363 lines
14 KiB
Plaintext
363 lines
14 KiB
Plaintext
Compile-time stack metadata validation
|
|
======================================
|
|
|
|
|
|
Overview
|
|
--------
|
|
|
|
The kernel CONFIG_STACK_VALIDATION option enables a host tool named
|
|
objtool which runs at compile time. It has a "check" subcommand which
|
|
analyzes every .o file and ensures the validity of its stack metadata.
|
|
It enforces a set of rules on asm code and C inline assembly code so
|
|
that stack traces can be reliable.
|
|
|
|
Currently it only checks frame pointer usage, but there are plans to add
|
|
CFI validation for C files and CFI generation for asm files.
|
|
|
|
For each function, it recursively follows all possible code paths and
|
|
validates the correct frame pointer state at each instruction.
|
|
|
|
It also follows code paths involving special sections, like
|
|
.altinstructions, __jump_table, and __ex_table, which can add
|
|
alternative execution paths to a given instruction (or set of
|
|
instructions). Similarly, it knows how to follow switch statements, for
|
|
which gcc sometimes uses jump tables.
|
|
|
|
|
|
Why do we need stack metadata validation?
|
|
-----------------------------------------
|
|
|
|
Here are some of the benefits of validating stack metadata:
|
|
|
|
a) More reliable stack traces for frame pointer enabled kernels
|
|
|
|
Frame pointers are used for debugging purposes. They allow runtime
|
|
code and debug tools to be able to walk the stack to determine the
|
|
chain of function call sites that led to the currently executing
|
|
code.
|
|
|
|
For some architectures, frame pointers are enabled by
|
|
CONFIG_FRAME_POINTER. For some other architectures they may be
|
|
required by the ABI (sometimes referred to as "backchain pointers").
|
|
|
|
For C code, gcc automatically generates instructions for setting up
|
|
frame pointers when the -fno-omit-frame-pointer option is used.
|
|
|
|
But for asm code, the frame setup instructions have to be written by
|
|
hand, which most people don't do. So the end result is that
|
|
CONFIG_FRAME_POINTER is honored for C code but not for most asm code.
|
|
|
|
For stack traces based on frame pointers to be reliable, all
|
|
functions which call other functions must first create a stack frame
|
|
and update the frame pointer. If a first function doesn't properly
|
|
create a stack frame before calling a second function, the *caller*
|
|
of the first function will be skipped on the stack trace.
|
|
|
|
For example, consider the following example backtrace with frame
|
|
pointers enabled:
|
|
|
|
[<ffffffff81812584>] dump_stack+0x4b/0x63
|
|
[<ffffffff812d6dc2>] cmdline_proc_show+0x12/0x30
|
|
[<ffffffff8127f568>] seq_read+0x108/0x3e0
|
|
[<ffffffff812cce62>] proc_reg_read+0x42/0x70
|
|
[<ffffffff81256197>] __vfs_read+0x37/0x100
|
|
[<ffffffff81256b16>] vfs_read+0x86/0x130
|
|
[<ffffffff81257898>] SyS_read+0x58/0xd0
|
|
[<ffffffff8181c1f2>] entry_SYSCALL_64_fastpath+0x12/0x76
|
|
|
|
It correctly shows that the caller of cmdline_proc_show() is
|
|
seq_read().
|
|
|
|
If we remove the frame pointer logic from cmdline_proc_show() by
|
|
replacing the frame pointer related instructions with nops, here's
|
|
what it looks like instead:
|
|
|
|
[<ffffffff81812584>] dump_stack+0x4b/0x63
|
|
[<ffffffff812d6dc2>] cmdline_proc_show+0x12/0x30
|
|
[<ffffffff812cce62>] proc_reg_read+0x42/0x70
|
|
[<ffffffff81256197>] __vfs_read+0x37/0x100
|
|
[<ffffffff81256b16>] vfs_read+0x86/0x130
|
|
[<ffffffff81257898>] SyS_read+0x58/0xd0
|
|
[<ffffffff8181c1f2>] entry_SYSCALL_64_fastpath+0x12/0x76
|
|
|
|
Notice that cmdline_proc_show()'s caller, seq_read(), has been
|
|
skipped. Instead the stack trace seems to show that
|
|
cmdline_proc_show() was called by proc_reg_read().
|
|
|
|
The benefit of objtool here is that because it ensures that *all*
|
|
functions honor CONFIG_FRAME_POINTER, no functions will ever[*] be
|
|
skipped on a stack trace.
|
|
|
|
[*] unless an interrupt or exception has occurred at the very
|
|
beginning of a function before the stack frame has been created,
|
|
or at the very end of the function after the stack frame has been
|
|
destroyed. This is an inherent limitation of frame pointers.
|
|
|
|
b) 100% reliable stack traces for DWARF enabled kernels
|
|
|
|
(NOTE: This is not yet implemented)
|
|
|
|
As an alternative to frame pointers, DWARF Call Frame Information
|
|
(CFI) metadata can be used to walk the stack. Unlike frame pointers,
|
|
CFI metadata is out of band. So it doesn't affect runtime
|
|
performance and it can be reliable even when interrupts or exceptions
|
|
are involved.
|
|
|
|
For C code, gcc automatically generates DWARF CFI metadata. But for
|
|
asm code, generating CFI is a tedious manual approach which requires
|
|
manually placed .cfi assembler macros to be scattered throughout the
|
|
code. It's clumsy and very easy to get wrong, and it makes the real
|
|
code harder to read.
|
|
|
|
Stacktool will improve this situation in several ways. For code
|
|
which already has CFI annotations, it will validate them. For code
|
|
which doesn't have CFI annotations, it will generate them. So an
|
|
architecture can opt to strip out all the manual .cfi annotations
|
|
from their asm code and have objtool generate them instead.
|
|
|
|
We might also add a runtime stack validation debug option where we
|
|
periodically walk the stack from schedule() and/or an NMI to ensure
|
|
that the stack metadata is sane and that we reach the bottom of the
|
|
stack.
|
|
|
|
So the benefit of objtool here will be that external tooling should
|
|
always show perfect stack traces. And the same will be true for
|
|
kernel warning/oops traces if the architecture has a runtime DWARF
|
|
unwinder.
|
|
|
|
c) Higher live patching compatibility rate
|
|
|
|
(NOTE: This is not yet implemented)
|
|
|
|
Currently with CONFIG_LIVEPATCH there's a basic live patching
|
|
framework which is safe for roughly 85-90% of "security" fixes. But
|
|
patches can't have complex features like function dependency or
|
|
prototype changes, or data structure changes.
|
|
|
|
There's a strong need to support patches which have the more complex
|
|
features so that the patch compatibility rate for security fixes can
|
|
eventually approach something resembling 100%. To achieve that, a
|
|
"consistency model" is needed, which allows tasks to be safely
|
|
transitioned from an unpatched state to a patched state.
|
|
|
|
One of the key requirements of the currently proposed livepatch
|
|
consistency model [*] is that it needs to walk the stack of each
|
|
sleeping task to determine if it can be transitioned to the patched
|
|
state. If objtool can ensure that stack traces are reliable, this
|
|
consistency model can be used and the live patching compatibility
|
|
rate can be improved significantly.
|
|
|
|
[*] https://lkml.kernel.org/r/cover.1423499826.git.jpoimboe@redhat.com
|
|
|
|
|
|
Rules
|
|
-----
|
|
|
|
To achieve the validation, objtool enforces the following rules:
|
|
|
|
1. Each callable function must be annotated as such with the ELF
|
|
function type. In asm code, this is typically done using the
|
|
ENTRY/ENDPROC macros. If objtool finds a return instruction
|
|
outside of a function, it flags an error since that usually indicates
|
|
callable code which should be annotated accordingly.
|
|
|
|
This rule is needed so that objtool can properly identify each
|
|
callable function in order to analyze its stack metadata.
|
|
|
|
2. Conversely, each section of code which is *not* callable should *not*
|
|
be annotated as an ELF function. The ENDPROC macro shouldn't be used
|
|
in this case.
|
|
|
|
This rule is needed so that objtool can ignore non-callable code.
|
|
Such code doesn't have to follow any of the other rules.
|
|
|
|
3. Each callable function which calls another function must have the
|
|
correct frame pointer logic, if required by CONFIG_FRAME_POINTER or
|
|
the architecture's back chain rules. This can by done in asm code
|
|
with the FRAME_BEGIN/FRAME_END macros.
|
|
|
|
This rule ensures that frame pointer based stack traces will work as
|
|
designed. If function A doesn't create a stack frame before calling
|
|
function B, the _caller_ of function A will be skipped on the stack
|
|
trace.
|
|
|
|
4. Dynamic jumps and jumps to undefined symbols are only allowed if:
|
|
|
|
a) the jump is part of a switch statement; or
|
|
|
|
b) the jump matches sibling call semantics and the frame pointer has
|
|
the same value it had on function entry.
|
|
|
|
This rule is needed so that objtool can reliably analyze all of a
|
|
function's code paths. If a function jumps to code in another file,
|
|
and it's not a sibling call, objtool has no way to follow the jump
|
|
because it only analyzes a single file at a time.
|
|
|
|
5. A callable function may not execute kernel entry/exit instructions.
|
|
The only code which needs such instructions is kernel entry code,
|
|
which shouldn't be be in callable functions anyway.
|
|
|
|
This rule is just a sanity check to ensure that callable functions
|
|
return normally.
|
|
|
|
|
|
Errors in .S files
|
|
------------------
|
|
|
|
If you're getting an error in a compiled .S file which you don't
|
|
understand, first make sure that the affected code follows the above
|
|
rules.
|
|
|
|
Here are some examples of common warnings reported by objtool, what
|
|
they mean, and suggestions for how to fix them.
|
|
|
|
|
|
1. asm_file.o: warning: objtool: func()+0x128: call without frame pointer save/setup
|
|
|
|
The func() function made a function call without first saving and/or
|
|
updating the frame pointer.
|
|
|
|
If func() is indeed a callable function, add proper frame pointer
|
|
logic using the FRAME_BEGIN and FRAME_END macros. Otherwise, remove
|
|
its ELF function annotation by changing ENDPROC to END.
|
|
|
|
If you're getting this error in a .c file, see the "Errors in .c
|
|
files" section.
|
|
|
|
|
|
2. asm_file.o: warning: objtool: .text+0x53: return instruction outside of a callable function
|
|
|
|
A return instruction was detected, but objtool couldn't find a way
|
|
for a callable function to reach the instruction.
|
|
|
|
If the return instruction is inside (or reachable from) a callable
|
|
function, the function needs to be annotated with the ENTRY/ENDPROC
|
|
macros.
|
|
|
|
If you _really_ need a return instruction outside of a function, and
|
|
are 100% sure that it won't affect stack traces, you can tell
|
|
objtool to ignore it. See the "Adding exceptions" section below.
|
|
|
|
|
|
3. asm_file.o: warning: objtool: func()+0x9: function has unreachable instruction
|
|
|
|
The instruction lives inside of a callable function, but there's no
|
|
possible control flow path from the beginning of the function to the
|
|
instruction.
|
|
|
|
If the instruction is actually needed, and it's actually in a
|
|
callable function, ensure that its function is properly annotated
|
|
with ENTRY/ENDPROC.
|
|
|
|
If it's not actually in a callable function (e.g. kernel entry code),
|
|
change ENDPROC to END.
|
|
|
|
|
|
4. asm_file.o: warning: objtool: func(): can't find starting instruction
|
|
or
|
|
asm_file.o: warning: objtool: func()+0x11dd: can't decode instruction
|
|
|
|
Did you put data in a text section? If so, that can confuse
|
|
objtool's instruction decoder. Move the data to a more appropriate
|
|
section like .data or .rodata.
|
|
|
|
|
|
5. asm_file.o: warning: objtool: func()+0x6: kernel entry/exit from callable instruction
|
|
|
|
This is a kernel entry/exit instruction like sysenter or sysret.
|
|
Such instructions aren't allowed in a callable function, and are most
|
|
likely part of the kernel entry code.
|
|
|
|
If the instruction isn't actually in a callable function, change
|
|
ENDPROC to END.
|
|
|
|
|
|
6. asm_file.o: warning: objtool: func()+0x26: sibling call from callable instruction with changed frame pointer
|
|
|
|
This is a dynamic jump or a jump to an undefined symbol. Stacktool
|
|
assumed it's a sibling call and detected that the frame pointer
|
|
wasn't first restored to its original state.
|
|
|
|
If it's not really a sibling call, you may need to move the
|
|
destination code to the local file.
|
|
|
|
If the instruction is not actually in a callable function (e.g.
|
|
kernel entry code), change ENDPROC to END.
|
|
|
|
|
|
7. asm_file: warning: objtool: func()+0x5c: frame pointer state mismatch
|
|
|
|
The instruction's frame pointer state is inconsistent, depending on
|
|
which execution path was taken to reach the instruction.
|
|
|
|
Make sure the function pushes and sets up the frame pointer (for
|
|
x86_64, this means rbp) at the beginning of the function and pops it
|
|
at the end of the function. Also make sure that no other code in the
|
|
function touches the frame pointer.
|
|
|
|
|
|
Errors in .c files
|
|
------------------
|
|
|
|
1. c_file.o: warning: objtool: funcA() falls through to next function funcB()
|
|
|
|
This means that funcA() doesn't end with a return instruction or an
|
|
unconditional jump, and that objtool has determined that the function
|
|
can fall through into the next function. There could be different
|
|
reasons for this:
|
|
|
|
1) funcA()'s last instruction is a call to a "noreturn" function like
|
|
panic(). In this case the noreturn function needs to be added to
|
|
objtool's hard-coded global_noreturns array. Feel free to bug the
|
|
objtool maintainer, or you can submit a patch.
|
|
|
|
2) funcA() uses the unreachable() annotation in a section of code
|
|
that is actually reachable.
|
|
|
|
3) If funcA() calls an inline function, the object code for funcA()
|
|
might be corrupt due to a gcc bug. For more details, see:
|
|
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=70646
|
|
|
|
2. If you're getting any other objtool error in a compiled .c file, it
|
|
may be because the file uses an asm() statement which has a "call"
|
|
instruction. An asm() statement with a call instruction must declare
|
|
the use of the stack pointer in its output operand. For example, on
|
|
x86_64:
|
|
|
|
register void *__sp asm("rsp");
|
|
asm volatile("call func" : "+r" (__sp));
|
|
|
|
Otherwise the stack frame may not get created before the call.
|
|
|
|
3. Another possible cause for errors in C code is if the Makefile removes
|
|
-fno-omit-frame-pointer or adds -fomit-frame-pointer to the gcc options.
|
|
|
|
Also see the above section for .S file errors for more information what
|
|
the individual error messages mean.
|
|
|
|
If the error doesn't seem to make sense, it could be a bug in objtool.
|
|
Feel free to ask the objtool maintainer for help.
|
|
|
|
|
|
Adding exceptions
|
|
-----------------
|
|
|
|
If you _really_ need objtool to ignore something, and are 100% sure
|
|
that it won't affect kernel stack traces, you can tell objtool to
|
|
ignore it:
|
|
|
|
- To skip validation of a function, use the STACK_FRAME_NON_STANDARD
|
|
macro.
|
|
|
|
- To skip validation of a file, add
|
|
|
|
OBJECT_FILES_NON_STANDARD_filename.o := n
|
|
|
|
to the Makefile.
|
|
|
|
- To skip validation of a directory, add
|
|
|
|
OBJECT_FILES_NON_STANDARD := y
|
|
|
|
to the Makefile.
|