]> git.ipfire.org Git - thirdparty/linux.git/blame - tools/objtool/check.c
projects / thirdparty / linux.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
objtool: Get rid of reloc->rel[a]
[thirdparty/linux.git] / tools / objtool / check.c
CommitLineData
1ccea77e 1// SPDX-License-Identifier: GPL-2.0-or-later
dcc914f4
JP		 2/*
3 * Copyright (C) 2015-2017 Josh Poimboeuf <jpoimboe@redhat.com>
dcc914f4
JP		 4 */
5
6#include <string.h>
7#include <stdlib.h>
22682a07 8#include <inttypes.h>
8b946cc3 9#include <sys/mman.h>
dcc914f4 10
7786032e
VG		 11#include <objtool/builtin.h>
12#include <objtool/cfi.h>
13#include <objtool/arch.h>
14#include <objtool/check.h>
15#include <objtool/special.h>
16#include <objtool/warn.h>
17#include <objtool/endianness.h>
dcc914f4 18
f7515d9f 19#include <linux/objtool_types.h>
dcc914f4
JP		 20#include <linux/hashtable.h>
21#include <linux/kernel.h>
1e7e4788 22#include <linux/static_call_types.h>
dcc914f4 23
dcc914f4 24struct alternative {
d5406654 25 struct alternative *next;
dcc914f4 26 struct instruction *insn;
764eef4b 27 bool skip_orig;
dcc914f4
JP		 28};
29
8b946cc3
PZ		 30static unsigned long nr_cfi, nr_cfi_reused, nr_cfi_cache;
31
32static struct cfi_init_state initial_func_cfi;
33static struct cfi_state init_cfi;
34static struct cfi_state func_cfi;
1e4b6191 35static struct cfi_state force_undefined_cfi;
dcc914f4 36
627fce14
JP		 37struct instruction *find_insn(struct objtool_file *file,
38 struct section *sec, unsigned long offset)
dcc914f4
JP		 39{
40 struct instruction *insn;
41
87ecb582 42 hash_for_each_possible(file->insn_hash, insn, hash, sec_offset_hash(sec, offset)) {
dcc914f4
JP		 43 if (insn->sec == sec && insn->offset == offset)
44 return insn;
87ecb582 45 }
dcc914f4
JP		 46
47 return NULL;
48}
49
1c34496e
PZ		 50struct instruction *next_insn_same_sec(struct objtool_file *file,
51 struct instruction *insn)
dcc914f4 52{
1c34496e
PZ		 53 if (insn->idx == INSN_CHUNK_MAX)
54 return find_insn(file, insn->sec, insn->offset + insn->len);
dcc914f4 55
1c34496e
PZ		 56 insn++;
57 if (!insn->len)
dcc914f4
JP		 58 return NULL;
59
1c34496e 60 return insn;
dcc914f4
JP		 61}
62
13810435
JP		 63static struct instruction *next_insn_same_func(struct objtool_file *file,
64 struct instruction *insn)
65{
1c34496e 66 struct instruction *next = next_insn_same_sec(file, insn);
dbcdbdfd 67 struct symbol *func = insn_func(insn);
13810435
JP		 68
69 if (!func)
70 return NULL;
71
1c34496e 72 if (next && insn_func(next) == func)
13810435
JP		 73 return next;
74
75 /* Check if we're already in the subfunction: */
76 if (func == func->cfunc)
77 return NULL;
78
79 /* Move to the subfunction: */
80 return find_insn(file, func->cfunc->sec, func->cfunc->offset);
81}
82
1c34496e
PZ		 83static struct instruction *prev_insn_same_sec(struct objtool_file *file,
84 struct instruction *insn)
85{
86 if (insn->idx == 0) {
87 if (insn->prev_len)
88 return find_insn(file, insn->sec, insn->offset - insn->prev_len);
89 return NULL;
90 }
91
92 return insn - 1;
93}
94
1119d265 95static struct instruction *prev_insn_same_sym(struct objtool_file *file,
1c34496e 96 struct instruction *insn)
1119d265 97{
1c34496e 98 struct instruction *prev = prev_insn_same_sec(file, insn);
1119d265 99
1c34496e 100 if (prev && insn_func(prev) == insn_func(insn))
1119d265
JP		 101 return prev;
102
103 return NULL;
104}
105
1c34496e
PZ		 106#define for_each_insn(file, insn) \
107 for (struct section *__sec, *__fake = (struct section *)1; \
108 __fake; __fake = NULL) \
109 for_each_sec(file, __sec) \
110 sec_for_each_insn(file, __sec, insn)
111
f0f70adb 112#define func_for_each_insn(file, func, insn) \
13810435
JP		 113 for (insn = find_insn(file, func->sec, func->offset); \
114 insn; \
115 insn = next_insn_same_func(file, insn))
116
dbf4aeb0
PZ		 117#define sym_for_each_insn(file, sym, insn) \
118 for (insn = find_insn(file, sym->sec, sym->offset); \
1c34496e
PZ		 119 insn && insn->offset < sym->offset + sym->len; \
120 insn = next_insn_same_sec(file, insn))
dcc914f4 121
dbf4aeb0 122#define sym_for_each_insn_continue_reverse(file, sym, insn) \
1c34496e
PZ		 123 for (insn = prev_insn_same_sec(file, insn); \
124 insn && insn->offset >= sym->offset; \
125 insn = prev_insn_same_sec(file, insn))
dcc914f4
JP		 126
127#define sec_for_each_insn_from(file, insn) \
128 for (; insn; insn = next_insn_same_sec(file, insn))
129
baa41469
JP		 130#define sec_for_each_insn_continue(file, insn) \
131 for (insn = next_insn_same_sec(file, insn); insn; \
132 insn = next_insn_same_sec(file, insn))
dcc914f4 133
c6f5dc28
PZ		 134static inline struct symbol *insn_call_dest(struct instruction *insn)
135{
136 if (insn->type == INSN_JUMP_DYNAMIC ||
137 insn->type == INSN_CALL_DYNAMIC)
138 return NULL;
139
140 return insn->_call_dest;
141}
142
143static inline struct reloc *insn_jump_table(struct instruction *insn)
144{
145 if (insn->type == INSN_JUMP_DYNAMIC ||
146 insn->type == INSN_CALL_DYNAMIC)
147 return insn->_jump_table;
148
149 return NULL;
150}
151
99033461
JP		 152static bool is_jump_table_jump(struct instruction *insn)
153{
154 struct alt_group *alt_group = insn->alt_group;
155
c6f5dc28 156 if (insn_jump_table(insn))
99033461
JP		 157 return true;
158
159 /* Retpoline alternative for a jump table? */
160 return alt_group && alt_group->orig_group &&
c6f5dc28 161 insn_jump_table(alt_group->orig_group->first_insn);
99033461
JP		 162}
163
0c1ddd33
JP		 164static bool is_sibling_call(struct instruction *insn)
165{
ecf11ba4 166 /*
5a9c361a 167 * Assume only STT_FUNC calls have jump-tables.
ecf11ba4 168 */
5a9c361a
PZ		 169 if (insn_func(insn)) {
170 /* An indirect jump is either a sibling call or a jump to a table. */
171 if (insn->type == INSN_JUMP_DYNAMIC)
172 return !is_jump_table_jump(insn);
173 }
0c1ddd33 174
c6f5dc28
PZ		 175 /* add_jump_destinations() sets insn_call_dest(insn) for sibling calls. */
176 return (is_static_jump(insn) && insn_call_dest(insn));
0c1ddd33
JP		 177}
178
dcc914f4
JP		 179/*
180 * This checks to see if the given function is a "noreturn" function.
181 *
182 * For global functions which are outside the scope of this object file, we
183 * have to keep a manual list of them.
184 *
185 * For local functions, we have to detect them manually by simply looking for
186 * the lack of a return instruction.
dcc914f4 187 */
8e25c9f8
JP		 188static bool __dead_end_function(struct objtool_file *file, struct symbol *func,
189 int recursion)
dcc914f4
JP		 190{
191 int i;
192 struct instruction *insn;
193 bool empty = true;
194
6245ce4a 195#define NORETURN(func) __stringify(func),
dcc914f4 196 static const char * const global_noreturns[] = {
6245ce4a 197#include "noreturns.h"
dcc914f4 198 };
6245ce4a 199#undef NORETURN
dcc914f4 200
c9bab22b
JP		 201 if (!func)
202 return false;
203
1c47c875 204 if (func->bind == STB_GLOBAL || func->bind == STB_WEAK)
dcc914f4
JP		 205 for (i = 0; i < ARRAY_SIZE(global_noreturns); i++)
206 if (!strcmp(func->name, global_noreturns[i]))
8e25c9f8 207 return true;
dcc914f4 208
1c47c875
JP		 209 if (func->bind == STB_WEAK)
210 return false;
211
13810435 212 if (!func->len)
8e25c9f8 213 return false;
dcc914f4 214
13810435 215 insn = find_insn(file, func->sec, func->offset);
5f6e430f 216 if (!insn || !insn_func(insn))
8e25c9f8 217 return false;
13810435 218
f0f70adb 219 func_for_each_insn(file, func, insn) {
dcc914f4
JP		 220 empty = false;
221
222 if (insn->type == INSN_RETURN)
8e25c9f8 223 return false;
dcc914f4
JP		 224 }
225
226 if (empty)
8e25c9f8 227 return false;
dcc914f4
JP		 228
229 /*
230 * A function can have a sibling call instead of a return. In that
231 * case, the function's dead-end status depends on whether the target
232 * of the sibling call returns.
233 */
f0f70adb 234 func_for_each_insn(file, func, insn) {
0c1ddd33 235 if (is_sibling_call(insn)) {
dcc914f4 236 struct instruction *dest = insn->jump_dest;
dcc914f4
JP		 237
238 if (!dest)
239 /* sibling call to another file */
8e25c9f8 240 return false;
dcc914f4 241
0c1ddd33
JP		 242 /* local sibling call */
243 if (recursion == 5) {
244 /*
245 * Infinite recursion: two functions have
246 * sibling calls to each other. This is a very
247 * rare case. It means they aren't dead ends.
248 */
249 return false;
dcc914f4 250 }
dcc914f4 251
dbcdbdfd 252 return __dead_end_function(file, insn_func(dest), recursion+1);
0c1ddd33 253 }
dcc914f4
JP		 254 }
255
8e25c9f8 256 return true;
dcc914f4
JP		 257}
258
8e25c9f8 259static bool dead_end_function(struct objtool_file *file, struct symbol *func)
dcc914f4
JP		 260{
261 return __dead_end_function(file, func, 0);
262}
263
e7c0219b 264static void init_cfi_state(struct cfi_state *cfi)
baa41469
JP		 265{
266 int i;
267
dd88a0a0 268 for (i = 0; i < CFI_NUM_REGS; i++) {
e7c0219b
PZ		 269 cfi->regs[i].base = CFI_UNDEFINED;
270 cfi->vals[i].base = CFI_UNDEFINED;
dd88a0a0 271 }
e7c0219b
PZ		 272 cfi->cfa.base = CFI_UNDEFINED;
273 cfi->drap_reg = CFI_UNDEFINED;
274 cfi->drap_offset = -1;
275}
276
753da417
JP		 277static void init_insn_state(struct objtool_file *file, struct insn_state *state,
278 struct section *sec)
e7c0219b
PZ		 279{
280 memset(state, 0, sizeof(*state));
281 init_cfi_state(&state->cfi);
932f8e98
PZ		 282
283 /*
284 * We need the full vmlinux for noinstr validation, otherwise we can
c6f5dc28
PZ		 285 * not correctly determine insn_call_dest(insn)->sec (external symbols
286 * do not have a section).
932f8e98 287 */
753da417 288 if (opts.link && opts.noinstr && sec)
932f8e98 289 state->noinstr = sec->noinstr;
baa41469
JP		 290}
291
8b946cc3
PZ		 292static struct cfi_state *cfi_alloc(void)
293{
294 struct cfi_state *cfi = calloc(sizeof(struct cfi_state), 1);
295 if (!cfi) {
296 WARN("calloc failed");
297 exit(1);
298 }
299 nr_cfi++;
300 return cfi;
301}
302
303static int cfi_bits;
304static struct hlist_head *cfi_hash;
305
306static inline bool cficmp(struct cfi_state *cfi1, struct cfi_state *cfi2)
307{
308 return memcmp((void *)cfi1 + sizeof(cfi1->hash),
309 (void *)cfi2 + sizeof(cfi2->hash),
310 sizeof(struct cfi_state) - sizeof(struct hlist_node));
311}
312
313static inline u32 cfi_key(struct cfi_state *cfi)
314{
315 return jhash((void *)cfi + sizeof(cfi->hash),
316 sizeof(*cfi) - sizeof(cfi->hash), 0);
317}
318
319static struct cfi_state *cfi_hash_find_or_add(struct cfi_state *cfi)
320{
321 struct hlist_head *head = &cfi_hash[hash_min(cfi_key(cfi), cfi_bits)];
322 struct cfi_state *obj;
323
324 hlist_for_each_entry(obj, head, hash) {
325 if (!cficmp(cfi, obj)) {
326 nr_cfi_cache++;
327 return obj;
328 }
329 }
330
331 obj = cfi_alloc();
332 *obj = *cfi;
333 hlist_add_head(&obj->hash, head);
334
335 return obj;
336}
337
338static void cfi_hash_add(struct cfi_state *cfi)
339{
340 struct hlist_head *head = &cfi_hash[hash_min(cfi_key(cfi), cfi_bits)];
341
342 hlist_add_head(&cfi->hash, head);
343}
344
345static void *cfi_hash_alloc(unsigned long size)
346{
347 cfi_bits = max(10, ilog2(size));
348 cfi_hash = mmap(NULL, sizeof(struct hlist_head) << cfi_bits,
349 PROT_READ|PROT_WRITE,
350 MAP_PRIVATE|MAP_ANON, -1, 0);
351 if (cfi_hash == (void *)-1L) {
352 WARN("mmap fail cfi_hash");
353 cfi_hash = NULL;
2daf7fab 354 } else if (opts.stats) {
8b946cc3
PZ		 355 printf("cfi_bits: %d\n", cfi_bits);
356 }
357
358 return cfi_hash;
359}
360
361static unsigned long nr_insns;
362static unsigned long nr_insns_visited;
363
dcc914f4
JP		 364/*
365 * Call the arch-specific instruction decoder for all the instructions and add
366 * them to the global instruction list.
367 */
368static int decode_instructions(struct objtool_file *file)
369{
370 struct section *sec;
371 struct symbol *func;
372 unsigned long offset;
373 struct instruction *insn;
374 int ret;
375
baa41469 376 for_each_sec(file, sec) {
1c34496e
PZ		 377 struct instruction *insns = NULL;
378 u8 prev_len = 0;
379 u8 idx = 0;
dcc914f4
JP		 380
381 if (!(sec->sh.sh_flags & SHF_EXECINSTR))
382 continue;
383
627fce14
JP		 384 if (strcmp(sec->name, ".altinstr_replacement") &&
385 strcmp(sec->name, ".altinstr_aux") &&
386 strncmp(sec->name, ".discard.", 9))
387 sec->text = true;
388
0cc9ac8d 389 if (!strcmp(sec->name, ".noinstr.text") ||
951ddecf 390 !strcmp(sec->name, ".entry.text") ||
2b5a0e42 391 !strcmp(sec->name, ".cpuidle.text") ||
951ddecf 392 !strncmp(sec->name, ".text.__x86.", 12))
c4a33939
PZ		 393 sec->noinstr = true;
394
6644ee84
PZ		 395 /*
396 * .init.text code is ran before userspace and thus doesn't
397 * strictly need retpolines, except for modules which are
398 * loaded late, they very much do need retpoline in their
399 * .init.text
400 */
401 if (!strcmp(sec->name, ".init.text") && !opts.module)
402 sec->init = true;
403
fe255fe6 404 for (offset = 0; offset < sec->sh.sh_size; offset += insn->len) {
1c34496e
PZ		 405 if (!insns || idx == INSN_CHUNK_MAX) {
406 insns = calloc(sizeof(*insn), INSN_CHUNK_SIZE);
407 if (!insns) {
408 WARN("malloc failed");
409 return -1;
410 }
411 idx = 0;
412 } else {
413 idx++;
baa41469 414 }
1c34496e
PZ		 415 insn = &insns[idx];
416 insn->idx = idx;
baa41469 417
1c34496e 418 INIT_LIST_HEAD(&insn->call_node);
dcc914f4
JP		 419 insn->sec = sec;
420 insn->offset = offset;
1c34496e 421 insn->prev_len = prev_len;
dcc914f4 422
db2b0c5d 423 ret = arch_decode_instruction(file, sec, offset,
fe255fe6 424 sec->sh.sh_size - offset,
20a55463 425 insn);
dcc914f4 426 if (ret)
1c34496e
PZ		 427 return ret;
428
429 prev_len = insn->len;
dcc914f4 430
0e5b613b
PZ		 431 /*
432 * By default, "ud2" is a dead end unless otherwise
433 * annotated, because GCC 7 inserts it for certain
434 * divide-by-zero cases.
435 */
436 if (insn->type == INSN_BUG)
437 insn->dead_end = true;
438
87ecb582 439 hash_add(file->insn_hash, &insn->hash, sec_offset_hash(sec, insn->offset));
1e11f3fd 440 nr_insns++;
dcc914f4
JP		 441 }
442
1c34496e
PZ		 443// printf("%s: last chunk used: %d\n", sec->name, (int)idx);
444
9290e772 445 sec_for_each_sym(sec, func) {
dbcdbdfd
PZ		 446 if (func->type != STT_NOTYPE && func->type != STT_FUNC)
447 continue;
448
cad90e53
NP		 449 if (func->offset == sec->sh.sh_size) {
450 /* Heuristic: likely an "end" symbol */
451 if (func->type == STT_NOTYPE)
452 continue;
453 WARN("%s(): STT_FUNC at end of section",
454 func->name);
455 return -1;
456 }
457
dbcdbdfd 458 if (func->return_thunk || func->alias != func)
dcc914f4
JP		 459 continue;
460
461 if (!find_insn(file, sec, func->offset)) {
462 WARN("%s(): can't find starting instruction",
463 func->name);
464 return -1;
465 }
466
08f87a93 467 sym_for_each_insn(file, func, insn) {
dbcdbdfd
PZ		 468 insn->sym = func;
469 if (func->type == STT_FUNC &&
470 insn->type == INSN_ENDBR &&
471 list_empty(&insn->call_node)) {
472 if (insn->offset == func->offset) {
89bc853e 473 list_add_tail(&insn->call_node, &file->endbr_list);
08f87a93
PZ		 474 file->nr_endbr++;
475 } else {
476 file->nr_endbr_int++;
477 }
478 }
479 }
dcc914f4
JP		 480 }
481 }
482
2daf7fab 483 if (opts.stats)
1e11f3fd
PZ		 484 printf("nr_insns: %lu\n", nr_insns);
485
dcc914f4
JP		 486 return 0;
487}
488
db2b0c5d
PZ		 489/*
490 * Read the pv_ops[] .data table to find the static initialized values.
491 */
492static int add_pv_ops(struct objtool_file *file, const char *symname)
493{
494 struct symbol *sym, *func;
495 unsigned long off, end;
a5bd6236 496 struct reloc *reloc;
db2b0c5d
PZ		 497 int idx;
498
499 sym = find_symbol_by_name(file->elf, symname);
500 if (!sym)
501 return 0;
502
503 off = sym->offset;
504 end = off + sym->len;
505 for (;;) {
a5bd6236
JP		 506 reloc = find_reloc_by_dest_range(file->elf, sym->sec, off, end - off);
507 if (!reloc)
db2b0c5d
PZ		 508 break;
509
a5bd6236 510 func = reloc->sym;
db2b0c5d 511 if (func->type == STT_SECTION)
0696b6e3
JP		 512 func = find_symbol_by_offset(reloc->sym->sec,
513 reloc_addend(reloc));
db2b0c5d 514
e4cbb9b8 515 idx = (reloc_offset(reloc) - sym->offset) / sizeof(unsigned long);
db2b0c5d
PZ		 516
517 objtool_pv_add(file, idx, func);
518
e4cbb9b8 519 off = reloc_offset(reloc) + 1;
db2b0c5d
PZ		 520 if (off > end)
521 break;
522 }
523
524 return 0;
525}
526
527/*
528 * Allocate and initialize file->pv_ops[].
529 */
530static int init_pv_ops(struct objtool_file *file)
531{
532 static const char *pv_ops_tables[] = {
533 "pv_ops",
534 "xen_cpu_ops",
535 "xen_irq_ops",
536 "xen_mmu_ops",
537 NULL,
538 };
539 const char *pv_ops;
540 struct symbol *sym;
541 int idx, nr;
542
2daf7fab 543 if (!opts.noinstr)
db2b0c5d
PZ		 544 return 0;
545
546 file->pv_ops = NULL;
547
548 sym = find_symbol_by_name(file->elf, "pv_ops");
549 if (!sym)
550 return 0;
551
552 nr = sym->len / sizeof(unsigned long);
553 file->pv_ops = calloc(sizeof(struct pv_state), nr);
554 if (!file->pv_ops)
555 return -1;
556
557 for (idx = 0; idx < nr; idx++)
558 INIT_LIST_HEAD(&file->pv_ops[idx].targets);
559
560 for (idx = 0; (pv_ops = pv_ops_tables[idx]); idx++)
561 add_pv_ops(file, pv_ops);
562
563 return 0;
564}
565
6b5dd716
ST		 566static struct instruction *find_last_insn(struct objtool_file *file,
567 struct section *sec)
568{
569 struct instruction *insn = NULL;
570 unsigned int offset;
fe255fe6 571 unsigned int end = (sec->sh.sh_size > 10) ? sec->sh.sh_size - 10 : 0;
6b5dd716 572
fe255fe6 573 for (offset = sec->sh.sh_size - 1; offset >= end && !insn; offset--)
6b5dd716
ST		 574 insn = find_insn(file, sec, offset);
575
576 return insn;
577}
578
dcc914f4 579/*
649ea4d5 580 * Mark "ud2" instructions and manually annotated dead ends.
dcc914f4
JP		 581 */
582static int add_dead_ends(struct objtool_file *file)
583{
a5bd6236 584 struct section *rsec;
f1974222 585 struct reloc *reloc;
dcc914f4 586 struct instruction *insn;
0696b6e3 587 s64 addend;
dcc914f4 588
649ea4d5
JP		 589 /*
590 * Check for manually annotated dead ends.
591 */
a5bd6236
JP		 592 rsec = find_section_by_name(file->elf, ".rela.discard.unreachable");
593 if (!rsec)
649ea4d5 594 goto reachable;
dcc914f4 595
caa4a6b7 596 for_each_reloc(rsec, reloc) {
0696b6e3 597
f1974222 598 if (reloc->sym->type != STT_SECTION) {
a5bd6236 599 WARN("unexpected relocation symbol type in %s", rsec->name);
dcc914f4
JP		 600 return -1;
601 }
0696b6e3
JP		 602
603 addend = reloc_addend(reloc);
604
605 insn = find_insn(file, reloc->sym->sec, addend);
dcc914f4 606 if (insn)
1c34496e 607 insn = prev_insn_same_sec(file, insn);
0696b6e3 608 else if (addend == reloc->sym->sec->sh.sh_size) {
f1974222 609 insn = find_last_insn(file, reloc->sym->sec);
6b5dd716 610 if (!insn) {
22682a07 611 WARN("can't find unreachable insn at %s+0x%" PRIx64,
0696b6e3 612 reloc->sym->sec->name, addend);
dcc914f4
JP		 613 return -1;
614 }
615 } else {
22682a07 616 WARN("can't find unreachable insn at %s+0x%" PRIx64,
0696b6e3 617 reloc->sym->sec->name, addend);
dcc914f4
JP		 618 return -1;
619 }
620
621 insn->dead_end = true;
622 }
623
649ea4d5
JP		 624reachable:
625 /*
626 * These manually annotated reachable checks are needed for GCC 4.4,
627 * where the Linux unreachable() macro isn't supported. In that case
628 * GCC doesn't know the "ud2" is fatal, so it generates code as if it's
629 * not a dead end.
630 */
a5bd6236
JP		 631 rsec = find_section_by_name(file->elf, ".rela.discard.reachable");
632 if (!rsec)
649ea4d5
JP		 633 return 0;
634
caa4a6b7 635 for_each_reloc(rsec, reloc) {
0696b6e3 636
f1974222 637 if (reloc->sym->type != STT_SECTION) {
a5bd6236 638 WARN("unexpected relocation symbol type in %s", rsec->name);
649ea4d5
JP		 639 return -1;
640 }
0696b6e3
JP		 641
642 addend = reloc_addend(reloc);
643
644 insn = find_insn(file, reloc->sym->sec, addend);
649ea4d5 645 if (insn)
1c34496e 646 insn = prev_insn_same_sec(file, insn);
0696b6e3 647 else if (addend == reloc->sym->sec->sh.sh_size) {
f1974222 648 insn = find_last_insn(file, reloc->sym->sec);
6b5dd716 649 if (!insn) {
22682a07 650 WARN("can't find reachable insn at %s+0x%" PRIx64,
0696b6e3 651 reloc->sym->sec->name, addend);
649ea4d5
JP		 652 return -1;
653 }
654 } else {
22682a07 655 WARN("can't find reachable insn at %s+0x%" PRIx64,
0696b6e3 656 reloc->sym->sec->name, addend);
649ea4d5
JP		 657 return -1;
658 }
659
660 insn->dead_end = false;
661 }
662
dcc914f4
JP		 663 return 0;
664}
665
1e7e4788
JP		 666static int create_static_call_sections(struct objtool_file *file)
667{
1e7e4788 668 struct static_call_site *site;
6342a20e 669 struct section *sec;
1e7e4788
JP		 670 struct instruction *insn;
671 struct symbol *key_sym;
672 char *key_name, *tmp;
673 int idx;
674
675 sec = find_section_by_name(file->elf, ".static_call_sites");
676 if (sec) {
677 INIT_LIST_HEAD(&file->static_call_list);
678 WARN("file already has .static_call_sites section, skipping");
679 return 0;
680 }
681
682 if (list_empty(&file->static_call_list))
683 return 0;
684
685 idx = 0;
43d5430a 686 list_for_each_entry(insn, &file->static_call_list, call_node)
1e7e4788
JP		 687 idx++;
688
6342a20e
JP		 689 sec = elf_create_section_pair(file->elf, ".static_call_sites",
690 sizeof(*site), idx, idx * 2);
1e7e4788
JP		 691 if (!sec)
692 return -1;
693
6342a20e 694 /* Allow modules to modify the low bits of static_call_site::key */
2707579d
JP		 695 sec->sh.sh_flags |= SHF_WRITE;
696
1e7e4788 697 idx = 0;
43d5430a 698 list_for_each_entry(insn, &file->static_call_list, call_node) {
1e7e4788 699
1e7e4788 700 /* populate reloc for 'addr' */
6342a20e
JP		 701 if (!elf_init_reloc_text_sym(file->elf, sec,
702 idx * sizeof(*site), idx * 2,
703 insn->sec, insn->offset))
44f6a7c0 704 return -1;
1e7e4788
JP		 705
706 /* find key symbol */
c6f5dc28 707 key_name = strdup(insn_call_dest(insn)->name);
1e7e4788
JP		 708 if (!key_name) {
709 perror("strdup");
710 return -1;
711 }
712 if (strncmp(key_name, STATIC_CALL_TRAMP_PREFIX_STR,
713 STATIC_CALL_TRAMP_PREFIX_LEN)) {
714 WARN("static_call: trampoline name malformed: %s", key_name);
3da73f10 715 free(key_name);
1e7e4788
JP		 716 return -1;
717 }
718 tmp = key_name + STATIC_CALL_TRAMP_PREFIX_LEN - STATIC_CALL_KEY_PREFIX_LEN;
719 memcpy(tmp, STATIC_CALL_KEY_PREFIX_STR, STATIC_CALL_KEY_PREFIX_LEN);
720
721 key_sym = find_symbol_by_name(file->elf, tmp);
722 if (!key_sym) {
2daf7fab 723 if (!opts.module) {
73f44fe1 724 WARN("static_call: can't find static_call_key symbol: %s", tmp);
3da73f10 725 free(key_name);
73f44fe1
JP		 726 return -1;
727 }
728
729 /*
730 * For modules(), the key might not be exported, which
731 * means the module can make static calls but isn't
732 * allowed to change them.
733 *
734 * In that case we temporarily set the key to be the
735 * trampoline address. This is fixed up in
736 * static_call_add_module().
737 */
c6f5dc28 738 key_sym = insn_call_dest(insn);
1e7e4788
JP		 739 }
740 free(key_name);
741
742 /* populate reloc for 'key' */
6342a20e
JP		 743 if (!elf_init_reloc_data_sym(file->elf, sec,
744 idx * sizeof(*site) + 4,
745 (idx * 2) + 1, key_sym,
746 is_sibling_call(insn) * STATIC_CALL_SITE_TAIL))
1e7e4788 747 return -1;
1e7e4788
JP		 748
749 idx++;
750 }
751
1e7e4788
JP		 752 return 0;
753}
754
134ab5bd
PZ		 755static int create_retpoline_sites_sections(struct objtool_file *file)
756{
757 struct instruction *insn;
758 struct section *sec;
759 int idx;
760
761 sec = find_section_by_name(file->elf, ".retpoline_sites");
762 if (sec) {
763 WARN("file already has .retpoline_sites, skipping");
764 return 0;
765 }
766
767 idx = 0;
768 list_for_each_entry(insn, &file->retpoline_call_list, call_node)
769 idx++;
770
771 if (!idx)
772 return 0;
773
6342a20e
JP		 774 sec = elf_create_section_pair(file->elf, ".retpoline_sites",
775 sizeof(int), idx, idx);
776 if (!sec)
134ab5bd 777 return -1;
134ab5bd
PZ		 778
779 idx = 0;
780 list_for_each_entry(insn, &file->retpoline_call_list, call_node) {
781
6342a20e
JP		 782 if (!elf_init_reloc_text_sym(file->elf, sec,
783 idx * sizeof(int), idx,
784 insn->sec, insn->offset))
134ab5bd 785 return -1;
134ab5bd
PZ		 786
787 idx++;
788 }
789
790 return 0;
791}
792
d9e9d230
PZ		 793static int create_return_sites_sections(struct objtool_file *file)
794{
795 struct instruction *insn;
796 struct section *sec;
797 int idx;
798
799 sec = find_section_by_name(file->elf, ".return_sites");
800 if (sec) {
801 WARN("file already has .return_sites, skipping");
802 return 0;
803 }
804
805 idx = 0;
806 list_for_each_entry(insn, &file->return_thunk_list, call_node)
807 idx++;
808
809 if (!idx)
810 return 0;
811
6342a20e
JP		 812 sec = elf_create_section_pair(file->elf, ".return_sites",
813 sizeof(int), idx, idx);
814 if (!sec)
d9e9d230 815 return -1;
d9e9d230
PZ		 816
817 idx = 0;
818 list_for_each_entry(insn, &file->return_thunk_list, call_node) {
819
6342a20e
JP		 820 if (!elf_init_reloc_text_sym(file->elf, sec,
821 idx * sizeof(int), idx,
822 insn->sec, insn->offset))
d9e9d230 823 return -1;
d9e9d230
PZ		 824
825 idx++;
826 }
827
828 return 0;
829}
830
89bc853e
PZ		 831static int create_ibt_endbr_seal_sections(struct objtool_file *file)
832{
833 struct instruction *insn;
834 struct section *sec;
835 int idx;
836
837 sec = find_section_by_name(file->elf, ".ibt_endbr_seal");
838 if (sec) {
839 WARN("file already has .ibt_endbr_seal, skipping");
840 return 0;
841 }
842
843 idx = 0;
844 list_for_each_entry(insn, &file->endbr_list, call_node)
845 idx++;
846
2daf7fab 847 if (opts.stats) {
89bc853e
PZ		 848 printf("ibt: ENDBR at function start: %d\n", file->nr_endbr);
849 printf("ibt: ENDBR inside functions: %d\n", file->nr_endbr_int);
850 printf("ibt: superfluous ENDBR: %d\n", idx);
851 }
852
853 if (!idx)
854 return 0;
855
6342a20e
JP		 856 sec = elf_create_section_pair(file->elf, ".ibt_endbr_seal",
857 sizeof(int), idx, idx);
858 if (!sec)
89bc853e 859 return -1;
89bc853e
PZ		 860
861 idx = 0;
862 list_for_each_entry(insn, &file->endbr_list, call_node) {
863
864 int *site = (int *)sec->data->d_buf + idx;
03d7a105 865 struct symbol *sym = insn->sym;
89bc853e
PZ		 866 *site = 0;
867
03d7a105
MK		 868 if (opts.module && sym && sym->type == STT_FUNC &&
869 insn->offset == sym->offset &&
870 (!strcmp(sym->name, "init_module") ||
871 !strcmp(sym->name, "cleanup_module")))
872 WARN("%s(): not an indirect call target", sym->name);
873
6342a20e
JP		 874 if (!elf_init_reloc_text_sym(file->elf, sec,
875 idx * sizeof(int), idx,
876 insn->sec, insn->offset))
89bc853e 877 return -1;
89bc853e
PZ		 878
879 idx++;
880 }
881
882 return 0;
883}
884
9a479f76
PZ		 885static int create_cfi_sections(struct objtool_file *file)
886{
9290e772 887 struct section *sec;
9a479f76 888 struct symbol *sym;
9a479f76
PZ		 889 int idx;
890
891 sec = find_section_by_name(file->elf, ".cfi_sites");
892 if (sec) {
893 INIT_LIST_HEAD(&file->call_list);
894 WARN("file already has .cfi_sites section, skipping");
895 return 0;
896 }
897
898 idx = 0;
9290e772
JP		 899 for_each_sym(file, sym) {
900 if (sym->type != STT_FUNC)
9a479f76
PZ		 901 continue;
902
9290e772
JP		 903 if (strncmp(sym->name, "__cfi_", 6))
904 continue;
9a479f76 905
9290e772 906 idx++;
9a479f76
PZ		 907 }
908
6342a20e
JP		 909 sec = elf_create_section_pair(file->elf, ".cfi_sites",
910 sizeof(unsigned int), idx, idx);
9a479f76
PZ		 911 if (!sec)
912 return -1;
913
914 idx = 0;
9290e772
JP		 915 for_each_sym(file, sym) {
916 if (sym->type != STT_FUNC)
9a479f76
PZ		 917 continue;
918
9290e772
JP		 919 if (strncmp(sym->name, "__cfi_", 6))
920 continue;
9a479f76 921
6342a20e
JP		 922 if (!elf_init_reloc_text_sym(file->elf, sec,
923 idx * sizeof(unsigned int), idx,
924 sym->sec, sym->offset))
9290e772 925 return -1;
9a479f76 926
9290e772 927 idx++;
9a479f76
PZ		 928 }
929
930 return 0;
931}
932
99d00215
PZ		 933static int create_mcount_loc_sections(struct objtool_file *file)
934{
53257a97 935 size_t addr_size = elf_addr_size(file->elf);
99d00215 936 struct instruction *insn;
86ea7f36 937 struct section *sec;
99d00215
PZ		 938 int idx;
939
940 sec = find_section_by_name(file->elf, "__mcount_loc");
941 if (sec) {
942 INIT_LIST_HEAD(&file->mcount_loc_list);
943 WARN("file already has __mcount_loc section, skipping");
944 return 0;
945 }
946
947 if (list_empty(&file->mcount_loc_list))
948 return 0;
949
950 idx = 0;
c509331b 951 list_for_each_entry(insn, &file->mcount_loc_list, call_node)
99d00215
PZ		 952 idx++;
953
6342a20e
JP		 954 sec = elf_create_section_pair(file->elf, "__mcount_loc", addr_size,
955 idx, idx);
99d00215
PZ		 956 if (!sec)
957 return -1;
958
53257a97 959 sec->sh.sh_addralign = addr_size;
86ea7f36 960
99d00215 961 idx = 0;
c509331b 962 list_for_each_entry(insn, &file->mcount_loc_list, call_node) {
99d00215 963
6342a20e 964 struct reloc *reloc;
99d00215 965
6342a20e
JP		 966 reloc = elf_init_reloc_text_sym(file->elf, sec, idx * addr_size, idx,
967 insn->sec, insn->offset);
968 if (!reloc)
99d00215 969 return -1;
99d00215 970
ec24b927 971 set_reloc_type(file->elf, reloc, addr_size == 8 ? R_ABS64 : R_ABS32);
6342a20e
JP		 972
973 idx++;
99d00215
PZ		 974 }
975
99d00215
PZ		 976 return 0;
977}
978
00abd384
PZ		 979static int create_direct_call_sections(struct objtool_file *file)
980{
981 struct instruction *insn;
982 struct section *sec;
00abd384
PZ		 983 int idx;
984
985 sec = find_section_by_name(file->elf, ".call_sites");
986 if (sec) {
987 INIT_LIST_HEAD(&file->call_list);
988 WARN("file already has .call_sites section, skipping");
989 return 0;
990 }
991
992 if (list_empty(&file->call_list))
993 return 0;
994
995 idx = 0;
996 list_for_each_entry(insn, &file->call_list, call_node)
997 idx++;
998
6342a20e
JP		 999 sec = elf_create_section_pair(file->elf, ".call_sites",
1000 sizeof(unsigned int), idx, idx);
00abd384
PZ		 1001 if (!sec)
1002 return -1;
1003
1004 idx = 0;
1005 list_for_each_entry(insn, &file->call_list, call_node) {
1006
6342a20e
JP		 1007 if (!elf_init_reloc_text_sym(file->elf, sec,
1008 idx * sizeof(unsigned int), idx,
1009 insn->sec, insn->offset))
00abd384
PZ		 1010 return -1;
1011
1012 idx++;
1013 }
1014
1015 return 0;
1016}
1017
dcc914f4
JP		 1018/*
1019 * Warnings shouldn't be reported for ignored functions.
1020 */
1021static void add_ignores(struct objtool_file *file)
1022{
1023 struct instruction *insn;
a5bd6236 1024 struct section *rsec;
dcc914f4 1025 struct symbol *func;
f1974222 1026 struct reloc *reloc;
dcc914f4 1027
a5bd6236
JP		 1028 rsec = find_section_by_name(file->elf, ".rela.discard.func_stack_frame_non_standard");
1029 if (!rsec)
aaf5c623 1030 return;
dcc914f4 1031
caa4a6b7 1032 for_each_reloc(rsec, reloc) {
f1974222 1033 switch (reloc->sym->type) {
aaf5c623 1034 case STT_FUNC:
f1974222 1035 func = reloc->sym;
aaf5c623
PZ		 1036 break;
1037
1038 case STT_SECTION:
0696b6e3 1039 func = find_func_by_offset(reloc->sym->sec, reloc_addend(reloc));
7acfe531 1040 if (!func)
dcc914f4 1041 continue;
aaf5c623 1042 break;
dcc914f4 1043
aaf5c623 1044 default:
a5bd6236
JP		 1045 WARN("unexpected relocation symbol type in %s: %d",
1046 rsec->name, reloc->sym->type);
aaf5c623 1047 continue;
dcc914f4 1048 }
aaf5c623 1049
f0f70adb 1050 func_for_each_insn(file, func, insn)
aaf5c623 1051 insn->ignore = true;
dcc914f4
JP		 1052 }
1053}
1054
ea24213d
PZ		 1055/*
1056 * This is a whitelist of functions that is allowed to be called with AC set.
1057 * The list is meant to be minimal and only contains compiler instrumentation
1058 * ABI and a few functions used to implement *_{to,from}_user() functions.
1059 *
1060 * These functions must not directly change AC, but may PUSHF/POPF.
1061 */
1062static const char *uaccess_safe_builtin[] = {
1063 /* KASAN */
1064 "kasan_report",
f00748bf 1065 "kasan_check_range",
ea24213d
PZ		 1066 /* KASAN out-of-line */
1067 "__asan_loadN_noabort",
1068 "__asan_load1_noabort",
1069 "__asan_load2_noabort",
1070 "__asan_load4_noabort",
1071 "__asan_load8_noabort",
1072 "__asan_load16_noabort",
1073 "__asan_storeN_noabort",
1074 "__asan_store1_noabort",
1075 "__asan_store2_noabort",
1076 "__asan_store4_noabort",
1077 "__asan_store8_noabort",
1078 "__asan_store16_noabort",
b0b8e56b
JH		 1079 "__kasan_check_read",
1080 "__kasan_check_write",
ea24213d
PZ		 1081 /* KASAN in-line */
1082 "__asan_report_load_n_noabort",
1083 "__asan_report_load1_noabort",
1084 "__asan_report_load2_noabort",
1085 "__asan_report_load4_noabort",
1086 "__asan_report_load8_noabort",
1087 "__asan_report_load16_noabort",
1088 "__asan_report_store_n_noabort",
1089 "__asan_report_store1_noabort",
1090 "__asan_report_store2_noabort",
1091 "__asan_report_store4_noabort",
1092 "__asan_report_store8_noabort",
1093 "__asan_report_store16_noabort",
5f5c9712 1094 /* KCSAN */
9967683c 1095 "__kcsan_check_access",
0525bd82
ME		 1096 "__kcsan_mb",
1097 "__kcsan_wmb",
1098 "__kcsan_rmb",
1099 "__kcsan_release",
5f5c9712
ME		 1100 "kcsan_found_watchpoint",
1101 "kcsan_setup_watchpoint",
9967683c 1102 "kcsan_check_scoped_accesses",
50a19ad4
ME		 1103 "kcsan_disable_current",
1104 "kcsan_enable_current_nowarn",
5f5c9712
ME		 1105 /* KCSAN/TSAN */
1106 "__tsan_func_entry",
1107 "__tsan_func_exit",
1108 "__tsan_read_range",
1109 "__tsan_write_range",
1110 "__tsan_read1",
1111 "__tsan_read2",
1112 "__tsan_read4",
1113 "__tsan_read8",
1114 "__tsan_read16",
1115 "__tsan_write1",
1116 "__tsan_write2",
1117 "__tsan_write4",
1118 "__tsan_write8",
1119 "__tsan_write16",
a81b3759
ME		 1120 "__tsan_read_write1",
1121 "__tsan_read_write2",
1122 "__tsan_read_write4",
1123 "__tsan_read_write8",
1124 "__tsan_read_write16",
63646fcb
ME		 1125 "__tsan_volatile_read1",
1126 "__tsan_volatile_read2",
1127 "__tsan_volatile_read4",
1128 "__tsan_volatile_read8",
1129 "__tsan_volatile_read16",
1130 "__tsan_volatile_write1",
1131 "__tsan_volatile_write2",
1132 "__tsan_volatile_write4",
1133 "__tsan_volatile_write8",
1134 "__tsan_volatile_write16",
883957b1
ME		 1135 "__tsan_atomic8_load",
1136 "__tsan_atomic16_load",
1137 "__tsan_atomic32_load",
1138 "__tsan_atomic64_load",
1139 "__tsan_atomic8_store",
1140 "__tsan_atomic16_store",
1141 "__tsan_atomic32_store",
1142 "__tsan_atomic64_store",
1143 "__tsan_atomic8_exchange",
1144 "__tsan_atomic16_exchange",
1145 "__tsan_atomic32_exchange",
1146 "__tsan_atomic64_exchange",
1147 "__tsan_atomic8_fetch_add",
1148 "__tsan_atomic16_fetch_add",
1149 "__tsan_atomic32_fetch_add",
1150 "__tsan_atomic64_fetch_add",
1151 "__tsan_atomic8_fetch_sub",
1152 "__tsan_atomic16_fetch_sub",
1153 "__tsan_atomic32_fetch_sub",
1154 "__tsan_atomic64_fetch_sub",
1155 "__tsan_atomic8_fetch_and",
1156 "__tsan_atomic16_fetch_and",
1157 "__tsan_atomic32_fetch_and",
1158 "__tsan_atomic64_fetch_and",
1159 "__tsan_atomic8_fetch_or",
1160 "__tsan_atomic16_fetch_or",
1161 "__tsan_atomic32_fetch_or",
1162 "__tsan_atomic64_fetch_or",
1163 "__tsan_atomic8_fetch_xor",
1164 "__tsan_atomic16_fetch_xor",
1165 "__tsan_atomic32_fetch_xor",
1166 "__tsan_atomic64_fetch_xor",
1167 "__tsan_atomic8_fetch_nand",
1168 "__tsan_atomic16_fetch_nand",
1169 "__tsan_atomic32_fetch_nand",
1170 "__tsan_atomic64_fetch_nand",
1171 "__tsan_atomic8_compare_exchange_strong",
1172 "__tsan_atomic16_compare_exchange_strong",
1173 "__tsan_atomic32_compare_exchange_strong",
1174 "__tsan_atomic64_compare_exchange_strong",
1175 "__tsan_atomic8_compare_exchange_weak",
1176 "__tsan_atomic16_compare_exchange_weak",
1177 "__tsan_atomic32_compare_exchange_weak",
1178 "__tsan_atomic64_compare_exchange_weak",
1179 "__tsan_atomic8_compare_exchange_val",
1180 "__tsan_atomic16_compare_exchange_val",
1181 "__tsan_atomic32_compare_exchange_val",
1182 "__tsan_atomic64_compare_exchange_val",
1183 "__tsan_atomic_thread_fence",
1184 "__tsan_atomic_signal_fence",
d5d46924
AB		 1185 "__tsan_unaligned_read16",
1186 "__tsan_unaligned_write16",
ea24213d
PZ		 1187 /* KCOV */
1188 "write_comp_data",
ae033f08 1189 "check_kcov_mode",
ea24213d
PZ		 1190 "__sanitizer_cov_trace_pc",
1191 "__sanitizer_cov_trace_const_cmp1",
1192 "__sanitizer_cov_trace_const_cmp2",
1193 "__sanitizer_cov_trace_const_cmp4",
1194 "__sanitizer_cov_trace_const_cmp8",
1195 "__sanitizer_cov_trace_cmp1",
1196 "__sanitizer_cov_trace_cmp2",
1197 "__sanitizer_cov_trace_cmp4",
1198 "__sanitizer_cov_trace_cmp8",
36b1c700 1199 "__sanitizer_cov_trace_switch",
40b22c9d
AP		 1200 /* KMSAN */
1201 "kmsan_copy_to_user",
1202 "kmsan_report",
1203 "kmsan_unpoison_entry_regs",
1204 "kmsan_unpoison_memory",
1205 "__msan_chain_origin",
1206 "__msan_get_context_state",
1207 "__msan_instrument_asm_store",
1208 "__msan_metadata_ptr_for_load_1",
1209 "__msan_metadata_ptr_for_load_2",
1210 "__msan_metadata_ptr_for_load_4",
1211 "__msan_metadata_ptr_for_load_8",
1212 "__msan_metadata_ptr_for_load_n",
1213 "__msan_metadata_ptr_for_store_1",
1214 "__msan_metadata_ptr_for_store_2",
1215 "__msan_metadata_ptr_for_store_4",
1216 "__msan_metadata_ptr_for_store_8",
1217 "__msan_metadata_ptr_for_store_n",
1218 "__msan_poison_alloca",
1219 "__msan_warning",
ea24213d
PZ		 1220 /* UBSAN */
1221 "ubsan_type_mismatch_common",
1222 "__ubsan_handle_type_mismatch",
1223 "__ubsan_handle_type_mismatch_v1",
9a50dcaf 1224 "__ubsan_handle_shift_out_of_bounds",
f18b0d7e 1225 "__ubsan_handle_load_invalid_value",
7f530fba
JP		 1226 /* STACKLEAK */
1227 "stackleak_track_stack",
ea24213d
PZ		 1228 /* misc */
1229 "csum_partial_copy_generic",
ec6347bb
DW		 1230 "copy_mc_fragile",
1231 "copy_mc_fragile_handle_tail",
5da8e4a6 1232 "copy_mc_enhanced_fast_string",
ea24213d 1233 "ftrace_likely_update", /* CONFIG_TRACE_BRANCH_PROFILING */
8c9b6a88 1234 "rep_stos_alternative",
427fda2c 1235 "rep_movs_alternative",
3639a535 1236 "__copy_user_nocache",
ea24213d
PZ		 1237 NULL
1238};
1239
1240static void add_uaccess_safe(struct objtool_file *file)
1241{
1242 struct symbol *func;
1243 const char **name;
1244
2daf7fab 1245 if (!opts.uaccess)
ea24213d
PZ		 1246 return;
1247
1248 for (name = uaccess_safe_builtin; *name; name++) {
1249 func = find_symbol_by_name(file->elf, *name);
1250 if (!func)
1251 continue;
1252
e10cd8fe 1253 func->uaccess_safe = true;
dcc914f4
JP		 1254 }
1255}
1256
258c7605
JP		 1257/*
1258 * FIXME: For now, just ignore any alternatives which add retpolines. This is
1259 * a temporary hack, as it doesn't allow ORC to unwind from inside a retpoline.
1260 * But it at least allows objtool to understand the control flow *around* the
1261 * retpoline.
1262 */
ff05ab23 1263static int add_ignore_alternatives(struct objtool_file *file)
258c7605 1264{
a5bd6236 1265 struct section *rsec;
f1974222 1266 struct reloc *reloc;
258c7605
JP		 1267 struct instruction *insn;
1268
a5bd6236
JP		 1269 rsec = find_section_by_name(file->elf, ".rela.discard.ignore_alts");
1270 if (!rsec)
258c7605
JP		 1271 return 0;
1272
caa4a6b7 1273 for_each_reloc(rsec, reloc) {
f1974222 1274 if (reloc->sym->type != STT_SECTION) {
a5bd6236 1275 WARN("unexpected relocation symbol type in %s", rsec->name);
258c7605
JP		 1276 return -1;
1277 }
1278
0696b6e3 1279 insn = find_insn(file, reloc->sym->sec, reloc_addend(reloc));
258c7605 1280 if (!insn) {
ff05ab23 1281 WARN("bad .discard.ignore_alts entry");
258c7605
JP		 1282 return -1;
1283 }
1284
1285 insn->ignore_alts = true;
1286 }
1287
1288 return 0;
1289}
1290
530b4ddd
PZ		 1291__weak bool arch_is_retpoline(struct symbol *sym)
1292{
1293 return false;
1294}
1295
d9e9d230
PZ		 1296__weak bool arch_is_rethunk(struct symbol *sym)
1297{
1298 return false;
1299}
1300
7bd2a600
PZ		 1301static struct reloc *insn_reloc(struct objtool_file *file, struct instruction *insn)
1302{
0932dbe1
PZ		 1303 struct reloc *reloc;
1304
1305 if (insn->no_reloc)
7bd2a600
PZ		 1306 return NULL;
1307
0932dbe1
PZ		 1308 if (!file)
1309 return NULL;
db2b0c5d 1310
0932dbe1
PZ		 1311 reloc = find_reloc_by_dest_range(file->elf, insn->sec,
1312 insn->offset, insn->len);
1313 if (!reloc) {
1314 insn->no_reloc = 1;
1315 return NULL;
7bd2a600
PZ		 1316 }
1317
0932dbe1 1318 return reloc;
7bd2a600
PZ		 1319}
1320
f56dae88
PZ		 1321static void remove_insn_ops(struct instruction *insn)
1322{
3ee88df1 1323 struct stack_op *op, *next;
f56dae88 1324
3ee88df1
PZ		 1325 for (op = insn->stack_ops; op; op = next) {
1326 next = op->next;
f56dae88
PZ		 1327 free(op);
1328 }
3ee88df1 1329 insn->stack_ops = NULL;
f56dae88
PZ		 1330}
1331
dd003ede
PZ		 1332static void annotate_call_site(struct objtool_file *file,
1333 struct instruction *insn, bool sibling)
f56dae88
PZ		 1334{
1335 struct reloc *reloc = insn_reloc(file, insn);
c6f5dc28 1336 struct symbol *sym = insn_call_dest(insn);
f56dae88 1337
dd003ede
PZ		 1338 if (!sym)
1339 sym = reloc->sym;
1340
1341 /*
1342 * Alternative replacement code is just template code which is
1343 * sometimes copied to the original instruction. For now, don't
1344 * annotate it. (In the future we might consider annotating the
1345 * original instruction if/when it ever makes sense to do so.)
1346 */
1347 if (!strcmp(insn->sec->name, ".altinstr_replacement"))
f56dae88
PZ		 1348 return;
1349
dd003ede
PZ		 1350 if (sym->static_call_tramp) {
1351 list_add_tail(&insn->call_node, &file->static_call_list);
1352 return;
f56dae88
PZ		 1353 }
1354
134ab5bd
PZ		 1355 if (sym->retpoline_thunk) {
1356 list_add_tail(&insn->call_node, &file->retpoline_call_list);
1357 return;
1358 }
1359
f56dae88 1360 /*
05098119
ME		 1361 * Many compilers cannot disable KCOV or sanitizer calls with a function
1362 * attribute so they need a little help, NOP out any such calls from
1363 * noinstr text.
f56dae88 1364 */
22102f45 1365 if (opts.hack_noinstr && insn->sec->noinstr && sym->profiling_func) {
ec24b927
JP		 1366 if (reloc)
1367 set_reloc_type(file->elf, reloc, R_NONE);
f56dae88
PZ		 1368
1369 elf_write_insn(file->elf, insn->sec,
1370 insn->offset, insn->len,
1371 sibling ? arch_ret_insn(insn->len)
1372 : arch_nop_insn(insn->len));
1373
1374 insn->type = sibling ? INSN_RETURN : INSN_NOP;
7a53f408
PZ		 1375
1376 if (sibling) {
1377 /*
1378 * We've replaced the tail-call JMP insn by two new
1379 * insn: RET; INT3, except we only have a single struct
1380 * insn here. Mark it retpoline_safe to avoid the SLS
1381 * warning, instead of adding another insn.
1382 */
1383 insn->retpoline_safe = true;
1384 }
1385
dd003ede 1386 return;
f56dae88
PZ		 1387 }
1388
2daf7fab 1389 if (opts.mcount && sym->fentry) {
f56dae88 1390 if (sibling)
246b2c85 1391 WARN_INSN(insn, "tail call to __fentry__ !?!?");
280981d6 1392 if (opts.mnop) {
ec24b927
JP		 1393 if (reloc)
1394 set_reloc_type(file->elf, reloc, R_NONE);
f56dae88 1395
280981d6
SV		 1396 elf_write_insn(file->elf, insn->sec,
1397 insn->offset, insn->len,
1398 arch_nop_insn(insn->len));
f56dae88 1399
280981d6
SV		 1400 insn->type = INSN_NOP;
1401 }
f56dae88 1402
c509331b 1403 list_add_tail(&insn->call_node, &file->mcount_loc_list);
dd003ede 1404 return;
f56dae88 1405 }
0e5b613b 1406
00abd384
PZ		 1407 if (insn->type == INSN_CALL && !insn->sec->init)
1408 list_add_tail(&insn->call_node, &file->call_list);
1409
0e5b613b
PZ		 1410 if (!sibling && dead_end_function(file, sym))
1411 insn->dead_end = true;
dd003ede
PZ		 1412}
1413
1414static void add_call_dest(struct objtool_file *file, struct instruction *insn,
1415 struct symbol *dest, bool sibling)
1416{
c6f5dc28 1417 insn->_call_dest = dest;
dd003ede
PZ		 1418 if (!dest)
1419 return;
f56dae88
PZ		 1420
1421 /*
1422 * Whatever stack impact regular CALLs have, should be undone
1423 * by the RETURN of the called function.
1424 *
1425 * Annotated intra-function calls retain the stack_ops but
1426 * are converted to JUMP, see read_intra_function_calls().
1427 */
1428 remove_insn_ops(insn);
dd003ede
PZ		 1429
1430 annotate_call_site(file, insn, sibling);
f56dae88
PZ		 1431}
1432
134ab5bd
PZ		 1433static void add_retpoline_call(struct objtool_file *file, struct instruction *insn)
1434{
1435 /*
1436 * Retpoline calls/jumps are really dynamic calls/jumps in disguise,
1437 * so convert them accordingly.
1438 */
1439 switch (insn->type) {
1440 case INSN_CALL:
1441 insn->type = INSN_CALL_DYNAMIC;
1442 break;
1443 case INSN_JUMP_UNCONDITIONAL:
1444 insn->type = INSN_JUMP_DYNAMIC;
1445 break;
1446 case INSN_JUMP_CONDITIONAL:
1447 insn->type = INSN_JUMP_DYNAMIC_CONDITIONAL;
1448 break;
1449 default:
1450 return;
1451 }
1452
1453 insn->retpoline_safe = true;
1454
1455 /*
1456 * Whatever stack impact regular CALLs have, should be undone
1457 * by the RETURN of the called function.
1458 *
1459 * Annotated intra-function calls retain the stack_ops but
1460 * are converted to JUMP, see read_intra_function_calls().
1461 */
1462 remove_insn_ops(insn);
1463
1464 annotate_call_site(file, insn, false);
1465}
08f87a93 1466
a149180f 1467static void add_return_call(struct objtool_file *file, struct instruction *insn, bool add)
d9e9d230
PZ		 1468{
1469 /*
1470 * Return thunk tail calls are really just returns in disguise,
1471 * so convert them accordingly.
1472 */
1473 insn->type = INSN_RETURN;
1474 insn->retpoline_safe = true;
1475
a149180f
PZ		 1476 if (add)
1477 list_add_tail(&insn->call_node, &file->return_thunk_list);
d9e9d230
PZ		 1478}
1479
5a9c361a
PZ		 1480static bool is_first_func_insn(struct objtool_file *file,
1481 struct instruction *insn, struct symbol *sym)
08f87a93 1482{
5a9c361a 1483 if (insn->offset == sym->offset)
d139bca4
PZ		 1484 return true;
1485
5a9c361a 1486 /* Allow direct CALL/JMP past ENDBR */
2daf7fab 1487 if (opts.ibt) {
d139bca4
PZ		 1488 struct instruction *prev = prev_insn_same_sym(file, insn);
1489
1490 if (prev && prev->type == INSN_ENDBR &&
5a9c361a 1491 insn->offset == sym->offset + prev->len)
d139bca4
PZ		 1492 return true;
1493 }
1494
1495 return false;
08f87a93
PZ		 1496}
1497
5a9c361a
PZ		 1498/*
1499 * A sibling call is a tail-call to another symbol -- to differentiate from a
1500 * recursive tail-call which is to the same symbol.
1501 */
1502static bool jump_is_sibling_call(struct objtool_file *file,
1503 struct instruction *from, struct instruction *to)
1504{
1505 struct symbol *fs = from->sym;
1506 struct symbol *ts = to->sym;
1507
1508 /* Not a sibling call if from/to a symbol hole */
1509 if (!fs || !ts)
1510 return false;
1511
1512 /* Not a sibling call if not targeting the start of a symbol. */
1513 if (!is_first_func_insn(file, to, ts))
1514 return false;
1515
1516 /* Disallow sibling calls into STT_NOTYPE */
1517 if (ts->type == STT_NOTYPE)
1518 return false;
1519
1520 /* Must not be self to be a sibling */
1521 return fs->pfunc != ts->pfunc;
1522}
1523
dcc914f4
JP		 1524/*
1525 * Find the destination instructions for all jumps.
1526 */
1527static int add_jump_destinations(struct objtool_file *file)
1528{
26ff6041 1529 struct instruction *insn, *jump_dest;
f1974222 1530 struct reloc *reloc;
dcc914f4
JP		 1531 struct section *dest_sec;
1532 unsigned long dest_off;
1533
1534 for_each_insn(file, insn) {
34c861e8
JP		 1535 if (insn->jump_dest) {
1536 /*
1537 * handle_group_alt() may have previously set
1538 * 'jump_dest' for some alternatives.
1539 */
1540 continue;
1541 }
a2296140 1542 if (!is_static_jump(insn))
dcc914f4
JP		 1543 continue;
1544
7bd2a600 1545 reloc = insn_reloc(file, insn);
f1974222 1546 if (!reloc) {
dcc914f4 1547 dest_sec = insn->sec;
bfb08f22 1548 dest_off = arch_jump_destination(insn);
f1974222
MH		 1549 } else if (reloc->sym->type == STT_SECTION) {
1550 dest_sec = reloc->sym->sec;
0696b6e3 1551 dest_off = arch_dest_reloc_offset(reloc_addend(reloc));
1739c66e 1552 } else if (reloc->sym->retpoline_thunk) {
134ab5bd 1553 add_retpoline_call(file, insn);
39b73533 1554 continue;
d9e9d230 1555 } else if (reloc->sym->return_thunk) {
a149180f 1556 add_return_call(file, insn, true);
d9e9d230 1557 continue;
dbcdbdfd 1558 } else if (insn_func(insn)) {
26ff6041
JP		 1559 /*
1560 * External sibling call or internal sibling call with
1561 * STT_FUNC reloc.
1562 */
f56dae88 1563 add_call_dest(file, insn, reloc->sym, true);
dcc914f4 1564 continue;
ecf11ba4
JP		 1565 } else if (reloc->sym->sec->idx) {
1566 dest_sec = reloc->sym->sec;
1567 dest_off = reloc->sym->sym.st_value +
0696b6e3 1568 arch_dest_reloc_offset(reloc_addend(reloc));
ecf11ba4
JP		 1569 } else {
1570 /* non-func asm code jumping to another file */
1571 continue;
dcc914f4
JP		 1572 }
1573
26ff6041
JP		 1574 jump_dest = find_insn(file, dest_sec, dest_off);
1575 if (!jump_dest) {
a149180f
PZ		 1576 struct symbol *sym = find_symbol_by_offset(dest_sec, dest_off);
1577
1578 /*
1579 * This is a special case for zen_untrain_ret().
1580 * It jumps to __x86_return_thunk(), but objtool
1581 * can't find the thunk's starting RET
1582 * instruction, because the RET is also in the
1583 * middle of another instruction. Objtool only
1584 * knows about the outer instruction.
1585 */
1586 if (sym && sym->return_thunk) {
1587 add_return_call(file, insn, false);
1588 continue;
1589 }
1590
246b2c85
JP		 1591 WARN_INSN(insn, "can't find jump dest instruction at %s+0x%lx",
1592 dest_sec->name, dest_off);
dcc914f4
JP		 1593 return -1;
1594 }
cd77849a
JP		 1595
1596 /*
54262aa2 1597 * Cross-function jump.
cd77849a 1598 */
dbcdbdfd
PZ		 1599 if (insn_func(insn) && insn_func(jump_dest) &&
1600 insn_func(insn) != insn_func(jump_dest)) {
54262aa2
PZ		 1601
1602 /*
1603 * For GCC 8+, create parent/child links for any cold
1604 * subfunctions. This is _mostly_ redundant with a
1605 * similar initialization in read_symbols().
1606 *
1607 * If a function has aliases, we want the *first* such
1608 * function in the symbol table to be the subfunction's
1609 * parent. In that case we overwrite the
1610 * initialization done in read_symbols().
1611 *
1612 * However this code can't completely replace the
1613 * read_symbols() code because this doesn't detect the
1614 * case where the parent function's only reference to a
e7c2bc37 1615 * subfunction is through a jump table.
54262aa2 1616 */
dbcdbdfd
PZ		 1617 if (!strstr(insn_func(insn)->name, ".cold") &&
1618 strstr(insn_func(jump_dest)->name, ".cold")) {
1619 insn_func(insn)->cfunc = insn_func(jump_dest);
1620 insn_func(jump_dest)->pfunc = insn_func(insn);
54262aa2 1621 }
cd77849a 1622 }
26ff6041 1623
5a9c361a
PZ		 1624 if (jump_is_sibling_call(file, insn, jump_dest)) {
1625 /*
1626 * Internal sibling call without reloc or with
1627 * STT_SECTION reloc.
1628 */
1629 add_call_dest(file, insn, insn_func(jump_dest), true);
1630 continue;
1631 }
1632
26ff6041 1633 insn->jump_dest = jump_dest;
dcc914f4
JP		 1634 }
1635
1636 return 0;
1637}
1638
2b232a22
JT		 1639static struct symbol *find_call_destination(struct section *sec, unsigned long offset)
1640{
1641 struct symbol *call_dest;
1642
1643 call_dest = find_func_by_offset(sec, offset);
1644 if (!call_dest)
1645 call_dest = find_symbol_by_offset(sec, offset);
1646
1647 return call_dest;
1648}
1649
dcc914f4
JP		 1650/*
1651 * Find the destination instructions for all calls.
1652 */
1653static int add_call_destinations(struct objtool_file *file)
1654{
1655 struct instruction *insn;
1656 unsigned long dest_off;
f56dae88 1657 struct symbol *dest;
f1974222 1658 struct reloc *reloc;
dcc914f4
JP		 1659
1660 for_each_insn(file, insn) {
1661 if (insn->type != INSN_CALL)
1662 continue;
1663
7bd2a600 1664 reloc = insn_reloc(file, insn);
f1974222 1665 if (!reloc) {
bfb08f22 1666 dest_off = arch_jump_destination(insn);
f56dae88
PZ		 1667 dest = find_call_destination(insn->sec, dest_off);
1668
1669 add_call_dest(file, insn, dest, false);
a845c7cf 1670
7acfe531
JP		 1671 if (insn->ignore)
1672 continue;
1673
c6f5dc28 1674 if (!insn_call_dest(insn)) {
246b2c85 1675 WARN_INSN(insn, "unannotated intra-function call");
dcc914f4
JP		 1676 return -1;
1677 }
a845c7cf 1678
c6f5dc28 1679 if (insn_func(insn) && insn_call_dest(insn)->type != STT_FUNC) {
246b2c85 1680 WARN_INSN(insn, "unsupported call to non-function");
7acfe531
JP		 1681 return -1;
1682 }
1683
f1974222 1684 } else if (reloc->sym->type == STT_SECTION) {
0696b6e3 1685 dest_off = arch_dest_reloc_offset(reloc_addend(reloc));
f56dae88
PZ		 1686 dest = find_call_destination(reloc->sym->sec, dest_off);
1687 if (!dest) {
246b2c85
JP		 1688 WARN_INSN(insn, "can't find call dest symbol at %s+0x%lx",
1689 reloc->sym->sec->name, dest_off);
dcc914f4
JP		 1690 return -1;
1691 }
bcb1b6ff 1692
f56dae88
PZ		 1693 add_call_dest(file, insn, dest, false);
1694
1739c66e 1695 } else if (reloc->sym->retpoline_thunk) {
134ab5bd 1696 add_retpoline_call(file, insn);
bcb1b6ff 1697
dcc914f4 1698 } else
f56dae88 1699 add_call_dest(file, insn, reloc->sym, false);
dcc914f4
JP		 1700 }
1701
1702 return 0;
1703}
1704
1705/*
c9c324dc
JP		 1706 * The .alternatives section requires some extra special care over and above
1707 * other special sections because alternatives are patched in place.
dcc914f4
JP		 1708 */
1709static int handle_group_alt(struct objtool_file *file,
1710 struct special_alt *special_alt,
1711 struct instruction *orig_insn,
1712 struct instruction **new_insn)
1713{
a706bb08 1714 struct instruction *last_new_insn = NULL, *insn, *nop = NULL;
b23cc71c 1715 struct alt_group *orig_alt_group, *new_alt_group;
dcc914f4
JP		 1716 unsigned long dest_off;
1717
a706bb08 1718 orig_alt_group = orig_insn->alt_group;
b23cc71c 1719 if (!orig_alt_group) {
a706bb08 1720 struct instruction *last_orig_insn = NULL;
c9c324dc 1721
a706bb08
PZ		 1722 orig_alt_group = malloc(sizeof(*orig_alt_group));
1723 if (!orig_alt_group) {
1724 WARN("malloc failed");
1725 return -1;
1726 }
1727 orig_alt_group->cfi = calloc(special_alt->orig_len,
1728 sizeof(struct cfi_state *));
1729 if (!orig_alt_group->cfi) {
1730 WARN("calloc failed");
1731 return -1;
1732 }
dcc914f4 1733
a706bb08
PZ		 1734 insn = orig_insn;
1735 sec_for_each_insn_from(file, insn) {
1736 if (insn->offset >= special_alt->orig_off + special_alt->orig_len)
1737 break;
dcc914f4 1738
a706bb08
PZ		 1739 insn->alt_group = orig_alt_group;
1740 last_orig_insn = insn;
1741 }
1742 orig_alt_group->orig_group = NULL;
1743 orig_alt_group->first_insn = orig_insn;
1744 orig_alt_group->last_insn = last_orig_insn;
1c34496e 1745 orig_alt_group->nop = NULL;
a706bb08
PZ		 1746 } else {
1747 if (orig_alt_group->last_insn->offset + orig_alt_group->last_insn->len -
1748 orig_alt_group->first_insn->offset != special_alt->orig_len) {
246b2c85 1749 WARN_INSN(orig_insn, "weirdly overlapping alternative! %ld != %d",
a706bb08
PZ		 1750 orig_alt_group->last_insn->offset +
1751 orig_alt_group->last_insn->len -
1752 orig_alt_group->first_insn->offset,
1753 special_alt->orig_len);
1754 return -1;
1755 }
1756 }
17bc3391 1757
c9c324dc
JP		 1758 new_alt_group = malloc(sizeof(*new_alt_group));
1759 if (!new_alt_group) {
1760 WARN("malloc failed");
1761 return -1;
dcc914f4 1762 }
dcc914f4 1763
c9c324dc
JP		 1764 if (special_alt->new_len < special_alt->orig_len) {
1765 /*
1766 * Insert a fake nop at the end to make the replacement
1767 * alt_group the same size as the original. This is needed to
1768 * allow propagate_alt_cfi() to do its magic. When the last
1769 * instruction affects the stack, the instruction after it (the
1770 * nop) will propagate the new state to the shared CFI array.
1771 */
1772 nop = malloc(sizeof(*nop));
1773 if (!nop) {
1774 WARN("malloc failed");
17bc3391
JP		 1775 return -1;
1776 }
c9c324dc 1777 memset(nop, 0, sizeof(*nop));
c9c324dc
JP		 1778
1779 nop->sec = special_alt->new_sec;
1780 nop->offset = special_alt->new_off + special_alt->new_len;
1781 nop->len = special_alt->orig_len - special_alt->new_len;
1782 nop->type = INSN_NOP;
dbcdbdfd 1783 nop->sym = orig_insn->sym;
c9c324dc
JP		 1784 nop->alt_group = new_alt_group;
1785 nop->ignore = orig_insn->ignore_alts;
dcc914f4 1786 }
17bc3391 1787
c9c324dc
JP		 1788 if (!special_alt->new_len) {
1789 *new_insn = nop;
1790 goto end;
dcc914f4
JP		 1791 }
1792
dcc914f4
JP		 1793 insn = *new_insn;
1794 sec_for_each_insn_from(file, insn) {
45245f51
JT		 1795 struct reloc *alt_reloc;
1796
dcc914f4
JP		 1797 if (insn->offset >= special_alt->new_off + special_alt->new_len)
1798 break;
1799
1800 last_new_insn = insn;
1801
a845c7cf 1802 insn->ignore = orig_insn->ignore_alts;
dbcdbdfd 1803 insn->sym = orig_insn->sym;
b23cc71c 1804 insn->alt_group = new_alt_group;
a845c7cf 1805
dc419723
JP		 1806 /*
1807 * Since alternative replacement code is copy/pasted by the
1808 * kernel after applying relocations, generally such code can't
1809 * have relative-address relocation references to outside the
1810 * .altinstr_replacement section, unless the arch's
1811 * alternatives code can adjust the relative offsets
1812 * accordingly.
dc419723 1813 */
7bd2a600 1814 alt_reloc = insn_reloc(file, insn);
61c6065e 1815 if (alt_reloc && arch_pc_relative_reloc(alt_reloc) &&
45245f51 1816 !arch_support_alt_relocation(special_alt, insn, alt_reloc)) {
dc419723 1817
246b2c85 1818 WARN_INSN(insn, "unsupported relocation in alternatives section");
dc419723
JP		 1819 return -1;
1820 }
1821
a2296140 1822 if (!is_static_jump(insn))
dcc914f4
JP		 1823 continue;
1824
1825 if (!insn->immediate)
1826 continue;
1827
bfb08f22 1828 dest_off = arch_jump_destination(insn);
34c861e8 1829 if (dest_off == special_alt->new_off + special_alt->new_len) {
a706bb08 1830 insn->jump_dest = next_insn_same_sec(file, orig_alt_group->last_insn);
34c861e8 1831 if (!insn->jump_dest) {
246b2c85 1832 WARN_INSN(insn, "can't find alternative jump destination");
34c861e8
JP		 1833 return -1;
1834 }
dcc914f4
JP		 1835 }
1836 }
1837
1838 if (!last_new_insn) {
1839 WARN_FUNC("can't find last new alternative instruction",
1840 special_alt->new_sec, special_alt->new_off);
1841 return -1;
1842 }
1843
c9c324dc 1844end:
b23cc71c
JP		 1845 new_alt_group->orig_group = orig_alt_group;
1846 new_alt_group->first_insn = *new_insn;
1c34496e
PZ		 1847 new_alt_group->last_insn = last_new_insn;
1848 new_alt_group->nop = nop;
c9c324dc 1849 new_alt_group->cfi = orig_alt_group->cfi;
dcc914f4
JP		 1850 return 0;
1851}
1852
1853/*
1854 * A jump table entry can either convert a nop to a jump or a jump to a nop.
1855 * If the original instruction is a jump, make the alt entry an effective nop
1856 * by just skipping the original instruction.
1857 */
1858static int handle_jump_alt(struct objtool_file *file,
1859 struct special_alt *special_alt,
1860 struct instruction *orig_insn,
1861 struct instruction **new_insn)
1862{
48001d26
PZ		 1863 if (orig_insn->type != INSN_JUMP_UNCONDITIONAL &&
1864 orig_insn->type != INSN_NOP) {
e2d9494b 1865
246b2c85 1866 WARN_INSN(orig_insn, "unsupported instruction at jump label");
dcc914f4
JP		 1867 return -1;
1868 }
1869
4ab7674f 1870 if (opts.hack_jump_label && special_alt->key_addend & 2) {
6d37b83c
PZ		 1871 struct reloc *reloc = insn_reloc(file, orig_insn);
1872
ec24b927
JP		 1873 if (reloc)
1874 set_reloc_type(file->elf, reloc, R_NONE);
6d37b83c
PZ		 1875 elf_write_insn(file->elf, orig_insn->sec,
1876 orig_insn->offset, orig_insn->len,
1877 arch_nop_insn(orig_insn->len));
1878 orig_insn->type = INSN_NOP;
48001d26
PZ		 1879 }
1880
1881 if (orig_insn->type == INSN_NOP) {
1882 if (orig_insn->len == 2)
1883 file->jl_nop_short++;
1884 else
1885 file->jl_nop_long++;
1886
1887 return 0;
6d37b83c
PZ		 1888 }
1889
e2d9494b
PZ		 1890 if (orig_insn->len == 2)
1891 file->jl_short++;
1892 else
1893 file->jl_long++;
1894
1c34496e 1895 *new_insn = next_insn_same_sec(file, orig_insn);
dcc914f4
JP		 1896 return 0;
1897}
1898
1899/*
1900 * Read all the special sections which have alternate instructions which can be
1901 * patched in or redirected to at runtime. Each instruction having alternate
1902 * instruction(s) has them added to its insn->alts list, which will be
1903 * traversed in validate_branch().
1904 */
1905static int add_special_section_alts(struct objtool_file *file)
1906{
1907 struct list_head special_alts;
1908 struct instruction *orig_insn, *new_insn;
1909 struct special_alt *special_alt, *tmp;
1910 struct alternative *alt;
1911 int ret;
1912
1913 ret = special_get_alts(file->elf, &special_alts);
1914 if (ret)
1915 return ret;
1916
1917 list_for_each_entry_safe(special_alt, tmp, &special_alts, list) {
dcc914f4
JP		 1918
1919 orig_insn = find_insn(file, special_alt->orig_sec,
1920 special_alt->orig_off);
1921 if (!orig_insn) {
1922 WARN_FUNC("special: can't find orig instruction",
1923 special_alt->orig_sec, special_alt->orig_off);
1924 ret = -1;
1925 goto out;
1926 }
1927
1928 new_insn = NULL;
1929 if (!special_alt->group || special_alt->new_len) {
1930 new_insn = find_insn(file, special_alt->new_sec,
1931 special_alt->new_off);
1932 if (!new_insn) {
1933 WARN_FUNC("special: can't find new instruction",
1934 special_alt->new_sec,
1935 special_alt->new_off);
1936 ret = -1;
1937 goto out;
1938 }
1939 }
1940
1941 if (special_alt->group) {
7170cf47 1942 if (!special_alt->orig_len) {
246b2c85 1943 WARN_INSN(orig_insn, "empty alternative entry");
7170cf47
JT		 1944 continue;
1945 }
1946
dcc914f4
JP		 1947 ret = handle_group_alt(file, special_alt, orig_insn,
1948 &new_insn);
1949 if (ret)
1950 goto out;
1951 } else if (special_alt->jump_or_nop) {
1952 ret = handle_jump_alt(file, special_alt, orig_insn,
1953 &new_insn);
1954 if (ret)
1955 goto out;
1956 }
1957
258c7605
JP		 1958 alt = malloc(sizeof(*alt));
1959 if (!alt) {
1960 WARN("malloc failed");
1961 ret = -1;
1962 goto out;
1963 }
1964
dcc914f4 1965 alt->insn = new_insn;
764eef4b 1966 alt->skip_orig = special_alt->skip_orig;
ea24213d 1967 orig_insn->ignore_alts |= special_alt->skip_alt;
d5406654
PZ		 1968 alt->next = orig_insn->alts;
1969 orig_insn->alts = alt;
dcc914f4
JP		 1970
1971 list_del(&special_alt->list);
1972 free(special_alt);
1973 }
1974
2daf7fab 1975 if (opts.stats) {
e2d9494b
PZ		 1976 printf("jl\\\tNOP\tJMP\n");
1977 printf("short:\t%ld\t%ld\n", file->jl_nop_short, file->jl_short);
1978 printf("long:\t%ld\t%ld\n", file->jl_nop_long, file->jl_long);
1979 }
1980
dcc914f4
JP		 1981out:
1982 return ret;
1983}
1984
e7c2bc37 1985static int add_jump_table(struct objtool_file *file, struct instruction *insn,
be2f0b1e 1986 struct reloc *next_table)
dcc914f4 1987{
dbcdbdfd 1988 struct symbol *pfunc = insn_func(insn)->pfunc;
be2f0b1e
JP		 1989 struct reloc *table = insn_jump_table(insn);
1990 struct instruction *dest_insn;
fd35c88b 1991 unsigned int prev_offset = 0;
be2f0b1e
JP		 1992 struct reloc *reloc = table;
1993 struct alternative *alt;
dcc914f4 1994
e7c2bc37 1995 /*
f1974222 1996 * Each @reloc is a switch table relocation which points to the target
e7c2bc37
JP		 1997 * instruction.
1998 */
caa4a6b7 1999 for_each_reloc_from(table->sec, reloc) {
bd98c813
JH		 2000
2001 /* Check for the end of the table: */
be2f0b1e 2002 if (reloc != table && reloc == next_table)
dcc914f4
JP		 2003 break;
2004
e7c2bc37 2005 /* Make sure the table entries are consecutive: */
e4cbb9b8 2006 if (prev_offset && reloc_offset(reloc) != prev_offset + 8)
fd35c88b
JP		 2007 break;
2008
2009 /* Detect function pointers from contiguous objects: */
f1974222 2010 if (reloc->sym->sec == pfunc->sec &&
0696b6e3 2011 reloc_addend(reloc) == pfunc->offset)
fd35c88b
JP		 2012 break;
2013
0696b6e3 2014 dest_insn = find_insn(file, reloc->sym->sec, reloc_addend(reloc));
e7c2bc37 2015 if (!dest_insn)
dcc914f4
JP		 2016 break;
2017
e7c2bc37 2018 /* Make sure the destination is in the same function: */
dbcdbdfd 2019 if (!insn_func(dest_insn) || insn_func(dest_insn)->pfunc != pfunc)
13810435 2020 break;
dcc914f4
JP		 2021
2022 alt = malloc(sizeof(*alt));
2023 if (!alt) {
2024 WARN("malloc failed");
2025 return -1;
2026 }
2027
e7c2bc37 2028 alt->insn = dest_insn;
d5406654
PZ		 2029 alt->next = insn->alts;
2030 insn->alts = alt;
e4cbb9b8 2031 prev_offset = reloc_offset(reloc);
fd35c88b
JP		 2032 }
2033
2034 if (!prev_offset) {
246b2c85 2035 WARN_INSN(insn, "can't find switch jump table");
fd35c88b 2036 return -1;
dcc914f4
JP		 2037 }
2038
2039 return 0;
2040}
2041
2042/*
d871f7b5
RG		 2043 * find_jump_table() - Given a dynamic jump, find the switch jump table
2044 * associated with it.
dcc914f4 2045 */
f1974222 2046static struct reloc *find_jump_table(struct objtool_file *file,
dcc914f4
JP		 2047 struct symbol *func,
2048 struct instruction *insn)
2049{
d871f7b5 2050 struct reloc *table_reloc;
113d4bc9 2051 struct instruction *dest_insn, *orig_insn = insn;
dcc914f4 2052
99ce7962
PZ		 2053 /*
2054 * Backward search using the @first_jump_src links, these help avoid
2055 * much of the 'in between' code. Which avoids us getting confused by
2056 * it.
2057 */
7dec80cc 2058 for (;
dbcdbdfd 2059 insn && insn_func(insn) && insn_func(insn)->pfunc == func;
1119d265 2060 insn = insn->first_jump_src ?: prev_insn_same_sym(file, insn)) {
99ce7962 2061
7dec80cc 2062 if (insn != orig_insn && insn->type == INSN_JUMP_DYNAMIC)
dcc914f4
JP		 2063 break;
2064
2065 /* allow small jumps within the range */
2066 if (insn->type == INSN_JUMP_UNCONDITIONAL &&
2067 insn->jump_dest &&
2068 (insn->jump_dest->offset <= insn->offset ||
2069 insn->jump_dest->offset > orig_insn->offset))
2070 break;
2071
d871f7b5 2072 table_reloc = arch_find_switch_table(file, insn);
f1974222 2073 if (!table_reloc)
e7c2bc37 2074 continue;
0696b6e3 2075 dest_insn = find_insn(file, table_reloc->sym->sec, reloc_addend(table_reloc));
dbcdbdfd 2076 if (!dest_insn || !insn_func(dest_insn) || insn_func(dest_insn)->pfunc != func)
113d4bc9 2077 continue;
7dec80cc 2078
f1974222 2079 return table_reloc;
dcc914f4
JP		 2080 }
2081
2082 return NULL;
2083}
2084
bd98c813
JH		 2085/*
2086 * First pass: Mark the head of each jump table so that in the next pass,
2087 * we know when a given jump table ends and the next one starts.
2088 */
2089static void mark_func_jump_tables(struct objtool_file *file,
2090 struct symbol *func)
dcc914f4 2091{
bd98c813 2092 struct instruction *insn, *last = NULL;
f1974222 2093 struct reloc *reloc;
dcc914f4 2094
f0f70adb 2095 func_for_each_insn(file, func, insn) {
99ce7962
PZ		 2096 if (!last)
2097 last = insn;
2098
2099 /*
2100 * Store back-pointers for unconditional forward jumps such
e7c2bc37 2101 * that find_jump_table() can back-track using those and
99ce7962
PZ		 2102 * avoid some potentially confusing code.
2103 */
2104 if (insn->type == INSN_JUMP_UNCONDITIONAL && insn->jump_dest &&
2105 insn->offset > last->offset &&
2106 insn->jump_dest->offset > insn->offset &&
2107 !insn->jump_dest->first_jump_src) {
2108
2109 insn->jump_dest->first_jump_src = insn;
2110 last = insn->jump_dest;
2111 }
2112
dcc914f4
JP		 2113 if (insn->type != INSN_JUMP_DYNAMIC)
2114 continue;
2115
f1974222 2116 reloc = find_jump_table(file, func, insn);
be2f0b1e 2117 if (reloc)
c6f5dc28 2118 insn->_jump_table = reloc;
dcc914f4 2119 }
bd98c813
JH		 2120}
2121
2122static int add_func_jump_tables(struct objtool_file *file,
2123 struct symbol *func)
2124{
be2f0b1e
JP		 2125 struct instruction *insn, *insn_t1 = NULL, *insn_t2;
2126 int ret = 0;
bd98c813 2127
f0f70adb 2128 func_for_each_insn(file, func, insn) {
c6f5dc28 2129 if (!insn_jump_table(insn))
bd98c813 2130 continue;
dcc914f4 2131
be2f0b1e
JP		 2132 if (!insn_t1) {
2133 insn_t1 = insn;
2134 continue;
2135 }
2136
2137 insn_t2 = insn;
2138
2139 ret = add_jump_table(file, insn_t1, insn_jump_table(insn_t2));
dcc914f4
JP		 2140 if (ret)
2141 return ret;
be2f0b1e
JP		 2142
2143 insn_t1 = insn_t2;
dcc914f4
JP		 2144 }
2145
be2f0b1e
JP		 2146 if (insn_t1)
2147 ret = add_jump_table(file, insn_t1, NULL);
2148
2149 return ret;
dcc914f4
JP		 2150}
2151
2152/*
2153 * For some switch statements, gcc generates a jump table in the .rodata
2154 * section which contains a list of addresses within the function to jump to.
2155 * This finds these jump tables and adds them to the insn->alts lists.
2156 */
e7c2bc37 2157static int add_jump_table_alts(struct objtool_file *file)
dcc914f4 2158{
dcc914f4
JP		 2159 struct symbol *func;
2160 int ret;
2161
4a60aa05 2162 if (!file->rodata)
dcc914f4
JP		 2163 return 0;
2164
9290e772
JP		 2165 for_each_sym(file, func) {
2166 if (func->type != STT_FUNC)
2167 continue;
dcc914f4 2168
9290e772
JP		 2169 mark_func_jump_tables(file, func);
2170 ret = add_func_jump_tables(file, func);
2171 if (ret)
2172 return ret;
dcc914f4
JP		 2173 }
2174
2175 return 0;
2176}
2177
b735bd3e
JP		 2178static void set_func_state(struct cfi_state *state)
2179{
2180 state->cfa = initial_func_cfi.cfa;
2181 memcpy(&state->regs, &initial_func_cfi.regs,
2182 CFI_NUM_REGS * sizeof(struct cfi_reg));
2183 state->stack_size = initial_func_cfi.cfa.offset;
fb799447 2184 state->type = UNWIND_HINT_TYPE_CALL;
b735bd3e
JP		 2185}
2186
39358a03
JP		 2187static int read_unwind_hints(struct objtool_file *file)
2188{
8b946cc3 2189 struct cfi_state cfi = init_cfi;
a5bd6236 2190 struct section *sec;
39358a03
JP		 2191 struct unwind_hint *hint;
2192 struct instruction *insn;
8b946cc3 2193 struct reloc *reloc;
39358a03
JP		 2194 int i;
2195
2196 sec = find_section_by_name(file->elf, ".discard.unwind_hints");
2197 if (!sec)
2198 return 0;
2199
a5bd6236 2200 if (!sec->rsec) {
39358a03
JP		 2201 WARN("missing .rela.discard.unwind_hints section");
2202 return -1;
2203 }
2204
fe255fe6 2205 if (sec->sh.sh_size % sizeof(struct unwind_hint)) {
39358a03
JP		 2206 WARN("struct unwind_hint size mismatch");
2207 return -1;
2208 }
2209
2210 file->hints = true;
2211
fe255fe6 2212 for (i = 0; i < sec->sh.sh_size / sizeof(struct unwind_hint); i++) {
39358a03
JP		 2213 hint = (struct unwind_hint *)sec->data->d_buf + i;
2214
f1974222
MH		 2215 reloc = find_reloc_by_dest(file->elf, sec, i * sizeof(*hint));
2216 if (!reloc) {
2217 WARN("can't find reloc for unwind_hints[%d]", i);
39358a03
JP		 2218 return -1;
2219 }
2220
0696b6e3 2221 insn = find_insn(file, reloc->sym->sec, reloc_addend(reloc));
39358a03
JP		 2222 if (!insn) {
2223 WARN("can't find insn for unwind_hints[%d]", i);
2224 return -1;
2225 }
2226
b735bd3e 2227 insn->hint = true;
39358a03 2228
1e4b6191
JP		 2229 if (hint->type == UNWIND_HINT_TYPE_UNDEFINED) {
2230 insn->cfi = &force_undefined_cfi;
2231 continue;
2232 }
2233
8faea26e
JP		 2234 if (hint->type == UNWIND_HINT_TYPE_SAVE) {
2235 insn->hint = false;
2236 insn->save = true;
2237 continue;
2238 }
2239
2240 if (hint->type == UNWIND_HINT_TYPE_RESTORE) {
2241 insn->restore = true;
2242 continue;
2243 }
2244
a09a6e23 2245 if (hint->type == UNWIND_HINT_TYPE_REGS_PARTIAL) {
08f87a93
PZ		 2246 struct symbol *sym = find_symbol_by_offset(insn->sec, insn->offset);
2247
a09a6e23
PZ		 2248 if (sym && sym->bind == STB_GLOBAL) {
2249 if (opts.ibt && insn->type != INSN_ENDBR && !insn->noendbr) {
246b2c85 2250 WARN_INSN(insn, "UNWIND_HINT_IRET_REGS without ENDBR");
a09a6e23 2251 }
08f87a93
PZ		 2252 }
2253 }
2254
b735bd3e 2255 if (hint->type == UNWIND_HINT_TYPE_FUNC) {
8b946cc3 2256 insn->cfi = &func_cfi;
39358a03
JP		 2257 continue;
2258 }
2259
8b946cc3
PZ		 2260 if (insn->cfi)
2261 cfi = *(insn->cfi);
2262
2263 if (arch_decode_hint_reg(hint->sp_reg, &cfi.cfa.base)) {
246b2c85 2264 WARN_INSN(insn, "unsupported unwind_hint sp base reg %d", hint->sp_reg);
39358a03
JP		 2265 return -1;
2266 }
2267
0646c28b 2268 cfi.cfa.offset = bswap_if_needed(file->elf, hint->sp_offset);
8b946cc3 2269 cfi.type = hint->type;
00c8f01c 2270 cfi.signal = hint->signal;
8b946cc3
PZ		 2271
2272 insn->cfi = cfi_hash_find_or_add(&cfi);
39358a03
JP		 2273 }
2274
2275 return 0;
2276}
2277
96db4a98
PZ		 2278static int read_noendbr_hints(struct objtool_file *file)
2279{
96db4a98 2280 struct instruction *insn;
a5bd6236 2281 struct section *rsec;
96db4a98
PZ		 2282 struct reloc *reloc;
2283
a5bd6236
JP		 2284 rsec = find_section_by_name(file->elf, ".rela.discard.noendbr");
2285 if (!rsec)
96db4a98
PZ		 2286 return 0;
2287
caa4a6b7 2288 for_each_reloc(rsec, reloc) {
0696b6e3
JP		 2289 insn = find_insn(file, reloc->sym->sec,
2290 reloc->sym->offset + reloc_addend(reloc));
96db4a98
PZ		 2291 if (!insn) {
2292 WARN("bad .discard.noendbr entry");
2293 return -1;
2294 }
2295
2296 insn->noendbr = 1;
2297 }
2298
2299 return 0;
2300}
2301
b5bc2231
PZ		 2302static int read_retpoline_hints(struct objtool_file *file)
2303{
a5bd6236 2304 struct section *rsec;
b5bc2231 2305 struct instruction *insn;
f1974222 2306 struct reloc *reloc;
b5bc2231 2307
a5bd6236
JP		 2308 rsec = find_section_by_name(file->elf, ".rela.discard.retpoline_safe");
2309 if (!rsec)
b5bc2231
PZ		 2310 return 0;
2311
caa4a6b7 2312 for_each_reloc(rsec, reloc) {
f1974222 2313 if (reloc->sym->type != STT_SECTION) {
a5bd6236 2314 WARN("unexpected relocation symbol type in %s", rsec->name);
b5bc2231
PZ		 2315 return -1;
2316 }
2317
0696b6e3 2318 insn = find_insn(file, reloc->sym->sec, reloc_addend(reloc));
b5bc2231 2319 if (!insn) {
63474dc4 2320 WARN("bad .discard.retpoline_safe entry");
b5bc2231
PZ		 2321 return -1;
2322 }
2323
2324 if (insn->type != INSN_JUMP_DYNAMIC &&
9bb2ec60 2325 insn->type != INSN_CALL_DYNAMIC &&
a09a6e23
PZ		 2326 insn->type != INSN_RETURN &&
2327 insn->type != INSN_NOP) {
246b2c85 2328 WARN_INSN(insn, "retpoline_safe hint not an indirect jump/call/ret/nop");
b5bc2231
PZ		 2329 return -1;
2330 }
2331
2332 insn->retpoline_safe = true;
2333 }
2334
2335 return 0;
2336}
2337
c4a33939
PZ		 2338static int read_instr_hints(struct objtool_file *file)
2339{
a5bd6236 2340 struct section *rsec;
c4a33939 2341 struct instruction *insn;
f1974222 2342 struct reloc *reloc;
c4a33939 2343
a5bd6236
JP		 2344 rsec = find_section_by_name(file->elf, ".rela.discard.instr_end");
2345 if (!rsec)
c4a33939
PZ		 2346 return 0;
2347
caa4a6b7 2348 for_each_reloc(rsec, reloc) {
f1974222 2349 if (reloc->sym->type != STT_SECTION) {
a5bd6236 2350 WARN("unexpected relocation symbol type in %s", rsec->name);
c4a33939
PZ		 2351 return -1;
2352 }
2353
0696b6e3 2354 insn = find_insn(file, reloc->sym->sec, reloc_addend(reloc));
c4a33939
PZ		 2355 if (!insn) {
2356 WARN("bad .discard.instr_end entry");
2357 return -1;
2358 }
2359
2360 insn->instr--;
2361 }
2362
a5bd6236
JP		 2363 rsec = find_section_by_name(file->elf, ".rela.discard.instr_begin");
2364 if (!rsec)
c4a33939
PZ		 2365 return 0;
2366
caa4a6b7 2367 for_each_reloc(rsec, reloc) {
f1974222 2368 if (reloc->sym->type != STT_SECTION) {
a5bd6236 2369 WARN("unexpected relocation symbol type in %s", rsec->name);
c4a33939
PZ		 2370 return -1;
2371 }
2372
0696b6e3 2373 insn = find_insn(file, reloc->sym->sec, reloc_addend(reloc));
c4a33939
PZ		 2374 if (!insn) {
2375 WARN("bad .discard.instr_begin entry");
2376 return -1;
2377 }
2378
2379 insn->instr++;
2380 }
2381
2382 return 0;
2383}
2384
4708ea14
JP		 2385static int read_validate_unret_hints(struct objtool_file *file)
2386{
a5bd6236 2387 struct section *rsec;
4708ea14
JP		 2388 struct instruction *insn;
2389 struct reloc *reloc;
2390
a5bd6236
JP		 2391 rsec = find_section_by_name(file->elf, ".rela.discard.validate_unret");
2392 if (!rsec)
4708ea14
JP		 2393 return 0;
2394
caa4a6b7 2395 for_each_reloc(rsec, reloc) {
4708ea14 2396 if (reloc->sym->type != STT_SECTION) {
a5bd6236 2397 WARN("unexpected relocation symbol type in %s", rsec->name);
4708ea14
JP		 2398 return -1;
2399 }
2400
0696b6e3 2401 insn = find_insn(file, reloc->sym->sec, reloc_addend(reloc));
4708ea14
JP		 2402 if (!insn) {
2403 WARN("bad .discard.instr_end entry");
2404 return -1;
2405 }
2406 insn->unret = 1;
2407 }
2408
2409 return 0;
2410}
2411
2412
8aa8eb2a
AC		 2413static int read_intra_function_calls(struct objtool_file *file)
2414{
2415 struct instruction *insn;
a5bd6236 2416 struct section *rsec;
f1974222 2417 struct reloc *reloc;
8aa8eb2a 2418
a5bd6236
JP		 2419 rsec = find_section_by_name(file->elf, ".rela.discard.intra_function_calls");
2420 if (!rsec)
8aa8eb2a
AC		 2421 return 0;
2422
caa4a6b7 2423 for_each_reloc(rsec, reloc) {
8aa8eb2a
AC		 2424 unsigned long dest_off;
2425
f1974222 2426 if (reloc->sym->type != STT_SECTION) {
8aa8eb2a 2427 WARN("unexpected relocation symbol type in %s",
a5bd6236 2428 rsec->name);
8aa8eb2a
AC		 2429 return -1;
2430 }
2431
0696b6e3 2432 insn = find_insn(file, reloc->sym->sec, reloc_addend(reloc));
8aa8eb2a
AC		 2433 if (!insn) {
2434 WARN("bad .discard.intra_function_call entry");
2435 return -1;
2436 }
2437
2438 if (insn->type != INSN_CALL) {
246b2c85 2439 WARN_INSN(insn, "intra_function_call not a direct call");
8aa8eb2a
AC		 2440 return -1;
2441 }
2442
2443 /*
2444 * Treat intra-function CALLs as JMPs, but with a stack_op.
2445 * See add_call_destinations(), which strips stack_ops from
2446 * normal CALLs.
2447 */
2448 insn->type = INSN_JUMP_UNCONDITIONAL;
2449
7b3e3186 2450 dest_off = arch_jump_destination(insn);
8aa8eb2a
AC		 2451 insn->jump_dest = find_insn(file, insn->sec, dest_off);
2452 if (!insn->jump_dest) {
246b2c85 2453 WARN_INSN(insn, "can't find call dest at %s+0x%lx",
8aa8eb2a
AC		 2454 insn->sec->name, dest_off);
2455 return -1;
2456 }
2457 }
2458
2459 return 0;
2460}
2461
05098119
ME		 2462/*
2463 * Return true if name matches an instrumentation function, where calls to that
2464 * function from noinstr code can safely be removed, but compilers won't do so.
2465 */
2466static bool is_profiling_func(const char *name)
2467{
2468 /*
2469 * Many compilers cannot disable KCOV with a function attribute.
2470 */
2471 if (!strncmp(name, "__sanitizer_cov_", 16))
2472 return true;
2473
2474 /*
2475 * Some compilers currently do not remove __tsan_func_entry/exit nor
2476 * __tsan_atomic_signal_fence (used for barrier instrumentation) with
2477 * the __no_sanitize_thread attribute, remove them. Once the kernel's
2478 * minimum Clang version is 14.0, this can be removed.
2479 */
2480 if (!strncmp(name, "__tsan_func_", 12) ||
2481 !strcmp(name, "__tsan_atomic_signal_fence"))
2482 return true;
2483
2484 return false;
2485}
2486
1739c66e 2487static int classify_symbols(struct objtool_file *file)
1e7e4788 2488{
1e7e4788
JP		 2489 struct symbol *func;
2490
9290e772
JP		 2491 for_each_sym(file, func) {
2492 if (func->bind != STB_GLOBAL)
2493 continue;
1739c66e 2494
9290e772
JP		 2495 if (!strncmp(func->name, STATIC_CALL_TRAMP_PREFIX_STR,
2496 strlen(STATIC_CALL_TRAMP_PREFIX_STR)))
2497 func->static_call_tramp = true;
1739c66e 2498
9290e772
JP		 2499 if (arch_is_retpoline(func))
2500 func->retpoline_thunk = true;
1739c66e 2501
9290e772
JP		 2502 if (arch_is_rethunk(func))
2503 func->return_thunk = true;
d9e9d230 2504
9290e772
JP		 2505 if (arch_ftrace_match(func->name))
2506 func->fentry = true;
1739c66e 2507
9290e772
JP		 2508 if (is_profiling_func(func->name))
2509 func->profiling_func = true;
1e7e4788
JP		 2510 }
2511
2512 return 0;
2513}
2514
4a60aa05
AX		 2515static void mark_rodata(struct objtool_file *file)
2516{
2517 struct section *sec;
2518 bool found = false;
2519
2520 /*
87b512de
JP		 2521 * Search for the following rodata sections, each of which can
2522 * potentially contain jump tables:
2523 *
2524 * - .rodata: can contain GCC switch tables
2525 * - .rodata.<func>: same, if -fdata-sections is being used
2526 * - .rodata..c_jump_table: contains C annotated jump tables
2527 *
2528 * .rodata.str1.* sections are ignored; they don't contain jump tables.
4a60aa05
AX		 2529 */
2530 for_each_sec(file, sec) {
1ee44470
MS		 2531 if (!strncmp(sec->name, ".rodata", 7) &&
2532 !strstr(sec->name, ".str1.")) {
4a60aa05
AX		 2533 sec->rodata = true;
2534 found = true;
2535 }
2536 }
2537
2538 file->rodata = found;
2539}
2540
dcc914f4
JP		 2541static int decode_sections(struct objtool_file *file)
2542{
2543 int ret;
2544
4a60aa05
AX		 2545 mark_rodata(file);
2546
db2b0c5d
PZ		 2547 ret = init_pv_ops(file);
2548 if (ret)
2549 return ret;
2550
dbcdbdfd
PZ		 2551 /*
2552 * Must be before add_{jump_call}_destination.
2553 */
2554 ret = classify_symbols(file);
2555 if (ret)
2556 return ret;
2557
dcc914f4
JP		 2558 ret = decode_instructions(file);
2559 if (ret)
2560 return ret;
2561
dcc914f4 2562 add_ignores(file);
ea24213d 2563 add_uaccess_safe(file);
dcc914f4 2564
ff05ab23 2565 ret = add_ignore_alternatives(file);
258c7605
JP		 2566 if (ret)
2567 return ret;
2568
08f87a93
PZ		 2569 /*
2570 * Must be before read_unwind_hints() since that needs insn->noendbr.
2571 */
96db4a98
PZ		 2572 ret = read_noendbr_hints(file);
2573 if (ret)
2574 return ret;
2575
43d5430a 2576 /*
34c861e8
JP		 2577 * Must be before add_jump_destinations(), which depends on 'func'
2578 * being set for alternatives, to enable proper sibling call detection.
43d5430a 2579 */
de6fbced
SV		 2580 if (opts.stackval || opts.orc || opts.uaccess || opts.noinstr) {
2581 ret = add_special_section_alts(file);
2582 if (ret)
2583 return ret;
2584 }
dcc914f4 2585
34c861e8 2586 ret = add_jump_destinations(file);
dcc914f4
JP		 2587 if (ret)
2588 return ret;
2589
a958c4fe
PZ		 2590 /*
2591 * Must be before add_call_destination(); it changes INSN_CALL to
2592 * INSN_JUMP.
2593 */
8aa8eb2a
AC		 2594 ret = read_intra_function_calls(file);
2595 if (ret)
2596 return ret;
2597
a845c7cf 2598 ret = add_call_destinations(file);
dcc914f4
JP		 2599 if (ret)
2600 return ret;
2601
0e5b613b
PZ		 2602 /*
2603 * Must be after add_call_destinations() such that it can override
2604 * dead_end_function() marks.
2605 */
2606 ret = add_dead_ends(file);
2607 if (ret)
2608 return ret;
2609
e7c2bc37 2610 ret = add_jump_table_alts(file);
dcc914f4
JP		 2611 if (ret)
2612 return ret;
2613
39358a03
JP		 2614 ret = read_unwind_hints(file);
2615 if (ret)
2616 return ret;
2617
b5bc2231
PZ		 2618 ret = read_retpoline_hints(file);
2619 if (ret)
2620 return ret;
2621
c4a33939
PZ		 2622 ret = read_instr_hints(file);
2623 if (ret)
2624 return ret;
2625
4708ea14
JP		 2626 ret = read_validate_unret_hints(file);
2627 if (ret)
2628 return ret;
2629
dcc914f4
JP		 2630 return 0;
2631}
2632
2633static bool is_fentry_call(struct instruction *insn)
2634{
1739c66e 2635 if (insn->type == INSN_CALL &&
c6f5dc28
PZ		 2636 insn_call_dest(insn) &&
2637 insn_call_dest(insn)->fentry)
dcc914f4
JP		 2638 return true;
2639
2640 return false;
2641}
2642
e25eea89 2643static bool has_modified_stack_frame(struct instruction *insn, struct insn_state *state)
dcc914f4 2644{
e7c0219b 2645 struct cfi_state *cfi = &state->cfi;
baa41469
JP		 2646 int i;
2647
e7c0219b 2648 if (cfi->cfa.base != initial_func_cfi.cfa.base || cfi->drap)
e25eea89
PZ		 2649 return true;
2650
b735bd3e 2651 if (cfi->cfa.offset != initial_func_cfi.cfa.offset)
baa41469
JP		 2652 return true;
2653
b735bd3e 2654 if (cfi->stack_size != initial_func_cfi.cfa.offset)
e25eea89
PZ		 2655 return true;
2656
2657 for (i = 0; i < CFI_NUM_REGS; i++) {
e7c0219b
PZ		 2658 if (cfi->regs[i].base != initial_func_cfi.regs[i].base ||
2659 cfi->regs[i].offset != initial_func_cfi.regs[i].offset)
baa41469 2660 return true;
e25eea89 2661 }
baa41469
JP		 2662
2663 return false;
2664}
2665
fb084fde
JT		 2666static bool check_reg_frame_pos(const struct cfi_reg *reg,
2667 int expected_offset)
2668{
2669 return reg->base == CFI_CFA &&
2670 reg->offset == expected_offset;
2671}
2672
baa41469
JP		 2673static bool has_valid_stack_frame(struct insn_state *state)
2674{
e7c0219b
PZ		 2675 struct cfi_state *cfi = &state->cfi;
2676
fb084fde
JT		 2677 if (cfi->cfa.base == CFI_BP &&
2678 check_reg_frame_pos(&cfi->regs[CFI_BP], -cfi->cfa.offset) &&
2679 check_reg_frame_pos(&cfi->regs[CFI_RA], -cfi->cfa.offset + 8))
baa41469
JP		 2680 return true;
2681
e7c0219b 2682 if (cfi->drap && cfi->regs[CFI_BP].base == CFI_BP)
baa41469
JP		 2683 return true;
2684
2685 return false;
dcc914f4
JP		 2686}
2687
e7c0219b
PZ		 2688static int update_cfi_state_regs(struct instruction *insn,
2689 struct cfi_state *cfi,
65ea47dc 2690 struct stack_op *op)
627fce14 2691{
e7c0219b 2692 struct cfi_reg *cfa = &cfi->cfa;
627fce14 2693
d8dd25a4 2694 if (cfa->base != CFI_SP && cfa->base != CFI_SP_INDIRECT)
627fce14
JP		 2695 return 0;
2696
2697 /* push */
ea24213d 2698 if (op->dest.type == OP_DEST_PUSH || op->dest.type == OP_DEST_PUSHF)
627fce14
JP		 2699 cfa->offset += 8;
2700
2701 /* pop */
ea24213d 2702 if (op->src.type == OP_SRC_POP || op->src.type == OP_SRC_POPF)
627fce14
JP		 2703 cfa->offset -= 8;
2704
2705 /* add immediate to sp */
2706 if (op->dest.type == OP_DEST_REG && op->src.type == OP_SRC_ADD &&
2707 op->dest.reg == CFI_SP && op->src.reg == CFI_SP)
2708 cfa->offset -= op->src.offset;
2709
2710 return 0;
2711}
2712
e7c0219b 2713static void save_reg(struct cfi_state *cfi, unsigned char reg, int base, int offset)
dcc914f4 2714{
bf4d1a83 2715 if (arch_callee_saved_reg(reg) &&
e7c0219b
PZ		 2716 cfi->regs[reg].base == CFI_UNDEFINED) {
2717 cfi->regs[reg].base = base;
2718 cfi->regs[reg].offset = offset;
baa41469 2719 }
dcc914f4
JP		 2720}
2721
e7c0219b 2722static void restore_reg(struct cfi_state *cfi, unsigned char reg)
dcc914f4 2723{
e7c0219b
PZ		 2724 cfi->regs[reg].base = initial_func_cfi.regs[reg].base;
2725 cfi->regs[reg].offset = initial_func_cfi.regs[reg].offset;
baa41469
JP		 2726}
2727
2728/*
2729 * A note about DRAP stack alignment:
2730 *
2731 * GCC has the concept of a DRAP register, which is used to help keep track of
2732 * the stack pointer when aligning the stack. r10 or r13 is used as the DRAP
2733 * register. The typical DRAP pattern is:
2734 *
2735 * 4c 8d 54 24 08 lea 0x8(%rsp),%r10
2736 * 48 83 e4 c0 and $0xffffffffffffffc0,%rsp
2737 * 41 ff 72 f8 pushq -0x8(%r10)
2738 * 55 push %rbp
2739 * 48 89 e5 mov %rsp,%rbp
2740 * (more pushes)
2741 * 41 52 push %r10
2742 * ...
2743 * 41 5a pop %r10
2744 * (more pops)
2745 * 5d pop %rbp
2746 * 49 8d 62 f8 lea -0x8(%r10),%rsp
2747 * c3 retq
2748 *
2749 * There are some variations in the epilogues, like:
2750 *
2751 * 5b pop %rbx
2752 * 41 5a pop %r10
2753 * 41 5c pop %r12
2754 * 41 5d pop %r13
2755 * 41 5e pop %r14
2756 * c9 leaveq
2757 * 49 8d 62 f8 lea -0x8(%r10),%rsp
2758 * c3 retq
2759 *
2760 * and:
2761 *
2762 * 4c 8b 55 e8 mov -0x18(%rbp),%r10
2763 * 48 8b 5d e0 mov -0x20(%rbp),%rbx
2764 * 4c 8b 65 f0 mov -0x10(%rbp),%r12
2765 * 4c 8b 6d f8 mov -0x8(%rbp),%r13
2766 * c9 leaveq
2767 * 49 8d 62 f8 lea -0x8(%r10),%rsp
2768 * c3 retq
2769 *
2770 * Sometimes r13 is used as the DRAP register, in which case it's saved and
2771 * restored beforehand:
2772 *
2773 * 41 55 push %r13
2774 * 4c 8d 6c 24 10 lea 0x10(%rsp),%r13
2775 * 48 83 e4 f0 and $0xfffffffffffffff0,%rsp
2776 * ...
2777 * 49 8d 65 f0 lea -0x10(%r13),%rsp
2778 * 41 5d pop %r13
2779 * c3 retq
2780 */
d54dba41
PZ		 2781static int update_cfi_state(struct instruction *insn,
2782 struct instruction *next_insn,
2783 struct cfi_state *cfi, struct stack_op *op)
baa41469 2784{
e7c0219b
PZ		 2785 struct cfi_reg *cfa = &cfi->cfa;
2786 struct cfi_reg *regs = cfi->regs;
baa41469 2787
1e4b6191
JP		 2788 /* ignore UNWIND_HINT_UNDEFINED regions */
2789 if (cfi->force_undefined)
2790 return 0;
2791
baa41469
JP		 2792 /* stack operations don't make sense with an undefined CFA */
2793 if (cfa->base == CFI_UNDEFINED) {
dbcdbdfd 2794 if (insn_func(insn)) {
246b2c85 2795 WARN_INSN(insn, "undefined stack state");
baa41469
JP		 2796 return -1;
2797 }
2798 return 0;
2799 }
2800
ee819aed
JT		 2801 if (cfi->type == UNWIND_HINT_TYPE_REGS ||
2802 cfi->type == UNWIND_HINT_TYPE_REGS_PARTIAL)
e7c0219b 2803 return update_cfi_state_regs(insn, cfi, op);
627fce14 2804
baa41469
JP		 2805 switch (op->dest.type) {
2806
2807 case OP_DEST_REG:
2808 switch (op->src.type) {
2809
2810 case OP_SRC_REG:
0d0970ee
JP		 2811 if (op->src.reg == CFI_SP && op->dest.reg == CFI_BP &&
2812 cfa->base == CFI_SP &&
fb084fde 2813 check_reg_frame_pos(&regs[CFI_BP], -cfa->offset)) {
0d0970ee
JP		 2814
2815 /* mov %rsp, %rbp */
2816 cfa->base = op->dest.reg;
e7c0219b 2817 cfi->bp_scratch = false;
0d0970ee 2818 }
dd88a0a0 2819
0d0970ee 2820 else if (op->src.reg == CFI_SP &&
e7c0219b 2821 op->dest.reg == CFI_BP && cfi->drap) {
dd88a0a0 2822
0d0970ee
JP		 2823 /* drap: mov %rsp, %rbp */
2824 regs[CFI_BP].base = CFI_BP;
e7c0219b
PZ		 2825 regs[CFI_BP].offset = -cfi->stack_size;
2826 cfi->bp_scratch = false;
0d0970ee 2827 }
dd88a0a0 2828
0d0970ee
JP		 2829 else if (op->src.reg == CFI_SP && cfa->base == CFI_SP) {
2830
2831 /*
2832 * mov %rsp, %reg
2833 *
2834 * This is needed for the rare case where GCC
2835 * does:
2836 *
2837 * mov %rsp, %rax
2838 * ...
2839 * mov %rax, %rsp
2840 */
e7c0219b
PZ		 2841 cfi->vals[op->dest.reg].base = CFI_CFA;
2842 cfi->vals[op->dest.reg].offset = -cfi->stack_size;
dd88a0a0
JP		 2843 }
2844
3c1f0583 2845 else if (op->src.reg == CFI_BP && op->dest.reg == CFI_SP &&
ffc7e74f 2846 (cfa->base == CFI_BP || cfa->base == cfi->drap_reg)) {
3c1f0583
JP		 2847
2848 /*
2849 * mov %rbp, %rsp
2850 *
2851 * Restore the original stack pointer (Clang).
2852 */
e7c0219b 2853 cfi->stack_size = -cfi->regs[CFI_BP].offset;
3c1f0583
JP		 2854 }
2855
dd88a0a0
JP		 2856 else if (op->dest.reg == cfa->base) {
2857
2858 /* mov %reg, %rsp */
2859 if (cfa->base == CFI_SP &&
e7c0219b 2860 cfi->vals[op->src.reg].base == CFI_CFA) {
dd88a0a0
JP		 2861
2862 /*
2863 * This is needed for the rare case
2864 * where GCC does something dumb like:
2865 *
2866 * lea 0x8(%rsp), %rcx
2867 * ...
2868 * mov %rcx, %rsp
2869 */
e7c0219b
PZ		 2870 cfa->offset = -cfi->vals[op->src.reg].offset;
2871 cfi->stack_size = cfa->offset;
dd88a0a0 2872
aafeb14e
PZ		 2873 } else if (cfa->base == CFI_SP &&
2874 cfi->vals[op->src.reg].base == CFI_SP_INDIRECT &&
2875 cfi->vals[op->src.reg].offset == cfa->offset) {
2876
2877 /*
2878 * Stack swizzle:
2879 *
2880 * 1: mov %rsp, (%[tos])
2881 * 2: mov %[tos], %rsp
2882 * ...
2883 * 3: pop %rsp
2884 *
2885 * Where:
2886 *
2887 * 1 - places a pointer to the previous
2888 * stack at the Top-of-Stack of the
2889 * new stack.
2890 *
2891 * 2 - switches to the new stack.
2892 *
2893 * 3 - pops the Top-of-Stack to restore
2894 * the original stack.
2895 *
2896 * Note: we set base to SP_INDIRECT
2897 * here and preserve offset. Therefore
2898 * when the unwinder reaches ToS it
2899 * will dereference SP and then add the
2900 * offset to find the next frame, IOW:
2901 * (%rsp) + offset.
2902 */
2903 cfa->base = CFI_SP_INDIRECT;
2904
dd88a0a0
JP		 2905 } else {
2906 cfa->base = CFI_UNDEFINED;
2907 cfa->offset = 0;
2908 }
baa41469
JP		 2909 }
2910
724c8a23
PZ		 2911 else if (op->dest.reg == CFI_SP &&
2912 cfi->vals[op->src.reg].base == CFI_SP_INDIRECT &&
2913 cfi->vals[op->src.reg].offset == cfa->offset) {
2914
2915 /*
2916 * The same stack swizzle case 2) as above. But
2917 * because we can't change cfa->base, case 3)
2918 * will become a regular POP. Pretend we're a
2919 * PUSH so things don't go unbalanced.
2920 */
2921 cfi->stack_size += 8;
2922 }
2923
2924
baa41469
JP		 2925 break;
2926
2927 case OP_SRC_ADD:
2928 if (op->dest.reg == CFI_SP && op->src.reg == CFI_SP) {
2929
2930 /* add imm, %rsp */
e7c0219b 2931 cfi->stack_size -= op->src.offset;
baa41469
JP		 2932 if (cfa->base == CFI_SP)
2933 cfa->offset -= op->src.offset;
2934 break;
2935 }
2936
2937 if (op->dest.reg == CFI_SP && op->src.reg == CFI_BP) {
2938
2939 /* lea disp(%rbp), %rsp */
e7c0219b 2940 cfi->stack_size = -(op->src.offset + regs[CFI_BP].offset);
baa41469
JP		 2941 break;
2942 }
2943
dd88a0a0 2944 if (op->src.reg == CFI_SP && cfa->base == CFI_SP) {
baa41469
JP		 2945
2946 /* drap: lea disp(%rsp), %drap */
e7c0219b 2947 cfi->drap_reg = op->dest.reg;
dd88a0a0
JP		 2948
2949 /*
2950 * lea disp(%rsp), %reg
2951 *
2952 * This is needed for the rare case where GCC
2953 * does something dumb like:
2954 *
2955 * lea 0x8(%rsp), %rcx
2956 * ...
2957 * mov %rcx, %rsp
2958 */
e7c0219b
PZ		 2959 cfi->vals[op->dest.reg].base = CFI_CFA;
2960 cfi->vals[op->dest.reg].offset = \
2961 -cfi->stack_size + op->src.offset;
dd88a0a0 2962
baa41469
JP		 2963 break;
2964 }
2965
e7c0219b
PZ		 2966 if (cfi->drap && op->dest.reg == CFI_SP &&
2967 op->src.reg == cfi->drap_reg) {
baa41469
JP		 2968
2969 /* drap: lea disp(%drap), %rsp */
2970 cfa->base = CFI_SP;
e7c0219b
PZ		 2971 cfa->offset = cfi->stack_size = -op->src.offset;
2972 cfi->drap_reg = CFI_UNDEFINED;
2973 cfi->drap = false;
baa41469
JP		 2974 break;
2975 }
2976
d54dba41 2977 if (op->dest.reg == cfi->cfa.base && !(next_insn && next_insn->hint)) {
246b2c85 2978 WARN_INSN(insn, "unsupported stack register modification");
baa41469
JP		 2979 return -1;
2980 }
2981
2982 break;
2983
2984 case OP_SRC_AND:
2985 if (op->dest.reg != CFI_SP ||
e7c0219b
PZ		 2986 (cfi->drap_reg != CFI_UNDEFINED && cfa->base != CFI_SP) ||
2987 (cfi->drap_reg == CFI_UNDEFINED && cfa->base != CFI_BP)) {
246b2c85 2988 WARN_INSN(insn, "unsupported stack pointer realignment");
baa41469
JP		 2989 return -1;
2990 }
2991
e7c0219b 2992 if (cfi->drap_reg != CFI_UNDEFINED) {
baa41469 2993 /* drap: and imm, %rsp */
e7c0219b
PZ		 2994 cfa->base = cfi->drap_reg;
2995 cfa->offset = cfi->stack_size = 0;
2996 cfi->drap = true;
baa41469
JP		 2997 }
2998
2999 /*
3000 * Older versions of GCC (4.8ish) realign the stack
3001 * without DRAP, with a frame pointer.
3002 */
3003
3004 break;
3005
3006 case OP_SRC_POP:
ea24213d 3007 case OP_SRC_POPF:
aafeb14e
PZ		 3008 if (op->dest.reg == CFI_SP && cfa->base == CFI_SP_INDIRECT) {
3009
3010 /* pop %rsp; # restore from a stack swizzle */
3011 cfa->base = CFI_SP;
3012 break;
3013 }
3014
e7c0219b 3015 if (!cfi->drap && op->dest.reg == cfa->base) {
baa41469
JP		 3016
3017 /* pop %rbp */
3018 cfa->base = CFI_SP;
3019 }
3020
e7c0219b
PZ		 3021 if (cfi->drap && cfa->base == CFI_BP_INDIRECT &&
3022 op->dest.reg == cfi->drap_reg &&
3023 cfi->drap_offset == -cfi->stack_size) {
baa41469 3024
bf4d1a83 3025 /* drap: pop %drap */
e7c0219b 3026 cfa->base = cfi->drap_reg;
bf4d1a83 3027 cfa->offset = 0;
e7c0219b 3028 cfi->drap_offset = -1;
baa41469 3029
ffc7e74f 3030 } else if (cfi->stack_size == -regs[op->dest.reg].offset) {
baa41469 3031
bf4d1a83 3032 /* pop %reg */
e7c0219b 3033 restore_reg(cfi, op->dest.reg);
baa41469
JP		 3034 }
3035
e7c0219b 3036 cfi->stack_size -= 8;
baa41469
JP		 3037 if (cfa->base == CFI_SP)
3038 cfa->offset -= 8;
3039
3040 break;
3041
3042 case OP_SRC_REG_INDIRECT:
201ef5a9
JT		 3043 if (!cfi->drap && op->dest.reg == cfa->base &&
3044 op->dest.reg == CFI_BP) {
3045
3046 /* mov disp(%rsp), %rbp */
3047 cfa->base = CFI_SP;
3048 cfa->offset = cfi->stack_size;
3049 }
3050
e7c0219b
PZ		 3051 if (cfi->drap && op->src.reg == CFI_BP &&
3052 op->src.offset == cfi->drap_offset) {
bf4d1a83
JP		 3053
3054 /* drap: mov disp(%rbp), %drap */
e7c0219b 3055 cfa->base = cfi->drap_reg;
bf4d1a83 3056 cfa->offset = 0;
e7c0219b 3057 cfi->drap_offset = -1;
bf4d1a83
JP		 3058 }
3059
e7c0219b 3060 if (cfi->drap && op->src.reg == CFI_BP &&
baa41469
JP		 3061 op->src.offset == regs[op->dest.reg].offset) {
3062
3063 /* drap: mov disp(%rbp), %reg */
e7c0219b 3064 restore_reg(cfi, op->dest.reg);
baa41469
JP		 3065
3066 } else if (op->src.reg == cfa->base &&
3067 op->src.offset == regs[op->dest.reg].offset + cfa->offset) {
3068
3069 /* mov disp(%rbp), %reg */
3070 /* mov disp(%rsp), %reg */
e7c0219b 3071 restore_reg(cfi, op->dest.reg);
201ef5a9
JT		 3072
3073 } else if (op->src.reg == CFI_SP &&
3074 op->src.offset == regs[op->dest.reg].offset + cfi->stack_size) {
3075
3076 /* mov disp(%rsp), %reg */
3077 restore_reg(cfi, op->dest.reg);
baa41469
JP		 3078 }
3079
3080 break;
3081
3082 default:
246b2c85 3083 WARN_INSN(insn, "unknown stack-related instruction");
baa41469
JP		 3084 return -1;
3085 }
3086
3087 break;
3088
3089 case OP_DEST_PUSH:
ea24213d 3090 case OP_DEST_PUSHF:
e7c0219b 3091 cfi->stack_size += 8;
baa41469
JP		 3092 if (cfa->base == CFI_SP)
3093 cfa->offset += 8;
3094
3095 if (op->src.type != OP_SRC_REG)
3096 break;
3097
e7c0219b
PZ		 3098 if (cfi->drap) {
3099 if (op->src.reg == cfa->base && op->src.reg == cfi->drap_reg) {
baa41469
JP		 3100
3101 /* drap: push %drap */
3102 cfa->base = CFI_BP_INDIRECT;
e7c0219b 3103 cfa->offset = -cfi->stack_size;
baa41469 3104
bf4d1a83 3105 /* save drap so we know when to restore it */
e7c0219b 3106 cfi->drap_offset = -cfi->stack_size;
baa41469 3107
e7c0219b 3108 } else if (op->src.reg == CFI_BP && cfa->base == cfi->drap_reg) {
baa41469
JP		 3109
3110 /* drap: push %rbp */
e7c0219b 3111 cfi->stack_size = 0;
baa41469 3112
f4f80398 3113 } else {
baa41469
JP		 3114
3115 /* drap: push %reg */
e7c0219b 3116 save_reg(cfi, op->src.reg, CFI_BP, -cfi->stack_size);
baa41469
JP		 3117 }
3118
3119 } else {
3120
3121 /* push %reg */
e7c0219b 3122 save_reg(cfi, op->src.reg, CFI_CFA, -cfi->stack_size);
baa41469
JP		 3123 }
3124
3125 /* detect when asm code uses rbp as a scratch register */
dbcdbdfd 3126 if (opts.stackval && insn_func(insn) && op->src.reg == CFI_BP &&
baa41469 3127 cfa->base != CFI_BP)
e7c0219b 3128 cfi->bp_scratch = true;
baa41469
JP		 3129 break;
3130
3131 case OP_DEST_REG_INDIRECT:
3132
e7c0219b
PZ		 3133 if (cfi->drap) {
3134 if (op->src.reg == cfa->base && op->src.reg == cfi->drap_reg) {
baa41469
JP		 3135
3136 /* drap: mov %drap, disp(%rbp) */
3137 cfa->base = CFI_BP_INDIRECT;
3138 cfa->offset = op->dest.offset;
3139
bf4d1a83 3140 /* save drap offset so we know when to restore it */
e7c0219b 3141 cfi->drap_offset = op->dest.offset;
f4f80398 3142 } else {
baa41469
JP		 3143
3144 /* drap: mov reg, disp(%rbp) */
e7c0219b 3145 save_reg(cfi, op->src.reg, CFI_BP, op->dest.offset);
baa41469
JP		 3146 }
3147
3148 } else if (op->dest.reg == cfa->base) {
3149
3150 /* mov reg, disp(%rbp) */
3151 /* mov reg, disp(%rsp) */
e7c0219b
PZ		 3152 save_reg(cfi, op->src.reg, CFI_CFA,
3153 op->dest.offset - cfi->cfa.offset);
201ef5a9
JT		 3154
3155 } else if (op->dest.reg == CFI_SP) {
3156
3157 /* mov reg, disp(%rsp) */
3158 save_reg(cfi, op->src.reg, CFI_CFA,
3159 op->dest.offset - cfi->stack_size);
aafeb14e
PZ		 3160
3161 } else if (op->src.reg == CFI_SP && op->dest.offset == 0) {
3162
3163 /* mov %rsp, (%reg); # setup a stack swizzle. */
3164 cfi->vals[op->dest.reg].base = CFI_SP_INDIRECT;
3165 cfi->vals[op->dest.reg].offset = cfa->offset;
baa41469
JP		 3166 }
3167
3168 break;
3169
baa41469 3170 case OP_DEST_MEM:
ea24213d 3171 if (op->src.type != OP_SRC_POP && op->src.type != OP_SRC_POPF) {
246b2c85 3172 WARN_INSN(insn, "unknown stack-related memory operation");
baa41469
JP		 3173 return -1;
3174 }
3175
3176 /* pop mem */
e7c0219b 3177 cfi->stack_size -= 8;
baa41469
JP		 3178 if (cfa->base == CFI_SP)
3179 cfa->offset -= 8;
3180
3181 break;
3182
3183 default:
246b2c85 3184 WARN_INSN(insn, "unknown stack-related instruction");
baa41469
JP		 3185 return -1;
3186 }
3187
3188 return 0;
3189}
3190
c9c324dc
JP		 3191/*
3192 * The stack layouts of alternatives instructions can sometimes diverge when
3193 * they have stack modifications. That's fine as long as the potential stack
3194 * layouts don't conflict at any given potential instruction boundary.
3195 *
3196 * Flatten the CFIs of the different alternative code streams (both original
3197 * and replacement) into a single shared CFI array which can be used to detect
3198 * conflicts and nicely feed a linear array of ORC entries to the unwinder.
3199 */
3200static int propagate_alt_cfi(struct objtool_file *file, struct instruction *insn)
65ea47dc 3201{
c9c324dc
JP		 3202 struct cfi_state **alt_cfi;
3203 int group_off;
65ea47dc 3204
c9c324dc
JP		 3205 if (!insn->alt_group)
3206 return 0;
65ea47dc 3207
8b946cc3
PZ		 3208 if (!insn->cfi) {
3209 WARN("CFI missing");
3210 return -1;
3211 }
3212
c9c324dc
JP		 3213 alt_cfi = insn->alt_group->cfi;
3214 group_off = insn->offset - insn->alt_group->first_insn->offset;
65ea47dc 3215
c9c324dc 3216 if (!alt_cfi[group_off]) {
8b946cc3 3217 alt_cfi[group_off] = insn->cfi;
c9c324dc 3218 } else {
8b946cc3 3219 if (cficmp(alt_cfi[group_off], insn->cfi)) {
a706bb08
PZ		 3220 struct alt_group *orig_group = insn->alt_group->orig_group ?: insn->alt_group;
3221 struct instruction *orig = orig_group->first_insn;
3222 char *where = offstr(insn->sec, insn->offset);
246b2c85 3223 WARN_INSN(orig, "stack layout conflict in alternatives: %s", where);
a706bb08 3224 free(where);
ab3852ab
PZ		 3225 return -1;
3226 }
c9c324dc
JP		 3227 }
3228
3229 return 0;
3230}
3231
d54dba41
PZ		 3232static int handle_insn_ops(struct instruction *insn,
3233 struct instruction *next_insn,
3234 struct insn_state *state)
c9c324dc
JP		 3235{
3236 struct stack_op *op;
3237
3ee88df1 3238 for (op = insn->stack_ops; op; op = op->next) {
c9c324dc 3239
d54dba41 3240 if (update_cfi_state(insn, next_insn, &state->cfi, op))
c9c324dc 3241 return 1;
ab3852ab 3242
ba08abca
PZ		 3243 if (!insn->alt_group)
3244 continue;
3245
65ea47dc
JT		 3246 if (op->dest.type == OP_DEST_PUSHF) {
3247 if (!state->uaccess_stack) {
3248 state->uaccess_stack = 1;
3249 } else if (state->uaccess_stack >> 31) {
246b2c85 3250 WARN_INSN(insn, "PUSHF stack exhausted");
65ea47dc
JT		 3251 return 1;
3252 }
3253 state->uaccess_stack <<= 1;
3254 state->uaccess_stack |= state->uaccess;
3255 }
3256
3257 if (op->src.type == OP_SRC_POPF) {
3258 if (state->uaccess_stack) {
3259 state->uaccess = state->uaccess_stack & 1;
3260 state->uaccess_stack >>= 1;
3261 if (state->uaccess_stack == 1)
3262 state->uaccess_stack = 0;
3263 }
3264 }
3265 }
3266
3267 return 0;
3268}
3269
e7c0219b 3270static bool insn_cfi_match(struct instruction *insn, struct cfi_state *cfi2)
baa41469 3271{
8b946cc3 3272 struct cfi_state *cfi1 = insn->cfi;
baa41469
JP		 3273 int i;
3274
8b946cc3
PZ		 3275 if (!cfi1) {
3276 WARN("CFI missing");
3277 return false;
3278 }
3279
e7c0219b
PZ		 3280 if (memcmp(&cfi1->cfa, &cfi2->cfa, sizeof(cfi1->cfa))) {
3281
246b2c85 3282 WARN_INSN(insn, "stack state mismatch: cfa1=%d%+d cfa2=%d%+d",
e7c0219b
PZ		 3283 cfi1->cfa.base, cfi1->cfa.offset,
3284 cfi2->cfa.base, cfi2->cfa.offset);
baa41469 3285
e7c0219b 3286 } else if (memcmp(&cfi1->regs, &cfi2->regs, sizeof(cfi1->regs))) {
baa41469 3287 for (i = 0; i < CFI_NUM_REGS; i++) {
e7c0219b 3288 if (!memcmp(&cfi1->regs[i], &cfi2->regs[i],
baa41469
JP		 3289 sizeof(struct cfi_reg)))
3290 continue;
3291
246b2c85 3292 WARN_INSN(insn, "stack state mismatch: reg1[%d]=%d%+d reg2[%d]=%d%+d",
e7c0219b
PZ		 3293 i, cfi1->regs[i].base, cfi1->regs[i].offset,
3294 i, cfi2->regs[i].base, cfi2->regs[i].offset);
baa41469
JP		 3295 break;
3296 }
3297
e7c0219b
PZ		 3298 } else if (cfi1->type != cfi2->type) {
3299
246b2c85
JP		 3300 WARN_INSN(insn, "stack state mismatch: type1=%d type2=%d",
3301 cfi1->type, cfi2->type);
e7c0219b
PZ		 3302
3303 } else if (cfi1->drap != cfi2->drap ||
3304 (cfi1->drap && cfi1->drap_reg != cfi2->drap_reg) ||
3305 (cfi1->drap && cfi1->drap_offset != cfi2->drap_offset)) {
627fce14 3306
246b2c85 3307 WARN_INSN(insn, "stack state mismatch: drap1=%d(%d,%d) drap2=%d(%d,%d)",
e7c0219b
PZ		 3308 cfi1->drap, cfi1->drap_reg, cfi1->drap_offset,
3309 cfi2->drap, cfi2->drap_reg, cfi2->drap_offset);
baa41469
JP		 3310
3311 } else
3312 return true;
3313
3314 return false;
dcc914f4
JP		 3315}
3316
ea24213d
PZ		 3317static inline bool func_uaccess_safe(struct symbol *func)
3318{
3319 if (func)
e10cd8fe 3320 return func->uaccess_safe;
ea24213d
PZ		 3321
3322 return false;
3323}
3324
0c1ddd33 3325static inline const char *call_dest_name(struct instruction *insn)
ea24213d 3326{
82880283 3327 static char pvname[19];
a5bd6236 3328 struct reloc *reloc;
db2b0c5d
PZ		 3329 int idx;
3330
c6f5dc28
PZ		 3331 if (insn_call_dest(insn))
3332 return insn_call_dest(insn)->name;
ea24213d 3333
a5bd6236
JP		 3334 reloc = insn_reloc(NULL, insn);
3335 if (reloc && !strcmp(reloc->sym->name, "pv_ops")) {
0696b6e3 3336 idx = (reloc_addend(reloc) / sizeof(void *));
db2b0c5d
PZ		 3337 snprintf(pvname, sizeof(pvname), "pv_ops[%d]", idx);
3338 return pvname;
3339 }
3340
ea24213d
PZ		 3341 return "{dynamic}";
3342}
3343
db2b0c5d
PZ		 3344static bool pv_call_dest(struct objtool_file *file, struct instruction *insn)
3345{
3346 struct symbol *target;
a5bd6236 3347 struct reloc *reloc;
db2b0c5d
PZ		 3348 int idx;
3349
a5bd6236
JP		 3350 reloc = insn_reloc(file, insn);
3351 if (!reloc || strcmp(reloc->sym->name, "pv_ops"))
db2b0c5d
PZ		 3352 return false;
3353
0696b6e3 3354 idx = (arch_dest_reloc_offset(reloc_addend(reloc)) / sizeof(void *));
db2b0c5d
PZ		 3355
3356 if (file->pv_ops[idx].clean)
3357 return true;
3358
3359 file->pv_ops[idx].clean = true;
3360
3361 list_for_each_entry(target, &file->pv_ops[idx].targets, pv_target) {
3362 if (!target->sec->noinstr) {
3363 WARN("pv_ops[%d]: %s", idx, target->name);
3364 file->pv_ops[idx].clean = false;
3365 }
3366 }
3367
3368 return file->pv_ops[idx].clean;
3369}
3370
3371static inline bool noinstr_call_dest(struct objtool_file *file,
3372 struct instruction *insn,
3373 struct symbol *func)
6b643a07
PZ		 3374{
3375 /*
3376 * We can't deal with indirect function calls at present;
3377 * assume they're instrumented.
3378 */
db2b0c5d
PZ		 3379 if (!func) {
3380 if (file->pv_ops)
3381 return pv_call_dest(file, insn);
3382
6b643a07 3383 return false;
db2b0c5d 3384 }
6b643a07
PZ		 3385
3386 /*
3387 * If the symbol is from a noinstr section; we good.
3388 */
3389 if (func->sec->noinstr)
3390 return true;
3391
2b5a0e42
PZ		 3392 /*
3393 * If the symbol is a static_call trampoline, we can't tell.
3394 */
3395 if (func->static_call_tramp)
3396 return true;
3397
6b643a07
PZ		 3398 /*
3399 * The __ubsan_handle_*() calls are like WARN(), they only happen when
3400 * something 'BAD' happened. At the risk of taking the machine down,
3401 * let them proceed to get the message out.
3402 */
3403 if (!strncmp(func->name, "__ubsan_handle_", 15))
3404 return true;
3405
3406 return false;
3407}
3408
db2b0c5d
PZ		 3409static int validate_call(struct objtool_file *file,
3410 struct instruction *insn,
3411 struct insn_state *state)
ea24213d 3412{
c4a33939 3413 if (state->noinstr && state->instr <= 0 &&
c6f5dc28 3414 !noinstr_call_dest(file, insn, insn_call_dest(insn))) {
246b2c85 3415 WARN_INSN(insn, "call to %s() leaves .noinstr.text section", call_dest_name(insn));
c4a33939
PZ		 3416 return 1;
3417 }
3418
c6f5dc28 3419 if (state->uaccess && !func_uaccess_safe(insn_call_dest(insn))) {
246b2c85 3420 WARN_INSN(insn, "call to %s() with UACCESS enabled", call_dest_name(insn));
ea24213d
PZ		 3421 return 1;
3422 }
3423
2f0f9e9a 3424 if (state->df) {
246b2c85 3425 WARN_INSN(insn, "call to %s() with DF set", call_dest_name(insn));
2f0f9e9a
PZ		 3426 return 1;
3427 }
3428
ea24213d
PZ		 3429 return 0;
3430}
3431
db2b0c5d
PZ		 3432static int validate_sibling_call(struct objtool_file *file,
3433 struct instruction *insn,
3434 struct insn_state *state)
54262aa2 3435{
5a9c361a 3436 if (insn_func(insn) && has_modified_stack_frame(insn, state)) {
246b2c85 3437 WARN_INSN(insn, "sibling call from callable instruction with modified stack frame");
54262aa2
PZ		 3438 return 1;
3439 }
3440
db2b0c5d 3441 return validate_call(file, insn, state);
54262aa2
PZ		 3442}
3443
a92e92d1
PZ		 3444static int validate_return(struct symbol *func, struct instruction *insn, struct insn_state *state)
3445{
c4a33939 3446 if (state->noinstr && state->instr > 0) {
246b2c85 3447 WARN_INSN(insn, "return with instrumentation enabled");
c4a33939
PZ		 3448 return 1;
3449 }
3450
a92e92d1 3451 if (state->uaccess && !func_uaccess_safe(func)) {
246b2c85 3452 WARN_INSN(insn, "return with UACCESS enabled");
a92e92d1
PZ		 3453 return 1;
3454 }
3455
3456 if (!state->uaccess && func_uaccess_safe(func)) {
246b2c85 3457 WARN_INSN(insn, "return with UACCESS disabled from a UACCESS-safe function");
a92e92d1
PZ		 3458 return 1;
3459 }
3460
3461 if (state->df) {
246b2c85 3462 WARN_INSN(insn, "return with DF set");
a92e92d1
PZ		 3463 return 1;
3464 }
3465
e25eea89 3466 if (func && has_modified_stack_frame(insn, state)) {
246b2c85 3467 WARN_INSN(insn, "return with modified stack frame");
a92e92d1
PZ		 3468 return 1;
3469 }
3470
e7c0219b 3471 if (state->cfi.bp_scratch) {
246b2c85 3472 WARN_INSN(insn, "BP used as a scratch register");
a92e92d1
PZ		 3473 return 1;
3474 }
3475
3476 return 0;
3477}
3478
c9c324dc
JP		 3479static struct instruction *next_insn_to_validate(struct objtool_file *file,
3480 struct instruction *insn)
7117f16b 3481{
b23cc71c 3482 struct alt_group *alt_group = insn->alt_group;
7117f16b 3483
c9c324dc
JP		 3484 /*
3485 * Simulate the fact that alternatives are patched in-place. When the
3486 * end of a replacement alt_group is reached, redirect objtool flow to
3487 * the end of the original alt_group.
1c34496e
PZ		 3488 *
3489 * insn->alts->insn -> alt_group->first_insn
3490 * ...
3491 * alt_group->last_insn
3492 * [alt_group->nop] -> next(orig_group->last_insn)
c9c324dc 3493 */
1c34496e
PZ		 3494 if (alt_group) {
3495 if (alt_group->nop) {
3496 /* ->nop implies ->orig_group */
3497 if (insn == alt_group->last_insn)
3498 return alt_group->nop;
3499 if (insn == alt_group->nop)
3500 goto next_orig;
3501 }
3502 if (insn == alt_group->last_insn && alt_group->orig_group)
3503 goto next_orig;
3504 }
c9c324dc
JP		 3505
3506 return next_insn_same_sec(file, insn);
1c34496e
PZ		 3507
3508next_orig:
3509 return next_insn_same_sec(file, alt_group->orig_group->last_insn);
7117f16b
PZ		 3510}
3511
dcc914f4
JP		 3512/*
3513 * Follow the branch starting at the given instruction, and recursively follow
3514 * any other branches (jumps). Meanwhile, track the frame pointer state at
3515 * each instruction and validate all the rules described in
d6a21f2d 3516 * tools/objtool/Documentation/objtool.txt.
dcc914f4 3517 */
c705cecc 3518static int validate_branch(struct objtool_file *file, struct symbol *func,
b7460462 3519 struct instruction *insn, struct insn_state state)
dcc914f4
JP		 3520{
3521 struct alternative *alt;
8b946cc3 3522 struct instruction *next_insn, *prev_insn = NULL;
dcc914f4 3523 struct section *sec;
882a0db9 3524 u8 visited;
dcc914f4
JP		 3525 int ret;
3526
dcc914f4 3527 sec = insn->sec;
dcc914f4 3528
dcc914f4 3529 while (1) {
c9c324dc 3530 next_insn = next_insn_to_validate(file, insn);
39358a03 3531
dbcdbdfd 3532 if (func && insn_func(insn) && func != insn_func(insn)->pfunc) {
3c68a92d 3533 /* Ignore KCFI type preambles, which always fall through */
9f2899fe
PZ		 3534 if (!strncmp(func->name, "__cfi_", 6) ||
3535 !strncmp(func->name, "__pfx_", 6))
3c68a92d
ST		 3536 return 0;
3537
ee97638b 3538 WARN("%s() falls through to next function %s()",
dbcdbdfd 3539 func->name, insn_func(insn)->name);
ee97638b 3540 return 1;
dcc914f4
JP		 3541 }
3542
4855022a 3543 if (func && insn->ignore) {
246b2c85 3544 WARN_INSN(insn, "BUG: why am I validating an ignored function?");
12b25729 3545 return 1;
4855022a
JP		 3546 }
3547
a09a6e23
PZ		 3548 visited = VISITED_BRANCH << state.uaccess;
3549 if (insn->visited & VISITED_BRANCH_MASK) {
e7c0219b 3550 if (!insn->hint && !insn_cfi_match(insn, &state.cfi))
dcc914f4 3551 return 1;
dcc914f4 3552
882a0db9 3553 if (insn->visited & visited)
ea24213d 3554 return 0;
8b946cc3
PZ		 3555 } else {
3556 nr_insns_visited++;
dcc914f4
JP		 3557 }
3558
c4a33939
PZ		 3559 if (state.noinstr)
3560 state.instr += insn->instr;
3561
8b946cc3 3562 if (insn->hint) {
8faea26e
JP		 3563 if (insn->restore) {
3564 struct instruction *save_insn, *i;
3565
3566 i = insn;
3567 save_insn = NULL;
3568
3569 sym_for_each_insn_continue_reverse(file, func, i) {
3570 if (i->save) {
3571 save_insn = i;
3572 break;
3573 }
3574 }
3575
3576 if (!save_insn) {
246b2c85 3577 WARN_INSN(insn, "no corresponding CFI save for CFI restore");
8faea26e
JP		 3578 return 1;
3579 }
3580
3581 if (!save_insn->visited) {
246b2c85 3582 WARN_INSN(insn, "objtool isn't smart enough to handle this CFI save/restore combo");
8faea26e
JP		 3583 return 1;
3584 }
3585
3586 insn->cfi = save_insn->cfi;
3587 nr_cfi_reused++;
3588 }
3589
8b946cc3
PZ		 3590 state.cfi = *insn->cfi;
3591 } else {
3592 /* XXX track if we actually changed state.cfi */
3593
3594 if (prev_insn && !cficmp(prev_insn->cfi, &state.cfi)) {
3595 insn->cfi = prev_insn->cfi;
3596 nr_cfi_reused++;
3597 } else {
3598 insn->cfi = cfi_hash_find_or_add(&state.cfi);
3599 }
3600 }
dcc914f4 3601
882a0db9 3602 insn->visited |= visited;
baa41469 3603
c9c324dc
JP		 3604 if (propagate_alt_cfi(file, insn))
3605 return 1;
3606
d5406654 3607 if (!insn->ignore_alts && insn->alts) {
764eef4b
PZ		 3608 bool skip_orig = false;
3609
d5406654 3610 for (alt = insn->alts; alt; alt = alt->next) {
764eef4b
PZ		 3611 if (alt->skip_orig)
3612 skip_orig = true;
3613
c705cecc 3614 ret = validate_branch(file, func, alt->insn, state);
7697eee3 3615 if (ret) {
ced23d2e 3616 BT_INSN(insn, "(alt)");
7697eee3
PZ		 3617 return ret;
3618 }
a845c7cf 3619 }
764eef4b
PZ		 3620
3621 if (skip_orig)
3622 return 0;
dcc914f4
JP		 3623 }
3624
d54dba41 3625 if (handle_insn_ops(insn, next_insn, &state))
60041bcd
PZ		 3626 return 1;
3627
dcc914f4
JP		 3628 switch (insn->type) {
3629
dcc914f4 3630 case INSN_RETURN:
a92e92d1 3631 return validate_return(func, insn, &state);
dcc914f4
JP		 3632
3633 case INSN_CALL:
ea24213d 3634 case INSN_CALL_DYNAMIC:
db2b0c5d 3635 ret = validate_call(file, insn, &state);
ea24213d
PZ		 3636 if (ret)
3637 return ret;
dcc914f4 3638
72064474 3639 if (opts.stackval && func && !is_fentry_call(insn) &&
c9bab22b 3640 !has_valid_stack_frame(&state)) {
246b2c85 3641 WARN_INSN(insn, "call without frame pointer save/setup");
dcc914f4
JP		 3642 return 1;
3643 }
c9bab22b 3644
0e5b613b 3645 if (insn->dead_end)
c9bab22b
JP		 3646 return 0;
3647
dcc914f4
JP		 3648 break;
3649
3650 case INSN_JUMP_CONDITIONAL:
3651 case INSN_JUMP_UNCONDITIONAL:
ecf11ba4 3652 if (is_sibling_call(insn)) {
db2b0c5d 3653 ret = validate_sibling_call(file, insn, &state);
dcc914f4 3654 if (ret)
54262aa2 3655 return ret;
4855022a 3656
0c1ddd33 3657 } else if (insn->jump_dest) {
c705cecc
JP		 3658 ret = validate_branch(file, func,
3659 insn->jump_dest, state);
7697eee3 3660 if (ret) {
ced23d2e 3661 BT_INSN(insn, "(branch)");
7697eee3
PZ		 3662 return ret;
3663 }
4855022a 3664 }
dcc914f4
JP		 3665
3666 if (insn->type == INSN_JUMP_UNCONDITIONAL)
3667 return 0;
3668
3669 break;
3670
3671 case INSN_JUMP_DYNAMIC:
b68b9907 3672 case INSN_JUMP_DYNAMIC_CONDITIONAL:
ecf11ba4 3673 if (is_sibling_call(insn)) {
db2b0c5d 3674 ret = validate_sibling_call(file, insn, &state);
54262aa2
PZ		 3675 if (ret)
3676 return ret;
dcc914f4
JP		 3677 }
3678
b68b9907
JP		 3679 if (insn->type == INSN_JUMP_DYNAMIC)
3680 return 0;
3681
3682 break;
dcc914f4 3683
39358a03
JP		 3684 case INSN_CONTEXT_SWITCH:
3685 if (func && (!next_insn || !next_insn->hint)) {
246b2c85 3686 WARN_INSN(insn, "unsupported instruction in callable function");
39358a03
JP		 3687 return 1;
3688 }
3689 return 0;
3690
ea24213d
PZ		 3691 case INSN_STAC:
3692 if (state.uaccess) {
246b2c85 3693 WARN_INSN(insn, "recursive UACCESS enable");
ea24213d
PZ		 3694 return 1;
3695 }
3696
3697 state.uaccess = true;
3698 break;
3699
3700 case INSN_CLAC:
c705cecc 3701 if (!state.uaccess && func) {
246b2c85 3702 WARN_INSN(insn, "redundant UACCESS disable");
ea24213d
PZ		 3703 return 1;
3704 }
3705
3706 if (func_uaccess_safe(func) && !state.uaccess_stack) {
246b2c85 3707 WARN_INSN(insn, "UACCESS-safe disables UACCESS");
ea24213d
PZ		 3708 return 1;
3709 }
3710
3711 state.uaccess = false;
baa41469
JP		 3712 break;
3713
2f0f9e9a 3714 case INSN_STD:
6f567c93 3715 if (state.df) {
246b2c85 3716 WARN_INSN(insn, "recursive STD");
6f567c93
JP		 3717 return 1;
3718 }
2f0f9e9a
PZ		 3719
3720 state.df = true;
3721 break;
3722
3723 case INSN_CLD:
6f567c93 3724 if (!state.df && func) {
246b2c85 3725 WARN_INSN(insn, "redundant CLD");
6f567c93
JP		 3726 return 1;
3727 }
2f0f9e9a
PZ		 3728
3729 state.df = false;
baa41469
JP		 3730 break;
3731
dcc914f4
JP		 3732 default:
3733 break;
3734 }
3735
3736 if (insn->dead_end)
3737 return 0;
3738
00d96180 3739 if (!next_insn) {
e7c0219b 3740 if (state.cfi.cfa.base == CFI_UNDEFINED)
00d96180 3741 return 0;
dcc914f4
JP		 3742 WARN("%s: unexpected end of section", sec->name);
3743 return 1;
3744 }
00d96180 3745
8b946cc3 3746 prev_insn = insn;
00d96180 3747 insn = next_insn;
dcc914f4
JP		 3748 }
3749
3750 return 0;
3751}
3752
1c34496e
PZ		 3753static int validate_unwind_hint(struct objtool_file *file,
3754 struct instruction *insn,
3755 struct insn_state *state)
3756{
3757 if (insn->hint && !insn->visited && !insn->ignore) {
3758 int ret = validate_branch(file, insn_func(insn), insn, *state);
ced23d2e
JP		 3759 if (ret)
3760 BT_INSN(insn, "<=== (hint)");
1c34496e
PZ		 3761 return ret;
3762 }
3763
3764 return 0;
3765}
3766
932f8e98 3767static int validate_unwind_hints(struct objtool_file *file, struct section *sec)
39358a03
JP		 3768{
3769 struct instruction *insn;
39358a03 3770 struct insn_state state;
1c34496e 3771 int warnings = 0;
39358a03
JP		 3772
3773 if (!file->hints)
3774 return 0;
3775
753da417 3776 init_insn_state(file, &state, sec);
39358a03 3777
932f8e98 3778 if (sec) {
1c34496e
PZ		 3779 sec_for_each_insn(file, sec, insn)
3780 warnings += validate_unwind_hint(file, insn, &state);
932f8e98 3781 } else {
1c34496e
PZ		 3782 for_each_insn(file, insn)
3783 warnings += validate_unwind_hint(file, insn, &state);
39358a03
JP		 3784 }
3785
3786 return warnings;
3787}
3788
a09a6e23
PZ		 3789/*
3790 * Validate rethunk entry constraint: must untrain RET before the first RET.
3791 *
4708ea14 3792 * Follow every branch (intra-function) and ensure VALIDATE_UNRET_END comes
a09a6e23
PZ		 3793 * before an actual RET instruction.
3794 */
4708ea14 3795static int validate_unret(struct objtool_file *file, struct instruction *insn)
a09a6e23
PZ		 3796{
3797 struct instruction *next, *dest;
d49d1666 3798 int ret;
a09a6e23
PZ		 3799
3800 for (;;) {
3801 next = next_insn_to_validate(file, insn);
3802
4708ea14 3803 if (insn->visited & VISITED_UNRET)
a09a6e23
PZ		 3804 return 0;
3805
4708ea14 3806 insn->visited |= VISITED_UNRET;
a09a6e23 3807
d5406654 3808 if (!insn->ignore_alts && insn->alts) {
a09a6e23
PZ		 3809 struct alternative *alt;
3810 bool skip_orig = false;
3811
d5406654 3812 for (alt = insn->alts; alt; alt = alt->next) {
a09a6e23
PZ		 3813 if (alt->skip_orig)
3814 skip_orig = true;
3815
4708ea14 3816 ret = validate_unret(file, alt->insn);
a09a6e23 3817 if (ret) {
ced23d2e 3818 BT_INSN(insn, "(alt)");
a09a6e23
PZ		 3819 return ret;
3820 }
3821 }
3822
3823 if (skip_orig)
3824 return 0;
3825 }
3826
3827 switch (insn->type) {
3828
3829 case INSN_CALL_DYNAMIC:
3830 case INSN_JUMP_DYNAMIC:
3831 case INSN_JUMP_DYNAMIC_CONDITIONAL:
246b2c85 3832 WARN_INSN(insn, "early indirect call");
a09a6e23
PZ		 3833 return 1;
3834
3835 case INSN_JUMP_UNCONDITIONAL:
3836 case INSN_JUMP_CONDITIONAL:
3837 if (!is_sibling_call(insn)) {
3838 if (!insn->jump_dest) {
246b2c85 3839 WARN_INSN(insn, "unresolved jump target after linking?!?");
a09a6e23
PZ		 3840 return -1;
3841 }
4708ea14 3842 ret = validate_unret(file, insn->jump_dest);
a09a6e23 3843 if (ret) {
ced23d2e
JP		 3844 BT_INSN(insn, "(branch%s)",
3845 insn->type == INSN_JUMP_CONDITIONAL ? "-cond" : "");
a09a6e23
PZ		 3846 return ret;
3847 }
3848
3849 if (insn->type == INSN_JUMP_UNCONDITIONAL)
3850 return 0;
3851
3852 break;
3853 }
3854
3855 /* fallthrough */
3856 case INSN_CALL:
c6f5dc28
PZ		 3857 dest = find_insn(file, insn_call_dest(insn)->sec,
3858 insn_call_dest(insn)->offset);
a09a6e23
PZ		 3859 if (!dest) {
3860 WARN("Unresolved function after linking!?: %s",
c6f5dc28 3861 insn_call_dest(insn)->name);
a09a6e23
PZ		 3862 return -1;
3863 }
3864
4708ea14 3865 ret = validate_unret(file, dest);
a09a6e23 3866 if (ret) {
ced23d2e 3867 BT_INSN(insn, "(call)");
a09a6e23
PZ		 3868 return ret;
3869 }
3870 /*
3871 * If a call returns without error, it must have seen UNTRAIN_RET.
3872 * Therefore any non-error return is a success.
3873 */
3874 return 0;
3875
3876 case INSN_RETURN:
246b2c85 3877 WARN_INSN(insn, "RET before UNTRAIN");
a09a6e23
PZ		 3878 return 1;
3879
3880 case INSN_NOP:
3881 if (insn->retpoline_safe)
3882 return 0;
3883 break;
3884
3885 default:
3886 break;
3887 }
3888
3889 if (!next) {
246b2c85 3890 WARN_INSN(insn, "teh end!");
a09a6e23
PZ		 3891 return -1;
3892 }
3893 insn = next;
3894 }
3895
d49d1666 3896 return 0;
a09a6e23
PZ		 3897}
3898
3899/*
4708ea14
JP		 3900 * Validate that all branches starting at VALIDATE_UNRET_BEGIN encounter
3901 * VALIDATE_UNRET_END before RET.
a09a6e23 3902 */
4708ea14 3903static int validate_unrets(struct objtool_file *file)
a09a6e23
PZ		 3904{
3905 struct instruction *insn;
3906 int ret, warnings = 0;
3907
3908 for_each_insn(file, insn) {
4708ea14 3909 if (!insn->unret)
a09a6e23
PZ		 3910 continue;
3911
4708ea14 3912 ret = validate_unret(file, insn);
a09a6e23 3913 if (ret < 0) {
246b2c85 3914 WARN_INSN(insn, "Failed UNRET validation");
a09a6e23
PZ		 3915 return ret;
3916 }
3917 warnings += ret;
3918 }
3919
3920 return warnings;
3921}
3922
b5bc2231
PZ		 3923static int validate_retpoline(struct objtool_file *file)
3924{
3925 struct instruction *insn;
3926 int warnings = 0;
3927
3928 for_each_insn(file, insn) {
3929 if (insn->type != INSN_JUMP_DYNAMIC &&
9bb2ec60
PZ		 3930 insn->type != INSN_CALL_DYNAMIC &&
3931 insn->type != INSN_RETURN)
b5bc2231
PZ		 3932 continue;
3933
3934 if (insn->retpoline_safe)
3935 continue;
3936
6644ee84 3937 if (insn->sec->init)
ca41b97e
PZ		 3938 continue;
3939
9bb2ec60 3940 if (insn->type == INSN_RETURN) {
f43b9876 3941 if (opts.rethunk) {
246b2c85 3942 WARN_INSN(insn, "'naked' return found in RETHUNK build");
f43b9876
PZ		 3943 } else
3944 continue;
9bb2ec60 3945 } else {
246b2c85 3946 WARN_INSN(insn, "indirect %s found in RETPOLINE build",
9bb2ec60
PZ		 3947 insn->type == INSN_JUMP_DYNAMIC ? "jump" : "call");
3948 }
b5bc2231
PZ		 3949
3950 warnings++;
3951 }
3952
3953 return warnings;
3954}
3955
dcc914f4
JP		 3956static bool is_kasan_insn(struct instruction *insn)
3957{
3958 return (insn->type == INSN_CALL &&
c6f5dc28 3959 !strcmp(insn_call_dest(insn)->name, "__asan_handle_no_return"));
dcc914f4
JP		 3960}
3961
3962static bool is_ubsan_insn(struct instruction *insn)
3963{
3964 return (insn->type == INSN_CALL &&
c6f5dc28 3965 !strcmp(insn_call_dest(insn)->name,
dcc914f4
JP		 3966 "__ubsan_handle_builtin_unreachable"));
3967}
3968
14db1f0a 3969static bool ignore_unreachable_insn(struct objtool_file *file, struct instruction *insn)
dcc914f4
JP		 3970{
3971 int i;
14db1f0a 3972 struct instruction *prev_insn;
dcc914f4 3973
1ffbe4e9 3974 if (insn->ignore || insn->type == INSN_NOP || insn->type == INSN_TRAP)
baa41469
JP		 3975 return true;
3976
3977 /*
82a8954a 3978 * Ignore alternative replacement instructions. This can happen
0e2bb2bc 3979 * when a whitelisted function uses one of the ALTERNATIVE macros.
baa41469 3980 */
82a8954a 3981 if (!strcmp(insn->sec->name, ".altinstr_replacement") ||
0e2bb2bc 3982 !strcmp(insn->sec->name, ".altinstr_aux"))
dcc914f4
JP		 3983 return true;
3984
4adb2368 3985 /*
753da417 3986 * Whole archive runs might encounter dead code from weak symbols.
4adb2368
PZ		 3987 * This is where the linker will have dropped the weak symbol in
3988 * favour of a regular symbol, but leaves the code in place.
3989 *
3990 * In this case we'll find a piece of code (whole function) that is not
3991 * covered by a !section symbol. Ignore them.
3992 */
dbcdbdfd 3993 if (opts.link && !insn_func(insn)) {
4adb2368
PZ		 3994 int size = find_symbol_hole_containing(insn->sec, insn->offset);
3995 unsigned long end = insn->offset + size;
3996
3997 if (!size) /* not a hole */
3998 return false;
3999
4000 if (size < 0) /* hole until the end */
4001 return true;
4002
4003 sec_for_each_insn_continue(file, insn) {
4004 /*
4005 * If we reach a visited instruction at or before the
4006 * end of the hole, ignore the unreachable.
4007 */
4008 if (insn->visited)
4009 return true;
4010
4011 if (insn->offset >= end)
4012 break;
4013
4014 /*
4015 * If this hole jumps to a .cold function, mark it ignore too.
4016 */
dbcdbdfd
PZ		 4017 if (insn->jump_dest && insn_func(insn->jump_dest) &&
4018 strstr(insn_func(insn->jump_dest)->name, ".cold")) {
4adb2368 4019 struct instruction *dest = insn->jump_dest;
dbcdbdfd 4020 func_for_each_insn(file, insn_func(dest), dest)
4adb2368
PZ		 4021 dest->ignore = true;
4022 }
4023 }
4024
4025 return false;
4026 }
4027
dbcdbdfd 4028 if (!insn_func(insn))
bd841d61
JP		 4029 return false;
4030
dbcdbdfd 4031 if (insn_func(insn)->static_call_tramp)
2105a927
PZ		 4032 return true;
4033
bd841d61
JP		 4034 /*
4035 * CONFIG_UBSAN_TRAP inserts a UD2 when it sees
4036 * __builtin_unreachable(). The BUG() macro has an unreachable() after
4037 * the UD2, which causes GCC's undefined trap logic to emit another UD2
4038 * (or occasionally a JMP to UD2).
14db1f0a
IH		 4039 *
4040 * It may also insert a UD2 after calling a __noreturn function.
bd841d61 4041 */
1c34496e 4042 prev_insn = prev_insn_same_sec(file, insn);
6126ed5d 4043 if (prev_insn->dead_end &&
bd841d61
JP		 4044 (insn->type == INSN_BUG ||
4045 (insn->type == INSN_JUMP_UNCONDITIONAL &&
4046 insn->jump_dest && insn->jump_dest->type == INSN_BUG)))
4047 return true;
4048
dcc914f4
JP		 4049 /*
4050 * Check if this (or a subsequent) instruction is related to
4051 * CONFIG_UBSAN or CONFIG_KASAN.
4052 *
4053 * End the search at 5 instructions to avoid going into the weeds.
4054 */
4055 for (i = 0; i < 5; i++) {
4056
4057 if (is_kasan_insn(insn) || is_ubsan_insn(insn))
4058 return true;
4059
fe24e271
JP		 4060 if (insn->type == INSN_JUMP_UNCONDITIONAL) {
4061 if (insn->jump_dest &&
dbcdbdfd 4062 insn_func(insn->jump_dest) == insn_func(insn)) {
fe24e271
JP		 4063 insn = insn->jump_dest;
4064 continue;
4065 }
4066
4067 break;
dcc914f4
JP		 4068 }
4069
dbcdbdfd 4070 if (insn->offset + insn->len >= insn_func(insn)->offset + insn_func(insn)->len)
dcc914f4 4071 break;
fe24e271 4072
1c34496e 4073 insn = next_insn_same_sec(file, insn);
dcc914f4
JP		 4074 }
4075
4076 return false;
4077}
4078
bd456a1b 4079static int add_prefix_symbol(struct objtool_file *file, struct symbol *func)
9f2899fe 4080{
bd456a1b 4081 struct instruction *insn, *prev;
5743654f 4082 struct cfi_state *cfi;
9f2899fe 4083
bd456a1b
JP		 4084 insn = find_insn(file, func->sec, func->offset);
4085 if (!insn)
4086 return -1;
9f2899fe 4087
bd456a1b
JP		 4088 for (prev = prev_insn_same_sec(file, insn);
4089 prev;
4090 prev = prev_insn_same_sec(file, prev)) {
4091 u64 offset;
9f2899fe
PZ		 4092
4093 if (prev->type != INSN_NOP)
bd456a1b 4094 return -1;
9f2899fe
PZ		 4095
4096 offset = func->offset - prev->offset;
bd456a1b
JP		 4097
4098 if (offset > opts.prefix)
4099 return -1;
4100
4101 if (offset < opts.prefix)
4102 continue;
4103
4104 elf_create_prefix_symbol(file->elf, func, opts.prefix);
4105 break;
9f2899fe
PZ		 4106 }
4107
bd456a1b
JP		 4108 if (!prev)
4109 return -1;
4110
5743654f
JP		 4111 if (!insn->cfi) {
4112 /*
4113 * This can happen if stack validation isn't enabled or the
4114 * function is annotated with STACK_FRAME_NON_STANDARD.
4115 */
4116 return 0;
4117 }
4118
4119 /* Propagate insn->cfi to the prefix code */
4120 cfi = cfi_hash_find_or_add(insn->cfi);
4121 for (; prev != insn; prev = next_insn_same_sec(file, prev))
4122 prev->cfi = cfi;
4123
9f2899fe
PZ		 4124 return 0;
4125}
4126
bd456a1b
JP		 4127static int add_prefix_symbols(struct objtool_file *file)
4128{
4129 struct section *sec;
4130 struct symbol *func;
bd456a1b
JP		 4131
4132 for_each_sec(file, sec) {
4133 if (!(sec->sh.sh_flags & SHF_EXECINSTR))
4134 continue;
4135
4136 sec_for_each_sym(sec, func) {
4137 if (func->type != STT_FUNC)
4138 continue;
4139
4140 add_prefix_symbol(file, func);
4141 }
4142 }
4143
d49d1666 4144 return 0;
bd456a1b
JP		 4145}
4146
4b5e2e7f
PZ		 4147static int validate_symbol(struct objtool_file *file, struct section *sec,
4148 struct symbol *sym, struct insn_state *state)
dcc914f4 4149{
dcc914f4 4150 struct instruction *insn;
4b5e2e7f
PZ		 4151 int ret;
4152
4153 if (!sym->len) {
4154 WARN("%s() is missing an ELF size annotation", sym->name);
4155 return 1;
4156 }
4157
4158 if (sym->pfunc != sym || sym->alias != sym)
4159 return 0;
4160
4161 insn = find_insn(file, sec, sym->offset);
4162 if (!insn || insn->ignore || insn->visited)
4163 return 0;
4164
4165 state->uaccess = sym->uaccess_safe;
4166
dbcdbdfd 4167 ret = validate_branch(file, insn_func(insn), insn, *state);
ced23d2e
JP		 4168 if (ret)
4169 BT_INSN(insn, "<=== (sym)");
4b5e2e7f
PZ		 4170 return ret;
4171}
4172
4173static int validate_section(struct objtool_file *file, struct section *sec)
4174{
baa41469 4175 struct insn_state state;
4b5e2e7f
PZ		 4176 struct symbol *func;
4177 int warnings = 0;
dcc914f4 4178
9290e772 4179 sec_for_each_sym(sec, func) {
350994bf
PZ		 4180 if (func->type != STT_FUNC)
4181 continue;
e10cd8fe 4182
753da417 4183 init_insn_state(file, &state, sec);
b735bd3e 4184 set_func_state(&state.cfi);
0699e551 4185
4b5e2e7f 4186 warnings += validate_symbol(file, sec, func, &state);
dcc914f4
JP		 4187 }
4188
dcc914f4
JP		 4189 return warnings;
4190}
4191
753da417 4192static int validate_noinstr_sections(struct objtool_file *file)
c4a33939
PZ		 4193{
4194 struct section *sec;
932f8e98 4195 int warnings = 0;
c4a33939
PZ		 4196
4197 sec = find_section_by_name(file->elf, ".noinstr.text");
0cc9ac8d
TG		 4198 if (sec) {
4199 warnings += validate_section(file, sec);
4200 warnings += validate_unwind_hints(file, sec);
4201 }
c4a33939 4202
0cc9ac8d
TG		 4203 sec = find_section_by_name(file->elf, ".entry.text");
4204 if (sec) {
4205 warnings += validate_section(file, sec);
4206 warnings += validate_unwind_hints(file, sec);
4207 }
932f8e98 4208
2b5a0e42
PZ		 4209 sec = find_section_by_name(file->elf, ".cpuidle.text");
4210 if (sec) {
4211 warnings += validate_section(file, sec);
4212 warnings += validate_unwind_hints(file, sec);
4213 }
4214
932f8e98 4215 return warnings;
c4a33939
PZ		 4216}
4217
350994bf
PZ		 4218static int validate_functions(struct objtool_file *file)
4219{
4220 struct section *sec;
4221 int warnings = 0;
4222
da837bd6
PZ		 4223 for_each_sec(file, sec) {
4224 if (!(sec->sh.sh_flags & SHF_EXECINSTR))
4225 continue;
4226
350994bf 4227 warnings += validate_section(file, sec);
da837bd6 4228 }
350994bf
PZ		 4229
4230 return warnings;
4231}
4232
3c6f9f77 4233static void mark_endbr_used(struct instruction *insn)
08f87a93 4234{
3c6f9f77
JP		 4235 if (!list_empty(&insn->call_node))
4236 list_del_init(&insn->call_node);
4237}
4238
08ef8c40
PZ		 4239static bool noendbr_range(struct objtool_file *file, struct instruction *insn)
4240{
4241 struct symbol *sym = find_symbol_containing(insn->sec, insn->offset-1);
4242 struct instruction *first;
4243
4244 if (!sym)
4245 return false;
4246
4247 first = find_insn(file, sym->sec, sym->offset);
4248 if (!first)
4249 return false;
4250
4251 if (first->type != INSN_ENDBR && !first->noendbr)
4252 return false;
4253
4254 return insn->offset == sym->offset + sym->len;
4255}
4256
3c6f9f77
JP		 4257static int validate_ibt_insn(struct objtool_file *file, struct instruction *insn)
4258{
4259 struct instruction *dest;
08f87a93 4260 struct reloc *reloc;
3c6f9f77
JP		 4261 unsigned long off;
4262 int warnings = 0;
08f87a93 4263
3c6f9f77
JP		 4264 /*
4265 * Looking for function pointer load relocations. Ignore
4266 * direct/indirect branches:
4267 */
4268 switch (insn->type) {
4269 case INSN_CALL:
4270 case INSN_CALL_DYNAMIC:
4271 case INSN_JUMP_CONDITIONAL:
4272 case INSN_JUMP_UNCONDITIONAL:
4273 case INSN_JUMP_DYNAMIC:
4274 case INSN_JUMP_DYNAMIC_CONDITIONAL:
4275 case INSN_RETURN:
4276 case INSN_NOP:
4277 return 0;
4278 default:
4279 break;
4280 }
08f87a93 4281
3c6f9f77
JP		 4282 for (reloc = insn_reloc(file, insn);
4283 reloc;
4284 reloc = find_reloc_by_dest_range(file->elf, insn->sec,
e4cbb9b8
JP		 4285 reloc_offset(reloc) + 1,
4286 (insn->offset + insn->len) - (reloc_offset(reloc) + 1))) {
08f87a93 4287
3c6f9f77
JP		 4288 /*
4289 * static_call_update() references the trampoline, which
4290 * doesn't have (or need) ENDBR. Skip warning in that case.
4291 */
4292 if (reloc->sym->static_call_tramp)
08f87a93
PZ		 4293 continue;
4294
3c6f9f77 4295 off = reloc->sym->offset;
fcee899d
JP		 4296 if (reloc_type(reloc) == R_X86_64_PC32 ||
4297 reloc_type(reloc) == R_X86_64_PLT32)
0696b6e3 4298 off += arch_dest_reloc_offset(reloc_addend(reloc));
3c6f9f77 4299 else
0696b6e3 4300 off += reloc_addend(reloc);
3c6f9f77
JP		 4301
4302 dest = find_insn(file, reloc->sym->sec, off);
4303 if (!dest)
08f87a93
PZ		 4304 continue;
4305
3c6f9f77
JP		 4306 if (dest->type == INSN_ENDBR) {
4307 mark_endbr_used(dest);
08f87a93 4308 continue;
3c6f9f77 4309 }
08f87a93 4310
dbcdbdfd 4311 if (insn_func(dest) && insn_func(dest) == insn_func(insn)) {
3c6f9f77
JP		 4312 /*
4313 * Anything from->to self is either _THIS_IP_ or
4314 * IRET-to-self.
4315 *
4316 * There is no sane way to annotate _THIS_IP_ since the
4317 * compiler treats the relocation as a constant and is
4318 * happy to fold in offsets, skewing any annotation we
4319 * do, leading to vast amounts of false-positives.
4320 *
4321 * There's also compiler generated _THIS_IP_ through
4322 * KCOV and such which we have no hope of annotating.
4323 *
4324 * As such, blanket accept self-references without
4325 * issue.
4326 */
08f87a93 4327 continue;
3c6f9f77 4328 }
08f87a93 4329
08ef8c40
PZ		 4330 /*
4331 * Accept anything ANNOTATE_NOENDBR.
4332 */
3c6f9f77 4333 if (dest->noendbr)
08f87a93
PZ		 4334 continue;
4335
08ef8c40
PZ		 4336 /*
4337 * Accept if this is the instruction after a symbol
4338 * that is (no)endbr -- typical code-range usage.
4339 */
4340 if (noendbr_range(file, dest))
4341 continue;
4342
246b2c85 4343 WARN_INSN(insn, "relocation to !ENDBR: %s", offstr(dest->sec, dest->offset));
3c6f9f77
JP		 4344
4345 warnings++;
4346 }
4347
4348 return warnings;
4349}
4350
4351static int validate_ibt_data_reloc(struct objtool_file *file,
4352 struct reloc *reloc)
4353{
4354 struct instruction *dest;
4355
4356 dest = find_insn(file, reloc->sym->sec,
0696b6e3 4357 reloc->sym->offset + reloc_addend(reloc));
3c6f9f77
JP		 4358 if (!dest)
4359 return 0;
4360
4361 if (dest->type == INSN_ENDBR) {
4362 mark_endbr_used(dest);
4363 return 0;
4364 }
4365
4366 if (dest->noendbr)
4367 return 0;
4368
4369 WARN_FUNC("data relocation to !ENDBR: %s",
e4cbb9b8 4370 reloc->sec->base, reloc_offset(reloc),
3c6f9f77
JP		 4371 offstr(dest->sec, dest->offset));
4372
4373 return 1;
4374}
4375
4376/*
4377 * Validate IBT rules and remove used ENDBR instructions from the seal list.
4378 * Unused ENDBR instructions will be annotated for sealing (i.e., replaced with
4379 * NOPs) later, in create_ibt_endbr_seal_sections().
4380 */
4381static int validate_ibt(struct objtool_file *file)
4382{
4383 struct section *sec;
4384 struct reloc *reloc;
4385 struct instruction *insn;
4386 int warnings = 0;
4387
4388 for_each_insn(file, insn)
4389 warnings += validate_ibt_insn(file, insn);
4390
4391 for_each_sec(file, sec) {
4392
4393 /* Already done by validate_ibt_insn() */
4394 if (sec->sh.sh_flags & SHF_EXECINSTR)
08f87a93
PZ		 4395 continue;
4396
a5bd6236 4397 if (!sec->rsec)
3c6f9f77 4398 continue;
08f87a93 4399
3c6f9f77
JP		 4400 /*
4401 * These sections can reference text addresses, but not with
4402 * the intent to indirect branch to them.
4403 */
e27e5bea
JP		 4404 if ((!strncmp(sec->name, ".discard", 8) &&
4405 strcmp(sec->name, ".discard.ibt_endbr_noseal")) ||
3c6f9f77
JP		 4406 !strncmp(sec->name, ".debug", 6) ||
4407 !strcmp(sec->name, ".altinstructions") ||
4408 !strcmp(sec->name, ".ibt_endbr_seal") ||
4409 !strcmp(sec->name, ".orc_unwind_ip") ||
4410 !strcmp(sec->name, ".parainstructions") ||
4411 !strcmp(sec->name, ".retpoline_sites") ||
4412 !strcmp(sec->name, ".smp_locks") ||
4413 !strcmp(sec->name, ".static_call_sites") ||
4414 !strcmp(sec->name, "_error_injection_whitelist") ||
4415 !strcmp(sec->name, "_kprobe_blacklist") ||
4416 !strcmp(sec->name, "__bug_table") ||
4417 !strcmp(sec->name, "__ex_table") ||
4418 !strcmp(sec->name, "__jump_table") ||
3c68a92d 4419 !strcmp(sec->name, "__mcount_loc") ||
0326074f 4420 !strcmp(sec->name, ".kcfi_traps") ||
9440155c 4421 strstr(sec->name, "__patchable_function_entries"))
3c6f9f77 4422 continue;
08f87a93 4423
caa4a6b7 4424 for_each_reloc(sec->rsec, reloc)
3c6f9f77 4425 warnings += validate_ibt_data_reloc(file, reloc);
08f87a93
PZ		 4426 }
4427
3c6f9f77 4428 return warnings;
08f87a93
PZ		 4429}
4430
c2bdd61c
JP		 4431static int validate_sls(struct objtool_file *file)
4432{
4433 struct instruction *insn, *next_insn;
4434 int warnings = 0;
4435
4436 for_each_insn(file, insn) {
4437 next_insn = next_insn_same_sec(file, insn);
4438
4439 if (insn->retpoline_safe)
4440 continue;
4441
4442 switch (insn->type) {
4443 case INSN_RETURN:
4444 if (!next_insn || next_insn->type != INSN_TRAP) {
246b2c85 4445 WARN_INSN(insn, "missing int3 after ret");
c2bdd61c
JP		 4446 warnings++;
4447 }
4448
4449 break;
4450 case INSN_JUMP_DYNAMIC:
4451 if (!next_insn || next_insn->type != INSN_TRAP) {
246b2c85 4452 WARN_INSN(insn, "missing int3 after indirect jump");
c2bdd61c
JP		 4453 warnings++;
4454 }
4455 break;
4456 default:
4457 break;
4458 }
4459 }
4460
4461 return warnings;
4462}
4463
55eeab2a
JP		 4464static bool ignore_noreturn_call(struct instruction *insn)
4465{
4466 struct symbol *call_dest = insn_call_dest(insn);
4467
4468 /*
4469 * FIXME: hack, we need a real noreturn solution
4470 *
4471 * Problem is, exc_double_fault() may or may not return, depending on
4472 * whether CONFIG_X86_ESPFIX64 is set. But objtool has no visibility
4473 * to the kernel config.
4474 *
4475 * Other potential ways to fix it:
4476 *
4477 * - have compiler communicate __noreturn functions somehow
4478 * - remove CONFIG_X86_ESPFIX64
4479 * - read the .config file
4480 * - add a cmdline option
4481 * - create a generic objtool annotation format (vs a bunch of custom
4482 * formats) and annotate it
4483 */
4484 if (!strcmp(call_dest->name, "exc_double_fault")) {
4485 /* prevent further unreachable warnings for the caller */
4486 insn->sym->warned = 1;
4487 return true;
4488 }
4489
4490 return false;
4491}
4492
baa41469 4493static int validate_reachable_instructions(struct objtool_file *file)
dcc914f4 4494{
fedb724c
JP		 4495 struct instruction *insn, *prev_insn;
4496 struct symbol *call_dest;
5e3992fe 4497 int warnings = 0;
baa41469
JP		 4498
4499 if (file->ignore_unreachables)
4500 return 0;
dcc914f4
JP		 4501
4502 for_each_insn(file, insn) {
14db1f0a 4503 if (insn->visited || ignore_unreachable_insn(file, insn))
baa41469
JP		 4504 continue;
4505
fedb724c
JP		 4506 prev_insn = prev_insn_same_sec(file, insn);
4507 if (prev_insn && prev_insn->dead_end) {
4508 call_dest = insn_call_dest(prev_insn);
55eeab2a 4509 if (call_dest && !ignore_noreturn_call(prev_insn)) {
fedb724c
JP		 4510 WARN_INSN(insn, "%s() is missing a __noreturn annotation",
4511 call_dest->name);
4512 warnings++;
4513 continue;
4514 }
4515 }
4516
246b2c85 4517 WARN_INSN(insn, "unreachable instruction");
5e3992fe 4518 warnings++;
dcc914f4
JP		 4519 }
4520
5e3992fe 4521 return warnings;
dcc914f4
JP		 4522}
4523
ca653464
JP		 4524/* 'funcs' is a space-separated list of function names */
4525static int disas_funcs(const char *funcs)
4526{
4527 const char *objdump_str, *cross_compile;
4528 int size, ret;
4529 char *cmd;
4530
4531 cross_compile = getenv("CROSS_COMPILE");
4532
4533 objdump_str = "%sobjdump -wdr %s | gawk -M -v _funcs='%s' '"
4534 "BEGIN { split(_funcs, funcs); }"
4535 "/^$/ { func_match = 0; }"
4536 "/<.*>:/ { "
4537 "f = gensub(/.*<(.*)>:/, \"\\\\1\", 1);"
4538 "for (i in funcs) {"
4539 "if (funcs[i] == f) {"
4540 "func_match = 1;"
4541 "base = strtonum(\"0x\" $1);"
4542 "break;"
4543 "}"
4544 "}"
4545 "}"
4546 "{"
4547 "if (func_match) {"
4548 "addr = strtonum(\"0x\" $1);"
4549 "printf(\"%%04x \", addr - base);"
4550 "print;"
4551 "}"
4552 "}' 1>&2";
4553
4554 /* fake snprintf() to calculate the size */
4555 size = snprintf(NULL, 0, objdump_str, cross_compile, objname, funcs) + 1;
4556 if (size <= 0) {
4557 WARN("objdump string size calculation failed");
4558 return -1;
4559 }
4560
4561 cmd = malloc(size);
4562
4563 /* real snprintf() */
4564 snprintf(cmd, size, objdump_str, cross_compile, objname, funcs);
4565 ret = system(cmd);
4566 if (ret) {
4567 WARN("disassembly failed: %d", ret);
4568 return -1;
4569 }
4570
4571 return 0;
4572}
4573
4574static int disas_warned_funcs(struct objtool_file *file)
4575{
4576 struct symbol *sym;
4577 char *funcs = NULL, *tmp;
4578
4579 for_each_sym(file, sym) {
4580 if (sym->warned) {
4581 if (!funcs) {
4582 funcs = malloc(strlen(sym->name) + 1);
4583 strcpy(funcs, sym->name);
4584 } else {
4585 tmp = malloc(strlen(funcs) + strlen(sym->name) + 2);
4586 sprintf(tmp, "%s %s", funcs, sym->name);
4587 free(funcs);
4588 funcs = tmp;
4589 }
4590 }
4591 }
4592
4593 if (funcs)
4594 disas_funcs(funcs);
4595
4596 return 0;
4597}
4598
d44becb9 4599int check(struct objtool_file *file)
dcc914f4 4600{
dcc914f4
JP		 4601 int ret, warnings = 0;
4602
baa41469 4603 arch_initial_func_cfi_state(&initial_func_cfi);
8b946cc3
PZ		 4604 init_cfi_state(&init_cfi);
4605 init_cfi_state(&func_cfi);
4606 set_func_state(&func_cfi);
1e4b6191
JP		 4607 init_cfi_state(&force_undefined_cfi);
4608 force_undefined_cfi.force_undefined = true;
8b946cc3
PZ		 4609
4610 if (!cfi_hash_alloc(1UL << (file->elf->symbol_bits - 3)))
4611 goto out;
4612
4613 cfi_hash_add(&init_cfi);
4614 cfi_hash_add(&func_cfi);
baa41469 4615
6545eb03 4616 ret = decode_sections(file);
dcc914f4
JP		 4617 if (ret < 0)
4618 goto out;
8b946cc3 4619
dcc914f4
JP		 4620 warnings += ret;
4621
1c34496e 4622 if (!nr_insns)
dcc914f4 4623 goto out;
dcc914f4 4624
2daf7fab 4625 if (opts.retpoline) {
6545eb03 4626 ret = validate_retpoline(file);
b5bc2231
PZ		 4627 if (ret < 0)
4628 return ret;
4629 warnings += ret;
4630 }
4631
c2bdd61c 4632 if (opts.stackval || opts.orc || opts.uaccess) {
7dce6204
JP		 4633 ret = validate_functions(file);
4634 if (ret < 0)
4635 goto out;
4636 warnings += ret;
39358a03 4637
7dce6204 4638 ret = validate_unwind_hints(file, NULL);
08f87a93
PZ		 4639 if (ret < 0)
4640 goto out;
4641 warnings += ret;
7dce6204
JP		 4642
4643 if (!warnings) {
4644 ret = validate_reachable_instructions(file);
4645 if (ret < 0)
4646 goto out;
4647 warnings += ret;
4648 }
753da417
JP		 4649
4650 } else if (opts.noinstr) {
4651 ret = validate_noinstr_sections(file);
4652 if (ret < 0)
4653 goto out;
4654 warnings += ret;
08f87a93
PZ		 4655 }
4656
a09a6e23
PZ		 4657 if (opts.unret) {
4658 /*
4659 * Must be after validate_branch() and friends, it plays
4660 * further games with insn->visited.
4661 */
4708ea14 4662 ret = validate_unrets(file);
a09a6e23
PZ		 4663 if (ret < 0)
4664 return ret;
4665 warnings += ret;
4666 }
4667
7dce6204
JP		 4668 if (opts.ibt) {
4669 ret = validate_ibt(file);
baa41469
JP		 4670 if (ret < 0)
4671 goto out;
c2bdd61c
JP		 4672 warnings += ret;
4673 }
4674
4675 if (opts.sls) {
4676 ret = validate_sls(file);
4677 if (ret < 0)
4678 goto out;
baa41469
JP		 4679 warnings += ret;
4680 }
4681
26e17689
JP		 4682 if (opts.static_call) {
4683 ret = create_static_call_sections(file);
4684 if (ret < 0)
4685 goto out;
4686 warnings += ret;
4687 }
1e7e4788 4688
2daf7fab 4689 if (opts.retpoline) {
134ab5bd
PZ		 4690 ret = create_retpoline_sites_sections(file);
4691 if (ret < 0)
4692 goto out;
4693 warnings += ret;
4694 }
4695
9a479f76
PZ		 4696 if (opts.cfi) {
4697 ret = create_cfi_sections(file);
4698 if (ret < 0)
4699 goto out;
4700 warnings += ret;
4701 }
4702
f43b9876 4703 if (opts.rethunk) {
d9e9d230
PZ		 4704 ret = create_return_sites_sections(file);
4705 if (ret < 0)
4706 goto out;
4707 warnings += ret;
00abd384 4708
0c0a6d89
PZ		 4709 if (opts.hack_skylake) {
4710 ret = create_direct_call_sections(file);
4711 if (ret < 0)
4712 goto out;
4713 warnings += ret;
4714 }
134ab5bd
PZ		 4715 }
4716
2daf7fab 4717 if (opts.mcount) {
99d00215
PZ		 4718 ret = create_mcount_loc_sections(file);
4719 if (ret < 0)
4720 goto out;
4721 warnings += ret;
4722 }
4723
bd456a1b
JP		 4724 if (opts.prefix) {
4725 ret = add_prefix_symbols(file);
4726 if (ret < 0)
4727 return ret;
4728 warnings += ret;
4729 }
4730
2daf7fab 4731 if (opts.ibt) {
89bc853e
PZ		 4732 ret = create_ibt_endbr_seal_sections(file);
4733 if (ret < 0)
4734 goto out;
4735 warnings += ret;
4736 }
4737
1c34496e 4738 if (opts.orc && nr_insns) {
b51277eb
JP		 4739 ret = orc_create(file);
4740 if (ret < 0)
4741 goto out;
4742 warnings += ret;
4743 }
4744
ca653464
JP		 4745 if (opts.verbose)
4746 disas_warned_funcs(file);
b51277eb 4747
2daf7fab 4748 if (opts.stats) {
8b946cc3
PZ		 4749 printf("nr_insns_visited: %ld\n", nr_insns_visited);
4750 printf("nr_cfi: %ld\n", nr_cfi);
4751 printf("nr_cfi_reused: %ld\n", nr_cfi_reused);
4752 printf("nr_cfi_cache: %ld\n", nr_cfi_cache);
4753 }
4754
dcc914f4 4755out:
655cf865
JP		 4756 /*
4757 * For now, don't fail the kernel build on fatal warnings. These
4758 * errors are still fairly common due to the growing matrix of
4759 * supported toolchains and their recent pace of change.
4760 */
dcc914f4
JP		 4761 return 0;
4762}
A mirror of Linus' kernel repository