[PATCH v2 11/20] objtool: Detect code coverage instrumentation in noinstr code

[Sasha Levin <sashal@kernel.org>]

gcov and Clang's source-based code coverage update their counters
inline, rather than by calling into a runtime like KCOV does, so
coverage instrumentation in noinstr code goes unnoticed by the noinstr
validation of call destinations.

Flag instructions in noinstr code, outside of instrumentation_begin()
and instrumentation_end() sections, that reference coverage counters:
GCC's __gcov<N>.* counters (including the MC/DC counters), Clang's gcov
__llvm_gcov_ctr* counters, and the __llvm_prf_cnts and __llvm_prf_bits
sections of Clang's source-based code coverage.

Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 tools/objtool/check.c               | 60 ++++++++++++++++++++++++++++-
 tools/objtool/include/objtool/elf.h |  1 +
 2 files changed, 60 insertions(+), 1 deletion(-)

diff --git a/tools/objtool/check.c b/tools/objtool/check.c
index 931c5c412f15d..b0ea6e42c4fda 100644
--- a/tools/objtool/check.c
+++ b/tools/objtool/check.c
@@ -4,6 +4,7 @@
  */
 
 #define _GNU_SOURCE /* memmem() */
+#include <ctype.h>
 #include <fnmatch.h>
 #include <string.h>
 #include <stdlib.h>
@@ -2490,6 +2491,21 @@ static bool is_profiling_func(const char *name)
 	return false;
 }
 
+/*
+ * Return true if sym is a code coverage counter: GCC's __gcov<N>.* and
+ * Clang's __llvm_gcov_ctr* gcov counters, or the counters and MC/DC bitmaps
+ * of Clang's source-based code coverage.
+ */
+static bool is_coverage_counter(struct symbol *sym)
+{
+	if (!strcmp(sym->sec->name, "__llvm_prf_cnts") ||
+	    !strcmp(sym->sec->name, "__llvm_prf_bits"))
+		return true;
+
+	return (strstarts(sym->name, "__gcov") && isdigit((unsigned char)sym->name[6])) ||
+	       strstarts(sym->name, "__llvm_gcov_ctr");
+}
+
 static int classify_symbols(struct objtool_file *file)
 {
 	struct symbol *func;
@@ -2499,6 +2515,9 @@ static int classify_symbols(struct objtool_file *file)
 		if (is_notype_sym(func) && strstarts(func->name, ".L"))
 			func->local_label = true;
 
+		if (is_coverage_counter(func))
+			func->coverage_counter = true;
+
 		if (!is_global_sym(func))
 			continue;
 
@@ -3508,6 +3527,39 @@ static inline bool noinstr_call_dest(struct objtool_file *file,
 	return false;
 }
 
+/*
+ * Code coverage instrumentation (gcov, Clang's source-based coverage) updates
+ * its counters inline rather than through calls, so it can't be caught by
+ * checking the call destinations of noinstr code.
+ */
+static bool insn_updates_coverage(struct objtool_file *file,
+				  struct instruction *insn)
+{
+	struct symbol *sym;
+	struct reloc *reloc;
+
+	for (reloc = insn_reloc(file, insn);
+	     reloc;
+	     reloc = find_reloc_by_dest_range(file->elf, insn->sec,
+					      reloc_offset(reloc) + 1,
+					      insn->offset + insn->len -
+					      (reloc_offset(reloc) + 1))) {
+
+		sym = reloc->sym;
+		if (is_sec_sym(sym)) {
+			sym = find_symbol_containing(sym->sec,
+						     arch_insn_adjusted_addend(insn, reloc));
+			if (!sym)
+				sym = reloc->sym;
+		}
+
+		if (sym->coverage_counter)
+			return true;
+	}
+
+	return false;
+}
+
 static int validate_call(struct objtool_file *file,
 			 struct instruction *insn,
 			 struct insn_state *state)
@@ -3678,9 +3730,15 @@ static int validate_insn(struct objtool_file *file, struct symbol *func,
 		nr_insns_visited++;
 	}
 
-	if (statep->noinstr)
+	if (statep->noinstr) {
 		statep->instr += insn->instr;
 
+		if (statep->instr <= 0 && insn_updates_coverage(file, insn)) {
+			WARN_INSN(insn, "coverage counter update in .noinstr.text section");
+			return 1;
+		}
+	}
+
 	if (insn->hint) {
 		if (insn->restore) {
 			struct instruction *save_insn, *i;
diff --git a/tools/objtool/include/objtool/elf.h b/tools/objtool/include/objtool/elf.h
index a82517a76a0f6..202e77f26785a 100644
--- a/tools/objtool/include/objtool/elf.h
+++ b/tools/objtool/include/objtool/elf.h
@@ -84,6 +84,7 @@ struct symbol {
 	u8 return_thunk      : 1;
 	u8 fentry            : 1;
 	u8 profiling_func    : 1;
+	u8 coverage_counter  : 1;
 	u8 warned	     : 1;
 	u8 embedded_insn     : 1;
 	u8 local_label       : 1;
-- 
2.53.0