check.c 70.6 KB
Newer Older
1
// SPDX-License-Identifier: GPL-2.0-or-later
2 3 4 5 6 7 8
/*
 * Copyright (C) 2015-2017 Josh Poimboeuf <jpoimboe@redhat.com>
 */

#include <string.h>
#include <stdlib.h>

9 10 11 12 13 14 15 16
#include <arch/elf.h>
#include <objtool/builtin.h>
#include <objtool/cfi.h>
#include <objtool/arch.h>
#include <objtool/check.h>
#include <objtool/special.h>
#include <objtool/warn.h>
#include <objtool/endianness.h>
17

18
#include <linux/objtool.h>
19 20
#include <linux/hashtable.h>
#include <linux/kernel.h>
21
#include <linux/static_call_types.h>
22 23 24 25

struct alternative {
	struct list_head list;
	struct instruction *insn;
P
Peter Zijlstra 已提交
26
	bool skip_orig;
27 28
};

29
struct cfi_init_state initial_func_cfi;
30

31 32
struct instruction *find_insn(struct objtool_file *file,
			      struct section *sec, unsigned long offset)
33 34 35
{
	struct instruction *insn;

36
	hash_for_each_possible(file->insn_hash, insn, hash, sec_offset_hash(sec, offset)) {
37 38
		if (insn->sec == sec && insn->offset == offset)
			return insn;
39
	}
40 41 42 43 44 45 46 47 48

	return NULL;
}

static struct instruction *next_insn_same_sec(struct objtool_file *file,
					      struct instruction *insn)
{
	struct instruction *next = list_next_entry(insn, list);

49
	if (!next || &next->list == &file->insn_list || next->sec != insn->sec)
50 51 52 53 54
		return NULL;

	return next;
}

55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74
static struct instruction *next_insn_same_func(struct objtool_file *file,
					       struct instruction *insn)
{
	struct instruction *next = list_next_entry(insn, list);
	struct symbol *func = insn->func;

	if (!func)
		return NULL;

	if (&next->list != &file->insn_list && next->func == func)
		return next;

	/* Check if we're already in the subfunction: */
	if (func == func->cfunc)
		return NULL;

	/* Move to the subfunction: */
	return find_insn(file, func->cfunc->sec, func->cfunc->offset);
}

75 76 77 78 79 80 81 82 83 84 85
static struct instruction *prev_insn_same_sym(struct objtool_file *file,
					       struct instruction *insn)
{
	struct instruction *prev = list_prev_entry(insn, list);

	if (&prev->list != &file->insn_list && prev->func == insn->func)
		return prev;

	return NULL;
}

86
#define func_for_each_insn(file, func, insn)				\
87 88 89 90
	for (insn = find_insn(file, func->sec, func->offset);		\
	     insn;							\
	     insn = next_insn_same_func(file, insn))

91 92
#define sym_for_each_insn(file, sym, insn)				\
	for (insn = find_insn(file, sym->sec, sym->offset);		\
93
	     insn && &insn->list != &file->insn_list &&			\
94 95
		insn->sec == sym->sec &&				\
		insn->offset < sym->offset + sym->len;			\
96 97
	     insn = list_next_entry(insn, list))

98
#define sym_for_each_insn_continue_reverse(file, sym, insn)		\
99 100
	for (insn = list_prev_entry(insn, list);			\
	     &insn->list != &file->insn_list &&				\
101
		insn->sec == sym->sec && insn->offset >= sym->offset;	\
102 103 104 105 106
	     insn = list_prev_entry(insn, list))

#define sec_for_each_insn_from(file, insn)				\
	for (; insn; insn = next_insn_same_sec(file, insn))

107 108 109
#define sec_for_each_insn_continue(file, insn)				\
	for (insn = next_insn_same_sec(file, insn); insn;		\
	     insn = next_insn_same_sec(file, insn))
110

111 112 113 114 115 116
static bool is_sibling_call(struct instruction *insn)
{
	/* An indirect jump is either a sibling call or a jump to a table. */
	if (insn->type == INSN_JUMP_DYNAMIC)
		return list_empty(&insn->alts);

117
	if (!is_static_jump(insn))
118 119 120 121 122 123
		return false;

	/* add_jump_destinations() sets insn->call_dest for sibling calls. */
	return !!insn->call_dest;
}

124 125 126 127 128 129 130 131 132
/*
 * This checks to see if the given function is a "noreturn" function.
 *
 * For global functions which are outside the scope of this object file, we
 * have to keep a manual list of them.
 *
 * For local functions, we have to detect them manually by simply looking for
 * the lack of a return instruction.
 */
133 134
static bool __dead_end_function(struct objtool_file *file, struct symbol *func,
				int recursion)
135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153
{
	int i;
	struct instruction *insn;
	bool empty = true;

	/*
	 * Unfortunately these have to be hard coded because the noreturn
	 * attribute isn't provided in ELF data.
	 */
	static const char * const global_noreturns[] = {
		"__stack_chk_fail",
		"panic",
		"do_exit",
		"do_task_dead",
		"__module_put_and_exit",
		"complete_and_exit",
		"__reiserfs_panic",
		"lbug_with_loc",
		"fortify_panic",
154
		"usercopy_abort",
155
		"machine_real_restart",
156
		"rewind_stack_do_exit",
157
		"kunit_try_catch_throw",
158 159
	};

160 161 162
	if (!func)
		return false;

163
	if (func->bind == STB_WEAK)
164
		return false;
165 166 167 168

	if (func->bind == STB_GLOBAL)
		for (i = 0; i < ARRAY_SIZE(global_noreturns); i++)
			if (!strcmp(func->name, global_noreturns[i]))
169
				return true;
170

171
	if (!func->len)
172
		return false;
173

174 175
	insn = find_insn(file, func->sec, func->offset);
	if (!insn->func)
176
		return false;
177

178
	func_for_each_insn(file, func, insn) {
179 180 181
		empty = false;

		if (insn->type == INSN_RETURN)
182
			return false;
183 184 185
	}

	if (empty)
186
		return false;
187 188 189 190 191 192

	/*
	 * A function can have a sibling call instead of a return.  In that
	 * case, the function's dead-end status depends on whether the target
	 * of the sibling call returns.
	 */
193
	func_for_each_insn(file, func, insn) {
194
		if (is_sibling_call(insn)) {
195 196 197 198
			struct instruction *dest = insn->jump_dest;

			if (!dest)
				/* sibling call to another file */
199
				return false;
200

201 202 203 204 205 206 207 208
			/* local sibling call */
			if (recursion == 5) {
				/*
				 * Infinite recursion: two functions have
				 * sibling calls to each other.  This is a very
				 * rare case.  It means they aren't dead ends.
				 */
				return false;
209 210
			}

211 212
			return __dead_end_function(file, dest->func, recursion+1);
		}
213 214
	}

215
	return true;
216 217
}

218
static bool dead_end_function(struct objtool_file *file, struct symbol *func)
219 220 221 222
{
	return __dead_end_function(file, func, 0);
}

223
static void init_cfi_state(struct cfi_state *cfi)
224 225 226
{
	int i;

227
	for (i = 0; i < CFI_NUM_REGS; i++) {
228 229
		cfi->regs[i].base = CFI_UNDEFINED;
		cfi->vals[i].base = CFI_UNDEFINED;
230
	}
231 232 233 234 235
	cfi->cfa.base = CFI_UNDEFINED;
	cfi->drap_reg = CFI_UNDEFINED;
	cfi->drap_offset = -1;
}

236
static void init_insn_state(struct insn_state *state, struct section *sec)
237 238 239
{
	memset(state, 0, sizeof(*state));
	init_cfi_state(&state->cfi);
240 241 242 243 244 245 246 247

	/*
	 * We need the full vmlinux for noinstr validation, otherwise we can
	 * not correctly determine insn->call_dest->sec (external symbols do
	 * not have a section).
	 */
	if (vmlinux && sec)
		state->noinstr = sec->noinstr;
248 249
}

250 251 252 253 254 255 256 257 258 259
/*
 * Call the arch-specific instruction decoder for all the instructions and add
 * them to the global instruction list.
 */
static int decode_instructions(struct objtool_file *file)
{
	struct section *sec;
	struct symbol *func;
	unsigned long offset;
	struct instruction *insn;
P
Peter Zijlstra 已提交
260
	unsigned long nr_insns = 0;
261 262
	int ret;

263
	for_each_sec(file, sec) {
264 265 266 267

		if (!(sec->sh.sh_flags & SHF_EXECINSTR))
			continue;

268 269 270 271 272
		if (strcmp(sec->name, ".altinstr_replacement") &&
		    strcmp(sec->name, ".altinstr_aux") &&
		    strncmp(sec->name, ".discard.", 9))
			sec->text = true;

273 274
		if (!strcmp(sec->name, ".noinstr.text") ||
		    !strcmp(sec->name, ".entry.text"))
275 276
			sec->noinstr = true;

277 278
		for (offset = 0; offset < sec->len; offset += insn->len) {
			insn = malloc(sizeof(*insn));
279 280 281 282
			if (!insn) {
				WARN("malloc failed");
				return -1;
			}
283 284
			memset(insn, 0, sizeof(*insn));
			INIT_LIST_HEAD(&insn->alts);
285
			INIT_LIST_HEAD(&insn->stack_ops);
286
			init_cfi_state(&insn->cfi);
287

288 289 290 291 292 293
			insn->sec = sec;
			insn->offset = offset;

			ret = arch_decode_instruction(file->elf, sec, offset,
						      sec->len - offset,
						      &insn->len, &insn->type,
294
						      &insn->immediate,
295
						      &insn->stack_ops);
296
			if (ret)
297
				goto err;
298

299
			hash_add(file->insn_hash, &insn->hash, sec_offset_hash(sec, insn->offset));
300
			list_add_tail(&insn->list, &file->insn_list);
P
Peter Zijlstra 已提交
301
			nr_insns++;
302 303 304
		}

		list_for_each_entry(func, &sec->symbol_list, list) {
305
			if (func->type != STT_FUNC || func->alias != func)
306 307 308 309 310 311 312 313
				continue;

			if (!find_insn(file, sec, func->offset)) {
				WARN("%s(): can't find starting instruction",
				     func->name);
				return -1;
			}

314
			sym_for_each_insn(file, func, insn)
315
				insn->func = func;
316 317 318
		}
	}

P
Peter Zijlstra 已提交
319 320 321
	if (stats)
		printf("nr_insns: %lu\n", nr_insns);

322
	return 0;
323 324 325 326

err:
	free(insn);
	return ret;
327 328
}

329 330 331 332 333 334 335 336 337 338 339 340 341
static struct instruction *find_last_insn(struct objtool_file *file,
					  struct section *sec)
{
	struct instruction *insn = NULL;
	unsigned int offset;
	unsigned int end = (sec->len > 10) ? sec->len - 10 : 0;

	for (offset = sec->len - 1; offset >= end && !insn; offset--)
		insn = find_insn(file, sec, offset);

	return insn;
}

342
/*
343
 * Mark "ud2" instructions and manually annotated dead ends.
344 345 346 347
 */
static int add_dead_ends(struct objtool_file *file)
{
	struct section *sec;
M
Matt Helsley 已提交
348
	struct reloc *reloc;
349 350
	struct instruction *insn;

351 352 353 354 355 356 357 358 359 360 361
	/*
	 * By default, "ud2" is a dead end unless otherwise annotated, because
	 * GCC 7 inserts it for certain divide-by-zero cases.
	 */
	for_each_insn(file, insn)
		if (insn->type == INSN_BUG)
			insn->dead_end = true;

	/*
	 * Check for manually annotated dead ends.
	 */
362 363
	sec = find_section_by_name(file->elf, ".rela.discard.unreachable");
	if (!sec)
364
		goto reachable;
365

M
Matt Helsley 已提交
366 367
	list_for_each_entry(reloc, &sec->reloc_list, list) {
		if (reloc->sym->type != STT_SECTION) {
368 369 370
			WARN("unexpected relocation symbol type in %s", sec->name);
			return -1;
		}
M
Matt Helsley 已提交
371
		insn = find_insn(file, reloc->sym->sec, reloc->addend);
372 373
		if (insn)
			insn = list_prev_entry(insn, list);
M
Matt Helsley 已提交
374 375
		else if (reloc->addend == reloc->sym->sec->len) {
			insn = find_last_insn(file, reloc->sym->sec);
376
			if (!insn) {
377
				WARN("can't find unreachable insn at %s+0x%x",
M
Matt Helsley 已提交
378
				     reloc->sym->sec->name, reloc->addend);
379 380 381 382
				return -1;
			}
		} else {
			WARN("can't find unreachable insn at %s+0x%x",
M
Matt Helsley 已提交
383
			     reloc->sym->sec->name, reloc->addend);
384 385 386 387 388 389
			return -1;
		}

		insn->dead_end = true;
	}

390 391 392 393 394 395 396 397 398 399 400
reachable:
	/*
	 * These manually annotated reachable checks are needed for GCC 4.4,
	 * where the Linux unreachable() macro isn't supported.  In that case
	 * GCC doesn't know the "ud2" is fatal, so it generates code as if it's
	 * not a dead end.
	 */
	sec = find_section_by_name(file->elf, ".rela.discard.reachable");
	if (!sec)
		return 0;

M
Matt Helsley 已提交
401 402
	list_for_each_entry(reloc, &sec->reloc_list, list) {
		if (reloc->sym->type != STT_SECTION) {
403 404 405
			WARN("unexpected relocation symbol type in %s", sec->name);
			return -1;
		}
M
Matt Helsley 已提交
406
		insn = find_insn(file, reloc->sym->sec, reloc->addend);
407 408
		if (insn)
			insn = list_prev_entry(insn, list);
M
Matt Helsley 已提交
409 410
		else if (reloc->addend == reloc->sym->sec->len) {
			insn = find_last_insn(file, reloc->sym->sec);
411
			if (!insn) {
412
				WARN("can't find reachable insn at %s+0x%x",
M
Matt Helsley 已提交
413
				     reloc->sym->sec->name, reloc->addend);
414 415 416 417
				return -1;
			}
		} else {
			WARN("can't find reachable insn at %s+0x%x",
M
Matt Helsley 已提交
418
			     reloc->sym->sec->name, reloc->addend);
419 420 421 422 423 424
			return -1;
		}

		insn->dead_end = false;
	}

425 426 427
	return 0;
}

428 429 430 431 432 433 434 435 436 437 438 439 440 441 442 443 444 445 446 447 448 449 450 451 452 453 454 455 456 457 458 459 460 461 462 463 464 465 466 467 468
static int create_static_call_sections(struct objtool_file *file)
{
	struct section *sec, *reloc_sec;
	struct reloc *reloc;
	struct static_call_site *site;
	struct instruction *insn;
	struct symbol *key_sym;
	char *key_name, *tmp;
	int idx;

	sec = find_section_by_name(file->elf, ".static_call_sites");
	if (sec) {
		INIT_LIST_HEAD(&file->static_call_list);
		WARN("file already has .static_call_sites section, skipping");
		return 0;
	}

	if (list_empty(&file->static_call_list))
		return 0;

	idx = 0;
	list_for_each_entry(insn, &file->static_call_list, static_call_node)
		idx++;

	sec = elf_create_section(file->elf, ".static_call_sites", SHF_WRITE,
				 sizeof(struct static_call_site), idx);
	if (!sec)
		return -1;

	reloc_sec = elf_create_reloc_section(file->elf, sec, SHT_RELA);
	if (!reloc_sec)
		return -1;

	idx = 0;
	list_for_each_entry(insn, &file->static_call_list, static_call_node) {

		site = (struct static_call_site *)sec->data->d_buf + idx;
		memset(site, 0, sizeof(struct static_call_site));

		/* populate reloc for 'addr' */
		reloc = malloc(sizeof(*reloc));
469

470 471 472 473 474
		if (!reloc) {
			perror("malloc");
			return -1;
		}
		memset(reloc, 0, sizeof(*reloc));
475 476 477 478 479 480 481 482

		insn_to_reloc_sym_addend(insn->sec, insn->offset, reloc);
		if (!reloc->sym) {
			WARN_FUNC("static call tramp: missing containing symbol",
				  insn->sec, insn->offset);
			return -1;
		}

483 484 485 486 487 488 489 490 491 492 493 494 495 496 497 498 499 500 501 502 503 504 505 506 507 508 509 510 511 512 513 514 515 516
		reloc->type = R_X86_64_PC32;
		reloc->offset = idx * sizeof(struct static_call_site);
		reloc->sec = reloc_sec;
		elf_add_reloc(file->elf, reloc);

		/* find key symbol */
		key_name = strdup(insn->call_dest->name);
		if (!key_name) {
			perror("strdup");
			return -1;
		}
		if (strncmp(key_name, STATIC_CALL_TRAMP_PREFIX_STR,
			    STATIC_CALL_TRAMP_PREFIX_LEN)) {
			WARN("static_call: trampoline name malformed: %s", key_name);
			return -1;
		}
		tmp = key_name + STATIC_CALL_TRAMP_PREFIX_LEN - STATIC_CALL_KEY_PREFIX_LEN;
		memcpy(tmp, STATIC_CALL_KEY_PREFIX_STR, STATIC_CALL_KEY_PREFIX_LEN);

		key_sym = find_symbol_by_name(file->elf, tmp);
		if (!key_sym) {
			WARN("static_call: can't find static_call_key symbol: %s", tmp);
			return -1;
		}
		free(key_name);

		/* populate reloc for 'key' */
		reloc = malloc(sizeof(*reloc));
		if (!reloc) {
			perror("malloc");
			return -1;
		}
		memset(reloc, 0, sizeof(*reloc));
		reloc->sym = key_sym;
P
Peter Zijlstra 已提交
517
		reloc->addend = is_sibling_call(insn) ? STATIC_CALL_SITE_TAIL : 0;
518 519 520 521 522 523 524 525 526 527 528 529 530 531
		reloc->type = R_X86_64_PC32;
		reloc->offset = idx * sizeof(struct static_call_site) + 4;
		reloc->sec = reloc_sec;
		elf_add_reloc(file->elf, reloc);

		idx++;
	}

	if (elf_rebuild_reloc_section(file->elf, reloc_sec))
		return -1;

	return 0;
}

532 533 534 535 536 537 538 539
/*
 * Warnings shouldn't be reported for ignored functions.
 */
static void add_ignores(struct objtool_file *file)
{
	struct instruction *insn;
	struct section *sec;
	struct symbol *func;
M
Matt Helsley 已提交
540
	struct reloc *reloc;
541

P
Peter Zijlstra 已提交
542 543 544
	sec = find_section_by_name(file->elf, ".rela.discard.func_stack_frame_non_standard");
	if (!sec)
		return;
545

M
Matt Helsley 已提交
546 547
	list_for_each_entry(reloc, &sec->reloc_list, list) {
		switch (reloc->sym->type) {
P
Peter Zijlstra 已提交
548
		case STT_FUNC:
M
Matt Helsley 已提交
549
			func = reloc->sym;
P
Peter Zijlstra 已提交
550 551 552
			break;

		case STT_SECTION:
M
Matt Helsley 已提交
553
			func = find_func_by_offset(reloc->sym->sec, reloc->addend);
554
			if (!func)
555
				continue;
P
Peter Zijlstra 已提交
556
			break;
557

P
Peter Zijlstra 已提交
558
		default:
M
Matt Helsley 已提交
559
			WARN("unexpected relocation symbol type in %s: %d", sec->name, reloc->sym->type);
P
Peter Zijlstra 已提交
560
			continue;
561
		}
P
Peter Zijlstra 已提交
562

563
		func_for_each_insn(file, func, insn)
P
Peter Zijlstra 已提交
564
			insn->ignore = true;
565 566 567
	}
}

P
Peter Zijlstra 已提交
568 569 570 571 572 573 574 575 576 577 578 579 580 581 582 583 584 585 586 587 588 589 590 591
/*
 * This is a whitelist of functions that is allowed to be called with AC set.
 * The list is meant to be minimal and only contains compiler instrumentation
 * ABI and a few functions used to implement *_{to,from}_user() functions.
 *
 * These functions must not directly change AC, but may PUSHF/POPF.
 */
static const char *uaccess_safe_builtin[] = {
	/* KASAN */
	"kasan_report",
	"check_memory_region",
	/* KASAN out-of-line */
	"__asan_loadN_noabort",
	"__asan_load1_noabort",
	"__asan_load2_noabort",
	"__asan_load4_noabort",
	"__asan_load8_noabort",
	"__asan_load16_noabort",
	"__asan_storeN_noabort",
	"__asan_store1_noabort",
	"__asan_store2_noabort",
	"__asan_store4_noabort",
	"__asan_store8_noabort",
	"__asan_store16_noabort",
592 593
	"__kasan_check_read",
	"__kasan_check_write",
P
Peter Zijlstra 已提交
594 595 596 597 598 599 600 601 602 603 604 605 606
	/* KASAN in-line */
	"__asan_report_load_n_noabort",
	"__asan_report_load1_noabort",
	"__asan_report_load2_noabort",
	"__asan_report_load4_noabort",
	"__asan_report_load8_noabort",
	"__asan_report_load16_noabort",
	"__asan_report_store_n_noabort",
	"__asan_report_store1_noabort",
	"__asan_report_store2_noabort",
	"__asan_report_store4_noabort",
	"__asan_report_store8_noabort",
	"__asan_report_store16_noabort",
607
	/* KCSAN */
608
	"__kcsan_check_access",
609 610
	"kcsan_found_watchpoint",
	"kcsan_setup_watchpoint",
611
	"kcsan_check_scoped_accesses",
612 613
	"kcsan_disable_current",
	"kcsan_enable_current_nowarn",
614 615 616 617 618 619 620 621 622 623 624 625 626 627 628
	/* KCSAN/TSAN */
	"__tsan_func_entry",
	"__tsan_func_exit",
	"__tsan_read_range",
	"__tsan_write_range",
	"__tsan_read1",
	"__tsan_read2",
	"__tsan_read4",
	"__tsan_read8",
	"__tsan_read16",
	"__tsan_write1",
	"__tsan_write2",
	"__tsan_write4",
	"__tsan_write8",
	"__tsan_write16",
629 630 631 632 633
	"__tsan_read_write1",
	"__tsan_read_write2",
	"__tsan_read_write4",
	"__tsan_read_write8",
	"__tsan_read_write16",
634 635 636 637 638 639 640 641 642 643 644 645 646 647 648 649 650 651 652 653 654 655 656 657 658 659 660 661 662 663 664 665 666 667 668 669 670 671 672 673 674 675 676 677 678 679 680 681 682 683
	"__tsan_atomic8_load",
	"__tsan_atomic16_load",
	"__tsan_atomic32_load",
	"__tsan_atomic64_load",
	"__tsan_atomic8_store",
	"__tsan_atomic16_store",
	"__tsan_atomic32_store",
	"__tsan_atomic64_store",
	"__tsan_atomic8_exchange",
	"__tsan_atomic16_exchange",
	"__tsan_atomic32_exchange",
	"__tsan_atomic64_exchange",
	"__tsan_atomic8_fetch_add",
	"__tsan_atomic16_fetch_add",
	"__tsan_atomic32_fetch_add",
	"__tsan_atomic64_fetch_add",
	"__tsan_atomic8_fetch_sub",
	"__tsan_atomic16_fetch_sub",
	"__tsan_atomic32_fetch_sub",
	"__tsan_atomic64_fetch_sub",
	"__tsan_atomic8_fetch_and",
	"__tsan_atomic16_fetch_and",
	"__tsan_atomic32_fetch_and",
	"__tsan_atomic64_fetch_and",
	"__tsan_atomic8_fetch_or",
	"__tsan_atomic16_fetch_or",
	"__tsan_atomic32_fetch_or",
	"__tsan_atomic64_fetch_or",
	"__tsan_atomic8_fetch_xor",
	"__tsan_atomic16_fetch_xor",
	"__tsan_atomic32_fetch_xor",
	"__tsan_atomic64_fetch_xor",
	"__tsan_atomic8_fetch_nand",
	"__tsan_atomic16_fetch_nand",
	"__tsan_atomic32_fetch_nand",
	"__tsan_atomic64_fetch_nand",
	"__tsan_atomic8_compare_exchange_strong",
	"__tsan_atomic16_compare_exchange_strong",
	"__tsan_atomic32_compare_exchange_strong",
	"__tsan_atomic64_compare_exchange_strong",
	"__tsan_atomic8_compare_exchange_weak",
	"__tsan_atomic16_compare_exchange_weak",
	"__tsan_atomic32_compare_exchange_weak",
	"__tsan_atomic64_compare_exchange_weak",
	"__tsan_atomic8_compare_exchange_val",
	"__tsan_atomic16_compare_exchange_val",
	"__tsan_atomic32_compare_exchange_val",
	"__tsan_atomic64_compare_exchange_val",
	"__tsan_atomic_thread_fence",
	"__tsan_atomic_signal_fence",
P
Peter Zijlstra 已提交
684 685
	/* KCOV */
	"write_comp_data",
686
	"check_kcov_mode",
P
Peter Zijlstra 已提交
687 688 689 690 691 692 693 694 695
	"__sanitizer_cov_trace_pc",
	"__sanitizer_cov_trace_const_cmp1",
	"__sanitizer_cov_trace_const_cmp2",
	"__sanitizer_cov_trace_const_cmp4",
	"__sanitizer_cov_trace_const_cmp8",
	"__sanitizer_cov_trace_cmp1",
	"__sanitizer_cov_trace_cmp2",
	"__sanitizer_cov_trace_cmp4",
	"__sanitizer_cov_trace_cmp8",
696
	"__sanitizer_cov_trace_switch",
P
Peter Zijlstra 已提交
697 698 699 700
	/* UBSAN */
	"ubsan_type_mismatch_common",
	"__ubsan_handle_type_mismatch",
	"__ubsan_handle_type_mismatch_v1",
701
	"__ubsan_handle_shift_out_of_bounds",
P
Peter Zijlstra 已提交
702 703
	/* misc */
	"csum_partial_copy_generic",
704 705
	"copy_mc_fragile",
	"copy_mc_fragile_handle_tail",
706
	"copy_mc_enhanced_fast_string",
P
Peter Zijlstra 已提交
707 708 709 710 711 712 713 714 715 716 717 718 719 720 721 722 723
	"ftrace_likely_update", /* CONFIG_TRACE_BRANCH_PROFILING */
	NULL
};

static void add_uaccess_safe(struct objtool_file *file)
{
	struct symbol *func;
	const char **name;

	if (!uaccess)
		return;

	for (name = uaccess_safe_builtin; *name; name++) {
		func = find_symbol_by_name(file->elf, *name);
		if (!func)
			continue;

724
		func->uaccess_safe = true;
725 726 727
	}
}

728 729 730 731 732 733
/*
 * FIXME: For now, just ignore any alternatives which add retpolines.  This is
 * a temporary hack, as it doesn't allow ORC to unwind from inside a retpoline.
 * But it at least allows objtool to understand the control flow *around* the
 * retpoline.
 */
734
static int add_ignore_alternatives(struct objtool_file *file)
735 736
{
	struct section *sec;
M
Matt Helsley 已提交
737
	struct reloc *reloc;
738 739
	struct instruction *insn;

740
	sec = find_section_by_name(file->elf, ".rela.discard.ignore_alts");
741 742 743
	if (!sec)
		return 0;

M
Matt Helsley 已提交
744 745
	list_for_each_entry(reloc, &sec->reloc_list, list) {
		if (reloc->sym->type != STT_SECTION) {
746 747 748 749
			WARN("unexpected relocation symbol type in %s", sec->name);
			return -1;
		}

M
Matt Helsley 已提交
750
		insn = find_insn(file, reloc->sym->sec, reloc->addend);
751
		if (!insn) {
752
			WARN("bad .discard.ignore_alts entry");
753 754 755 756 757 758 759 760 761
			return -1;
		}

		insn->ignore_alts = true;
	}

	return 0;
}

762 763 764 765 766 767
/*
 * Find the destination instructions for all jumps.
 */
static int add_jump_destinations(struct objtool_file *file)
{
	struct instruction *insn;
M
Matt Helsley 已提交
768
	struct reloc *reloc;
769 770 771 772
	struct section *dest_sec;
	unsigned long dest_off;

	for_each_insn(file, insn) {
773
		if (!is_static_jump(insn))
774 775
			continue;

M
Matt Helsley 已提交
776
		reloc = find_reloc_by_dest_range(file->elf, insn->sec,
777
					       insn->offset, insn->len);
M
Matt Helsley 已提交
778
		if (!reloc) {
779
			dest_sec = insn->sec;
780
			dest_off = arch_jump_destination(insn);
M
Matt Helsley 已提交
781 782 783
		} else if (reloc->sym->type == STT_SECTION) {
			dest_sec = reloc->sym->sec;
			dest_off = arch_dest_reloc_offset(reloc->addend);
784 785
		} else if (!strncmp(reloc->sym->name, "__x86_indirect_thunk_", 21) ||
			   !strncmp(reloc->sym->name, "__x86_retpoline_", 16)) {
786 787 788 789
			/*
			 * Retpoline jumps are really dynamic jumps in
			 * disguise, so convert them accordingly.
			 */
790 791 792 793 794
			if (insn->type == INSN_JUMP_UNCONDITIONAL)
				insn->type = INSN_JUMP_DYNAMIC;
			else
				insn->type = INSN_JUMP_DYNAMIC_CONDITIONAL;

795
			insn->retpoline_safe = true;
796
			continue;
797 798 799 800
		} else if (reloc->sym->sec->idx) {
			dest_sec = reloc->sym->sec;
			dest_off = reloc->sym->sym.st_value +
				   arch_dest_reloc_offset(reloc->addend);
801
		} else {
802
			/* external sibling call */
M
Matt Helsley 已提交
803
			insn->call_dest = reloc->sym;
P
Peter Zijlstra 已提交
804 805 806 807
			if (insn->call_dest->static_call_tramp) {
				list_add_tail(&insn->static_call_node,
					      &file->static_call_list);
			}
808 809 810 811 812 813 814 815 816 817 818 819 820 821 822 823 824 825 826
			continue;
		}

		insn->jump_dest = find_insn(file, dest_sec, dest_off);
		if (!insn->jump_dest) {

			/*
			 * This is a special case where an alt instruction
			 * jumps past the end of the section.  These are
			 * handled later in handle_group_alt().
			 */
			if (!strcmp(insn->sec->name, ".altinstr_replacement"))
				continue;

			WARN_FUNC("can't find jump dest instruction at %s+0x%lx",
				  insn->sec, insn->offset, dest_sec->name,
				  dest_off);
			return -1;
		}
827 828

		/*
829
		 * Cross-function jump.
830 831
		 */
		if (insn->func && insn->jump_dest->func &&
832 833 834 835 836 837 838 839 840 841 842 843 844 845 846
		    insn->func != insn->jump_dest->func) {

			/*
			 * For GCC 8+, create parent/child links for any cold
			 * subfunctions.  This is _mostly_ redundant with a
			 * similar initialization in read_symbols().
			 *
			 * If a function has aliases, we want the *first* such
			 * function in the symbol table to be the subfunction's
			 * parent.  In that case we overwrite the
			 * initialization done in read_symbols().
			 *
			 * However this code can't completely replace the
			 * read_symbols() code because this doesn't detect the
			 * case where the parent function's only reference to a
847
			 * subfunction is through a jump table.
848
			 */
849 850
			if (!strstr(insn->func->name, ".cold") &&
			    strstr(insn->jump_dest->func->name, ".cold")) {
851 852 853 854 855 856
				insn->func->cfunc = insn->jump_dest->func;
				insn->jump_dest->func->pfunc = insn->func;

			} else if (insn->jump_dest->func->pfunc != insn->func->pfunc &&
				   insn->jump_dest->offset == insn->jump_dest->func->offset) {

857
				/* internal sibling call */
858
				insn->call_dest = insn->jump_dest->func;
P
Peter Zijlstra 已提交
859 860 861 862
				if (insn->call_dest->static_call_tramp) {
					list_add_tail(&insn->static_call_node,
						      &file->static_call_list);
				}
863
			}
864
		}
865 866 867 868 869
	}

	return 0;
}

870 871 872 873 874 875 876 877 878 879
static void remove_insn_ops(struct instruction *insn)
{
	struct stack_op *op, *tmp;

	list_for_each_entry_safe(op, tmp, &insn->stack_ops, list) {
		list_del(&op->list);
		free(op);
	}
}

880 881 882 883 884 885 886 887 888 889 890
static struct symbol *find_call_destination(struct section *sec, unsigned long offset)
{
	struct symbol *call_dest;

	call_dest = find_func_by_offset(sec, offset);
	if (!call_dest)
		call_dest = find_symbol_by_offset(sec, offset);

	return call_dest;
}

891 892 893 894 895 896 897
/*
 * Find the destination instructions for all calls.
 */
static int add_call_destinations(struct objtool_file *file)
{
	struct instruction *insn;
	unsigned long dest_off;
M
Matt Helsley 已提交
898
	struct reloc *reloc;
899 900 901 902 903

	for_each_insn(file, insn) {
		if (insn->type != INSN_CALL)
			continue;

M
Matt Helsley 已提交
904
		reloc = find_reloc_by_dest_range(file->elf, insn->sec,
905
					       insn->offset, insn->len);
M
Matt Helsley 已提交
906
		if (!reloc) {
907
			dest_off = arch_jump_destination(insn);
908
			insn->call_dest = find_call_destination(insn->sec, dest_off);
909

910 911 912 913
			if (insn->ignore)
				continue;

			if (!insn->call_dest) {
914
				WARN_FUNC("unannotated intra-function call", insn->sec, insn->offset);
915 916
				return -1;
			}
917

918 919 920 921 922 923
			if (insn->func && insn->call_dest->type != STT_FUNC) {
				WARN_FUNC("unsupported call to non-function",
					  insn->sec, insn->offset);
				return -1;
			}

M
Matt Helsley 已提交
924 925
		} else if (reloc->sym->type == STT_SECTION) {
			dest_off = arch_dest_reloc_offset(reloc->addend);
926 927
			insn->call_dest = find_call_destination(reloc->sym->sec,
								dest_off);
928
			if (!insn->call_dest) {
929
				WARN_FUNC("can't find call dest symbol at %s+0x%lx",
930
					  insn->sec, insn->offset,
M
Matt Helsley 已提交
931
					  reloc->sym->sec->name,
932
					  dest_off);
933 934 935
				return -1;
			}
		} else
M
Matt Helsley 已提交
936
			insn->call_dest = reloc->sym;
937

P
Peter Zijlstra 已提交
938 939 940 941 942 943 944
		/*
		 * Many compilers cannot disable KCOV with a function attribute
		 * so they need a little help, NOP out any KCOV calls from noinstr
		 * text.
		 */
		if (insn->sec->noinstr &&
		    !strncmp(insn->call_dest->name, "__sanitizer_cov_", 16)) {
945 946 947
			if (reloc) {
				reloc->type = R_NONE;
				elf_write_reloc(file->elf, reloc);
P
Peter Zijlstra 已提交
948 949 950 951 952 953 954 955
			}

			elf_write_insn(file->elf, insn->sec,
				       insn->offset, insn->len,
				       arch_nop_insn(insn->len));
			insn->type = INSN_NOP;
		}

956 957 958 959 960 961 962 963
		/*
		 * Whatever stack impact regular CALLs have, should be undone
		 * by the RETURN of the called function.
		 *
		 * Annotated intra-function calls retain the stack_ops but
		 * are converted to JUMP, see read_intra_function_calls().
		 */
		remove_insn_ops(insn);
964 965 966 967 968 969
	}

	return 0;
}

/*
970 971
 * The .alternatives section requires some extra special care over and above
 * other special sections because alternatives are patched in place.
972 973 974 975 976 977
 */
static int handle_group_alt(struct objtool_file *file,
			    struct special_alt *special_alt,
			    struct instruction *orig_insn,
			    struct instruction **new_insn)
{
978
	struct instruction *last_orig_insn, *last_new_insn = NULL, *insn, *nop = NULL;
J
Josh Poimboeuf 已提交
979
	struct alt_group *orig_alt_group, *new_alt_group;
980 981
	unsigned long dest_off;

J
Josh Poimboeuf 已提交
982 983 984 985 986 987

	orig_alt_group = malloc(sizeof(*orig_alt_group));
	if (!orig_alt_group) {
		WARN("malloc failed");
		return -1;
	}
988 989 990 991 992 993 994
	orig_alt_group->cfi = calloc(special_alt->orig_len,
				     sizeof(struct cfi_state *));
	if (!orig_alt_group->cfi) {
		WARN("calloc failed");
		return -1;
	}

995 996 997 998 999 1000
	last_orig_insn = NULL;
	insn = orig_insn;
	sec_for_each_insn_from(file, insn) {
		if (insn->offset >= special_alt->orig_off + special_alt->orig_len)
			break;

J
Josh Poimboeuf 已提交
1001
		insn->alt_group = orig_alt_group;
1002 1003
		last_orig_insn = insn;
	}
J
Josh Poimboeuf 已提交
1004 1005 1006
	orig_alt_group->orig_group = NULL;
	orig_alt_group->first_insn = orig_insn;
	orig_alt_group->last_insn = last_orig_insn;
1007

1008

1009 1010 1011 1012
	new_alt_group = malloc(sizeof(*new_alt_group));
	if (!new_alt_group) {
		WARN("malloc failed");
		return -1;
1013 1014
	}

1015 1016 1017 1018 1019 1020 1021 1022 1023 1024 1025
	if (special_alt->new_len < special_alt->orig_len) {
		/*
		 * Insert a fake nop at the end to make the replacement
		 * alt_group the same size as the original.  This is needed to
		 * allow propagate_alt_cfi() to do its magic.  When the last
		 * instruction affects the stack, the instruction after it (the
		 * nop) will propagate the new state to the shared CFI array.
		 */
		nop = malloc(sizeof(*nop));
		if (!nop) {
			WARN("malloc failed");
1026 1027
			return -1;
		}
1028 1029 1030 1031 1032 1033 1034 1035 1036 1037 1038 1039
		memset(nop, 0, sizeof(*nop));
		INIT_LIST_HEAD(&nop->alts);
		INIT_LIST_HEAD(&nop->stack_ops);
		init_cfi_state(&nop->cfi);

		nop->sec = special_alt->new_sec;
		nop->offset = special_alt->new_off + special_alt->new_len;
		nop->len = special_alt->orig_len - special_alt->new_len;
		nop->type = INSN_NOP;
		nop->func = orig_insn->func;
		nop->alt_group = new_alt_group;
		nop->ignore = orig_insn->ignore_alts;
1040 1041
	}

1042 1043 1044
	if (!special_alt->new_len) {
		*new_insn = nop;
		goto end;
J
Josh Poimboeuf 已提交
1045 1046
	}

1047 1048
	insn = *new_insn;
	sec_for_each_insn_from(file, insn) {
1049 1050
		struct reloc *alt_reloc;

1051 1052 1053 1054 1055
		if (insn->offset >= special_alt->new_off + special_alt->new_len)
			break;

		last_new_insn = insn;

1056
		insn->ignore = orig_insn->ignore_alts;
1057
		insn->func = orig_insn->func;
J
Josh Poimboeuf 已提交
1058
		insn->alt_group = new_alt_group;
1059

1060 1061 1062 1063 1064 1065 1066 1067
		/*
		 * Since alternative replacement code is copy/pasted by the
		 * kernel after applying relocations, generally such code can't
		 * have relative-address relocation references to outside the
		 * .altinstr_replacement section, unless the arch's
		 * alternatives code can adjust the relative offsets
		 * accordingly.
		 */
1068 1069 1070 1071
		alt_reloc = find_reloc_by_dest_range(file->elf, insn->sec,
						   insn->offset, insn->len);
		if (alt_reloc &&
		    !arch_support_alt_relocation(special_alt, insn, alt_reloc)) {
1072 1073 1074 1075 1076 1077

			WARN_FUNC("unsupported relocation in alternatives section",
				  insn->sec, insn->offset);
			return -1;
		}

1078
		if (!is_static_jump(insn))
1079 1080 1081 1082 1083
			continue;

		if (!insn->immediate)
			continue;

1084
		dest_off = arch_jump_destination(insn);
1085 1086
		if (dest_off == special_alt->new_off + special_alt->new_len)
			insn->jump_dest = next_insn_same_sec(file, last_orig_insn);
1087 1088 1089 1090 1091 1092 1093 1094 1095 1096 1097 1098 1099 1100

		if (!insn->jump_dest) {
			WARN_FUNC("can't find alternative jump destination",
				  insn->sec, insn->offset);
			return -1;
		}
	}

	if (!last_new_insn) {
		WARN_FUNC("can't find last new alternative instruction",
			  special_alt->new_sec, special_alt->new_off);
		return -1;
	}

1101 1102 1103
	if (nop)
		list_add(&nop->list, &last_new_insn->list);
end:
J
Josh Poimboeuf 已提交
1104 1105
	new_alt_group->orig_group = orig_alt_group;
	new_alt_group->first_insn = *new_insn;
1106 1107
	new_alt_group->last_insn = nop ? : last_new_insn;
	new_alt_group->cfi = orig_alt_group->cfi;
1108 1109 1110 1111 1112 1113 1114 1115 1116 1117 1118 1119 1120 1121 1122 1123 1124 1125 1126 1127 1128 1129 1130 1131 1132 1133 1134 1135 1136 1137 1138 1139 1140 1141 1142 1143 1144 1145 1146 1147 1148 1149 1150 1151 1152 1153 1154 1155 1156 1157 1158 1159 1160 1161 1162 1163 1164 1165 1166 1167 1168 1169 1170 1171 1172 1173 1174 1175 1176
	return 0;
}

/*
 * A jump table entry can either convert a nop to a jump or a jump to a nop.
 * If the original instruction is a jump, make the alt entry an effective nop
 * by just skipping the original instruction.
 */
static int handle_jump_alt(struct objtool_file *file,
			   struct special_alt *special_alt,
			   struct instruction *orig_insn,
			   struct instruction **new_insn)
{
	if (orig_insn->type == INSN_NOP)
		return 0;

	if (orig_insn->type != INSN_JUMP_UNCONDITIONAL) {
		WARN_FUNC("unsupported instruction at jump label",
			  orig_insn->sec, orig_insn->offset);
		return -1;
	}

	*new_insn = list_next_entry(orig_insn, list);
	return 0;
}

/*
 * Read all the special sections which have alternate instructions which can be
 * patched in or redirected to at runtime.  Each instruction having alternate
 * instruction(s) has them added to its insn->alts list, which will be
 * traversed in validate_branch().
 */
static int add_special_section_alts(struct objtool_file *file)
{
	struct list_head special_alts;
	struct instruction *orig_insn, *new_insn;
	struct special_alt *special_alt, *tmp;
	struct alternative *alt;
	int ret;

	ret = special_get_alts(file->elf, &special_alts);
	if (ret)
		return ret;

	list_for_each_entry_safe(special_alt, tmp, &special_alts, list) {

		orig_insn = find_insn(file, special_alt->orig_sec,
				      special_alt->orig_off);
		if (!orig_insn) {
			WARN_FUNC("special: can't find orig instruction",
				  special_alt->orig_sec, special_alt->orig_off);
			ret = -1;
			goto out;
		}

		new_insn = NULL;
		if (!special_alt->group || special_alt->new_len) {
			new_insn = find_insn(file, special_alt->new_sec,
					     special_alt->new_off);
			if (!new_insn) {
				WARN_FUNC("special: can't find new instruction",
					  special_alt->new_sec,
					  special_alt->new_off);
				ret = -1;
				goto out;
			}
		}

		if (special_alt->group) {
1177 1178 1179 1180 1181 1182
			if (!special_alt->orig_len) {
				WARN_FUNC("empty alternative entry",
					  orig_insn->sec, orig_insn->offset);
				continue;
			}

1183 1184 1185 1186 1187 1188 1189 1190 1191 1192 1193
			ret = handle_group_alt(file, special_alt, orig_insn,
					       &new_insn);
			if (ret)
				goto out;
		} else if (special_alt->jump_or_nop) {
			ret = handle_jump_alt(file, special_alt, orig_insn,
					      &new_insn);
			if (ret)
				goto out;
		}

1194 1195 1196 1197 1198 1199 1200
		alt = malloc(sizeof(*alt));
		if (!alt) {
			WARN("malloc failed");
			ret = -1;
			goto out;
		}

1201
		alt->insn = new_insn;
P
Peter Zijlstra 已提交
1202
		alt->skip_orig = special_alt->skip_orig;
P
Peter Zijlstra 已提交
1203
		orig_insn->ignore_alts |= special_alt->skip_alt;
1204 1205 1206 1207 1208 1209 1210 1211 1212 1213
		list_add_tail(&alt->list, &orig_insn->alts);

		list_del(&special_alt->list);
		free(special_alt);
	}

out:
	return ret;
}

1214
static int add_jump_table(struct objtool_file *file, struct instruction *insn,
M
Matt Helsley 已提交
1215
			    struct reloc *table)
1216
{
M
Matt Helsley 已提交
1217
	struct reloc *reloc = table;
1218
	struct instruction *dest_insn;
1219
	struct alternative *alt;
1220 1221
	struct symbol *pfunc = insn->func->pfunc;
	unsigned int prev_offset = 0;
1222

1223
	/*
M
Matt Helsley 已提交
1224
	 * Each @reloc is a switch table relocation which points to the target
1225 1226
	 * instruction.
	 */
M
Matt Helsley 已提交
1227
	list_for_each_entry_from(reloc, &table->sec->reloc_list, list) {
1228 1229

		/* Check for the end of the table: */
M
Matt Helsley 已提交
1230
		if (reloc != table && reloc->jump_table_start)
1231 1232
			break;

1233
		/* Make sure the table entries are consecutive: */
M
Matt Helsley 已提交
1234
		if (prev_offset && reloc->offset != prev_offset + 8)
1235 1236 1237
			break;

		/* Detect function pointers from contiguous objects: */
M
Matt Helsley 已提交
1238 1239
		if (reloc->sym->sec == pfunc->sec &&
		    reloc->addend == pfunc->offset)
1240 1241
			break;

M
Matt Helsley 已提交
1242
		dest_insn = find_insn(file, reloc->sym->sec, reloc->addend);
1243
		if (!dest_insn)
1244 1245
			break;

1246
		/* Make sure the destination is in the same function: */
1247
		if (!dest_insn->func || dest_insn->func->pfunc != pfunc)
1248
			break;
1249 1250 1251 1252 1253 1254 1255

		alt = malloc(sizeof(*alt));
		if (!alt) {
			WARN("malloc failed");
			return -1;
		}

1256
		alt->insn = dest_insn;
1257
		list_add_tail(&alt->list, &insn->alts);
M
Matt Helsley 已提交
1258
		prev_offset = reloc->offset;
1259 1260 1261 1262 1263 1264
	}

	if (!prev_offset) {
		WARN_FUNC("can't find switch jump table",
			  insn->sec, insn->offset);
		return -1;
1265 1266 1267 1268 1269 1270
	}

	return 0;
}

/*
1271 1272
 * find_jump_table() - Given a dynamic jump, find the switch jump table
 * associated with it.
1273
 */
M
Matt Helsley 已提交
1274
static struct reloc *find_jump_table(struct objtool_file *file,
1275 1276 1277
				      struct symbol *func,
				      struct instruction *insn)
{
1278
	struct reloc *table_reloc;
1279
	struct instruction *dest_insn, *orig_insn = insn;
1280

1281 1282 1283 1284 1285
	/*
	 * Backward search using the @first_jump_src links, these help avoid
	 * much of the 'in between' code. Which avoids us getting confused by
	 * it.
	 */
1286
	for (;
1287 1288
	     insn && insn->func && insn->func->pfunc == func;
	     insn = insn->first_jump_src ?: prev_insn_same_sym(file, insn)) {
1289

1290
		if (insn != orig_insn && insn->type == INSN_JUMP_DYNAMIC)
1291 1292 1293 1294 1295 1296 1297 1298 1299
			break;

		/* allow small jumps within the range */
		if (insn->type == INSN_JUMP_UNCONDITIONAL &&
		    insn->jump_dest &&
		    (insn->jump_dest->offset <= insn->offset ||
		     insn->jump_dest->offset > orig_insn->offset))
		    break;

1300
		table_reloc = arch_find_switch_table(file, insn);
M
Matt Helsley 已提交
1301
		if (!table_reloc)
1302
			continue;
M
Matt Helsley 已提交
1303
		dest_insn = find_insn(file, table_reloc->sym->sec, table_reloc->addend);
1304 1305
		if (!dest_insn || !dest_insn->func || dest_insn->func->pfunc != func)
			continue;
1306

M
Matt Helsley 已提交
1307
		return table_reloc;
1308 1309 1310 1311 1312
	}

	return NULL;
}

1313 1314 1315 1316 1317 1318
/*
 * First pass: Mark the head of each jump table so that in the next pass,
 * we know when a given jump table ends and the next one starts.
 */
static void mark_func_jump_tables(struct objtool_file *file,
				    struct symbol *func)
1319
{
1320
	struct instruction *insn, *last = NULL;
M
Matt Helsley 已提交
1321
	struct reloc *reloc;
1322

1323
	func_for_each_insn(file, func, insn) {
1324 1325 1326 1327 1328
		if (!last)
			last = insn;

		/*
		 * Store back-pointers for unconditional forward jumps such
1329
		 * that find_jump_table() can back-track using those and
1330 1331 1332 1333 1334 1335 1336 1337 1338 1339 1340
		 * avoid some potentially confusing code.
		 */
		if (insn->type == INSN_JUMP_UNCONDITIONAL && insn->jump_dest &&
		    insn->offset > last->offset &&
		    insn->jump_dest->offset > insn->offset &&
		    !insn->jump_dest->first_jump_src) {

			insn->jump_dest->first_jump_src = insn;
			last = insn->jump_dest;
		}

1341 1342 1343
		if (insn->type != INSN_JUMP_DYNAMIC)
			continue;

M
Matt Helsley 已提交
1344 1345 1346 1347
		reloc = find_jump_table(file, func, insn);
		if (reloc) {
			reloc->jump_table_start = true;
			insn->jump_table = reloc;
1348 1349
		}
	}
1350 1351 1352 1353 1354 1355 1356 1357
}

static int add_func_jump_tables(struct objtool_file *file,
				  struct symbol *func)
{
	struct instruction *insn;
	int ret;

1358
	func_for_each_insn(file, func, insn) {
1359 1360
		if (!insn->jump_table)
			continue;
1361

1362
		ret = add_jump_table(file, insn, insn->jump_table);
1363 1364 1365 1366 1367 1368 1369 1370 1371 1372 1373 1374
		if (ret)
			return ret;
	}

	return 0;
}

/*
 * For some switch statements, gcc generates a jump table in the .rodata
 * section which contains a list of addresses within the function to jump to.
 * This finds these jump tables and adds them to the insn->alts lists.
 */
1375
static int add_jump_table_alts(struct objtool_file *file)
1376 1377 1378 1379 1380
{
	struct section *sec;
	struct symbol *func;
	int ret;

1381
	if (!file->rodata)
1382 1383
		return 0;

1384
	for_each_sec(file, sec) {
1385 1386 1387 1388
		list_for_each_entry(func, &sec->symbol_list, list) {
			if (func->type != STT_FUNC)
				continue;

1389
			mark_func_jump_tables(file, func);
1390
			ret = add_func_jump_tables(file, func);
1391 1392 1393 1394 1395 1396 1397 1398
			if (ret)
				return ret;
		}
	}

	return 0;
}

1399 1400
static int read_unwind_hints(struct objtool_file *file)
{
M
Matt Helsley 已提交
1401 1402
	struct section *sec, *relocsec;
	struct reloc *reloc;
1403 1404 1405 1406 1407 1408 1409 1410 1411
	struct unwind_hint *hint;
	struct instruction *insn;
	struct cfi_reg *cfa;
	int i;

	sec = find_section_by_name(file->elf, ".discard.unwind_hints");
	if (!sec)
		return 0;

M
Matt Helsley 已提交
1412 1413
	relocsec = sec->reloc;
	if (!relocsec) {
1414 1415 1416 1417 1418 1419 1420 1421 1422 1423 1424 1425 1426 1427
		WARN("missing .rela.discard.unwind_hints section");
		return -1;
	}

	if (sec->len % sizeof(struct unwind_hint)) {
		WARN("struct unwind_hint size mismatch");
		return -1;
	}

	file->hints = true;

	for (i = 0; i < sec->len / sizeof(struct unwind_hint); i++) {
		hint = (struct unwind_hint *)sec->data->d_buf + i;

M
Matt Helsley 已提交
1428 1429 1430
		reloc = find_reloc_by_dest(file->elf, sec, i * sizeof(*hint));
		if (!reloc) {
			WARN("can't find reloc for unwind_hints[%d]", i);
1431 1432 1433
			return -1;
		}

M
Matt Helsley 已提交
1434
		insn = find_insn(file, reloc->sym->sec, reloc->addend);
1435 1436 1437 1438 1439
		if (!insn) {
			WARN("can't find insn for unwind_hints[%d]", i);
			return -1;
		}

1440
		cfa = &insn->cfi.cfa;
1441

1442
		if (hint->type == UNWIND_HINT_TYPE_RET_OFFSET) {
1443
			insn->ret_offset = bswap_if_needed(hint->sp_offset);
1444 1445 1446 1447 1448
			continue;
		}

		insn->hint = true;

1449
		if (arch_decode_hint_reg(insn, hint->sp_reg)) {
1450 1451 1452 1453 1454
			WARN_FUNC("unsupported unwind_hint sp base reg %d",
				  insn->sec, insn->offset, hint->sp_reg);
			return -1;
		}

1455
		cfa->offset = bswap_if_needed(hint->sp_offset);
1456 1457
		insn->cfi.type = hint->type;
		insn->cfi.end = hint->end;
1458 1459 1460 1461 1462
	}

	return 0;
}

1463 1464
static int read_retpoline_hints(struct objtool_file *file)
{
J
Josh Poimboeuf 已提交
1465
	struct section *sec;
1466
	struct instruction *insn;
M
Matt Helsley 已提交
1467
	struct reloc *reloc;
1468

J
Josh Poimboeuf 已提交
1469
	sec = find_section_by_name(file->elf, ".rela.discard.retpoline_safe");
1470 1471 1472
	if (!sec)
		return 0;

M
Matt Helsley 已提交
1473 1474
	list_for_each_entry(reloc, &sec->reloc_list, list) {
		if (reloc->sym->type != STT_SECTION) {
J
Josh Poimboeuf 已提交
1475
			WARN("unexpected relocation symbol type in %s", sec->name);
1476 1477 1478
			return -1;
		}

M
Matt Helsley 已提交
1479
		insn = find_insn(file, reloc->sym->sec, reloc->addend);
1480
		if (!insn) {
J
Josh Poimboeuf 已提交
1481
			WARN("bad .discard.retpoline_safe entry");
1482 1483 1484 1485 1486
			return -1;
		}

		if (insn->type != INSN_JUMP_DYNAMIC &&
		    insn->type != INSN_CALL_DYNAMIC) {
J
Josh Poimboeuf 已提交
1487
			WARN_FUNC("retpoline_safe hint not an indirect jump/call",
1488 1489 1490 1491 1492 1493 1494 1495 1496 1497
				  insn->sec, insn->offset);
			return -1;
		}

		insn->retpoline_safe = true;
	}

	return 0;
}

1498 1499 1500 1501
static int read_instr_hints(struct objtool_file *file)
{
	struct section *sec;
	struct instruction *insn;
M
Matt Helsley 已提交
1502
	struct reloc *reloc;
1503 1504 1505 1506 1507

	sec = find_section_by_name(file->elf, ".rela.discard.instr_end");
	if (!sec)
		return 0;

M
Matt Helsley 已提交
1508 1509
	list_for_each_entry(reloc, &sec->reloc_list, list) {
		if (reloc->sym->type != STT_SECTION) {
1510 1511 1512 1513
			WARN("unexpected relocation symbol type in %s", sec->name);
			return -1;
		}

M
Matt Helsley 已提交
1514
		insn = find_insn(file, reloc->sym->sec, reloc->addend);
1515 1516 1517 1518 1519 1520 1521 1522 1523 1524 1525 1526
		if (!insn) {
			WARN("bad .discard.instr_end entry");
			return -1;
		}

		insn->instr--;
	}

	sec = find_section_by_name(file->elf, ".rela.discard.instr_begin");
	if (!sec)
		return 0;

M
Matt Helsley 已提交
1527 1528
	list_for_each_entry(reloc, &sec->reloc_list, list) {
		if (reloc->sym->type != STT_SECTION) {
1529 1530 1531 1532
			WARN("unexpected relocation symbol type in %s", sec->name);
			return -1;
		}

M
Matt Helsley 已提交
1533
		insn = find_insn(file, reloc->sym->sec, reloc->addend);
1534 1535 1536 1537 1538 1539 1540 1541 1542 1543 1544
		if (!insn) {
			WARN("bad .discard.instr_begin entry");
			return -1;
		}

		insn->instr++;
	}

	return 0;
}

1545 1546 1547 1548
static int read_intra_function_calls(struct objtool_file *file)
{
	struct instruction *insn;
	struct section *sec;
M
Matt Helsley 已提交
1549
	struct reloc *reloc;
1550 1551 1552 1553 1554

	sec = find_section_by_name(file->elf, ".rela.discard.intra_function_calls");
	if (!sec)
		return 0;

M
Matt Helsley 已提交
1555
	list_for_each_entry(reloc, &sec->reloc_list, list) {
1556 1557
		unsigned long dest_off;

M
Matt Helsley 已提交
1558
		if (reloc->sym->type != STT_SECTION) {
1559 1560 1561 1562 1563
			WARN("unexpected relocation symbol type in %s",
			     sec->name);
			return -1;
		}

M
Matt Helsley 已提交
1564
		insn = find_insn(file, reloc->sym->sec, reloc->addend);
1565 1566 1567 1568 1569 1570 1571 1572 1573 1574 1575 1576 1577 1578 1579 1580 1581 1582 1583 1584 1585 1586 1587 1588 1589 1590 1591 1592 1593 1594 1595
		if (!insn) {
			WARN("bad .discard.intra_function_call entry");
			return -1;
		}

		if (insn->type != INSN_CALL) {
			WARN_FUNC("intra_function_call not a direct call",
				  insn->sec, insn->offset);
			return -1;
		}

		/*
		 * Treat intra-function CALLs as JMPs, but with a stack_op.
		 * See add_call_destinations(), which strips stack_ops from
		 * normal CALLs.
		 */
		insn->type = INSN_JUMP_UNCONDITIONAL;

		dest_off = insn->offset + insn->len + insn->immediate;
		insn->jump_dest = find_insn(file, insn->sec, dest_off);
		if (!insn->jump_dest) {
			WARN_FUNC("can't find call dest at %s+0x%lx",
				  insn->sec, insn->offset,
				  insn->sec->name, dest_off);
			return -1;
		}
	}

	return 0;
}

1596 1597 1598 1599 1600 1601 1602 1603 1604 1605 1606 1607 1608 1609 1610 1611 1612
static int read_static_call_tramps(struct objtool_file *file)
{
	struct section *sec;
	struct symbol *func;

	for_each_sec(file, sec) {
		list_for_each_entry(func, &sec->symbol_list, list) {
			if (func->bind == STB_GLOBAL &&
			    !strncmp(func->name, STATIC_CALL_TRAMP_PREFIX_STR,
				     strlen(STATIC_CALL_TRAMP_PREFIX_STR)))
				func->static_call_tramp = true;
		}
	}

	return 0;
}

1613 1614 1615 1616 1617 1618
static void mark_rodata(struct objtool_file *file)
{
	struct section *sec;
	bool found = false;

	/*
1619 1620 1621 1622 1623 1624 1625 1626
	 * Search for the following rodata sections, each of which can
	 * potentially contain jump tables:
	 *
	 * - .rodata: can contain GCC switch tables
	 * - .rodata.<func>: same, if -fdata-sections is being used
	 * - .rodata..c_jump_table: contains C annotated jump tables
	 *
	 * .rodata.str1.* sections are ignored; they don't contain jump tables.
1627 1628
	 */
	for_each_sec(file, sec) {
1629 1630
		if (!strncmp(sec->name, ".rodata", 7) &&
		    !strstr(sec->name, ".str1.")) {
1631 1632 1633 1634 1635 1636 1637 1638
			sec->rodata = true;
			found = true;
		}
	}

	file->rodata = found;
}

1639 1640 1641 1642
static int decode_sections(struct objtool_file *file)
{
	int ret;

1643 1644
	mark_rodata(file);

1645 1646 1647 1648 1649 1650 1651 1652 1653
	ret = decode_instructions(file);
	if (ret)
		return ret;

	ret = add_dead_ends(file);
	if (ret)
		return ret;

	add_ignores(file);
P
Peter Zijlstra 已提交
1654
	add_uaccess_safe(file);
1655

1656
	ret = add_ignore_alternatives(file);
1657 1658 1659
	if (ret)
		return ret;

P
Peter Zijlstra 已提交
1660 1661 1662 1663
	ret = read_static_call_tramps(file);
	if (ret)
		return ret;

1664 1665 1666 1667
	ret = add_jump_destinations(file);
	if (ret)
		return ret;

1668
	ret = add_special_section_alts(file);
1669 1670 1671
	if (ret)
		return ret;

1672 1673 1674 1675
	ret = read_intra_function_calls(file);
	if (ret)
		return ret;

1676
	ret = add_call_destinations(file);
1677 1678 1679
	if (ret)
		return ret;

1680
	ret = add_jump_table_alts(file);
1681 1682 1683
	if (ret)
		return ret;

1684 1685 1686 1687
	ret = read_unwind_hints(file);
	if (ret)
		return ret;

1688 1689 1690 1691
	ret = read_retpoline_hints(file);
	if (ret)
		return ret;

1692 1693 1694 1695
	ret = read_instr_hints(file);
	if (ret)
		return ret;

1696 1697 1698 1699 1700
	return 0;
}

static bool is_fentry_call(struct instruction *insn)
{
1701
	if (insn->type == INSN_CALL && insn->call_dest &&
1702 1703 1704 1705 1706 1707 1708
	    insn->call_dest->type == STT_NOTYPE &&
	    !strcmp(insn->call_dest->name, "__fentry__"))
		return true;

	return false;
}

1709
static bool has_modified_stack_frame(struct instruction *insn, struct insn_state *state)
1710
{
1711
	u8 ret_offset = insn->ret_offset;
1712
	struct cfi_state *cfi = &state->cfi;
1713 1714
	int i;

1715
	if (cfi->cfa.base != initial_func_cfi.cfa.base || cfi->drap)
1716 1717
		return true;

1718
	if (cfi->cfa.offset != initial_func_cfi.cfa.offset + ret_offset)
1719 1720
		return true;

1721
	if (cfi->stack_size != initial_func_cfi.cfa.offset + ret_offset)
1722 1723
		return true;

1724 1725 1726 1727 1728 1729 1730 1731
	/*
	 * If there is a ret offset hint then don't check registers
	 * because a callee-saved register might have been pushed on
	 * the stack.
	 */
	if (ret_offset)
		return false;

1732
	for (i = 0; i < CFI_NUM_REGS; i++) {
1733 1734
		if (cfi->regs[i].base != initial_func_cfi.regs[i].base ||
		    cfi->regs[i].offset != initial_func_cfi.regs[i].offset)
1735
			return true;
1736
	}
1737 1738 1739 1740

	return false;
}

1741 1742 1743 1744 1745 1746 1747
static bool check_reg_frame_pos(const struct cfi_reg *reg,
				int expected_offset)
{
	return reg->base == CFI_CFA &&
	       reg->offset == expected_offset;
}

1748 1749
static bool has_valid_stack_frame(struct insn_state *state)
{
1750 1751
	struct cfi_state *cfi = &state->cfi;

1752 1753 1754
	if (cfi->cfa.base == CFI_BP &&
	    check_reg_frame_pos(&cfi->regs[CFI_BP], -cfi->cfa.offset) &&
	    check_reg_frame_pos(&cfi->regs[CFI_RA], -cfi->cfa.offset + 8))
1755 1756
		return true;

1757
	if (cfi->drap && cfi->regs[CFI_BP].base == CFI_BP)
1758 1759 1760
		return true;

	return false;
1761 1762
}

1763 1764
static int update_cfi_state_regs(struct instruction *insn,
				  struct cfi_state *cfi,
1765
				  struct stack_op *op)
1766
{
1767
	struct cfi_reg *cfa = &cfi->cfa;
1768

1769
	if (cfa->base != CFI_SP && cfa->base != CFI_SP_INDIRECT)
1770 1771 1772
		return 0;

	/* push */
P
Peter Zijlstra 已提交
1773
	if (op->dest.type == OP_DEST_PUSH || op->dest.type == OP_DEST_PUSHF)
1774 1775 1776
		cfa->offset += 8;

	/* pop */
P
Peter Zijlstra 已提交
1777
	if (op->src.type == OP_SRC_POP || op->src.type == OP_SRC_POPF)
1778 1779 1780 1781 1782 1783 1784 1785 1786 1787
		cfa->offset -= 8;

	/* add immediate to sp */
	if (op->dest.type == OP_DEST_REG && op->src.type == OP_SRC_ADD &&
	    op->dest.reg == CFI_SP && op->src.reg == CFI_SP)
		cfa->offset -= op->src.offset;

	return 0;
}

1788
static void save_reg(struct cfi_state *cfi, unsigned char reg, int base, int offset)
1789
{
1790
	if (arch_callee_saved_reg(reg) &&
1791 1792 1793
	    cfi->regs[reg].base == CFI_UNDEFINED) {
		cfi->regs[reg].base = base;
		cfi->regs[reg].offset = offset;
1794
	}
1795 1796
}

1797
static void restore_reg(struct cfi_state *cfi, unsigned char reg)
1798
{
1799 1800
	cfi->regs[reg].base = initial_func_cfi.regs[reg].base;
	cfi->regs[reg].offset = initial_func_cfi.regs[reg].offset;
1801 1802 1803 1804 1805 1806 1807 1808 1809 1810 1811 1812 1813 1814 1815 1816 1817 1818 1819 1820 1821 1822 1823 1824 1825 1826 1827 1828 1829 1830 1831 1832 1833 1834 1835 1836 1837 1838 1839 1840 1841 1842 1843 1844 1845 1846 1847 1848 1849 1850 1851 1852 1853 1854 1855
}

/*
 * A note about DRAP stack alignment:
 *
 * GCC has the concept of a DRAP register, which is used to help keep track of
 * the stack pointer when aligning the stack.  r10 or r13 is used as the DRAP
 * register.  The typical DRAP pattern is:
 *
 *   4c 8d 54 24 08		lea    0x8(%rsp),%r10
 *   48 83 e4 c0		and    $0xffffffffffffffc0,%rsp
 *   41 ff 72 f8		pushq  -0x8(%r10)
 *   55				push   %rbp
 *   48 89 e5			mov    %rsp,%rbp
 *				(more pushes)
 *   41 52			push   %r10
 *				...
 *   41 5a			pop    %r10
 *				(more pops)
 *   5d				pop    %rbp
 *   49 8d 62 f8		lea    -0x8(%r10),%rsp
 *   c3				retq
 *
 * There are some variations in the epilogues, like:
 *
 *   5b				pop    %rbx
 *   41 5a			pop    %r10
 *   41 5c			pop    %r12
 *   41 5d			pop    %r13
 *   41 5e			pop    %r14
 *   c9				leaveq
 *   49 8d 62 f8		lea    -0x8(%r10),%rsp
 *   c3				retq
 *
 * and:
 *
 *   4c 8b 55 e8		mov    -0x18(%rbp),%r10
 *   48 8b 5d e0		mov    -0x20(%rbp),%rbx
 *   4c 8b 65 f0		mov    -0x10(%rbp),%r12
 *   4c 8b 6d f8		mov    -0x8(%rbp),%r13
 *   c9				leaveq
 *   49 8d 62 f8		lea    -0x8(%r10),%rsp
 *   c3				retq
 *
 * Sometimes r13 is used as the DRAP register, in which case it's saved and
 * restored beforehand:
 *
 *   41 55			push   %r13
 *   4c 8d 6c 24 10		lea    0x10(%rsp),%r13
 *   48 83 e4 f0		and    $0xfffffffffffffff0,%rsp
 *				...
 *   49 8d 65 f0		lea    -0x10(%r13),%rsp
 *   41 5d			pop    %r13
 *   c3				retq
 */
1856
static int update_cfi_state(struct instruction *insn, struct cfi_state *cfi,
1857
			     struct stack_op *op)
1858
{
1859 1860
	struct cfi_reg *cfa = &cfi->cfa;
	struct cfi_reg *regs = cfi->regs;
1861 1862 1863 1864 1865 1866 1867 1868 1869 1870

	/* stack operations don't make sense with an undefined CFA */
	if (cfa->base == CFI_UNDEFINED) {
		if (insn->func) {
			WARN_FUNC("undefined stack state", insn->sec, insn->offset);
			return -1;
		}
		return 0;
	}

1871 1872
	if (cfi->type == UNWIND_HINT_TYPE_REGS ||
	    cfi->type == UNWIND_HINT_TYPE_REGS_PARTIAL)
1873
		return update_cfi_state_regs(insn, cfi, op);
1874

1875 1876 1877 1878 1879 1880
	switch (op->dest.type) {

	case OP_DEST_REG:
		switch (op->src.type) {

		case OP_SRC_REG:
1881 1882
			if (op->src.reg == CFI_SP && op->dest.reg == CFI_BP &&
			    cfa->base == CFI_SP &&
1883
			    check_reg_frame_pos(&regs[CFI_BP], -cfa->offset)) {
1884 1885 1886

				/* mov %rsp, %rbp */
				cfa->base = op->dest.reg;
1887
				cfi->bp_scratch = false;
1888
			}
1889

1890
			else if (op->src.reg == CFI_SP &&
1891
				 op->dest.reg == CFI_BP && cfi->drap) {
1892

1893 1894
				/* drap: mov %rsp, %rbp */
				regs[CFI_BP].base = CFI_BP;
1895 1896
				regs[CFI_BP].offset = -cfi->stack_size;
				cfi->bp_scratch = false;
1897
			}
1898

1899 1900 1901 1902 1903 1904 1905 1906 1907 1908 1909 1910
			else if (op->src.reg == CFI_SP && cfa->base == CFI_SP) {

				/*
				 * mov %rsp, %reg
				 *
				 * This is needed for the rare case where GCC
				 * does:
				 *
				 *   mov    %rsp, %rax
				 *   ...
				 *   mov    %rax, %rsp
				 */
1911 1912
				cfi->vals[op->dest.reg].base = CFI_CFA;
				cfi->vals[op->dest.reg].offset = -cfi->stack_size;
1913 1914
			}

J
Josh Poimboeuf 已提交
1915 1916 1917 1918 1919 1920 1921 1922
			else if (op->src.reg == CFI_BP && op->dest.reg == CFI_SP &&
				 cfa->base == CFI_BP) {

				/*
				 * mov %rbp, %rsp
				 *
				 * Restore the original stack pointer (Clang).
				 */
1923
				cfi->stack_size = -cfi->regs[CFI_BP].offset;
J
Josh Poimboeuf 已提交
1924 1925
			}

1926 1927 1928 1929
			else if (op->dest.reg == cfa->base) {

				/* mov %reg, %rsp */
				if (cfa->base == CFI_SP &&
1930
				    cfi->vals[op->src.reg].base == CFI_CFA) {
1931 1932 1933 1934 1935 1936 1937 1938 1939

					/*
					 * This is needed for the rare case
					 * where GCC does something dumb like:
					 *
					 *   lea    0x8(%rsp), %rcx
					 *   ...
					 *   mov    %rcx, %rsp
					 */
1940 1941
					cfa->offset = -cfi->vals[op->src.reg].offset;
					cfi->stack_size = cfa->offset;
1942 1943 1944 1945 1946

				} else {
					cfa->base = CFI_UNDEFINED;
					cfa->offset = 0;
				}
1947 1948 1949 1950 1951 1952 1953 1954
			}

			break;

		case OP_SRC_ADD:
			if (op->dest.reg == CFI_SP && op->src.reg == CFI_SP) {

				/* add imm, %rsp */
1955
				cfi->stack_size -= op->src.offset;
1956 1957 1958 1959 1960 1961 1962 1963
				if (cfa->base == CFI_SP)
					cfa->offset -= op->src.offset;
				break;
			}

			if (op->dest.reg == CFI_SP && op->src.reg == CFI_BP) {

				/* lea disp(%rbp), %rsp */
1964
				cfi->stack_size = -(op->src.offset + regs[CFI_BP].offset);
1965 1966 1967
				break;
			}

1968 1969 1970 1971 1972 1973 1974 1975 1976 1977 1978
			if (!cfi->drap && op->src.reg == CFI_SP &&
			    op->dest.reg == CFI_BP && cfa->base == CFI_SP &&
			    check_reg_frame_pos(&regs[CFI_BP], -cfa->offset + op->src.offset)) {

				/* lea disp(%rsp), %rbp */
				cfa->base = CFI_BP;
				cfa->offset -= op->src.offset;
				cfi->bp_scratch = false;
				break;
			}

1979
			if (op->src.reg == CFI_SP && cfa->base == CFI_SP) {
1980 1981

				/* drap: lea disp(%rsp), %drap */
1982
				cfi->drap_reg = op->dest.reg;
1983 1984 1985 1986 1987 1988 1989 1990 1991 1992 1993

				/*
				 * lea disp(%rsp), %reg
				 *
				 * This is needed for the rare case where GCC
				 * does something dumb like:
				 *
				 *   lea    0x8(%rsp), %rcx
				 *   ...
				 *   mov    %rcx, %rsp
				 */
1994 1995 1996
				cfi->vals[op->dest.reg].base = CFI_CFA;
				cfi->vals[op->dest.reg].offset = \
					-cfi->stack_size + op->src.offset;
1997

1998 1999 2000
				break;
			}

2001 2002
			if (cfi->drap && op->dest.reg == CFI_SP &&
			    op->src.reg == cfi->drap_reg) {
2003 2004 2005

				 /* drap: lea disp(%drap), %rsp */
				cfa->base = CFI_SP;
2006 2007 2008
				cfa->offset = cfi->stack_size = -op->src.offset;
				cfi->drap_reg = CFI_UNDEFINED;
				cfi->drap = false;
2009 2010 2011
				break;
			}

2012
			if (op->dest.reg == cfi->cfa.base) {
2013 2014 2015 2016 2017 2018 2019 2020 2021
				WARN_FUNC("unsupported stack register modification",
					  insn->sec, insn->offset);
				return -1;
			}

			break;

		case OP_SRC_AND:
			if (op->dest.reg != CFI_SP ||
2022 2023
			    (cfi->drap_reg != CFI_UNDEFINED && cfa->base != CFI_SP) ||
			    (cfi->drap_reg == CFI_UNDEFINED && cfa->base != CFI_BP)) {
2024 2025 2026 2027 2028
				WARN_FUNC("unsupported stack pointer realignment",
					  insn->sec, insn->offset);
				return -1;
			}

2029
			if (cfi->drap_reg != CFI_UNDEFINED) {
2030
				/* drap: and imm, %rsp */
2031 2032 2033
				cfa->base = cfi->drap_reg;
				cfa->offset = cfi->stack_size = 0;
				cfi->drap = true;
2034 2035 2036 2037 2038 2039 2040 2041 2042 2043
			}

			/*
			 * Older versions of GCC (4.8ish) realign the stack
			 * without DRAP, with a frame pointer.
			 */

			break;

		case OP_SRC_POP:
P
Peter Zijlstra 已提交
2044
		case OP_SRC_POPF:
2045
			if (!cfi->drap && op->dest.reg == cfa->base) {
2046 2047 2048 2049 2050

				/* pop %rbp */
				cfa->base = CFI_SP;
			}

2051 2052 2053
			if (cfi->drap && cfa->base == CFI_BP_INDIRECT &&
			    op->dest.reg == cfi->drap_reg &&
			    cfi->drap_offset == -cfi->stack_size) {
2054

2055
				/* drap: pop %drap */
2056
				cfa->base = cfi->drap_reg;
2057
				cfa->offset = 0;
2058
				cfi->drap_offset = -1;
2059

2060
			} else if (regs[op->dest.reg].offset == -cfi->stack_size) {
2061

2062
				/* pop %reg */
2063
				restore_reg(cfi, op->dest.reg);
2064 2065
			}

2066
			cfi->stack_size -= 8;
2067 2068 2069 2070 2071 2072
			if (cfa->base == CFI_SP)
				cfa->offset -= 8;

			break;

		case OP_SRC_REG_INDIRECT:
2073 2074 2075 2076 2077 2078 2079 2080
			if (!cfi->drap && op->dest.reg == cfa->base &&
			    op->dest.reg == CFI_BP) {

				/* mov disp(%rsp), %rbp */
				cfa->base = CFI_SP;
				cfa->offset = cfi->stack_size;
			}

2081 2082
			if (cfi->drap && op->src.reg == CFI_BP &&
			    op->src.offset == cfi->drap_offset) {
2083 2084

				/* drap: mov disp(%rbp), %drap */
2085
				cfa->base = cfi->drap_reg;
2086
				cfa->offset = 0;
2087
				cfi->drap_offset = -1;
2088 2089
			}

2090
			if (cfi->drap && op->src.reg == CFI_BP &&
2091 2092 2093
			    op->src.offset == regs[op->dest.reg].offset) {

				/* drap: mov disp(%rbp), %reg */
2094
				restore_reg(cfi, op->dest.reg);
2095 2096 2097 2098 2099 2100

			} else if (op->src.reg == cfa->base &&
			    op->src.offset == regs[op->dest.reg].offset + cfa->offset) {

				/* mov disp(%rbp), %reg */
				/* mov disp(%rsp), %reg */
2101
				restore_reg(cfi, op->dest.reg);
2102 2103 2104 2105 2106 2107

			} else if (op->src.reg == CFI_SP &&
				   op->src.offset == regs[op->dest.reg].offset + cfi->stack_size) {

				/* mov disp(%rsp), %reg */
				restore_reg(cfi, op->dest.reg);
2108 2109 2110 2111 2112 2113 2114 2115 2116 2117 2118 2119 2120
			}

			break;

		default:
			WARN_FUNC("unknown stack-related instruction",
				  insn->sec, insn->offset);
			return -1;
		}

		break;

	case OP_DEST_PUSH:
P
Peter Zijlstra 已提交
2121
	case OP_DEST_PUSHF:
2122
		cfi->stack_size += 8;
2123 2124 2125 2126 2127 2128
		if (cfa->base == CFI_SP)
			cfa->offset += 8;

		if (op->src.type != OP_SRC_REG)
			break;

2129 2130
		if (cfi->drap) {
			if (op->src.reg == cfa->base && op->src.reg == cfi->drap_reg) {
2131 2132 2133

				/* drap: push %drap */
				cfa->base = CFI_BP_INDIRECT;
2134
				cfa->offset = -cfi->stack_size;
2135

2136
				/* save drap so we know when to restore it */
2137
				cfi->drap_offset = -cfi->stack_size;
2138

2139
			} else if (op->src.reg == CFI_BP && cfa->base == cfi->drap_reg) {
2140 2141

				/* drap: push %rbp */
2142
				cfi->stack_size = 0;
2143

2144
			} else {
2145 2146

				/* drap: push %reg */
2147
				save_reg(cfi, op->src.reg, CFI_BP, -cfi->stack_size);
2148 2149 2150 2151 2152
			}

		} else {

			/* push %reg */
2153
			save_reg(cfi, op->src.reg, CFI_CFA, -cfi->stack_size);
2154 2155 2156
		}

		/* detect when asm code uses rbp as a scratch register */
2157
		if (!no_fp && insn->func && op->src.reg == CFI_BP &&
2158
		    cfa->base != CFI_BP)
2159
			cfi->bp_scratch = true;
2160 2161 2162 2163
		break;

	case OP_DEST_REG_INDIRECT:

2164 2165
		if (cfi->drap) {
			if (op->src.reg == cfa->base && op->src.reg == cfi->drap_reg) {
2166 2167 2168 2169 2170

				/* drap: mov %drap, disp(%rbp) */
				cfa->base = CFI_BP_INDIRECT;
				cfa->offset = op->dest.offset;

2171
				/* save drap offset so we know when to restore it */
2172
				cfi->drap_offset = op->dest.offset;
2173
			} else {
2174 2175

				/* drap: mov reg, disp(%rbp) */
2176
				save_reg(cfi, op->src.reg, CFI_BP, op->dest.offset);
2177 2178 2179 2180 2181 2182
			}

		} else if (op->dest.reg == cfa->base) {

			/* mov reg, disp(%rbp) */
			/* mov reg, disp(%rsp) */
2183 2184
			save_reg(cfi, op->src.reg, CFI_CFA,
				 op->dest.offset - cfi->cfa.offset);
2185 2186 2187 2188 2189 2190

		} else if (op->dest.reg == CFI_SP) {

			/* mov reg, disp(%rsp) */
			save_reg(cfi, op->src.reg, CFI_CFA,
				 op->dest.offset - cfi->stack_size);
2191 2192 2193 2194 2195
		}

		break;

	case OP_DEST_LEAVE:
2196 2197
		if ((!cfi->drap && cfa->base != CFI_BP) ||
		    (cfi->drap && cfa->base != cfi->drap_reg)) {
2198 2199 2200 2201 2202 2203 2204
			WARN_FUNC("leave instruction with modified stack frame",
				  insn->sec, insn->offset);
			return -1;
		}

		/* leave (mov %rbp, %rsp; pop %rbp) */

2205 2206
		cfi->stack_size = -cfi->regs[CFI_BP].offset - 8;
		restore_reg(cfi, CFI_BP);
2207

2208
		if (!cfi->drap) {
2209 2210 2211 2212 2213 2214 2215
			cfa->base = CFI_SP;
			cfa->offset -= 8;
		}

		break;

	case OP_DEST_MEM:
P
Peter Zijlstra 已提交
2216
		if (op->src.type != OP_SRC_POP && op->src.type != OP_SRC_POPF) {
2217 2218 2219 2220 2221 2222
			WARN_FUNC("unknown stack-related memory operation",
				  insn->sec, insn->offset);
			return -1;
		}

		/* pop mem */
2223
		cfi->stack_size -= 8;
2224 2225 2226 2227 2228 2229 2230 2231 2232 2233 2234 2235 2236 2237
		if (cfa->base == CFI_SP)
			cfa->offset -= 8;

		break;

	default:
		WARN_FUNC("unknown stack-related instruction",
			  insn->sec, insn->offset);
		return -1;
	}

	return 0;
}

2238 2239 2240 2241 2242 2243 2244 2245 2246 2247
/*
 * The stack layouts of alternatives instructions can sometimes diverge when
 * they have stack modifications.  That's fine as long as the potential stack
 * layouts don't conflict at any given potential instruction boundary.
 *
 * Flatten the CFIs of the different alternative code streams (both original
 * and replacement) into a single shared CFI array which can be used to detect
 * conflicts and nicely feed a linear array of ORC entries to the unwinder.
 */
static int propagate_alt_cfi(struct objtool_file *file, struct instruction *insn)
2248
{
2249 2250
	struct cfi_state **alt_cfi;
	int group_off;
2251

2252 2253
	if (!insn->alt_group)
		return 0;
2254

2255 2256
	alt_cfi = insn->alt_group->cfi;
	group_off = insn->offset - insn->alt_group->first_insn->offset;
2257

2258 2259 2260 2261 2262 2263
	if (!alt_cfi[group_off]) {
		alt_cfi[group_off] = &insn->cfi;
	} else {
		if (memcmp(alt_cfi[group_off], &insn->cfi, sizeof(struct cfi_state))) {
			WARN_FUNC("stack layout conflict in alternatives",
				  insn->sec, insn->offset);
2264 2265
			return -1;
		}
2266 2267 2268 2269 2270 2271 2272 2273 2274 2275 2276 2277 2278
	}

	return 0;
}

static int handle_insn_ops(struct instruction *insn, struct insn_state *state)
{
	struct stack_op *op;

	list_for_each_entry(op, &insn->stack_ops, list) {

		if (update_cfi_state(insn, &state->cfi, op))
			return 1;
2279

2280 2281 2282 2283 2284 2285 2286 2287 2288 2289 2290 2291 2292 2293 2294 2295 2296 2297 2298 2299 2300 2301 2302 2303 2304
		if (op->dest.type == OP_DEST_PUSHF) {
			if (!state->uaccess_stack) {
				state->uaccess_stack = 1;
			} else if (state->uaccess_stack >> 31) {
				WARN_FUNC("PUSHF stack exhausted",
					  insn->sec, insn->offset);
				return 1;
			}
			state->uaccess_stack <<= 1;
			state->uaccess_stack  |= state->uaccess;
		}

		if (op->src.type == OP_SRC_POPF) {
			if (state->uaccess_stack) {
				state->uaccess = state->uaccess_stack & 1;
				state->uaccess_stack >>= 1;
				if (state->uaccess_stack == 1)
					state->uaccess_stack = 0;
			}
		}
	}

	return 0;
}

2305
static bool insn_cfi_match(struct instruction *insn, struct cfi_state *cfi2)
2306
{
2307
	struct cfi_state *cfi1 = &insn->cfi;
2308 2309
	int i;

2310 2311
	if (memcmp(&cfi1->cfa, &cfi2->cfa, sizeof(cfi1->cfa))) {

2312 2313
		WARN_FUNC("stack state mismatch: cfa1=%d%+d cfa2=%d%+d",
			  insn->sec, insn->offset,
2314 2315
			  cfi1->cfa.base, cfi1->cfa.offset,
			  cfi2->cfa.base, cfi2->cfa.offset);
2316

2317
	} else if (memcmp(&cfi1->regs, &cfi2->regs, sizeof(cfi1->regs))) {
2318
		for (i = 0; i < CFI_NUM_REGS; i++) {
2319
			if (!memcmp(&cfi1->regs[i], &cfi2->regs[i],
2320 2321 2322 2323 2324
				    sizeof(struct cfi_reg)))
				continue;

			WARN_FUNC("stack state mismatch: reg1[%d]=%d%+d reg2[%d]=%d%+d",
				  insn->sec, insn->offset,
2325 2326
				  i, cfi1->regs[i].base, cfi1->regs[i].offset,
				  i, cfi2->regs[i].base, cfi2->regs[i].offset);
2327 2328 2329
			break;
		}

2330 2331
	} else if (cfi1->type != cfi2->type) {

2332
		WARN_FUNC("stack state mismatch: type1=%d type2=%d",
2333 2334 2335 2336 2337
			  insn->sec, insn->offset, cfi1->type, cfi2->type);

	} else if (cfi1->drap != cfi2->drap ||
		   (cfi1->drap && cfi1->drap_reg != cfi2->drap_reg) ||
		   (cfi1->drap && cfi1->drap_offset != cfi2->drap_offset)) {
2338

2339
		WARN_FUNC("stack state mismatch: drap1=%d(%d,%d) drap2=%d(%d,%d)",
2340
			  insn->sec, insn->offset,
2341 2342
			  cfi1->drap, cfi1->drap_reg, cfi1->drap_offset,
			  cfi2->drap, cfi2->drap_reg, cfi2->drap_offset);
2343 2344 2345 2346 2347

	} else
		return true;

	return false;
2348 2349
}

P
Peter Zijlstra 已提交
2350 2351 2352
static inline bool func_uaccess_safe(struct symbol *func)
{
	if (func)
2353
		return func->uaccess_safe;
P
Peter Zijlstra 已提交
2354 2355 2356 2357

	return false;
}

2358
static inline const char *call_dest_name(struct instruction *insn)
P
Peter Zijlstra 已提交
2359 2360 2361 2362 2363 2364 2365
{
	if (insn->call_dest)
		return insn->call_dest->name;

	return "{dynamic}";
}

2366 2367 2368 2369 2370 2371 2372 2373 2374 2375 2376 2377 2378 2379 2380 2381 2382 2383 2384 2385 2386 2387 2388 2389 2390 2391
static inline bool noinstr_call_dest(struct symbol *func)
{
	/*
	 * We can't deal with indirect function calls at present;
	 * assume they're instrumented.
	 */
	if (!func)
		return false;

	/*
	 * If the symbol is from a noinstr section; we good.
	 */
	if (func->sec->noinstr)
		return true;

	/*
	 * The __ubsan_handle_*() calls are like WARN(), they only happen when
	 * something 'BAD' happened. At the risk of taking the machine down,
	 * let them proceed to get the message out.
	 */
	if (!strncmp(func->name, "__ubsan_handle_", 15))
		return true;

	return false;
}

P
Peter Zijlstra 已提交
2392 2393
static int validate_call(struct instruction *insn, struct insn_state *state)
{
2394
	if (state->noinstr && state->instr <= 0 &&
2395
	    !noinstr_call_dest(insn->call_dest)) {
2396 2397 2398 2399 2400
		WARN_FUNC("call to %s() leaves .noinstr.text section",
				insn->sec, insn->offset, call_dest_name(insn));
		return 1;
	}

P
Peter Zijlstra 已提交
2401 2402
	if (state->uaccess && !func_uaccess_safe(insn->call_dest)) {
		WARN_FUNC("call to %s() with UACCESS enabled",
2403
				insn->sec, insn->offset, call_dest_name(insn));
P
Peter Zijlstra 已提交
2404 2405 2406
		return 1;
	}

2407 2408
	if (state->df) {
		WARN_FUNC("call to %s() with DF set",
2409
				insn->sec, insn->offset, call_dest_name(insn));
2410 2411 2412
		return 1;
	}

P
Peter Zijlstra 已提交
2413 2414 2415
	return 0;
}

2416 2417
static int validate_sibling_call(struct instruction *insn, struct insn_state *state)
{
2418
	if (has_modified_stack_frame(insn, state)) {
2419 2420 2421 2422 2423
		WARN_FUNC("sibling call from callable instruction with modified stack frame",
				insn->sec, insn->offset);
		return 1;
	}

P
Peter Zijlstra 已提交
2424
	return validate_call(insn, state);
2425 2426
}

2427 2428
static int validate_return(struct symbol *func, struct instruction *insn, struct insn_state *state)
{
2429 2430 2431 2432 2433 2434
	if (state->noinstr && state->instr > 0) {
		WARN_FUNC("return with instrumentation enabled",
			  insn->sec, insn->offset);
		return 1;
	}

2435 2436 2437 2438 2439 2440 2441 2442 2443 2444 2445 2446 2447 2448 2449 2450 2451 2452
	if (state->uaccess && !func_uaccess_safe(func)) {
		WARN_FUNC("return with UACCESS enabled",
			  insn->sec, insn->offset);
		return 1;
	}

	if (!state->uaccess && func_uaccess_safe(func)) {
		WARN_FUNC("return with UACCESS disabled from a UACCESS-safe function",
			  insn->sec, insn->offset);
		return 1;
	}

	if (state->df) {
		WARN_FUNC("return with DF set",
			  insn->sec, insn->offset);
		return 1;
	}

2453
	if (func && has_modified_stack_frame(insn, state)) {
2454 2455 2456 2457 2458
		WARN_FUNC("return with modified stack frame",
			  insn->sec, insn->offset);
		return 1;
	}

2459
	if (state->cfi.bp_scratch) {
2460 2461
		WARN_FUNC("BP used as a scratch register",
			  insn->sec, insn->offset);
2462 2463 2464 2465 2466 2467
		return 1;
	}

	return 0;
}

2468 2469
static struct instruction *next_insn_to_validate(struct objtool_file *file,
						 struct instruction *insn)
2470
{
J
Josh Poimboeuf 已提交
2471
	struct alt_group *alt_group = insn->alt_group;
2472

2473 2474 2475 2476 2477 2478 2479 2480 2481
	/*
	 * Simulate the fact that alternatives are patched in-place.  When the
	 * end of a replacement alt_group is reached, redirect objtool flow to
	 * the end of the original alt_group.
	 */
	if (alt_group && insn == alt_group->last_insn && alt_group->orig_group)
		return next_insn_same_sec(file, alt_group->orig_group->last_insn);

	return next_insn_same_sec(file, insn);
2482 2483
}

2484 2485 2486 2487 2488 2489
/*
 * Follow the branch starting at the given instruction, and recursively follow
 * any other branches (jumps).  Meanwhile, track the frame pointer state at
 * each instruction and validate all the rules described in
 * tools/objtool/Documentation/stack-validation.txt.
 */
2490
static int validate_branch(struct objtool_file *file, struct symbol *func,
P
Peter Zijlstra 已提交
2491
			   struct instruction *insn, struct insn_state state)
2492 2493
{
	struct alternative *alt;
P
Peter Zijlstra 已提交
2494
	struct instruction *next_insn;
2495
	struct section *sec;
2496
	u8 visited;
2497 2498 2499 2500 2501
	int ret;

	sec = insn->sec;

	while (1) {
2502
		next_insn = next_insn_to_validate(file, insn);
2503

2504
		if (file->c_file && func && insn->func && func != insn->func->pfunc) {
2505 2506 2507
			WARN("%s() falls through to next function %s()",
			     func->name, insn->func->name);
			return 1;
2508 2509
		}

2510 2511 2512
		if (func && insn->ignore) {
			WARN_FUNC("BUG: why am I validating an ignored function?",
				  sec, insn->offset);
2513
			return 1;
2514 2515
		}

2516
		visited = 1 << state.uaccess;
2517
		if (insn->visited) {
2518
			if (!insn->hint && !insn_cfi_match(insn, &state.cfi))
2519 2520
				return 1;

2521
			if (insn->visited & visited)
P
Peter Zijlstra 已提交
2522
				return 0;
2523 2524
		}

2525 2526 2527
		if (state.noinstr)
			state.instr += insn->instr;

2528
		if (insn->hint)
2529
			state.cfi = insn->cfi;
2530
		else
2531
			insn->cfi = state.cfi;
2532

2533
		insn->visited |= visited;
2534

2535 2536 2537
		if (propagate_alt_cfi(file, insn))
			return 1;

2538
		if (!insn->ignore_alts && !list_empty(&insn->alts)) {
P
Peter Zijlstra 已提交
2539 2540
			bool skip_orig = false;

2541
			list_for_each_entry(alt, &insn->alts, list) {
P
Peter Zijlstra 已提交
2542 2543 2544
				if (alt->skip_orig)
					skip_orig = true;

2545
				ret = validate_branch(file, func, alt->insn, state);
2546 2547 2548 2549 2550
				if (ret) {
					if (backtrace)
						BT_FUNC("(alt)", insn);
					return ret;
				}
2551
			}
P
Peter Zijlstra 已提交
2552 2553 2554

			if (skip_orig)
				return 0;
2555 2556
		}

2557 2558 2559
		if (handle_insn_ops(insn, &state))
			return 1;

2560 2561 2562
		switch (insn->type) {

		case INSN_RETURN:
2563
			return validate_return(func, insn, &state);
2564 2565

		case INSN_CALL:
P
Peter Zijlstra 已提交
2566 2567 2568 2569
		case INSN_CALL_DYNAMIC:
			ret = validate_call(insn, &state);
			if (ret)
				return ret;
2570

2571 2572
			if (!no_fp && func && !is_fentry_call(insn) &&
			    !has_valid_stack_frame(&state)) {
2573 2574 2575 2576
				WARN_FUNC("call without frame pointer save/setup",
					  sec, insn->offset);
				return 1;
			}
2577 2578 2579 2580

			if (dead_end_function(file, insn->call_dest))
				return 0;

2581 2582 2583 2584 2585
			if (insn->type == INSN_CALL && insn->call_dest->static_call_tramp) {
				list_add_tail(&insn->static_call_node,
					      &file->static_call_list);
			}

2586 2587 2588 2589
			break;

		case INSN_JUMP_CONDITIONAL:
		case INSN_JUMP_UNCONDITIONAL:
2590
			if (func && is_sibling_call(insn)) {
2591
				ret = validate_sibling_call(insn, &state);
2592
				if (ret)
2593
					return ret;
2594

2595
			} else if (insn->jump_dest) {
2596 2597
				ret = validate_branch(file, func,
						      insn->jump_dest, state);
2598 2599 2600 2601 2602
				if (ret) {
					if (backtrace)
						BT_FUNC("(branch)", insn);
					return ret;
				}
2603
			}
2604 2605 2606 2607 2608 2609 2610

			if (insn->type == INSN_JUMP_UNCONDITIONAL)
				return 0;

			break;

		case INSN_JUMP_DYNAMIC:
2611
		case INSN_JUMP_DYNAMIC_CONDITIONAL:
2612
			if (func && is_sibling_call(insn)) {
2613 2614 2615
				ret = validate_sibling_call(insn, &state);
				if (ret)
					return ret;
2616 2617
			}

2618 2619 2620 2621
			if (insn->type == INSN_JUMP_DYNAMIC)
				return 0;

			break;
2622

2623 2624 2625 2626 2627 2628 2629 2630
		case INSN_CONTEXT_SWITCH:
			if (func && (!next_insn || !next_insn->hint)) {
				WARN_FUNC("unsupported instruction in callable function",
					  sec, insn->offset);
				return 1;
			}
			return 0;

P
Peter Zijlstra 已提交
2631 2632 2633 2634 2635 2636 2637 2638 2639 2640
		case INSN_STAC:
			if (state.uaccess) {
				WARN_FUNC("recursive UACCESS enable", sec, insn->offset);
				return 1;
			}

			state.uaccess = true;
			break;

		case INSN_CLAC:
2641
			if (!state.uaccess && func) {
P
Peter Zijlstra 已提交
2642 2643 2644 2645 2646 2647 2648 2649 2650 2651
				WARN_FUNC("redundant UACCESS disable", sec, insn->offset);
				return 1;
			}

			if (func_uaccess_safe(func) && !state.uaccess_stack) {
				WARN_FUNC("UACCESS-safe disables UACCESS", sec, insn->offset);
				return 1;
			}

			state.uaccess = false;
2652 2653
			break;

2654
		case INSN_STD:
2655
			if (state.df) {
2656
				WARN_FUNC("recursive STD", sec, insn->offset);
2657 2658
				return 1;
			}
2659 2660 2661 2662 2663

			state.df = true;
			break;

		case INSN_CLD:
2664
			if (!state.df && func) {
2665
				WARN_FUNC("redundant CLD", sec, insn->offset);
2666 2667
				return 1;
			}
2668 2669

			state.df = false;
2670 2671
			break;

2672 2673 2674 2675 2676 2677 2678
		default:
			break;
		}

		if (insn->dead_end)
			return 0;

2679
		if (!next_insn) {
2680
			if (state.cfi.cfa.base == CFI_UNDEFINED)
2681
				return 0;
2682 2683 2684
			WARN("%s: unexpected end of section", sec->name);
			return 1;
		}
2685 2686

		insn = next_insn;
2687 2688 2689 2690 2691
	}

	return 0;
}

2692
static int validate_unwind_hints(struct objtool_file *file, struct section *sec)
2693 2694 2695
{
	struct instruction *insn;
	struct insn_state state;
2696
	int ret, warnings = 0;
2697 2698 2699 2700

	if (!file->hints)
		return 0;

2701
	init_insn_state(&state, sec);
2702

2703 2704 2705 2706 2707 2708 2709 2710 2711
	if (sec) {
		insn = find_insn(file, sec, 0);
		if (!insn)
			return 0;
	} else {
		insn = list_first_entry(&file->insn_list, typeof(*insn), list);
	}

	while (&insn->list != &file->insn_list && (!sec || insn->sec == sec)) {
2712
		if (insn->hint && !insn->visited) {
2713
			ret = validate_branch(file, insn->func, insn, state);
2714 2715
			if (ret && backtrace)
				BT_FUNC("<=== (hint)", insn);
2716 2717
			warnings += ret;
		}
2718 2719

		insn = list_next_entry(insn, list);
2720 2721 2722 2723 2724
	}

	return warnings;
}

2725 2726 2727 2728 2729 2730 2731 2732 2733 2734 2735 2736 2737
static int validate_retpoline(struct objtool_file *file)
{
	struct instruction *insn;
	int warnings = 0;

	for_each_insn(file, insn) {
		if (insn->type != INSN_JUMP_DYNAMIC &&
		    insn->type != INSN_CALL_DYNAMIC)
			continue;

		if (insn->retpoline_safe)
			continue;

2738 2739 2740 2741 2742 2743 2744 2745 2746
		/*
		 * .init.text code is ran before userspace and thus doesn't
		 * strictly need retpolines, except for modules which are
		 * loaded late, they very much do need retpoline in their
		 * .init.text
		 */
		if (!strcmp(insn->sec->name, ".init.text") && !module)
			continue;

2747 2748 2749 2750 2751 2752 2753 2754 2755 2756
		WARN_FUNC("indirect %s found in RETPOLINE build",
			  insn->sec, insn->offset,
			  insn->type == INSN_JUMP_DYNAMIC ? "jump" : "call");

		warnings++;
	}

	return warnings;
}

2757 2758 2759 2760 2761 2762 2763 2764 2765 2766 2767 2768 2769
static bool is_kasan_insn(struct instruction *insn)
{
	return (insn->type == INSN_CALL &&
		!strcmp(insn->call_dest->name, "__asan_handle_no_return"));
}

static bool is_ubsan_insn(struct instruction *insn)
{
	return (insn->type == INSN_CALL &&
		!strcmp(insn->call_dest->name,
			"__ubsan_handle_builtin_unreachable"));
}

2770
static bool ignore_unreachable_insn(struct objtool_file *file, struct instruction *insn)
2771 2772
{
	int i;
2773
	struct instruction *prev_insn;
2774

2775 2776 2777 2778 2779 2780
	if (insn->ignore || insn->type == INSN_NOP)
		return true;

	/*
	 * Ignore any unused exceptions.  This can happen when a whitelisted
	 * function has an exception table entry.
2781 2782 2783
	 *
	 * Also ignore alternative replacement instructions.  This can happen
	 * when a whitelisted function uses one of the ALTERNATIVE macros.
2784
	 */
2785 2786 2787
	if (!strcmp(insn->sec->name, ".fixup") ||
	    !strcmp(insn->sec->name, ".altinstr_replacement") ||
	    !strcmp(insn->sec->name, ".altinstr_aux"))
2788 2789
		return true;

2790 2791 2792 2793 2794 2795 2796 2797
	if (!insn->func)
		return false;

	/*
	 * CONFIG_UBSAN_TRAP inserts a UD2 when it sees
	 * __builtin_unreachable().  The BUG() macro has an unreachable() after
	 * the UD2, which causes GCC's undefined trap logic to emit another UD2
	 * (or occasionally a JMP to UD2).
2798 2799
	 *
	 * It may also insert a UD2 after calling a __noreturn function.
2800
	 */
2801 2802
	prev_insn = list_prev_entry(insn, list);
	if ((prev_insn->dead_end || dead_end_function(file, prev_insn->call_dest)) &&
2803 2804 2805 2806 2807
	    (insn->type == INSN_BUG ||
	     (insn->type == INSN_JUMP_UNCONDITIONAL &&
	      insn->jump_dest && insn->jump_dest->type == INSN_BUG)))
		return true;

2808 2809 2810 2811 2812 2813 2814 2815 2816 2817 2818
	/*
	 * Check if this (or a subsequent) instruction is related to
	 * CONFIG_UBSAN or CONFIG_KASAN.
	 *
	 * End the search at 5 instructions to avoid going into the weeds.
	 */
	for (i = 0; i < 5; i++) {

		if (is_kasan_insn(insn) || is_ubsan_insn(insn))
			return true;

2819 2820 2821 2822 2823 2824 2825 2826
		if (insn->type == INSN_JUMP_UNCONDITIONAL) {
			if (insn->jump_dest &&
			    insn->jump_dest->func == insn->func) {
				insn = insn->jump_dest;
				continue;
			}

			break;
2827 2828
		}

2829
		if (insn->offset + insn->len >= insn->func->offset + insn->func->len)
2830
			break;
2831

2832 2833 2834 2835 2836 2837
		insn = list_next_entry(insn, list);
	}

	return false;
}

2838 2839
static int validate_symbol(struct objtool_file *file, struct section *sec,
			   struct symbol *sym, struct insn_state *state)
2840 2841
{
	struct instruction *insn;
2842 2843 2844 2845 2846 2847 2848 2849 2850 2851 2852 2853 2854 2855 2856 2857 2858 2859 2860 2861 2862 2863 2864 2865
	int ret;

	if (!sym->len) {
		WARN("%s() is missing an ELF size annotation", sym->name);
		return 1;
	}

	if (sym->pfunc != sym || sym->alias != sym)
		return 0;

	insn = find_insn(file, sec, sym->offset);
	if (!insn || insn->ignore || insn->visited)
		return 0;

	state->uaccess = sym->uaccess_safe;

	ret = validate_branch(file, insn->func, insn, *state);
	if (ret && backtrace)
		BT_FUNC("<=== (sym)", insn);
	return ret;
}

static int validate_section(struct objtool_file *file, struct section *sec)
{
2866
	struct insn_state state;
2867 2868
	struct symbol *func;
	int warnings = 0;
2869

2870 2871 2872
	list_for_each_entry(func, &sec->symbol_list, list) {
		if (func->type != STT_FUNC)
			continue;
2873

2874
		init_insn_state(&state, sec);
2875 2876
		state.cfi.cfa = initial_func_cfi.cfa;
		memcpy(&state.cfi.regs, &initial_func_cfi.regs,
2877
		       CFI_NUM_REGS * sizeof(struct cfi_reg));
2878
		state.cfi.stack_size = initial_func_cfi.cfa.offset;
2879

2880
		warnings += validate_symbol(file, sec, func, &state);
2881 2882 2883 2884 2885
	}

	return warnings;
}

2886 2887 2888
static int validate_vmlinux_functions(struct objtool_file *file)
{
	struct section *sec;
2889
	int warnings = 0;
2890 2891

	sec = find_section_by_name(file->elf, ".noinstr.text");
2892 2893 2894 2895
	if (sec) {
		warnings += validate_section(file, sec);
		warnings += validate_unwind_hints(file, sec);
	}
2896

2897 2898 2899 2900 2901
	sec = find_section_by_name(file->elf, ".entry.text");
	if (sec) {
		warnings += validate_section(file, sec);
		warnings += validate_unwind_hints(file, sec);
	}
2902 2903

	return warnings;
2904 2905
}

2906 2907 2908 2909 2910
static int validate_functions(struct objtool_file *file)
{
	struct section *sec;
	int warnings = 0;

2911 2912 2913 2914
	for_each_sec(file, sec) {
		if (!(sec->sh.sh_flags & SHF_EXECINSTR))
			continue;

2915
		warnings += validate_section(file, sec);
2916
	}
2917 2918 2919 2920

	return warnings;
}

2921
static int validate_reachable_instructions(struct objtool_file *file)
2922 2923
{
	struct instruction *insn;
2924 2925 2926

	if (file->ignore_unreachables)
		return 0;
2927 2928

	for_each_insn(file, insn) {
2929
		if (insn->visited || ignore_unreachable_insn(file, insn))
2930 2931 2932 2933
			continue;

		WARN_FUNC("unreachable instruction", insn->sec, insn->offset);
		return 1;
2934 2935
	}

2936
	return 0;
2937 2938
}

2939
int check(struct objtool_file *file)
2940 2941 2942
{
	int ret, warnings = 0;

2943 2944
	arch_initial_func_cfi_state(&initial_func_cfi);

2945
	ret = decode_sections(file);
2946 2947 2948 2949
	if (ret < 0)
		goto out;
	warnings += ret;

2950
	if (list_empty(&file->insn_list))
2951 2952
		goto out;

2953
	if (vmlinux && !validate_dup) {
2954
		ret = validate_vmlinux_functions(file);
2955 2956 2957 2958 2959 2960 2961
		if (ret < 0)
			goto out;

		warnings += ret;
		goto out;
	}

2962
	if (retpoline) {
2963
		ret = validate_retpoline(file);
2964 2965 2966 2967 2968
		if (ret < 0)
			return ret;
		warnings += ret;
	}

2969
	ret = validate_functions(file);
2970 2971 2972 2973
	if (ret < 0)
		goto out;
	warnings += ret;

2974
	ret = validate_unwind_hints(file, NULL);
2975 2976 2977 2978
	if (ret < 0)
		goto out;
	warnings += ret;

2979
	if (!warnings) {
2980
		ret = validate_reachable_instructions(file);
2981 2982 2983 2984 2985
		if (ret < 0)
			goto out;
		warnings += ret;
	}

2986
	ret = create_static_call_sections(file);
2987 2988 2989 2990
	if (ret < 0)
		goto out;
	warnings += ret;

2991
out:
2992 2993 2994 2995 2996 2997 2998 2999 3000
	if (ret < 0) {
		/*
		 *  Fatal error.  The binary is corrupt or otherwise broken in
		 *  some way, or objtool itself is broken.  Fail the kernel
		 *  build.
		 */
		return ret;
	}

3001 3002
	return 0;
}