check.c 70.5 KB
Newer Older
1
// SPDX-License-Identifier: GPL-2.0-or-later
2 3 4 5 6 7 8
/*
 * Copyright (C) 2015-2017 Josh Poimboeuf <jpoimboe@redhat.com>
 */

#include <string.h>
#include <stdlib.h>

9 10 11 12 13 14 15 16
#include <arch/elf.h>
#include <objtool/builtin.h>
#include <objtool/cfi.h>
#include <objtool/arch.h>
#include <objtool/check.h>
#include <objtool/special.h>
#include <objtool/warn.h>
#include <objtool/endianness.h>
17

18
#include <linux/objtool.h>
19 20
#include <linux/hashtable.h>
#include <linux/kernel.h>
21
#include <linux/static_call_types.h>
22 23 24 25

struct alternative {
	struct list_head list;
	struct instruction *insn;
26
	bool skip_orig;
27 28
};

29
struct cfi_init_state initial_func_cfi;
30

31 32
struct instruction *find_insn(struct objtool_file *file,
			      struct section *sec, unsigned long offset)
33 34 35
{
	struct instruction *insn;

36
	hash_for_each_possible(file->insn_hash, insn, hash, sec_offset_hash(sec, offset)) {
37 38
		if (insn->sec == sec && insn->offset == offset)
			return insn;
39
	}
40 41 42 43 44 45 46 47 48

	return NULL;
}

static struct instruction *next_insn_same_sec(struct objtool_file *file,
					      struct instruction *insn)
{
	struct instruction *next = list_next_entry(insn, list);

49
	if (!next || &next->list == &file->insn_list || next->sec != insn->sec)
50 51 52 53 54
		return NULL;

	return next;
}

55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74
static struct instruction *next_insn_same_func(struct objtool_file *file,
					       struct instruction *insn)
{
	struct instruction *next = list_next_entry(insn, list);
	struct symbol *func = insn->func;

	if (!func)
		return NULL;

	if (&next->list != &file->insn_list && next->func == func)
		return next;

	/* Check if we're already in the subfunction: */
	if (func == func->cfunc)
		return NULL;

	/* Move to the subfunction: */
	return find_insn(file, func->cfunc->sec, func->cfunc->offset);
}

75 76 77 78 79 80 81 82 83 84 85
static struct instruction *prev_insn_same_sym(struct objtool_file *file,
					       struct instruction *insn)
{
	struct instruction *prev = list_prev_entry(insn, list);

	if (&prev->list != &file->insn_list && prev->func == insn->func)
		return prev;

	return NULL;
}

86
#define func_for_each_insn(file, func, insn)				\
87 88 89 90
	for (insn = find_insn(file, func->sec, func->offset);		\
	     insn;							\
	     insn = next_insn_same_func(file, insn))

91 92
#define sym_for_each_insn(file, sym, insn)				\
	for (insn = find_insn(file, sym->sec, sym->offset);		\
93
	     insn && &insn->list != &file->insn_list &&			\
94 95
		insn->sec == sym->sec &&				\
		insn->offset < sym->offset + sym->len;			\
96 97
	     insn = list_next_entry(insn, list))

98
#define sym_for_each_insn_continue_reverse(file, sym, insn)		\
99 100
	for (insn = list_prev_entry(insn, list);			\
	     &insn->list != &file->insn_list &&				\
101
		insn->sec == sym->sec && insn->offset >= sym->offset;	\
102 103 104 105 106
	     insn = list_prev_entry(insn, list))

#define sec_for_each_insn_from(file, insn)				\
	for (; insn; insn = next_insn_same_sec(file, insn))

107 108 109
#define sec_for_each_insn_continue(file, insn)				\
	for (insn = next_insn_same_sec(file, insn); insn;		\
	     insn = next_insn_same_sec(file, insn))
110

111 112 113 114 115 116
static bool is_sibling_call(struct instruction *insn)
{
	/* An indirect jump is either a sibling call or a jump to a table. */
	if (insn->type == INSN_JUMP_DYNAMIC)
		return list_empty(&insn->alts);

117
	if (!is_static_jump(insn))
118 119 120 121 122 123
		return false;

	/* add_jump_destinations() sets insn->call_dest for sibling calls. */
	return !!insn->call_dest;
}

124 125 126 127 128 129 130 131 132
/*
 * This checks to see if the given function is a "noreturn" function.
 *
 * For global functions which are outside the scope of this object file, we
 * have to keep a manual list of them.
 *
 * For local functions, we have to detect them manually by simply looking for
 * the lack of a return instruction.
 */
133 134
static bool __dead_end_function(struct objtool_file *file, struct symbol *func,
				int recursion)
135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153
{
	int i;
	struct instruction *insn;
	bool empty = true;

	/*
	 * Unfortunately these have to be hard coded because the noreturn
	 * attribute isn't provided in ELF data.
	 */
	static const char * const global_noreturns[] = {
		"__stack_chk_fail",
		"panic",
		"do_exit",
		"do_task_dead",
		"__module_put_and_exit",
		"complete_and_exit",
		"__reiserfs_panic",
		"lbug_with_loc",
		"fortify_panic",
154
		"usercopy_abort",
155
		"machine_real_restart",
156
		"rewind_stack_do_exit",
157
		"kunit_try_catch_throw",
158 159
	};

160 161 162
	if (!func)
		return false;

163
	if (func->bind == STB_WEAK)
164
		return false;
165 166 167 168

	if (func->bind == STB_GLOBAL)
		for (i = 0; i < ARRAY_SIZE(global_noreturns); i++)
			if (!strcmp(func->name, global_noreturns[i]))
169
				return true;
170

171
	if (!func->len)
172
		return false;
173

174 175
	insn = find_insn(file, func->sec, func->offset);
	if (!insn->func)
176
		return false;
177

178
	func_for_each_insn(file, func, insn) {
179 180 181
		empty = false;

		if (insn->type == INSN_RETURN)
182
			return false;
183 184 185
	}

	if (empty)
186
		return false;
187 188 189 190 191 192

	/*
	 * A function can have a sibling call instead of a return.  In that
	 * case, the function's dead-end status depends on whether the target
	 * of the sibling call returns.
	 */
193
	func_for_each_insn(file, func, insn) {
194
		if (is_sibling_call(insn)) {
195 196 197 198
			struct instruction *dest = insn->jump_dest;

			if (!dest)
				/* sibling call to another file */
199
				return false;
200

201 202 203 204 205 206 207 208
			/* local sibling call */
			if (recursion == 5) {
				/*
				 * Infinite recursion: two functions have
				 * sibling calls to each other.  This is a very
				 * rare case.  It means they aren't dead ends.
				 */
				return false;
209 210
			}

211 212
			return __dead_end_function(file, dest->func, recursion+1);
		}
213 214
	}

215
	return true;
216 217
}

218
static bool dead_end_function(struct objtool_file *file, struct symbol *func)
219 220 221 222
{
	return __dead_end_function(file, func, 0);
}

223
static void init_cfi_state(struct cfi_state *cfi)
224 225 226
{
	int i;

227
	for (i = 0; i < CFI_NUM_REGS; i++) {
228 229
		cfi->regs[i].base = CFI_UNDEFINED;
		cfi->vals[i].base = CFI_UNDEFINED;
230
	}
231 232 233 234 235
	cfi->cfa.base = CFI_UNDEFINED;
	cfi->drap_reg = CFI_UNDEFINED;
	cfi->drap_offset = -1;
}

236
static void init_insn_state(struct insn_state *state, struct section *sec)
237 238 239
{
	memset(state, 0, sizeof(*state));
	init_cfi_state(&state->cfi);
240 241 242 243 244 245 246 247

	/*
	 * We need the full vmlinux for noinstr validation, otherwise we can
	 * not correctly determine insn->call_dest->sec (external symbols do
	 * not have a section).
	 */
	if (vmlinux && sec)
		state->noinstr = sec->noinstr;
248 249
}

250 251 252 253 254 255 256 257 258 259
/*
 * Call the arch-specific instruction decoder for all the instructions and add
 * them to the global instruction list.
 */
static int decode_instructions(struct objtool_file *file)
{
	struct section *sec;
	struct symbol *func;
	unsigned long offset;
	struct instruction *insn;
260
	unsigned long nr_insns = 0;
261 262
	int ret;

263
	for_each_sec(file, sec) {
264 265 266 267

		if (!(sec->sh.sh_flags & SHF_EXECINSTR))
			continue;

268 269 270 271 272
		if (strcmp(sec->name, ".altinstr_replacement") &&
		    strcmp(sec->name, ".altinstr_aux") &&
		    strncmp(sec->name, ".discard.", 9))
			sec->text = true;

273 274
		if (!strcmp(sec->name, ".noinstr.text") ||
		    !strcmp(sec->name, ".entry.text"))
275 276
			sec->noinstr = true;

277 278
		for (offset = 0; offset < sec->len; offset += insn->len) {
			insn = malloc(sizeof(*insn));
279 280 281 282
			if (!insn) {
				WARN("malloc failed");
				return -1;
			}
283 284
			memset(insn, 0, sizeof(*insn));
			INIT_LIST_HEAD(&insn->alts);
285
			INIT_LIST_HEAD(&insn->stack_ops);
286
			init_cfi_state(&insn->cfi);
287

288 289 290 291 292 293
			insn->sec = sec;
			insn->offset = offset;

			ret = arch_decode_instruction(file->elf, sec, offset,
						      sec->len - offset,
						      &insn->len, &insn->type,
294
						      &insn->immediate,
295
						      &insn->stack_ops);
296
			if (ret)
297
				goto err;
298

299
			hash_add(file->insn_hash, &insn->hash, sec_offset_hash(sec, insn->offset));
300
			list_add_tail(&insn->list, &file->insn_list);
301
			nr_insns++;
302 303 304
		}

		list_for_each_entry(func, &sec->symbol_list, list) {
305
			if (func->type != STT_FUNC || func->alias != func)
306 307 308 309 310 311 312 313
				continue;

			if (!find_insn(file, sec, func->offset)) {
				WARN("%s(): can't find starting instruction",
				     func->name);
				return -1;
			}

314
			sym_for_each_insn(file, func, insn)
315
				insn->func = func;
316 317 318
		}
	}

319 320 321
	if (stats)
		printf("nr_insns: %lu\n", nr_insns);

322
	return 0;
323 324 325 326

err:
	free(insn);
	return ret;
327 328
}

329 330 331 332 333 334 335 336 337 338 339 340 341
static struct instruction *find_last_insn(struct objtool_file *file,
					  struct section *sec)
{
	struct instruction *insn = NULL;
	unsigned int offset;
	unsigned int end = (sec->len > 10) ? sec->len - 10 : 0;

	for (offset = sec->len - 1; offset >= end && !insn; offset--)
		insn = find_insn(file, sec, offset);

	return insn;
}

342
/*
343
 * Mark "ud2" instructions and manually annotated dead ends.
344 345 346 347
 */
static int add_dead_ends(struct objtool_file *file)
{
	struct section *sec;
348
	struct reloc *reloc;
349 350
	struct instruction *insn;

351 352 353 354 355 356 357 358 359 360 361
	/*
	 * By default, "ud2" is a dead end unless otherwise annotated, because
	 * GCC 7 inserts it for certain divide-by-zero cases.
	 */
	for_each_insn(file, insn)
		if (insn->type == INSN_BUG)
			insn->dead_end = true;

	/*
	 * Check for manually annotated dead ends.
	 */
362 363
	sec = find_section_by_name(file->elf, ".rela.discard.unreachable");
	if (!sec)
364
		goto reachable;
365

366 367
	list_for_each_entry(reloc, &sec->reloc_list, list) {
		if (reloc->sym->type != STT_SECTION) {
368 369 370
			WARN("unexpected relocation symbol type in %s", sec->name);
			return -1;
		}
371
		insn = find_insn(file, reloc->sym->sec, reloc->addend);
372 373
		if (insn)
			insn = list_prev_entry(insn, list);
374 375
		else if (reloc->addend == reloc->sym->sec->len) {
			insn = find_last_insn(file, reloc->sym->sec);
376
			if (!insn) {
377
				WARN("can't find unreachable insn at %s+0x%x",
378
				     reloc->sym->sec->name, reloc->addend);
379 380 381 382
				return -1;
			}
		} else {
			WARN("can't find unreachable insn at %s+0x%x",
383
			     reloc->sym->sec->name, reloc->addend);
384 385 386 387 388 389
			return -1;
		}

		insn->dead_end = true;
	}

390 391 392 393 394 395 396 397 398 399 400
reachable:
	/*
	 * These manually annotated reachable checks are needed for GCC 4.4,
	 * where the Linux unreachable() macro isn't supported.  In that case
	 * GCC doesn't know the "ud2" is fatal, so it generates code as if it's
	 * not a dead end.
	 */
	sec = find_section_by_name(file->elf, ".rela.discard.reachable");
	if (!sec)
		return 0;

401 402
	list_for_each_entry(reloc, &sec->reloc_list, list) {
		if (reloc->sym->type != STT_SECTION) {
403 404 405
			WARN("unexpected relocation symbol type in %s", sec->name);
			return -1;
		}
406
		insn = find_insn(file, reloc->sym->sec, reloc->addend);
407 408
		if (insn)
			insn = list_prev_entry(insn, list);
409 410
		else if (reloc->addend == reloc->sym->sec->len) {
			insn = find_last_insn(file, reloc->sym->sec);
411
			if (!insn) {
412
				WARN("can't find reachable insn at %s+0x%x",
413
				     reloc->sym->sec->name, reloc->addend);
414 415 416 417
				return -1;
			}
		} else {
			WARN("can't find reachable insn at %s+0x%x",
418
			     reloc->sym->sec->name, reloc->addend);
419 420 421 422 423 424
			return -1;
		}

		insn->dead_end = false;
	}

425 426 427
	return 0;
}

428 429 430 431 432 433 434 435 436 437 438 439 440 441 442 443 444 445 446 447 448 449 450 451 452 453 454 455 456 457 458 459 460 461 462 463 464 465 466 467 468
static int create_static_call_sections(struct objtool_file *file)
{
	struct section *sec, *reloc_sec;
	struct reloc *reloc;
	struct static_call_site *site;
	struct instruction *insn;
	struct symbol *key_sym;
	char *key_name, *tmp;
	int idx;

	sec = find_section_by_name(file->elf, ".static_call_sites");
	if (sec) {
		INIT_LIST_HEAD(&file->static_call_list);
		WARN("file already has .static_call_sites section, skipping");
		return 0;
	}

	if (list_empty(&file->static_call_list))
		return 0;

	idx = 0;
	list_for_each_entry(insn, &file->static_call_list, static_call_node)
		idx++;

	sec = elf_create_section(file->elf, ".static_call_sites", SHF_WRITE,
				 sizeof(struct static_call_site), idx);
	if (!sec)
		return -1;

	reloc_sec = elf_create_reloc_section(file->elf, sec, SHT_RELA);
	if (!reloc_sec)
		return -1;

	idx = 0;
	list_for_each_entry(insn, &file->static_call_list, static_call_node) {

		site = (struct static_call_site *)sec->data->d_buf + idx;
		memset(site, 0, sizeof(struct static_call_site));

		/* populate reloc for 'addr' */
		reloc = malloc(sizeof(*reloc));
469

470 471 472 473 474
		if (!reloc) {
			perror("malloc");
			return -1;
		}
		memset(reloc, 0, sizeof(*reloc));
475 476 477 478 479 480 481 482

		insn_to_reloc_sym_addend(insn->sec, insn->offset, reloc);
		if (!reloc->sym) {
			WARN_FUNC("static call tramp: missing containing symbol",
				  insn->sec, insn->offset);
			return -1;
		}

483 484 485 486 487 488 489 490 491 492 493 494 495 496 497 498 499 500 501 502 503 504 505 506 507 508 509 510 511 512 513 514 515 516
		reloc->type = R_X86_64_PC32;
		reloc->offset = idx * sizeof(struct static_call_site);
		reloc->sec = reloc_sec;
		elf_add_reloc(file->elf, reloc);

		/* find key symbol */
		key_name = strdup(insn->call_dest->name);
		if (!key_name) {
			perror("strdup");
			return -1;
		}
		if (strncmp(key_name, STATIC_CALL_TRAMP_PREFIX_STR,
			    STATIC_CALL_TRAMP_PREFIX_LEN)) {
			WARN("static_call: trampoline name malformed: %s", key_name);
			return -1;
		}
		tmp = key_name + STATIC_CALL_TRAMP_PREFIX_LEN - STATIC_CALL_KEY_PREFIX_LEN;
		memcpy(tmp, STATIC_CALL_KEY_PREFIX_STR, STATIC_CALL_KEY_PREFIX_LEN);

		key_sym = find_symbol_by_name(file->elf, tmp);
		if (!key_sym) {
			WARN("static_call: can't find static_call_key symbol: %s", tmp);
			return -1;
		}
		free(key_name);

		/* populate reloc for 'key' */
		reloc = malloc(sizeof(*reloc));
		if (!reloc) {
			perror("malloc");
			return -1;
		}
		memset(reloc, 0, sizeof(*reloc));
		reloc->sym = key_sym;
517
		reloc->addend = is_sibling_call(insn) ? STATIC_CALL_SITE_TAIL : 0;
518 519 520 521 522 523 524 525 526 527 528 529 530 531
		reloc->type = R_X86_64_PC32;
		reloc->offset = idx * sizeof(struct static_call_site) + 4;
		reloc->sec = reloc_sec;
		elf_add_reloc(file->elf, reloc);

		idx++;
	}

	if (elf_rebuild_reloc_section(file->elf, reloc_sec))
		return -1;

	return 0;
}

532 533 534 535 536 537 538 539
/*
 * Warnings shouldn't be reported for ignored functions.
 */
static void add_ignores(struct objtool_file *file)
{
	struct instruction *insn;
	struct section *sec;
	struct symbol *func;
540
	struct reloc *reloc;
541

542 543 544
	sec = find_section_by_name(file->elf, ".rela.discard.func_stack_frame_non_standard");
	if (!sec)
		return;
545

546 547
	list_for_each_entry(reloc, &sec->reloc_list, list) {
		switch (reloc->sym->type) {
548
		case STT_FUNC:
549
			func = reloc->sym;
550 551 552
			break;

		case STT_SECTION:
553
			func = find_func_by_offset(reloc->sym->sec, reloc->addend);
554
			if (!func)
555
				continue;
556
			break;
557

558
		default:
559
			WARN("unexpected relocation symbol type in %s: %d", sec->name, reloc->sym->type);
560
			continue;
561
		}
562

563
		func_for_each_insn(file, func, insn)
564
			insn->ignore = true;
565 566 567
	}
}

568 569 570 571 572 573 574 575 576 577 578 579 580 581 582 583 584 585 586 587 588 589 590 591
/*
 * This is a whitelist of functions that is allowed to be called with AC set.
 * The list is meant to be minimal and only contains compiler instrumentation
 * ABI and a few functions used to implement *_{to,from}_user() functions.
 *
 * These functions must not directly change AC, but may PUSHF/POPF.
 */
static const char *uaccess_safe_builtin[] = {
	/* KASAN */
	"kasan_report",
	"check_memory_region",
	/* KASAN out-of-line */
	"__asan_loadN_noabort",
	"__asan_load1_noabort",
	"__asan_load2_noabort",
	"__asan_load4_noabort",
	"__asan_load8_noabort",
	"__asan_load16_noabort",
	"__asan_storeN_noabort",
	"__asan_store1_noabort",
	"__asan_store2_noabort",
	"__asan_store4_noabort",
	"__asan_store8_noabort",
	"__asan_store16_noabort",
592 593
	"__kasan_check_read",
	"__kasan_check_write",
594 595 596 597 598 599 600 601 602 603 604 605 606
	/* KASAN in-line */
	"__asan_report_load_n_noabort",
	"__asan_report_load1_noabort",
	"__asan_report_load2_noabort",
	"__asan_report_load4_noabort",
	"__asan_report_load8_noabort",
	"__asan_report_load16_noabort",
	"__asan_report_store_n_noabort",
	"__asan_report_store1_noabort",
	"__asan_report_store2_noabort",
	"__asan_report_store4_noabort",
	"__asan_report_store8_noabort",
	"__asan_report_store16_noabort",
607
	/* KCSAN */
608
	"__kcsan_check_access",
609 610
	"kcsan_found_watchpoint",
	"kcsan_setup_watchpoint",
611
	"kcsan_check_scoped_accesses",
612 613
	"kcsan_disable_current",
	"kcsan_enable_current_nowarn",
614 615 616 617 618 619 620 621 622 623 624 625 626 627 628
	/* KCSAN/TSAN */
	"__tsan_func_entry",
	"__tsan_func_exit",
	"__tsan_read_range",
	"__tsan_write_range",
	"__tsan_read1",
	"__tsan_read2",
	"__tsan_read4",
	"__tsan_read8",
	"__tsan_read16",
	"__tsan_write1",
	"__tsan_write2",
	"__tsan_write4",
	"__tsan_write8",
	"__tsan_write16",
629 630 631 632 633
	"__tsan_read_write1",
	"__tsan_read_write2",
	"__tsan_read_write4",
	"__tsan_read_write8",
	"__tsan_read_write16",
634 635 636 637 638 639 640 641 642 643 644 645 646 647 648 649 650 651 652 653 654 655 656 657 658 659 660 661 662 663 664 665 666 667 668 669 670 671 672 673 674 675 676 677 678 679 680 681 682 683
	"__tsan_atomic8_load",
	"__tsan_atomic16_load",
	"__tsan_atomic32_load",
	"__tsan_atomic64_load",
	"__tsan_atomic8_store",
	"__tsan_atomic16_store",
	"__tsan_atomic32_store",
	"__tsan_atomic64_store",
	"__tsan_atomic8_exchange",
	"__tsan_atomic16_exchange",
	"__tsan_atomic32_exchange",
	"__tsan_atomic64_exchange",
	"__tsan_atomic8_fetch_add",
	"__tsan_atomic16_fetch_add",
	"__tsan_atomic32_fetch_add",
	"__tsan_atomic64_fetch_add",
	"__tsan_atomic8_fetch_sub",
	"__tsan_atomic16_fetch_sub",
	"__tsan_atomic32_fetch_sub",
	"__tsan_atomic64_fetch_sub",
	"__tsan_atomic8_fetch_and",
	"__tsan_atomic16_fetch_and",
	"__tsan_atomic32_fetch_and",
	"__tsan_atomic64_fetch_and",
	"__tsan_atomic8_fetch_or",
	"__tsan_atomic16_fetch_or",
	"__tsan_atomic32_fetch_or",
	"__tsan_atomic64_fetch_or",
	"__tsan_atomic8_fetch_xor",
	"__tsan_atomic16_fetch_xor",
	"__tsan_atomic32_fetch_xor",
	"__tsan_atomic64_fetch_xor",
	"__tsan_atomic8_fetch_nand",
	"__tsan_atomic16_fetch_nand",
	"__tsan_atomic32_fetch_nand",
	"__tsan_atomic64_fetch_nand",
	"__tsan_atomic8_compare_exchange_strong",
	"__tsan_atomic16_compare_exchange_strong",
	"__tsan_atomic32_compare_exchange_strong",
	"__tsan_atomic64_compare_exchange_strong",
	"__tsan_atomic8_compare_exchange_weak",
	"__tsan_atomic16_compare_exchange_weak",
	"__tsan_atomic32_compare_exchange_weak",
	"__tsan_atomic64_compare_exchange_weak",
	"__tsan_atomic8_compare_exchange_val",
	"__tsan_atomic16_compare_exchange_val",
	"__tsan_atomic32_compare_exchange_val",
	"__tsan_atomic64_compare_exchange_val",
	"__tsan_atomic_thread_fence",
	"__tsan_atomic_signal_fence",
684 685
	/* KCOV */
	"write_comp_data",
686
	"check_kcov_mode",
687 688 689 690 691 692 693 694 695
	"__sanitizer_cov_trace_pc",
	"__sanitizer_cov_trace_const_cmp1",
	"__sanitizer_cov_trace_const_cmp2",
	"__sanitizer_cov_trace_const_cmp4",
	"__sanitizer_cov_trace_const_cmp8",
	"__sanitizer_cov_trace_cmp1",
	"__sanitizer_cov_trace_cmp2",
	"__sanitizer_cov_trace_cmp4",
	"__sanitizer_cov_trace_cmp8",
696
	"__sanitizer_cov_trace_switch",
697 698 699 700
	/* UBSAN */
	"ubsan_type_mismatch_common",
	"__ubsan_handle_type_mismatch",
	"__ubsan_handle_type_mismatch_v1",
701
	"__ubsan_handle_shift_out_of_bounds",
702 703
	/* misc */
	"csum_partial_copy_generic",
704 705
	"copy_mc_fragile",
	"copy_mc_fragile_handle_tail",
706
	"copy_mc_enhanced_fast_string",
707 708 709 710 711 712 713 714 715 716 717 718 719 720 721 722 723
	"ftrace_likely_update", /* CONFIG_TRACE_BRANCH_PROFILING */
	NULL
};

static void add_uaccess_safe(struct objtool_file *file)
{
	struct symbol *func;
	const char **name;

	if (!uaccess)
		return;

	for (name = uaccess_safe_builtin; *name; name++) {
		func = find_symbol_by_name(file->elf, *name);
		if (!func)
			continue;

724
		func->uaccess_safe = true;
725 726 727
	}
}

728 729 730 731 732 733
/*
 * FIXME: For now, just ignore any alternatives which add retpolines.  This is
 * a temporary hack, as it doesn't allow ORC to unwind from inside a retpoline.
 * But it at least allows objtool to understand the control flow *around* the
 * retpoline.
 */
734
static int add_ignore_alternatives(struct objtool_file *file)
735 736
{
	struct section *sec;
737
	struct reloc *reloc;
738 739
	struct instruction *insn;

740
	sec = find_section_by_name(file->elf, ".rela.discard.ignore_alts");
741 742 743
	if (!sec)
		return 0;

744 745
	list_for_each_entry(reloc, &sec->reloc_list, list) {
		if (reloc->sym->type != STT_SECTION) {
746 747 748 749
			WARN("unexpected relocation symbol type in %s", sec->name);
			return -1;
		}

750
		insn = find_insn(file, reloc->sym->sec, reloc->addend);
751
		if (!insn) {
752
			WARN("bad .discard.ignore_alts entry");
753 754 755 756 757 758 759 760 761
			return -1;
		}

		insn->ignore_alts = true;
	}

	return 0;
}

762 763 764 765 766 767
/*
 * Find the destination instructions for all jumps.
 */
static int add_jump_destinations(struct objtool_file *file)
{
	struct instruction *insn;
768
	struct reloc *reloc;
769 770 771 772
	struct section *dest_sec;
	unsigned long dest_off;

	for_each_insn(file, insn) {
773
		if (!is_static_jump(insn))
774 775
			continue;

776
		reloc = find_reloc_by_dest_range(file->elf, insn->sec,
777
					       insn->offset, insn->len);
778
		if (!reloc) {
779
			dest_sec = insn->sec;
780
			dest_off = arch_jump_destination(insn);
781 782 783 784 785 786 787 788
		} else if (reloc->sym->type == STT_SECTION) {
			dest_sec = reloc->sym->sec;
			dest_off = arch_dest_reloc_offset(reloc->addend);
		} else if (reloc->sym->sec->idx) {
			dest_sec = reloc->sym->sec;
			dest_off = reloc->sym->sym.st_value +
				   arch_dest_reloc_offset(reloc->addend);
		} else if (strstr(reloc->sym->name, "_indirect_thunk_")) {
789 790 791 792
			/*
			 * Retpoline jumps are really dynamic jumps in
			 * disguise, so convert them accordingly.
			 */
793 794 795 796 797
			if (insn->type == INSN_JUMP_UNCONDITIONAL)
				insn->type = INSN_JUMP_DYNAMIC;
			else
				insn->type = INSN_JUMP_DYNAMIC_CONDITIONAL;

798
			insn->retpoline_safe = true;
799
			continue;
800
		} else {
801
			/* external sibling call */
802
			insn->call_dest = reloc->sym;
803 804 805 806
			if (insn->call_dest->static_call_tramp) {
				list_add_tail(&insn->static_call_node,
					      &file->static_call_list);
			}
807 808 809 810 811 812 813 814 815 816 817 818 819 820 821 822 823 824 825
			continue;
		}

		insn->jump_dest = find_insn(file, dest_sec, dest_off);
		if (!insn->jump_dest) {

			/*
			 * This is a special case where an alt instruction
			 * jumps past the end of the section.  These are
			 * handled later in handle_group_alt().
			 */
			if (!strcmp(insn->sec->name, ".altinstr_replacement"))
				continue;

			WARN_FUNC("can't find jump dest instruction at %s+0x%lx",
				  insn->sec, insn->offset, dest_sec->name,
				  dest_off);
			return -1;
		}
826 827

		/*
828
		 * Cross-function jump.
829 830
		 */
		if (insn->func && insn->jump_dest->func &&
831 832 833 834 835 836 837 838 839 840 841 842 843 844 845
		    insn->func != insn->jump_dest->func) {

			/*
			 * For GCC 8+, create parent/child links for any cold
			 * subfunctions.  This is _mostly_ redundant with a
			 * similar initialization in read_symbols().
			 *
			 * If a function has aliases, we want the *first* such
			 * function in the symbol table to be the subfunction's
			 * parent.  In that case we overwrite the
			 * initialization done in read_symbols().
			 *
			 * However this code can't completely replace the
			 * read_symbols() code because this doesn't detect the
			 * case where the parent function's only reference to a
846
			 * subfunction is through a jump table.
847 848 849 850 851 852 853 854 855
			 */
			if (!strstr(insn->func->name, ".cold.") &&
			    strstr(insn->jump_dest->func->name, ".cold.")) {
				insn->func->cfunc = insn->jump_dest->func;
				insn->jump_dest->func->pfunc = insn->func;

			} else if (insn->jump_dest->func->pfunc != insn->func->pfunc &&
				   insn->jump_dest->offset == insn->jump_dest->func->offset) {

856
				/* internal sibling call */
857
				insn->call_dest = insn->jump_dest->func;
858 859 860 861
				if (insn->call_dest->static_call_tramp) {
					list_add_tail(&insn->static_call_node,
						      &file->static_call_list);
				}
862
			}
863
		}
864 865 866 867 868
	}

	return 0;
}

869 870 871 872 873 874 875 876 877 878
static void remove_insn_ops(struct instruction *insn)
{
	struct stack_op *op, *tmp;

	list_for_each_entry_safe(op, tmp, &insn->stack_ops, list) {
		list_del(&op->list);
		free(op);
	}
}

879 880 881 882 883 884 885 886 887 888 889
static struct symbol *find_call_destination(struct section *sec, unsigned long offset)
{
	struct symbol *call_dest;

	call_dest = find_func_by_offset(sec, offset);
	if (!call_dest)
		call_dest = find_symbol_by_offset(sec, offset);

	return call_dest;
}

890 891 892 893 894 895 896
/*
 * Find the destination instructions for all calls.
 */
static int add_call_destinations(struct objtool_file *file)
{
	struct instruction *insn;
	unsigned long dest_off;
897
	struct reloc *reloc;
898 899 900 901 902

	for_each_insn(file, insn) {
		if (insn->type != INSN_CALL)
			continue;

903
		reloc = find_reloc_by_dest_range(file->elf, insn->sec,
904
					       insn->offset, insn->len);
905
		if (!reloc) {
906
			dest_off = arch_jump_destination(insn);
907
			insn->call_dest = find_call_destination(insn->sec, dest_off);
908

909 910 911 912
			if (insn->ignore)
				continue;

			if (!insn->call_dest) {
913
				WARN_FUNC("unannotated intra-function call", insn->sec, insn->offset);
914 915
				return -1;
			}
916

917 918 919 920 921 922
			if (insn->func && insn->call_dest->type != STT_FUNC) {
				WARN_FUNC("unsupported call to non-function",
					  insn->sec, insn->offset);
				return -1;
			}

923 924
		} else if (reloc->sym->type == STT_SECTION) {
			dest_off = arch_dest_reloc_offset(reloc->addend);
925 926
			insn->call_dest = find_call_destination(reloc->sym->sec,
								dest_off);
927
			if (!insn->call_dest) {
928
				WARN_FUNC("can't find call dest symbol at %s+0x%lx",
929
					  insn->sec, insn->offset,
930
					  reloc->sym->sec->name,
931
					  dest_off);
932 933 934
				return -1;
			}
		} else
935
			insn->call_dest = reloc->sym;
936

937 938 939 940 941 942 943
		/*
		 * Many compilers cannot disable KCOV with a function attribute
		 * so they need a little help, NOP out any KCOV calls from noinstr
		 * text.
		 */
		if (insn->sec->noinstr &&
		    !strncmp(insn->call_dest->name, "__sanitizer_cov_", 16)) {
944 945 946
			if (reloc) {
				reloc->type = R_NONE;
				elf_write_reloc(file->elf, reloc);
947 948 949 950 951 952 953 954
			}

			elf_write_insn(file->elf, insn->sec,
				       insn->offset, insn->len,
				       arch_nop_insn(insn->len));
			insn->type = INSN_NOP;
		}

955 956 957 958 959 960 961 962
		/*
		 * Whatever stack impact regular CALLs have, should be undone
		 * by the RETURN of the called function.
		 *
		 * Annotated intra-function calls retain the stack_ops but
		 * are converted to JUMP, see read_intra_function_calls().
		 */
		remove_insn_ops(insn);
963 964 965 966 967 968
	}

	return 0;
}

/*
969 970
 * The .alternatives section requires some extra special care over and above
 * other special sections because alternatives are patched in place.
971 972 973 974 975 976
 */
static int handle_group_alt(struct objtool_file *file,
			    struct special_alt *special_alt,
			    struct instruction *orig_insn,
			    struct instruction **new_insn)
{
977
	struct instruction *last_orig_insn, *last_new_insn = NULL, *insn, *nop = NULL;
978
	struct alt_group *orig_alt_group, *new_alt_group;
979 980
	unsigned long dest_off;

981 982 983 984 985 986

	orig_alt_group = malloc(sizeof(*orig_alt_group));
	if (!orig_alt_group) {
		WARN("malloc failed");
		return -1;
	}
987 988 989 990 991 992 993
	orig_alt_group->cfi = calloc(special_alt->orig_len,
				     sizeof(struct cfi_state *));
	if (!orig_alt_group->cfi) {
		WARN("calloc failed");
		return -1;
	}

994 995 996 997 998 999
	last_orig_insn = NULL;
	insn = orig_insn;
	sec_for_each_insn_from(file, insn) {
		if (insn->offset >= special_alt->orig_off + special_alt->orig_len)
			break;

1000
		insn->alt_group = orig_alt_group;
1001 1002
		last_orig_insn = insn;
	}
1003 1004 1005
	orig_alt_group->orig_group = NULL;
	orig_alt_group->first_insn = orig_insn;
	orig_alt_group->last_insn = last_orig_insn;
1006

1007

1008 1009 1010 1011
	new_alt_group = malloc(sizeof(*new_alt_group));
	if (!new_alt_group) {
		WARN("malloc failed");
		return -1;
1012 1013
	}

1014 1015 1016 1017 1018 1019 1020 1021 1022 1023 1024
	if (special_alt->new_len < special_alt->orig_len) {
		/*
		 * Insert a fake nop at the end to make the replacement
		 * alt_group the same size as the original.  This is needed to
		 * allow propagate_alt_cfi() to do its magic.  When the last
		 * instruction affects the stack, the instruction after it (the
		 * nop) will propagate the new state to the shared CFI array.
		 */
		nop = malloc(sizeof(*nop));
		if (!nop) {
			WARN("malloc failed");
1025 1026
			return -1;
		}
1027 1028 1029 1030 1031 1032 1033 1034 1035 1036 1037 1038
		memset(nop, 0, sizeof(*nop));
		INIT_LIST_HEAD(&nop->alts);
		INIT_LIST_HEAD(&nop->stack_ops);
		init_cfi_state(&nop->cfi);

		nop->sec = special_alt->new_sec;
		nop->offset = special_alt->new_off + special_alt->new_len;
		nop->len = special_alt->orig_len - special_alt->new_len;
		nop->type = INSN_NOP;
		nop->func = orig_insn->func;
		nop->alt_group = new_alt_group;
		nop->ignore = orig_insn->ignore_alts;
1039 1040
	}

1041 1042 1043
	if (!special_alt->new_len) {
		*new_insn = nop;
		goto end;
1044 1045
	}

1046 1047
	insn = *new_insn;
	sec_for_each_insn_from(file, insn) {
1048 1049
		struct reloc *alt_reloc;

1050 1051 1052 1053 1054
		if (insn->offset >= special_alt->new_off + special_alt->new_len)
			break;

		last_new_insn = insn;

1055
		insn->ignore = orig_insn->ignore_alts;
1056
		insn->func = orig_insn->func;
1057
		insn->alt_group = new_alt_group;
1058

1059 1060 1061 1062 1063 1064 1065 1066
		/*
		 * Since alternative replacement code is copy/pasted by the
		 * kernel after applying relocations, generally such code can't
		 * have relative-address relocation references to outside the
		 * .altinstr_replacement section, unless the arch's
		 * alternatives code can adjust the relative offsets
		 * accordingly.
		 */
1067 1068 1069 1070
		alt_reloc = find_reloc_by_dest_range(file->elf, insn->sec,
						   insn->offset, insn->len);
		if (alt_reloc &&
		    !arch_support_alt_relocation(special_alt, insn, alt_reloc)) {
1071 1072 1073 1074 1075 1076

			WARN_FUNC("unsupported relocation in alternatives section",
				  insn->sec, insn->offset);
			return -1;
		}

1077
		if (!is_static_jump(insn))
1078 1079 1080 1081 1082
			continue;

		if (!insn->immediate)
			continue;

1083
		dest_off = arch_jump_destination(insn);
1084 1085
		if (dest_off == special_alt->new_off + special_alt->new_len)
			insn->jump_dest = next_insn_same_sec(file, last_orig_insn);
1086 1087 1088 1089 1090 1091 1092 1093 1094 1095 1096 1097 1098 1099

		if (!insn->jump_dest) {
			WARN_FUNC("can't find alternative jump destination",
				  insn->sec, insn->offset);
			return -1;
		}
	}

	if (!last_new_insn) {
		WARN_FUNC("can't find last new alternative instruction",
			  special_alt->new_sec, special_alt->new_off);
		return -1;
	}

1100 1101 1102
	if (nop)
		list_add(&nop->list, &last_new_insn->list);
end:
1103 1104
	new_alt_group->orig_group = orig_alt_group;
	new_alt_group->first_insn = *new_insn;
1105 1106
	new_alt_group->last_insn = nop ? : last_new_insn;
	new_alt_group->cfi = orig_alt_group->cfi;
1107 1108 1109 1110 1111 1112 1113 1114 1115 1116 1117 1118 1119 1120 1121 1122 1123 1124 1125 1126 1127 1128 1129 1130 1131 1132 1133 1134 1135 1136 1137 1138 1139 1140 1141 1142 1143 1144 1145 1146 1147 1148 1149 1150 1151 1152 1153 1154 1155 1156 1157 1158 1159 1160 1161 1162 1163 1164 1165 1166 1167 1168 1169 1170 1171 1172 1173 1174 1175
	return 0;
}

/*
 * A jump table entry can either convert a nop to a jump or a jump to a nop.
 * If the original instruction is a jump, make the alt entry an effective nop
 * by just skipping the original instruction.
 */
static int handle_jump_alt(struct objtool_file *file,
			   struct special_alt *special_alt,
			   struct instruction *orig_insn,
			   struct instruction **new_insn)
{
	if (orig_insn->type == INSN_NOP)
		return 0;

	if (orig_insn->type != INSN_JUMP_UNCONDITIONAL) {
		WARN_FUNC("unsupported instruction at jump label",
			  orig_insn->sec, orig_insn->offset);
		return -1;
	}

	*new_insn = list_next_entry(orig_insn, list);
	return 0;
}

/*
 * Read all the special sections which have alternate instructions which can be
 * patched in or redirected to at runtime.  Each instruction having alternate
 * instruction(s) has them added to its insn->alts list, which will be
 * traversed in validate_branch().
 */
static int add_special_section_alts(struct objtool_file *file)
{
	struct list_head special_alts;
	struct instruction *orig_insn, *new_insn;
	struct special_alt *special_alt, *tmp;
	struct alternative *alt;
	int ret;

	ret = special_get_alts(file->elf, &special_alts);
	if (ret)
		return ret;

	list_for_each_entry_safe(special_alt, tmp, &special_alts, list) {

		orig_insn = find_insn(file, special_alt->orig_sec,
				      special_alt->orig_off);
		if (!orig_insn) {
			WARN_FUNC("special: can't find orig instruction",
				  special_alt->orig_sec, special_alt->orig_off);
			ret = -1;
			goto out;
		}

		new_insn = NULL;
		if (!special_alt->group || special_alt->new_len) {
			new_insn = find_insn(file, special_alt->new_sec,
					     special_alt->new_off);
			if (!new_insn) {
				WARN_FUNC("special: can't find new instruction",
					  special_alt->new_sec,
					  special_alt->new_off);
				ret = -1;
				goto out;
			}
		}

		if (special_alt->group) {
1176 1177 1178 1179 1180 1181
			if (!special_alt->orig_len) {
				WARN_FUNC("empty alternative entry",
					  orig_insn->sec, orig_insn->offset);
				continue;
			}

1182 1183 1184 1185 1186 1187 1188 1189 1190 1191 1192
			ret = handle_group_alt(file, special_alt, orig_insn,
					       &new_insn);
			if (ret)
				goto out;
		} else if (special_alt->jump_or_nop) {
			ret = handle_jump_alt(file, special_alt, orig_insn,
					      &new_insn);
			if (ret)
				goto out;
		}

1193 1194 1195 1196 1197 1198 1199
		alt = malloc(sizeof(*alt));
		if (!alt) {
			WARN("malloc failed");
			ret = -1;
			goto out;
		}

1200
		alt->insn = new_insn;
1201
		alt->skip_orig = special_alt->skip_orig;
1202
		orig_insn->ignore_alts |= special_alt->skip_alt;
1203 1204 1205 1206 1207 1208 1209 1210 1211 1212
		list_add_tail(&alt->list, &orig_insn->alts);

		list_del(&special_alt->list);
		free(special_alt);
	}

out:
	return ret;
}

1213
static int add_jump_table(struct objtool_file *file, struct instruction *insn,
1214
			    struct reloc *table)
1215
{
1216
	struct reloc *reloc = table;
1217
	struct instruction *dest_insn;
1218
	struct alternative *alt;
1219 1220
	struct symbol *pfunc = insn->func->pfunc;
	unsigned int prev_offset = 0;
1221

1222
	/*
1223
	 * Each @reloc is a switch table relocation which points to the target
1224 1225
	 * instruction.
	 */
1226
	list_for_each_entry_from(reloc, &table->sec->reloc_list, list) {
1227 1228

		/* Check for the end of the table: */
1229
		if (reloc != table && reloc->jump_table_start)
1230 1231
			break;

1232
		/* Make sure the table entries are consecutive: */
1233
		if (prev_offset && reloc->offset != prev_offset + 8)
1234 1235 1236
			break;

		/* Detect function pointers from contiguous objects: */
1237 1238
		if (reloc->sym->sec == pfunc->sec &&
		    reloc->addend == pfunc->offset)
1239 1240
			break;

1241
		dest_insn = find_insn(file, reloc->sym->sec, reloc->addend);
1242
		if (!dest_insn)
1243 1244
			break;

1245
		/* Make sure the destination is in the same function: */
1246
		if (!dest_insn->func || dest_insn->func->pfunc != pfunc)
1247
			break;
1248 1249 1250 1251 1252 1253 1254

		alt = malloc(sizeof(*alt));
		if (!alt) {
			WARN("malloc failed");
			return -1;
		}

1255
		alt->insn = dest_insn;
1256
		list_add_tail(&alt->list, &insn->alts);
1257
		prev_offset = reloc->offset;
1258 1259 1260 1261 1262 1263
	}

	if (!prev_offset) {
		WARN_FUNC("can't find switch jump table",
			  insn->sec, insn->offset);
		return -1;
1264 1265 1266 1267 1268 1269
	}

	return 0;
}

/*
1270 1271
 * find_jump_table() - Given a dynamic jump, find the switch jump table
 * associated with it.
1272
 */
1273
static struct reloc *find_jump_table(struct objtool_file *file,
1274 1275 1276
				      struct symbol *func,
				      struct instruction *insn)
{
1277
	struct reloc *table_reloc;
1278
	struct instruction *dest_insn, *orig_insn = insn;
1279

1280 1281 1282 1283 1284
	/*
	 * Backward search using the @first_jump_src links, these help avoid
	 * much of the 'in between' code. Which avoids us getting confused by
	 * it.
	 */
1285
	for (;
1286 1287
	     insn && insn->func && insn->func->pfunc == func;
	     insn = insn->first_jump_src ?: prev_insn_same_sym(file, insn)) {
1288

1289
		if (insn != orig_insn && insn->type == INSN_JUMP_DYNAMIC)
1290 1291 1292 1293 1294 1295 1296 1297 1298
			break;

		/* allow small jumps within the range */
		if (insn->type == INSN_JUMP_UNCONDITIONAL &&
		    insn->jump_dest &&
		    (insn->jump_dest->offset <= insn->offset ||
		     insn->jump_dest->offset > orig_insn->offset))
		    break;

1299
		table_reloc = arch_find_switch_table(file, insn);
1300
		if (!table_reloc)
1301
			continue;
1302
		dest_insn = find_insn(file, table_reloc->sym->sec, table_reloc->addend);
1303 1304
		if (!dest_insn || !dest_insn->func || dest_insn->func->pfunc != func)
			continue;
1305

1306
		return table_reloc;
1307 1308 1309 1310 1311
	}

	return NULL;
}

1312 1313 1314 1315 1316 1317
/*
 * First pass: Mark the head of each jump table so that in the next pass,
 * we know when a given jump table ends and the next one starts.
 */
static void mark_func_jump_tables(struct objtool_file *file,
				    struct symbol *func)
1318
{
1319
	struct instruction *insn, *last = NULL;
1320
	struct reloc *reloc;
1321

1322
	func_for_each_insn(file, func, insn) {
1323 1324 1325 1326 1327
		if (!last)
			last = insn;

		/*
		 * Store back-pointers for unconditional forward jumps such
1328
		 * that find_jump_table() can back-track using those and
1329 1330 1331 1332 1333 1334 1335 1336 1337 1338 1339
		 * avoid some potentially confusing code.
		 */
		if (insn->type == INSN_JUMP_UNCONDITIONAL && insn->jump_dest &&
		    insn->offset > last->offset &&
		    insn->jump_dest->offset > insn->offset &&
		    !insn->jump_dest->first_jump_src) {

			insn->jump_dest->first_jump_src = insn;
			last = insn->jump_dest;
		}

1340 1341 1342
		if (insn->type != INSN_JUMP_DYNAMIC)
			continue;

1343 1344 1345 1346
		reloc = find_jump_table(file, func, insn);
		if (reloc) {
			reloc->jump_table_start = true;
			insn->jump_table = reloc;
1347 1348
		}
	}
1349 1350 1351 1352 1353 1354 1355 1356
}

static int add_func_jump_tables(struct objtool_file *file,
				  struct symbol *func)
{
	struct instruction *insn;
	int ret;

1357
	func_for_each_insn(file, func, insn) {
1358 1359
		if (!insn->jump_table)
			continue;
1360

1361
		ret = add_jump_table(file, insn, insn->jump_table);
1362 1363 1364 1365 1366 1367 1368 1369 1370 1371 1372 1373
		if (ret)
			return ret;
	}

	return 0;
}

/*
 * For some switch statements, gcc generates a jump table in the .rodata
 * section which contains a list of addresses within the function to jump to.
 * This finds these jump tables and adds them to the insn->alts lists.
 */
1374
static int add_jump_table_alts(struct objtool_file *file)
1375 1376 1377 1378 1379
{
	struct section *sec;
	struct symbol *func;
	int ret;

1380
	if (!file->rodata)
1381 1382
		return 0;

1383
	for_each_sec(file, sec) {
1384 1385 1386 1387
		list_for_each_entry(func, &sec->symbol_list, list) {
			if (func->type != STT_FUNC)
				continue;

1388
			mark_func_jump_tables(file, func);
1389
			ret = add_func_jump_tables(file, func);
1390 1391 1392 1393 1394 1395 1396 1397
			if (ret)
				return ret;
		}
	}

	return 0;
}

1398 1399
static int read_unwind_hints(struct objtool_file *file)
{
1400 1401
	struct section *sec, *relocsec;
	struct reloc *reloc;
1402 1403 1404 1405 1406 1407 1408 1409 1410
	struct unwind_hint *hint;
	struct instruction *insn;
	struct cfi_reg *cfa;
	int i;

	sec = find_section_by_name(file->elf, ".discard.unwind_hints");
	if (!sec)
		return 0;

1411 1412
	relocsec = sec->reloc;
	if (!relocsec) {
1413 1414 1415 1416 1417 1418 1419 1420 1421 1422 1423 1424 1425 1426
		WARN("missing .rela.discard.unwind_hints section");
		return -1;
	}

	if (sec->len % sizeof(struct unwind_hint)) {
		WARN("struct unwind_hint size mismatch");
		return -1;
	}

	file->hints = true;

	for (i = 0; i < sec->len / sizeof(struct unwind_hint); i++) {
		hint = (struct unwind_hint *)sec->data->d_buf + i;

1427 1428 1429
		reloc = find_reloc_by_dest(file->elf, sec, i * sizeof(*hint));
		if (!reloc) {
			WARN("can't find reloc for unwind_hints[%d]", i);
1430 1431 1432
			return -1;
		}

1433
		insn = find_insn(file, reloc->sym->sec, reloc->addend);
1434 1435 1436 1437 1438
		if (!insn) {
			WARN("can't find insn for unwind_hints[%d]", i);
			return -1;
		}

1439
		cfa = &insn->cfi.cfa;
1440

1441
		if (hint->type == UNWIND_HINT_TYPE_RET_OFFSET) {
1442
			insn->ret_offset = bswap_if_needed(hint->sp_offset);
1443 1444 1445 1446 1447
			continue;
		}

		insn->hint = true;

1448
		if (arch_decode_hint_reg(insn, hint->sp_reg)) {
1449 1450 1451 1452 1453
			WARN_FUNC("unsupported unwind_hint sp base reg %d",
				  insn->sec, insn->offset, hint->sp_reg);
			return -1;
		}

1454
		cfa->offset = bswap_if_needed(hint->sp_offset);
1455 1456
		insn->cfi.type = hint->type;
		insn->cfi.end = hint->end;
1457 1458 1459 1460 1461
	}

	return 0;
}

1462 1463
static int read_retpoline_hints(struct objtool_file *file)
{
Josh Poimboeuf's avatar
Josh Poimboeuf committed
1464
	struct section *sec;
1465
	struct instruction *insn;
1466
	struct reloc *reloc;
1467

Josh Poimboeuf's avatar
Josh Poimboeuf committed
1468
	sec = find_section_by_name(file->elf, ".rela.discard.retpoline_safe");
1469 1470 1471
	if (!sec)
		return 0;

1472 1473
	list_for_each_entry(reloc, &sec->reloc_list, list) {
		if (reloc->sym->type != STT_SECTION) {
Josh Poimboeuf's avatar
Josh Poimboeuf committed
1474
			WARN("unexpected relocation symbol type in %s", sec->name);
1475 1476 1477
			return -1;
		}

1478
		insn = find_insn(file, reloc->sym->sec, reloc->addend);
1479
		if (!insn) {
Josh Poimboeuf's avatar
Josh Poimboeuf committed
1480
			WARN("bad .discard.retpoline_safe entry");
1481 1482 1483 1484 1485
			return -1;
		}

		if (insn->type != INSN_JUMP_DYNAMIC &&
		    insn->type != INSN_CALL_DYNAMIC) {
Josh Poimboeuf's avatar
Josh Poimboeuf committed
1486
			WARN_FUNC("retpoline_safe hint not an indirect jump/call",
1487 1488 1489 1490 1491 1492 1493 1494 1495 1496
				  insn->sec, insn->offset);
			return -1;
		}

		insn->retpoline_safe = true;
	}

	return 0;
}

1497 1498 1499 1500
static int read_instr_hints(struct objtool_file *file)
{
	struct section *sec;
	struct instruction *insn;
1501
	struct reloc *reloc;
1502 1503 1504 1505 1506

	sec = find_section_by_name(file->elf, ".rela.discard.instr_end");
	if (!sec)
		return 0;

1507 1508
	list_for_each_entry(reloc, &sec->reloc_list, list) {
		if (reloc->sym->type != STT_SECTION) {
1509 1510 1511 1512
			WARN("unexpected relocation symbol type in %s", sec->name);
			return -1;
		}

1513
		insn = find_insn(file, reloc->sym->sec, reloc->addend);
1514 1515 1516 1517 1518 1519 1520 1521 1522 1523 1524 1525
		if (!insn) {
			WARN("bad .discard.instr_end entry");
			return -1;
		}

		insn->instr--;
	}

	sec = find_section_by_name(file->elf, ".rela.discard.instr_begin");
	if (!sec)
		return 0;

1526 1527
	list_for_each_entry(reloc, &sec->reloc_list, list) {
		if (reloc->sym->type != STT_SECTION) {
1528 1529 1530 1531
			WARN("unexpected relocation symbol type in %s", sec->name);
			return -1;
		}

1532
		insn = find_insn(file, reloc->sym->sec, reloc->addend);
1533 1534 1535 1536 1537 1538 1539 1540 1541 1542 1543
		if (!insn) {
			WARN("bad .discard.instr_begin entry");
			return -1;
		}

		insn->instr++;
	}

	return 0;
}

1544 1545 1546 1547
static int read_intra_function_calls(struct objtool_file *file)
{
	struct instruction *insn;
	struct section *sec;
1548
	struct reloc *reloc;
1549 1550 1551 1552 1553

	sec = find_section_by_name(file->elf, ".rela.discard.intra_function_calls");
	if (!sec)
		return 0;

1554
	list_for_each_entry(reloc, &sec->reloc_list, list) {
1555 1556
		unsigned long dest_off;

1557
		if (reloc->sym->type != STT_SECTION) {
1558 1559 1560 1561 1562
			WARN("unexpected relocation symbol type in %s",
			     sec->name);
			return -1;
		}

1563
		insn = find_insn(file, reloc->sym->sec, reloc->addend);
1564 1565 1566 1567 1568 1569 1570 1571 1572 1573 1574 1575 1576 1577 1578 1579 1580 1581 1582 1583 1584 1585 1586 1587 1588 1589 1590 1591 1592 1593 1594
		if (!insn) {
			WARN("bad .discard.intra_function_call entry");
			return -1;
		}

		if (insn->type != INSN_CALL) {
			WARN_FUNC("intra_function_call not a direct call",
				  insn->sec, insn->offset);
			return -1;
		}

		/*
		 * Treat intra-function CALLs as JMPs, but with a stack_op.
		 * See add_call_destinations(), which strips stack_ops from
		 * normal CALLs.
		 */
		insn->type = INSN_JUMP_UNCONDITIONAL;

		dest_off = insn->offset + insn->len + insn->immediate;
		insn->jump_dest = find_insn(file, insn->sec, dest_off);
		if (!insn->jump_dest) {
			WARN_FUNC("can't find call dest at %s+0x%lx",
				  insn->sec, insn->offset,
				  insn->sec->name, dest_off);
			return -1;
		}
	}

	return 0;
}

1595 1596 1597 1598 1599 1600 1601 1602 1603 1604 1605 1606 1607 1608 1609 1610 1611
static int read_static_call_tramps(struct objtool_file *file)
{
	struct section *sec;
	struct symbol *func;

	for_each_sec(file, sec) {
		list_for_each_entry(func, &sec->symbol_list, list) {
			if (func->bind == STB_GLOBAL &&
			    !strncmp(func->name, STATIC_CALL_TRAMP_PREFIX_STR,
				     strlen(STATIC_CALL_TRAMP_PREFIX_STR)))
				func->static_call_tramp = true;
		}
	}

	return 0;
}

1612 1613 1614 1615 1616 1617
static void mark_rodata(struct objtool_file *file)
{
	struct section *sec;
	bool found = false;

	/*
1618 1619 1620 1621 1622 1623 1624 1625
	 * Search for the following rodata sections, each of which can
	 * potentially contain jump tables:
	 *
	 * - .rodata: can contain GCC switch tables
	 * - .rodata.<func>: same, if -fdata-sections is being used
	 * - .rodata..c_jump_table: contains C annotated jump tables
	 *
	 * .rodata.str1.* sections are ignored; they don't contain jump tables.
1626 1627
	 */
	for_each_sec(file, sec) {
1628 1629
		if (!strncmp(sec->name, ".rodata", 7) &&
		    !strstr(sec->name, ".str1.")) {
1630 1631 1632 1633 1634 1635 1636 1637
			sec->rodata = true;
			found = true;
		}
	}

	file->rodata = found;
}

1638 1639 1640 1641
static int decode_sections(struct objtool_file *file)
{
	int ret;

1642 1643
	mark_rodata(file);

1644 1645 1646 1647 1648 1649 1650 1651 1652
	ret = decode_instructions(file);
	if (ret)
		return ret;

	ret = add_dead_ends(file);
	if (ret)
		return ret;

	add_ignores(file);
1653
	add_uaccess_safe(file);
1654

1655
	ret = add_ignore_alternatives(file);
1656 1657 1658
	if (ret)
		return ret;

1659 1660 1661 1662
	ret = read_static_call_tramps(file);
	if (ret)
		return ret;

1663 1664 1665 1666
	ret = add_jump_destinations(file);
	if (ret)
		return ret;

1667
	ret = add_special_section_alts(file);
1668 1669 1670
	if (ret)
		return ret;

1671 1672 1673 1674
	ret = read_intra_function_calls(file);
	if (ret)
		return ret;

1675
	ret = add_call_destinations(file);
1676 1677 1678
	if (ret)
		return ret;

1679
	ret = add_jump_table_alts(file);
1680 1681 1682
	if (ret)
		return ret;

1683 1684 1685 1686
	ret = read_unwind_hints(file);
	if (ret)
		return ret;

1687 1688 1689 1690
	ret = read_retpoline_hints(file);
	if (ret)
		return ret;

1691 1692 1693 1694
	ret = read_instr_hints(file);
	if (ret)
		return ret;

1695 1696 1697 1698 1699
	return 0;
}

static bool is_fentry_call(struct instruction *insn)
{
1700
	if (insn->type == INSN_CALL && insn->call_dest &&
1701 1702 1703 1704 1705 1706 1707
	    insn->call_dest->type == STT_NOTYPE &&
	    !strcmp(insn->call_dest->name, "__fentry__"))
		return true;

	return false;
}

1708
static bool has_modified_stack_frame(struct instruction *insn, struct insn_state *state)
1709
{
1710
	u8 ret_offset = insn->ret_offset;
1711
	struct cfi_state *cfi = &state->cfi;
1712 1713
	int i;

1714
	if (cfi->cfa.base != initial_func_cfi.cfa.base || cfi->drap)
1715 1716
		return true;

1717
	if (cfi->cfa.offset != initial_func_cfi.cfa.offset + ret_offset)
1718 1719
		return true;

1720
	if (cfi->stack_size != initial_func_cfi.cfa.offset + ret_offset)
1721 1722
		return true;

1723 1724 1725 1726 1727 1728 1729 1730
	/*
	 * If there is a ret offset hint then don't check registers
	 * because a callee-saved register might have been pushed on
	 * the stack.
	 */
	if (ret_offset)
		return false;

1731
	for (i = 0; i < CFI_NUM_REGS; i++) {
1732 1733
		if (cfi->regs[i].base != initial_func_cfi.regs[i].base ||
		    cfi->regs[i].offset != initial_func_cfi.regs[i].offset)
1734
			return true;
1735
	}
1736 1737 1738 1739

	return false;
}

1740 1741 1742 1743 1744 1745 1746
static bool check_reg_frame_pos(const struct cfi_reg *reg,
				int expected_offset)
{
	return reg->base == CFI_CFA &&
	       reg->offset == expected_offset;
}

1747 1748
static bool has_valid_stack_frame(struct insn_state *state)
{
1749 1750
	struct cfi_state *cfi = &state->cfi;

1751 1752 1753
	if (cfi->cfa.base == CFI_BP &&
	    check_reg_frame_pos(&cfi->regs[CFI_BP], -cfi->cfa.offset) &&
	    check_reg_frame_pos(&cfi->regs[CFI_RA], -cfi->cfa.offset + 8))
1754 1755
		return true;

1756
	if (cfi->drap && cfi->regs[CFI_BP].base == CFI_BP)
1757 1758 1759
		return true;

	return false;
1760 1761
}

1762 1763
static int update_cfi_state_regs(struct instruction *insn,
				  struct cfi_state *cfi,
1764
				  struct stack_op *op)
1765
{
1766
	struct cfi_reg *cfa = &cfi->cfa;
1767

1768
	if (cfa->base != CFI_SP && cfa->base != CFI_SP_INDIRECT)
1769 1770 1771
		return 0;

	/* push */
1772
	if (op->dest.type == OP_DEST_PUSH || op->dest.type == OP_DEST_PUSHF)
1773 1774 1775
		cfa->offset += 8;

	/* pop */
1776
	if (op->src.type == OP_SRC_POP || op->src.type == OP_SRC_POPF)
1777 1778 1779 1780 1781 1782 1783 1784 1785 1786
		cfa->offset -= 8;

	/* add immediate to sp */
	if (op->dest.type == OP_DEST_REG && op->src.type == OP_SRC_ADD &&
	    op->dest.reg == CFI_SP && op->src.reg == CFI_SP)
		cfa->offset -= op->src.offset;

	return 0;
}

1787
static void save_reg(struct cfi_state *cfi, unsigned char reg, int base, int offset)
1788
{
1789
	if (arch_callee_saved_reg(reg) &&
1790 1791 1792
	    cfi->regs[reg].base == CFI_UNDEFINED) {
		cfi->regs[reg].base = base;
		cfi->regs[reg].offset = offset;
1793
	}
1794 1795
}

1796
static void restore_reg(struct cfi_state *cfi, unsigned char reg)
1797
{
1798 1799
	cfi->regs[reg].base = initial_func_cfi.regs[reg].base;
	cfi->regs[reg].offset = initial_func_cfi.regs[reg].offset;
1800 1801 1802 1803 1804 1805 1806 1807 1808 1809 1810 1811 1812 1813 1814 1815 1816 1817 1818 1819 1820 1821 1822 1823 1824 1825 1826 1827 1828 1829 1830 1831 1832 1833 1834 1835 1836 1837 1838 1839 1840 1841 1842 1843 1844 1845 1846 1847 1848 1849 1850 1851 1852 1853 1854
}

/*
 * A note about DRAP stack alignment:
 *
 * GCC has the concept of a DRAP register, which is used to help keep track of
 * the stack pointer when aligning the stack.  r10 or r13 is used as the DRAP
 * register.  The typical DRAP pattern is:
 *
 *   4c 8d 54 24 08		lea    0x8(%rsp),%r10
 *   48 83 e4 c0		and    $0xffffffffffffffc0,%rsp
 *   41 ff 72 f8		pushq  -0x8(%r10)
 *   55				push   %rbp
 *   48 89 e5			mov    %rsp,%rbp
 *				(more pushes)
 *   41 52			push   %r10
 *				...
 *   41 5a			pop    %r10
 *				(more pops)
 *   5d				pop    %rbp
 *   49 8d 62 f8		lea    -0x8(%r10),%rsp
 *   c3				retq
 *
 * There are some variations in the epilogues, like:
 *
 *   5b				pop    %rbx
 *   41 5a			pop    %r10
 *   41 5c			pop    %r12
 *   41 5d			pop    %r13
 *   41 5e			pop    %r14
 *   c9				leaveq
 *   49 8d 62 f8		lea    -0x8(%r10),%rsp
 *   c3				retq
 *
 * and:
 *
 *   4c 8b 55 e8		mov    -0x18(%rbp),%r10
 *   48 8b 5d e0		mov    -0x20(%rbp),%rbx
 *   4c 8b 65 f0		mov    -0x10(%rbp),%r12
 *   4c 8b 6d f8		mov    -0x8(%rbp),%r13
 *   c9				leaveq
 *   49 8d 62 f8		lea    -0x8(%r10),%rsp
 *   c3				retq
 *
 * Sometimes r13 is used as the DRAP register, in which case it's saved and
 * restored beforehand:
 *
 *   41 55			push   %r13
 *   4c 8d 6c 24 10		lea    0x10(%rsp),%r13
 *   48 83 e4 f0		and    $0xfffffffffffffff0,%rsp
 *				...
 *   49 8d 65 f0		lea    -0x10(%r13),%rsp
 *   41 5d			pop    %r13
 *   c3				retq
 */
1855
static int update_cfi_state(struct instruction *insn, struct cfi_state *cfi,
1856
			     struct stack_op *op)
1857
{
1858 1859
	struct cfi_reg *cfa = &cfi->cfa;
	struct cfi_reg *regs = cfi->regs;
1860 1861 1862 1863 1864 1865 1866 1867 1868 1869

	/* stack operations don't make sense with an undefined CFA */
	if (cfa->base == CFI_UNDEFINED) {
		if (insn->func) {
			WARN_FUNC("undefined stack state", insn->sec, insn->offset);
			return -1;
		}
		return 0;
	}

1870 1871
	if (cfi->type == UNWIND_HINT_TYPE_REGS ||
	    cfi->type == UNWIND_HINT_TYPE_REGS_PARTIAL)
1872
		return update_cfi_state_regs(insn, cfi, op);
1873

1874 1875 1876 1877 1878 1879
	switch (op->dest.type) {

	case OP_DEST_REG:
		switch (op->src.type) {

		case OP_SRC_REG:
1880 1881
			if (op->src.reg == CFI_SP && op->dest.reg == CFI_BP &&
			    cfa->base == CFI_SP &&
1882
			    check_reg_frame_pos(&regs[CFI_BP], -cfa->offset)) {
1883 1884 1885

				/* mov %rsp, %rbp */
				cfa->base = op->dest.reg;
1886
				cfi->bp_scratch = false;
1887
			}
1888

1889
			else if (op->src.reg == CFI_SP &&
1890
				 op->dest.reg == CFI_BP && cfi->drap) {
1891

1892 1893
				/* drap: mov %rsp, %rbp */
				regs[CFI_BP].base = CFI_BP;
1894 1895
				regs[CFI_BP].offset = -cfi->stack_size;
				cfi->bp_scratch = false;
1896
			}
1897

1898 1899 1900 1901 1902 1903 1904 1905 1906 1907 1908 1909
			else if (op->src.reg == CFI_SP && cfa->base == CFI_SP) {

				/*
				 * mov %rsp, %reg
				 *
				 * This is needed for the rare case where GCC
				 * does:
				 *
				 *   mov    %rsp, %rax
				 *   ...
				 *   mov    %rax, %rsp
				 */
1910 1911
				cfi->vals[op->dest.reg].base = CFI_CFA;
				cfi->vals[op->dest.reg].offset = -cfi->stack_size;
1912 1913
			}

1914 1915 1916 1917 1918 1919 1920 1921
			else if (op->src.reg == CFI_BP && op->dest.reg == CFI_SP &&
				 cfa->base == CFI_BP) {

				/*
				 * mov %rbp, %rsp
				 *
				 * Restore the original stack pointer (Clang).
				 */
1922
				cfi->stack_size = -cfi->regs[CFI_BP].offset;
1923 1924
			}

1925 1926 1927 1928
			else if (op->dest.reg == cfa->base) {

				/* mov %reg, %rsp */
				if (cfa->base == CFI_SP &&
1929
				    cfi->vals[op->src.reg].base == CFI_CFA) {
1930 1931 1932 1933 1934 1935 1936 1937 1938

					/*
					 * This is needed for the rare case
					 * where GCC does something dumb like:
					 *
					 *   lea    0x8(%rsp), %rcx
					 *   ...
					 *   mov    %rcx, %rsp
					 */
1939 1940
					cfa->offset = -cfi->vals[op->src.reg].offset;
					cfi->stack_size = cfa->offset;
1941 1942 1943 1944 1945

				} else {
					cfa->base = CFI_UNDEFINED;
					cfa->offset = 0;
				}
1946 1947 1948 1949 1950 1951 1952 1953
			}

			break;

		case OP_SRC_ADD:
			if (op->dest.reg == CFI_SP && op->src.reg == CFI_SP) {

				/* add imm, %rsp */
1954
				cfi->stack_size -= op->src.offset;
1955 1956 1957 1958 1959 1960 1961 1962
				if (cfa->base == CFI_SP)
					cfa->offset -= op->src.offset;
				break;
			}

			if (op->dest.reg == CFI_SP && op->src.reg == CFI_BP) {

				/* lea disp(%rbp), %rsp */
1963
				cfi->stack_size = -(op->src.offset + regs[CFI_BP].offset);
1964 1965 1966
				break;
			}

1967 1968 1969 1970 1971 1972 1973 1974 1975 1976 1977
			if (!cfi->drap && op->src.reg == CFI_SP &&
			    op->dest.reg == CFI_BP && cfa->base == CFI_SP &&
			    check_reg_frame_pos(&regs[CFI_BP], -cfa->offset + op->src.offset)) {

				/* lea disp(%rsp), %rbp */
				cfa->base = CFI_BP;
				cfa->offset -= op->src.offset;
				cfi->bp_scratch = false;
				break;
			}

1978
			if (op->src.reg == CFI_SP && cfa->base == CFI_SP) {
1979 1980

				/* drap: lea disp(%rsp), %drap */
1981
				cfi->drap_reg = op->dest.reg;
1982 1983 1984 1985 1986 1987 1988 1989 1990 1991 1992

				/*
				 * lea disp(%rsp), %reg
				 *
				 * This is needed for the rare case where GCC
				 * does something dumb like:
				 *
				 *   lea    0x8(%rsp), %rcx
				 *   ...
				 *   mov    %rcx, %rsp
				 */
1993 1994 1995
				cfi->vals[op->dest.reg].base = CFI_CFA;
				cfi->vals[op->dest.reg].offset = \
					-cfi->stack_size + op->src.offset;
1996

1997 1998 1999
				break;
			}

2000 2001
			if (cfi->drap && op->dest.reg == CFI_SP &&
			    op->src.reg == cfi->drap_reg) {
2002 2003 2004

				 /* drap: lea disp(%drap), %rsp */
				cfa->base = CFI_SP;
2005 2006 2007
				cfa->offset = cfi->stack_size = -op->src.offset;
				cfi->drap_reg = CFI_UNDEFINED;
				cfi->drap = false;
2008 2009 2010
				break;
			}

2011
			if (op->dest.reg == cfi->cfa.base) {
2012 2013 2014 2015 2016 2017 2018 2019 2020
				WARN_FUNC("unsupported stack register modification",
					  insn->sec, insn->offset);
				return -1;
			}

			break;

		case OP_SRC_AND:
			if (op->dest.reg != CFI_SP ||
2021 2022
			    (cfi->drap_reg != CFI_UNDEFINED && cfa->base != CFI_SP) ||
			    (cfi->drap_reg == CFI_UNDEFINED && cfa->base != CFI_BP)) {
2023 2024 2025 2026 2027
				WARN_FUNC("unsupported stack pointer realignment",
					  insn->sec, insn->offset);
				return -1;
			}

2028
			if (cfi->drap_reg != CFI_UNDEFINED) {
2029
				/* drap: and imm, %rsp */
2030 2031 2032
				cfa->base = cfi->drap_reg;
				cfa->offset = cfi->stack_size = 0;
				cfi->drap = true;
2033 2034 2035 2036 2037 2038 2039 2040 2041 2042
			}

			/*
			 * Older versions of GCC (4.8ish) realign the stack
			 * without DRAP, with a frame pointer.
			 */

			break;

		case OP_SRC_POP:
2043
		case OP_SRC_POPF:
2044
			if (!cfi->drap && op->dest.reg == cfa->base) {
2045 2046 2047 2048 2049

				/* pop %rbp */
				cfa->base = CFI_SP;
			}

2050 2051 2052
			if (cfi->drap && cfa->base == CFI_BP_INDIRECT &&
			    op->dest.reg == cfi->drap_reg &&
			    cfi->drap_offset == -cfi->stack_size) {
2053

2054
				/* drap: pop %drap */
2055
				cfa->base = cfi->drap_reg;
2056
				cfa->offset = 0;
2057
				cfi->drap_offset = -1;
2058

2059
			} else if (regs[op->dest.reg].offset == -cfi->stack_size) {
2060

2061
				/* pop %reg */
2062
				restore_reg(cfi, op->dest.reg);
2063 2064
			}

2065
			cfi->stack_size -= 8;
2066 2067 2068 2069 2070 2071
			if (cfa->base == CFI_SP)
				cfa->offset -= 8;

			break;

		case OP_SRC_REG_INDIRECT:
2072 2073 2074 2075 2076 2077 2078 2079
			if (!cfi->drap && op->dest.reg == cfa->base &&
			    op->dest.reg == CFI_BP) {

				/* mov disp(%rsp), %rbp */
				cfa->base = CFI_SP;
				cfa->offset = cfi->stack_size;
			}

2080 2081
			if (cfi->drap && op->src.reg == CFI_BP &&
			    op->src.offset == cfi->drap_offset) {
2082 2083

				/* drap: mov disp(%rbp), %drap */
2084
				cfa->base = cfi->drap_reg;
2085
				cfa->offset = 0;
2086
				cfi->drap_offset = -1;
2087 2088
			}

2089
			if (cfi->drap && op->src.reg == CFI_BP &&
2090 2091 2092
			    op->src.offset == regs[op->dest.reg].offset) {

				/* drap: mov disp(%rbp), %reg */
2093
				restore_reg(cfi, op->dest.reg);
2094 2095 2096 2097 2098 2099

			} else if (op->src.reg == cfa->base &&
			    op->src.offset == regs[op->dest.reg].offset + cfa->offset) {

				/* mov disp(%rbp), %reg */
				/* mov disp(%rsp), %reg */
2100
				restore_reg(cfi, op->dest.reg);
2101 2102 2103 2104 2105 2106

			} else if (op->src.reg == CFI_SP &&
				   op->src.offset == regs[op->dest.reg].offset + cfi->stack_size) {

				/* mov disp(%rsp), %reg */
				restore_reg(cfi, op->dest.reg);
2107 2108 2109 2110 2111 2112 2113 2114 2115 2116 2117 2118 2119
			}

			break;

		default:
			WARN_FUNC("unknown stack-related instruction",
				  insn->sec, insn->offset);
			return -1;
		}

		break;

	case OP_DEST_PUSH:
2120
	case OP_DEST_PUSHF:
2121
		cfi->stack_size += 8;
2122 2123 2124 2125 2126 2127
		if (cfa->base == CFI_SP)
			cfa->offset += 8;

		if (op->src.type != OP_SRC_REG)
			break;

2128 2129
		if (cfi->drap) {
			if (op->src.reg == cfa->base && op->src.reg == cfi->drap_reg) {
2130 2131 2132

				/* drap: push %drap */
				cfa->base = CFI_BP_INDIRECT;
2133
				cfa->offset = -cfi->stack_size;
2134

2135
				/* save drap so we know when to restore it */
2136
				cfi->drap_offset = -cfi->stack_size;
2137

2138
			} else if (op->src.reg == CFI_BP && cfa->base == cfi->drap_reg) {
2139 2140

				/* drap: push %rbp */
2141
				cfi->stack_size = 0;
2142

2143
			} else {
2144 2145

				/* drap: push %reg */
2146
				save_reg(cfi, op->src.reg, CFI_BP, -cfi->stack_size);
2147 2148 2149 2150 2151
			}

		} else {

			/* push %reg */
2152
			save_reg(cfi, op->src.reg, CFI_CFA, -cfi->stack_size);
2153 2154 2155
		}

		/* detect when asm code uses rbp as a scratch register */
2156
		if (!no_fp && insn->func && op->src.reg == CFI_BP &&
2157
		    cfa->base != CFI_BP)
2158
			cfi->bp_scratch = true;
2159 2160 2161 2162
		break;

	case OP_DEST_REG_INDIRECT:

2163 2164
		if (cfi->drap) {
			if (op->src.reg == cfa->base && op->src.reg == cfi->drap_reg) {
2165 2166 2167 2168 2169

				/* drap: mov %drap, disp(%rbp) */
				cfa->base = CFI_BP_INDIRECT;
				cfa->offset = op->dest.offset;

2170
				/* save drap offset so we know when to restore it */
2171
				cfi->drap_offset = op->dest.offset;
2172
			} else {
2173 2174

				/* drap: mov reg, disp(%rbp) */
2175
				save_reg(cfi, op->src.reg, CFI_BP, op->dest.offset);
2176 2177 2178 2179 2180 2181
			}

		} else if (op->dest.reg == cfa->base) {

			/* mov reg, disp(%rbp) */
			/* mov reg, disp(%rsp) */
2182 2183
			save_reg(cfi, op->src.reg, CFI_CFA,
				 op->dest.offset - cfi->cfa.offset);
2184 2185 2186 2187 2188 2189

		} else if (op->dest.reg == CFI_SP) {

			/* mov reg, disp(%rsp) */
			save_reg(cfi, op->src.reg, CFI_CFA,
				 op->dest.offset - cfi->stack_size);
2190 2191 2192 2193 2194
		}

		break;

	case OP_DEST_LEAVE:
2195 2196
		if ((!cfi->drap && cfa->base != CFI_BP) ||
		    (cfi->drap && cfa->base != cfi->drap_reg)) {
2197 2198 2199 2200 2201 2202 2203
			WARN_FUNC("leave instruction with modified stack frame",
				  insn->sec, insn->offset);
			return -1;
		}

		/* leave (mov %rbp, %rsp; pop %rbp) */

2204 2205
		cfi->stack_size = -cfi->regs[CFI_BP].offset - 8;
		restore_reg(cfi, CFI_BP);
2206

2207
		if (!cfi->drap) {
2208 2209 2210 2211 2212 2213 2214
			cfa->base = CFI_SP;
			cfa->offset -= 8;
		}

		break;

	case OP_DEST_MEM:
2215
		if (op->src.type != OP_SRC_POP && op->src.type != OP_SRC_POPF) {
2216 2217 2218 2219 2220 2221
			WARN_FUNC("unknown stack-related memory operation",
				  insn->sec, insn->offset);
			return -1;
		}

		/* pop mem */
2222
		cfi->stack_size -= 8;
2223 2224 2225 2226 2227 2228 2229 2230 2231 2232 2233 2234 2235 2236
		if (cfa->base == CFI_SP)
			cfa->offset -= 8;

		break;

	default:
		WARN_FUNC("unknown stack-related instruction",
			  insn->sec, insn->offset);
		return -1;
	}

	return 0;
}

2237 2238 2239 2240 2241 2242 2243 2244 2245 2246
/*
 * The stack layouts of alternatives instructions can sometimes diverge when
 * they have stack modifications.  That's fine as long as the potential stack
 * layouts don't conflict at any given potential instruction boundary.
 *
 * Flatten the CFIs of the different alternative code streams (both original
 * and replacement) into a single shared CFI array which can be used to detect
 * conflicts and nicely feed a linear array of ORC entries to the unwinder.
 */
static int propagate_alt_cfi(struct objtool_file *file, struct instruction *insn)
2247
{
2248 2249
	struct cfi_state **alt_cfi;
	int group_off;
2250

2251 2252
	if (!insn->alt_group)
		return 0;
2253

2254 2255
	alt_cfi = insn->alt_group->cfi;
	group_off = insn->offset - insn->alt_group->first_insn->offset;
2256

2257 2258 2259 2260 2261 2262
	if (!alt_cfi[group_off]) {
		alt_cfi[group_off] = &insn->cfi;
	} else {
		if (memcmp(alt_cfi[group_off], &insn->cfi, sizeof(struct cfi_state))) {
			WARN_FUNC("stack layout conflict in alternatives",
				  insn->sec, insn->offset);
2263 2264
			return -1;
		}
2265 2266 2267 2268 2269 2270 2271 2272 2273 2274 2275 2276 2277
	}

	return 0;
}

static int handle_insn_ops(struct instruction *insn, struct insn_state *state)
{
	struct stack_op *op;

	list_for_each_entry(op, &insn->stack_ops, list) {

		if (update_cfi_state(insn, &state->cfi, op))
			return 1;
2278

2279 2280 2281 2282 2283 2284 2285 2286 2287 2288 2289 2290 2291 2292 2293 2294 2295 2296 2297 2298 2299 2300 2301 2302 2303
		if (op->dest.type == OP_DEST_PUSHF) {
			if (!state->uaccess_stack) {
				state->uaccess_stack = 1;
			} else if (state->uaccess_stack >> 31) {
				WARN_FUNC("PUSHF stack exhausted",
					  insn->sec, insn->offset);
				return 1;
			}
			state->uaccess_stack <<= 1;
			state->uaccess_stack  |= state->uaccess;
		}

		if (op->src.type == OP_SRC_POPF) {
			if (state->uaccess_stack) {
				state->uaccess = state->uaccess_stack & 1;
				state->uaccess_stack >>= 1;
				if (state->uaccess_stack == 1)
					state->uaccess_stack = 0;
			}
		}
	}

	return 0;
}

2304
static bool insn_cfi_match(struct instruction *insn, struct cfi_state *cfi2)
2305
{
2306
	struct cfi_state *cfi1 = &insn->cfi;
2307 2308
	int i;

2309 2310
	if (memcmp(&cfi1->cfa, &cfi2->cfa, sizeof(cfi1->cfa))) {

2311 2312
		WARN_FUNC("stack state mismatch: cfa1=%d%+d cfa2=%d%+d",
			  insn->sec, insn->offset,
2313 2314
			  cfi1->cfa.base, cfi1->cfa.offset,
			  cfi2->cfa.base, cfi2->cfa.offset);
2315

2316
	} else if (memcmp(&cfi1->regs, &cfi2->regs, sizeof(cfi1->regs))) {
2317
		for (i = 0; i < CFI_NUM_REGS; i++) {
2318
			if (!memcmp(&cfi1->regs[i], &cfi2->regs[i],
2319 2320 2321 2322 2323
				    sizeof(struct cfi_reg)))
				continue;

			WARN_FUNC("stack state mismatch: reg1[%d]=%d%+d reg2[%d]=%d%+d",
				  insn->sec, insn->offset,
2324 2325
				  i, cfi1->regs[i].base, cfi1->regs[i].offset,
				  i, cfi2->regs[i].base, cfi2->regs[i].offset);
2326 2327 2328
			break;
		}

2329 2330
	} else if (cfi1->type != cfi2->type) {

2331
		WARN_FUNC("stack state mismatch: type1=%d type2=%d",
2332 2333 2334 2335 2336
			  insn->sec, insn->offset, cfi1->type, cfi2->type);

	} else if (cfi1->drap != cfi2->drap ||
		   (cfi1->drap && cfi1->drap_reg != cfi2->drap_reg) ||
		   (cfi1->drap && cfi1->drap_offset != cfi2->drap_offset)) {
2337

2338
		WARN_FUNC("stack state mismatch: drap1=%d(%d,%d) drap2=%d(%d,%d)",
2339
			  insn->sec, insn->offset,
2340 2341
			  cfi1->drap, cfi1->drap_reg, cfi1->drap_offset,
			  cfi2->drap, cfi2->drap_reg, cfi2->drap_offset);
2342 2343 2344 2345 2346

	} else
		return true;

	return false;
2347 2348
}

2349 2350 2351
static inline bool func_uaccess_safe(struct symbol *func)
{
	if (func)
2352
		return func->uaccess_safe;
2353 2354 2355 2356

	return false;
}

2357
static inline const char *call_dest_name(struct instruction *insn)
2358 2359 2360 2361 2362 2363 2364
{
	if (insn->call_dest)
		return insn->call_dest->name;

	return "{dynamic}";
}

2365 2366 2367 2368 2369 2370 2371 2372 2373 2374 2375 2376 2377 2378 2379 2380 2381 2382 2383 2384 2385 2386 2387 2388 2389 2390
static inline bool noinstr_call_dest(struct symbol *func)
{
	/*
	 * We can't deal with indirect function calls at present;
	 * assume they're instrumented.
	 */
	if (!func)
		return false;

	/*
	 * If the symbol is from a noinstr section; we good.
	 */
	if (func->sec->noinstr)
		return true;

	/*
	 * The __ubsan_handle_*() calls are like WARN(), they only happen when
	 * something 'BAD' happened. At the risk of taking the machine down,
	 * let them proceed to get the message out.
	 */
	if (!strncmp(func->name, "__ubsan_handle_", 15))
		return true;

	return false;
}

2391 2392
static int validate_call(struct instruction *insn, struct insn_state *state)
{
2393
	if (state->noinstr && state->instr <= 0 &&
2394
	    !noinstr_call_dest(insn->call_dest)) {
2395 2396 2397 2398 2399
		WARN_FUNC("call to %s() leaves .noinstr.text section",
				insn->sec, insn->offset, call_dest_name(insn));
		return 1;
	}

2400 2401
	if (state->uaccess && !func_uaccess_safe(insn->call_dest)) {
		WARN_FUNC("call to %s() with UACCESS enabled",
2402
				insn->sec, insn->offset, call_dest_name(insn));
2403 2404 2405
		return 1;
	}

2406 2407
	if (state->df) {
		WARN_FUNC("call to %s() with DF set",
2408
				insn->sec, insn->offset, call_dest_name(insn));
2409 2410 2411
		return 1;
	}

2412 2413 2414
	return 0;
}

2415 2416
static int validate_sibling_call(struct instruction *insn, struct insn_state *state)
{
2417
	if (has_modified_stack_frame(insn, state)) {
2418 2419 2420 2421 2422
		WARN_FUNC("sibling call from callable instruction with modified stack frame",
				insn->sec, insn->offset);
		return 1;
	}

2423
	return validate_call(insn, state);
2424 2425
}

2426 2427
static int validate_return(struct symbol *func, struct instruction *insn, struct insn_state *state)
{
2428 2429 2430 2431 2432 2433
	if (state->noinstr && state->instr > 0) {
		WARN_FUNC("return with instrumentation enabled",
			  insn->sec, insn->offset);
		return 1;
	}

2434 2435 2436 2437 2438 2439 2440 2441 2442 2443 2444 2445 2446 2447 2448 2449 2450 2451
	if (state->uaccess && !func_uaccess_safe(func)) {
		WARN_FUNC("return with UACCESS enabled",
			  insn->sec, insn->offset);
		return 1;
	}

	if (!state->uaccess && func_uaccess_safe(func)) {
		WARN_FUNC("return with UACCESS disabled from a UACCESS-safe function",
			  insn->sec, insn->offset);
		return 1;
	}

	if (state->df) {
		WARN_FUNC("return with DF set",
			  insn->sec, insn->offset);
		return 1;
	}

2452
	if (func && has_modified_stack_frame(insn, state)) {
2453 2454 2455 2456 2457
		WARN_FUNC("return with modified stack frame",
			  insn->sec, insn->offset);
		return 1;
	}

2458
	if (state->cfi.bp_scratch) {
2459 2460
		WARN_FUNC("BP used as a scratch register",
			  insn->sec, insn->offset);
2461 2462 2463 2464 2465 2466
		return 1;
	}

	return 0;
}

2467 2468
static struct instruction *next_insn_to_validate(struct objtool_file *file,
						 struct instruction *insn)
2469
{
2470
	struct alt_group *alt_group = insn->alt_group;
2471

2472 2473 2474 2475 2476 2477 2478 2479 2480
	/*
	 * Simulate the fact that alternatives are patched in-place.  When the
	 * end of a replacement alt_group is reached, redirect objtool flow to
	 * the end of the original alt_group.
	 */
	if (alt_group && insn == alt_group->last_insn && alt_group->orig_group)
		return next_insn_same_sec(file, alt_group->orig_group->last_insn);

	return next_insn_same_sec(file, insn);
2481 2482
}

2483 2484 2485 2486 2487 2488
/*
 * Follow the branch starting at the given instruction, and recursively follow
 * any other branches (jumps).  Meanwhile, track the frame pointer state at
 * each instruction and validate all the rules described in
 * tools/objtool/Documentation/stack-validation.txt.
 */
2489
static int validate_branch(struct objtool_file *file, struct symbol *func,
2490
			   struct instruction *insn, struct insn_state state)
2491 2492
{
	struct alternative *alt;
2493
	struct instruction *next_insn;
2494
	struct section *sec;
2495
	u8 visited;
2496 2497 2498 2499 2500
	int ret;

	sec = insn->sec;

	while (1) {
2501
		next_insn = next_insn_to_validate(file, insn);
2502

2503
		if (file->c_file && func && insn->func && func != insn->func->pfunc) {
2504 2505 2506
			WARN("%s() falls through to next function %s()",
			     func->name, insn->func->name);
			return 1;
2507 2508
		}

2509 2510 2511
		if (func && insn->ignore) {
			WARN_FUNC("BUG: why am I validating an ignored function?",
				  sec, insn->offset);
2512
			return 1;
2513 2514
		}

2515
		visited = 1 << state.uaccess;
2516
		if (insn->visited) {
2517
			if (!insn->hint && !insn_cfi_match(insn, &state.cfi))
2518 2519
				return 1;

2520
			if (insn->visited & visited)
2521
				return 0;
2522 2523
		}

2524 2525 2526
		if (state.noinstr)
			state.instr += insn->instr;

2527
		if (insn->hint)
2528
			state.cfi = insn->cfi;
2529
		else
2530
			insn->cfi = state.cfi;
2531

2532
		insn->visited |= visited;
2533

2534 2535 2536
		if (propagate_alt_cfi(file, insn))
			return 1;

2537
		if (!insn->ignore_alts && !list_empty(&insn->alts)) {
2538 2539
			bool skip_orig = false;

2540
			list_for_each_entry(alt, &insn->alts, list) {
2541 2542 2543
				if (alt->skip_orig)
					skip_orig = true;

2544
				ret = validate_branch(file, func, alt->insn, state);
2545 2546 2547 2548 2549
				if (ret) {
					if (backtrace)
						BT_FUNC("(alt)", insn);
					return ret;
				}
2550
			}
2551 2552 2553

			if (skip_orig)
				return 0;
2554 2555
		}

2556 2557 2558
		if (handle_insn_ops(insn, &state))
			return 1;

2559 2560 2561
		switch (insn->type) {

		case INSN_RETURN:
2562
			return validate_return(func, insn, &state);
2563 2564

		case INSN_CALL:
2565 2566 2567 2568
		case INSN_CALL_DYNAMIC:
			ret = validate_call(insn, &state);
			if (ret)
				return ret;
2569

2570 2571
			if (!no_fp && func && !is_fentry_call(insn) &&
			    !has_valid_stack_frame(&state)) {
2572 2573 2574 2575
				WARN_FUNC("call without frame pointer save/setup",
					  sec, insn->offset);
				return 1;
			}
2576 2577 2578 2579

			if (dead_end_function(file, insn->call_dest))
				return 0;

2580 2581 2582 2583 2584
			if (insn->type == INSN_CALL && insn->call_dest->static_call_tramp) {
				list_add_tail(&insn->static_call_node,
					      &file->static_call_list);
			}

2585 2586 2587 2588
			break;

		case INSN_JUMP_CONDITIONAL:
		case INSN_JUMP_UNCONDITIONAL:
2589
			if (func && is_sibling_call(insn)) {
2590
				ret = validate_sibling_call(insn, &state);
2591
				if (ret)
2592
					return ret;
2593

2594
			} else if (insn->jump_dest) {
2595 2596
				ret = validate_branch(file, func,
						      insn->jump_dest, state);
2597 2598 2599 2600 2601
				if (ret) {
					if (backtrace)
						BT_FUNC("(branch)", insn);
					return ret;
				}
2602
			}
2603 2604 2605 2606 2607 2608 2609

			if (insn->type == INSN_JUMP_UNCONDITIONAL)
				return 0;

			break;

		case INSN_JUMP_DYNAMIC:
2610
		case INSN_JUMP_DYNAMIC_CONDITIONAL:
2611
			if (func && is_sibling_call(insn)) {
2612 2613 2614
				ret = validate_sibling_call(insn, &state);
				if (ret)
					return ret;
2615 2616
			}

2617 2618 2619 2620
			if (insn->type == INSN_JUMP_DYNAMIC)
				return 0;

			break;
2621

2622 2623 2624 2625 2626 2627 2628 2629
		case INSN_CONTEXT_SWITCH:
			if (func && (!next_insn || !next_insn->hint)) {
				WARN_FUNC("unsupported instruction in callable function",
					  sec, insn->offset);
				return 1;
			}
			return 0;

2630 2631 2632 2633 2634 2635 2636 2637 2638 2639
		case INSN_STAC:
			if (state.uaccess) {
				WARN_FUNC("recursive UACCESS enable", sec, insn->offset);
				return 1;
			}

			state.uaccess = true;
			break;

		case INSN_CLAC:
2640
			if (!state.uaccess && func) {
2641 2642 2643 2644 2645 2646 2647 2648 2649 2650
				WARN_FUNC("redundant UACCESS disable", sec, insn->offset);
				return 1;
			}

			if (func_uaccess_safe(func) && !state.uaccess_stack) {
				WARN_FUNC("UACCESS-safe disables UACCESS", sec, insn->offset);
				return 1;
			}

			state.uaccess = false;
2651 2652
			break;

2653
		case INSN_STD:
2654
			if (state.df) {
2655
				WARN_FUNC("recursive STD", sec, insn->offset);
2656 2657
				return 1;
			}
2658 2659 2660 2661 2662

			state.df = true;
			break;

		case INSN_CLD:
2663
			if (!state.df && func) {
2664
				WARN_FUNC("redundant CLD", sec, insn->offset);
2665 2666
				return 1;
			}
2667 2668

			state.df = false;
2669 2670
			break;

2671 2672 2673 2674 2675 2676 2677
		default:
			break;
		}

		if (insn->dead_end)
			return 0;

2678
		if (!next_insn) {
2679
			if (state.cfi.cfa.base == CFI_UNDEFINED)
2680
				return 0;
2681 2682 2683
			WARN("%s: unexpected end of section", sec->name);
			return 1;
		}
2684 2685

		insn = next_insn;
2686 2687 2688 2689 2690
	}

	return 0;
}

2691
static int validate_unwind_hints(struct objtool_file *file, struct section *sec)
2692 2693 2694
{
	struct instruction *insn;
	struct insn_state state;
2695
	int ret, warnings = 0;
2696 2697 2698 2699

	if (!file->hints)
		return 0;

2700
	init_insn_state(&state, sec);
2701

2702 2703 2704 2705 2706 2707 2708 2709 2710
	if (sec) {
		insn = find_insn(file, sec, 0);
		if (!insn)
			return 0;
	} else {
		insn = list_first_entry(&file->insn_list, typeof(*insn), list);
	}

	while (&insn->list != &file->insn_list && (!sec || insn->sec == sec)) {
2711
		if (insn->hint && !insn->visited) {
2712
			ret = validate_branch(file, insn->func, insn, state);
2713 2714
			if (ret && backtrace)
				BT_FUNC("<=== (hint)", insn);
2715 2716
			warnings += ret;
		}
2717 2718

		insn = list_next_entry(insn, list);
2719 2720 2721 2722 2723
	}

	return warnings;
}

2724 2725 2726 2727 2728 2729 2730 2731 2732 2733 2734 2735 2736
static int validate_retpoline(struct objtool_file *file)
{
	struct instruction *insn;
	int warnings = 0;

	for_each_insn(file, insn) {
		if (insn->type != INSN_JUMP_DYNAMIC &&
		    insn->type != INSN_CALL_DYNAMIC)
			continue;

		if (insn->retpoline_safe)
			continue;

2737 2738 2739 2740 2741 2742 2743 2744 2745
		/*
		 * .init.text code is ran before userspace and thus doesn't
		 * strictly need retpolines, except for modules which are
		 * loaded late, they very much do need retpoline in their
		 * .init.text
		 */
		if (!strcmp(insn->sec->name, ".init.text") && !module)
			continue;

2746 2747 2748 2749 2750 2751 2752 2753 2754 2755
		WARN_FUNC("indirect %s found in RETPOLINE build",
			  insn->sec, insn->offset,
			  insn->type == INSN_JUMP_DYNAMIC ? "jump" : "call");

		warnings++;
	}

	return warnings;
}

2756 2757 2758 2759 2760 2761 2762 2763 2764 2765 2766 2767 2768
static bool is_kasan_insn(struct instruction *insn)
{
	return (insn->type == INSN_CALL &&
		!strcmp(insn->call_dest->name, "__asan_handle_no_return"));
}

static bool is_ubsan_insn(struct instruction *insn)
{
	return (insn->type == INSN_CALL &&
		!strcmp(insn->call_dest->name,
			"__ubsan_handle_builtin_unreachable"));
}

2769
static bool ignore_unreachable_insn(struct objtool_file *file, struct instruction *insn)
2770 2771
{
	int i;
2772
	struct instruction *prev_insn;
2773

2774 2775 2776 2777 2778 2779
	if (insn->ignore || insn->type == INSN_NOP)
		return true;

	/*
	 * Ignore any unused exceptions.  This can happen when a whitelisted
	 * function has an exception table entry.
2780 2781 2782
	 *
	 * Also ignore alternative replacement instructions.  This can happen
	 * when a whitelisted function uses one of the ALTERNATIVE macros.
2783
	 */
2784 2785 2786
	if (!strcmp(insn->sec->name, ".fixup") ||
	    !strcmp(insn->sec->name, ".altinstr_replacement") ||
	    !strcmp(insn->sec->name, ".altinstr_aux"))
2787 2788
		return true;

2789 2790 2791 2792 2793 2794 2795 2796
	if (!insn->func)
		return false;

	/*
	 * CONFIG_UBSAN_TRAP inserts a UD2 when it sees
	 * __builtin_unreachable().  The BUG() macro has an unreachable() after
	 * the UD2, which causes GCC's undefined trap logic to emit another UD2
	 * (or occasionally a JMP to UD2).
2797 2798
	 *
	 * It may also insert a UD2 after calling a __noreturn function.
2799
	 */
2800 2801
	prev_insn = list_prev_entry(insn, list);
	if ((prev_insn->dead_end || dead_end_function(file, prev_insn->call_dest)) &&
2802 2803 2804 2805 2806
	    (insn->type == INSN_BUG ||
	     (insn->type == INSN_JUMP_UNCONDITIONAL &&
	      insn->jump_dest && insn->jump_dest->type == INSN_BUG)))
		return true;

2807 2808 2809 2810 2811 2812 2813 2814 2815 2816 2817
	/*
	 * Check if this (or a subsequent) instruction is related to
	 * CONFIG_UBSAN or CONFIG_KASAN.
	 *
	 * End the search at 5 instructions to avoid going into the weeds.
	 */
	for (i = 0; i < 5; i++) {

		if (is_kasan_insn(insn) || is_ubsan_insn(insn))
			return true;

2818 2819 2820 2821 2822 2823 2824 2825
		if (insn->type == INSN_JUMP_UNCONDITIONAL) {
			if (insn->jump_dest &&
			    insn->jump_dest->func == insn->func) {
				insn = insn->jump_dest;
				continue;
			}

			break;
2826 2827
		}

2828
		if (insn->offset + insn->len >= insn->func->offset + insn->func->len)
2829
			break;
2830

2831 2832 2833 2834 2835 2836
		insn = list_next_entry(insn, list);
	}

	return false;
}

2837 2838
static int validate_symbol(struct objtool_file *file, struct section *sec,
			   struct symbol *sym, struct insn_state *state)
2839 2840
{
	struct instruction *insn;
2841 2842 2843 2844 2845 2846 2847 2848 2849 2850 2851 2852 2853 2854 2855 2856 2857 2858 2859 2860 2861 2862 2863 2864
	int ret;

	if (!sym->len) {
		WARN("%s() is missing an ELF size annotation", sym->name);
		return 1;
	}

	if (sym->pfunc != sym || sym->alias != sym)
		return 0;

	insn = find_insn(file, sec, sym->offset);
	if (!insn || insn->ignore || insn->visited)
		return 0;

	state->uaccess = sym->uaccess_safe;

	ret = validate_branch(file, insn->func, insn, *state);
	if (ret && backtrace)
		BT_FUNC("<=== (sym)", insn);
	return ret;
}

static int validate_section(struct objtool_file *file, struct section *sec)
{
2865
	struct insn_state state;
2866 2867
	struct symbol *func;
	int warnings = 0;
2868

2869 2870 2871
	list_for_each_entry(func, &sec->symbol_list, list) {
		if (func->type != STT_FUNC)
			continue;
2872

2873
		init_insn_state(&state, sec);
2874 2875
		state.cfi.cfa = initial_func_cfi.cfa;
		memcpy(&state.cfi.regs, &initial_func_cfi.regs,
2876
		       CFI_NUM_REGS * sizeof(struct cfi_reg));
2877
		state.cfi.stack_size = initial_func_cfi.cfa.offset;
2878

2879
		warnings += validate_symbol(file, sec, func, &state);
2880 2881 2882 2883 2884
	}

	return warnings;
}

2885 2886 2887
static int validate_vmlinux_functions(struct objtool_file *file)
{
	struct section *sec;
2888
	int warnings = 0;
2889 2890

	sec = find_section_by_name(file->elf, ".noinstr.text");
2891 2892 2893 2894
	if (sec) {
		warnings += validate_section(file, sec);
		warnings += validate_unwind_hints(file, sec);
	}
2895

2896 2897 2898 2899 2900
	sec = find_section_by_name(file->elf, ".entry.text");
	if (sec) {
		warnings += validate_section(file, sec);
		warnings += validate_unwind_hints(file, sec);
	}
2901 2902

	return warnings;
2903 2904
}

2905 2906 2907 2908 2909
static int validate_functions(struct objtool_file *file)
{
	struct section *sec;
	int warnings = 0;

2910 2911 2912 2913
	for_each_sec(file, sec) {
		if (!(sec->sh.sh_flags & SHF_EXECINSTR))
			continue;

2914
		warnings += validate_section(file, sec);
2915
	}
2916 2917 2918 2919

	return warnings;
}

2920
static int validate_reachable_instructions(struct objtool_file *file)
2921 2922
{
	struct instruction *insn;
2923 2924 2925

	if (file->ignore_unreachables)
		return 0;
2926 2927

	for_each_insn(file, insn) {
2928
		if (insn->visited || ignore_unreachable_insn(file, insn))
2929 2930 2931 2932
			continue;

		WARN_FUNC("unreachable instruction", insn->sec, insn->offset);
		return 1;
2933 2934
	}

2935
	return 0;
2936 2937
}

2938
int check(struct objtool_file *file)
2939 2940 2941
{
	int ret, warnings = 0;

2942 2943
	arch_initial_func_cfi_state(&initial_func_cfi);

2944
	ret = decode_sections(file);
2945 2946 2947 2948
	if (ret < 0)
		goto out;
	warnings += ret;

2949
	if (list_empty(&file->insn_list))
2950 2951
		goto out;

2952
	if (vmlinux && !validate_dup) {
2953
		ret = validate_vmlinux_functions(file);
2954 2955 2956 2957 2958 2959 2960
		if (ret < 0)
			goto out;

		warnings += ret;
		goto out;
	}

2961
	if (retpoline) {
2962
		ret = validate_retpoline(file);
2963 2964 2965 2966 2967
		if (ret < 0)
			return ret;
		warnings += ret;
	}

2968
	ret = validate_functions(file);
2969 2970 2971 2972
	if (ret < 0)
		goto out;
	warnings += ret;

2973
	ret = validate_unwind_hints(file, NULL);
2974 2975 2976 2977
	if (ret < 0)
		goto out;
	warnings += ret;

2978
	if (!warnings) {
2979
		ret = validate_reachable_instructions(file);
2980 2981 2982 2983 2984
		if (ret < 0)
			goto out;
		warnings += ret;
	}

2985
	ret = create_static_call_sections(file);
2986 2987 2988 2989
	if (ret < 0)
		goto out;
	warnings += ret;

2990
out:
2991 2992 2993 2994 2995 2996 2997 2998 2999
	if (ret < 0) {
		/*
		 *  Fatal error.  The binary is corrupt or otherwise broken in
		 *  some way, or objtool itself is broken.  Fail the kernel
		 *  build.
		 */
		return ret;
	}

3000 3001
	return 0;
}