warning: objtool: fn1 uses BP as a scratch register

warning: objtool: fn1 uses BP as a scratch register

[Arnd Bergmann]

A lot of objtool fixes showed up in linux-next, so I looked at some
remaining ones.
This one comes a lot up in some configurations

https://godbolt.org/z/ZZLVD-

struct ov7670_win_size {
  int width;
  int height;
};
struct ov7670_devtype {
  struct ov7670_win_size *win_sizes;
  unsigned n_win_sizes;
};
struct ov7670_info {
  int min_width;
  int min_height;
  struct ov7670_devtype devtype;
} a;
int b;
int fn1() {
  struct ov7670_info c = a;
  int i = 0;
  for (; i < c.devtype.n_win_sizes; i++) {
    struct ov7670_win_size d = c.devtype.win_sizes[i];
    if (c.min_width && d.width < d.height < c.min_height)
      if (b)
        return 0;
  }
  return 2;
}

$ clang-8 -O2 -fno-omit-frame-pointer -fno-strict-overflow -c ov7670.i
$ objtool check  --no-unreachable --uaccess ov7670.o
ov7670.o: warning: objtool: fn1 uses BP as a scratch register

     Arnd

Re: warning: objtool: fn1 uses BP as a scratch register

[Nick Desaulniers]

On Fri, Jul 19, 2019 at 11:10 AM Arnd Bergmann <arnd@arndb.de> wrote:
>
> A lot of objtool fixes showed up in linux-next, so I looked at some
> remaining ones.
> This one comes a lot up in some configurations
>
> https://godbolt.org/z/ZZLVD-
>
> struct ov7670_win_size {
>   int width;
>   int height;
> };
> struct ov7670_devtype {
>   struct ov7670_win_size *win_sizes;
>   unsigned n_win_sizes;
> };
> struct ov7670_info {
>   int min_width;
>   int min_height;
>   struct ov7670_devtype devtype;
> } a;
> int b;
> int fn1() {
>   struct ov7670_info c = a;
>   int i = 0;
>   for (; i < c.devtype.n_win_sizes; i++) {
>     struct ov7670_win_size d = c.devtype.win_sizes[i];
>     if (c.min_width && d.width < d.height < c.min_height)
>       if (b)
>         return 0;
>   }
>   return 2;
> }
>
> $ clang-8 -O2 -fno-omit-frame-pointer -fno-strict-overflow -c ov7670.i
> $ objtool check  --no-unreachable --uaccess ov7670.o
> ov7670.o: warning: objtool: fn1 uses BP as a scratch register

Thanks for the report and reduced test case.  From the godbolt link, I
don't see %rbp, %ebp, %bp, or %bpl being referenced (other that %rbp
in the typical epilogue).  Am I missing something? Is objtool maybe
not reporting the precise function at fault?
-- 
Thanks,
~Nick Desaulniers

Re: warning: objtool: fn1 uses BP as a scratch register

[Josh Poimboeuf]

On Fri, Jul 19, 2019 at 11:23:16AM -0700, Nick Desaulniers wrote:
> On Fri, Jul 19, 2019 at 11:10 AM Arnd Bergmann <arnd@arndb.de> wrote:
> >
> > A lot of objtool fixes showed up in linux-next, so I looked at some
> > remaining ones.
> > This one comes a lot up in some configurations
> >
> > https://godbolt.org/z/ZZLVD-
> >
> > struct ov7670_win_size {
> >   int width;
> >   int height;
> > };
> > struct ov7670_devtype {
> >   struct ov7670_win_size *win_sizes;
> >   unsigned n_win_sizes;
> > };
> > struct ov7670_info {
> >   int min_width;
> >   int min_height;
> >   struct ov7670_devtype devtype;
> > } a;
> > int b;
> > int fn1() {
> >   struct ov7670_info c = a;
> >   int i = 0;
> >   for (; i < c.devtype.n_win_sizes; i++) {
> >     struct ov7670_win_size d = c.devtype.win_sizes[i];
> >     if (c.min_width && d.width < d.height < c.min_height)
> >       if (b)
> >         return 0;
> >   }
> >   return 2;
> > }
> >
> > $ clang-8 -O2 -fno-omit-frame-pointer -fno-strict-overflow -c ov7670.i
> > $ objtool check  --no-unreachable --uaccess ov7670.o
> > ov7670.o: warning: objtool: fn1 uses BP as a scratch register
> 
> Thanks for the report and reduced test case.  From the godbolt link, I
> don't see %rbp, %ebp, %bp, or %bpl being referenced (other that %rbp
> in the typical epilogue).  Am I missing something? Is objtool maybe
> not reporting the precise function at fault?

I haven't looked, but it could very well be an objtool bug (surprise).

-- 
Josh

Re: warning: objtool: fn1 uses BP as a scratch register

[Arnd Bergmann]

On Fri, Jul 19, 2019 at 8:31 PM Josh Poimboeuf <jpoimboe@redhat.com> wrote:
>
> On Fri, Jul 19, 2019 at 11:23:16AM -0700, Nick Desaulniers wrote:
> > On Fri, Jul 19, 2019 at 11:10 AM Arnd Bergmann <arnd@arndb.de> wrote:
> > >
> > > A lot of objtool fixes showed up in linux-next, so I looked at some
> > > remaining ones.
> > > This one comes a lot up in some configurations
> > >
> > > https://godbolt.org/z/ZZLVD-
> > >
> > > struct ov7670_win_size {
> > >   int width;
> > >   int height;
> > > };
> > > struct ov7670_devtype {
> > >   struct ov7670_win_size *win_sizes;
> > >   unsigned n_win_sizes;
> > > };
> > > struct ov7670_info {
> > >   int min_width;
> > >   int min_height;
> > >   struct ov7670_devtype devtype;
> > > } a;
> > > int b;
> > > int fn1() {
> > >   struct ov7670_info c = a;
> > >   int i = 0;
> > >   for (; i < c.devtype.n_win_sizes; i++) {
> > >     struct ov7670_win_size d = c.devtype.win_sizes[i];
> > >     if (c.min_width && d.width < d.height < c.min_height)
> > >       if (b)
> > >         return 0;
> > >   }
> > >   return 2;
> > > }
> > >
> > > $ clang-8 -O2 -fno-omit-frame-pointer -fno-strict-overflow -c ov7670.i
> > > $ objtool check  --no-unreachable --uaccess ov7670.o
> > > ov7670.o: warning: objtool: fn1 uses BP as a scratch register
> >
> > Thanks for the report and reduced test case.  From the godbolt link, I
> > don't see %rbp, %ebp, %bp, or %bpl being referenced (other that %rbp
> > in the typical epilogue).  Am I missing something? Is objtool maybe
> > not reporting the precise function at fault?
>
> I haven't looked, but it could very well be an objtool bug (surprise).

Actually the reproducer may be wrong. I reduced the test case using
9.0.0-svn363902-1~exp1+0~20190620001509.2315~1.gbp76e756,
and this contains a link

         testl %ebp, %ebp

I get the same thing with clang-8, but godbolt.org shows it only
with clang-8 (see https://godbolt.org/z/g1lZO0) , not with trunk.

       Arnd

Re: warning: objtool: fn1 uses BP as a scratch register

[Nick Desaulniers]

On Fri, Jul 19, 2019 at 11:44 AM Arnd Bergmann <arnd@arndb.de> wrote:
>
> On Fri, Jul 19, 2019 at 8:31 PM Josh Poimboeuf <jpoimboe@redhat.com> wrote:
> >
> > On Fri, Jul 19, 2019 at 11:23:16AM -0700, Nick Desaulniers wrote:
> > > On Fri, Jul 19, 2019 at 11:10 AM Arnd Bergmann <arnd@arndb.de> wrote:
> > > >
> > > > A lot of objtool fixes showed up in linux-next, so I looked at some
> > > > remaining ones.
> > > > This one comes a lot up in some configurations
> > > >
> > > > https://godbolt.org/z/ZZLVD-
> > > >
> > > > struct ov7670_win_size {
> > > >   int width;
> > > >   int height;
> > > > };
> > > > struct ov7670_devtype {
> > > >   struct ov7670_win_size *win_sizes;
> > > >   unsigned n_win_sizes;
> > > > };
> > > > struct ov7670_info {
> > > >   int min_width;
> > > >   int min_height;
> > > >   struct ov7670_devtype devtype;
> > > > } a;
> > > > int b;
> > > > int fn1() {
> > > >   struct ov7670_info c = a;
> > > >   int i = 0;
> > > >   for (; i < c.devtype.n_win_sizes; i++) {
> > > >     struct ov7670_win_size d = c.devtype.win_sizes[i];
> > > >     if (c.min_width && d.width < d.height < c.min_height)
> > > >       if (b)
> > > >         return 0;
> > > >   }
> > > >   return 2;
> > > > }
> > > >
> > > > $ clang-8 -O2 -fno-omit-frame-pointer -fno-strict-overflow -c ov7670.i
> > > > $ objtool check  --no-unreachable --uaccess ov7670.o
> > > > ov7670.o: warning: objtool: fn1 uses BP as a scratch register
> > >
> > > Thanks for the report and reduced test case.  From the godbolt link, I
> > > don't see %rbp, %ebp, %bp, or %bpl being referenced (other that %rbp
> > > in the typical epilogue).  Am I missing something? Is objtool maybe
> > > not reporting the precise function at fault?
> >
> > I haven't looked, but it could very well be an objtool bug (surprise).
>
> Actually the reproducer may be wrong. I reduced the test case using
> 9.0.0-svn363902-1~exp1+0~20190620001509.2315~1.gbp76e756,
> and this contains a link
>
>          testl %ebp, %ebp
>
> I get the same thing with clang-8, but godbolt.org shows it only
> with clang-8 (see https://godbolt.org/z/g1lZO0) , not with trunk.
>
>        Arnd



-- 
Thanks,
~Nick Desaulniers

Re: warning: objtool: fn1 uses BP as a scratch register

[Nick Desaulniers]

On Fri, Jul 19, 2019 at 11:44 AM Arnd Bergmann <arnd@arndb.de> wrote:
>
> On Fri, Jul 19, 2019 at 8:31 PM Josh Poimboeuf <jpoimboe@redhat.com> wrote:
> >
> > On Fri, Jul 19, 2019 at 11:23:16AM -0700, Nick Desaulniers wrote:
> > > On Fri, Jul 19, 2019 at 11:10 AM Arnd Bergmann <arnd@arndb.de> wrote:
> > > >
> > > > A lot of objtool fixes showed up in linux-next, so I looked at some
> > > > remaining ones.
> > > > This one comes a lot up in some configurations
> > > >
> > > > https://godbolt.org/z/ZZLVD-
> > > >
> > > > struct ov7670_win_size {
> > > >   int width;
> > > >   int height;
> > > > };
> > > > struct ov7670_devtype {
> > > >   struct ov7670_win_size *win_sizes;
> > > >   unsigned n_win_sizes;
> > > > };
> > > > struct ov7670_info {
> > > >   int min_width;
> > > >   int min_height;
> > > >   struct ov7670_devtype devtype;
> > > > } a;
> > > > int b;
> > > > int fn1() {
> > > >   struct ov7670_info c = a;
> > > >   int i = 0;
> > > >   for (; i < c.devtype.n_win_sizes; i++) {
> > > >     struct ov7670_win_size d = c.devtype.win_sizes[i];
> > > >     if (c.min_width && d.width < d.height < c.min_height)
> > > >       if (b)
> > > >         return 0;
> > > >   }
> > > >   return 2;
> > > > }
> > > >
> > > > $ clang-8 -O2 -fno-omit-frame-pointer -fno-strict-overflow -c ov7670.i
> > > > $ objtool check  --no-unreachable --uaccess ov7670.o
> > > > ov7670.o: warning: objtool: fn1 uses BP as a scratch register
> > >
> > > Thanks for the report and reduced test case.  From the godbolt link, I
> > > don't see %rbp, %ebp, %bp, or %bpl being referenced (other that %rbp
> > > in the typical epilogue).  Am I missing something? Is objtool maybe
> > > not reporting the precise function at fault?
> >
> > I haven't looked, but it could very well be an objtool bug (surprise).
>
> Actually the reproducer may be wrong. I reduced the test case using
> 9.0.0-svn363902-1~exp1+0~20190620001509.2315~1.gbp76e756,
> and this contains a link
>
>          testl %ebp, %ebp
>
> I get the same thing with clang-8, but godbolt.org shows it only
> with clang-8 (see https://godbolt.org/z/g1lZO0) , not with trunk.

(Sorry for sending a blank email just now)
+ Craig and Simon, in case they recall this being a recent fix in
LLVM's x86 backend.
Sounds like this is fixing in upstream LLVM.  Guessing this could
result in improper unwinding w/ clang-8, but that's kind of irrelevant
for x86 as there's no asm goto (though we don't need CONFIG_JUMP_LABEL
in LTS branches :P)
-- 
Thanks,
~Nick Desaulniers

Re: warning: objtool: fn1 uses BP as a scratch register

[Arnd Bergmann]

[-- Attachment #1: Type: text/plain, Size: 4711 bytes --]

On Fri, Jul 19, 2019 at 8:50 PM 'Nick Desaulniers' via Clang Built
Linux <clang-built-linux@googlegroups.com> wrote:
> On Fri, Jul 19, 2019 at 11:44 AM Arnd Bergmann <arnd@arndb.de> wrote:
> > On Fri, Jul 19, 2019 at 8:31 PM Josh Poimboeuf <jpoimboe@redhat.com> wrote:
> > Actually the reproducer may be wrong. I reduced the test case using
> > 9.0.0-svn363902-1~exp1+0~20190620001509.2315~1.gbp76e756,
> > and this contains a link
> >
> >          testl %ebp, %ebp
> >
> > I get the same thing with clang-8, but godbolt.org shows it only
> > with clang-8 (see https://godbolt.org/z/g1lZO0) , not with trunk.
>
> (Sorry for sending a blank email just now)
> + Craig and Simon, in case they recall this being a recent fix in
> LLVM's x86 backend.
> Sounds like this is fixing in upstream LLVM.  Guessing this could
> result in improper unwinding w/ clang-8, but that's kind of irrelevant
> for x86 as there's no asm goto (though we don't need CONFIG_JUMP_LABEL
> in LTS branches :P)

Maybe you can try the attached .config file with a more recent clang
build. This showed a few hundred warnings like this one for me, so
if it was not a bugfix but a random change in clang-9 that changed my
reproducer.

Ignoring the 'uses BP as a scratch' warnings and the reiserfs
'unreachable instruction' ones, this is what else I got with today's
linux-next:

arch/x86/events/intel/core.o: warning: objtool:
intel_pmu_nhm_workaround()+0x103: unreachable instruction
arch/x86/ia32/ia32_signal.o: warning: objtool:
ia32_setup_rt_frame()+0x151: call to memset() with UACCESS enabled
arch/x86/kernel/cpu/mtrr/generic.o: warning: objtool:
get_fixed_ranges()+0x144: unreachable instruction
arch/x86/kernel/process.o: warning: objtool: get_tsc_mode()+0x20: call
without frame pointer save/setup
arch/x86/kernel/signal.o: warning: objtool: __setup_rt_frame()+0x1a0:
call to memset() with UACCESS enabled
arch/x86/kernel/signal.o: warning: objtool:
x32_setup_rt_frame()+0x1da: call to memset() with UACCESS enabled
arch/x86/kernel/tsc.o: warning: objtool: sched_clock()+0x0: call
without frame pointer save/setup
arch/x86/mm/fault.o: warning: objtool: do_user_addr_fault()+0x53:
unreachable instruction
drivers/ata/sata_dwc_460ex.o: warning: objtool:
sata_dwc_bmdma_start_by_tag()+0x259: can't find switch jump table
drivers/gpu/drm/amd/amdgpu/atom.o: warning: objtool: atom_op_move()
falls through to next function atom_op_and()
drivers/gpu/drm/radeon/atom.o: warning: objtool: atom_op_move()+0xce:
sibling call from callable instruction with modified stack frame
drivers/gpu/drm/radeon/atom.o: warning: objtool: atom_op_move() falls
through to next function atom_op_and()
modified stack frame
drivers/gpu/drm/radeon/evergreen_cs.o: warning: objtool:
evergreen_cs_parse()+0xbcf: sibling call from callable instruction
with modified stack frame
drivers/gpu/drm/radeon/evergreen_cs.o: warning: objtool:
evergreen_cs_parse() falls through to next function
evergreen_dma_cs_parse()
drivers/hwmon/pmbus/adm1275.o: warning: objtool:
adm1275_probe()+0x949: unreachable instruction
drivers/media/dvb-frontends/cxd2880/cxd2880_tnrdmd_dvbt2.o: warning:
objtool: x_tune_dvbt2_demod_setting()+0x92a: can't find switch jump
table
drivers/pinctrl/pinctrl-ingenic.o: warning: objtool:
ingenic_pinconf_set()+0x93: sibling call from callable instruction
with modified stack frame
drivers/platform/x86/intel_speed_select_if/isst_if_common.o: warning:
objtool: isst_restore_msr_local()+0x13d: unreachable instruction
drivers/platform/x86/intel_speed_select_if/isst_if_mbox_msr.o:
warning: objtool: isst_if_send_mbox_cmd()+0x80: unreachable
instruction
fs/hfsplus/xattr.o: warning: objtool:
hfsplus_create_attributes_file()+0x4f7: unreachable instruction
kernel/trace/ring_buffer.o: warning: objtool:
ring_buffer_nest_end()+0x1b: call without frame pointer save/setup
kernel/trace/trace.o: warning: objtool: saved_cmdlines_stop()+0x13:
call without frame pointer save/setup
lib/iov_iter.o: warning: objtool: .altinstr_replacement+0x30: call
without frame pointer save/setup
lib/ubsan.o: warning: objtool: __ubsan_handle_type_mismatch()+0x25:
call to memcpy() with UACCESS enabled
lib/ubsan.o: warning: objtool: __ubsan_handle_type_mismatch_v1()+0xbd:
call to __stack_chk_fail() with UACCESS enabled
lib/ubsan.o: warning: objtool: ubsan_type_mismatch_common()+0x448:
call to __stack_chk_fail() with UACCESS enabled
mm/kasan/common.o: warning: objtool: kasan_report()+0x43: call to
__stack_chk_fail() with UACCESS enabled
mm/page_alloc.o: warning: objtool: .altinstr_replacement+0x47: call
without frame pointer save/setup
mm/workingset.o: warning: objtool: count_shadow_nodes()+0x126:
unreachable instruction

Any interesting ones in there?

       Arnd

[-- Attachment #2: config-0x94187A56.gz --]
[-- Type: application/gzip, Size: 35351 bytes --]

RE: warning: objtool: fn1 uses BP as a scratch register

[Topper, Craig]

The framepointer thing may have been fixed by this  https://reviews.llvm.org/D64294 

-----Original Message-----
From: Arnd Bergmann <arnd@arndb.de> 
Sent: Friday, July 19, 2019 12:44 PM
To: Nick Desaulniers <ndesaulniers@google.com>
Cc: Josh Poimboeuf <jpoimboe@redhat.com>; clang-built-linux <clang-built-linux@googlegroups.com>; Linux Kernel Mailing List <linux-kernel@vger.kernel.org>; Peter Zijlstra <peterz@infradead.org>; Topper, Craig <craig.topper@intel.com>; Simon Pilgrim <llvm-dev@redking.me.uk>
Subject: Re: warning: objtool: fn1 uses BP as a scratch register

On Fri, Jul 19, 2019 at 8:50 PM 'Nick Desaulniers' via Clang Built Linux <clang-built-linux@googlegroups.com> wrote:
> On Fri, Jul 19, 2019 at 11:44 AM Arnd Bergmann <arnd@arndb.de> wrote:
> > On Fri, Jul 19, 2019 at 8:31 PM Josh Poimboeuf <jpoimboe@redhat.com> wrote:
> > Actually the reproducer may be wrong. I reduced the test case using 
> > 9.0.0-svn363902-1~exp1+0~20190620001509.2315~1.gbp76e756,
> > and this contains a link
> >
> >          testl %ebp, %ebp
> >
> > I get the same thing with clang-8, but godbolt.org shows it only 
> > with clang-8 (see https://godbolt.org/z/g1lZO0) , not with trunk.
>
> (Sorry for sending a blank email just now)
> + Craig and Simon, in case they recall this being a recent fix in
> LLVM's x86 backend.
> Sounds like this is fixing in upstream LLVM.  Guessing this could 
> result in improper unwinding w/ clang-8, but that's kind of irrelevant 
> for x86 as there's no asm goto (though we don't need CONFIG_JUMP_LABEL 
> in LTS branches :P)

Maybe you can try the attached .config file with a more recent clang build. This showed a few hundred warnings like this one for me, so if it was not a bugfix but a random change in clang-9 that changed my reproducer.

Ignoring the 'uses BP as a scratch' warnings and the reiserfs 'unreachable instruction' ones, this is what else I got with today's
linux-next:

arch/x86/events/intel/core.o: warning: objtool:
intel_pmu_nhm_workaround()+0x103: unreachable instruction
arch/x86/ia32/ia32_signal.o: warning: objtool:
ia32_setup_rt_frame()+0x151: call to memset() with UACCESS enabled
arch/x86/kernel/cpu/mtrr/generic.o: warning: objtool:
get_fixed_ranges()+0x144: unreachable instruction
arch/x86/kernel/process.o: warning: objtool: get_tsc_mode()+0x20: call without frame pointer save/setup
arch/x86/kernel/signal.o: warning: objtool: __setup_rt_frame()+0x1a0:
call to memset() with UACCESS enabled
arch/x86/kernel/signal.o: warning: objtool:
x32_setup_rt_frame()+0x1da: call to memset() with UACCESS enabled
arch/x86/kernel/tsc.o: warning: objtool: sched_clock()+0x0: call without frame pointer save/setup
arch/x86/mm/fault.o: warning: objtool: do_user_addr_fault()+0x53:
unreachable instruction
drivers/ata/sata_dwc_460ex.o: warning: objtool:
sata_dwc_bmdma_start_by_tag()+0x259: can't find switch jump table
drivers/gpu/drm/amd/amdgpu/atom.o: warning: objtool: atom_op_move() falls through to next function atom_op_and()
drivers/gpu/drm/radeon/atom.o: warning: objtool: atom_op_move()+0xce:
sibling call from callable instruction with modified stack frame
drivers/gpu/drm/radeon/atom.o: warning: objtool: atom_op_move() falls through to next function atom_op_and() modified stack frame
drivers/gpu/drm/radeon/evergreen_cs.o: warning: objtool:
evergreen_cs_parse()+0xbcf: sibling call from callable instruction with modified stack frame
drivers/gpu/drm/radeon/evergreen_cs.o: warning: objtool:
evergreen_cs_parse() falls through to next function
evergreen_dma_cs_parse()
drivers/hwmon/pmbus/adm1275.o: warning: objtool:
adm1275_probe()+0x949: unreachable instruction
drivers/media/dvb-frontends/cxd2880/cxd2880_tnrdmd_dvbt2.o: warning:
objtool: x_tune_dvbt2_demod_setting()+0x92a: can't find switch jump table
drivers/pinctrl/pinctrl-ingenic.o: warning: objtool:
ingenic_pinconf_set()+0x93: sibling call from callable instruction with modified stack frame
drivers/platform/x86/intel_speed_select_if/isst_if_common.o: warning:
objtool: isst_restore_msr_local()+0x13d: unreachable instruction
drivers/platform/x86/intel_speed_select_if/isst_if_mbox_msr.o:
warning: objtool: isst_if_send_mbox_cmd()+0x80: unreachable instruction
fs/hfsplus/xattr.o: warning: objtool:
hfsplus_create_attributes_file()+0x4f7: unreachable instruction
kernel/trace/ring_buffer.o: warning: objtool:
ring_buffer_nest_end()+0x1b: call without frame pointer save/setup
kernel/trace/trace.o: warning: objtool: saved_cmdlines_stop()+0x13:
call without frame pointer save/setup
lib/iov_iter.o: warning: objtool: .altinstr_replacement+0x30: call without frame pointer save/setup
lib/ubsan.o: warning: objtool: __ubsan_handle_type_mismatch()+0x25:
call to memcpy() with UACCESS enabled
lib/ubsan.o: warning: objtool: __ubsan_handle_type_mismatch_v1()+0xbd:
call to __stack_chk_fail() with UACCESS enabled
lib/ubsan.o: warning: objtool: ubsan_type_mismatch_common()+0x448:
call to __stack_chk_fail() with UACCESS enabled
mm/kasan/common.o: warning: objtool: kasan_report()+0x43: call to
__stack_chk_fail() with UACCESS enabled
mm/page_alloc.o: warning: objtool: .altinstr_replacement+0x47: call without frame pointer save/setup
mm/workingset.o: warning: objtool: count_shadow_nodes()+0x126:
unreachable instruction

Any interesting ones in there?

       Arnd