1 // SPDX-License-Identifier: GPL-2.0-or-later 1 // SPDX-License-Identifier: GPL-2.0-or-later
2 /* 2 /*
3 * Copyright (C) 2015-2017 Josh Poimboeuf <jpo 3 * Copyright (C) 2015-2017 Josh Poimboeuf <jpoimboe@redhat.com>
4 */ 4 */
5 5
6 #include <string.h> 6 #include <string.h>
7 #include <stdlib.h> 7 #include <stdlib.h>
8 #include <inttypes.h> <<
9 #include <sys/mman.h> <<
10 8
11 #include <objtool/builtin.h> !! 9 #include "builtin.h"
12 #include <objtool/cfi.h> !! 10 #include "cfi.h"
13 #include <objtool/arch.h> !! 11 #include "arch.h"
14 #include <objtool/check.h> !! 12 #include "check.h"
15 #include <objtool/special.h> !! 13 #include "special.h"
16 #include <objtool/warn.h> !! 14 #include "warn.h"
17 #include <objtool/endianness.h> !! 15 #include "arch_elf.h"
18 16
19 #include <linux/objtool_types.h> <<
20 #include <linux/hashtable.h> 17 #include <linux/hashtable.h>
21 #include <linux/kernel.h> 18 #include <linux/kernel.h>
22 #include <linux/static_call_types.h> !! 19
23 #include <linux/string.h> !! 20 #define FAKE_JUMP_OFFSET -1
>> 21
>> 22 #define C_JUMP_TABLE_SECTION ".rodata..c_jump_table"
24 23
25 struct alternative { 24 struct alternative {
26 struct alternative *next; !! 25 struct list_head list;
27 struct instruction *insn; 26 struct instruction *insn;
28 bool skip_orig; 27 bool skip_orig;
29 }; 28 };
30 29
31 static unsigned long nr_cfi, nr_cfi_reused, nr !! 30 const char *objname;
32 !! 31 struct cfi_init_state initial_func_cfi;
33 static struct cfi_init_state initial_func_cfi; <<
34 static struct cfi_state init_cfi; <<
35 static struct cfi_state func_cfi; <<
36 static struct cfi_state force_undefined_cfi; <<
37 32
38 struct instruction *find_insn(struct objtool_f 33 struct instruction *find_insn(struct objtool_file *file,
39 struct section * 34 struct section *sec, unsigned long offset)
40 { 35 {
41 struct instruction *insn; 36 struct instruction *insn;
42 37
43 hash_for_each_possible(file->insn_hash 38 hash_for_each_possible(file->insn_hash, insn, hash, sec_offset_hash(sec, offset)) {
44 if (insn->sec == sec && insn-> 39 if (insn->sec == sec && insn->offset == offset)
45 return insn; 40 return insn;
46 } 41 }
47 42
48 return NULL; 43 return NULL;
49 } 44 }
50 45
51 struct instruction *next_insn_same_sec(struct !! 46 static struct instruction *next_insn_same_sec(struct objtool_file *file,
52 struct !! 47 struct instruction *insn)
53 { 48 {
54 if (insn->idx == INSN_CHUNK_MAX) !! 49 struct instruction *next = list_next_entry(insn, list);
55 return find_insn(file, insn->s <<
56 50
57 insn++; !! 51 if (!next || &next->list == &file->insn_list || next->sec != insn->sec)
58 if (!insn->len) <<
59 return NULL; 52 return NULL;
60 53
61 return insn; !! 54 return next;
62 } 55 }
63 56
64 static struct instruction *next_insn_same_func 57 static struct instruction *next_insn_same_func(struct objtool_file *file,
65 58 struct instruction *insn)
66 { 59 {
67 struct instruction *next = next_insn_s !! 60 struct instruction *next = list_next_entry(insn, list);
68 struct symbol *func = insn_func(insn); !! 61 struct symbol *func = insn->func;
69 62
70 if (!func) 63 if (!func)
71 return NULL; 64 return NULL;
72 65
73 if (next && insn_func(next) == func) !! 66 if (&next->list != &file->insn_list && next->func == func)
74 return next; 67 return next;
75 68
76 /* Check if we're already in the subfu 69 /* Check if we're already in the subfunction: */
77 if (func == func->cfunc) 70 if (func == func->cfunc)
78 return NULL; 71 return NULL;
79 72
80 /* Move to the subfunction: */ 73 /* Move to the subfunction: */
81 return find_insn(file, func->cfunc->se 74 return find_insn(file, func->cfunc->sec, func->cfunc->offset);
82 } 75 }
83 76
84 static struct instruction *prev_insn_same_sec( <<
85 <<
86 { <<
87 if (insn->idx == 0) { <<
88 if (insn->prev_len) <<
89 return find_insn(file, <<
90 return NULL; <<
91 } <<
92 <<
93 return insn - 1; <<
94 } <<
95 <<
96 static struct instruction *prev_insn_same_sym( 77 static struct instruction *prev_insn_same_sym(struct objtool_file *file,
97 !! 78 struct instruction *insn)
98 { 79 {
99 struct instruction *prev = prev_insn_s !! 80 struct instruction *prev = list_prev_entry(insn, list);
100 81
101 if (prev && insn_func(prev) == insn_fu !! 82 if (&prev->list != &file->insn_list && prev->func == insn->func)
102 return prev; 83 return prev;
103 84
104 return NULL; 85 return NULL;
105 } 86 }
106 87
107 #define for_each_insn(file, insn) <<
108 for (struct section *__sec, *__fake = <<
109 __fake; __fake = NULL) <<
110 for_each_sec(file, __sec) <<
111 sec_for_each_insn(file <<
112 <<
113 #define func_for_each_insn(file, func, insn) 88 #define func_for_each_insn(file, func, insn) \
114 for (insn = find_insn(file, func->sec, 89 for (insn = find_insn(file, func->sec, func->offset); \
115 insn; 90 insn; \
116 insn = next_insn_same_func(file, 91 insn = next_insn_same_func(file, insn))
117 92
118 #define sym_for_each_insn(file, sym, insn) 93 #define sym_for_each_insn(file, sym, insn) \
119 for (insn = find_insn(file, sym->sec, 94 for (insn = find_insn(file, sym->sec, sym->offset); \
120 insn && insn->offset < sym->offse !! 95 insn && &insn->list != &file->insn_list && \
121 insn = next_insn_same_sec(file, i !! 96 insn->sec == sym->sec && \
>> 97 insn->offset < sym->offset + sym->len; \
>> 98 insn = list_next_entry(insn, list))
122 99
123 #define sym_for_each_insn_continue_reverse(fil 100 #define sym_for_each_insn_continue_reverse(file, sym, insn) \
124 for (insn = prev_insn_same_sec(file, i !! 101 for (insn = list_prev_entry(insn, list); \
125 insn && insn->offset >= sym->offs !! 102 &insn->list != &file->insn_list && \
126 insn = prev_insn_same_sec(file, i !! 103 insn->sec == sym->sec && insn->offset >= sym->offset; \
>> 104 insn = list_prev_entry(insn, list))
127 105
128 #define sec_for_each_insn_from(file, insn) 106 #define sec_for_each_insn_from(file, insn) \
129 for (; insn; insn = next_insn_same_sec 107 for (; insn; insn = next_insn_same_sec(file, insn))
130 108
131 #define sec_for_each_insn_continue(file, insn) 109 #define sec_for_each_insn_continue(file, insn) \
132 for (insn = next_insn_same_sec(file, i 110 for (insn = next_insn_same_sec(file, insn); insn; \
133 insn = next_insn_same_sec(file, i 111 insn = next_insn_same_sec(file, insn))
134 112
135 static inline struct symbol *insn_call_dest(st !! 113 static bool is_static_jump(struct instruction *insn)
136 { <<
137 if (insn->type == INSN_JUMP_DYNAMIC || <<
138 insn->type == INSN_CALL_DYNAMIC) <<
139 return NULL; <<
140 <<
141 return insn->_call_dest; <<
142 } <<
143 <<
144 static inline struct reloc *insn_jump_table(st <<
145 { 114 {
146 if (insn->type == INSN_JUMP_DYNAMIC || !! 115 return insn->type == INSN_JUMP_CONDITIONAL ||
147 insn->type == INSN_CALL_DYNAMIC) !! 116 insn->type == INSN_JUMP_UNCONDITIONAL;
148 return insn->_jump_table; <<
149 <<
150 return NULL; <<
151 } <<
152 <<
153 static bool is_jump_table_jump(struct instruct <<
154 { <<
155 struct alt_group *alt_group = insn->al <<
156 <<
157 if (insn_jump_table(insn)) <<
158 return true; <<
159 <<
160 /* Retpoline alternative for a jump ta <<
161 return alt_group && alt_group->orig_gr <<
162 insn_jump_table(alt_group->orig <<
163 } 117 }
164 118
165 static bool is_sibling_call(struct instruction 119 static bool is_sibling_call(struct instruction *insn)
166 { 120 {
167 /* !! 121 /* An indirect jump is either a sibling call or a jump to a table. */
168 * Assume only STT_FUNC calls have jum !! 122 if (insn->type == INSN_JUMP_DYNAMIC)
169 */ !! 123 return list_empty(&insn->alts);
170 if (insn_func(insn)) { <<
171 /* An indirect jump is either <<
172 if (insn->type == INSN_JUMP_DY <<
173 return !is_jump_table_ <<
174 } <<
175 <<
176 /* add_jump_destinations() sets insn_c <<
177 return (is_static_jump(insn) && insn_c <<
178 } <<
179 <<
180 /* <<
181 * Checks if a string ends with another. <<
182 */ <<
183 static bool str_ends_with(const char *s, const <<
184 { <<
185 const int slen = strlen(s); <<
186 const int sublen = strlen(sub); <<
187 <<
188 if (sublen > slen) <<
189 return 0; <<
190 <<
191 return !memcmp(s + slen - sublen, sub, <<
192 } <<
193 124
194 /* !! 125 if (!is_static_jump(insn))
195 * Checks if a function is a Rust "noreturn" o <<
196 */ <<
197 static bool is_rust_noreturn(const struct symb <<
198 { <<
199 /* <<
200 * If it does not start with "_R", the <<
201 */ <<
202 if (strncmp(func->name, "_R", 2)) <<
203 return false; 126 return false;
204 127
205 /* !! 128 /* add_jump_destinations() sets insn->call_dest for sibling calls. */
206 * These are just heuristics -- we do !! 129 return !!insn->call_dest;
207 * name, due to the crate disambiguato <<
208 * as well as changes to the source co <<
209 * these come from the Rust standard l <<
210 */ <<
211 return str_ends_with(func->name, "_4co <<
212 str_ends_with(func->name, "_4co <<
213 str_ends_with(func->name, "_4co <<
214 str_ends_with(func->name, "_4co <<
215 str_ends_with(func->name, "_4co <<
216 str_ends_with(func->name, "_4co <<
217 str_ends_with(func->name, "_4co <<
218 str_ends_with(func->name, "_4co <<
219 str_ends_with(func->name, "_4co <<
220 str_ends_with(func->name, "_4co <<
221 strstr(func->name, "_4core9pani <<
222 (strstr(func->name, "_4core5sli <<
223 str_ends_with(func->name, "_fa <<
224 } 130 }
225 131
226 /* 132 /*
227 * This checks to see if the given function is 133 * This checks to see if the given function is a "noreturn" function.
228 * 134 *
229 * For global functions which are outside the 135 * For global functions which are outside the scope of this object file, we
230 * have to keep a manual list of them. 136 * have to keep a manual list of them.
231 * 137 *
232 * For local functions, we have to detect them 138 * For local functions, we have to detect them manually by simply looking for
233 * the lack of a return instruction. 139 * the lack of a return instruction.
234 */ 140 */
235 static bool __dead_end_function(struct objtool 141 static bool __dead_end_function(struct objtool_file *file, struct symbol *func,
236 int recursion) 142 int recursion)
237 { 143 {
238 int i; 144 int i;
239 struct instruction *insn; 145 struct instruction *insn;
240 bool empty = true; 146 bool empty = true;
241 147
242 #define NORETURN(func) __stringify(func), !! 148 /*
>> 149 * Unfortunately these have to be hard coded because the noreturn
>> 150 * attribute isn't provided in ELF data.
>> 151 */
243 static const char * const global_noret 152 static const char * const global_noreturns[] = {
244 #include "noreturns.h" !! 153 "__stack_chk_fail",
>> 154 "panic",
>> 155 "do_exit",
>> 156 "do_task_dead",
>> 157 "__module_put_and_exit",
>> 158 "complete_and_exit",
>> 159 "__reiserfs_panic",
>> 160 "lbug_with_loc",
>> 161 "fortify_panic",
>> 162 "usercopy_abort",
>> 163 "machine_real_restart",
>> 164 "rewind_stack_do_exit",
>> 165 "kunit_try_catch_throw",
245 }; 166 };
246 #undef NORETURN <<
247 167
248 if (!func) 168 if (!func)
249 return false; 169 return false;
250 170
251 if (func->bind == STB_GLOBAL || func-> !! 171 if (func->bind == STB_WEAK)
252 if (is_rust_noreturn(func)) !! 172 return false;
253 return true; <<
254 173
>> 174 if (func->bind == STB_GLOBAL)
255 for (i = 0; i < ARRAY_SIZE(glo 175 for (i = 0; i < ARRAY_SIZE(global_noreturns); i++)
256 if (!strcmp(func->name 176 if (!strcmp(func->name, global_noreturns[i]))
257 return true; 177 return true;
258 } <<
259 <<
260 if (func->bind == STB_WEAK) <<
261 return false; <<
262 178
263 if (!func->len) 179 if (!func->len)
264 return false; 180 return false;
265 181
266 insn = find_insn(file, func->sec, func 182 insn = find_insn(file, func->sec, func->offset);
267 if (!insn || !insn_func(insn)) !! 183 if (!insn->func)
268 return false; 184 return false;
269 185
270 func_for_each_insn(file, func, insn) { 186 func_for_each_insn(file, func, insn) {
271 empty = false; 187 empty = false;
272 188
273 if (insn->type == INSN_RETURN) 189 if (insn->type == INSN_RETURN)
274 return false; 190 return false;
275 } 191 }
276 192
277 if (empty) 193 if (empty)
278 return false; 194 return false;
279 195
280 /* 196 /*
281 * A function can have a sibling call 197 * A function can have a sibling call instead of a return. In that
282 * case, the function's dead-end statu 198 * case, the function's dead-end status depends on whether the target
283 * of the sibling call returns. 199 * of the sibling call returns.
284 */ 200 */
285 func_for_each_insn(file, func, insn) { 201 func_for_each_insn(file, func, insn) {
286 if (is_sibling_call(insn)) { 202 if (is_sibling_call(insn)) {
287 struct instruction *de 203 struct instruction *dest = insn->jump_dest;
288 204
289 if (!dest) 205 if (!dest)
290 /* sibling cal 206 /* sibling call to another file */
291 return false; 207 return false;
292 208
293 /* local sibling call 209 /* local sibling call */
294 if (recursion == 5) { 210 if (recursion == 5) {
295 /* 211 /*
296 * Infinite re 212 * Infinite recursion: two functions have
297 * sibling cal 213 * sibling calls to each other. This is a very
298 * rare case. 214 * rare case. It means they aren't dead ends.
299 */ 215 */
300 return false; 216 return false;
301 } 217 }
302 218
303 return __dead_end_func !! 219 return __dead_end_function(file, dest->func, recursion+1);
304 } 220 }
305 } 221 }
306 222
307 return true; 223 return true;
308 } 224 }
309 225
310 static bool dead_end_function(struct objtool_f 226 static bool dead_end_function(struct objtool_file *file, struct symbol *func)
311 { 227 {
312 return __dead_end_function(file, func, 228 return __dead_end_function(file, func, 0);
313 } 229 }
314 230
315 static void init_cfi_state(struct cfi_state *c 231 static void init_cfi_state(struct cfi_state *cfi)
316 { 232 {
317 int i; 233 int i;
318 234
319 for (i = 0; i < CFI_NUM_REGS; i++) { 235 for (i = 0; i < CFI_NUM_REGS; i++) {
320 cfi->regs[i].base = CFI_UNDEFI 236 cfi->regs[i].base = CFI_UNDEFINED;
321 cfi->vals[i].base = CFI_UNDEFI 237 cfi->vals[i].base = CFI_UNDEFINED;
322 } 238 }
323 cfi->cfa.base = CFI_UNDEFINED; 239 cfi->cfa.base = CFI_UNDEFINED;
324 cfi->drap_reg = CFI_UNDEFINED; 240 cfi->drap_reg = CFI_UNDEFINED;
325 cfi->drap_offset = -1; 241 cfi->drap_offset = -1;
326 } 242 }
327 243
328 static void init_insn_state(struct objtool_fil !! 244 static void init_insn_state(struct insn_state *state, struct section *sec)
329 struct section *se <<
330 { 245 {
331 memset(state, 0, sizeof(*state)); 246 memset(state, 0, sizeof(*state));
332 init_cfi_state(&state->cfi); 247 init_cfi_state(&state->cfi);
333 248
334 /* 249 /*
335 * We need the full vmlinux for noinst 250 * We need the full vmlinux for noinstr validation, otherwise we can
336 * not correctly determine insn_call_d !! 251 * not correctly determine insn->call_dest->sec (external symbols do
337 * do not have a section). !! 252 * not have a section).
338 */ 253 */
339 if (opts.link && opts.noinstr && sec) !! 254 if (vmlinux && sec)
340 state->noinstr = sec->noinstr; 255 state->noinstr = sec->noinstr;
341 } 256 }
342 257
343 static struct cfi_state *cfi_alloc(void) <<
344 { <<
345 struct cfi_state *cfi = calloc(1, size <<
346 if (!cfi) { <<
347 WARN("calloc failed"); <<
348 exit(1); <<
349 } <<
350 nr_cfi++; <<
351 return cfi; <<
352 } <<
353 <<
354 static int cfi_bits; <<
355 static struct hlist_head *cfi_hash; <<
356 <<
357 static inline bool cficmp(struct cfi_state *cf <<
358 { <<
359 return memcmp((void *)cfi1 + sizeof(cf <<
360 (void *)cfi2 + sizeof(cf <<
361 sizeof(struct cfi_state) <<
362 } <<
363 <<
364 static inline u32 cfi_key(struct cfi_state *cf <<
365 { <<
366 return jhash((void *)cfi + sizeof(cfi- <<
367 sizeof(*cfi) - sizeof(cfi <<
368 } <<
369 <<
370 static struct cfi_state *cfi_hash_find_or_add( <<
371 { <<
372 struct hlist_head *head = &cfi_hash[ha <<
373 struct cfi_state *obj; <<
374 <<
375 hlist_for_each_entry(obj, head, hash) <<
376 if (!cficmp(cfi, obj)) { <<
377 nr_cfi_cache++; <<
378 return obj; <<
379 } <<
380 } <<
381 <<
382 obj = cfi_alloc(); <<
383 *obj = *cfi; <<
384 hlist_add_head(&obj->hash, head); <<
385 <<
386 return obj; <<
387 } <<
388 <<
389 static void cfi_hash_add(struct cfi_state *cfi <<
390 { <<
391 struct hlist_head *head = &cfi_hash[ha <<
392 <<
393 hlist_add_head(&cfi->hash, head); <<
394 } <<
395 <<
396 static void *cfi_hash_alloc(unsigned long size <<
397 { <<
398 cfi_bits = max(10, ilog2(size)); <<
399 cfi_hash = mmap(NULL, sizeof(struct hl <<
400 PROT_READ|PROT_WRITE, <<
401 MAP_PRIVATE|MAP_ANON, <<
402 if (cfi_hash == (void *)-1L) { <<
403 WARN("mmap fail cfi_hash"); <<
404 cfi_hash = NULL; <<
405 } else if (opts.stats) { <<
406 printf("cfi_bits: %d\n", cfi_b <<
407 } <<
408 <<
409 return cfi_hash; <<
410 } <<
411 <<
412 static unsigned long nr_insns; <<
413 static unsigned long nr_insns_visited; <<
414 <<
415 /* 258 /*
416 * Call the arch-specific instruction decoder 259 * Call the arch-specific instruction decoder for all the instructions and add
417 * them to the global instruction list. 260 * them to the global instruction list.
418 */ 261 */
419 static int decode_instructions(struct objtool_ 262 static int decode_instructions(struct objtool_file *file)
420 { 263 {
421 struct section *sec; 264 struct section *sec;
422 struct symbol *func; 265 struct symbol *func;
423 unsigned long offset; 266 unsigned long offset;
424 struct instruction *insn; 267 struct instruction *insn;
>> 268 unsigned long nr_insns = 0;
425 int ret; 269 int ret;
426 270
427 for_each_sec(file, sec) { 271 for_each_sec(file, sec) {
428 struct instruction *insns = NU <<
429 u8 prev_len = 0; <<
430 u8 idx = 0; <<
431 272
432 if (!(sec->sh.sh_flags & SHF_E 273 if (!(sec->sh.sh_flags & SHF_EXECINSTR))
433 continue; 274 continue;
434 275
435 if (strcmp(sec->name, ".altins 276 if (strcmp(sec->name, ".altinstr_replacement") &&
436 strcmp(sec->name, ".altins 277 strcmp(sec->name, ".altinstr_aux") &&
437 strncmp(sec->name, ".disca 278 strncmp(sec->name, ".discard.", 9))
438 sec->text = true; 279 sec->text = true;
439 280
440 if (!strcmp(sec->name, ".noins 281 if (!strcmp(sec->name, ".noinstr.text") ||
441 !strcmp(sec->name, ".entry !! 282 !strcmp(sec->name, ".entry.text"))
442 !strcmp(sec->name, ".cpuid <<
443 !strncmp(sec->name, ".text <<
444 sec->noinstr = true; 283 sec->noinstr = true;
445 284
446 /* !! 285 for (offset = 0; offset < sec->len; offset += insn->len) {
447 * .init.text code is ran befo !! 286 insn = malloc(sizeof(*insn));
448 * strictly need retpolines, e !! 287 if (!insn) {
449 * loaded late, they very much !! 288 WARN("malloc failed");
450 * .init.text !! 289 return -1;
451 */ <<
452 if (!strcmp(sec->name, ".init. <<
453 sec->init = true; <<
454 <<
455 for (offset = 0; offset < sec- <<
456 if (!insns || idx == I <<
457 insns = calloc <<
458 if (!insns) { <<
459 WARN(" <<
460 return <<
461 } <<
462 idx = 0; <<
463 } else { <<
464 idx++; <<
465 } 290 }
466 insn = &insns[idx]; !! 291 memset(insn, 0, sizeof(*insn));
467 insn->idx = idx; !! 292 INIT_LIST_HEAD(&insn->alts);
>> 293 INIT_LIST_HEAD(&insn->stack_ops);
>> 294 init_cfi_state(&insn->cfi);
468 295
469 INIT_LIST_HEAD(&insn-> <<
470 insn->sec = sec; 296 insn->sec = sec;
471 insn->offset = offset; 297 insn->offset = offset;
472 insn->prev_len = prev_ <<
473 298
474 ret = arch_decode_inst !! 299 ret = arch_decode_instruction(file->elf, sec, offset,
475 !! 300 sec->len - offset,
476 !! 301 &insn->len, &insn->type,
>> 302 &insn->immediate,
>> 303 &insn->stack_ops);
477 if (ret) 304 if (ret)
478 return ret; !! 305 goto err;
479 <<
480 prev_len = insn->len; <<
481 <<
482 /* <<
483 * By default, "ud2" i <<
484 * annotated, because <<
485 * divide-by-zero case <<
486 */ <<
487 if (insn->type == INSN <<
488 insn->dead_end <<
489 306
490 hash_add(file->insn_ha 307 hash_add(file->insn_hash, &insn->hash, sec_offset_hash(sec, insn->offset));
>> 308 list_add_tail(&insn->list, &file->insn_list);
491 nr_insns++; 309 nr_insns++;
492 } 310 }
493 311
494 // printf("%s: last chunk used: % !! 312 list_for_each_entry(func, &sec->symbol_list, list) {
495 !! 313 if (func->type != STT_FUNC || func->alias != func)
496 sec_for_each_sym(sec, func) { <<
497 if (func->type != STT_ <<
498 continue; <<
499 <<
500 if (func->offset == se <<
501 /* Heuristic: <<
502 if (func->type <<
503 contin <<
504 WARN("%s(): ST <<
505 func->nam <<
506 return -1; <<
507 } <<
508 <<
509 if (func->embedded_ins <<
510 continue; 314 continue;
511 315
512 if (!find_insn(file, s 316 if (!find_insn(file, sec, func->offset)) {
513 WARN("%s(): ca 317 WARN("%s(): can't find starting instruction",
514 func->nam 318 func->name);
515 return -1; 319 return -1;
516 } 320 }
517 321
518 sym_for_each_insn(file !! 322 sym_for_each_insn(file, func, insn)
519 insn->sym = fu !! 323 insn->func = func;
520 if (func->type <<
521 insn->type <<
522 list_empty <<
523 if (in <<
524 <<
525 <<
526 } else <<
527 <<
528 } <<
529 } <<
530 } <<
531 } 324 }
532 } 325 }
533 326
534 if (opts.stats) !! 327 if (stats)
535 printf("nr_insns: %lu\n", nr_i 328 printf("nr_insns: %lu\n", nr_insns);
536 329
537 return 0; 330 return 0;
538 } <<
539 <<
540 /* <<
541 * Read the pv_ops[] .data table to find the s <<
542 */ <<
543 static int add_pv_ops(struct objtool_file *fil <<
544 { <<
545 struct symbol *sym, *func; <<
546 unsigned long off, end; <<
547 struct reloc *reloc; <<
548 int idx; <<
549 <<
550 sym = find_symbol_by_name(file->elf, s <<
551 if (!sym) <<
552 return 0; <<
553 <<
554 off = sym->offset; <<
555 end = off + sym->len; <<
556 for (;;) { <<
557 reloc = find_reloc_by_dest_ran <<
558 if (!reloc) <<
559 break; <<
560 <<
561 func = reloc->sym; <<
562 if (func->type == STT_SECTION) <<
563 func = find_symbol_by_ <<
564 <<
565 <<
566 idx = (reloc_offset(reloc) - s <<
567 <<
568 objtool_pv_add(file, idx, func <<
569 <<
570 off = reloc_offset(reloc) + 1; <<
571 if (off > end) <<
572 break; <<
573 } <<
574 <<
575 return 0; <<
576 } <<
577 331
578 /* !! 332 err:
579 * Allocate and initialize file->pv_ops[]. !! 333 free(insn);
580 */ !! 334 return ret;
581 static int init_pv_ops(struct objtool_file *fi <<
582 { <<
583 static const char *pv_ops_tables[] = { <<
584 "pv_ops", <<
585 "xen_cpu_ops", <<
586 "xen_irq_ops", <<
587 "xen_mmu_ops", <<
588 NULL, <<
589 }; <<
590 const char *pv_ops; <<
591 struct symbol *sym; <<
592 int idx, nr; <<
593 <<
594 if (!opts.noinstr) <<
595 return 0; <<
596 <<
597 file->pv_ops = NULL; <<
598 <<
599 sym = find_symbol_by_name(file->elf, " <<
600 if (!sym) <<
601 return 0; <<
602 <<
603 nr = sym->len / sizeof(unsigned long); <<
604 file->pv_ops = calloc(sizeof(struct pv <<
605 if (!file->pv_ops) <<
606 return -1; <<
607 <<
608 for (idx = 0; idx < nr; idx++) <<
609 INIT_LIST_HEAD(&file->pv_ops[i <<
610 <<
611 for (idx = 0; (pv_ops = pv_ops_tables[ <<
612 add_pv_ops(file, pv_ops); <<
613 <<
614 return 0; <<
615 } 335 }
616 336
617 static struct instruction *find_last_insn(stru 337 static struct instruction *find_last_insn(struct objtool_file *file,
618 stru 338 struct section *sec)
619 { 339 {
620 struct instruction *insn = NULL; 340 struct instruction *insn = NULL;
621 unsigned int offset; 341 unsigned int offset;
622 unsigned int end = (sec->sh.sh_size > !! 342 unsigned int end = (sec->len > 10) ? sec->len - 10 : 0;
623 343
624 for (offset = sec->sh.sh_size - 1; off !! 344 for (offset = sec->len - 1; offset >= end && !insn; offset--)
625 insn = find_insn(file, sec, of 345 insn = find_insn(file, sec, offset);
626 346
627 return insn; 347 return insn;
628 } 348 }
629 349
630 /* 350 /*
631 * Mark "ud2" instructions and manually annota 351 * Mark "ud2" instructions and manually annotated dead ends.
632 */ 352 */
633 static int add_dead_ends(struct objtool_file * 353 static int add_dead_ends(struct objtool_file *file)
634 { 354 {
635 struct section *rsec; !! 355 struct section *sec;
636 struct reloc *reloc; !! 356 struct rela *rela;
637 struct instruction *insn; 357 struct instruction *insn;
638 uint64_t offset; !! 358
>> 359 /*
>> 360 * By default, "ud2" is a dead end unless otherwise annotated, because
>> 361 * GCC 7 inserts it for certain divide-by-zero cases.
>> 362 */
>> 363 for_each_insn(file, insn)
>> 364 if (insn->type == INSN_BUG)
>> 365 insn->dead_end = true;
639 366
640 /* 367 /*
641 * Check for manually annotated dead e 368 * Check for manually annotated dead ends.
642 */ 369 */
643 rsec = find_section_by_name(file->elf, !! 370 sec = find_section_by_name(file->elf, ".rela.discard.unreachable");
644 if (!rsec) !! 371 if (!sec)
645 goto reachable; 372 goto reachable;
646 373
647 for_each_reloc(rsec, reloc) { !! 374 list_for_each_entry(rela, &sec->rela_list, list) {
648 if (reloc->sym->type == STT_SE !! 375 if (rela->sym->type != STT_SECTION) {
649 offset = reloc_addend( !! 376 WARN("unexpected relocation symbol type in %s", sec->name);
650 } else if (reloc->sym->local_l <<
651 offset = reloc->sym->o <<
652 } else { <<
653 WARN("unexpected reloc <<
654 return -1; 377 return -1;
655 } 378 }
656 !! 379 insn = find_insn(file, rela->sym->sec, rela->addend);
657 insn = find_insn(file, reloc-> <<
658 if (insn) 380 if (insn)
659 insn = prev_insn_same_ !! 381 insn = list_prev_entry(insn, list);
660 else if (offset == reloc->sym- !! 382 else if (rela->addend == rela->sym->sec->len) {
661 insn = find_last_insn( !! 383 insn = find_last_insn(file, rela->sym->sec);
662 if (!insn) { 384 if (!insn) {
663 WARN("can't fi !! 385 WARN("can't find unreachable insn at %s+0x%x",
664 reloc->sy !! 386 rela->sym->sec->name, rela->addend);
665 return -1; 387 return -1;
666 } 388 }
667 } else { 389 } else {
668 WARN("can't find unrea !! 390 WARN("can't find unreachable insn at %s+0x%x",
669 reloc->sym->sec-> !! 391 rela->sym->sec->name, rela->addend);
670 return -1; 392 return -1;
671 } 393 }
672 394
673 insn->dead_end = true; 395 insn->dead_end = true;
674 } 396 }
675 397
676 reachable: 398 reachable:
677 /* 399 /*
678 * These manually annotated reachable 400 * These manually annotated reachable checks are needed for GCC 4.4,
679 * where the Linux unreachable() macro 401 * where the Linux unreachable() macro isn't supported. In that case
680 * GCC doesn't know the "ud2" is fatal 402 * GCC doesn't know the "ud2" is fatal, so it generates code as if it's
681 * not a dead end. 403 * not a dead end.
682 */ 404 */
683 rsec = find_section_by_name(file->elf, !! 405 sec = find_section_by_name(file->elf, ".rela.discard.reachable");
684 if (!rsec) !! 406 if (!sec)
685 return 0; 407 return 0;
686 408
687 for_each_reloc(rsec, reloc) { !! 409 list_for_each_entry(rela, &sec->rela_list, list) {
688 if (reloc->sym->type == STT_SE !! 410 if (rela->sym->type != STT_SECTION) {
689 offset = reloc_addend( !! 411 WARN("unexpected relocation symbol type in %s", sec->name);
690 } else if (reloc->sym->local_l <<
691 offset = reloc->sym->o <<
692 } else { <<
693 WARN("unexpected reloc <<
694 return -1; 412 return -1;
695 } 413 }
696 !! 414 insn = find_insn(file, rela->sym->sec, rela->addend);
697 insn = find_insn(file, reloc-> <<
698 if (insn) 415 if (insn)
699 insn = prev_insn_same_ !! 416 insn = list_prev_entry(insn, list);
700 else if (offset == reloc->sym- !! 417 else if (rela->addend == rela->sym->sec->len) {
701 insn = find_last_insn( !! 418 insn = find_last_insn(file, rela->sym->sec);
702 if (!insn) { 419 if (!insn) {
703 WARN("can't fi !! 420 WARN("can't find reachable insn at %s+0x%x",
704 reloc->sy !! 421 rela->sym->sec->name, rela->addend);
705 return -1; 422 return -1;
706 } 423 }
707 } else { 424 } else {
708 WARN("can't find reach !! 425 WARN("can't find reachable insn at %s+0x%x",
709 reloc->sym->sec-> !! 426 rela->sym->sec->name, rela->addend);
710 return -1; 427 return -1;
711 } 428 }
712 429
713 insn->dead_end = false; 430 insn->dead_end = false;
714 } 431 }
715 432
716 return 0; 433 return 0;
717 } 434 }
718 435
719 static int create_static_call_sections(struct <<
720 { <<
721 struct static_call_site *site; <<
722 struct section *sec; <<
723 struct instruction *insn; <<
724 struct symbol *key_sym; <<
725 char *key_name, *tmp; <<
726 int idx; <<
727 <<
728 sec = find_section_by_name(file->elf, <<
729 if (sec) { <<
730 INIT_LIST_HEAD(&file->static_c <<
731 WARN("file already has .static <<
732 return 0; <<
733 } <<
734 <<
735 if (list_empty(&file->static_call_list <<
736 return 0; <<
737 <<
738 idx = 0; <<
739 list_for_each_entry(insn, &file->stati <<
740 idx++; <<
741 <<
742 sec = elf_create_section_pair(file->el <<
743 sizeof(* <<
744 if (!sec) <<
745 return -1; <<
746 <<
747 /* Allow modules to modify the low bit <<
748 sec->sh.sh_flags |= SHF_WRITE; <<
749 <<
750 idx = 0; <<
751 list_for_each_entry(insn, &file->stati <<
752 <<
753 /* populate reloc for 'addr' * <<
754 if (!elf_init_reloc_text_sym(f <<
755 i <<
756 i <<
757 return -1; <<
758 <<
759 /* find key symbol */ <<
760 key_name = strdup(insn_call_de <<
761 if (!key_name) { <<
762 perror("strdup"); <<
763 return -1; <<
764 } <<
765 if (strncmp(key_name, STATIC_C <<
766 STATIC_CALL_TRAMP_ <<
767 WARN("static_call: tra <<
768 free(key_name); <<
769 return -1; <<
770 } <<
771 tmp = key_name + STATIC_CALL_T <<
772 memcpy(tmp, STATIC_CALL_KEY_PR <<
773 <<
774 key_sym = find_symbol_by_name( <<
775 if (!key_sym) { <<
776 if (!opts.module) { <<
777 WARN("static_c <<
778 free(key_name) <<
779 return -1; <<
780 } <<
781 <<
782 /* <<
783 * For modules(), the <<
784 * means the module ca <<
785 * allowed to change t <<
786 * <<
787 * In that case we tem <<
788 * trampoline address. <<
789 * static_call_add_mod <<
790 */ <<
791 key_sym = insn_call_de <<
792 } <<
793 free(key_name); <<
794 <<
795 /* populate reloc for 'key' */ <<
796 if (!elf_init_reloc_data_sym(f <<
797 i <<
798 ( <<
799 i <<
800 return -1; <<
801 <<
802 idx++; <<
803 } <<
804 <<
805 return 0; <<
806 } <<
807 <<
808 static int create_retpoline_sites_sections(str <<
809 { <<
810 struct instruction *insn; <<
811 struct section *sec; <<
812 int idx; <<
813 <<
814 sec = find_section_by_name(file->elf, <<
815 if (sec) { <<
816 WARN("file already has .retpol <<
817 return 0; <<
818 } <<
819 <<
820 idx = 0; <<
821 list_for_each_entry(insn, &file->retpo <<
822 idx++; <<
823 <<
824 if (!idx) <<
825 return 0; <<
826 <<
827 sec = elf_create_section_pair(file->el <<
828 sizeof(i <<
829 if (!sec) <<
830 return -1; <<
831 <<
832 idx = 0; <<
833 list_for_each_entry(insn, &file->retpo <<
834 <<
835 if (!elf_init_reloc_text_sym(f <<
836 i <<
837 i <<
838 return -1; <<
839 <<
840 idx++; <<
841 } <<
842 <<
843 return 0; <<
844 } <<
845 <<
846 static int create_return_sites_sections(struct <<
847 { <<
848 struct instruction *insn; <<
849 struct section *sec; <<
850 int idx; <<
851 <<
852 sec = find_section_by_name(file->elf, <<
853 if (sec) { <<
854 WARN("file already has .return <<
855 return 0; <<
856 } <<
857 <<
858 idx = 0; <<
859 list_for_each_entry(insn, &file->retur <<
860 idx++; <<
861 <<
862 if (!idx) <<
863 return 0; <<
864 <<
865 sec = elf_create_section_pair(file->el <<
866 sizeof(i <<
867 if (!sec) <<
868 return -1; <<
869 <<
870 idx = 0; <<
871 list_for_each_entry(insn, &file->retur <<
872 <<
873 if (!elf_init_reloc_text_sym(f <<
874 i <<
875 i <<
876 return -1; <<
877 <<
878 idx++; <<
879 } <<
880 <<
881 return 0; <<
882 } <<
883 <<
884 static int create_ibt_endbr_seal_sections(stru <<
885 { <<
886 struct instruction *insn; <<
887 struct section *sec; <<
888 int idx; <<
889 <<
890 sec = find_section_by_name(file->elf, <<
891 if (sec) { <<
892 WARN("file already has .ibt_en <<
893 return 0; <<
894 } <<
895 <<
896 idx = 0; <<
897 list_for_each_entry(insn, &file->endbr <<
898 idx++; <<
899 <<
900 if (opts.stats) { <<
901 printf("ibt: ENDBR at function <<
902 printf("ibt: ENDBR inside func <<
903 printf("ibt: superfluous ENDBR <<
904 } <<
905 <<
906 if (!idx) <<
907 return 0; <<
908 <<
909 sec = elf_create_section_pair(file->el <<
910 sizeof(i <<
911 if (!sec) <<
912 return -1; <<
913 <<
914 idx = 0; <<
915 list_for_each_entry(insn, &file->endbr <<
916 <<
917 int *site = (int *)sec->data-> <<
918 struct symbol *sym = insn->sym <<
919 *site = 0; <<
920 <<
921 if (opts.module && sym && sym- <<
922 insn->offset == sym->offse <<
923 (!strcmp(sym->name, "init_ <<
924 !strcmp(sym->name, "clean <<
925 WARN("%s(): not an ind <<
926 <<
927 if (!elf_init_reloc_text_sym(f <<
928 i <<
929 i <<
930 return -1; <<
931 <<
932 idx++; <<
933 } <<
934 <<
935 return 0; <<
936 } <<
937 <<
938 static int create_cfi_sections(struct objtool_ <<
939 { <<
940 struct section *sec; <<
941 struct symbol *sym; <<
942 int idx; <<
943 <<
944 sec = find_section_by_name(file->elf, <<
945 if (sec) { <<
946 INIT_LIST_HEAD(&file->call_lis <<
947 WARN("file already has .cfi_si <<
948 return 0; <<
949 } <<
950 <<
951 idx = 0; <<
952 for_each_sym(file, sym) { <<
953 if (sym->type != STT_FUNC) <<
954 continue; <<
955 <<
956 if (strncmp(sym->name, "__cfi_ <<
957 continue; <<
958 <<
959 idx++; <<
960 } <<
961 <<
962 sec = elf_create_section_pair(file->el <<
963 sizeof(u <<
964 if (!sec) <<
965 return -1; <<
966 <<
967 idx = 0; <<
968 for_each_sym(file, sym) { <<
969 if (sym->type != STT_FUNC) <<
970 continue; <<
971 <<
972 if (strncmp(sym->name, "__cfi_ <<
973 continue; <<
974 <<
975 if (!elf_init_reloc_text_sym(f <<
976 i <<
977 s <<
978 return -1; <<
979 <<
980 idx++; <<
981 } <<
982 <<
983 return 0; <<
984 } <<
985 <<
986 static int create_mcount_loc_sections(struct o <<
987 { <<
988 size_t addr_size = elf_addr_size(file- <<
989 struct instruction *insn; <<
990 struct section *sec; <<
991 int idx; <<
992 <<
993 sec = find_section_by_name(file->elf, <<
994 if (sec) { <<
995 INIT_LIST_HEAD(&file->mcount_l <<
996 WARN("file already has __mcoun <<
997 return 0; <<
998 } <<
999 <<
1000 if (list_empty(&file->mcount_loc_list <<
1001 return 0; <<
1002 <<
1003 idx = 0; <<
1004 list_for_each_entry(insn, &file->mcou <<
1005 idx++; <<
1006 <<
1007 sec = elf_create_section_pair(file->e <<
1008 idx, id <<
1009 if (!sec) <<
1010 return -1; <<
1011 <<
1012 sec->sh.sh_addralign = addr_size; <<
1013 <<
1014 idx = 0; <<
1015 list_for_each_entry(insn, &file->mcou <<
1016 <<
1017 struct reloc *reloc; <<
1018 <<
1019 reloc = elf_init_reloc_text_s <<
1020 <<
1021 if (!reloc) <<
1022 return -1; <<
1023 <<
1024 set_reloc_type(file->elf, rel <<
1025 <<
1026 idx++; <<
1027 } <<
1028 <<
1029 return 0; <<
1030 } <<
1031 <<
1032 static int create_direct_call_sections(struct <<
1033 { <<
1034 struct instruction *insn; <<
1035 struct section *sec; <<
1036 int idx; <<
1037 <<
1038 sec = find_section_by_name(file->elf, <<
1039 if (sec) { <<
1040 INIT_LIST_HEAD(&file->call_li <<
1041 WARN("file already has .call_ <<
1042 return 0; <<
1043 } <<
1044 <<
1045 if (list_empty(&file->call_list)) <<
1046 return 0; <<
1047 <<
1048 idx = 0; <<
1049 list_for_each_entry(insn, &file->call <<
1050 idx++; <<
1051 <<
1052 sec = elf_create_section_pair(file->e <<
1053 sizeof( <<
1054 if (!sec) <<
1055 return -1; <<
1056 <<
1057 idx = 0; <<
1058 list_for_each_entry(insn, &file->call <<
1059 <<
1060 if (!elf_init_reloc_text_sym( <<
1061 <<
1062 <<
1063 return -1; <<
1064 <<
1065 idx++; <<
1066 } <<
1067 <<
1068 return 0; <<
1069 } <<
1070 <<
1071 /* 436 /*
1072 * Warnings shouldn't be reported for ignored 437 * Warnings shouldn't be reported for ignored functions.
1073 */ 438 */
1074 static void add_ignores(struct objtool_file * 439 static void add_ignores(struct objtool_file *file)
1075 { 440 {
1076 struct instruction *insn; 441 struct instruction *insn;
1077 struct section *rsec; !! 442 struct section *sec;
1078 struct symbol *func; 443 struct symbol *func;
1079 struct reloc *reloc; !! 444 struct rela *rela;
1080 445
1081 rsec = find_section_by_name(file->elf !! 446 sec = find_section_by_name(file->elf, ".rela.discard.func_stack_frame_non_standard");
1082 if (!rsec) !! 447 if (!sec)
1083 return; 448 return;
1084 449
1085 for_each_reloc(rsec, reloc) { !! 450 list_for_each_entry(rela, &sec->rela_list, list) {
1086 switch (reloc->sym->type) { !! 451 switch (rela->sym->type) {
1087 case STT_FUNC: 452 case STT_FUNC:
1088 func = reloc->sym; !! 453 func = rela->sym;
1089 break; 454 break;
1090 455
1091 case STT_SECTION: 456 case STT_SECTION:
1092 func = find_func_by_o !! 457 func = find_func_by_offset(rela->sym->sec, rela->addend);
1093 if (!func) 458 if (!func)
1094 continue; 459 continue;
1095 break; 460 break;
1096 461
1097 default: 462 default:
1098 WARN("unexpected relo !! 463 WARN("unexpected relocation symbol type in %s: %d", sec->name, rela->sym->type);
1099 rsec->name, relo <<
1100 continue; 464 continue;
1101 } 465 }
1102 466
1103 func_for_each_insn(file, func 467 func_for_each_insn(file, func, insn)
1104 insn->ignore = true; 468 insn->ignore = true;
1105 } 469 }
1106 } 470 }
1107 471
1108 /* 472 /*
1109 * This is a whitelist of functions that is a 473 * This is a whitelist of functions that is allowed to be called with AC set.
1110 * The list is meant to be minimal and only c 474 * The list is meant to be minimal and only contains compiler instrumentation
1111 * ABI and a few functions used to implement 475 * ABI and a few functions used to implement *_{to,from}_user() functions.
1112 * 476 *
1113 * These functions must not directly change A 477 * These functions must not directly change AC, but may PUSHF/POPF.
1114 */ 478 */
1115 static const char *uaccess_safe_builtin[] = { 479 static const char *uaccess_safe_builtin[] = {
1116 /* KASAN */ 480 /* KASAN */
1117 "kasan_report", 481 "kasan_report",
1118 "kasan_check_range", !! 482 "check_memory_region",
1119 /* KASAN out-of-line */ 483 /* KASAN out-of-line */
1120 "__asan_loadN_noabort", 484 "__asan_loadN_noabort",
1121 "__asan_load1_noabort", 485 "__asan_load1_noabort",
1122 "__asan_load2_noabort", 486 "__asan_load2_noabort",
1123 "__asan_load4_noabort", 487 "__asan_load4_noabort",
1124 "__asan_load8_noabort", 488 "__asan_load8_noabort",
1125 "__asan_load16_noabort", 489 "__asan_load16_noabort",
1126 "__asan_storeN_noabort", 490 "__asan_storeN_noabort",
1127 "__asan_store1_noabort", 491 "__asan_store1_noabort",
1128 "__asan_store2_noabort", 492 "__asan_store2_noabort",
1129 "__asan_store4_noabort", 493 "__asan_store4_noabort",
1130 "__asan_store8_noabort", 494 "__asan_store8_noabort",
1131 "__asan_store16_noabort", 495 "__asan_store16_noabort",
1132 "__kasan_check_read", <<
1133 "__kasan_check_write", <<
1134 /* KASAN in-line */ 496 /* KASAN in-line */
1135 "__asan_report_load_n_noabort", 497 "__asan_report_load_n_noabort",
1136 "__asan_report_load1_noabort", 498 "__asan_report_load1_noabort",
1137 "__asan_report_load2_noabort", 499 "__asan_report_load2_noabort",
1138 "__asan_report_load4_noabort", 500 "__asan_report_load4_noabort",
1139 "__asan_report_load8_noabort", 501 "__asan_report_load8_noabort",
1140 "__asan_report_load16_noabort", 502 "__asan_report_load16_noabort",
1141 "__asan_report_store_n_noabort", 503 "__asan_report_store_n_noabort",
1142 "__asan_report_store1_noabort", 504 "__asan_report_store1_noabort",
1143 "__asan_report_store2_noabort", 505 "__asan_report_store2_noabort",
1144 "__asan_report_store4_noabort", 506 "__asan_report_store4_noabort",
1145 "__asan_report_store8_noabort", 507 "__asan_report_store8_noabort",
1146 "__asan_report_store16_noabort", 508 "__asan_report_store16_noabort",
1147 /* KCSAN */ 509 /* KCSAN */
1148 "__kcsan_check_access", 510 "__kcsan_check_access",
1149 "__kcsan_mb", <<
1150 "__kcsan_wmb", <<
1151 "__kcsan_rmb", <<
1152 "__kcsan_release", <<
1153 "kcsan_found_watchpoint", 511 "kcsan_found_watchpoint",
1154 "kcsan_setup_watchpoint", 512 "kcsan_setup_watchpoint",
1155 "kcsan_check_scoped_accesses", 513 "kcsan_check_scoped_accesses",
1156 "kcsan_disable_current", 514 "kcsan_disable_current",
1157 "kcsan_enable_current_nowarn", 515 "kcsan_enable_current_nowarn",
1158 /* KCSAN/TSAN */ 516 /* KCSAN/TSAN */
1159 "__tsan_func_entry", 517 "__tsan_func_entry",
1160 "__tsan_func_exit", 518 "__tsan_func_exit",
1161 "__tsan_read_range", 519 "__tsan_read_range",
1162 "__tsan_write_range", 520 "__tsan_write_range",
1163 "__tsan_read1", 521 "__tsan_read1",
1164 "__tsan_read2", 522 "__tsan_read2",
1165 "__tsan_read4", 523 "__tsan_read4",
1166 "__tsan_read8", 524 "__tsan_read8",
1167 "__tsan_read16", 525 "__tsan_read16",
1168 "__tsan_write1", 526 "__tsan_write1",
1169 "__tsan_write2", 527 "__tsan_write2",
1170 "__tsan_write4", 528 "__tsan_write4",
1171 "__tsan_write8", 529 "__tsan_write8",
1172 "__tsan_write16", 530 "__tsan_write16",
1173 "__tsan_read_write1", <<
1174 "__tsan_read_write2", <<
1175 "__tsan_read_write4", <<
1176 "__tsan_read_write8", <<
1177 "__tsan_read_write16", <<
1178 "__tsan_volatile_read1", <<
1179 "__tsan_volatile_read2", <<
1180 "__tsan_volatile_read4", <<
1181 "__tsan_volatile_read8", <<
1182 "__tsan_volatile_read16", <<
1183 "__tsan_volatile_write1", <<
1184 "__tsan_volatile_write2", <<
1185 "__tsan_volatile_write4", <<
1186 "__tsan_volatile_write8", <<
1187 "__tsan_volatile_write16", <<
1188 "__tsan_atomic8_load", <<
1189 "__tsan_atomic16_load", <<
1190 "__tsan_atomic32_load", <<
1191 "__tsan_atomic64_load", <<
1192 "__tsan_atomic8_store", <<
1193 "__tsan_atomic16_store", <<
1194 "__tsan_atomic32_store", <<
1195 "__tsan_atomic64_store", <<
1196 "__tsan_atomic8_exchange", <<
1197 "__tsan_atomic16_exchange", <<
1198 "__tsan_atomic32_exchange", <<
1199 "__tsan_atomic64_exchange", <<
1200 "__tsan_atomic8_fetch_add", <<
1201 "__tsan_atomic16_fetch_add", <<
1202 "__tsan_atomic32_fetch_add", <<
1203 "__tsan_atomic64_fetch_add", <<
1204 "__tsan_atomic8_fetch_sub", <<
1205 "__tsan_atomic16_fetch_sub", <<
1206 "__tsan_atomic32_fetch_sub", <<
1207 "__tsan_atomic64_fetch_sub", <<
1208 "__tsan_atomic8_fetch_and", <<
1209 "__tsan_atomic16_fetch_and", <<
1210 "__tsan_atomic32_fetch_and", <<
1211 "__tsan_atomic64_fetch_and", <<
1212 "__tsan_atomic8_fetch_or", <<
1213 "__tsan_atomic16_fetch_or", <<
1214 "__tsan_atomic32_fetch_or", <<
1215 "__tsan_atomic64_fetch_or", <<
1216 "__tsan_atomic8_fetch_xor", <<
1217 "__tsan_atomic16_fetch_xor", <<
1218 "__tsan_atomic32_fetch_xor", <<
1219 "__tsan_atomic64_fetch_xor", <<
1220 "__tsan_atomic8_fetch_nand", <<
1221 "__tsan_atomic16_fetch_nand", <<
1222 "__tsan_atomic32_fetch_nand", <<
1223 "__tsan_atomic64_fetch_nand", <<
1224 "__tsan_atomic8_compare_exchange_stro <<
1225 "__tsan_atomic16_compare_exchange_str <<
1226 "__tsan_atomic32_compare_exchange_str <<
1227 "__tsan_atomic64_compare_exchange_str <<
1228 "__tsan_atomic8_compare_exchange_weak <<
1229 "__tsan_atomic16_compare_exchange_wea <<
1230 "__tsan_atomic32_compare_exchange_wea <<
1231 "__tsan_atomic64_compare_exchange_wea <<
1232 "__tsan_atomic8_compare_exchange_val" <<
1233 "__tsan_atomic16_compare_exchange_val <<
1234 "__tsan_atomic32_compare_exchange_val <<
1235 "__tsan_atomic64_compare_exchange_val <<
1236 "__tsan_atomic_thread_fence", <<
1237 "__tsan_atomic_signal_fence", <<
1238 "__tsan_unaligned_read16", <<
1239 "__tsan_unaligned_write16", <<
1240 /* KCOV */ 531 /* KCOV */
1241 "write_comp_data", 532 "write_comp_data",
1242 "check_kcov_mode", 533 "check_kcov_mode",
1243 "__sanitizer_cov_trace_pc", 534 "__sanitizer_cov_trace_pc",
1244 "__sanitizer_cov_trace_const_cmp1", 535 "__sanitizer_cov_trace_const_cmp1",
1245 "__sanitizer_cov_trace_const_cmp2", 536 "__sanitizer_cov_trace_const_cmp2",
1246 "__sanitizer_cov_trace_const_cmp4", 537 "__sanitizer_cov_trace_const_cmp4",
1247 "__sanitizer_cov_trace_const_cmp8", 538 "__sanitizer_cov_trace_const_cmp8",
1248 "__sanitizer_cov_trace_cmp1", 539 "__sanitizer_cov_trace_cmp1",
1249 "__sanitizer_cov_trace_cmp2", 540 "__sanitizer_cov_trace_cmp2",
1250 "__sanitizer_cov_trace_cmp4", 541 "__sanitizer_cov_trace_cmp4",
1251 "__sanitizer_cov_trace_cmp8", 542 "__sanitizer_cov_trace_cmp8",
1252 "__sanitizer_cov_trace_switch", 543 "__sanitizer_cov_trace_switch",
1253 /* KMSAN */ <<
1254 "kmsan_copy_to_user", <<
1255 "kmsan_disable_current", <<
1256 "kmsan_enable_current", <<
1257 "kmsan_report", <<
1258 "kmsan_unpoison_entry_regs", <<
1259 "kmsan_unpoison_memory", <<
1260 "__msan_chain_origin", <<
1261 "__msan_get_context_state", <<
1262 "__msan_instrument_asm_store", <<
1263 "__msan_metadata_ptr_for_load_1", <<
1264 "__msan_metadata_ptr_for_load_2", <<
1265 "__msan_metadata_ptr_for_load_4", <<
1266 "__msan_metadata_ptr_for_load_8", <<
1267 "__msan_metadata_ptr_for_load_n", <<
1268 "__msan_metadata_ptr_for_store_1", <<
1269 "__msan_metadata_ptr_for_store_2", <<
1270 "__msan_metadata_ptr_for_store_4", <<
1271 "__msan_metadata_ptr_for_store_8", <<
1272 "__msan_metadata_ptr_for_store_n", <<
1273 "__msan_poison_alloca", <<
1274 "__msan_warning", <<
1275 /* UBSAN */ 544 /* UBSAN */
1276 "ubsan_type_mismatch_common", 545 "ubsan_type_mismatch_common",
1277 "__ubsan_handle_type_mismatch", 546 "__ubsan_handle_type_mismatch",
1278 "__ubsan_handle_type_mismatch_v1", 547 "__ubsan_handle_type_mismatch_v1",
1279 "__ubsan_handle_shift_out_of_bounds", 548 "__ubsan_handle_shift_out_of_bounds",
1280 "__ubsan_handle_load_invalid_value", <<
1281 /* STACKLEAK */ <<
1282 "stackleak_track_stack", <<
1283 /* misc */ 549 /* misc */
1284 "csum_partial_copy_generic", 550 "csum_partial_copy_generic",
1285 "copy_mc_fragile", 551 "copy_mc_fragile",
1286 "copy_mc_fragile_handle_tail", 552 "copy_mc_fragile_handle_tail",
1287 "copy_mc_enhanced_fast_string", 553 "copy_mc_enhanced_fast_string",
1288 "ftrace_likely_update", /* CONFIG_TRA 554 "ftrace_likely_update", /* CONFIG_TRACE_BRANCH_PROFILING */
1289 "rep_stos_alternative", <<
1290 "rep_movs_alternative", <<
1291 "__copy_user_nocache", <<
1292 NULL 555 NULL
1293 }; 556 };
1294 557
1295 static void add_uaccess_safe(struct objtool_f 558 static void add_uaccess_safe(struct objtool_file *file)
1296 { 559 {
1297 struct symbol *func; 560 struct symbol *func;
1298 const char **name; 561 const char **name;
1299 562
1300 if (!opts.uaccess) !! 563 if (!uaccess)
1301 return; 564 return;
1302 565
1303 for (name = uaccess_safe_builtin; *na 566 for (name = uaccess_safe_builtin; *name; name++) {
1304 func = find_symbol_by_name(fi 567 func = find_symbol_by_name(file->elf, *name);
1305 if (!func) 568 if (!func)
1306 continue; 569 continue;
1307 570
1308 func->uaccess_safe = true; 571 func->uaccess_safe = true;
1309 } 572 }
1310 } 573 }
1311 574
1312 /* 575 /*
1313 * FIXME: For now, just ignore any alternativ 576 * FIXME: For now, just ignore any alternatives which add retpolines. This is
1314 * a temporary hack, as it doesn't allow ORC 577 * a temporary hack, as it doesn't allow ORC to unwind from inside a retpoline.
1315 * But it at least allows objtool to understa 578 * But it at least allows objtool to understand the control flow *around* the
1316 * retpoline. 579 * retpoline.
1317 */ 580 */
1318 static int add_ignore_alternatives(struct obj 581 static int add_ignore_alternatives(struct objtool_file *file)
1319 { 582 {
1320 struct section *rsec; !! 583 struct section *sec;
1321 struct reloc *reloc; !! 584 struct rela *rela;
1322 struct instruction *insn; 585 struct instruction *insn;
1323 586
1324 rsec = find_section_by_name(file->elf !! 587 sec = find_section_by_name(file->elf, ".rela.discard.ignore_alts");
1325 if (!rsec) !! 588 if (!sec)
1326 return 0; 589 return 0;
1327 590
1328 for_each_reloc(rsec, reloc) { !! 591 list_for_each_entry(rela, &sec->rela_list, list) {
1329 if (reloc->sym->type != STT_S !! 592 if (rela->sym->type != STT_SECTION) {
1330 WARN("unexpected relo !! 593 WARN("unexpected relocation symbol type in %s", sec->name);
1331 return -1; 594 return -1;
1332 } 595 }
1333 596
1334 insn = find_insn(file, reloc- !! 597 insn = find_insn(file, rela->sym->sec, rela->addend);
1335 if (!insn) { 598 if (!insn) {
1336 WARN("bad .discard.ig 599 WARN("bad .discard.ignore_alts entry");
1337 return -1; 600 return -1;
1338 } 601 }
1339 602
1340 insn->ignore_alts = true; 603 insn->ignore_alts = true;
1341 } 604 }
1342 605
1343 return 0; 606 return 0;
1344 } 607 }
1345 608
1346 /* 609 /*
1347 * Symbols that replace INSN_CALL_DYNAMIC, ev <<
1348 * will be added to the .retpoline_sites sect <<
1349 */ <<
1350 __weak bool arch_is_retpoline(struct symbol * <<
1351 { <<
1352 return false; <<
1353 } <<
1354 <<
1355 /* <<
1356 * Symbols that replace INSN_RETURN, every (t <<
1357 * will be added to the .return_sites section <<
1358 */ <<
1359 __weak bool arch_is_rethunk(struct symbol *sy <<
1360 { <<
1361 return false; <<
1362 } <<
1363 <<
1364 /* <<
1365 * Symbols that are embedded inside other ins <<
1366 * code exists. These are mostly ignored for <<
1367 */ <<
1368 __weak bool arch_is_embedded_insn(struct symb <<
1369 { <<
1370 return false; <<
1371 } <<
1372 <<
1373 static struct reloc *insn_reloc(struct objtoo <<
1374 { <<
1375 struct reloc *reloc; <<
1376 <<
1377 if (insn->no_reloc) <<
1378 return NULL; <<
1379 <<
1380 if (!file) <<
1381 return NULL; <<
1382 <<
1383 reloc = find_reloc_by_dest_range(file <<
1384 insn <<
1385 if (!reloc) { <<
1386 insn->no_reloc = 1; <<
1387 return NULL; <<
1388 } <<
1389 <<
1390 return reloc; <<
1391 } <<
1392 <<
1393 static void remove_insn_ops(struct instructio <<
1394 { <<
1395 struct stack_op *op, *next; <<
1396 <<
1397 for (op = insn->stack_ops; op; op = n <<
1398 next = op->next; <<
1399 free(op); <<
1400 } <<
1401 insn->stack_ops = NULL; <<
1402 } <<
1403 <<
1404 static void annotate_call_site(struct objtool <<
1405 struct instruc <<
1406 { <<
1407 struct reloc *reloc = insn_reloc(file <<
1408 struct symbol *sym = insn_call_dest(i <<
1409 <<
1410 if (!sym) <<
1411 sym = reloc->sym; <<
1412 <<
1413 /* <<
1414 * Alternative replacement code is ju <<
1415 * sometimes copied to the original i <<
1416 * annotate it. (In the future we mig <<
1417 * original instruction if/when it ev <<
1418 */ <<
1419 if (!strcmp(insn->sec->name, ".altins <<
1420 return; <<
1421 <<
1422 if (sym->static_call_tramp) { <<
1423 list_add_tail(&insn->call_nod <<
1424 return; <<
1425 } <<
1426 <<
1427 if (sym->retpoline_thunk) { <<
1428 list_add_tail(&insn->call_nod <<
1429 return; <<
1430 } <<
1431 <<
1432 /* <<
1433 * Many compilers cannot disable KCOV <<
1434 * attribute so they need a little he <<
1435 * noinstr text. <<
1436 */ <<
1437 if (opts.hack_noinstr && insn->sec->n <<
1438 if (reloc) <<
1439 set_reloc_type(file-> <<
1440 <<
1441 elf_write_insn(file->elf, ins <<
1442 insn->offset, <<
1443 sibling ? arch <<
1444 : arch <<
1445 <<
1446 insn->type = sibling ? INSN_R <<
1447 <<
1448 if (sibling) { <<
1449 /* <<
1450 * We've replaced the <<
1451 * insn: RET; INT3, e <<
1452 * insn here. Mark it <<
1453 * warning, instead o <<
1454 */ <<
1455 insn->retpoline_safe <<
1456 } <<
1457 <<
1458 return; <<
1459 } <<
1460 <<
1461 if (opts.mcount && sym->fentry) { <<
1462 if (sibling) <<
1463 WARN_INSN(insn, "tail <<
1464 if (opts.mnop) { <<
1465 if (reloc) <<
1466 set_reloc_typ <<
1467 <<
1468 elf_write_insn(file-> <<
1469 insn-> <<
1470 arch_n <<
1471 <<
1472 insn->type = INSN_NOP <<
1473 } <<
1474 <<
1475 list_add_tail(&insn->call_nod <<
1476 return; <<
1477 } <<
1478 <<
1479 if (insn->type == INSN_CALL && !insn- <<
1480 list_add_tail(&insn->call_nod <<
1481 <<
1482 if (!sibling && dead_end_function(fil <<
1483 insn->dead_end = true; <<
1484 } <<
1485 <<
1486 static void add_call_dest(struct objtool_file <<
1487 struct symbol *dest <<
1488 { <<
1489 insn->_call_dest = dest; <<
1490 if (!dest) <<
1491 return; <<
1492 <<
1493 /* <<
1494 * Whatever stack impact regular CALL <<
1495 * by the RETURN of the called functi <<
1496 * <<
1497 * Annotated intra-function calls ret <<
1498 * are converted to JUMP, see read_in <<
1499 */ <<
1500 remove_insn_ops(insn); <<
1501 <<
1502 annotate_call_site(file, insn, siblin <<
1503 } <<
1504 <<
1505 static void add_retpoline_call(struct objtool <<
1506 { <<
1507 /* <<
1508 * Retpoline calls/jumps are really d <<
1509 * so convert them accordingly. <<
1510 */ <<
1511 switch (insn->type) { <<
1512 case INSN_CALL: <<
1513 insn->type = INSN_CALL_DYNAMI <<
1514 break; <<
1515 case INSN_JUMP_UNCONDITIONAL: <<
1516 insn->type = INSN_JUMP_DYNAMI <<
1517 break; <<
1518 case INSN_JUMP_CONDITIONAL: <<
1519 insn->type = INSN_JUMP_DYNAMI <<
1520 break; <<
1521 default: <<
1522 return; <<
1523 } <<
1524 <<
1525 insn->retpoline_safe = true; <<
1526 <<
1527 /* <<
1528 * Whatever stack impact regular CALL <<
1529 * by the RETURN of the called functi <<
1530 * <<
1531 * Annotated intra-function calls ret <<
1532 * are converted to JUMP, see read_in <<
1533 */ <<
1534 remove_insn_ops(insn); <<
1535 <<
1536 annotate_call_site(file, insn, false) <<
1537 } <<
1538 <<
1539 static void add_return_call(struct objtool_fi <<
1540 { <<
1541 /* <<
1542 * Return thunk tail calls are really <<
1543 * so convert them accordingly. <<
1544 */ <<
1545 insn->type = INSN_RETURN; <<
1546 insn->retpoline_safe = true; <<
1547 <<
1548 if (add) <<
1549 list_add_tail(&insn->call_nod <<
1550 } <<
1551 <<
1552 static bool is_first_func_insn(struct objtool <<
1553 struct instruc <<
1554 { <<
1555 if (insn->offset == sym->offset) <<
1556 return true; <<
1557 <<
1558 /* Allow direct CALL/JMP past ENDBR * <<
1559 if (opts.ibt) { <<
1560 struct instruction *prev = pr <<
1561 <<
1562 if (prev && prev->type == INS <<
1563 insn->offset == sym->offs <<
1564 return true; <<
1565 } <<
1566 <<
1567 return false; <<
1568 } <<
1569 <<
1570 /* <<
1571 * A sibling call is a tail-call to another s <<
1572 * recursive tail-call which is to the same s <<
1573 */ <<
1574 static bool jump_is_sibling_call(struct objto <<
1575 struct instr <<
1576 { <<
1577 struct symbol *fs = from->sym; <<
1578 struct symbol *ts = to->sym; <<
1579 <<
1580 /* Not a sibling call if from/to a sy <<
1581 if (!fs || !ts) <<
1582 return false; <<
1583 <<
1584 /* Not a sibling call if not targetin <<
1585 if (!is_first_func_insn(file, to, ts) <<
1586 return false; <<
1587 <<
1588 /* Disallow sibling calls into STT_NO <<
1589 if (ts->type == STT_NOTYPE) <<
1590 return false; <<
1591 <<
1592 /* Must not be self to be a sibling * <<
1593 return fs->pfunc != ts->pfunc; <<
1594 } <<
1595 <<
1596 /* <<
1597 * Find the destination instructions for all 610 * Find the destination instructions for all jumps.
1598 */ 611 */
1599 static int add_jump_destinations(struct objto 612 static int add_jump_destinations(struct objtool_file *file)
1600 { 613 {
1601 struct instruction *insn, *jump_dest; !! 614 struct instruction *insn;
1602 struct reloc *reloc; !! 615 struct rela *rela;
1603 struct section *dest_sec; 616 struct section *dest_sec;
1604 unsigned long dest_off; 617 unsigned long dest_off;
1605 618
1606 for_each_insn(file, insn) { 619 for_each_insn(file, insn) {
1607 if (insn->jump_dest) { <<
1608 /* <<
1609 * handle_group_alt() <<
1610 * 'jump_dest' for so <<
1611 */ <<
1612 continue; <<
1613 } <<
1614 if (!is_static_jump(insn)) 620 if (!is_static_jump(insn))
1615 continue; 621 continue;
1616 622
1617 reloc = insn_reloc(file, insn !! 623 if (insn->offset == FAKE_JUMP_OFFSET)
1618 if (!reloc) { !! 624 continue;
>> 625
>> 626 rela = find_rela_by_dest_range(file->elf, insn->sec,
>> 627 insn->offset, insn->len);
>> 628 if (!rela) {
1619 dest_sec = insn->sec; 629 dest_sec = insn->sec;
1620 dest_off = arch_jump_ 630 dest_off = arch_jump_destination(insn);
1621 } else if (reloc->sym->type = !! 631 } else if (rela->sym->type == STT_SECTION) {
1622 dest_sec = reloc->sym !! 632 dest_sec = rela->sym->sec;
1623 dest_off = arch_dest_ !! 633 dest_off = arch_dest_rela_offset(rela->addend);
1624 } else if (reloc->sym->retpol !! 634 } else if (rela->sym->sec->idx) {
1625 add_retpoline_call(fi !! 635 dest_sec = rela->sym->sec;
1626 continue; !! 636 dest_off = rela->sym->sym.st_value +
1627 } else if (reloc->sym->return !! 637 arch_dest_rela_offset(rela->addend);
1628 add_return_call(file, !! 638 } else if (strstr(rela->sym->name, "_indirect_thunk_")) {
1629 continue; <<
1630 } else if (insn_func(insn)) { <<
1631 /* 639 /*
1632 * External sibling c !! 640 * Retpoline jumps are really dynamic jumps in
1633 * STT_FUNC reloc. !! 641 * disguise, so convert them accordingly.
1634 */ 642 */
1635 add_call_dest(file, i !! 643 if (insn->type == INSN_JUMP_UNCONDITIONAL)
>> 644 insn->type = INSN_JUMP_DYNAMIC;
>> 645 else
>> 646 insn->type = INSN_JUMP_DYNAMIC_CONDITIONAL;
>> 647
>> 648 insn->retpoline_safe = true;
1636 continue; 649 continue;
1637 } else if (reloc->sym->sec->i <<
1638 dest_sec = reloc->sym <<
1639 dest_off = reloc->sym <<
1640 arch_dest_ <<
1641 } else { 650 } else {
1642 /* non-func asm code !! 651 /* external sibling call */
>> 652 insn->call_dest = rela->sym;
1643 continue; 653 continue;
1644 } 654 }
1645 655
1646 jump_dest = find_insn(file, d !! 656 insn->jump_dest = find_insn(file, dest_sec, dest_off);
1647 if (!jump_dest) { !! 657 if (!insn->jump_dest) {
1648 struct symbol *sym = <<
1649 658
1650 /* 659 /*
1651 * This is a special !! 660 * This is a special case where an alt instruction
1652 * It jumps to __x86_ !! 661 * jumps past the end of the section. These are
1653 * can't find the thu !! 662 * handled later in handle_group_alt().
1654 * instruction, becau <<
1655 * middle of another <<
1656 * knows about the ou <<
1657 */ 663 */
1658 if (sym && sym->embed !! 664 if (!strcmp(insn->sec->name, ".altinstr_replacement"))
1659 add_return_ca <<
1660 continue; 665 continue;
1661 } <<
1662 666
1663 WARN_INSN(insn, "can' !! 667 WARN_FUNC("can't find jump dest instruction at %s+0x%lx",
1664 dest_sec->n !! 668 insn->sec, insn->offset, dest_sec->name,
>> 669 dest_off);
1665 return -1; 670 return -1;
1666 } 671 }
1667 672
1668 /* 673 /*
1669 * An intra-TU jump in retpol <<
1670 * for its jump dest, in whic <<
1671 * add_{retpoline,return}_cal <<
1672 */ <<
1673 if (jump_dest->sym && jump_de <<
1674 if (jump_dest->sym->r <<
1675 add_retpoline <<
1676 continue; <<
1677 } <<
1678 if (jump_dest->sym->r <<
1679 add_return_ca <<
1680 continue; <<
1681 } <<
1682 } <<
1683 <<
1684 /* <<
1685 * Cross-function jump. 674 * Cross-function jump.
1686 */ 675 */
1687 if (insn_func(insn) && insn_f !! 676 if (insn->func && insn->jump_dest->func &&
1688 insn_func(insn) != insn_f !! 677 insn->func != insn->jump_dest->func) {
1689 678
1690 /* 679 /*
1691 * For GCC 8+, create 680 * For GCC 8+, create parent/child links for any cold
1692 * subfunctions. Thi 681 * subfunctions. This is _mostly_ redundant with a
1693 * similar initializa 682 * similar initialization in read_symbols().
1694 * 683 *
1695 * If a function has 684 * If a function has aliases, we want the *first* such
1696 * function in the sy 685 * function in the symbol table to be the subfunction's
1697 * parent. In that c 686 * parent. In that case we overwrite the
1698 * initialization don 687 * initialization done in read_symbols().
1699 * 688 *
1700 * However this code 689 * However this code can't completely replace the
1701 * read_symbols() cod 690 * read_symbols() code because this doesn't detect the
1702 * case where the par 691 * case where the parent function's only reference to a
1703 * subfunction is thr 692 * subfunction is through a jump table.
1704 */ 693 */
1705 if (!strstr(insn_func !! 694 if (!strstr(insn->func->name, ".cold.") &&
1706 strstr(insn_func( !! 695 strstr(insn->jump_dest->func->name, ".cold.")) {
1707 insn_func(ins !! 696 insn->func->cfunc = insn->jump_dest->func;
1708 insn_func(jum !! 697 insn->jump_dest->func->pfunc = insn->func;
1709 } <<
1710 } <<
1711 698
1712 if (jump_is_sibling_call(file !! 699 } else if (insn->jump_dest->func->pfunc != insn->func->pfunc &&
1713 /* !! 700 insn->jump_dest->offset == insn->jump_dest->func->offset) {
1714 * Internal sibling c <<
1715 * STT_SECTION reloc. <<
1716 */ <<
1717 add_call_dest(file, i <<
1718 continue; <<
1719 } <<
1720 701
1721 insn->jump_dest = jump_dest; !! 702 /* internal sibling call */
>> 703 insn->call_dest = insn->jump_dest->func;
>> 704 }
>> 705 }
1722 } 706 }
1723 707
1724 return 0; 708 return 0;
1725 } 709 }
1726 710
1727 static struct symbol *find_call_destination(s !! 711 static void remove_insn_ops(struct instruction *insn)
1728 { 712 {
1729 struct symbol *call_dest; !! 713 struct stack_op *op, *tmp;
1730 714
1731 call_dest = find_func_by_offset(sec, !! 715 list_for_each_entry_safe(op, tmp, &insn->stack_ops, list) {
1732 if (!call_dest) !! 716 list_del(&op->list);
1733 call_dest = find_symbol_by_of !! 717 free(op);
1734 !! 718 }
1735 return call_dest; <<
1736 } 719 }
1737 720
1738 /* 721 /*
1739 * Find the destination instructions for all 722 * Find the destination instructions for all calls.
1740 */ 723 */
1741 static int add_call_destinations(struct objto 724 static int add_call_destinations(struct objtool_file *file)
1742 { 725 {
1743 struct instruction *insn; 726 struct instruction *insn;
1744 unsigned long dest_off; 727 unsigned long dest_off;
1745 struct symbol *dest; !! 728 struct rela *rela;
1746 struct reloc *reloc; <<
1747 729
1748 for_each_insn(file, insn) { 730 for_each_insn(file, insn) {
1749 if (insn->type != INSN_CALL) 731 if (insn->type != INSN_CALL)
1750 continue; 732 continue;
1751 733
1752 reloc = insn_reloc(file, insn !! 734 rela = find_rela_by_dest_range(file->elf, insn->sec,
1753 if (!reloc) { !! 735 insn->offset, insn->len);
>> 736 if (!rela) {
1754 dest_off = arch_jump_ 737 dest_off = arch_jump_destination(insn);
1755 dest = find_call_dest !! 738 insn->call_dest = find_func_by_offset(insn->sec, dest_off);
1756 !! 739 if (!insn->call_dest)
1757 add_call_dest(file, i !! 740 insn->call_dest = find_symbol_by_offset(insn->sec, dest_off);
1758 741
1759 if (insn->ignore) 742 if (insn->ignore)
1760 continue; 743 continue;
1761 744
1762 if (!insn_call_dest(i !! 745 if (!insn->call_dest) {
1763 WARN_INSN(ins !! 746 WARN_FUNC("unannotated intra-function call", insn->sec, insn->offset);
1764 return -1; 747 return -1;
1765 } 748 }
1766 749
1767 if (insn_func(insn) & !! 750 if (insn->func && insn->call_dest->type != STT_FUNC) {
1768 WARN_INSN(ins !! 751 WARN_FUNC("unsupported call to non-function",
>> 752 insn->sec, insn->offset);
1769 return -1; 753 return -1;
1770 } 754 }
1771 755
1772 } else if (reloc->sym->type = !! 756 } else if (rela->sym->type == STT_SECTION) {
1773 dest_off = arch_dest_ !! 757 dest_off = arch_dest_rela_offset(rela->addend);
1774 dest = find_call_dest !! 758 insn->call_dest = find_func_by_offset(rela->sym->sec,
1775 if (!dest) { !! 759 dest_off);
1776 WARN_INSN(ins !! 760 if (!insn->call_dest) {
1777 rel !! 761 WARN_FUNC("can't find call dest symbol at %s+0x%lx",
>> 762 insn->sec, insn->offset,
>> 763 rela->sym->sec->name,
>> 764 dest_off);
1778 return -1; 765 return -1;
1779 } 766 }
>> 767 } else
>> 768 insn->call_dest = rela->sym;
1780 769
1781 add_call_dest(file, i !! 770 /*
>> 771 * Many compilers cannot disable KCOV with a function attribute
>> 772 * so they need a little help, NOP out any KCOV calls from noinstr
>> 773 * text.
>> 774 */
>> 775 if (insn->sec->noinstr &&
>> 776 !strncmp(insn->call_dest->name, "__sanitizer_cov_", 16)) {
>> 777 if (rela) {
>> 778 rela->type = R_NONE;
>> 779 elf_write_rela(file->elf, rela);
>> 780 }
1782 781
1783 } else if (reloc->sym->retpol !! 782 elf_write_insn(file->elf, insn->sec,
1784 add_retpoline_call(fi !! 783 insn->offset, insn->len,
>> 784 arch_nop_insn(insn->len));
>> 785 insn->type = INSN_NOP;
>> 786 }
1785 787
1786 } else !! 788 /*
1787 add_call_dest(file, i !! 789 * Whatever stack impact regular CALLs have, should be undone
>> 790 * by the RETURN of the called function.
>> 791 *
>> 792 * Annotated intra-function calls retain the stack_ops but
>> 793 * are converted to JUMP, see read_intra_function_calls().
>> 794 */
>> 795 remove_insn_ops(insn);
1788 } 796 }
1789 797
1790 return 0; 798 return 0;
1791 } 799 }
1792 800
1793 /* 801 /*
1794 * The .alternatives section requires some ex !! 802 * The .alternatives section requires some extra special care, over and above
1795 * other special sections because alternative !! 803 * what other special sections require:
>> 804 *
>> 805 * 1. Because alternatives are patched in-place, we need to insert a fake jump
>> 806 * instruction at the end so that validate_branch() skips all the original
>> 807 * replaced instructions when validating the new instruction path.
>> 808 *
>> 809 * 2. An added wrinkle is that the new instruction length might be zero. In
>> 810 * that case the old instructions are replaced with noops. We simulate that
>> 811 * by creating a fake jump as the only new instruction.
>> 812 *
>> 813 * 3. In some cases, the alternative section includes an instruction which
>> 814 * conditionally jumps to the _end_ of the entry. We have to modify these
>> 815 * jumps' destinations to point back to .text rather than the end of the
>> 816 * entry in .altinstr_replacement.
1796 */ 817 */
1797 static int handle_group_alt(struct objtool_fi 818 static int handle_group_alt(struct objtool_file *file,
1798 struct special_al 819 struct special_alt *special_alt,
1799 struct instructio 820 struct instruction *orig_insn,
1800 struct instructio 821 struct instruction **new_insn)
1801 { 822 {
1802 struct instruction *last_new_insn = N !! 823 static unsigned int alt_group_next_index = 1;
1803 struct alt_group *orig_alt_group, *ne !! 824 struct instruction *last_orig_insn, *last_new_insn, *insn, *fake_jump = NULL;
>> 825 unsigned int alt_group = alt_group_next_index++;
1804 unsigned long dest_off; 826 unsigned long dest_off;
1805 827
1806 orig_alt_group = orig_insn->alt_group !! 828 last_orig_insn = NULL;
1807 if (!orig_alt_group) { !! 829 insn = orig_insn;
1808 struct instruction *last_orig !! 830 sec_for_each_insn_from(file, insn) {
1809 !! 831 if (insn->offset >= special_alt->orig_off + special_alt->orig_len)
1810 orig_alt_group = malloc(sizeo !! 832 break;
1811 if (!orig_alt_group) { <<
1812 WARN("malloc failed") <<
1813 return -1; <<
1814 } <<
1815 orig_alt_group->cfi = calloc( <<
1816 <<
1817 if (!orig_alt_group->cfi) { <<
1818 WARN("calloc failed") <<
1819 return -1; <<
1820 } <<
1821 <<
1822 insn = orig_insn; <<
1823 sec_for_each_insn_from(file, <<
1824 if (insn->offset >= s <<
1825 break; <<
1826 <<
1827 insn->alt_group = ori <<
1828 last_orig_insn = insn <<
1829 } <<
1830 orig_alt_group->orig_group = <<
1831 orig_alt_group->first_insn = <<
1832 orig_alt_group->last_insn = l <<
1833 orig_alt_group->nop = NULL; <<
1834 } else { <<
1835 if (orig_alt_group->last_insn <<
1836 orig_alt_group->first_ins <<
1837 WARN_INSN(orig_insn, <<
1838 orig_alt_gr <<
1839 orig_alt_gr <<
1840 orig_alt_gr <<
1841 special_alt <<
1842 return -1; <<
1843 } <<
1844 } <<
1845 833
1846 new_alt_group = malloc(sizeof(*new_al !! 834 insn->alt_group = alt_group;
1847 if (!new_alt_group) { !! 835 last_orig_insn = insn;
1848 WARN("malloc failed"); <<
1849 return -1; <<
1850 } 836 }
1851 837
1852 if (special_alt->new_len < special_al !! 838 if (next_insn_same_sec(file, last_orig_insn)) {
1853 /* !! 839 fake_jump = malloc(sizeof(*fake_jump));
1854 * Insert a fake nop at the e !! 840 if (!fake_jump) {
1855 * alt_group the same size as <<
1856 * allow propagate_alt_cfi() <<
1857 * instruction affects the st <<
1858 * nop) will propagate the ne <<
1859 */ <<
1860 nop = malloc(sizeof(*nop)); <<
1861 if (!nop) { <<
1862 WARN("malloc failed") 841 WARN("malloc failed");
1863 return -1; 842 return -1;
1864 } 843 }
1865 memset(nop, 0, sizeof(*nop)); !! 844 memset(fake_jump, 0, sizeof(*fake_jump));
1866 !! 845 INIT_LIST_HEAD(&fake_jump->alts);
1867 nop->sec = special_alt->new_s !! 846 INIT_LIST_HEAD(&fake_jump->stack_ops);
1868 nop->offset = special_alt->ne !! 847 init_cfi_state(&fake_jump->cfi);
1869 nop->len = special_alt->orig_ !! 848
1870 nop->type = INSN_NOP; !! 849 fake_jump->sec = special_alt->new_sec;
1871 nop->sym = orig_insn->sym; !! 850 fake_jump->offset = FAKE_JUMP_OFFSET;
1872 nop->alt_group = new_alt_grou !! 851 fake_jump->type = INSN_JUMP_UNCONDITIONAL;
1873 nop->ignore = orig_insn->igno !! 852 fake_jump->jump_dest = list_next_entry(last_orig_insn, list);
>> 853 fake_jump->func = orig_insn->func;
1874 } 854 }
1875 855
1876 if (!special_alt->new_len) { 856 if (!special_alt->new_len) {
1877 *new_insn = nop; !! 857 if (!fake_jump) {
1878 goto end; !! 858 WARN("%s: empty alternative at end of section",
>> 859 special_alt->orig_sec->name);
>> 860 return -1;
>> 861 }
>> 862
>> 863 *new_insn = fake_jump;
>> 864 return 0;
1879 } 865 }
1880 866
>> 867 last_new_insn = NULL;
>> 868 alt_group = alt_group_next_index++;
1881 insn = *new_insn; 869 insn = *new_insn;
1882 sec_for_each_insn_from(file, insn) { 870 sec_for_each_insn_from(file, insn) {
1883 struct reloc *alt_reloc; <<
1884 <<
1885 if (insn->offset >= special_a 871 if (insn->offset >= special_alt->new_off + special_alt->new_len)
1886 break; 872 break;
1887 873
1888 last_new_insn = insn; 874 last_new_insn = insn;
1889 875
1890 insn->ignore = orig_insn->ign 876 insn->ignore = orig_insn->ignore_alts;
1891 insn->sym = orig_insn->sym; !! 877 insn->func = orig_insn->func;
1892 insn->alt_group = new_alt_gro !! 878 insn->alt_group = alt_group;
1893 879
1894 /* 880 /*
1895 * Since alternative replacem 881 * Since alternative replacement code is copy/pasted by the
1896 * kernel after applying relo 882 * kernel after applying relocations, generally such code can't
1897 * have relative-address relo 883 * have relative-address relocation references to outside the
1898 * .altinstr_replacement sect 884 * .altinstr_replacement section, unless the arch's
1899 * alternatives code can adju 885 * alternatives code can adjust the relative offsets
1900 * accordingly. 886 * accordingly.
>> 887 *
>> 888 * The x86 alternatives code adjusts the offsets only when it
>> 889 * encounters a branch instruction at the very beginning of the
>> 890 * replacement group.
1901 */ 891 */
1902 alt_reloc = insn_reloc(file, !! 892 if ((insn->offset != special_alt->new_off ||
1903 if (alt_reloc && arch_pc_rela !! 893 (insn->type != INSN_CALL && !is_static_jump(insn))) &&
1904 !arch_support_alt_relocat !! 894 find_rela_by_dest_range(file->elf, insn->sec, insn->offset, insn->len)) {
1905 895
1906 WARN_INSN(insn, "unsu !! 896 WARN_FUNC("unsupported relocation in alternatives section",
>> 897 insn->sec, insn->offset);
1907 return -1; 898 return -1;
1908 } 899 }
1909 900
1910 if (!is_static_jump(insn)) 901 if (!is_static_jump(insn))
1911 continue; 902 continue;
1912 903
1913 if (!insn->immediate) 904 if (!insn->immediate)
1914 continue; 905 continue;
1915 906
1916 dest_off = arch_jump_destinat 907 dest_off = arch_jump_destination(insn);
1917 if (dest_off == special_alt-> 908 if (dest_off == special_alt->new_off + special_alt->new_len) {
1918 insn->jump_dest = nex !! 909 if (!fake_jump) {
1919 if (!insn->jump_dest) !! 910 WARN("%s: alternative jump to end of section",
1920 WARN_INSN(ins !! 911 special_alt->orig_sec->name);
1921 return -1; 912 return -1;
1922 } 913 }
>> 914 insn->jump_dest = fake_jump;
>> 915 }
>> 916
>> 917 if (!insn->jump_dest) {
>> 918 WARN_FUNC("can't find alternative jump destination",
>> 919 insn->sec, insn->offset);
>> 920 return -1;
1923 } 921 }
1924 } 922 }
1925 923
1926 if (!last_new_insn) { 924 if (!last_new_insn) {
1927 WARN_FUNC("can't find last ne 925 WARN_FUNC("can't find last new alternative instruction",
1928 special_alt->new_se 926 special_alt->new_sec, special_alt->new_off);
1929 return -1; 927 return -1;
1930 } 928 }
1931 929
1932 end: !! 930 if (fake_jump)
1933 new_alt_group->orig_group = orig_alt_ !! 931 list_add(&fake_jump->list, &last_new_insn->list);
1934 new_alt_group->first_insn = *new_insn !! 932
1935 new_alt_group->last_insn = last_new_i <<
1936 new_alt_group->nop = nop; <<
1937 new_alt_group->cfi = orig_alt_group-> <<
1938 return 0; 933 return 0;
1939 } 934 }
1940 935
1941 /* 936 /*
1942 * A jump table entry can either convert a no 937 * A jump table entry can either convert a nop to a jump or a jump to a nop.
1943 * If the original instruction is a jump, mak 938 * If the original instruction is a jump, make the alt entry an effective nop
1944 * by just skipping the original instruction. 939 * by just skipping the original instruction.
1945 */ 940 */
1946 static int handle_jump_alt(struct objtool_fil 941 static int handle_jump_alt(struct objtool_file *file,
1947 struct special_alt 942 struct special_alt *special_alt,
1948 struct instruction 943 struct instruction *orig_insn,
1949 struct instruction 944 struct instruction **new_insn)
1950 { 945 {
1951 if (orig_insn->type != INSN_JUMP_UNCO !! 946 if (orig_insn->type == INSN_NOP)
1952 orig_insn->type != INSN_NOP) { !! 947 return 0;
1953 948
1954 WARN_INSN(orig_insn, "unsuppo !! 949 if (orig_insn->type != INSN_JUMP_UNCONDITIONAL) {
>> 950 WARN_FUNC("unsupported instruction at jump label",
>> 951 orig_insn->sec, orig_insn->offset);
1955 return -1; 952 return -1;
1956 } 953 }
1957 954
1958 if (opts.hack_jump_label && special_a !! 955 *new_insn = list_next_entry(orig_insn, list);
1959 struct reloc *reloc = insn_re <<
1960 <<
1961 if (reloc) <<
1962 set_reloc_type(file-> <<
1963 elf_write_insn(file->elf, ori <<
1964 orig_insn->off <<
1965 arch_nop_insn( <<
1966 orig_insn->type = INSN_NOP; <<
1967 } <<
1968 <<
1969 if (orig_insn->type == INSN_NOP) { <<
1970 if (orig_insn->len == 2) <<
1971 file->jl_nop_short++; <<
1972 else <<
1973 file->jl_nop_long++; <<
1974 <<
1975 return 0; <<
1976 } <<
1977 <<
1978 if (orig_insn->len == 2) <<
1979 file->jl_short++; <<
1980 else <<
1981 file->jl_long++; <<
1982 <<
1983 *new_insn = next_insn_same_sec(file, <<
1984 return 0; 956 return 0;
1985 } 957 }
1986 958
1987 /* 959 /*
1988 * Read all the special sections which have a 960 * Read all the special sections which have alternate instructions which can be
1989 * patched in or redirected to at runtime. E 961 * patched in or redirected to at runtime. Each instruction having alternate
1990 * instruction(s) has them added to its insn- 962 * instruction(s) has them added to its insn->alts list, which will be
1991 * traversed in validate_branch(). 963 * traversed in validate_branch().
1992 */ 964 */
1993 static int add_special_section_alts(struct ob 965 static int add_special_section_alts(struct objtool_file *file)
1994 { 966 {
1995 struct list_head special_alts; 967 struct list_head special_alts;
1996 struct instruction *orig_insn, *new_i 968 struct instruction *orig_insn, *new_insn;
1997 struct special_alt *special_alt, *tmp 969 struct special_alt *special_alt, *tmp;
1998 struct alternative *alt; 970 struct alternative *alt;
1999 int ret; 971 int ret;
2000 972
2001 ret = special_get_alts(file->elf, &sp 973 ret = special_get_alts(file->elf, &special_alts);
2002 if (ret) 974 if (ret)
2003 return ret; 975 return ret;
2004 976
2005 list_for_each_entry_safe(special_alt, 977 list_for_each_entry_safe(special_alt, tmp, &special_alts, list) {
2006 978
2007 orig_insn = find_insn(file, s 979 orig_insn = find_insn(file, special_alt->orig_sec,
2008 special 980 special_alt->orig_off);
2009 if (!orig_insn) { 981 if (!orig_insn) {
2010 WARN_FUNC("special: c 982 WARN_FUNC("special: can't find orig instruction",
2011 special_alt 983 special_alt->orig_sec, special_alt->orig_off);
2012 ret = -1; 984 ret = -1;
2013 goto out; 985 goto out;
2014 } 986 }
2015 987
2016 new_insn = NULL; 988 new_insn = NULL;
2017 if (!special_alt->group || sp 989 if (!special_alt->group || special_alt->new_len) {
2018 new_insn = find_insn( 990 new_insn = find_insn(file, special_alt->new_sec,
2019 991 special_alt->new_off);
2020 if (!new_insn) { 992 if (!new_insn) {
2021 WARN_FUNC("sp 993 WARN_FUNC("special: can't find new instruction",
2022 spe 994 special_alt->new_sec,
2023 spe 995 special_alt->new_off);
2024 ret = -1; 996 ret = -1;
2025 goto out; 997 goto out;
2026 } 998 }
2027 } 999 }
2028 1000
2029 if (special_alt->group) { 1001 if (special_alt->group) {
2030 if (!special_alt->ori 1002 if (!special_alt->orig_len) {
2031 WARN_INSN(ori !! 1003 WARN_FUNC("empty alternative entry",
>> 1004 orig_insn->sec, orig_insn->offset);
2032 continue; 1005 continue;
2033 } 1006 }
2034 1007
2035 ret = handle_group_al 1008 ret = handle_group_alt(file, special_alt, orig_insn,
2036 1009 &new_insn);
2037 if (ret) 1010 if (ret)
2038 goto out; 1011 goto out;
2039 } else if (special_alt->jump_ 1012 } else if (special_alt->jump_or_nop) {
2040 ret = handle_jump_alt 1013 ret = handle_jump_alt(file, special_alt, orig_insn,
2041 1014 &new_insn);
2042 if (ret) 1015 if (ret)
2043 goto out; 1016 goto out;
2044 } 1017 }
2045 1018
2046 alt = malloc(sizeof(*alt)); 1019 alt = malloc(sizeof(*alt));
2047 if (!alt) { 1020 if (!alt) {
2048 WARN("malloc failed") 1021 WARN("malloc failed");
2049 ret = -1; 1022 ret = -1;
2050 goto out; 1023 goto out;
2051 } 1024 }
2052 1025
2053 alt->insn = new_insn; 1026 alt->insn = new_insn;
2054 alt->skip_orig = special_alt- 1027 alt->skip_orig = special_alt->skip_orig;
2055 orig_insn->ignore_alts |= spe 1028 orig_insn->ignore_alts |= special_alt->skip_alt;
2056 alt->next = orig_insn->alts; !! 1029 list_add_tail(&alt->list, &orig_insn->alts);
2057 orig_insn->alts = alt; <<
2058 1030
2059 list_del(&special_alt->list); 1031 list_del(&special_alt->list);
2060 free(special_alt); 1032 free(special_alt);
2061 } 1033 }
2062 1034
2063 if (opts.stats) { <<
2064 printf("jl\\\tNOP\tJMP\n"); <<
2065 printf("short:\t%ld\t%ld\n", <<
2066 printf("long:\t%ld\t%ld\n", f <<
2067 } <<
2068 <<
2069 out: 1035 out:
2070 return ret; 1036 return ret;
2071 } 1037 }
2072 1038
2073 static int add_jump_table(struct objtool_file 1039 static int add_jump_table(struct objtool_file *file, struct instruction *insn,
2074 struct reloc *next_ !! 1040 struct rela *table)
2075 { 1041 {
2076 struct symbol *pfunc = insn_func(insn !! 1042 struct rela *rela = table;
2077 struct reloc *table = insn_jump_table <<
2078 struct instruction *dest_insn; 1043 struct instruction *dest_insn;
2079 unsigned int prev_offset = 0; <<
2080 struct reloc *reloc = table; <<
2081 struct alternative *alt; 1044 struct alternative *alt;
>> 1045 struct symbol *pfunc = insn->func->pfunc;
>> 1046 unsigned int prev_offset = 0;
2082 1047
2083 /* 1048 /*
2084 * Each @reloc is a switch table relo !! 1049 * Each @rela is a switch table relocation which points to the target
2085 * instruction. 1050 * instruction.
2086 */ 1051 */
2087 for_each_reloc_from(table->sec, reloc !! 1052 list_for_each_entry_from(rela, &table->sec->rela_list, list) {
2088 1053
2089 /* Check for the end of the t 1054 /* Check for the end of the table: */
2090 if (reloc != table && reloc = !! 1055 if (rela != table && rela->jump_table_start)
2091 break; 1056 break;
2092 1057
2093 /* Make sure the table entrie 1058 /* Make sure the table entries are consecutive: */
2094 if (prev_offset && reloc_offs !! 1059 if (prev_offset && rela->offset != prev_offset + 8)
2095 break; 1060 break;
2096 1061
2097 /* Detect function pointers f 1062 /* Detect function pointers from contiguous objects: */
2098 if (reloc->sym->sec == pfunc- !! 1063 if (rela->sym->sec == pfunc->sec &&
2099 reloc_addend(reloc) == pf !! 1064 rela->addend == pfunc->offset)
2100 break; 1065 break;
2101 1066
2102 dest_insn = find_insn(file, r !! 1067 dest_insn = find_insn(file, rela->sym->sec, rela->addend);
2103 if (!dest_insn) 1068 if (!dest_insn)
2104 break; 1069 break;
2105 1070
2106 /* Make sure the destination 1071 /* Make sure the destination is in the same function: */
2107 if (!insn_func(dest_insn) || !! 1072 if (!dest_insn->func || dest_insn->func->pfunc != pfunc)
2108 break; 1073 break;
2109 1074
2110 alt = malloc(sizeof(*alt)); 1075 alt = malloc(sizeof(*alt));
2111 if (!alt) { 1076 if (!alt) {
2112 WARN("malloc failed") 1077 WARN("malloc failed");
2113 return -1; 1078 return -1;
2114 } 1079 }
2115 1080
2116 alt->insn = dest_insn; 1081 alt->insn = dest_insn;
2117 alt->next = insn->alts; !! 1082 list_add_tail(&alt->list, &insn->alts);
2118 insn->alts = alt; !! 1083 prev_offset = rela->offset;
2119 prev_offset = reloc_offset(re <<
2120 } 1084 }
2121 1085
2122 if (!prev_offset) { 1086 if (!prev_offset) {
2123 WARN_INSN(insn, "can't find s !! 1087 WARN_FUNC("can't find switch jump table",
>> 1088 insn->sec, insn->offset);
2124 return -1; 1089 return -1;
2125 } 1090 }
2126 1091
2127 return 0; 1092 return 0;
2128 } 1093 }
2129 1094
2130 /* 1095 /*
2131 * find_jump_table() - Given a dynamic jump, !! 1096 * find_jump_table() - Given a dynamic jump, find the switch jump table in
2132 * associated with it. !! 1097 * .rodata associated with it.
>> 1098 *
>> 1099 * There are 3 basic patterns:
>> 1100 *
>> 1101 * 1. jmpq *[rodata addr](,%reg,8)
>> 1102 *
>> 1103 * This is the most common case by far. It jumps to an address in a simple
>> 1104 * jump table which is stored in .rodata.
>> 1105 *
>> 1106 * 2. jmpq *[rodata addr](%rip)
>> 1107 *
>> 1108 * This is caused by a rare GCC quirk, currently only seen in three driver
>> 1109 * functions in the kernel, only with certain obscure non-distro configs.
>> 1110 *
>> 1111 * As part of an optimization, GCC makes a copy of an existing switch jump
>> 1112 * table, modifies it, and then hard-codes the jump (albeit with an indirect
>> 1113 * jump) to use a single entry in the table. The rest of the jump table and
>> 1114 * some of its jump targets remain as dead code.
>> 1115 *
>> 1116 * In such a case we can just crudely ignore all unreachable instruction
>> 1117 * warnings for the entire object file. Ideally we would just ignore them
>> 1118 * for the function, but that would require redesigning the code quite a
>> 1119 * bit. And honestly that's just not worth doing: unreachable instruction
>> 1120 * warnings are of questionable value anyway, and this is such a rare issue.
>> 1121 *
>> 1122 * 3. mov [rodata addr],%reg1
>> 1123 * ... some instructions ...
>> 1124 * jmpq *(%reg1,%reg2,8)
>> 1125 *
>> 1126 * This is a fairly uncommon pattern which is new for GCC 6. As of this
>> 1127 * writing, there are 11 occurrences of it in the allmodconfig kernel.
>> 1128 *
>> 1129 * As of GCC 7 there are quite a few more of these and the 'in between' code
>> 1130 * is significant. Esp. with KASAN enabled some of the code between the mov
>> 1131 * and jmpq uses .rodata itself, which can confuse things.
>> 1132 *
>> 1133 * TODO: Once we have DWARF CFI and smarter instruction decoding logic,
>> 1134 * ensure the same register is used in the mov and jump instructions.
>> 1135 *
>> 1136 * NOTE: RETPOLINE made it harder still to decode dynamic jumps.
2133 */ 1137 */
2134 static struct reloc *find_jump_table(struct o !! 1138 static struct rela *find_jump_table(struct objtool_file *file,
2135 struct 1139 struct symbol *func,
2136 struct 1140 struct instruction *insn)
2137 { 1141 {
2138 struct reloc *table_reloc; !! 1142 struct rela *text_rela, *table_rela;
2139 struct instruction *dest_insn, *orig_ 1143 struct instruction *dest_insn, *orig_insn = insn;
>> 1144 struct section *table_sec;
>> 1145 unsigned long table_offset;
2140 1146
2141 /* 1147 /*
2142 * Backward search using the @first_j 1148 * Backward search using the @first_jump_src links, these help avoid
2143 * much of the 'in between' code. Whi 1149 * much of the 'in between' code. Which avoids us getting confused by
2144 * it. 1150 * it.
2145 */ 1151 */
2146 for (; 1152 for (;
2147 insn && insn_func(insn) && insn_ !! 1153 insn && insn->func && insn->func->pfunc == func;
2148 insn = insn->first_jump_src ?: p 1154 insn = insn->first_jump_src ?: prev_insn_same_sym(file, insn)) {
2149 1155
2150 if (insn != orig_insn && insn 1156 if (insn != orig_insn && insn->type == INSN_JUMP_DYNAMIC)
2151 break; 1157 break;
2152 1158
2153 /* allow small jumps within t 1159 /* allow small jumps within the range */
2154 if (insn->type == INSN_JUMP_U 1160 if (insn->type == INSN_JUMP_UNCONDITIONAL &&
2155 insn->jump_dest && 1161 insn->jump_dest &&
2156 (insn->jump_dest->offset 1162 (insn->jump_dest->offset <= insn->offset ||
2157 insn->jump_dest->offset 1163 insn->jump_dest->offset > orig_insn->offset))
2158 break; 1164 break;
2159 1165
2160 table_reloc = arch_find_switc !! 1166 /* look for a relocation which references .rodata */
2161 if (!table_reloc) !! 1167 text_rela = find_rela_by_dest_range(file->elf, insn->sec,
>> 1168 insn->offset, insn->len);
>> 1169 if (!text_rela || text_rela->sym->type != STT_SECTION ||
>> 1170 !text_rela->sym->sec->rodata)
>> 1171 continue;
>> 1172
>> 1173 table_offset = text_rela->addend;
>> 1174 table_sec = text_rela->sym->sec;
>> 1175
>> 1176 if (text_rela->type == R_X86_64_PC32)
>> 1177 table_offset += 4;
>> 1178
>> 1179 /*
>> 1180 * Make sure the .rodata address isn't associated with a
>> 1181 * symbol. GCC jump tables are anonymous data.
>> 1182 *
>> 1183 * Also support C jump tables which are in the same format as
>> 1184 * switch jump tables. For objtool to recognize them, they
>> 1185 * need to be placed in the C_JUMP_TABLE_SECTION section. They
>> 1186 * have symbols associated with them.
>> 1187 */
>> 1188 if (find_symbol_containing(table_sec, table_offset) &&
>> 1189 strcmp(table_sec->name, C_JUMP_TABLE_SECTION))
2162 continue; 1190 continue;
2163 dest_insn = find_insn(file, t !! 1191
2164 if (!dest_insn || !insn_func( !! 1192 /*
>> 1193 * Each table entry has a rela associated with it. The rela
>> 1194 * should reference text in the same function as the original
>> 1195 * instruction.
>> 1196 */
>> 1197 table_rela = find_rela_by_dest(file->elf, table_sec, table_offset);
>> 1198 if (!table_rela)
>> 1199 continue;
>> 1200 dest_insn = find_insn(file, table_rela->sym->sec, table_rela->addend);
>> 1201 if (!dest_insn || !dest_insn->func || dest_insn->func->pfunc != func)
2165 continue; 1202 continue;
2166 1203
2167 return table_reloc; !! 1204 /*
>> 1205 * Use of RIP-relative switch jumps is quite rare, and
>> 1206 * indicates a rare GCC quirk/bug which can leave dead code
>> 1207 * behind.
>> 1208 */
>> 1209 if (text_rela->type == R_X86_64_PC32)
>> 1210 file->ignore_unreachables = true;
>> 1211
>> 1212 return table_rela;
2168 } 1213 }
2169 1214
2170 return NULL; 1215 return NULL;
2171 } 1216 }
2172 1217
2173 /* 1218 /*
2174 * First pass: Mark the head of each jump tab 1219 * First pass: Mark the head of each jump table so that in the next pass,
2175 * we know when a given jump table ends and t 1220 * we know when a given jump table ends and the next one starts.
2176 */ 1221 */
2177 static void mark_func_jump_tables(struct objt 1222 static void mark_func_jump_tables(struct objtool_file *file,
2178 struct sy 1223 struct symbol *func)
2179 { 1224 {
2180 struct instruction *insn, *last = NUL 1225 struct instruction *insn, *last = NULL;
2181 struct reloc *reloc; !! 1226 struct rela *rela;
2182 1227
2183 func_for_each_insn(file, func, insn) 1228 func_for_each_insn(file, func, insn) {
2184 if (!last) 1229 if (!last)
2185 last = insn; 1230 last = insn;
2186 1231
2187 /* 1232 /*
2188 * Store back-pointers for un 1233 * Store back-pointers for unconditional forward jumps such
2189 * that find_jump_table() can 1234 * that find_jump_table() can back-track using those and
2190 * avoid some potentially con 1235 * avoid some potentially confusing code.
2191 */ 1236 */
2192 if (insn->type == INSN_JUMP_U 1237 if (insn->type == INSN_JUMP_UNCONDITIONAL && insn->jump_dest &&
2193 insn->offset > last->offs 1238 insn->offset > last->offset &&
2194 insn->jump_dest->offset > 1239 insn->jump_dest->offset > insn->offset &&
2195 !insn->jump_dest->first_j 1240 !insn->jump_dest->first_jump_src) {
2196 1241
2197 insn->jump_dest->firs 1242 insn->jump_dest->first_jump_src = insn;
2198 last = insn->jump_des 1243 last = insn->jump_dest;
2199 } 1244 }
2200 1245
2201 if (insn->type != INSN_JUMP_D 1246 if (insn->type != INSN_JUMP_DYNAMIC)
2202 continue; 1247 continue;
2203 1248
2204 reloc = find_jump_table(file, !! 1249 rela = find_jump_table(file, func, insn);
2205 if (reloc) !! 1250 if (rela) {
2206 insn->_jump_table = r !! 1251 rela->jump_table_start = true;
>> 1252 insn->jump_table = rela;
>> 1253 }
2207 } 1254 }
2208 } 1255 }
2209 1256
2210 static int add_func_jump_tables(struct objtoo 1257 static int add_func_jump_tables(struct objtool_file *file,
2211 struct symb 1258 struct symbol *func)
2212 { 1259 {
2213 struct instruction *insn, *insn_t1 = !! 1260 struct instruction *insn;
2214 int ret = 0; !! 1261 int ret;
2215 1262
2216 func_for_each_insn(file, func, insn) 1263 func_for_each_insn(file, func, insn) {
2217 if (!insn_jump_table(insn)) !! 1264 if (!insn->jump_table)
2218 continue; <<
2219 <<
2220 if (!insn_t1) { <<
2221 insn_t1 = insn; <<
2222 continue; 1265 continue;
2223 } <<
2224 <<
2225 insn_t2 = insn; <<
2226 1266
2227 ret = add_jump_table(file, in !! 1267 ret = add_jump_table(file, insn, insn->jump_table);
2228 if (ret) 1268 if (ret)
2229 return ret; 1269 return ret;
2230 <<
2231 insn_t1 = insn_t2; <<
2232 } 1270 }
2233 1271
2234 if (insn_t1) !! 1272 return 0;
2235 ret = add_jump_table(file, in <<
2236 <<
2237 return ret; <<
2238 } 1273 }
2239 1274
2240 /* 1275 /*
2241 * For some switch statements, gcc generates 1276 * For some switch statements, gcc generates a jump table in the .rodata
2242 * section which contains a list of addresses 1277 * section which contains a list of addresses within the function to jump to.
2243 * This finds these jump tables and adds them 1278 * This finds these jump tables and adds them to the insn->alts lists.
2244 */ 1279 */
2245 static int add_jump_table_alts(struct objtool 1280 static int add_jump_table_alts(struct objtool_file *file)
2246 { 1281 {
>> 1282 struct section *sec;
2247 struct symbol *func; 1283 struct symbol *func;
2248 int ret; 1284 int ret;
2249 1285
2250 if (!file->rodata) 1286 if (!file->rodata)
2251 return 0; 1287 return 0;
2252 1288
2253 for_each_sym(file, func) { !! 1289 for_each_sec(file, sec) {
2254 if (func->type != STT_FUNC) !! 1290 list_for_each_entry(func, &sec->symbol_list, list) {
2255 continue; !! 1291 if (func->type != STT_FUNC)
>> 1292 continue;
2256 1293
2257 mark_func_jump_tables(file, f !! 1294 mark_func_jump_tables(file, func);
2258 ret = add_func_jump_tables(fi !! 1295 ret = add_func_jump_tables(file, func);
2259 if (ret) !! 1296 if (ret)
2260 return ret; !! 1297 return ret;
>> 1298 }
2261 } 1299 }
2262 1300
2263 return 0; 1301 return 0;
2264 } 1302 }
2265 1303
2266 static void set_func_state(struct cfi_state * <<
2267 { <<
2268 state->cfa = initial_func_cfi.cfa; <<
2269 memcpy(&state->regs, &initial_func_cf <<
2270 CFI_NUM_REGS * sizeof(struct c <<
2271 state->stack_size = initial_func_cfi. <<
2272 state->type = UNWIND_HINT_TYPE_CALL; <<
2273 } <<
2274 <<
2275 static int read_unwind_hints(struct objtool_f 1304 static int read_unwind_hints(struct objtool_file *file)
2276 { 1305 {
2277 struct cfi_state cfi = init_cfi; !! 1306 struct section *sec, *relasec;
2278 struct section *sec; !! 1307 struct rela *rela;
2279 struct unwind_hint *hint; 1308 struct unwind_hint *hint;
2280 struct instruction *insn; 1309 struct instruction *insn;
2281 struct reloc *reloc; !! 1310 struct cfi_reg *cfa;
2282 unsigned long offset; <<
2283 int i; 1311 int i;
2284 1312
2285 sec = find_section_by_name(file->elf, 1313 sec = find_section_by_name(file->elf, ".discard.unwind_hints");
2286 if (!sec) 1314 if (!sec)
2287 return 0; 1315 return 0;
2288 1316
2289 if (!sec->rsec) { !! 1317 relasec = sec->rela;
>> 1318 if (!relasec) {
2290 WARN("missing .rela.discard.u 1319 WARN("missing .rela.discard.unwind_hints section");
2291 return -1; 1320 return -1;
2292 } 1321 }
2293 1322
2294 if (sec->sh.sh_size % sizeof(struct u !! 1323 if (sec->len % sizeof(struct unwind_hint)) {
2295 WARN("struct unwind_hint size 1324 WARN("struct unwind_hint size mismatch");
2296 return -1; 1325 return -1;
2297 } 1326 }
2298 1327
2299 file->hints = true; 1328 file->hints = true;
2300 1329
2301 for (i = 0; i < sec->sh.sh_size / siz !! 1330 for (i = 0; i < sec->len / sizeof(struct unwind_hint); i++) {
2302 hint = (struct unwind_hint *) 1331 hint = (struct unwind_hint *)sec->data->d_buf + i;
2303 1332
2304 reloc = find_reloc_by_dest(fi !! 1333 rela = find_rela_by_dest(file->elf, sec, i * sizeof(*hint));
2305 if (!reloc) { !! 1334 if (!rela) {
2306 WARN("can't find relo !! 1335 WARN("can't find rela for unwind_hints[%d]", i);
2307 return -1; <<
2308 } <<
2309 <<
2310 if (reloc->sym->type == STT_S <<
2311 offset = reloc_addend <<
2312 } else if (reloc->sym->local_ <<
2313 offset = reloc->sym-> <<
2314 } else { <<
2315 WARN("unexpected relo <<
2316 return -1; 1336 return -1;
2317 } 1337 }
2318 1338
2319 insn = find_insn(file, reloc- !! 1339 insn = find_insn(file, rela->sym->sec, rela->addend);
2320 if (!insn) { 1340 if (!insn) {
2321 WARN("can't find insn 1341 WARN("can't find insn for unwind_hints[%d]", i);
2322 return -1; 1342 return -1;
2323 } 1343 }
2324 1344
2325 insn->hint = true; !! 1345 cfa = &insn->cfi.cfa;
2326 <<
2327 if (hint->type == UNWIND_HINT <<
2328 insn->cfi = &force_un <<
2329 continue; <<
2330 } <<
2331 1346
2332 if (hint->type == UNWIND_HINT !! 1347 if (hint->type == UNWIND_HINT_TYPE_RET_OFFSET) {
2333 insn->hint = false; !! 1348 insn->ret_offset = hint->sp_offset;
2334 insn->save = true; <<
2335 continue; 1349 continue;
2336 } 1350 }
2337 1351
2338 if (hint->type == UNWIND_HINT !! 1352 insn->hint = true;
2339 insn->restore = true; <<
2340 continue; <<
2341 } <<
2342 <<
2343 if (hint->type == UNWIND_HINT <<
2344 struct symbol *sym = <<
2345 <<
2346 if (sym && sym->bind <<
2347 if (opts.ibt <<
2348 WARN_ <<
2349 } <<
2350 } <<
2351 } <<
2352 <<
2353 if (hint->type == UNWIND_HINT <<
2354 insn->cfi = &func_cfi <<
2355 continue; <<
2356 } <<
2357 <<
2358 if (insn->cfi) <<
2359 cfi = *(insn->cfi); <<
2360 <<
2361 if (arch_decode_hint_reg(hint <<
2362 WARN_INSN(insn, "unsu <<
2363 return -1; <<
2364 } <<
2365 <<
2366 cfi.cfa.offset = bswap_if_nee <<
2367 cfi.type = hint->type; <<
2368 cfi.signal = hint->signal; <<
2369 <<
2370 insn->cfi = cfi_hash_find_or_ <<
2371 } <<
2372 <<
2373 return 0; <<
2374 } <<
2375 <<
2376 static int read_noendbr_hints(struct objtool_ <<
2377 { <<
2378 struct instruction *insn; <<
2379 struct section *rsec; <<
2380 struct reloc *reloc; <<
2381 <<
2382 rsec = find_section_by_name(file->elf <<
2383 if (!rsec) <<
2384 return 0; <<
2385 1353
2386 for_each_reloc(rsec, reloc) { !! 1354 switch (hint->sp_reg) {
2387 insn = find_insn(file, reloc- !! 1355 case ORC_REG_UNDEFINED:
2388 reloc->sym-> !! 1356 cfa->base = CFI_UNDEFINED;
2389 if (!insn) { !! 1357 break;
2390 WARN("bad .discard.no !! 1358 case ORC_REG_SP:
>> 1359 cfa->base = CFI_SP;
>> 1360 break;
>> 1361 case ORC_REG_BP:
>> 1362 cfa->base = CFI_BP;
>> 1363 break;
>> 1364 case ORC_REG_SP_INDIRECT:
>> 1365 cfa->base = CFI_SP_INDIRECT;
>> 1366 break;
>> 1367 case ORC_REG_R10:
>> 1368 cfa->base = CFI_R10;
>> 1369 break;
>> 1370 case ORC_REG_R13:
>> 1371 cfa->base = CFI_R13;
>> 1372 break;
>> 1373 case ORC_REG_DI:
>> 1374 cfa->base = CFI_DI;
>> 1375 break;
>> 1376 case ORC_REG_DX:
>> 1377 cfa->base = CFI_DX;
>> 1378 break;
>> 1379 default:
>> 1380 WARN_FUNC("unsupported unwind_hint sp base reg %d",
>> 1381 insn->sec, insn->offset, hint->sp_reg);
2391 return -1; 1382 return -1;
2392 } 1383 }
2393 1384
2394 insn->noendbr = 1; !! 1385 cfa->offset = hint->sp_offset;
>> 1386 insn->cfi.type = hint->type;
>> 1387 insn->cfi.end = hint->end;
2395 } 1388 }
2396 1389
2397 return 0; 1390 return 0;
2398 } 1391 }
2399 1392
2400 static int read_retpoline_hints(struct objtoo 1393 static int read_retpoline_hints(struct objtool_file *file)
2401 { 1394 {
2402 struct section *rsec; !! 1395 struct section *sec;
2403 struct instruction *insn; 1396 struct instruction *insn;
2404 struct reloc *reloc; !! 1397 struct rela *rela;
2405 1398
2406 rsec = find_section_by_name(file->elf !! 1399 sec = find_section_by_name(file->elf, ".rela.discard.retpoline_safe");
2407 if (!rsec) !! 1400 if (!sec)
2408 return 0; 1401 return 0;
2409 1402
2410 for_each_reloc(rsec, reloc) { !! 1403 list_for_each_entry(rela, &sec->rela_list, list) {
2411 if (reloc->sym->type != STT_S !! 1404 if (rela->sym->type != STT_SECTION) {
2412 WARN("unexpected relo !! 1405 WARN("unexpected relocation symbol type in %s", sec->name);
2413 return -1; 1406 return -1;
2414 } 1407 }
2415 1408
2416 insn = find_insn(file, reloc- !! 1409 insn = find_insn(file, rela->sym->sec, rela->addend);
2417 if (!insn) { 1410 if (!insn) {
2418 WARN("bad .discard.re 1411 WARN("bad .discard.retpoline_safe entry");
2419 return -1; 1412 return -1;
2420 } 1413 }
2421 1414
2422 if (insn->type != INSN_JUMP_D 1415 if (insn->type != INSN_JUMP_DYNAMIC &&
2423 insn->type != INSN_CALL_D !! 1416 insn->type != INSN_CALL_DYNAMIC) {
2424 insn->type != INSN_RETURN !! 1417 WARN_FUNC("retpoline_safe hint not an indirect jump/call",
2425 insn->type != INSN_NOP) { !! 1418 insn->sec, insn->offset);
2426 WARN_INSN(insn, "retp <<
2427 return -1; 1419 return -1;
2428 } 1420 }
2429 1421
2430 insn->retpoline_safe = true; 1422 insn->retpoline_safe = true;
2431 } 1423 }
2432 1424
2433 return 0; 1425 return 0;
2434 } 1426 }
2435 1427
2436 static int read_instr_hints(struct objtool_fi 1428 static int read_instr_hints(struct objtool_file *file)
2437 { 1429 {
2438 struct section *rsec; !! 1430 struct section *sec;
2439 struct instruction *insn; 1431 struct instruction *insn;
2440 struct reloc *reloc; !! 1432 struct rela *rela;
2441 1433
2442 rsec = find_section_by_name(file->elf !! 1434 sec = find_section_by_name(file->elf, ".rela.discard.instr_end");
2443 if (!rsec) !! 1435 if (!sec)
2444 return 0; 1436 return 0;
2445 1437
2446 for_each_reloc(rsec, reloc) { !! 1438 list_for_each_entry(rela, &sec->rela_list, list) {
2447 if (reloc->sym->type != STT_S !! 1439 if (rela->sym->type != STT_SECTION) {
2448 WARN("unexpected relo !! 1440 WARN("unexpected relocation symbol type in %s", sec->name);
2449 return -1; 1441 return -1;
2450 } 1442 }
2451 1443
2452 insn = find_insn(file, reloc- !! 1444 insn = find_insn(file, rela->sym->sec, rela->addend);
2453 if (!insn) { 1445 if (!insn) {
2454 WARN("bad .discard.in 1446 WARN("bad .discard.instr_end entry");
2455 return -1; 1447 return -1;
2456 } 1448 }
2457 1449
2458 insn->instr--; 1450 insn->instr--;
2459 } 1451 }
2460 1452
2461 rsec = find_section_by_name(file->elf !! 1453 sec = find_section_by_name(file->elf, ".rela.discard.instr_begin");
2462 if (!rsec) !! 1454 if (!sec)
2463 return 0; 1455 return 0;
2464 1456
2465 for_each_reloc(rsec, reloc) { !! 1457 list_for_each_entry(rela, &sec->rela_list, list) {
2466 if (reloc->sym->type != STT_S !! 1458 if (rela->sym->type != STT_SECTION) {
2467 WARN("unexpected relo !! 1459 WARN("unexpected relocation symbol type in %s", sec->name);
2468 return -1; 1460 return -1;
2469 } 1461 }
2470 1462
2471 insn = find_insn(file, reloc- !! 1463 insn = find_insn(file, rela->sym->sec, rela->addend);
2472 if (!insn) { 1464 if (!insn) {
2473 WARN("bad .discard.in 1465 WARN("bad .discard.instr_begin entry");
2474 return -1; 1466 return -1;
2475 } 1467 }
2476 1468
2477 insn->instr++; 1469 insn->instr++;
2478 } 1470 }
2479 1471
2480 return 0; 1472 return 0;
2481 } 1473 }
2482 1474
2483 static int read_validate_unret_hints(struct o <<
2484 { <<
2485 struct section *rsec; <<
2486 struct instruction *insn; <<
2487 struct reloc *reloc; <<
2488 <<
2489 rsec = find_section_by_name(file->elf <<
2490 if (!rsec) <<
2491 return 0; <<
2492 <<
2493 for_each_reloc(rsec, reloc) { <<
2494 if (reloc->sym->type != STT_S <<
2495 WARN("unexpected relo <<
2496 return -1; <<
2497 } <<
2498 <<
2499 insn = find_insn(file, reloc- <<
2500 if (!insn) { <<
2501 WARN("bad .discard.in <<
2502 return -1; <<
2503 } <<
2504 insn->unret = 1; <<
2505 } <<
2506 <<
2507 return 0; <<
2508 } <<
2509 <<
2510 <<
2511 static int read_intra_function_calls(struct o 1475 static int read_intra_function_calls(struct objtool_file *file)
2512 { 1476 {
2513 struct instruction *insn; 1477 struct instruction *insn;
2514 struct section *rsec; !! 1478 struct section *sec;
2515 struct reloc *reloc; !! 1479 struct rela *rela;
2516 1480
2517 rsec = find_section_by_name(file->elf !! 1481 sec = find_section_by_name(file->elf, ".rela.discard.intra_function_calls");
2518 if (!rsec) !! 1482 if (!sec)
2519 return 0; 1483 return 0;
2520 1484
2521 for_each_reloc(rsec, reloc) { !! 1485 list_for_each_entry(rela, &sec->rela_list, list) {
2522 unsigned long dest_off; 1486 unsigned long dest_off;
2523 1487
2524 if (reloc->sym->type != STT_S !! 1488 if (rela->sym->type != STT_SECTION) {
2525 WARN("unexpected relo 1489 WARN("unexpected relocation symbol type in %s",
2526 rsec->name); !! 1490 sec->name);
2527 return -1; 1491 return -1;
2528 } 1492 }
2529 1493
2530 insn = find_insn(file, reloc- !! 1494 insn = find_insn(file, rela->sym->sec, rela->addend);
2531 if (!insn) { 1495 if (!insn) {
2532 WARN("bad .discard.in 1496 WARN("bad .discard.intra_function_call entry");
2533 return -1; 1497 return -1;
2534 } 1498 }
2535 1499
2536 if (insn->type != INSN_CALL) 1500 if (insn->type != INSN_CALL) {
2537 WARN_INSN(insn, "intr !! 1501 WARN_FUNC("intra_function_call not a direct call",
>> 1502 insn->sec, insn->offset);
2538 return -1; 1503 return -1;
2539 } 1504 }
2540 1505
2541 /* 1506 /*
2542 * Treat intra-function CALLs 1507 * Treat intra-function CALLs as JMPs, but with a stack_op.
2543 * See add_call_destinations( 1508 * See add_call_destinations(), which strips stack_ops from
2544 * normal CALLs. 1509 * normal CALLs.
2545 */ 1510 */
2546 insn->type = INSN_JUMP_UNCOND 1511 insn->type = INSN_JUMP_UNCONDITIONAL;
2547 1512
2548 dest_off = arch_jump_destinat !! 1513 dest_off = insn->offset + insn->len + insn->immediate;
2549 insn->jump_dest = find_insn(f 1514 insn->jump_dest = find_insn(file, insn->sec, dest_off);
2550 if (!insn->jump_dest) { 1515 if (!insn->jump_dest) {
2551 WARN_INSN(insn, "can' !! 1516 WARN_FUNC("can't find call dest at %s+0x%lx",
>> 1517 insn->sec, insn->offset,
2552 insn->sec-> 1518 insn->sec->name, dest_off);
2553 return -1; 1519 return -1;
2554 } 1520 }
2555 } 1521 }
2556 1522
2557 return 0; 1523 return 0;
2558 } 1524 }
2559 1525
2560 /* <<
2561 * Return true if name matches an instrumenta <<
2562 * function from noinstr code can safely be r <<
2563 */ <<
2564 static bool is_profiling_func(const char *nam <<
2565 { <<
2566 /* <<
2567 * Many compilers cannot disable KCOV <<
2568 */ <<
2569 if (!strncmp(name, "__sanitizer_cov_" <<
2570 return true; <<
2571 <<
2572 /* <<
2573 * Some compilers currently do not re <<
2574 * __tsan_atomic_signal_fence (used f <<
2575 * the __no_sanitize_thread attribute <<
2576 * minimum Clang version is 14.0, thi <<
2577 */ <<
2578 if (!strncmp(name, "__tsan_func_", 12 <<
2579 !strcmp(name, "__tsan_atomic_sign <<
2580 return true; <<
2581 <<
2582 return false; <<
2583 } <<
2584 <<
2585 static int classify_symbols(struct objtool_fi <<
2586 { <<
2587 struct symbol *func; <<
2588 <<
2589 for_each_sym(file, func) { <<
2590 if (func->type == STT_NOTYPE <<
2591 func->local_label = t <<
2592 <<
2593 if (func->bind != STB_GLOBAL) <<
2594 continue; <<
2595 <<
2596 if (!strncmp(func->name, STAT <<
2597 strlen(STATIC_CA <<
2598 func->static_call_tra <<
2599 <<
2600 if (arch_is_retpoline(func)) <<
2601 func->retpoline_thunk <<
2602 <<
2603 if (arch_is_rethunk(func)) <<
2604 func->return_thunk = <<
2605 <<
2606 if (arch_is_embedded_insn(fun <<
2607 func->embedded_insn = <<
2608 <<
2609 if (arch_ftrace_match(func->n <<
2610 func->fentry = true; <<
2611 <<
2612 if (is_profiling_func(func->n <<
2613 func->profiling_func <<
2614 } <<
2615 <<
2616 return 0; <<
2617 } <<
2618 <<
2619 static void mark_rodata(struct objtool_file * 1526 static void mark_rodata(struct objtool_file *file)
2620 { 1527 {
2621 struct section *sec; 1528 struct section *sec;
2622 bool found = false; 1529 bool found = false;
2623 1530
2624 /* 1531 /*
2625 * Search for the following rodata se 1532 * Search for the following rodata sections, each of which can
2626 * potentially contain jump tables: 1533 * potentially contain jump tables:
2627 * 1534 *
2628 * - .rodata: can contain GCC switch 1535 * - .rodata: can contain GCC switch tables
2629 * - .rodata.<func>: same, if -fdata- 1536 * - .rodata.<func>: same, if -fdata-sections is being used
2630 * - .rodata..c_jump_table: contains 1537 * - .rodata..c_jump_table: contains C annotated jump tables
2631 * 1538 *
2632 * .rodata.str1.* sections are ignore 1539 * .rodata.str1.* sections are ignored; they don't contain jump tables.
2633 */ 1540 */
2634 for_each_sec(file, sec) { 1541 for_each_sec(file, sec) {
2635 if (!strncmp(sec->name, ".rod 1542 if (!strncmp(sec->name, ".rodata", 7) &&
2636 !strstr(sec->name, ".str1 1543 !strstr(sec->name, ".str1.")) {
2637 sec->rodata = true; 1544 sec->rodata = true;
2638 found = true; 1545 found = true;
2639 } 1546 }
2640 } 1547 }
2641 1548
2642 file->rodata = found; 1549 file->rodata = found;
2643 } 1550 }
2644 1551
2645 static int decode_sections(struct objtool_fil 1552 static int decode_sections(struct objtool_file *file)
2646 { 1553 {
2647 int ret; 1554 int ret;
2648 1555
2649 mark_rodata(file); 1556 mark_rodata(file);
2650 1557
2651 ret = init_pv_ops(file); !! 1558 ret = decode_instructions(file);
2652 if (ret) <<
2653 return ret; <<
2654 <<
2655 /* <<
2656 * Must be before add_{jump_call}_des <<
2657 */ <<
2658 ret = classify_symbols(file); <<
2659 if (ret) 1559 if (ret)
2660 return ret; 1560 return ret;
2661 1561
2662 ret = decode_instructions(file); !! 1562 ret = add_dead_ends(file);
2663 if (ret) 1563 if (ret)
2664 return ret; 1564 return ret;
2665 1565
2666 add_ignores(file); 1566 add_ignores(file);
2667 add_uaccess_safe(file); 1567 add_uaccess_safe(file);
2668 1568
2669 ret = add_ignore_alternatives(file); 1569 ret = add_ignore_alternatives(file);
2670 if (ret) 1570 if (ret)
2671 return ret; 1571 return ret;
2672 1572
2673 /* !! 1573 ret = add_jump_destinations(file);
2674 * Must be before read_unwind_hints() <<
2675 */ <<
2676 ret = read_noendbr_hints(file); <<
2677 if (ret) 1574 if (ret)
2678 return ret; 1575 return ret;
2679 1576
2680 /* !! 1577 ret = add_special_section_alts(file);
2681 * Must be before add_jump_destinatio <<
2682 * being set for alternatives, to ena <<
2683 */ <<
2684 if (opts.stackval || opts.orc || opts <<
2685 ret = add_special_section_alt <<
2686 if (ret) <<
2687 return ret; <<
2688 } <<
2689 <<
2690 ret = add_jump_destinations(file); <<
2691 if (ret) 1578 if (ret)
2692 return ret; 1579 return ret;
2693 1580
2694 /* <<
2695 * Must be before add_call_destinatio <<
2696 * INSN_JUMP. <<
2697 */ <<
2698 ret = read_intra_function_calls(file) 1581 ret = read_intra_function_calls(file);
2699 if (ret) 1582 if (ret)
2700 return ret; 1583 return ret;
2701 1584
2702 ret = add_call_destinations(file); 1585 ret = add_call_destinations(file);
2703 if (ret) 1586 if (ret)
2704 return ret; 1587 return ret;
2705 1588
2706 /* <<
2707 * Must be after add_call_destination <<
2708 * dead_end_function() marks. <<
2709 */ <<
2710 ret = add_dead_ends(file); <<
2711 if (ret) <<
2712 return ret; <<
2713 <<
2714 ret = add_jump_table_alts(file); 1589 ret = add_jump_table_alts(file);
2715 if (ret) 1590 if (ret)
2716 return ret; 1591 return ret;
2717 1592
2718 ret = read_unwind_hints(file); 1593 ret = read_unwind_hints(file);
2719 if (ret) 1594 if (ret)
2720 return ret; 1595 return ret;
2721 1596
2722 ret = read_retpoline_hints(file); 1597 ret = read_retpoline_hints(file);
2723 if (ret) 1598 if (ret)
2724 return ret; 1599 return ret;
2725 1600
2726 ret = read_instr_hints(file); 1601 ret = read_instr_hints(file);
2727 if (ret) 1602 if (ret)
2728 return ret; 1603 return ret;
2729 1604
2730 ret = read_validate_unret_hints(file) <<
2731 if (ret) <<
2732 return ret; <<
2733 <<
2734 return 0; 1605 return 0;
2735 } 1606 }
2736 1607
2737 static bool is_special_call(struct instructio !! 1608 static bool is_fentry_call(struct instruction *insn)
2738 { 1609 {
2739 if (insn->type == INSN_CALL) { !! 1610 if (insn->type == INSN_CALL && insn->call_dest &&
2740 struct symbol *dest = insn_ca !! 1611 insn->call_dest->type == STT_NOTYPE &&
2741 !! 1612 !strcmp(insn->call_dest->name, "__fentry__"))
2742 if (!dest) !! 1613 return true;
2743 return false; <<
2744 <<
2745 if (dest->fentry || dest->emb <<
2746 return true; <<
2747 } <<
2748 1614
2749 return false; 1615 return false;
2750 } 1616 }
2751 1617
2752 static bool has_modified_stack_frame(struct i 1618 static bool has_modified_stack_frame(struct instruction *insn, struct insn_state *state)
2753 { 1619 {
>> 1620 u8 ret_offset = insn->ret_offset;
2754 struct cfi_state *cfi = &state->cfi; 1621 struct cfi_state *cfi = &state->cfi;
2755 int i; 1622 int i;
2756 1623
2757 if (cfi->cfa.base != initial_func_cfi 1624 if (cfi->cfa.base != initial_func_cfi.cfa.base || cfi->drap)
2758 return true; 1625 return true;
2759 1626
2760 if (cfi->cfa.offset != initial_func_c !! 1627 if (cfi->cfa.offset != initial_func_cfi.cfa.offset + ret_offset)
2761 return true; 1628 return true;
2762 1629
2763 if (cfi->stack_size != initial_func_c !! 1630 if (cfi->stack_size != initial_func_cfi.cfa.offset + ret_offset)
2764 return true; 1631 return true;
2765 1632
>> 1633 /*
>> 1634 * If there is a ret offset hint then don't check registers
>> 1635 * because a callee-saved register might have been pushed on
>> 1636 * the stack.
>> 1637 */
>> 1638 if (ret_offset)
>> 1639 return false;
>> 1640
2766 for (i = 0; i < CFI_NUM_REGS; i++) { 1641 for (i = 0; i < CFI_NUM_REGS; i++) {
2767 if (cfi->regs[i].base != init 1642 if (cfi->regs[i].base != initial_func_cfi.regs[i].base ||
2768 cfi->regs[i].offset != in 1643 cfi->regs[i].offset != initial_func_cfi.regs[i].offset)
2769 return true; 1644 return true;
2770 } 1645 }
2771 1646
2772 return false; 1647 return false;
2773 } 1648 }
2774 1649
2775 static bool check_reg_frame_pos(const struct <<
2776 int expected_ <<
2777 { <<
2778 return reg->base == CFI_CFA && <<
2779 reg->offset == expected_offset <<
2780 } <<
2781 <<
2782 static bool has_valid_stack_frame(struct insn 1650 static bool has_valid_stack_frame(struct insn_state *state)
2783 { 1651 {
2784 struct cfi_state *cfi = &state->cfi; 1652 struct cfi_state *cfi = &state->cfi;
2785 1653
2786 if (cfi->cfa.base == CFI_BP && !! 1654 if (cfi->cfa.base == CFI_BP && cfi->regs[CFI_BP].base == CFI_CFA &&
2787 check_reg_frame_pos(&cfi->regs[CF !! 1655 cfi->regs[CFI_BP].offset == -16)
2788 check_reg_frame_pos(&cfi->regs[CF <<
2789 return true; 1656 return true;
2790 1657
2791 if (cfi->drap && cfi->regs[CFI_BP].ba 1658 if (cfi->drap && cfi->regs[CFI_BP].base == CFI_BP)
2792 return true; 1659 return true;
2793 1660
2794 return false; 1661 return false;
2795 } 1662 }
2796 1663
2797 static int update_cfi_state_regs(struct instr 1664 static int update_cfi_state_regs(struct instruction *insn,
2798 struct cfi_ 1665 struct cfi_state *cfi,
2799 struct stac 1666 struct stack_op *op)
2800 { 1667 {
2801 struct cfi_reg *cfa = &cfi->cfa; 1668 struct cfi_reg *cfa = &cfi->cfa;
2802 1669
2803 if (cfa->base != CFI_SP && cfa->base 1670 if (cfa->base != CFI_SP && cfa->base != CFI_SP_INDIRECT)
2804 return 0; 1671 return 0;
2805 1672
2806 /* push */ 1673 /* push */
2807 if (op->dest.type == OP_DEST_PUSH || 1674 if (op->dest.type == OP_DEST_PUSH || op->dest.type == OP_DEST_PUSHF)
2808 cfa->offset += 8; 1675 cfa->offset += 8;
2809 1676
2810 /* pop */ 1677 /* pop */
2811 if (op->src.type == OP_SRC_POP || op- 1678 if (op->src.type == OP_SRC_POP || op->src.type == OP_SRC_POPF)
2812 cfa->offset -= 8; 1679 cfa->offset -= 8;
2813 1680
2814 /* add immediate to sp */ 1681 /* add immediate to sp */
2815 if (op->dest.type == OP_DEST_REG && o 1682 if (op->dest.type == OP_DEST_REG && op->src.type == OP_SRC_ADD &&
2816 op->dest.reg == CFI_SP && op->src 1683 op->dest.reg == CFI_SP && op->src.reg == CFI_SP)
2817 cfa->offset -= op->src.offset 1684 cfa->offset -= op->src.offset;
2818 1685
2819 return 0; 1686 return 0;
2820 } 1687 }
2821 1688
2822 static void save_reg(struct cfi_state *cfi, u 1689 static void save_reg(struct cfi_state *cfi, unsigned char reg, int base, int offset)
2823 { 1690 {
2824 if (arch_callee_saved_reg(reg) && 1691 if (arch_callee_saved_reg(reg) &&
2825 cfi->regs[reg].base == CFI_UNDEFI 1692 cfi->regs[reg].base == CFI_UNDEFINED) {
2826 cfi->regs[reg].base = base; 1693 cfi->regs[reg].base = base;
2827 cfi->regs[reg].offset = offse 1694 cfi->regs[reg].offset = offset;
2828 } 1695 }
2829 } 1696 }
2830 1697
2831 static void restore_reg(struct cfi_state *cfi 1698 static void restore_reg(struct cfi_state *cfi, unsigned char reg)
2832 { 1699 {
2833 cfi->regs[reg].base = initial_func_cf 1700 cfi->regs[reg].base = initial_func_cfi.regs[reg].base;
2834 cfi->regs[reg].offset = initial_func_ 1701 cfi->regs[reg].offset = initial_func_cfi.regs[reg].offset;
2835 } 1702 }
2836 1703
2837 /* 1704 /*
2838 * A note about DRAP stack alignment: 1705 * A note about DRAP stack alignment:
2839 * 1706 *
2840 * GCC has the concept of a DRAP register, wh 1707 * GCC has the concept of a DRAP register, which is used to help keep track of
2841 * the stack pointer when aligning the stack. 1708 * the stack pointer when aligning the stack. r10 or r13 is used as the DRAP
2842 * register. The typical DRAP pattern is: 1709 * register. The typical DRAP pattern is:
2843 * 1710 *
2844 * 4c 8d 54 24 08 lea 0x8(%r 1711 * 4c 8d 54 24 08 lea 0x8(%rsp),%r10
2845 * 48 83 e4 c0 and $0xfff 1712 * 48 83 e4 c0 and $0xffffffffffffffc0,%rsp
2846 * 41 ff 72 f8 pushq -0x8(% 1713 * 41 ff 72 f8 pushq -0x8(%r10)
2847 * 55 push %rbp 1714 * 55 push %rbp
2848 * 48 89 e5 mov %rsp,% 1715 * 48 89 e5 mov %rsp,%rbp
2849 * (more pushes) 1716 * (more pushes)
2850 * 41 52 push %r10 1717 * 41 52 push %r10
2851 * ... 1718 * ...
2852 * 41 5a pop %r10 1719 * 41 5a pop %r10
2853 * (more pops) 1720 * (more pops)
2854 * 5d pop %rbp 1721 * 5d pop %rbp
2855 * 49 8d 62 f8 lea -0x8(% 1722 * 49 8d 62 f8 lea -0x8(%r10),%rsp
2856 * c3 retq 1723 * c3 retq
2857 * 1724 *
2858 * There are some variations in the epilogues 1725 * There are some variations in the epilogues, like:
2859 * 1726 *
2860 * 5b pop %rbx 1727 * 5b pop %rbx
2861 * 41 5a pop %r10 1728 * 41 5a pop %r10
2862 * 41 5c pop %r12 1729 * 41 5c pop %r12
2863 * 41 5d pop %r13 1730 * 41 5d pop %r13
2864 * 41 5e pop %r14 1731 * 41 5e pop %r14
2865 * c9 leaveq 1732 * c9 leaveq
2866 * 49 8d 62 f8 lea -0x8(% 1733 * 49 8d 62 f8 lea -0x8(%r10),%rsp
2867 * c3 retq 1734 * c3 retq
2868 * 1735 *
2869 * and: 1736 * and:
2870 * 1737 *
2871 * 4c 8b 55 e8 mov -0x18( 1738 * 4c 8b 55 e8 mov -0x18(%rbp),%r10
2872 * 48 8b 5d e0 mov -0x20( 1739 * 48 8b 5d e0 mov -0x20(%rbp),%rbx
2873 * 4c 8b 65 f0 mov -0x10( 1740 * 4c 8b 65 f0 mov -0x10(%rbp),%r12
2874 * 4c 8b 6d f8 mov -0x8(% 1741 * 4c 8b 6d f8 mov -0x8(%rbp),%r13
2875 * c9 leaveq 1742 * c9 leaveq
2876 * 49 8d 62 f8 lea -0x8(% 1743 * 49 8d 62 f8 lea -0x8(%r10),%rsp
2877 * c3 retq 1744 * c3 retq
2878 * 1745 *
2879 * Sometimes r13 is used as the DRAP register 1746 * Sometimes r13 is used as the DRAP register, in which case it's saved and
2880 * restored beforehand: 1747 * restored beforehand:
2881 * 1748 *
2882 * 41 55 push %r13 1749 * 41 55 push %r13
2883 * 4c 8d 6c 24 10 lea 0x10(% 1750 * 4c 8d 6c 24 10 lea 0x10(%rsp),%r13
2884 * 48 83 e4 f0 and $0xfff 1751 * 48 83 e4 f0 and $0xfffffffffffffff0,%rsp
2885 * ... 1752 * ...
2886 * 49 8d 65 f0 lea -0x10( 1753 * 49 8d 65 f0 lea -0x10(%r13),%rsp
2887 * 41 5d pop %r13 1754 * 41 5d pop %r13
2888 * c3 retq 1755 * c3 retq
2889 */ 1756 */
2890 static int update_cfi_state(struct instructio !! 1757 static int update_cfi_state(struct instruction *insn, struct cfi_state *cfi,
2891 struct instructio !! 1758 struct stack_op *op)
2892 struct cfi_state <<
2893 { 1759 {
2894 struct cfi_reg *cfa = &cfi->cfa; 1760 struct cfi_reg *cfa = &cfi->cfa;
2895 struct cfi_reg *regs = cfi->regs; 1761 struct cfi_reg *regs = cfi->regs;
2896 1762
2897 /* ignore UNWIND_HINT_UNDEFINED regio <<
2898 if (cfi->force_undefined) <<
2899 return 0; <<
2900 <<
2901 /* stack operations don't make sense 1763 /* stack operations don't make sense with an undefined CFA */
2902 if (cfa->base == CFI_UNDEFINED) { 1764 if (cfa->base == CFI_UNDEFINED) {
2903 if (insn_func(insn)) { !! 1765 if (insn->func) {
2904 WARN_INSN(insn, "unde !! 1766 WARN_FUNC("undefined stack state", insn->sec, insn->offset);
2905 return -1; 1767 return -1;
2906 } 1768 }
2907 return 0; 1769 return 0;
2908 } 1770 }
2909 1771
2910 if (cfi->type == UNWIND_HINT_TYPE_REG !! 1772 if (cfi->type == ORC_TYPE_REGS || cfi->type == ORC_TYPE_REGS_IRET)
2911 cfi->type == UNWIND_HINT_TYPE_REG <<
2912 return update_cfi_state_regs( 1773 return update_cfi_state_regs(insn, cfi, op);
2913 1774
2914 switch (op->dest.type) { 1775 switch (op->dest.type) {
2915 1776
2916 case OP_DEST_REG: 1777 case OP_DEST_REG:
2917 switch (op->src.type) { 1778 switch (op->src.type) {
2918 1779
2919 case OP_SRC_REG: 1780 case OP_SRC_REG:
2920 if (op->src.reg == CF 1781 if (op->src.reg == CFI_SP && op->dest.reg == CFI_BP &&
2921 cfa->base == CFI_ 1782 cfa->base == CFI_SP &&
2922 check_reg_frame_p !! 1783 regs[CFI_BP].base == CFI_CFA &&
>> 1784 regs[CFI_BP].offset == -cfa->offset) {
2923 1785
2924 /* mov %rsp, 1786 /* mov %rsp, %rbp */
2925 cfa->base = o 1787 cfa->base = op->dest.reg;
2926 cfi->bp_scrat 1788 cfi->bp_scratch = false;
2927 } 1789 }
2928 1790
2929 else if (op->src.reg 1791 else if (op->src.reg == CFI_SP &&
2930 op->dest.reg 1792 op->dest.reg == CFI_BP && cfi->drap) {
2931 1793
2932 /* drap: mov 1794 /* drap: mov %rsp, %rbp */
2933 regs[CFI_BP]. 1795 regs[CFI_BP].base = CFI_BP;
2934 regs[CFI_BP]. 1796 regs[CFI_BP].offset = -cfi->stack_size;
2935 cfi->bp_scrat 1797 cfi->bp_scratch = false;
2936 } 1798 }
2937 1799
2938 else if (op->src.reg 1800 else if (op->src.reg == CFI_SP && cfa->base == CFI_SP) {
2939 1801
2940 /* 1802 /*
2941 * mov %rsp, 1803 * mov %rsp, %reg
2942 * 1804 *
2943 * This is ne 1805 * This is needed for the rare case where GCC
2944 * does: 1806 * does:
2945 * 1807 *
2946 * mov % 1808 * mov %rsp, %rax
2947 * ... 1809 * ...
2948 * mov % 1810 * mov %rax, %rsp
2949 */ 1811 */
2950 cfi->vals[op- 1812 cfi->vals[op->dest.reg].base = CFI_CFA;
2951 cfi->vals[op- 1813 cfi->vals[op->dest.reg].offset = -cfi->stack_size;
2952 } 1814 }
2953 1815
2954 else if (op->src.reg 1816 else if (op->src.reg == CFI_BP && op->dest.reg == CFI_SP &&
2955 (cfa->base = !! 1817 cfa->base == CFI_BP) {
2956 1818
2957 /* 1819 /*
2958 * mov %rbp, 1820 * mov %rbp, %rsp
2959 * 1821 *
2960 * Restore th 1822 * Restore the original stack pointer (Clang).
2961 */ 1823 */
2962 cfi->stack_si 1824 cfi->stack_size = -cfi->regs[CFI_BP].offset;
2963 } 1825 }
2964 1826
2965 else if (op->dest.reg 1827 else if (op->dest.reg == cfa->base) {
2966 1828
2967 /* mov %reg, 1829 /* mov %reg, %rsp */
2968 if (cfa->base 1830 if (cfa->base == CFI_SP &&
2969 cfi->vals 1831 cfi->vals[op->src.reg].base == CFI_CFA) {
2970 1832
2971 /* 1833 /*
2972 * Th 1834 * This is needed for the rare case
2973 * wh 1835 * where GCC does something dumb like:
2974 * 1836 *
2975 * 1837 * lea 0x8(%rsp), %rcx
2976 * 1838 * ...
2977 * 1839 * mov %rcx, %rsp
2978 */ 1840 */
2979 cfa-> 1841 cfa->offset = -cfi->vals[op->src.reg].offset;
2980 cfi-> 1842 cfi->stack_size = cfa->offset;
2981 1843
2982 } else if (cf <<
2983 cf <<
2984 cf <<
2985 <<
2986 /* <<
2987 * St <<
2988 * <<
2989 * 1: <<
2990 * 2: <<
2991 * <<
2992 * 3: <<
2993 * <<
2994 * Wh <<
2995 * <<
2996 * 1 <<
2997 * <<
2998 * <<
2999 * <<
3000 * 2 <<
3001 * <<
3002 * 3 <<
3003 * <<
3004 * <<
3005 * No <<
3006 * he <<
3007 * wh <<
3008 * wi <<
3009 * of <<
3010 * (% <<
3011 */ <<
3012 cfa-> <<
3013 <<
3014 } else { 1844 } else {
3015 cfa-> 1845 cfa->base = CFI_UNDEFINED;
3016 cfa-> 1846 cfa->offset = 0;
3017 } 1847 }
3018 } 1848 }
3019 1849
3020 else if (op->dest.reg <<
3021 cfi->vals[op <<
3022 cfi->vals[op <<
3023 <<
3024 /* <<
3025 * The same s <<
3026 * because we <<
3027 * will becom <<
3028 * PUSH so th <<
3029 */ <<
3030 cfi->stack_si <<
3031 } <<
3032 <<
3033 <<
3034 break; 1850 break;
3035 1851
3036 case OP_SRC_ADD: 1852 case OP_SRC_ADD:
3037 if (op->dest.reg == C 1853 if (op->dest.reg == CFI_SP && op->src.reg == CFI_SP) {
3038 1854
3039 /* add imm, % 1855 /* add imm, %rsp */
3040 cfi->stack_si 1856 cfi->stack_size -= op->src.offset;
3041 if (cfa->base 1857 if (cfa->base == CFI_SP)
3042 cfa-> 1858 cfa->offset -= op->src.offset;
3043 break; 1859 break;
3044 } 1860 }
3045 1861
3046 if (op->dest.reg == C <<
3047 insn->sym->frame_ <<
3048 /* addi.d fp, <<
3049 if (cfa->base <<
3050 cfa-> <<
3051 cfa-> <<
3052 } <<
3053 break; <<
3054 } <<
3055 <<
3056 if (op->dest.reg == C 1862 if (op->dest.reg == CFI_SP && op->src.reg == CFI_BP) {
3057 /* addi.d sp, !! 1863
3058 if (cfa->base !! 1864 /* lea disp(%rbp), %rsp */
3059 if (i !! 1865 cfi->stack_size = -(op->src.offset + regs[CFI_BP].offset);
3060 <<
3061 <<
3062 } <<
3063 } else { <<
3064 /* le <<
3065 cfi-> <<
3066 } <<
3067 break; 1866 break;
3068 } 1867 }
3069 1868
3070 if (op->src.reg == CF 1869 if (op->src.reg == CFI_SP && cfa->base == CFI_SP) {
3071 1870
3072 /* drap: lea 1871 /* drap: lea disp(%rsp), %drap */
3073 cfi->drap_reg 1872 cfi->drap_reg = op->dest.reg;
3074 1873
3075 /* 1874 /*
3076 * lea disp(% 1875 * lea disp(%rsp), %reg
3077 * 1876 *
3078 * This is ne 1877 * This is needed for the rare case where GCC
3079 * does somet 1878 * does something dumb like:
3080 * 1879 *
3081 * lea 0 1880 * lea 0x8(%rsp), %rcx
3082 * ... 1881 * ...
3083 * mov % 1882 * mov %rcx, %rsp
3084 */ 1883 */
3085 cfi->vals[op- 1884 cfi->vals[op->dest.reg].base = CFI_CFA;
3086 cfi->vals[op- 1885 cfi->vals[op->dest.reg].offset = \
3087 -cfi- 1886 -cfi->stack_size + op->src.offset;
3088 1887
3089 break; 1888 break;
3090 } 1889 }
3091 1890
3092 if (cfi->drap && op-> 1891 if (cfi->drap && op->dest.reg == CFI_SP &&
3093 op->src.reg == cf 1892 op->src.reg == cfi->drap_reg) {
3094 1893
3095 /* drap: lea 1894 /* drap: lea disp(%drap), %rsp */
3096 cfa->base = C 1895 cfa->base = CFI_SP;
3097 cfa->offset = 1896 cfa->offset = cfi->stack_size = -op->src.offset;
3098 cfi->drap_reg 1897 cfi->drap_reg = CFI_UNDEFINED;
3099 cfi->drap = f 1898 cfi->drap = false;
3100 break; 1899 break;
3101 } 1900 }
3102 1901
3103 if (op->dest.reg == c !! 1902 if (op->dest.reg == cfi->cfa.base) {
3104 WARN_INSN(ins !! 1903 WARN_FUNC("unsupported stack register modification",
>> 1904 insn->sec, insn->offset);
3105 return -1; 1905 return -1;
3106 } 1906 }
3107 1907
3108 break; 1908 break;
3109 1909
3110 case OP_SRC_AND: 1910 case OP_SRC_AND:
3111 if (op->dest.reg != C 1911 if (op->dest.reg != CFI_SP ||
3112 (cfi->drap_reg != 1912 (cfi->drap_reg != CFI_UNDEFINED && cfa->base != CFI_SP) ||
3113 (cfi->drap_reg == 1913 (cfi->drap_reg == CFI_UNDEFINED && cfa->base != CFI_BP)) {
3114 WARN_INSN(ins !! 1914 WARN_FUNC("unsupported stack pointer realignment",
>> 1915 insn->sec, insn->offset);
3115 return -1; 1916 return -1;
3116 } 1917 }
3117 1918
3118 if (cfi->drap_reg != 1919 if (cfi->drap_reg != CFI_UNDEFINED) {
3119 /* drap: and 1920 /* drap: and imm, %rsp */
3120 cfa->base = c 1921 cfa->base = cfi->drap_reg;
3121 cfa->offset = 1922 cfa->offset = cfi->stack_size = 0;
3122 cfi->drap = t 1923 cfi->drap = true;
3123 } 1924 }
3124 1925
3125 /* 1926 /*
3126 * Older versions of 1927 * Older versions of GCC (4.8ish) realign the stack
3127 * without DRAP, with 1928 * without DRAP, with a frame pointer.
3128 */ 1929 */
3129 1930
3130 break; 1931 break;
3131 1932
3132 case OP_SRC_POP: 1933 case OP_SRC_POP:
3133 case OP_SRC_POPF: 1934 case OP_SRC_POPF:
3134 if (op->dest.reg == C <<
3135 <<
3136 /* pop %rsp; <<
3137 cfa->base = C <<
3138 break; <<
3139 } <<
3140 <<
3141 if (!cfi->drap && op- 1935 if (!cfi->drap && op->dest.reg == cfa->base) {
3142 1936
3143 /* pop %rbp * 1937 /* pop %rbp */
3144 cfa->base = C 1938 cfa->base = CFI_SP;
3145 } 1939 }
3146 1940
3147 if (cfi->drap && cfa- 1941 if (cfi->drap && cfa->base == CFI_BP_INDIRECT &&
3148 op->dest.reg == c 1942 op->dest.reg == cfi->drap_reg &&
3149 cfi->drap_offset 1943 cfi->drap_offset == -cfi->stack_size) {
3150 1944
3151 /* drap: pop 1945 /* drap: pop %drap */
3152 cfa->base = c 1946 cfa->base = cfi->drap_reg;
3153 cfa->offset = 1947 cfa->offset = 0;
3154 cfi->drap_off 1948 cfi->drap_offset = -1;
3155 1949
3156 } else if (cfi->stack !! 1950 } else if (regs[op->dest.reg].offset == -cfi->stack_size) {
3157 1951
3158 /* pop %reg * 1952 /* pop %reg */
3159 restore_reg(c 1953 restore_reg(cfi, op->dest.reg);
3160 } 1954 }
3161 1955
3162 cfi->stack_size -= 8; 1956 cfi->stack_size -= 8;
3163 if (cfa->base == CFI_ 1957 if (cfa->base == CFI_SP)
3164 cfa->offset - 1958 cfa->offset -= 8;
3165 1959
3166 break; 1960 break;
3167 1961
3168 case OP_SRC_REG_INDIRECT: 1962 case OP_SRC_REG_INDIRECT:
3169 if (!cfi->drap && op- <<
3170 op->dest.reg == C <<
3171 <<
3172 /* mov disp(% <<
3173 cfa->base = C <<
3174 cfa->offset = <<
3175 } <<
3176 <<
3177 if (cfi->drap && op-> 1963 if (cfi->drap && op->src.reg == CFI_BP &&
3178 op->src.offset == 1964 op->src.offset == cfi->drap_offset) {
3179 1965
3180 /* drap: mov 1966 /* drap: mov disp(%rbp), %drap */
3181 cfa->base = c 1967 cfa->base = cfi->drap_reg;
3182 cfa->offset = 1968 cfa->offset = 0;
3183 cfi->drap_off 1969 cfi->drap_offset = -1;
3184 } 1970 }
3185 1971
3186 if (cfi->drap && op-> 1972 if (cfi->drap && op->src.reg == CFI_BP &&
3187 op->src.offset == 1973 op->src.offset == regs[op->dest.reg].offset) {
3188 1974
3189 /* drap: mov 1975 /* drap: mov disp(%rbp), %reg */
3190 restore_reg(c 1976 restore_reg(cfi, op->dest.reg);
3191 1977
3192 } else if (op->src.re 1978 } else if (op->src.reg == cfa->base &&
3193 op->src.offset == 1979 op->src.offset == regs[op->dest.reg].offset + cfa->offset) {
3194 1980
3195 /* mov disp(% 1981 /* mov disp(%rbp), %reg */
3196 /* mov disp(% 1982 /* mov disp(%rsp), %reg */
3197 restore_reg(c 1983 restore_reg(cfi, op->dest.reg);
3198 <<
3199 } else if (op->src.re <<
3200 op->src.of <<
3201 <<
3202 /* mov disp(% <<
3203 restore_reg(c <<
3204 } 1984 }
3205 1985
3206 break; 1986 break;
3207 1987
3208 default: 1988 default:
3209 WARN_INSN(insn, "unkn !! 1989 WARN_FUNC("unknown stack-related instruction",
>> 1990 insn->sec, insn->offset);
3210 return -1; 1991 return -1;
3211 } 1992 }
3212 1993
3213 break; 1994 break;
3214 1995
3215 case OP_DEST_PUSH: 1996 case OP_DEST_PUSH:
3216 case OP_DEST_PUSHF: 1997 case OP_DEST_PUSHF:
3217 cfi->stack_size += 8; 1998 cfi->stack_size += 8;
3218 if (cfa->base == CFI_SP) 1999 if (cfa->base == CFI_SP)
3219 cfa->offset += 8; 2000 cfa->offset += 8;
3220 2001
3221 if (op->src.type != OP_SRC_RE 2002 if (op->src.type != OP_SRC_REG)
3222 break; 2003 break;
3223 2004
3224 if (cfi->drap) { 2005 if (cfi->drap) {
3225 if (op->src.reg == cf 2006 if (op->src.reg == cfa->base && op->src.reg == cfi->drap_reg) {
3226 2007
3227 /* drap: push 2008 /* drap: push %drap */
3228 cfa->base = C 2009 cfa->base = CFI_BP_INDIRECT;
3229 cfa->offset = 2010 cfa->offset = -cfi->stack_size;
3230 2011
3231 /* save drap 2012 /* save drap so we know when to restore it */
3232 cfi->drap_off 2013 cfi->drap_offset = -cfi->stack_size;
3233 2014
3234 } else if (op->src.re 2015 } else if (op->src.reg == CFI_BP && cfa->base == cfi->drap_reg) {
3235 2016
3236 /* drap: push 2017 /* drap: push %rbp */
3237 cfi->stack_si 2018 cfi->stack_size = 0;
3238 2019
3239 } else { !! 2020 } else if (regs[op->src.reg].base == CFI_UNDEFINED) {
3240 2021
3241 /* drap: push 2022 /* drap: push %reg */
3242 save_reg(cfi, 2023 save_reg(cfi, op->src.reg, CFI_BP, -cfi->stack_size);
3243 } 2024 }
3244 2025
3245 } else { 2026 } else {
3246 2027
3247 /* push %reg */ 2028 /* push %reg */
3248 save_reg(cfi, op->src 2029 save_reg(cfi, op->src.reg, CFI_CFA, -cfi->stack_size);
3249 } 2030 }
3250 2031
3251 /* detect when asm code uses 2032 /* detect when asm code uses rbp as a scratch register */
3252 if (opts.stackval && insn_fun !! 2033 if (!no_fp && insn->func && op->src.reg == CFI_BP &&
3253 cfa->base != CFI_BP) 2034 cfa->base != CFI_BP)
3254 cfi->bp_scratch = tru 2035 cfi->bp_scratch = true;
3255 break; 2036 break;
3256 2037
3257 case OP_DEST_REG_INDIRECT: 2038 case OP_DEST_REG_INDIRECT:
3258 2039
3259 if (cfi->drap) { 2040 if (cfi->drap) {
3260 if (op->src.reg == cf 2041 if (op->src.reg == cfa->base && op->src.reg == cfi->drap_reg) {
3261 2042
3262 /* drap: mov 2043 /* drap: mov %drap, disp(%rbp) */
3263 cfa->base = C 2044 cfa->base = CFI_BP_INDIRECT;
3264 cfa->offset = 2045 cfa->offset = op->dest.offset;
3265 2046
3266 /* save drap 2047 /* save drap offset so we know when to restore it */
3267 cfi->drap_off 2048 cfi->drap_offset = op->dest.offset;
3268 } else { !! 2049 }
>> 2050
>> 2051 else if (regs[op->src.reg].base == CFI_UNDEFINED) {
3269 2052
3270 /* drap: mov 2053 /* drap: mov reg, disp(%rbp) */
3271 save_reg(cfi, 2054 save_reg(cfi, op->src.reg, CFI_BP, op->dest.offset);
3272 } 2055 }
3273 2056
3274 } else if (op->dest.reg == cf 2057 } else if (op->dest.reg == cfa->base) {
3275 2058
3276 /* mov reg, disp(%rbp 2059 /* mov reg, disp(%rbp) */
3277 /* mov reg, disp(%rsp 2060 /* mov reg, disp(%rsp) */
3278 save_reg(cfi, op->src 2061 save_reg(cfi, op->src.reg, CFI_CFA,
3279 op->dest.off 2062 op->dest.offset - cfi->cfa.offset);
>> 2063 }
3280 2064
3281 } else if (op->dest.reg == CF !! 2065 break;
3282 2066
3283 /* mov reg, disp(%rsp !! 2067 case OP_DEST_LEAVE:
3284 save_reg(cfi, op->src !! 2068 if ((!cfi->drap && cfa->base != CFI_BP) ||
3285 op->dest.off !! 2069 (cfi->drap && cfa->base != cfi->drap_reg)) {
>> 2070 WARN_FUNC("leave instruction with modified stack frame",
>> 2071 insn->sec, insn->offset);
>> 2072 return -1;
>> 2073 }
>> 2074
>> 2075 /* leave (mov %rbp, %rsp; pop %rbp) */
3286 2076
3287 } else if (op->src.reg == CFI !! 2077 cfi->stack_size = -cfi->regs[CFI_BP].offset - 8;
>> 2078 restore_reg(cfi, CFI_BP);
3288 2079
3289 /* mov %rsp, (%reg); !! 2080 if (!cfi->drap) {
3290 cfi->vals[op->dest.re !! 2081 cfa->base = CFI_SP;
3291 cfi->vals[op->dest.re !! 2082 cfa->offset -= 8;
3292 } 2083 }
3293 2084
3294 break; 2085 break;
3295 2086
3296 case OP_DEST_MEM: 2087 case OP_DEST_MEM:
3297 if (op->src.type != OP_SRC_PO 2088 if (op->src.type != OP_SRC_POP && op->src.type != OP_SRC_POPF) {
3298 WARN_INSN(insn, "unkn !! 2089 WARN_FUNC("unknown stack-related memory operation",
>> 2090 insn->sec, insn->offset);
3299 return -1; 2091 return -1;
3300 } 2092 }
3301 2093
3302 /* pop mem */ 2094 /* pop mem */
3303 cfi->stack_size -= 8; 2095 cfi->stack_size -= 8;
3304 if (cfa->base == CFI_SP) 2096 if (cfa->base == CFI_SP)
3305 cfa->offset -= 8; 2097 cfa->offset -= 8;
3306 2098
3307 break; 2099 break;
3308 2100
3309 default: 2101 default:
3310 WARN_INSN(insn, "unknown stac !! 2102 WARN_FUNC("unknown stack-related instruction",
>> 2103 insn->sec, insn->offset);
3311 return -1; 2104 return -1;
3312 } 2105 }
3313 2106
3314 return 0; 2107 return 0;
3315 } 2108 }
3316 2109
3317 /* !! 2110 static int handle_insn_ops(struct instruction *insn, struct insn_state *state)
3318 * The stack layouts of alternatives instruct <<
3319 * they have stack modifications. That's fin <<
3320 * layouts don't conflict at any given potent <<
3321 * <<
3322 * Flatten the CFIs of the different alternat <<
3323 * and replacement) into a single shared CFI <<
3324 * conflicts and nicely feed a linear array o <<
3325 */ <<
3326 static int propagate_alt_cfi(struct objtool_f <<
3327 { 2111 {
3328 struct cfi_state **alt_cfi; !! 2112 struct stack_op *op;
3329 int group_off; <<
3330 <<
3331 if (!insn->alt_group) <<
3332 return 0; <<
3333 <<
3334 if (!insn->cfi) { <<
3335 WARN("CFI missing"); <<
3336 return -1; <<
3337 } <<
3338 2113
3339 alt_cfi = insn->alt_group->cfi; !! 2114 list_for_each_entry(op, &insn->stack_ops, list) {
3340 group_off = insn->offset - insn->alt_ !! 2115 struct cfi_state old_cfi = state->cfi;
>> 2116 int res;
>> 2117
>> 2118 res = update_cfi_state(insn, &state->cfi, op);
>> 2119 if (res)
>> 2120 return res;
3341 2121
3342 if (!alt_cfi[group_off]) { !! 2122 if (insn->alt_group && memcmp(&state->cfi, &old_cfi, sizeof(struct cfi_state))) {
3343 alt_cfi[group_off] = insn->cf !! 2123 WARN_FUNC("alternative modifies stack", insn->sec, insn->offset);
3344 } else { <<
3345 if (cficmp(alt_cfi[group_off] <<
3346 struct alt_group *ori <<
3347 struct instruction *o <<
3348 char *where = offstr( <<
3349 WARN_INSN(orig, "stac <<
3350 free(where); <<
3351 return -1; 2124 return -1;
3352 } 2125 }
3353 } <<
3354 <<
3355 return 0; <<
3356 } <<
3357 <<
3358 static int handle_insn_ops(struct instruction <<
3359 struct instruction <<
3360 struct insn_state <<
3361 { <<
3362 struct stack_op *op; <<
3363 <<
3364 for (op = insn->stack_ops; op; op = o <<
3365 <<
3366 if (update_cfi_state(insn, ne <<
3367 return 1; <<
3368 <<
3369 if (!insn->alt_group) <<
3370 continue; <<
3371 2126
3372 if (op->dest.type == OP_DEST_ 2127 if (op->dest.type == OP_DEST_PUSHF) {
3373 if (!state->uaccess_s 2128 if (!state->uaccess_stack) {
3374 state->uacces 2129 state->uaccess_stack = 1;
3375 } else if (state->uac 2130 } else if (state->uaccess_stack >> 31) {
3376 WARN_INSN(ins !! 2131 WARN_FUNC("PUSHF stack exhausted",
>> 2132 insn->sec, insn->offset);
3377 return 1; 2133 return 1;
3378 } 2134 }
3379 state->uaccess_stack 2135 state->uaccess_stack <<= 1;
3380 state->uaccess_stack 2136 state->uaccess_stack |= state->uaccess;
3381 } 2137 }
3382 2138
3383 if (op->src.type == OP_SRC_PO 2139 if (op->src.type == OP_SRC_POPF) {
3384 if (state->uaccess_st 2140 if (state->uaccess_stack) {
3385 state->uacces 2141 state->uaccess = state->uaccess_stack & 1;
3386 state->uacces 2142 state->uaccess_stack >>= 1;
3387 if (state->ua 2143 if (state->uaccess_stack == 1)
3388 state 2144 state->uaccess_stack = 0;
3389 } 2145 }
3390 } 2146 }
3391 } 2147 }
3392 2148
3393 return 0; 2149 return 0;
3394 } 2150 }
3395 2151
3396 static bool insn_cfi_match(struct instruction 2152 static bool insn_cfi_match(struct instruction *insn, struct cfi_state *cfi2)
3397 { 2153 {
3398 struct cfi_state *cfi1 = insn->cfi; !! 2154 struct cfi_state *cfi1 = &insn->cfi;
3399 int i; 2155 int i;
3400 2156
3401 if (!cfi1) { <<
3402 WARN("CFI missing"); <<
3403 return false; <<
3404 } <<
3405 <<
3406 if (memcmp(&cfi1->cfa, &cfi2->cfa, si 2157 if (memcmp(&cfi1->cfa, &cfi2->cfa, sizeof(cfi1->cfa))) {
3407 2158
3408 WARN_INSN(insn, "stack state !! 2159 WARN_FUNC("stack state mismatch: cfa1=%d%+d cfa2=%d%+d",
>> 2160 insn->sec, insn->offset,
3409 cfi1->cfa.base, cfi 2161 cfi1->cfa.base, cfi1->cfa.offset,
3410 cfi2->cfa.base, cfi 2162 cfi2->cfa.base, cfi2->cfa.offset);
3411 2163
3412 } else if (memcmp(&cfi1->regs, &cfi2- 2164 } else if (memcmp(&cfi1->regs, &cfi2->regs, sizeof(cfi1->regs))) {
3413 for (i = 0; i < CFI_NUM_REGS; 2165 for (i = 0; i < CFI_NUM_REGS; i++) {
3414 if (!memcmp(&cfi1->re 2166 if (!memcmp(&cfi1->regs[i], &cfi2->regs[i],
3415 sizeof(st 2167 sizeof(struct cfi_reg)))
3416 continue; 2168 continue;
3417 2169
3418 WARN_INSN(insn, "stac !! 2170 WARN_FUNC("stack state mismatch: reg1[%d]=%d%+d reg2[%d]=%d%+d",
>> 2171 insn->sec, insn->offset,
3419 i, cfi1->re 2172 i, cfi1->regs[i].base, cfi1->regs[i].offset,
3420 i, cfi2->re 2173 i, cfi2->regs[i].base, cfi2->regs[i].offset);
3421 break; 2174 break;
3422 } 2175 }
3423 2176
3424 } else if (cfi1->type != cfi2->type) 2177 } else if (cfi1->type != cfi2->type) {
3425 2178
3426 WARN_INSN(insn, "stack state !! 2179 WARN_FUNC("stack state mismatch: type1=%d type2=%d",
3427 cfi1->type, cfi2->t !! 2180 insn->sec, insn->offset, cfi1->type, cfi2->type);
3428 2181
3429 } else if (cfi1->drap != cfi2->drap | 2182 } else if (cfi1->drap != cfi2->drap ||
3430 (cfi1->drap && cfi1->drap_ 2183 (cfi1->drap && cfi1->drap_reg != cfi2->drap_reg) ||
3431 (cfi1->drap && cfi1->drap_ 2184 (cfi1->drap && cfi1->drap_offset != cfi2->drap_offset)) {
3432 2185
3433 WARN_INSN(insn, "stack state !! 2186 WARN_FUNC("stack state mismatch: drap1=%d(%d,%d) drap2=%d(%d,%d)",
>> 2187 insn->sec, insn->offset,
3434 cfi1->drap, cfi1->d 2188 cfi1->drap, cfi1->drap_reg, cfi1->drap_offset,
3435 cfi2->drap, cfi2->d 2189 cfi2->drap, cfi2->drap_reg, cfi2->drap_offset);
3436 2190
3437 } else 2191 } else
3438 return true; 2192 return true;
3439 2193
3440 return false; 2194 return false;
3441 } 2195 }
3442 2196
3443 static inline bool func_uaccess_safe(struct s 2197 static inline bool func_uaccess_safe(struct symbol *func)
3444 { 2198 {
3445 if (func) 2199 if (func)
3446 return func->uaccess_safe; 2200 return func->uaccess_safe;
3447 2201
3448 return false; 2202 return false;
3449 } 2203 }
3450 2204
3451 static inline const char *call_dest_name(stru 2205 static inline const char *call_dest_name(struct instruction *insn)
3452 { 2206 {
3453 static char pvname[19]; !! 2207 if (insn->call_dest)
3454 struct reloc *reloc; !! 2208 return insn->call_dest->name;
3455 int idx; <<
3456 <<
3457 if (insn_call_dest(insn)) <<
3458 return insn_call_dest(insn)-> <<
3459 <<
3460 reloc = insn_reloc(NULL, insn); <<
3461 if (reloc && !strcmp(reloc->sym->name <<
3462 idx = (reloc_addend(reloc) / <<
3463 snprintf(pvname, sizeof(pvnam <<
3464 return pvname; <<
3465 } <<
3466 2209
3467 return "{dynamic}"; 2210 return "{dynamic}";
3468 } 2211 }
3469 2212
3470 static bool pv_call_dest(struct objtool_file !! 2213 static inline bool noinstr_call_dest(struct symbol *func)
3471 { <<
3472 struct symbol *target; <<
3473 struct reloc *reloc; <<
3474 int idx; <<
3475 <<
3476 reloc = insn_reloc(file, insn); <<
3477 if (!reloc || strcmp(reloc->sym->name <<
3478 return false; <<
3479 <<
3480 idx = (arch_dest_reloc_offset(reloc_a <<
3481 <<
3482 if (file->pv_ops[idx].clean) <<
3483 return true; <<
3484 <<
3485 file->pv_ops[idx].clean = true; <<
3486 <<
3487 list_for_each_entry(target, &file->pv <<
3488 if (!target->sec->noinstr) { <<
3489 WARN("pv_ops[%d]: %s" <<
3490 file->pv_ops[idx].cle <<
3491 } <<
3492 } <<
3493 <<
3494 return file->pv_ops[idx].clean; <<
3495 } <<
3496 <<
3497 static inline bool noinstr_call_dest(struct o <<
3498 struct i <<
3499 struct s <<
3500 { 2214 {
3501 /* 2215 /*
3502 * We can't deal with indirect functi 2216 * We can't deal with indirect function calls at present;
3503 * assume they're instrumented. 2217 * assume they're instrumented.
3504 */ 2218 */
3505 if (!func) { !! 2219 if (!func)
3506 if (file->pv_ops) <<
3507 return pv_call_dest(f <<
3508 <<
3509 return false; 2220 return false;
3510 } <<
3511 2221
3512 /* 2222 /*
3513 * If the symbol is from a noinstr se 2223 * If the symbol is from a noinstr section; we good.
3514 */ 2224 */
3515 if (func->sec->noinstr) 2225 if (func->sec->noinstr)
3516 return true; 2226 return true;
3517 2227
3518 /* 2228 /*
3519 * If the symbol is a static_call tra <<
3520 */ <<
3521 if (func->static_call_tramp) <<
3522 return true; <<
3523 <<
3524 /* <<
3525 * The __ubsan_handle_*() calls are l 2229 * The __ubsan_handle_*() calls are like WARN(), they only happen when
3526 * something 'BAD' happened. At the r 2230 * something 'BAD' happened. At the risk of taking the machine down,
3527 * let them proceed to get the messag 2231 * let them proceed to get the message out.
3528 */ 2232 */
3529 if (!strncmp(func->name, "__ubsan_han 2233 if (!strncmp(func->name, "__ubsan_handle_", 15))
3530 return true; 2234 return true;
3531 2235
3532 return false; 2236 return false;
3533 } 2237 }
3534 2238
3535 static int validate_call(struct objtool_file !! 2239 static int validate_call(struct instruction *insn, struct insn_state *state)
3536 struct instruction * <<
3537 struct insn_state *s <<
3538 { 2240 {
3539 if (state->noinstr && state->instr <= 2241 if (state->noinstr && state->instr <= 0 &&
3540 !noinstr_call_dest(file, insn, in !! 2242 !noinstr_call_dest(insn->call_dest)) {
3541 WARN_INSN(insn, "call to %s() !! 2243 WARN_FUNC("call to %s() leaves .noinstr.text section",
>> 2244 insn->sec, insn->offset, call_dest_name(insn));
3542 return 1; 2245 return 1;
3543 } 2246 }
3544 2247
3545 if (state->uaccess && !func_uaccess_s !! 2248 if (state->uaccess && !func_uaccess_safe(insn->call_dest)) {
3546 WARN_INSN(insn, "call to %s() !! 2249 WARN_FUNC("call to %s() with UACCESS enabled",
>> 2250 insn->sec, insn->offset, call_dest_name(insn));
3547 return 1; 2251 return 1;
3548 } 2252 }
3549 2253
3550 if (state->df) { 2254 if (state->df) {
3551 WARN_INSN(insn, "call to %s() !! 2255 WARN_FUNC("call to %s() with DF set",
>> 2256 insn->sec, insn->offset, call_dest_name(insn));
3552 return 1; 2257 return 1;
3553 } 2258 }
3554 2259
3555 return 0; 2260 return 0;
3556 } 2261 }
3557 2262
3558 static int validate_sibling_call(struct objto !! 2263 static int validate_sibling_call(struct instruction *insn, struct insn_state *state)
3559 struct instr <<
3560 struct insn_ <<
3561 { 2264 {
3562 if (insn_func(insn) && has_modified_s !! 2265 if (has_modified_stack_frame(insn, state)) {
3563 WARN_INSN(insn, "sibling call !! 2266 WARN_FUNC("sibling call from callable instruction with modified stack frame",
>> 2267 insn->sec, insn->offset);
3564 return 1; 2268 return 1;
3565 } 2269 }
3566 2270
3567 return validate_call(file, insn, stat !! 2271 return validate_call(insn, state);
3568 } 2272 }
3569 2273
3570 static int validate_return(struct symbol *fun 2274 static int validate_return(struct symbol *func, struct instruction *insn, struct insn_state *state)
3571 { 2275 {
3572 if (state->noinstr && state->instr > 2276 if (state->noinstr && state->instr > 0) {
3573 WARN_INSN(insn, "return with !! 2277 WARN_FUNC("return with instrumentation enabled",
>> 2278 insn->sec, insn->offset);
3574 return 1; 2279 return 1;
3575 } 2280 }
3576 2281
3577 if (state->uaccess && !func_uaccess_s 2282 if (state->uaccess && !func_uaccess_safe(func)) {
3578 WARN_INSN(insn, "return with !! 2283 WARN_FUNC("return with UACCESS enabled",
>> 2284 insn->sec, insn->offset);
3579 return 1; 2285 return 1;
3580 } 2286 }
3581 2287
3582 if (!state->uaccess && func_uaccess_s 2288 if (!state->uaccess && func_uaccess_safe(func)) {
3583 WARN_INSN(insn, "return with !! 2289 WARN_FUNC("return with UACCESS disabled from a UACCESS-safe function",
>> 2290 insn->sec, insn->offset);
3584 return 1; 2291 return 1;
3585 } 2292 }
3586 2293
3587 if (state->df) { 2294 if (state->df) {
3588 WARN_INSN(insn, "return with !! 2295 WARN_FUNC("return with DF set",
>> 2296 insn->sec, insn->offset);
3589 return 1; 2297 return 1;
3590 } 2298 }
3591 2299
3592 if (func && has_modified_stack_frame( 2300 if (func && has_modified_stack_frame(insn, state)) {
3593 WARN_INSN(insn, "return with !! 2301 WARN_FUNC("return with modified stack frame",
>> 2302 insn->sec, insn->offset);
3594 return 1; 2303 return 1;
3595 } 2304 }
3596 2305
3597 if (state->cfi.bp_scratch) { 2306 if (state->cfi.bp_scratch) {
3598 WARN_INSN(insn, "BP used as a !! 2307 WARN_FUNC("BP used as a scratch register",
>> 2308 insn->sec, insn->offset);
3599 return 1; 2309 return 1;
3600 } 2310 }
3601 2311
3602 return 0; 2312 return 0;
3603 } 2313 }
3604 2314
3605 static struct instruction *next_insn_to_valid !! 2315 /*
3606 !! 2316 * Alternatives should not contain any ORC entries, this in turn means they
>> 2317 * should not contain any CFI ops, which implies all instructions should have
>> 2318 * the same same CFI state.
>> 2319 *
>> 2320 * It is possible to constuct alternatives that have unreachable holes that go
>> 2321 * unreported (because they're NOPs), such holes would result in CFI_UNDEFINED
>> 2322 * states which then results in ORC entries, which we just said we didn't want.
>> 2323 *
>> 2324 * Avoid them by copying the CFI entry of the first instruction into the whole
>> 2325 * alternative.
>> 2326 */
>> 2327 static void fill_alternative_cfi(struct objtool_file *file, struct instruction *insn)
3607 { 2328 {
3608 struct alt_group *alt_group = insn->a !! 2329 struct instruction *first_insn = insn;
>> 2330 int alt_group = insn->alt_group;
3609 2331
3610 /* !! 2332 sec_for_each_insn_continue(file, insn) {
3611 * Simulate the fact that alternative !! 2333 if (insn->alt_group != alt_group)
3612 * end of a replacement alt_group is !! 2334 break;
3613 * the end of the original alt_group. !! 2335 insn->cfi = first_insn->cfi;
3614 * <<
3615 * insn->alts->insn -> alt_group->fir <<
3616 * ... <<
3617 * alt_group->las <<
3618 * [alt_group->no <<
3619 */ <<
3620 if (alt_group) { <<
3621 if (alt_group->nop) { <<
3622 /* ->nop implies ->or <<
3623 if (insn == alt_group <<
3624 return alt_gr <<
3625 if (insn == alt_group <<
3626 goto next_ori <<
3627 } <<
3628 if (insn == alt_group->last_i <<
3629 goto next_orig; <<
3630 } 2336 }
3631 <<
3632 return next_insn_same_sec(file, insn) <<
3633 <<
3634 next_orig: <<
3635 return next_insn_same_sec(file, alt_g <<
3636 } 2337 }
3637 2338
3638 /* 2339 /*
3639 * Follow the branch starting at the given in 2340 * Follow the branch starting at the given instruction, and recursively follow
3640 * any other branches (jumps). Meanwhile, tr 2341 * any other branches (jumps). Meanwhile, track the frame pointer state at
3641 * each instruction and validate all the rule 2342 * each instruction and validate all the rules described in
3642 * tools/objtool/Documentation/objtool.txt. !! 2343 * tools/objtool/Documentation/stack-validation.txt.
3643 */ 2344 */
3644 static int validate_branch(struct objtool_fil 2345 static int validate_branch(struct objtool_file *file, struct symbol *func,
3645 struct instruction 2346 struct instruction *insn, struct insn_state state)
3646 { 2347 {
3647 struct alternative *alt; 2348 struct alternative *alt;
3648 struct instruction *next_insn, *prev_ !! 2349 struct instruction *next_insn;
3649 struct section *sec; 2350 struct section *sec;
3650 u8 visited; 2351 u8 visited;
3651 int ret; 2352 int ret;
3652 2353
3653 sec = insn->sec; 2354 sec = insn->sec;
3654 2355
3655 while (1) { 2356 while (1) {
3656 next_insn = next_insn_to_vali !! 2357 next_insn = next_insn_same_sec(file, insn);
3657 <<
3658 if (func && insn_func(insn) & <<
3659 /* Ignore KCFI type p <<
3660 if (!strncmp(func->na <<
3661 !strncmp(func->na <<
3662 return 0; <<
3663 2358
>> 2359 if (file->c_file && func && insn->func && func != insn->func->pfunc) {
3664 WARN("%s() falls thro 2360 WARN("%s() falls through to next function %s()",
3665 func->name, insn !! 2361 func->name, insn->func->name);
3666 return 1; 2362 return 1;
3667 } 2363 }
3668 2364
3669 if (func && insn->ignore) { 2365 if (func && insn->ignore) {
3670 WARN_INSN(insn, "BUG: !! 2366 WARN_FUNC("BUG: why am I validating an ignored function?",
>> 2367 sec, insn->offset);
3671 return 1; 2368 return 1;
3672 } 2369 }
3673 2370
3674 visited = VISITED_BRANCH << s !! 2371 visited = 1 << state.uaccess;
3675 if (insn->visited & VISITED_B !! 2372 if (insn->visited) {
3676 if (!insn->hint && !i 2373 if (!insn->hint && !insn_cfi_match(insn, &state.cfi))
3677 return 1; 2374 return 1;
3678 2375
3679 if (insn->visited & v 2376 if (insn->visited & visited)
3680 return 0; 2377 return 0;
3681 } else { <<
3682 nr_insns_visited++; <<
3683 } 2378 }
3684 2379
3685 if (state.noinstr) 2380 if (state.noinstr)
3686 state.instr += insn-> 2381 state.instr += insn->instr;
3687 2382
3688 if (insn->hint) { !! 2383 if (insn->hint)
3689 if (insn->restore) { !! 2384 state.cfi = insn->cfi;
3690 struct instru !! 2385 else
3691 !! 2386 insn->cfi = state.cfi;
3692 i = insn; <<
3693 save_insn = N <<
3694 <<
3695 sym_for_each_ <<
3696 if (i <<
3697 <<
3698 <<
3699 } <<
3700 } <<
3701 <<
3702 if (!save_ins <<
3703 WARN_ <<
3704 retur <<
3705 } <<
3706 <<
3707 if (!save_ins <<
3708 /* <<
3709 * If <<
3710 * be <<
3711 * br <<
3712 * sa <<
3713 * de <<
3714 * It <<
3715 * st <<
3716 */ <<
3717 if (! <<
3718 <<
3719 <<
3720 WARN_ <<
3721 retur <<
3722 } <<
3723 <<
3724 insn->cfi = s <<
3725 nr_cfi_reused <<
3726 } <<
3727 <<
3728 state.cfi = *insn->cf <<
3729 } else { <<
3730 /* XXX track if we ac <<
3731 <<
3732 if (prev_insn && !cfi <<
3733 insn->cfi = p <<
3734 nr_cfi_reused <<
3735 } else { <<
3736 insn->cfi = c <<
3737 } <<
3738 } <<
3739 2387
3740 insn->visited |= visited; 2388 insn->visited |= visited;
3741 2389
3742 if (propagate_alt_cfi(file, i !! 2390 if (!insn->ignore_alts && !list_empty(&insn->alts)) {
3743 return 1; <<
3744 <<
3745 if (!insn->ignore_alts && ins <<
3746 bool skip_orig = fals 2391 bool skip_orig = false;
3747 2392
3748 for (alt = insn->alts !! 2393 list_for_each_entry(alt, &insn->alts, list) {
3749 if (alt->skip 2394 if (alt->skip_orig)
3750 skip_ 2395 skip_orig = true;
3751 2396
3752 ret = validat 2397 ret = validate_branch(file, func, alt->insn, state);
3753 if (ret) { 2398 if (ret) {
3754 BT_IN !! 2399 if (backtrace)
>> 2400 BT_FUNC("(alt)", insn);
3755 retur 2401 return ret;
3756 } 2402 }
3757 } 2403 }
3758 2404
>> 2405 if (insn->alt_group)
>> 2406 fill_alternative_cfi(file, insn);
>> 2407
3759 if (skip_orig) 2408 if (skip_orig)
3760 return 0; 2409 return 0;
3761 } 2410 }
3762 2411
3763 if (handle_insn_ops(insn, nex !! 2412 if (handle_insn_ops(insn, &state))
3764 return 1; 2413 return 1;
3765 2414
3766 switch (insn->type) { 2415 switch (insn->type) {
3767 2416
3768 case INSN_RETURN: 2417 case INSN_RETURN:
3769 return validate_retur 2418 return validate_return(func, insn, &state);
3770 2419
3771 case INSN_CALL: 2420 case INSN_CALL:
3772 case INSN_CALL_DYNAMIC: 2421 case INSN_CALL_DYNAMIC:
3773 ret = validate_call(f !! 2422 ret = validate_call(insn, &state);
3774 if (ret) 2423 if (ret)
3775 return ret; 2424 return ret;
3776 2425
3777 if (opts.stackval && !! 2426 if (!no_fp && func && !is_fentry_call(insn) &&
3778 !has_valid_stack_ 2427 !has_valid_stack_frame(&state)) {
3779 WARN_INSN(ins !! 2428 WARN_FUNC("call without frame pointer save/setup",
>> 2429 sec, insn->offset);
3780 return 1; 2430 return 1;
3781 } 2431 }
3782 2432
3783 if (insn->dead_end) !! 2433 if (dead_end_function(file, insn->call_dest))
3784 return 0; 2434 return 0;
3785 2435
3786 break; 2436 break;
3787 2437
3788 case INSN_JUMP_CONDITIONAL: 2438 case INSN_JUMP_CONDITIONAL:
3789 case INSN_JUMP_UNCONDITIONAL: 2439 case INSN_JUMP_UNCONDITIONAL:
3790 if (is_sibling_call(i !! 2440 if (func && is_sibling_call(insn)) {
3791 ret = validat !! 2441 ret = validate_sibling_call(insn, &state);
3792 if (ret) 2442 if (ret)
3793 retur 2443 return ret;
3794 2444
3795 } else if (insn->jump 2445 } else if (insn->jump_dest) {
3796 ret = validat 2446 ret = validate_branch(file, func,
3797 2447 insn->jump_dest, state);
3798 if (ret) { 2448 if (ret) {
3799 BT_IN !! 2449 if (backtrace)
>> 2450 BT_FUNC("(branch)", insn);
3800 retur 2451 return ret;
3801 } 2452 }
3802 } 2453 }
3803 2454
3804 if (insn->type == INS 2455 if (insn->type == INSN_JUMP_UNCONDITIONAL)
3805 return 0; 2456 return 0;
3806 2457
3807 break; 2458 break;
3808 2459
3809 case INSN_JUMP_DYNAMIC: 2460 case INSN_JUMP_DYNAMIC:
3810 case INSN_JUMP_DYNAMIC_CONDIT 2461 case INSN_JUMP_DYNAMIC_CONDITIONAL:
3811 if (is_sibling_call(i !! 2462 if (func && is_sibling_call(insn)) {
3812 ret = validat !! 2463 ret = validate_sibling_call(insn, &state);
3813 if (ret) 2464 if (ret)
3814 retur 2465 return ret;
3815 } 2466 }
3816 2467
3817 if (insn->type == INS 2468 if (insn->type == INSN_JUMP_DYNAMIC)
3818 return 0; 2469 return 0;
3819 2470
3820 break; 2471 break;
3821 2472
3822 case INSN_CONTEXT_SWITCH: 2473 case INSN_CONTEXT_SWITCH:
3823 if (func && (!next_in 2474 if (func && (!next_insn || !next_insn->hint)) {
3824 WARN_INSN(ins !! 2475 WARN_FUNC("unsupported instruction in callable function",
>> 2476 sec, insn->offset);
3825 return 1; 2477 return 1;
3826 } 2478 }
3827 return 0; 2479 return 0;
3828 2480
3829 case INSN_STAC: 2481 case INSN_STAC:
3830 if (state.uaccess) { 2482 if (state.uaccess) {
3831 WARN_INSN(ins !! 2483 WARN_FUNC("recursive UACCESS enable", sec, insn->offset);
3832 return 1; 2484 return 1;
3833 } 2485 }
3834 2486
3835 state.uaccess = true; 2487 state.uaccess = true;
3836 break; 2488 break;
3837 2489
3838 case INSN_CLAC: 2490 case INSN_CLAC:
3839 if (!state.uaccess && 2491 if (!state.uaccess && func) {
3840 WARN_INSN(ins !! 2492 WARN_FUNC("redundant UACCESS disable", sec, insn->offset);
3841 return 1; 2493 return 1;
3842 } 2494 }
3843 2495
3844 if (func_uaccess_safe 2496 if (func_uaccess_safe(func) && !state.uaccess_stack) {
3845 WARN_INSN(ins !! 2497 WARN_FUNC("UACCESS-safe disables UACCESS", sec, insn->offset);
3846 return 1; 2498 return 1;
3847 } 2499 }
3848 2500
3849 state.uaccess = false 2501 state.uaccess = false;
3850 break; 2502 break;
3851 2503
3852 case INSN_STD: 2504 case INSN_STD:
3853 if (state.df) { !! 2505 if (state.df)
3854 WARN_INSN(ins !! 2506 WARN_FUNC("recursive STD", sec, insn->offset);
3855 return 1; <<
3856 } <<
3857 2507
3858 state.df = true; 2508 state.df = true;
3859 break; 2509 break;
3860 2510
3861 case INSN_CLD: 2511 case INSN_CLD:
3862 if (!state.df && func !! 2512 if (!state.df && func)
3863 WARN_INSN(ins !! 2513 WARN_FUNC("redundant CLD", sec, insn->offset);
3864 return 1; <<
3865 } <<
3866 2514
3867 state.df = false; 2515 state.df = false;
3868 break; 2516 break;
3869 2517
3870 default: 2518 default:
3871 break; 2519 break;
3872 } 2520 }
3873 2521
3874 if (insn->dead_end) 2522 if (insn->dead_end)
3875 return 0; 2523 return 0;
3876 2524
3877 if (!next_insn) { 2525 if (!next_insn) {
3878 if (state.cfi.cfa.bas 2526 if (state.cfi.cfa.base == CFI_UNDEFINED)
3879 return 0; 2527 return 0;
3880 WARN("%s: unexpected 2528 WARN("%s: unexpected end of section", sec->name);
3881 return 1; 2529 return 1;
3882 } 2530 }
3883 2531
3884 prev_insn = insn; <<
3885 insn = next_insn; 2532 insn = next_insn;
3886 } 2533 }
3887 2534
3888 return 0; 2535 return 0;
3889 } 2536 }
3890 2537
3891 static int validate_unwind_hint(struct objtoo <<
3892 struct inst <<
3893 struct insn <<
3894 { <<
3895 if (insn->hint && !insn->visited && ! <<
3896 int ret = validate_branch(fil <<
3897 if (ret) <<
3898 BT_INSN(insn, "<=== ( <<
3899 return ret; <<
3900 } <<
3901 <<
3902 return 0; <<
3903 } <<
3904 <<
3905 static int validate_unwind_hints(struct objto 2538 static int validate_unwind_hints(struct objtool_file *file, struct section *sec)
3906 { 2539 {
3907 struct instruction *insn; 2540 struct instruction *insn;
3908 struct insn_state state; 2541 struct insn_state state;
3909 int warnings = 0; !! 2542 int ret, warnings = 0;
3910 2543
3911 if (!file->hints) 2544 if (!file->hints)
3912 return 0; 2545 return 0;
3913 2546
3914 init_insn_state(file, &state, sec); !! 2547 init_insn_state(&state, sec);
3915 2548
3916 if (sec) { 2549 if (sec) {
3917 sec_for_each_insn(file, sec, !! 2550 insn = find_insn(file, sec, 0);
3918 warnings += validate_ !! 2551 if (!insn)
>> 2552 return 0;
3919 } else { 2553 } else {
3920 for_each_insn(file, insn) !! 2554 insn = list_first_entry(&file->insn_list, typeof(*insn), list);
3921 warnings += validate_ <<
3922 } 2555 }
3923 2556
3924 return warnings; !! 2557 while (&insn->list != &file->insn_list && (!sec || insn->sec == sec)) {
3925 } !! 2558 if (insn->hint && !insn->visited) {
3926 !! 2559 ret = validate_branch(file, insn->func, insn, state);
3927 /* !! 2560 if (ret && backtrace)
3928 * Validate rethunk entry constraint: must un !! 2561 BT_FUNC("<=== (hint)", insn);
3929 * !! 2562 warnings += ret;
3930 * Follow every branch (intra-function) and e <<
3931 * before an actual RET instruction. <<
3932 */ <<
3933 static int validate_unret(struct objtool_file <<
3934 { <<
3935 struct instruction *next, *dest; <<
3936 int ret; <<
3937 <<
3938 for (;;) { <<
3939 next = next_insn_to_validate( <<
3940 <<
3941 if (insn->visited & VISITED_U <<
3942 return 0; <<
3943 <<
3944 insn->visited |= VISITED_UNRE <<
3945 <<
3946 if (!insn->ignore_alts && ins <<
3947 struct alternative *a <<
3948 bool skip_orig = fals <<
3949 <<
3950 for (alt = insn->alts <<
3951 if (alt->skip <<
3952 skip_ <<
3953 <<
3954 ret = validat <<
3955 if (ret) { <<
3956 BT_IN <<
3957 retur <<
3958 } <<
3959 } <<
3960 <<
3961 if (skip_orig) <<
3962 return 0; <<
3963 } <<
3964 <<
3965 switch (insn->type) { <<
3966 <<
3967 case INSN_CALL_DYNAMIC: <<
3968 case INSN_JUMP_DYNAMIC: <<
3969 case INSN_JUMP_DYNAMIC_CONDIT <<
3970 WARN_INSN(insn, "earl <<
3971 return 1; <<
3972 <<
3973 case INSN_JUMP_UNCONDITIONAL: <<
3974 case INSN_JUMP_CONDITIONAL: <<
3975 if (!is_sibling_call( <<
3976 if (!insn->ju <<
3977 WARN_ <<
3978 retur <<
3979 } <<
3980 ret = validat <<
3981 if (ret) { <<
3982 BT_IN <<
3983 <<
3984 retur <<
3985 } <<
3986 <<
3987 if (insn->typ <<
3988 retur <<
3989 <<
3990 break; <<
3991 } <<
3992 <<
3993 /* fallthrough */ <<
3994 case INSN_CALL: <<
3995 dest = find_insn(file <<
3996 insn <<
3997 if (!dest) { <<
3998 WARN("Unresol <<
3999 insn_cal <<
4000 return -1; <<
4001 } <<
4002 <<
4003 ret = validate_unret( <<
4004 if (ret) { <<
4005 BT_INSN(insn, <<
4006 return ret; <<
4007 } <<
4008 /* <<
4009 * If a call returns <<
4010 * Therefore any non- <<
4011 */ <<
4012 return 0; <<
4013 <<
4014 case INSN_RETURN: <<
4015 WARN_INSN(insn, "RET <<
4016 return 1; <<
4017 <<
4018 case INSN_NOP: <<
4019 if (insn->retpoline_s <<
4020 return 0; <<
4021 break; <<
4022 <<
4023 default: <<
4024 break; <<
4025 } <<
4026 <<
4027 if (!next) { <<
4028 WARN_INSN(insn, "teh <<
4029 return -1; <<
4030 } 2563 }
4031 insn = next; <<
4032 } <<
4033 <<
4034 return 0; <<
4035 } <<
4036 <<
4037 /* <<
4038 * Validate that all branches starting at VAL <<
4039 * VALIDATE_UNRET_END before RET. <<
4040 */ <<
4041 static int validate_unrets(struct objtool_fil <<
4042 { <<
4043 struct instruction *insn; <<
4044 int ret, warnings = 0; <<
4045 2564
4046 for_each_insn(file, insn) { !! 2565 insn = list_next_entry(insn, list);
4047 if (!insn->unret) <<
4048 continue; <<
4049 <<
4050 ret = validate_unret(file, in <<
4051 if (ret < 0) { <<
4052 WARN_INSN(insn, "Fail <<
4053 return ret; <<
4054 } <<
4055 warnings += ret; <<
4056 } 2566 }
4057 2567
4058 return warnings; 2568 return warnings;
4059 } 2569 }
4060 2570
4061 static int validate_retpoline(struct objtool_ 2571 static int validate_retpoline(struct objtool_file *file)
4062 { 2572 {
4063 struct instruction *insn; 2573 struct instruction *insn;
4064 int warnings = 0; 2574 int warnings = 0;
4065 2575
4066 for_each_insn(file, insn) { 2576 for_each_insn(file, insn) {
4067 if (insn->type != INSN_JUMP_D 2577 if (insn->type != INSN_JUMP_DYNAMIC &&
4068 insn->type != INSN_CALL_D !! 2578 insn->type != INSN_CALL_DYNAMIC)
4069 insn->type != INSN_RETURN <<
4070 continue; 2579 continue;
4071 2580
4072 if (insn->retpoline_safe) 2581 if (insn->retpoline_safe)
4073 continue; 2582 continue;
4074 2583
4075 if (insn->sec->init) !! 2584 /*
>> 2585 * .init.text code is ran before userspace and thus doesn't
>> 2586 * strictly need retpolines, except for modules which are
>> 2587 * loaded late, they very much do need retpoline in their
>> 2588 * .init.text
>> 2589 */
>> 2590 if (!strcmp(insn->sec->name, ".init.text") && !module)
4076 continue; 2591 continue;
4077 2592
4078 if (insn->type == INSN_RETURN !! 2593 WARN_FUNC("indirect %s found in RETPOLINE build",
4079 if (opts.rethunk) { !! 2594 insn->sec, insn->offset,
4080 WARN_INSN(ins !! 2595 insn->type == INSN_JUMP_DYNAMIC ? "jump" : "call");
4081 } else <<
4082 continue; <<
4083 } else { <<
4084 WARN_INSN(insn, "indi <<
4085 insn->type <<
4086 } <<
4087 2596
4088 warnings++; 2597 warnings++;
4089 } 2598 }
4090 2599
4091 return warnings; 2600 return warnings;
4092 } 2601 }
4093 2602
4094 static bool is_kasan_insn(struct instruction 2603 static bool is_kasan_insn(struct instruction *insn)
4095 { 2604 {
4096 return (insn->type == INSN_CALL && 2605 return (insn->type == INSN_CALL &&
4097 !strcmp(insn_call_dest(insn)- !! 2606 !strcmp(insn->call_dest->name, "__asan_handle_no_return"));
4098 } 2607 }
4099 2608
4100 static bool is_ubsan_insn(struct instruction 2609 static bool is_ubsan_insn(struct instruction *insn)
4101 { 2610 {
4102 return (insn->type == INSN_CALL && 2611 return (insn->type == INSN_CALL &&
4103 !strcmp(insn_call_dest(insn)- !! 2612 !strcmp(insn->call_dest->name,
4104 "__ubsan_handle_built 2613 "__ubsan_handle_builtin_unreachable"));
4105 } 2614 }
4106 2615
4107 static bool ignore_unreachable_insn(struct ob !! 2616 static bool ignore_unreachable_insn(struct instruction *insn)
4108 { 2617 {
4109 int i; 2618 int i;
4110 struct instruction *prev_insn; <<
4111 2619
4112 if (insn->ignore || insn->type == INS !! 2620 if (insn->ignore || insn->type == INSN_NOP)
4113 return true; 2621 return true;
4114 2622
4115 /* 2623 /*
4116 * Ignore alternative replacement ins !! 2624 * Ignore any unused exceptions. This can happen when a whitelisted
>> 2625 * function has an exception table entry.
>> 2626 *
>> 2627 * Also ignore alternative replacement instructions. This can happen
4117 * when a whitelisted function uses o 2628 * when a whitelisted function uses one of the ALTERNATIVE macros.
4118 */ 2629 */
4119 if (!strcmp(insn->sec->name, ".altins !! 2630 if (!strcmp(insn->sec->name, ".fixup") ||
>> 2631 !strcmp(insn->sec->name, ".altinstr_replacement") ||
4120 !strcmp(insn->sec->name, ".altins 2632 !strcmp(insn->sec->name, ".altinstr_aux"))
4121 return true; 2633 return true;
4122 2634
4123 /* !! 2635 if (!insn->func)
4124 * Whole archive runs might encounter <<
4125 * This is where the linker will have <<
4126 * favour of a regular symbol, but le <<
4127 * <<
4128 * In this case we'll find a piece of <<
4129 * covered by a !section symbol. Igno <<
4130 */ <<
4131 if (opts.link && !insn_func(insn)) { <<
4132 int size = find_symbol_hole_c <<
4133 unsigned long end = insn->off <<
4134 <<
4135 if (!size) /* not a hole */ <<
4136 return false; <<
4137 <<
4138 if (size < 0) /* hole until t <<
4139 return true; <<
4140 <<
4141 sec_for_each_insn_continue(fi <<
4142 /* <<
4143 * If we reach a visi <<
4144 * end of the hole, i <<
4145 */ <<
4146 if (insn->visited) <<
4147 return true; <<
4148 <<
4149 if (insn->offset >= e <<
4150 break; <<
4151 <<
4152 /* <<
4153 * If this hole jumps <<
4154 */ <<
4155 if (insn->jump_dest & <<
4156 strstr(insn_func( <<
4157 struct instru <<
4158 func_for_each <<
4159 dest- <<
4160 } <<
4161 } <<
4162 <<
4163 return false; 2636 return false;
4164 } <<
4165 <<
4166 if (!insn_func(insn)) <<
4167 return false; <<
4168 <<
4169 if (insn_func(insn)->static_call_tram <<
4170 return true; <<
4171 2637
4172 /* 2638 /*
4173 * CONFIG_UBSAN_TRAP inserts a UD2 wh 2639 * CONFIG_UBSAN_TRAP inserts a UD2 when it sees
4174 * __builtin_unreachable(). The BUG( 2640 * __builtin_unreachable(). The BUG() macro has an unreachable() after
4175 * the UD2, which causes GCC's undefi 2641 * the UD2, which causes GCC's undefined trap logic to emit another UD2
4176 * (or occasionally a JMP to UD2). 2642 * (or occasionally a JMP to UD2).
4177 * <<
4178 * It may also insert a UD2 after cal <<
4179 */ 2643 */
4180 prev_insn = prev_insn_same_sec(file, !! 2644 if (list_prev_entry(insn, list)->dead_end &&
4181 if (prev_insn->dead_end && <<
4182 (insn->type == INSN_BUG || 2645 (insn->type == INSN_BUG ||
4183 (insn->type == INSN_JUMP_UNCONDI 2646 (insn->type == INSN_JUMP_UNCONDITIONAL &&
4184 insn->jump_dest && insn->jump_d 2647 insn->jump_dest && insn->jump_dest->type == INSN_BUG)))
4185 return true; 2648 return true;
4186 2649
4187 /* 2650 /*
4188 * Check if this (or a subsequent) in 2651 * Check if this (or a subsequent) instruction is related to
4189 * CONFIG_UBSAN or CONFIG_KASAN. 2652 * CONFIG_UBSAN or CONFIG_KASAN.
4190 * 2653 *
4191 * End the search at 5 instructions t 2654 * End the search at 5 instructions to avoid going into the weeds.
4192 */ 2655 */
4193 for (i = 0; i < 5; i++) { 2656 for (i = 0; i < 5; i++) {
4194 2657
4195 if (is_kasan_insn(insn) || is 2658 if (is_kasan_insn(insn) || is_ubsan_insn(insn))
4196 return true; 2659 return true;
4197 2660
4198 if (insn->type == INSN_JUMP_U 2661 if (insn->type == INSN_JUMP_UNCONDITIONAL) {
4199 if (insn->jump_dest & 2662 if (insn->jump_dest &&
4200 insn_func(insn->j !! 2663 insn->jump_dest->func == insn->func) {
4201 insn = insn-> 2664 insn = insn->jump_dest;
4202 continue; 2665 continue;
4203 } 2666 }
4204 2667
4205 break; 2668 break;
4206 } 2669 }
4207 2670
4208 if (insn->offset + insn->len !! 2671 if (insn->offset + insn->len >= insn->func->offset + insn->func->len)
4209 break; 2672 break;
4210 2673
4211 insn = next_insn_same_sec(fil !! 2674 insn = list_next_entry(insn, list);
4212 } 2675 }
4213 2676
4214 return false; 2677 return false;
4215 } 2678 }
4216 2679
4217 static int add_prefix_symbol(struct objtool_f <<
4218 { <<
4219 struct instruction *insn, *prev; <<
4220 struct cfi_state *cfi; <<
4221 <<
4222 insn = find_insn(file, func->sec, fun <<
4223 if (!insn) <<
4224 return -1; <<
4225 <<
4226 for (prev = prev_insn_same_sec(file, <<
4227 prev; <<
4228 prev = prev_insn_same_sec(file, <<
4229 u64 offset; <<
4230 <<
4231 if (prev->type != INSN_NOP) <<
4232 return -1; <<
4233 <<
4234 offset = func->offset - prev- <<
4235 <<
4236 if (offset > opts.prefix) <<
4237 return -1; <<
4238 <<
4239 if (offset < opts.prefix) <<
4240 continue; <<
4241 <<
4242 elf_create_prefix_symbol(file <<
4243 break; <<
4244 } <<
4245 <<
4246 if (!prev) <<
4247 return -1; <<
4248 <<
4249 if (!insn->cfi) { <<
4250 /* <<
4251 * This can happen if stack v <<
4252 * function is annotated with <<
4253 */ <<
4254 return 0; <<
4255 } <<
4256 <<
4257 /* Propagate insn->cfi to the prefix <<
4258 cfi = cfi_hash_find_or_add(insn->cfi) <<
4259 for (; prev != insn; prev = next_insn <<
4260 prev->cfi = cfi; <<
4261 <<
4262 return 0; <<
4263 } <<
4264 <<
4265 static int add_prefix_symbols(struct objtool_ <<
4266 { <<
4267 struct section *sec; <<
4268 struct symbol *func; <<
4269 <<
4270 for_each_sec(file, sec) { <<
4271 if (!(sec->sh.sh_flags & SHF_ <<
4272 continue; <<
4273 <<
4274 sec_for_each_sym(sec, func) { <<
4275 if (func->type != STT <<
4276 continue; <<
4277 <<
4278 add_prefix_symbol(fil <<
4279 } <<
4280 } <<
4281 <<
4282 return 0; <<
4283 } <<
4284 <<
4285 static int validate_symbol(struct objtool_fil 2680 static int validate_symbol(struct objtool_file *file, struct section *sec,
4286 struct symbol *sym 2681 struct symbol *sym, struct insn_state *state)
4287 { 2682 {
4288 struct instruction *insn; 2683 struct instruction *insn;
4289 int ret; 2684 int ret;
4290 2685
4291 if (!sym->len) { 2686 if (!sym->len) {
4292 WARN("%s() is missing an ELF 2687 WARN("%s() is missing an ELF size annotation", sym->name);
4293 return 1; 2688 return 1;
4294 } 2689 }
4295 2690
4296 if (sym->pfunc != sym || sym->alias ! 2691 if (sym->pfunc != sym || sym->alias != sym)
4297 return 0; 2692 return 0;
4298 2693
4299 insn = find_insn(file, sec, sym->offs 2694 insn = find_insn(file, sec, sym->offset);
4300 if (!insn || insn->ignore || insn->vi 2695 if (!insn || insn->ignore || insn->visited)
4301 return 0; 2696 return 0;
4302 2697
4303 state->uaccess = sym->uaccess_safe; 2698 state->uaccess = sym->uaccess_safe;
4304 2699
4305 ret = validate_branch(file, insn_func !! 2700 ret = validate_branch(file, insn->func, insn, *state);
4306 if (ret) !! 2701 if (ret && backtrace)
4307 BT_INSN(insn, "<=== (sym)"); !! 2702 BT_FUNC("<=== (sym)", insn);
4308 return ret; 2703 return ret;
4309 } 2704 }
4310 2705
4311 static int validate_section(struct objtool_fi 2706 static int validate_section(struct objtool_file *file, struct section *sec)
4312 { 2707 {
4313 struct insn_state state; 2708 struct insn_state state;
4314 struct symbol *func; 2709 struct symbol *func;
4315 int warnings = 0; 2710 int warnings = 0;
4316 2711
4317 sec_for_each_sym(sec, func) { !! 2712 list_for_each_entry(func, &sec->symbol_list, list) {
4318 if (func->type != STT_FUNC) 2713 if (func->type != STT_FUNC)
4319 continue; 2714 continue;
4320 2715
4321 init_insn_state(file, &state, !! 2716 init_insn_state(&state, sec);
4322 set_func_state(&state.cfi); !! 2717 state.cfi.cfa = initial_func_cfi.cfa;
>> 2718 memcpy(&state.cfi.regs, &initial_func_cfi.regs,
>> 2719 CFI_NUM_REGS * sizeof(struct cfi_reg));
>> 2720 state.cfi.stack_size = initial_func_cfi.cfa.offset;
4323 2721
4324 warnings += validate_symbol(f 2722 warnings += validate_symbol(file, sec, func, &state);
4325 } 2723 }
4326 2724
4327 return warnings; 2725 return warnings;
4328 } 2726 }
4329 2727
4330 static int validate_noinstr_sections(struct o !! 2728 static int validate_vmlinux_functions(struct objtool_file *file)
4331 { 2729 {
4332 struct section *sec; 2730 struct section *sec;
4333 int warnings = 0; 2731 int warnings = 0;
4334 2732
4335 sec = find_section_by_name(file->elf, 2733 sec = find_section_by_name(file->elf, ".noinstr.text");
4336 if (sec) { 2734 if (sec) {
4337 warnings += validate_section( 2735 warnings += validate_section(file, sec);
4338 warnings += validate_unwind_h 2736 warnings += validate_unwind_hints(file, sec);
4339 } 2737 }
4340 2738
4341 sec = find_section_by_name(file->elf, 2739 sec = find_section_by_name(file->elf, ".entry.text");
4342 if (sec) { 2740 if (sec) {
4343 warnings += validate_section( 2741 warnings += validate_section(file, sec);
4344 warnings += validate_unwind_h 2742 warnings += validate_unwind_hints(file, sec);
4345 } 2743 }
4346 2744
4347 sec = find_section_by_name(file->elf, <<
4348 if (sec) { <<
4349 warnings += validate_section( <<
4350 warnings += validate_unwind_h <<
4351 } <<
4352 <<
4353 return warnings; 2745 return warnings;
4354 } 2746 }
4355 2747
4356 static int validate_functions(struct objtool_ 2748 static int validate_functions(struct objtool_file *file)
4357 { 2749 {
4358 struct section *sec; 2750 struct section *sec;
4359 int warnings = 0; 2751 int warnings = 0;
4360 2752
4361 for_each_sec(file, sec) { 2753 for_each_sec(file, sec) {
4362 if (!(sec->sh.sh_flags & SHF_ 2754 if (!(sec->sh.sh_flags & SHF_EXECINSTR))
4363 continue; 2755 continue;
4364 2756
4365 warnings += validate_section( 2757 warnings += validate_section(file, sec);
4366 } 2758 }
4367 2759
4368 return warnings; 2760 return warnings;
4369 } 2761 }
4370 2762
4371 static void mark_endbr_used(struct instructio <<
4372 { <<
4373 if (!list_empty(&insn->call_node)) <<
4374 list_del_init(&insn->call_nod <<
4375 } <<
4376 <<
4377 static bool noendbr_range(struct objtool_file <<
4378 { <<
4379 struct symbol *sym = find_symbol_cont <<
4380 struct instruction *first; <<
4381 <<
4382 if (!sym) <<
4383 return false; <<
4384 <<
4385 first = find_insn(file, sym->sec, sym <<
4386 if (!first) <<
4387 return false; <<
4388 <<
4389 if (first->type != INSN_ENDBR && !fir <<
4390 return false; <<
4391 <<
4392 return insn->offset == sym->offset + <<
4393 } <<
4394 <<
4395 static int validate_ibt_insn(struct objtool_f <<
4396 { <<
4397 struct instruction *dest; <<
4398 struct reloc *reloc; <<
4399 unsigned long off; <<
4400 int warnings = 0; <<
4401 <<
4402 /* <<
4403 * Looking for function pointer load <<
4404 * direct/indirect branches: <<
4405 */ <<
4406 switch (insn->type) { <<
4407 case INSN_CALL: <<
4408 case INSN_CALL_DYNAMIC: <<
4409 case INSN_JUMP_CONDITIONAL: <<
4410 case INSN_JUMP_UNCONDITIONAL: <<
4411 case INSN_JUMP_DYNAMIC: <<
4412 case INSN_JUMP_DYNAMIC_CONDITIONAL: <<
4413 case INSN_RETURN: <<
4414 case INSN_NOP: <<
4415 return 0; <<
4416 default: <<
4417 break; <<
4418 } <<
4419 <<
4420 for (reloc = insn_reloc(file, insn); <<
4421 reloc; <<
4422 reloc = find_reloc_by_dest_range <<
4423 <<
4424 <<
4425 <<
4426 /* <<
4427 * static_call_update() refer <<
4428 * doesn't have (or need) END <<
4429 */ <<
4430 if (reloc->sym->static_call_t <<
4431 continue; <<
4432 <<
4433 off = reloc->sym->offset; <<
4434 if (reloc_type(reloc) == R_X8 <<
4435 reloc_type(reloc) == R_X8 <<
4436 off += arch_dest_relo <<
4437 else <<
4438 off += reloc_addend(r <<
4439 <<
4440 dest = find_insn(file, reloc- <<
4441 if (!dest) <<
4442 continue; <<
4443 <<
4444 if (dest->type == INSN_ENDBR) <<
4445 mark_endbr_used(dest) <<
4446 continue; <<
4447 } <<
4448 <<
4449 if (insn_func(dest) && insn_f <<
4450 insn_func(dest)->pfunc == <<
4451 /* <<
4452 * Anything from->to <<
4453 * IRET-to-self. <<
4454 * <<
4455 * There is no sane w <<
4456 * compiler treats th <<
4457 * happy to fold in o <<
4458 * do, leading to vas <<
4459 * <<
4460 * There's also compi <<
4461 * KCOV and such whic <<
4462 * <<
4463 * As such, blanket a <<
4464 * issue. <<
4465 */ <<
4466 continue; <<
4467 } <<
4468 <<
4469 /* <<
4470 * Accept anything ANNOTATE_N <<
4471 */ <<
4472 if (dest->noendbr) <<
4473 continue; <<
4474 <<
4475 /* <<
4476 * Accept if this is the inst <<
4477 * that is (no)endbr -- typic <<
4478 */ <<
4479 if (noendbr_range(file, dest) <<
4480 continue; <<
4481 <<
4482 WARN_INSN(insn, "relocation t <<
4483 <<
4484 warnings++; <<
4485 } <<
4486 <<
4487 return warnings; <<
4488 } <<
4489 <<
4490 static int validate_ibt_data_reloc(struct obj <<
4491 struct rel <<
4492 { <<
4493 struct instruction *dest; <<
4494 <<
4495 dest = find_insn(file, reloc->sym->se <<
4496 reloc->sym->offset + <<
4497 if (!dest) <<
4498 return 0; <<
4499 <<
4500 if (dest->type == INSN_ENDBR) { <<
4501 mark_endbr_used(dest); <<
4502 return 0; <<
4503 } <<
4504 <<
4505 if (dest->noendbr) <<
4506 return 0; <<
4507 <<
4508 WARN_FUNC("data relocation to !ENDBR: <<
4509 reloc->sec->base, reloc_off <<
4510 offstr(dest->sec, dest->off <<
4511 <<
4512 return 1; <<
4513 } <<
4514 <<
4515 /* <<
4516 * Validate IBT rules and remove used ENDBR i <<
4517 * Unused ENDBR instructions will be annotate <<
4518 * NOPs) later, in create_ibt_endbr_seal_sect <<
4519 */ <<
4520 static int validate_ibt(struct objtool_file * <<
4521 { <<
4522 struct section *sec; <<
4523 struct reloc *reloc; <<
4524 struct instruction *insn; <<
4525 int warnings = 0; <<
4526 <<
4527 for_each_insn(file, insn) <<
4528 warnings += validate_ibt_insn <<
4529 <<
4530 for_each_sec(file, sec) { <<
4531 <<
4532 /* Already done by validate_i <<
4533 if (sec->sh.sh_flags & SHF_EX <<
4534 continue; <<
4535 <<
4536 if (!sec->rsec) <<
4537 continue; <<
4538 <<
4539 /* <<
4540 * These sections can referen <<
4541 * the intent to indirect bra <<
4542 */ <<
4543 if ((!strncmp(sec->name, ".di <<
4544 strcmp(sec->name, ".disc <<
4545 !strncmp(sec->name, ".deb <<
4546 !strcmp(sec->name, ".alti <<
4547 !strcmp(sec->name, ".ibt_ <<
4548 !strcmp(sec->name, ".orc_ <<
4549 !strcmp(sec->name, ".para <<
4550 !strcmp(sec->name, ".retp <<
4551 !strcmp(sec->name, ".smp_ <<
4552 !strcmp(sec->name, ".stat <<
4553 !strcmp(sec->name, "_erro <<
4554 !strcmp(sec->name, "_kpro <<
4555 !strcmp(sec->name, "__bug <<
4556 !strcmp(sec->name, "__ex_ <<
4557 !strcmp(sec->name, "__jum <<
4558 !strcmp(sec->name, "__mco <<
4559 !strcmp(sec->name, ".kcfi <<
4560 strstr(sec->name, "__patc <<
4561 continue; <<
4562 <<
4563 for_each_reloc(sec->rsec, rel <<
4564 warnings += validate_ <<
4565 } <<
4566 <<
4567 return warnings; <<
4568 } <<
4569 <<
4570 static int validate_sls(struct objtool_file * <<
4571 { <<
4572 struct instruction *insn, *next_insn; <<
4573 int warnings = 0; <<
4574 <<
4575 for_each_insn(file, insn) { <<
4576 next_insn = next_insn_same_se <<
4577 <<
4578 if (insn->retpoline_safe) <<
4579 continue; <<
4580 <<
4581 switch (insn->type) { <<
4582 case INSN_RETURN: <<
4583 if (!next_insn || nex <<
4584 WARN_INSN(ins <<
4585 warnings++; <<
4586 } <<
4587 <<
4588 break; <<
4589 case INSN_JUMP_DYNAMIC: <<
4590 if (!next_insn || nex <<
4591 WARN_INSN(ins <<
4592 warnings++; <<
4593 } <<
4594 break; <<
4595 default: <<
4596 break; <<
4597 } <<
4598 } <<
4599 <<
4600 return warnings; <<
4601 } <<
4602 <<
4603 static bool ignore_noreturn_call(struct instr <<
4604 { <<
4605 struct symbol *call_dest = insn_call_ <<
4606 <<
4607 /* <<
4608 * FIXME: hack, we need a real noretu <<
4609 * <<
4610 * Problem is, exc_double_fault() may <<
4611 * whether CONFIG_X86_ESPFIX64 is set <<
4612 * to the kernel config. <<
4613 * <<
4614 * Other potential ways to fix it: <<
4615 * <<
4616 * - have compiler communicate __no <<
4617 * - remove CONFIG_X86_ESPFIX64 <<
4618 * - read the .config file <<
4619 * - add a cmdline option <<
4620 * - create a generic objtool annot <<
4621 * formats) and annotate it <<
4622 */ <<
4623 if (!strcmp(call_dest->name, "exc_dou <<
4624 /* prevent further unreachabl <<
4625 insn->sym->warned = 1; <<
4626 return true; <<
4627 } <<
4628 <<
4629 return false; <<
4630 } <<
4631 <<
4632 static int validate_reachable_instructions(st 2763 static int validate_reachable_instructions(struct objtool_file *file)
4633 { 2764 {
4634 struct instruction *insn, *prev_insn; !! 2765 struct instruction *insn;
4635 struct symbol *call_dest; <<
4636 int warnings = 0; <<
4637 2766
4638 if (file->ignore_unreachables) 2767 if (file->ignore_unreachables)
4639 return 0; 2768 return 0;
4640 2769
4641 for_each_insn(file, insn) { 2770 for_each_insn(file, insn) {
4642 if (insn->visited || ignore_u !! 2771 if (insn->visited || ignore_unreachable_insn(insn))
4643 continue; 2772 continue;
4644 2773
4645 prev_insn = prev_insn_same_se !! 2774 WARN_FUNC("unreachable instruction", insn->sec, insn->offset);
4646 if (prev_insn && prev_insn->d !! 2775 return 1;
4647 call_dest = insn_call <<
4648 if (call_dest && !ign <<
4649 WARN_INSN(ins <<
4650 cal <<
4651 warnings++; <<
4652 continue; <<
4653 } <<
4654 } <<
4655 <<
4656 WARN_INSN(insn, "unreachable <<
4657 warnings++; <<
4658 } <<
4659 <<
4660 return warnings; <<
4661 } <<
4662 <<
4663 /* 'funcs' is a space-separated list of funct <<
4664 static int disas_funcs(const char *funcs) <<
4665 { <<
4666 const char *objdump_str, *cross_compi <<
4667 int size, ret; <<
4668 char *cmd; <<
4669 <<
4670 cross_compile = getenv("CROSS_COMPILE <<
4671 <<
4672 objdump_str = "%sobjdump -wdr %s | ga <<
4673 "BEGIN { split(_funcs <<
4674 "/^$/ { func_match = <<
4675 "/<.*>:/ { " <<
4676 "f = gensub(/ <<
4677 "for (i in fu <<
4678 "if ( <<
4679 <<
4680 <<
4681 <<
4682 "}" <<
4683 "}" <<
4684 "}" <<
4685 "{" <<
4686 "if (func_mat <<
4687 "addr <<
4688 "prin <<
4689 "prin <<
4690 "}" <<
4691 "}' 1>&2"; <<
4692 <<
4693 /* fake snprintf() to calculate the s <<
4694 size = snprintf(NULL, 0, objdump_str, <<
4695 if (size <= 0) { <<
4696 WARN("objdump string size cal <<
4697 return -1; <<
4698 } <<
4699 <<
4700 cmd = malloc(size); <<
4701 <<
4702 /* real snprintf() */ <<
4703 snprintf(cmd, size, objdump_str, cros <<
4704 ret = system(cmd); <<
4705 if (ret) { <<
4706 WARN("disassembly failed: %d" <<
4707 return -1; <<
4708 } <<
4709 <<
4710 return 0; <<
4711 } <<
4712 <<
4713 static int disas_warned_funcs(struct objtool_ <<
4714 { <<
4715 struct symbol *sym; <<
4716 char *funcs = NULL, *tmp; <<
4717 <<
4718 for_each_sym(file, sym) { <<
4719 if (sym->warned) { <<
4720 if (!funcs) { <<
4721 funcs = mallo <<
4722 strcpy(funcs, <<
4723 } else { <<
4724 tmp = malloc( <<
4725 sprintf(tmp, <<
4726 free(funcs); <<
4727 funcs = tmp; <<
4728 } <<
4729 } <<
4730 } 2776 }
4731 2777
4732 if (funcs) <<
4733 disas_funcs(funcs); <<
4734 <<
4735 return 0; 2778 return 0;
4736 } 2779 }
4737 2780
4738 struct insn_chunk { !! 2781 static struct objtool_file file;
4739 void *addr; <<
4740 struct insn_chunk *next; <<
4741 }; <<
4742 2782
4743 /* !! 2783 int check(const char *_objname, bool orc)
4744 * Reduce peak RSS usage by freeing insns mem <<
4745 * which can trigger more allocations for .de <<
4746 * been read yet. <<
4747 */ <<
4748 static void free_insns(struct objtool_file *f <<
4749 { 2784 {
4750 struct instruction *insn; !! 2785 int ret, warnings = 0;
4751 struct insn_chunk *chunks = NULL, *ch <<
4752 2786
4753 for_each_insn(file, insn) { !! 2787 objname = _objname;
4754 if (!insn->idx) { <<
4755 chunk = malloc(sizeof <<
4756 chunk->addr = insn; <<
4757 chunk->next = chunks; <<
4758 chunks = chunk; <<
4759 } <<
4760 } <<
4761 2788
4762 for (chunk = chunks; chunk; chunk = c !! 2789 file.elf = elf_open_read(objname, O_RDWR);
4763 free(chunk->addr); !! 2790 if (!file.elf)
4764 } !! 2791 return 1;
4765 2792
4766 int check(struct objtool_file *file) !! 2793 INIT_LIST_HEAD(&file.insn_list);
4767 { !! 2794 hash_init(file.insn_hash);
4768 int ret, warnings = 0; !! 2795 file.c_file = !vmlinux && find_section_by_name(file.elf, ".comment");
>> 2796 file.ignore_unreachables = no_unreachable;
>> 2797 file.hints = false;
4769 2798
4770 arch_initial_func_cfi_state(&initial_ 2799 arch_initial_func_cfi_state(&initial_func_cfi);
4771 init_cfi_state(&init_cfi); <<
4772 init_cfi_state(&func_cfi); <<
4773 set_func_state(&func_cfi); <<
4774 init_cfi_state(&force_undefined_cfi); <<
4775 force_undefined_cfi.force_undefined = <<
4776 <<
4777 if (!cfi_hash_alloc(1UL << (file->elf <<
4778 goto out; <<
4779 <<
4780 cfi_hash_add(&init_cfi); <<
4781 cfi_hash_add(&func_cfi); <<
4782 2800
4783 ret = decode_sections(file); !! 2801 ret = decode_sections(&file);
4784 if (ret < 0) 2802 if (ret < 0)
4785 goto out; 2803 goto out;
4786 <<
4787 warnings += ret; 2804 warnings += ret;
4788 2805
4789 if (!nr_insns) !! 2806 if (list_empty(&file.insn_list))
4790 goto out; 2807 goto out;
4791 2808
4792 if (opts.retpoline) { !! 2809 if (vmlinux && !validate_dup) {
4793 ret = validate_retpoline(file !! 2810 ret = validate_vmlinux_functions(&file);
4794 if (ret < 0) <<
4795 return ret; <<
4796 warnings += ret; <<
4797 } <<
4798 <<
4799 if (opts.stackval || opts.orc || opts <<
4800 ret = validate_functions(file <<
4801 if (ret < 0) 2811 if (ret < 0)
4802 goto out; 2812 goto out;
4803 warnings += ret; <<
4804 2813
4805 ret = validate_unwind_hints(f <<
4806 if (ret < 0) <<
4807 goto out; <<
4808 warnings += ret; <<
4809 <<
4810 if (!warnings) { <<
4811 ret = validate_reacha <<
4812 if (ret < 0) <<
4813 goto out; <<
4814 warnings += ret; <<
4815 } <<
4816 <<
4817 } else if (opts.noinstr) { <<
4818 ret = validate_noinstr_sectio <<
4819 if (ret < 0) <<
4820 goto out; <<
4821 warnings += ret; 2814 warnings += ret;
>> 2815 goto out;
4822 } 2816 }
4823 2817
4824 if (opts.unret) { !! 2818 if (retpoline) {
4825 /* !! 2819 ret = validate_retpoline(&file);
4826 * Must be after validate_bra <<
4827 * further games with insn->v <<
4828 */ <<
4829 ret = validate_unrets(file); <<
4830 if (ret < 0) 2820 if (ret < 0)
4831 return ret; 2821 return ret;
4832 warnings += ret; 2822 warnings += ret;
4833 } 2823 }
4834 2824
4835 if (opts.ibt) { !! 2825 ret = validate_functions(&file);
4836 ret = validate_ibt(file); !! 2826 if (ret < 0)
4837 if (ret < 0) !! 2827 goto out;
4838 goto out; !! 2828 warnings += ret;
4839 warnings += ret; <<
4840 } <<
4841 <<
4842 if (opts.sls) { <<
4843 ret = validate_sls(file); <<
4844 if (ret < 0) <<
4845 goto out; <<
4846 warnings += ret; <<
4847 } <<
4848 <<
4849 if (opts.static_call) { <<
4850 ret = create_static_call_sect <<
4851 if (ret < 0) <<
4852 goto out; <<
4853 warnings += ret; <<
4854 } <<
4855 2829
4856 if (opts.retpoline) { !! 2830 ret = validate_unwind_hints(&file, NULL);
4857 ret = create_retpoline_sites_ !! 2831 if (ret < 0)
4858 if (ret < 0) !! 2832 goto out;
4859 goto out; !! 2833 warnings += ret;
4860 warnings += ret; <<
4861 } <<
4862 2834
4863 if (opts.cfi) { !! 2835 if (!warnings) {
4864 ret = create_cfi_sections(fil !! 2836 ret = validate_reachable_instructions(&file);
4865 if (ret < 0) 2837 if (ret < 0)
4866 goto out; 2838 goto out;
4867 warnings += ret; 2839 warnings += ret;
4868 } 2840 }
4869 2841
4870 if (opts.rethunk) { !! 2842 if (orc) {
4871 ret = create_return_sites_sec !! 2843 ret = create_orc(&file);
4872 if (ret < 0) 2844 if (ret < 0)
4873 goto out; 2845 goto out;
4874 warnings += ret; <<
4875 <<
4876 if (opts.hack_skylake) { <<
4877 ret = create_direct_c <<
4878 if (ret < 0) <<
4879 goto out; <<
4880 warnings += ret; <<
4881 } <<
4882 } <<
4883 2846
4884 if (opts.mcount) { !! 2847 ret = create_orc_sections(&file);
4885 ret = create_mcount_loc_secti <<
4886 if (ret < 0) 2848 if (ret < 0)
4887 goto out; 2849 goto out;
4888 warnings += ret; <<
4889 } 2850 }
4890 2851
4891 if (opts.prefix) { !! 2852 if (file.elf->changed) {
4892 ret = add_prefix_symbols(file !! 2853 ret = elf_write(file.elf);
4893 if (ret < 0) <<
4894 return ret; <<
4895 warnings += ret; <<
4896 } <<
4897 <<
4898 if (opts.ibt) { <<
4899 ret = create_ibt_endbr_seal_s <<
4900 if (ret < 0) <<
4901 goto out; <<
4902 warnings += ret; <<
4903 } <<
4904 <<
4905 if (opts.orc && nr_insns) { <<
4906 ret = orc_create(file); <<
4907 if (ret < 0) 2854 if (ret < 0)
4908 goto out; 2855 goto out;
4909 warnings += ret; <<
4910 } 2856 }
4911 2857
4912 free_insns(file); !! 2858 out:
4913 !! 2859 if (ret < 0) {
4914 if (opts.verbose) !! 2860 /*
4915 disas_warned_funcs(file); !! 2861 * Fatal error. The binary is corrupt or otherwise broken in
4916 !! 2862 * some way, or objtool itself is broken. Fail the kernel
4917 if (opts.stats) { !! 2863 * build.
4918 printf("nr_insns_visited: %ld !! 2864 */
4919 printf("nr_cfi: %ld\n", nr_cf !! 2865 return ret;
4920 printf("nr_cfi_reused: %ld\n" <<
4921 printf("nr_cfi_cache: %ld\n", <<
4922 } 2866 }
4923 2867
4924 out: <<
4925 /* <<
4926 * For now, don't fail the kernel bu <<
4927 * errors are still fairly common du <<
4928 * supported toolchains and their re <<
4929 */ <<
4930 return 0; 2868 return 0;
4931 } 2869 }
4932 2870
Linux® is a registered trademark of Linus Torvalds in the United States and other countries.
TOMOYO® is a registered trademark of NTT DATA CORPORATION.