?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
objtool: Add rewind_stack_do_exit() to the noreturn list
[linux/fpc-iii.git] / tools / objtool / check.c
blob09782ff427d0d3dfde9d52bf0209a09dc8d39178
1 /*
2 * Copyright (C) 2015-2017 Josh Poimboeuf <jpoimboe@redhat.com>
3 *
4 * This program is free software; you can redistribute it and/or
5 * modify it under the terms of the GNU General Public License
6 * as published by the Free Software Foundation; either version 2
7 * of the License, or (at your option) any later version.
8 *
9 * This program is distributed in the hope that it will be useful,
10 * but WITHOUT ANY WARRANTY; without even the implied warranty of
11 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
12 * GNU General Public License for more details.
13 *
14 * You should have received a copy of the GNU General Public License
15 * along with this program; if not, see <http://www.gnu.org/licenses/>.
16 */
17
18 #include <string.h>
19 #include <stdlib.h>
20
21 #include "builtin.h"
22 #include "check.h"
23 #include "elf.h"
24 #include "special.h"
25 #include "arch.h"
26 #include "warn.h"
27
28 #include <linux/hashtable.h>
29 #include <linux/kernel.h>
30
31 #define FAKE_JUMP_OFFSET -1
32
33 struct alternative {
34 struct list_head list;
35 struct instruction *insn;
36 };
37
38 const char *objname;
39 struct cfi_state initial_func_cfi;
40
41 struct instruction *find_insn(struct objtool_file *file,
42 struct section *sec, unsigned long offset)
43 {
44 struct instruction *insn;
45
46 hash_for_each_possible(file->insn_hash, insn, hash, offset)
47 if (insn->sec == sec && insn->offset == offset)
48 return insn;
49
50 return NULL;
51 }
52
53 static struct instruction *next_insn_same_sec(struct objtool_file *file,
54 struct instruction *insn)
55 {
56 struct instruction *next = list_next_entry(insn, list);
57
58 if (!next || &next->list == &file->insn_list || next->sec != insn->sec)
59 return NULL;
60
61 return next;
62 }
63
64 static struct instruction *next_insn_same_func(struct objtool_file *file,
65 struct instruction *insn)
66 {
67 struct instruction *next = list_next_entry(insn, list);
68 struct symbol *func = insn->func;
69
70 if (!func)
71 return NULL;
72
73 if (&next->list != &file->insn_list && next->func == func)
74 return next;
75
76 /* Check if we're already in the subfunction: */
77 if (func == func->cfunc)
78 return NULL;
79
80 /* Move to the subfunction: */
81 return find_insn(file, func->cfunc->sec, func->cfunc->offset);
82 }
83
84 #define func_for_each_insn_all(file, func, insn) \
85 for (insn = find_insn(file, func->sec, func->offset); \
86 insn; \
87 insn = next_insn_same_func(file, insn))
88
89 #define func_for_each_insn(file, func, insn) \
90 for (insn = find_insn(file, func->sec, func->offset); \
91 insn && &insn->list != &file->insn_list && \
92 insn->sec == func->sec && \
93 insn->offset < func->offset + func->len; \
94 insn = list_next_entry(insn, list))
95
96 #define func_for_each_insn_continue_reverse(file, func, insn) \
97 for (insn = list_prev_entry(insn, list); \
98 &insn->list != &file->insn_list && \
99 insn->sec == func->sec && insn->offset >= func->offset; \
100 insn = list_prev_entry(insn, list))
101
102 #define sec_for_each_insn_from(file, insn) \
103 for (; insn; insn = next_insn_same_sec(file, insn))
104
105 #define sec_for_each_insn_continue(file, insn) \
106 for (insn = next_insn_same_sec(file, insn); insn; \
107 insn = next_insn_same_sec(file, insn))
108
109 /*
110 * Check if the function has been manually whitelisted with the
111 * STACK_FRAME_NON_STANDARD macro, or if it should be automatically whitelisted
112 * due to its use of a context switching instruction.
113 */
114 static bool ignore_func(struct objtool_file *file, struct symbol *func)
115 {
116 struct rela *rela;
117
118 /* check for STACK_FRAME_NON_STANDARD */
119 if (file->whitelist && file->whitelist->rela)
120 list_for_each_entry(rela, &file->whitelist->rela->rela_list, list) {
121 if (rela->sym->type == STT_SECTION &&
122 rela->sym->sec == func->sec &&
123 rela->addend == func->offset)
124 return true;
125 if (rela->sym->type == STT_FUNC && rela->sym == func)
126 return true;
127 }
128
129 return false;
130 }
131
132 /*
133 * This checks to see if the given function is a "noreturn" function.
134 *
135 * For global functions which are outside the scope of this object file, we
136 * have to keep a manual list of them.
137 *
138 * For local functions, we have to detect them manually by simply looking for
139 * the lack of a return instruction.
140 *
141 * Returns:
142 * -1: error
143 * 0: no dead end
144 * 1: dead end
145 */
146 static int __dead_end_function(struct objtool_file *file, struct symbol *func,
147 int recursion)
148 {
149 int i;
150 struct instruction *insn;
151 bool empty = true;
152
153 /*
154 * Unfortunately these have to be hard coded because the noreturn
155 * attribute isn't provided in ELF data.
156 */
157 static const char * const global_noreturns[] = {
158 "__stack_chk_fail",
159 "panic",
160 "do_exit",
161 "do_task_dead",
162 "__module_put_and_exit",
163 "complete_and_exit",
164 "kvm_spurious_fault",
165 "__reiserfs_panic",
166 "lbug_with_loc",
167 "fortify_panic",
168 "machine_real_restart",
169 "rewind_stack_do_exit",
170 };
171
172 if (func->bind == STB_WEAK)
173 return 0;
174
175 if (func->bind == STB_GLOBAL)
176 for (i = 0; i < ARRAY_SIZE(global_noreturns); i++)
177 if (!strcmp(func->name, global_noreturns[i]))
178 return 1;
179
180 if (!func->len)
181 return 0;
182
183 insn = find_insn(file, func->sec, func->offset);
184 if (!insn->func)
185 return 0;
186
187 func_for_each_insn_all(file, func, insn) {
188 empty = false;
189
190 if (insn->type == INSN_RETURN)
191 return 0;
192 }
193
194 if (empty)
195 return 0;
196
197 /*
198 * A function can have a sibling call instead of a return. In that
199 * case, the function's dead-end status depends on whether the target
200 * of the sibling call returns.
201 */
202 func_for_each_insn_all(file, func, insn) {
203 if (insn->type == INSN_JUMP_UNCONDITIONAL) {
204 struct instruction *dest = insn->jump_dest;
205
206 if (!dest)
207 /* sibling call to another file */
208 return 0;
209
210 if (dest->func && dest->func->pfunc != insn->func->pfunc) {
211
212 /* local sibling call */
213 if (recursion == 5) {
214 /*
215 * Infinite recursion: two functions
216 * have sibling calls to each other.
217 * This is a very rare case. It means
218 * they aren't dead ends.
219 */
220 return 0;
221 }
222
223 return __dead_end_function(file, dest->func,
224 recursion + 1);
225 }
226 }
227
228 if (insn->type == INSN_JUMP_DYNAMIC && list_empty(&insn->alts))
229 /* sibling call */
230 return 0;
231 }
232
233 return 1;
234 }
235
236 static int dead_end_function(struct objtool_file *file, struct symbol *func)
237 {
238 return __dead_end_function(file, func, 0);
239 }
240
241 static void clear_insn_state(struct insn_state *state)
242 {
243 int i;
244
245 memset(state, 0, sizeof(*state));
246 state->cfa.base = CFI_UNDEFINED;
247 for (i = 0; i < CFI_NUM_REGS; i++) {
248 state->regs[i].base = CFI_UNDEFINED;
249 state->vals[i].base = CFI_UNDEFINED;
250 }
251 state->drap_reg = CFI_UNDEFINED;
252 state->drap_offset = -1;
253 }
254
255 /*
256 * Call the arch-specific instruction decoder for all the instructions and add
257 * them to the global instruction list.
258 */
259 static int decode_instructions(struct objtool_file *file)
260 {
261 struct section *sec;
262 struct symbol *func;
263 unsigned long offset;
264 struct instruction *insn;
265 int ret;
266
267 for_each_sec(file, sec) {
268
269 if (!(sec->sh.sh_flags & SHF_EXECINSTR))
270 continue;
271
272 if (strcmp(sec->name, ".altinstr_replacement") &&
273 strcmp(sec->name, ".altinstr_aux") &&
274 strncmp(sec->name, ".discard.", 9))
275 sec->text = true;
276
277 for (offset = 0; offset < sec->len; offset += insn->len) {
278 insn = malloc(sizeof(*insn));
279 if (!insn) {
280 WARN("malloc failed");
281 return -1;
282 }
283 memset(insn, 0, sizeof(*insn));
284 INIT_LIST_HEAD(&insn->alts);
285 clear_insn_state(&insn->state);
286
287 insn->sec = sec;
288 insn->offset = offset;
289
290 ret = arch_decode_instruction(file->elf, sec, offset,
291 sec->len - offset,
292 &insn->len, &insn->type,
293 &insn->immediate,
294 &insn->stack_op);
295 if (ret)
296 goto err;
297
298 if (!insn->type || insn->type > INSN_LAST) {
299 WARN_FUNC("invalid instruction type %d",
300 insn->sec, insn->offset, insn->type);
301 ret = -1;
302 goto err;
303 }
304
305 hash_add(file->insn_hash, &insn->hash, insn->offset);
306 list_add_tail(&insn->list, &file->insn_list);
307 }
308
309 list_for_each_entry(func, &sec->symbol_list, list) {
310 if (func->type != STT_FUNC)
311 continue;
312
313 if (!find_insn(file, sec, func->offset)) {
314 WARN("%s(): can't find starting instruction",
315 func->name);
316 return -1;
317 }
318
319 func_for_each_insn(file, func, insn)
320 if (!insn->func)
321 insn->func = func;
322 }
323 }
324
325 return 0;
326
327 err:
328 free(insn);
329 return ret;
330 }
331
332 /*
333 * Mark "ud2" instructions and manually annotated dead ends.
334 */
335 static int add_dead_ends(struct objtool_file *file)
336 {
337 struct section *sec;
338 struct rela *rela;
339 struct instruction *insn;
340 bool found;
341
342 /*
343 * By default, "ud2" is a dead end unless otherwise annotated, because
344 * GCC 7 inserts it for certain divide-by-zero cases.
345 */
346 for_each_insn(file, insn)
347 if (insn->type == INSN_BUG)
348 insn->dead_end = true;
349
350 /*
351 * Check for manually annotated dead ends.
352 */
353 sec = find_section_by_name(file->elf, ".rela.discard.unreachable");
354 if (!sec)
355 goto reachable;
356
357 list_for_each_entry(rela, &sec->rela_list, list) {
358 if (rela->sym->type != STT_SECTION) {
359 WARN("unexpected relocation symbol type in %s", sec->name);
360 return -1;
361 }
362 insn = find_insn(file, rela->sym->sec, rela->addend);
363 if (insn)
364 insn = list_prev_entry(insn, list);
365 else if (rela->addend == rela->sym->sec->len) {
366 found = false;
367 list_for_each_entry_reverse(insn, &file->insn_list, list) {
368 if (insn->sec == rela->sym->sec) {
369 found = true;
370 break;
371 }
372 }
373
374 if (!found) {
375 WARN("can't find unreachable insn at %s+0x%x",
376 rela->sym->sec->name, rela->addend);
377 return -1;
378 }
379 } else {
380 WARN("can't find unreachable insn at %s+0x%x",
381 rela->sym->sec->name, rela->addend);
382 return -1;
383 }
384
385 insn->dead_end = true;
386 }
387
388 reachable:
389 /*
390 * These manually annotated reachable checks are needed for GCC 4.4,
391 * where the Linux unreachable() macro isn't supported. In that case
392 * GCC doesn't know the "ud2" is fatal, so it generates code as if it's
393 * not a dead end.
394 */
395 sec = find_section_by_name(file->elf, ".rela.discard.reachable");
396 if (!sec)
397 return 0;
398
399 list_for_each_entry(rela, &sec->rela_list, list) {
400 if (rela->sym->type != STT_SECTION) {
401 WARN("unexpected relocation symbol type in %s", sec->name);
402 return -1;
403 }
404 insn = find_insn(file, rela->sym->sec, rela->addend);
405 if (insn)
406 insn = list_prev_entry(insn, list);
407 else if (rela->addend == rela->sym->sec->len) {
408 found = false;
409 list_for_each_entry_reverse(insn, &file->insn_list, list) {
410 if (insn->sec == rela->sym->sec) {
411 found = true;
412 break;
413 }
414 }
415
416 if (!found) {
417 WARN("can't find reachable insn at %s+0x%x",
418 rela->sym->sec->name, rela->addend);
419 return -1;
420 }
421 } else {
422 WARN("can't find reachable insn at %s+0x%x",
423 rela->sym->sec->name, rela->addend);
424 return -1;
425 }
426
427 insn->dead_end = false;
428 }
429
430 return 0;
431 }
432
433 /*
434 * Warnings shouldn't be reported for ignored functions.
435 */
436 static void add_ignores(struct objtool_file *file)
437 {
438 struct instruction *insn;
439 struct section *sec;
440 struct symbol *func;
441
442 for_each_sec(file, sec) {
443 list_for_each_entry(func, &sec->symbol_list, list) {
444 if (func->type != STT_FUNC)
445 continue;
446
447 if (!ignore_func(file, func))
448 continue;
449
450 func_for_each_insn_all(file, func, insn)
451 insn->ignore = true;
452 }
453 }
454 }
455
456 /*
457 * FIXME: For now, just ignore any alternatives which add retpolines. This is
458 * a temporary hack, as it doesn't allow ORC to unwind from inside a retpoline.
459 * But it at least allows objtool to understand the control flow *around* the
460 * retpoline.
461 */
462 static int add_nospec_ignores(struct objtool_file *file)
463 {
464 struct section *sec;
465 struct rela *rela;
466 struct instruction *insn;
467
468 sec = find_section_by_name(file->elf, ".rela.discard.nospec");
469 if (!sec)
470 return 0;
471
472 list_for_each_entry(rela, &sec->rela_list, list) {
473 if (rela->sym->type != STT_SECTION) {
474 WARN("unexpected relocation symbol type in %s", sec->name);
475 return -1;
476 }
477
478 insn = find_insn(file, rela->sym->sec, rela->addend);
479 if (!insn) {
480 WARN("bad .discard.nospec entry");
481 return -1;
482 }
483
484 insn->ignore_alts = true;
485 }
486
487 return 0;
488 }
489
490 /*
491 * Find the destination instructions for all jumps.
492 */
493 static int add_jump_destinations(struct objtool_file *file)
494 {
495 struct instruction *insn;
496 struct rela *rela;
497 struct section *dest_sec;
498 unsigned long dest_off;
499
500 for_each_insn(file, insn) {
501 if (insn->type != INSN_JUMP_CONDITIONAL &&
502 insn->type != INSN_JUMP_UNCONDITIONAL)
503 continue;
504
505 if (insn->ignore || insn->offset == FAKE_JUMP_OFFSET)
506 continue;
507
508 rela = find_rela_by_dest_range(insn->sec, insn->offset,
509 insn->len);
510 if (!rela) {
511 dest_sec = insn->sec;
512 dest_off = insn->offset + insn->len + insn->immediate;
513 } else if (rela->sym->type == STT_SECTION) {
514 dest_sec = rela->sym->sec;
515 dest_off = rela->addend + 4;
516 } else if (rela->sym->sec->idx) {
517 dest_sec = rela->sym->sec;
518 dest_off = rela->sym->sym.st_value + rela->addend + 4;
519 } else if (strstr(rela->sym->name, "_indirect_thunk_")) {
520 /*
521 * Retpoline jumps are really dynamic jumps in
522 * disguise, so convert them accordingly.
523 */
524 insn->type = INSN_JUMP_DYNAMIC;
525 insn->retpoline_safe = true;
526 continue;
527 } else {
528 /* sibling call */
529 insn->jump_dest = 0;
530 continue;
531 }
532
533 insn->jump_dest = find_insn(file, dest_sec, dest_off);
534 if (!insn->jump_dest) {
535
536 /*
537 * This is a special case where an alt instruction
538 * jumps past the end of the section. These are
539 * handled later in handle_group_alt().
540 */
541 if (!strcmp(insn->sec->name, ".altinstr_replacement"))
542 continue;
543
544 WARN_FUNC("can't find jump dest instruction at %s+0x%lx",
545 insn->sec, insn->offset, dest_sec->name,
546 dest_off);
547 return -1;
548 }
549 }
550
551 return 0;
552 }
553
554 /*
555 * Find the destination instructions for all calls.
556 */
557 static int add_call_destinations(struct objtool_file *file)
558 {
559 struct instruction *insn;
560 unsigned long dest_off;
561 struct rela *rela;
562
563 for_each_insn(file, insn) {
564 if (insn->type != INSN_CALL)
565 continue;
566
567 rela = find_rela_by_dest_range(insn->sec, insn->offset,
568 insn->len);
569 if (!rela) {
570 dest_off = insn->offset + insn->len + insn->immediate;
571 insn->call_dest = find_symbol_by_offset(insn->sec,
572 dest_off);
573
574 if (!insn->call_dest && !insn->ignore) {
575 WARN_FUNC("unsupported intra-function call",
576 insn->sec, insn->offset);
577 if (retpoline)
578 WARN("If this is a retpoline, please patch it in with alternatives and annotate it with ANNOTATE_NOSPEC_ALTERNATIVE.");
579 return -1;
580 }
581
582 } else if (rela->sym->type == STT_SECTION) {
583 insn->call_dest = find_symbol_by_offset(rela->sym->sec,
584 rela->addend+4);
585 if (!insn->call_dest ||
586 insn->call_dest->type != STT_FUNC) {
587 WARN_FUNC("can't find call dest symbol at %s+0x%x",
588 insn->sec, insn->offset,
589 rela->sym->sec->name,
590 rela->addend + 4);
591 return -1;
592 }
593 } else
594 insn->call_dest = rela->sym;
595 }
596
597 return 0;
598 }
599
600 /*
601 * The .alternatives section requires some extra special care, over and above
602 * what other special sections require:
603 *
604 * 1. Because alternatives are patched in-place, we need to insert a fake jump
605 * instruction at the end so that validate_branch() skips all the original
606 * replaced instructions when validating the new instruction path.
607 *
608 * 2. An added wrinkle is that the new instruction length might be zero. In
609 * that case the old instructions are replaced with noops. We simulate that
610 * by creating a fake jump as the only new instruction.
611 *
612 * 3. In some cases, the alternative section includes an instruction which
613 * conditionally jumps to the _end_ of the entry. We have to modify these
614 * jumps' destinations to point back to .text rather than the end of the
615 * entry in .altinstr_replacement.
616 *
617 * 4. It has been requested that we don't validate the !POPCNT feature path
618 * which is a "very very small percentage of machines".
619 */
620 static int handle_group_alt(struct objtool_file *file,
621 struct special_alt *special_alt,
622 struct instruction *orig_insn,
623 struct instruction **new_insn)
624 {
625 struct instruction *last_orig_insn, *last_new_insn, *insn, *fake_jump = NULL;
626 unsigned long dest_off;
627
628 last_orig_insn = NULL;
629 insn = orig_insn;
630 sec_for_each_insn_from(file, insn) {
631 if (insn->offset >= special_alt->orig_off + special_alt->orig_len)
632 break;
633
634 if (special_alt->skip_orig)
635 insn->type = INSN_NOP;
636
637 insn->alt_group = true;
638 last_orig_insn = insn;
639 }
640
641 if (next_insn_same_sec(file, last_orig_insn)) {
642 fake_jump = malloc(sizeof(*fake_jump));
643 if (!fake_jump) {
644 WARN("malloc failed");
645 return -1;
646 }
647 memset(fake_jump, 0, sizeof(*fake_jump));
648 INIT_LIST_HEAD(&fake_jump->alts);
649 clear_insn_state(&fake_jump->state);
650
651 fake_jump->sec = special_alt->new_sec;
652 fake_jump->offset = FAKE_JUMP_OFFSET;
653 fake_jump->type = INSN_JUMP_UNCONDITIONAL;
654 fake_jump->jump_dest = list_next_entry(last_orig_insn, list);
655 fake_jump->func = orig_insn->func;
656 }
657
658 if (!special_alt->new_len) {
659 if (!fake_jump) {
660 WARN("%s: empty alternative at end of section",
661 special_alt->orig_sec->name);
662 return -1;
663 }
664
665 *new_insn = fake_jump;
666 return 0;
667 }
668
669 last_new_insn = NULL;
670 insn = *new_insn;
671 sec_for_each_insn_from(file, insn) {
672 if (insn->offset >= special_alt->new_off + special_alt->new_len)
673 break;
674
675 last_new_insn = insn;
676
677 insn->ignore = orig_insn->ignore_alts;
678
679 if (insn->type != INSN_JUMP_CONDITIONAL &&
680 insn->type != INSN_JUMP_UNCONDITIONAL)
681 continue;
682
683 if (!insn->immediate)
684 continue;
685
686 dest_off = insn->offset + insn->len + insn->immediate;
687 if (dest_off == special_alt->new_off + special_alt->new_len) {
688 if (!fake_jump) {
689 WARN("%s: alternative jump to end of section",
690 special_alt->orig_sec->name);
691 return -1;
692 }
693 insn->jump_dest = fake_jump;
694 }
695
696 if (!insn->jump_dest) {
697 WARN_FUNC("can't find alternative jump destination",
698 insn->sec, insn->offset);
699 return -1;
700 }
701 }
702
703 if (!last_new_insn) {
704 WARN_FUNC("can't find last new alternative instruction",
705 special_alt->new_sec, special_alt->new_off);
706 return -1;
707 }
708
709 if (fake_jump)
710 list_add(&fake_jump->list, &last_new_insn->list);
711
712 return 0;
713 }
714
715 /*
716 * A jump table entry can either convert a nop to a jump or a jump to a nop.
717 * If the original instruction is a jump, make the alt entry an effective nop
718 * by just skipping the original instruction.
719 */
720 static int handle_jump_alt(struct objtool_file *file,
721 struct special_alt *special_alt,
722 struct instruction *orig_insn,
723 struct instruction **new_insn)
724 {
725 if (orig_insn->type == INSN_NOP)
726 return 0;
727
728 if (orig_insn->type != INSN_JUMP_UNCONDITIONAL) {
729 WARN_FUNC("unsupported instruction at jump label",
730 orig_insn->sec, orig_insn->offset);
731 return -1;
732 }
733
734 *new_insn = list_next_entry(orig_insn, list);
735 return 0;
736 }
737
738 /*
739 * Read all the special sections which have alternate instructions which can be
740 * patched in or redirected to at runtime. Each instruction having alternate
741 * instruction(s) has them added to its insn->alts list, which will be
742 * traversed in validate_branch().
743 */
744 static int add_special_section_alts(struct objtool_file *file)
745 {
746 struct list_head special_alts;
747 struct instruction *orig_insn, *new_insn;
748 struct special_alt *special_alt, *tmp;
749 struct alternative *alt;
750 int ret;
751
752 ret = special_get_alts(file->elf, &special_alts);
753 if (ret)
754 return ret;
755
756 list_for_each_entry_safe(special_alt, tmp, &special_alts, list) {
757
758 orig_insn = find_insn(file, special_alt->orig_sec,
759 special_alt->orig_off);
760 if (!orig_insn) {
761 WARN_FUNC("special: can't find orig instruction",
762 special_alt->orig_sec, special_alt->orig_off);
763 ret = -1;
764 goto out;
765 }
766
767 new_insn = NULL;
768 if (!special_alt->group || special_alt->new_len) {
769 new_insn = find_insn(file, special_alt->new_sec,
770 special_alt->new_off);
771 if (!new_insn) {
772 WARN_FUNC("special: can't find new instruction",
773 special_alt->new_sec,
774 special_alt->new_off);
775 ret = -1;
776 goto out;
777 }
778 }
779
780 if (special_alt->group) {
781 ret = handle_group_alt(file, special_alt, orig_insn,
782 &new_insn);
783 if (ret)
784 goto out;
785 } else if (special_alt->jump_or_nop) {
786 ret = handle_jump_alt(file, special_alt, orig_insn,
787 &new_insn);
788 if (ret)
789 goto out;
790 }
791
792 alt = malloc(sizeof(*alt));
793 if (!alt) {
794 WARN("malloc failed");
795 ret = -1;
796 goto out;
797 }
798
799 alt->insn = new_insn;
800 list_add_tail(&alt->list, &orig_insn->alts);
801
802 list_del(&special_alt->list);
803 free(special_alt);
804 }
805
806 out:
807 return ret;
808 }
809
810 static int add_switch_table(struct objtool_file *file, struct instruction *insn,
811 struct rela *table, struct rela *next_table)
812 {
813 struct rela *rela = table;
814 struct instruction *alt_insn;
815 struct alternative *alt;
816 struct symbol *pfunc = insn->func->pfunc;
817 unsigned int prev_offset = 0;
818
819 list_for_each_entry_from(rela, &file->rodata->rela->rela_list, list) {
820 if (rela == next_table)
821 break;
822
823 /* Make sure the switch table entries are consecutive: */
824 if (prev_offset && rela->offset != prev_offset + 8)
825 break;
826
827 /* Detect function pointers from contiguous objects: */
828 if (rela->sym->sec == pfunc->sec &&
829 rela->addend == pfunc->offset)
830 break;
831
832 alt_insn = find_insn(file, rela->sym->sec, rela->addend);
833 if (!alt_insn)
834 break;
835
836 /* Make sure the jmp dest is in the function or subfunction: */
837 if (alt_insn->func->pfunc != pfunc)
838 break;
839
840 alt = malloc(sizeof(*alt));
841 if (!alt) {
842 WARN("malloc failed");
843 return -1;
844 }
845
846 alt->insn = alt_insn;
847 list_add_tail(&alt->list, &insn->alts);
848 prev_offset = rela->offset;
849 }
850
851 if (!prev_offset) {
852 WARN_FUNC("can't find switch jump table",
853 insn->sec, insn->offset);
854 return -1;
855 }
856
857 return 0;
858 }
859
860 /*
861 * find_switch_table() - Given a dynamic jump, find the switch jump table in
862 * .rodata associated with it.
863 *
864 * There are 3 basic patterns:
865 *
866 * 1. jmpq *[rodata addr](,%reg,8)
867 *
868 * This is the most common case by far. It jumps to an address in a simple
869 * jump table which is stored in .rodata.
870 *
871 * 2. jmpq *[rodata addr](%rip)
872 *
873 * This is caused by a rare GCC quirk, currently only seen in three driver
874 * functions in the kernel, only with certain obscure non-distro configs.
875 *
876 * As part of an optimization, GCC makes a copy of an existing switch jump
877 * table, modifies it, and then hard-codes the jump (albeit with an indirect
878 * jump) to use a single entry in the table. The rest of the jump table and
879 * some of its jump targets remain as dead code.
880 *
881 * In such a case we can just crudely ignore all unreachable instruction
882 * warnings for the entire object file. Ideally we would just ignore them
883 * for the function, but that would require redesigning the code quite a
884 * bit. And honestly that's just not worth doing: unreachable instruction
885 * warnings are of questionable value anyway, and this is such a rare issue.
886 *
887 * 3. mov [rodata addr],%reg1
888 * ... some instructions ...
889 * jmpq *(%reg1,%reg2,8)
890 *
891 * This is a fairly uncommon pattern which is new for GCC 6. As of this
892 * writing, there are 11 occurrences of it in the allmodconfig kernel.
893 *
894 * As of GCC 7 there are quite a few more of these and the 'in between' code
895 * is significant. Esp. with KASAN enabled some of the code between the mov
896 * and jmpq uses .rodata itself, which can confuse things.
897 *
898 * TODO: Once we have DWARF CFI and smarter instruction decoding logic,
899 * ensure the same register is used in the mov and jump instructions.
900 *
901 * NOTE: RETPOLINE made it harder still to decode dynamic jumps.
902 */
903 static struct rela *find_switch_table(struct objtool_file *file,
904 struct symbol *func,
905 struct instruction *insn)
906 {
907 struct rela *text_rela, *rodata_rela;
908 struct instruction *orig_insn = insn;
909 unsigned long table_offset;
910
911 /*
912 * Backward search using the @first_jump_src links, these help avoid
913 * much of the 'in between' code. Which avoids us getting confused by
914 * it.
915 */
916 for (;
917 &insn->list != &file->insn_list &&
918 insn->sec == func->sec &&
919 insn->offset >= func->offset;
920
921 insn = insn->first_jump_src ?: list_prev_entry(insn, list)) {
922
923 if (insn != orig_insn && insn->type == INSN_JUMP_DYNAMIC)
924 break;
925
926 /* allow small jumps within the range */
927 if (insn->type == INSN_JUMP_UNCONDITIONAL &&
928 insn->jump_dest &&
929 (insn->jump_dest->offset <= insn->offset ||
930 insn->jump_dest->offset > orig_insn->offset))
931 break;
932
933 /* look for a relocation which references .rodata */
934 text_rela = find_rela_by_dest_range(insn->sec, insn->offset,
935 insn->len);
936 if (!text_rela || text_rela->sym != file->rodata->sym)
937 continue;
938
939 table_offset = text_rela->addend;
940 if (text_rela->type == R_X86_64_PC32)
941 table_offset += 4;
942
943 /*
944 * Make sure the .rodata address isn't associated with a
945 * symbol. gcc jump tables are anonymous data.
946 */
947 if (find_symbol_containing(file->rodata, table_offset))
948 continue;
949
950 rodata_rela = find_rela_by_dest(file->rodata, table_offset);
951 if (rodata_rela) {
952 /*
953 * Use of RIP-relative switch jumps is quite rare, and
954 * indicates a rare GCC quirk/bug which can leave dead
955 * code behind.
956 */
957 if (text_rela->type == R_X86_64_PC32)
958 file->ignore_unreachables = true;
959
960 return rodata_rela;
961 }
962 }
963
964 return NULL;
965 }
966
967
968 static int add_func_switch_tables(struct objtool_file *file,
969 struct symbol *func)
970 {
971 struct instruction *insn, *last = NULL, *prev_jump = NULL;
972 struct rela *rela, *prev_rela = NULL;
973 int ret;
974
975 func_for_each_insn_all(file, func, insn) {
976 if (!last)
977 last = insn;
978
979 /*
980 * Store back-pointers for unconditional forward jumps such
981 * that find_switch_table() can back-track using those and
982 * avoid some potentially confusing code.
983 */
984 if (insn->type == INSN_JUMP_UNCONDITIONAL && insn->jump_dest &&
985 insn->offset > last->offset &&
986 insn->jump_dest->offset > insn->offset &&
987 !insn->jump_dest->first_jump_src) {
988
989 insn->jump_dest->first_jump_src = insn;
990 last = insn->jump_dest;
991 }
992
993 if (insn->type != INSN_JUMP_DYNAMIC)
994 continue;
995
996 rela = find_switch_table(file, func, insn);
997 if (!rela)
998 continue;
999
1000 /*
1001 * We found a switch table, but we don't know yet how big it
1002 * is. Don't add it until we reach the end of the function or
1003 * the beginning of another switch table in the same function.
1004 */
1005 if (prev_jump) {
1006 ret = add_switch_table(file, prev_jump, prev_rela, rela);
1007 if (ret)
1008 return ret;
1009 }
1010
1011 prev_jump = insn;
1012 prev_rela = rela;
1013 }
1014
1015 if (prev_jump) {
1016 ret = add_switch_table(file, prev_jump, prev_rela, NULL);
1017 if (ret)
1018 return ret;
1019 }
1020
1021 return 0;
1022 }
1023
1024 /*
1025 * For some switch statements, gcc generates a jump table in the .rodata
1026 * section which contains a list of addresses within the function to jump to.
1027 * This finds these jump tables and adds them to the insn->alts lists.
1028 */
1029 static int add_switch_table_alts(struct objtool_file *file)
1030 {
1031 struct section *sec;
1032 struct symbol *func;
1033 int ret;
1034
1035 if (!file->rodata || !file->rodata->rela)
1036 return 0;
1037
1038 for_each_sec(file, sec) {
1039 list_for_each_entry(func, &sec->symbol_list, list) {
1040 if (func->type != STT_FUNC)
1041 continue;
1042
1043 ret = add_func_switch_tables(file, func);
1044 if (ret)
1045 return ret;
1046 }
1047 }
1048
1049 return 0;
1050 }
1051
1052 static int read_unwind_hints(struct objtool_file *file)
1053 {
1054 struct section *sec, *relasec;
1055 struct rela *rela;
1056 struct unwind_hint *hint;
1057 struct instruction *insn;
1058 struct cfi_reg *cfa;
1059 int i;
1060
1061 sec = find_section_by_name(file->elf, ".discard.unwind_hints");
1062 if (!sec)
1063 return 0;
1064
1065 relasec = sec->rela;
1066 if (!relasec) {
1067 WARN("missing .rela.discard.unwind_hints section");
1068 return -1;
1069 }
1070
1071 if (sec->len % sizeof(struct unwind_hint)) {
1072 WARN("struct unwind_hint size mismatch");
1073 return -1;
1074 }
1075
1076 file->hints = true;
1077
1078 for (i = 0; i < sec->len / sizeof(struct unwind_hint); i++) {
1079 hint = (struct unwind_hint *)sec->data->d_buf + i;
1080
1081 rela = find_rela_by_dest(sec, i * sizeof(*hint));
1082 if (!rela) {
1083 WARN("can't find rela for unwind_hints[%d]", i);
1084 return -1;
1085 }
1086
1087 insn = find_insn(file, rela->sym->sec, rela->addend);
1088 if (!insn) {
1089 WARN("can't find insn for unwind_hints[%d]", i);
1090 return -1;
1091 }
1092
1093 cfa = &insn->state.cfa;
1094
1095 if (hint->type == UNWIND_HINT_TYPE_SAVE) {
1096 insn->save = true;
1097 continue;
1098
1099 } else if (hint->type == UNWIND_HINT_TYPE_RESTORE) {
1100 insn->restore = true;
1101 insn->hint = true;
1102 continue;
1103 }
1104
1105 insn->hint = true;
1106
1107 switch (hint->sp_reg) {
1108 case ORC_REG_UNDEFINED:
1109 cfa->base = CFI_UNDEFINED;
1110 break;
1111 case ORC_REG_SP:
1112 cfa->base = CFI_SP;
1113 break;
1114 case ORC_REG_BP:
1115 cfa->base = CFI_BP;
1116 break;
1117 case ORC_REG_SP_INDIRECT:
1118 cfa->base = CFI_SP_INDIRECT;
1119 break;
1120 case ORC_REG_R10:
1121 cfa->base = CFI_R10;
1122 break;
1123 case ORC_REG_R13:
1124 cfa->base = CFI_R13;
1125 break;
1126 case ORC_REG_DI:
1127 cfa->base = CFI_DI;
1128 break;
1129 case ORC_REG_DX:
1130 cfa->base = CFI_DX;
1131 break;
1132 default:
1133 WARN_FUNC("unsupported unwind_hint sp base reg %d",
1134 insn->sec, insn->offset, hint->sp_reg);
1135 return -1;
1136 }
1137
1138 cfa->offset = hint->sp_offset;
1139 insn->state.type = hint->type;
1140 }
1141
1142 return 0;
1143 }
1144
1145 static int read_retpoline_hints(struct objtool_file *file)
1146 {
1147 struct section *sec;
1148 struct instruction *insn;
1149 struct rela *rela;
1150
1151 sec = find_section_by_name(file->elf, ".rela.discard.retpoline_safe");
1152 if (!sec)
1153 return 0;
1154
1155 list_for_each_entry(rela, &sec->rela_list, list) {
1156 if (rela->sym->type != STT_SECTION) {
1157 WARN("unexpected relocation symbol type in %s", sec->name);
1158 return -1;
1159 }
1160
1161 insn = find_insn(file, rela->sym->sec, rela->addend);
1162 if (!insn) {
1163 WARN("bad .discard.retpoline_safe entry");
1164 return -1;
1165 }
1166
1167 if (insn->type != INSN_JUMP_DYNAMIC &&
1168 insn->type != INSN_CALL_DYNAMIC) {
1169 WARN_FUNC("retpoline_safe hint not an indirect jump/call",
1170 insn->sec, insn->offset);
1171 return -1;
1172 }
1173
1174 insn->retpoline_safe = true;
1175 }
1176
1177 return 0;
1178 }
1179
1180 static int decode_sections(struct objtool_file *file)
1181 {
1182 int ret;
1183
1184 ret = decode_instructions(file);
1185 if (ret)
1186 return ret;
1187
1188 ret = add_dead_ends(file);
1189 if (ret)
1190 return ret;
1191
1192 add_ignores(file);
1193
1194 ret = add_nospec_ignores(file);
1195 if (ret)
1196 return ret;
1197
1198 ret = add_jump_destinations(file);
1199 if (ret)
1200 return ret;
1201
1202 ret = add_special_section_alts(file);
1203 if (ret)
1204 return ret;
1205
1206 ret = add_call_destinations(file);
1207 if (ret)
1208 return ret;
1209
1210 ret = add_switch_table_alts(file);
1211 if (ret)
1212 return ret;
1213
1214 ret = read_unwind_hints(file);
1215 if (ret)
1216 return ret;
1217
1218 ret = read_retpoline_hints(file);
1219 if (ret)
1220 return ret;
1221
1222 return 0;
1223 }
1224
1225 static bool is_fentry_call(struct instruction *insn)
1226 {
1227 if (insn->type == INSN_CALL &&
1228 insn->call_dest->type == STT_NOTYPE &&
1229 !strcmp(insn->call_dest->name, "__fentry__"))
1230 return true;
1231
1232 return false;
1233 }
1234
1235 static bool has_modified_stack_frame(struct insn_state *state)
1236 {
1237 int i;
1238
1239 if (state->cfa.base != initial_func_cfi.cfa.base ||
1240 state->cfa.offset != initial_func_cfi.cfa.offset ||
1241 state->stack_size != initial_func_cfi.cfa.offset ||
1242 state->drap)
1243 return true;
1244
1245 for (i = 0; i < CFI_NUM_REGS; i++)
1246 if (state->regs[i].base != initial_func_cfi.regs[i].base ||
1247 state->regs[i].offset != initial_func_cfi.regs[i].offset)
1248 return true;
1249
1250 return false;
1251 }
1252
1253 static bool has_valid_stack_frame(struct insn_state *state)
1254 {
1255 if (state->cfa.base == CFI_BP && state->regs[CFI_BP].base == CFI_CFA &&
1256 state->regs[CFI_BP].offset == -16)
1257 return true;
1258
1259 if (state->drap && state->regs[CFI_BP].base == CFI_BP)
1260 return true;
1261
1262 return false;
1263 }
1264
1265 static int update_insn_state_regs(struct instruction *insn, struct insn_state *state)
1266 {
1267 struct cfi_reg *cfa = &state->cfa;
1268 struct stack_op *op = &insn->stack_op;
1269
1270 if (cfa->base != CFI_SP)
1271 return 0;
1272
1273 /* push */
1274 if (op->dest.type == OP_DEST_PUSH)
1275 cfa->offset += 8;
1276
1277 /* pop */
1278 if (op->src.type == OP_SRC_POP)
1279 cfa->offset -= 8;
1280
1281 /* add immediate to sp */
1282 if (op->dest.type == OP_DEST_REG && op->src.type == OP_SRC_ADD &&
1283 op->dest.reg == CFI_SP && op->src.reg == CFI_SP)
1284 cfa->offset -= op->src.offset;
1285
1286 return 0;
1287 }
1288
1289 static void save_reg(struct insn_state *state, unsigned char reg, int base,
1290 int offset)
1291 {
1292 if (arch_callee_saved_reg(reg) &&
1293 state->regs[reg].base == CFI_UNDEFINED) {
1294 state->regs[reg].base = base;
1295 state->regs[reg].offset = offset;
1296 }
1297 }
1298
1299 static void restore_reg(struct insn_state *state, unsigned char reg)
1300 {
1301 state->regs[reg].base = CFI_UNDEFINED;
1302 state->regs[reg].offset = 0;
1303 }
1304
1305 /*
1306 * A note about DRAP stack alignment:
1307 *
1308 * GCC has the concept of a DRAP register, which is used to help keep track of
1309 * the stack pointer when aligning the stack. r10 or r13 is used as the DRAP
1310 * register. The typical DRAP pattern is:
1311 *
1312 * 4c 8d 54 24 08 lea 0x8(%rsp),%r10
1313 * 48 83 e4 c0 and $0xffffffffffffffc0,%rsp
1314 * 41 ff 72 f8 pushq -0x8(%r10)
1315 * 55 push %rbp
1316 * 48 89 e5 mov %rsp,%rbp
1317 * (more pushes)
1318 * 41 52 push %r10
1319 * ...
1320 * 41 5a pop %r10
1321 * (more pops)
1322 * 5d pop %rbp
1323 * 49 8d 62 f8 lea -0x8(%r10),%rsp
1324 * c3 retq
1325 *
1326 * There are some variations in the epilogues, like:
1327 *
1328 * 5b pop %rbx
1329 * 41 5a pop %r10
1330 * 41 5c pop %r12
1331 * 41 5d pop %r13
1332 * 41 5e pop %r14
1333 * c9 leaveq
1334 * 49 8d 62 f8 lea -0x8(%r10),%rsp
1335 * c3 retq
1336 *
1337 * and:
1338 *
1339 * 4c 8b 55 e8 mov -0x18(%rbp),%r10
1340 * 48 8b 5d e0 mov -0x20(%rbp),%rbx
1341 * 4c 8b 65 f0 mov -0x10(%rbp),%r12
1342 * 4c 8b 6d f8 mov -0x8(%rbp),%r13
1343 * c9 leaveq
1344 * 49 8d 62 f8 lea -0x8(%r10),%rsp
1345 * c3 retq
1346 *
1347 * Sometimes r13 is used as the DRAP register, in which case it's saved and
1348 * restored beforehand:
1349 *
1350 * 41 55 push %r13
1351 * 4c 8d 6c 24 10 lea 0x10(%rsp),%r13
1352 * 48 83 e4 f0 and $0xfffffffffffffff0,%rsp
1353 * ...
1354 * 49 8d 65 f0 lea -0x10(%r13),%rsp
1355 * 41 5d pop %r13
1356 * c3 retq
1357 */
1358 static int update_insn_state(struct instruction *insn, struct insn_state *state)
1359 {
1360 struct stack_op *op = &insn->stack_op;
1361 struct cfi_reg *cfa = &state->cfa;
1362 struct cfi_reg *regs = state->regs;
1363
1364 /* stack operations don't make sense with an undefined CFA */
1365 if (cfa->base == CFI_UNDEFINED) {
1366 if (insn->func) {
1367 WARN_FUNC("undefined stack state", insn->sec, insn->offset);
1368 return -1;
1369 }
1370 return 0;
1371 }
1372
1373 if (state->type == ORC_TYPE_REGS || state->type == ORC_TYPE_REGS_IRET)
1374 return update_insn_state_regs(insn, state);
1375
1376 switch (op->dest.type) {
1377
1378 case OP_DEST_REG:
1379 switch (op->src.type) {
1380
1381 case OP_SRC_REG:
1382 if (op->src.reg == CFI_SP && op->dest.reg == CFI_BP &&
1383 cfa->base == CFI_SP &&
1384 regs[CFI_BP].base == CFI_CFA &&
1385 regs[CFI_BP].offset == -cfa->offset) {
1386
1387 /* mov %rsp, %rbp */
1388 cfa->base = op->dest.reg;
1389 state->bp_scratch = false;
1390 }
1391
1392 else if (op->src.reg == CFI_SP &&
1393 op->dest.reg == CFI_BP && state->drap) {
1394
1395 /* drap: mov %rsp, %rbp */
1396 regs[CFI_BP].base = CFI_BP;
1397 regs[CFI_BP].offset = -state->stack_size;
1398 state->bp_scratch = false;
1399 }
1400
1401 else if (op->src.reg == CFI_SP && cfa->base == CFI_SP) {
1402
1403 /*
1404 * mov %rsp, %reg
1405 *
1406 * This is needed for the rare case where GCC
1407 * does:
1408 *
1409 * mov %rsp, %rax
1410 * ...
1411 * mov %rax, %rsp
1412 */
1413 state->vals[op->dest.reg].base = CFI_CFA;
1414 state->vals[op->dest.reg].offset = -state->stack_size;
1415 }
1416
1417 else if (op->src.reg == CFI_BP && op->dest.reg == CFI_SP &&
1418 cfa->base == CFI_BP) {
1419
1420 /*
1421 * mov %rbp, %rsp
1422 *
1423 * Restore the original stack pointer (Clang).
1424 */
1425 state->stack_size = -state->regs[CFI_BP].offset;
1426 }
1427
1428 else if (op->dest.reg == cfa->base) {
1429
1430 /* mov %reg, %rsp */
1431 if (cfa->base == CFI_SP &&
1432 state->vals[op->src.reg].base == CFI_CFA) {
1433
1434 /*
1435 * This is needed for the rare case
1436 * where GCC does something dumb like:
1437 *
1438 * lea 0x8(%rsp), %rcx
1439 * ...
1440 * mov %rcx, %rsp
1441 */
1442 cfa->offset = -state->vals[op->src.reg].offset;
1443 state->stack_size = cfa->offset;
1444
1445 } else {
1446 cfa->base = CFI_UNDEFINED;
1447 cfa->offset = 0;
1448 }
1449 }
1450
1451 break;
1452
1453 case OP_SRC_ADD:
1454 if (op->dest.reg == CFI_SP && op->src.reg == CFI_SP) {
1455
1456 /* add imm, %rsp */
1457 state->stack_size -= op->src.offset;
1458 if (cfa->base == CFI_SP)
1459 cfa->offset -= op->src.offset;
1460 break;
1461 }
1462
1463 if (op->dest.reg == CFI_SP && op->src.reg == CFI_BP) {
1464
1465 /* lea disp(%rbp), %rsp */
1466 state->stack_size = -(op->src.offset + regs[CFI_BP].offset);
1467 break;
1468 }
1469
1470 if (op->src.reg == CFI_SP && cfa->base == CFI_SP) {
1471
1472 /* drap: lea disp(%rsp), %drap */
1473 state->drap_reg = op->dest.reg;
1474
1475 /*
1476 * lea disp(%rsp), %reg
1477 *
1478 * This is needed for the rare case where GCC
1479 * does something dumb like:
1480 *
1481 * lea 0x8(%rsp), %rcx
1482 * ...
1483 * mov %rcx, %rsp
1484 */
1485 state->vals[op->dest.reg].base = CFI_CFA;
1486 state->vals[op->dest.reg].offset = \
1487 -state->stack_size + op->src.offset;
1488
1489 break;
1490 }
1491
1492 if (state->drap && op->dest.reg == CFI_SP &&
1493 op->src.reg == state->drap_reg) {
1494
1495 /* drap: lea disp(%drap), %rsp */
1496 cfa->base = CFI_SP;
1497 cfa->offset = state->stack_size = -op->src.offset;
1498 state->drap_reg = CFI_UNDEFINED;
1499 state->drap = false;
1500 break;
1501 }
1502
1503 if (op->dest.reg == state->cfa.base) {
1504 WARN_FUNC("unsupported stack register modification",
1505 insn->sec, insn->offset);
1506 return -1;
1507 }
1508
1509 break;
1510
1511 case OP_SRC_AND:
1512 if (op->dest.reg != CFI_SP ||
1513 (state->drap_reg != CFI_UNDEFINED && cfa->base != CFI_SP) ||
1514 (state->drap_reg == CFI_UNDEFINED && cfa->base != CFI_BP)) {
1515 WARN_FUNC("unsupported stack pointer realignment",
1516 insn->sec, insn->offset);
1517 return -1;
1518 }
1519
1520 if (state->drap_reg != CFI_UNDEFINED) {
1521 /* drap: and imm, %rsp */
1522 cfa->base = state->drap_reg;
1523 cfa->offset = state->stack_size = 0;
1524 state->drap = true;
1525 }
1526
1527 /*
1528 * Older versions of GCC (4.8ish) realign the stack
1529 * without DRAP, with a frame pointer.
1530 */
1531
1532 break;
1533
1534 case OP_SRC_POP:
1535 if (!state->drap && op->dest.type == OP_DEST_REG &&
1536 op->dest.reg == cfa->base) {
1537
1538 /* pop %rbp */
1539 cfa->base = CFI_SP;
1540 }
1541
1542 if (state->drap && cfa->base == CFI_BP_INDIRECT &&
1543 op->dest.type == OP_DEST_REG &&
1544 op->dest.reg == state->drap_reg &&
1545 state->drap_offset == -state->stack_size) {
1546
1547 /* drap: pop %drap */
1548 cfa->base = state->drap_reg;
1549 cfa->offset = 0;
1550 state->drap_offset = -1;
1551
1552 } else if (regs[op->dest.reg].offset == -state->stack_size) {
1553
1554 /* pop %reg */
1555 restore_reg(state, op->dest.reg);
1556 }
1557
1558 state->stack_size -= 8;
1559 if (cfa->base == CFI_SP)
1560 cfa->offset -= 8;
1561
1562 break;
1563
1564 case OP_SRC_REG_INDIRECT:
1565 if (state->drap && op->src.reg == CFI_BP &&
1566 op->src.offset == state->drap_offset) {
1567
1568 /* drap: mov disp(%rbp), %drap */
1569 cfa->base = state->drap_reg;
1570 cfa->offset = 0;
1571 state->drap_offset = -1;
1572 }
1573
1574 if (state->drap && op->src.reg == CFI_BP &&
1575 op->src.offset == regs[op->dest.reg].offset) {
1576
1577 /* drap: mov disp(%rbp), %reg */
1578 restore_reg(state, op->dest.reg);
1579
1580 } else if (op->src.reg == cfa->base &&
1581 op->src.offset == regs[op->dest.reg].offset + cfa->offset) {
1582
1583 /* mov disp(%rbp), %reg */
1584 /* mov disp(%rsp), %reg */
1585 restore_reg(state, op->dest.reg);
1586 }
1587
1588 break;
1589
1590 default:
1591 WARN_FUNC("unknown stack-related instruction",
1592 insn->sec, insn->offset);
1593 return -1;
1594 }
1595
1596 break;
1597
1598 case OP_DEST_PUSH:
1599 state->stack_size += 8;
1600 if (cfa->base == CFI_SP)
1601 cfa->offset += 8;
1602
1603 if (op->src.type != OP_SRC_REG)
1604 break;
1605
1606 if (state->drap) {
1607 if (op->src.reg == cfa->base && op->src.reg == state->drap_reg) {
1608
1609 /* drap: push %drap */
1610 cfa->base = CFI_BP_INDIRECT;
1611 cfa->offset = -state->stack_size;
1612
1613 /* save drap so we know when to restore it */
1614 state->drap_offset = -state->stack_size;
1615
1616 } else if (op->src.reg == CFI_BP && cfa->base == state->drap_reg) {
1617
1618 /* drap: push %rbp */
1619 state->stack_size = 0;
1620
1621 } else if (regs[op->src.reg].base == CFI_UNDEFINED) {
1622
1623 /* drap: push %reg */
1624 save_reg(state, op->src.reg, CFI_BP, -state->stack_size);
1625 }
1626
1627 } else {
1628
1629 /* push %reg */
1630 save_reg(state, op->src.reg, CFI_CFA, -state->stack_size);
1631 }
1632
1633 /* detect when asm code uses rbp as a scratch register */
1634 if (!no_fp && insn->func && op->src.reg == CFI_BP &&
1635 cfa->base != CFI_BP)
1636 state->bp_scratch = true;
1637 break;
1638
1639 case OP_DEST_REG_INDIRECT:
1640
1641 if (state->drap) {
1642 if (op->src.reg == cfa->base && op->src.reg == state->drap_reg) {
1643
1644 /* drap: mov %drap, disp(%rbp) */
1645 cfa->base = CFI_BP_INDIRECT;
1646 cfa->offset = op->dest.offset;
1647
1648 /* save drap offset so we know when to restore it */
1649 state->drap_offset = op->dest.offset;
1650 }
1651
1652 else if (regs[op->src.reg].base == CFI_UNDEFINED) {
1653
1654 /* drap: mov reg, disp(%rbp) */
1655 save_reg(state, op->src.reg, CFI_BP, op->dest.offset);
1656 }
1657
1658 } else if (op->dest.reg == cfa->base) {
1659
1660 /* mov reg, disp(%rbp) */
1661 /* mov reg, disp(%rsp) */
1662 save_reg(state, op->src.reg, CFI_CFA,
1663 op->dest.offset - state->cfa.offset);
1664 }
1665
1666 break;
1667
1668 case OP_DEST_LEAVE:
1669 if ((!state->drap && cfa->base != CFI_BP) ||
1670 (state->drap && cfa->base != state->drap_reg)) {
1671 WARN_FUNC("leave instruction with modified stack frame",
1672 insn->sec, insn->offset);
1673 return -1;
1674 }
1675
1676 /* leave (mov %rbp, %rsp; pop %rbp) */
1677
1678 state->stack_size = -state->regs[CFI_BP].offset - 8;
1679 restore_reg(state, CFI_BP);
1680
1681 if (!state->drap) {
1682 cfa->base = CFI_SP;
1683 cfa->offset -= 8;
1684 }
1685
1686 break;
1687
1688 case OP_DEST_MEM:
1689 if (op->src.type != OP_SRC_POP) {
1690 WARN_FUNC("unknown stack-related memory operation",
1691 insn->sec, insn->offset);
1692 return -1;
1693 }
1694
1695 /* pop mem */
1696 state->stack_size -= 8;
1697 if (cfa->base == CFI_SP)
1698 cfa->offset -= 8;
1699
1700 break;
1701
1702 default:
1703 WARN_FUNC("unknown stack-related instruction",
1704 insn->sec, insn->offset);
1705 return -1;
1706 }
1707
1708 return 0;
1709 }
1710
1711 static bool insn_state_match(struct instruction *insn, struct insn_state *state)
1712 {
1713 struct insn_state *state1 = &insn->state, *state2 = state;
1714 int i;
1715
1716 if (memcmp(&state1->cfa, &state2->cfa, sizeof(state1->cfa))) {
1717 WARN_FUNC("stack state mismatch: cfa1=%d%+d cfa2=%d%+d",
1718 insn->sec, insn->offset,
1719 state1->cfa.base, state1->cfa.offset,
1720 state2->cfa.base, state2->cfa.offset);
1721
1722 } else if (memcmp(&state1->regs, &state2->regs, sizeof(state1->regs))) {
1723 for (i = 0; i < CFI_NUM_REGS; i++) {
1724 if (!memcmp(&state1->regs[i], &state2->regs[i],
1725 sizeof(struct cfi_reg)))
1726 continue;
1727
1728 WARN_FUNC("stack state mismatch: reg1[%d]=%d%+d reg2[%d]=%d%+d",
1729 insn->sec, insn->offset,
1730 i, state1->regs[i].base, state1->regs[i].offset,
1731 i, state2->regs[i].base, state2->regs[i].offset);
1732 break;
1733 }
1734
1735 } else if (state1->type != state2->type) {
1736 WARN_FUNC("stack state mismatch: type1=%d type2=%d",
1737 insn->sec, insn->offset, state1->type, state2->type);
1738
1739 } else if (state1->drap != state2->drap ||
1740 (state1->drap && state1->drap_reg != state2->drap_reg) ||
1741 (state1->drap && state1->drap_offset != state2->drap_offset)) {
1742 WARN_FUNC("stack state mismatch: drap1=%d(%d,%d) drap2=%d(%d,%d)",
1743 insn->sec, insn->offset,
1744 state1->drap, state1->drap_reg, state1->drap_offset,
1745 state2->drap, state2->drap_reg, state2->drap_offset);
1746
1747 } else
1748 return true;
1749
1750 return false;
1751 }
1752
1753 /*
1754 * Follow the branch starting at the given instruction, and recursively follow
1755 * any other branches (jumps). Meanwhile, track the frame pointer state at
1756 * each instruction and validate all the rules described in
1757 * tools/objtool/Documentation/stack-validation.txt.
1758 */
1759 static int validate_branch(struct objtool_file *file, struct instruction *first,
1760 struct insn_state state)
1761 {
1762 struct alternative *alt;
1763 struct instruction *insn, *next_insn;
1764 struct section *sec;
1765 struct symbol *func = NULL;
1766 int ret;
1767
1768 insn = first;
1769 sec = insn->sec;
1770
1771 if (insn->alt_group && list_empty(&insn->alts)) {
1772 WARN_FUNC("don't know how to handle branch to middle of alternative instruction group",
1773 sec, insn->offset);
1774 return 1;
1775 }
1776
1777 while (1) {
1778 next_insn = next_insn_same_sec(file, insn);
1779
1780 if (file->c_file && func && insn->func && func != insn->func->pfunc) {
1781 WARN("%s() falls through to next function %s()",
1782 func->name, insn->func->name);
1783 return 1;
1784 }
1785
1786 if (insn->func)
1787 func = insn->func->pfunc;
1788
1789 if (func && insn->ignore) {
1790 WARN_FUNC("BUG: why am I validating an ignored function?",
1791 sec, insn->offset);
1792 return 1;
1793 }
1794
1795 if (insn->visited) {
1796 if (!insn->hint && !insn_state_match(insn, &state))
1797 return 1;
1798
1799 return 0;
1800 }
1801
1802 if (insn->hint) {
1803 if (insn->restore) {
1804 struct instruction *save_insn, *i;
1805
1806 i = insn;
1807 save_insn = NULL;
1808 func_for_each_insn_continue_reverse(file, insn->func, i) {
1809 if (i->save) {
1810 save_insn = i;
1811 break;
1812 }
1813 }
1814
1815 if (!save_insn) {
1816 WARN_FUNC("no corresponding CFI save for CFI restore",
1817 sec, insn->offset);
1818 return 1;
1819 }
1820
1821 if (!save_insn->visited) {
1822 /*
1823 * Oops, no state to copy yet.
1824 * Hopefully we can reach this
1825 * instruction from another branch
1826 * after the save insn has been
1827 * visited.
1828 */
1829 if (insn == first)
1830 return 0;
1831
1832 WARN_FUNC("objtool isn't smart enough to handle this CFI save/restore combo",
1833 sec, insn->offset);
1834 return 1;
1835 }
1836
1837 insn->state = save_insn->state;
1838 }
1839
1840 state = insn->state;
1841
1842 } else
1843 insn->state = state;
1844
1845 insn->visited = true;
1846
1847 if (!insn->ignore_alts) {
1848 list_for_each_entry(alt, &insn->alts, list) {
1849 ret = validate_branch(file, alt->insn, state);
1850 if (ret)
1851 return 1;
1852 }
1853 }
1854
1855 switch (insn->type) {
1856
1857 case INSN_RETURN:
1858 if (func && has_modified_stack_frame(&state)) {
1859 WARN_FUNC("return with modified stack frame",
1860 sec, insn->offset);
1861 return 1;
1862 }
1863
1864 if (state.bp_scratch) {
1865 WARN("%s uses BP as a scratch register",
1866 insn->func->name);
1867 return 1;
1868 }
1869
1870 return 0;
1871
1872 case INSN_CALL:
1873 if (is_fentry_call(insn))
1874 break;
1875
1876 ret = dead_end_function(file, insn->call_dest);
1877 if (ret == 1)
1878 return 0;
1879 if (ret == -1)
1880 return 1;
1881
1882 /* fallthrough */
1883 case INSN_CALL_DYNAMIC:
1884 if (!no_fp && func && !has_valid_stack_frame(&state)) {
1885 WARN_FUNC("call without frame pointer save/setup",
1886 sec, insn->offset);
1887 return 1;
1888 }
1889 break;
1890
1891 case INSN_JUMP_CONDITIONAL:
1892 case INSN_JUMP_UNCONDITIONAL:
1893 if (insn->jump_dest &&
1894 (!func || !insn->jump_dest->func ||
1895 insn->jump_dest->func->pfunc == func)) {
1896 ret = validate_branch(file, insn->jump_dest,
1897 state);
1898 if (ret)
1899 return 1;
1900
1901 } else if (func && has_modified_stack_frame(&state)) {
1902 WARN_FUNC("sibling call from callable instruction with modified stack frame",
1903 sec, insn->offset);
1904 return 1;
1905 }
1906
1907 if (insn->type == INSN_JUMP_UNCONDITIONAL)
1908 return 0;
1909
1910 break;
1911
1912 case INSN_JUMP_DYNAMIC:
1913 if (func && list_empty(&insn->alts) &&
1914 has_modified_stack_frame(&state)) {
1915 WARN_FUNC("sibling call from callable instruction with modified stack frame",
1916 sec, insn->offset);
1917 return 1;
1918 }
1919
1920 return 0;
1921
1922 case INSN_CONTEXT_SWITCH:
1923 if (func && (!next_insn || !next_insn->hint)) {
1924 WARN_FUNC("unsupported instruction in callable function",
1925 sec, insn->offset);
1926 return 1;
1927 }
1928 return 0;
1929
1930 case INSN_STACK:
1931 if (update_insn_state(insn, &state))
1932 return 1;
1933
1934 break;
1935
1936 default:
1937 break;
1938 }
1939
1940 if (insn->dead_end)
1941 return 0;
1942
1943 if (!next_insn) {
1944 if (state.cfa.base == CFI_UNDEFINED)
1945 return 0;
1946 WARN("%s: unexpected end of section", sec->name);
1947 return 1;
1948 }
1949
1950 insn = next_insn;
1951 }
1952
1953 return 0;
1954 }
1955
1956 static int validate_unwind_hints(struct objtool_file *file)
1957 {
1958 struct instruction *insn;
1959 int ret, warnings = 0;
1960 struct insn_state state;
1961
1962 if (!file->hints)
1963 return 0;
1964
1965 clear_insn_state(&state);
1966
1967 for_each_insn(file, insn) {
1968 if (insn->hint && !insn->visited) {
1969 ret = validate_branch(file, insn, state);
1970 warnings += ret;
1971 }
1972 }
1973
1974 return warnings;
1975 }
1976
1977 static int validate_retpoline(struct objtool_file *file)
1978 {
1979 struct instruction *insn;
1980 int warnings = 0;
1981
1982 for_each_insn(file, insn) {
1983 if (insn->type != INSN_JUMP_DYNAMIC &&
1984 insn->type != INSN_CALL_DYNAMIC)
1985 continue;
1986
1987 if (insn->retpoline_safe)
1988 continue;
1989
1990 /*
1991 * .init.text code is ran before userspace and thus doesn't
1992 * strictly need retpolines, except for modules which are
1993 * loaded late, they very much do need retpoline in their
1994 * .init.text
1995 */
1996 if (!strcmp(insn->sec->name, ".init.text") && !module)
1997 continue;
1998
1999 WARN_FUNC("indirect %s found in RETPOLINE build",
2000 insn->sec, insn->offset,
2001 insn->type == INSN_JUMP_DYNAMIC ? "jump" : "call");
2002
2003 warnings++;
2004 }
2005
2006 return warnings;
2007 }
2008
2009 static bool is_kasan_insn(struct instruction *insn)
2010 {
2011 return (insn->type == INSN_CALL &&
2012 !strcmp(insn->call_dest->name, "__asan_handle_no_return"));
2013 }
2014
2015 static bool is_ubsan_insn(struct instruction *insn)
2016 {
2017 return (insn->type == INSN_CALL &&
2018 !strcmp(insn->call_dest->name,
2019 "__ubsan_handle_builtin_unreachable"));
2020 }
2021
2022 static bool ignore_unreachable_insn(struct instruction *insn)
2023 {
2024 int i;
2025
2026 if (insn->ignore || insn->type == INSN_NOP)
2027 return true;
2028
2029 /*
2030 * Ignore any unused exceptions. This can happen when a whitelisted
2031 * function has an exception table entry.
2032 *
2033 * Also ignore alternative replacement instructions. This can happen
2034 * when a whitelisted function uses one of the ALTERNATIVE macros.
2035 */
2036 if (!strcmp(insn->sec->name, ".fixup") ||
2037 !strcmp(insn->sec->name, ".altinstr_replacement") ||
2038 !strcmp(insn->sec->name, ".altinstr_aux"))
2039 return true;
2040
2041 /*
2042 * Check if this (or a subsequent) instruction is related to
2043 * CONFIG_UBSAN or CONFIG_KASAN.
2044 *
2045 * End the search at 5 instructions to avoid going into the weeds.
2046 */
2047 if (!insn->func)
2048 return false;
2049 for (i = 0; i < 5; i++) {
2050
2051 if (is_kasan_insn(insn) || is_ubsan_insn(insn))
2052 return true;
2053
2054 if (insn->type == INSN_JUMP_UNCONDITIONAL) {
2055 if (insn->jump_dest &&
2056 insn->jump_dest->func == insn->func) {
2057 insn = insn->jump_dest;
2058 continue;
2059 }
2060
2061 break;
2062 }
2063
2064 if (insn->offset + insn->len >= insn->func->offset + insn->func->len)
2065 break;
2066
2067 insn = list_next_entry(insn, list);
2068 }
2069
2070 return false;
2071 }
2072
2073 static int validate_functions(struct objtool_file *file)
2074 {
2075 struct section *sec;
2076 struct symbol *func;
2077 struct instruction *insn;
2078 struct insn_state state;
2079 int ret, warnings = 0;
2080
2081 clear_insn_state(&state);
2082
2083 state.cfa = initial_func_cfi.cfa;
2084 memcpy(&state.regs, &initial_func_cfi.regs,
2085 CFI_NUM_REGS * sizeof(struct cfi_reg));
2086 state.stack_size = initial_func_cfi.cfa.offset;
2087
2088 for_each_sec(file, sec) {
2089 list_for_each_entry(func, &sec->symbol_list, list) {
2090 if (func->type != STT_FUNC || func->pfunc != func)
2091 continue;
2092
2093 insn = find_insn(file, sec, func->offset);
2094 if (!insn || insn->ignore)
2095 continue;
2096
2097 ret = validate_branch(file, insn, state);
2098 warnings += ret;
2099 }
2100 }
2101
2102 return warnings;
2103 }
2104
2105 static int validate_reachable_instructions(struct objtool_file *file)
2106 {
2107 struct instruction *insn;
2108
2109 if (file->ignore_unreachables)
2110 return 0;
2111
2112 for_each_insn(file, insn) {
2113 if (insn->visited || ignore_unreachable_insn(insn))
2114 continue;
2115
2116 WARN_FUNC("unreachable instruction", insn->sec, insn->offset);
2117 return 1;
2118 }
2119
2120 return 0;
2121 }
2122
2123 static void cleanup(struct objtool_file *file)
2124 {
2125 struct instruction *insn, *tmpinsn;
2126 struct alternative *alt, *tmpalt;
2127
2128 list_for_each_entry_safe(insn, tmpinsn, &file->insn_list, list) {
2129 list_for_each_entry_safe(alt, tmpalt, &insn->alts, list) {
2130 list_del(&alt->list);
2131 free(alt);
2132 }
2133 list_del(&insn->list);
2134 hash_del(&insn->hash);
2135 free(insn);
2136 }
2137 elf_close(file->elf);
2138 }
2139
2140 static struct objtool_file file;
2141
2142 int check(const char *_objname, bool orc)
2143 {
2144 int ret, warnings = 0;
2145
2146 objname = _objname;
2147
2148 file.elf = elf_open(objname, orc ? O_RDWR : O_RDONLY);
2149 if (!file.elf)
2150 return 1;
2151
2152 INIT_LIST_HEAD(&file.insn_list);
2153 hash_init(file.insn_hash);
2154 file.whitelist = find_section_by_name(file.elf, ".discard.func_stack_frame_non_standard");
2155 file.rodata = find_section_by_name(file.elf, ".rodata");
2156 file.c_file = find_section_by_name(file.elf, ".comment");
2157 file.ignore_unreachables = no_unreachable;
2158 file.hints = false;
2159
2160 arch_initial_func_cfi_state(&initial_func_cfi);
2161
2162 ret = decode_sections(&file);
2163 if (ret < 0)
2164 goto out;
2165 warnings += ret;
2166
2167 if (list_empty(&file.insn_list))
2168 goto out;
2169
2170 if (retpoline) {
2171 ret = validate_retpoline(&file);
2172 if (ret < 0)
2173 return ret;
2174 warnings += ret;
2175 }
2176
2177 ret = validate_functions(&file);
2178 if (ret < 0)
2179 goto out;
2180 warnings += ret;
2181
2182 ret = validate_unwind_hints(&file);
2183 if (ret < 0)
2184 goto out;
2185 warnings += ret;
2186
2187 if (!warnings) {
2188 ret = validate_reachable_instructions(&file);
2189 if (ret < 0)
2190 goto out;
2191 warnings += ret;
2192 }
2193
2194 if (orc) {
2195 ret = create_orc(&file);
2196 if (ret < 0)
2197 goto out;
2198
2199 ret = create_orc_sections(&file);
2200 if (ret < 0)
2201 goto out;
2202
2203 ret = elf_write(file.elf);
2204 if (ret < 0)
2205 goto out;
2206 }
2207
2208 out:
2209 cleanup(&file);
2210
2211 /* ignore warnings for now until we get all the code cleaned up */
2212 if (ret || warnings)
2213 return 0;
2214 return 0;
2215 }
Linux with added FPC-III support