Hi,
The following patches are the result of limitation found on the CFA
management code when trying to validate arm64 frames. I tried to keep
things simple and not contradict current CFA management logic nor
introduce too many corner cases.
The patches apply on top of the cleanup series[1] I sent previously.
[1] https://lkml.org/lkml/2020/9/15/199
Thanks,
Julien
-->
Julien Thierry (3):
objtool: check: Fully validate the stack frame
objtool: check: Support addition to set CFA base
objtool: check: Make SP memory operation match PUSH/POP semantics
tools/objtool/arch/x86/include/cfi_regs.h | 4 ++
tools/objtool/check.c | 47 +++++++++++++++++++++--
2 files changed, 47 insertions(+), 4 deletions(-)
--
2.21.3
A valid stack frame should contain both the return address and the
previous frame pointer value.
On x86, the return value is placed on the stack by the calling
instructions. On other architectures, the callee need to explicitly
save the return value on the stack.
Add the necessary checks to verify a function properly sets up the all
the elements of the stack frame.
Signed-off-by: Julien Thierry <[email protected]>
---
tools/objtool/arch/x86/include/cfi_regs.h | 4 ++++
tools/objtool/check.c | 17 +++++++++++++----
2 files changed, 17 insertions(+), 4 deletions(-)
diff --git a/tools/objtool/arch/x86/include/cfi_regs.h b/tools/objtool/arch/x86/include/cfi_regs.h
index 79bc517efba8..19b75b8b8439 100644
--- a/tools/objtool/arch/x86/include/cfi_regs.h
+++ b/tools/objtool/arch/x86/include/cfi_regs.h
@@ -22,4 +22,8 @@
#define CFI_RA 16
#define CFI_NUM_REGS 17
+#define CFA_SIZE 16
+#define CFA_BP_OFFSET -16
+#define CFA_RA_OFFSET -8
+
#endif /* _OBJTOOL_CFI_REGS_H */
diff --git a/tools/objtool/check.c b/tools/objtool/check.c
index 500f63b3dcff..7db6761d28c2 100644
--- a/tools/objtool/check.c
+++ b/tools/objtool/check.c
@@ -1669,12 +1669,20 @@ static bool has_modified_stack_frame(struct instruction *insn, struct insn_state
return false;
}
+static bool check_reg_frame_pos(const struct cfi_reg *reg, int cfa_start,
+ int expected_offset)
+{
+ return reg->base == CFI_CFA &&
+ reg->offset == cfa_start + expected_offset;
+}
+
static bool has_valid_stack_frame(struct insn_state *state)
{
struct cfi_state *cfi = &state->cfi;
- if (cfi->cfa.base == CFI_BP && cfi->regs[CFI_BP].base == CFI_CFA &&
- cfi->regs[CFI_BP].offset == -16)
+ if (cfi->cfa.base == CFI_BP && cfi->cfa.offset >= CFA_SIZE &&
+ check_reg_frame_pos(&cfi->regs[CFI_BP], -cfi->cfa.offset + CFA_SIZE, CFA_BP_OFFSET) &&
+ check_reg_frame_pos(&cfi->regs[CFI_RA], -cfi->cfa.offset + CFA_SIZE, CFA_RA_OFFSET))
return true;
if (cfi->drap && cfi->regs[CFI_BP].base == CFI_BP)
@@ -1803,8 +1811,9 @@ static int update_cfi_state(struct instruction *insn, struct cfi_state *cfi,
case OP_SRC_REG:
if (op->src.reg == CFI_SP && op->dest.reg == CFI_BP &&
cfa->base == CFI_SP &&
- regs[CFI_BP].base == CFI_CFA &&
- regs[CFI_BP].offset == -cfa->offset) {
+ check_reg_frame_pos(®s[CFI_BP],
+ -cfa->offset + CFA_SIZE,
+ CFA_BP_OFFSET)) {
/* mov %rsp, %rbp */
cfa->base = op->dest.reg;
--
2.21.3
Instead of "mov SP, BP", a compiler could simply set BP
to SP + constant. Handle changing the CFA base in such cases.
Signed-off-by: Julien Thierry <[email protected]>
---
tools/objtool/check.c | 13 +++++++++++++
1 file changed, 13 insertions(+)
diff --git a/tools/objtool/check.c b/tools/objtool/check.c
index 7db6761d28c2..f45991c2db41 100644
--- a/tools/objtool/check.c
+++ b/tools/objtool/check.c
@@ -1898,6 +1898,19 @@ static int update_cfi_state(struct instruction *insn, struct cfi_state *cfi,
break;
}
+ if (!cfi->drap && op->src.reg == CFI_SP &&
+ op->dest.reg == CFI_BP && cfa->base == CFI_SP &&
+ check_reg_frame_pos(®s[CFI_BP],
+ -cfa->offset + op->src.offset + CFA_SIZE,
+ CFA_BP_OFFSET)) {
+
+ /* lea disp(%rsp), %rbp */
+ cfa->base = CFI_BP;
+ cfa->offset -= op->src.offset;
+ cfi->bp_scratch = false;
+ break;
+ }
+
if (op->src.reg == CFI_SP && cfa->base == CFI_SP) {
/* drap: lea disp(%rsp), %drap */
--
2.21.3
On Tue, Sep 15, 2020 at 09:12:02AM +0100, Julien Thierry wrote:
> A valid stack frame should contain both the return address and the
> previous frame pointer value.
>
> On x86, the return value is placed on the stack by the calling
> instructions. On other architectures, the callee need to explicitly
> save the return value on the stack.
s/return value/return address/g
>
> Add the necessary checks to verify a function properly sets up the all
s/the all/all the/
> the elements of the stack frame.
>
> Signed-off-by: Julien Thierry <[email protected]>
> ---
> tools/objtool/arch/x86/include/cfi_regs.h | 4 ++++
> tools/objtool/check.c | 17 +++++++++++++----
> 2 files changed, 17 insertions(+), 4 deletions(-)
>
> diff --git a/tools/objtool/arch/x86/include/cfi_regs.h b/tools/objtool/arch/x86/include/cfi_regs.h
> index 79bc517efba8..19b75b8b8439 100644
> --- a/tools/objtool/arch/x86/include/cfi_regs.h
> +++ b/tools/objtool/arch/x86/include/cfi_regs.h
> @@ -22,4 +22,8 @@
> #define CFI_RA 16
> #define CFI_NUM_REGS 17
>
> +#define CFA_SIZE 16
If I remember correctly, CFA (stolen from DWARF) is "Caller Frame
Address". It's the stack address of the caller, before the call.
I get the feeling CFA_SIZE is the wrong name, because CFA is an address,
and its size isn't 16 bytes. But I'm not quite sure what this is
supposed to represent. Is it supposed to be the size of the frame
pointer + return address? Isn't that always going to be 16 bytes for
both arches?
> +#define CFA_BP_OFFSET -16
> +#define CFA_RA_OFFSET -8
> +
> #endif /* _OBJTOOL_CFI_REGS_H */
> diff --git a/tools/objtool/check.c b/tools/objtool/check.c
> index 500f63b3dcff..7db6761d28c2 100644
> --- a/tools/objtool/check.c
> +++ b/tools/objtool/check.c
> @@ -1669,12 +1669,20 @@ static bool has_modified_stack_frame(struct instruction *insn, struct insn_state
> return false;
> }
>
> +static bool check_reg_frame_pos(const struct cfi_reg *reg, int cfa_start,
> + int expected_offset)
> +{
> + return reg->base == CFI_CFA &&
> + reg->offset == cfa_start + expected_offset;
> +}
> +
> static bool has_valid_stack_frame(struct insn_state *state)
> {
> struct cfi_state *cfi = &state->cfi;
>
> - if (cfi->cfa.base == CFI_BP && cfi->regs[CFI_BP].base == CFI_CFA &&
> - cfi->regs[CFI_BP].offset == -16)
> + if (cfi->cfa.base == CFI_BP && cfi->cfa.offset >= CFA_SIZE &&
Why '>=' rather than '=='?
> + check_reg_frame_pos(&cfi->regs[CFI_BP], -cfi->cfa.offset + CFA_SIZE, CFA_BP_OFFSET) &&
> + check_reg_frame_pos(&cfi->regs[CFI_RA], -cfi->cfa.offset + CFA_SIZE, CFA_RA_OFFSET))
Isn't '-cfi->cfa.offset + CFA_SIZE' always going to be zero?
--
Josh
On Tue, Sep 15, 2020 at 09:12:03AM +0100, Julien Thierry wrote:
> Instead of "mov SP, BP", a compiler could simply set BP
> to SP + constant. Handle changing the CFA base in such cases.
Rather than what a compiler _could_ do, it would be good to be specific
about when this can happen (presumably arm64).
--
Josh
On 9/18/20 9:56 PM, Josh Poimboeuf wrote:
> On Tue, Sep 15, 2020 at 09:12:02AM +0100, Julien Thierry wrote:
>> A valid stack frame should contain both the return address and the
>> previous frame pointer value.
>>
>> On x86, the return value is placed on the stack by the calling
>> instructions. On other architectures, the callee need to explicitly
>> save the return value on the stack.
>
> s/return value/return address/g
>
>>
>> Add the necessary checks to verify a function properly sets up the all
>
> s/the all/all the/
>
>> the elements of the stack frame.
>>
>> Signed-off-by: Julien Thierry <[email protected]>
>> ---
>> tools/objtool/arch/x86/include/cfi_regs.h | 4 ++++
>> tools/objtool/check.c | 17 +++++++++++++----
>> 2 files changed, 17 insertions(+), 4 deletions(-)
>>
>> diff --git a/tools/objtool/arch/x86/include/cfi_regs.h b/tools/objtool/arch/x86/include/cfi_regs.h
>> index 79bc517efba8..19b75b8b8439 100644
>> --- a/tools/objtool/arch/x86/include/cfi_regs.h
>> +++ b/tools/objtool/arch/x86/include/cfi_regs.h
>> @@ -22,4 +22,8 @@
>> #define CFI_RA 16
>> #define CFI_NUM_REGS 17
>>
>> +#define CFA_SIZE 16
>
> If I remember correctly, CFA (stolen from DWARF) is "Caller Frame
> Address". It's the stack address of the caller, before the call.
>
Ok, so maybe I'm mixing Call Frame and Stack Frame (frame pointer +
return address).
> I get the feeling CFA_SIZE is the wrong name, because CFA is an address,
> and its size isn't 16 bytes. But I'm not quite sure what this is
> supposed to represent. Is it supposed to be the size of the frame
> pointer + return address? Isn't that always going to be 16 bytes for
> both arches?
>
For arm64 and x86_64 it is. Maybe it is a bit early to consider it might
differ for other arches (e.g. 32bit arches?).
>> +#define CFA_BP_OFFSET -16
>> +#define CFA_RA_OFFSET -8
>> +
>> #endif /* _OBJTOOL_CFI_REGS_H */
>> diff --git a/tools/objtool/check.c b/tools/objtool/check.c
>> index 500f63b3dcff..7db6761d28c2 100644
>> --- a/tools/objtool/check.c
>> +++ b/tools/objtool/check.c
>> @@ -1669,12 +1669,20 @@ static bool has_modified_stack_frame(struct instruction *insn, struct insn_state
>> return false;
>> }
>>
>> +static bool check_reg_frame_pos(const struct cfi_reg *reg, int cfa_start,
>> + int expected_offset)
>> +{
>> + return reg->base == CFI_CFA &&
>> + reg->offset == cfa_start + expected_offset;
>> +}
>> +
>> static bool has_valid_stack_frame(struct insn_state *state)
>> {
>> struct cfi_state *cfi = &state->cfi;
>>
>> - if (cfi->cfa.base == CFI_BP && cfi->regs[CFI_BP].base == CFI_CFA &&
>> - cfi->regs[CFI_BP].offset == -16)
>> + if (cfi->cfa.base == CFI_BP && cfi->cfa.offset >= CFA_SIZE &&
>
> Why '>=' rather than '=='?
>
Because on arm64 the stack frame is not necessarily the first thing put
on the stack by the callee. The callee is free to create the stack frame
where it wants (on its part of the stack of course) as long as it
appropriately sets the frame pointer before making a call.
You could have something like:
+------------+
| |
| |
+------------+----> f1() called
| |
| some callee|
| saved regs |
| |
+------------+
| RA |
+------------+
| BP/FP |
+------------+----> Set new BP/FP value
>> + check_reg_frame_pos(&cfi->regs[CFI_BP], -cfi->cfa.offset + CFA_SIZE, CFA_BP_OFFSET) &&
>> + check_reg_frame_pos(&cfi->regs[CFI_RA], -cfi->cfa.offset + CFA_SIZE, CFA_RA_OFFSET))
>
> Isn't '-cfi->cfa.offset + CFA_SIZE' always going to be zero?
>
For x86 yes, for arm64 it cfa.offset can be > 16.
--
Julien Thierry
On Mon, Sep 21, 2020 at 11:31:23AM +0100, Julien Thierry wrote:
> > > +++ b/tools/objtool/arch/x86/include/cfi_regs.h
> > > @@ -22,4 +22,8 @@
> > > #define CFI_RA 16
> > > #define CFI_NUM_REGS 17
> > > +#define CFA_SIZE 16
> >
> > If I remember correctly, CFA (stolen from DWARF) is "Caller Frame
> > Address". It's the stack address of the caller, before the call.
> >
>
> Ok, so maybe I'm mixing Call Frame and Stack Frame (frame pointer + return
> address).
>
> > I get the feeling CFA_SIZE is the wrong name, because CFA is an address,
> > and its size isn't 16 bytes. But I'm not quite sure what this is
> > supposed to represent. Is it supposed to be the size of the frame
> > pointer + return address? Isn't that always going to be 16 bytes for
> > both arches?
> >
>
> For arm64 and x86_64 it is. Maybe it is a bit early to consider it might
> differ for other arches (e.g. 32bit arches?).
I'd rather not consider other arches yet. Even in the 32-bit case it
wouldn't necessarily have to be an arch-specific value since it would
presumably be 'size(long) * 2'.
>
> > > static bool has_valid_stack_frame(struct insn_state *state)
> > > {
> > > struct cfi_state *cfi = &state->cfi;
> > > - if (cfi->cfa.base == CFI_BP && cfi->regs[CFI_BP].base == CFI_CFA &&
> > > - cfi->regs[CFI_BP].offset == -16)
> > > + if (cfi->cfa.base == CFI_BP && cfi->cfa.offset >= CFA_SIZE &&
> >
> > Why '>=' rather than '=='?
> >
>
> Because on arm64 the stack frame is not necessarily the first thing put on
> the stack by the callee. The callee is free to create the stack frame where
> it wants (on its part of the stack of course) as long as it appropriately
> sets the frame pointer before making a call.
>
> You could have something like:
>
> +------------+
> | |
> | |
> +------------+----> f1() called
> | |
> | some callee|
> | saved regs |
> | |
> +------------+
> | RA |
> +------------+
> | BP/FP |
> +------------+----> Set new BP/FP value
I see, thanks.
--
Josh