1 // SPDX-License-Identifier: GPL-2.0-or-later
3 * Copyright (C) 2015-2017 Josh Poimboeuf <jpoimboe@redhat.com>
12 #include <objtool/builtin.h>
13 #include <objtool/cfi.h>
14 #include <objtool/arch.h>
15 #include <objtool/check.h>
16 #include <objtool/special.h>
17 #include <objtool/warn.h>
18 #include <objtool/endianness.h>
20 #include <linux/objtool_types.h>
21 #include <linux/hashtable.h>
22 #include <linux/kernel.h>
23 #include <linux/static_call_types.h>
26 struct alternative
*next
;
27 struct instruction
*insn
;
31 static unsigned long nr_cfi
, nr_cfi_reused
, nr_cfi_cache
;
33 static struct cfi_init_state initial_func_cfi
;
34 static struct cfi_state init_cfi
;
35 static struct cfi_state func_cfi
;
36 static struct cfi_state force_undefined_cfi
;
38 struct instruction
*find_insn(struct objtool_file
*file
,
39 struct section
*sec
, unsigned long offset
)
41 struct instruction
*insn
;
43 hash_for_each_possible(file
->insn_hash
, insn
, hash
, sec_offset_hash(sec
, offset
)) {
44 if (insn
->sec
== sec
&& insn
->offset
== offset
)
51 struct instruction
*next_insn_same_sec(struct objtool_file
*file
,
52 struct instruction
*insn
)
54 if (insn
->idx
== INSN_CHUNK_MAX
)
55 return find_insn(file
, insn
->sec
, insn
->offset
+ insn
->len
);
64 static struct instruction
*next_insn_same_func(struct objtool_file
*file
,
65 struct instruction
*insn
)
67 struct instruction
*next
= next_insn_same_sec(file
, insn
);
68 struct symbol
*func
= insn_func(insn
);
73 if (next
&& insn_func(next
) == func
)
76 /* Check if we're already in the subfunction: */
77 if (func
== func
->cfunc
)
80 /* Move to the subfunction: */
81 return find_insn(file
, func
->cfunc
->sec
, func
->cfunc
->offset
);
84 static struct instruction
*prev_insn_same_sec(struct objtool_file
*file
,
85 struct instruction
*insn
)
89 return find_insn(file
, insn
->sec
, insn
->offset
- insn
->prev_len
);
96 static struct instruction
*prev_insn_same_sym(struct objtool_file
*file
,
97 struct instruction
*insn
)
99 struct instruction
*prev
= prev_insn_same_sec(file
, insn
);
101 if (prev
&& insn_func(prev
) == insn_func(insn
))
107 #define for_each_insn(file, insn) \
108 for (struct section *__sec, *__fake = (struct section *)1; \
109 __fake; __fake = NULL) \
110 for_each_sec(file, __sec) \
111 sec_for_each_insn(file, __sec, insn)
113 #define func_for_each_insn(file, func, insn) \
114 for (insn = find_insn(file, func->sec, func->offset); \
116 insn = next_insn_same_func(file, insn))
118 #define sym_for_each_insn(file, sym, insn) \
119 for (insn = find_insn(file, sym->sec, sym->offset); \
120 insn && insn->offset < sym->offset + sym->len; \
121 insn = next_insn_same_sec(file, insn))
123 #define sym_for_each_insn_continue_reverse(file, sym, insn) \
124 for (insn = prev_insn_same_sec(file, insn); \
125 insn && insn->offset >= sym->offset; \
126 insn = prev_insn_same_sec(file, insn))
128 #define sec_for_each_insn_from(file, insn) \
129 for (; insn; insn = next_insn_same_sec(file, insn))
131 #define sec_for_each_insn_continue(file, insn) \
132 for (insn = next_insn_same_sec(file, insn); insn; \
133 insn = next_insn_same_sec(file, insn))
135 static inline struct symbol
*insn_call_dest(struct instruction
*insn
)
137 if (insn
->type
== INSN_JUMP_DYNAMIC
||
138 insn
->type
== INSN_CALL_DYNAMIC
)
141 return insn
->_call_dest
;
144 static inline struct reloc
*insn_jump_table(struct instruction
*insn
)
146 if (insn
->type
== INSN_JUMP_DYNAMIC
||
147 insn
->type
== INSN_CALL_DYNAMIC
)
148 return insn
->_jump_table
;
153 static bool is_jump_table_jump(struct instruction
*insn
)
155 struct alt_group
*alt_group
= insn
->alt_group
;
157 if (insn_jump_table(insn
))
160 /* Retpoline alternative for a jump table? */
161 return alt_group
&& alt_group
->orig_group
&&
162 insn_jump_table(alt_group
->orig_group
->first_insn
);
165 static bool is_sibling_call(struct instruction
*insn
)
168 * Assume only STT_FUNC calls have jump-tables.
170 if (insn_func(insn
)) {
171 /* An indirect jump is either a sibling call or a jump to a table. */
172 if (insn
->type
== INSN_JUMP_DYNAMIC
)
173 return !is_jump_table_jump(insn
);
176 /* add_jump_destinations() sets insn_call_dest(insn) for sibling calls. */
177 return (is_static_jump(insn
) && insn_call_dest(insn
));
181 * This checks to see if the given function is a "noreturn" function.
183 * For global functions which are outside the scope of this object file, we
184 * have to keep a manual list of them.
186 * For local functions, we have to detect them manually by simply looking for
187 * the lack of a return instruction.
189 static bool __dead_end_function(struct objtool_file
*file
, struct symbol
*func
,
193 struct instruction
*insn
;
196 #define NORETURN(func) __stringify(func),
197 static const char * const global_noreturns
[] = {
198 #include "noreturns.h"
205 if (func
->bind
== STB_GLOBAL
|| func
->bind
== STB_WEAK
)
206 for (i
= 0; i
< ARRAY_SIZE(global_noreturns
); i
++)
207 if (!strcmp(func
->name
, global_noreturns
[i
]))
210 if (func
->bind
== STB_WEAK
)
216 insn
= find_insn(file
, func
->sec
, func
->offset
);
217 if (!insn
|| !insn_func(insn
))
220 func_for_each_insn(file
, func
, insn
) {
223 if (insn
->type
== INSN_RETURN
)
231 * A function can have a sibling call instead of a return. In that
232 * case, the function's dead-end status depends on whether the target
233 * of the sibling call returns.
235 func_for_each_insn(file
, func
, insn
) {
236 if (is_sibling_call(insn
)) {
237 struct instruction
*dest
= insn
->jump_dest
;
240 /* sibling call to another file */
243 /* local sibling call */
244 if (recursion
== 5) {
246 * Infinite recursion: two functions have
247 * sibling calls to each other. This is a very
248 * rare case. It means they aren't dead ends.
253 return __dead_end_function(file
, insn_func(dest
), recursion
+1);
260 static bool dead_end_function(struct objtool_file
*file
, struct symbol
*func
)
262 return __dead_end_function(file
, func
, 0);
265 static void init_cfi_state(struct cfi_state
*cfi
)
269 for (i
= 0; i
< CFI_NUM_REGS
; i
++) {
270 cfi
->regs
[i
].base
= CFI_UNDEFINED
;
271 cfi
->vals
[i
].base
= CFI_UNDEFINED
;
273 cfi
->cfa
.base
= CFI_UNDEFINED
;
274 cfi
->drap_reg
= CFI_UNDEFINED
;
275 cfi
->drap_offset
= -1;
278 static void init_insn_state(struct objtool_file
*file
, struct insn_state
*state
,
281 memset(state
, 0, sizeof(*state
));
282 init_cfi_state(&state
->cfi
);
285 * We need the full vmlinux for noinstr validation, otherwise we can
286 * not correctly determine insn_call_dest(insn)->sec (external symbols
287 * do not have a section).
289 if (opts
.link
&& opts
.noinstr
&& sec
)
290 state
->noinstr
= sec
->noinstr
;
293 static struct cfi_state
*cfi_alloc(void)
295 struct cfi_state
*cfi
= calloc(sizeof(struct cfi_state
), 1);
297 WARN("calloc failed");
305 static struct hlist_head
*cfi_hash
;
307 static inline bool cficmp(struct cfi_state
*cfi1
, struct cfi_state
*cfi2
)
309 return memcmp((void *)cfi1
+ sizeof(cfi1
->hash
),
310 (void *)cfi2
+ sizeof(cfi2
->hash
),
311 sizeof(struct cfi_state
) - sizeof(struct hlist_node
));
314 static inline u32
cfi_key(struct cfi_state
*cfi
)
316 return jhash((void *)cfi
+ sizeof(cfi
->hash
),
317 sizeof(*cfi
) - sizeof(cfi
->hash
), 0);
320 static struct cfi_state
*cfi_hash_find_or_add(struct cfi_state
*cfi
)
322 struct hlist_head
*head
= &cfi_hash
[hash_min(cfi_key(cfi
), cfi_bits
)];
323 struct cfi_state
*obj
;
325 hlist_for_each_entry(obj
, head
, hash
) {
326 if (!cficmp(cfi
, obj
)) {
334 hlist_add_head(&obj
->hash
, head
);
339 static void cfi_hash_add(struct cfi_state
*cfi
)
341 struct hlist_head
*head
= &cfi_hash
[hash_min(cfi_key(cfi
), cfi_bits
)];
343 hlist_add_head(&cfi
->hash
, head
);
346 static void *cfi_hash_alloc(unsigned long size
)
348 cfi_bits
= max(10, ilog2(size
));
349 cfi_hash
= mmap(NULL
, sizeof(struct hlist_head
) << cfi_bits
,
350 PROT_READ
|PROT_WRITE
,
351 MAP_PRIVATE
|MAP_ANON
, -1, 0);
352 if (cfi_hash
== (void *)-1L) {
353 WARN("mmap fail cfi_hash");
355 } else if (opts
.stats
) {
356 printf("cfi_bits: %d\n", cfi_bits
);
362 static unsigned long nr_insns
;
363 static unsigned long nr_insns_visited
;
366 * Call the arch-specific instruction decoder for all the instructions and add
367 * them to the global instruction list.
369 static int decode_instructions(struct objtool_file
*file
)
373 unsigned long offset
;
374 struct instruction
*insn
;
377 for_each_sec(file
, sec
) {
378 struct instruction
*insns
= NULL
;
382 if (!(sec
->sh
.sh_flags
& SHF_EXECINSTR
))
385 if (strcmp(sec
->name
, ".altinstr_replacement") &&
386 strcmp(sec
->name
, ".altinstr_aux") &&
387 strncmp(sec
->name
, ".discard.", 9))
390 if (!strcmp(sec
->name
, ".noinstr.text") ||
391 !strcmp(sec
->name
, ".entry.text") ||
392 !strcmp(sec
->name
, ".cpuidle.text") ||
393 !strncmp(sec
->name
, ".text.__x86.", 12))
397 * .init.text code is ran before userspace and thus doesn't
398 * strictly need retpolines, except for modules which are
399 * loaded late, they very much do need retpoline in their
402 if (!strcmp(sec
->name
, ".init.text") && !opts
.module
)
405 for (offset
= 0; offset
< sec
->sh
.sh_size
; offset
+= insn
->len
) {
406 if (!insns
|| idx
== INSN_CHUNK_MAX
) {
407 insns
= calloc(sizeof(*insn
), INSN_CHUNK_SIZE
);
409 WARN("malloc failed");
419 INIT_LIST_HEAD(&insn
->call_node
);
421 insn
->offset
= offset
;
422 insn
->prev_len
= prev_len
;
424 ret
= arch_decode_instruction(file
, sec
, offset
,
425 sec
->sh
.sh_size
- offset
,
430 prev_len
= insn
->len
;
433 * By default, "ud2" is a dead end unless otherwise
434 * annotated, because GCC 7 inserts it for certain
435 * divide-by-zero cases.
437 if (insn
->type
== INSN_BUG
)
438 insn
->dead_end
= true;
440 hash_add(file
->insn_hash
, &insn
->hash
, sec_offset_hash(sec
, insn
->offset
));
444 // printf("%s: last chunk used: %d\n", sec->name, (int)idx);
446 sec_for_each_sym(sec
, func
) {
447 if (func
->type
!= STT_NOTYPE
&& func
->type
!= STT_FUNC
)
450 if (func
->offset
== sec
->sh
.sh_size
) {
451 /* Heuristic: likely an "end" symbol */
452 if (func
->type
== STT_NOTYPE
)
454 WARN("%s(): STT_FUNC at end of section",
459 if (func
->return_thunk
|| func
->alias
!= func
)
462 if (!find_insn(file
, sec
, func
->offset
)) {
463 WARN("%s(): can't find starting instruction",
468 sym_for_each_insn(file
, func
, insn
) {
470 if (func
->type
== STT_FUNC
&&
471 insn
->type
== INSN_ENDBR
&&
472 list_empty(&insn
->call_node
)) {
473 if (insn
->offset
== func
->offset
) {
474 list_add_tail(&insn
->call_node
, &file
->endbr_list
);
477 file
->nr_endbr_int
++;
485 printf("nr_insns: %lu\n", nr_insns
);
491 * Read the pv_ops[] .data table to find the static initialized values.
493 static int add_pv_ops(struct objtool_file
*file
, const char *symname
)
495 struct symbol
*sym
, *func
;
496 unsigned long off
, end
;
500 sym
= find_symbol_by_name(file
->elf
, symname
);
505 end
= off
+ sym
->len
;
507 reloc
= find_reloc_by_dest_range(file
->elf
, sym
->sec
, off
, end
- off
);
512 if (func
->type
== STT_SECTION
)
513 func
= find_symbol_by_offset(reloc
->sym
->sec
, reloc
->addend
);
515 idx
= (reloc
->offset
- sym
->offset
) / sizeof(unsigned long);
517 objtool_pv_add(file
, idx
, func
);
519 off
= reloc
->offset
+ 1;
528 * Allocate and initialize file->pv_ops[].
530 static int init_pv_ops(struct objtool_file
*file
)
532 static const char *pv_ops_tables
[] = {
548 sym
= find_symbol_by_name(file
->elf
, "pv_ops");
552 nr
= sym
->len
/ sizeof(unsigned long);
553 file
->pv_ops
= calloc(sizeof(struct pv_state
), nr
);
557 for (idx
= 0; idx
< nr
; idx
++)
558 INIT_LIST_HEAD(&file
->pv_ops
[idx
].targets
);
560 for (idx
= 0; (pv_ops
= pv_ops_tables
[idx
]); idx
++)
561 add_pv_ops(file
, pv_ops
);
566 static struct instruction
*find_last_insn(struct objtool_file
*file
,
569 struct instruction
*insn
= NULL
;
571 unsigned int end
= (sec
->sh
.sh_size
> 10) ? sec
->sh
.sh_size
- 10 : 0;
573 for (offset
= sec
->sh
.sh_size
- 1; offset
>= end
&& !insn
; offset
--)
574 insn
= find_insn(file
, sec
, offset
);
580 * Mark "ud2" instructions and manually annotated dead ends.
582 static int add_dead_ends(struct objtool_file
*file
)
584 struct section
*rsec
;
586 struct instruction
*insn
;
589 * Check for manually annotated dead ends.
591 rsec
= find_section_by_name(file
->elf
, ".rela.discard.unreachable");
595 list_for_each_entry(reloc
, &rsec
->reloc_list
, list
) {
596 if (reloc
->sym
->type
!= STT_SECTION
) {
597 WARN("unexpected relocation symbol type in %s", rsec
->name
);
600 insn
= find_insn(file
, reloc
->sym
->sec
, reloc
->addend
);
602 insn
= prev_insn_same_sec(file
, insn
);
603 else if (reloc
->addend
== reloc
->sym
->sec
->sh
.sh_size
) {
604 insn
= find_last_insn(file
, reloc
->sym
->sec
);
606 WARN("can't find unreachable insn at %s+0x%" PRIx64
,
607 reloc
->sym
->sec
->name
, reloc
->addend
);
611 WARN("can't find unreachable insn at %s+0x%" PRIx64
,
612 reloc
->sym
->sec
->name
, reloc
->addend
);
616 insn
->dead_end
= true;
621 * These manually annotated reachable checks are needed for GCC 4.4,
622 * where the Linux unreachable() macro isn't supported. In that case
623 * GCC doesn't know the "ud2" is fatal, so it generates code as if it's
626 rsec
= find_section_by_name(file
->elf
, ".rela.discard.reachable");
630 list_for_each_entry(reloc
, &rsec
->reloc_list
, list
) {
631 if (reloc
->sym
->type
!= STT_SECTION
) {
632 WARN("unexpected relocation symbol type in %s", rsec
->name
);
635 insn
= find_insn(file
, reloc
->sym
->sec
, reloc
->addend
);
637 insn
= prev_insn_same_sec(file
, insn
);
638 else if (reloc
->addend
== reloc
->sym
->sec
->sh
.sh_size
) {
639 insn
= find_last_insn(file
, reloc
->sym
->sec
);
641 WARN("can't find reachable insn at %s+0x%" PRIx64
,
642 reloc
->sym
->sec
->name
, reloc
->addend
);
646 WARN("can't find reachable insn at %s+0x%" PRIx64
,
647 reloc
->sym
->sec
->name
, reloc
->addend
);
651 insn
->dead_end
= false;
657 static int create_static_call_sections(struct objtool_file
*file
)
660 struct static_call_site
*site
;
661 struct instruction
*insn
;
662 struct symbol
*key_sym
;
663 char *key_name
, *tmp
;
666 sec
= find_section_by_name(file
->elf
, ".static_call_sites");
668 INIT_LIST_HEAD(&file
->static_call_list
);
669 WARN("file already has .static_call_sites section, skipping");
673 if (list_empty(&file
->static_call_list
))
677 list_for_each_entry(insn
, &file
->static_call_list
, call_node
)
680 sec
= elf_create_section(file
->elf
, ".static_call_sites",
681 sizeof(struct static_call_site
), idx
);
685 /* Allow modules to set the low bits of static_call_site::key */
686 sec
->sh
.sh_flags
|= SHF_WRITE
;
689 list_for_each_entry(insn
, &file
->static_call_list
, call_node
) {
691 site
= (struct static_call_site
*)sec
->data
->d_buf
+ idx
;
692 memset(site
, 0, sizeof(struct static_call_site
));
694 /* populate reloc for 'addr' */
695 if (elf_add_reloc_to_insn(file
->elf
, sec
,
696 idx
* sizeof(struct static_call_site
),
698 insn
->sec
, insn
->offset
))
701 /* find key symbol */
702 key_name
= strdup(insn_call_dest(insn
)->name
);
707 if (strncmp(key_name
, STATIC_CALL_TRAMP_PREFIX_STR
,
708 STATIC_CALL_TRAMP_PREFIX_LEN
)) {
709 WARN("static_call: trampoline name malformed: %s", key_name
);
713 tmp
= key_name
+ STATIC_CALL_TRAMP_PREFIX_LEN
- STATIC_CALL_KEY_PREFIX_LEN
;
714 memcpy(tmp
, STATIC_CALL_KEY_PREFIX_STR
, STATIC_CALL_KEY_PREFIX_LEN
);
716 key_sym
= find_symbol_by_name(file
->elf
, tmp
);
719 WARN("static_call: can't find static_call_key symbol: %s", tmp
);
725 * For modules(), the key might not be exported, which
726 * means the module can make static calls but isn't
727 * allowed to change them.
729 * In that case we temporarily set the key to be the
730 * trampoline address. This is fixed up in
731 * static_call_add_module().
733 key_sym
= insn_call_dest(insn
);
737 /* populate reloc for 'key' */
738 if (elf_add_reloc(file
->elf
, sec
,
739 idx
* sizeof(struct static_call_site
) + 4,
740 R_X86_64_PC32
, key_sym
,
741 is_sibling_call(insn
) * STATIC_CALL_SITE_TAIL
))
750 static int create_retpoline_sites_sections(struct objtool_file
*file
)
752 struct instruction
*insn
;
756 sec
= find_section_by_name(file
->elf
, ".retpoline_sites");
758 WARN("file already has .retpoline_sites, skipping");
763 list_for_each_entry(insn
, &file
->retpoline_call_list
, call_node
)
769 sec
= elf_create_section(file
->elf
, ".retpoline_sites",
772 WARN("elf_create_section: .retpoline_sites");
777 list_for_each_entry(insn
, &file
->retpoline_call_list
, call_node
) {
779 int *site
= (int *)sec
->data
->d_buf
+ idx
;
782 if (elf_add_reloc_to_insn(file
->elf
, sec
,
785 insn
->sec
, insn
->offset
)) {
786 WARN("elf_add_reloc_to_insn: .retpoline_sites");
796 static int create_return_sites_sections(struct objtool_file
*file
)
798 struct instruction
*insn
;
802 sec
= find_section_by_name(file
->elf
, ".return_sites");
804 WARN("file already has .return_sites, skipping");
809 list_for_each_entry(insn
, &file
->return_thunk_list
, call_node
)
815 sec
= elf_create_section(file
->elf
, ".return_sites",
818 WARN("elf_create_section: .return_sites");
823 list_for_each_entry(insn
, &file
->return_thunk_list
, call_node
) {
825 int *site
= (int *)sec
->data
->d_buf
+ idx
;
828 if (elf_add_reloc_to_insn(file
->elf
, sec
,
831 insn
->sec
, insn
->offset
)) {
832 WARN("elf_add_reloc_to_insn: .return_sites");
842 static int create_ibt_endbr_seal_sections(struct objtool_file
*file
)
844 struct instruction
*insn
;
848 sec
= find_section_by_name(file
->elf
, ".ibt_endbr_seal");
850 WARN("file already has .ibt_endbr_seal, skipping");
855 list_for_each_entry(insn
, &file
->endbr_list
, call_node
)
859 printf("ibt: ENDBR at function start: %d\n", file
->nr_endbr
);
860 printf("ibt: ENDBR inside functions: %d\n", file
->nr_endbr_int
);
861 printf("ibt: superfluous ENDBR: %d\n", idx
);
867 sec
= elf_create_section(file
->elf
, ".ibt_endbr_seal",
870 WARN("elf_create_section: .ibt_endbr_seal");
875 list_for_each_entry(insn
, &file
->endbr_list
, call_node
) {
877 int *site
= (int *)sec
->data
->d_buf
+ idx
;
878 struct symbol
*sym
= insn
->sym
;
881 if (opts
.module
&& sym
&& sym
->type
== STT_FUNC
&&
882 insn
->offset
== sym
->offset
&&
883 (!strcmp(sym
->name
, "init_module") ||
884 !strcmp(sym
->name
, "cleanup_module")))
885 WARN("%s(): not an indirect call target", sym
->name
);
887 if (elf_add_reloc_to_insn(file
->elf
, sec
,
890 insn
->sec
, insn
->offset
)) {
891 WARN("elf_add_reloc_to_insn: .ibt_endbr_seal");
901 static int create_cfi_sections(struct objtool_file
*file
)
908 sec
= find_section_by_name(file
->elf
, ".cfi_sites");
910 INIT_LIST_HEAD(&file
->call_list
);
911 WARN("file already has .cfi_sites section, skipping");
916 for_each_sym(file
, sym
) {
917 if (sym
->type
!= STT_FUNC
)
920 if (strncmp(sym
->name
, "__cfi_", 6))
926 sec
= elf_create_section(file
->elf
, ".cfi_sites", sizeof(unsigned int), idx
);
931 for_each_sym(file
, sym
) {
932 if (sym
->type
!= STT_FUNC
)
935 if (strncmp(sym
->name
, "__cfi_", 6))
938 loc
= (unsigned int *)sec
->data
->d_buf
+ idx
;
939 memset(loc
, 0, sizeof(unsigned int));
941 if (elf_add_reloc_to_insn(file
->elf
, sec
,
942 idx
* sizeof(unsigned int),
944 sym
->sec
, sym
->offset
))
953 static int create_mcount_loc_sections(struct objtool_file
*file
)
955 int addrsize
= elf_class_addrsize(file
->elf
);
956 struct instruction
*insn
;
960 sec
= find_section_by_name(file
->elf
, "__mcount_loc");
962 INIT_LIST_HEAD(&file
->mcount_loc_list
);
963 WARN("file already has __mcount_loc section, skipping");
967 if (list_empty(&file
->mcount_loc_list
))
971 list_for_each_entry(insn
, &file
->mcount_loc_list
, call_node
)
974 sec
= elf_create_section(file
->elf
, "__mcount_loc", addrsize
, idx
);
978 sec
->sh
.sh_addralign
= addrsize
;
981 list_for_each_entry(insn
, &file
->mcount_loc_list
, call_node
) {
984 loc
= sec
->data
->d_buf
+ idx
;
985 memset(loc
, 0, addrsize
);
987 if (elf_add_reloc_to_insn(file
->elf
, sec
, idx
,
988 addrsize
== sizeof(u64
) ? R_ABS64
: R_ABS32
,
989 insn
->sec
, insn
->offset
))
998 static int create_direct_call_sections(struct objtool_file
*file
)
1000 struct instruction
*insn
;
1001 struct section
*sec
;
1005 sec
= find_section_by_name(file
->elf
, ".call_sites");
1007 INIT_LIST_HEAD(&file
->call_list
);
1008 WARN("file already has .call_sites section, skipping");
1012 if (list_empty(&file
->call_list
))
1016 list_for_each_entry(insn
, &file
->call_list
, call_node
)
1019 sec
= elf_create_section(file
->elf
, ".call_sites", sizeof(unsigned int), idx
);
1024 list_for_each_entry(insn
, &file
->call_list
, call_node
) {
1026 loc
= (unsigned int *)sec
->data
->d_buf
+ idx
;
1027 memset(loc
, 0, sizeof(unsigned int));
1029 if (elf_add_reloc_to_insn(file
->elf
, sec
,
1030 idx
* sizeof(unsigned int),
1032 insn
->sec
, insn
->offset
))
1042 * Warnings shouldn't be reported for ignored functions.
1044 static void add_ignores(struct objtool_file
*file
)
1046 struct instruction
*insn
;
1047 struct section
*rsec
;
1048 struct symbol
*func
;
1049 struct reloc
*reloc
;
1051 rsec
= find_section_by_name(file
->elf
, ".rela.discard.func_stack_frame_non_standard");
1055 list_for_each_entry(reloc
, &rsec
->reloc_list
, list
) {
1056 switch (reloc
->sym
->type
) {
1062 func
= find_func_by_offset(reloc
->sym
->sec
, reloc
->addend
);
1068 WARN("unexpected relocation symbol type in %s: %d",
1069 rsec
->name
, reloc
->sym
->type
);
1073 func_for_each_insn(file
, func
, insn
)
1074 insn
->ignore
= true;
1079 * This is a whitelist of functions that is allowed to be called with AC set.
1080 * The list is meant to be minimal and only contains compiler instrumentation
1081 * ABI and a few functions used to implement *_{to,from}_user() functions.
1083 * These functions must not directly change AC, but may PUSHF/POPF.
1085 static const char *uaccess_safe_builtin
[] = {
1088 "kasan_check_range",
1089 /* KASAN out-of-line */
1090 "__asan_loadN_noabort",
1091 "__asan_load1_noabort",
1092 "__asan_load2_noabort",
1093 "__asan_load4_noabort",
1094 "__asan_load8_noabort",
1095 "__asan_load16_noabort",
1096 "__asan_storeN_noabort",
1097 "__asan_store1_noabort",
1098 "__asan_store2_noabort",
1099 "__asan_store4_noabort",
1100 "__asan_store8_noabort",
1101 "__asan_store16_noabort",
1102 "__kasan_check_read",
1103 "__kasan_check_write",
1105 "__asan_report_load_n_noabort",
1106 "__asan_report_load1_noabort",
1107 "__asan_report_load2_noabort",
1108 "__asan_report_load4_noabort",
1109 "__asan_report_load8_noabort",
1110 "__asan_report_load16_noabort",
1111 "__asan_report_store_n_noabort",
1112 "__asan_report_store1_noabort",
1113 "__asan_report_store2_noabort",
1114 "__asan_report_store4_noabort",
1115 "__asan_report_store8_noabort",
1116 "__asan_report_store16_noabort",
1118 "__kcsan_check_access",
1123 "kcsan_found_watchpoint",
1124 "kcsan_setup_watchpoint",
1125 "kcsan_check_scoped_accesses",
1126 "kcsan_disable_current",
1127 "kcsan_enable_current_nowarn",
1129 "__tsan_func_entry",
1131 "__tsan_read_range",
1132 "__tsan_write_range",
1143 "__tsan_read_write1",
1144 "__tsan_read_write2",
1145 "__tsan_read_write4",
1146 "__tsan_read_write8",
1147 "__tsan_read_write16",
1148 "__tsan_volatile_read1",
1149 "__tsan_volatile_read2",
1150 "__tsan_volatile_read4",
1151 "__tsan_volatile_read8",
1152 "__tsan_volatile_read16",
1153 "__tsan_volatile_write1",
1154 "__tsan_volatile_write2",
1155 "__tsan_volatile_write4",
1156 "__tsan_volatile_write8",
1157 "__tsan_volatile_write16",
1158 "__tsan_atomic8_load",
1159 "__tsan_atomic16_load",
1160 "__tsan_atomic32_load",
1161 "__tsan_atomic64_load",
1162 "__tsan_atomic8_store",
1163 "__tsan_atomic16_store",
1164 "__tsan_atomic32_store",
1165 "__tsan_atomic64_store",
1166 "__tsan_atomic8_exchange",
1167 "__tsan_atomic16_exchange",
1168 "__tsan_atomic32_exchange",
1169 "__tsan_atomic64_exchange",
1170 "__tsan_atomic8_fetch_add",
1171 "__tsan_atomic16_fetch_add",
1172 "__tsan_atomic32_fetch_add",
1173 "__tsan_atomic64_fetch_add",
1174 "__tsan_atomic8_fetch_sub",
1175 "__tsan_atomic16_fetch_sub",
1176 "__tsan_atomic32_fetch_sub",
1177 "__tsan_atomic64_fetch_sub",
1178 "__tsan_atomic8_fetch_and",
1179 "__tsan_atomic16_fetch_and",
1180 "__tsan_atomic32_fetch_and",
1181 "__tsan_atomic64_fetch_and",
1182 "__tsan_atomic8_fetch_or",
1183 "__tsan_atomic16_fetch_or",
1184 "__tsan_atomic32_fetch_or",
1185 "__tsan_atomic64_fetch_or",
1186 "__tsan_atomic8_fetch_xor",
1187 "__tsan_atomic16_fetch_xor",
1188 "__tsan_atomic32_fetch_xor",
1189 "__tsan_atomic64_fetch_xor",
1190 "__tsan_atomic8_fetch_nand",
1191 "__tsan_atomic16_fetch_nand",
1192 "__tsan_atomic32_fetch_nand",
1193 "__tsan_atomic64_fetch_nand",
1194 "__tsan_atomic8_compare_exchange_strong",
1195 "__tsan_atomic16_compare_exchange_strong",
1196 "__tsan_atomic32_compare_exchange_strong",
1197 "__tsan_atomic64_compare_exchange_strong",
1198 "__tsan_atomic8_compare_exchange_weak",
1199 "__tsan_atomic16_compare_exchange_weak",
1200 "__tsan_atomic32_compare_exchange_weak",
1201 "__tsan_atomic64_compare_exchange_weak",
1202 "__tsan_atomic8_compare_exchange_val",
1203 "__tsan_atomic16_compare_exchange_val",
1204 "__tsan_atomic32_compare_exchange_val",
1205 "__tsan_atomic64_compare_exchange_val",
1206 "__tsan_atomic_thread_fence",
1207 "__tsan_atomic_signal_fence",
1208 "__tsan_unaligned_read16",
1209 "__tsan_unaligned_write16",
1213 "__sanitizer_cov_trace_pc",
1214 "__sanitizer_cov_trace_const_cmp1",
1215 "__sanitizer_cov_trace_const_cmp2",
1216 "__sanitizer_cov_trace_const_cmp4",
1217 "__sanitizer_cov_trace_const_cmp8",
1218 "__sanitizer_cov_trace_cmp1",
1219 "__sanitizer_cov_trace_cmp2",
1220 "__sanitizer_cov_trace_cmp4",
1221 "__sanitizer_cov_trace_cmp8",
1222 "__sanitizer_cov_trace_switch",
1224 "kmsan_copy_to_user",
1226 "kmsan_unpoison_entry_regs",
1227 "kmsan_unpoison_memory",
1228 "__msan_chain_origin",
1229 "__msan_get_context_state",
1230 "__msan_instrument_asm_store",
1231 "__msan_metadata_ptr_for_load_1",
1232 "__msan_metadata_ptr_for_load_2",
1233 "__msan_metadata_ptr_for_load_4",
1234 "__msan_metadata_ptr_for_load_8",
1235 "__msan_metadata_ptr_for_load_n",
1236 "__msan_metadata_ptr_for_store_1",
1237 "__msan_metadata_ptr_for_store_2",
1238 "__msan_metadata_ptr_for_store_4",
1239 "__msan_metadata_ptr_for_store_8",
1240 "__msan_metadata_ptr_for_store_n",
1241 "__msan_poison_alloca",
1244 "ubsan_type_mismatch_common",
1245 "__ubsan_handle_type_mismatch",
1246 "__ubsan_handle_type_mismatch_v1",
1247 "__ubsan_handle_shift_out_of_bounds",
1248 "__ubsan_handle_load_invalid_value",
1250 "stackleak_track_stack",
1252 "csum_partial_copy_generic",
1254 "copy_mc_fragile_handle_tail",
1255 "copy_mc_enhanced_fast_string",
1256 "ftrace_likely_update", /* CONFIG_TRACE_BRANCH_PROFILING */
1257 "rep_stos_alternative",
1258 "rep_movs_alternative",
1259 "__copy_user_nocache",
1263 static void add_uaccess_safe(struct objtool_file
*file
)
1265 struct symbol
*func
;
1271 for (name
= uaccess_safe_builtin
; *name
; name
++) {
1272 func
= find_symbol_by_name(file
->elf
, *name
);
1276 func
->uaccess_safe
= true;
1281 * FIXME: For now, just ignore any alternatives which add retpolines. This is
1282 * a temporary hack, as it doesn't allow ORC to unwind from inside a retpoline.
1283 * But it at least allows objtool to understand the control flow *around* the
1286 static int add_ignore_alternatives(struct objtool_file
*file
)
1288 struct section
*rsec
;
1289 struct reloc
*reloc
;
1290 struct instruction
*insn
;
1292 rsec
= find_section_by_name(file
->elf
, ".rela.discard.ignore_alts");
1296 list_for_each_entry(reloc
, &rsec
->reloc_list
, list
) {
1297 if (reloc
->sym
->type
!= STT_SECTION
) {
1298 WARN("unexpected relocation symbol type in %s", rsec
->name
);
1302 insn
= find_insn(file
, reloc
->sym
->sec
, reloc
->addend
);
1304 WARN("bad .discard.ignore_alts entry");
1308 insn
->ignore_alts
= true;
1314 __weak
bool arch_is_retpoline(struct symbol
*sym
)
1319 __weak
bool arch_is_rethunk(struct symbol
*sym
)
1324 static struct reloc
*insn_reloc(struct objtool_file
*file
, struct instruction
*insn
)
1326 struct reloc
*reloc
;
1334 reloc
= find_reloc_by_dest_range(file
->elf
, insn
->sec
,
1335 insn
->offset
, insn
->len
);
1344 static void remove_insn_ops(struct instruction
*insn
)
1346 struct stack_op
*op
, *next
;
1348 for (op
= insn
->stack_ops
; op
; op
= next
) {
1352 insn
->stack_ops
= NULL
;
1355 static void annotate_call_site(struct objtool_file
*file
,
1356 struct instruction
*insn
, bool sibling
)
1358 struct reloc
*reloc
= insn_reloc(file
, insn
);
1359 struct symbol
*sym
= insn_call_dest(insn
);
1365 * Alternative replacement code is just template code which is
1366 * sometimes copied to the original instruction. For now, don't
1367 * annotate it. (In the future we might consider annotating the
1368 * original instruction if/when it ever makes sense to do so.)
1370 if (!strcmp(insn
->sec
->name
, ".altinstr_replacement"))
1373 if (sym
->static_call_tramp
) {
1374 list_add_tail(&insn
->call_node
, &file
->static_call_list
);
1378 if (sym
->retpoline_thunk
) {
1379 list_add_tail(&insn
->call_node
, &file
->retpoline_call_list
);
1384 * Many compilers cannot disable KCOV or sanitizer calls with a function
1385 * attribute so they need a little help, NOP out any such calls from
1388 if (opts
.hack_noinstr
&& insn
->sec
->noinstr
&& sym
->profiling_func
) {
1390 reloc
->type
= R_NONE
;
1391 elf_write_reloc(file
->elf
, reloc
);
1394 elf_write_insn(file
->elf
, insn
->sec
,
1395 insn
->offset
, insn
->len
,
1396 sibling
? arch_ret_insn(insn
->len
)
1397 : arch_nop_insn(insn
->len
));
1399 insn
->type
= sibling
? INSN_RETURN
: INSN_NOP
;
1403 * We've replaced the tail-call JMP insn by two new
1404 * insn: RET; INT3, except we only have a single struct
1405 * insn here. Mark it retpoline_safe to avoid the SLS
1406 * warning, instead of adding another insn.
1408 insn
->retpoline_safe
= true;
1414 if (opts
.mcount
&& sym
->fentry
) {
1416 WARN_INSN(insn
, "tail call to __fentry__ !?!?");
1419 reloc
->type
= R_NONE
;
1420 elf_write_reloc(file
->elf
, reloc
);
1423 elf_write_insn(file
->elf
, insn
->sec
,
1424 insn
->offset
, insn
->len
,
1425 arch_nop_insn(insn
->len
));
1427 insn
->type
= INSN_NOP
;
1430 list_add_tail(&insn
->call_node
, &file
->mcount_loc_list
);
1434 if (insn
->type
== INSN_CALL
&& !insn
->sec
->init
)
1435 list_add_tail(&insn
->call_node
, &file
->call_list
);
1437 if (!sibling
&& dead_end_function(file
, sym
))
1438 insn
->dead_end
= true;
1441 static void add_call_dest(struct objtool_file
*file
, struct instruction
*insn
,
1442 struct symbol
*dest
, bool sibling
)
1444 insn
->_call_dest
= dest
;
1449 * Whatever stack impact regular CALLs have, should be undone
1450 * by the RETURN of the called function.
1452 * Annotated intra-function calls retain the stack_ops but
1453 * are converted to JUMP, see read_intra_function_calls().
1455 remove_insn_ops(insn
);
1457 annotate_call_site(file
, insn
, sibling
);
1460 static void add_retpoline_call(struct objtool_file
*file
, struct instruction
*insn
)
1463 * Retpoline calls/jumps are really dynamic calls/jumps in disguise,
1464 * so convert them accordingly.
1466 switch (insn
->type
) {
1468 insn
->type
= INSN_CALL_DYNAMIC
;
1470 case INSN_JUMP_UNCONDITIONAL
:
1471 insn
->type
= INSN_JUMP_DYNAMIC
;
1473 case INSN_JUMP_CONDITIONAL
:
1474 insn
->type
= INSN_JUMP_DYNAMIC_CONDITIONAL
;
1480 insn
->retpoline_safe
= true;
1483 * Whatever stack impact regular CALLs have, should be undone
1484 * by the RETURN of the called function.
1486 * Annotated intra-function calls retain the stack_ops but
1487 * are converted to JUMP, see read_intra_function_calls().
1489 remove_insn_ops(insn
);
1491 annotate_call_site(file
, insn
, false);
1494 static void add_return_call(struct objtool_file
*file
, struct instruction
*insn
, bool add
)
1497 * Return thunk tail calls are really just returns in disguise,
1498 * so convert them accordingly.
1500 insn
->type
= INSN_RETURN
;
1501 insn
->retpoline_safe
= true;
1504 list_add_tail(&insn
->call_node
, &file
->return_thunk_list
);
1507 static bool is_first_func_insn(struct objtool_file
*file
,
1508 struct instruction
*insn
, struct symbol
*sym
)
1510 if (insn
->offset
== sym
->offset
)
1513 /* Allow direct CALL/JMP past ENDBR */
1515 struct instruction
*prev
= prev_insn_same_sym(file
, insn
);
1517 if (prev
&& prev
->type
== INSN_ENDBR
&&
1518 insn
->offset
== sym
->offset
+ prev
->len
)
1526 * A sibling call is a tail-call to another symbol -- to differentiate from a
1527 * recursive tail-call which is to the same symbol.
1529 static bool jump_is_sibling_call(struct objtool_file
*file
,
1530 struct instruction
*from
, struct instruction
*to
)
1532 struct symbol
*fs
= from
->sym
;
1533 struct symbol
*ts
= to
->sym
;
1535 /* Not a sibling call if from/to a symbol hole */
1539 /* Not a sibling call if not targeting the start of a symbol. */
1540 if (!is_first_func_insn(file
, to
, ts
))
1543 /* Disallow sibling calls into STT_NOTYPE */
1544 if (ts
->type
== STT_NOTYPE
)
1547 /* Must not be self to be a sibling */
1548 return fs
->pfunc
!= ts
->pfunc
;
1552 * Find the destination instructions for all jumps.
1554 static int add_jump_destinations(struct objtool_file
*file
)
1556 struct instruction
*insn
, *jump_dest
;
1557 struct reloc
*reloc
;
1558 struct section
*dest_sec
;
1559 unsigned long dest_off
;
1561 for_each_insn(file
, insn
) {
1562 if (insn
->jump_dest
) {
1564 * handle_group_alt() may have previously set
1565 * 'jump_dest' for some alternatives.
1569 if (!is_static_jump(insn
))
1572 reloc
= insn_reloc(file
, insn
);
1574 dest_sec
= insn
->sec
;
1575 dest_off
= arch_jump_destination(insn
);
1576 } else if (reloc
->sym
->type
== STT_SECTION
) {
1577 dest_sec
= reloc
->sym
->sec
;
1578 dest_off
= arch_dest_reloc_offset(reloc
->addend
);
1579 } else if (reloc
->sym
->retpoline_thunk
) {
1580 add_retpoline_call(file
, insn
);
1582 } else if (reloc
->sym
->return_thunk
) {
1583 add_return_call(file
, insn
, true);
1585 } else if (insn_func(insn
)) {
1587 * External sibling call or internal sibling call with
1590 add_call_dest(file
, insn
, reloc
->sym
, true);
1592 } else if (reloc
->sym
->sec
->idx
) {
1593 dest_sec
= reloc
->sym
->sec
;
1594 dest_off
= reloc
->sym
->sym
.st_value
+
1595 arch_dest_reloc_offset(reloc
->addend
);
1597 /* non-func asm code jumping to another file */
1601 jump_dest
= find_insn(file
, dest_sec
, dest_off
);
1603 struct symbol
*sym
= find_symbol_by_offset(dest_sec
, dest_off
);
1606 * This is a special case for zen_untrain_ret().
1607 * It jumps to __x86_return_thunk(), but objtool
1608 * can't find the thunk's starting RET
1609 * instruction, because the RET is also in the
1610 * middle of another instruction. Objtool only
1611 * knows about the outer instruction.
1613 if (sym
&& sym
->return_thunk
) {
1614 add_return_call(file
, insn
, false);
1618 WARN_INSN(insn
, "can't find jump dest instruction at %s+0x%lx",
1619 dest_sec
->name
, dest_off
);
1624 * Cross-function jump.
1626 if (insn_func(insn
) && insn_func(jump_dest
) &&
1627 insn_func(insn
) != insn_func(jump_dest
)) {
1630 * For GCC 8+, create parent/child links for any cold
1631 * subfunctions. This is _mostly_ redundant with a
1632 * similar initialization in read_symbols().
1634 * If a function has aliases, we want the *first* such
1635 * function in the symbol table to be the subfunction's
1636 * parent. In that case we overwrite the
1637 * initialization done in read_symbols().
1639 * However this code can't completely replace the
1640 * read_symbols() code because this doesn't detect the
1641 * case where the parent function's only reference to a
1642 * subfunction is through a jump table.
1644 if (!strstr(insn_func(insn
)->name
, ".cold") &&
1645 strstr(insn_func(jump_dest
)->name
, ".cold")) {
1646 insn_func(insn
)->cfunc
= insn_func(jump_dest
);
1647 insn_func(jump_dest
)->pfunc
= insn_func(insn
);
1651 if (jump_is_sibling_call(file
, insn
, jump_dest
)) {
1653 * Internal sibling call without reloc or with
1654 * STT_SECTION reloc.
1656 add_call_dest(file
, insn
, insn_func(jump_dest
), true);
1660 insn
->jump_dest
= jump_dest
;
1666 static struct symbol
*find_call_destination(struct section
*sec
, unsigned long offset
)
1668 struct symbol
*call_dest
;
1670 call_dest
= find_func_by_offset(sec
, offset
);
1672 call_dest
= find_symbol_by_offset(sec
, offset
);
1678 * Find the destination instructions for all calls.
1680 static int add_call_destinations(struct objtool_file
*file
)
1682 struct instruction
*insn
;
1683 unsigned long dest_off
;
1684 struct symbol
*dest
;
1685 struct reloc
*reloc
;
1687 for_each_insn(file
, insn
) {
1688 if (insn
->type
!= INSN_CALL
)
1691 reloc
= insn_reloc(file
, insn
);
1693 dest_off
= arch_jump_destination(insn
);
1694 dest
= find_call_destination(insn
->sec
, dest_off
);
1696 add_call_dest(file
, insn
, dest
, false);
1701 if (!insn_call_dest(insn
)) {
1702 WARN_INSN(insn
, "unannotated intra-function call");
1706 if (insn_func(insn
) && insn_call_dest(insn
)->type
!= STT_FUNC
) {
1707 WARN_INSN(insn
, "unsupported call to non-function");
1711 } else if (reloc
->sym
->type
== STT_SECTION
) {
1712 dest_off
= arch_dest_reloc_offset(reloc
->addend
);
1713 dest
= find_call_destination(reloc
->sym
->sec
, dest_off
);
1715 WARN_INSN(insn
, "can't find call dest symbol at %s+0x%lx",
1716 reloc
->sym
->sec
->name
, dest_off
);
1720 add_call_dest(file
, insn
, dest
, false);
1722 } else if (reloc
->sym
->retpoline_thunk
) {
1723 add_retpoline_call(file
, insn
);
1726 add_call_dest(file
, insn
, reloc
->sym
, false);
1733 * The .alternatives section requires some extra special care over and above
1734 * other special sections because alternatives are patched in place.
1736 static int handle_group_alt(struct objtool_file
*file
,
1737 struct special_alt
*special_alt
,
1738 struct instruction
*orig_insn
,
1739 struct instruction
**new_insn
)
1741 struct instruction
*last_new_insn
= NULL
, *insn
, *nop
= NULL
;
1742 struct alt_group
*orig_alt_group
, *new_alt_group
;
1743 unsigned long dest_off
;
1745 orig_alt_group
= orig_insn
->alt_group
;
1746 if (!orig_alt_group
) {
1747 struct instruction
*last_orig_insn
= NULL
;
1749 orig_alt_group
= malloc(sizeof(*orig_alt_group
));
1750 if (!orig_alt_group
) {
1751 WARN("malloc failed");
1754 orig_alt_group
->cfi
= calloc(special_alt
->orig_len
,
1755 sizeof(struct cfi_state
*));
1756 if (!orig_alt_group
->cfi
) {
1757 WARN("calloc failed");
1762 sec_for_each_insn_from(file
, insn
) {
1763 if (insn
->offset
>= special_alt
->orig_off
+ special_alt
->orig_len
)
1766 insn
->alt_group
= orig_alt_group
;
1767 last_orig_insn
= insn
;
1769 orig_alt_group
->orig_group
= NULL
;
1770 orig_alt_group
->first_insn
= orig_insn
;
1771 orig_alt_group
->last_insn
= last_orig_insn
;
1772 orig_alt_group
->nop
= NULL
;
1774 if (orig_alt_group
->last_insn
->offset
+ orig_alt_group
->last_insn
->len
-
1775 orig_alt_group
->first_insn
->offset
!= special_alt
->orig_len
) {
1776 WARN_INSN(orig_insn
, "weirdly overlapping alternative! %ld != %d",
1777 orig_alt_group
->last_insn
->offset
+
1778 orig_alt_group
->last_insn
->len
-
1779 orig_alt_group
->first_insn
->offset
,
1780 special_alt
->orig_len
);
1785 new_alt_group
= malloc(sizeof(*new_alt_group
));
1786 if (!new_alt_group
) {
1787 WARN("malloc failed");
1791 if (special_alt
->new_len
< special_alt
->orig_len
) {
1793 * Insert a fake nop at the end to make the replacement
1794 * alt_group the same size as the original. This is needed to
1795 * allow propagate_alt_cfi() to do its magic. When the last
1796 * instruction affects the stack, the instruction after it (the
1797 * nop) will propagate the new state to the shared CFI array.
1799 nop
= malloc(sizeof(*nop
));
1801 WARN("malloc failed");
1804 memset(nop
, 0, sizeof(*nop
));
1806 nop
->sec
= special_alt
->new_sec
;
1807 nop
->offset
= special_alt
->new_off
+ special_alt
->new_len
;
1808 nop
->len
= special_alt
->orig_len
- special_alt
->new_len
;
1809 nop
->type
= INSN_NOP
;
1810 nop
->sym
= orig_insn
->sym
;
1811 nop
->alt_group
= new_alt_group
;
1812 nop
->ignore
= orig_insn
->ignore_alts
;
1815 if (!special_alt
->new_len
) {
1821 sec_for_each_insn_from(file
, insn
) {
1822 struct reloc
*alt_reloc
;
1824 if (insn
->offset
>= special_alt
->new_off
+ special_alt
->new_len
)
1827 last_new_insn
= insn
;
1829 insn
->ignore
= orig_insn
->ignore_alts
;
1830 insn
->sym
= orig_insn
->sym
;
1831 insn
->alt_group
= new_alt_group
;
1834 * Since alternative replacement code is copy/pasted by the
1835 * kernel after applying relocations, generally such code can't
1836 * have relative-address relocation references to outside the
1837 * .altinstr_replacement section, unless the arch's
1838 * alternatives code can adjust the relative offsets
1841 alt_reloc
= insn_reloc(file
, insn
);
1842 if (alt_reloc
&& arch_pc_relative_reloc(alt_reloc
) &&
1843 !arch_support_alt_relocation(special_alt
, insn
, alt_reloc
)) {
1845 WARN_INSN(insn
, "unsupported relocation in alternatives section");
1849 if (!is_static_jump(insn
))
1852 if (!insn
->immediate
)
1855 dest_off
= arch_jump_destination(insn
);
1856 if (dest_off
== special_alt
->new_off
+ special_alt
->new_len
) {
1857 insn
->jump_dest
= next_insn_same_sec(file
, orig_alt_group
->last_insn
);
1858 if (!insn
->jump_dest
) {
1859 WARN_INSN(insn
, "can't find alternative jump destination");
1865 if (!last_new_insn
) {
1866 WARN_FUNC("can't find last new alternative instruction",
1867 special_alt
->new_sec
, special_alt
->new_off
);
1872 new_alt_group
->orig_group
= orig_alt_group
;
1873 new_alt_group
->first_insn
= *new_insn
;
1874 new_alt_group
->last_insn
= last_new_insn
;
1875 new_alt_group
->nop
= nop
;
1876 new_alt_group
->cfi
= orig_alt_group
->cfi
;
1881 * A jump table entry can either convert a nop to a jump or a jump to a nop.
1882 * If the original instruction is a jump, make the alt entry an effective nop
1883 * by just skipping the original instruction.
1885 static int handle_jump_alt(struct objtool_file
*file
,
1886 struct special_alt
*special_alt
,
1887 struct instruction
*orig_insn
,
1888 struct instruction
**new_insn
)
1890 if (orig_insn
->type
!= INSN_JUMP_UNCONDITIONAL
&&
1891 orig_insn
->type
!= INSN_NOP
) {
1893 WARN_INSN(orig_insn
, "unsupported instruction at jump label");
1897 if (opts
.hack_jump_label
&& special_alt
->key_addend
& 2) {
1898 struct reloc
*reloc
= insn_reloc(file
, orig_insn
);
1901 reloc
->type
= R_NONE
;
1902 elf_write_reloc(file
->elf
, reloc
);
1904 elf_write_insn(file
->elf
, orig_insn
->sec
,
1905 orig_insn
->offset
, orig_insn
->len
,
1906 arch_nop_insn(orig_insn
->len
));
1907 orig_insn
->type
= INSN_NOP
;
1910 if (orig_insn
->type
== INSN_NOP
) {
1911 if (orig_insn
->len
== 2)
1912 file
->jl_nop_short
++;
1914 file
->jl_nop_long
++;
1919 if (orig_insn
->len
== 2)
1924 *new_insn
= next_insn_same_sec(file
, orig_insn
);
1929 * Read all the special sections which have alternate instructions which can be
1930 * patched in or redirected to at runtime. Each instruction having alternate
1931 * instruction(s) has them added to its insn->alts list, which will be
1932 * traversed in validate_branch().
1934 static int add_special_section_alts(struct objtool_file
*file
)
1936 struct list_head special_alts
;
1937 struct instruction
*orig_insn
, *new_insn
;
1938 struct special_alt
*special_alt
, *tmp
;
1939 struct alternative
*alt
;
1942 ret
= special_get_alts(file
->elf
, &special_alts
);
1946 list_for_each_entry_safe(special_alt
, tmp
, &special_alts
, list
) {
1948 orig_insn
= find_insn(file
, special_alt
->orig_sec
,
1949 special_alt
->orig_off
);
1951 WARN_FUNC("special: can't find orig instruction",
1952 special_alt
->orig_sec
, special_alt
->orig_off
);
1958 if (!special_alt
->group
|| special_alt
->new_len
) {
1959 new_insn
= find_insn(file
, special_alt
->new_sec
,
1960 special_alt
->new_off
);
1962 WARN_FUNC("special: can't find new instruction",
1963 special_alt
->new_sec
,
1964 special_alt
->new_off
);
1970 if (special_alt
->group
) {
1971 if (!special_alt
->orig_len
) {
1972 WARN_INSN(orig_insn
, "empty alternative entry");
1976 ret
= handle_group_alt(file
, special_alt
, orig_insn
,
1980 } else if (special_alt
->jump_or_nop
) {
1981 ret
= handle_jump_alt(file
, special_alt
, orig_insn
,
1987 alt
= malloc(sizeof(*alt
));
1989 WARN("malloc failed");
1994 alt
->insn
= new_insn
;
1995 alt
->skip_orig
= special_alt
->skip_orig
;
1996 orig_insn
->ignore_alts
|= special_alt
->skip_alt
;
1997 alt
->next
= orig_insn
->alts
;
1998 orig_insn
->alts
= alt
;
2000 list_del(&special_alt
->list
);
2005 printf("jl\\\tNOP\tJMP\n");
2006 printf("short:\t%ld\t%ld\n", file
->jl_nop_short
, file
->jl_short
);
2007 printf("long:\t%ld\t%ld\n", file
->jl_nop_long
, file
->jl_long
);
2014 static int add_jump_table(struct objtool_file
*file
, struct instruction
*insn
,
2015 struct reloc
*table
)
2017 struct reloc
*reloc
= table
;
2018 struct instruction
*dest_insn
;
2019 struct alternative
*alt
;
2020 struct symbol
*pfunc
= insn_func(insn
)->pfunc
;
2021 unsigned int prev_offset
= 0;
2024 * Each @reloc is a switch table relocation which points to the target
2027 list_for_each_entry_from(reloc
, &table
->sec
->reloc_list
, list
) {
2029 /* Check for the end of the table: */
2030 if (reloc
!= table
&& reloc
->jump_table_start
)
2033 /* Make sure the table entries are consecutive: */
2034 if (prev_offset
&& reloc
->offset
!= prev_offset
+ 8)
2037 /* Detect function pointers from contiguous objects: */
2038 if (reloc
->sym
->sec
== pfunc
->sec
&&
2039 reloc
->addend
== pfunc
->offset
)
2042 dest_insn
= find_insn(file
, reloc
->sym
->sec
, reloc
->addend
);
2046 /* Make sure the destination is in the same function: */
2047 if (!insn_func(dest_insn
) || insn_func(dest_insn
)->pfunc
!= pfunc
)
2050 alt
= malloc(sizeof(*alt
));
2052 WARN("malloc failed");
2056 alt
->insn
= dest_insn
;
2057 alt
->next
= insn
->alts
;
2059 prev_offset
= reloc
->offset
;
2063 WARN_INSN(insn
, "can't find switch jump table");
2071 * find_jump_table() - Given a dynamic jump, find the switch jump table
2072 * associated with it.
2074 static struct reloc
*find_jump_table(struct objtool_file
*file
,
2075 struct symbol
*func
,
2076 struct instruction
*insn
)
2078 struct reloc
*table_reloc
;
2079 struct instruction
*dest_insn
, *orig_insn
= insn
;
2082 * Backward search using the @first_jump_src links, these help avoid
2083 * much of the 'in between' code. Which avoids us getting confused by
2087 insn
&& insn_func(insn
) && insn_func(insn
)->pfunc
== func
;
2088 insn
= insn
->first_jump_src
?: prev_insn_same_sym(file
, insn
)) {
2090 if (insn
!= orig_insn
&& insn
->type
== INSN_JUMP_DYNAMIC
)
2093 /* allow small jumps within the range */
2094 if (insn
->type
== INSN_JUMP_UNCONDITIONAL
&&
2096 (insn
->jump_dest
->offset
<= insn
->offset
||
2097 insn
->jump_dest
->offset
> orig_insn
->offset
))
2100 table_reloc
= arch_find_switch_table(file
, insn
);
2103 dest_insn
= find_insn(file
, table_reloc
->sym
->sec
, table_reloc
->addend
);
2104 if (!dest_insn
|| !insn_func(dest_insn
) || insn_func(dest_insn
)->pfunc
!= func
)
2114 * First pass: Mark the head of each jump table so that in the next pass,
2115 * we know when a given jump table ends and the next one starts.
2117 static void mark_func_jump_tables(struct objtool_file
*file
,
2118 struct symbol
*func
)
2120 struct instruction
*insn
, *last
= NULL
;
2121 struct reloc
*reloc
;
2123 func_for_each_insn(file
, func
, insn
) {
2128 * Store back-pointers for unconditional forward jumps such
2129 * that find_jump_table() can back-track using those and
2130 * avoid some potentially confusing code.
2132 if (insn
->type
== INSN_JUMP_UNCONDITIONAL
&& insn
->jump_dest
&&
2133 insn
->offset
> last
->offset
&&
2134 insn
->jump_dest
->offset
> insn
->offset
&&
2135 !insn
->jump_dest
->first_jump_src
) {
2137 insn
->jump_dest
->first_jump_src
= insn
;
2138 last
= insn
->jump_dest
;
2141 if (insn
->type
!= INSN_JUMP_DYNAMIC
)
2144 reloc
= find_jump_table(file
, func
, insn
);
2146 reloc
->jump_table_start
= true;
2147 insn
->_jump_table
= reloc
;
2152 static int add_func_jump_tables(struct objtool_file
*file
,
2153 struct symbol
*func
)
2155 struct instruction
*insn
;
2158 func_for_each_insn(file
, func
, insn
) {
2159 if (!insn_jump_table(insn
))
2162 ret
= add_jump_table(file
, insn
, insn_jump_table(insn
));
2171 * For some switch statements, gcc generates a jump table in the .rodata
2172 * section which contains a list of addresses within the function to jump to.
2173 * This finds these jump tables and adds them to the insn->alts lists.
2175 static int add_jump_table_alts(struct objtool_file
*file
)
2177 struct symbol
*func
;
2183 for_each_sym(file
, func
) {
2184 if (func
->type
!= STT_FUNC
)
2187 mark_func_jump_tables(file
, func
);
2188 ret
= add_func_jump_tables(file
, func
);
2196 static void set_func_state(struct cfi_state
*state
)
2198 state
->cfa
= initial_func_cfi
.cfa
;
2199 memcpy(&state
->regs
, &initial_func_cfi
.regs
,
2200 CFI_NUM_REGS
* sizeof(struct cfi_reg
));
2201 state
->stack_size
= initial_func_cfi
.cfa
.offset
;
2202 state
->type
= UNWIND_HINT_TYPE_CALL
;
2205 static int read_unwind_hints(struct objtool_file
*file
)
2207 struct cfi_state cfi
= init_cfi
;
2208 struct section
*sec
;
2209 struct unwind_hint
*hint
;
2210 struct instruction
*insn
;
2211 struct reloc
*reloc
;
2214 sec
= find_section_by_name(file
->elf
, ".discard.unwind_hints");
2219 WARN("missing .rela.discard.unwind_hints section");
2223 if (sec
->sh
.sh_size
% sizeof(struct unwind_hint
)) {
2224 WARN("struct unwind_hint size mismatch");
2230 for (i
= 0; i
< sec
->sh
.sh_size
/ sizeof(struct unwind_hint
); i
++) {
2231 hint
= (struct unwind_hint
*)sec
->data
->d_buf
+ i
;
2233 reloc
= find_reloc_by_dest(file
->elf
, sec
, i
* sizeof(*hint
));
2235 WARN("can't find reloc for unwind_hints[%d]", i
);
2239 insn
= find_insn(file
, reloc
->sym
->sec
, reloc
->addend
);
2241 WARN("can't find insn for unwind_hints[%d]", i
);
2247 if (hint
->type
== UNWIND_HINT_TYPE_UNDEFINED
) {
2248 insn
->cfi
= &force_undefined_cfi
;
2252 if (hint
->type
== UNWIND_HINT_TYPE_SAVE
) {
2258 if (hint
->type
== UNWIND_HINT_TYPE_RESTORE
) {
2259 insn
->restore
= true;
2263 if (hint
->type
== UNWIND_HINT_TYPE_REGS_PARTIAL
) {
2264 struct symbol
*sym
= find_symbol_by_offset(insn
->sec
, insn
->offset
);
2266 if (sym
&& sym
->bind
== STB_GLOBAL
) {
2267 if (opts
.ibt
&& insn
->type
!= INSN_ENDBR
&& !insn
->noendbr
) {
2268 WARN_INSN(insn
, "UNWIND_HINT_IRET_REGS without ENDBR");
2273 if (hint
->type
== UNWIND_HINT_TYPE_FUNC
) {
2274 insn
->cfi
= &func_cfi
;
2281 if (arch_decode_hint_reg(hint
->sp_reg
, &cfi
.cfa
.base
)) {
2282 WARN_INSN(insn
, "unsupported unwind_hint sp base reg %d", hint
->sp_reg
);
2286 cfi
.cfa
.offset
= bswap_if_needed(file
->elf
, hint
->sp_offset
);
2287 cfi
.type
= hint
->type
;
2288 cfi
.signal
= hint
->signal
;
2290 insn
->cfi
= cfi_hash_find_or_add(&cfi
);
2296 static int read_noendbr_hints(struct objtool_file
*file
)
2298 struct instruction
*insn
;
2299 struct section
*rsec
;
2300 struct reloc
*reloc
;
2302 rsec
= find_section_by_name(file
->elf
, ".rela.discard.noendbr");
2306 list_for_each_entry(reloc
, &rsec
->reloc_list
, list
) {
2307 insn
= find_insn(file
, reloc
->sym
->sec
, reloc
->sym
->offset
+ reloc
->addend
);
2309 WARN("bad .discard.noendbr entry");
2319 static int read_retpoline_hints(struct objtool_file
*file
)
2321 struct section
*rsec
;
2322 struct instruction
*insn
;
2323 struct reloc
*reloc
;
2325 rsec
= find_section_by_name(file
->elf
, ".rela.discard.retpoline_safe");
2329 list_for_each_entry(reloc
, &rsec
->reloc_list
, list
) {
2330 if (reloc
->sym
->type
!= STT_SECTION
) {
2331 WARN("unexpected relocation symbol type in %s", rsec
->name
);
2335 insn
= find_insn(file
, reloc
->sym
->sec
, reloc
->addend
);
2337 WARN("bad .discard.retpoline_safe entry");
2341 if (insn
->type
!= INSN_JUMP_DYNAMIC
&&
2342 insn
->type
!= INSN_CALL_DYNAMIC
&&
2343 insn
->type
!= INSN_RETURN
&&
2344 insn
->type
!= INSN_NOP
) {
2345 WARN_INSN(insn
, "retpoline_safe hint not an indirect jump/call/ret/nop");
2349 insn
->retpoline_safe
= true;
2355 static int read_instr_hints(struct objtool_file
*file
)
2357 struct section
*rsec
;
2358 struct instruction
*insn
;
2359 struct reloc
*reloc
;
2361 rsec
= find_section_by_name(file
->elf
, ".rela.discard.instr_end");
2365 list_for_each_entry(reloc
, &rsec
->reloc_list
, list
) {
2366 if (reloc
->sym
->type
!= STT_SECTION
) {
2367 WARN("unexpected relocation symbol type in %s", rsec
->name
);
2371 insn
= find_insn(file
, reloc
->sym
->sec
, reloc
->addend
);
2373 WARN("bad .discard.instr_end entry");
2380 rsec
= find_section_by_name(file
->elf
, ".rela.discard.instr_begin");
2384 list_for_each_entry(reloc
, &rsec
->reloc_list
, list
) {
2385 if (reloc
->sym
->type
!= STT_SECTION
) {
2386 WARN("unexpected relocation symbol type in %s", rsec
->name
);
2390 insn
= find_insn(file
, reloc
->sym
->sec
, reloc
->addend
);
2392 WARN("bad .discard.instr_begin entry");
2402 static int read_validate_unret_hints(struct objtool_file
*file
)
2404 struct section
*rsec
;
2405 struct instruction
*insn
;
2406 struct reloc
*reloc
;
2408 rsec
= find_section_by_name(file
->elf
, ".rela.discard.validate_unret");
2412 list_for_each_entry(reloc
, &rsec
->reloc_list
, list
) {
2413 if (reloc
->sym
->type
!= STT_SECTION
) {
2414 WARN("unexpected relocation symbol type in %s", rsec
->name
);
2418 insn
= find_insn(file
, reloc
->sym
->sec
, reloc
->addend
);
2420 WARN("bad .discard.instr_end entry");
2430 static int read_intra_function_calls(struct objtool_file
*file
)
2432 struct instruction
*insn
;
2433 struct section
*rsec
;
2434 struct reloc
*reloc
;
2436 rsec
= find_section_by_name(file
->elf
, ".rela.discard.intra_function_calls");
2440 list_for_each_entry(reloc
, &rsec
->reloc_list
, list
) {
2441 unsigned long dest_off
;
2443 if (reloc
->sym
->type
!= STT_SECTION
) {
2444 WARN("unexpected relocation symbol type in %s",
2449 insn
= find_insn(file
, reloc
->sym
->sec
, reloc
->addend
);
2451 WARN("bad .discard.intra_function_call entry");
2455 if (insn
->type
!= INSN_CALL
) {
2456 WARN_INSN(insn
, "intra_function_call not a direct call");
2461 * Treat intra-function CALLs as JMPs, but with a stack_op.
2462 * See add_call_destinations(), which strips stack_ops from
2465 insn
->type
= INSN_JUMP_UNCONDITIONAL
;
2467 dest_off
= arch_jump_destination(insn
);
2468 insn
->jump_dest
= find_insn(file
, insn
->sec
, dest_off
);
2469 if (!insn
->jump_dest
) {
2470 WARN_INSN(insn
, "can't find call dest at %s+0x%lx",
2471 insn
->sec
->name
, dest_off
);
2480 * Return true if name matches an instrumentation function, where calls to that
2481 * function from noinstr code can safely be removed, but compilers won't do so.
2483 static bool is_profiling_func(const char *name
)
2486 * Many compilers cannot disable KCOV with a function attribute.
2488 if (!strncmp(name
, "__sanitizer_cov_", 16))
2492 * Some compilers currently do not remove __tsan_func_entry/exit nor
2493 * __tsan_atomic_signal_fence (used for barrier instrumentation) with
2494 * the __no_sanitize_thread attribute, remove them. Once the kernel's
2495 * minimum Clang version is 14.0, this can be removed.
2497 if (!strncmp(name
, "__tsan_func_", 12) ||
2498 !strcmp(name
, "__tsan_atomic_signal_fence"))
2504 static int classify_symbols(struct objtool_file
*file
)
2506 struct symbol
*func
;
2508 for_each_sym(file
, func
) {
2509 if (func
->bind
!= STB_GLOBAL
)
2512 if (!strncmp(func
->name
, STATIC_CALL_TRAMP_PREFIX_STR
,
2513 strlen(STATIC_CALL_TRAMP_PREFIX_STR
)))
2514 func
->static_call_tramp
= true;
2516 if (arch_is_retpoline(func
))
2517 func
->retpoline_thunk
= true;
2519 if (arch_is_rethunk(func
))
2520 func
->return_thunk
= true;
2522 if (arch_ftrace_match(func
->name
))
2523 func
->fentry
= true;
2525 if (is_profiling_func(func
->name
))
2526 func
->profiling_func
= true;
2532 static void mark_rodata(struct objtool_file
*file
)
2534 struct section
*sec
;
2538 * Search for the following rodata sections, each of which can
2539 * potentially contain jump tables:
2541 * - .rodata: can contain GCC switch tables
2542 * - .rodata.<func>: same, if -fdata-sections is being used
2543 * - .rodata..c_jump_table: contains C annotated jump tables
2545 * .rodata.str1.* sections are ignored; they don't contain jump tables.
2547 for_each_sec(file
, sec
) {
2548 if (!strncmp(sec
->name
, ".rodata", 7) &&
2549 !strstr(sec
->name
, ".str1.")) {
2555 file
->rodata
= found
;
2558 static int decode_sections(struct objtool_file
*file
)
2564 ret
= init_pv_ops(file
);
2569 * Must be before add_{jump_call}_destination.
2571 ret
= classify_symbols(file
);
2575 ret
= decode_instructions(file
);
2580 add_uaccess_safe(file
);
2582 ret
= add_ignore_alternatives(file
);
2587 * Must be before read_unwind_hints() since that needs insn->noendbr.
2589 ret
= read_noendbr_hints(file
);
2594 * Must be before add_jump_destinations(), which depends on 'func'
2595 * being set for alternatives, to enable proper sibling call detection.
2597 if (opts
.stackval
|| opts
.orc
|| opts
.uaccess
|| opts
.noinstr
) {
2598 ret
= add_special_section_alts(file
);
2603 ret
= add_jump_destinations(file
);
2608 * Must be before add_call_destination(); it changes INSN_CALL to
2611 ret
= read_intra_function_calls(file
);
2615 ret
= add_call_destinations(file
);
2620 * Must be after add_call_destinations() such that it can override
2621 * dead_end_function() marks.
2623 ret
= add_dead_ends(file
);
2627 ret
= add_jump_table_alts(file
);
2631 ret
= read_unwind_hints(file
);
2635 ret
= read_retpoline_hints(file
);
2639 ret
= read_instr_hints(file
);
2643 ret
= read_validate_unret_hints(file
);
2650 static bool is_fentry_call(struct instruction
*insn
)
2652 if (insn
->type
== INSN_CALL
&&
2653 insn_call_dest(insn
) &&
2654 insn_call_dest(insn
)->fentry
)
2660 static bool has_modified_stack_frame(struct instruction
*insn
, struct insn_state
*state
)
2662 struct cfi_state
*cfi
= &state
->cfi
;
2665 if (cfi
->cfa
.base
!= initial_func_cfi
.cfa
.base
|| cfi
->drap
)
2668 if (cfi
->cfa
.offset
!= initial_func_cfi
.cfa
.offset
)
2671 if (cfi
->stack_size
!= initial_func_cfi
.cfa
.offset
)
2674 for (i
= 0; i
< CFI_NUM_REGS
; i
++) {
2675 if (cfi
->regs
[i
].base
!= initial_func_cfi
.regs
[i
].base
||
2676 cfi
->regs
[i
].offset
!= initial_func_cfi
.regs
[i
].offset
)
2683 static bool check_reg_frame_pos(const struct cfi_reg
*reg
,
2684 int expected_offset
)
2686 return reg
->base
== CFI_CFA
&&
2687 reg
->offset
== expected_offset
;
2690 static bool has_valid_stack_frame(struct insn_state
*state
)
2692 struct cfi_state
*cfi
= &state
->cfi
;
2694 if (cfi
->cfa
.base
== CFI_BP
&&
2695 check_reg_frame_pos(&cfi
->regs
[CFI_BP
], -cfi
->cfa
.offset
) &&
2696 check_reg_frame_pos(&cfi
->regs
[CFI_RA
], -cfi
->cfa
.offset
+ 8))
2699 if (cfi
->drap
&& cfi
->regs
[CFI_BP
].base
== CFI_BP
)
2705 static int update_cfi_state_regs(struct instruction
*insn
,
2706 struct cfi_state
*cfi
,
2707 struct stack_op
*op
)
2709 struct cfi_reg
*cfa
= &cfi
->cfa
;
2711 if (cfa
->base
!= CFI_SP
&& cfa
->base
!= CFI_SP_INDIRECT
)
2715 if (op
->dest
.type
== OP_DEST_PUSH
|| op
->dest
.type
== OP_DEST_PUSHF
)
2719 if (op
->src
.type
== OP_SRC_POP
|| op
->src
.type
== OP_SRC_POPF
)
2722 /* add immediate to sp */
2723 if (op
->dest
.type
== OP_DEST_REG
&& op
->src
.type
== OP_SRC_ADD
&&
2724 op
->dest
.reg
== CFI_SP
&& op
->src
.reg
== CFI_SP
)
2725 cfa
->offset
-= op
->src
.offset
;
2730 static void save_reg(struct cfi_state
*cfi
, unsigned char reg
, int base
, int offset
)
2732 if (arch_callee_saved_reg(reg
) &&
2733 cfi
->regs
[reg
].base
== CFI_UNDEFINED
) {
2734 cfi
->regs
[reg
].base
= base
;
2735 cfi
->regs
[reg
].offset
= offset
;
2739 static void restore_reg(struct cfi_state
*cfi
, unsigned char reg
)
2741 cfi
->regs
[reg
].base
= initial_func_cfi
.regs
[reg
].base
;
2742 cfi
->regs
[reg
].offset
= initial_func_cfi
.regs
[reg
].offset
;
2746 * A note about DRAP stack alignment:
2748 * GCC has the concept of a DRAP register, which is used to help keep track of
2749 * the stack pointer when aligning the stack. r10 or r13 is used as the DRAP
2750 * register. The typical DRAP pattern is:
2752 * 4c 8d 54 24 08 lea 0x8(%rsp),%r10
2753 * 48 83 e4 c0 and $0xffffffffffffffc0,%rsp
2754 * 41 ff 72 f8 pushq -0x8(%r10)
2756 * 48 89 e5 mov %rsp,%rbp
2763 * 49 8d 62 f8 lea -0x8(%r10),%rsp
2766 * There are some variations in the epilogues, like:
2774 * 49 8d 62 f8 lea -0x8(%r10),%rsp
2779 * 4c 8b 55 e8 mov -0x18(%rbp),%r10
2780 * 48 8b 5d e0 mov -0x20(%rbp),%rbx
2781 * 4c 8b 65 f0 mov -0x10(%rbp),%r12
2782 * 4c 8b 6d f8 mov -0x8(%rbp),%r13
2784 * 49 8d 62 f8 lea -0x8(%r10),%rsp
2787 * Sometimes r13 is used as the DRAP register, in which case it's saved and
2788 * restored beforehand:
2791 * 4c 8d 6c 24 10 lea 0x10(%rsp),%r13
2792 * 48 83 e4 f0 and $0xfffffffffffffff0,%rsp
2794 * 49 8d 65 f0 lea -0x10(%r13),%rsp
2798 static int update_cfi_state(struct instruction
*insn
,
2799 struct instruction
*next_insn
,
2800 struct cfi_state
*cfi
, struct stack_op
*op
)
2802 struct cfi_reg
*cfa
= &cfi
->cfa
;
2803 struct cfi_reg
*regs
= cfi
->regs
;
2805 /* ignore UNWIND_HINT_UNDEFINED regions */
2806 if (cfi
->force_undefined
)
2809 /* stack operations don't make sense with an undefined CFA */
2810 if (cfa
->base
== CFI_UNDEFINED
) {
2811 if (insn_func(insn
)) {
2812 WARN_INSN(insn
, "undefined stack state");
2818 if (cfi
->type
== UNWIND_HINT_TYPE_REGS
||
2819 cfi
->type
== UNWIND_HINT_TYPE_REGS_PARTIAL
)
2820 return update_cfi_state_regs(insn
, cfi
, op
);
2822 switch (op
->dest
.type
) {
2825 switch (op
->src
.type
) {
2828 if (op
->src
.reg
== CFI_SP
&& op
->dest
.reg
== CFI_BP
&&
2829 cfa
->base
== CFI_SP
&&
2830 check_reg_frame_pos(®s
[CFI_BP
], -cfa
->offset
)) {
2832 /* mov %rsp, %rbp */
2833 cfa
->base
= op
->dest
.reg
;
2834 cfi
->bp_scratch
= false;
2837 else if (op
->src
.reg
== CFI_SP
&&
2838 op
->dest
.reg
== CFI_BP
&& cfi
->drap
) {
2840 /* drap: mov %rsp, %rbp */
2841 regs
[CFI_BP
].base
= CFI_BP
;
2842 regs
[CFI_BP
].offset
= -cfi
->stack_size
;
2843 cfi
->bp_scratch
= false;
2846 else if (op
->src
.reg
== CFI_SP
&& cfa
->base
== CFI_SP
) {
2851 * This is needed for the rare case where GCC
2858 cfi
->vals
[op
->dest
.reg
].base
= CFI_CFA
;
2859 cfi
->vals
[op
->dest
.reg
].offset
= -cfi
->stack_size
;
2862 else if (op
->src
.reg
== CFI_BP
&& op
->dest
.reg
== CFI_SP
&&
2863 (cfa
->base
== CFI_BP
|| cfa
->base
== cfi
->drap_reg
)) {
2868 * Restore the original stack pointer (Clang).
2870 cfi
->stack_size
= -cfi
->regs
[CFI_BP
].offset
;
2873 else if (op
->dest
.reg
== cfa
->base
) {
2875 /* mov %reg, %rsp */
2876 if (cfa
->base
== CFI_SP
&&
2877 cfi
->vals
[op
->src
.reg
].base
== CFI_CFA
) {
2880 * This is needed for the rare case
2881 * where GCC does something dumb like:
2883 * lea 0x8(%rsp), %rcx
2887 cfa
->offset
= -cfi
->vals
[op
->src
.reg
].offset
;
2888 cfi
->stack_size
= cfa
->offset
;
2890 } else if (cfa
->base
== CFI_SP
&&
2891 cfi
->vals
[op
->src
.reg
].base
== CFI_SP_INDIRECT
&&
2892 cfi
->vals
[op
->src
.reg
].offset
== cfa
->offset
) {
2897 * 1: mov %rsp, (%[tos])
2898 * 2: mov %[tos], %rsp
2904 * 1 - places a pointer to the previous
2905 * stack at the Top-of-Stack of the
2908 * 2 - switches to the new stack.
2910 * 3 - pops the Top-of-Stack to restore
2911 * the original stack.
2913 * Note: we set base to SP_INDIRECT
2914 * here and preserve offset. Therefore
2915 * when the unwinder reaches ToS it
2916 * will dereference SP and then add the
2917 * offset to find the next frame, IOW:
2920 cfa
->base
= CFI_SP_INDIRECT
;
2923 cfa
->base
= CFI_UNDEFINED
;
2928 else if (op
->dest
.reg
== CFI_SP
&&
2929 cfi
->vals
[op
->src
.reg
].base
== CFI_SP_INDIRECT
&&
2930 cfi
->vals
[op
->src
.reg
].offset
== cfa
->offset
) {
2933 * The same stack swizzle case 2) as above. But
2934 * because we can't change cfa->base, case 3)
2935 * will become a regular POP. Pretend we're a
2936 * PUSH so things don't go unbalanced.
2938 cfi
->stack_size
+= 8;
2945 if (op
->dest
.reg
== CFI_SP
&& op
->src
.reg
== CFI_SP
) {
2948 cfi
->stack_size
-= op
->src
.offset
;
2949 if (cfa
->base
== CFI_SP
)
2950 cfa
->offset
-= op
->src
.offset
;
2954 if (op
->dest
.reg
== CFI_SP
&& op
->src
.reg
== CFI_BP
) {
2956 /* lea disp(%rbp), %rsp */
2957 cfi
->stack_size
= -(op
->src
.offset
+ regs
[CFI_BP
].offset
);
2961 if (op
->src
.reg
== CFI_SP
&& cfa
->base
== CFI_SP
) {
2963 /* drap: lea disp(%rsp), %drap */
2964 cfi
->drap_reg
= op
->dest
.reg
;
2967 * lea disp(%rsp), %reg
2969 * This is needed for the rare case where GCC
2970 * does something dumb like:
2972 * lea 0x8(%rsp), %rcx
2976 cfi
->vals
[op
->dest
.reg
].base
= CFI_CFA
;
2977 cfi
->vals
[op
->dest
.reg
].offset
= \
2978 -cfi
->stack_size
+ op
->src
.offset
;
2983 if (cfi
->drap
&& op
->dest
.reg
== CFI_SP
&&
2984 op
->src
.reg
== cfi
->drap_reg
) {
2986 /* drap: lea disp(%drap), %rsp */
2988 cfa
->offset
= cfi
->stack_size
= -op
->src
.offset
;
2989 cfi
->drap_reg
= CFI_UNDEFINED
;
2994 if (op
->dest
.reg
== cfi
->cfa
.base
&& !(next_insn
&& next_insn
->hint
)) {
2995 WARN_INSN(insn
, "unsupported stack register modification");
3002 if (op
->dest
.reg
!= CFI_SP
||
3003 (cfi
->drap_reg
!= CFI_UNDEFINED
&& cfa
->base
!= CFI_SP
) ||
3004 (cfi
->drap_reg
== CFI_UNDEFINED
&& cfa
->base
!= CFI_BP
)) {
3005 WARN_INSN(insn
, "unsupported stack pointer realignment");
3009 if (cfi
->drap_reg
!= CFI_UNDEFINED
) {
3010 /* drap: and imm, %rsp */
3011 cfa
->base
= cfi
->drap_reg
;
3012 cfa
->offset
= cfi
->stack_size
= 0;
3017 * Older versions of GCC (4.8ish) realign the stack
3018 * without DRAP, with a frame pointer.
3025 if (op
->dest
.reg
== CFI_SP
&& cfa
->base
== CFI_SP_INDIRECT
) {
3027 /* pop %rsp; # restore from a stack swizzle */
3032 if (!cfi
->drap
&& op
->dest
.reg
== cfa
->base
) {
3038 if (cfi
->drap
&& cfa
->base
== CFI_BP_INDIRECT
&&
3039 op
->dest
.reg
== cfi
->drap_reg
&&
3040 cfi
->drap_offset
== -cfi
->stack_size
) {
3042 /* drap: pop %drap */
3043 cfa
->base
= cfi
->drap_reg
;
3045 cfi
->drap_offset
= -1;
3047 } else if (cfi
->stack_size
== -regs
[op
->dest
.reg
].offset
) {
3050 restore_reg(cfi
, op
->dest
.reg
);
3053 cfi
->stack_size
-= 8;
3054 if (cfa
->base
== CFI_SP
)
3059 case OP_SRC_REG_INDIRECT
:
3060 if (!cfi
->drap
&& op
->dest
.reg
== cfa
->base
&&
3061 op
->dest
.reg
== CFI_BP
) {
3063 /* mov disp(%rsp), %rbp */
3065 cfa
->offset
= cfi
->stack_size
;
3068 if (cfi
->drap
&& op
->src
.reg
== CFI_BP
&&
3069 op
->src
.offset
== cfi
->drap_offset
) {
3071 /* drap: mov disp(%rbp), %drap */
3072 cfa
->base
= cfi
->drap_reg
;
3074 cfi
->drap_offset
= -1;
3077 if (cfi
->drap
&& op
->src
.reg
== CFI_BP
&&
3078 op
->src
.offset
== regs
[op
->dest
.reg
].offset
) {
3080 /* drap: mov disp(%rbp), %reg */
3081 restore_reg(cfi
, op
->dest
.reg
);
3083 } else if (op
->src
.reg
== cfa
->base
&&
3084 op
->src
.offset
== regs
[op
->dest
.reg
].offset
+ cfa
->offset
) {
3086 /* mov disp(%rbp), %reg */
3087 /* mov disp(%rsp), %reg */
3088 restore_reg(cfi
, op
->dest
.reg
);
3090 } else if (op
->src
.reg
== CFI_SP
&&
3091 op
->src
.offset
== regs
[op
->dest
.reg
].offset
+ cfi
->stack_size
) {
3093 /* mov disp(%rsp), %reg */
3094 restore_reg(cfi
, op
->dest
.reg
);
3100 WARN_INSN(insn
, "unknown stack-related instruction");
3108 cfi
->stack_size
+= 8;
3109 if (cfa
->base
== CFI_SP
)
3112 if (op
->src
.type
!= OP_SRC_REG
)
3116 if (op
->src
.reg
== cfa
->base
&& op
->src
.reg
== cfi
->drap_reg
) {
3118 /* drap: push %drap */
3119 cfa
->base
= CFI_BP_INDIRECT
;
3120 cfa
->offset
= -cfi
->stack_size
;
3122 /* save drap so we know when to restore it */
3123 cfi
->drap_offset
= -cfi
->stack_size
;
3125 } else if (op
->src
.reg
== CFI_BP
&& cfa
->base
== cfi
->drap_reg
) {
3127 /* drap: push %rbp */
3128 cfi
->stack_size
= 0;
3132 /* drap: push %reg */
3133 save_reg(cfi
, op
->src
.reg
, CFI_BP
, -cfi
->stack_size
);
3139 save_reg(cfi
, op
->src
.reg
, CFI_CFA
, -cfi
->stack_size
);
3142 /* detect when asm code uses rbp as a scratch register */
3143 if (opts
.stackval
&& insn_func(insn
) && op
->src
.reg
== CFI_BP
&&
3144 cfa
->base
!= CFI_BP
)
3145 cfi
->bp_scratch
= true;
3148 case OP_DEST_REG_INDIRECT
:
3151 if (op
->src
.reg
== cfa
->base
&& op
->src
.reg
== cfi
->drap_reg
) {
3153 /* drap: mov %drap, disp(%rbp) */
3154 cfa
->base
= CFI_BP_INDIRECT
;
3155 cfa
->offset
= op
->dest
.offset
;
3157 /* save drap offset so we know when to restore it */
3158 cfi
->drap_offset
= op
->dest
.offset
;
3161 /* drap: mov reg, disp(%rbp) */
3162 save_reg(cfi
, op
->src
.reg
, CFI_BP
, op
->dest
.offset
);
3165 } else if (op
->dest
.reg
== cfa
->base
) {
3167 /* mov reg, disp(%rbp) */
3168 /* mov reg, disp(%rsp) */
3169 save_reg(cfi
, op
->src
.reg
, CFI_CFA
,
3170 op
->dest
.offset
- cfi
->cfa
.offset
);
3172 } else if (op
->dest
.reg
== CFI_SP
) {
3174 /* mov reg, disp(%rsp) */
3175 save_reg(cfi
, op
->src
.reg
, CFI_CFA
,
3176 op
->dest
.offset
- cfi
->stack_size
);
3178 } else if (op
->src
.reg
== CFI_SP
&& op
->dest
.offset
== 0) {
3180 /* mov %rsp, (%reg); # setup a stack swizzle. */
3181 cfi
->vals
[op
->dest
.reg
].base
= CFI_SP_INDIRECT
;
3182 cfi
->vals
[op
->dest
.reg
].offset
= cfa
->offset
;
3188 if (op
->src
.type
!= OP_SRC_POP
&& op
->src
.type
!= OP_SRC_POPF
) {
3189 WARN_INSN(insn
, "unknown stack-related memory operation");
3194 cfi
->stack_size
-= 8;
3195 if (cfa
->base
== CFI_SP
)
3201 WARN_INSN(insn
, "unknown stack-related instruction");
3209 * The stack layouts of alternatives instructions can sometimes diverge when
3210 * they have stack modifications. That's fine as long as the potential stack
3211 * layouts don't conflict at any given potential instruction boundary.
3213 * Flatten the CFIs of the different alternative code streams (both original
3214 * and replacement) into a single shared CFI array which can be used to detect
3215 * conflicts and nicely feed a linear array of ORC entries to the unwinder.
3217 static int propagate_alt_cfi(struct objtool_file
*file
, struct instruction
*insn
)
3219 struct cfi_state
**alt_cfi
;
3222 if (!insn
->alt_group
)
3226 WARN("CFI missing");
3230 alt_cfi
= insn
->alt_group
->cfi
;
3231 group_off
= insn
->offset
- insn
->alt_group
->first_insn
->offset
;
3233 if (!alt_cfi
[group_off
]) {
3234 alt_cfi
[group_off
] = insn
->cfi
;
3236 if (cficmp(alt_cfi
[group_off
], insn
->cfi
)) {
3237 struct alt_group
*orig_group
= insn
->alt_group
->orig_group
?: insn
->alt_group
;
3238 struct instruction
*orig
= orig_group
->first_insn
;
3239 char *where
= offstr(insn
->sec
, insn
->offset
);
3240 WARN_INSN(orig
, "stack layout conflict in alternatives: %s", where
);
3249 static int handle_insn_ops(struct instruction
*insn
,
3250 struct instruction
*next_insn
,
3251 struct insn_state
*state
)
3253 struct stack_op
*op
;
3255 for (op
= insn
->stack_ops
; op
; op
= op
->next
) {
3257 if (update_cfi_state(insn
, next_insn
, &state
->cfi
, op
))
3260 if (!insn
->alt_group
)
3263 if (op
->dest
.type
== OP_DEST_PUSHF
) {
3264 if (!state
->uaccess_stack
) {
3265 state
->uaccess_stack
= 1;
3266 } else if (state
->uaccess_stack
>> 31) {
3267 WARN_INSN(insn
, "PUSHF stack exhausted");
3270 state
->uaccess_stack
<<= 1;
3271 state
->uaccess_stack
|= state
->uaccess
;
3274 if (op
->src
.type
== OP_SRC_POPF
) {
3275 if (state
->uaccess_stack
) {
3276 state
->uaccess
= state
->uaccess_stack
& 1;
3277 state
->uaccess_stack
>>= 1;
3278 if (state
->uaccess_stack
== 1)
3279 state
->uaccess_stack
= 0;
3287 static bool insn_cfi_match(struct instruction
*insn
, struct cfi_state
*cfi2
)
3289 struct cfi_state
*cfi1
= insn
->cfi
;
3293 WARN("CFI missing");
3297 if (memcmp(&cfi1
->cfa
, &cfi2
->cfa
, sizeof(cfi1
->cfa
))) {
3299 WARN_INSN(insn
, "stack state mismatch: cfa1=%d%+d cfa2=%d%+d",
3300 cfi1
->cfa
.base
, cfi1
->cfa
.offset
,
3301 cfi2
->cfa
.base
, cfi2
->cfa
.offset
);
3303 } else if (memcmp(&cfi1
->regs
, &cfi2
->regs
, sizeof(cfi1
->regs
))) {
3304 for (i
= 0; i
< CFI_NUM_REGS
; i
++) {
3305 if (!memcmp(&cfi1
->regs
[i
], &cfi2
->regs
[i
],
3306 sizeof(struct cfi_reg
)))
3309 WARN_INSN(insn
, "stack state mismatch: reg1[%d]=%d%+d reg2[%d]=%d%+d",
3310 i
, cfi1
->regs
[i
].base
, cfi1
->regs
[i
].offset
,
3311 i
, cfi2
->regs
[i
].base
, cfi2
->regs
[i
].offset
);
3315 } else if (cfi1
->type
!= cfi2
->type
) {
3317 WARN_INSN(insn
, "stack state mismatch: type1=%d type2=%d",
3318 cfi1
->type
, cfi2
->type
);
3320 } else if (cfi1
->drap
!= cfi2
->drap
||
3321 (cfi1
->drap
&& cfi1
->drap_reg
!= cfi2
->drap_reg
) ||
3322 (cfi1
->drap
&& cfi1
->drap_offset
!= cfi2
->drap_offset
)) {
3324 WARN_INSN(insn
, "stack state mismatch: drap1=%d(%d,%d) drap2=%d(%d,%d)",
3325 cfi1
->drap
, cfi1
->drap_reg
, cfi1
->drap_offset
,
3326 cfi2
->drap
, cfi2
->drap_reg
, cfi2
->drap_offset
);
3334 static inline bool func_uaccess_safe(struct symbol
*func
)
3337 return func
->uaccess_safe
;
3342 static inline const char *call_dest_name(struct instruction
*insn
)
3344 static char pvname
[19];
3345 struct reloc
*reloc
;
3348 if (insn_call_dest(insn
))
3349 return insn_call_dest(insn
)->name
;
3351 reloc
= insn_reloc(NULL
, insn
);
3352 if (reloc
&& !strcmp(reloc
->sym
->name
, "pv_ops")) {
3353 idx
= (reloc
->addend
/ sizeof(void *));
3354 snprintf(pvname
, sizeof(pvname
), "pv_ops[%d]", idx
);
3361 static bool pv_call_dest(struct objtool_file
*file
, struct instruction
*insn
)
3363 struct symbol
*target
;
3364 struct reloc
*reloc
;
3367 reloc
= insn_reloc(file
, insn
);
3368 if (!reloc
|| strcmp(reloc
->sym
->name
, "pv_ops"))
3371 idx
= (arch_dest_reloc_offset(reloc
->addend
) / sizeof(void *));
3373 if (file
->pv_ops
[idx
].clean
)
3376 file
->pv_ops
[idx
].clean
= true;
3378 list_for_each_entry(target
, &file
->pv_ops
[idx
].targets
, pv_target
) {
3379 if (!target
->sec
->noinstr
) {
3380 WARN("pv_ops[%d]: %s", idx
, target
->name
);
3381 file
->pv_ops
[idx
].clean
= false;
3385 return file
->pv_ops
[idx
].clean
;
3388 static inline bool noinstr_call_dest(struct objtool_file
*file
,
3389 struct instruction
*insn
,
3390 struct symbol
*func
)
3393 * We can't deal with indirect function calls at present;
3394 * assume they're instrumented.
3398 return pv_call_dest(file
, insn
);
3404 * If the symbol is from a noinstr section; we good.
3406 if (func
->sec
->noinstr
)
3410 * If the symbol is a static_call trampoline, we can't tell.
3412 if (func
->static_call_tramp
)
3416 * The __ubsan_handle_*() calls are like WARN(), they only happen when
3417 * something 'BAD' happened. At the risk of taking the machine down,
3418 * let them proceed to get the message out.
3420 if (!strncmp(func
->name
, "__ubsan_handle_", 15))
3426 static int validate_call(struct objtool_file
*file
,
3427 struct instruction
*insn
,
3428 struct insn_state
*state
)
3430 if (state
->noinstr
&& state
->instr
<= 0 &&
3431 !noinstr_call_dest(file
, insn
, insn_call_dest(insn
))) {
3432 WARN_INSN(insn
, "call to %s() leaves .noinstr.text section", call_dest_name(insn
));
3436 if (state
->uaccess
&& !func_uaccess_safe(insn_call_dest(insn
))) {
3437 WARN_INSN(insn
, "call to %s() with UACCESS enabled", call_dest_name(insn
));
3442 WARN_INSN(insn
, "call to %s() with DF set", call_dest_name(insn
));
3449 static int validate_sibling_call(struct objtool_file
*file
,
3450 struct instruction
*insn
,
3451 struct insn_state
*state
)
3453 if (insn_func(insn
) && has_modified_stack_frame(insn
, state
)) {
3454 WARN_INSN(insn
, "sibling call from callable instruction with modified stack frame");
3458 return validate_call(file
, insn
, state
);
3461 static int validate_return(struct symbol
*func
, struct instruction
*insn
, struct insn_state
*state
)
3463 if (state
->noinstr
&& state
->instr
> 0) {
3464 WARN_INSN(insn
, "return with instrumentation enabled");
3468 if (state
->uaccess
&& !func_uaccess_safe(func
)) {
3469 WARN_INSN(insn
, "return with UACCESS enabled");
3473 if (!state
->uaccess
&& func_uaccess_safe(func
)) {
3474 WARN_INSN(insn
, "return with UACCESS disabled from a UACCESS-safe function");
3479 WARN_INSN(insn
, "return with DF set");
3483 if (func
&& has_modified_stack_frame(insn
, state
)) {
3484 WARN_INSN(insn
, "return with modified stack frame");
3488 if (state
->cfi
.bp_scratch
) {
3489 WARN_INSN(insn
, "BP used as a scratch register");
3496 static struct instruction
*next_insn_to_validate(struct objtool_file
*file
,
3497 struct instruction
*insn
)
3499 struct alt_group
*alt_group
= insn
->alt_group
;
3502 * Simulate the fact that alternatives are patched in-place. When the
3503 * end of a replacement alt_group is reached, redirect objtool flow to
3504 * the end of the original alt_group.
3506 * insn->alts->insn -> alt_group->first_insn
3508 * alt_group->last_insn
3509 * [alt_group->nop] -> next(orig_group->last_insn)
3512 if (alt_group
->nop
) {
3513 /* ->nop implies ->orig_group */
3514 if (insn
== alt_group
->last_insn
)
3515 return alt_group
->nop
;
3516 if (insn
== alt_group
->nop
)
3519 if (insn
== alt_group
->last_insn
&& alt_group
->orig_group
)
3523 return next_insn_same_sec(file
, insn
);
3526 return next_insn_same_sec(file
, alt_group
->orig_group
->last_insn
);
3530 * Follow the branch starting at the given instruction, and recursively follow
3531 * any other branches (jumps). Meanwhile, track the frame pointer state at
3532 * each instruction and validate all the rules described in
3533 * tools/objtool/Documentation/objtool.txt.
3535 static int validate_branch(struct objtool_file
*file
, struct symbol
*func
,
3536 struct instruction
*insn
, struct insn_state state
)
3538 struct alternative
*alt
;
3539 struct instruction
*next_insn
, *prev_insn
= NULL
;
3540 struct section
*sec
;
3547 next_insn
= next_insn_to_validate(file
, insn
);
3549 if (func
&& insn_func(insn
) && func
!= insn_func(insn
)->pfunc
) {
3550 /* Ignore KCFI type preambles, which always fall through */
3551 if (!strncmp(func
->name
, "__cfi_", 6) ||
3552 !strncmp(func
->name
, "__pfx_", 6))
3555 WARN("%s() falls through to next function %s()",
3556 func
->name
, insn_func(insn
)->name
);
3560 if (func
&& insn
->ignore
) {
3561 WARN_INSN(insn
, "BUG: why am I validating an ignored function?");
3565 visited
= VISITED_BRANCH
<< state
.uaccess
;
3566 if (insn
->visited
& VISITED_BRANCH_MASK
) {
3567 if (!insn
->hint
&& !insn_cfi_match(insn
, &state
.cfi
))
3570 if (insn
->visited
& visited
)
3577 state
.instr
+= insn
->instr
;
3580 if (insn
->restore
) {
3581 struct instruction
*save_insn
, *i
;
3586 sym_for_each_insn_continue_reverse(file
, func
, i
) {
3594 WARN_INSN(insn
, "no corresponding CFI save for CFI restore");
3598 if (!save_insn
->visited
) {
3599 WARN_INSN(insn
, "objtool isn't smart enough to handle this CFI save/restore combo");
3603 insn
->cfi
= save_insn
->cfi
;
3607 state
.cfi
= *insn
->cfi
;
3609 /* XXX track if we actually changed state.cfi */
3611 if (prev_insn
&& !cficmp(prev_insn
->cfi
, &state
.cfi
)) {
3612 insn
->cfi
= prev_insn
->cfi
;
3615 insn
->cfi
= cfi_hash_find_or_add(&state
.cfi
);
3619 insn
->visited
|= visited
;
3621 if (propagate_alt_cfi(file
, insn
))
3624 if (!insn
->ignore_alts
&& insn
->alts
) {
3625 bool skip_orig
= false;
3627 for (alt
= insn
->alts
; alt
; alt
= alt
->next
) {
3631 ret
= validate_branch(file
, func
, alt
->insn
, state
);
3633 BT_INSN(insn
, "(alt)");
3642 if (handle_insn_ops(insn
, next_insn
, &state
))
3645 switch (insn
->type
) {
3648 return validate_return(func
, insn
, &state
);
3651 case INSN_CALL_DYNAMIC
:
3652 ret
= validate_call(file
, insn
, &state
);
3656 if (opts
.stackval
&& func
&& !is_fentry_call(insn
) &&
3657 !has_valid_stack_frame(&state
)) {
3658 WARN_INSN(insn
, "call without frame pointer save/setup");
3667 case INSN_JUMP_CONDITIONAL
:
3668 case INSN_JUMP_UNCONDITIONAL
:
3669 if (is_sibling_call(insn
)) {
3670 ret
= validate_sibling_call(file
, insn
, &state
);
3674 } else if (insn
->jump_dest
) {
3675 ret
= validate_branch(file
, func
,
3676 insn
->jump_dest
, state
);
3678 BT_INSN(insn
, "(branch)");
3683 if (insn
->type
== INSN_JUMP_UNCONDITIONAL
)
3688 case INSN_JUMP_DYNAMIC
:
3689 case INSN_JUMP_DYNAMIC_CONDITIONAL
:
3690 if (is_sibling_call(insn
)) {
3691 ret
= validate_sibling_call(file
, insn
, &state
);
3696 if (insn
->type
== INSN_JUMP_DYNAMIC
)
3701 case INSN_CONTEXT_SWITCH
:
3702 if (func
&& (!next_insn
|| !next_insn
->hint
)) {
3703 WARN_INSN(insn
, "unsupported instruction in callable function");
3709 if (state
.uaccess
) {
3710 WARN_INSN(insn
, "recursive UACCESS enable");
3714 state
.uaccess
= true;
3718 if (!state
.uaccess
&& func
) {
3719 WARN_INSN(insn
, "redundant UACCESS disable");
3723 if (func_uaccess_safe(func
) && !state
.uaccess_stack
) {
3724 WARN_INSN(insn
, "UACCESS-safe disables UACCESS");
3728 state
.uaccess
= false;
3733 WARN_INSN(insn
, "recursive STD");
3741 if (!state
.df
&& func
) {
3742 WARN_INSN(insn
, "redundant CLD");
3757 if (state
.cfi
.cfa
.base
== CFI_UNDEFINED
)
3759 WARN("%s: unexpected end of section", sec
->name
);
3770 static int validate_unwind_hint(struct objtool_file
*file
,
3771 struct instruction
*insn
,
3772 struct insn_state
*state
)
3774 if (insn
->hint
&& !insn
->visited
&& !insn
->ignore
) {
3775 int ret
= validate_branch(file
, insn_func(insn
), insn
, *state
);
3777 BT_INSN(insn
, "<=== (hint)");
3784 static int validate_unwind_hints(struct objtool_file
*file
, struct section
*sec
)
3786 struct instruction
*insn
;
3787 struct insn_state state
;
3793 init_insn_state(file
, &state
, sec
);
3796 sec_for_each_insn(file
, sec
, insn
)
3797 warnings
+= validate_unwind_hint(file
, insn
, &state
);
3799 for_each_insn(file
, insn
)
3800 warnings
+= validate_unwind_hint(file
, insn
, &state
);
3807 * Validate rethunk entry constraint: must untrain RET before the first RET.
3809 * Follow every branch (intra-function) and ensure VALIDATE_UNRET_END comes
3810 * before an actual RET instruction.
3812 static int validate_unret(struct objtool_file
*file
, struct instruction
*insn
)
3814 struct instruction
*next
, *dest
;
3818 next
= next_insn_to_validate(file
, insn
);
3820 if (insn
->visited
& VISITED_UNRET
)
3823 insn
->visited
|= VISITED_UNRET
;
3825 if (!insn
->ignore_alts
&& insn
->alts
) {
3826 struct alternative
*alt
;
3827 bool skip_orig
= false;
3829 for (alt
= insn
->alts
; alt
; alt
= alt
->next
) {
3833 ret
= validate_unret(file
, alt
->insn
);
3835 BT_INSN(insn
, "(alt)");
3844 switch (insn
->type
) {
3846 case INSN_CALL_DYNAMIC
:
3847 case INSN_JUMP_DYNAMIC
:
3848 case INSN_JUMP_DYNAMIC_CONDITIONAL
:
3849 WARN_INSN(insn
, "early indirect call");
3852 case INSN_JUMP_UNCONDITIONAL
:
3853 case INSN_JUMP_CONDITIONAL
:
3854 if (!is_sibling_call(insn
)) {
3855 if (!insn
->jump_dest
) {
3856 WARN_INSN(insn
, "unresolved jump target after linking?!?");
3859 ret
= validate_unret(file
, insn
->jump_dest
);
3861 BT_INSN(insn
, "(branch%s)",
3862 insn
->type
== INSN_JUMP_CONDITIONAL
? "-cond" : "");
3866 if (insn
->type
== INSN_JUMP_UNCONDITIONAL
)
3874 dest
= find_insn(file
, insn_call_dest(insn
)->sec
,
3875 insn_call_dest(insn
)->offset
);
3877 WARN("Unresolved function after linking!?: %s",
3878 insn_call_dest(insn
)->name
);
3882 ret
= validate_unret(file
, dest
);
3884 BT_INSN(insn
, "(call)");
3888 * If a call returns without error, it must have seen UNTRAIN_RET.
3889 * Therefore any non-error return is a success.
3894 WARN_INSN(insn
, "RET before UNTRAIN");
3898 if (insn
->retpoline_safe
)
3907 WARN_INSN(insn
, "teh end!");
3917 * Validate that all branches starting at VALIDATE_UNRET_BEGIN encounter
3918 * VALIDATE_UNRET_END before RET.
3920 static int validate_unrets(struct objtool_file
*file
)
3922 struct instruction
*insn
;
3923 int ret
, warnings
= 0;
3925 for_each_insn(file
, insn
) {
3929 ret
= validate_unret(file
, insn
);
3931 WARN_INSN(insn
, "Failed UNRET validation");
3940 static int validate_retpoline(struct objtool_file
*file
)
3942 struct instruction
*insn
;
3945 for_each_insn(file
, insn
) {
3946 if (insn
->type
!= INSN_JUMP_DYNAMIC
&&
3947 insn
->type
!= INSN_CALL_DYNAMIC
&&
3948 insn
->type
!= INSN_RETURN
)
3951 if (insn
->retpoline_safe
)
3954 if (insn
->sec
->init
)
3957 if (insn
->type
== INSN_RETURN
) {
3959 WARN_INSN(insn
, "'naked' return found in RETHUNK build");
3963 WARN_INSN(insn
, "indirect %s found in RETPOLINE build",
3964 insn
->type
== INSN_JUMP_DYNAMIC
? "jump" : "call");
3973 static bool is_kasan_insn(struct instruction
*insn
)
3975 return (insn
->type
== INSN_CALL
&&
3976 !strcmp(insn_call_dest(insn
)->name
, "__asan_handle_no_return"));
3979 static bool is_ubsan_insn(struct instruction
*insn
)
3981 return (insn
->type
== INSN_CALL
&&
3982 !strcmp(insn_call_dest(insn
)->name
,
3983 "__ubsan_handle_builtin_unreachable"));
3986 static bool ignore_unreachable_insn(struct objtool_file
*file
, struct instruction
*insn
)
3989 struct instruction
*prev_insn
;
3991 if (insn
->ignore
|| insn
->type
== INSN_NOP
|| insn
->type
== INSN_TRAP
)
3995 * Ignore alternative replacement instructions. This can happen
3996 * when a whitelisted function uses one of the ALTERNATIVE macros.
3998 if (!strcmp(insn
->sec
->name
, ".altinstr_replacement") ||
3999 !strcmp(insn
->sec
->name
, ".altinstr_aux"))
4003 * Whole archive runs might encounter dead code from weak symbols.
4004 * This is where the linker will have dropped the weak symbol in
4005 * favour of a regular symbol, but leaves the code in place.
4007 * In this case we'll find a piece of code (whole function) that is not
4008 * covered by a !section symbol. Ignore them.
4010 if (opts
.link
&& !insn_func(insn
)) {
4011 int size
= find_symbol_hole_containing(insn
->sec
, insn
->offset
);
4012 unsigned long end
= insn
->offset
+ size
;
4014 if (!size
) /* not a hole */
4017 if (size
< 0) /* hole until the end */
4020 sec_for_each_insn_continue(file
, insn
) {
4022 * If we reach a visited instruction at or before the
4023 * end of the hole, ignore the unreachable.
4028 if (insn
->offset
>= end
)
4032 * If this hole jumps to a .cold function, mark it ignore too.
4034 if (insn
->jump_dest
&& insn_func(insn
->jump_dest
) &&
4035 strstr(insn_func(insn
->jump_dest
)->name
, ".cold")) {
4036 struct instruction
*dest
= insn
->jump_dest
;
4037 func_for_each_insn(file
, insn_func(dest
), dest
)
4038 dest
->ignore
= true;
4045 if (!insn_func(insn
))
4048 if (insn_func(insn
)->static_call_tramp
)
4052 * CONFIG_UBSAN_TRAP inserts a UD2 when it sees
4053 * __builtin_unreachable(). The BUG() macro has an unreachable() after
4054 * the UD2, which causes GCC's undefined trap logic to emit another UD2
4055 * (or occasionally a JMP to UD2).
4057 * It may also insert a UD2 after calling a __noreturn function.
4059 prev_insn
= prev_insn_same_sec(file
, insn
);
4060 if (prev_insn
->dead_end
&&
4061 (insn
->type
== INSN_BUG
||
4062 (insn
->type
== INSN_JUMP_UNCONDITIONAL
&&
4063 insn
->jump_dest
&& insn
->jump_dest
->type
== INSN_BUG
)))
4067 * Check if this (or a subsequent) instruction is related to
4068 * CONFIG_UBSAN or CONFIG_KASAN.
4070 * End the search at 5 instructions to avoid going into the weeds.
4072 for (i
= 0; i
< 5; i
++) {
4074 if (is_kasan_insn(insn
) || is_ubsan_insn(insn
))
4077 if (insn
->type
== INSN_JUMP_UNCONDITIONAL
) {
4078 if (insn
->jump_dest
&&
4079 insn_func(insn
->jump_dest
) == insn_func(insn
)) {
4080 insn
= insn
->jump_dest
;
4087 if (insn
->offset
+ insn
->len
>= insn_func(insn
)->offset
+ insn_func(insn
)->len
)
4090 insn
= next_insn_same_sec(file
, insn
);
4096 static int add_prefix_symbol(struct objtool_file
*file
, struct symbol
*func
)
4098 struct instruction
*insn
, *prev
;
4099 struct cfi_state
*cfi
;
4101 insn
= find_insn(file
, func
->sec
, func
->offset
);
4105 for (prev
= prev_insn_same_sec(file
, insn
);
4107 prev
= prev_insn_same_sec(file
, prev
)) {
4110 if (prev
->type
!= INSN_NOP
)
4113 offset
= func
->offset
- prev
->offset
;
4115 if (offset
> opts
.prefix
)
4118 if (offset
< opts
.prefix
)
4121 elf_create_prefix_symbol(file
->elf
, func
, opts
.prefix
);
4130 * This can happen if stack validation isn't enabled or the
4131 * function is annotated with STACK_FRAME_NON_STANDARD.
4136 /* Propagate insn->cfi to the prefix code */
4137 cfi
= cfi_hash_find_or_add(insn
->cfi
);
4138 for (; prev
!= insn
; prev
= next_insn_same_sec(file
, prev
))
4144 static int add_prefix_symbols(struct objtool_file
*file
)
4146 struct section
*sec
;
4147 struct symbol
*func
;
4149 for_each_sec(file
, sec
) {
4150 if (!(sec
->sh
.sh_flags
& SHF_EXECINSTR
))
4153 sec_for_each_sym(sec
, func
) {
4154 if (func
->type
!= STT_FUNC
)
4157 add_prefix_symbol(file
, func
);
4164 static int validate_symbol(struct objtool_file
*file
, struct section
*sec
,
4165 struct symbol
*sym
, struct insn_state
*state
)
4167 struct instruction
*insn
;
4171 WARN("%s() is missing an ELF size annotation", sym
->name
);
4175 if (sym
->pfunc
!= sym
|| sym
->alias
!= sym
)
4178 insn
= find_insn(file
, sec
, sym
->offset
);
4179 if (!insn
|| insn
->ignore
|| insn
->visited
)
4182 state
->uaccess
= sym
->uaccess_safe
;
4184 ret
= validate_branch(file
, insn_func(insn
), insn
, *state
);
4186 BT_INSN(insn
, "<=== (sym)");
4190 static int validate_section(struct objtool_file
*file
, struct section
*sec
)
4192 struct insn_state state
;
4193 struct symbol
*func
;
4196 sec_for_each_sym(sec
, func
) {
4197 if (func
->type
!= STT_FUNC
)
4200 init_insn_state(file
, &state
, sec
);
4201 set_func_state(&state
.cfi
);
4203 warnings
+= validate_symbol(file
, sec
, func
, &state
);
4209 static int validate_noinstr_sections(struct objtool_file
*file
)
4211 struct section
*sec
;
4214 sec
= find_section_by_name(file
->elf
, ".noinstr.text");
4216 warnings
+= validate_section(file
, sec
);
4217 warnings
+= validate_unwind_hints(file
, sec
);
4220 sec
= find_section_by_name(file
->elf
, ".entry.text");
4222 warnings
+= validate_section(file
, sec
);
4223 warnings
+= validate_unwind_hints(file
, sec
);
4226 sec
= find_section_by_name(file
->elf
, ".cpuidle.text");
4228 warnings
+= validate_section(file
, sec
);
4229 warnings
+= validate_unwind_hints(file
, sec
);
4235 static int validate_functions(struct objtool_file
*file
)
4237 struct section
*sec
;
4240 for_each_sec(file
, sec
) {
4241 if (!(sec
->sh
.sh_flags
& SHF_EXECINSTR
))
4244 warnings
+= validate_section(file
, sec
);
4250 static void mark_endbr_used(struct instruction
*insn
)
4252 if (!list_empty(&insn
->call_node
))
4253 list_del_init(&insn
->call_node
);
4256 static bool noendbr_range(struct objtool_file
*file
, struct instruction
*insn
)
4258 struct symbol
*sym
= find_symbol_containing(insn
->sec
, insn
->offset
-1);
4259 struct instruction
*first
;
4264 first
= find_insn(file
, sym
->sec
, sym
->offset
);
4268 if (first
->type
!= INSN_ENDBR
&& !first
->noendbr
)
4271 return insn
->offset
== sym
->offset
+ sym
->len
;
4274 static int validate_ibt_insn(struct objtool_file
*file
, struct instruction
*insn
)
4276 struct instruction
*dest
;
4277 struct reloc
*reloc
;
4282 * Looking for function pointer load relocations. Ignore
4283 * direct/indirect branches:
4285 switch (insn
->type
) {
4287 case INSN_CALL_DYNAMIC
:
4288 case INSN_JUMP_CONDITIONAL
:
4289 case INSN_JUMP_UNCONDITIONAL
:
4290 case INSN_JUMP_DYNAMIC
:
4291 case INSN_JUMP_DYNAMIC_CONDITIONAL
:
4299 for (reloc
= insn_reloc(file
, insn
);
4301 reloc
= find_reloc_by_dest_range(file
->elf
, insn
->sec
,
4303 (insn
->offset
+ insn
->len
) - (reloc
->offset
+ 1))) {
4306 * static_call_update() references the trampoline, which
4307 * doesn't have (or need) ENDBR. Skip warning in that case.
4309 if (reloc
->sym
->static_call_tramp
)
4312 off
= reloc
->sym
->offset
;
4313 if (reloc
->type
== R_X86_64_PC32
|| reloc
->type
== R_X86_64_PLT32
)
4314 off
+= arch_dest_reloc_offset(reloc
->addend
);
4316 off
+= reloc
->addend
;
4318 dest
= find_insn(file
, reloc
->sym
->sec
, off
);
4322 if (dest
->type
== INSN_ENDBR
) {
4323 mark_endbr_used(dest
);
4327 if (insn_func(dest
) && insn_func(dest
) == insn_func(insn
)) {
4329 * Anything from->to self is either _THIS_IP_ or
4332 * There is no sane way to annotate _THIS_IP_ since the
4333 * compiler treats the relocation as a constant and is
4334 * happy to fold in offsets, skewing any annotation we
4335 * do, leading to vast amounts of false-positives.
4337 * There's also compiler generated _THIS_IP_ through
4338 * KCOV and such which we have no hope of annotating.
4340 * As such, blanket accept self-references without
4347 * Accept anything ANNOTATE_NOENDBR.
4353 * Accept if this is the instruction after a symbol
4354 * that is (no)endbr -- typical code-range usage.
4356 if (noendbr_range(file
, dest
))
4359 WARN_INSN(insn
, "relocation to !ENDBR: %s", offstr(dest
->sec
, dest
->offset
));
4367 static int validate_ibt_data_reloc(struct objtool_file
*file
,
4368 struct reloc
*reloc
)
4370 struct instruction
*dest
;
4372 dest
= find_insn(file
, reloc
->sym
->sec
,
4373 reloc
->sym
->offset
+ reloc
->addend
);
4377 if (dest
->type
== INSN_ENDBR
) {
4378 mark_endbr_used(dest
);
4385 WARN_FUNC("data relocation to !ENDBR: %s",
4386 reloc
->sec
->base
, reloc
->offset
,
4387 offstr(dest
->sec
, dest
->offset
));
4393 * Validate IBT rules and remove used ENDBR instructions from the seal list.
4394 * Unused ENDBR instructions will be annotated for sealing (i.e., replaced with
4395 * NOPs) later, in create_ibt_endbr_seal_sections().
4397 static int validate_ibt(struct objtool_file
*file
)
4399 struct section
*sec
;
4400 struct reloc
*reloc
;
4401 struct instruction
*insn
;
4404 for_each_insn(file
, insn
)
4405 warnings
+= validate_ibt_insn(file
, insn
);
4407 for_each_sec(file
, sec
) {
4409 /* Already done by validate_ibt_insn() */
4410 if (sec
->sh
.sh_flags
& SHF_EXECINSTR
)
4417 * These sections can reference text addresses, but not with
4418 * the intent to indirect branch to them.
4420 if ((!strncmp(sec
->name
, ".discard", 8) &&
4421 strcmp(sec
->name
, ".discard.ibt_endbr_noseal")) ||
4422 !strncmp(sec
->name
, ".debug", 6) ||
4423 !strcmp(sec
->name
, ".altinstructions") ||
4424 !strcmp(sec
->name
, ".ibt_endbr_seal") ||
4425 !strcmp(sec
->name
, ".orc_unwind_ip") ||
4426 !strcmp(sec
->name
, ".parainstructions") ||
4427 !strcmp(sec
->name
, ".retpoline_sites") ||
4428 !strcmp(sec
->name
, ".smp_locks") ||
4429 !strcmp(sec
->name
, ".static_call_sites") ||
4430 !strcmp(sec
->name
, "_error_injection_whitelist") ||
4431 !strcmp(sec
->name
, "_kprobe_blacklist") ||
4432 !strcmp(sec
->name
, "__bug_table") ||
4433 !strcmp(sec
->name
, "__ex_table") ||
4434 !strcmp(sec
->name
, "__jump_table") ||
4435 !strcmp(sec
->name
, "__mcount_loc") ||
4436 !strcmp(sec
->name
, ".kcfi_traps") ||
4437 strstr(sec
->name
, "__patchable_function_entries"))
4440 list_for_each_entry(reloc
, &sec
->rsec
->reloc_list
, list
)
4441 warnings
+= validate_ibt_data_reloc(file
, reloc
);
4447 static int validate_sls(struct objtool_file
*file
)
4449 struct instruction
*insn
, *next_insn
;
4452 for_each_insn(file
, insn
) {
4453 next_insn
= next_insn_same_sec(file
, insn
);
4455 if (insn
->retpoline_safe
)
4458 switch (insn
->type
) {
4460 if (!next_insn
|| next_insn
->type
!= INSN_TRAP
) {
4461 WARN_INSN(insn
, "missing int3 after ret");
4466 case INSN_JUMP_DYNAMIC
:
4467 if (!next_insn
|| next_insn
->type
!= INSN_TRAP
) {
4468 WARN_INSN(insn
, "missing int3 after indirect jump");
4480 static bool ignore_noreturn_call(struct instruction
*insn
)
4482 struct symbol
*call_dest
= insn_call_dest(insn
);
4485 * FIXME: hack, we need a real noreturn solution
4487 * Problem is, exc_double_fault() may or may not return, depending on
4488 * whether CONFIG_X86_ESPFIX64 is set. But objtool has no visibility
4489 * to the kernel config.
4491 * Other potential ways to fix it:
4493 * - have compiler communicate __noreturn functions somehow
4494 * - remove CONFIG_X86_ESPFIX64
4495 * - read the .config file
4496 * - add a cmdline option
4497 * - create a generic objtool annotation format (vs a bunch of custom
4498 * formats) and annotate it
4500 if (!strcmp(call_dest
->name
, "exc_double_fault")) {
4501 /* prevent further unreachable warnings for the caller */
4502 insn
->sym
->warned
= 1;
4509 static int validate_reachable_instructions(struct objtool_file
*file
)
4511 struct instruction
*insn
, *prev_insn
;
4512 struct symbol
*call_dest
;
4515 if (file
->ignore_unreachables
)
4518 for_each_insn(file
, insn
) {
4519 if (insn
->visited
|| ignore_unreachable_insn(file
, insn
))
4522 prev_insn
= prev_insn_same_sec(file
, insn
);
4523 if (prev_insn
&& prev_insn
->dead_end
) {
4524 call_dest
= insn_call_dest(prev_insn
);
4525 if (call_dest
&& !ignore_noreturn_call(prev_insn
)) {
4526 WARN_INSN(insn
, "%s() is missing a __noreturn annotation",
4533 WARN_INSN(insn
, "unreachable instruction");
4540 /* 'funcs' is a space-separated list of function names */
4541 static int disas_funcs(const char *funcs
)
4543 const char *objdump_str
, *cross_compile
;
4547 cross_compile
= getenv("CROSS_COMPILE");
4549 objdump_str
= "%sobjdump -wdr %s | gawk -M -v _funcs='%s' '"
4550 "BEGIN { split(_funcs, funcs); }"
4551 "/^$/ { func_match = 0; }"
4553 "f = gensub(/.*<(.*)>:/, \"\\\\1\", 1);"
4554 "for (i in funcs) {"
4555 "if (funcs[i] == f) {"
4557 "base = strtonum(\"0x\" $1);"
4564 "addr = strtonum(\"0x\" $1);"
4565 "printf(\"%%04x \", addr - base);"
4570 /* fake snprintf() to calculate the size */
4571 size
= snprintf(NULL
, 0, objdump_str
, cross_compile
, objname
, funcs
) + 1;
4573 WARN("objdump string size calculation failed");
4579 /* real snprintf() */
4580 snprintf(cmd
, size
, objdump_str
, cross_compile
, objname
, funcs
);
4583 WARN("disassembly failed: %d", ret
);
4590 static int disas_warned_funcs(struct objtool_file
*file
)
4593 char *funcs
= NULL
, *tmp
;
4595 for_each_sym(file
, sym
) {
4598 funcs
= malloc(strlen(sym
->name
) + 1);
4599 strcpy(funcs
, sym
->name
);
4601 tmp
= malloc(strlen(funcs
) + strlen(sym
->name
) + 2);
4602 sprintf(tmp
, "%s %s", funcs
, sym
->name
);
4615 int check(struct objtool_file
*file
)
4617 int ret
, warnings
= 0;
4619 arch_initial_func_cfi_state(&initial_func_cfi
);
4620 init_cfi_state(&init_cfi
);
4621 init_cfi_state(&func_cfi
);
4622 set_func_state(&func_cfi
);
4623 init_cfi_state(&force_undefined_cfi
);
4624 force_undefined_cfi
.force_undefined
= true;
4626 if (!cfi_hash_alloc(1UL << (file
->elf
->symbol_bits
- 3)))
4629 cfi_hash_add(&init_cfi
);
4630 cfi_hash_add(&func_cfi
);
4632 ret
= decode_sections(file
);
4641 if (opts
.retpoline
) {
4642 ret
= validate_retpoline(file
);
4648 if (opts
.stackval
|| opts
.orc
|| opts
.uaccess
) {
4649 ret
= validate_functions(file
);
4654 ret
= validate_unwind_hints(file
, NULL
);
4660 ret
= validate_reachable_instructions(file
);
4666 } else if (opts
.noinstr
) {
4667 ret
= validate_noinstr_sections(file
);
4675 * Must be after validate_branch() and friends, it plays
4676 * further games with insn->visited.
4678 ret
= validate_unrets(file
);
4685 ret
= validate_ibt(file
);
4692 ret
= validate_sls(file
);
4698 if (opts
.static_call
) {
4699 ret
= create_static_call_sections(file
);
4705 if (opts
.retpoline
) {
4706 ret
= create_retpoline_sites_sections(file
);
4713 ret
= create_cfi_sections(file
);
4720 ret
= create_return_sites_sections(file
);
4725 if (opts
.hack_skylake
) {
4726 ret
= create_direct_call_sections(file
);
4734 ret
= create_mcount_loc_sections(file
);
4741 ret
= add_prefix_symbols(file
);
4748 ret
= create_ibt_endbr_seal_sections(file
);
4754 if (opts
.orc
&& nr_insns
) {
4755 ret
= orc_create(file
);
4762 disas_warned_funcs(file
);
4765 printf("nr_insns_visited: %ld\n", nr_insns_visited
);
4766 printf("nr_cfi: %ld\n", nr_cfi
);
4767 printf("nr_cfi_reused: %ld\n", nr_cfi_reused
);
4768 printf("nr_cfi_cache: %ld\n", nr_cfi_cache
);
4773 * For now, don't fail the kernel build on fatal warnings. These
4774 * errors are still fairly common due to the growing matrix of
4775 * supported toolchains and their recent pace of change.