stacktrace.c

  1// SPDX-License-Identifier: GPL-2.0-only
  2/*
  3 * Stack tracing support
  4 *
  5 * Copyright (C) 2012 ARM Ltd.
  6 */
  7#include <linux/kernel.h>
  8#include <linux/efi.h>
  9#include <linux/export.h>
 10#include <linux/filter.h>
 11#include <linux/ftrace.h>
 12#include <linux/kprobes.h>
 13#include <linux/sched.h>
 14#include <linux/sched/debug.h>
 15#include <linux/sched/task_stack.h>
 16#include <linux/stacktrace.h>
 17
 18#include <asm/efi.h>
 19#include <asm/irq.h>
 20#include <asm/stack_pointer.h>
 21#include <asm/stacktrace.h>
 22
 23enum kunwind_source {
 24	KUNWIND_SOURCE_UNKNOWN,
 25	KUNWIND_SOURCE_FRAME,
 26	KUNWIND_SOURCE_CALLER,
 27	KUNWIND_SOURCE_TASK,
 28	KUNWIND_SOURCE_REGS_PC,
 29};
 30
 31union unwind_flags {
 32	unsigned long	all;
 33	struct {
 34		unsigned long	fgraph : 1,
 35				kretprobe : 1;
 36	};
 37};
 38
 39/*
 40 * Kernel unwind state
 41 *
 42 * @common:      Common unwind state.
 43 * @task:        The task being unwound.
 44 * @graph_idx:   Used by ftrace_graph_ret_addr() for optimized stack unwinding.
 45 * @kr_cur:      When KRETPROBES is selected, holds the kretprobe instance
 46 *               associated with the most recently encountered replacement lr
 47 *               value.
 48 */
 49struct kunwind_state {
 50	struct unwind_state common;
 51	struct task_struct *task;
 52	int graph_idx;
 53#ifdef CONFIG_KRETPROBES
 54	struct llist_node *kr_cur;
 55#endif
 56	enum kunwind_source source;
 57	union unwind_flags flags;
 58	struct pt_regs *regs;
 59};
 60
 61static __always_inline void
 62kunwind_init(struct kunwind_state *state,
 63	     struct task_struct *task)
 64{
 65	unwind_init_common(&state->common);
 66	state->task = task;
 67	state->source = KUNWIND_SOURCE_UNKNOWN;
 68	state->flags.all = 0;
 69	state->regs = NULL;
 70}
 71
 72/*
 73 * Start an unwind from a pt_regs.
 74 *
 75 * The unwind will begin at the PC within the regs.
 76 *
 77 * The regs must be on a stack currently owned by the calling task.
 78 */
 79static __always_inline void
 80kunwind_init_from_regs(struct kunwind_state *state,
 81		       struct pt_regs *regs)
 82{
 83	kunwind_init(state, current);
 84
 85	state->regs = regs;
 86	state->common.fp = regs->regs[29];
 87	state->common.pc = regs->pc;
 88	state->source = KUNWIND_SOURCE_REGS_PC;
 89}
 90
 91/*
 92 * Start an unwind from a caller.
 93 *
 94 * The unwind will begin at the caller of whichever function this is inlined
 95 * into.
 96 *
 97 * The function which invokes this must be noinline.
 98 */
 99static __always_inline void
100kunwind_init_from_caller(struct kunwind_state *state)
101{
102	kunwind_init(state, current);
103
104	state->common.fp = (unsigned long)__builtin_frame_address(1);
105	state->common.pc = (unsigned long)__builtin_return_address(0);
106	state->source = KUNWIND_SOURCE_CALLER;
107}
108
109/*
110 * Start an unwind from a blocked task.
111 *
112 * The unwind will begin at the blocked tasks saved PC (i.e. the caller of
113 * cpu_switch_to()).
114 *
115 * The caller should ensure the task is blocked in cpu_switch_to() for the
116 * duration of the unwind, or the unwind will be bogus. It is never valid to
117 * call this for the current task.
118 */
119static __always_inline void
120kunwind_init_from_task(struct kunwind_state *state,
121		       struct task_struct *task)
122{
123	kunwind_init(state, task);
124
125	state->common.fp = thread_saved_fp(task);
126	state->common.pc = thread_saved_pc(task);
127	state->source = KUNWIND_SOURCE_TASK;
128}
129
130static __always_inline int
131kunwind_recover_return_address(struct kunwind_state *state)
132{
133#ifdef CONFIG_FUNCTION_GRAPH_TRACER
134	if (state->task->ret_stack &&
135	    (state->common.pc == (unsigned long)return_to_handler)) {
136		unsigned long orig_pc;
137		orig_pc = ftrace_graph_ret_addr(state->task, &state->graph_idx,
138						state->common.pc,
139						(void *)state->common.fp);
140		if (state->common.pc == orig_pc) {
141			WARN_ON_ONCE(state->task == current);
142			return -EINVAL;
143		}
144		state->common.pc = orig_pc;
145		state->flags.fgraph = 1;
146	}
147#endif /* CONFIG_FUNCTION_GRAPH_TRACER */
148
149#ifdef CONFIG_KRETPROBES
150	if (is_kretprobe_trampoline(state->common.pc)) {
151		unsigned long orig_pc;
152		orig_pc = kretprobe_find_ret_addr(state->task,
153						  (void *)state->common.fp,
154						  &state->kr_cur);
155		if (!orig_pc)
156			return -EINVAL;
157		state->common.pc = orig_pc;
158		state->flags.kretprobe = 1;
159	}
160#endif /* CONFIG_KRETPROBES */
161
162	return 0;
163}
164
165static __always_inline
166int kunwind_next_regs_pc(struct kunwind_state *state)
167{
168	struct stack_info *info;
169	unsigned long fp = state->common.fp;
170	struct pt_regs *regs;
171
172	regs = container_of((u64 *)fp, struct pt_regs, stackframe.record.fp);
173
174	info = unwind_find_stack(&state->common, (unsigned long)regs, sizeof(*regs));
175	if (!info)
176		return -EINVAL;
177
178	unwind_consume_stack(&state->common, info, (unsigned long)regs,
179			     sizeof(*regs));
180
181	state->regs = regs;
182	state->common.pc = regs->pc;
183	state->common.fp = regs->regs[29];
184	state->regs = NULL;
185	state->source = KUNWIND_SOURCE_REGS_PC;
186	return 0;
187}
188
189static __always_inline int
190kunwind_next_frame_record_meta(struct kunwind_state *state)
191{
192	struct task_struct *tsk = state->task;
193	unsigned long fp = state->common.fp;
194	struct frame_record_meta *meta;
195	struct stack_info *info;
196
197	info = unwind_find_stack(&state->common, fp, sizeof(*meta));
198	if (!info)
199		return -EINVAL;
200
201	meta = (struct frame_record_meta *)fp;
202	switch (READ_ONCE(meta->type)) {
203	case FRAME_META_TYPE_FINAL:
204		if (meta == &task_pt_regs(tsk)->stackframe)
205			return -ENOENT;
206		WARN_ON_ONCE(tsk == current);
207		return -EINVAL;
208	case FRAME_META_TYPE_PT_REGS:
209		return kunwind_next_regs_pc(state);
210	default:
211		WARN_ON_ONCE(tsk == current);
212		return -EINVAL;
213	}
214}
215
216static __always_inline int
217kunwind_next_frame_record(struct kunwind_state *state)
218{
219	unsigned long fp = state->common.fp;
220	struct frame_record *record;
221	struct stack_info *info;
222	unsigned long new_fp, new_pc;
223
224	if (fp & 0x7)
225		return -EINVAL;
226
227	info = unwind_find_stack(&state->common, fp, sizeof(*record));
228	if (!info)
229		return -EINVAL;
230
231	record = (struct frame_record *)fp;
232	new_fp = READ_ONCE(record->fp);
233	new_pc = READ_ONCE(record->lr);
234
235	if (!new_fp && !new_pc)
236		return kunwind_next_frame_record_meta(state);
237
238	unwind_consume_stack(&state->common, info, fp, sizeof(*record));
239
240	state->common.fp = new_fp;
241	state->common.pc = new_pc;
242	state->source = KUNWIND_SOURCE_FRAME;
243
244	return 0;
245}
246
247/*
248 * Unwind from one frame record (A) to the next frame record (B).
249 *
250 * We terminate early if the location of B indicates a malformed chain of frame
251 * records (e.g. a cycle), determined based on the location and fp value of A
252 * and the location (but not the fp value) of B.
253 */
254static __always_inline int
255kunwind_next(struct kunwind_state *state)
256{
257	int err;
258
259	state->flags.all = 0;
260
261	switch (state->source) {
262	case KUNWIND_SOURCE_FRAME:
263	case KUNWIND_SOURCE_CALLER:
264	case KUNWIND_SOURCE_TASK:
265	case KUNWIND_SOURCE_REGS_PC:
266		err = kunwind_next_frame_record(state);
267		break;
268	default:
269		err = -EINVAL;
270	}
271
272	if (err)
273		return err;
274
275	state->common.pc = ptrauth_strip_kernel_insn_pac(state->common.pc);
276
277	return kunwind_recover_return_address(state);
278}
279
280typedef bool (*kunwind_consume_fn)(const struct kunwind_state *state, void *cookie);
281
282static __always_inline int
283do_kunwind(struct kunwind_state *state, kunwind_consume_fn consume_state,
284	   void *cookie)
285{
286	int ret;
287
288	ret = kunwind_recover_return_address(state);
289	if (ret)
290		return ret;
291
292	while (1) {
293		if (!consume_state(state, cookie))
294			return -EINVAL;
295		ret = kunwind_next(state);
296		if (ret == -ENOENT)
297			return 0;
298		if (ret < 0)
299			return ret;
300	}
301}
302
303/*
304 * Per-cpu stacks are only accessible when unwinding the current task in a
305 * non-preemptible context.
306 */
307#define STACKINFO_CPU(name)					\
308	({							\
309		((task == current) && !preemptible())		\
310			? stackinfo_get_##name()		\
311			: stackinfo_get_unknown();		\
312	})
313
314/*
315 * SDEI stacks are only accessible when unwinding the current task in an NMI
316 * context.
317 */
318#define STACKINFO_SDEI(name)					\
319	({							\
320		((task == current) && in_nmi())			\
321			? stackinfo_get_sdei_##name()		\
322			: stackinfo_get_unknown();		\
323	})
324
325#define STACKINFO_EFI						\
326	({							\
327		((task == current) && current_in_efi())		\
328			? stackinfo_get_efi()			\
329			: stackinfo_get_unknown();		\
330	})
331
332static __always_inline int
333kunwind_stack_walk(kunwind_consume_fn consume_state,
334		   void *cookie, struct task_struct *task,
335		   struct pt_regs *regs)
336{
337	struct stack_info stacks[] = {
338		stackinfo_get_task(task),
339		STACKINFO_CPU(irq),
340		STACKINFO_CPU(overflow),
341#if defined(CONFIG_ARM_SDE_INTERFACE)
342		STACKINFO_SDEI(normal),
343		STACKINFO_SDEI(critical),
344#endif
345#ifdef CONFIG_EFI
346		STACKINFO_EFI,
347#endif
348	};
349	struct kunwind_state state = {
350		.common = {
351			.stacks = stacks,
352			.nr_stacks = ARRAY_SIZE(stacks),
353		},
354	};
355
356	if (regs) {
357		if (task != current)
358			return -EINVAL;
359		kunwind_init_from_regs(&state, regs);
360	} else if (task == current) {
361		kunwind_init_from_caller(&state);
362	} else {
363		kunwind_init_from_task(&state, task);
364	}
365
366	return do_kunwind(&state, consume_state, cookie);
367}
368
369struct kunwind_consume_entry_data {
370	stack_trace_consume_fn consume_entry;
371	void *cookie;
372};
373
374static __always_inline bool
375arch_kunwind_consume_entry(const struct kunwind_state *state, void *cookie)
376{
377	struct kunwind_consume_entry_data *data = cookie;
378	return data->consume_entry(data->cookie, state->common.pc);
379}
380
381noinline noinstr void arch_stack_walk(stack_trace_consume_fn consume_entry,
382			      void *cookie, struct task_struct *task,
383			      struct pt_regs *regs)
384{
385	struct kunwind_consume_entry_data data = {
386		.consume_entry = consume_entry,
387		.cookie = cookie,
388	};
389
390	kunwind_stack_walk(arch_kunwind_consume_entry, &data, task, regs);
391}
392
393static __always_inline bool
394arch_reliable_kunwind_consume_entry(const struct kunwind_state *state, void *cookie)
395{
396	/*
397	 * At an exception boundary we can reliably consume the saved PC. We do
398	 * not know whether the LR was live when the exception was taken, and
399	 * so we cannot perform the next unwind step reliably.
400	 *
401	 * All that matters is whether the *entire* unwind is reliable, so give
402	 * up as soon as we hit an exception boundary.
403	 */
404	if (state->source == KUNWIND_SOURCE_REGS_PC)
405		return false;
406
407	return arch_kunwind_consume_entry(state, cookie);
408}
409
410noinline noinstr int arch_stack_walk_reliable(stack_trace_consume_fn consume_entry,
411					      void *cookie,
412					      struct task_struct *task)
413{
414	struct kunwind_consume_entry_data data = {
415		.consume_entry = consume_entry,
416		.cookie = cookie,
417	};
418
419	return kunwind_stack_walk(arch_reliable_kunwind_consume_entry, &data,
420				  task, NULL);
421}
422
423struct bpf_unwind_consume_entry_data {
424	bool (*consume_entry)(void *cookie, u64 ip, u64 sp, u64 fp);
425	void *cookie;
426};
427
428static bool
429arch_bpf_unwind_consume_entry(const struct kunwind_state *state, void *cookie)
430{
431	struct bpf_unwind_consume_entry_data *data = cookie;
432
433	return data->consume_entry(data->cookie, state->common.pc, 0,
434				   state->common.fp);
435}
436
437noinline noinstr void arch_bpf_stack_walk(bool (*consume_entry)(void *cookie, u64 ip, u64 sp,
438								u64 fp), void *cookie)
439{
440	struct bpf_unwind_consume_entry_data data = {
441		.consume_entry = consume_entry,
442		.cookie = cookie,
443	};
444
445	kunwind_stack_walk(arch_bpf_unwind_consume_entry, &data, current, NULL);
446}
447
448static const char *state_source_string(const struct kunwind_state *state)
449{
450	switch (state->source) {
451	case KUNWIND_SOURCE_FRAME:	return NULL;
452	case KUNWIND_SOURCE_CALLER:	return "C";
453	case KUNWIND_SOURCE_TASK:	return "T";
454	case KUNWIND_SOURCE_REGS_PC:	return "P";
455	default:			return "U";
456	}
457}
458
459static bool dump_backtrace_entry(const struct kunwind_state *state, void *arg)
460{
461	const char *source = state_source_string(state);
462	union unwind_flags flags = state->flags;
463	bool has_info = source || flags.all;
464	char *loglvl = arg;
465
466	printk("%s %pSb%s%s%s%s%s\n", loglvl,
467		(void *)state->common.pc,
468		has_info ? " (" : "",
469		source ? source : "",
470		flags.fgraph ? "F" : "",
471		flags.kretprobe ? "K" : "",
472		has_info ? ")" : "");
473
474	return true;
475}
476
477void dump_backtrace(struct pt_regs *regs, struct task_struct *tsk,
478		    const char *loglvl)
479{
480	pr_debug("%s(regs = %p tsk = %p)\n", __func__, regs, tsk);
481
482	if (regs && user_mode(regs))
483		return;
484
485	if (!tsk)
486		tsk = current;
487
488	if (!try_get_task_stack(tsk))
489		return;
490
491	printk("%sCall trace:\n", loglvl);
492	kunwind_stack_walk(dump_backtrace_entry, (void *)loglvl, tsk, regs);
493
494	put_task_stack(tsk);
495}
496
497void show_stack(struct task_struct *tsk, unsigned long *sp, const char *loglvl)
498{
499	dump_backtrace(NULL, tsk, loglvl);
500	barrier();
501}
502
503/*
504 * The struct defined for userspace stack frame in AARCH64 mode.
505 */
506struct frame_tail {
507	struct frame_tail	__user *fp;
508	unsigned long		lr;
509} __attribute__((packed));
510
511/*
512 * Get the return address for a single stackframe and return a pointer to the
513 * next frame tail.
514 */
515static struct frame_tail __user *
516unwind_user_frame(struct frame_tail __user *tail, void *cookie,
517	       stack_trace_consume_fn consume_entry)
518{
519	struct frame_tail buftail;
520	unsigned long err;
521	unsigned long lr;
522
523	/* Also check accessibility of one struct frame_tail beyond */
524	if (!access_ok(tail, sizeof(buftail)))
525		return NULL;
526
527	pagefault_disable();
528	err = __copy_from_user_inatomic(&buftail, tail, sizeof(buftail));
529	pagefault_enable();
530
531	if (err)
532		return NULL;
533
534	lr = ptrauth_strip_user_insn_pac(buftail.lr);
535
536	if (!consume_entry(cookie, lr))
537		return NULL;
538
539	/*
540	 * Frame pointers should strictly progress back up the stack
541	 * (towards higher addresses).
542	 */
543	if (tail >= buftail.fp)
544		return NULL;
545
546	return buftail.fp;
547}
548
549#ifdef CONFIG_COMPAT
550/*
551 * The registers we're interested in are at the end of the variable
552 * length saved register structure. The fp points at the end of this
553 * structure so the address of this struct is:
554 * (struct compat_frame_tail *)(xxx->fp)-1
555 *
556 * This code has been adapted from the ARM OProfile support.
557 */
558struct compat_frame_tail {
559	compat_uptr_t	fp; /* a (struct compat_frame_tail *) in compat mode */
560	u32		sp;
561	u32		lr;
562} __attribute__((packed));
563
564static struct compat_frame_tail __user *
565unwind_compat_user_frame(struct compat_frame_tail __user *tail, void *cookie,
566				stack_trace_consume_fn consume_entry)
567{
568	struct compat_frame_tail buftail;
569	unsigned long err;
570
571	/* Also check accessibility of one struct frame_tail beyond */
572	if (!access_ok(tail, sizeof(buftail)))
573		return NULL;
574
575	pagefault_disable();
576	err = __copy_from_user_inatomic(&buftail, tail, sizeof(buftail));
577	pagefault_enable();
578
579	if (err)
580		return NULL;
581
582	if (!consume_entry(cookie, buftail.lr))
583		return NULL;
584
585	/*
586	 * Frame pointers should strictly progress back up the stack
587	 * (towards higher addresses).
588	 */
589	if (tail + 1 >= (struct compat_frame_tail __user *)
590			compat_ptr(buftail.fp))
591		return NULL;
592
593	return (struct compat_frame_tail __user *)compat_ptr(buftail.fp) - 1;
594}
595#endif /* CONFIG_COMPAT */
596
597
598void arch_stack_walk_user(stack_trace_consume_fn consume_entry, void *cookie,
599					const struct pt_regs *regs)
600{
601	if (!consume_entry(cookie, regs->pc))
602		return;
603
604	if (!compat_user_mode(regs)) {
605		/* AARCH64 mode */
606		struct frame_tail __user *tail;
607
608		tail = (struct frame_tail __user *)regs->regs[29];
609		while (tail && !((unsigned long)tail & 0x7))
610			tail = unwind_user_frame(tail, cookie, consume_entry);
611	} else {
612#ifdef CONFIG_COMPAT
613		/* AARCH32 compat mode */
614		struct compat_frame_tail __user *tail;
615
616		tail = (struct compat_frame_tail __user *)regs->compat_fp - 1;
617		while (tail && !((unsigned long)tail & 0x3))
618			tail = unwind_compat_user_frame(tail, cookie, consume_entry);
619#endif
620	}
621}