1*4882a593Smuzhiyun#! /bin/bash 2*4882a593Smuzhiyun# SPDX-License-Identifier: GPL-2.0 3*4882a593Smuzhiyun# (c) 2015, Quentin Casasnovas <quentin.casasnovas@oracle.com> 4*4882a593Smuzhiyun 5*4882a593Smuzhiyunobj=$1 6*4882a593Smuzhiyun 7*4882a593Smuzhiyunfile ${obj} | grep -q ELF || (echo "${obj} is not and ELF file." 1>&2 ; exit 0) 8*4882a593Smuzhiyun 9*4882a593Smuzhiyun# Bail out early if there isn't an __ex_table section in this object file. 10*4882a593Smuzhiyunobjdump -hj __ex_table ${obj} 2> /dev/null > /dev/null 11*4882a593Smuzhiyun[ $? -ne 0 ] && exit 0 12*4882a593Smuzhiyun 13*4882a593Smuzhiyunwhite_list=.text,.fixup 14*4882a593Smuzhiyun 15*4882a593Smuzhiyunsuspicious_relocs=$(objdump -rj __ex_table ${obj} | tail -n +6 | 16*4882a593Smuzhiyun grep -v $(eval echo -e{${white_list}}) | awk '{print $3}') 17*4882a593Smuzhiyun 18*4882a593Smuzhiyun# No suspicious relocs in __ex_table, jobs a good'un 19*4882a593Smuzhiyun[ -z "${suspicious_relocs}" ] && exit 0 20*4882a593Smuzhiyun 21*4882a593Smuzhiyun 22*4882a593Smuzhiyun# After this point, something is seriously wrong since we just found out we 23*4882a593Smuzhiyun# have some relocations in __ex_table which point to sections which aren't 24*4882a593Smuzhiyun# white listed. If you're adding a new section in the Linux kernel, and 25*4882a593Smuzhiyun# you're expecting this section to contain code which can fault (i.e. the 26*4882a593Smuzhiyun# __ex_table relocation to your new section is expected), simply add your 27*4882a593Smuzhiyun# new section to the white_list variable above. If not, you're probably 28*4882a593Smuzhiyun# doing something wrong and the rest of this code is just trying to print 29*4882a593Smuzhiyun# you more information about it. 30*4882a593Smuzhiyun 31*4882a593Smuzhiyunfunction find_section_offset_from_symbol() 32*4882a593Smuzhiyun{ 33*4882a593Smuzhiyun eval $(objdump -t ${obj} | grep ${1} | sed 's/\([0-9a-f]\+\) .\{7\} \([^ \t]\+\).*/section="\2"; section_offset="0x\1" /') 34*4882a593Smuzhiyun 35*4882a593Smuzhiyun # addr2line takes addresses in hexadecimal... 36*4882a593Smuzhiyun section_offset=$(printf "0x%016x" $(( ${section_offset} + $2 )) ) 37*4882a593Smuzhiyun} 38*4882a593Smuzhiyun 39*4882a593Smuzhiyunfunction find_symbol_and_offset_from_reloc() 40*4882a593Smuzhiyun{ 41*4882a593Smuzhiyun # Extract symbol and offset from the objdump output 42*4882a593Smuzhiyun eval $(echo $reloc | sed 's/\([^+]\+\)+\?\(0x[0-9a-f]\+\)\?/symbol="\1"; symbol_offset="\2"/') 43*4882a593Smuzhiyun 44*4882a593Smuzhiyun # When the relocation points to the begining of a symbol or section, it 45*4882a593Smuzhiyun # won't print the offset since it is zero. 46*4882a593Smuzhiyun if [ -z "${symbol_offset}" ]; then 47*4882a593Smuzhiyun symbol_offset=0x0 48*4882a593Smuzhiyun fi 49*4882a593Smuzhiyun} 50*4882a593Smuzhiyun 51*4882a593Smuzhiyunfunction find_alt_replacement_target() 52*4882a593Smuzhiyun{ 53*4882a593Smuzhiyun # The target of the .altinstr_replacement is the relocation just before 54*4882a593Smuzhiyun # the .altinstr_replacement one. 55*4882a593Smuzhiyun eval $(objdump -rj .altinstructions ${obj} | grep -B1 "${section}+${section_offset}" | head -n1 | awk '{print $3}' | 56*4882a593Smuzhiyun sed 's/\([^+]\+\)+\(0x[0-9a-f]\+\)/alt_target_section="\1"; alt_target_offset="\2"/') 57*4882a593Smuzhiyun} 58*4882a593Smuzhiyun 59*4882a593Smuzhiyunfunction handle_alt_replacement_reloc() 60*4882a593Smuzhiyun{ 61*4882a593Smuzhiyun # This will define alt_target_section and alt_target_section_offset 62*4882a593Smuzhiyun find_alt_replacement_target ${section} ${section_offset} 63*4882a593Smuzhiyun 64*4882a593Smuzhiyun echo "Error: found a reference to .altinstr_replacement in __ex_table:" 65*4882a593Smuzhiyun addr2line -fip -j ${alt_target_section} -e ${obj} ${alt_target_offset} | awk '{print "\t" $0}' 66*4882a593Smuzhiyun 67*4882a593Smuzhiyun error=true 68*4882a593Smuzhiyun} 69*4882a593Smuzhiyun 70*4882a593Smuzhiyunfunction is_executable_section() 71*4882a593Smuzhiyun{ 72*4882a593Smuzhiyun objdump -hwj ${section} ${obj} | grep -q CODE 73*4882a593Smuzhiyun return $? 74*4882a593Smuzhiyun} 75*4882a593Smuzhiyun 76*4882a593Smuzhiyunfunction handle_suspicious_generic_reloc() 77*4882a593Smuzhiyun{ 78*4882a593Smuzhiyun if is_executable_section ${section}; then 79*4882a593Smuzhiyun # We've got a relocation to a non white listed _executable_ 80*4882a593Smuzhiyun # section, print a warning so the developper adds the section to 81*4882a593Smuzhiyun # the white list or fix his code. We try to pretty-print the file 82*4882a593Smuzhiyun # and line number where that relocation was added. 83*4882a593Smuzhiyun echo "Warning: found a reference to section \"${section}\" in __ex_table:" 84*4882a593Smuzhiyun addr2line -fip -j ${section} -e ${obj} ${section_offset} | awk '{print "\t" $0}' 85*4882a593Smuzhiyun else 86*4882a593Smuzhiyun # Something is definitively wrong here since we've got a relocation 87*4882a593Smuzhiyun # to a non-executable section, there's no way this would ever be 88*4882a593Smuzhiyun # running in the kernel. 89*4882a593Smuzhiyun echo "Error: found a reference to non-executable section \"${section}\" in __ex_table at offset ${section_offset}" 90*4882a593Smuzhiyun error=true 91*4882a593Smuzhiyun fi 92*4882a593Smuzhiyun} 93*4882a593Smuzhiyun 94*4882a593Smuzhiyunfunction handle_suspicious_reloc() 95*4882a593Smuzhiyun{ 96*4882a593Smuzhiyun case "${section}" in 97*4882a593Smuzhiyun ".altinstr_replacement") 98*4882a593Smuzhiyun handle_alt_replacement_reloc ${section} ${section_offset} 99*4882a593Smuzhiyun ;; 100*4882a593Smuzhiyun *) 101*4882a593Smuzhiyun handle_suspicious_generic_reloc ${section} ${section_offset} 102*4882a593Smuzhiyun ;; 103*4882a593Smuzhiyun esac 104*4882a593Smuzhiyun} 105*4882a593Smuzhiyun 106*4882a593Smuzhiyunfunction diagnose() 107*4882a593Smuzhiyun{ 108*4882a593Smuzhiyun 109*4882a593Smuzhiyun for reloc in ${suspicious_relocs}; do 110*4882a593Smuzhiyun # Let's find out where the target of the relocation in __ex_table 111*4882a593Smuzhiyun # is, this will define ${symbol} and ${symbol_offset} 112*4882a593Smuzhiyun find_symbol_and_offset_from_reloc ${reloc} 113*4882a593Smuzhiyun 114*4882a593Smuzhiyun # When there's a global symbol at the place of the relocation, 115*4882a593Smuzhiyun # objdump will use it instead of giving us a section+offset, so 116*4882a593Smuzhiyun # let's find out which section is this symbol in and the total 117*4882a593Smuzhiyun # offset withing that section. 118*4882a593Smuzhiyun find_section_offset_from_symbol ${symbol} ${symbol_offset} 119*4882a593Smuzhiyun 120*4882a593Smuzhiyun # In this case objdump was presenting us with a reloc to a symbol 121*4882a593Smuzhiyun # rather than a section. Now that we've got the actual section, 122*4882a593Smuzhiyun # we can skip it if it's in the white_list. 123*4882a593Smuzhiyun if [ -z "$( echo $section | grep -v $(eval echo -e{${white_list}}))" ]; then 124*4882a593Smuzhiyun continue; 125*4882a593Smuzhiyun fi 126*4882a593Smuzhiyun 127*4882a593Smuzhiyun # Will either print a warning if the relocation happens to be in a 128*4882a593Smuzhiyun # section we do not know but has executable bit set, or error out. 129*4882a593Smuzhiyun handle_suspicious_reloc 130*4882a593Smuzhiyun done 131*4882a593Smuzhiyun} 132*4882a593Smuzhiyun 133*4882a593Smuzhiyunfunction check_debug_info() { 134*4882a593Smuzhiyun objdump -hj .debug_info ${obj} 2> /dev/null > /dev/null || 135*4882a593Smuzhiyun echo -e "${obj} does not contain debug information, the addr2line output will be limited.\n" \ 136*4882a593Smuzhiyun "Recompile ${obj} with CONFIG_DEBUG_INFO to get a more useful output." 137*4882a593Smuzhiyun} 138*4882a593Smuzhiyun 139*4882a593Smuzhiyuncheck_debug_info 140*4882a593Smuzhiyun 141*4882a593Smuzhiyundiagnose 142*4882a593Smuzhiyun 143*4882a593Smuzhiyunif [ "${error}" ]; then 144*4882a593Smuzhiyun exit 1 145*4882a593Smuzhiyunfi 146*4882a593Smuzhiyun 147*4882a593Smuzhiyunexit 0 148