2 * Copyright (C) 2015 Josh Poimboeuf <jpoimboe@redhat.com>
4 * This program is free software; you can redistribute it and/or
5 * modify it under the terms of the GNU General Public License
6 * as published by the Free Software Foundation; either version 2
7 * of the License, or (at your option) any later version.
9 * This program is distributed in the hope that it will be useful,
10 * but WITHOUT ANY WARRANTY; without even the implied warranty of
11 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
12 * GNU General Public License for more details.
14 * You should have received a copy of the GNU General Public License
15 * along with this program; if not, see <http://www.gnu.org/licenses/>.
21 * This command analyzes every .o file and ensures the validity of its stack
22 * trace metadata. It enforces a set of rules on asm code and C inline
23 * assembly code so that stack traces can be reliable.
25 * For more information, see tools/objtool/Documentation/stack-validation.txt.
30 #include <subcmd/parse-options.h>
38 #include <linux/hashtable.h>
40 #define ARRAY_SIZE(x) (sizeof(x) / sizeof((x)[0]))
42 #define STATE_FP_SAVED 0x1
43 #define STATE_FP_SETUP 0x2
44 #define STATE_FENTRY 0x4
47 struct list_head list
;
48 struct hlist_node hash
;
51 unsigned int len
, state
;
53 unsigned long immediate
;
54 bool alt_group
, visited
;
55 struct symbol
*call_dest
;
56 struct instruction
*jump_dest
;
57 struct list_head alts
;
62 struct list_head list
;
63 struct instruction
*insn
;
68 struct list_head insn_list
;
69 DECLARE_HASHTABLE(insn_hash
, 16);
70 struct section
*rodata
, *whitelist
;
71 bool ignore_unreachables
, c_file
;
77 static struct instruction
*find_insn(struct objtool_file
*file
,
78 struct section
*sec
, unsigned long offset
)
80 struct instruction
*insn
;
82 hash_for_each_possible(file
->insn_hash
, insn
, hash
, offset
)
83 if (insn
->sec
== sec
&& insn
->offset
== offset
)
89 static struct instruction
*next_insn_same_sec(struct objtool_file
*file
,
90 struct instruction
*insn
)
92 struct instruction
*next
= list_next_entry(insn
, list
);
94 if (&next
->list
== &file
->insn_list
|| next
->sec
!= insn
->sec
)
100 #define for_each_insn(file, insn) \
101 list_for_each_entry(insn, &file->insn_list, list)
103 #define func_for_each_insn(file, func, insn) \
104 for (insn = find_insn(file, func->sec, func->offset); \
105 insn && &insn->list != &file->insn_list && \
106 insn->sec == func->sec && \
107 insn->offset < func->offset + func->len; \
108 insn = list_next_entry(insn, list))
110 #define func_for_each_insn_continue_reverse(file, func, insn) \
111 for (insn = list_prev_entry(insn, list); \
112 &insn->list != &file->insn_list && \
113 insn->sec == func->sec && insn->offset >= func->offset; \
114 insn = list_prev_entry(insn, list))
116 #define sec_for_each_insn_from(file, insn) \
117 for (; insn; insn = next_insn_same_sec(file, insn))
121 * Check if the function has been manually whitelisted with the
122 * STACK_FRAME_NON_STANDARD macro, or if it should be automatically whitelisted
123 * due to its use of a context switching instruction.
125 static bool ignore_func(struct objtool_file
*file
, struct symbol
*func
)
128 struct instruction
*insn
;
130 /* check for STACK_FRAME_NON_STANDARD */
131 if (file
->whitelist
&& file
->whitelist
->rela
)
132 list_for_each_entry(rela
, &file
->whitelist
->rela
->rela_list
, list
) {
133 if (rela
->sym
->type
== STT_SECTION
&&
134 rela
->sym
->sec
== func
->sec
&&
135 rela
->addend
== func
->offset
)
137 if (rela
->sym
->type
== STT_FUNC
&& rela
->sym
== func
)
141 /* check if it has a context switching instruction */
142 func_for_each_insn(file
, func
, insn
)
143 if (insn
->type
== INSN_CONTEXT_SWITCH
)
150 * This checks to see if the given function is a "noreturn" function.
152 * For global functions which are outside the scope of this object file, we
153 * have to keep a manual list of them.
155 * For local functions, we have to detect them manually by simply looking for
156 * the lack of a return instruction.
163 static int __dead_end_function(struct objtool_file
*file
, struct symbol
*func
,
167 struct instruction
*insn
;
171 * Unfortunately these have to be hard coded because the noreturn
172 * attribute isn't provided in ELF data.
174 static const char * const global_noreturns
[] = {
178 "__module_put_and_exit",
180 "kvm_spurious_fault",
185 if (func
->bind
== STB_WEAK
)
188 if (func
->bind
== STB_GLOBAL
)
189 for (i
= 0; i
< ARRAY_SIZE(global_noreturns
); i
++)
190 if (!strcmp(func
->name
, global_noreturns
[i
]))
196 func_for_each_insn(file
, func
, insn
) {
199 if (insn
->type
== INSN_RETURN
)
207 * A function can have a sibling call instead of a return. In that
208 * case, the function's dead-end status depends on whether the target
209 * of the sibling call returns.
211 func_for_each_insn(file
, func
, insn
) {
212 if (insn
->sec
!= func
->sec
||
213 insn
->offset
>= func
->offset
+ func
->len
)
216 if (insn
->type
== INSN_JUMP_UNCONDITIONAL
) {
217 struct instruction
*dest
= insn
->jump_dest
;
218 struct symbol
*dest_func
;
221 /* sibling call to another file */
224 if (dest
->sec
!= func
->sec
||
225 dest
->offset
< func
->offset
||
226 dest
->offset
>= func
->offset
+ func
->len
) {
227 /* local sibling call */
228 dest_func
= find_symbol_by_offset(dest
->sec
,
233 if (recursion
== 5) {
234 WARN_FUNC("infinite recursion (objtool bug!)",
235 dest
->sec
, dest
->offset
);
239 return __dead_end_function(file
, dest_func
,
244 if (insn
->type
== INSN_JUMP_DYNAMIC
&& list_empty(&insn
->alts
))
252 static int dead_end_function(struct objtool_file
*file
, struct symbol
*func
)
254 return __dead_end_function(file
, func
, 0);
258 * Call the arch-specific instruction decoder for all the instructions and add
259 * them to the global instruction list.
261 static int decode_instructions(struct objtool_file
*file
)
265 unsigned long offset
;
266 struct instruction
*insn
;
269 list_for_each_entry(sec
, &file
->elf
->sections
, list
) {
271 if (!(sec
->sh
.sh_flags
& SHF_EXECINSTR
))
274 for (offset
= 0; offset
< sec
->len
; offset
+= insn
->len
) {
275 insn
= malloc(sizeof(*insn
));
276 memset(insn
, 0, sizeof(*insn
));
278 INIT_LIST_HEAD(&insn
->alts
);
280 insn
->offset
= offset
;
282 ret
= arch_decode_instruction(file
->elf
, sec
, offset
,
284 &insn
->len
, &insn
->type
,
289 if (!insn
->type
|| insn
->type
> INSN_LAST
) {
290 WARN_FUNC("invalid instruction type %d",
291 insn
->sec
, insn
->offset
, insn
->type
);
295 hash_add(file
->insn_hash
, &insn
->hash
, insn
->offset
);
296 list_add_tail(&insn
->list
, &file
->insn_list
);
299 list_for_each_entry(func
, &sec
->symbol_list
, list
) {
300 if (func
->type
!= STT_FUNC
)
303 if (!find_insn(file
, sec
, func
->offset
)) {
304 WARN("%s(): can't find starting instruction",
309 func_for_each_insn(file
, func
, insn
)
319 * Warnings shouldn't be reported for ignored functions.
321 static void add_ignores(struct objtool_file
*file
)
323 struct instruction
*insn
;
327 list_for_each_entry(sec
, &file
->elf
->sections
, list
) {
328 list_for_each_entry(func
, &sec
->symbol_list
, list
) {
329 if (func
->type
!= STT_FUNC
)
332 if (!ignore_func(file
, func
))
335 func_for_each_insn(file
, func
, insn
)
336 insn
->visited
= true;
342 * Find the destination instructions for all jumps.
344 static int add_jump_destinations(struct objtool_file
*file
)
346 struct instruction
*insn
;
348 struct section
*dest_sec
;
349 unsigned long dest_off
;
351 for_each_insn(file
, insn
) {
352 if (insn
->type
!= INSN_JUMP_CONDITIONAL
&&
353 insn
->type
!= INSN_JUMP_UNCONDITIONAL
)
360 rela
= find_rela_by_dest_range(insn
->sec
, insn
->offset
,
363 dest_sec
= insn
->sec
;
364 dest_off
= insn
->offset
+ insn
->len
+ insn
->immediate
;
365 } else if (rela
->sym
->type
== STT_SECTION
) {
366 dest_sec
= rela
->sym
->sec
;
367 dest_off
= rela
->addend
+ 4;
368 } else if (rela
->sym
->sec
->idx
) {
369 dest_sec
= rela
->sym
->sec
;
370 dest_off
= rela
->sym
->sym
.st_value
+ rela
->addend
+ 4;
377 insn
->jump_dest
= find_insn(file
, dest_sec
, dest_off
);
378 if (!insn
->jump_dest
) {
381 * This is a special case where an alt instruction
382 * jumps past the end of the section. These are
383 * handled later in handle_group_alt().
385 if (!strcmp(insn
->sec
->name
, ".altinstr_replacement"))
388 WARN_FUNC("can't find jump dest instruction at %s+0x%lx",
389 insn
->sec
, insn
->offset
, dest_sec
->name
,
399 * Find the destination instructions for all calls.
401 static int add_call_destinations(struct objtool_file
*file
)
403 struct instruction
*insn
;
404 unsigned long dest_off
;
407 for_each_insn(file
, insn
) {
408 if (insn
->type
!= INSN_CALL
)
411 rela
= find_rela_by_dest_range(insn
->sec
, insn
->offset
,
414 dest_off
= insn
->offset
+ insn
->len
+ insn
->immediate
;
415 insn
->call_dest
= find_symbol_by_offset(insn
->sec
,
417 if (!insn
->call_dest
) {
418 WARN_FUNC("can't find call dest symbol at offset 0x%lx",
419 insn
->sec
, insn
->offset
, dest_off
);
422 } else if (rela
->sym
->type
== STT_SECTION
) {
423 insn
->call_dest
= find_symbol_by_offset(rela
->sym
->sec
,
425 if (!insn
->call_dest
||
426 insn
->call_dest
->type
!= STT_FUNC
) {
427 WARN_FUNC("can't find call dest symbol at %s+0x%x",
428 insn
->sec
, insn
->offset
,
429 rela
->sym
->sec
->name
,
434 insn
->call_dest
= rela
->sym
;
441 * The .alternatives section requires some extra special care, over and above
442 * what other special sections require:
444 * 1. Because alternatives are patched in-place, we need to insert a fake jump
445 * instruction at the end so that validate_branch() skips all the original
446 * replaced instructions when validating the new instruction path.
448 * 2. An added wrinkle is that the new instruction length might be zero. In
449 * that case the old instructions are replaced with noops. We simulate that
450 * by creating a fake jump as the only new instruction.
452 * 3. In some cases, the alternative section includes an instruction which
453 * conditionally jumps to the _end_ of the entry. We have to modify these
454 * jumps' destinations to point back to .text rather than the end of the
455 * entry in .altinstr_replacement.
457 * 4. It has been requested that we don't validate the !POPCNT feature path
458 * which is a "very very small percentage of machines".
460 static int handle_group_alt(struct objtool_file
*file
,
461 struct special_alt
*special_alt
,
462 struct instruction
*orig_insn
,
463 struct instruction
**new_insn
)
465 struct instruction
*last_orig_insn
, *last_new_insn
, *insn
, *fake_jump
;
466 unsigned long dest_off
;
468 last_orig_insn
= NULL
;
470 sec_for_each_insn_from(file
, insn
) {
471 if (insn
->offset
>= special_alt
->orig_off
+ special_alt
->orig_len
)
474 if (special_alt
->skip_orig
)
475 insn
->type
= INSN_NOP
;
477 insn
->alt_group
= true;
478 last_orig_insn
= insn
;
481 if (!next_insn_same_sec(file
, last_orig_insn
)) {
482 WARN("%s: don't know how to handle alternatives at end of section",
483 special_alt
->orig_sec
->name
);
487 fake_jump
= malloc(sizeof(*fake_jump
));
489 WARN("malloc failed");
492 memset(fake_jump
, 0, sizeof(*fake_jump
));
493 INIT_LIST_HEAD(&fake_jump
->alts
);
494 fake_jump
->sec
= special_alt
->new_sec
;
495 fake_jump
->offset
= -1;
496 fake_jump
->type
= INSN_JUMP_UNCONDITIONAL
;
497 fake_jump
->jump_dest
= list_next_entry(last_orig_insn
, list
);
499 if (!special_alt
->new_len
) {
500 *new_insn
= fake_jump
;
504 last_new_insn
= NULL
;
506 sec_for_each_insn_from(file
, insn
) {
507 if (insn
->offset
>= special_alt
->new_off
+ special_alt
->new_len
)
510 last_new_insn
= insn
;
512 if (insn
->type
!= INSN_JUMP_CONDITIONAL
&&
513 insn
->type
!= INSN_JUMP_UNCONDITIONAL
)
516 if (!insn
->immediate
)
519 dest_off
= insn
->offset
+ insn
->len
+ insn
->immediate
;
520 if (dest_off
== special_alt
->new_off
+ special_alt
->new_len
)
521 insn
->jump_dest
= fake_jump
;
523 if (!insn
->jump_dest
) {
524 WARN_FUNC("can't find alternative jump destination",
525 insn
->sec
, insn
->offset
);
530 if (!last_new_insn
) {
531 WARN_FUNC("can't find last new alternative instruction",
532 special_alt
->new_sec
, special_alt
->new_off
);
536 list_add(&fake_jump
->list
, &last_new_insn
->list
);
542 * A jump table entry can either convert a nop to a jump or a jump to a nop.
543 * If the original instruction is a jump, make the alt entry an effective nop
544 * by just skipping the original instruction.
546 static int handle_jump_alt(struct objtool_file
*file
,
547 struct special_alt
*special_alt
,
548 struct instruction
*orig_insn
,
549 struct instruction
**new_insn
)
551 if (orig_insn
->type
== INSN_NOP
)
554 if (orig_insn
->type
!= INSN_JUMP_UNCONDITIONAL
) {
555 WARN_FUNC("unsupported instruction at jump label",
556 orig_insn
->sec
, orig_insn
->offset
);
560 *new_insn
= list_next_entry(orig_insn
, list
);
565 * Read all the special sections which have alternate instructions which can be
566 * patched in or redirected to at runtime. Each instruction having alternate
567 * instruction(s) has them added to its insn->alts list, which will be
568 * traversed in validate_branch().
570 static int add_special_section_alts(struct objtool_file
*file
)
572 struct list_head special_alts
;
573 struct instruction
*orig_insn
, *new_insn
;
574 struct special_alt
*special_alt
, *tmp
;
575 struct alternative
*alt
;
578 ret
= special_get_alts(file
->elf
, &special_alts
);
582 list_for_each_entry_safe(special_alt
, tmp
, &special_alts
, list
) {
583 alt
= malloc(sizeof(*alt
));
585 WARN("malloc failed");
590 orig_insn
= find_insn(file
, special_alt
->orig_sec
,
591 special_alt
->orig_off
);
593 WARN_FUNC("special: can't find orig instruction",
594 special_alt
->orig_sec
, special_alt
->orig_off
);
600 if (!special_alt
->group
|| special_alt
->new_len
) {
601 new_insn
= find_insn(file
, special_alt
->new_sec
,
602 special_alt
->new_off
);
604 WARN_FUNC("special: can't find new instruction",
605 special_alt
->new_sec
,
606 special_alt
->new_off
);
612 if (special_alt
->group
) {
613 ret
= handle_group_alt(file
, special_alt
, orig_insn
,
617 } else if (special_alt
->jump_or_nop
) {
618 ret
= handle_jump_alt(file
, special_alt
, orig_insn
,
624 alt
->insn
= new_insn
;
625 list_add_tail(&alt
->list
, &orig_insn
->alts
);
627 list_del(&special_alt
->list
);
635 static int add_switch_table(struct objtool_file
*file
, struct symbol
*func
,
636 struct instruction
*insn
, struct rela
*table
,
637 struct rela
*next_table
)
639 struct rela
*rela
= table
;
640 struct instruction
*alt_insn
;
641 struct alternative
*alt
;
643 list_for_each_entry_from(rela
, &file
->rodata
->rela
->rela_list
, list
) {
644 if (rela
== next_table
)
647 if (rela
->sym
->sec
!= insn
->sec
||
648 rela
->addend
<= func
->offset
||
649 rela
->addend
>= func
->offset
+ func
->len
)
652 alt_insn
= find_insn(file
, insn
->sec
, rela
->addend
);
654 WARN("%s: can't find instruction at %s+0x%x",
655 file
->rodata
->rela
->name
, insn
->sec
->name
,
660 alt
= malloc(sizeof(*alt
));
662 WARN("malloc failed");
666 alt
->insn
= alt_insn
;
667 list_add_tail(&alt
->list
, &insn
->alts
);
674 * find_switch_table() - Given a dynamic jump, find the switch jump table in
675 * .rodata associated with it.
677 * There are 3 basic patterns:
679 * 1. jmpq *[rodata addr](,%reg,8)
681 * This is the most common case by far. It jumps to an address in a simple
682 * jump table which is stored in .rodata.
684 * 2. jmpq *[rodata addr](%rip)
686 * This is caused by a rare GCC quirk, currently only seen in three driver
687 * functions in the kernel, only with certain obscure non-distro configs.
689 * As part of an optimization, GCC makes a copy of an existing switch jump
690 * table, modifies it, and then hard-codes the jump (albeit with an indirect
691 * jump) to use a single entry in the table. The rest of the jump table and
692 * some of its jump targets remain as dead code.
694 * In such a case we can just crudely ignore all unreachable instruction
695 * warnings for the entire object file. Ideally we would just ignore them
696 * for the function, but that would require redesigning the code quite a
697 * bit. And honestly that's just not worth doing: unreachable instruction
698 * warnings are of questionable value anyway, and this is such a rare issue.
700 * 3. mov [rodata addr],%reg1
701 * ... some instructions ...
702 * jmpq *(%reg1,%reg2,8)
704 * This is a fairly uncommon pattern which is new for GCC 6. As of this
705 * writing, there are 11 occurrences of it in the allmodconfig kernel.
707 * TODO: Once we have DWARF CFI and smarter instruction decoding logic,
708 * ensure the same register is used in the mov and jump instructions.
710 static struct rela
*find_switch_table(struct objtool_file
*file
,
712 struct instruction
*insn
)
714 struct rela
*text_rela
, *rodata_rela
;
716 text_rela
= find_rela_by_dest_range(insn
->sec
, insn
->offset
, insn
->len
);
717 if (text_rela
&& text_rela
->sym
== file
->rodata
->sym
) {
719 rodata_rela
= find_rela_by_dest(file
->rodata
,
725 rodata_rela
= find_rela_by_dest(file
->rodata
,
726 text_rela
->addend
+ 4);
729 file
->ignore_unreachables
= true;
734 func_for_each_insn_continue_reverse(file
, func
, insn
) {
735 if (insn
->type
== INSN_JUMP_UNCONDITIONAL
||
736 insn
->type
== INSN_JUMP_DYNAMIC
)
739 text_rela
= find_rela_by_dest_range(insn
->sec
, insn
->offset
,
741 if (text_rela
&& text_rela
->sym
== file
->rodata
->sym
)
742 return find_rela_by_dest(file
->rodata
,
749 static int add_func_switch_tables(struct objtool_file
*file
,
752 struct instruction
*insn
, *prev_jump
= NULL
;
753 struct rela
*rela
, *prev_rela
= NULL
;
756 func_for_each_insn(file
, func
, insn
) {
757 if (insn
->type
!= INSN_JUMP_DYNAMIC
)
760 rela
= find_switch_table(file
, func
, insn
);
765 * We found a switch table, but we don't know yet how big it
766 * is. Don't add it until we reach the end of the function or
767 * the beginning of another switch table in the same function.
770 ret
= add_switch_table(file
, func
, prev_jump
, prev_rela
,
781 ret
= add_switch_table(file
, func
, prev_jump
, prev_rela
, NULL
);
790 * For some switch statements, gcc generates a jump table in the .rodata
791 * section which contains a list of addresses within the function to jump to.
792 * This finds these jump tables and adds them to the insn->alts lists.
794 static int add_switch_table_alts(struct objtool_file
*file
)
800 if (!file
->rodata
|| !file
->rodata
->rela
)
803 list_for_each_entry(sec
, &file
->elf
->sections
, list
) {
804 list_for_each_entry(func
, &sec
->symbol_list
, list
) {
805 if (func
->type
!= STT_FUNC
)
808 ret
= add_func_switch_tables(file
, func
);
817 static int decode_sections(struct objtool_file
*file
)
821 ret
= decode_instructions(file
);
827 ret
= add_jump_destinations(file
);
831 ret
= add_call_destinations(file
);
835 ret
= add_special_section_alts(file
);
839 ret
= add_switch_table_alts(file
);
846 static bool is_fentry_call(struct instruction
*insn
)
848 if (insn
->type
== INSN_CALL
&&
849 insn
->call_dest
->type
== STT_NOTYPE
&&
850 !strcmp(insn
->call_dest
->name
, "__fentry__"))
856 static bool has_modified_stack_frame(struct instruction
*insn
)
858 return (insn
->state
& STATE_FP_SAVED
) ||
859 (insn
->state
& STATE_FP_SETUP
);
862 static bool has_valid_stack_frame(struct instruction
*insn
)
864 return (insn
->state
& STATE_FP_SAVED
) &&
865 (insn
->state
& STATE_FP_SETUP
);
868 static unsigned int frame_state(unsigned long state
)
870 return (state
& (STATE_FP_SAVED
| STATE_FP_SETUP
));
874 * Follow the branch starting at the given instruction, and recursively follow
875 * any other branches (jumps). Meanwhile, track the frame pointer state at
876 * each instruction and validate all the rules described in
877 * tools/objtool/Documentation/stack-validation.txt.
879 static int validate_branch(struct objtool_file
*file
,
880 struct instruction
*first
, unsigned char first_state
)
882 struct alternative
*alt
;
883 struct instruction
*insn
;
885 struct symbol
*func
= NULL
;
893 if (insn
->alt_group
&& list_empty(&insn
->alts
)) {
894 WARN_FUNC("don't know how to handle branch to middle of alternative instruction group",
900 if (file
->c_file
&& insn
->func
) {
901 if (func
&& func
!= insn
->func
) {
902 WARN("%s() falls through to next function %s()",
903 func
->name
, insn
->func
->name
);
911 if (frame_state(insn
->state
) != frame_state(state
)) {
912 WARN_FUNC("frame pointer state mismatch",
920 insn
->visited
= true;
923 list_for_each_entry(alt
, &insn
->alts
, list
) {
924 ret
= validate_branch(file
, alt
->insn
, state
);
929 switch (insn
->type
) {
933 if (state
& STATE_FP_SAVED
) {
934 WARN_FUNC("duplicate frame pointer save",
938 state
|= STATE_FP_SAVED
;
944 if (state
& STATE_FP_SETUP
) {
945 WARN_FUNC("duplicate frame pointer setup",
949 state
|= STATE_FP_SETUP
;
953 case INSN_FP_RESTORE
:
955 if (has_valid_stack_frame(insn
))
956 state
&= ~STATE_FP_SETUP
;
958 state
&= ~STATE_FP_SAVED
;
963 if (!nofp
&& has_modified_stack_frame(insn
)) {
964 WARN_FUNC("return without frame pointer restore",
971 if (is_fentry_call(insn
)) {
972 state
|= STATE_FENTRY
;
976 ret
= dead_end_function(file
, insn
->call_dest
);
983 case INSN_CALL_DYNAMIC
:
984 if (!nofp
&& !has_valid_stack_frame(insn
)) {
985 WARN_FUNC("call without frame pointer save/setup",
991 case INSN_JUMP_CONDITIONAL
:
992 case INSN_JUMP_UNCONDITIONAL
:
993 if (insn
->jump_dest
) {
994 ret
= validate_branch(file
, insn
->jump_dest
,
998 } else if (has_modified_stack_frame(insn
)) {
999 WARN_FUNC("sibling call from callable instruction with changed frame pointer",
1002 } /* else it's a sibling call */
1004 if (insn
->type
== INSN_JUMP_UNCONDITIONAL
)
1009 case INSN_JUMP_DYNAMIC
:
1010 if (list_empty(&insn
->alts
) &&
1011 has_modified_stack_frame(insn
)) {
1012 WARN_FUNC("sibling call from callable instruction with changed frame pointer",
1026 insn
= next_insn_same_sec(file
, insn
);
1028 WARN("%s: unexpected end of section", sec
->name
);
1036 static bool is_gcov_insn(struct instruction
*insn
)
1039 struct section
*sec
;
1041 unsigned long offset
;
1043 rela
= find_rela_by_dest_range(insn
->sec
, insn
->offset
, insn
->len
);
1047 if (rela
->sym
->type
!= STT_SECTION
)
1050 sec
= rela
->sym
->sec
;
1051 offset
= rela
->addend
+ insn
->offset
+ insn
->len
- rela
->offset
;
1053 list_for_each_entry(sym
, &sec
->symbol_list
, list
) {
1054 if (sym
->type
!= STT_OBJECT
)
1057 if (offset
>= sym
->offset
&& offset
< sym
->offset
+ sym
->len
)
1058 return (!memcmp(sym
->name
, "__gcov0.", 8));
1064 static bool is_kasan_insn(struct instruction
*insn
)
1066 return (insn
->type
== INSN_CALL
&&
1067 !strcmp(insn
->call_dest
->name
, "__asan_handle_no_return"));
1070 static bool is_ubsan_insn(struct instruction
*insn
)
1072 return (insn
->type
== INSN_CALL
&&
1073 !strcmp(insn
->call_dest
->name
,
1074 "__ubsan_handle_builtin_unreachable"));
1077 static bool ignore_unreachable_insn(struct symbol
*func
,
1078 struct instruction
*insn
)
1082 if (insn
->type
== INSN_NOP
)
1085 if (is_gcov_insn(insn
))
1089 * Check if this (or a subsequent) instruction is related to
1090 * CONFIG_UBSAN or CONFIG_KASAN.
1092 * End the search at 5 instructions to avoid going into the weeds.
1094 for (i
= 0; i
< 5; i
++) {
1096 if (is_kasan_insn(insn
) || is_ubsan_insn(insn
))
1099 if (insn
->type
== INSN_JUMP_UNCONDITIONAL
&& insn
->jump_dest
) {
1100 insn
= insn
->jump_dest
;
1104 if (insn
->offset
+ insn
->len
>= func
->offset
+ func
->len
)
1106 insn
= list_next_entry(insn
, list
);
1112 static int validate_functions(struct objtool_file
*file
)
1114 struct section
*sec
;
1115 struct symbol
*func
;
1116 struct instruction
*insn
;
1117 int ret
, warnings
= 0;
1119 list_for_each_entry(sec
, &file
->elf
->sections
, list
) {
1120 list_for_each_entry(func
, &sec
->symbol_list
, list
) {
1121 if (func
->type
!= STT_FUNC
)
1124 insn
= find_insn(file
, sec
, func
->offset
);
1128 ret
= validate_branch(file
, insn
, 0);
1133 list_for_each_entry(sec
, &file
->elf
->sections
, list
) {
1134 list_for_each_entry(func
, &sec
->symbol_list
, list
) {
1135 if (func
->type
!= STT_FUNC
)
1138 func_for_each_insn(file
, func
, insn
) {
1142 insn
->visited
= true;
1144 if (file
->ignore_unreachables
|| warnings
||
1145 ignore_unreachable_insn(func
, insn
))
1148 WARN_FUNC("function has unreachable instruction", insn
->sec
, insn
->offset
);
1157 static int validate_uncallable_instructions(struct objtool_file
*file
)
1159 struct instruction
*insn
;
1162 for_each_insn(file
, insn
) {
1163 if (!insn
->visited
&& insn
->type
== INSN_RETURN
) {
1164 WARN_FUNC("return instruction outside of a callable function",
1165 insn
->sec
, insn
->offset
);
1173 static void cleanup(struct objtool_file
*file
)
1175 struct instruction
*insn
, *tmpinsn
;
1176 struct alternative
*alt
, *tmpalt
;
1178 list_for_each_entry_safe(insn
, tmpinsn
, &file
->insn_list
, list
) {
1179 list_for_each_entry_safe(alt
, tmpalt
, &insn
->alts
, list
) {
1180 list_del(&alt
->list
);
1183 list_del(&insn
->list
);
1184 hash_del(&insn
->hash
);
1187 elf_close(file
->elf
);
1190 const char * const check_usage
[] = {
1191 "objtool check [<options>] file.o",
1195 int cmd_check(int argc
, const char **argv
)
1197 struct objtool_file file
;
1198 int ret
, warnings
= 0;
1200 const struct option options
[] = {
1201 OPT_BOOLEAN('f', "no-fp", &nofp
, "Skip frame pointer validation"),
1205 argc
= parse_options(argc
, argv
, options
, check_usage
, 0);
1208 usage_with_options(check_usage
, options
);
1212 file
.elf
= elf_open(objname
);
1214 fprintf(stderr
, "error reading elf file %s\n", objname
);
1218 INIT_LIST_HEAD(&file
.insn_list
);
1219 hash_init(file
.insn_hash
);
1220 file
.whitelist
= find_section_by_name(file
.elf
, "__func_stack_frame_non_standard");
1221 file
.rodata
= find_section_by_name(file
.elf
, ".rodata");
1222 file
.ignore_unreachables
= false;
1223 file
.c_file
= find_section_by_name(file
.elf
, ".comment");
1225 ret
= decode_sections(&file
);
1230 ret
= validate_functions(&file
);
1235 ret
= validate_uncallable_instructions(&file
);
1243 /* ignore warnings for now until we get all the code cleaned up */
1244 if (ret
|| warnings
)
This page took 0.062495 seconds and 6 git commands to generate.