state->regs[CFI_BP].base == CFI_BP) 1245 return true; 1246 1247 return false; 1248 } 1249 1250 static int update_insn_state_regs(struct instruction *insn, struct insn_state *state) 1251 { 1252 struct cfi_reg *cfa = &state->cfa; 1253 struct stack_op *op = &insn->stack_op; 1254 1255 if (cfa->base != CFI_SP) 1256 return 0; 1257 1258 /* push */ 1259 if (op->dest.type == OP_DEST_PUSH) 1260 cfa->offset += 8; 1261 1262 /* pop */ 1263 if (op->src.type == OP_SRC_POP) 1264 cfa->offset -= 8; 1265 1266 /* add immediate to sp */ 1267 if (op->dest.type == OP_DEST_REG && op->src.type == OP_SRC_ADD && 1268 op->dest.reg == CFI_SP && op->src.reg == CFI_SP) 1269 cfa->offset -= op->src.offset; 1270 1271 return 0; 1272 } 1273 1274 static void save_reg(struct insn_state *state, unsigned char reg, int base, 1275 int offset) 1276 { 1277 if (arch_callee_saved_reg(reg) && 1278 state->regs[reg].base == CFI_UNDEFINED) { 1279 state->regs[reg].base = base; 1280 state->regs[reg].offset = offset; 1281 } 1282 } 1283 1284 static void restore_reg(struct insn_state *state, unsigned char reg) 1285 { 1286 state->regs[reg].base = CFI_UNDEFINED; 1287 state->regs[reg].offset = 0; 1288 } 1289 1290 /* 1291 * A note about DRAP stack alignment: 1292 * 1293 * GCC has the concept of a DRAP register, which is used to help keep track of 1294 * the stack pointer when aligning the stack. r10 or r13 is used as the DRAP 1295 * register. The typical DRAP pattern is: 1296 * 1297 * 4c 8d 54 24 08 lea 0x8(%rsp),%r10 1298 * 48 83 e4 c0 and $0xffffffffffffffc0,%rsp 1299 * 41 ff 72 f8 pushq -0x8(%r10) 1300 * 55 push %rbp 1301 * 48 89 e5 mov %rsp,%rbp 1302 * (more pushes) 1303 * 41 52 push %r10 1304 * ... 1305 * 41 5a pop %r10 1306 * (more pops) 1307 * 5d pop %rbp 1308 * 49 8d 62 f8 lea -0x8(%r10),%rsp 1309 * c3 retq 1310 * 1311 * There are some variations in the epilogues, like: 1312 * 1313 * 5b pop %rbx 1314 * 41 5a pop %r10 1315 * 41 5c pop %r12 1316 * 41 5d pop %r13 1317 * 41 5e pop %r14 1318 * c9 leaveq 1319 * 49 8d 62 f8 lea -0x8(%r10),%rsp 1320 * c3 retq 1321 * 1322 * and: 1323 * 1324 * 4c 8b 55 e8 mov -0x18(%rbp),%r10 1325 * 48 8b 5d e0 mov -0x20(%rbp),%rbx 1326 * 4c 8b 65 f0 mov -0x10(%rbp),%r12 1327 * 4c 8b 6d f8 mov -0x8(%rbp),%r13 1328 * c9 leaveq 1329 * 49 8d 62 f8 lea -0x8(%r10),%rsp 1330 * c3 retq 1331 * 1332 * Sometimes r13 is used as the DRAP register, in which case it's saved and 1333 * restored beforehand: 1334 * 1335 * 41 55 push %r13 1336 * 4c 8d 6c 24 10 lea 0x10(%rsp),%r13 1337 * 48 83 e4 f0 and $0xfffffffffffffff0,%rsp 1338 * ... 1339 * 49 8d 65 f0 lea -0x10(%r13),%rsp 1340 * 41 5d pop %r13 1341 * c3 retq 1342 */ 1343 static int update_insn_state(struct instruction *insn, struct insn_state *state) 1344 { 1345 struct stack_op *op = &insn->stack_op; 1346 struct cfi_reg *cfa = &state->cfa; 1347 struct cfi_reg *regs = state->regs; 1348 1349 /* stack operations don't make sense with an undefined CFA */ 1350 if (cfa->base == CFI_UNDEFINED) { 1351 if (insn->func) { 1352 WARN_FUNC("undefined stack state", insn->sec, insn->offset); 1353 return -1; 1354 } 1355 return 0; 1356 } 1357 1358 if (state->type == ORC_TYPE_REGS || state->type == ORC_TYPE_REGS_IRET) 1359 return update_insn_state_regs(insn, state); 1360 1361 switch (op->dest.type) { 1362 1363 case OP_DEST_REG: 1364 switch (op->src.type) { 1365 1366 case OP_SRC_REG: 1367 if (op->src.reg == CFI_SP && op->dest.reg == CFI_BP && 1368 cfa->base == CFI_SP && 1369 regs[CFI_BP].base == CFI_CFA && 1370 regs[CFI_BP].offset == -cfa->offset) { 1371 1372 /* mov %rsp, %rbp */ 1373 cfa->base = op->dest.reg; 1374 state->bp_scratch = false; 1375 } 1376 1377 else if (op->src.reg == CFI_SP && 1378 op->dest.reg == CFI_BP && state->drap) { 1379 1380 /* drap: mov %rsp, %rbp */ 1381 regs[CFI_BP].base = CFI_BP; 1382 regs[CFI_BP].offset = -state->stack_size; 1383 state->bp_scratch = false; 1384 } 1385 1386 else if (op->src.reg == CFI_SP && cfa->base == CFI_SP) { 1387 1388 /* 1389 * mov %rsp, %reg 1390 * 1391 * This is needed for the rare case where GCC 1392 * does: 1393 * 1394 * mov %rsp, %rax 1395 * ... 1396 * mov %rax, %rsp 1397 */ 1398 state->vals[op->dest.reg].base = CFI_CFA; 1399 state->vals[op->dest.reg].offset = -state->stack_size; 1400 } 1401 1402 else if (op->dest.reg == cfa->base) { 1403 1404 /* mov %reg, %rsp */ 1405 if (cfa->base == CFI_SP && 1406 state->vals[op->src.reg].base == CFI_CFA) { 1407 1408 /* 1409 * This is needed for the rare case 1410 * where GCC does something dumb like: 1411 * 1412 * lea 0x8(%rsp), %rcx 1413 * ... 1414 * mov %rcx, %rsp 1415 */ 1416 cfa->offset = -state->vals[op->src.reg].offset; 1417 state->stack_size = cfa->offset; 1418 1419 } else { 1420 cfa->base = CFI_UNDEFINED; 1421 cfa->offset = 0; 1422 } 1423 } 1424 1425 break; 1426 1427 case OP_SRC_ADD: 1428 if (op->dest.reg == CFI_SP && op->src.reg == CFI_SP) { 1429 1430 /* add imm, %rsp */ 1431 state->stack_size -= op->src.offset; 1432 if (cfa->base == CFI_SP) 1433 cfa->offset -= op->src.offset; 1434 break; 1435 } 1436 1437 if (op->dest.reg == CFI_SP && op->src.reg == CFI_BP) { 1438 1439 /* lea disp(%rbp), %rsp */ 1440 state->stack_size = -(op->src.offset + regs[CFI_BP].offset); 1441 break; 1442 } 1443 1444 if (op->src.reg == CFI_SP && cfa->base == CFI_SP) { 1445 1446 /* drap: lea disp(%rsp), %drap */ 1447 state->drap_reg = op->dest.reg; 1448 1449 /* 1450 * lea disp(%rsp), %reg 1451 * 1452 * This is needed for the rare case where GCC 1453 * does something dumb like: 1454 * 1455 * lea 0x8(%rsp), %rcx 1456 * ... 1457 * mov %rcx, %rsp 1458 */ 1459 state->vals[op->dest.reg].base = CFI_CFA; 1460 state->vals[op->dest.reg].offset = \ 1461 -state->stack_size + op->src.offset; 1462 1463 break; 1464 } 1465 1466 if (state->drap && op->dest.reg == CFI_SP && 1467 op->src.reg == state->drap_reg) { 1468 1469 /* drap: lea disp(%drap), %rsp */ 1470 cfa->base = CFI_SP; 1471 cfa->offset = state->stack_size = -op->src.offset; 1472 state->drap_reg = CFI_UNDEFINED; 1473 state->drap = false; 1474 break; 1475 } 1476 1477 if (op->dest.reg == state->cfa.base) { 1478 WARN_FUNC("unsupported stack register modification", 1479 insn->sec, insn->offset); 1480 return -1; 1481 } 1482 1483 break; 1484 1485 case OP_SRC_AND: 1486 if (op->dest.reg != CFI_SP || 1487 (state->drap_reg != CFI_UNDEFINED && cfa->base != CFI_SP) || 1488 (state->drap_reg == CFI_UNDEFINED && cfa->base != CFI_BP)) { 1489 WARN_FUNC("unsupported stack pointer realignment", 1490 insn->sec, insn->offset); 1491 return -1; 1492 } 1493 1494 if (state->drap_reg != CFI_UNDEFINED) { 1495 /* drap: and imm, %rsp */ 1496 cfa->base = state->drap_reg; 1497 cfa->offset = state->stack_size = 0; 1498 state->drap = true; 1499 } 1500 1501 /* 1502 * Older versions of GCC (4.8ish) realign the stack 1503 * without DRAP, with a frame pointer. 1504 */ 1505 1506 break; 1507 1508 case OP_SRC_POP: 1509 if (!state->drap && op->dest.type == OP_DEST_REG && 1510 op->dest.reg == cfa->base) { 1511 1512 /* pop %rbp */ 1513 cfa->base = CFI_SP; 1514 } 1515 1516 if (state->drap && cfa->base == CFI_BP_INDIRECT && 1517 op->dest.type == OP_DEST_REG && 1518 op->dest.reg == state->drap_reg && 1519 state->drap_offset == -state->stack_size) { 1520 1521 /* drap: pop %drap */ 1522 cfa->base = state->drap_reg; 1523 cfa->offset = 0; 1524 state->drap_offset = -1; 1525 1526 } else if (regs[op->dest.reg].offset == -state->stack_size) { 1527 1528 /* pop %reg */ 1529 restore_reg(state, op->dest.reg); 1530 } 1531 1532 state->stack_size -= 8; 1533 if (cfa->base == CFI_SP) 1534 cfa->offset -= 8; 1535 1536 break; 1537 1538 case OP_SRC_REG_INDIRECT: 1539 if (state->drap && op->src.reg == CFI_BP && 1540 op->src.offset == state->drap_offset) { 1541 1542 /* drap: mov disp(%rbp), %drap */ 1543 cfa->base = state->drap_reg; 1544 cfa->offset = 0; 1545 state->drap_offset = -1; 1546 } 1547 1548 if (state->drap && op->src.reg == CFI_BP && 1549 op->src.offset == regs[op->dest.reg].offset) { 1550 1551 /* drap: mov disp(%rbp), %reg */ 1552 restore_reg(state, op->dest.reg); 1553 1554 } else if (op->src.reg == cfa->base && 1555 op->src.offset == regs[op->dest.reg].offset + cfa->offset) { 1556 1557 /* mov disp(%rbp), %reg */ 1558 /* mov disp(%rsp), %reg */ 1559 restore_reg(state, op->dest.reg); 1560 } 1561 1562 break; 1563 1564 default: 1565 WARN_FUNC("unknown stack-related instruction", 1566 insn->sec, insn->offset); 1567 return -1; 1568 } 1569 1570 break; 1571 1572 case OP_DEST_PUSH: 1573 state->stack_size += 8; 1574 if (cfa->base == CFI_SP) 1575 cfa->offset += 8; 1576 1577 if (op->src.type != OP_SRC_REG) 1578 break; 1579 1580 if (state->drap) { 1581 if (op->src.reg == cfa->base && op->src.reg == state->drap_reg) { 1582 1583 /* drap: push %drap */ 1584 cfa->base = CFI_BP_INDIRECT; 1585 cfa->offset = -state->stack_size; 1586 1587 /* save drap so we know when to restore it */ 1588 state->drap_offset = -state->stack_size; 1589 1590 } else if (op->src.reg == CFI_BP && cfa->base == state->drap_reg) { 1591 1592 /* drap: push %rbp */ 1593 state->stack_size = 0; 1594 1595 } else if (regs[op->src.reg].base == CFI_UNDEFINED) { 1596 1597 /* drap: push %reg */ 1598 save_reg(state, op->src.reg, CFI_BP, -state->stack_size); 1599 } 1600 1601 } else { 1602 1603 /* push %reg */ 1604 save_reg(state, op->src.reg, CFI_CFA, -state->stack_size); 1605 } 1606 1607 /* detect when asm code uses rbp as a scratch register */ 1608 if (!no_fp && insn->func && op->src.reg == CFI_BP && 1609 cfa->base != CFI_BP) 1610 state->bp_scratch = true; 1611 break; 1612 1613 case OP_DEST_REG_INDIRECT: 1614 1615 if (state->drap) { 1616 if (op->src.reg == cfa->base && op->src.reg == state->drap_reg) { 1617 1618 /* drap: mov %drap, disp(%rbp) */ 1619 cfa->base = CFI_BP_INDIRECT; 1620 cfa->offset = op->dest.offset; 1621 1622 /* save drap offset so we know when to restore it */ 1623 state->drap_offset = op->dest.offset; 1624 } 1625 1626 else if (regs[op->src.reg].base == CFI_UNDEFINED) { 1627 1628 /* drap: mov reg, disp(%rbp) */ 1629 save_reg(state, op->src.reg, CFI_BP, op->dest.offset); 1630 } 1631 1632 } else if (op->dest.reg == cfa->base) { 1633 1634 /* mov reg, disp(%rbp) */ 1635 /* mov reg, disp(%rsp) */ 1636 save_reg(state, op->src.reg, CFI_CFA, 1637 op->dest.offset - state->cfa.offset); 1638 } 1639 1640 break; 1641 1642 case OP_DEST_LEAVE: 1643 if ((!state->drap && cfa->base != CFI_BP) || 1644 (state->drap && cfa->base != state->drap_reg)) { 1645 WARN_FUNC("leave instruction with modified stack frame", 1646 insn->sec, insn->offset); 1647 return -1; 1648 } 1649 1650 /* leave (mov %rbp, %rsp; pop %rbp) */ 1651 1652 state->stack_size = -state->regs[CFI_BP].offset - 8; 1653 restore_reg(state, CFI_BP); 1654 1655 if (!state->drap) { 1656 cfa->base = CFI_SP; 1657 cfa->offset -= 8; 1658 } 1659 1660 break; 1661 1662 case OP_DEST_MEM: 1663 if (op->src.type != OP_SRC_POP) { 1664 WARN_FUNC("unknown stack-related memory operation", 1665 insn->sec, insn->offset); 1666 return -1; 1667 } 1668 1669 /* pop mem */ 1670 state->stack_size -= 8; 1671 if (cfa->base == CFI_SP) 1672 cfa->offset -= 8; 1673 1674 break; 1675 1676 default: 1677 WARN_FUNC("unknown stack-related instruction", 1678 insn->sec, insn->offset); 1679 return -1; 1680 } 1681 1682 return 0; 1683 } 1684 1685 static bool insn_state_match(struct instruction *insn, struct insn_state *state) 1686 { 1687 struct insn_state *state1 = &insn->state, *state2 = state; 1688 int i; 1689 1690 if (memcmp(&state1->cfa, &state2->cfa, sizeof(state1->cfa))) { 1691 WARN_FUNC("stack state mismatch: cfa1=%d%+d cfa2=%d%+d", 1692 insn->sec, insn->offset, 1693 state1->cfa.base, state1->cfa.offset, 1694 state2->cfa.base, state2->cfa.offset); 1695 1696 } else if (memcmp(&state1->regs, &state2->regs, sizeof(state1->regs))) { 1697 for (i = 0; i < CFI_NUM_REGS; i++) { 1698 if (!memcmp(&state1->regs[i], &state2->regs[i], 1699 sizeof(struct cfi_reg))) 1700 continue; 1701 1702 WARN_FUNC("stack state mismatch: reg1[%d]=%d%+d reg2[%d]=%d%+d", 1703 insn->sec, insn->offset, 1704 i, state1->regs[i].base, state1->regs[i].offset, 1705 i, state2->regs[i].base, state2->regs[i].offset); 1706 break; 1707 } 1708 1709 } else if (state1->type != state2->type) { 1710 WARN_FUNC("stack state mismatch: type1=%d type2=%d", 1711 insn->sec, insn->offset, state1->type, state2->type); 1712 1713 } else if (state1->drap != state2->drap || 1714 (state1->drap && state1->drap_reg != state2->drap_reg) || 1715 (state1->drap && state1->drap_offset != state2->drap_offset)) { 1716 WARN_FUNC("stack state mismatch: drap1=%d(%d,%d) drap2=%d(%d,%d)", 1717 insn->sec, insn->offset, 1718 state1->drap, state1->drap_reg, state1->drap_offset, 1719 state2->drap, state2->drap_reg, state2->drap_offset); 1720 1721 } else 1722 return true; 1723 1724 return false; 1725 } 1726 1727 /* 1728 * Follow the branch starting at the given instruction, and recursively follow 1729 * any other branches (jumps). Meanwhile, track the frame pointer state at 1730 * each instruction and validate all the rules described in 1731 * tools/objtool/Documentation/stack-validation.txt. 1732 */ 1733 static int validate_branch(struct objtool_file *file, struct instruction *first, 1734 struct insn_state state) 1735 { 1736 struct alternative *alt; 1737 struct instruction *insn, *next_insn; 1738 struct section *sec; 1739 struct symbol *func = NULL; 1740 int ret; 1741 1742 insn = first; 1743 sec = insn->sec; 1744 1745 if (insn->alt_group && list_empty(&insn->alts)) { 1746 WARN_FUNC("don't know how to handle branch to middle of alternative instruction group", 1747 sec, insn->offset); 1748 return 1; 1749 } 1750 1751 while (1) { 1752 next_insn = next_insn_same_sec(file, insn); 1753 1754 1755 if (file->c_file && func && insn->func && func != insn->func) { 1756 WARN("%s() falls through to next function %s()", 1757 func->name, insn->func->name); 1758 return 1; 1759 } 1760 1761 if (insn->func) 1762 func = insn->func; 1763 1764 if (func && insn->ignore) { 1765 WARN_FUNC("BUG: why am I validating an ignored function?", 1766 sec, insn->offset); 1767 return 1; 1768 } 1769 1770 if (insn->visited) { 1771 if (!insn->hint && !insn_state_match(insn, &state)) 1772 return 1; 1773 1774 return 0; 1775 } 1776 1777 if (insn->hint) { 1778 if (insn->restore) { 1779 struct instruction *save_insn, *i; 1780 1781 i = insn; 1782 save_insn = NULL; 1783 func_for_each_insn_continue_reverse(file, func, i) { 1784 if (i->save) { 1785 save_insn = i; 1786 break; 1787 } 1788 } 1789 1790 if (!save_insn) { 1791 WARN_FUNC("no corresponding CFI save for CFI restore", 1792 sec, insn->offset); 1793 return 1; 1794 } 1795 1796 if (!save_insn->visited) { 1797 /* 1798 * Oops, no state to copy yet. 1799 * Hopefully we can reach this 1800 * instruction from another branch 1801 * after the save insn has been 1802 * visited. 1803 */ 1804 if (insn == first) 1805 return 0; 1806 1807 WARN_FUNC("objtool isn't smart enough to handle this CFI save/restore combo", 1808 sec, insn->offset); 1809 return 1; 1810 } 1811 1812 insn->state = save_insn->state; 1813 } 1814 1815 state = insn->state; 1816 1817 } else 1818 insn->state = state; 1819 1820 insn->visited = true; 1821 1822 if (!insn->ignore_alts) { 1823 list_for_each_entry(alt, &insn->alts, list) { 1824 ret = validate_branch(file, alt->insn, state); 1825 if (ret) 1826 return 1; 1827 } 1828 } 1829 1830 switch (insn->type) { 1831 1832 case INSN_RETURN: 1833 if (func && has_modified_stack_frame(&state)) { 1834 WARN_FUNC("return with modified stack frame", 1835 sec, insn->offset); 1836 return 1; 1837 } 1838 1839 if (state.bp_scratch) { 1840 WARN("%s uses BP as a scratch register", 1841 insn->func->name); 1842 return 1; 1843 } 1844 1845 return 0; 1846 1847 case INSN_CALL: 1848 if (is_fentry_call(insn)) 1849 break; 1850 1851 ret = dead_end_function(file, insn->call_dest); 1852 if (ret == 1) 1853 return 0; 1854 if (ret == -1) 1855 return 1; 1856 1857 /* fallthrough */ 1858 case INSN_CALL_DYNAMIC: 1859 if (!no_fp && func && !has_valid_stack_frame(&state)) { 1860 WARN_FUNC("call without frame pointer save/setup", 1861 sec, insn->offset); 1862 return 1; 1863 } 1864 break; 1865 1866 case INSN_JUMP_CONDITIONAL: 1867 case INSN_JUMP_UNCONDITIONAL: 1868 if (insn->jump_dest && 1869 (!func || !insn->jump_dest->func || 1870 func == insn->jump_dest->func)) { 1871 ret = validate_branch(file, insn->jump_dest, 1872 state); 1873 if (ret) 1874 return 1; 1875 1876 } else if (func && has_modified_stack_frame(&state)) { 1877 WARN_FUNC("sibling call from callable instruction with modified stack frame", 1878 sec, insn->offset); 1879 return 1; 1880 } 1881 1882 if (insn->type == INSN_JUMP_UNCONDITIONAL) 1883 return 0; 1884 1885 break; 1886 1887 case INSN_JUMP_DYNAMIC: 1888 if (func && list_empty(&insn->alts) && 1889 has_modified_stack_frame(&state)) { 1890 WARN_FUNC("sibling call from callable instruction with modified stack frame", 1891 sec, insn->offset); 1892 return 1; 1893 } 1894 1895 return 0; 1896 1897 case INSN_CONTEXT_SWITCH: 1898 if (func && (!next_insn || !next_insn->hint)) { 1899 WARN_FUNC("unsupported instruction in callable function", 1900 sec, insn->offset); 1901 return 1; 1902 } 1903 return 0; 1904 1905 case INSN_STACK: 1906 if (update_insn_state(insn, &state)) 1907 return 1; 1908 1909 break; 1910 1911 default: 1912 break; 1913 } 1914 1915 if (insn->dead_end) 1916 return 0; 1917 1918 if (!next_insn) { 1919 if (state.cfa.base == CFI_UNDEFINED) 1920 return 0; 1921 WARN("%s: unexpected end of section", sec->name); 1922 return 1; 1923 } 1924 1925 insn = next_insn; 1926 } 1927 1928 return 0; 1929 } 1930 1931 static int validate_unwind_hints(struct objtool_file *file) 1932 { 1933 struct instruction *insn; 1934 int ret, warnings = 0; 1935 struct insn_state state; 1936 1937 if (!file->hints) 1938 return 0; 1939 1940 clear_insn_state(&state); 1941 1942 for_each_insn(file, insn) { 1943 if (insn->hint && !insn->visited) { 1944 ret = validate_branch(file, insn, state); 1945 warnings += ret; 1946 } 1947 } 1948 1949 return warnings; 1950 } 1951 1952 static int validate_retpoline(struct objtool_file *file) 1953 { 1954 struct instruction *insn; 1955 int warnings = 0; 1956 1957 for_each_insn(file, insn) { 1958 if (insn->type != INSN_JUMP_DYNAMIC && 1959 insn->type != INSN_CALL_DYNAMIC) 1960 continue; 1961 1962 if (insn->retpoline_safe) 1963 continue; 1964 1965 /* 1966 * .init.text code is ran before userspace and thus doesn't 1967 * strictly need retpolines, except for modules which are 1968 * loaded late, they very much do need retpoline in their 1969 * .init.text 1970 */ 1971 if (!strcmp(insn->sec->name, ".init.text") && !module) 1972 continue; 1973 1974 WARN_FUNC("indirect %s found in RETPOLINE build", 1975 insn->sec, insn->offset, 1976 insn->type == INSN_JUMP_DYNAMIC ? "jump" : "call"); 1977 1978 warnings++; 1979 } 1980 1981 return warnings; 1982 } 1983 1984 static bool is_kasan_insn(struct instruction *insn) 1985 { 1986 return (insn->type == INSN_CALL && 1987 !strcmp(insn->call_dest->name, "__asan_handle_no_return")); 1988 } 1989 1990 static bool is_ubsan_insn(struct instruction *insn) 1991 { 1992 return (insn->type == INSN_CALL && 1993 !strcmp(insn->call_dest->name, 1994 "__ubsan_handle_builtin_unreachable")); 1995 } 1996 1997 static bool ignore_unreachable_insn(struct instruction *insn) 1998 { 1999 int i; 2000 2001 if (insn->ignore || insn->type == INSN_NOP) 2002 return true; 2003 2004 /* 2005 * Ignore any unused exceptions. This can happen when a whitelisted 2006 * function has an exception table entry. 2007 * 2008 * Also ignore alternative replacement instructions. This can happen 2009 * when a whitelisted function uses one of the ALTERNATIVE macros. 2010 */ 2011 if (!strcmp(insn->sec->name, ".fixup") || 2012 !strcmp(insn->sec->name, ".altinstr_replacement") || 2013 !strcmp(insn->sec->name, ".altinstr_aux")) 2014 return true; 2015 2016 /* 2017 * Check if this (or a subsequent) instruction is related to 2018 * CONFIG_UBSAN or CONFIG_KASAN. 2019 * 2020 * End the search at 5 instructions to avoid going into the weeds. 2021 */ 2022 if (!insn->func) 2023 return false; 2024 for (i = 0; i < 5; i++) { 2025 2026 if (is_kasan_insn(insn) || is_ubsan_insn(insn)) 2027 return true; 2028 2029 if (insn->type == INSN_JUMP_UNCONDITIONAL) { 2030 if (insn->jump_dest && 2031 insn->jump_dest->func == insn->func) { 2032 insn = insn->jump_dest; 2033 continue; 2034 } 2035 2036 break; 2037 } 2038 2039 if (insn->offset + insn->len >= insn->func->offset + insn->func->len) 2040 break; 2041 2042 insn = list_next_entry(insn, list); 2043 } 2044 2045 return false; 2046 } 2047 2048 static int validate_functions(struct objtool_file *file) 2049 { 2050 struct section *sec; 2051 struct symbol *func; 2052 struct instruction *insn; 2053 struct insn_state state; 2054 int ret, warnings = 0; 2055 2056 clear_insn_state(&state); 2057 2058 state.cfa = initial_func_cfi.cfa; 2059 memcpy(&state.regs, &initial_func_cfi.regs, 2060 CFI_NUM_REGS * sizeof(struct cfi_reg)); 2061 state.stack_size = initial_func_cfi.cfa.offset; 2062 2063 for_each_sec(file, sec) { 2064 list_for_each_entry(func, &sec->symbol_list, list) { 2065 if (func->type != STT_FUNC) 2066 continue; 2067 2068 insn = find_insn(file, sec, func->offset); 2069 if (!insn || insn->ignore) 2070 continue; 2071 2072 ret = validate_branch(file, insn, state); 2073 warnings += ret; 2074 } 2075 } 2076 2077 return warnings; 2078 } 2079 2080 static int validate_reachable_instructions(struct objtool_file *file) 2081 { 2082 struct instruction *insn; 2083 2084 if (file->ignore_unreachables) 2085 return 0; 2086 2087 for_each_insn(file, insn) { 2088 if (insn->visited || ignore_unreachable_insn(insn)) 2089 continue; 2090 2091 WARN_FUNC("unreachable instruction", insn->sec, insn->offset); 2092 return 1; 2093 } 2094 2095 return 0; 2096 } 2097 2098 static void cleanup(struct objtool_file *file) 2099 { 2100 struct instruction *insn, *tmpinsn; 2101 struct alternative *alt, *tmpalt; 2102 2103 list_for_each_entry_safe(insn, tmpinsn, &file->insn_list, list) { 2104 list_for_each_entry_safe(alt, tmpalt, &insn->alts, list) { 2105 list_del(&alt->list); 2106 free(alt); 2107 } 2108 list_del(&insn->list); 2109 hash_del(&insn->hash); 2110 free(insn); 2111 } 2112 elf_close(file->elf); 2113 } 2114 2115 int check(const char *_objname, bool orc) 2116 { 2117 struct objtool_file file; 2118 int ret, warnings = 0; 2119 2120 objname = _objname; 2121 2122 file.elf = elf_open(objname, orc ? O_RDWR : O_RDONLY); 2123 if (!file.elf) 2124 return 1; 2125 2126 INIT_LIST_HEAD(&file.insn_list); 2127 hash_init(file.insn_hash); 2128 file.whitelist = find_section_by_name(file.elf, ".discard.func_stack_frame_non_standard"); 2129 file.rodata = find_section_by_name(file.elf, ".rodata"); 2130 file.c_file = find_section_by_name(file.elf, ".comment"); 2131 file.ignore_unreachables = no_unreachable; 2132 file.hints = false; 2133 2134 arch_initial_func_cfi_state(&initial_func_cfi); 2135 2136 ret = decode_sections(&file); 2137 if (ret < 0) 2138 goto out; 2139 warnings += ret; 2140 2141 if (list_empty(&file.insn_list)) 2142 goto out; 2143 2144 if (retpoline) { 2145 ret = validate_retpoline(&file); 2146 if (ret < 0) 2147 return ret; 2148 warnings += ret; 2149 } 2150 2151 ret = validate_functions(&file); 2152 if (ret < 0) 2153 goto out; 2154 warnings += ret; 2155 2156 ret = validate_unwind_hints(&file); 2157 if (ret < 0) 2158 goto out; 2159 warnings += ret; 2160 2161 if (!warnings) { 2162 ret = validate_reachable_instructions(&file); 2163 if (ret < 0) 2164 goto out; 2165 warnings += ret; 2166 } 2167 2168 if (orc) { 2169 ret = create_orc(&file); 2170 if (ret < 0) 2171 goto out; 2172 2173 ret = create_orc_sections(&file); 2174 if (ret < 0) 2175 goto out; 2176 2177 ret = elf_write(file.elf); 2178 if (ret < 0) 2179 goto out; 2180 } 2181 2182 out: 2183 cleanup(&file); 2184 2185 /* ignore warnings for now until we get all the code cleaned up */ 2186 if (ret || warnings) 2187 return 0; 2188 return 0; 2189 } 2190