2012-03-05 19:49:27 +08:00
|
|
|
/*
|
|
|
|
|
* Stack tracing support
|
|
|
|
|
*
|
|
|
|
|
* Copyright (C) 2012 ARM Ltd.
|
|
|
|
|
*
|
|
|
|
|
* This program is free software; you can redistribute it and/or modify
|
|
|
|
|
* it under the terms of the GNU General Public License version 2 as
|
|
|
|
|
* published by the Free Software Foundation.
|
|
|
|
|
*
|
|
|
|
|
* This program is distributed in the hope that it will be useful,
|
|
|
|
|
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
|
|
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
|
|
|
* GNU General Public License for more details.
|
|
|
|
|
*
|
|
|
|
|
* You should have received a copy of the GNU General Public License
|
|
|
|
|
* along with this program. If not, see <http://www.gnu.org/licenses/>.
|
|
|
|
|
*/
|
|
|
|
|
#include <linux/kernel.h>
|
|
|
|
|
#include <linux/export.h>
|
2015-12-15 16:33:41 +08:00
|
|
|
#include <linux/ftrace.h>
|
2012-03-05 19:49:27 +08:00
|
|
|
#include <linux/sched.h>
|
2017-02-09 01:51:35 +08:00
|
|
|
#include <linux/sched/debug.h>
|
2017-02-09 01:51:37 +08:00
|
|
|
#include <linux/sched/task_stack.h>
|
2012-03-05 19:49:27 +08:00
|
|
|
#include <linux/stacktrace.h>
|
|
|
|
|
|
2015-12-04 19:02:26 +08:00
|
|
|
#include <asm/irq.h>
|
2016-11-04 04:23:05 +08:00
|
|
|
#include <asm/stack_pointer.h>
|
2012-03-05 19:49:27 +08:00
|
|
|
#include <asm/stacktrace.h>
|
|
|
|
|
|
|
|
|
|
/*
|
|
|
|
|
* AArch64 PCS assigns the frame pointer to x29.
|
|
|
|
|
*
|
|
|
|
|
* A simple function prologue looks like this:
|
|
|
|
|
* sub sp, sp, #0x10
|
|
|
|
|
* stp x29, x30, [sp]
|
|
|
|
|
* mov x29, sp
|
|
|
|
|
*
|
|
|
|
|
* A simple function epilogue looks like this:
|
|
|
|
|
* mov sp, x29
|
|
|
|
|
* ldp x29, x30, [sp]
|
|
|
|
|
* add sp, sp, #0x10
|
|
|
|
|
*/
|
2015-12-15 16:33:40 +08:00
|
|
|
int notrace unwind_frame(struct task_struct *tsk, struct stackframe *frame)
|
2012-03-05 19:49:27 +08:00
|
|
|
{
|
|
|
|
|
unsigned long fp = frame->fp;
|
2017-07-22 19:48:34 +08:00
|
|
|
|
|
|
|
|
if (fp & 0xf)
|
|
|
|
|
return -EINVAL;
|
2015-12-04 19:02:26 +08:00
|
|
|
|
arm64: fix dump_backtrace/unwind_frame with NULL tsk
In some places, dump_backtrace() is called with a NULL tsk parameter,
e.g. in bug_handler() in arch/arm64, or indirectly via show_stack() in
core code. The expectation is that this is treated as if current were
passed instead of NULL. Similar is true of unwind_frame().
Commit a80a0eb70c358f8c ("arm64: make irq_stack_ptr more robust") didn't
take this into account. In dump_backtrace() it compares tsk against
current *before* we check if tsk is NULL, and in unwind_frame() we never
set tsk if it is NULL.
Due to this, we won't initialise irq_stack_ptr in either function. In
dump_backtrace() this results in calling dump_mem() for memory
immediately above the IRQ stack range, rather than for the relevant
range on the task stack. In unwind_frame we'll reject unwinding frames
on the IRQ stack.
In either case this results in incomplete or misleading backtrace
information, but is not otherwise problematic. The initial percpu areas
(including the IRQ stacks) are allocated in the linear map, and dump_mem
uses __get_user(), so we shouldn't access anything with side-effects,
and will handle holes safely.
This patch fixes the issue by having both functions handle the NULL tsk
case before doing anything else with tsk.
Signed-off-by: Mark Rutland <mark.rutland@arm.com>
Fixes: a80a0eb70c358f8c ("arm64: make irq_stack_ptr more robust")
Acked-by: James Morse <james.morse@arm.com>
Cc: Catalin Marinas <catalin.marinas@arm.com>
Cc: Will Deacon <will.deacon@arm.com>
Cc: Yang Shi <yang.shi@linaro.org>
Signed-off-by: Will Deacon <will.deacon@arm.com>
2016-09-24 00:55:05 +08:00
|
|
|
if (!tsk)
|
|
|
|
|
tsk = current;
|
|
|
|
|
|
2017-08-02 01:51:15 +08:00
|
|
|
if (!on_accessible_stack(tsk, fp))
|
2012-03-05 19:49:27 +08:00
|
|
|
return -EINVAL;
|
|
|
|
|
|
2016-02-09 01:13:09 +08:00
|
|
|
frame->fp = READ_ONCE_NOCHECK(*(unsigned long *)(fp));
|
|
|
|
|
frame->pc = READ_ONCE_NOCHECK(*(unsigned long *)(fp + 8));
|
2012-03-05 19:49:27 +08:00
|
|
|
|
2015-12-15 16:33:41 +08:00
|
|
|
#ifdef CONFIG_FUNCTION_GRAPH_TRACER
|
arm64: fix dump_backtrace/unwind_frame with NULL tsk
In some places, dump_backtrace() is called with a NULL tsk parameter,
e.g. in bug_handler() in arch/arm64, or indirectly via show_stack() in
core code. The expectation is that this is treated as if current were
passed instead of NULL. Similar is true of unwind_frame().
Commit a80a0eb70c358f8c ("arm64: make irq_stack_ptr more robust") didn't
take this into account. In dump_backtrace() it compares tsk against
current *before* we check if tsk is NULL, and in unwind_frame() we never
set tsk if it is NULL.
Due to this, we won't initialise irq_stack_ptr in either function. In
dump_backtrace() this results in calling dump_mem() for memory
immediately above the IRQ stack range, rather than for the relevant
range on the task stack. In unwind_frame we'll reject unwinding frames
on the IRQ stack.
In either case this results in incomplete or misleading backtrace
information, but is not otherwise problematic. The initial percpu areas
(including the IRQ stacks) are allocated in the linear map, and dump_mem
uses __get_user(), so we shouldn't access anything with side-effects,
and will handle holes safely.
This patch fixes the issue by having both functions handle the NULL tsk
case before doing anything else with tsk.
Signed-off-by: Mark Rutland <mark.rutland@arm.com>
Fixes: a80a0eb70c358f8c ("arm64: make irq_stack_ptr more robust")
Acked-by: James Morse <james.morse@arm.com>
Cc: Catalin Marinas <catalin.marinas@arm.com>
Cc: Will Deacon <will.deacon@arm.com>
Cc: Yang Shi <yang.shi@linaro.org>
Signed-off-by: Will Deacon <will.deacon@arm.com>
2016-09-24 00:55:05 +08:00
|
|
|
if (tsk->ret_stack &&
|
2015-12-15 16:33:41 +08:00
|
|
|
(frame->pc == (unsigned long)return_to_handler)) {
|
|
|
|
|
/*
|
|
|
|
|
* This is a case where function graph tracer has
|
|
|
|
|
* modified a return address (LR) in a stack frame
|
|
|
|
|
* to hook a function return.
|
|
|
|
|
* So replace it to an original value.
|
|
|
|
|
*/
|
|
|
|
|
frame->pc = tsk->ret_stack[frame->graph--].ret;
|
|
|
|
|
}
|
|
|
|
|
#endif /* CONFIG_FUNCTION_GRAPH_TRACER */
|
|
|
|
|
|
2015-12-04 19:02:26 +08:00
|
|
|
/*
|
arm64: unwind: reference pt_regs via embedded stack frame
As it turns out, the unwind code is slightly broken, and probably has
been for a while. The problem is in the dumping of the exception stack,
which is intended to dump the contents of the pt_regs struct at each
level in the call stack where an exception was taken and routed to a
routine marked as __exception (which means its stack frame is right
below the pt_regs struct on the stack).
'Right below the pt_regs struct' is ill defined, though: the unwind
code assigns 'frame pointer + 0x10' to the .sp member of the stackframe
struct at each level, and dump_backtrace() happily dereferences that as
the pt_regs pointer when encountering an __exception routine. However,
the actual size of the stack frame created by this routine (which could
be one of many __exception routines we have in the kernel) is not known,
and so frame.sp is pretty useless to figure out where struct pt_regs
really is.
So it seems the only way to ensure that we can find our struct pt_regs
when walking the stack frames is to put it at a known fixed offset of
the stack frame pointer that is passed to such __exception routines.
The simplest way to do that is to put it inside pt_regs itself, which is
the main change implemented by this patch. As a bonus, doing this allows
us to get rid of a fair amount of cruft related to walking from one stack
to the other, which is especially nice since we intend to introduce yet
another stack for overflow handling once we add support for vmapped
stacks. It also fixes an inconsistency where we only add a stack frame
pointing to ELR_EL1 if we are executing from the IRQ stack but not when
we are executing from the task stack.
To consistly identify exceptions regs even in the presence of exceptions
taken from entry code, we must check whether the next frame was created
by entry text, rather than whether the current frame was crated by
exception text.
To avoid backtracing using PCs that fall in the idmap, or are controlled
by userspace, we must explcitly zero the FP and LR in startup paths, and
must ensure that the frame embedded in pt_regs is zeroed upon entry from
EL0. To avoid these NULL entries showin in the backtrace, unwind_frame()
is updated to avoid them.
Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
[Mark: compare current frame against .entry.text, avoid bogus PCs]
Signed-off-by: Mark Rutland <mark.rutland@arm.com>
Cc: Catalin Marinas <catalin.marinas@arm.com>
Cc: James Morse <james.morse@arm.com>
Cc: Will Deacon <will.deacon@arm.com>
2017-07-23 01:45:33 +08:00
|
|
|
* Frames created upon entry from EL0 have NULL FP and PC values, so
|
|
|
|
|
* don't bother reporting these. Frames created by __noreturn functions
|
|
|
|
|
* might have a valid FP even if PC is bogus, so only terminate where
|
|
|
|
|
* both are NULL.
|
2015-12-04 19:02:26 +08:00
|
|
|
*/
|
arm64: unwind: reference pt_regs via embedded stack frame
As it turns out, the unwind code is slightly broken, and probably has
been for a while. The problem is in the dumping of the exception stack,
which is intended to dump the contents of the pt_regs struct at each
level in the call stack where an exception was taken and routed to a
routine marked as __exception (which means its stack frame is right
below the pt_regs struct on the stack).
'Right below the pt_regs struct' is ill defined, though: the unwind
code assigns 'frame pointer + 0x10' to the .sp member of the stackframe
struct at each level, and dump_backtrace() happily dereferences that as
the pt_regs pointer when encountering an __exception routine. However,
the actual size of the stack frame created by this routine (which could
be one of many __exception routines we have in the kernel) is not known,
and so frame.sp is pretty useless to figure out where struct pt_regs
really is.
So it seems the only way to ensure that we can find our struct pt_regs
when walking the stack frames is to put it at a known fixed offset of
the stack frame pointer that is passed to such __exception routines.
The simplest way to do that is to put it inside pt_regs itself, which is
the main change implemented by this patch. As a bonus, doing this allows
us to get rid of a fair amount of cruft related to walking from one stack
to the other, which is especially nice since we intend to introduce yet
another stack for overflow handling once we add support for vmapped
stacks. It also fixes an inconsistency where we only add a stack frame
pointing to ELR_EL1 if we are executing from the IRQ stack but not when
we are executing from the task stack.
To consistly identify exceptions regs even in the presence of exceptions
taken from entry code, we must check whether the next frame was created
by entry text, rather than whether the current frame was crated by
exception text.
To avoid backtracing using PCs that fall in the idmap, or are controlled
by userspace, we must explcitly zero the FP and LR in startup paths, and
must ensure that the frame embedded in pt_regs is zeroed upon entry from
EL0. To avoid these NULL entries showin in the backtrace, unwind_frame()
is updated to avoid them.
Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
[Mark: compare current frame against .entry.text, avoid bogus PCs]
Signed-off-by: Mark Rutland <mark.rutland@arm.com>
Cc: Catalin Marinas <catalin.marinas@arm.com>
Cc: James Morse <james.morse@arm.com>
Cc: Will Deacon <will.deacon@arm.com>
2017-07-23 01:45:33 +08:00
|
|
|
if (!frame->fp && !frame->pc)
|
|
|
|
|
return -EINVAL;
|
2015-12-04 19:02:26 +08:00
|
|
|
|
2012-03-05 19:49:27 +08:00
|
|
|
return 0;
|
|
|
|
|
}
|
|
|
|
|
|
2015-12-15 16:33:40 +08:00
|
|
|
void notrace walk_stackframe(struct task_struct *tsk, struct stackframe *frame,
|
2012-03-05 19:49:27 +08:00
|
|
|
int (*fn)(struct stackframe *, void *), void *data)
|
|
|
|
|
{
|
|
|
|
|
while (1) {
|
|
|
|
|
int ret;
|
|
|
|
|
|
|
|
|
|
if (fn(frame, data))
|
|
|
|
|
break;
|
2015-12-15 16:33:40 +08:00
|
|
|
ret = unwind_frame(tsk, frame);
|
2012-03-05 19:49:27 +08:00
|
|
|
if (ret < 0)
|
|
|
|
|
break;
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
#ifdef CONFIG_STACKTRACE
|
|
|
|
|
struct stack_trace_data {
|
|
|
|
|
struct stack_trace *trace;
|
|
|
|
|
unsigned int no_sched_functions;
|
|
|
|
|
unsigned int skip;
|
|
|
|
|
};
|
|
|
|
|
|
|
|
|
|
static int save_trace(struct stackframe *frame, void *d)
|
|
|
|
|
{
|
|
|
|
|
struct stack_trace_data *data = d;
|
|
|
|
|
struct stack_trace *trace = data->trace;
|
|
|
|
|
unsigned long addr = frame->pc;
|
|
|
|
|
|
|
|
|
|
if (data->no_sched_functions && in_sched_functions(addr))
|
|
|
|
|
return 0;
|
|
|
|
|
if (data->skip) {
|
|
|
|
|
data->skip--;
|
|
|
|
|
return 0;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
trace->entries[trace->nr_entries++] = addr;
|
|
|
|
|
|
|
|
|
|
return trace->nr_entries >= trace->max_entries;
|
|
|
|
|
}
|
|
|
|
|
|
2016-09-05 10:33:16 +08:00
|
|
|
void save_stack_trace_regs(struct pt_regs *regs, struct stack_trace *trace)
|
|
|
|
|
{
|
|
|
|
|
struct stack_trace_data data;
|
|
|
|
|
struct stackframe frame;
|
|
|
|
|
|
|
|
|
|
data.trace = trace;
|
|
|
|
|
data.skip = trace->skip;
|
|
|
|
|
data.no_sched_functions = 0;
|
|
|
|
|
|
|
|
|
|
frame.fp = regs->regs[29];
|
|
|
|
|
frame.pc = regs->pc;
|
|
|
|
|
#ifdef CONFIG_FUNCTION_GRAPH_TRACER
|
|
|
|
|
frame.graph = current->curr_ret_stack;
|
|
|
|
|
#endif
|
|
|
|
|
|
|
|
|
|
walk_stackframe(current, &frame, save_trace, &data);
|
|
|
|
|
if (trace->nr_entries < trace->max_entries)
|
|
|
|
|
trace->entries[trace->nr_entries++] = ULONG_MAX;
|
|
|
|
|
}
|
|
|
|
|
|
2012-03-05 19:49:27 +08:00
|
|
|
void save_stack_trace_tsk(struct task_struct *tsk, struct stack_trace *trace)
|
|
|
|
|
{
|
|
|
|
|
struct stack_trace_data data;
|
|
|
|
|
struct stackframe frame;
|
|
|
|
|
|
2016-11-04 04:23:08 +08:00
|
|
|
if (!try_get_task_stack(tsk))
|
|
|
|
|
return;
|
|
|
|
|
|
2012-03-05 19:49:27 +08:00
|
|
|
data.trace = trace;
|
|
|
|
|
data.skip = trace->skip;
|
|
|
|
|
|
|
|
|
|
if (tsk != current) {
|
|
|
|
|
data.no_sched_functions = 1;
|
|
|
|
|
frame.fp = thread_saved_fp(tsk);
|
|
|
|
|
frame.pc = thread_saved_pc(tsk);
|
|
|
|
|
} else {
|
|
|
|
|
data.no_sched_functions = 0;
|
|
|
|
|
frame.fp = (unsigned long)__builtin_frame_address(0);
|
|
|
|
|
frame.pc = (unsigned long)save_stack_trace_tsk;
|
|
|
|
|
}
|
2015-12-15 16:33:41 +08:00
|
|
|
#ifdef CONFIG_FUNCTION_GRAPH_TRACER
|
|
|
|
|
frame.graph = tsk->curr_ret_stack;
|
|
|
|
|
#endif
|
2012-03-05 19:49:27 +08:00
|
|
|
|
2015-12-15 16:33:40 +08:00
|
|
|
walk_stackframe(tsk, &frame, save_trace, &data);
|
2012-03-05 19:49:27 +08:00
|
|
|
if (trace->nr_entries < trace->max_entries)
|
|
|
|
|
trace->entries[trace->nr_entries++] = ULONG_MAX;
|
2016-11-04 04:23:08 +08:00
|
|
|
|
|
|
|
|
put_task_stack(tsk);
|
2012-03-05 19:49:27 +08:00
|
|
|
}
|
2017-06-14 02:40:56 +08:00
|
|
|
EXPORT_SYMBOL_GPL(save_stack_trace_tsk);
|
2012-03-05 19:49:27 +08:00
|
|
|
|
|
|
|
|
void save_stack_trace(struct stack_trace *trace)
|
|
|
|
|
{
|
|
|
|
|
save_stack_trace_tsk(current, trace);
|
|
|
|
|
}
|
|
|
|
|
EXPORT_SYMBOL_GPL(save_stack_trace);
|
|
|
|
|
#endif
|
