| 1 | // SPDX-License-Identifier: GPL-2.0-only |
| 2 | #include <linux/export.h> |
| 3 | #include <linux/kprobes.h> |
| 4 | #include <linux/sched.h> |
| 5 | #include <linux/sched/debug.h> |
| 6 | #include <linux/stacktrace.h> |
| 7 | |
| 8 | #include <asm/sections.h> |
| 9 | #include <asm/stacktrace.h> |
| 10 | #include <asm/traps.h> |
| 11 | |
| 12 | #include "reboot.h" |
| 13 | |
| 14 | #if defined(CONFIG_FRAME_POINTER) && !defined(CONFIG_ARM_UNWIND) |
| 15 | /* |
| 16 | * Unwind the current stack frame and store the new register values in the |
| 17 | * structure passed as argument. Unwinding is equivalent to a function return, |
| 18 | * hence the new PC value rather than LR should be used for backtrace. |
| 19 | * |
| 20 | * With framepointer enabled, a simple function prologue looks like this: |
| 21 | * mov ip, sp |
| 22 | * stmdb sp!, {fp, ip, lr, pc} |
| 23 | * sub fp, ip, #4 |
| 24 | * |
| 25 | * A simple function epilogue looks like this: |
| 26 | * ldm sp, {fp, sp, pc} |
| 27 | * |
| 28 | * When compiled with clang, pc and sp are not pushed. A simple function |
| 29 | * prologue looks like this when built with clang: |
| 30 | * |
| 31 | * stmdb {..., fp, lr} |
| 32 | * add fp, sp, #x |
| 33 | * sub sp, sp, #y |
| 34 | * |
| 35 | * A simple function epilogue looks like this when built with clang: |
| 36 | * |
| 37 | * sub sp, fp, #x |
| 38 | * ldm {..., fp, pc} |
| 39 | * |
| 40 | * |
| 41 | * Note that with framepointer enabled, even the leaf functions have the same |
| 42 | * prologue and epilogue, therefore we can ignore the LR value in this case. |
| 43 | */ |
| 44 | |
| 45 | extern unsigned long call_with_stack_end; |
| 46 | |
| 47 | static int frame_pointer_check(struct stackframe *frame) |
| 48 | { |
| 49 | unsigned long high, low; |
| 50 | unsigned long fp = frame->fp; |
| 51 | unsigned long pc = frame->pc; |
| 52 | |
| 53 | /* |
| 54 | * call_with_stack() is the only place we allow SP to jump from one |
| 55 | * stack to another, with FP and SP pointing to different stacks, |
| 56 | * skipping the FP boundary check at this point. |
| 57 | */ |
| 58 | if (pc >= (unsigned long)&call_with_stack && |
| 59 | pc < (unsigned long)&call_with_stack_end) |
| 60 | return 0; |
| 61 | |
| 62 | /* only go to a higher address on the stack */ |
| 63 | low = frame->sp; |
| 64 | high = ALIGN(low, THREAD_SIZE); |
| 65 | |
| 66 | /* check current frame pointer is within bounds */ |
| 67 | #ifdef CONFIG_CC_IS_CLANG |
| 68 | if (fp < low + 4 || fp > high - 4) |
| 69 | return -EINVAL; |
| 70 | #else |
| 71 | if (fp < low + 12 || fp > high - 4) |
| 72 | return -EINVAL; |
| 73 | #endif |
| 74 | |
| 75 | return 0; |
| 76 | } |
| 77 | |
| 78 | int notrace unwind_frame(struct stackframe *frame) |
| 79 | { |
| 80 | unsigned long fp = frame->fp; |
| 81 | |
| 82 | if (frame_pointer_check(frame)) |
| 83 | return -EINVAL; |
| 84 | |
| 85 | /* |
| 86 | * When we unwind through an exception stack, include the saved PC |
| 87 | * value into the stack trace. |
| 88 | */ |
| 89 | if (frame->ex_frame) { |
| 90 | struct pt_regs *regs = (struct pt_regs *)frame->sp; |
| 91 | |
| 92 | /* |
| 93 | * We check that 'regs + sizeof(struct pt_regs)' (that is, |
| 94 | * ®s[1]) does not exceed the bottom of the stack to avoid |
| 95 | * accessing data outside the task's stack. This may happen |
| 96 | * when frame->ex_frame is a false positive. |
| 97 | */ |
| 98 | if ((unsigned long)®s[1] > ALIGN(frame->sp, THREAD_SIZE)) |
| 99 | return -EINVAL; |
| 100 | |
| 101 | frame->pc = regs->ARM_pc; |
| 102 | frame->ex_frame = false; |
| 103 | return 0; |
| 104 | } |
| 105 | |
| 106 | /* restore the registers from the stack frame */ |
| 107 | #ifdef CONFIG_CC_IS_CLANG |
| 108 | frame->sp = frame->fp; |
| 109 | frame->fp = READ_ONCE_NOCHECK(*(unsigned long *)(fp)); |
| 110 | frame->pc = READ_ONCE_NOCHECK(*(unsigned long *)(fp + 4)); |
| 111 | #else |
| 112 | frame->fp = READ_ONCE_NOCHECK(*(unsigned long *)(fp - 12)); |
| 113 | frame->sp = READ_ONCE_NOCHECK(*(unsigned long *)(fp - 8)); |
| 114 | frame->pc = READ_ONCE_NOCHECK(*(unsigned long *)(fp - 4)); |
| 115 | #endif |
| 116 | #ifdef CONFIG_KRETPROBES |
| 117 | if (is_kretprobe_trampoline(frame->pc)) |
| 118 | frame->pc = kretprobe_find_ret_addr(frame->tsk, |
| 119 | (void *)frame->fp, &frame->kr_cur); |
| 120 | #endif |
| 121 | |
| 122 | if (in_entry_text(frame->pc)) |
| 123 | frame->ex_frame = true; |
| 124 | |
| 125 | return 0; |
| 126 | } |
| 127 | #endif |
| 128 | |
| 129 | void notrace walk_stackframe(struct stackframe *frame, |
| 130 | bool (*fn)(void *, unsigned long), void *data) |
| 131 | { |
| 132 | while (1) { |
| 133 | int ret; |
| 134 | |
| 135 | if (!fn(data, frame->pc)) |
| 136 | break; |
| 137 | ret = unwind_frame(frame); |
| 138 | if (ret < 0) |
| 139 | break; |
| 140 | } |
| 141 | } |
| 142 | EXPORT_SYMBOL(walk_stackframe); |
| 143 | |
| 144 | #ifdef CONFIG_STACKTRACE |
| 145 | static void start_stack_trace(struct stackframe *frame, struct task_struct *task, |
| 146 | unsigned long fp, unsigned long sp, |
| 147 | unsigned long lr, unsigned long pc) |
| 148 | { |
| 149 | frame->fp = fp; |
| 150 | frame->sp = sp; |
| 151 | frame->lr = lr; |
| 152 | frame->pc = pc; |
| 153 | #ifdef CONFIG_KRETPROBES |
| 154 | frame->kr_cur = NULL; |
| 155 | frame->tsk = task; |
| 156 | #endif |
| 157 | #ifdef CONFIG_UNWINDER_FRAME_POINTER |
| 158 | frame->ex_frame = in_entry_text(frame->pc); |
| 159 | #endif |
| 160 | } |
| 161 | |
| 162 | void arch_stack_walk(stack_trace_consume_fn consume_entry, void *cookie, |
| 163 | struct task_struct *task, struct pt_regs *regs) |
| 164 | { |
| 165 | struct stackframe frame; |
| 166 | |
| 167 | if (regs) { |
| 168 | start_stack_trace(frame: &frame, NULL, fp: regs->ARM_fp, sp: regs->ARM_sp, |
| 169 | lr: regs->ARM_lr, pc: regs->ARM_pc); |
| 170 | } else if (task != current) { |
| 171 | #ifdef CONFIG_SMP |
| 172 | /* |
| 173 | * What guarantees do we have here that 'tsk' is not |
| 174 | * running on another CPU? For now, ignore it as we |
| 175 | * can't guarantee we won't explode. |
| 176 | */ |
| 177 | return; |
| 178 | #else |
| 179 | start_stack_trace(&frame, task, thread_saved_fp(task), |
| 180 | thread_saved_sp(task), 0, |
| 181 | thread_saved_pc(task)); |
| 182 | #endif |
| 183 | } else { |
| 184 | here: |
| 185 | start_stack_trace(frame: &frame, task, |
| 186 | fp: (unsigned long)__builtin_frame_address(0), |
| 187 | sp: current_stack_pointer, |
| 188 | lr: (unsigned long)__builtin_return_address(0), |
| 189 | pc: (unsigned long)&&here); |
| 190 | /* skip this function */ |
| 191 | if (unwind_frame(&frame)) |
| 192 | return; |
| 193 | } |
| 194 | |
| 195 | walk_stackframe(&frame, consume_entry, cookie); |
| 196 | } |
| 197 | #endif |
| 198 | |