Teach objtool a little more about IRET so that we can avoid using the SAVE/RESTORE annotation. In particular, make the weird corner case in insn->restore go away. The purpose of that corner case is to deal with the fact that UNWIND_HINT_RESTORE lands on the instruction after IRET, but that instruction can end up being outside the basic block, consider: if (cond) sync_core() foo(); Then the hint will land on foo(), and we'll encounter the restore hint without ever having seen the save hint. By teaching objtool about the arch specific exception frame size, and assuming that any IRET in an STT_FUNC symbol is an exception frame sized POP, we can remove the use of save/restore hints for this code. Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> Reviewed-by: Miroslav Benes <mbenes@suse.cz> Reviewed-by: Alexandre Chartre <alexandre.chartre@oracle.com> Acked-by: Josh Poimboeuf <jpoimboe@redhat.com> Link: https://lkml.kernel.org/r/20200416115118.631224674@infradead.org Signed-off-by: Ingo Molnar <mingo@kernel.org>
532 lines
10 KiB
C
532 lines
10 KiB
C
// SPDX-License-Identifier: GPL-2.0-or-later
|
|
/*
|
|
* Copyright (C) 2015 Josh Poimboeuf <jpoimboe@redhat.com>
|
|
*/
|
|
|
|
#include <stdio.h>
|
|
#include <stdlib.h>
|
|
|
|
#define unlikely(cond) (cond)
|
|
#include <asm/insn.h>
|
|
#include "../../../arch/x86/lib/inat.c"
|
|
#include "../../../arch/x86/lib/insn.c"
|
|
|
|
#include "../../check.h"
|
|
#include "../../elf.h"
|
|
#include "../../arch.h"
|
|
#include "../../warn.h"
|
|
|
|
static unsigned char op_to_cfi_reg[][2] = {
|
|
{CFI_AX, CFI_R8},
|
|
{CFI_CX, CFI_R9},
|
|
{CFI_DX, CFI_R10},
|
|
{CFI_BX, CFI_R11},
|
|
{CFI_SP, CFI_R12},
|
|
{CFI_BP, CFI_R13},
|
|
{CFI_SI, CFI_R14},
|
|
{CFI_DI, CFI_R15},
|
|
};
|
|
|
|
static int is_x86_64(struct elf *elf)
|
|
{
|
|
switch (elf->ehdr.e_machine) {
|
|
case EM_X86_64:
|
|
return 1;
|
|
case EM_386:
|
|
return 0;
|
|
default:
|
|
WARN("unexpected ELF machine type %d", elf->ehdr.e_machine);
|
|
return -1;
|
|
}
|
|
}
|
|
|
|
bool arch_callee_saved_reg(unsigned char reg)
|
|
{
|
|
switch (reg) {
|
|
case CFI_BP:
|
|
case CFI_BX:
|
|
case CFI_R12:
|
|
case CFI_R13:
|
|
case CFI_R14:
|
|
case CFI_R15:
|
|
return true;
|
|
|
|
case CFI_AX:
|
|
case CFI_CX:
|
|
case CFI_DX:
|
|
case CFI_SI:
|
|
case CFI_DI:
|
|
case CFI_SP:
|
|
case CFI_R8:
|
|
case CFI_R9:
|
|
case CFI_R10:
|
|
case CFI_R11:
|
|
case CFI_RA:
|
|
default:
|
|
return false;
|
|
}
|
|
}
|
|
|
|
unsigned long arch_dest_rela_offset(int addend)
|
|
{
|
|
return addend + 4;
|
|
}
|
|
|
|
unsigned long arch_jump_destination(struct instruction *insn)
|
|
{
|
|
return insn->offset + insn->len + insn->immediate;
|
|
}
|
|
|
|
int arch_decode_instruction(struct elf *elf, struct section *sec,
|
|
unsigned long offset, unsigned int maxlen,
|
|
unsigned int *len, enum insn_type *type,
|
|
unsigned long *immediate,
|
|
struct list_head *ops_list)
|
|
{
|
|
struct insn insn;
|
|
int x86_64, sign;
|
|
unsigned char op1, op2, rex = 0, rex_b = 0, rex_r = 0, rex_w = 0,
|
|
rex_x = 0, modrm = 0, modrm_mod = 0, modrm_rm = 0,
|
|
modrm_reg = 0, sib = 0;
|
|
struct stack_op *op;
|
|
|
|
x86_64 = is_x86_64(elf);
|
|
if (x86_64 == -1)
|
|
return -1;
|
|
|
|
insn_init(&insn, sec->data->d_buf + offset, maxlen, x86_64);
|
|
insn_get_length(&insn);
|
|
|
|
if (!insn_complete(&insn)) {
|
|
WARN_FUNC("can't decode instruction", sec, offset);
|
|
return -1;
|
|
}
|
|
|
|
*len = insn.length;
|
|
*type = INSN_OTHER;
|
|
|
|
if (insn.vex_prefix.nbytes)
|
|
return 0;
|
|
|
|
op1 = insn.opcode.bytes[0];
|
|
op2 = insn.opcode.bytes[1];
|
|
|
|
if (insn.rex_prefix.nbytes) {
|
|
rex = insn.rex_prefix.bytes[0];
|
|
rex_w = X86_REX_W(rex) >> 3;
|
|
rex_r = X86_REX_R(rex) >> 2;
|
|
rex_x = X86_REX_X(rex) >> 1;
|
|
rex_b = X86_REX_B(rex);
|
|
}
|
|
|
|
if (insn.modrm.nbytes) {
|
|
modrm = insn.modrm.bytes[0];
|
|
modrm_mod = X86_MODRM_MOD(modrm);
|
|
modrm_reg = X86_MODRM_REG(modrm);
|
|
modrm_rm = X86_MODRM_RM(modrm);
|
|
}
|
|
|
|
if (insn.sib.nbytes)
|
|
sib = insn.sib.bytes[0];
|
|
|
|
op = calloc(1, sizeof(*op));
|
|
if (!op)
|
|
return -1;
|
|
|
|
switch (op1) {
|
|
|
|
case 0x1:
|
|
case 0x29:
|
|
if (rex_w && !rex_b && modrm_mod == 3 && modrm_rm == 4) {
|
|
|
|
/* add/sub reg, %rsp */
|
|
*type = INSN_STACK;
|
|
op->src.type = OP_SRC_ADD;
|
|
op->src.reg = op_to_cfi_reg[modrm_reg][rex_r];
|
|
op->dest.type = OP_DEST_REG;
|
|
op->dest.reg = CFI_SP;
|
|
}
|
|
break;
|
|
|
|
case 0x50 ... 0x57:
|
|
|
|
/* push reg */
|
|
*type = INSN_STACK;
|
|
op->src.type = OP_SRC_REG;
|
|
op->src.reg = op_to_cfi_reg[op1 & 0x7][rex_b];
|
|
op->dest.type = OP_DEST_PUSH;
|
|
|
|
break;
|
|
|
|
case 0x58 ... 0x5f:
|
|
|
|
/* pop reg */
|
|
*type = INSN_STACK;
|
|
op->src.type = OP_SRC_POP;
|
|
op->dest.type = OP_DEST_REG;
|
|
op->dest.reg = op_to_cfi_reg[op1 & 0x7][rex_b];
|
|
|
|
break;
|
|
|
|
case 0x68:
|
|
case 0x6a:
|
|
/* push immediate */
|
|
*type = INSN_STACK;
|
|
op->src.type = OP_SRC_CONST;
|
|
op->dest.type = OP_DEST_PUSH;
|
|
break;
|
|
|
|
case 0x70 ... 0x7f:
|
|
*type = INSN_JUMP_CONDITIONAL;
|
|
break;
|
|
|
|
case 0x81:
|
|
case 0x83:
|
|
if (rex != 0x48)
|
|
break;
|
|
|
|
if (modrm == 0xe4) {
|
|
/* and imm, %rsp */
|
|
*type = INSN_STACK;
|
|
op->src.type = OP_SRC_AND;
|
|
op->src.reg = CFI_SP;
|
|
op->src.offset = insn.immediate.value;
|
|
op->dest.type = OP_DEST_REG;
|
|
op->dest.reg = CFI_SP;
|
|
break;
|
|
}
|
|
|
|
if (modrm == 0xc4)
|
|
sign = 1;
|
|
else if (modrm == 0xec)
|
|
sign = -1;
|
|
else
|
|
break;
|
|
|
|
/* add/sub imm, %rsp */
|
|
*type = INSN_STACK;
|
|
op->src.type = OP_SRC_ADD;
|
|
op->src.reg = CFI_SP;
|
|
op->src.offset = insn.immediate.value * sign;
|
|
op->dest.type = OP_DEST_REG;
|
|
op->dest.reg = CFI_SP;
|
|
break;
|
|
|
|
case 0x89:
|
|
if (rex_w && !rex_r && modrm_mod == 3 && modrm_reg == 4) {
|
|
|
|
/* mov %rsp, reg */
|
|
*type = INSN_STACK;
|
|
op->src.type = OP_SRC_REG;
|
|
op->src.reg = CFI_SP;
|
|
op->dest.type = OP_DEST_REG;
|
|
op->dest.reg = op_to_cfi_reg[modrm_rm][rex_b];
|
|
break;
|
|
}
|
|
|
|
if (rex_w && !rex_b && modrm_mod == 3 && modrm_rm == 4) {
|
|
|
|
/* mov reg, %rsp */
|
|
*type = INSN_STACK;
|
|
op->src.type = OP_SRC_REG;
|
|
op->src.reg = op_to_cfi_reg[modrm_reg][rex_r];
|
|
op->dest.type = OP_DEST_REG;
|
|
op->dest.reg = CFI_SP;
|
|
break;
|
|
}
|
|
|
|
/* fallthrough */
|
|
case 0x88:
|
|
if (!rex_b &&
|
|
(modrm_mod == 1 || modrm_mod == 2) && modrm_rm == 5) {
|
|
|
|
/* mov reg, disp(%rbp) */
|
|
*type = INSN_STACK;
|
|
op->src.type = OP_SRC_REG;
|
|
op->src.reg = op_to_cfi_reg[modrm_reg][rex_r];
|
|
op->dest.type = OP_DEST_REG_INDIRECT;
|
|
op->dest.reg = CFI_BP;
|
|
op->dest.offset = insn.displacement.value;
|
|
|
|
} else if (rex_w && !rex_b && modrm_rm == 4 && sib == 0x24) {
|
|
|
|
/* mov reg, disp(%rsp) */
|
|
*type = INSN_STACK;
|
|
op->src.type = OP_SRC_REG;
|
|
op->src.reg = op_to_cfi_reg[modrm_reg][rex_r];
|
|
op->dest.type = OP_DEST_REG_INDIRECT;
|
|
op->dest.reg = CFI_SP;
|
|
op->dest.offset = insn.displacement.value;
|
|
}
|
|
|
|
break;
|
|
|
|
case 0x8b:
|
|
if (rex_w && !rex_b && modrm_mod == 1 && modrm_rm == 5) {
|
|
|
|
/* mov disp(%rbp), reg */
|
|
*type = INSN_STACK;
|
|
op->src.type = OP_SRC_REG_INDIRECT;
|
|
op->src.reg = CFI_BP;
|
|
op->src.offset = insn.displacement.value;
|
|
op->dest.type = OP_DEST_REG;
|
|
op->dest.reg = op_to_cfi_reg[modrm_reg][rex_r];
|
|
|
|
} else if (rex_w && !rex_b && sib == 0x24 &&
|
|
modrm_mod != 3 && modrm_rm == 4) {
|
|
|
|
/* mov disp(%rsp), reg */
|
|
*type = INSN_STACK;
|
|
op->src.type = OP_SRC_REG_INDIRECT;
|
|
op->src.reg = CFI_SP;
|
|
op->src.offset = insn.displacement.value;
|
|
op->dest.type = OP_DEST_REG;
|
|
op->dest.reg = op_to_cfi_reg[modrm_reg][rex_r];
|
|
}
|
|
|
|
break;
|
|
|
|
case 0x8d:
|
|
if (sib == 0x24 && rex_w && !rex_b && !rex_x) {
|
|
|
|
*type = INSN_STACK;
|
|
if (!insn.displacement.value) {
|
|
/* lea (%rsp), reg */
|
|
op->src.type = OP_SRC_REG;
|
|
} else {
|
|
/* lea disp(%rsp), reg */
|
|
op->src.type = OP_SRC_ADD;
|
|
op->src.offset = insn.displacement.value;
|
|
}
|
|
op->src.reg = CFI_SP;
|
|
op->dest.type = OP_DEST_REG;
|
|
op->dest.reg = op_to_cfi_reg[modrm_reg][rex_r];
|
|
|
|
} else if (rex == 0x48 && modrm == 0x65) {
|
|
|
|
/* lea disp(%rbp), %rsp */
|
|
*type = INSN_STACK;
|
|
op->src.type = OP_SRC_ADD;
|
|
op->src.reg = CFI_BP;
|
|
op->src.offset = insn.displacement.value;
|
|
op->dest.type = OP_DEST_REG;
|
|
op->dest.reg = CFI_SP;
|
|
|
|
} else if (rex == 0x49 && modrm == 0x62 &&
|
|
insn.displacement.value == -8) {
|
|
|
|
/*
|
|
* lea -0x8(%r10), %rsp
|
|
*
|
|
* Restoring rsp back to its original value after a
|
|
* stack realignment.
|
|
*/
|
|
*type = INSN_STACK;
|
|
op->src.type = OP_SRC_ADD;
|
|
op->src.reg = CFI_R10;
|
|
op->src.offset = -8;
|
|
op->dest.type = OP_DEST_REG;
|
|
op->dest.reg = CFI_SP;
|
|
|
|
} else if (rex == 0x49 && modrm == 0x65 &&
|
|
insn.displacement.value == -16) {
|
|
|
|
/*
|
|
* lea -0x10(%r13), %rsp
|
|
*
|
|
* Restoring rsp back to its original value after a
|
|
* stack realignment.
|
|
*/
|
|
*type = INSN_STACK;
|
|
op->src.type = OP_SRC_ADD;
|
|
op->src.reg = CFI_R13;
|
|
op->src.offset = -16;
|
|
op->dest.type = OP_DEST_REG;
|
|
op->dest.reg = CFI_SP;
|
|
}
|
|
|
|
break;
|
|
|
|
case 0x8f:
|
|
/* pop to mem */
|
|
*type = INSN_STACK;
|
|
op->src.type = OP_SRC_POP;
|
|
op->dest.type = OP_DEST_MEM;
|
|
break;
|
|
|
|
case 0x90:
|
|
*type = INSN_NOP;
|
|
break;
|
|
|
|
case 0x9c:
|
|
/* pushf */
|
|
*type = INSN_STACK;
|
|
op->src.type = OP_SRC_CONST;
|
|
op->dest.type = OP_DEST_PUSHF;
|
|
break;
|
|
|
|
case 0x9d:
|
|
/* popf */
|
|
*type = INSN_STACK;
|
|
op->src.type = OP_SRC_POPF;
|
|
op->dest.type = OP_DEST_MEM;
|
|
break;
|
|
|
|
case 0x0f:
|
|
|
|
if (op2 == 0x01) {
|
|
|
|
if (modrm == 0xca)
|
|
*type = INSN_CLAC;
|
|
else if (modrm == 0xcb)
|
|
*type = INSN_STAC;
|
|
|
|
} else if (op2 >= 0x80 && op2 <= 0x8f) {
|
|
|
|
*type = INSN_JUMP_CONDITIONAL;
|
|
|
|
} else if (op2 == 0x05 || op2 == 0x07 || op2 == 0x34 ||
|
|
op2 == 0x35) {
|
|
|
|
/* sysenter, sysret */
|
|
*type = INSN_CONTEXT_SWITCH;
|
|
|
|
} else if (op2 == 0x0b || op2 == 0xb9) {
|
|
|
|
/* ud2 */
|
|
*type = INSN_BUG;
|
|
|
|
} else if (op2 == 0x0d || op2 == 0x1f) {
|
|
|
|
/* nopl/nopw */
|
|
*type = INSN_NOP;
|
|
|
|
} else if (op2 == 0xa0 || op2 == 0xa8) {
|
|
|
|
/* push fs/gs */
|
|
*type = INSN_STACK;
|
|
op->src.type = OP_SRC_CONST;
|
|
op->dest.type = OP_DEST_PUSH;
|
|
|
|
} else if (op2 == 0xa1 || op2 == 0xa9) {
|
|
|
|
/* pop fs/gs */
|
|
*type = INSN_STACK;
|
|
op->src.type = OP_SRC_POP;
|
|
op->dest.type = OP_DEST_MEM;
|
|
}
|
|
|
|
break;
|
|
|
|
case 0xc9:
|
|
/*
|
|
* leave
|
|
*
|
|
* equivalent to:
|
|
* mov bp, sp
|
|
* pop bp
|
|
*/
|
|
*type = INSN_STACK;
|
|
op->dest.type = OP_DEST_LEAVE;
|
|
|
|
break;
|
|
|
|
case 0xe3:
|
|
/* jecxz/jrcxz */
|
|
*type = INSN_JUMP_CONDITIONAL;
|
|
break;
|
|
|
|
case 0xe9:
|
|
case 0xeb:
|
|
*type = INSN_JUMP_UNCONDITIONAL;
|
|
break;
|
|
|
|
case 0xc2:
|
|
case 0xc3:
|
|
*type = INSN_RETURN;
|
|
break;
|
|
|
|
case 0xcf: /* iret */
|
|
*type = INSN_EXCEPTION_RETURN;
|
|
|
|
/* add $40, %rsp */
|
|
op->src.type = OP_SRC_ADD;
|
|
op->src.reg = CFI_SP;
|
|
op->src.offset = 5*8;
|
|
op->dest.type = OP_DEST_REG;
|
|
op->dest.reg = CFI_SP;
|
|
break;
|
|
|
|
case 0xca: /* retf */
|
|
case 0xcb: /* retf */
|
|
*type = INSN_CONTEXT_SWITCH;
|
|
break;
|
|
|
|
case 0xe8:
|
|
*type = INSN_CALL;
|
|
break;
|
|
|
|
case 0xfc:
|
|
*type = INSN_CLD;
|
|
break;
|
|
|
|
case 0xfd:
|
|
*type = INSN_STD;
|
|
break;
|
|
|
|
case 0xff:
|
|
if (modrm_reg == 2 || modrm_reg == 3)
|
|
|
|
*type = INSN_CALL_DYNAMIC;
|
|
|
|
else if (modrm_reg == 4)
|
|
|
|
*type = INSN_JUMP_DYNAMIC;
|
|
|
|
else if (modrm_reg == 5)
|
|
|
|
/* jmpf */
|
|
*type = INSN_CONTEXT_SWITCH;
|
|
|
|
else if (modrm_reg == 6) {
|
|
|
|
/* push from mem */
|
|
*type = INSN_STACK;
|
|
op->src.type = OP_SRC_CONST;
|
|
op->dest.type = OP_DEST_PUSH;
|
|
}
|
|
|
|
break;
|
|
|
|
default:
|
|
break;
|
|
}
|
|
|
|
*immediate = insn.immediate.nbytes ? insn.immediate.value : 0;
|
|
|
|
if (*type == INSN_STACK || *type == INSN_EXCEPTION_RETURN)
|
|
list_add_tail(&op->list, ops_list);
|
|
else
|
|
free(op);
|
|
|
|
return 0;
|
|
}
|
|
|
|
void arch_initial_func_cfi_state(struct cfi_state *state)
|
|
{
|
|
int i;
|
|
|
|
for (i = 0; i < CFI_NUM_REGS; i++) {
|
|
state->regs[i].base = CFI_UNDEFINED;
|
|
state->regs[i].offset = 0;
|
|
}
|
|
|
|
/* initial CFA (call frame address) */
|
|
state->cfa.base = CFI_SP;
|
|
state->cfa.offset = 8;
|
|
|
|
/* initial RA (return address) */
|
|
state->regs[16].base = CFI_CFA;
|
|
state->regs[16].offset = -8;
|
|
}
|