tools/objtool/check.c

   1 // SPDX-License-Identifier: GPL-2.0-or-later
   2 /*
   3  * Copyright (C) 2015-2017 Josh Poimboeuf <jpoimboe@redhat.com>
   4  */
   5
   6 #include <string.h>
   7 #include <stdlib.h>
   8
   9 #include "builtin.h"
  10 #include "cfi.h"
  11 #include "arch.h"
  12 #include "check.h"
  13 #include "special.h"
  14 #include "warn.h"
  15
  16 #include <linux/hashtable.h>
  17 #include <linux/kernel.h>
  18
  19 #define FAKE_JUMP_OFFSET -1
  20
  21 #define C_JUMP_TABLE_SECTION ".rodata..c_jump_table"
  22
  23 struct alternative {
  24         struct list_head list;
  25         struct instruction *insn;
  26         bool skip_orig;
  27 };
  28
  29 const char *objname;
  30 struct cfi_init_state initial_func_cfi;
  31
  32 struct instruction *find_insn(struct objtool_file *file,
  33                               struct section *sec, unsigned long offset)
  34 {
  35         struct instruction *insn;
  36
  37         hash_for_each_possible(file->insn_hash, insn, hash, sec_offset_hash(sec, offset)) {
  38                 if (insn->sec == sec && insn->offset == offset)
  39                         return insn;
  40         }
  41
  42         return NULL;
  43 }
  44
  45 static struct instruction *next_insn_same_sec(struct objtool_file *file,
  46                                               struct instruction *insn)
  47 {
  48         struct instruction *next = list_next_entry(insn, list);
  49
  50         if (!next || &next->list == &file->insn_list || next->sec != insn->sec)
  51                 return NULL;
  52
  53         return next;
  54 }
  55
  56 static struct instruction *next_insn_same_func(struct objtool_file *file,
  57                                                struct instruction *insn)
  58 {
  59         struct instruction *next = list_next_entry(insn, list);
  60         struct symbol *func = insn->func;
  61
  62         if (!func)
  63                 return NULL;
  64
  65         if (&next->list != &file->insn_list && next->func == func)
  66                 return next;
  67
  68         /* Check if we're already in the subfunction: */
  69         if (func == func->cfunc)
  70                 return NULL;
  71
  72         /* Move to the subfunction: */
  73         return find_insn(file, func->cfunc->sec, func->cfunc->offset);
  74 }
  75
  76 static struct instruction *prev_insn_same_sym(struct objtool_file *file,
  77                                                struct instruction *insn)
  78 {
  79         struct instruction *prev = list_prev_entry(insn, list);
  80
  81         if (&prev->list != &file->insn_list && prev->func == insn->func)
  82                 return prev;
  83
  84         return NULL;
  85 }
  86
  87 #define func_for_each_insn(file, func, insn)                            \
  88         for (insn = find_insn(file, func->sec, func->offset);           \
  89              insn;                                                      \
  90              insn = next_insn_same_func(file, insn))
  91
  92 #define sym_for_each_insn(file, sym, insn)                              \
  93         for (insn = find_insn(file, sym->sec, sym->offset);             \
  94              insn && &insn->list != &file->insn_list &&                 \
  95                 insn->sec == sym->sec &&                                \
  96                 insn->offset < sym->offset + sym->len;                  \
  97              insn = list_next_entry(insn, list))
  98
  99 #define sym_for_each_insn_continue_reverse(file, sym, insn)             \
 100         for (insn = list_prev_entry(insn, list);                        \
 101              &insn->list != &file->insn_list &&                         \
 102                 insn->sec == sym->sec && insn->offset >= sym->offset;   \
 103              insn = list_prev_entry(insn, list))
 104
 105 #define sec_for_each_insn_from(file, insn)                              \
 106         for (; insn; insn = next_insn_same_sec(file, insn))
 107
 108 #define sec_for_each_insn_continue(file, insn)                          \
 109         for (insn = next_insn_same_sec(file, insn); insn;               \
 110              insn = next_insn_same_sec(file, insn))
 111
 112 static bool is_static_jump(struct instruction *insn)
 113 {
 114         return insn->type == INSN_JUMP_CONDITIONAL ||
 115                insn->type == INSN_JUMP_UNCONDITIONAL;
 116 }
 117
 118 static bool is_sibling_call(struct instruction *insn)
 119 {
 120         /* An indirect jump is either a sibling call or a jump to a table. */
 121         if (insn->type == INSN_JUMP_DYNAMIC)
 122                 return list_empty(&insn->alts);
 123
 124         if (!is_static_jump(insn))
 125                 return false;
 126
 127         /* add_jump_destinations() sets insn->call_dest for sibling calls. */
 128         return !!insn->call_dest;
 129 }
 130
 131 /*
 132  * This checks to see if the given function is a "noreturn" function.
 133  *
 134  * For global functions which are outside the scope of this object file, we
 135  * have to keep a manual list of them.
 136  *
 137  * For local functions, we have to detect them manually by simply looking for
 138  * the lack of a return instruction.
 139  */
 140 static bool __dead_end_function(struct objtool_file *file, struct symbol *func,
 141                                 int recursion)
 142 {
 143         int i;
 144         struct instruction *insn;
 145         bool empty = true;
 146
 147         /*
 148          * Unfortunately these have to be hard coded because the noreturn
 149          * attribute isn't provided in ELF data.
 150          */
 151         static const char * const global_noreturns[] = {
 152                 "__stack_chk_fail",
 153                 "panic",
 154                 "do_exit",
 155                 "do_task_dead",
 156                 "__module_put_and_exit",
 157                 "complete_and_exit",
 158                 "__reiserfs_panic",
 159                 "lbug_with_loc",
 160                 "fortify_panic",
 161                 "usercopy_abort",
 162                 "machine_real_restart",
 163                 "rewind_stack_do_exit",
 164                 "kunit_try_catch_throw",
 165         };
 166
 167         if (!func)
 168                 return false;
 169
 170         if (func->bind == STB_WEAK)
 171                 return false;
 172
 173         if (func->bind == STB_GLOBAL)
 174                 for (i = 0; i < ARRAY_SIZE(global_noreturns); i++)
 175                         if (!strcmp(func->name, global_noreturns[i]))
 176                                 return true;
 177
 178         if (!func->len)
 179                 return false;
 180
 181         insn = find_insn(file, func->sec, func->offset);
 182         if (!insn->func)
 183                 return false;
 184
 185         func_for_each_insn(file, func, insn) {
 186                 empty = false;
 187
 188                 if (insn->type == INSN_RETURN)
 189                         return false;
 190         }
 191
 192         if (empty)
 193                 return false;
 194
 195         /*
 196          * A function can have a sibling call instead of a return.  In that
 197          * case, the function's dead-end status depends on whether the target
 198          * of the sibling call returns.
 199          */
 200         func_for_each_insn(file, func, insn) {
 201                 if (is_sibling_call(insn)) {
 202                         struct instruction *dest = insn->jump_dest;
 203
 204                         if (!dest)
 205                                 /* sibling call to another file */
 206                                 return false;
 207
 208                         /* local sibling call */
 209                         if (recursion == 5) {
 210                                 /*
 211                                  * Infinite recursion: two functions have
 212                                  * sibling calls to each other.  This is a very
 213                                  * rare case.  It means they aren't dead ends.
 214                                  */
 215                                 return false;
 216                         }
 217
 218                         return __dead_end_function(file, dest->func, recursion+1);
 219                 }
 220         }
 221
 222         return true;
 223 }
 224
 225 static bool dead_end_function(struct objtool_file *file, struct symbol *func)
 226 {
 227         return __dead_end_function(file, func, 0);
 228 }
 229
 230 static void init_cfi_state(struct cfi_state *cfi)
 231 {
 232         int i;
 233
 234         for (i = 0; i < CFI_NUM_REGS; i++) {
 235                 cfi->regs[i].base = CFI_UNDEFINED;
 236                 cfi->vals[i].base = CFI_UNDEFINED;
 237         }
 238         cfi->cfa.base = CFI_UNDEFINED;
 239         cfi->drap_reg = CFI_UNDEFINED;
 240         cfi->drap_offset = -1;
 241 }
 242
 243 static void init_insn_state(struct insn_state *state, struct section *sec)
 244 {
 245         memset(state, 0, sizeof(*state));
 246         init_cfi_state(&state->cfi);
 247
 248         /*
 249          * We need the full vmlinux for noinstr validation, otherwise we can
 250          * not correctly determine insn->call_dest->sec (external symbols do
 251          * not have a section).
 252          */
 253         if (vmlinux && sec)
 254                 state->noinstr = sec->noinstr;
 255 }
 256
 257 /*
 258  * Call the arch-specific instruction decoder for all the instructions and add
 259  * them to the global instruction list.
 260  */
 261 static int decode_instructions(struct objtool_file *file)
 262 {
 263         struct section *sec;
 264         struct symbol *func;
 265         unsigned long offset;
 266         struct instruction *insn;
 267         unsigned long nr_insns = 0;
 268         int ret;
 269
 270         for_each_sec(file, sec) {
 271
 272                 if (!(sec->sh.sh_flags & SHF_EXECINSTR))
 273                         continue;
 274
 275                 if (strcmp(sec->name, ".altinstr_replacement") &&
 276                     strcmp(sec->name, ".altinstr_aux") &&
 277                     strncmp(sec->name, ".discard.", 9))
 278                         sec->text = true;
 279
 280                 if (!strcmp(sec->name, ".noinstr.text") ||
 281                     !strcmp(sec->name, ".entry.text"))
 282                         sec->noinstr = true;
 283
 284                 for (offset = 0; offset < sec->len; offset += insn->len) {
 285                         insn = malloc(sizeof(*insn));
 286                         if (!insn) {
 287                                 WARN("malloc failed");
 288                                 return -1;
 289                         }
 290                         memset(insn, 0, sizeof(*insn));
 291                         INIT_LIST_HEAD(&insn->alts);
 292                         INIT_LIST_HEAD(&insn->stack_ops);
 293                         init_cfi_state(&insn->cfi);
 294
 295                         insn->sec = sec;
 296                         insn->offset = offset;
 297
 298                         ret = arch_decode_instruction(file->elf, sec, offset,
 299                                                       sec->len - offset,
 300                                                       &insn->len, &insn->type,
 301                                                       &insn->immediate,
 302                                                       &insn->stack_ops);
 303                         if (ret)
 304                                 goto err;
 305
 306                         hash_add(file->insn_hash, &insn->hash, sec_offset_hash(sec, insn->offset));
 307                         list_add_tail(&insn->list, &file->insn_list);
 308                         nr_insns++;
 309                 }
 310
 311                 list_for_each_entry(func, &sec->symbol_list, list) {
 312                         if (func->type != STT_FUNC || func->alias != func)
 313                                 continue;
 314
 315                         if (!find_insn(file, sec, func->offset)) {
 316                                 WARN("%s(): can't find starting instruction",
 317                                      func->name);
 318                                 return -1;
 319                         }
 320
 321                         sym_for_each_insn(file, func, insn)
 322                                 insn->func = func;
 323                 }
 324         }
 325
 326         if (stats)
 327                 printf("nr_insns: %lu\n", nr_insns);
 328
 329         return 0;
 330
 331 err:
 332         free(insn);
 333         return ret;
 334 }
 335
 336 static struct instruction *find_last_insn(struct objtool_file *file,
 337                                           struct section *sec)
 338 {
 339         struct instruction *insn = NULL;
 340         unsigned int offset;
 341         unsigned int end = (sec->len > 10) ? sec->len - 10 : 0;
 342
 343         for (offset = sec->len - 1; offset >= end && !insn; offset--)
 344                 insn = find_insn(file, sec, offset);
 345
 346         return insn;
 347 }
 348
 349 /*
 350  * Mark "ud2" instructions and manually annotated dead ends.
 351  */
 352 static int add_dead_ends(struct objtool_file *file)
 353 {
 354         struct section *sec;
 355         struct rela *rela;
 356         struct instruction *insn;
 357
 358         /*
 359          * By default, "ud2" is a dead end unless otherwise annotated, because
 360          * GCC 7 inserts it for certain divide-by-zero cases.
 361          */
 362         for_each_insn(file, insn)
 363                 if (insn->type == INSN_BUG)
 364                         insn->dead_end = true;
 365
 366         /*
 367          * Check for manually annotated dead ends.
 368          */
 369         sec = find_section_by_name(file->elf, ".rela.discard.unreachable");
 370         if (!sec)
 371                 goto reachable;
 372
 373         list_for_each_entry(rela, &sec->rela_list, list) {
 374                 if (rela->sym->type != STT_SECTION) {
 375                         WARN("unexpected relocation symbol type in %s", sec->name);
 376                         return -1;
 377                 }
 378                 insn = find_insn(file, rela->sym->sec, rela->addend);
 379                 if (insn)
 380                         insn = list_prev_entry(insn, list);
 381                 else if (rela->addend == rela->sym->sec->len) {
 382                         insn = find_last_insn(file, rela->sym->sec);
 383                         if (!insn) {
 384                                 WARN("can't find unreachable insn at %s+0x%x",
 385                                      rela->sym->sec->name, rela->addend);
 386                                 return -1;
 387                         }
 388                 } else {
 389                         WARN("can't find unreachable insn at %s+0x%x",
 390                              rela->sym->sec->name, rela->addend);
 391                         return -1;
 392                 }
 393
 394                 insn->dead_end = true;
 395         }
 396
 397 reachable:
 398         /*
 399          * These manually annotated reachable checks are needed for GCC 4.4,
 400          * where the Linux unreachable() macro isn't supported.  In that case
 401          * GCC doesn't know the "ud2" is fatal, so it generates code as if it's
 402          * not a dead end.
 403          */
 404         sec = find_section_by_name(file->elf, ".rela.discard.reachable");
 405         if (!sec)
 406                 return 0;
 407
 408         list_for_each_entry(rela, &sec->rela_list, list) {
 409                 if (rela->sym->type != STT_SECTION) {
 410                         WARN("unexpected relocation symbol type in %s", sec->name);
 411                         return -1;
 412                 }
 413                 insn = find_insn(file, rela->sym->sec, rela->addend);
 414                 if (insn)
 415                         insn = list_prev_entry(insn, list);
 416                 else if (rela->addend == rela->sym->sec->len) {
 417                         insn = find_last_insn(file, rela->sym->sec);
 418                         if (!insn) {
 419                                 WARN("can't find reachable insn at %s+0x%x",
 420                                      rela->sym->sec->name, rela->addend);
 421                                 return -1;
 422                         }
 423                 } else {
 424                         WARN("can't find reachable insn at %s+0x%x",
 425                              rela->sym->sec->name, rela->addend);
 426                         return -1;
 427                 }
 428
 429                 insn->dead_end = false;
 430         }
 431
 432         return 0;
 433 }
 434
 435 /*
 436  * Warnings shouldn't be reported for ignored functions.
 437  */
 438 static void add_ignores(struct objtool_file *file)
 439 {
 440         struct instruction *insn;
 441         struct section *sec;
 442         struct symbol *func;
 443         struct rela *rela;
 444
 445         sec = find_section_by_name(file->elf, ".rela.discard.func_stack_frame_non_standard");
 446         if (!sec)
 447                 return;
 448
 449         list_for_each_entry(rela, &sec->rela_list, list) {
 450                 switch (rela->sym->type) {
 451                 case STT_FUNC:
 452                         func = rela->sym;
 453                         break;
 454
 455                 case STT_SECTION:
 456                         func = find_func_by_offset(rela->sym->sec, rela->addend);
 457                         if (!func)
 458                                 continue;
 459                         break;
 460
 461                 default:
 462                         WARN("unexpected relocation symbol type in %s: %d", sec->name, rela->sym->type);
 463                         continue;
 464                 }
 465
 466                 func_for_each_insn(file, func, insn)
 467                         insn->ignore = true;
 468         }
 469 }
 470
 471 /*
 472  * This is a whitelist of functions that is allowed to be called with AC set.
 473  * The list is meant to be minimal and only contains compiler instrumentation
 474  * ABI and a few functions used to implement *_{to,from}_user() functions.
 475  *
 476  * These functions must not directly change AC, but may PUSHF/POPF.
 477  */
 478 static const char *uaccess_safe_builtin[] = {
 479         /* KASAN */
 480         "kasan_report",
 481         "check_memory_region",
 482         /* KASAN out-of-line */
 483         "__asan_loadN_noabort",
 484         "__asan_load1_noabort",
 485         "__asan_load2_noabort",
 486         "__asan_load4_noabort",
 487         "__asan_load8_noabort",
 488         "__asan_load16_noabort",
 489         "__asan_storeN_noabort",
 490         "__asan_store1_noabort",
 491         "__asan_store2_noabort",
 492         "__asan_store4_noabort",
 493         "__asan_store8_noabort",
 494         "__asan_store16_noabort",
 495         /* KASAN in-line */
 496         "__asan_report_load_n_noabort",
 497         "__asan_report_load1_noabort",
 498         "__asan_report_load2_noabort",
 499         "__asan_report_load4_noabort",
 500         "__asan_report_load8_noabort",
 501         "__asan_report_load16_noabort",
 502         "__asan_report_store_n_noabort",
 503         "__asan_report_store1_noabort",
 504         "__asan_report_store2_noabort",
 505         "__asan_report_store4_noabort",
 506         "__asan_report_store8_noabort",
 507         "__asan_report_store16_noabort",
 508         /* KCOV */
 509         "write_comp_data",
 510         "check_kcov_mode",
 511         "__sanitizer_cov_trace_pc",
 512         "__sanitizer_cov_trace_const_cmp1",
 513         "__sanitizer_cov_trace_const_cmp2",
 514         "__sanitizer_cov_trace_const_cmp4",
 515         "__sanitizer_cov_trace_const_cmp8",
 516         "__sanitizer_cov_trace_cmp1",
 517         "__sanitizer_cov_trace_cmp2",
 518         "__sanitizer_cov_trace_cmp4",
 519         "__sanitizer_cov_trace_cmp8",
 520         "__sanitizer_cov_trace_switch",
 521         /* UBSAN */
 522         "ubsan_type_mismatch_common",
 523         "__ubsan_handle_type_mismatch",
 524         "__ubsan_handle_type_mismatch_v1",
 525         "__ubsan_handle_shift_out_of_bounds",
 526         /* misc */
 527         "csum_partial_copy_generic",
 528         "__memcpy_mcsafe",
 529         "mcsafe_handle_tail",
 530         "ftrace_likely_update", /* CONFIG_TRACE_BRANCH_PROFILING */
 531         NULL
 532 };
 533
 534 static void add_uaccess_safe(struct objtool_file *file)
 535 {
 536         struct symbol *func;
 537         const char **name;
 538
 539         if (!uaccess)
 540                 return;
 541
 542         for (name = uaccess_safe_builtin; *name; name++) {
 543                 func = find_symbol_by_name(file->elf, *name);
 544                 if (!func)
 545                         continue;
 546
 547                 func->uaccess_safe = true;
 548         }
 549 }
 550
 551 /*
 552  * FIXME: For now, just ignore any alternatives which add retpolines.  This is
 553  * a temporary hack, as it doesn't allow ORC to unwind from inside a retpoline.
 554  * But it at least allows objtool to understand the control flow *around* the
 555  * retpoline.
 556  */
 557 static int add_ignore_alternatives(struct objtool_file *file)
 558 {
 559         struct section *sec;
 560         struct rela *rela;
 561         struct instruction *insn;
 562
 563         sec = find_section_by_name(file->elf, ".rela.discard.ignore_alts");
 564         if (!sec)
 565                 return 0;
 566
 567         list_for_each_entry(rela, &sec->rela_list, list) {
 568                 if (rela->sym->type != STT_SECTION) {
 569                         WARN("unexpected relocation symbol type in %s", sec->name);
 570                         return -1;
 571                 }
 572
 573                 insn = find_insn(file, rela->sym->sec, rela->addend);
 574                 if (!insn) {
 575                         WARN("bad .discard.ignore_alts entry");
 576                         return -1;
 577                 }
 578
 579                 insn->ignore_alts = true;
 580         }
 581
 582         return 0;
 583 }
 584
 585 /*
 586  * Find the destination instructions for all jumps.
 587  */
 588 static int add_jump_destinations(struct objtool_file *file)
 589 {
 590         struct instruction *insn;
 591         struct rela *rela;
 592         struct section *dest_sec;
 593         unsigned long dest_off;
 594
 595         for_each_insn(file, insn) {
 596                 if (!is_static_jump(insn))
 597                         continue;
 598
 599                 if (insn->ignore || insn->offset == FAKE_JUMP_OFFSET)
 600                         continue;
 601
 602                 rela = find_rela_by_dest_range(file->elf, insn->sec,
 603                                                insn->offset, insn->len);
 604                 if (!rela) {
 605                         dest_sec = insn->sec;
 606                         dest_off = arch_jump_destination(insn);
 607                 } else if (rela->sym->type == STT_SECTION) {
 608                         dest_sec = rela->sym->sec;
 609                         dest_off = arch_dest_rela_offset(rela->addend);
 610                 } else if (rela->sym->sec->idx) {
 611                         dest_sec = rela->sym->sec;
 612                         dest_off = rela->sym->sym.st_value +
 613                                    arch_dest_rela_offset(rela->addend);
 614                 } else if (strstr(rela->sym->name, "_indirect_thunk_")) {
 615                         /*
 616                          * Retpoline jumps are really dynamic jumps in
 617                          * disguise, so convert them accordingly.
 618                          */
 619                         if (insn->type == INSN_JUMP_UNCONDITIONAL)
 620                                 insn->type = INSN_JUMP_DYNAMIC;
 621                         else
 622                                 insn->type = INSN_JUMP_DYNAMIC_CONDITIONAL;
 623
 624                         insn->retpoline_safe = true;
 625                         continue;
 626                 } else {
 627                         /* external sibling call */
 628                         insn->call_dest = rela->sym;
 629                         continue;
 630                 }
 631
 632                 insn->jump_dest = find_insn(file, dest_sec, dest_off);
 633                 if (!insn->jump_dest) {
 634
 635                         /*
 636                          * This is a special case where an alt instruction
 637                          * jumps past the end of the section.  These are
 638                          * handled later in handle_group_alt().
 639                          */
 640                         if (!strcmp(insn->sec->name, ".altinstr_replacement"))
 641                                 continue;
 642
 643                         WARN_FUNC("can't find jump dest instruction at %s+0x%lx",
 644                                   insn->sec, insn->offset, dest_sec->name,
 645                                   dest_off);
 646                         return -1;
 647                 }
 648
 649                 /*
 650                  * Cross-function jump.
 651                  */
 652                 if (insn->func && insn->jump_dest->func &&
 653                     insn->func != insn->jump_dest->func) {
 654
 655                         /*
 656                          * For GCC 8+, create parent/child links for any cold
 657                          * subfunctions.  This is _mostly_ redundant with a
 658                          * similar initialization in read_symbols().
 659                          *
 660                          * If a function has aliases, we want the *first* such
 661                          * function in the symbol table to be the subfunction's
 662                          * parent.  In that case we overwrite the
 663                          * initialization done in read_symbols().
 664                          *
 665                          * However this code can't completely replace the
 666                          * read_symbols() code because this doesn't detect the
 667                          * case where the parent function's only reference to a
 668                          * subfunction is through a jump table.
 669                          */
 670                         if (!strstr(insn->func->name, ".cold.") &&
 671                             strstr(insn->jump_dest->func->name, ".cold.")) {
 672                                 insn->func->cfunc = insn->jump_dest->func;
 673                                 insn->jump_dest->func->pfunc = insn->func;
 674
 675                         } else if (insn->jump_dest->func->pfunc != insn->func->pfunc &&
 676                                    insn->jump_dest->offset == insn->jump_dest->func->offset) {
 677
 678                                 /* internal sibling call */
 679                                 insn->call_dest = insn->jump_dest->func;
 680                         }
 681                 }
 682         }
 683
 684         return 0;
 685 }
 686
 687 static void remove_insn_ops(struct instruction *insn)
 688 {
 689         struct stack_op *op, *tmp;
 690
 691         list_for_each_entry_safe(op, tmp, &insn->stack_ops, list) {
 692                 list_del(&op->list);
 693                 free(op);
 694         }
 695 }
 696
 697 /*
 698  * Find the destination instructions for all calls.
 699  */
 700 static int add_call_destinations(struct objtool_file *file)
 701 {
 702         struct instruction *insn;
 703         unsigned long dest_off;
 704         struct rela *rela;
 705
 706         for_each_insn(file, insn) {
 707                 if (insn->type != INSN_CALL)
 708                         continue;
 709
 710                 rela = find_rela_by_dest_range(file->elf, insn->sec,
 711                                                insn->offset, insn->len);
 712                 if (!rela) {
 713                         dest_off = arch_jump_destination(insn);
 714                         insn->call_dest = find_func_by_offset(insn->sec, dest_off);
 715                         if (!insn->call_dest)
 716                                 insn->call_dest = find_symbol_by_offset(insn->sec, dest_off);
 717
 718                         if (insn->ignore)
 719                                 continue;
 720
 721                         if (!insn->call_dest) {
 722                                 WARN_FUNC("unannotated intra-function call", insn->sec, insn->offset);
 723                                 return -1;
 724                         }
 725
 726                         if (insn->func && insn->call_dest->type != STT_FUNC) {
 727                                 WARN_FUNC("unsupported call to non-function",
 728                                           insn->sec, insn->offset);
 729                                 return -1;
 730                         }
 731
 732                 } else if (rela->sym->type == STT_SECTION) {
 733                         dest_off = arch_dest_rela_offset(rela->addend);
 734                         insn->call_dest = find_func_by_offset(rela->sym->sec,
 735                                                               dest_off);
 736                         if (!insn->call_dest) {
 737                                 WARN_FUNC("can't find call dest symbol at %s+0x%lx",
 738                                           insn->sec, insn->offset,
 739                                           rela->sym->sec->name,
 740                                           dest_off);
 741                                 return -1;
 742                         }
 743                 } else
 744                         insn->call_dest = rela->sym;
 745
 746                 /*
 747                  * Whatever stack impact regular CALLs have, should be undone
 748                  * by the RETURN of the called function.
 749                  *
 750                  * Annotated intra-function calls retain the stack_ops but
 751                  * are converted to JUMP, see read_intra_function_calls().
 752                  */
 753                 remove_insn_ops(insn);
 754         }
 755
 756         return 0;
 757 }
 758
 759 /*
 760  * The .alternatives section requires some extra special care, over and above
 761  * what other special sections require:
 762  *
 763  * 1. Because alternatives are patched in-place, we need to insert a fake jump
 764  *    instruction at the end so that validate_branch() skips all the original
 765  *    replaced instructions when validating the new instruction path.
 766  *
 767  * 2. An added wrinkle is that the new instruction length might be zero.  In
 768  *    that case the old instructions are replaced with noops.  We simulate that
 769  *    by creating a fake jump as the only new instruction.
 770  *
 771  * 3. In some cases, the alternative section includes an instruction which
 772  *    conditionally jumps to the _end_ of the entry.  We have to modify these
 773  *    jumps' destinations to point back to .text rather than the end of the
 774  *    entry in .altinstr_replacement.
 775  */
 776 static int handle_group_alt(struct objtool_file *file,
 777                             struct special_alt *special_alt,
 778                             struct instruction *orig_insn,
 779                             struct instruction **new_insn)
 780 {
 781         static unsigned int alt_group_next_index = 1;
 782         struct instruction *last_orig_insn, *last_new_insn, *insn, *fake_jump = NULL;
 783         unsigned int alt_group = alt_group_next_index++;
 784         unsigned long dest_off;
 785
 786         last_orig_insn = NULL;
 787         insn = orig_insn;
 788         sec_for_each_insn_from(file, insn) {
 789                 if (insn->offset >= special_alt->orig_off + special_alt->orig_len)
 790                         break;
 791
 792                 insn->alt_group = alt_group;
 793                 last_orig_insn = insn;
 794         }
 795
 796         if (next_insn_same_sec(file, last_orig_insn)) {
 797                 fake_jump = malloc(sizeof(*fake_jump));
 798                 if (!fake_jump) {
 799                         WARN("malloc failed");
 800                         return -1;
 801                 }
 802                 memset(fake_jump, 0, sizeof(*fake_jump));
 803                 INIT_LIST_HEAD(&fake_jump->alts);
 804                 INIT_LIST_HEAD(&fake_jump->stack_ops);
 805                 init_cfi_state(&fake_jump->cfi);
 806
 807                 fake_jump->sec = special_alt->new_sec;
 808                 fake_jump->offset = FAKE_JUMP_OFFSET;
 809                 fake_jump->type = INSN_JUMP_UNCONDITIONAL;
 810                 fake_jump->jump_dest = list_next_entry(last_orig_insn, list);
 811                 fake_jump->func = orig_insn->func;
 812         }
 813
 814         if (!special_alt->new_len) {
 815                 if (!fake_jump) {
 816                         WARN("%s: empty alternative at end of section",
 817                              special_alt->orig_sec->name);
 818                         return -1;
 819                 }
 820
 821                 *new_insn = fake_jump;
 822                 return 0;
 823         }
 824
 825         last_new_insn = NULL;
 826         alt_group = alt_group_next_index++;
 827         insn = *new_insn;
 828         sec_for_each_insn_from(file, insn) {
 829                 if (insn->offset >= special_alt->new_off + special_alt->new_len)
 830                         break;
 831
 832                 last_new_insn = insn;
 833
 834                 insn->ignore = orig_insn->ignore_alts;
 835                 insn->func = orig_insn->func;
 836                 insn->alt_group = alt_group;
 837
 838                 /*
 839                  * Since alternative replacement code is copy/pasted by the
 840                  * kernel after applying relocations, generally such code can't
 841                  * have relative-address relocation references to outside the
 842                  * .altinstr_replacement section, unless the arch's
 843                  * alternatives code can adjust the relative offsets
 844                  * accordingly.
 845                  *
 846                  * The x86 alternatives code adjusts the offsets only when it
 847                  * encounters a branch instruction at the very beginning of the
 848                  * replacement group.
 849                  */
 850                 if ((insn->offset != special_alt->new_off ||
 851                     (insn->type != INSN_CALL && !is_static_jump(insn))) &&
 852                     find_rela_by_dest_range(file->elf, insn->sec, insn->offset, insn->len)) {
 853
 854                         WARN_FUNC("unsupported relocation in alternatives section",
 855                                   insn->sec, insn->offset);
 856                         return -1;
 857                 }
 858
 859                 if (!is_static_jump(insn))
 860                         continue;
 861
 862                 if (!insn->immediate)
 863                         continue;
 864
 865                 dest_off = arch_jump_destination(insn);
 866                 if (dest_off == special_alt->new_off + special_alt->new_len) {
 867                         if (!fake_jump) {
 868                                 WARN("%s: alternative jump to end of section",
 869                                      special_alt->orig_sec->name);
 870                                 return -1;
 871                         }
 872                         insn->jump_dest = fake_jump;
 873                 }
 874
 875                 if (!insn->jump_dest) {
 876                         WARN_FUNC("can't find alternative jump destination",
 877                                   insn->sec, insn->offset);
 878                         return -1;
 879                 }
 880         }
 881
 882         if (!last_new_insn) {
 883                 WARN_FUNC("can't find last new alternative instruction",
 884                           special_alt->new_sec, special_alt->new_off);
 885                 return -1;
 886         }
 887
 888         if (fake_jump)
 889                 list_add(&fake_jump->list, &last_new_insn->list);
 890
 891         return 0;
 892 }
 893
 894 /*
 895  * A jump table entry can either convert a nop to a jump or a jump to a nop.
 896  * If the original instruction is a jump, make the alt entry an effective nop
 897  * by just skipping the original instruction.
 898  */
 899 static int handle_jump_alt(struct objtool_file *file,
 900                            struct special_alt *special_alt,
 901                            struct instruction *orig_insn,
 902                            struct instruction **new_insn)
 903 {
 904         if (orig_insn->type == INSN_NOP)
 905                 return 0;
 906
 907         if (orig_insn->type != INSN_JUMP_UNCONDITIONAL) {
 908                 WARN_FUNC("unsupported instruction at jump label",
 909                           orig_insn->sec, orig_insn->offset);
 910                 return -1;
 911         }
 912
 913         *new_insn = list_next_entry(orig_insn, list);
 914         return 0;
 915 }
 916
 917 /*
 918  * Read all the special sections which have alternate instructions which can be
 919  * patched in or redirected to at runtime.  Each instruction having alternate
 920  * instruction(s) has them added to its insn->alts list, which will be
 921  * traversed in validate_branch().
 922  */
 923 static int add_special_section_alts(struct objtool_file *file)
 924 {
 925         struct list_head special_alts;
 926         struct instruction *orig_insn, *new_insn;
 927         struct special_alt *special_alt, *tmp;
 928         struct alternative *alt;
 929         int ret;
 930
 931         ret = special_get_alts(file->elf, &special_alts);
 932         if (ret)
 933                 return ret;
 934
 935         list_for_each_entry_safe(special_alt, tmp, &special_alts, list) {
 936
 937                 orig_insn = find_insn(file, special_alt->orig_sec,
 938                                       special_alt->orig_off);
 939                 if (!orig_insn) {
 940                         WARN_FUNC("special: can't find orig instruction",
 941                                   special_alt->orig_sec, special_alt->orig_off);
 942                         ret = -1;
 943                         goto out;
 944                 }
 945
 946                 new_insn = NULL;
 947                 if (!special_alt->group || special_alt->new_len) {
 948                         new_insn = find_insn(file, special_alt->new_sec,
 949                                              special_alt->new_off);
 950                         if (!new_insn) {
 951                                 WARN_FUNC("special: can't find new instruction",
 952                                           special_alt->new_sec,
 953                                           special_alt->new_off);
 954                                 ret = -1;
 955                                 goto out;
 956                         }
 957                 }
 958
 959                 if (special_alt->group) {
 960                         if (!special_alt->orig_len) {
 961                                 WARN_FUNC("empty alternative entry",
 962                                           orig_insn->sec, orig_insn->offset);
 963                                 continue;
 964                         }
 965
 966                         ret = handle_group_alt(file, special_alt, orig_insn,
 967                                                &new_insn);
 968                         if (ret)
 969                                 goto out;
 970                 } else if (special_alt->jump_or_nop) {
 971                         ret = handle_jump_alt(file, special_alt, orig_insn,
 972                                               &new_insn);
 973                         if (ret)
 974                                 goto out;
 975                 }
 976
 977                 alt = malloc(sizeof(*alt));
 978                 if (!alt) {
 979                         WARN("malloc failed");
 980                         ret = -1;
 981                         goto out;
 982                 }
 983
 984                 alt->insn = new_insn;
 985                 alt->skip_orig = special_alt->skip_orig;
 986                 orig_insn->ignore_alts |= special_alt->skip_alt;
 987                 list_add_tail(&alt->list, &orig_insn->alts);
 988
 989                 list_del(&special_alt->list);
 990                 free(special_alt);
 991         }
 992
 993 out:
 994         return ret;
 995 }
 996
 997 static int add_jump_table(struct objtool_file *file, struct instruction *insn,
 998                             struct rela *table)
 999 {
1000         struct rela *rela = table;
1001         struct instruction *dest_insn;
1002         struct alternative *alt;
1003         struct symbol *pfunc = insn->func->pfunc;
1004         unsigned int prev_offset = 0;
1005
1006         /*
1007          * Each @rela is a switch table relocation which points to the target
1008          * instruction.
1009          */
1010         list_for_each_entry_from(rela, &table->sec->rela_list, list) {
1011
1012                 /* Check for the end of the table: */
1013                 if (rela != table && rela->jump_table_start)
1014                         break;
1015
1016                 /* Make sure the table entries are consecutive: */
1017                 if (prev_offset && rela->offset != prev_offset + 8)
1018                         break;
1019
1020                 /* Detect function pointers from contiguous objects: */
1021                 if (rela->sym->sec == pfunc->sec &&
1022                     rela->addend == pfunc->offset)
1023                         break;
1024
1025                 dest_insn = find_insn(file, rela->sym->sec, rela->addend);
1026                 if (!dest_insn)
1027                         break;
1028
1029                 /* Make sure the destination is in the same function: */
1030                 if (!dest_insn->func || dest_insn->func->pfunc != pfunc)
1031                         break;
1032
1033                 alt = malloc(sizeof(*alt));
1034                 if (!alt) {
1035                         WARN("malloc failed");
1036                         return -1;
1037                 }
1038
1039                 alt->insn = dest_insn;
1040                 list_add_tail(&alt->list, &insn->alts);
1041                 prev_offset = rela->offset;
1042         }
1043
1044         if (!prev_offset) {
1045                 WARN_FUNC("can't find switch jump table",
1046                           insn->sec, insn->offset);
1047                 return -1;
1048         }
1049
1050         return 0;
1051 }
1052
1053 /*
1054  * find_jump_table() - Given a dynamic jump, find the switch jump table in
1055  * .rodata associated with it.
1056  *
1057  * There are 3 basic patterns:
1058  *
1059  * 1. jmpq *[rodata addr](,%reg,8)
1060  *
1061  *    This is the most common case by far.  It jumps to an address in a simple
1062  *    jump table which is stored in .rodata.
1063  *
1064  * 2. jmpq *[rodata addr](%rip)
1065  *
1066  *    This is caused by a rare GCC quirk, currently only seen in three driver
1067  *    functions in the kernel, only with certain obscure non-distro configs.
1068  *
1069  *    As part of an optimization, GCC makes a copy of an existing switch jump
1070  *    table, modifies it, and then hard-codes the jump (albeit with an indirect
1071  *    jump) to use a single entry in the table.  The rest of the jump table and
1072  *    some of its jump targets remain as dead code.
1073  *
1074  *    In such a case we can just crudely ignore all unreachable instruction
1075  *    warnings for the entire object file.  Ideally we would just ignore them
1076  *    for the function, but that would require redesigning the code quite a
1077  *    bit.  And honestly that's just not worth doing: unreachable instruction
1078  *    warnings are of questionable value anyway, and this is such a rare issue.
1079  *
1080  * 3. mov [rodata addr],%reg1
1081  *    ... some instructions ...
1082  *    jmpq *(%reg1,%reg2,8)
1083  *
1084  *    This is a fairly uncommon pattern which is new for GCC 6.  As of this
1085  *    writing, there are 11 occurrences of it in the allmodconfig kernel.
1086  *
1087  *    As of GCC 7 there are quite a few more of these and the 'in between' code
1088  *    is significant. Esp. with KASAN enabled some of the code between the mov
1089  *    and jmpq uses .rodata itself, which can confuse things.
1090  *
1091  *    TODO: Once we have DWARF CFI and smarter instruction decoding logic,
1092  *    ensure the same register is used in the mov and jump instructions.
1093  *
1094  *    NOTE: RETPOLINE made it harder still to decode dynamic jumps.
1095  */
1096 static struct rela *find_jump_table(struct objtool_file *file,
1097                                       struct symbol *func,
1098                                       struct instruction *insn)
1099 {
1100         struct rela *text_rela, *table_rela;
1101         struct instruction *dest_insn, *orig_insn = insn;
1102         struct section *table_sec;
1103         unsigned long table_offset;
1104
1105         /*
1106          * Backward search using the @first_jump_src links, these help avoid
1107          * much of the 'in between' code. Which avoids us getting confused by
1108          * it.
1109          */
1110         for (;
1111              insn && insn->func && insn->func->pfunc == func;
1112              insn = insn->first_jump_src ?: prev_insn_same_sym(file, insn)) {
1113
1114                 if (insn != orig_insn && insn->type == INSN_JUMP_DYNAMIC)
1115                         break;
1116
1117                 /* allow small jumps within the range */
1118                 if (insn->type == INSN_JUMP_UNCONDITIONAL &&
1119                     insn->jump_dest &&
1120                     (insn->jump_dest->offset <= insn->offset ||
1121                      insn->jump_dest->offset > orig_insn->offset))
1122                     break;
1123
1124                 /* look for a relocation which references .rodata */
1125                 text_rela = find_rela_by_dest_range(file->elf, insn->sec,
1126                                                     insn->offset, insn->len);
1127                 if (!text_rela || text_rela->sym->type != STT_SECTION ||
1128                     !text_rela->sym->sec->rodata)
1129                         continue;
1130
1131                 table_offset = text_rela->addend;
1132                 table_sec = text_rela->sym->sec;
1133
1134                 if (text_rela->type == R_X86_64_PC32)
1135                         table_offset += 4;
1136
1137                 /*
1138                  * Make sure the .rodata address isn't associated with a
1139                  * symbol.  GCC jump tables are anonymous data.
1140                  *
1141                  * Also support C jump tables which are in the same format as
1142                  * switch jump tables.  For objtool to recognize them, they
1143                  * need to be placed in the C_JUMP_TABLE_SECTION section.  They
1144                  * have symbols associated with them.
1145                  */
1146                 if (find_symbol_containing(table_sec, table_offset) &&
1147                     strcmp(table_sec->name, C_JUMP_TABLE_SECTION))
1148                         continue;
1149
1150                 /*
1151                  * Each table entry has a rela associated with it.  The rela
1152                  * should reference text in the same function as the original
1153                  * instruction.
1154                  */
1155                 table_rela = find_rela_by_dest(file->elf, table_sec, table_offset);
1156                 if (!table_rela)
1157                         continue;
1158                 dest_insn = find_insn(file, table_rela->sym->sec, table_rela->addend);
1159                 if (!dest_insn || !dest_insn->func || dest_insn->func->pfunc != func)
1160                         continue;
1161
1162                 /*
1163                  * Use of RIP-relative switch jumps is quite rare, and
1164                  * indicates a rare GCC quirk/bug which can leave dead code
1165                  * behind.
1166                  */
1167                 if (text_rela->type == R_X86_64_PC32)
1168                         file->ignore_unreachables = true;
1169
1170                 return table_rela;
1171         }
1172
1173         return NULL;
1174 }
1175
1176 /*
1177  * First pass: Mark the head of each jump table so that in the next pass,
1178  * we know when a given jump table ends and the next one starts.
1179  */
1180 static void mark_func_jump_tables(struct objtool_file *file,
1181                                     struct symbol *func)
1182 {
1183         struct instruction *insn, *last = NULL;
1184         struct rela *rela;
1185
1186         func_for_each_insn(file, func, insn) {
1187                 if (!last)
1188                         last = insn;
1189
1190                 /*
1191                  * Store back-pointers for unconditional forward jumps such
1192                  * that find_jump_table() can back-track using those and
1193                  * avoid some potentially confusing code.
1194                  */
1195                 if (insn->type == INSN_JUMP_UNCONDITIONAL && insn->jump_dest &&
1196                     insn->offset > last->offset &&
1197                     insn->jump_dest->offset > insn->offset &&
1198                     !insn->jump_dest->first_jump_src) {
1199
1200                         insn->jump_dest->first_jump_src = insn;
1201                         last = insn->jump_dest;
1202                 }
1203
1204                 if (insn->type != INSN_JUMP_DYNAMIC)
1205                         continue;
1206
1207                 rela = find_jump_table(file, func, insn);
1208                 if (rela) {
1209                         rela->jump_table_start = true;
1210                         insn->jump_table = rela;
1211                 }
1212         }
1213 }
1214
1215 static int add_func_jump_tables(struct objtool_file *file,
1216                                   struct symbol *func)
1217 {
1218         struct instruction *insn;
1219         int ret;
1220
1221         func_for_each_insn(file, func, insn) {
1222                 if (!insn->jump_table)
1223                         continue;
1224
1225                 ret = add_jump_table(file, insn, insn->jump_table);
1226                 if (ret)
1227                         return ret;
1228         }
1229
1230         return 0;
1231 }
1232
1233 /*
1234  * For some switch statements, gcc generates a jump table in the .rodata
1235  * section which contains a list of addresses within the function to jump to.
1236  * This finds these jump tables and adds them to the insn->alts lists.
1237  */
1238 static int add_jump_table_alts(struct objtool_file *file)
1239 {
1240         struct section *sec;
1241         struct symbol *func;
1242         int ret;
1243
1244         if (!file->rodata)
1245                 return 0;
1246
1247         for_each_sec(file, sec) {
1248                 list_for_each_entry(func, &sec->symbol_list, list) {
1249                         if (func->type != STT_FUNC)
1250                                 continue;
1251
1252                         mark_func_jump_tables(file, func);
1253                         ret = add_func_jump_tables(file, func);
1254                         if (ret)
1255                                 return ret;
1256                 }
1257         }
1258
1259         return 0;
1260 }
1261
1262 static int read_unwind_hints(struct objtool_file *file)
1263 {
1264         struct section *sec, *relasec;
1265         struct rela *rela;
1266         struct unwind_hint *hint;
1267         struct instruction *insn;
1268         struct cfi_reg *cfa;
1269         int i;
1270
1271         sec = find_section_by_name(file->elf, ".discard.unwind_hints");
1272         if (!sec)
1273                 return 0;
1274
1275         relasec = sec->rela;
1276         if (!relasec) {
1277                 WARN("missing .rela.discard.unwind_hints section");
1278                 return -1;
1279         }
1280
1281         if (sec->len % sizeof(struct unwind_hint)) {
1282                 WARN("struct unwind_hint size mismatch");
1283                 return -1;
1284         }
1285
1286         file->hints = true;
1287
1288         for (i = 0; i < sec->len / sizeof(struct unwind_hint); i++) {
1289                 hint = (struct unwind_hint *)sec->data->d_buf + i;
1290
1291                 rela = find_rela_by_dest(file->elf, sec, i * sizeof(*hint));
1292                 if (!rela) {
1293                         WARN("can't find rela for unwind_hints[%d]", i);
1294                         return -1;
1295                 }
1296
1297                 insn = find_insn(file, rela->sym->sec, rela->addend);
1298                 if (!insn) {
1299                         WARN("can't find insn for unwind_hints[%d]", i);
1300                         return -1;
1301                 }
1302
1303                 cfa = &insn->cfi.cfa;
1304
1305                 if (hint->type == UNWIND_HINT_TYPE_RET_OFFSET) {
1306                         insn->ret_offset = hint->sp_offset;
1307                         continue;
1308                 }
1309
1310                 insn->hint = true;
1311
1312                 switch (hint->sp_reg) {
1313                 case ORC_REG_UNDEFINED:
1314                         cfa->base = CFI_UNDEFINED;
1315                         break;
1316                 case ORC_REG_SP:
1317                         cfa->base = CFI_SP;
1318                         break;
1319                 case ORC_REG_BP:
1320                         cfa->base = CFI_BP;
1321                         break;
1322                 case ORC_REG_SP_INDIRECT:
1323                         cfa->base = CFI_SP_INDIRECT;
1324                         break;
1325                 case ORC_REG_R10:
1326                         cfa->base = CFI_R10;
1327                         break;
1328                 case ORC_REG_R13:
1329                         cfa->base = CFI_R13;
1330                         break;
1331                 case ORC_REG_DI:
1332                         cfa->base = CFI_DI;
1333                         break;
1334                 case ORC_REG_DX:
1335                         cfa->base = CFI_DX;
1336                         break;
1337                 default:
1338                         WARN_FUNC("unsupported unwind_hint sp base reg %d",
1339                                   insn->sec, insn->offset, hint->sp_reg);
1340                         return -1;
1341                 }
1342
1343                 cfa->offset = hint->sp_offset;
1344                 insn->cfi.type = hint->type;
1345                 insn->cfi.end = hint->end;
1346         }
1347
1348         return 0;
1349 }
1350
1351 static int read_retpoline_hints(struct objtool_file *file)
1352 {
1353         struct section *sec;
1354         struct instruction *insn;
1355         struct rela *rela;
1356
1357         sec = find_section_by_name(file->elf, ".rela.discard.retpoline_safe");
1358         if (!sec)
1359                 return 0;
1360
1361         list_for_each_entry(rela, &sec->rela_list, list) {
1362                 if (rela->sym->type != STT_SECTION) {
1363                         WARN("unexpected relocation symbol type in %s", sec->name);
1364                         return -1;
1365                 }
1366
1367                 insn = find_insn(file, rela->sym->sec, rela->addend);
1368                 if (!insn) {
1369                         WARN("bad .discard.retpoline_safe entry");
1370                         return -1;
1371                 }
1372
1373                 if (insn->type != INSN_JUMP_DYNAMIC &&
1374                     insn->type != INSN_CALL_DYNAMIC) {
1375                         WARN_FUNC("retpoline_safe hint not an indirect jump/call",
1376                                   insn->sec, insn->offset);
1377                         return -1;
1378                 }
1379
1380                 insn->retpoline_safe = true;
1381         }
1382
1383         return 0;
1384 }
1385
1386 static int read_instr_hints(struct objtool_file *file)
1387 {
1388         struct section *sec;
1389         struct instruction *insn;
1390         struct rela *rela;
1391
1392         sec = find_section_by_name(file->elf, ".rela.discard.instr_end");
1393         if (!sec)
1394                 return 0;
1395
1396         list_for_each_entry(rela, &sec->rela_list, list) {
1397                 if (rela->sym->type != STT_SECTION) {
1398                         WARN("unexpected relocation symbol type in %s", sec->name);
1399                         return -1;
1400                 }
1401
1402                 insn = find_insn(file, rela->sym->sec, rela->addend);
1403                 if (!insn) {
1404                         WARN("bad .discard.instr_end entry");
1405                         return -1;
1406                 }
1407
1408                 insn->instr--;
1409         }
1410
1411         sec = find_section_by_name(file->elf, ".rela.discard.instr_begin");
1412         if (!sec)
1413                 return 0;
1414
1415         list_for_each_entry(rela, &sec->rela_list, list) {
1416                 if (rela->sym->type != STT_SECTION) {
1417                         WARN("unexpected relocation symbol type in %s", sec->name);
1418                         return -1;
1419                 }
1420
1421                 insn = find_insn(file, rela->sym->sec, rela->addend);
1422                 if (!insn) {
1423                         WARN("bad .discard.instr_begin entry");
1424                         return -1;
1425                 }
1426
1427                 insn->instr++;
1428         }
1429
1430         return 0;
1431 }
1432
1433 static int read_intra_function_calls(struct objtool_file *file)
1434 {
1435         struct instruction *insn;
1436         struct section *sec;
1437         struct rela *rela;
1438
1439         sec = find_section_by_name(file->elf, ".rela.discard.intra_function_calls");
1440         if (!sec)
1441                 return 0;
1442
1443         list_for_each_entry(rela, &sec->rela_list, list) {
1444                 unsigned long dest_off;
1445
1446                 if (rela->sym->type != STT_SECTION) {
1447                         WARN("unexpected relocation symbol type in %s",
1448                              sec->name);
1449                         return -1;
1450                 }
1451
1452                 insn = find_insn(file, rela->sym->sec, rela->addend);
1453                 if (!insn) {
1454                         WARN("bad .discard.intra_function_call entry");
1455                         return -1;
1456                 }
1457
1458                 if (insn->type != INSN_CALL) {
1459                         WARN_FUNC("intra_function_call not a direct call",
1460                                   insn->sec, insn->offset);
1461                         return -1;
1462                 }
1463
1464                 /*
1465                  * Treat intra-function CALLs as JMPs, but with a stack_op.
1466                  * See add_call_destinations(), which strips stack_ops from
1467                  * normal CALLs.
1468                  */
1469                 insn->type = INSN_JUMP_UNCONDITIONAL;
1470
1471                 dest_off = insn->offset + insn->len + insn->immediate;
1472                 insn->jump_dest = find_insn(file, insn->sec, dest_off);
1473                 if (!insn->jump_dest) {
1474                         WARN_FUNC("can't find call dest at %s+0x%lx",
1475                                   insn->sec, insn->offset,
1476                                   insn->sec->name, dest_off);
1477                         return -1;
1478                 }
1479         }
1480
1481         return 0;
1482 }
1483
1484 static void mark_rodata(struct objtool_file *file)
1485 {
1486         struct section *sec;
1487         bool found = false;
1488
1489         /*
1490          * Search for the following rodata sections, each of which can
1491          * potentially contain jump tables:
1492          *
1493          * - .rodata: can contain GCC switch tables
1494          * - .rodata.<func>: same, if -fdata-sections is being used
1495          * - .rodata..c_jump_table: contains C annotated jump tables
1496          *
1497          * .rodata.str1.* sections are ignored; they don't contain jump tables.
1498          */
1499         for_each_sec(file, sec) {
1500                 if (!strncmp(sec->name, ".rodata", 7) &&
1501                     !strstr(sec->name, ".str1.")) {
1502                         sec->rodata = true;
1503                         found = true;
1504                 }
1505         }
1506
1507         file->rodata = found;
1508 }
1509
1510 static int decode_sections(struct objtool_file *file)
1511 {
1512         int ret;
1513
1514         mark_rodata(file);
1515
1516         ret = decode_instructions(file);
1517         if (ret)
1518                 return ret;
1519
1520         ret = add_dead_ends(file);
1521         if (ret)
1522                 return ret;
1523
1524         add_ignores(file);
1525         add_uaccess_safe(file);
1526
1527         ret = add_ignore_alternatives(file);
1528         if (ret)
1529                 return ret;
1530
1531         ret = add_jump_destinations(file);
1532         if (ret)
1533                 return ret;
1534
1535         ret = add_special_section_alts(file);
1536         if (ret)
1537                 return ret;
1538
1539         ret = read_intra_function_calls(file);
1540         if (ret)
1541                 return ret;
1542
1543         ret = add_call_destinations(file);
1544         if (ret)
1545                 return ret;
1546
1547         ret = add_jump_table_alts(file);
1548         if (ret)
1549                 return ret;
1550
1551         ret = read_unwind_hints(file);
1552         if (ret)
1553                 return ret;
1554
1555         ret = read_retpoline_hints(file);
1556         if (ret)
1557                 return ret;
1558
1559         ret = read_instr_hints(file);
1560         if (ret)
1561                 return ret;
1562
1563         return 0;
1564 }
1565
1566 static bool is_fentry_call(struct instruction *insn)
1567 {
1568         if (insn->type == INSN_CALL && insn->call_dest &&
1569             insn->call_dest->type == STT_NOTYPE &&
1570             !strcmp(insn->call_dest->name, "__fentry__"))
1571                 return true;
1572
1573         return false;
1574 }
1575
1576 static bool has_modified_stack_frame(struct instruction *insn, struct insn_state *state)
1577 {
1578         u8 ret_offset = insn->ret_offset;
1579         struct cfi_state *cfi = &state->cfi;
1580         int i;
1581
1582         if (cfi->cfa.base != initial_func_cfi.cfa.base || cfi->drap)
1583                 return true;
1584
1585         if (cfi->cfa.offset != initial_func_cfi.cfa.offset + ret_offset)
1586                 return true;
1587
1588         if (cfi->stack_size != initial_func_cfi.cfa.offset + ret_offset)
1589                 return true;
1590
1591         /*
1592          * If there is a ret offset hint then don't check registers
1593          * because a callee-saved register might have been pushed on
1594          * the stack.
1595          */
1596         if (ret_offset)
1597                 return false;
1598
1599         for (i = 0; i < CFI_NUM_REGS; i++) {
1600                 if (cfi->regs[i].base != initial_func_cfi.regs[i].base ||
1601                     cfi->regs[i].offset != initial_func_cfi.regs[i].offset)
1602                         return true;
1603         }
1604
1605         return false;
1606 }
1607
1608 static bool has_valid_stack_frame(struct insn_state *state)
1609 {
1610         struct cfi_state *cfi = &state->cfi;
1611
1612         if (cfi->cfa.base == CFI_BP && cfi->regs[CFI_BP].base == CFI_CFA &&
1613             cfi->regs[CFI_BP].offset == -16)
1614                 return true;
1615
1616         if (cfi->drap && cfi->regs[CFI_BP].base == CFI_BP)
1617                 return true;
1618
1619         return false;
1620 }
1621
1622 static int update_cfi_state_regs(struct instruction *insn,
1623                                   struct cfi_state *cfi,
1624                                   struct stack_op *op)
1625 {
1626         struct cfi_reg *cfa = &cfi->cfa;
1627
1628         if (cfa->base != CFI_SP && cfa->base != CFI_SP_INDIRECT)
1629                 return 0;
1630
1631         /* push */
1632         if (op->dest.type == OP_DEST_PUSH || op->dest.type == OP_DEST_PUSHF)
1633                 cfa->offset += 8;
1634
1635         /* pop */
1636         if (op->src.type == OP_SRC_POP || op->src.type == OP_SRC_POPF)
1637                 cfa->offset -= 8;
1638
1639         /* add immediate to sp */
1640         if (op->dest.type == OP_DEST_REG && op->src.type == OP_SRC_ADD &&
1641             op->dest.reg == CFI_SP && op->src.reg == CFI_SP)
1642                 cfa->offset -= op->src.offset;
1643
1644         return 0;
1645 }
1646
1647 static void save_reg(struct cfi_state *cfi, unsigned char reg, int base, int offset)
1648 {
1649         if (arch_callee_saved_reg(reg) &&
1650             cfi->regs[reg].base == CFI_UNDEFINED) {
1651                 cfi->regs[reg].base = base;
1652                 cfi->regs[reg].offset = offset;
1653         }
1654 }
1655
1656 static void restore_reg(struct cfi_state *cfi, unsigned char reg)
1657 {
1658         cfi->regs[reg].base = initial_func_cfi.regs[reg].base;
1659         cfi->regs[reg].offset = initial_func_cfi.regs[reg].offset;
1660 }
1661
1662 /*
1663  * A note about DRAP stack alignment:
1664  *
1665  * GCC has the concept of a DRAP register, which is used to help keep track of
1666  * the stack pointer when aligning the stack.  r10 or r13 is used as the DRAP
1667  * register.  The typical DRAP pattern is:
1668  *
1669  *   4c 8d 54 24 08             lea    0x8(%rsp),%r10
1670  *   48 83 e4 c0                and    $0xffffffffffffffc0,%rsp
1671  *   41 ff 72 f8                pushq  -0x8(%r10)
1672  *   55                         push   %rbp
1673  *   48 89 e5                   mov    %rsp,%rbp
1674  *                              (more pushes)
1675  *   41 52                      push   %r10
1676  *                              ...
1677  *   41 5a                      pop    %r10
1678  *                              (more pops)
1679  *   5d                         pop    %rbp
1680  *   49 8d 62 f8                lea    -0x8(%r10),%rsp
1681  *   c3                         retq
1682  *
1683  * There are some variations in the epilogues, like:
1684  *
1685  *   5b                         pop    %rbx
1686  *   41 5a                      pop    %r10
1687  *   41 5c                      pop    %r12
1688  *   41 5d                      pop    %r13
1689  *   41 5e                      pop    %r14
1690  *   c9                         leaveq
1691  *   49 8d 62 f8                lea    -0x8(%r10),%rsp
1692  *   c3                         retq
1693  *
1694  * and:
1695  *
1696  *   4c 8b 55 e8                mov    -0x18(%rbp),%r10
1697  *   48 8b 5d e0                mov    -0x20(%rbp),%rbx
1698  *   4c 8b 65 f0                mov    -0x10(%rbp),%r12
1699  *   4c 8b 6d f8                mov    -0x8(%rbp),%r13
1700  *   c9                         leaveq
1701  *   49 8d 62 f8                lea    -0x8(%r10),%rsp
1702  *   c3                         retq
1703  *
1704  * Sometimes r13 is used as the DRAP register, in which case it's saved and
1705  * restored beforehand:
1706  *
1707  *   41 55                      push   %r13
1708  *   4c 8d 6c 24 10             lea    0x10(%rsp),%r13
1709  *   48 83 e4 f0                and    $0xfffffffffffffff0,%rsp
1710  *                              ...
1711  *   49 8d 65 f0                lea    -0x10(%r13),%rsp
1712  *   41 5d                      pop    %r13
1713  *   c3                         retq
1714  */
1715 static int update_cfi_state(struct instruction *insn, struct cfi_state *cfi,
1716                              struct stack_op *op)
1717 {
1718         struct cfi_reg *cfa = &cfi->cfa;
1719         struct cfi_reg *regs = cfi->regs;
1720
1721         /* stack operations don't make sense with an undefined CFA */
1722         if (cfa->base == CFI_UNDEFINED) {
1723                 if (insn->func) {
1724                         WARN_FUNC("undefined stack state", insn->sec, insn->offset);
1725                         return -1;
1726                 }
1727                 return 0;
1728         }
1729
1730         if (cfi->type == ORC_TYPE_REGS || cfi->type == ORC_TYPE_REGS_IRET)
1731                 return update_cfi_state_regs(insn, cfi, op);
1732
1733         switch (op->dest.type) {
1734
1735         case OP_DEST_REG:
1736                 switch (op->src.type) {
1737
1738                 case OP_SRC_REG:
1739                         if (op->src.reg == CFI_SP && op->dest.reg == CFI_BP &&
1740                             cfa->base == CFI_SP &&
1741                             regs[CFI_BP].base == CFI_CFA &&
1742                             regs[CFI_BP].offset == -cfa->offset) {
1743
1744                                 /* mov %rsp, %rbp */
1745                                 cfa->base = op->dest.reg;
1746                                 cfi->bp_scratch = false;
1747                         }
1748
1749                         else if (op->src.reg == CFI_SP &&
1750                                  op->dest.reg == CFI_BP && cfi->drap) {
1751
1752                                 /* drap: mov %rsp, %rbp */
1753                                 regs[CFI_BP].base = CFI_BP;
1754                                 regs[CFI_BP].offset = -cfi->stack_size;
1755                                 cfi->bp_scratch = false;
1756                         }
1757
1758                         else if (op->src.reg == CFI_SP && cfa->base == CFI_SP) {
1759
1760                                 /*
1761                                  * mov %rsp, %reg
1762                                  *
1763                                  * This is needed for the rare case where GCC
1764                                  * does:
1765                                  *
1766                                  *   mov    %rsp, %rax
1767                                  *   ...
1768                                  *   mov    %rax, %rsp
1769                                  */
1770                                 cfi->vals[op->dest.reg].base = CFI_CFA;
1771                                 cfi->vals[op->dest.reg].offset = -cfi->stack_size;
1772                         }
1773
1774                         else if (op->src.reg == CFI_BP && op->dest.reg == CFI_SP &&
1775                                  cfa->base == CFI_BP) {
1776
1777                                 /*
1778                                  * mov %rbp, %rsp
1779                                  *
1780                                  * Restore the original stack pointer (Clang).
1781                                  */
1782                                 cfi->stack_size = -cfi->regs[CFI_BP].offset;
1783                         }
1784
1785                         else if (op->dest.reg == cfa->base) {
1786
1787                                 /* mov %reg, %rsp */
1788                                 if (cfa->base == CFI_SP &&
1789                                     cfi->vals[op->src.reg].base == CFI_CFA) {
1790
1791                                         /*
1792                                          * This is needed for the rare case
1793                                          * where GCC does something dumb like:
1794                                          *
1795                                          *   lea    0x8(%rsp), %rcx
1796                                          *   ...
1797                                          *   mov    %rcx, %rsp
1798                                          */
1799                                         cfa->offset = -cfi->vals[op->src.reg].offset;
1800                                         cfi->stack_size = cfa->offset;
1801
1802                                 } else {
1803                                         cfa->base = CFI_UNDEFINED;
1804                                         cfa->offset = 0;
1805                                 }
1806                         }
1807
1808                         break;
1809
1810                 case OP_SRC_ADD:
1811                         if (op->dest.reg == CFI_SP && op->src.reg == CFI_SP) {
1812
1813                                 /* add imm, %rsp */
1814                                 cfi->stack_size -= op->src.offset;
1815                                 if (cfa->base == CFI_SP)
1816                                         cfa->offset -= op->src.offset;
1817                                 break;
1818                         }
1819
1820                         if (op->dest.reg == CFI_SP && op->src.reg == CFI_BP) {
1821
1822                                 /* lea disp(%rbp), %rsp */
1823                                 cfi->stack_size = -(op->src.offset + regs[CFI_BP].offset);
1824                                 break;
1825                         }
1826
1827                         if (op->src.reg == CFI_SP && cfa->base == CFI_SP) {
1828
1829                                 /* drap: lea disp(%rsp), %drap */
1830                                 cfi->drap_reg = op->dest.reg;
1831
1832                                 /*
1833                                  * lea disp(%rsp), %reg
1834                                  *
1835                                  * This is needed for the rare case where GCC
1836                                  * does something dumb like:
1837                                  *
1838                                  *   lea    0x8(%rsp), %rcx
1839                                  *   ...
1840                                  *   mov    %rcx, %rsp
1841                                  */
1842                                 cfi->vals[op->dest.reg].base = CFI_CFA;
1843                                 cfi->vals[op->dest.reg].offset = \
1844                                         -cfi->stack_size + op->src.offset;
1845
1846                                 break;
1847                         }
1848
1849                         if (cfi->drap && op->dest.reg == CFI_SP &&
1850                             op->src.reg == cfi->drap_reg) {
1851
1852                                  /* drap: lea disp(%drap), %rsp */
1853                                 cfa->base = CFI_SP;
1854                                 cfa->offset = cfi->stack_size = -op->src.offset;
1855                                 cfi->drap_reg = CFI_UNDEFINED;
1856                                 cfi->drap = false;
1857                                 break;
1858                         }
1859
1860                         if (op->dest.reg == cfi->cfa.base) {
1861                                 WARN_FUNC("unsupported stack register modification",
1862                                           insn->sec, insn->offset);
1863                                 return -1;
1864                         }
1865
1866                         break;
1867
1868                 case OP_SRC_AND:
1869                         if (op->dest.reg != CFI_SP ||
1870                             (cfi->drap_reg != CFI_UNDEFINED && cfa->base != CFI_SP) ||
1871                             (cfi->drap_reg == CFI_UNDEFINED && cfa->base != CFI_BP)) {
1872                                 WARN_FUNC("unsupported stack pointer realignment",
1873                                           insn->sec, insn->offset);
1874                                 return -1;
1875                         }
1876
1877                         if (cfi->drap_reg != CFI_UNDEFINED) {
1878                                 /* drap: and imm, %rsp */
1879                                 cfa->base = cfi->drap_reg;
1880                                 cfa->offset = cfi->stack_size = 0;
1881                                 cfi->drap = true;
1882                         }
1883
1884                         /*
1885                          * Older versions of GCC (4.8ish) realign the stack
1886                          * without DRAP, with a frame pointer.
1887                          */
1888
1889                         break;
1890
1891                 case OP_SRC_POP:
1892                 case OP_SRC_POPF:
1893                         if (!cfi->drap && op->dest.reg == cfa->base) {
1894
1895                                 /* pop %rbp */
1896                                 cfa->base = CFI_SP;
1897                         }
1898
1899                         if (cfi->drap && cfa->base == CFI_BP_INDIRECT &&
1900                             op->dest.reg == cfi->drap_reg &&
1901                             cfi->drap_offset == -cfi->stack_size) {
1902
1903                                 /* drap: pop %drap */
1904                                 cfa->base = cfi->drap_reg;
1905                                 cfa->offset = 0;
1906                                 cfi->drap_offset = -1;
1907
1908                         } else if (regs[op->dest.reg].offset == -cfi->stack_size) {
1909
1910                                 /* pop %reg */
1911                                 restore_reg(cfi, op->dest.reg);
1912                         }
1913
1914                         cfi->stack_size -= 8;
1915                         if (cfa->base == CFI_SP)
1916                                 cfa->offset -= 8;
1917
1918                         break;
1919
1920                 case OP_SRC_REG_INDIRECT:
1921                         if (cfi->drap && op->src.reg == CFI_BP &&
1922                             op->src.offset == cfi->drap_offset) {
1923
1924                                 /* drap: mov disp(%rbp), %drap */
1925                                 cfa->base = cfi->drap_reg;
1926                                 cfa->offset = 0;
1927                                 cfi->drap_offset = -1;
1928                         }
1929
1930                         if (cfi->drap && op->src.reg == CFI_BP &&
1931                             op->src.offset == regs[op->dest.reg].offset) {
1932
1933                                 /* drap: mov disp(%rbp), %reg */
1934                                 restore_reg(cfi, op->dest.reg);
1935
1936                         } else if (op->src.reg == cfa->base &&
1937                             op->src.offset == regs[op->dest.reg].offset + cfa->offset) {
1938
1939                                 /* mov disp(%rbp), %reg */
1940                                 /* mov disp(%rsp), %reg */
1941                                 restore_reg(cfi, op->dest.reg);
1942                         }
1943
1944                         break;
1945
1946                 default:
1947                         WARN_FUNC("unknown stack-related instruction",
1948                                   insn->sec, insn->offset);
1949                         return -1;
1950                 }
1951
1952                 break;
1953
1954         case OP_DEST_PUSH:
1955         case OP_DEST_PUSHF:
1956                 cfi->stack_size += 8;
1957                 if (cfa->base == CFI_SP)
1958                         cfa->offset += 8;
1959
1960                 if (op->src.type != OP_SRC_REG)
1961                         break;
1962
1963                 if (cfi->drap) {
1964                         if (op->src.reg == cfa->base && op->src.reg == cfi->drap_reg) {
1965
1966                                 /* drap: push %drap */
1967                                 cfa->base = CFI_BP_INDIRECT;
1968                                 cfa->offset = -cfi->stack_size;
1969
1970                                 /* save drap so we know when to restore it */
1971                                 cfi->drap_offset = -cfi->stack_size;
1972
1973                         } else if (op->src.reg == CFI_BP && cfa->base == cfi->drap_reg) {
1974
1975                                 /* drap: push %rbp */
1976                                 cfi->stack_size = 0;
1977
1978                         } else if (regs[op->src.reg].base == CFI_UNDEFINED) {
1979
1980                                 /* drap: push %reg */
1981                                 save_reg(cfi, op->src.reg, CFI_BP, -cfi->stack_size);
1982                         }
1983
1984                 } else {
1985
1986                         /* push %reg */
1987                         save_reg(cfi, op->src.reg, CFI_CFA, -cfi->stack_size);
1988                 }
1989
1990                 /* detect when asm code uses rbp as a scratch register */
1991                 if (!no_fp && insn->func && op->src.reg == CFI_BP &&
1992                     cfa->base != CFI_BP)
1993                         cfi->bp_scratch = true;
1994                 break;
1995
1996         case OP_DEST_REG_INDIRECT:
1997
1998                 if (cfi->drap) {
1999                         if (op->src.reg == cfa->base && op->src.reg == cfi->drap_reg) {
2000
2001                                 /* drap: mov %drap, disp(%rbp) */
2002                                 cfa->base = CFI_BP_INDIRECT;
2003                                 cfa->offset = op->dest.offset;
2004
2005                                 /* save drap offset so we know when to restore it */
2006                                 cfi->drap_offset = op->dest.offset;
2007                         }
2008
2009                         else if (regs[op->src.reg].base == CFI_UNDEFINED) {
2010
2011                                 /* drap: mov reg, disp(%rbp) */
2012                                 save_reg(cfi, op->src.reg, CFI_BP, op->dest.offset);
2013                         }
2014
2015                 } else if (op->dest.reg == cfa->base) {
2016
2017                         /* mov reg, disp(%rbp) */
2018                         /* mov reg, disp(%rsp) */
2019                         save_reg(cfi, op->src.reg, CFI_CFA,
2020                                  op->dest.offset - cfi->cfa.offset);
2021                 }
2022
2023                 break;
2024
2025         case OP_DEST_LEAVE:
2026                 if ((!cfi->drap && cfa->base != CFI_BP) ||
2027                     (cfi->drap && cfa->base != cfi->drap_reg)) {
2028                         WARN_FUNC("leave instruction with modified stack frame",
2029                                   insn->sec, insn->offset);
2030                         return -1;
2031                 }
2032
2033                 /* leave (mov %rbp, %rsp; pop %rbp) */
2034
2035                 cfi->stack_size = -cfi->regs[CFI_BP].offset - 8;
2036                 restore_reg(cfi, CFI_BP);
2037
2038                 if (!cfi->drap) {
2039                         cfa->base = CFI_SP;
2040                         cfa->offset -= 8;
2041                 }
2042
2043                 break;
2044
2045         case OP_DEST_MEM:
2046                 if (op->src.type != OP_SRC_POP && op->src.type != OP_SRC_POPF) {
2047                         WARN_FUNC("unknown stack-related memory operation",
2048                                   insn->sec, insn->offset);
2049                         return -1;
2050                 }
2051
2052                 /* pop mem */
2053                 cfi->stack_size -= 8;
2054                 if (cfa->base == CFI_SP)
2055                         cfa->offset -= 8;
2056
2057                 break;
2058
2059         default:
2060                 WARN_FUNC("unknown stack-related instruction",
2061                           insn->sec, insn->offset);
2062                 return -1;
2063         }
2064
2065         return 0;
2066 }
2067
2068 static int handle_insn_ops(struct instruction *insn, struct insn_state *state)
2069 {
2070         struct stack_op *op;
2071
2072         list_for_each_entry(op, &insn->stack_ops, list) {
2073                 struct cfi_state old_cfi = state->cfi;
2074                 int res;
2075
2076                 res = update_cfi_state(insn, &state->cfi, op);
2077                 if (res)
2078                         return res;
2079
2080                 if (insn->alt_group && memcmp(&state->cfi, &old_cfi, sizeof(struct cfi_state))) {
2081                         WARN_FUNC("alternative modifies stack", insn->sec, insn->offset);
2082                         return -1;
2083                 }
2084
2085                 if (op->dest.type == OP_DEST_PUSHF) {
2086                         if (!state->uaccess_stack) {
2087                                 state->uaccess_stack = 1;
2088                         } else if (state->uaccess_stack >> 31) {
2089                                 WARN_FUNC("PUSHF stack exhausted",
2090                                           insn->sec, insn->offset);
2091                                 return 1;
2092                         }
2093                         state->uaccess_stack <<= 1;
2094                         state->uaccess_stack  |= state->uaccess;
2095                 }
2096
2097                 if (op->src.type == OP_SRC_POPF) {
2098                         if (state->uaccess_stack) {
2099                                 state->uaccess = state->uaccess_stack & 1;
2100                                 state->uaccess_stack >>= 1;
2101                                 if (state->uaccess_stack == 1)
2102                                         state->uaccess_stack = 0;
2103                         }
2104                 }
2105         }
2106
2107         return 0;
2108 }
2109
2110 static bool insn_cfi_match(struct instruction *insn, struct cfi_state *cfi2)
2111 {
2112         struct cfi_state *cfi1 = &insn->cfi;
2113         int i;
2114
2115         if (memcmp(&cfi1->cfa, &cfi2->cfa, sizeof(cfi1->cfa))) {
2116
2117                 WARN_FUNC("stack state mismatch: cfa1=%d%+d cfa2=%d%+d",
2118                           insn->sec, insn->offset,
2119                           cfi1->cfa.base, cfi1->cfa.offset,
2120                           cfi2->cfa.base, cfi2->cfa.offset);
2121
2122         } else if (memcmp(&cfi1->regs, &cfi2->regs, sizeof(cfi1->regs))) {
2123                 for (i = 0; i < CFI_NUM_REGS; i++) {
2124                         if (!memcmp(&cfi1->regs[i], &cfi2->regs[i],
2125                                     sizeof(struct cfi_reg)))
2126                                 continue;
2127
2128                         WARN_FUNC("stack state mismatch: reg1[%d]=%d%+d reg2[%d]=%d%+d",
2129                                   insn->sec, insn->offset,
2130                                   i, cfi1->regs[i].base, cfi1->regs[i].offset,
2131                                   i, cfi2->regs[i].base, cfi2->regs[i].offset);
2132                         break;
2133                 }
2134
2135         } else if (cfi1->type != cfi2->type) {
2136
2137                 WARN_FUNC("stack state mismatch: type1=%d type2=%d",
2138                           insn->sec, insn->offset, cfi1->type, cfi2->type);
2139
2140         } else if (cfi1->drap != cfi2->drap ||
2141                    (cfi1->drap && cfi1->drap_reg != cfi2->drap_reg) ||
2142                    (cfi1->drap && cfi1->drap_offset != cfi2->drap_offset)) {
2143
2144                 WARN_FUNC("stack state mismatch: drap1=%d(%d,%d) drap2=%d(%d,%d)",
2145                           insn->sec, insn->offset,
2146                           cfi1->drap, cfi1->drap_reg, cfi1->drap_offset,
2147                           cfi2->drap, cfi2->drap_reg, cfi2->drap_offset);
2148
2149         } else
2150                 return true;
2151
2152         return false;
2153 }
2154
2155 static inline bool func_uaccess_safe(struct symbol *func)
2156 {
2157         if (func)
2158                 return func->uaccess_safe;
2159
2160         return false;
2161 }
2162
2163 static inline const char *call_dest_name(struct instruction *insn)
2164 {
2165         if (insn->call_dest)
2166                 return insn->call_dest->name;
2167
2168         return "{dynamic}";
2169 }
2170
2171 static int validate_call(struct instruction *insn, struct insn_state *state)
2172 {
2173         if (state->noinstr && state->instr <= 0 &&
2174             (!insn->call_dest || !insn->call_dest->sec->noinstr)) {
2175                 WARN_FUNC("call to %s() leaves .noinstr.text section",
2176                                 insn->sec, insn->offset, call_dest_name(insn));
2177                 return 1;
2178         }
2179
2180         if (state->uaccess && !func_uaccess_safe(insn->call_dest)) {
2181                 WARN_FUNC("call to %s() with UACCESS enabled",
2182                                 insn->sec, insn->offset, call_dest_name(insn));
2183                 return 1;
2184         }
2185
2186         if (state->df) {
2187                 WARN_FUNC("call to %s() with DF set",
2188                                 insn->sec, insn->offset, call_dest_name(insn));
2189                 return 1;
2190         }
2191
2192         return 0;
2193 }
2194
2195 static int validate_sibling_call(struct instruction *insn, struct insn_state *state)
2196 {
2197         if (has_modified_stack_frame(insn, state)) {
2198                 WARN_FUNC("sibling call from callable instruction with modified stack frame",
2199                                 insn->sec, insn->offset);
2200                 return 1;
2201         }
2202
2203         return validate_call(insn, state);
2204 }
2205
2206 static int validate_return(struct symbol *func, struct instruction *insn, struct insn_state *state)
2207 {
2208         if (state->noinstr && state->instr > 0) {
2209                 WARN_FUNC("return with instrumentation enabled",
2210                           insn->sec, insn->offset);
2211                 return 1;
2212         }
2213
2214         if (state->uaccess && !func_uaccess_safe(func)) {
2215                 WARN_FUNC("return with UACCESS enabled",
2216                           insn->sec, insn->offset);
2217                 return 1;
2218         }
2219
2220         if (!state->uaccess && func_uaccess_safe(func)) {
2221                 WARN_FUNC("return with UACCESS disabled from a UACCESS-safe function",
2222                           insn->sec, insn->offset);
2223                 return 1;
2224         }
2225
2226         if (state->df) {
2227                 WARN_FUNC("return with DF set",
2228                           insn->sec, insn->offset);
2229                 return 1;
2230         }
2231
2232         if (func && has_modified_stack_frame(insn, state)) {
2233                 WARN_FUNC("return with modified stack frame",
2234                           insn->sec, insn->offset);
2235                 return 1;
2236         }
2237
2238         if (state->cfi.bp_scratch) {
2239                 WARN_FUNC("BP used as a scratch register",
2240                           insn->sec, insn->offset);
2241                 return 1;
2242         }
2243
2244         return 0;
2245 }
2246
2247 /*
2248  * Alternatives should not contain any ORC entries, this in turn means they
2249  * should not contain any CFI ops, which implies all instructions should have
2250  * the same same CFI state.
2251  *
2252  * It is possible to constuct alternatives that have unreachable holes that go
2253  * unreported (because they're NOPs), such holes would result in CFI_UNDEFINED
2254  * states which then results in ORC entries, which we just said we didn't want.
2255  *
2256  * Avoid them by copying the CFI entry of the first instruction into the whole
2257  * alternative.
2258  */
2259 static void fill_alternative_cfi(struct objtool_file *file, struct instruction *insn)
2260 {
2261         struct instruction *first_insn = insn;
2262         int alt_group = insn->alt_group;
2263
2264         sec_for_each_insn_continue(file, insn) {
2265                 if (insn->alt_group != alt_group)
2266                         break;
2267                 insn->cfi = first_insn->cfi;
2268         }
2269 }
2270
2271 /*
2272  * Follow the branch starting at the given instruction, and recursively follow
2273  * any other branches (jumps).  Meanwhile, track the frame pointer state at
2274  * each instruction and validate all the rules described in
2275  * tools/objtool/Documentation/stack-validation.txt.
2276  */
2277 static int validate_branch(struct objtool_file *file, struct symbol *func,
2278                            struct instruction *insn, struct insn_state state)
2279 {
2280         struct alternative *alt;
2281         struct instruction *next_insn;
2282         struct section *sec;
2283         u8 visited;
2284         int ret;
2285
2286         sec = insn->sec;
2287
2288         while (1) {
2289                 next_insn = next_insn_same_sec(file, insn);
2290
2291                 if (file->c_file && func && insn->func && func != insn->func->pfunc) {
2292                         WARN("%s() falls through to next function %s()",
2293                              func->name, insn->func->name);
2294                         return 1;
2295                 }
2296
2297                 if (func && insn->ignore) {
2298                         WARN_FUNC("BUG: why am I validating an ignored function?",
2299                                   sec, insn->offset);
2300                         return 1;
2301                 }
2302
2303                 visited = 1 << state.uaccess;
2304                 if (insn->visited) {
2305                         if (!insn->hint && !insn_cfi_match(insn, &state.cfi))
2306                                 return 1;
2307
2308                         if (insn->visited & visited)
2309                                 return 0;
2310                 }
2311
2312                 if (state.noinstr)
2313                         state.instr += insn->instr;
2314
2315                 if (insn->hint)
2316                         state.cfi = insn->cfi;
2317                 else
2318                         insn->cfi = state.cfi;
2319
2320                 insn->visited |= visited;
2321
2322                 if (!insn->ignore_alts && !list_empty(&insn->alts)) {
2323                         bool skip_orig = false;
2324
2325                         list_for_each_entry(alt, &insn->alts, list) {
2326                                 if (alt->skip_orig)
2327                                         skip_orig = true;
2328
2329                                 ret = validate_branch(file, func, alt->insn, state);
2330                                 if (ret) {
2331                                         if (backtrace)
2332                                                 BT_FUNC("(alt)", insn);
2333                                         return ret;
2334                                 }
2335                         }
2336
2337                         if (insn->alt_group)
2338                                 fill_alternative_cfi(file, insn);
2339
2340                         if (skip_orig)
2341                                 return 0;
2342                 }
2343
2344                 if (handle_insn_ops(insn, &state))
2345                         return 1;
2346
2347                 switch (insn->type) {
2348
2349                 case INSN_RETURN:
2350                         return validate_return(func, insn, &state);
2351
2352                 case INSN_CALL:
2353                 case INSN_CALL_DYNAMIC:
2354                         ret = validate_call(insn, &state);
2355                         if (ret)
2356                                 return ret;
2357
2358                         if (!no_fp && func && !is_fentry_call(insn) &&
2359                             !has_valid_stack_frame(&state)) {
2360                                 WARN_FUNC("call without frame pointer save/setup",
2361                                           sec, insn->offset);
2362                                 return 1;
2363                         }
2364
2365                         if (dead_end_function(file, insn->call_dest))
2366                                 return 0;
2367
2368                         break;
2369
2370                 case INSN_JUMP_CONDITIONAL:
2371                 case INSN_JUMP_UNCONDITIONAL:
2372                         if (func && is_sibling_call(insn)) {
2373                                 ret = validate_sibling_call(insn, &state);
2374                                 if (ret)
2375                                         return ret;
2376
2377                         } else if (insn->jump_dest) {
2378                                 ret = validate_branch(file, func,
2379                                                       insn->jump_dest, state);
2380                                 if (ret) {
2381                                         if (backtrace)
2382                                                 BT_FUNC("(branch)", insn);
2383                                         return ret;
2384                                 }
2385                         }
2386
2387                         if (insn->type == INSN_JUMP_UNCONDITIONAL)
2388                                 return 0;
2389
2390                         break;
2391
2392                 case INSN_JUMP_DYNAMIC:
2393                 case INSN_JUMP_DYNAMIC_CONDITIONAL:
2394                         if (func && is_sibling_call(insn)) {
2395                                 ret = validate_sibling_call(insn, &state);
2396                                 if (ret)
2397                                         return ret;
2398                         }
2399
2400                         if (insn->type == INSN_JUMP_DYNAMIC)
2401                                 return 0;
2402
2403                         break;
2404
2405                 case INSN_CONTEXT_SWITCH:
2406                         if (func && (!next_insn || !next_insn->hint)) {
2407                                 WARN_FUNC("unsupported instruction in callable function",
2408                                           sec, insn->offset);
2409                                 return 1;
2410                         }
2411                         return 0;
2412
2413                 case INSN_STAC:
2414                         if (state.uaccess) {
2415                                 WARN_FUNC("recursive UACCESS enable", sec, insn->offset);
2416                                 return 1;
2417                         }
2418
2419                         state.uaccess = true;
2420                         break;
2421
2422                 case INSN_CLAC:
2423                         if (!state.uaccess && func) {
2424                                 WARN_FUNC("redundant UACCESS disable", sec, insn->offset);
2425                                 return 1;
2426                         }
2427
2428                         if (func_uaccess_safe(func) && !state.uaccess_stack) {
2429                                 WARN_FUNC("UACCESS-safe disables UACCESS", sec, insn->offset);
2430                                 return 1;
2431                         }
2432
2433                         state.uaccess = false;
2434                         break;
2435
2436                 case INSN_STD:
2437                         if (state.df)
2438                                 WARN_FUNC("recursive STD", sec, insn->offset);
2439
2440                         state.df = true;
2441                         break;
2442
2443                 case INSN_CLD:
2444                         if (!state.df && func)
2445                                 WARN_FUNC("redundant CLD", sec, insn->offset);
2446
2447                         state.df = false;
2448                         break;
2449
2450                 default:
2451                         break;
2452                 }
2453
2454                 if (insn->dead_end)
2455                         return 0;
2456
2457                 if (!next_insn) {
2458                         if (state.cfi.cfa.base == CFI_UNDEFINED)
2459                                 return 0;
2460                         WARN("%s: unexpected end of section", sec->name);
2461                         return 1;
2462                 }
2463
2464                 insn = next_insn;
2465         }
2466
2467         return 0;
2468 }
2469
2470 static int validate_unwind_hints(struct objtool_file *file, struct section *sec)
2471 {
2472         struct instruction *insn;
2473         struct insn_state state;
2474         int ret, warnings = 0;
2475
2476         if (!file->hints)
2477                 return 0;
2478
2479         init_insn_state(&state, sec);
2480
2481         if (sec) {
2482                 insn = find_insn(file, sec, 0);
2483                 if (!insn)
2484                         return 0;
2485         } else {
2486                 insn = list_first_entry(&file->insn_list, typeof(*insn), list);
2487         }
2488
2489         while (&insn->list != &file->insn_list && (!sec || insn->sec == sec)) {
2490                 if (insn->hint && !insn->visited) {
2491                         ret = validate_branch(file, insn->func, insn, state);
2492                         if (ret && backtrace)
2493                                 BT_FUNC("<=== (hint)", insn);
2494                         warnings += ret;
2495                 }
2496
2497                 insn = list_next_entry(insn, list);
2498         }
2499
2500         return warnings;
2501 }
2502
2503 static int validate_retpoline(struct objtool_file *file)
2504 {
2505         struct instruction *insn;
2506         int warnings = 0;
2507
2508         for_each_insn(file, insn) {
2509                 if (insn->type != INSN_JUMP_DYNAMIC &&
2510                     insn->type != INSN_CALL_DYNAMIC)
2511                         continue;
2512
2513                 if (insn->retpoline_safe)
2514                         continue;
2515
2516                 /*
2517                  * .init.text code is ran before userspace and thus doesn't
2518                  * strictly need retpolines, except for modules which are
2519                  * loaded late, they very much do need retpoline in their
2520                  * .init.text
2521                  */
2522                 if (!strcmp(insn->sec->name, ".init.text") && !module)
2523                         continue;
2524
2525                 WARN_FUNC("indirect %s found in RETPOLINE build",
2526                           insn->sec, insn->offset,
2527                           insn->type == INSN_JUMP_DYNAMIC ? "jump" : "call");
2528
2529                 warnings++;
2530         }
2531
2532         return warnings;
2533 }
2534
2535 static bool is_kasan_insn(struct instruction *insn)
2536 {
2537         return (insn->type == INSN_CALL &&
2538                 !strcmp(insn->call_dest->name, "__asan_handle_no_return"));
2539 }
2540
2541 static bool is_ubsan_insn(struct instruction *insn)
2542 {
2543         return (insn->type == INSN_CALL &&
2544                 !strcmp(insn->call_dest->name,
2545                         "__ubsan_handle_builtin_unreachable"));
2546 }
2547
2548 static bool ignore_unreachable_insn(struct instruction *insn)
2549 {
2550         int i;
2551
2552         if (insn->ignore || insn->type == INSN_NOP)
2553                 return true;
2554
2555         /*
2556          * Ignore any unused exceptions.  This can happen when a whitelisted
2557          * function has an exception table entry.
2558          *
2559          * Also ignore alternative replacement instructions.  This can happen
2560          * when a whitelisted function uses one of the ALTERNATIVE macros.
2561          */
2562         if (!strcmp(insn->sec->name, ".fixup") ||
2563             !strcmp(insn->sec->name, ".altinstr_replacement") ||
2564             !strcmp(insn->sec->name, ".altinstr_aux"))
2565                 return true;
2566
2567         if (!insn->func)
2568                 return false;
2569
2570         /*
2571          * CONFIG_UBSAN_TRAP inserts a UD2 when it sees
2572          * __builtin_unreachable().  The BUG() macro has an unreachable() after
2573          * the UD2, which causes GCC's undefined trap logic to emit another UD2
2574          * (or occasionally a JMP to UD2).
2575          */
2576         if (list_prev_entry(insn, list)->dead_end &&
2577             (insn->type == INSN_BUG ||
2578              (insn->type == INSN_JUMP_UNCONDITIONAL &&
2579               insn->jump_dest && insn->jump_dest->type == INSN_BUG)))
2580                 return true;
2581
2582         /*
2583          * Check if this (or a subsequent) instruction is related to
2584          * CONFIG_UBSAN or CONFIG_KASAN.
2585          *
2586          * End the search at 5 instructions to avoid going into the weeds.
2587          */
2588         for (i = 0; i < 5; i++) {
2589
2590                 if (is_kasan_insn(insn) || is_ubsan_insn(insn))
2591                         return true;
2592
2593                 if (insn->type == INSN_JUMP_UNCONDITIONAL) {
2594                         if (insn->jump_dest &&
2595                             insn->jump_dest->func == insn->func) {
2596                                 insn = insn->jump_dest;
2597                                 continue;
2598                         }
2599
2600                         break;
2601                 }
2602
2603                 if (insn->offset + insn->len >= insn->func->offset + insn->func->len)
2604                         break;
2605
2606                 insn = list_next_entry(insn, list);
2607         }
2608
2609         return false;
2610 }
2611
2612 static int validate_symbol(struct objtool_file *file, struct section *sec,
2613                            struct symbol *sym, struct insn_state *state)
2614 {
2615         struct instruction *insn;
2616         int ret;
2617
2618         if (!sym->len) {
2619                 WARN("%s() is missing an ELF size annotation", sym->name);
2620                 return 1;
2621         }
2622
2623         if (sym->pfunc != sym || sym->alias != sym)
2624                 return 0;
2625
2626         insn = find_insn(file, sec, sym->offset);
2627         if (!insn || insn->ignore || insn->visited)
2628                 return 0;
2629
2630         state->uaccess = sym->uaccess_safe;
2631
2632         ret = validate_branch(file, insn->func, insn, *state);
2633         if (ret && backtrace)
2634                 BT_FUNC("<=== (sym)", insn);
2635         return ret;
2636 }
2637
2638 static int validate_section(struct objtool_file *file, struct section *sec)
2639 {
2640         struct insn_state state;
2641         struct symbol *func;
2642         int warnings = 0;
2643
2644         list_for_each_entry(func, &sec->symbol_list, list) {
2645                 if (func->type != STT_FUNC)
2646                         continue;
2647
2648                 init_insn_state(&state, sec);
2649                 state.cfi.cfa = initial_func_cfi.cfa;
2650                 memcpy(&state.cfi.regs, &initial_func_cfi.regs,
2651                        CFI_NUM_REGS * sizeof(struct cfi_reg));
2652                 state.cfi.stack_size = initial_func_cfi.cfa.offset;
2653
2654                 warnings += validate_symbol(file, sec, func, &state);
2655         }
2656
2657         return warnings;
2658 }
2659
2660 static int validate_vmlinux_functions(struct objtool_file *file)
2661 {
2662         struct section *sec;
2663         int warnings = 0;
2664
2665         sec = find_section_by_name(file->elf, ".noinstr.text");
2666         if (sec) {
2667                 warnings += validate_section(file, sec);
2668                 warnings += validate_unwind_hints(file, sec);
2669         }
2670
2671         sec = find_section_by_name(file->elf, ".entry.text");
2672         if (sec) {
2673                 warnings += validate_section(file, sec);
2674                 warnings += validate_unwind_hints(file, sec);
2675         }
2676
2677         return warnings;
2678 }
2679
2680 static int validate_functions(struct objtool_file *file)
2681 {
2682         struct section *sec;
2683         int warnings = 0;
2684
2685         for_each_sec(file, sec) {
2686                 if (!(sec->sh.sh_flags & SHF_EXECINSTR))
2687                         continue;
2688
2689                 warnings += validate_section(file, sec);
2690         }
2691
2692         return warnings;
2693 }
2694
2695 static int validate_reachable_instructions(struct objtool_file *file)
2696 {
2697         struct instruction *insn;
2698
2699         if (file->ignore_unreachables)
2700                 return 0;
2701
2702         for_each_insn(file, insn) {
2703                 if (insn->visited || ignore_unreachable_insn(insn))
2704                         continue;
2705
2706                 WARN_FUNC("unreachable instruction", insn->sec, insn->offset);
2707                 return 1;
2708         }
2709
2710         return 0;
2711 }
2712
2713 static struct objtool_file file;
2714
2715 int check(const char *_objname, bool orc)
2716 {
2717         int ret, warnings = 0;
2718
2719         objname = _objname;
2720
2721         file.elf = elf_open_read(objname, orc ? O_RDWR : O_RDONLY);
2722         if (!file.elf)
2723                 return 1;
2724
2725         INIT_LIST_HEAD(&file.insn_list);
2726         hash_init(file.insn_hash);
2727         file.c_file = find_section_by_name(file.elf, ".comment");
2728         file.ignore_unreachables = no_unreachable;
2729         file.hints = false;
2730
2731         arch_initial_func_cfi_state(&initial_func_cfi);
2732
2733         ret = decode_sections(&file);
2734         if (ret < 0)
2735                 goto out;
2736         warnings += ret;
2737
2738         if (list_empty(&file.insn_list))
2739                 goto out;
2740
2741         if (vmlinux && !validate_dup) {
2742                 ret = validate_vmlinux_functions(&file);
2743                 if (ret < 0)
2744                         goto out;
2745
2746                 warnings += ret;
2747                 goto out;
2748         }
2749
2750         if (retpoline) {
2751                 ret = validate_retpoline(&file);
2752                 if (ret < 0)
2753                         return ret;
2754                 warnings += ret;
2755         }
2756
2757         ret = validate_functions(&file);
2758         if (ret < 0)
2759                 goto out;
2760         warnings += ret;
2761
2762         ret = validate_unwind_hints(&file, NULL);
2763         if (ret < 0)
2764                 goto out;
2765         warnings += ret;
2766
2767         if (!warnings) {
2768                 ret = validate_reachable_instructions(&file);
2769                 if (ret < 0)
2770                         goto out;
2771                 warnings += ret;
2772         }
2773
2774         if (orc) {
2775                 ret = create_orc(&file);
2776                 if (ret < 0)
2777                         goto out;
2778
2779                 ret = create_orc_sections(&file);
2780                 if (ret < 0)
2781                         goto out;
2782
2783                 ret = elf_write(file.elf);
2784                 if (ret < 0)
2785                         goto out;
2786         }
2787
2788 out:
2789         if (ret < 0) {
2790                 /*
2791                  *  Fatal error.  The binary is corrupt or otherwise broken in
2792                  *  some way, or objtool itself is broken.  Fail the kernel
2793                  *  build.
2794                  */
2795                 return ret;
2796         }
2797
2798         return 0;
2799 }