1 | // SPDX-License-Identifier: GPL-2.0 |
2 | |
3 | /* |
4 | * Stack trace utility functions etc. |
5 | * |
6 | * Copyright 2008 Christoph Hellwig, IBM Corp. |
7 | * Copyright 2018 SUSE Linux GmbH |
8 | * Copyright 2018 Nick Piggin, Michael Ellerman, IBM Corp. |
9 | */ |
10 | |
11 | #include <linux/delay.h> |
12 | #include <linux/export.h> |
13 | #include <linux/kallsyms.h> |
14 | #include <linux/module.h> |
15 | #include <linux/nmi.h> |
16 | #include <linux/sched.h> |
17 | #include <linux/sched/debug.h> |
18 | #include <linux/sched/task_stack.h> |
19 | #include <linux/stacktrace.h> |
20 | #include <asm/ptrace.h> |
21 | #include <asm/processor.h> |
22 | #include <linux/ftrace.h> |
23 | #include <asm/kprobes.h> |
24 | |
25 | #include <asm/paca.h> |
26 | |
27 | void __no_sanitize_address arch_stack_walk(stack_trace_consume_fn consume_entry, void *cookie, |
28 | struct task_struct *task, struct pt_regs *regs) |
29 | { |
30 | unsigned long sp; |
31 | |
32 | if (regs && !consume_entry(cookie, regs->nip)) |
33 | return; |
34 | |
35 | if (regs) |
36 | sp = regs->gpr[1]; |
37 | else if (task == current) |
38 | sp = current_stack_frame(); |
39 | else |
40 | sp = task->thread.ksp; |
41 | |
42 | for (;;) { |
43 | unsigned long *stack = (unsigned long *) sp; |
44 | unsigned long newsp, ip; |
45 | |
46 | if (!validate_sp(sp, task)) |
47 | return; |
48 | |
49 | newsp = stack[0]; |
50 | ip = stack[STACK_FRAME_LR_SAVE]; |
51 | |
52 | if (!consume_entry(cookie, ip)) |
53 | return; |
54 | |
55 | sp = newsp; |
56 | } |
57 | } |
58 | |
59 | /* |
60 | * This function returns an error if it detects any unreliable features of the |
61 | * stack. Otherwise it guarantees that the stack trace is reliable. |
62 | * |
63 | * If the task is not 'current', the caller *must* ensure the task is inactive. |
64 | */ |
65 | int __no_sanitize_address arch_stack_walk_reliable(stack_trace_consume_fn consume_entry, |
66 | void *cookie, struct task_struct *task) |
67 | { |
68 | unsigned long sp; |
69 | unsigned long newsp; |
70 | unsigned long stack_page = (unsigned long)task_stack_page(task); |
71 | unsigned long stack_end; |
72 | int graph_idx = 0; |
73 | bool firstframe; |
74 | |
75 | stack_end = stack_page + THREAD_SIZE; |
76 | |
77 | // See copy_thread() for details. |
78 | if (task->flags & PF_KTHREAD) |
79 | stack_end -= STACK_FRAME_MIN_SIZE; |
80 | else |
81 | stack_end -= STACK_USER_INT_FRAME_SIZE; |
82 | |
83 | if (task == current) |
84 | sp = current_stack_frame(); |
85 | else |
86 | sp = task->thread.ksp; |
87 | |
88 | if (sp < stack_page + sizeof(struct thread_struct) || |
89 | sp > stack_end - STACK_FRAME_MIN_SIZE) { |
90 | return -EINVAL; |
91 | } |
92 | |
93 | for (firstframe = true; sp != stack_end; |
94 | firstframe = false, sp = newsp) { |
95 | unsigned long *stack = (unsigned long *) sp; |
96 | unsigned long ip; |
97 | |
98 | /* sanity check: ABI requires SP to be aligned 16 bytes. */ |
99 | if (sp & 0xF) |
100 | return -EINVAL; |
101 | |
102 | newsp = stack[0]; |
103 | /* Stack grows downwards; unwinder may only go up. */ |
104 | if (newsp <= sp) |
105 | return -EINVAL; |
106 | |
107 | if (newsp != stack_end && |
108 | newsp > stack_end - STACK_FRAME_MIN_SIZE) { |
109 | return -EINVAL; /* invalid backlink, too far up. */ |
110 | } |
111 | |
112 | /* |
113 | * We can only trust the bottom frame's backlink, the |
114 | * rest of the frame may be uninitialized, continue to |
115 | * the next. |
116 | */ |
117 | if (firstframe) |
118 | continue; |
119 | |
120 | /* Mark stacktraces with exception frames as unreliable. */ |
121 | if (sp <= stack_end - STACK_INT_FRAME_SIZE && |
122 | stack[STACK_INT_FRAME_MARKER_LONGS] == STACK_FRAME_REGS_MARKER) { |
123 | return -EINVAL; |
124 | } |
125 | |
126 | /* Examine the saved LR: it must point into kernel code. */ |
127 | ip = stack[STACK_FRAME_LR_SAVE]; |
128 | if (!__kernel_text_address(addr: ip)) |
129 | return -EINVAL; |
130 | |
131 | /* |
132 | * FIXME: IMHO these tests do not belong in |
133 | * arch-dependent code, they are generic. |
134 | */ |
135 | ip = ftrace_graph_ret_addr(task, idx: &graph_idx, ret: ip, retp: stack); |
136 | #ifdef CONFIG_KPROBES |
137 | /* |
138 | * Mark stacktraces with kretprobed functions on them |
139 | * as unreliable. |
140 | */ |
141 | if (ip == (unsigned long)__kretprobe_trampoline) |
142 | return -EINVAL; |
143 | #endif |
144 | |
145 | if (!consume_entry(cookie, ip)) |
146 | return -EINVAL; |
147 | } |
148 | return 0; |
149 | } |
150 | |
151 | #if defined(CONFIG_PPC_BOOK3S_64) && defined(CONFIG_NMI_IPI) |
152 | static void handle_backtrace_ipi(struct pt_regs *regs) |
153 | { |
154 | nmi_cpu_backtrace(regs); |
155 | } |
156 | |
157 | static void raise_backtrace_ipi(cpumask_t *mask) |
158 | { |
159 | struct paca_struct *p; |
160 | unsigned int cpu; |
161 | u64 delay_us; |
162 | |
163 | for_each_cpu(cpu, mask) { |
164 | if (cpu == smp_processor_id()) { |
165 | handle_backtrace_ipi(NULL); |
166 | continue; |
167 | } |
168 | |
169 | delay_us = 5 * USEC_PER_SEC; |
170 | |
171 | if (smp_send_safe_nmi_ipi(cpu, handle_backtrace_ipi, delay_us)) { |
172 | // Now wait up to 5s for the other CPU to do its backtrace |
173 | while (cpumask_test_cpu(cpu, mask) && delay_us) { |
174 | udelay(1); |
175 | delay_us--; |
176 | } |
177 | |
178 | // Other CPU cleared itself from the mask |
179 | if (delay_us) |
180 | continue; |
181 | } |
182 | |
183 | p = paca_ptrs[cpu]; |
184 | |
185 | cpumask_clear_cpu(cpu, mask); |
186 | |
187 | pr_warn("CPU %d didn't respond to backtrace IPI, inspecting paca.\n" , cpu); |
188 | if (!virt_addr_valid(p)) { |
189 | pr_warn("paca pointer appears corrupt? (%px)\n" , p); |
190 | continue; |
191 | } |
192 | |
193 | pr_warn("irq_soft_mask: 0x%02x in_mce: %d in_nmi: %d" , |
194 | p->irq_soft_mask, p->in_mce, p->in_nmi); |
195 | |
196 | if (virt_addr_valid(p->__current)) |
197 | pr_cont(" current: %d (%s)\n" , p->__current->pid, |
198 | p->__current->comm); |
199 | else |
200 | pr_cont(" current pointer corrupt? (%px)\n" , p->__current); |
201 | |
202 | pr_warn("Back trace of paca->saved_r1 (0x%016llx) (possibly stale):\n" , p->saved_r1); |
203 | show_stack(p->__current, (unsigned long *)p->saved_r1, KERN_WARNING); |
204 | } |
205 | } |
206 | |
207 | void arch_trigger_cpumask_backtrace(const cpumask_t *mask, int exclude_cpu) |
208 | { |
209 | nmi_trigger_cpumask_backtrace(mask, exclude_cpu, raise_backtrace_ipi); |
210 | } |
211 | #endif /* defined(CONFIG_PPC_BOOK3S_64) && defined(CONFIG_NMI_IPI) */ |
212 | |