1 // SPDX-License-Identifier: GPL-2.0-only
2 #include <linux/module.h>
3 #include <linux/sort.h>
4 #include <asm/ptrace.h>
5 #include <asm/stacktrace.h>
6 #include <asm/unwind.h>
7 #include <asm/orc_types.h>
8 #include <asm/orc_lookup.h>
10 #define orc_warn(fmt, ...) \
11 printk_deferred_once(KERN_WARNING "WARNING: " fmt, ##__VA_ARGS__)
13 #define orc_warn_current(args...) \
15 if (state->task == current) \
19 extern int __start_orc_unwind_ip
[];
20 extern int __stop_orc_unwind_ip
[];
21 extern struct orc_entry __start_orc_unwind
[];
22 extern struct orc_entry __stop_orc_unwind
[];
24 static bool orc_init __ro_after_init
;
25 static unsigned int lookup_num_blocks __ro_after_init
;
27 static DEFINE_MUTEX(sort_mutex
);
28 static int *cur_orc_ip_table
= __start_orc_unwind_ip
;
29 static struct orc_entry
*cur_orc_table
= __start_orc_unwind
;
31 static inline unsigned long orc_ip(const int *ip
)
33 return (unsigned long)ip
+ *ip
;
36 static struct orc_entry
*__orc_find(int *ip_table
, struct orc_entry
*u_table
,
37 unsigned int num_entries
, unsigned long ip
)
39 int *first
= ip_table
;
40 int *last
= ip_table
+ num_entries
- 1;
41 int *mid
= first
, *found
= first
;
47 * Do a binary range search to find the rightmost duplicate of a given
48 * starting address. Some entries are section terminators which are
49 * "weak" entries for ensuring there are no gaps. They should be
50 * ignored when they conflict with a real entry.
52 while (first
<= last
) {
53 mid
= first
+ ((last
- first
) / 2);
55 if (orc_ip(mid
) <= ip
) {
62 return u_table
+ (found
- ip_table
);
66 static struct orc_entry
*orc_module_find(unsigned long ip
)
70 mod
= __module_address(ip
);
71 if (!mod
|| !mod
->arch
.orc_unwind
|| !mod
->arch
.orc_unwind_ip
)
73 return __orc_find(mod
->arch
.orc_unwind_ip
, mod
->arch
.orc_unwind
,
74 mod
->arch
.num_orcs
, ip
);
77 static struct orc_entry
*orc_module_find(unsigned long ip
)
83 #ifdef CONFIG_DYNAMIC_FTRACE
84 static struct orc_entry
*orc_find(unsigned long ip
);
87 * Ftrace dynamic trampolines do not have orc entries of their own.
88 * But they are copies of the ftrace entries that are static and
89 * defined in ftrace_*.S, which do have orc entries.
91 * If the unwinder comes across a ftrace trampoline, then find the
92 * ftrace function that was used to create it, and use that ftrace
93 * function's orc entry, as the placement of the return code in
94 * the stack will be identical.
96 static struct orc_entry
*orc_ftrace_find(unsigned long ip
)
98 struct ftrace_ops
*ops
;
101 ops
= ftrace_ops_trampoline(ip
);
105 if (ops
->flags
& FTRACE_OPS_FL_SAVE_REGS
)
106 caller
= (unsigned long)ftrace_regs_call
;
108 caller
= (unsigned long)ftrace_call
;
110 /* Prevent unlikely recursion */
114 return orc_find(caller
);
117 static struct orc_entry
*orc_ftrace_find(unsigned long ip
)
124 * If we crash with IP==0, the last successfully executed instruction
125 * was probably an indirect function call with a NULL function pointer,
126 * and we don't have unwind information for NULL.
127 * This hardcoded ORC entry for IP==0 allows us to unwind from a NULL function
128 * pointer into its parent and then continue normally from there.
130 static struct orc_entry null_orc_entry
= {
131 .sp_offset
= sizeof(long),
132 .sp_reg
= ORC_REG_SP
,
133 .bp_reg
= ORC_REG_UNDEFINED
,
134 .type
= ORC_TYPE_CALL
137 /* Fake frame pointer entry -- used as a fallback for generated code */
138 static struct orc_entry orc_fp_entry
= {
139 .type
= ORC_TYPE_CALL
,
140 .sp_reg
= ORC_REG_BP
,
142 .bp_reg
= ORC_REG_PREV_SP
,
147 static struct orc_entry
*orc_find(unsigned long ip
)
149 static struct orc_entry
*orc
;
152 return &null_orc_entry
;
154 /* For non-init vmlinux addresses, use the fast lookup table: */
155 if (ip
>= LOOKUP_START_IP
&& ip
< LOOKUP_STOP_IP
) {
156 unsigned int idx
, start
, stop
;
158 idx
= (ip
- LOOKUP_START_IP
) / LOOKUP_BLOCK_SIZE
;
160 if (unlikely((idx
>= lookup_num_blocks
-1))) {
161 orc_warn("WARNING: bad lookup idx: idx=%u num=%u ip=%pB\n",
162 idx
, lookup_num_blocks
, (void *)ip
);
166 start
= orc_lookup
[idx
];
167 stop
= orc_lookup
[idx
+ 1] + 1;
169 if (unlikely((__start_orc_unwind
+ start
>= __stop_orc_unwind
) ||
170 (__start_orc_unwind
+ stop
> __stop_orc_unwind
))) {
171 orc_warn("WARNING: bad lookup value: idx=%u num=%u start=%u stop=%u ip=%pB\n",
172 idx
, lookup_num_blocks
, start
, stop
, (void *)ip
);
176 return __orc_find(__start_orc_unwind_ip
+ start
,
177 __start_orc_unwind
+ start
, stop
- start
, ip
);
180 /* vmlinux .init slow lookup: */
181 if (init_kernel_text(ip
))
182 return __orc_find(__start_orc_unwind_ip
, __start_orc_unwind
,
183 __stop_orc_unwind_ip
- __start_orc_unwind_ip
, ip
);
186 orc
= orc_module_find(ip
);
190 return orc_ftrace_find(ip
);
193 #ifdef CONFIG_MODULES
195 static void orc_sort_swap(void *_a
, void *_b
, int size
)
197 struct orc_entry
*orc_a
, *orc_b
;
198 struct orc_entry orc_tmp
;
199 int *a
= _a
, *b
= _b
, tmp
;
202 /* Swap the .orc_unwind_ip entries: */
207 /* Swap the corresponding .orc_unwind entries: */
208 orc_a
= cur_orc_table
+ (a
- cur_orc_ip_table
);
209 orc_b
= cur_orc_table
+ (b
- cur_orc_ip_table
);
215 static int orc_sort_cmp(const void *_a
, const void *_b
)
217 struct orc_entry
*orc_a
;
218 const int *a
= _a
, *b
= _b
;
219 unsigned long a_val
= orc_ip(a
);
220 unsigned long b_val
= orc_ip(b
);
228 * The "weak" section terminator entries need to always be on the left
229 * to ensure the lookup code skips them in favor of real entries.
230 * These terminator entries exist to handle any gaps created by
231 * whitelisted .o files which didn't get objtool generation.
233 orc_a
= cur_orc_table
+ (a
- cur_orc_ip_table
);
234 return orc_a
->sp_reg
== ORC_REG_UNDEFINED
&& !orc_a
->end
? -1 : 1;
237 void unwind_module_init(struct module
*mod
, void *_orc_ip
, size_t orc_ip_size
,
238 void *_orc
, size_t orc_size
)
240 int *orc_ip
= _orc_ip
;
241 struct orc_entry
*orc
= _orc
;
242 unsigned int num_entries
= orc_ip_size
/ sizeof(int);
244 WARN_ON_ONCE(orc_ip_size
% sizeof(int) != 0 ||
245 orc_size
% sizeof(*orc
) != 0 ||
246 num_entries
!= orc_size
/ sizeof(*orc
));
249 * The 'cur_orc_*' globals allow the orc_sort_swap() callback to
250 * associate an .orc_unwind_ip table entry with its corresponding
251 * .orc_unwind entry so they can both be swapped.
253 mutex_lock(&sort_mutex
);
254 cur_orc_ip_table
= orc_ip
;
256 sort(orc_ip
, num_entries
, sizeof(int), orc_sort_cmp
, orc_sort_swap
);
257 mutex_unlock(&sort_mutex
);
259 mod
->arch
.orc_unwind_ip
= orc_ip
;
260 mod
->arch
.orc_unwind
= orc
;
261 mod
->arch
.num_orcs
= num_entries
;
265 void __init
unwind_init(void)
267 size_t orc_ip_size
= (void *)__stop_orc_unwind_ip
- (void *)__start_orc_unwind_ip
;
268 size_t orc_size
= (void *)__stop_orc_unwind
- (void *)__start_orc_unwind
;
269 size_t num_entries
= orc_ip_size
/ sizeof(int);
270 struct orc_entry
*orc
;
273 if (!num_entries
|| orc_ip_size
% sizeof(int) != 0 ||
274 orc_size
% sizeof(struct orc_entry
) != 0 ||
275 num_entries
!= orc_size
/ sizeof(struct orc_entry
)) {
276 orc_warn("WARNING: Bad or missing .orc_unwind table. Disabling unwinder.\n");
281 * Note, the orc_unwind and orc_unwind_ip tables were already
282 * sorted at build time via the 'sorttable' tool.
283 * It's ready for binary search straight away, no need to sort it.
286 /* Initialize the fast lookup table: */
287 lookup_num_blocks
= orc_lookup_end
- orc_lookup
;
288 for (i
= 0; i
< lookup_num_blocks
-1; i
++) {
289 orc
= __orc_find(__start_orc_unwind_ip
, __start_orc_unwind
,
291 LOOKUP_START_IP
+ (LOOKUP_BLOCK_SIZE
* i
));
293 orc_warn("WARNING: Corrupt .orc_unwind table. Disabling unwinder.\n");
297 orc_lookup
[i
] = orc
- __start_orc_unwind
;
300 /* Initialize the ending block: */
301 orc
= __orc_find(__start_orc_unwind_ip
, __start_orc_unwind
, num_entries
,
304 orc_warn("WARNING: Corrupt .orc_unwind table. Disabling unwinder.\n");
307 orc_lookup
[lookup_num_blocks
-1] = orc
- __start_orc_unwind
;
312 unsigned long unwind_get_return_address(struct unwind_state
*state
)
314 if (unwind_done(state
))
317 return __kernel_text_address(state
->ip
) ? state
->ip
: 0;
319 EXPORT_SYMBOL_GPL(unwind_get_return_address
);
321 unsigned long *unwind_get_return_address_ptr(struct unwind_state
*state
)
323 if (unwind_done(state
))
327 return &state
->regs
->ip
;
330 return (unsigned long *)state
->sp
- 1;
335 static bool stack_access_ok(struct unwind_state
*state
, unsigned long _addr
,
338 struct stack_info
*info
= &state
->stack_info
;
339 void *addr
= (void *)_addr
;
341 if (!on_stack(info
, addr
, len
) &&
342 (get_stack_info(addr
, state
->task
, info
, &state
->stack_mask
)))
348 static bool deref_stack_reg(struct unwind_state
*state
, unsigned long addr
,
351 if (!stack_access_ok(state
, addr
, sizeof(long)))
354 *val
= READ_ONCE_NOCHECK(*(unsigned long *)addr
);
358 static bool deref_stack_regs(struct unwind_state
*state
, unsigned long addr
,
359 unsigned long *ip
, unsigned long *sp
)
361 struct pt_regs
*regs
= (struct pt_regs
*)addr
;
363 /* x86-32 support will be more complicated due to the ®s->sp hack */
364 BUILD_BUG_ON(IS_ENABLED(CONFIG_X86_32
));
366 if (!stack_access_ok(state
, addr
, sizeof(struct pt_regs
)))
374 static bool deref_stack_iret_regs(struct unwind_state
*state
, unsigned long addr
,
375 unsigned long *ip
, unsigned long *sp
)
377 struct pt_regs
*regs
= (void *)addr
- IRET_FRAME_OFFSET
;
379 if (!stack_access_ok(state
, addr
, IRET_FRAME_SIZE
))
387 bool unwind_next_frame(struct unwind_state
*state
)
389 unsigned long ip_p
, sp
, orig_ip
= state
->ip
, prev_sp
= state
->sp
;
390 enum stack_type prev_type
= state
->stack_info
.type
;
391 struct orc_entry
*orc
;
392 bool indirect
= false;
394 if (unwind_done(state
))
397 /* Don't let modules unload while we're reading their ORC data. */
400 /* End-of-stack check for user tasks: */
401 if (state
->regs
&& user_mode(state
->regs
))
405 * Find the orc_entry associated with the text address.
407 * Decrement call return addresses by one so they work for sibling
408 * calls and calls to noreturn functions.
410 orc
= orc_find(state
->signal
? state
->ip
: state
->ip
- 1);
413 * As a fallback, try to assume this code uses a frame pointer.
414 * This is useful for generated code, like BPF, which ORC
415 * doesn't know about. This is just a guess, so the rest of
416 * the unwind is no longer considered reliable.
422 /* End-of-stack check for kernel threads: */
423 if (orc
->sp_reg
== ORC_REG_UNDEFINED
) {
430 /* Find the previous frame's stack: */
431 switch (orc
->sp_reg
) {
433 sp
= state
->sp
+ orc
->sp_offset
;
437 sp
= state
->bp
+ orc
->sp_offset
;
440 case ORC_REG_SP_INDIRECT
:
441 sp
= state
->sp
+ orc
->sp_offset
;
445 case ORC_REG_BP_INDIRECT
:
446 sp
= state
->bp
+ orc
->sp_offset
;
451 if (!state
->regs
|| !state
->full_regs
) {
452 orc_warn_current("missing R10 value at %pB\n",
456 sp
= state
->regs
->r10
;
460 if (!state
->regs
|| !state
->full_regs
) {
461 orc_warn_current("missing R13 value at %pB\n",
465 sp
= state
->regs
->r13
;
469 if (!state
->regs
|| !state
->full_regs
) {
470 orc_warn_current("missing RDI value at %pB\n",
474 sp
= state
->regs
->di
;
478 if (!state
->regs
|| !state
->full_regs
) {
479 orc_warn_current("missing DX value at %pB\n",
483 sp
= state
->regs
->dx
;
487 orc_warn("unknown SP base reg %d at %pB\n",
488 orc
->sp_reg
, (void *)state
->ip
);
493 if (!deref_stack_reg(state
, sp
, &sp
))
497 /* Find IP, SP and possibly regs: */
500 ip_p
= sp
- sizeof(long);
502 if (!deref_stack_reg(state
, ip_p
, &state
->ip
))
505 state
->ip
= ftrace_graph_ret_addr(state
->task
, &state
->graph_idx
,
506 state
->ip
, (void *)ip_p
);
510 state
->signal
= false;
514 if (!deref_stack_regs(state
, sp
, &state
->ip
, &state
->sp
)) {
515 orc_warn_current("can't access registers at %pB\n",
520 state
->regs
= (struct pt_regs
*)sp
;
521 state
->full_regs
= true;
522 state
->signal
= true;
525 case ORC_TYPE_REGS_IRET
:
526 if (!deref_stack_iret_regs(state
, sp
, &state
->ip
, &state
->sp
)) {
527 orc_warn_current("can't access iret registers at %pB\n",
532 state
->regs
= (void *)sp
- IRET_FRAME_OFFSET
;
533 state
->full_regs
= false;
534 state
->signal
= true;
538 orc_warn("unknown .orc_unwind entry type %d at %pB\n",
539 orc
->type
, (void *)orig_ip
);
544 switch (orc
->bp_reg
) {
545 case ORC_REG_UNDEFINED
:
546 if (state
->regs
&& state
->full_regs
)
547 state
->bp
= state
->regs
->bp
;
550 case ORC_REG_PREV_SP
:
551 if (!deref_stack_reg(state
, sp
+ orc
->bp_offset
, &state
->bp
))
556 if (!deref_stack_reg(state
, state
->bp
+ orc
->bp_offset
, &state
->bp
))
561 orc_warn("unknown BP base reg %d for ip %pB\n",
562 orc
->bp_reg
, (void *)orig_ip
);
566 /* Prevent a recursive loop due to bad ORC data: */
567 if (state
->stack_info
.type
== prev_type
&&
568 on_stack(&state
->stack_info
, (void *)state
->sp
, sizeof(long)) &&
569 state
->sp
<= prev_sp
) {
570 orc_warn_current("stack going in the wrong direction? at %pB\n",
583 state
->stack_info
.type
= STACK_TYPE_UNKNOWN
;
586 EXPORT_SYMBOL_GPL(unwind_next_frame
);
588 void __unwind_start(struct unwind_state
*state
, struct task_struct
*task
,
589 struct pt_regs
*regs
, unsigned long *first_frame
)
594 memset(state
, 0, sizeof(*state
));
598 * Refuse to unwind the stack of a task while it's executing on another
599 * CPU. This check is racy, but that's ok: the unwinder has other
600 * checks to prevent it from going off the rails.
602 if (task_on_another_cpu(task
))
609 state
->ip
= regs
->ip
;
610 state
->sp
= regs
->sp
;
611 state
->bp
= regs
->bp
;
613 state
->full_regs
= true;
614 state
->signal
= true;
616 } else if (task
== current
) {
617 asm volatile("lea (%%rip), %0\n\t"
620 : "=r" (state
->ip
), "=r" (state
->sp
),
624 struct inactive_task_frame
*frame
= (void *)task
->thread
.sp
;
626 state
->sp
= task
->thread
.sp
;
627 state
->bp
= READ_ONCE_NOCHECK(frame
->bp
);
628 state
->ip
= READ_ONCE_NOCHECK(frame
->ret_addr
);
631 if (get_stack_info((unsigned long *)state
->sp
, state
->task
,
632 &state
->stack_info
, &state
->stack_mask
)) {
634 * We weren't on a valid stack. It's possible that
635 * we overflowed a valid stack into a guard page.
636 * See if the next page up is valid so that we can
637 * generate some kind of backtrace if this happens.
639 void *next_page
= (void *)PAGE_ALIGN((unsigned long)state
->sp
);
640 if (get_stack_info(next_page
, state
->task
, &state
->stack_info
,
646 * The caller can provide the address of the first frame directly
647 * (first_frame) or indirectly (regs->sp) to indicate which stack frame
648 * to start unwinding at. Skip ahead until we reach it.
651 /* When starting from regs, skip the regs frame: */
653 unwind_next_frame(state
);
657 /* Otherwise, skip ahead to the user-specified starting frame: */
658 while (!unwind_done(state
) &&
659 (!on_stack(&state
->stack_info
, first_frame
, sizeof(long)) ||
660 state
->sp
< (unsigned long)first_frame
))
661 unwind_next_frame(state
);
666 state
->stack_info
.type
= STACK_TYPE_UNKNOWN
;
669 EXPORT_SYMBOL_GPL(__unwind_start
);