powerpc/kernel/stacktrace.c

0001 // SPDX-License-Identifier: GPL-2.0
0002
0003 /*
0004  * Stack trace utility functions etc.
0005  *
0006  * Copyright 2008 Christoph Hellwig, IBM Corp.
0007  * Copyright 2018 SUSE Linux GmbH
0008  * Copyright 2018 Nick Piggin, Michael Ellerman, IBM Corp.
0009  */
0010
0011 #include <linux/delay.h>
0012 #include <linux/export.h>
0013 #include <linux/kallsyms.h>
0014 #include <linux/module.h>
0015 #include <linux/nmi.h>
0016 #include <linux/sched.h>
0017 #include <linux/sched/debug.h>
0018 #include <linux/sched/task_stack.h>
0019 #include <linux/stacktrace.h>
0020 #include <asm/ptrace.h>
0021 #include <asm/processor.h>
0022 #include <linux/ftrace.h>
0023 #include <asm/kprobes.h>
0024
0025 #include <asm/paca.h>
0026
0027 void __no_sanitize_address arch_stack_walk(stack_trace_consume_fn consume_entry, void *cookie,
0028                        struct task_struct *task, struct pt_regs *regs)
0029 {
0030     unsigned long sp;
0031
0032     if (regs && !consume_entry(cookie, regs->nip))
0033         return;
0034
0035     if (regs)
0036         sp = regs->gpr[1];
0037     else if (task == current)
0038         sp = current_stack_frame();
0039     else
0040         sp = task->thread.ksp;
0041
0042     for (;;) {
0043         unsigned long *stack = (unsigned long *) sp;
0044         unsigned long newsp, ip;
0045
0046         if (!validate_sp(sp, task, STACK_FRAME_OVERHEAD))
0047             return;
0048
0049         newsp = stack[0];
0050         ip = stack[STACK_FRAME_LR_SAVE];
0051
0052         if (!consume_entry(cookie, ip))
0053             return;
0054
0055         sp = newsp;
0056     }
0057 }
0058
0059 /*
0060  * This function returns an error if it detects any unreliable features of the
0061  * stack.  Otherwise it guarantees that the stack trace is reliable.
0062  *
0063  * If the task is not 'current', the caller *must* ensure the task is inactive.
0064  */
0065 int __no_sanitize_address arch_stack_walk_reliable(stack_trace_consume_fn consume_entry,
0066                            void *cookie, struct task_struct *task)
0067 {
0068     unsigned long sp;
0069     unsigned long newsp;
0070     unsigned long stack_page = (unsigned long)task_stack_page(task);
0071     unsigned long stack_end;
0072     int graph_idx = 0;
0073     bool firstframe;
0074
0075     stack_end = stack_page + THREAD_SIZE;
0076     if (!is_idle_task(task)) {
0077         /*
0078          * For user tasks, this is the SP value loaded on
0079          * kernel entry, see "PACAKSAVE(r13)" in _switch() and
0080          * system_call_common()/EXCEPTION_PROLOG_COMMON().
0081          *
0082          * Likewise for non-swapper kernel threads,
0083          * this also happens to be the top of the stack
0084          * as setup by copy_thread().
0085          *
0086          * Note that stack backlinks are not properly setup by
0087          * copy_thread() and thus, a forked task() will have
0088          * an unreliable stack trace until it's been
0089          * _switch()'ed to for the first time.
0090          */
0091         stack_end -= STACK_FRAME_OVERHEAD + sizeof(struct pt_regs);
0092     } else {
0093         /*
0094          * idle tasks have a custom stack layout,
0095          * c.f. cpu_idle_thread_init().
0096          */
0097         stack_end -= STACK_FRAME_OVERHEAD;
0098     }
0099
0100     if (task == current)
0101         sp = current_stack_frame();
0102     else
0103         sp = task->thread.ksp;
0104
0105     if (sp < stack_page + sizeof(struct thread_struct) ||
0106         sp > stack_end - STACK_FRAME_MIN_SIZE) {
0107         return -EINVAL;
0108     }
0109
0110     for (firstframe = true; sp != stack_end;
0111          firstframe = false, sp = newsp) {
0112         unsigned long *stack = (unsigned long *) sp;
0113         unsigned long ip;
0114
0115         /* sanity check: ABI requires SP to be aligned 16 bytes. */
0116         if (sp & 0xF)
0117             return -EINVAL;
0118
0119         newsp = stack[0];
0120         /* Stack grows downwards; unwinder may only go up. */
0121         if (newsp <= sp)
0122             return -EINVAL;
0123
0124         if (newsp != stack_end &&
0125             newsp > stack_end - STACK_FRAME_MIN_SIZE) {
0126             return -EINVAL; /* invalid backlink, too far up. */
0127         }
0128
0129         /*
0130          * We can only trust the bottom frame's backlink, the
0131          * rest of the frame may be uninitialized, continue to
0132          * the next.
0133          */
0134         if (firstframe)
0135             continue;
0136
0137         /* Mark stacktraces with exception frames as unreliable. */
0138         if (sp <= stack_end - STACK_INT_FRAME_SIZE &&
0139             stack[STACK_FRAME_MARKER] == STACK_FRAME_REGS_MARKER) {
0140             return -EINVAL;
0141         }
0142
0143         /* Examine the saved LR: it must point into kernel code. */
0144         ip = stack[STACK_FRAME_LR_SAVE];
0145         if (!__kernel_text_address(ip))
0146             return -EINVAL;
0147
0148         /*
0149          * FIXME: IMHO these tests do not belong in
0150          * arch-dependent code, they are generic.
0151          */
0152         ip = ftrace_graph_ret_addr(task, &graph_idx, ip, stack);
0153 #ifdef CONFIG_KPROBES
0154         /*
0155          * Mark stacktraces with kretprobed functions on them
0156          * as unreliable.
0157          */
0158         if (ip == (unsigned long)__kretprobe_trampoline)
0159             return -EINVAL;
0160 #endif
0161
0162         if (!consume_entry(cookie, ip))
0163             return -EINVAL;
0164     }
0165     return 0;
0166 }
0167
0168 #if defined(CONFIG_PPC_BOOK3S_64) && defined(CONFIG_NMI_IPI)
0169 static void handle_backtrace_ipi(struct pt_regs *regs)
0170 {
0171     nmi_cpu_backtrace(regs);
0172 }
0173
0174 static void raise_backtrace_ipi(cpumask_t *mask)
0175 {
0176     struct paca_struct *p;
0177     unsigned int cpu;
0178     u64 delay_us;
0179
0180     for_each_cpu(cpu, mask) {
0181         if (cpu == smp_processor_id()) {
0182             handle_backtrace_ipi(NULL);
0183             continue;
0184         }
0185
0186         delay_us = 5 * USEC_PER_SEC;
0187
0188         if (smp_send_safe_nmi_ipi(cpu, handle_backtrace_ipi, delay_us)) {
0189             // Now wait up to 5s for the other CPU to do its backtrace
0190             while (cpumask_test_cpu(cpu, mask) && delay_us) {
0191                 udelay(1);
0192                 delay_us--;
0193             }
0194
0195             // Other CPU cleared itself from the mask
0196             if (delay_us)
0197                 continue;
0198         }
0199
0200         p = paca_ptrs[cpu];
0201
0202         cpumask_clear_cpu(cpu, mask);
0203
0204         pr_warn("CPU %d didn't respond to backtrace IPI, inspecting paca.\n", cpu);
0205         if (!virt_addr_valid(p)) {
0206             pr_warn("paca pointer appears corrupt? (%px)\n", p);
0207             continue;
0208         }
0209
0210         pr_warn("irq_soft_mask: 0x%02x in_mce: %d in_nmi: %d",
0211             p->irq_soft_mask, p->in_mce, p->in_nmi);
0212
0213         if (virt_addr_valid(p->__current))
0214             pr_cont(" current: %d (%s)\n", p->__current->pid,
0215                 p->__current->comm);
0216         else
0217             pr_cont(" current pointer corrupt? (%px)\n", p->__current);
0218
0219         pr_warn("Back trace of paca->saved_r1 (0x%016llx) (possibly stale):\n", p->saved_r1);
0220         show_stack(p->__current, (unsigned long *)p->saved_r1, KERN_WARNING);
0221     }
0222 }
0223
0224 void arch_trigger_cpumask_backtrace(const cpumask_t *mask, bool exclude_self)
0225 {
0226     nmi_trigger_cpumask_backtrace(mask, exclude_self, raise_backtrace_ipi);
0227 }
0228 #endif /* defined(CONFIG_PPC_BOOK3S_64) && defined(CONFIG_NMI_IPI) */