From 995db8ab88916b6397676b67be98c0a4f82cca49 Mon Sep 17 00:00:00 2001 From: Hong YANG Date: Mon, 15 Nov 2021 15:41:01 +0800 Subject: [PATCH 1/3] arm64: Support overflow stack panic Kernel commit <872d8327ce89> ("arm64: add VMAP_STACK overflow detection") has supported the overflow stack exception handling. Without the patch, the "bt" command will make crash generate a core dump because of segmentation fault. With the patch, the "bt" command can display the overflow stack. Before: crash> bt PID: 3607 TASK: ffffffcbf9a4da00 CPU: 2 COMMAND: "sh" Segmentation fault (core dumped) After: crash> bt PID: 3607 TASK: ffffffcbf9a4da00 CPU: 2 COMMAND: "sh" #0 [ffffffccbfd85f50] __delay at ffffff8008ceded8 ... #5 [ffffffccbfd85fd0] emergency_restart at ffffff80080d49fc #6 [ffffffccbfd86140] panic at ffffff80080af4c0 #7 [ffffffccbfd86150] nmi_panic at ffffff80080af150 #8 [ffffffccbfd86190] handle_bad_stack at ffffff800808b0b8 #9 [ffffffccbfd862d0] __bad_stack at ffffff800808285c PC: ffffff8008082e80 [el1_sync] LR: ffffff8000d6c214 [stack_overflow_demo+84] SP: ffffff1a79930070 PSTATE: 204003c5 X29: ffffff8011b03d00 X28: ffffffcbf9a4da00 X27: ffffff8008e02000 X26: 0000000000000040 X25: 0000000000000124 X24: ffffffcbf9a4da00 X23: 0000007daec2e288 X22: ffffffcbfe03b800 X21: 0000007daec2e288 X20: 0000000000000002 X19: 0000000000000002 X18: 0000000000000002 X17: 00000000000003e7 X16: 0000000000000000 X15: 0000000000000000 X14: ffffffcc17facb00 X13: ffffffccb4c25c00 X12: 0000000000000000 X11: ffffffcc17fad660 X10: 0000000000000af0 X9: 0000000000000000 X8: ffffff1a799334f0 X7: 0000000000000000 X6: 000000000000003f X5: 0000000000000040 X4: 0000000000000010 X3: 00000065981d07f0 X2: 00000065981d07f0 X1: 0000000000000000 X0: ffffff1a799334f0 Signed-off-by: Hong YANG --- arm64.c | 169 ++++++++++++++++++++++++++++++++++++++++++++++++++------ defs.h | 6 ++ 2 files changed, 159 insertions(+), 16 deletions(-) diff --git a/arm64.c b/arm64.c index 94681d1a37db..23c3d75d85aa 100644 --- a/arm64.c +++ b/arm64.c @@ -45,6 +45,7 @@ static int arm64_vtop_3level_4k(ulong, ulong, physaddr_t *, int); static int arm64_vtop_4level_4k(ulong, ulong, physaddr_t *, int); static ulong arm64_get_task_pgd(ulong); static void arm64_irq_stack_init(void); +static void arm64_overflow_stack_init(void); static void arm64_stackframe_init(void); static int arm64_eframe_search(struct bt_info *); static int arm64_is_kernel_exception_frame(struct bt_info *, ulong); @@ -63,6 +64,7 @@ static int arm64_get_dumpfile_stackframe(struct bt_info *, struct arm64_stackfra static int arm64_in_kdump_text(struct bt_info *, struct arm64_stackframe *); static int arm64_in_kdump_text_on_irq_stack(struct bt_info *); static int arm64_switch_stack(struct bt_info *, struct arm64_stackframe *, FILE *); +static int arm64_switch_stack_from_overflow(struct bt_info *, struct arm64_stackframe *, FILE *); static int arm64_get_stackframe(struct bt_info *, struct arm64_stackframe *); static void arm64_get_stack_frame(struct bt_info *, ulong *, ulong *); static void arm64_gen_hidden_frame(struct bt_info *bt, ulong, struct arm64_stackframe *); @@ -78,8 +80,11 @@ static int arm64_get_smp_cpus(void); static void arm64_clear_machdep_cache(void); static int arm64_on_process_stack(struct bt_info *, ulong); static int arm64_in_alternate_stack(int, ulong); +static int arm64_in_alternate_stackv(int cpu, ulong stkptr, ulong *stacks, ulong stack_size); static int arm64_on_irq_stack(int, ulong); +static int arm64_on_overflow_stack(int, ulong); static void arm64_set_irq_stack(struct bt_info *); +static void arm64_set_overflow_stack(struct bt_info *); static void arm64_set_process_stack(struct bt_info *); static int arm64_get_kvaddr_ranges(struct vaddr_range *); static void arm64_get_crash_notes(void); @@ -463,6 +468,7 @@ arm64_init(int when) machdep->hz = 100; arm64_irq_stack_init(); + arm64_overflow_stack_init(); arm64_stackframe_init(); break; @@ -1715,6 +1721,49 @@ arm64_irq_stack_init(void) } } +/* + * Gather Overflow stack values. + * + * Overflow stack supported since 4.14, in commit 872d8327c + */ +static void +arm64_overflow_stack_init(void) +{ + int i; + struct syment *sp; + struct gnu_request request, *req; + struct machine_specific *ms = machdep->machspec; + req = &request; + + if (symbol_exists("overflow_stack") && + (sp = per_cpu_symbol_search("overflow_stack")) && + get_symbol_type("overflow_stack", NULL, req)) { + if (CRASHDEBUG(1)) { + fprintf(fp, "overflow_stack: \n"); + fprintf(fp, " type: %x, %s\n", + (int)req->typecode, + (req->typecode == TYPE_CODE_ARRAY) ? + "TYPE_CODE_ARRAY" : "other"); + fprintf(fp, " target_typecode: %x, %s\n", + (int)req->target_typecode, + req->target_typecode == TYPE_CODE_INT ? + "TYPE_CODE_INT" : "other"); + fprintf(fp, " target_length: %ld\n", + req->target_length); + fprintf(fp, " length: %ld\n", req->length); + } + + if (!(ms->overflow_stacks = (ulong *)malloc((size_t)(kt->cpus * sizeof(ulong))))) + error(FATAL, "cannot malloc overflow_stack addresses\n"); + + ms->overflow_stack_size = ARM64_OVERFLOW_STACK_SIZE; + machdep->flags |= OVERFLOW_STACKS; + + for (i = 0; i < kt->cpus; i++) + ms->overflow_stacks[i] = kt->__per_cpu_offset[i] + sp->value; + } +} + /* * Gather and verify all of the backtrace requirements. */ @@ -1960,6 +2009,7 @@ static char *arm64_exception_functions[] = { "do_mem_abort", "do_el0_irq_bp_hardening", "do_sp_pc_abort", + "handle_bad_stack", NULL }; @@ -1978,7 +2028,10 @@ arm64_in_exception_text(ulong ptr) if ((ptr >= ms->__exception_text_start) && (ptr < ms->__exception_text_end)) return TRUE; - } else if ((name = closest_symbol(ptr))) { /* Linux 5.5 and later */ + } + + name = closest_symbol(ptr); + if (name != NULL) { /* Linux 5.5 and later */ for (func = &arm64_exception_functions[0]; *func; func++) { if (STREQ(name, *func)) return TRUE; @@ -2252,15 +2305,14 @@ arm64_unwind_frame(struct bt_info *bt, struct arm64_stackframe *frame) if ((frame->fp == 0) && (frame->pc == 0)) return FALSE; - if (!(machdep->flags & IRQ_STACKS)) - return TRUE; - - if (!(machdep->flags & IRQ_STACKS)) + if (!(machdep->flags & (IRQ_STACKS | OVERFLOW_STACKS))) return TRUE; if (machdep->flags & UNW_4_14) { - if ((bt->flags & BT_IRQSTACK) && - !arm64_on_irq_stack(bt->tc->processor, frame->fp)) { + if (((bt->flags & BT_IRQSTACK) && + !arm64_on_irq_stack(bt->tc->processor, frame->fp)) || + ((bt->flags & BT_OVERFLOW_STACK) && + !arm64_on_overflow_stack(bt->tc->processor, frame->fp))) { if (arm64_on_process_stack(bt, frame->fp)) { arm64_set_process_stack(bt); @@ -2677,6 +2729,9 @@ arm64_back_trace_cmd(struct bt_info *bt) if (arm64_on_irq_stack(bt->tc->processor, bt->frameptr)) { arm64_set_irq_stack(bt); bt->flags |= BT_IRQSTACK; + } else if (arm64_on_overflow_stack(bt->tc->processor, bt->frameptr)) { + arm64_set_overflow_stack(bt); + bt->flags |= BT_OVERFLOW_STACK; } stackframe.sp = bt->stkptr; stackframe.pc = bt->instptr; @@ -2731,7 +2786,9 @@ arm64_back_trace_cmd(struct bt_info *bt) break; if (arm64_in_exception_text(bt->instptr) && INSTACK(stackframe.fp, bt)) { - if (!(bt->flags & BT_IRQSTACK) || + if (bt->flags & BT_OVERFLOW_STACK) { + exception_frame = stackframe.fp - KERN_EFRAME_OFFSET; + } else if (!(bt->flags & BT_IRQSTACK) || ((stackframe.sp + SIZE(pt_regs)) < bt->stacktop)) { if (arm64_is_kernel_exception_frame(bt, stackframe.fp - KERN_EFRAME_OFFSET)) exception_frame = stackframe.fp - KERN_EFRAME_OFFSET; @@ -2745,6 +2802,12 @@ arm64_back_trace_cmd(struct bt_info *bt) break; } + if ((bt->flags & BT_OVERFLOW_STACK) && + !arm64_on_overflow_stack(bt->tc->processor, stackframe.fp)) { + bt->flags &= ~BT_OVERFLOW_STACK; + if (arm64_switch_stack_from_overflow(bt, &stackframe, ofp) == USER_MODE) + break; + } level++; } @@ -3131,6 +3194,43 @@ arm64_switch_stack(struct bt_info *bt, struct arm64_stackframe *frame, FILE *ofp return KERNEL_MODE; } +static int +arm64_switch_stack_from_overflow(struct bt_info *bt, struct arm64_stackframe *frame, FILE *ofp) +{ + int i; + ulong stacktop, words, addr; + ulong *stackbuf; + char buf[BUFSIZE]; + struct machine_specific *ms = machdep->machspec; + + if (bt->flags & BT_FULL) { + stacktop = ms->overflow_stacks[bt->tc->processor] + ms->overflow_stack_size; + words = (stacktop - bt->bptr) / sizeof(ulong); + stackbuf = (ulong *)GETBUF(words * sizeof(ulong)); + readmem(bt->bptr, KVADDR, stackbuf, words * sizeof(long), + "top of overflow stack", FAULT_ON_ERROR); + + addr = bt->bptr; + for (i = 0; i < words; i++) { + if (!(i & 1)) + fprintf(ofp, "%s %lx: ", i ? "\n" : "", addr); + fprintf(ofp, "%s ", format_stack_entry(bt, buf, stackbuf[i], 0)); + addr += sizeof(ulong); + } + fprintf(ofp, "\n"); + FREEBUF(stackbuf); + } + fprintf(ofp, "--- ---\n"); + + if (frame->fp == 0) + return USER_MODE; + + if (!(machdep->flags & UNW_4_14)) + arm64_print_exception_frame(bt, frame->sp, KERNEL_MODE, ofp); + + return KERNEL_MODE; +} + static int arm64_get_dumpfile_stackframe(struct bt_info *bt, struct arm64_stackframe *frame) { @@ -3682,6 +3782,16 @@ arm64_display_machine_stats(void) machdep->machspec->irq_stacks[i]); } } + if (machdep->machspec->overflow_stack_size) { + fprintf(fp, "OVERFLOW STACK SIZE: %ld\n", + machdep->machspec->overflow_stack_size); + fprintf(fp, " OVERFLOW STACKS:\n"); + for (i = 0; i < kt->cpus; i++) { + pad = (i < 10) ? 3 : (i < 100) ? 2 : (i < 1000) ? 1 : 0; + fprintf(fp, "%s CPU %d: %lx\n", space(pad), i, + machdep->machspec->overflow_stacks[i]); + } + } } static int @@ -3875,24 +3985,41 @@ arm64_on_process_stack(struct bt_info *bt, ulong stkptr) } static int -arm64_on_irq_stack(int cpu, ulong stkptr) +arm64_in_alternate_stackv(int cpu, ulong stkptr, ulong *stacks, ulong stack_size) { - return arm64_in_alternate_stack(cpu, stkptr); + if ((cpu >= kt->cpus) || (stacks == NULL) || !stack_size) + return FALSE; + + if ((stkptr >= stacks[cpu]) && + (stkptr < (stacks[cpu] + stack_size))) + return TRUE; + + return FALSE; } static int arm64_in_alternate_stack(int cpu, ulong stkptr) +{ + return (arm64_on_irq_stack(cpu, stkptr) || + arm64_on_overflow_stack(cpu, stkptr)); +} + +static int +arm64_on_irq_stack(int cpu, ulong stkptr) { struct machine_specific *ms = machdep->machspec; - if (!ms->irq_stack_size || (cpu >= kt->cpus)) - return FALSE; + return arm64_in_alternate_stackv(cpu, stkptr, + ms->irq_stacks, ms->irq_stack_size); +} - if ((stkptr >= ms->irq_stacks[cpu]) && - (stkptr < (ms->irq_stacks[cpu] + ms->irq_stack_size))) - return TRUE; +static int +arm64_on_overflow_stack(int cpu, ulong stkptr) +{ + struct machine_specific *ms = machdep->machspec; - return FALSE; + return arm64_in_alternate_stackv(cpu, stkptr, + ms->overflow_stacks, ms->overflow_stack_size); } static void @@ -3905,6 +4032,16 @@ arm64_set_irq_stack(struct bt_info *bt) alter_stackbuf(bt); } +static void +arm64_set_overflow_stack(struct bt_info *bt) +{ + struct machine_specific *ms = machdep->machspec; + + bt->stackbase = ms->overflow_stacks[bt->tc->processor]; + bt->stacktop = bt->stackbase + ms->overflow_stack_size; + alter_stackbuf(bt); +} + static void arm64_set_process_stack(struct bt_info *bt) { diff --git a/defs.h b/defs.h index a2f30853a4b1..7e2a16e34a59 100644 --- a/defs.h +++ b/defs.h @@ -3218,6 +3218,7 @@ typedef signed int s32; #define UNW_4_14 (0x200) #define FLIPPED_VM (0x400) #define HAS_PHYSVIRT_OFFSET (0x800) +#define OVERFLOW_STACKS (0x1000) /* * Get kimage_voffset from /dev/crash @@ -3260,6 +3261,7 @@ typedef signed int s32; #define ARM64_STACK_SIZE (16384) #define ARM64_IRQ_STACK_SIZE ARM64_STACK_SIZE +#define ARM64_OVERFLOW_STACK_SIZE (4096) #define _SECTION_SIZE_BITS 30 #define _SECTION_SIZE_BITS_5_12 27 @@ -3332,6 +3334,9 @@ struct machine_specific { char *irq_stackbuf; ulong __irqentry_text_start; ulong __irqentry_text_end; + ulong overflow_stack_size; + ulong *overflow_stacks; + char *overflow_stackbuf; /* for exception vector code */ ulong exp_entry1_start; ulong exp_entry1_end; @@ -5770,6 +5775,7 @@ ulong cpu_map_addr(const char *type); #define BT_CPUMASK (0x1000000000000ULL) #define BT_SHOW_ALL_REGS (0x2000000000000ULL) #define BT_REGS_NOT_FOUND (0x4000000000000ULL) +#define BT_OVERFLOW_STACK (0x8000000000000ULL) #define BT_SYMBOL_OFFSET (BT_SYMBOLIC_ARGS) #define BT_REF_HEXVAL (0x1) -- 2.30.2