check.c 73 KB

12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061626364656667686970717273747576777879808182838485868788899091929394959697989910010110210310410510610710810911011111211311411511611711811912012112212312412512612712812913013113213313413513613713813914014114214314414514614714814915015115215315415515615715815916016116216316416516616716816917017117217317417517617717817918018118218318418518618718818919019119219319419519619719819920020120220320420520620720820921021121221321421521621721821922022122222322422522622722822923023123223323423523623723823924024124224324424524624724824925025125225325425525625725825926026126226326426526626726826927027127227327427527627727827928028128228328428528628728828929029129229329429529629729829930030130230330430530630730830931031131231331431531631731831932032132232332432532632732832933033133233333433533633733833934034134234334434534634734834935035135235335435535635735835936036136236336436536636736836937037137237337437537637737837938038138238338438538638738838939039139239339439539639739839940040140240340440540640740840941041141241341441541641741841942042142242342442542642742842943043143243343443543643743843944044144244344444544644744844945045145245345445545645745845946046146246346446546646746846947047147247347447547647747847948048148248348448548648748848949049149249349449549649749849950050150250350450550650750850951051151251351451551651751851952052152252352452552652752852953053153253353453553653753853954054154254354454554654754854955055155255355455555655755855956056156256356456556656756856957057157257357457557657757857958058158258358458558658758858959059159259359459559659759859960060160260360460560660760860961061161261361461561661761861962062162262362462562662762862963063163263363463563663763863964064164264364464564664764864965065165265365465565665765865966066166266366466566666766866967067167267367467567667767867968068168268368468568668768868969069169269369469569669769869970070170270370470570670770870971071171271371471571671771871972072172272372472572672772872973073173273373473573673773873974074174274374474574674774874975075175275375475575675775875976076176276376476576676776876977077177277377477577677777877978078178278378478578678778878979079179279379479579679779879980080180280380480580680780880981081181281381481581681781881982082182282382482582682782882983083183283383483583683783883984084184284384484584684784884985085185285385485585685785885986086186286386486586686786886987087187287387487587687787887988088188288388488588688788888989089189289389489589689789889990090190290390490590690790890991091191291391491591691791891992092192292392492592692792892993093193293393493593693793893994094194294394494594694794894995095195295395495595695795895996096196296396496596696796896997097197297397497597697797897998098198298398498598698798898999099199299399499599699799899910001001100210031004100510061007100810091010101110121013101410151016101710181019102010211022102310241025102610271028102910301031103210331034103510361037103810391040104110421043104410451046104710481049105010511052105310541055105610571058105910601061106210631064106510661067106810691070107110721073107410751076107710781079108010811082108310841085108610871088108910901091109210931094109510961097109810991100110111021103110411051106110711081109111011111112111311141115111611171118111911201121112211231124112511261127112811291130113111321133113411351136113711381139114011411142114311441145114611471148114911501151115211531154115511561157115811591160116111621163116411651166116711681169117011711172117311741175117611771178117911801181118211831184118511861187118811891190119111921193119411951196119711981199120012011202120312041205120612071208120912101211121212131214121512161217121812191220122112221223122412251226122712281229123012311232123312341235123612371238123912401241124212431244124512461247124812491250125112521253125412551256125712581259126012611262126312641265126612671268126912701271127212731274127512761277127812791280128112821283128412851286128712881289129012911292129312941295129612971298129913001301130213031304130513061307130813091310131113121313131413151316131713181319132013211322132313241325132613271328132913301331133213331334133513361337133813391340134113421343134413451346134713481349135013511352135313541355135613571358135913601361136213631364136513661367136813691370137113721373137413751376137713781379138013811382138313841385138613871388138913901391139213931394139513961397139813991400140114021403140414051406140714081409141014111412141314141415141614171418141914201421142214231424142514261427142814291430143114321433143414351436143714381439144014411442144314441445144614471448144914501451145214531454145514561457145814591460146114621463146414651466146714681469147014711472147314741475147614771478147914801481148214831484148514861487148814891490149114921493149414951496149714981499150015011502150315041505150615071508150915101511151215131514151515161517151815191520152115221523152415251526152715281529153015311532153315341535153615371538153915401541154215431544154515461547154815491550155115521553155415551556155715581559156015611562156315641565156615671568156915701571157215731574157515761577157815791580158115821583158415851586158715881589159015911592159315941595159615971598159916001601160216031604160516061607160816091610161116121613161416151616161716181619162016211622162316241625162616271628162916301631163216331634163516361637163816391640164116421643164416451646164716481649165016511652165316541655165616571658165916601661166216631664166516661667166816691670167116721673167416751676167716781679168016811682168316841685168616871688168916901691169216931694169516961697169816991700170117021703170417051706170717081709171017111712171317141715171617171718171917201721172217231724172517261727172817291730173117321733173417351736173717381739174017411742174317441745174617471748174917501751175217531754175517561757175817591760176117621763176417651766176717681769177017711772177317741775177617771778177917801781178217831784178517861787178817891790179117921793179417951796179717981799180018011802180318041805180618071808180918101811181218131814181518161817181818191820182118221823182418251826182718281829183018311832183318341835183618371838183918401841184218431844184518461847184818491850185118521853185418551856185718581859186018611862186318641865186618671868186918701871187218731874187518761877187818791880188118821883188418851886188718881889189018911892189318941895189618971898189919001901190219031904190519061907190819091910191119121913191419151916191719181919192019211922192319241925192619271928192919301931193219331934193519361937193819391940194119421943194419451946194719481949195019511952195319541955195619571958195919601961196219631964196519661967196819691970197119721973197419751976197719781979198019811982198319841985198619871988198919901991199219931994199519961997199819992000200120022003200420052006200720082009201020112012201320142015201620172018201920202021202220232024202520262027202820292030203120322033203420352036203720382039204020412042204320442045204620472048204920502051205220532054205520562057205820592060206120622063206420652066206720682069207020712072207320742075207620772078207920802081208220832084208520862087208820892090209120922093209420952096209720982099210021012102210321042105210621072108210921102111211221132114211521162117211821192120212121222123212421252126212721282129213021312132213321342135213621372138213921402141214221432144214521462147214821492150215121522153215421552156215721582159216021612162216321642165216621672168216921702171217221732174217521762177217821792180218121822183218421852186218721882189219021912192219321942195219621972198219922002201220222032204220522062207220822092210221122122213221422152216221722182219222022212222222322242225222622272228222922302231223222332234223522362237223822392240224122422243224422452246224722482249225022512252225322542255225622572258225922602261226222632264226522662267226822692270227122722273227422752276227722782279228022812282228322842285228622872288228922902291229222932294229522962297229822992300230123022303230423052306230723082309231023112312231323142315231623172318231923202321232223232324232523262327232823292330233123322333233423352336233723382339234023412342234323442345234623472348234923502351235223532354235523562357235823592360236123622363236423652366236723682369237023712372237323742375237623772378237923802381238223832384238523862387238823892390239123922393239423952396239723982399240024012402240324042405240624072408240924102411241224132414241524162417241824192420242124222423242424252426242724282429243024312432243324342435243624372438243924402441244224432444244524462447244824492450245124522453245424552456245724582459246024612462246324642465246624672468246924702471247224732474247524762477247824792480248124822483248424852486248724882489249024912492249324942495249624972498249925002501250225032504250525062507250825092510251125122513251425152516251725182519252025212522252325242525252625272528252925302531253225332534253525362537253825392540254125422543254425452546254725482549255025512552255325542555255625572558255925602561256225632564256525662567256825692570257125722573257425752576257725782579258025812582258325842585258625872588258925902591259225932594259525962597259825992600260126022603260426052606260726082609261026112612261326142615261626172618261926202621262226232624262526262627262826292630263126322633263426352636263726382639264026412642264326442645264626472648264926502651265226532654265526562657265826592660266126622663266426652666266726682669267026712672267326742675267626772678267926802681268226832684268526862687268826892690269126922693269426952696269726982699270027012702270327042705270627072708270927102711271227132714271527162717271827192720272127222723272427252726272727282729273027312732273327342735273627372738273927402741274227432744274527462747274827492750275127522753275427552756275727582759276027612762276327642765276627672768276927702771277227732774277527762777277827792780278127822783278427852786278727882789279027912792279327942795279627972798279928002801280228032804280528062807280828092810281128122813281428152816281728182819282028212822282328242825282628272828282928302831283228332834283528362837283828392840284128422843284428452846284728482849285028512852285328542855285628572858285928602861286228632864286528662867286828692870287128722873287428752876287728782879288028812882288328842885288628872888288928902891289228932894289528962897289828992900290129022903290429052906290729082909291029112912291329142915291629172918291929202921292229232924292529262927292829292930293129322933293429352936293729382939294029412942294329442945294629472948294929502951295229532954295529562957295829592960296129622963296429652966296729682969297029712972297329742975297629772978297929802981298229832984298529862987298829892990299129922993299429952996299729982999300030013002300330043005300630073008300930103011301230133014301530163017301830193020302130223023302430253026302730283029303030313032303330343035303630373038303930403041304230433044304530463047304830493050305130523053305430553056305730583059306030613062306330643065306630673068306930703071307230733074307530763077307830793080308130823083308430853086308730883089309030913092309330943095309630973098309931003101
  1. // SPDX-License-Identifier: GPL-2.0-or-later
  2. /*
  3. * Copyright (C) 2015-2017 Josh Poimboeuf <jpoimboe@redhat.com>
  4. */
  5. #include <string.h>
  6. #include <stdlib.h>
  7. #include "builtin.h"
  8. #include "cfi.h"
  9. #include "arch.h"
  10. #include "check.h"
  11. #include "special.h"
  12. #include "warn.h"
  13. #include "arch_elf.h"
  14. #include <linux/objtool.h>
  15. #include <linux/hashtable.h>
  16. #include <linux/kernel.h>
  17. #include <linux/static_call_types.h>
  18. #define FAKE_JUMP_OFFSET -1
  19. struct alternative {
  20. struct list_head list;
  21. struct instruction *insn;
  22. bool skip_orig;
  23. };
  24. struct cfi_init_state initial_func_cfi;
  25. struct instruction *find_insn(struct objtool_file *file,
  26. struct section *sec, unsigned long offset)
  27. {
  28. struct instruction *insn;
  29. hash_for_each_possible(file->insn_hash, insn, hash, sec_offset_hash(sec, offset)) {
  30. if (insn->sec == sec && insn->offset == offset)
  31. return insn;
  32. }
  33. return NULL;
  34. }
  35. static struct instruction *next_insn_same_sec(struct objtool_file *file,
  36. struct instruction *insn)
  37. {
  38. struct instruction *next = list_next_entry(insn, list);
  39. if (!next || &next->list == &file->insn_list || next->sec != insn->sec)
  40. return NULL;
  41. return next;
  42. }
  43. static struct instruction *next_insn_same_func(struct objtool_file *file,
  44. struct instruction *insn)
  45. {
  46. struct instruction *next = list_next_entry(insn, list);
  47. struct symbol *func = insn->func;
  48. if (!func)
  49. return NULL;
  50. if (&next->list != &file->insn_list && next->func == func)
  51. return next;
  52. /* Check if we're already in the subfunction: */
  53. if (func == func->cfunc)
  54. return NULL;
  55. /* Move to the subfunction: */
  56. return find_insn(file, func->cfunc->sec, func->cfunc->offset);
  57. }
  58. static struct instruction *prev_insn_same_sym(struct objtool_file *file,
  59. struct instruction *insn)
  60. {
  61. struct instruction *prev = list_prev_entry(insn, list);
  62. if (&prev->list != &file->insn_list && prev->func == insn->func)
  63. return prev;
  64. return NULL;
  65. }
  66. #define func_for_each_insn(file, func, insn) \
  67. for (insn = find_insn(file, func->sec, func->offset); \
  68. insn; \
  69. insn = next_insn_same_func(file, insn))
  70. #define sym_for_each_insn(file, sym, insn) \
  71. for (insn = find_insn(file, sym->sec, sym->offset); \
  72. insn && &insn->list != &file->insn_list && \
  73. insn->sec == sym->sec && \
  74. insn->offset < sym->offset + sym->len; \
  75. insn = list_next_entry(insn, list))
  76. #define sym_for_each_insn_continue_reverse(file, sym, insn) \
  77. for (insn = list_prev_entry(insn, list); \
  78. &insn->list != &file->insn_list && \
  79. insn->sec == sym->sec && insn->offset >= sym->offset; \
  80. insn = list_prev_entry(insn, list))
  81. #define sec_for_each_insn_from(file, insn) \
  82. for (; insn; insn = next_insn_same_sec(file, insn))
  83. #define sec_for_each_insn_continue(file, insn) \
  84. for (insn = next_insn_same_sec(file, insn); insn; \
  85. insn = next_insn_same_sec(file, insn))
  86. static bool is_sibling_call(struct instruction *insn)
  87. {
  88. /* An indirect jump is either a sibling call or a jump to a table. */
  89. if (insn->type == INSN_JUMP_DYNAMIC)
  90. return list_empty(&insn->alts);
  91. if (!is_static_jump(insn))
  92. return false;
  93. /* add_jump_destinations() sets insn->call_dest for sibling calls. */
  94. return !!insn->call_dest;
  95. }
  96. /*
  97. * This checks to see if the given function is a "noreturn" function.
  98. *
  99. * For global functions which are outside the scope of this object file, we
  100. * have to keep a manual list of them.
  101. *
  102. * For local functions, we have to detect them manually by simply looking for
  103. * the lack of a return instruction.
  104. */
  105. static bool __dead_end_function(struct objtool_file *file, struct symbol *func,
  106. int recursion)
  107. {
  108. int i;
  109. struct instruction *insn;
  110. bool empty = true;
  111. /*
  112. * Unfortunately these have to be hard coded because the noreturn
  113. * attribute isn't provided in ELF data.
  114. */
  115. static const char * const global_noreturns[] = {
  116. "__stack_chk_fail",
  117. "panic",
  118. "do_exit",
  119. "do_task_dead",
  120. "__module_put_and_exit",
  121. "complete_and_exit",
  122. "__reiserfs_panic",
  123. "lbug_with_loc",
  124. "fortify_panic",
  125. "usercopy_abort",
  126. "machine_real_restart",
  127. "rewind_stack_do_exit",
  128. "kunit_try_catch_throw",
  129. "xen_start_kernel",
  130. "cpu_bringup_and_idle",
  131. };
  132. if (!func)
  133. return false;
  134. if (func->bind == STB_WEAK)
  135. return false;
  136. if (func->bind == STB_GLOBAL)
  137. for (i = 0; i < ARRAY_SIZE(global_noreturns); i++)
  138. if (!strcmp(func->name, global_noreturns[i]))
  139. return true;
  140. if (!func->len)
  141. return false;
  142. insn = find_insn(file, func->sec, func->offset);
  143. if (!insn->func)
  144. return false;
  145. func_for_each_insn(file, func, insn) {
  146. empty = false;
  147. if (insn->type == INSN_RETURN)
  148. return false;
  149. }
  150. if (empty)
  151. return false;
  152. /*
  153. * A function can have a sibling call instead of a return. In that
  154. * case, the function's dead-end status depends on whether the target
  155. * of the sibling call returns.
  156. */
  157. func_for_each_insn(file, func, insn) {
  158. if (is_sibling_call(insn)) {
  159. struct instruction *dest = insn->jump_dest;
  160. if (!dest)
  161. /* sibling call to another file */
  162. return false;
  163. /* local sibling call */
  164. if (recursion == 5) {
  165. /*
  166. * Infinite recursion: two functions have
  167. * sibling calls to each other. This is a very
  168. * rare case. It means they aren't dead ends.
  169. */
  170. return false;
  171. }
  172. return __dead_end_function(file, dest->func, recursion+1);
  173. }
  174. }
  175. return true;
  176. }
  177. static bool dead_end_function(struct objtool_file *file, struct symbol *func)
  178. {
  179. return __dead_end_function(file, func, 0);
  180. }
  181. static void init_cfi_state(struct cfi_state *cfi)
  182. {
  183. int i;
  184. for (i = 0; i < CFI_NUM_REGS; i++) {
  185. cfi->regs[i].base = CFI_UNDEFINED;
  186. cfi->vals[i].base = CFI_UNDEFINED;
  187. }
  188. cfi->cfa.base = CFI_UNDEFINED;
  189. cfi->drap_reg = CFI_UNDEFINED;
  190. cfi->drap_offset = -1;
  191. }
  192. static void init_insn_state(struct insn_state *state, struct section *sec)
  193. {
  194. memset(state, 0, sizeof(*state));
  195. init_cfi_state(&state->cfi);
  196. /*
  197. * We need the full vmlinux for noinstr validation, otherwise we can
  198. * not correctly determine insn->call_dest->sec (external symbols do
  199. * not have a section).
  200. */
  201. if (vmlinux && noinstr && sec)
  202. state->noinstr = sec->noinstr;
  203. }
  204. /*
  205. * Call the arch-specific instruction decoder for all the instructions and add
  206. * them to the global instruction list.
  207. */
  208. static int decode_instructions(struct objtool_file *file)
  209. {
  210. struct section *sec;
  211. struct symbol *func;
  212. unsigned long offset;
  213. struct instruction *insn;
  214. unsigned long nr_insns = 0;
  215. int ret;
  216. for_each_sec(file, sec) {
  217. if (!(sec->sh.sh_flags & SHF_EXECINSTR))
  218. continue;
  219. if (strcmp(sec->name, ".altinstr_replacement") &&
  220. strcmp(sec->name, ".altinstr_aux") &&
  221. strncmp(sec->name, ".discard.", 9))
  222. sec->text = true;
  223. if (!strcmp(sec->name, ".noinstr.text") ||
  224. !strcmp(sec->name, ".entry.text"))
  225. sec->noinstr = true;
  226. for (offset = 0; offset < sec->len; offset += insn->len) {
  227. insn = malloc(sizeof(*insn));
  228. if (!insn) {
  229. WARN("malloc failed");
  230. return -1;
  231. }
  232. memset(insn, 0, sizeof(*insn));
  233. INIT_LIST_HEAD(&insn->alts);
  234. INIT_LIST_HEAD(&insn->stack_ops);
  235. init_cfi_state(&insn->cfi);
  236. insn->sec = sec;
  237. insn->offset = offset;
  238. ret = arch_decode_instruction(file->elf, sec, offset,
  239. sec->len - offset,
  240. &insn->len, &insn->type,
  241. &insn->immediate,
  242. &insn->stack_ops);
  243. if (ret)
  244. goto err;
  245. hash_add(file->insn_hash, &insn->hash, sec_offset_hash(sec, insn->offset));
  246. list_add_tail(&insn->list, &file->insn_list);
  247. nr_insns++;
  248. }
  249. list_for_each_entry(func, &sec->symbol_list, list) {
  250. if (func->type != STT_FUNC || func->alias != func)
  251. continue;
  252. if (!find_insn(file, sec, func->offset)) {
  253. WARN("%s(): can't find starting instruction",
  254. func->name);
  255. return -1;
  256. }
  257. sym_for_each_insn(file, func, insn)
  258. insn->func = func;
  259. }
  260. }
  261. if (stats)
  262. printf("nr_insns: %lu\n", nr_insns);
  263. return 0;
  264. err:
  265. free(insn);
  266. return ret;
  267. }
  268. static struct instruction *find_last_insn(struct objtool_file *file,
  269. struct section *sec)
  270. {
  271. struct instruction *insn = NULL;
  272. unsigned int offset;
  273. unsigned int end = (sec->len > 10) ? sec->len - 10 : 0;
  274. for (offset = sec->len - 1; offset >= end && !insn; offset--)
  275. insn = find_insn(file, sec, offset);
  276. return insn;
  277. }
  278. /*
  279. * Mark "ud2" instructions and manually annotated dead ends.
  280. */
  281. static int add_dead_ends(struct objtool_file *file)
  282. {
  283. struct section *sec;
  284. struct reloc *reloc;
  285. struct instruction *insn;
  286. /*
  287. * By default, "ud2" is a dead end unless otherwise annotated, because
  288. * GCC 7 inserts it for certain divide-by-zero cases.
  289. */
  290. for_each_insn(file, insn)
  291. if (insn->type == INSN_BUG)
  292. insn->dead_end = true;
  293. /*
  294. * Check for manually annotated dead ends.
  295. */
  296. sec = find_section_by_name(file->elf, ".rela.discard.unreachable");
  297. if (!sec)
  298. goto reachable;
  299. list_for_each_entry(reloc, &sec->reloc_list, list) {
  300. if (reloc->sym->type != STT_SECTION) {
  301. WARN("unexpected relocation symbol type in %s", sec->name);
  302. return -1;
  303. }
  304. insn = find_insn(file, reloc->sym->sec, reloc->addend);
  305. if (insn)
  306. insn = list_prev_entry(insn, list);
  307. else if (reloc->addend == reloc->sym->sec->len) {
  308. insn = find_last_insn(file, reloc->sym->sec);
  309. if (!insn) {
  310. WARN("can't find unreachable insn at %s+0x%x",
  311. reloc->sym->sec->name, reloc->addend);
  312. return -1;
  313. }
  314. } else {
  315. WARN("can't find unreachable insn at %s+0x%x",
  316. reloc->sym->sec->name, reloc->addend);
  317. return -1;
  318. }
  319. insn->dead_end = true;
  320. }
  321. reachable:
  322. /*
  323. * These manually annotated reachable checks are needed for GCC 4.4,
  324. * where the Linux unreachable() macro isn't supported. In that case
  325. * GCC doesn't know the "ud2" is fatal, so it generates code as if it's
  326. * not a dead end.
  327. */
  328. sec = find_section_by_name(file->elf, ".rela.discard.reachable");
  329. if (!sec)
  330. return 0;
  331. list_for_each_entry(reloc, &sec->reloc_list, list) {
  332. if (reloc->sym->type != STT_SECTION) {
  333. WARN("unexpected relocation symbol type in %s", sec->name);
  334. return -1;
  335. }
  336. insn = find_insn(file, reloc->sym->sec, reloc->addend);
  337. if (insn)
  338. insn = list_prev_entry(insn, list);
  339. else if (reloc->addend == reloc->sym->sec->len) {
  340. insn = find_last_insn(file, reloc->sym->sec);
  341. if (!insn) {
  342. WARN("can't find reachable insn at %s+0x%x",
  343. reloc->sym->sec->name, reloc->addend);
  344. return -1;
  345. }
  346. } else {
  347. WARN("can't find reachable insn at %s+0x%x",
  348. reloc->sym->sec->name, reloc->addend);
  349. return -1;
  350. }
  351. insn->dead_end = false;
  352. }
  353. return 0;
  354. }
  355. static int create_static_call_sections(struct objtool_file *file)
  356. {
  357. struct section *sec, *reloc_sec;
  358. struct reloc *reloc;
  359. struct static_call_site *site;
  360. struct instruction *insn;
  361. struct symbol *key_sym;
  362. char *key_name, *tmp;
  363. int idx;
  364. sec = find_section_by_name(file->elf, ".static_call_sites");
  365. if (sec) {
  366. INIT_LIST_HEAD(&file->static_call_list);
  367. WARN("file already has .static_call_sites section, skipping");
  368. return 0;
  369. }
  370. if (list_empty(&file->static_call_list))
  371. return 0;
  372. idx = 0;
  373. list_for_each_entry(insn, &file->static_call_list, static_call_node)
  374. idx++;
  375. sec = elf_create_section(file->elf, ".static_call_sites", SHF_WRITE,
  376. sizeof(struct static_call_site), idx);
  377. if (!sec)
  378. return -1;
  379. reloc_sec = elf_create_reloc_section(file->elf, sec, SHT_RELA);
  380. if (!reloc_sec)
  381. return -1;
  382. idx = 0;
  383. list_for_each_entry(insn, &file->static_call_list, static_call_node) {
  384. site = (struct static_call_site *)sec->data->d_buf + idx;
  385. memset(site, 0, sizeof(struct static_call_site));
  386. /* populate reloc for 'addr' */
  387. reloc = malloc(sizeof(*reloc));
  388. if (!reloc) {
  389. perror("malloc");
  390. return -1;
  391. }
  392. memset(reloc, 0, sizeof(*reloc));
  393. insn_to_reloc_sym_addend(insn->sec, insn->offset, reloc);
  394. if (!reloc->sym) {
  395. WARN_FUNC("static call tramp: missing containing symbol",
  396. insn->sec, insn->offset);
  397. return -1;
  398. }
  399. reloc->type = R_X86_64_PC32;
  400. reloc->offset = idx * sizeof(struct static_call_site);
  401. reloc->sec = reloc_sec;
  402. elf_add_reloc(file->elf, reloc);
  403. /* find key symbol */
  404. key_name = strdup(insn->call_dest->name);
  405. if (!key_name) {
  406. perror("strdup");
  407. return -1;
  408. }
  409. if (strncmp(key_name, STATIC_CALL_TRAMP_PREFIX_STR,
  410. STATIC_CALL_TRAMP_PREFIX_LEN)) {
  411. WARN("static_call: trampoline name malformed: %s", key_name);
  412. return -1;
  413. }
  414. tmp = key_name + STATIC_CALL_TRAMP_PREFIX_LEN - STATIC_CALL_KEY_PREFIX_LEN;
  415. memcpy(tmp, STATIC_CALL_KEY_PREFIX_STR, STATIC_CALL_KEY_PREFIX_LEN);
  416. key_sym = find_symbol_by_name(file->elf, tmp);
  417. if (!key_sym) {
  418. if (!module) {
  419. WARN("static_call: can't find static_call_key symbol: %s", tmp);
  420. return -1;
  421. }
  422. /*
  423. * For modules(), the key might not be exported, which
  424. * means the module can make static calls but isn't
  425. * allowed to change them.
  426. *
  427. * In that case we temporarily set the key to be the
  428. * trampoline address. This is fixed up in
  429. * static_call_add_module().
  430. */
  431. key_sym = insn->call_dest;
  432. }
  433. free(key_name);
  434. /* populate reloc for 'key' */
  435. reloc = malloc(sizeof(*reloc));
  436. if (!reloc) {
  437. perror("malloc");
  438. return -1;
  439. }
  440. memset(reloc, 0, sizeof(*reloc));
  441. reloc->sym = key_sym;
  442. reloc->addend = is_sibling_call(insn) ? STATIC_CALL_SITE_TAIL : 0;
  443. reloc->type = R_X86_64_PC32;
  444. reloc->offset = idx * sizeof(struct static_call_site) + 4;
  445. reloc->sec = reloc_sec;
  446. elf_add_reloc(file->elf, reloc);
  447. idx++;
  448. }
  449. if (elf_rebuild_reloc_section(file->elf, reloc_sec))
  450. return -1;
  451. return 0;
  452. }
  453. static int create_mcount_loc_sections(struct objtool_file *file)
  454. {
  455. struct section *sec, *reloc_sec;
  456. struct reloc *reloc;
  457. unsigned long *loc;
  458. struct instruction *insn;
  459. int idx;
  460. sec = find_section_by_name(file->elf, "__mcount_loc");
  461. if (sec) {
  462. INIT_LIST_HEAD(&file->mcount_loc_list);
  463. WARN("file already has __mcount_loc section, skipping");
  464. return 0;
  465. }
  466. if (list_empty(&file->mcount_loc_list))
  467. return 0;
  468. idx = 0;
  469. list_for_each_entry(insn, &file->mcount_loc_list, mcount_loc_node)
  470. idx++;
  471. sec = elf_create_section(file->elf, "__mcount_loc", 0, sizeof(unsigned long), idx);
  472. if (!sec)
  473. return -1;
  474. reloc_sec = elf_create_reloc_section(file->elf, sec, SHT_RELA);
  475. if (!reloc_sec)
  476. return -1;
  477. idx = 0;
  478. list_for_each_entry(insn, &file->mcount_loc_list, mcount_loc_node) {
  479. loc = (unsigned long *)sec->data->d_buf + idx;
  480. memset(loc, 0, sizeof(unsigned long));
  481. reloc = malloc(sizeof(*reloc));
  482. if (!reloc) {
  483. perror("malloc");
  484. return -1;
  485. }
  486. memset(reloc, 0, sizeof(*reloc));
  487. if (insn->sec->sym) {
  488. reloc->sym = insn->sec->sym;
  489. reloc->addend = insn->offset;
  490. } else {
  491. reloc->sym = find_symbol_containing(insn->sec, insn->offset);
  492. if (!reloc->sym) {
  493. WARN("missing symbol for insn at offset 0x%lx\n",
  494. insn->offset);
  495. return -1;
  496. }
  497. reloc->addend = insn->offset - reloc->sym->offset;
  498. }
  499. reloc->type = R_X86_64_64;
  500. reloc->offset = idx * sizeof(unsigned long);
  501. reloc->sec = reloc_sec;
  502. elf_add_reloc(file->elf, reloc);
  503. idx++;
  504. }
  505. if (elf_rebuild_reloc_section(file->elf, reloc_sec))
  506. return -1;
  507. return 0;
  508. }
  509. /*
  510. * Warnings shouldn't be reported for ignored functions.
  511. */
  512. static void add_ignores(struct objtool_file *file)
  513. {
  514. struct instruction *insn;
  515. struct section *sec;
  516. struct symbol *func;
  517. struct reloc *reloc;
  518. sec = find_section_by_name(file->elf, ".rela.discard.func_stack_frame_non_standard");
  519. if (!sec)
  520. return;
  521. list_for_each_entry(reloc, &sec->reloc_list, list) {
  522. switch (reloc->sym->type) {
  523. case STT_FUNC:
  524. func = reloc->sym;
  525. break;
  526. case STT_SECTION:
  527. func = find_func_by_offset(reloc->sym->sec, reloc->addend);
  528. if (!func)
  529. continue;
  530. break;
  531. default:
  532. WARN("unexpected relocation symbol type in %s: %d", sec->name, reloc->sym->type);
  533. continue;
  534. }
  535. func_for_each_insn(file, func, insn)
  536. insn->ignore = true;
  537. }
  538. }
  539. /*
  540. * This is a whitelist of functions that is allowed to be called with AC set.
  541. * The list is meant to be minimal and only contains compiler instrumentation
  542. * ABI and a few functions used to implement *_{to,from}_user() functions.
  543. *
  544. * These functions must not directly change AC, but may PUSHF/POPF.
  545. */
  546. static const char *uaccess_safe_builtin[] = {
  547. /* KASAN */
  548. "kasan_report",
  549. "kasan_check_range",
  550. /* KASAN out-of-line */
  551. "__asan_loadN_noabort",
  552. "__asan_load1_noabort",
  553. "__asan_load2_noabort",
  554. "__asan_load4_noabort",
  555. "__asan_load8_noabort",
  556. "__asan_load16_noabort",
  557. "__asan_storeN_noabort",
  558. "__asan_store1_noabort",
  559. "__asan_store2_noabort",
  560. "__asan_store4_noabort",
  561. "__asan_store8_noabort",
  562. "__asan_store16_noabort",
  563. "__kasan_check_read",
  564. "__kasan_check_write",
  565. /* KASAN in-line */
  566. "__asan_report_load_n_noabort",
  567. "__asan_report_load1_noabort",
  568. "__asan_report_load2_noabort",
  569. "__asan_report_load4_noabort",
  570. "__asan_report_load8_noabort",
  571. "__asan_report_load16_noabort",
  572. "__asan_report_store_n_noabort",
  573. "__asan_report_store1_noabort",
  574. "__asan_report_store2_noabort",
  575. "__asan_report_store4_noabort",
  576. "__asan_report_store8_noabort",
  577. "__asan_report_store16_noabort",
  578. /* KCSAN */
  579. "__kcsan_check_access",
  580. "kcsan_found_watchpoint",
  581. "kcsan_setup_watchpoint",
  582. "kcsan_check_scoped_accesses",
  583. "kcsan_disable_current",
  584. "kcsan_enable_current_nowarn",
  585. /* KCSAN/TSAN */
  586. "__tsan_func_entry",
  587. "__tsan_func_exit",
  588. "__tsan_read_range",
  589. "__tsan_write_range",
  590. "__tsan_read1",
  591. "__tsan_read2",
  592. "__tsan_read4",
  593. "__tsan_read8",
  594. "__tsan_read16",
  595. "__tsan_write1",
  596. "__tsan_write2",
  597. "__tsan_write4",
  598. "__tsan_write8",
  599. "__tsan_write16",
  600. "__tsan_read_write1",
  601. "__tsan_read_write2",
  602. "__tsan_read_write4",
  603. "__tsan_read_write8",
  604. "__tsan_read_write16",
  605. "__tsan_atomic8_load",
  606. "__tsan_atomic16_load",
  607. "__tsan_atomic32_load",
  608. "__tsan_atomic64_load",
  609. "__tsan_atomic8_store",
  610. "__tsan_atomic16_store",
  611. "__tsan_atomic32_store",
  612. "__tsan_atomic64_store",
  613. "__tsan_atomic8_exchange",
  614. "__tsan_atomic16_exchange",
  615. "__tsan_atomic32_exchange",
  616. "__tsan_atomic64_exchange",
  617. "__tsan_atomic8_fetch_add",
  618. "__tsan_atomic16_fetch_add",
  619. "__tsan_atomic32_fetch_add",
  620. "__tsan_atomic64_fetch_add",
  621. "__tsan_atomic8_fetch_sub",
  622. "__tsan_atomic16_fetch_sub",
  623. "__tsan_atomic32_fetch_sub",
  624. "__tsan_atomic64_fetch_sub",
  625. "__tsan_atomic8_fetch_and",
  626. "__tsan_atomic16_fetch_and",
  627. "__tsan_atomic32_fetch_and",
  628. "__tsan_atomic64_fetch_and",
  629. "__tsan_atomic8_fetch_or",
  630. "__tsan_atomic16_fetch_or",
  631. "__tsan_atomic32_fetch_or",
  632. "__tsan_atomic64_fetch_or",
  633. "__tsan_atomic8_fetch_xor",
  634. "__tsan_atomic16_fetch_xor",
  635. "__tsan_atomic32_fetch_xor",
  636. "__tsan_atomic64_fetch_xor",
  637. "__tsan_atomic8_fetch_nand",
  638. "__tsan_atomic16_fetch_nand",
  639. "__tsan_atomic32_fetch_nand",
  640. "__tsan_atomic64_fetch_nand",
  641. "__tsan_atomic8_compare_exchange_strong",
  642. "__tsan_atomic16_compare_exchange_strong",
  643. "__tsan_atomic32_compare_exchange_strong",
  644. "__tsan_atomic64_compare_exchange_strong",
  645. "__tsan_atomic8_compare_exchange_weak",
  646. "__tsan_atomic16_compare_exchange_weak",
  647. "__tsan_atomic32_compare_exchange_weak",
  648. "__tsan_atomic64_compare_exchange_weak",
  649. "__tsan_atomic8_compare_exchange_val",
  650. "__tsan_atomic16_compare_exchange_val",
  651. "__tsan_atomic32_compare_exchange_val",
  652. "__tsan_atomic64_compare_exchange_val",
  653. "__tsan_atomic_thread_fence",
  654. "__tsan_atomic_signal_fence",
  655. /* KCOV */
  656. "write_comp_data",
  657. "check_kcov_mode",
  658. "__sanitizer_cov_trace_pc",
  659. "__sanitizer_cov_trace_const_cmp1",
  660. "__sanitizer_cov_trace_const_cmp2",
  661. "__sanitizer_cov_trace_const_cmp4",
  662. "__sanitizer_cov_trace_const_cmp8",
  663. "__sanitizer_cov_trace_cmp1",
  664. "__sanitizer_cov_trace_cmp2",
  665. "__sanitizer_cov_trace_cmp4",
  666. "__sanitizer_cov_trace_cmp8",
  667. "__sanitizer_cov_trace_switch",
  668. /* UBSAN */
  669. "ubsan_type_mismatch_common",
  670. "__ubsan_handle_type_mismatch",
  671. "__ubsan_handle_type_mismatch_v1",
  672. "__ubsan_handle_shift_out_of_bounds",
  673. /* misc */
  674. "csum_partial_copy_generic",
  675. "copy_mc_fragile",
  676. "copy_mc_fragile_handle_tail",
  677. "copy_mc_enhanced_fast_string",
  678. "ftrace_likely_update", /* CONFIG_TRACE_BRANCH_PROFILING */
  679. NULL
  680. };
  681. static void add_uaccess_safe(struct objtool_file *file)
  682. {
  683. struct symbol *func;
  684. const char **name;
  685. if (!uaccess)
  686. return;
  687. for (name = uaccess_safe_builtin; *name; name++) {
  688. func = find_symbol_by_name(file->elf, *name);
  689. if (!func)
  690. continue;
  691. func->uaccess_safe = true;
  692. }
  693. }
  694. /*
  695. * FIXME: For now, just ignore any alternatives which add retpolines. This is
  696. * a temporary hack, as it doesn't allow ORC to unwind from inside a retpoline.
  697. * But it at least allows objtool to understand the control flow *around* the
  698. * retpoline.
  699. */
  700. static int add_ignore_alternatives(struct objtool_file *file)
  701. {
  702. struct section *sec;
  703. struct reloc *reloc;
  704. struct instruction *insn;
  705. sec = find_section_by_name(file->elf, ".rela.discard.ignore_alts");
  706. if (!sec)
  707. return 0;
  708. list_for_each_entry(reloc, &sec->reloc_list, list) {
  709. if (reloc->sym->type != STT_SECTION) {
  710. WARN("unexpected relocation symbol type in %s", sec->name);
  711. return -1;
  712. }
  713. insn = find_insn(file, reloc->sym->sec, reloc->addend);
  714. if (!insn) {
  715. WARN("bad .discard.ignore_alts entry");
  716. return -1;
  717. }
  718. insn->ignore_alts = true;
  719. }
  720. return 0;
  721. }
  722. /*
  723. * CONFIG_CFI_CLANG: Check if the section is a CFI jump table or a
  724. * compiler-generated CFI handler.
  725. */
  726. static bool is_cfi_section(struct section *sec)
  727. {
  728. return (sec->name &&
  729. (!strncmp(sec->name, ".text..L.cfi.jumptable", 22) ||
  730. !strcmp(sec->name, ".text.__cfi_check")));
  731. }
  732. /*
  733. * CONFIG_CFI_CLANG: Ignore CFI jump tables.
  734. */
  735. static void add_cfi_jumptables(struct objtool_file *file)
  736. {
  737. struct section *sec;
  738. struct symbol *func;
  739. struct instruction *insn;
  740. for_each_sec(file, sec) {
  741. if (!is_cfi_section(sec))
  742. continue;
  743. list_for_each_entry(func, &sec->symbol_list, list) {
  744. sym_for_each_insn(file, func, insn)
  745. insn->ignore = true;
  746. }
  747. }
  748. }
  749. /*
  750. * Find the destination instructions for all jumps.
  751. */
  752. static int add_jump_destinations(struct objtool_file *file)
  753. {
  754. struct instruction *insn;
  755. struct reloc *reloc;
  756. struct section *dest_sec;
  757. unsigned long dest_off;
  758. for_each_insn(file, insn) {
  759. if (!is_static_jump(insn))
  760. continue;
  761. if (insn->offset == FAKE_JUMP_OFFSET)
  762. continue;
  763. reloc = find_reloc_by_dest_range(file->elf, insn->sec,
  764. insn->offset, insn->len);
  765. if (!reloc) {
  766. dest_sec = insn->sec;
  767. dest_off = arch_jump_destination(insn);
  768. } else if (reloc->sym->type == STT_SECTION) {
  769. dest_sec = reloc->sym->sec;
  770. dest_off = arch_dest_reloc_offset(reloc->addend);
  771. } else if (reloc->sym->sec->idx) {
  772. dest_sec = reloc->sym->sec;
  773. dest_off = reloc->sym->sym.st_value +
  774. arch_dest_reloc_offset(reloc->addend);
  775. } else if (!strncmp(reloc->sym->name, "__x86_indirect_thunk_", 21) ||
  776. !strncmp(reloc->sym->name, "__x86_retpoline_", 16)) {
  777. /*
  778. * Retpoline jumps are really dynamic jumps in
  779. * disguise, so convert them accordingly.
  780. */
  781. if (insn->type == INSN_JUMP_UNCONDITIONAL)
  782. insn->type = INSN_JUMP_DYNAMIC;
  783. else
  784. insn->type = INSN_JUMP_DYNAMIC_CONDITIONAL;
  785. insn->retpoline_safe = true;
  786. continue;
  787. } else {
  788. /* external sibling call */
  789. insn->call_dest = reloc->sym;
  790. if (insn->call_dest->static_call_tramp) {
  791. list_add_tail(&insn->static_call_node,
  792. &file->static_call_list);
  793. }
  794. continue;
  795. }
  796. insn->jump_dest = find_insn(file, dest_sec, dest_off);
  797. if (!insn->jump_dest && dest_sec->len == dest_off)
  798. insn->jump_dest = find_last_insn(file, dest_sec);
  799. if (!insn->jump_dest) {
  800. /*
  801. * This is a special case where an alt instruction
  802. * jumps past the end of the section. These are
  803. * handled later in handle_group_alt().
  804. */
  805. if (!strcmp(insn->sec->name, ".altinstr_replacement"))
  806. continue;
  807. if (is_cfi_section(insn->sec))
  808. continue;
  809. WARN_FUNC("can't find jump dest instruction at %s+0x%lx",
  810. insn->sec, insn->offset, dest_sec->name,
  811. dest_off);
  812. return -1;
  813. }
  814. /*
  815. * Cross-function jump.
  816. */
  817. if (insn->func && insn->jump_dest->func &&
  818. insn->func != insn->jump_dest->func) {
  819. /*
  820. * For GCC 8+, create parent/child links for any cold
  821. * subfunctions. This is _mostly_ redundant with a
  822. * similar initialization in read_symbols().
  823. *
  824. * If a function has aliases, we want the *first* such
  825. * function in the symbol table to be the subfunction's
  826. * parent. In that case we overwrite the
  827. * initialization done in read_symbols().
  828. *
  829. * However this code can't completely replace the
  830. * read_symbols() code because this doesn't detect the
  831. * case where the parent function's only reference to a
  832. * subfunction is through a jump table.
  833. */
  834. if (!strstr(insn->func->name, ".cold") &&
  835. strstr(insn->jump_dest->func->name, ".cold")) {
  836. insn->func->cfunc = insn->jump_dest->func;
  837. insn->jump_dest->func->pfunc = insn->func;
  838. } else if (insn->jump_dest->func->pfunc != insn->func->pfunc &&
  839. insn->jump_dest->offset == insn->jump_dest->func->offset) {
  840. /* internal sibling call */
  841. insn->call_dest = insn->jump_dest->func;
  842. if (insn->call_dest->static_call_tramp) {
  843. list_add_tail(&insn->static_call_node,
  844. &file->static_call_list);
  845. }
  846. }
  847. }
  848. }
  849. return 0;
  850. }
  851. static void remove_insn_ops(struct instruction *insn)
  852. {
  853. struct stack_op *op, *tmp;
  854. list_for_each_entry_safe(op, tmp, &insn->stack_ops, list) {
  855. list_del(&op->list);
  856. free(op);
  857. }
  858. }
  859. static struct symbol *find_call_destination(struct section *sec, unsigned long offset)
  860. {
  861. struct symbol *call_dest;
  862. call_dest = find_func_by_offset(sec, offset);
  863. if (!call_dest)
  864. call_dest = find_symbol_by_offset(sec, offset);
  865. return call_dest;
  866. }
  867. /*
  868. * Find the destination instructions for all calls.
  869. */
  870. static int add_call_destinations(struct objtool_file *file)
  871. {
  872. struct instruction *insn;
  873. unsigned long dest_off;
  874. struct reloc *reloc;
  875. for_each_insn(file, insn) {
  876. if (insn->type != INSN_CALL)
  877. continue;
  878. reloc = find_reloc_by_dest_range(file->elf, insn->sec,
  879. insn->offset, insn->len);
  880. if (!reloc) {
  881. dest_off = arch_jump_destination(insn);
  882. insn->call_dest = find_call_destination(insn->sec, dest_off);
  883. if (insn->ignore)
  884. continue;
  885. if (!insn->call_dest) {
  886. WARN_FUNC("unannotated intra-function call", insn->sec, insn->offset);
  887. return -1;
  888. }
  889. if (insn->func && insn->call_dest->type != STT_FUNC) {
  890. WARN_FUNC("unsupported call to non-function",
  891. insn->sec, insn->offset);
  892. return -1;
  893. }
  894. } else if (reloc->sym->type == STT_SECTION) {
  895. dest_off = arch_dest_reloc_offset(reloc->addend);
  896. insn->call_dest = find_call_destination(reloc->sym->sec,
  897. dest_off);
  898. if (!insn->call_dest) {
  899. if (is_cfi_section(reloc->sym->sec))
  900. continue;
  901. WARN_FUNC("can't find call dest symbol at %s+0x%lx",
  902. insn->sec, insn->offset,
  903. reloc->sym->sec->name,
  904. dest_off);
  905. return -1;
  906. }
  907. } else
  908. insn->call_dest = reloc->sym;
  909. if (insn->call_dest && insn->call_dest->static_call_tramp) {
  910. list_add_tail(&insn->static_call_node,
  911. &file->static_call_list);
  912. }
  913. /*
  914. * Many compilers cannot disable KCOV with a function attribute
  915. * so they need a little help, NOP out any KCOV calls from noinstr
  916. * text.
  917. */
  918. if (insn->sec->noinstr &&
  919. !strncmp(insn->call_dest->name, "__sanitizer_cov_", 16)) {
  920. if (reloc) {
  921. reloc->type = R_NONE;
  922. elf_write_reloc(file->elf, reloc);
  923. }
  924. elf_write_insn(file->elf, insn->sec,
  925. insn->offset, insn->len,
  926. arch_nop_insn(insn->len));
  927. insn->type = INSN_NOP;
  928. }
  929. if (mcount && !strcmp(insn->call_dest->name, "__fentry__")) {
  930. if (reloc) {
  931. reloc->type = R_NONE;
  932. elf_write_reloc(file->elf, reloc);
  933. }
  934. elf_write_insn(file->elf, insn->sec,
  935. insn->offset, insn->len,
  936. arch_nop_insn(insn->len));
  937. insn->type = INSN_NOP;
  938. list_add_tail(&insn->mcount_loc_node,
  939. &file->mcount_loc_list);
  940. }
  941. /*
  942. * Whatever stack impact regular CALLs have, should be undone
  943. * by the RETURN of the called function.
  944. *
  945. * Annotated intra-function calls retain the stack_ops but
  946. * are converted to JUMP, see read_intra_function_calls().
  947. */
  948. remove_insn_ops(insn);
  949. }
  950. return 0;
  951. }
  952. /*
  953. * The .alternatives section requires some extra special care, over and above
  954. * what other special sections require:
  955. *
  956. * 1. Because alternatives are patched in-place, we need to insert a fake jump
  957. * instruction at the end so that validate_branch() skips all the original
  958. * replaced instructions when validating the new instruction path.
  959. *
  960. * 2. An added wrinkle is that the new instruction length might be zero. In
  961. * that case the old instructions are replaced with noops. We simulate that
  962. * by creating a fake jump as the only new instruction.
  963. *
  964. * 3. In some cases, the alternative section includes an instruction which
  965. * conditionally jumps to the _end_ of the entry. We have to modify these
  966. * jumps' destinations to point back to .text rather than the end of the
  967. * entry in .altinstr_replacement.
  968. */
  969. static int handle_group_alt(struct objtool_file *file,
  970. struct special_alt *special_alt,
  971. struct instruction *orig_insn,
  972. struct instruction **new_insn)
  973. {
  974. static unsigned int alt_group_next_index = 1;
  975. struct instruction *last_orig_insn, *last_new_insn, *insn, *fake_jump = NULL;
  976. unsigned int alt_group = alt_group_next_index++;
  977. unsigned long dest_off;
  978. last_orig_insn = NULL;
  979. insn = orig_insn;
  980. sec_for_each_insn_from(file, insn) {
  981. if (insn->offset >= special_alt->orig_off + special_alt->orig_len)
  982. break;
  983. insn->alt_group = alt_group;
  984. last_orig_insn = insn;
  985. }
  986. if (next_insn_same_sec(file, last_orig_insn)) {
  987. fake_jump = malloc(sizeof(*fake_jump));
  988. if (!fake_jump) {
  989. WARN("malloc failed");
  990. return -1;
  991. }
  992. memset(fake_jump, 0, sizeof(*fake_jump));
  993. INIT_LIST_HEAD(&fake_jump->alts);
  994. INIT_LIST_HEAD(&fake_jump->stack_ops);
  995. init_cfi_state(&fake_jump->cfi);
  996. fake_jump->sec = special_alt->new_sec;
  997. fake_jump->offset = FAKE_JUMP_OFFSET;
  998. fake_jump->type = INSN_JUMP_UNCONDITIONAL;
  999. fake_jump->jump_dest = list_next_entry(last_orig_insn, list);
  1000. fake_jump->func = orig_insn->func;
  1001. }
  1002. if (!special_alt->new_len) {
  1003. if (!fake_jump) {
  1004. WARN("%s: empty alternative at end of section",
  1005. special_alt->orig_sec->name);
  1006. return -1;
  1007. }
  1008. *new_insn = fake_jump;
  1009. return 0;
  1010. }
  1011. last_new_insn = NULL;
  1012. alt_group = alt_group_next_index++;
  1013. insn = *new_insn;
  1014. sec_for_each_insn_from(file, insn) {
  1015. struct reloc *alt_reloc;
  1016. if (insn->offset >= special_alt->new_off + special_alt->new_len)
  1017. break;
  1018. last_new_insn = insn;
  1019. insn->ignore = orig_insn->ignore_alts;
  1020. insn->func = orig_insn->func;
  1021. insn->alt_group = alt_group;
  1022. /*
  1023. * Since alternative replacement code is copy/pasted by the
  1024. * kernel after applying relocations, generally such code can't
  1025. * have relative-address relocation references to outside the
  1026. * .altinstr_replacement section, unless the arch's
  1027. * alternatives code can adjust the relative offsets
  1028. * accordingly.
  1029. */
  1030. alt_reloc = find_reloc_by_dest_range(file->elf, insn->sec,
  1031. insn->offset, insn->len);
  1032. if (alt_reloc &&
  1033. !arch_support_alt_relocation(special_alt, insn, alt_reloc)) {
  1034. WARN_FUNC("unsupported relocation in alternatives section",
  1035. insn->sec, insn->offset);
  1036. return -1;
  1037. }
  1038. if (!is_static_jump(insn))
  1039. continue;
  1040. if (!insn->immediate)
  1041. continue;
  1042. dest_off = arch_jump_destination(insn);
  1043. if (dest_off == special_alt->new_off + special_alt->new_len) {
  1044. if (!fake_jump) {
  1045. WARN("%s: alternative jump to end of section",
  1046. special_alt->orig_sec->name);
  1047. return -1;
  1048. }
  1049. insn->jump_dest = fake_jump;
  1050. }
  1051. if (!insn->jump_dest) {
  1052. WARN_FUNC("can't find alternative jump destination",
  1053. insn->sec, insn->offset);
  1054. return -1;
  1055. }
  1056. }
  1057. if (!last_new_insn) {
  1058. WARN_FUNC("can't find last new alternative instruction",
  1059. special_alt->new_sec, special_alt->new_off);
  1060. return -1;
  1061. }
  1062. if (fake_jump)
  1063. list_add(&fake_jump->list, &last_new_insn->list);
  1064. return 0;
  1065. }
  1066. /*
  1067. * A jump table entry can either convert a nop to a jump or a jump to a nop.
  1068. * If the original instruction is a jump, make the alt entry an effective nop
  1069. * by just skipping the original instruction.
  1070. */
  1071. static int handle_jump_alt(struct objtool_file *file,
  1072. struct special_alt *special_alt,
  1073. struct instruction *orig_insn,
  1074. struct instruction **new_insn)
  1075. {
  1076. if (orig_insn->type == INSN_NOP)
  1077. return 0;
  1078. if (orig_insn->type != INSN_JUMP_UNCONDITIONAL) {
  1079. WARN_FUNC("unsupported instruction at jump label",
  1080. orig_insn->sec, orig_insn->offset);
  1081. return -1;
  1082. }
  1083. *new_insn = list_next_entry(orig_insn, list);
  1084. return 0;
  1085. }
  1086. /*
  1087. * Read all the special sections which have alternate instructions which can be
  1088. * patched in or redirected to at runtime. Each instruction having alternate
  1089. * instruction(s) has them added to its insn->alts list, which will be
  1090. * traversed in validate_branch().
  1091. */
  1092. static int add_special_section_alts(struct objtool_file *file)
  1093. {
  1094. struct list_head special_alts;
  1095. struct instruction *orig_insn, *new_insn;
  1096. struct special_alt *special_alt, *tmp;
  1097. struct alternative *alt;
  1098. int ret;
  1099. ret = special_get_alts(file->elf, &special_alts);
  1100. if (ret)
  1101. return ret;
  1102. list_for_each_entry_safe(special_alt, tmp, &special_alts, list) {
  1103. orig_insn = find_insn(file, special_alt->orig_sec,
  1104. special_alt->orig_off);
  1105. if (!orig_insn) {
  1106. WARN_FUNC("special: can't find orig instruction",
  1107. special_alt->orig_sec, special_alt->orig_off);
  1108. ret = -1;
  1109. goto out;
  1110. }
  1111. new_insn = NULL;
  1112. if (!special_alt->group || special_alt->new_len) {
  1113. new_insn = find_insn(file, special_alt->new_sec,
  1114. special_alt->new_off);
  1115. if (!new_insn) {
  1116. WARN_FUNC("special: can't find new instruction",
  1117. special_alt->new_sec,
  1118. special_alt->new_off);
  1119. ret = -1;
  1120. goto out;
  1121. }
  1122. }
  1123. if (special_alt->group) {
  1124. if (!special_alt->orig_len) {
  1125. WARN_FUNC("empty alternative entry",
  1126. orig_insn->sec, orig_insn->offset);
  1127. continue;
  1128. }
  1129. ret = handle_group_alt(file, special_alt, orig_insn,
  1130. &new_insn);
  1131. if (ret)
  1132. goto out;
  1133. } else if (special_alt->jump_or_nop) {
  1134. ret = handle_jump_alt(file, special_alt, orig_insn,
  1135. &new_insn);
  1136. if (ret)
  1137. goto out;
  1138. }
  1139. alt = malloc(sizeof(*alt));
  1140. if (!alt) {
  1141. WARN("malloc failed");
  1142. ret = -1;
  1143. goto out;
  1144. }
  1145. alt->insn = new_insn;
  1146. alt->skip_orig = special_alt->skip_orig;
  1147. orig_insn->ignore_alts |= special_alt->skip_alt;
  1148. list_add_tail(&alt->list, &orig_insn->alts);
  1149. list_del(&special_alt->list);
  1150. free(special_alt);
  1151. }
  1152. out:
  1153. return ret;
  1154. }
  1155. static int add_jump_table(struct objtool_file *file, struct instruction *insn,
  1156. struct reloc *table)
  1157. {
  1158. struct reloc *reloc = table;
  1159. struct instruction *dest_insn;
  1160. struct alternative *alt;
  1161. struct symbol *pfunc = insn->func->pfunc;
  1162. unsigned int prev_offset = 0;
  1163. /*
  1164. * Each @reloc is a switch table relocation which points to the target
  1165. * instruction.
  1166. */
  1167. list_for_each_entry_from(reloc, &table->sec->reloc_list, list) {
  1168. /* Check for the end of the table: */
  1169. if (reloc != table && reloc->jump_table_start)
  1170. break;
  1171. /* Make sure the table entries are consecutive: */
  1172. if (prev_offset && reloc->offset != prev_offset + 8)
  1173. break;
  1174. /* Detect function pointers from contiguous objects: */
  1175. if (reloc->sym->sec == pfunc->sec &&
  1176. reloc->addend == pfunc->offset)
  1177. break;
  1178. dest_insn = find_insn(file, reloc->sym->sec, reloc->addend);
  1179. if (!dest_insn)
  1180. break;
  1181. /* Make sure the destination is in the same function: */
  1182. if (!dest_insn->func || dest_insn->func->pfunc != pfunc)
  1183. break;
  1184. alt = malloc(sizeof(*alt));
  1185. if (!alt) {
  1186. WARN("malloc failed");
  1187. return -1;
  1188. }
  1189. alt->insn = dest_insn;
  1190. list_add_tail(&alt->list, &insn->alts);
  1191. prev_offset = reloc->offset;
  1192. }
  1193. if (!prev_offset) {
  1194. WARN_FUNC("can't find switch jump table",
  1195. insn->sec, insn->offset);
  1196. return -1;
  1197. }
  1198. return 0;
  1199. }
  1200. /*
  1201. * find_jump_table() - Given a dynamic jump, find the switch jump table
  1202. * associated with it.
  1203. */
  1204. static struct reloc *find_jump_table(struct objtool_file *file,
  1205. struct symbol *func,
  1206. struct instruction *insn)
  1207. {
  1208. struct reloc *table_reloc;
  1209. struct instruction *dest_insn, *orig_insn = insn;
  1210. /*
  1211. * Backward search using the @first_jump_src links, these help avoid
  1212. * much of the 'in between' code. Which avoids us getting confused by
  1213. * it.
  1214. */
  1215. for (;
  1216. insn && insn->func && insn->func->pfunc == func;
  1217. insn = insn->first_jump_src ?: prev_insn_same_sym(file, insn)) {
  1218. if (insn != orig_insn && insn->type == INSN_JUMP_DYNAMIC)
  1219. break;
  1220. /* allow small jumps within the range */
  1221. if (insn->type == INSN_JUMP_UNCONDITIONAL &&
  1222. insn->jump_dest &&
  1223. (insn->jump_dest->offset <= insn->offset ||
  1224. insn->jump_dest->offset > orig_insn->offset))
  1225. break;
  1226. table_reloc = arch_find_switch_table(file, insn);
  1227. if (!table_reloc)
  1228. continue;
  1229. dest_insn = find_insn(file, table_reloc->sym->sec, table_reloc->addend);
  1230. if (!dest_insn || !dest_insn->func || dest_insn->func->pfunc != func)
  1231. continue;
  1232. return table_reloc;
  1233. }
  1234. return NULL;
  1235. }
  1236. /*
  1237. * First pass: Mark the head of each jump table so that in the next pass,
  1238. * we know when a given jump table ends and the next one starts.
  1239. */
  1240. static void mark_func_jump_tables(struct objtool_file *file,
  1241. struct symbol *func)
  1242. {
  1243. struct instruction *insn, *last = NULL;
  1244. struct reloc *reloc;
  1245. func_for_each_insn(file, func, insn) {
  1246. if (!last)
  1247. last = insn;
  1248. /*
  1249. * Store back-pointers for unconditional forward jumps such
  1250. * that find_jump_table() can back-track using those and
  1251. * avoid some potentially confusing code.
  1252. */
  1253. if (insn->type == INSN_JUMP_UNCONDITIONAL && insn->jump_dest &&
  1254. insn->offset > last->offset &&
  1255. insn->jump_dest->offset > insn->offset &&
  1256. !insn->jump_dest->first_jump_src) {
  1257. insn->jump_dest->first_jump_src = insn;
  1258. last = insn->jump_dest;
  1259. }
  1260. if (insn->type != INSN_JUMP_DYNAMIC)
  1261. continue;
  1262. reloc = find_jump_table(file, func, insn);
  1263. if (reloc) {
  1264. reloc->jump_table_start = true;
  1265. insn->jump_table = reloc;
  1266. }
  1267. }
  1268. }
  1269. static int add_func_jump_tables(struct objtool_file *file,
  1270. struct symbol *func)
  1271. {
  1272. struct instruction *insn;
  1273. int ret;
  1274. func_for_each_insn(file, func, insn) {
  1275. if (!insn->jump_table)
  1276. continue;
  1277. ret = add_jump_table(file, insn, insn->jump_table);
  1278. if (ret)
  1279. return ret;
  1280. }
  1281. return 0;
  1282. }
  1283. /*
  1284. * For some switch statements, gcc generates a jump table in the .rodata
  1285. * section which contains a list of addresses within the function to jump to.
  1286. * This finds these jump tables and adds them to the insn->alts lists.
  1287. */
  1288. static int add_jump_table_alts(struct objtool_file *file)
  1289. {
  1290. struct section *sec;
  1291. struct symbol *func;
  1292. int ret;
  1293. if (!file->rodata)
  1294. return 0;
  1295. for_each_sec(file, sec) {
  1296. list_for_each_entry(func, &sec->symbol_list, list) {
  1297. if (func->type != STT_FUNC)
  1298. continue;
  1299. mark_func_jump_tables(file, func);
  1300. ret = add_func_jump_tables(file, func);
  1301. if (ret)
  1302. return ret;
  1303. }
  1304. }
  1305. return 0;
  1306. }
  1307. static int read_unwind_hints(struct objtool_file *file)
  1308. {
  1309. struct section *sec, *relocsec;
  1310. struct reloc *reloc;
  1311. struct unwind_hint *hint;
  1312. struct instruction *insn;
  1313. struct cfi_reg *cfa;
  1314. int i;
  1315. sec = find_section_by_name(file->elf, ".discard.unwind_hints");
  1316. if (!sec)
  1317. return 0;
  1318. relocsec = sec->reloc;
  1319. if (!relocsec) {
  1320. WARN("missing .rela.discard.unwind_hints section");
  1321. return -1;
  1322. }
  1323. if (sec->len % sizeof(struct unwind_hint)) {
  1324. WARN("struct unwind_hint size mismatch");
  1325. return -1;
  1326. }
  1327. file->hints = true;
  1328. for (i = 0; i < sec->len / sizeof(struct unwind_hint); i++) {
  1329. hint = (struct unwind_hint *)sec->data->d_buf + i;
  1330. reloc = find_reloc_by_dest(file->elf, sec, i * sizeof(*hint));
  1331. if (!reloc) {
  1332. WARN("can't find reloc for unwind_hints[%d]", i);
  1333. return -1;
  1334. }
  1335. insn = find_insn(file, reloc->sym->sec, reloc->addend);
  1336. if (!insn) {
  1337. WARN("can't find insn for unwind_hints[%d]", i);
  1338. return -1;
  1339. }
  1340. cfa = &insn->cfi.cfa;
  1341. if (hint->type == UNWIND_HINT_TYPE_RET_OFFSET) {
  1342. insn->ret_offset = hint->sp_offset;
  1343. continue;
  1344. }
  1345. insn->hint = true;
  1346. if (arch_decode_hint_reg(insn, hint->sp_reg)) {
  1347. WARN_FUNC("unsupported unwind_hint sp base reg %d",
  1348. insn->sec, insn->offset, hint->sp_reg);
  1349. return -1;
  1350. }
  1351. cfa->offset = hint->sp_offset;
  1352. insn->cfi.type = hint->type;
  1353. insn->cfi.end = hint->end;
  1354. }
  1355. return 0;
  1356. }
  1357. static int read_retpoline_hints(struct objtool_file *file)
  1358. {
  1359. struct section *sec;
  1360. struct instruction *insn;
  1361. struct reloc *reloc;
  1362. sec = find_section_by_name(file->elf, ".rela.discard.retpoline_safe");
  1363. if (!sec)
  1364. return 0;
  1365. list_for_each_entry(reloc, &sec->reloc_list, list) {
  1366. if (reloc->sym->type != STT_SECTION) {
  1367. WARN("unexpected relocation symbol type in %s", sec->name);
  1368. return -1;
  1369. }
  1370. insn = find_insn(file, reloc->sym->sec, reloc->addend);
  1371. if (!insn) {
  1372. WARN("bad .discard.retpoline_safe entry");
  1373. return -1;
  1374. }
  1375. if (insn->type != INSN_JUMP_DYNAMIC &&
  1376. insn->type != INSN_CALL_DYNAMIC) {
  1377. WARN_FUNC("retpoline_safe hint not an indirect jump/call",
  1378. insn->sec, insn->offset);
  1379. return -1;
  1380. }
  1381. insn->retpoline_safe = true;
  1382. }
  1383. return 0;
  1384. }
  1385. static int read_instr_hints(struct objtool_file *file)
  1386. {
  1387. struct section *sec;
  1388. struct instruction *insn;
  1389. struct reloc *reloc;
  1390. sec = find_section_by_name(file->elf, ".rela.discard.instr_end");
  1391. if (!sec)
  1392. return 0;
  1393. list_for_each_entry(reloc, &sec->reloc_list, list) {
  1394. if (reloc->sym->type != STT_SECTION) {
  1395. WARN("unexpected relocation symbol type in %s", sec->name);
  1396. return -1;
  1397. }
  1398. insn = find_insn(file, reloc->sym->sec, reloc->addend);
  1399. if (!insn) {
  1400. WARN("bad .discard.instr_end entry");
  1401. return -1;
  1402. }
  1403. insn->instr--;
  1404. }
  1405. sec = find_section_by_name(file->elf, ".rela.discard.instr_begin");
  1406. if (!sec)
  1407. return 0;
  1408. list_for_each_entry(reloc, &sec->reloc_list, list) {
  1409. if (reloc->sym->type != STT_SECTION) {
  1410. WARN("unexpected relocation symbol type in %s", sec->name);
  1411. return -1;
  1412. }
  1413. insn = find_insn(file, reloc->sym->sec, reloc->addend);
  1414. if (!insn) {
  1415. WARN("bad .discard.instr_begin entry");
  1416. return -1;
  1417. }
  1418. insn->instr++;
  1419. }
  1420. return 0;
  1421. }
  1422. static int read_intra_function_calls(struct objtool_file *file)
  1423. {
  1424. struct instruction *insn;
  1425. struct section *sec;
  1426. struct reloc *reloc;
  1427. sec = find_section_by_name(file->elf, ".rela.discard.intra_function_calls");
  1428. if (!sec)
  1429. return 0;
  1430. list_for_each_entry(reloc, &sec->reloc_list, list) {
  1431. unsigned long dest_off;
  1432. if (reloc->sym->type != STT_SECTION) {
  1433. WARN("unexpected relocation symbol type in %s",
  1434. sec->name);
  1435. return -1;
  1436. }
  1437. insn = find_insn(file, reloc->sym->sec, reloc->addend);
  1438. if (!insn) {
  1439. WARN("bad .discard.intra_function_call entry");
  1440. return -1;
  1441. }
  1442. if (insn->type != INSN_CALL) {
  1443. WARN_FUNC("intra_function_call not a direct call",
  1444. insn->sec, insn->offset);
  1445. return -1;
  1446. }
  1447. /*
  1448. * Treat intra-function CALLs as JMPs, but with a stack_op.
  1449. * See add_call_destinations(), which strips stack_ops from
  1450. * normal CALLs.
  1451. */
  1452. insn->type = INSN_JUMP_UNCONDITIONAL;
  1453. dest_off = insn->offset + insn->len + insn->immediate;
  1454. insn->jump_dest = find_insn(file, insn->sec, dest_off);
  1455. if (!insn->jump_dest) {
  1456. WARN_FUNC("can't find call dest at %s+0x%lx",
  1457. insn->sec, insn->offset,
  1458. insn->sec->name, dest_off);
  1459. return -1;
  1460. }
  1461. }
  1462. return 0;
  1463. }
  1464. static int read_static_call_tramps(struct objtool_file *file)
  1465. {
  1466. struct section *sec;
  1467. struct symbol *func;
  1468. for_each_sec(file, sec) {
  1469. list_for_each_entry(func, &sec->symbol_list, list) {
  1470. if (func->bind == STB_GLOBAL &&
  1471. !strncmp(func->name, STATIC_CALL_TRAMP_PREFIX_STR,
  1472. strlen(STATIC_CALL_TRAMP_PREFIX_STR)))
  1473. func->static_call_tramp = true;
  1474. }
  1475. }
  1476. return 0;
  1477. }
  1478. static void mark_rodata(struct objtool_file *file)
  1479. {
  1480. struct section *sec;
  1481. bool found = false;
  1482. /*
  1483. * Search for the following rodata sections, each of which can
  1484. * potentially contain jump tables:
  1485. *
  1486. * - .rodata: can contain GCC switch tables
  1487. * - .rodata.<func>: same, if -fdata-sections is being used
  1488. * - .rodata..c_jump_table: contains C annotated jump tables
  1489. *
  1490. * .rodata.str1.* sections are ignored; they don't contain jump tables.
  1491. */
  1492. for_each_sec(file, sec) {
  1493. if (!strncmp(sec->name, ".rodata", 7) &&
  1494. !strstr(sec->name, ".str1.")) {
  1495. sec->rodata = true;
  1496. found = true;
  1497. }
  1498. }
  1499. file->rodata = found;
  1500. }
  1501. static int decode_sections(struct objtool_file *file)
  1502. {
  1503. int ret;
  1504. mark_rodata(file);
  1505. ret = decode_instructions(file);
  1506. if (ret)
  1507. return ret;
  1508. ret = add_dead_ends(file);
  1509. if (ret)
  1510. return ret;
  1511. add_ignores(file);
  1512. add_uaccess_safe(file);
  1513. add_cfi_jumptables(file);
  1514. ret = add_ignore_alternatives(file);
  1515. if (ret)
  1516. return ret;
  1517. /*
  1518. * Must be before add_{jump_call}_destination.
  1519. */
  1520. ret = read_static_call_tramps(file);
  1521. if (ret)
  1522. return ret;
  1523. ret = add_jump_destinations(file);
  1524. if (ret)
  1525. return ret;
  1526. ret = add_special_section_alts(file);
  1527. if (ret)
  1528. return ret;
  1529. /*
  1530. * Must be before add_call_destination(); it changes INSN_CALL to
  1531. * INSN_JUMP.
  1532. */
  1533. ret = read_intra_function_calls(file);
  1534. if (ret)
  1535. return ret;
  1536. ret = add_call_destinations(file);
  1537. if (ret)
  1538. return ret;
  1539. ret = add_jump_table_alts(file);
  1540. if (ret)
  1541. return ret;
  1542. ret = read_unwind_hints(file);
  1543. if (ret)
  1544. return ret;
  1545. ret = read_retpoline_hints(file);
  1546. if (ret)
  1547. return ret;
  1548. ret = read_instr_hints(file);
  1549. if (ret)
  1550. return ret;
  1551. return 0;
  1552. }
  1553. static bool is_fentry_call(struct instruction *insn)
  1554. {
  1555. if (insn->type == INSN_CALL && insn->call_dest &&
  1556. insn->call_dest->type == STT_NOTYPE &&
  1557. !strcmp(insn->call_dest->name, "__fentry__"))
  1558. return true;
  1559. return false;
  1560. }
  1561. static bool has_modified_stack_frame(struct instruction *insn, struct insn_state *state)
  1562. {
  1563. u8 ret_offset = insn->ret_offset;
  1564. struct cfi_state *cfi = &state->cfi;
  1565. int i;
  1566. if (cfi->cfa.base != initial_func_cfi.cfa.base || cfi->drap)
  1567. return true;
  1568. if (cfi->cfa.offset != initial_func_cfi.cfa.offset + ret_offset)
  1569. return true;
  1570. if (cfi->stack_size != initial_func_cfi.cfa.offset + ret_offset)
  1571. return true;
  1572. /*
  1573. * If there is a ret offset hint then don't check registers
  1574. * because a callee-saved register might have been pushed on
  1575. * the stack.
  1576. */
  1577. if (ret_offset)
  1578. return false;
  1579. for (i = 0; i < CFI_NUM_REGS; i++) {
  1580. if (cfi->regs[i].base != initial_func_cfi.regs[i].base ||
  1581. cfi->regs[i].offset != initial_func_cfi.regs[i].offset)
  1582. return true;
  1583. }
  1584. return false;
  1585. }
  1586. static bool has_valid_stack_frame(struct insn_state *state)
  1587. {
  1588. struct cfi_state *cfi = &state->cfi;
  1589. if (cfi->cfa.base == CFI_BP && cfi->regs[CFI_BP].base == CFI_CFA &&
  1590. cfi->regs[CFI_BP].offset == -16)
  1591. return true;
  1592. if (cfi->drap && cfi->regs[CFI_BP].base == CFI_BP)
  1593. return true;
  1594. return false;
  1595. }
  1596. static int update_cfi_state_regs(struct instruction *insn,
  1597. struct cfi_state *cfi,
  1598. struct stack_op *op)
  1599. {
  1600. struct cfi_reg *cfa = &cfi->cfa;
  1601. if (cfa->base != CFI_SP && cfa->base != CFI_SP_INDIRECT)
  1602. return 0;
  1603. /* push */
  1604. if (op->dest.type == OP_DEST_PUSH || op->dest.type == OP_DEST_PUSHF)
  1605. cfa->offset += 8;
  1606. /* pop */
  1607. if (op->src.type == OP_SRC_POP || op->src.type == OP_SRC_POPF)
  1608. cfa->offset -= 8;
  1609. /* add immediate to sp */
  1610. if (op->dest.type == OP_DEST_REG && op->src.type == OP_SRC_ADD &&
  1611. op->dest.reg == CFI_SP && op->src.reg == CFI_SP)
  1612. cfa->offset -= op->src.offset;
  1613. return 0;
  1614. }
  1615. static void save_reg(struct cfi_state *cfi, unsigned char reg, int base, int offset)
  1616. {
  1617. if (arch_callee_saved_reg(reg) &&
  1618. cfi->regs[reg].base == CFI_UNDEFINED) {
  1619. cfi->regs[reg].base = base;
  1620. cfi->regs[reg].offset = offset;
  1621. }
  1622. }
  1623. static void restore_reg(struct cfi_state *cfi, unsigned char reg)
  1624. {
  1625. cfi->regs[reg].base = initial_func_cfi.regs[reg].base;
  1626. cfi->regs[reg].offset = initial_func_cfi.regs[reg].offset;
  1627. }
  1628. /*
  1629. * A note about DRAP stack alignment:
  1630. *
  1631. * GCC has the concept of a DRAP register, which is used to help keep track of
  1632. * the stack pointer when aligning the stack. r10 or r13 is used as the DRAP
  1633. * register. The typical DRAP pattern is:
  1634. *
  1635. * 4c 8d 54 24 08 lea 0x8(%rsp),%r10
  1636. * 48 83 e4 c0 and $0xffffffffffffffc0,%rsp
  1637. * 41 ff 72 f8 pushq -0x8(%r10)
  1638. * 55 push %rbp
  1639. * 48 89 e5 mov %rsp,%rbp
  1640. * (more pushes)
  1641. * 41 52 push %r10
  1642. * ...
  1643. * 41 5a pop %r10
  1644. * (more pops)
  1645. * 5d pop %rbp
  1646. * 49 8d 62 f8 lea -0x8(%r10),%rsp
  1647. * c3 retq
  1648. *
  1649. * There are some variations in the epilogues, like:
  1650. *
  1651. * 5b pop %rbx
  1652. * 41 5a pop %r10
  1653. * 41 5c pop %r12
  1654. * 41 5d pop %r13
  1655. * 41 5e pop %r14
  1656. * c9 leaveq
  1657. * 49 8d 62 f8 lea -0x8(%r10),%rsp
  1658. * c3 retq
  1659. *
  1660. * and:
  1661. *
  1662. * 4c 8b 55 e8 mov -0x18(%rbp),%r10
  1663. * 48 8b 5d e0 mov -0x20(%rbp),%rbx
  1664. * 4c 8b 65 f0 mov -0x10(%rbp),%r12
  1665. * 4c 8b 6d f8 mov -0x8(%rbp),%r13
  1666. * c9 leaveq
  1667. * 49 8d 62 f8 lea -0x8(%r10),%rsp
  1668. * c3 retq
  1669. *
  1670. * Sometimes r13 is used as the DRAP register, in which case it's saved and
  1671. * restored beforehand:
  1672. *
  1673. * 41 55 push %r13
  1674. * 4c 8d 6c 24 10 lea 0x10(%rsp),%r13
  1675. * 48 83 e4 f0 and $0xfffffffffffffff0,%rsp
  1676. * ...
  1677. * 49 8d 65 f0 lea -0x10(%r13),%rsp
  1678. * 41 5d pop %r13
  1679. * c3 retq
  1680. */
  1681. static int update_cfi_state(struct instruction *insn, struct cfi_state *cfi,
  1682. struct stack_op *op)
  1683. {
  1684. struct cfi_reg *cfa = &cfi->cfa;
  1685. struct cfi_reg *regs = cfi->regs;
  1686. /* stack operations don't make sense with an undefined CFA */
  1687. if (cfa->base == CFI_UNDEFINED) {
  1688. if (insn->func) {
  1689. WARN_FUNC("undefined stack state", insn->sec, insn->offset);
  1690. return -1;
  1691. }
  1692. return 0;
  1693. }
  1694. if (cfi->type == UNWIND_HINT_TYPE_REGS ||
  1695. cfi->type == UNWIND_HINT_TYPE_REGS_PARTIAL)
  1696. return update_cfi_state_regs(insn, cfi, op);
  1697. switch (op->dest.type) {
  1698. case OP_DEST_REG:
  1699. switch (op->src.type) {
  1700. case OP_SRC_REG:
  1701. if (op->src.reg == CFI_SP && op->dest.reg == CFI_BP &&
  1702. cfa->base == CFI_SP &&
  1703. regs[CFI_BP].base == CFI_CFA &&
  1704. regs[CFI_BP].offset == -cfa->offset) {
  1705. /* mov %rsp, %rbp */
  1706. cfa->base = op->dest.reg;
  1707. cfi->bp_scratch = false;
  1708. }
  1709. else if (op->src.reg == CFI_SP &&
  1710. op->dest.reg == CFI_BP && cfi->drap) {
  1711. /* drap: mov %rsp, %rbp */
  1712. regs[CFI_BP].base = CFI_BP;
  1713. regs[CFI_BP].offset = -cfi->stack_size;
  1714. cfi->bp_scratch = false;
  1715. }
  1716. else if (op->src.reg == CFI_SP && cfa->base == CFI_SP) {
  1717. /*
  1718. * mov %rsp, %reg
  1719. *
  1720. * This is needed for the rare case where GCC
  1721. * does:
  1722. *
  1723. * mov %rsp, %rax
  1724. * ...
  1725. * mov %rax, %rsp
  1726. */
  1727. cfi->vals[op->dest.reg].base = CFI_CFA;
  1728. cfi->vals[op->dest.reg].offset = -cfi->stack_size;
  1729. }
  1730. else if (op->src.reg == CFI_BP && op->dest.reg == CFI_SP &&
  1731. cfa->base == CFI_BP) {
  1732. /*
  1733. * mov %rbp, %rsp
  1734. *
  1735. * Restore the original stack pointer (Clang).
  1736. */
  1737. cfi->stack_size = -cfi->regs[CFI_BP].offset;
  1738. }
  1739. else if (op->dest.reg == cfa->base) {
  1740. /* mov %reg, %rsp */
  1741. if (cfa->base == CFI_SP &&
  1742. cfi->vals[op->src.reg].base == CFI_CFA) {
  1743. /*
  1744. * This is needed for the rare case
  1745. * where GCC does something dumb like:
  1746. *
  1747. * lea 0x8(%rsp), %rcx
  1748. * ...
  1749. * mov %rcx, %rsp
  1750. */
  1751. cfa->offset = -cfi->vals[op->src.reg].offset;
  1752. cfi->stack_size = cfa->offset;
  1753. } else {
  1754. cfa->base = CFI_UNDEFINED;
  1755. cfa->offset = 0;
  1756. }
  1757. }
  1758. break;
  1759. case OP_SRC_ADD:
  1760. if (op->dest.reg == CFI_SP && op->src.reg == CFI_SP) {
  1761. /* add imm, %rsp */
  1762. cfi->stack_size -= op->src.offset;
  1763. if (cfa->base == CFI_SP)
  1764. cfa->offset -= op->src.offset;
  1765. break;
  1766. }
  1767. if (op->dest.reg == CFI_SP && op->src.reg == CFI_BP) {
  1768. /* lea disp(%rbp), %rsp */
  1769. cfi->stack_size = -(op->src.offset + regs[CFI_BP].offset);
  1770. break;
  1771. }
  1772. if (op->src.reg == CFI_SP && cfa->base == CFI_SP) {
  1773. /* drap: lea disp(%rsp), %drap */
  1774. cfi->drap_reg = op->dest.reg;
  1775. /*
  1776. * lea disp(%rsp), %reg
  1777. *
  1778. * This is needed for the rare case where GCC
  1779. * does something dumb like:
  1780. *
  1781. * lea 0x8(%rsp), %rcx
  1782. * ...
  1783. * mov %rcx, %rsp
  1784. */
  1785. cfi->vals[op->dest.reg].base = CFI_CFA;
  1786. cfi->vals[op->dest.reg].offset = \
  1787. -cfi->stack_size + op->src.offset;
  1788. break;
  1789. }
  1790. if (cfi->drap && op->dest.reg == CFI_SP &&
  1791. op->src.reg == cfi->drap_reg) {
  1792. /* drap: lea disp(%drap), %rsp */
  1793. cfa->base = CFI_SP;
  1794. cfa->offset = cfi->stack_size = -op->src.offset;
  1795. cfi->drap_reg = CFI_UNDEFINED;
  1796. cfi->drap = false;
  1797. break;
  1798. }
  1799. if (op->dest.reg == cfi->cfa.base) {
  1800. WARN_FUNC("unsupported stack register modification",
  1801. insn->sec, insn->offset);
  1802. return -1;
  1803. }
  1804. break;
  1805. case OP_SRC_AND:
  1806. if (op->dest.reg != CFI_SP ||
  1807. (cfi->drap_reg != CFI_UNDEFINED && cfa->base != CFI_SP) ||
  1808. (cfi->drap_reg == CFI_UNDEFINED && cfa->base != CFI_BP)) {
  1809. WARN_FUNC("unsupported stack pointer realignment",
  1810. insn->sec, insn->offset);
  1811. return -1;
  1812. }
  1813. if (cfi->drap_reg != CFI_UNDEFINED) {
  1814. /* drap: and imm, %rsp */
  1815. cfa->base = cfi->drap_reg;
  1816. cfa->offset = cfi->stack_size = 0;
  1817. cfi->drap = true;
  1818. }
  1819. /*
  1820. * Older versions of GCC (4.8ish) realign the stack
  1821. * without DRAP, with a frame pointer.
  1822. */
  1823. break;
  1824. case OP_SRC_POP:
  1825. case OP_SRC_POPF:
  1826. if (!cfi->drap && op->dest.reg == cfa->base) {
  1827. /* pop %rbp */
  1828. cfa->base = CFI_SP;
  1829. }
  1830. if (cfi->drap && cfa->base == CFI_BP_INDIRECT &&
  1831. op->dest.reg == cfi->drap_reg &&
  1832. cfi->drap_offset == -cfi->stack_size) {
  1833. /* drap: pop %drap */
  1834. cfa->base = cfi->drap_reg;
  1835. cfa->offset = 0;
  1836. cfi->drap_offset = -1;
  1837. } else if (regs[op->dest.reg].offset == -cfi->stack_size) {
  1838. /* pop %reg */
  1839. restore_reg(cfi, op->dest.reg);
  1840. }
  1841. cfi->stack_size -= 8;
  1842. if (cfa->base == CFI_SP)
  1843. cfa->offset -= 8;
  1844. break;
  1845. case OP_SRC_REG_INDIRECT:
  1846. if (cfi->drap && op->src.reg == CFI_BP &&
  1847. op->src.offset == cfi->drap_offset) {
  1848. /* drap: mov disp(%rbp), %drap */
  1849. cfa->base = cfi->drap_reg;
  1850. cfa->offset = 0;
  1851. cfi->drap_offset = -1;
  1852. }
  1853. if (cfi->drap && op->src.reg == CFI_BP &&
  1854. op->src.offset == regs[op->dest.reg].offset) {
  1855. /* drap: mov disp(%rbp), %reg */
  1856. restore_reg(cfi, op->dest.reg);
  1857. } else if (op->src.reg == cfa->base &&
  1858. op->src.offset == regs[op->dest.reg].offset + cfa->offset) {
  1859. /* mov disp(%rbp), %reg */
  1860. /* mov disp(%rsp), %reg */
  1861. restore_reg(cfi, op->dest.reg);
  1862. }
  1863. break;
  1864. default:
  1865. WARN_FUNC("unknown stack-related instruction",
  1866. insn->sec, insn->offset);
  1867. return -1;
  1868. }
  1869. break;
  1870. case OP_DEST_PUSH:
  1871. case OP_DEST_PUSHF:
  1872. cfi->stack_size += 8;
  1873. if (cfa->base == CFI_SP)
  1874. cfa->offset += 8;
  1875. if (op->src.type != OP_SRC_REG)
  1876. break;
  1877. if (cfi->drap) {
  1878. if (op->src.reg == cfa->base && op->src.reg == cfi->drap_reg) {
  1879. /* drap: push %drap */
  1880. cfa->base = CFI_BP_INDIRECT;
  1881. cfa->offset = -cfi->stack_size;
  1882. /* save drap so we know when to restore it */
  1883. cfi->drap_offset = -cfi->stack_size;
  1884. } else if (op->src.reg == CFI_BP && cfa->base == cfi->drap_reg) {
  1885. /* drap: push %rbp */
  1886. cfi->stack_size = 0;
  1887. } else {
  1888. /* drap: push %reg */
  1889. save_reg(cfi, op->src.reg, CFI_BP, -cfi->stack_size);
  1890. }
  1891. } else {
  1892. /* push %reg */
  1893. save_reg(cfi, op->src.reg, CFI_CFA, -cfi->stack_size);
  1894. }
  1895. /* detect when asm code uses rbp as a scratch register */
  1896. if (!no_fp && insn->func && op->src.reg == CFI_BP &&
  1897. cfa->base != CFI_BP)
  1898. cfi->bp_scratch = true;
  1899. break;
  1900. case OP_DEST_REG_INDIRECT:
  1901. if (cfi->drap) {
  1902. if (op->src.reg == cfa->base && op->src.reg == cfi->drap_reg) {
  1903. /* drap: mov %drap, disp(%rbp) */
  1904. cfa->base = CFI_BP_INDIRECT;
  1905. cfa->offset = op->dest.offset;
  1906. /* save drap offset so we know when to restore it */
  1907. cfi->drap_offset = op->dest.offset;
  1908. } else {
  1909. /* drap: mov reg, disp(%rbp) */
  1910. save_reg(cfi, op->src.reg, CFI_BP, op->dest.offset);
  1911. }
  1912. } else if (op->dest.reg == cfa->base) {
  1913. /* mov reg, disp(%rbp) */
  1914. /* mov reg, disp(%rsp) */
  1915. save_reg(cfi, op->src.reg, CFI_CFA,
  1916. op->dest.offset - cfi->cfa.offset);
  1917. }
  1918. break;
  1919. case OP_DEST_LEAVE:
  1920. if ((!cfi->drap && cfa->base != CFI_BP) ||
  1921. (cfi->drap && cfa->base != cfi->drap_reg)) {
  1922. WARN_FUNC("leave instruction with modified stack frame",
  1923. insn->sec, insn->offset);
  1924. return -1;
  1925. }
  1926. /* leave (mov %rbp, %rsp; pop %rbp) */
  1927. cfi->stack_size = -cfi->regs[CFI_BP].offset - 8;
  1928. restore_reg(cfi, CFI_BP);
  1929. if (!cfi->drap) {
  1930. cfa->base = CFI_SP;
  1931. cfa->offset -= 8;
  1932. }
  1933. break;
  1934. case OP_DEST_MEM:
  1935. if (op->src.type != OP_SRC_POP && op->src.type != OP_SRC_POPF) {
  1936. WARN_FUNC("unknown stack-related memory operation",
  1937. insn->sec, insn->offset);
  1938. return -1;
  1939. }
  1940. /* pop mem */
  1941. cfi->stack_size -= 8;
  1942. if (cfa->base == CFI_SP)
  1943. cfa->offset -= 8;
  1944. break;
  1945. default:
  1946. WARN_FUNC("unknown stack-related instruction",
  1947. insn->sec, insn->offset);
  1948. return -1;
  1949. }
  1950. return 0;
  1951. }
  1952. static int handle_insn_ops(struct instruction *insn, struct insn_state *state)
  1953. {
  1954. struct stack_op *op;
  1955. list_for_each_entry(op, &insn->stack_ops, list) {
  1956. struct cfi_state old_cfi = state->cfi;
  1957. int res;
  1958. res = update_cfi_state(insn, &state->cfi, op);
  1959. if (res)
  1960. return res;
  1961. if (insn->alt_group && memcmp(&state->cfi, &old_cfi, sizeof(struct cfi_state))) {
  1962. WARN_FUNC("alternative modifies stack", insn->sec, insn->offset);
  1963. return -1;
  1964. }
  1965. if (op->dest.type == OP_DEST_PUSHF) {
  1966. if (!state->uaccess_stack) {
  1967. state->uaccess_stack = 1;
  1968. } else if (state->uaccess_stack >> 31) {
  1969. WARN_FUNC("PUSHF stack exhausted",
  1970. insn->sec, insn->offset);
  1971. return 1;
  1972. }
  1973. state->uaccess_stack <<= 1;
  1974. state->uaccess_stack |= state->uaccess;
  1975. }
  1976. if (op->src.type == OP_SRC_POPF) {
  1977. if (state->uaccess_stack) {
  1978. state->uaccess = state->uaccess_stack & 1;
  1979. state->uaccess_stack >>= 1;
  1980. if (state->uaccess_stack == 1)
  1981. state->uaccess_stack = 0;
  1982. }
  1983. }
  1984. }
  1985. return 0;
  1986. }
  1987. static bool insn_cfi_match(struct instruction *insn, struct cfi_state *cfi2)
  1988. {
  1989. struct cfi_state *cfi1 = &insn->cfi;
  1990. int i;
  1991. if (memcmp(&cfi1->cfa, &cfi2->cfa, sizeof(cfi1->cfa))) {
  1992. WARN_FUNC("stack state mismatch: cfa1=%d%+d cfa2=%d%+d",
  1993. insn->sec, insn->offset,
  1994. cfi1->cfa.base, cfi1->cfa.offset,
  1995. cfi2->cfa.base, cfi2->cfa.offset);
  1996. } else if (memcmp(&cfi1->regs, &cfi2->regs, sizeof(cfi1->regs))) {
  1997. for (i = 0; i < CFI_NUM_REGS; i++) {
  1998. if (!memcmp(&cfi1->regs[i], &cfi2->regs[i],
  1999. sizeof(struct cfi_reg)))
  2000. continue;
  2001. WARN_FUNC("stack state mismatch: reg1[%d]=%d%+d reg2[%d]=%d%+d",
  2002. insn->sec, insn->offset,
  2003. i, cfi1->regs[i].base, cfi1->regs[i].offset,
  2004. i, cfi2->regs[i].base, cfi2->regs[i].offset);
  2005. break;
  2006. }
  2007. } else if (cfi1->type != cfi2->type) {
  2008. WARN_FUNC("stack state mismatch: type1=%d type2=%d",
  2009. insn->sec, insn->offset, cfi1->type, cfi2->type);
  2010. } else if (cfi1->drap != cfi2->drap ||
  2011. (cfi1->drap && cfi1->drap_reg != cfi2->drap_reg) ||
  2012. (cfi1->drap && cfi1->drap_offset != cfi2->drap_offset)) {
  2013. WARN_FUNC("stack state mismatch: drap1=%d(%d,%d) drap2=%d(%d,%d)",
  2014. insn->sec, insn->offset,
  2015. cfi1->drap, cfi1->drap_reg, cfi1->drap_offset,
  2016. cfi2->drap, cfi2->drap_reg, cfi2->drap_offset);
  2017. } else
  2018. return true;
  2019. return false;
  2020. }
  2021. static inline bool func_uaccess_safe(struct symbol *func)
  2022. {
  2023. if (func)
  2024. return func->uaccess_safe;
  2025. return false;
  2026. }
  2027. static inline const char *call_dest_name(struct instruction *insn)
  2028. {
  2029. if (insn->call_dest)
  2030. return insn->call_dest->name;
  2031. return "{dynamic}";
  2032. }
  2033. static inline bool noinstr_call_dest(struct symbol *func)
  2034. {
  2035. /*
  2036. * We can't deal with indirect function calls at present;
  2037. * assume they're instrumented.
  2038. */
  2039. if (!func)
  2040. return false;
  2041. /*
  2042. * If the symbol is from a noinstr section; we good.
  2043. */
  2044. if (func->sec->noinstr)
  2045. return true;
  2046. /*
  2047. * The __ubsan_handle_*() calls are like WARN(), they only happen when
  2048. * something 'BAD' happened. At the risk of taking the machine down,
  2049. * let them proceed to get the message out.
  2050. */
  2051. if (!strncmp(func->name, "__ubsan_handle_", 15))
  2052. return true;
  2053. return false;
  2054. }
  2055. static int validate_call(struct instruction *insn, struct insn_state *state)
  2056. {
  2057. if (state->noinstr && state->instr <= 0 &&
  2058. !noinstr_call_dest(insn->call_dest)) {
  2059. WARN_FUNC("call to %s() leaves .noinstr.text section",
  2060. insn->sec, insn->offset, call_dest_name(insn));
  2061. return 1;
  2062. }
  2063. if (state->uaccess && !func_uaccess_safe(insn->call_dest)) {
  2064. WARN_FUNC("call to %s() with UACCESS enabled",
  2065. insn->sec, insn->offset, call_dest_name(insn));
  2066. return 1;
  2067. }
  2068. if (state->df) {
  2069. WARN_FUNC("call to %s() with DF set",
  2070. insn->sec, insn->offset, call_dest_name(insn));
  2071. return 1;
  2072. }
  2073. return 0;
  2074. }
  2075. static int validate_sibling_call(struct instruction *insn, struct insn_state *state)
  2076. {
  2077. if (has_modified_stack_frame(insn, state)) {
  2078. WARN_FUNC("sibling call from callable instruction with modified stack frame",
  2079. insn->sec, insn->offset);
  2080. return 1;
  2081. }
  2082. return validate_call(insn, state);
  2083. }
  2084. static int validate_return(struct symbol *func, struct instruction *insn, struct insn_state *state)
  2085. {
  2086. if (state->noinstr && state->instr > 0) {
  2087. WARN_FUNC("return with instrumentation enabled",
  2088. insn->sec, insn->offset);
  2089. return 1;
  2090. }
  2091. if (state->uaccess && !func_uaccess_safe(func)) {
  2092. WARN_FUNC("return with UACCESS enabled",
  2093. insn->sec, insn->offset);
  2094. return 1;
  2095. }
  2096. if (!state->uaccess && func_uaccess_safe(func)) {
  2097. WARN_FUNC("return with UACCESS disabled from a UACCESS-safe function",
  2098. insn->sec, insn->offset);
  2099. return 1;
  2100. }
  2101. if (state->df) {
  2102. WARN_FUNC("return with DF set",
  2103. insn->sec, insn->offset);
  2104. return 1;
  2105. }
  2106. if (func && has_modified_stack_frame(insn, state)) {
  2107. WARN_FUNC("return with modified stack frame",
  2108. insn->sec, insn->offset);
  2109. return 1;
  2110. }
  2111. if (state->cfi.bp_scratch) {
  2112. WARN_FUNC("BP used as a scratch register",
  2113. insn->sec, insn->offset);
  2114. return 1;
  2115. }
  2116. return 0;
  2117. }
  2118. /*
  2119. * Alternatives should not contain any ORC entries, this in turn means they
  2120. * should not contain any CFI ops, which implies all instructions should have
  2121. * the same same CFI state.
  2122. *
  2123. * It is possible to constuct alternatives that have unreachable holes that go
  2124. * unreported (because they're NOPs), such holes would result in CFI_UNDEFINED
  2125. * states which then results in ORC entries, which we just said we didn't want.
  2126. *
  2127. * Avoid them by copying the CFI entry of the first instruction into the whole
  2128. * alternative.
  2129. */
  2130. static void fill_alternative_cfi(struct objtool_file *file, struct instruction *insn)
  2131. {
  2132. struct instruction *first_insn = insn;
  2133. int alt_group = insn->alt_group;
  2134. sec_for_each_insn_continue(file, insn) {
  2135. if (insn->alt_group != alt_group)
  2136. break;
  2137. insn->cfi = first_insn->cfi;
  2138. }
  2139. }
  2140. /*
  2141. * Follow the branch starting at the given instruction, and recursively follow
  2142. * any other branches (jumps). Meanwhile, track the frame pointer state at
  2143. * each instruction and validate all the rules described in
  2144. * tools/objtool/Documentation/stack-validation.txt.
  2145. */
  2146. static int validate_branch(struct objtool_file *file, struct symbol *func,
  2147. struct instruction *insn, struct insn_state state)
  2148. {
  2149. struct alternative *alt;
  2150. struct instruction *next_insn;
  2151. struct section *sec;
  2152. u8 visited;
  2153. int ret;
  2154. sec = insn->sec;
  2155. while (1) {
  2156. next_insn = next_insn_same_sec(file, insn);
  2157. if (file->c_file && func && insn->func && func != insn->func->pfunc) {
  2158. WARN("%s() falls through to next function %s()",
  2159. func->name, insn->func->name);
  2160. return 1;
  2161. }
  2162. if (func && insn->ignore) {
  2163. WARN_FUNC("BUG: why am I validating an ignored function?",
  2164. sec, insn->offset);
  2165. return 1;
  2166. }
  2167. visited = 1 << state.uaccess;
  2168. if (insn->visited) {
  2169. if (!insn->hint && !insn_cfi_match(insn, &state.cfi))
  2170. return 1;
  2171. if (insn->visited & visited)
  2172. return 0;
  2173. }
  2174. if (state.noinstr)
  2175. state.instr += insn->instr;
  2176. if (insn->hint)
  2177. state.cfi = insn->cfi;
  2178. else
  2179. insn->cfi = state.cfi;
  2180. insn->visited |= visited;
  2181. if (!insn->ignore_alts && !list_empty(&insn->alts)) {
  2182. bool skip_orig = false;
  2183. list_for_each_entry(alt, &insn->alts, list) {
  2184. if (alt->skip_orig)
  2185. skip_orig = true;
  2186. ret = validate_branch(file, func, alt->insn, state);
  2187. if (ret) {
  2188. if (backtrace)
  2189. BT_FUNC("(alt)", insn);
  2190. return ret;
  2191. }
  2192. }
  2193. if (insn->alt_group)
  2194. fill_alternative_cfi(file, insn);
  2195. if (skip_orig)
  2196. return 0;
  2197. }
  2198. if (handle_insn_ops(insn, &state))
  2199. return 1;
  2200. switch (insn->type) {
  2201. case INSN_RETURN:
  2202. return validate_return(func, insn, &state);
  2203. case INSN_CALL:
  2204. case INSN_CALL_DYNAMIC:
  2205. ret = validate_call(insn, &state);
  2206. if (ret)
  2207. return ret;
  2208. if (!no_fp && func && !is_fentry_call(insn) &&
  2209. !has_valid_stack_frame(&state)) {
  2210. WARN_FUNC("call without frame pointer save/setup",
  2211. sec, insn->offset);
  2212. return 1;
  2213. }
  2214. if (dead_end_function(file, insn->call_dest))
  2215. return 0;
  2216. break;
  2217. case INSN_JUMP_CONDITIONAL:
  2218. case INSN_JUMP_UNCONDITIONAL:
  2219. if (func && is_sibling_call(insn)) {
  2220. ret = validate_sibling_call(insn, &state);
  2221. if (ret)
  2222. return ret;
  2223. } else if (insn->jump_dest) {
  2224. ret = validate_branch(file, func,
  2225. insn->jump_dest, state);
  2226. if (ret) {
  2227. if (backtrace)
  2228. BT_FUNC("(branch)", insn);
  2229. return ret;
  2230. }
  2231. }
  2232. if (insn->type == INSN_JUMP_UNCONDITIONAL)
  2233. return 0;
  2234. break;
  2235. case INSN_JUMP_DYNAMIC:
  2236. case INSN_JUMP_DYNAMIC_CONDITIONAL:
  2237. if (func && is_sibling_call(insn)) {
  2238. ret = validate_sibling_call(insn, &state);
  2239. if (ret)
  2240. return ret;
  2241. }
  2242. if (insn->type == INSN_JUMP_DYNAMIC)
  2243. return 0;
  2244. break;
  2245. case INSN_CONTEXT_SWITCH:
  2246. if (func && (!next_insn || !next_insn->hint)) {
  2247. WARN_FUNC("unsupported instruction in callable function",
  2248. sec, insn->offset);
  2249. return 1;
  2250. }
  2251. return 0;
  2252. case INSN_STAC:
  2253. if (state.uaccess) {
  2254. WARN_FUNC("recursive UACCESS enable", sec, insn->offset);
  2255. return 1;
  2256. }
  2257. state.uaccess = true;
  2258. break;
  2259. case INSN_CLAC:
  2260. if (!state.uaccess && func) {
  2261. WARN_FUNC("redundant UACCESS disable", sec, insn->offset);
  2262. return 1;
  2263. }
  2264. if (func_uaccess_safe(func) && !state.uaccess_stack) {
  2265. WARN_FUNC("UACCESS-safe disables UACCESS", sec, insn->offset);
  2266. return 1;
  2267. }
  2268. state.uaccess = false;
  2269. break;
  2270. case INSN_STD:
  2271. if (state.df) {
  2272. WARN_FUNC("recursive STD", sec, insn->offset);
  2273. return 1;
  2274. }
  2275. state.df = true;
  2276. break;
  2277. case INSN_CLD:
  2278. if (!state.df && func) {
  2279. WARN_FUNC("redundant CLD", sec, insn->offset);
  2280. return 1;
  2281. }
  2282. state.df = false;
  2283. break;
  2284. default:
  2285. break;
  2286. }
  2287. if (insn->dead_end)
  2288. return 0;
  2289. if (!next_insn) {
  2290. if (state.cfi.cfa.base == CFI_UNDEFINED)
  2291. return 0;
  2292. WARN("%s: unexpected end of section", sec->name);
  2293. return 1;
  2294. }
  2295. insn = next_insn;
  2296. }
  2297. return 0;
  2298. }
  2299. static int validate_unwind_hints(struct objtool_file *file, struct section *sec)
  2300. {
  2301. struct instruction *insn;
  2302. struct insn_state state;
  2303. int ret, warnings = 0;
  2304. if (!file->hints)
  2305. return 0;
  2306. init_insn_state(&state, sec);
  2307. if (sec) {
  2308. insn = find_insn(file, sec, 0);
  2309. if (!insn)
  2310. return 0;
  2311. } else {
  2312. insn = list_first_entry(&file->insn_list, typeof(*insn), list);
  2313. }
  2314. while (&insn->list != &file->insn_list && (!sec || insn->sec == sec)) {
  2315. if (insn->hint && !insn->visited) {
  2316. ret = validate_branch(file, insn->func, insn, state);
  2317. if (ret && backtrace)
  2318. BT_FUNC("<=== (hint)", insn);
  2319. warnings += ret;
  2320. }
  2321. insn = list_next_entry(insn, list);
  2322. }
  2323. return warnings;
  2324. }
  2325. static int validate_retpoline(struct objtool_file *file)
  2326. {
  2327. struct instruction *insn;
  2328. int warnings = 0;
  2329. for_each_insn(file, insn) {
  2330. if (insn->type != INSN_JUMP_DYNAMIC &&
  2331. insn->type != INSN_CALL_DYNAMIC)
  2332. continue;
  2333. if (insn->retpoline_safe)
  2334. continue;
  2335. /*
  2336. * .init.text code is ran before userspace and thus doesn't
  2337. * strictly need retpolines, except for modules which are
  2338. * loaded late, they very much do need retpoline in their
  2339. * .init.text
  2340. */
  2341. if (!strcmp(insn->sec->name, ".init.text") && !module)
  2342. continue;
  2343. WARN_FUNC("indirect %s found in RETPOLINE build",
  2344. insn->sec, insn->offset,
  2345. insn->type == INSN_JUMP_DYNAMIC ? "jump" : "call");
  2346. warnings++;
  2347. }
  2348. return warnings;
  2349. }
  2350. static bool is_kasan_insn(struct instruction *insn)
  2351. {
  2352. return (insn->type == INSN_CALL &&
  2353. !strcmp(insn->call_dest->name, "__asan_handle_no_return"));
  2354. }
  2355. static bool is_ubsan_insn(struct instruction *insn)
  2356. {
  2357. return (insn->type == INSN_CALL &&
  2358. !strcmp(insn->call_dest->name,
  2359. "__ubsan_handle_builtin_unreachable"));
  2360. }
  2361. static bool ignore_unreachable_insn(struct objtool_file *file, struct instruction *insn)
  2362. {
  2363. int i;
  2364. struct instruction *prev_insn;
  2365. if (insn->ignore || insn->type == INSN_NOP)
  2366. return true;
  2367. /*
  2368. * Ignore any unused exceptions. This can happen when a whitelisted
  2369. * function has an exception table entry.
  2370. *
  2371. * Also ignore alternative replacement instructions. This can happen
  2372. * when a whitelisted function uses one of the ALTERNATIVE macros.
  2373. */
  2374. if (!strcmp(insn->sec->name, ".fixup") ||
  2375. !strcmp(insn->sec->name, ".altinstr_replacement") ||
  2376. !strcmp(insn->sec->name, ".altinstr_aux"))
  2377. return true;
  2378. if (insn->type == INSN_JUMP_UNCONDITIONAL && insn->offset == FAKE_JUMP_OFFSET)
  2379. return true;
  2380. if (!insn->func)
  2381. return false;
  2382. /*
  2383. * CONFIG_UBSAN_TRAP inserts a UD2 when it sees
  2384. * __builtin_unreachable(). The BUG() macro has an unreachable() after
  2385. * the UD2, which causes GCC's undefined trap logic to emit another UD2
  2386. * (or occasionally a JMP to UD2).
  2387. *
  2388. * It may also insert a UD2 after calling a __noreturn function.
  2389. */
  2390. prev_insn = list_prev_entry(insn, list);
  2391. if ((prev_insn->dead_end || dead_end_function(file, prev_insn->call_dest)) &&
  2392. (insn->type == INSN_BUG ||
  2393. (insn->type == INSN_JUMP_UNCONDITIONAL &&
  2394. insn->jump_dest && insn->jump_dest->type == INSN_BUG)))
  2395. return true;
  2396. /*
  2397. * Check if this (or a subsequent) instruction is related to
  2398. * CONFIG_UBSAN or CONFIG_KASAN.
  2399. *
  2400. * End the search at 5 instructions to avoid going into the weeds.
  2401. */
  2402. for (i = 0; i < 5; i++) {
  2403. if (is_kasan_insn(insn) || is_ubsan_insn(insn))
  2404. return true;
  2405. if (insn->type == INSN_JUMP_UNCONDITIONAL) {
  2406. if (insn->jump_dest &&
  2407. insn->jump_dest->func == insn->func) {
  2408. insn = insn->jump_dest;
  2409. continue;
  2410. }
  2411. break;
  2412. }
  2413. if (insn->offset + insn->len >= insn->func->offset + insn->func->len)
  2414. break;
  2415. insn = list_next_entry(insn, list);
  2416. }
  2417. return false;
  2418. }
  2419. static int validate_symbol(struct objtool_file *file, struct section *sec,
  2420. struct symbol *sym, struct insn_state *state)
  2421. {
  2422. struct instruction *insn;
  2423. int ret;
  2424. if (!sym->len) {
  2425. WARN("%s() is missing an ELF size annotation", sym->name);
  2426. return 1;
  2427. }
  2428. if (sym->pfunc != sym || sym->alias != sym)
  2429. return 0;
  2430. insn = find_insn(file, sec, sym->offset);
  2431. if (!insn || insn->ignore || insn->visited)
  2432. return 0;
  2433. state->uaccess = sym->uaccess_safe;
  2434. ret = validate_branch(file, insn->func, insn, *state);
  2435. if (ret && backtrace)
  2436. BT_FUNC("<=== (sym)", insn);
  2437. return ret;
  2438. }
  2439. static int validate_section(struct objtool_file *file, struct section *sec)
  2440. {
  2441. struct insn_state state;
  2442. struct symbol *func;
  2443. int warnings = 0;
  2444. list_for_each_entry(func, &sec->symbol_list, list) {
  2445. if (func->type != STT_FUNC)
  2446. continue;
  2447. init_insn_state(&state, sec);
  2448. state.cfi.cfa = initial_func_cfi.cfa;
  2449. memcpy(&state.cfi.regs, &initial_func_cfi.regs,
  2450. CFI_NUM_REGS * sizeof(struct cfi_reg));
  2451. state.cfi.stack_size = initial_func_cfi.cfa.offset;
  2452. warnings += validate_symbol(file, sec, func, &state);
  2453. }
  2454. return warnings;
  2455. }
  2456. static int validate_vmlinux_functions(struct objtool_file *file)
  2457. {
  2458. struct section *sec;
  2459. int warnings = 0;
  2460. sec = find_section_by_name(file->elf, ".noinstr.text");
  2461. if (sec) {
  2462. warnings += validate_section(file, sec);
  2463. warnings += validate_unwind_hints(file, sec);
  2464. }
  2465. sec = find_section_by_name(file->elf, ".entry.text");
  2466. if (sec) {
  2467. warnings += validate_section(file, sec);
  2468. warnings += validate_unwind_hints(file, sec);
  2469. }
  2470. return warnings;
  2471. }
  2472. static int validate_functions(struct objtool_file *file)
  2473. {
  2474. struct section *sec;
  2475. int warnings = 0;
  2476. for_each_sec(file, sec) {
  2477. if (!(sec->sh.sh_flags & SHF_EXECINSTR))
  2478. continue;
  2479. warnings += validate_section(file, sec);
  2480. }
  2481. return warnings;
  2482. }
  2483. static int validate_reachable_instructions(struct objtool_file *file)
  2484. {
  2485. struct instruction *insn;
  2486. if (file->ignore_unreachables)
  2487. return 0;
  2488. for_each_insn(file, insn) {
  2489. if (insn->visited || ignore_unreachable_insn(file, insn))
  2490. continue;
  2491. WARN_FUNC("unreachable instruction", insn->sec, insn->offset);
  2492. return 1;
  2493. }
  2494. return 0;
  2495. }
  2496. int check(struct objtool_file *file)
  2497. {
  2498. int ret, warnings = 0;
  2499. arch_initial_func_cfi_state(&initial_func_cfi);
  2500. ret = decode_sections(file);
  2501. if (ret < 0)
  2502. goto out;
  2503. warnings += ret;
  2504. if (list_empty(&file->insn_list))
  2505. goto out;
  2506. if (vmlinux && !validate_dup) {
  2507. ret = validate_vmlinux_functions(file);
  2508. if (ret < 0)
  2509. goto out;
  2510. warnings += ret;
  2511. goto out;
  2512. }
  2513. if (retpoline) {
  2514. ret = validate_retpoline(file);
  2515. if (ret < 0)
  2516. return ret;
  2517. warnings += ret;
  2518. }
  2519. ret = validate_functions(file);
  2520. if (ret < 0)
  2521. goto out;
  2522. warnings += ret;
  2523. ret = validate_unwind_hints(file, NULL);
  2524. if (ret < 0)
  2525. goto out;
  2526. warnings += ret;
  2527. if (!warnings) {
  2528. ret = validate_reachable_instructions(file);
  2529. if (ret < 0)
  2530. goto out;
  2531. warnings += ret;
  2532. }
  2533. ret = create_static_call_sections(file);
  2534. if (ret < 0)
  2535. goto out;
  2536. warnings += ret;
  2537. if (mcount) {
  2538. ret = create_mcount_loc_sections(file);
  2539. if (ret < 0)
  2540. goto out;
  2541. warnings += ret;
  2542. }
  2543. out:
  2544. /*
  2545. * For now, don't fail the kernel build on fatal warnings. These
  2546. * errors are still fairly common due to the growing matrix of
  2547. * supported toolchains and their recent pace of change.
  2548. */
  2549. return 0;
  2550. }