Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751927AbbHOMtT (ORCPT ); Sat, 15 Aug 2015 08:49:19 -0400 Received: from mx1.redhat.com ([209.132.183.28]:60129 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751191AbbHOMtQ (ORCPT ); Sat, 15 Aug 2015 08:49:16 -0400 Date: Sat, 15 Aug 2015 07:49:13 -0500 From: Josh Poimboeuf To: Andrew Morton Cc: Thomas Gleixner , Ingo Molnar , "H. Peter Anvin" , x86@kernel.org, linux-kernel@vger.kernel.org, Michal Marek , Peter Zijlstra , Andy Lutomirski , Borislav Petkov , Linus Torvalds , Andi Kleen , Pedro Alves , Namhyung Kim , Bernd Petrovitsch , Chris J Arges , live-patching@vger.kernel.org Subject: Re: [PATCH v10 03/20] x86/stackvalidate: Compile-time stack validation Message-ID: <20150815124913.GB3254@treble.hsd1.ky.comcast.net> References: <07bf51833b5e1c52bfd9a4dbda41b80c508dffff.1439521412.git.jpoimboe@redhat.com> <20150815002354.7fb2f21e.akpm@linux-foundation.org> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline In-Reply-To: <20150815002354.7fb2f21e.akpm@linux-foundation.org> User-Agent: Mutt/1.5.23.1-rc1 (2014-03-12) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 7917 Lines: 225 On Sat, Aug 15, 2015 at 12:23:54AM -0700, Andrew Morton wrote: > On Thu, 13 Aug 2015 22:10:24 -0500 Josh Poimboeuf wrote: > > > This adds a CONFIG_STACK_VALIDATION option which enables a host tool > > named stackvalidate which runs at compile time. > > It would be useful to > > - show example output for a typical error site > > - describe the consequences of that error (ie: why should we fix > these things?) > > - describe what needs to be done to repair these sites. > > > IOW, what do we gain from merging all this stuff? I attempted to do all that in Documentation/stack-validation.txt which is in patch 03/20. Does it address your concerns? Here it is: Compile-time stack validation ============================= Overview -------- The CONFIG_STACK_VALIDATION option enables a host tool named stackvalidate which runs at compile time. It analyzes every .o file and ensures the validity of its stack metadata. It enforces a set of rules on asm code and C inline assembly code so that stack traces can be reliable. Currently it only checks frame pointer usage, but there are plans to add CFI validation for C files and CFI generation for asm files. For each function, it recursively follows all possible code paths and validates the correct frame pointer state at each instruction. It also follows code paths involving special sections, like .altinstructions, __jump_table, and __ex_table, which can add alternative execution paths to a given instruction (or set of instructions). Similarly, it knows how to follow switch statements, for which gcc sometimes uses jump tables. Rules ----- To achieve the validation, stackvalidate enforces the following rules: 1. Each callable function must be annotated as such with the ELF function type. In asm code, this is typically done using the ENTRY/ENDPROC macros. If stackvalidate finds a return instruction outside of a function, it flags an error since that usually indicates callable code which should be annotated accordingly. 2. Conversely, each section of code which is *not* callable should *not* be annotated as an ELF function. The ENDPROC macro shouldn't be used in this case. 3. Each callable function which calls another function must have the correct frame pointer logic, if required by CONFIG_FRAME_POINTER or the architecture's back chain rules. This can by done in asm code with the FRAME_BEGIN/FRAME_END macros. 4. Dynamic jumps and jumps to undefined symbols are only allowed if: a) the jump is part of a switch statement; or b) the jump matches sibling call semantics and the frame pointer has the same value it had on function entry. 5. A callable function may not execute kernel entry/exit instructions. The only code which needs such instructions is kernel entry code, which shouldn't be be in callable functions anyway. Errors in .S files ------------------ If you're getting an error in a compiled .S file which you don't understand, first make sure that the affected code follows the above rules. Here are some examples of common problems and suggestions for how to fix them. 1. stackvalidate: asm_file.o: func()+0x128: call without frame pointer save/setup The func() function made a function call without first saving and/or updating the frame pointer. If func() is indeed a callable function, add proper frame pointer logic using the FP_SAVE and FP_RESTORE macros. Otherwise, remove its ELF function annotation by changing ENDPROC to END. If you're getting this error in a .c file, see the "Errors in .c files" section. 2. stackvalidate: asm_file.o: .text+0x53: return instruction outside of a callable function A return instruction was detected, but stackvalidate couldn't find a way for a callable function to reach the instruction. If the return instruction is inside (or reachable from) a callable function, the function needs to be annotated with the ENTRY/ENDPROC macros. If you _really_ need a return instruction outside of a function, and are 100% sure that it won't affect stack traces, you can tell stackvalidate to ignore it. See the "Adding exceptions" section below. 3. stackvalidate: asm_file.o: func()+0x9: function has unreachable instruction The instruction lives inside of a callable function, but there's no possible control flow path from the beginning of the function to the instruction. If the instruction is actually needed, and it's actually in a callable function, ensure that its function is properly annotated with ENTRY/ENDPROC. If it's not actually in a callable function (e.g. kernel entry code), change ENDPROC to END. 4. stackvalidate: asm_file.o: func(): can't find starting instruction or stackvalidate: asm_file.o: func()+0x11dd: can't decode instruction Did you put data in a text section? If so, that can confuse stackvalidate's instruction decoder. Move the data to a more appropriate section like .data or .rodata. 5. stackvalidate: asm_file.o: func()+0x6: kernel entry/exit from callable instruction This is a kernel entry/exit instruction like sysenter or sysret. Such instructions aren't allowed in a callable function, and are most likely part of the kernel entry code. If the instruction isn't actually in a callable function, change ENDPROC to END. 6. stackvalidate: asm_file.o: func()+0x26: sibling call from callable instruction with changed frame pointer This is a dynamic jump or a jump to an undefined symbol. Stackvalidate assumed it's a sibling call and detected that the frame pointer wasn't first restored to its original state. If it's not really a sibling call, you may need to move the destination code to the local file. If the instruction is not actually in a callable function (e.g. kernel entry code), change ENDPROC to END. 7. stackvalidate: asm_file: func()+0x5c: frame pointer state mismatch The instruction's frame pointer state is inconsistent, depending on which execution path was taken to reach the instruction. Make sure the function pushes and sets up the frame pointer (for x86_64, this means rbp) at the beginning of the function and pops it at the end of the function. Also make sure that no other code in the function touches the frame pointer. Errors in .c files ------------------ If you're getting a stackvalidate error in a compiled .c file, chances are the file uses an asm() statement which has a "call" instruction. An asm() statement with a call instruction must declare the use of the stack pointer in its output operand. For example, on x86_64: register void *__sp asm("rsp"); asm volatile("call func" : "+r" (__sp)); Otherwise the stack frame may not get created before the call. Another possible cause for errors in C code is if the Makefile removes -fno-omit-frame-pointer or adds -fomit-frame-pointer to the gcc options. Also see the above section for .S file errors for more information what the individual error messages mean. Adding exceptions ----------------- If you _really_ need stackvalidate to ignore something, and are 100% sure that it won't affect kernel stack traces, you can tell stackvalidate to ignore it: - To skip validation of an instruction, use the STACKVALIDATE_IGNORE_INSN macro immediately before the instruction. - To skip validation of a function, use the STACKVALIDATE_IGNORE_FUNC macro. - To skip validation of a file, add "STACKVALIDATE_filename.o := n" to the Makefile. - To skip validation of a directory, add "STACKVALIDATE := n" to the Makefile. -- Josh -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/