tools/objtool/check.c

   1 /*
   2  * Copyright (C) 2015-2017 Josh Poimboeuf <jpoimboe@redhat.com>
   3  *
   4  * This program is free software; you can redistribute it and/or
   5  * modify it under the terms of the GNU General Public License
   6  * as published by the Free Software Foundation; either version 2
   7  * of the License, or (at your option) any later version.
   8  *
   9  * This program is distributed in the hope that it will be useful,
  10  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  11  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  12  * GNU General Public License for more details.
  13  *
  14  * You should have received a copy of the GNU General Public License
  15  * along with this program; if not, see <http://www.gnu.org/licenses/>.
  16  */
  17
  18 #include <string.h>
  19 #include <stdlib.h>
  20
  21 #include "builtin.h"
  22 #include "check.h"
  23 #include "elf.h"
  24 #include "special.h"
  25 #include "arch.h"
  26 #include "warn.h"
  27
  28 #include <linux/hashtable.h>
  29 #include <linux/kernel.h>
  30
  31 struct alternative {
  32         struct list_head list;
  33         struct instruction *insn;
  34 };
  35
  36 const char *objname;
  37 struct cfi_state initial_func_cfi;
  38
  39 struct instruction *find_insn(struct objtool_file *file,
  40                               struct section *sec, unsigned long offset)
  41 {
  42         struct instruction *insn;
  43
  44         hash_for_each_possible(file->insn_hash, insn, hash, offset)
  45                 if (insn->sec == sec && insn->offset == offset)
  46                         return insn;
  47
  48         return NULL;
  49 }
  50
  51 static struct instruction *next_insn_same_sec(struct objtool_file *file,
  52                                               struct instruction *insn)
  53 {
  54         struct instruction *next = list_next_entry(insn, list);
  55
  56         if (!next || &next->list == &file->insn_list || next->sec != insn->sec)
  57                 return NULL;
  58
  59         return next;
  60 }
  61
  62 static struct instruction *next_insn_same_func(struct objtool_file *file,
  63                                                struct instruction *insn)
  64 {
  65         struct instruction *next = list_next_entry(insn, list);
  66         struct symbol *func = insn->func;
  67
  68         if (!func)
  69                 return NULL;
  70
  71         if (&next->list != &file->insn_list && next->func == func)
  72                 return next;
  73
  74         /* Check if we're already in the subfunction: */
  75         if (func == func->cfunc)
  76                 return NULL;
  77
  78         /* Move to the subfunction: */
  79         return find_insn(file, func->cfunc->sec, func->cfunc->offset);
  80 }
  81
  82 #define func_for_each_insn_all(file, func, insn)                        \
  83         for (insn = find_insn(file, func->sec, func->offset);           \
  84              insn;                                                      \
  85              insn = next_insn_same_func(file, insn))
  86
  87 #define func_for_each_insn(file, func, insn)                            \
  88         for (insn = find_insn(file, func->sec, func->offset);           \
  89              insn && &insn->list != &file->insn_list &&                 \
  90                 insn->sec == func->sec &&                               \
  91                 insn->offset < func->offset + func->len;                \
  92              insn = list_next_entry(insn, list))
  93
  94 #define func_for_each_insn_continue_reverse(file, func, insn)           \
  95         for (insn = list_prev_entry(insn, list);                        \
  96              &insn->list != &file->insn_list &&                         \
  97                 insn->sec == func->sec && insn->offset >= func->offset; \
  98              insn = list_prev_entry(insn, list))
  99
 100 #define sec_for_each_insn_from(file, insn)                              \
 101         for (; insn; insn = next_insn_same_sec(file, insn))
 102
 103 #define sec_for_each_insn_continue(file, insn)                          \
 104         for (insn = next_insn_same_sec(file, insn); insn;               \
 105              insn = next_insn_same_sec(file, insn))
 106
 107 /*
 108  * This checks to see if the given function is a "noreturn" function.
 109  *
 110  * For global functions which are outside the scope of this object file, we
 111  * have to keep a manual list of them.
 112  *
 113  * For local functions, we have to detect them manually by simply looking for
 114  * the lack of a return instruction.
 115  *
 116  * Returns:
 117  *  -1: error
 118  *   0: no dead end
 119  *   1: dead end
 120  */
 121 static int __dead_end_function(struct objtool_file *file, struct symbol *func,
 122                                int recursion)
 123 {
 124         int i;
 125         struct instruction *insn;
 126         bool empty = true;
 127
 128         /*
 129          * Unfortunately these have to be hard coded because the noreturn
 130          * attribute isn't provided in ELF data.
 131          */
 132         static const char * const global_noreturns[] = {
 133                 "__stack_chk_fail",
 134                 "panic",
 135                 "do_exit",
 136                 "do_task_dead",
 137                 "__module_put_and_exit",
 138                 "complete_and_exit",
 139                 "kvm_spurious_fault",
 140                 "__reiserfs_panic",
 141                 "lbug_with_loc",
 142                 "fortify_panic",
 143                 "usercopy_abort",
 144                 "machine_real_restart",
 145         };
 146
 147         if (func->bind == STB_WEAK)
 148                 return 0;
 149
 150         if (func->bind == STB_GLOBAL)
 151                 for (i = 0; i < ARRAY_SIZE(global_noreturns); i++)
 152                         if (!strcmp(func->name, global_noreturns[i]))
 153                                 return 1;
 154
 155         if (!func->len)
 156                 return 0;
 157
 158         insn = find_insn(file, func->sec, func->offset);
 159         if (!insn->func)
 160                 return 0;
 161
 162         func_for_each_insn_all(file, func, insn) {
 163                 empty = false;
 164
 165                 if (insn->type == INSN_RETURN)
 166                         return 0;
 167         }
 168
 169         if (empty)
 170                 return 0;
 171
 172         /*
 173          * A function can have a sibling call instead of a return.  In that
 174          * case, the function's dead-end status depends on whether the target
 175          * of the sibling call returns.
 176          */
 177         func_for_each_insn_all(file, func, insn) {
 178                 if (insn->type == INSN_JUMP_UNCONDITIONAL) {
 179                         struct instruction *dest = insn->jump_dest;
 180
 181                         if (!dest)
 182                                 /* sibling call to another file */
 183                                 return 0;
 184
 185                         if (dest->func && dest->func->pfunc != insn->func->pfunc) {
 186
 187                                 /* local sibling call */
 188                                 if (recursion == 5) {
 189                                         /*
 190                                          * Infinite recursion: two functions
 191                                          * have sibling calls to each other.
 192                                          * This is a very rare case.  It means
 193                                          * they aren't dead ends.
 194                                          */
 195                                         return 0;
 196                                 }
 197
 198                                 return __dead_end_function(file, dest->func,
 199                                                            recursion + 1);
 200                         }
 201                 }
 202
 203                 if (insn->type == INSN_JUMP_DYNAMIC && list_empty(&insn->alts))
 204                         /* sibling call */
 205                         return 0;
 206         }
 207
 208         return 1;
 209 }
 210
 211 static int dead_end_function(struct objtool_file *file, struct symbol *func)
 212 {
 213         return __dead_end_function(file, func, 0);
 214 }
 215
 216 static void clear_insn_state(struct insn_state *state)
 217 {
 218         int i;
 219
 220         memset(state, 0, sizeof(*state));
 221         state->cfa.base = CFI_UNDEFINED;
 222         for (i = 0; i < CFI_NUM_REGS; i++) {
 223                 state->regs[i].base = CFI_UNDEFINED;
 224                 state->vals[i].base = CFI_UNDEFINED;
 225         }
 226         state->drap_reg = CFI_UNDEFINED;
 227         state->drap_offset = -1;
 228 }
 229
 230 /*
 231  * Call the arch-specific instruction decoder for all the instructions and add
 232  * them to the global instruction list.
 233  */
 234 static int decode_instructions(struct objtool_file *file)
 235 {
 236         struct section *sec;
 237         struct symbol *func;
 238         unsigned long offset;
 239         struct instruction *insn;
 240         int ret;
 241
 242         for_each_sec(file, sec) {
 243
 244                 if (!(sec->sh.sh_flags & SHF_EXECINSTR))
 245                         continue;
 246
 247                 if (strcmp(sec->name, ".altinstr_replacement") &&
 248                     strcmp(sec->name, ".altinstr_aux") &&
 249                     strncmp(sec->name, ".discard.", 9))
 250                         sec->text = true;
 251
 252                 for (offset = 0; offset < sec->len; offset += insn->len) {
 253                         insn = malloc(sizeof(*insn));
 254                         if (!insn) {
 255                                 WARN("malloc failed");
 256                                 return -1;
 257                         }
 258                         memset(insn, 0, sizeof(*insn));
 259                         INIT_LIST_HEAD(&insn->alts);
 260                         clear_insn_state(&insn->state);
 261
 262                         insn->sec = sec;
 263                         insn->offset = offset;
 264
 265                         ret = arch_decode_instruction(file->elf, sec, offset,
 266                                                       sec->len - offset,
 267                                                       &insn->len, &insn->type,
 268                                                       &insn->immediate,
 269                                                       &insn->stack_op);
 270                         if (ret)
 271                                 goto err;
 272
 273                         if (!insn->type || insn->type > INSN_LAST) {
 274                                 WARN_FUNC("invalid instruction type %d",
 275                                           insn->sec, insn->offset, insn->type);
 276                                 ret = -1;
 277                                 goto err;
 278                         }
 279
 280                         hash_add(file->insn_hash, &insn->hash, insn->offset);
 281                         list_add_tail(&insn->list, &file->insn_list);
 282                 }
 283
 284                 list_for_each_entry(func, &sec->symbol_list, list) {
 285                         if (func->type != STT_FUNC)
 286                                 continue;
 287
 288                         if (!find_insn(file, sec, func->offset)) {
 289                                 WARN("%s(): can't find starting instruction",
 290                                      func->name);
 291                                 return -1;
 292                         }
 293
 294                         func_for_each_insn(file, func, insn)
 295                                 if (!insn->func)
 296                                         insn->func = func;
 297                 }
 298         }
 299
 300         return 0;
 301
 302 err:
 303         free(insn);
 304         return ret;
 305 }
 306
 307 /*
 308  * Mark "ud2" instructions and manually annotated dead ends.
 309  */
 310 static int add_dead_ends(struct objtool_file *file)
 311 {
 312         struct section *sec;
 313         struct rela *rela;
 314         struct instruction *insn;
 315         bool found;
 316
 317         /*
 318          * By default, "ud2" is a dead end unless otherwise annotated, because
 319          * GCC 7 inserts it for certain divide-by-zero cases.
 320          */
 321         for_each_insn(file, insn)
 322                 if (insn->type == INSN_BUG)
 323                         insn->dead_end = true;
 324
 325         /*
 326          * Check for manually annotated dead ends.
 327          */
 328         sec = find_section_by_name(file->elf, ".rela.discard.unreachable");
 329         if (!sec)
 330                 goto reachable;
 331
 332         list_for_each_entry(rela, &sec->rela_list, list) {
 333                 if (rela->sym->type != STT_SECTION) {
 334                         WARN("unexpected relocation symbol type in %s", sec->name);
 335                         return -1;
 336                 }
 337                 insn = find_insn(file, rela->sym->sec, rela->addend);
 338                 if (insn)
 339                         insn = list_prev_entry(insn, list);
 340                 else if (rela->addend == rela->sym->sec->len) {
 341                         found = false;
 342                         list_for_each_entry_reverse(insn, &file->insn_list, list) {
 343                                 if (insn->sec == rela->sym->sec) {
 344                                         found = true;
 345                                         break;
 346                                 }
 347                         }
 348
 349                         if (!found) {
 350                                 WARN("can't find unreachable insn at %s+0x%x",
 351                                      rela->sym->sec->name, rela->addend);
 352                                 return -1;
 353                         }
 354                 } else {
 355                         WARN("can't find unreachable insn at %s+0x%x",
 356                              rela->sym->sec->name, rela->addend);
 357                         return -1;
 358                 }
 359
 360                 insn->dead_end = true;
 361         }
 362
 363 reachable:
 364         /*
 365          * These manually annotated reachable checks are needed for GCC 4.4,
 366          * where the Linux unreachable() macro isn't supported.  In that case
 367          * GCC doesn't know the "ud2" is fatal, so it generates code as if it's
 368          * not a dead end.
 369          */
 370         sec = find_section_by_name(file->elf, ".rela.discard.reachable");
 371         if (!sec)
 372                 return 0;
 373
 374         list_for_each_entry(rela, &sec->rela_list, list) {
 375                 if (rela->sym->type != STT_SECTION) {
 376                         WARN("unexpected relocation symbol type in %s", sec->name);
 377                         return -1;
 378                 }
 379                 insn = find_insn(file, rela->sym->sec, rela->addend);
 380                 if (insn)
 381                         insn = list_prev_entry(insn, list);
 382                 else if (rela->addend == rela->sym->sec->len) {
 383                         found = false;
 384                         list_for_each_entry_reverse(insn, &file->insn_list, list) {
 385                                 if (insn->sec == rela->sym->sec) {
 386                                         found = true;
 387                                         break;
 388                                 }
 389                         }
 390
 391                         if (!found) {
 392                                 WARN("can't find reachable insn at %s+0x%x",
 393                                      rela->sym->sec->name, rela->addend);
 394                                 return -1;
 395                         }
 396                 } else {
 397                         WARN("can't find reachable insn at %s+0x%x",
 398                              rela->sym->sec->name, rela->addend);
 399                         return -1;
 400                 }
 401
 402                 insn->dead_end = false;
 403         }
 404
 405         return 0;
 406 }
 407
 408 /*
 409  * Warnings shouldn't be reported for ignored functions.
 410  */
 411 static void add_ignores(struct objtool_file *file)
 412 {
 413         struct instruction *insn;
 414         struct section *sec;
 415         struct symbol *func;
 416         struct rela *rela;
 417
 418         sec = find_section_by_name(file->elf, ".rela.discard.func_stack_frame_non_standard");
 419         if (!sec)
 420                 return;
 421
 422         list_for_each_entry(rela, &sec->rela_list, list) {
 423                 switch (rela->sym->type) {
 424                 case STT_FUNC:
 425                         func = rela->sym;
 426                         break;
 427
 428                 case STT_SECTION:
 429                         func = find_symbol_by_offset(rela->sym->sec, rela->addend);
 430                         if (!func || func->type != STT_FUNC)
 431                                 continue;
 432                         break;
 433
 434                 default:
 435                         WARN("unexpected relocation symbol type in %s: %d", sec->name, rela->sym->type);
 436                         continue;
 437                 }
 438
 439                 func_for_each_insn_all(file, func, insn)
 440                         insn->ignore = true;
 441         }
 442 }
 443
 444 /*
 445  * FIXME: For now, just ignore any alternatives which add retpolines.  This is
 446  * a temporary hack, as it doesn't allow ORC to unwind from inside a retpoline.
 447  * But it at least allows objtool to understand the control flow *around* the
 448  * retpoline.
 449  */
 450 static int add_ignore_alternatives(struct objtool_file *file)
 451 {
 452         struct section *sec;
 453         struct rela *rela;
 454         struct instruction *insn;
 455
 456         sec = find_section_by_name(file->elf, ".rela.discard.ignore_alts");
 457         if (!sec)
 458                 return 0;
 459
 460         list_for_each_entry(rela, &sec->rela_list, list) {
 461                 if (rela->sym->type != STT_SECTION) {
 462                         WARN("unexpected relocation symbol type in %s", sec->name);
 463                         return -1;
 464                 }
 465
 466                 insn = find_insn(file, rela->sym->sec, rela->addend);
 467                 if (!insn) {
 468                         WARN("bad .discard.ignore_alts entry");
 469                         return -1;
 470                 }
 471
 472                 insn->ignore_alts = true;
 473         }
 474
 475         return 0;
 476 }
 477
 478 /*
 479  * Find the destination instructions for all jumps.
 480  */
 481 static int add_jump_destinations(struct objtool_file *file)
 482 {
 483         struct instruction *insn;
 484         struct rela *rela;
 485         struct section *dest_sec;
 486         unsigned long dest_off;
 487
 488         for_each_insn(file, insn) {
 489                 if (insn->type != INSN_JUMP_CONDITIONAL &&
 490                     insn->type != INSN_JUMP_UNCONDITIONAL)
 491                         continue;
 492
 493                 if (insn->ignore)
 494                         continue;
 495
 496                 rela = find_rela_by_dest_range(insn->sec, insn->offset,
 497                                                insn->len);
 498                 if (!rela) {
 499                         dest_sec = insn->sec;
 500                         dest_off = insn->offset + insn->len + insn->immediate;
 501                 } else if (rela->sym->type == STT_SECTION) {
 502                         dest_sec = rela->sym->sec;
 503                         dest_off = rela->addend + 4;
 504                 } else if (rela->sym->sec->idx) {
 505                         dest_sec = rela->sym->sec;
 506                         dest_off = rela->sym->sym.st_value + rela->addend + 4;
 507                 } else if (strstr(rela->sym->name, "_indirect_thunk_")) {
 508                         /*
 509                          * Retpoline jumps are really dynamic jumps in
 510                          * disguise, so convert them accordingly.
 511                          */
 512                         insn->type = INSN_JUMP_DYNAMIC;
 513                         insn->retpoline_safe = true;
 514                         continue;
 515                 } else {
 516                         /* sibling call */
 517                         insn->jump_dest = 0;
 518                         continue;
 519                 }
 520
 521                 insn->jump_dest = find_insn(file, dest_sec, dest_off);
 522                 if (!insn->jump_dest) {
 523
 524                         /*
 525                          * This is a special case where an alt instruction
 526                          * jumps past the end of the section.  These are
 527                          * handled later in handle_group_alt().
 528                          */
 529                         if (!strcmp(insn->sec->name, ".altinstr_replacement"))
 530                                 continue;
 531
 532                         WARN_FUNC("can't find jump dest instruction at %s+0x%lx",
 533                                   insn->sec, insn->offset, dest_sec->name,
 534                                   dest_off);
 535                         return -1;
 536                 }
 537
 538                 /*
 539                  * For GCC 8+, create parent/child links for any cold
 540                  * subfunctions.  This is _mostly_ redundant with a similar
 541                  * initialization in read_symbols().
 542                  *
 543                  * If a function has aliases, we want the *first* such function
 544                  * in the symbol table to be the subfunction's parent.  In that
 545                  * case we overwrite the initialization done in read_symbols().
 546                  *
 547                  * However this code can't completely replace the
 548                  * read_symbols() code because this doesn't detect the case
 549                  * where the parent function's only reference to a subfunction
 550                  * is through a switch table.
 551                  */
 552                 if (insn->func && insn->jump_dest->func &&
 553                     insn->func != insn->jump_dest->func &&
 554                     !strstr(insn->func->name, ".cold.") &&
 555                     strstr(insn->jump_dest->func->name, ".cold.")) {
 556                         insn->func->cfunc = insn->jump_dest->func;
 557                         insn->jump_dest->func->pfunc = insn->func;
 558                 }
 559         }
 560
 561         return 0;
 562 }
 563
 564 /*
 565  * Find the destination instructions for all calls.
 566  */
 567 static int add_call_destinations(struct objtool_file *file)
 568 {
 569         struct instruction *insn;
 570         unsigned long dest_off;
 571         struct rela *rela;
 572
 573         for_each_insn(file, insn) {
 574                 if (insn->type != INSN_CALL)
 575                         continue;
 576
 577                 rela = find_rela_by_dest_range(insn->sec, insn->offset,
 578                                                insn->len);
 579                 if (!rela) {
 580                         dest_off = insn->offset + insn->len + insn->immediate;
 581                         insn->call_dest = find_symbol_by_offset(insn->sec,
 582                                                                 dest_off);
 583
 584                         if (!insn->call_dest && !insn->ignore) {
 585                                 WARN_FUNC("unsupported intra-function call",
 586                                           insn->sec, insn->offset);
 587                                 if (retpoline)
 588                                         WARN("If this is a retpoline, please patch it in with alternatives and annotate it with ANNOTATE_NOSPEC_ALTERNATIVE.");
 589                                 return -1;
 590                         }
 591
 592                 } else if (rela->sym->type == STT_SECTION) {
 593                         insn->call_dest = find_symbol_by_offset(rela->sym->sec,
 594                                                                 rela->addend+4);
 595                         if (!insn->call_dest ||
 596                             insn->call_dest->type != STT_FUNC) {
 597                                 WARN_FUNC("can't find call dest symbol at %s+0x%x",
 598                                           insn->sec, insn->offset,
 599                                           rela->sym->sec->name,
 600                                           rela->addend + 4);
 601                                 return -1;
 602                         }
 603                 } else
 604                         insn->call_dest = rela->sym;
 605         }
 606
 607         return 0;
 608 }
 609
 610 /*
 611  * The .alternatives section requires some extra special care, over and above
 612  * what other special sections require:
 613  *
 614  * 1. Because alternatives are patched in-place, we need to insert a fake jump
 615  *    instruction at the end so that validate_branch() skips all the original
 616  *    replaced instructions when validating the new instruction path.
 617  *
 618  * 2. An added wrinkle is that the new instruction length might be zero.  In
 619  *    that case the old instructions are replaced with noops.  We simulate that
 620  *    by creating a fake jump as the only new instruction.
 621  *
 622  * 3. In some cases, the alternative section includes an instruction which
 623  *    conditionally jumps to the _end_ of the entry.  We have to modify these
 624  *    jumps' destinations to point back to .text rather than the end of the
 625  *    entry in .altinstr_replacement.
 626  *
 627  * 4. It has been requested that we don't validate the !POPCNT feature path
 628  *    which is a "very very small percentage of machines".
 629  */
 630 static int handle_group_alt(struct objtool_file *file,
 631                             struct special_alt *special_alt,
 632                             struct instruction *orig_insn,
 633                             struct instruction **new_insn)
 634 {
 635         struct instruction *last_orig_insn, *last_new_insn, *insn, *fake_jump = NULL;
 636         unsigned long dest_off;
 637
 638         last_orig_insn = NULL;
 639         insn = orig_insn;
 640         sec_for_each_insn_from(file, insn) {
 641                 if (insn->offset >= special_alt->orig_off + special_alt->orig_len)
 642                         break;
 643
 644                 if (special_alt->skip_orig)
 645                         insn->type = INSN_NOP;
 646
 647                 insn->alt_group = true;
 648                 last_orig_insn = insn;
 649         }
 650
 651         if (next_insn_same_sec(file, last_orig_insn)) {
 652                 fake_jump = malloc(sizeof(*fake_jump));
 653                 if (!fake_jump) {
 654                         WARN("malloc failed");
 655                         return -1;
 656                 }
 657                 memset(fake_jump, 0, sizeof(*fake_jump));
 658                 INIT_LIST_HEAD(&fake_jump->alts);
 659                 clear_insn_state(&fake_jump->state);
 660
 661                 fake_jump->sec = special_alt->new_sec;
 662                 fake_jump->offset = -1;
 663                 fake_jump->type = INSN_JUMP_UNCONDITIONAL;
 664                 fake_jump->jump_dest = list_next_entry(last_orig_insn, list);
 665                 fake_jump->ignore = true;
 666         }
 667
 668         if (!special_alt->new_len) {
 669                 if (!fake_jump) {
 670                         WARN("%s: empty alternative at end of section",
 671                              special_alt->orig_sec->name);
 672                         return -1;
 673                 }
 674
 675                 *new_insn = fake_jump;
 676                 return 0;
 677         }
 678
 679         last_new_insn = NULL;
 680         insn = *new_insn;
 681         sec_for_each_insn_from(file, insn) {
 682                 if (insn->offset >= special_alt->new_off + special_alt->new_len)
 683                         break;
 684
 685                 last_new_insn = insn;
 686
 687                 insn->ignore = orig_insn->ignore_alts;
 688                 insn->func = orig_insn->func;
 689
 690                 if (insn->type != INSN_JUMP_CONDITIONAL &&
 691                     insn->type != INSN_JUMP_UNCONDITIONAL)
 692                         continue;
 693
 694                 if (!insn->immediate)
 695                         continue;
 696
 697                 dest_off = insn->offset + insn->len + insn->immediate;
 698                 if (dest_off == special_alt->new_off + special_alt->new_len) {
 699                         if (!fake_jump) {
 700                                 WARN("%s: alternative jump to end of section",
 701                                      special_alt->orig_sec->name);
 702                                 return -1;
 703                         }
 704                         insn->jump_dest = fake_jump;
 705                 }
 706
 707                 if (!insn->jump_dest) {
 708                         WARN_FUNC("can't find alternative jump destination",
 709                                   insn->sec, insn->offset);
 710                         return -1;
 711                 }
 712         }
 713
 714         if (!last_new_insn) {
 715                 WARN_FUNC("can't find last new alternative instruction",
 716                           special_alt->new_sec, special_alt->new_off);
 717                 return -1;
 718         }
 719
 720         if (fake_jump)
 721                 list_add(&fake_jump->list, &last_new_insn->list);
 722
 723         return 0;
 724 }
 725
 726 /*
 727  * A jump table entry can either convert a nop to a jump or a jump to a nop.
 728  * If the original instruction is a jump, make the alt entry an effective nop
 729  * by just skipping the original instruction.
 730  */
 731 static int handle_jump_alt(struct objtool_file *file,
 732                            struct special_alt *special_alt,
 733                            struct instruction *orig_insn,
 734                            struct instruction **new_insn)
 735 {
 736         if (orig_insn->type == INSN_NOP)
 737                 return 0;
 738
 739         if (orig_insn->type != INSN_JUMP_UNCONDITIONAL) {
 740                 WARN_FUNC("unsupported instruction at jump label",
 741                           orig_insn->sec, orig_insn->offset);
 742                 return -1;
 743         }
 744
 745         *new_insn = list_next_entry(orig_insn, list);
 746         return 0;
 747 }
 748
 749 /*
 750  * Read all the special sections which have alternate instructions which can be
 751  * patched in or redirected to at runtime.  Each instruction having alternate
 752  * instruction(s) has them added to its insn->alts list, which will be
 753  * traversed in validate_branch().
 754  */
 755 static int add_special_section_alts(struct objtool_file *file)
 756 {
 757         struct list_head special_alts;
 758         struct instruction *orig_insn, *new_insn;
 759         struct special_alt *special_alt, *tmp;
 760         struct alternative *alt;
 761         int ret;
 762
 763         ret = special_get_alts(file->elf, &special_alts);
 764         if (ret)
 765                 return ret;
 766
 767         list_for_each_entry_safe(special_alt, tmp, &special_alts, list) {
 768
 769                 orig_insn = find_insn(file, special_alt->orig_sec,
 770                                       special_alt->orig_off);
 771                 if (!orig_insn) {
 772                         WARN_FUNC("special: can't find orig instruction",
 773                                   special_alt->orig_sec, special_alt->orig_off);
 774                         ret = -1;
 775                         goto out;
 776                 }
 777
 778                 new_insn = NULL;
 779                 if (!special_alt->group || special_alt->new_len) {
 780                         new_insn = find_insn(file, special_alt->new_sec,
 781                                              special_alt->new_off);
 782                         if (!new_insn) {
 783                                 WARN_FUNC("special: can't find new instruction",
 784                                           special_alt->new_sec,
 785                                           special_alt->new_off);
 786                                 ret = -1;
 787                                 goto out;
 788                         }
 789                 }
 790
 791                 if (special_alt->group) {
 792                         ret = handle_group_alt(file, special_alt, orig_insn,
 793                                                &new_insn);
 794                         if (ret)
 795                                 goto out;
 796                 } else if (special_alt->jump_or_nop) {
 797                         ret = handle_jump_alt(file, special_alt, orig_insn,
 798                                               &new_insn);
 799                         if (ret)
 800                                 goto out;
 801                 }
 802
 803                 alt = malloc(sizeof(*alt));
 804                 if (!alt) {
 805                         WARN("malloc failed");
 806                         ret = -1;
 807                         goto out;
 808                 }
 809
 810                 alt->insn = new_insn;
 811                 list_add_tail(&alt->list, &orig_insn->alts);
 812
 813                 list_del(&special_alt->list);
 814                 free(special_alt);
 815         }
 816
 817 out:
 818         return ret;
 819 }
 820
 821 static int add_switch_table(struct objtool_file *file, struct instruction *insn,
 822                             struct rela *table, struct rela *next_table)
 823 {
 824         struct rela *rela = table;
 825         struct instruction *alt_insn;
 826         struct alternative *alt;
 827         struct symbol *pfunc = insn->func->pfunc;
 828         unsigned int prev_offset = 0;
 829
 830         list_for_each_entry_from(rela, &table->rela_sec->rela_list, list) {
 831                 if (rela == next_table)
 832                         break;
 833
 834                 /* Make sure the switch table entries are consecutive: */
 835                 if (prev_offset && rela->offset != prev_offset + 8)
 836                         break;
 837
 838                 /* Detect function pointers from contiguous objects: */
 839                 if (rela->sym->sec == pfunc->sec &&
 840                     rela->addend == pfunc->offset)
 841                         break;
 842
 843                 alt_insn = find_insn(file, rela->sym->sec, rela->addend);
 844                 if (!alt_insn)
 845                         break;
 846
 847                 /* Make sure the jmp dest is in the function or subfunction: */
 848                 if (alt_insn->func->pfunc != pfunc)
 849                         break;
 850
 851                 alt = malloc(sizeof(*alt));
 852                 if (!alt) {
 853                         WARN("malloc failed");
 854                         return -1;
 855                 }
 856
 857                 alt->insn = alt_insn;
 858                 list_add_tail(&alt->list, &insn->alts);
 859                 prev_offset = rela->offset;
 860         }
 861
 862         if (!prev_offset) {
 863                 WARN_FUNC("can't find switch jump table",
 864                           insn->sec, insn->offset);
 865                 return -1;
 866         }
 867
 868         return 0;
 869 }
 870
 871 /*
 872  * find_switch_table() - Given a dynamic jump, find the switch jump table in
 873  * .rodata associated with it.
 874  *
 875  * There are 3 basic patterns:
 876  *
 877  * 1. jmpq *[rodata addr](,%reg,8)
 878  *
 879  *    This is the most common case by far.  It jumps to an address in a simple
 880  *    jump table which is stored in .rodata.
 881  *
 882  * 2. jmpq *[rodata addr](%rip)
 883  *
 884  *    This is caused by a rare GCC quirk, currently only seen in three driver
 885  *    functions in the kernel, only with certain obscure non-distro configs.
 886  *
 887  *    As part of an optimization, GCC makes a copy of an existing switch jump
 888  *    table, modifies it, and then hard-codes the jump (albeit with an indirect
 889  *    jump) to use a single entry in the table.  The rest of the jump table and
 890  *    some of its jump targets remain as dead code.
 891  *
 892  *    In such a case we can just crudely ignore all unreachable instruction
 893  *    warnings for the entire object file.  Ideally we would just ignore them
 894  *    for the function, but that would require redesigning the code quite a
 895  *    bit.  And honestly that's just not worth doing: unreachable instruction
 896  *    warnings are of questionable value anyway, and this is such a rare issue.
 897  *
 898  * 3. mov [rodata addr],%reg1
 899  *    ... some instructions ...
 900  *    jmpq *(%reg1,%reg2,8)
 901  *
 902  *    This is a fairly uncommon pattern which is new for GCC 6.  As of this
 903  *    writing, there are 11 occurrences of it in the allmodconfig kernel.
 904  *
 905  *    As of GCC 7 there are quite a few more of these and the 'in between' code
 906  *    is significant. Esp. with KASAN enabled some of the code between the mov
 907  *    and jmpq uses .rodata itself, which can confuse things.
 908  *
 909  *    TODO: Once we have DWARF CFI and smarter instruction decoding logic,
 910  *    ensure the same register is used in the mov and jump instructions.
 911  *
 912  *    NOTE: RETPOLINE made it harder still to decode dynamic jumps.
 913  */
 914 static struct rela *find_switch_table(struct objtool_file *file,
 915                                       struct symbol *func,
 916                                       struct instruction *insn)
 917 {
 918         struct rela *text_rela, *rodata_rela;
 919         struct instruction *orig_insn = insn;
 920         struct section *rodata_sec;
 921         unsigned long table_offset;
 922
 923         /*
 924          * Backward search using the @first_jump_src links, these help avoid
 925          * much of the 'in between' code. Which avoids us getting confused by
 926          * it.
 927          */
 928         for (;
 929              &insn->list != &file->insn_list &&
 930              insn->sec == func->sec &&
 931              insn->offset >= func->offset;
 932
 933              insn = insn->first_jump_src ?: list_prev_entry(insn, list)) {
 934
 935                 if (insn != orig_insn && insn->type == INSN_JUMP_DYNAMIC)
 936                         break;
 937
 938                 /* allow small jumps within the range */
 939                 if (insn->type == INSN_JUMP_UNCONDITIONAL &&
 940                     insn->jump_dest &&
 941                     (insn->jump_dest->offset <= insn->offset ||
 942                      insn->jump_dest->offset > orig_insn->offset))
 943                     break;
 944
 945                 /* look for a relocation which references .rodata */
 946                 text_rela = find_rela_by_dest_range(insn->sec, insn->offset,
 947                                                     insn->len);
 948                 if (!text_rela || text_rela->sym->type != STT_SECTION ||
 949                     !text_rela->sym->sec->rodata)
 950                         continue;
 951
 952                 table_offset = text_rela->addend;
 953                 rodata_sec = text_rela->sym->sec;
 954
 955                 if (text_rela->type == R_X86_64_PC32)
 956                         table_offset += 4;
 957
 958                 /*
 959                  * Make sure the .rodata address isn't associated with a
 960                  * symbol.  gcc jump tables are anonymous data.
 961                  */
 962                 if (find_symbol_containing(rodata_sec, table_offset))
 963                         continue;
 964
 965                 rodata_rela = find_rela_by_dest(rodata_sec, table_offset);
 966                 if (rodata_rela) {
 967                         /*
 968                          * Use of RIP-relative switch jumps is quite rare, and
 969                          * indicates a rare GCC quirk/bug which can leave dead
 970                          * code behind.
 971                          */
 972                         if (text_rela->type == R_X86_64_PC32)
 973                                 file->ignore_unreachables = true;
 974
 975                         return rodata_rela;
 976                 }
 977         }
 978
 979         return NULL;
 980 }
 981
 982
 983 static int add_func_switch_tables(struct objtool_file *file,
 984                                   struct symbol *func)
 985 {
 986         struct instruction *insn, *last = NULL, *prev_jump = NULL;
 987         struct rela *rela, *prev_rela = NULL;
 988         int ret;
 989
 990         func_for_each_insn_all(file, func, insn) {
 991                 if (!last)
 992                         last = insn;
 993
 994                 /*
 995                  * Store back-pointers for unconditional forward jumps such
 996                  * that find_switch_table() can back-track using those and
 997                  * avoid some potentially confusing code.
 998                  */
 999                 if (insn->type == INSN_JUMP_UNCONDITIONAL && insn->jump_dest &&
1000                     insn->offset > last->offset &&
1001                     insn->jump_dest->offset > insn->offset &&
1002                     !insn->jump_dest->first_jump_src) {
1003
1004                         insn->jump_dest->first_jump_src = insn;
1005                         last = insn->jump_dest;
1006                 }
1007
1008                 if (insn->type != INSN_JUMP_DYNAMIC)
1009                         continue;
1010
1011                 rela = find_switch_table(file, func, insn);
1012                 if (!rela)
1013                         continue;
1014
1015                 /*
1016                  * We found a switch table, but we don't know yet how big it
1017                  * is.  Don't add it until we reach the end of the function or
1018                  * the beginning of another switch table in the same function.
1019                  */
1020                 if (prev_jump) {
1021                         ret = add_switch_table(file, prev_jump, prev_rela, rela);
1022                         if (ret)
1023                                 return ret;
1024                 }
1025
1026                 prev_jump = insn;
1027                 prev_rela = rela;
1028         }
1029
1030         if (prev_jump) {
1031                 ret = add_switch_table(file, prev_jump, prev_rela, NULL);
1032                 if (ret)
1033                         return ret;
1034         }
1035
1036         return 0;
1037 }
1038
1039 /*
1040  * For some switch statements, gcc generates a jump table in the .rodata
1041  * section which contains a list of addresses within the function to jump to.
1042  * This finds these jump tables and adds them to the insn->alts lists.
1043  */
1044 static int add_switch_table_alts(struct objtool_file *file)
1045 {
1046         struct section *sec;
1047         struct symbol *func;
1048         int ret;
1049
1050         if (!file->rodata)
1051                 return 0;
1052
1053         for_each_sec(file, sec) {
1054                 list_for_each_entry(func, &sec->symbol_list, list) {
1055                         if (func->type != STT_FUNC)
1056                                 continue;
1057
1058                         ret = add_func_switch_tables(file, func);
1059                         if (ret)
1060                                 return ret;
1061                 }
1062         }
1063
1064         return 0;
1065 }
1066
1067 static int read_unwind_hints(struct objtool_file *file)
1068 {
1069         struct section *sec, *relasec;
1070         struct rela *rela;
1071         struct unwind_hint *hint;
1072         struct instruction *insn;
1073         struct cfi_reg *cfa;
1074         int i;
1075
1076         sec = find_section_by_name(file->elf, ".discard.unwind_hints");
1077         if (!sec)
1078                 return 0;
1079
1080         relasec = sec->rela;
1081         if (!relasec) {
1082                 WARN("missing .rela.discard.unwind_hints section");
1083                 return -1;
1084         }
1085
1086         if (sec->len % sizeof(struct unwind_hint)) {
1087                 WARN("struct unwind_hint size mismatch");
1088                 return -1;
1089         }
1090
1091         file->hints = true;
1092
1093         for (i = 0; i < sec->len / sizeof(struct unwind_hint); i++) {
1094                 hint = (struct unwind_hint *)sec->data->d_buf + i;
1095
1096                 rela = find_rela_by_dest(sec, i * sizeof(*hint));
1097                 if (!rela) {
1098                         WARN("can't find rela for unwind_hints[%d]", i);
1099                         return -1;
1100                 }
1101
1102                 insn = find_insn(file, rela->sym->sec, rela->addend);
1103                 if (!insn) {
1104                         WARN("can't find insn for unwind_hints[%d]", i);
1105                         return -1;
1106                 }
1107
1108                 cfa = &insn->state.cfa;
1109
1110                 if (hint->type == UNWIND_HINT_TYPE_SAVE) {
1111                         insn->save = true;
1112                         continue;
1113
1114                 } else if (hint->type == UNWIND_HINT_TYPE_RESTORE) {
1115                         insn->restore = true;
1116                         insn->hint = true;
1117                         continue;
1118                 }
1119
1120                 insn->hint = true;
1121
1122                 switch (hint->sp_reg) {
1123                 case ORC_REG_UNDEFINED:
1124                         cfa->base = CFI_UNDEFINED;
1125                         break;
1126                 case ORC_REG_SP:
1127                         cfa->base = CFI_SP;
1128                         break;
1129                 case ORC_REG_BP:
1130                         cfa->base = CFI_BP;
1131                         break;
1132                 case ORC_REG_SP_INDIRECT:
1133                         cfa->base = CFI_SP_INDIRECT;
1134                         break;
1135                 case ORC_REG_R10:
1136                         cfa->base = CFI_R10;
1137                         break;
1138                 case ORC_REG_R13:
1139                         cfa->base = CFI_R13;
1140                         break;
1141                 case ORC_REG_DI:
1142                         cfa->base = CFI_DI;
1143                         break;
1144                 case ORC_REG_DX:
1145                         cfa->base = CFI_DX;
1146                         break;
1147                 default:
1148                         WARN_FUNC("unsupported unwind_hint sp base reg %d",
1149                                   insn->sec, insn->offset, hint->sp_reg);
1150                         return -1;
1151                 }
1152
1153                 cfa->offset = hint->sp_offset;
1154                 insn->state.type = hint->type;
1155                 insn->state.end = hint->end;
1156         }
1157
1158         return 0;
1159 }
1160
1161 static int read_retpoline_hints(struct objtool_file *file)
1162 {
1163         struct section *sec;
1164         struct instruction *insn;
1165         struct rela *rela;
1166
1167         sec = find_section_by_name(file->elf, ".rela.discard.retpoline_safe");
1168         if (!sec)
1169                 return 0;
1170
1171         list_for_each_entry(rela, &sec->rela_list, list) {
1172                 if (rela->sym->type != STT_SECTION) {
1173                         WARN("unexpected relocation symbol type in %s", sec->name);
1174                         return -1;
1175                 }
1176
1177                 insn = find_insn(file, rela->sym->sec, rela->addend);
1178                 if (!insn) {
1179                         WARN("bad .discard.retpoline_safe entry");
1180                         return -1;
1181                 }
1182
1183                 if (insn->type != INSN_JUMP_DYNAMIC &&
1184                     insn->type != INSN_CALL_DYNAMIC) {
1185                         WARN_FUNC("retpoline_safe hint not an indirect jump/call",
1186                                   insn->sec, insn->offset);
1187                         return -1;
1188                 }
1189
1190                 insn->retpoline_safe = true;
1191         }
1192
1193         return 0;
1194 }
1195
1196 static void mark_rodata(struct objtool_file *file)
1197 {
1198         struct section *sec;
1199         bool found = false;
1200
1201         /*
1202          * This searches for the .rodata section or multiple .rodata.func_name
1203          * sections if -fdata-sections is being used. The .str.1.1 and .str.1.8
1204          * rodata sections are ignored as they don't contain jump tables.
1205          */
1206         for_each_sec(file, sec) {
1207                 if (!strncmp(sec->name, ".rodata", 7) &&
1208                     !strstr(sec->name, ".str1.")) {
1209                         sec->rodata = true;
1210                         found = true;
1211                 }
1212         }
1213
1214         file->rodata = found;
1215 }
1216
1217 static int decode_sections(struct objtool_file *file)
1218 {
1219         int ret;
1220
1221         mark_rodata(file);
1222
1223         ret = decode_instructions(file);
1224         if (ret)
1225                 return ret;
1226
1227         ret = add_dead_ends(file);
1228         if (ret)
1229                 return ret;
1230
1231         add_ignores(file);
1232
1233         ret = add_ignore_alternatives(file);
1234         if (ret)
1235                 return ret;
1236
1237         ret = add_jump_destinations(file);
1238         if (ret)
1239                 return ret;
1240
1241         ret = add_special_section_alts(file);
1242         if (ret)
1243                 return ret;
1244
1245         ret = add_call_destinations(file);
1246         if (ret)
1247                 return ret;
1248
1249         ret = add_switch_table_alts(file);
1250         if (ret)
1251                 return ret;
1252
1253         ret = read_unwind_hints(file);
1254         if (ret)
1255                 return ret;
1256
1257         ret = read_retpoline_hints(file);
1258         if (ret)
1259                 return ret;
1260
1261         return 0;
1262 }
1263
1264 static bool is_fentry_call(struct instruction *insn)
1265 {
1266         if (insn->type == INSN_CALL &&
1267             insn->call_dest->type == STT_NOTYPE &&
1268             !strcmp(insn->call_dest->name, "__fentry__"))
1269                 return true;
1270
1271         return false;
1272 }
1273
1274 static bool has_modified_stack_frame(struct insn_state *state)
1275 {
1276         int i;
1277
1278         if (state->cfa.base != initial_func_cfi.cfa.base ||
1279             state->cfa.offset != initial_func_cfi.cfa.offset ||
1280             state->stack_size != initial_func_cfi.cfa.offset ||
1281             state->drap)
1282                 return true;
1283
1284         for (i = 0; i < CFI_NUM_REGS; i++)
1285                 if (state->regs[i].base != initial_func_cfi.regs[i].base ||
1286                     state->regs[i].offset != initial_func_cfi.regs[i].offset)
1287                         return true;
1288
1289         return false;
1290 }
1291
1292 static bool has_valid_stack_frame(struct insn_state *state)
1293 {
1294         if (state->cfa.base == CFI_BP && state->regs[CFI_BP].base == CFI_CFA &&
1295             state->regs[CFI_BP].offset == -16)
1296                 return true;
1297
1298         if (state->drap && state->regs[CFI_BP].base == CFI_BP)
1299                 return true;
1300
1301         return false;
1302 }
1303
1304 static int update_insn_state_regs(struct instruction *insn, struct insn_state *state)
1305 {
1306         struct cfi_reg *cfa = &state->cfa;
1307         struct stack_op *op = &insn->stack_op;
1308
1309         if (cfa->base != CFI_SP)
1310                 return 0;
1311
1312         /* push */
1313         if (op->dest.type == OP_DEST_PUSH)
1314                 cfa->offset += 8;
1315
1316         /* pop */
1317         if (op->src.type == OP_SRC_POP)
1318                 cfa->offset -= 8;
1319
1320         /* add immediate to sp */
1321         if (op->dest.type == OP_DEST_REG && op->src.type == OP_SRC_ADD &&
1322             op->dest.reg == CFI_SP && op->src.reg == CFI_SP)
1323                 cfa->offset -= op->src.offset;
1324
1325         return 0;
1326 }
1327
1328 static void save_reg(struct insn_state *state, unsigned char reg, int base,
1329                      int offset)
1330 {
1331         if (arch_callee_saved_reg(reg) &&
1332             state->regs[reg].base == CFI_UNDEFINED) {
1333                 state->regs[reg].base = base;
1334                 state->regs[reg].offset = offset;
1335         }
1336 }
1337
1338 static void restore_reg(struct insn_state *state, unsigned char reg)
1339 {
1340         state->regs[reg].base = CFI_UNDEFINED;
1341         state->regs[reg].offset = 0;
1342 }
1343
1344 /*
1345  * A note about DRAP stack alignment:
1346  *
1347  * GCC has the concept of a DRAP register, which is used to help keep track of
1348  * the stack pointer when aligning the stack.  r10 or r13 is used as the DRAP
1349  * register.  The typical DRAP pattern is:
1350  *
1351  *   4c 8d 54 24 08             lea    0x8(%rsp),%r10
1352  *   48 83 e4 c0                and    $0xffffffffffffffc0,%rsp
1353  *   41 ff 72 f8                pushq  -0x8(%r10)
1354  *   55                         push   %rbp
1355  *   48 89 e5                   mov    %rsp,%rbp
1356  *                              (more pushes)
1357  *   41 52                      push   %r10
1358  *                              ...
1359  *   41 5a                      pop    %r10
1360  *                              (more pops)
1361  *   5d                         pop    %rbp
1362  *   49 8d 62 f8                lea    -0x8(%r10),%rsp
1363  *   c3                         retq
1364  *
1365  * There are some variations in the epilogues, like:
1366  *
1367  *   5b                         pop    %rbx
1368  *   41 5a                      pop    %r10
1369  *   41 5c                      pop    %r12
1370  *   41 5d                      pop    %r13
1371  *   41 5e                      pop    %r14
1372  *   c9                         leaveq
1373  *   49 8d 62 f8                lea    -0x8(%r10),%rsp
1374  *   c3                         retq
1375  *
1376  * and:
1377  *
1378  *   4c 8b 55 e8                mov    -0x18(%rbp),%r10
1379  *   48 8b 5d e0                mov    -0x20(%rbp),%rbx
1380  *   4c 8b 65 f0                mov    -0x10(%rbp),%r12
1381  *   4c 8b 6d f8                mov    -0x8(%rbp),%r13
1382  *   c9                         leaveq
1383  *   49 8d 62 f8                lea    -0x8(%r10),%rsp
1384  *   c3                         retq
1385  *
1386  * Sometimes r13 is used as the DRAP register, in which case it's saved and
1387  * restored beforehand:
1388  *
1389  *   41 55                      push   %r13
1390  *   4c 8d 6c 24 10             lea    0x10(%rsp),%r13
1391  *   48 83 e4 f0                and    $0xfffffffffffffff0,%rsp
1392  *                              ...
1393  *   49 8d 65 f0                lea    -0x10(%r13),%rsp
1394  *   41 5d                      pop    %r13
1395  *   c3                         retq
1396  */
1397 static int update_insn_state(struct instruction *insn, struct insn_state *state)
1398 {
1399         struct stack_op *op = &insn->stack_op;
1400         struct cfi_reg *cfa = &state->cfa;
1401         struct cfi_reg *regs = state->regs;
1402
1403         /* stack operations don't make sense with an undefined CFA */
1404         if (cfa->base == CFI_UNDEFINED) {
1405                 if (insn->func) {
1406                         WARN_FUNC("undefined stack state", insn->sec, insn->offset);
1407                         return -1;
1408                 }
1409                 return 0;
1410         }
1411
1412         if (state->type == ORC_TYPE_REGS || state->type == ORC_TYPE_REGS_IRET)
1413                 return update_insn_state_regs(insn, state);
1414
1415         switch (op->dest.type) {
1416
1417         case OP_DEST_REG:
1418                 switch (op->src.type) {
1419
1420                 case OP_SRC_REG:
1421                         if (op->src.reg == CFI_SP && op->dest.reg == CFI_BP &&
1422                             cfa->base == CFI_SP &&
1423                             regs[CFI_BP].base == CFI_CFA &&
1424                             regs[CFI_BP].offset == -cfa->offset) {
1425
1426                                 /* mov %rsp, %rbp */
1427                                 cfa->base = op->dest.reg;
1428                                 state->bp_scratch = false;
1429                         }
1430
1431                         else if (op->src.reg == CFI_SP &&
1432                                  op->dest.reg == CFI_BP && state->drap) {
1433
1434                                 /* drap: mov %rsp, %rbp */
1435                                 regs[CFI_BP].base = CFI_BP;
1436                                 regs[CFI_BP].offset = -state->stack_size;
1437                                 state->bp_scratch = false;
1438                         }
1439
1440                         else if (op->src.reg == CFI_SP && cfa->base == CFI_SP) {
1441
1442                                 /*
1443                                  * mov %rsp, %reg
1444                                  *
1445                                  * This is needed for the rare case where GCC
1446                                  * does:
1447                                  *
1448                                  *   mov    %rsp, %rax
1449                                  *   ...
1450                                  *   mov    %rax, %rsp
1451                                  */
1452                                 state->vals[op->dest.reg].base = CFI_CFA;
1453                                 state->vals[op->dest.reg].offset = -state->stack_size;
1454                         }
1455
1456                         else if (op->src.reg == CFI_BP && op->dest.reg == CFI_SP &&
1457                                  cfa->base == CFI_BP) {
1458
1459                                 /*
1460                                  * mov %rbp, %rsp
1461                                  *
1462                                  * Restore the original stack pointer (Clang).
1463                                  */
1464                                 state->stack_size = -state->regs[CFI_BP].offset;
1465                         }
1466
1467                         else if (op->dest.reg == cfa->base) {
1468
1469                                 /* mov %reg, %rsp */
1470                                 if (cfa->base == CFI_SP &&
1471                                     state->vals[op->src.reg].base == CFI_CFA) {
1472
1473                                         /*
1474                                          * This is needed for the rare case
1475                                          * where GCC does something dumb like:
1476                                          *
1477                                          *   lea    0x8(%rsp), %rcx
1478                                          *   ...
1479                                          *   mov    %rcx, %rsp
1480                                          */
1481                                         cfa->offset = -state->vals[op->src.reg].offset;
1482                                         state->stack_size = cfa->offset;
1483
1484                                 } else {
1485                                         cfa->base = CFI_UNDEFINED;
1486                                         cfa->offset = 0;
1487                                 }
1488                         }
1489
1490                         break;
1491
1492                 case OP_SRC_ADD:
1493                         if (op->dest.reg == CFI_SP && op->src.reg == CFI_SP) {
1494
1495                                 /* add imm, %rsp */
1496                                 state->stack_size -= op->src.offset;
1497                                 if (cfa->base == CFI_SP)
1498                                         cfa->offset -= op->src.offset;
1499                                 break;
1500                         }
1501
1502                         if (op->dest.reg == CFI_SP && op->src.reg == CFI_BP) {
1503
1504                                 /* lea disp(%rbp), %rsp */
1505                                 state->stack_size = -(op->src.offset + regs[CFI_BP].offset);
1506                                 break;
1507                         }
1508
1509                         if (op->src.reg == CFI_SP && cfa->base == CFI_SP) {
1510
1511                                 /* drap: lea disp(%rsp), %drap */
1512                                 state->drap_reg = op->dest.reg;
1513
1514                                 /*
1515                                  * lea disp(%rsp), %reg
1516                                  *
1517                                  * This is needed for the rare case where GCC
1518                                  * does something dumb like:
1519                                  *
1520                                  *   lea    0x8(%rsp), %rcx
1521                                  *   ...
1522                                  *   mov    %rcx, %rsp
1523                                  */
1524                                 state->vals[op->dest.reg].base = CFI_CFA;
1525                                 state->vals[op->dest.reg].offset = \
1526                                         -state->stack_size + op->src.offset;
1527
1528                                 break;
1529                         }
1530
1531                         if (state->drap && op->dest.reg == CFI_SP &&
1532                             op->src.reg == state->drap_reg) {
1533
1534                                  /* drap: lea disp(%drap), %rsp */
1535                                 cfa->base = CFI_SP;
1536                                 cfa->offset = state->stack_size = -op->src.offset;
1537                                 state->drap_reg = CFI_UNDEFINED;
1538                                 state->drap = false;
1539                                 break;
1540                         }
1541
1542                         if (op->dest.reg == state->cfa.base) {
1543                                 WARN_FUNC("unsupported stack register modification",
1544                                           insn->sec, insn->offset);
1545                                 return -1;
1546                         }
1547
1548                         break;
1549
1550                 case OP_SRC_AND:
1551                         if (op->dest.reg != CFI_SP ||
1552                             (state->drap_reg != CFI_UNDEFINED && cfa->base != CFI_SP) ||
1553                             (state->drap_reg == CFI_UNDEFINED && cfa->base != CFI_BP)) {
1554                                 WARN_FUNC("unsupported stack pointer realignment",
1555                                           insn->sec, insn->offset);
1556                                 return -1;
1557                         }
1558
1559                         if (state->drap_reg != CFI_UNDEFINED) {
1560                                 /* drap: and imm, %rsp */
1561                                 cfa->base = state->drap_reg;
1562                                 cfa->offset = state->stack_size = 0;
1563                                 state->drap = true;
1564                         }
1565
1566                         /*
1567                          * Older versions of GCC (4.8ish) realign the stack
1568                          * without DRAP, with a frame pointer.
1569                          */
1570
1571                         break;
1572
1573                 case OP_SRC_POP:
1574                         if (!state->drap && op->dest.type == OP_DEST_REG &&
1575                             op->dest.reg == cfa->base) {
1576
1577                                 /* pop %rbp */
1578                                 cfa->base = CFI_SP;
1579                         }
1580
1581                         if (state->drap && cfa->base == CFI_BP_INDIRECT &&
1582                             op->dest.type == OP_DEST_REG &&
1583                             op->dest.reg == state->drap_reg &&
1584                             state->drap_offset == -state->stack_size) {
1585
1586                                 /* drap: pop %drap */
1587                                 cfa->base = state->drap_reg;
1588                                 cfa->offset = 0;
1589                                 state->drap_offset = -1;
1590
1591                         } else if (regs[op->dest.reg].offset == -state->stack_size) {
1592
1593                                 /* pop %reg */
1594                                 restore_reg(state, op->dest.reg);
1595                         }
1596
1597                         state->stack_size -= 8;
1598                         if (cfa->base == CFI_SP)
1599                                 cfa->offset -= 8;
1600
1601                         break;
1602
1603                 case OP_SRC_REG_INDIRECT:
1604                         if (state->drap && op->src.reg == CFI_BP &&
1605                             op->src.offset == state->drap_offset) {
1606
1607                                 /* drap: mov disp(%rbp), %drap */
1608                                 cfa->base = state->drap_reg;
1609                                 cfa->offset = 0;
1610                                 state->drap_offset = -1;
1611                         }
1612
1613                         if (state->drap && op->src.reg == CFI_BP &&
1614                             op->src.offset == regs[op->dest.reg].offset) {
1615
1616                                 /* drap: mov disp(%rbp), %reg */
1617                                 restore_reg(state, op->dest.reg);
1618
1619                         } else if (op->src.reg == cfa->base &&
1620                             op->src.offset == regs[op->dest.reg].offset + cfa->offset) {
1621
1622                                 /* mov disp(%rbp), %reg */
1623                                 /* mov disp(%rsp), %reg */
1624                                 restore_reg(state, op->dest.reg);
1625                         }
1626
1627                         break;
1628
1629                 default:
1630                         WARN_FUNC("unknown stack-related instruction",
1631                                   insn->sec, insn->offset);
1632                         return -1;
1633                 }
1634
1635                 break;
1636
1637         case OP_DEST_PUSH:
1638                 state->stack_size += 8;
1639                 if (cfa->base == CFI_SP)
1640                         cfa->offset += 8;
1641
1642                 if (op->src.type != OP_SRC_REG)
1643                         break;
1644
1645                 if (state->drap) {
1646                         if (op->src.reg == cfa->base && op->src.reg == state->drap_reg) {
1647
1648                                 /* drap: push %drap */
1649                                 cfa->base = CFI_BP_INDIRECT;
1650                                 cfa->offset = -state->stack_size;
1651
1652                                 /* save drap so we know when to restore it */
1653                                 state->drap_offset = -state->stack_size;
1654
1655                         } else if (op->src.reg == CFI_BP && cfa->base == state->drap_reg) {
1656
1657                                 /* drap: push %rbp */
1658                                 state->stack_size = 0;
1659
1660                         } else if (regs[op->src.reg].base == CFI_UNDEFINED) {
1661
1662                                 /* drap: push %reg */
1663                                 save_reg(state, op->src.reg, CFI_BP, -state->stack_size);
1664                         }
1665
1666                 } else {
1667
1668                         /* push %reg */
1669                         save_reg(state, op->src.reg, CFI_CFA, -state->stack_size);
1670                 }
1671
1672                 /* detect when asm code uses rbp as a scratch register */
1673                 if (!no_fp && insn->func && op->src.reg == CFI_BP &&
1674                     cfa->base != CFI_BP)
1675                         state->bp_scratch = true;
1676                 break;
1677
1678         case OP_DEST_REG_INDIRECT:
1679
1680                 if (state->drap) {
1681                         if (op->src.reg == cfa->base && op->src.reg == state->drap_reg) {
1682
1683                                 /* drap: mov %drap, disp(%rbp) */
1684                                 cfa->base = CFI_BP_INDIRECT;
1685                                 cfa->offset = op->dest.offset;
1686
1687                                 /* save drap offset so we know when to restore it */
1688                                 state->drap_offset = op->dest.offset;
1689                         }
1690
1691                         else if (regs[op->src.reg].base == CFI_UNDEFINED) {
1692
1693                                 /* drap: mov reg, disp(%rbp) */
1694                                 save_reg(state, op->src.reg, CFI_BP, op->dest.offset);
1695                         }
1696
1697                 } else if (op->dest.reg == cfa->base) {
1698
1699                         /* mov reg, disp(%rbp) */
1700                         /* mov reg, disp(%rsp) */
1701                         save_reg(state, op->src.reg, CFI_CFA,
1702                                  op->dest.offset - state->cfa.offset);
1703                 }
1704
1705                 break;
1706
1707         case OP_DEST_LEAVE:
1708                 if ((!state->drap && cfa->base != CFI_BP) ||
1709                     (state->drap && cfa->base != state->drap_reg)) {
1710                         WARN_FUNC("leave instruction with modified stack frame",
1711                                   insn->sec, insn->offset);
1712                         return -1;
1713                 }
1714
1715                 /* leave (mov %rbp, %rsp; pop %rbp) */
1716
1717                 state->stack_size = -state->regs[CFI_BP].offset - 8;
1718                 restore_reg(state, CFI_BP);
1719
1720                 if (!state->drap) {
1721                         cfa->base = CFI_SP;
1722                         cfa->offset -= 8;
1723                 }
1724
1725                 break;
1726
1727         case OP_DEST_MEM:
1728                 if (op->src.type != OP_SRC_POP) {
1729                         WARN_FUNC("unknown stack-related memory operation",
1730                                   insn->sec, insn->offset);
1731                         return -1;
1732                 }
1733
1734                 /* pop mem */
1735                 state->stack_size -= 8;
1736                 if (cfa->base == CFI_SP)
1737                         cfa->offset -= 8;
1738
1739                 break;
1740
1741         default:
1742                 WARN_FUNC("unknown stack-related instruction",
1743                           insn->sec, insn->offset);
1744                 return -1;
1745         }
1746
1747         return 0;
1748 }
1749
1750 static bool insn_state_match(struct instruction *insn, struct insn_state *state)
1751 {
1752         struct insn_state *state1 = &insn->state, *state2 = state;
1753         int i;
1754
1755         if (memcmp(&state1->cfa, &state2->cfa, sizeof(state1->cfa))) {
1756                 WARN_FUNC("stack state mismatch: cfa1=%d%+d cfa2=%d%+d",
1757                           insn->sec, insn->offset,
1758                           state1->cfa.base, state1->cfa.offset,
1759                           state2->cfa.base, state2->cfa.offset);
1760
1761         } else if (memcmp(&state1->regs, &state2->regs, sizeof(state1->regs))) {
1762                 for (i = 0; i < CFI_NUM_REGS; i++) {
1763                         if (!memcmp(&state1->regs[i], &state2->regs[i],
1764                                     sizeof(struct cfi_reg)))
1765                                 continue;
1766
1767                         WARN_FUNC("stack state mismatch: reg1[%d]=%d%+d reg2[%d]=%d%+d",
1768                                   insn->sec, insn->offset,
1769                                   i, state1->regs[i].base, state1->regs[i].offset,
1770                                   i, state2->regs[i].base, state2->regs[i].offset);
1771                         break;
1772                 }
1773
1774         } else if (state1->type != state2->type) {
1775                 WARN_FUNC("stack state mismatch: type1=%d type2=%d",
1776                           insn->sec, insn->offset, state1->type, state2->type);
1777
1778         } else if (state1->drap != state2->drap ||
1779                  (state1->drap && state1->drap_reg != state2->drap_reg) ||
1780                  (state1->drap && state1->drap_offset != state2->drap_offset)) {
1781                 WARN_FUNC("stack state mismatch: drap1=%d(%d,%d) drap2=%d(%d,%d)",
1782                           insn->sec, insn->offset,
1783                           state1->drap, state1->drap_reg, state1->drap_offset,
1784                           state2->drap, state2->drap_reg, state2->drap_offset);
1785
1786         } else
1787                 return true;
1788
1789         return false;
1790 }
1791
1792 /*
1793  * Follow the branch starting at the given instruction, and recursively follow
1794  * any other branches (jumps).  Meanwhile, track the frame pointer state at
1795  * each instruction and validate all the rules described in
1796  * tools/objtool/Documentation/stack-validation.txt.
1797  */
1798 static int validate_branch(struct objtool_file *file, struct instruction *first,
1799                            struct insn_state state)
1800 {
1801         struct alternative *alt;
1802         struct instruction *insn, *next_insn;
1803         struct section *sec;
1804         struct symbol *func = NULL;
1805         int ret;
1806
1807         insn = first;
1808         sec = insn->sec;
1809
1810         if (insn->alt_group && list_empty(&insn->alts)) {
1811                 WARN_FUNC("don't know how to handle branch to middle of alternative instruction group",
1812                           sec, insn->offset);
1813                 return 1;
1814         }
1815
1816         while (1) {
1817                 next_insn = next_insn_same_sec(file, insn);
1818
1819                 if (file->c_file && func && insn->func && func != insn->func->pfunc) {
1820                         WARN("%s() falls through to next function %s()",
1821                              func->name, insn->func->name);
1822                         return 1;
1823                 }
1824
1825                 func = insn->func ? insn->func->pfunc : NULL;
1826
1827                 if (func && insn->ignore) {
1828                         WARN_FUNC("BUG: why am I validating an ignored function?",
1829                                   sec, insn->offset);
1830                         return 1;
1831                 }
1832
1833                 if (insn->visited) {
1834                         if (!insn->hint && !insn_state_match(insn, &state))
1835                                 return 1;
1836
1837                         return 0;
1838                 }
1839
1840                 if (insn->hint) {
1841                         if (insn->restore) {
1842                                 struct instruction *save_insn, *i;
1843
1844                                 i = insn;
1845                                 save_insn = NULL;
1846                                 func_for_each_insn_continue_reverse(file, insn->func, i) {
1847                                         if (i->save) {
1848                                                 save_insn = i;
1849                                                 break;
1850                                         }
1851                                 }
1852
1853                                 if (!save_insn) {
1854                                         WARN_FUNC("no corresponding CFI save for CFI restore",
1855                                                   sec, insn->offset);
1856                                         return 1;
1857                                 }
1858
1859                                 if (!save_insn->visited) {
1860                                         /*
1861                                          * Oops, no state to copy yet.
1862                                          * Hopefully we can reach this
1863                                          * instruction from another branch
1864                                          * after the save insn has been
1865                                          * visited.
1866                                          */
1867                                         if (insn == first)
1868                                                 return 0;
1869
1870                                         WARN_FUNC("objtool isn't smart enough to handle this CFI save/restore combo",
1871                                                   sec, insn->offset);
1872                                         return 1;
1873                                 }
1874
1875                                 insn->state = save_insn->state;
1876                         }
1877
1878                         state = insn->state;
1879
1880                 } else
1881                         insn->state = state;
1882
1883                 insn->visited = true;
1884
1885                 if (!insn->ignore_alts) {
1886                         list_for_each_entry(alt, &insn->alts, list) {
1887                                 ret = validate_branch(file, alt->insn, state);
1888                                 if (ret) {
1889                                         if (backtrace)
1890                                                 BT_FUNC("(alt)", insn);
1891                                         return ret;
1892                                 }
1893                         }
1894                 }
1895
1896                 switch (insn->type) {
1897
1898                 case INSN_RETURN:
1899                         if (func && has_modified_stack_frame(&state)) {
1900                                 WARN_FUNC("return with modified stack frame",
1901                                           sec, insn->offset);
1902                                 return 1;
1903                         }
1904
1905                         if (state.bp_scratch) {
1906                                 WARN("%s uses BP as a scratch register",
1907                                      insn->func->name);
1908                                 return 1;
1909                         }
1910
1911                         return 0;
1912
1913                 case INSN_CALL:
1914                         if (is_fentry_call(insn))
1915                                 break;
1916
1917                         ret = dead_end_function(file, insn->call_dest);
1918                         if (ret == 1)
1919                                 return 0;
1920                         if (ret == -1)
1921                                 return 1;
1922
1923                         /* fallthrough */
1924                 case INSN_CALL_DYNAMIC:
1925                         if (!no_fp && func && !has_valid_stack_frame(&state)) {
1926                                 WARN_FUNC("call without frame pointer save/setup",
1927                                           sec, insn->offset);
1928                                 return 1;
1929                         }
1930                         break;
1931
1932                 case INSN_JUMP_CONDITIONAL:
1933                 case INSN_JUMP_UNCONDITIONAL:
1934                         if (insn->jump_dest &&
1935                             (!func || !insn->jump_dest->func ||
1936                              insn->jump_dest->func->pfunc == func)) {
1937                                 ret = validate_branch(file, insn->jump_dest,
1938                                                       state);
1939                                 if (ret) {
1940                                         if (backtrace)
1941                                                 BT_FUNC("(branch)", insn);
1942                                         return ret;
1943                                 }
1944
1945                         } else if (func && has_modified_stack_frame(&state)) {
1946                                 WARN_FUNC("sibling call from callable instruction with modified stack frame",
1947                                           sec, insn->offset);
1948                                 return 1;
1949                         }
1950
1951                         if (insn->type == INSN_JUMP_UNCONDITIONAL)
1952                                 return 0;
1953
1954                         break;
1955
1956                 case INSN_JUMP_DYNAMIC:
1957                         if (func && list_empty(&insn->alts) &&
1958                             has_modified_stack_frame(&state)) {
1959                                 WARN_FUNC("sibling call from callable instruction with modified stack frame",
1960                                           sec, insn->offset);
1961                                 return 1;
1962                         }
1963
1964                         return 0;
1965
1966                 case INSN_CONTEXT_SWITCH:
1967                         if (func && (!next_insn || !next_insn->hint)) {
1968                                 WARN_FUNC("unsupported instruction in callable function",
1969                                           sec, insn->offset);
1970                                 return 1;
1971                         }
1972                         return 0;
1973
1974                 case INSN_STACK:
1975                         if (update_insn_state(insn, &state))
1976                                 return 1;
1977
1978                         break;
1979
1980                 default:
1981                         break;
1982                 }
1983
1984                 if (insn->dead_end)
1985                         return 0;
1986
1987                 if (!next_insn) {
1988                         if (state.cfa.base == CFI_UNDEFINED)
1989                                 return 0;
1990                         WARN("%s: unexpected end of section", sec->name);
1991                         return 1;
1992                 }
1993
1994                 insn = next_insn;
1995         }
1996
1997         return 0;
1998 }
1999
2000 static int validate_unwind_hints(struct objtool_file *file)
2001 {
2002         struct instruction *insn;
2003         int ret, warnings = 0;
2004         struct insn_state state;
2005
2006         if (!file->hints)
2007                 return 0;
2008
2009         clear_insn_state(&state);
2010
2011         for_each_insn(file, insn) {
2012                 if (insn->hint && !insn->visited) {
2013                         ret = validate_branch(file, insn, state);
2014                         if (ret && backtrace)
2015                                 BT_FUNC("<=== (hint)", insn);
2016                         warnings += ret;
2017                 }
2018         }
2019
2020         return warnings;
2021 }
2022
2023 static int validate_retpoline(struct objtool_file *file)
2024 {
2025         struct instruction *insn;
2026         int warnings = 0;
2027
2028         for_each_insn(file, insn) {
2029                 if (insn->type != INSN_JUMP_DYNAMIC &&
2030                     insn->type != INSN_CALL_DYNAMIC)
2031                         continue;
2032
2033                 if (insn->retpoline_safe)
2034                         continue;
2035
2036                 /*
2037                  * .init.text code is ran before userspace and thus doesn't
2038                  * strictly need retpolines, except for modules which are
2039                  * loaded late, they very much do need retpoline in their
2040                  * .init.text
2041                  */
2042                 if (!strcmp(insn->sec->name, ".init.text") && !module)
2043                         continue;
2044
2045                 WARN_FUNC("indirect %s found in RETPOLINE build",
2046                           insn->sec, insn->offset,
2047                           insn->type == INSN_JUMP_DYNAMIC ? "jump" : "call");
2048
2049                 warnings++;
2050         }
2051
2052         return warnings;
2053 }
2054
2055 static bool is_kasan_insn(struct instruction *insn)
2056 {
2057         return (insn->type == INSN_CALL &&
2058                 !strcmp(insn->call_dest->name, "__asan_handle_no_return"));
2059 }
2060
2061 static bool is_ubsan_insn(struct instruction *insn)
2062 {
2063         return (insn->type == INSN_CALL &&
2064                 !strcmp(insn->call_dest->name,
2065                         "__ubsan_handle_builtin_unreachable"));
2066 }
2067
2068 static bool ignore_unreachable_insn(struct instruction *insn)
2069 {
2070         int i;
2071
2072         if (insn->ignore || insn->type == INSN_NOP)
2073                 return true;
2074
2075         /*
2076          * Ignore any unused exceptions.  This can happen when a whitelisted
2077          * function has an exception table entry.
2078          *
2079          * Also ignore alternative replacement instructions.  This can happen
2080          * when a whitelisted function uses one of the ALTERNATIVE macros.
2081          */
2082         if (!strcmp(insn->sec->name, ".fixup") ||
2083             !strcmp(insn->sec->name, ".altinstr_replacement") ||
2084             !strcmp(insn->sec->name, ".altinstr_aux"))
2085                 return true;
2086
2087         /*
2088          * Check if this (or a subsequent) instruction is related to
2089          * CONFIG_UBSAN or CONFIG_KASAN.
2090          *
2091          * End the search at 5 instructions to avoid going into the weeds.
2092          */
2093         if (!insn->func)
2094                 return false;
2095         for (i = 0; i < 5; i++) {
2096
2097                 if (is_kasan_insn(insn) || is_ubsan_insn(insn))
2098                         return true;
2099
2100                 if (insn->type == INSN_JUMP_UNCONDITIONAL) {
2101                         if (insn->jump_dest &&
2102                             insn->jump_dest->func == insn->func) {
2103                                 insn = insn->jump_dest;
2104                                 continue;
2105                         }
2106
2107                         break;
2108                 }
2109
2110                 if (insn->offset + insn->len >= insn->func->offset + insn->func->len)
2111                         break;
2112
2113                 insn = list_next_entry(insn, list);
2114         }
2115
2116         return false;
2117 }
2118
2119 static int validate_functions(struct objtool_file *file)
2120 {
2121         struct section *sec;
2122         struct symbol *func;
2123         struct instruction *insn;
2124         struct insn_state state;
2125         int ret, warnings = 0;
2126
2127         clear_insn_state(&state);
2128
2129         state.cfa = initial_func_cfi.cfa;
2130         memcpy(&state.regs, &initial_func_cfi.regs,
2131                CFI_NUM_REGS * sizeof(struct cfi_reg));
2132         state.stack_size = initial_func_cfi.cfa.offset;
2133
2134         for_each_sec(file, sec) {
2135                 list_for_each_entry(func, &sec->symbol_list, list) {
2136                         if (func->type != STT_FUNC || func->pfunc != func)
2137                                 continue;
2138
2139                         insn = find_insn(file, sec, func->offset);
2140                         if (!insn || insn->ignore)
2141                                 continue;
2142
2143                         ret = validate_branch(file, insn, state);
2144                         if (ret && backtrace)
2145                                 BT_FUNC("<=== (func)", insn);
2146                         warnings += ret;
2147                 }
2148         }
2149
2150         return warnings;
2151 }
2152
2153 static int validate_reachable_instructions(struct objtool_file *file)
2154 {
2155         struct instruction *insn;
2156
2157         if (file->ignore_unreachables)
2158                 return 0;
2159
2160         for_each_insn(file, insn) {
2161                 if (insn->visited || ignore_unreachable_insn(insn))
2162                         continue;
2163
2164                 WARN_FUNC("unreachable instruction", insn->sec, insn->offset);
2165                 return 1;
2166         }
2167
2168         return 0;
2169 }
2170
2171 static void cleanup(struct objtool_file *file)
2172 {
2173         struct instruction *insn, *tmpinsn;
2174         struct alternative *alt, *tmpalt;
2175
2176         list_for_each_entry_safe(insn, tmpinsn, &file->insn_list, list) {
2177                 list_for_each_entry_safe(alt, tmpalt, &insn->alts, list) {
2178                         list_del(&alt->list);
2179                         free(alt);
2180                 }
2181                 list_del(&insn->list);
2182                 hash_del(&insn->hash);
2183                 free(insn);
2184         }
2185         elf_close(file->elf);
2186 }
2187
2188 static struct objtool_file file;
2189
2190 int check(const char *_objname, bool orc)
2191 {
2192         int ret, warnings = 0;
2193
2194         objname = _objname;
2195
2196         file.elf = elf_open(objname, orc ? O_RDWR : O_RDONLY);
2197         if (!file.elf)
2198                 return 1;
2199
2200         INIT_LIST_HEAD(&file.insn_list);
2201         hash_init(file.insn_hash);
2202         file.c_file = find_section_by_name(file.elf, ".comment");
2203         file.ignore_unreachables = no_unreachable;
2204         file.hints = false;
2205
2206         arch_initial_func_cfi_state(&initial_func_cfi);
2207
2208         ret = decode_sections(&file);
2209         if (ret < 0)
2210                 goto out;
2211         warnings += ret;
2212
2213         if (list_empty(&file.insn_list))
2214                 goto out;
2215
2216         if (retpoline) {
2217                 ret = validate_retpoline(&file);
2218                 if (ret < 0)
2219                         return ret;
2220                 warnings += ret;
2221         }
2222
2223         ret = validate_functions(&file);
2224         if (ret < 0)
2225                 goto out;
2226         warnings += ret;
2227
2228         ret = validate_unwind_hints(&file);
2229         if (ret < 0)
2230                 goto out;
2231         warnings += ret;
2232
2233         if (!warnings) {
2234                 ret = validate_reachable_instructions(&file);
2235                 if (ret < 0)
2236                         goto out;
2237                 warnings += ret;
2238         }
2239
2240         if (orc) {
2241                 ret = create_orc(&file);
2242                 if (ret < 0)
2243                         goto out;
2244
2245                 ret = create_orc_sections(&file);
2246                 if (ret < 0)
2247                         goto out;
2248
2249                 ret = elf_write(file.elf);
2250                 if (ret < 0)
2251                         goto out;
2252         }
2253
2254 out:
2255         cleanup(&file);
2256
2257         /* ignore warnings for now until we get all the code cleaned up */
2258         if (ret || warnings)
2259                 return 0;
2260         return 0;
2261 }