1 /* SPDX-License-Identifier: GPL-2.0-only */
2 /*
3  * Common arm64 stack unwinder code.
4  *
5  * To implement a new arm64 stack unwinder:
6  *     1) Include this header
7  *
8  *     2) Provide implementations for the following functions:
9  *          on_overflow_stack():   Returns true if SP is on the overflow
10  *                                 stack.
11  *          on_accessible_stack(): Returns true is SP is on any accessible
12  *                                 stack.
13  *          unwind_next():         Performs validation checks on the frame
14  *                                 pointer, and transitions unwind_state
15  *                                 to the next frame.
16  *
17  *         See: arch/arm64/include/asm/stacktrace.h for reference
18  *              implementations.
19  *
20  * Copyright (C) 2012 ARM Ltd.
21  */
22 #ifndef __ASM_STACKTRACE_COMMON_H
23 #define __ASM_STACKTRACE_COMMON_H
24 
25 #include <linux/bitmap.h>
26 #include <linux/bitops.h>
27 #include <linux/kprobes.h>
28 #include <linux/types.h>
29 
30 enum stack_type {
31 	STACK_TYPE_UNKNOWN,
32 	STACK_TYPE_TASK,
33 	STACK_TYPE_IRQ,
34 	STACK_TYPE_OVERFLOW,
35 	STACK_TYPE_SDEI_NORMAL,
36 	STACK_TYPE_SDEI_CRITICAL,
37 	STACK_TYPE_HYP,
38 	__NR_STACK_TYPES
39 };
40 
41 struct stack_info {
42 	unsigned long low;
43 	unsigned long high;
44 	enum stack_type type;
45 };
46 
47 /*
48  * A snapshot of a frame record or fp/lr register values, along with some
49  * accounting information necessary for robust unwinding.
50  *
51  * @fp:          The fp value in the frame record (or the real fp)
52  * @pc:          The lr value in the frame record (or the real lr)
53  *
54  * @stacks_done: Stacks which have been entirely unwound, for which it is no
55  *               longer valid to unwind to.
56  *
57  * @prev_fp:     The fp that pointed to this frame record, or a synthetic value
58  *               of 0. This is used to ensure that within a stack, each
59  *               subsequent frame record is at an increasing address.
60  * @prev_type:   The type of stack this frame record was on, or a synthetic
61  *               value of STACK_TYPE_UNKNOWN. This is used to detect a
62  *               transition from one stack to another.
63  *
64  * @kr_cur:      When KRETPROBES is selected, holds the kretprobe instance
65  *               associated with the most recently encountered replacement lr
66  *               value.
67  *
68  * @task:        The task being unwound.
69  */
70 struct unwind_state {
71 	unsigned long fp;
72 	unsigned long pc;
73 	DECLARE_BITMAP(stacks_done, __NR_STACK_TYPES);
74 	unsigned long prev_fp;
75 	enum stack_type prev_type;
76 #ifdef CONFIG_KRETPROBES
77 	struct llist_node *kr_cur;
78 #endif
79 	struct task_struct *task;
80 };
81 
82 static inline bool on_overflow_stack(unsigned long sp, unsigned long size,
83 				     struct stack_info *info);
84 
85 static inline bool on_accessible_stack(const struct task_struct *tsk,
86 				       unsigned long sp, unsigned long size,
87 				       struct stack_info *info);
88 
89 static inline int unwind_next(struct unwind_state *state);
90 
91 static inline bool on_stack(unsigned long sp, unsigned long size,
92 			    unsigned long low, unsigned long high,
93 			    enum stack_type type, struct stack_info *info)
94 {
95 	if (!low)
96 		return false;
97 
98 	if (sp < low || sp + size < sp || sp + size > high)
99 		return false;
100 
101 	if (info) {
102 		info->low = low;
103 		info->high = high;
104 		info->type = type;
105 	}
106 	return true;
107 }
108 
109 static inline bool on_accessible_stack_common(const struct task_struct *tsk,
110 					      unsigned long sp,
111 					      unsigned long size,
112 					      struct stack_info *info)
113 {
114 	if (info)
115 		info->type = STACK_TYPE_UNKNOWN;
116 
117 	/*
118 	 * Both the kernel and nvhe hypervisor make use of
119 	 * an overflow_stack
120 	 */
121 	return on_overflow_stack(sp, size, info);
122 }
123 
124 static inline void unwind_init_common(struct unwind_state *state,
125 				      struct task_struct *task)
126 {
127 	state->task = task;
128 #ifdef CONFIG_KRETPROBES
129 	state->kr_cur = NULL;
130 #endif
131 
132 	/*
133 	 * Prime the first unwind.
134 	 *
135 	 * In unwind_next() we'll check that the FP points to a valid stack,
136 	 * which can't be STACK_TYPE_UNKNOWN, and the first unwind will be
137 	 * treated as a transition to whichever stack that happens to be. The
138 	 * prev_fp value won't be used, but we set it to 0 such that it is
139 	 * definitely not an accessible stack address.
140 	 */
141 	bitmap_zero(state->stacks_done, __NR_STACK_TYPES);
142 	state->prev_fp = 0;
143 	state->prev_type = STACK_TYPE_UNKNOWN;
144 }
145 
146 /*
147  * stack_trace_translate_fp_fn() - Translates a non-kernel frame pointer to
148  * a kernel address.
149  *
150  * @fp:   the frame pointer to be updated to its kernel address.
151  * @type: the stack type associated with frame pointer @fp
152  *
153  * Returns true and success and @fp is updated to the corresponding
154  * kernel virtual address; otherwise returns false.
155  */
156 typedef bool (*stack_trace_translate_fp_fn)(unsigned long *fp,
157 					    enum stack_type type);
158 
159 static inline int unwind_next_common(struct unwind_state *state,
160 				     struct stack_info *info,
161 				     stack_trace_translate_fp_fn translate_fp)
162 {
163 	unsigned long fp = state->fp, kern_fp = fp;
164 	struct task_struct *tsk = state->task;
165 
166 	if (fp & 0x7)
167 		return -EINVAL;
168 
169 	if (!on_accessible_stack(tsk, fp, 16, info))
170 		return -EINVAL;
171 
172 	if (test_bit(info->type, state->stacks_done))
173 		return -EINVAL;
174 
175 	/*
176 	 * If fp is not from the current address space perform the necessary
177 	 * translation before dereferencing it to get the next fp.
178 	 */
179 	if (translate_fp && !translate_fp(&kern_fp, info->type))
180 		return -EINVAL;
181 
182 	/*
183 	 * As stacks grow downward, any valid record on the same stack must be
184 	 * at a strictly higher address than the prior record.
185 	 *
186 	 * Stacks can nest in several valid orders, e.g.
187 	 *
188 	 * TASK -> IRQ -> OVERFLOW -> SDEI_NORMAL
189 	 * TASK -> SDEI_NORMAL -> SDEI_CRITICAL -> OVERFLOW
190 	 * HYP -> OVERFLOW
191 	 *
192 	 * ... but the nesting itself is strict. Once we transition from one
193 	 * stack to another, it's never valid to unwind back to that first
194 	 * stack.
195 	 */
196 	if (info->type == state->prev_type) {
197 		if (fp <= state->prev_fp)
198 			return -EINVAL;
199 	} else {
200 		__set_bit(state->prev_type, state->stacks_done);
201 	}
202 
203 	/*
204 	 * Record this frame record's values and location. The prev_fp and
205 	 * prev_type are only meaningful to the next unwind_next() invocation.
206 	 */
207 	state->fp = READ_ONCE(*(unsigned long *)(kern_fp));
208 	state->pc = READ_ONCE(*(unsigned long *)(kern_fp + 8));
209 	state->prev_fp = fp;
210 	state->prev_type = info->type;
211 
212 	return 0;
213 }
214 
215 static inline void notrace unwind(struct unwind_state *state,
216 				  stack_trace_consume_fn consume_entry,
217 				  void *cookie)
218 {
219 	while (1) {
220 		int ret;
221 
222 		if (!consume_entry(cookie, state->pc))
223 			break;
224 		ret = unwind_next(state);
225 		if (ret < 0)
226 			break;
227 	}
228 }
229 NOKPROBE_SYMBOL(unwind);
230 #endif	/* __ASM_STACKTRACE_COMMON_H */
231