osfmk/kern/backtrace.c

   1 /*
   2  * Copyright (c) 2016 Apple Inc. All rights reserved.
   3  *
   4  * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
   5  *
   6  * This file contains Original Code and/or Modifications of Original Code
   7  * as defined in and that are subject to the Apple Public Source License
   8  * Version 2.0 (the 'License'). You may not use this file except in
   9  * compliance with the License. The rights granted to you under the License
  10  * may not be used to create, or enable the creation or redistribution of,
  11  * unlawful or unlicensed copies of an Apple operating system, or to
  12  * circumvent, violate, or enable the circumvention or violation of, any
  13  * terms of an Apple operating system software license agreement.
  14  *
  15  * Please obtain a copy of the License at
  16  * http://www.opensource.apple.com/apsl/ and read it before using this file.
  17  *
  18  * The Original Code and all software distributed under the License are
  19  * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
  20  * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
  21  * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
  22  * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
  23  * Please see the License for the specific language governing rights and
  24  * limitations under the License.
  25  *
  26  * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
  27  */
  28
  29 #include <stddef.h>
  30 #include <stdint.h>
  31
  32 #include <kern/assert.h>
  33 #include <kern/backtrace.h>
  34 #include <kern/thread.h>
  35 #include <sys/errno.h>
  36 #include <vm/vm_map.h>
  37
  38 #if defined(__arm__) || defined(__arm64__)
  39 #include <arm/cpu_data.h>
  40 #include <arm/cpu_data_internal.h>
  41 #endif
  42
  43 #if defined(HAS_APPLE_PAC)
  44 #include <ptrauth.h>
  45 #endif
  46
  47
  48 unsigned int __attribute__((noinline))
  49 backtrace(uintptr_t *bt, unsigned int max_frames, bool *was_truncated_out)
  50 {
  51         return backtrace_frame(bt, max_frames, __builtin_frame_address(0),
  52             was_truncated_out);
  53 }
  54
  55 /*
  56  * This function captures a backtrace from the current stack and returns the
  57  * number of frames captured, limited by max_frames and starting at start_frame.
  58  * It's fast because it does no checking to make sure there isn't bad data.
  59  * Since it's only called from threads that we're going to keep executing,
  60  * if there's bad data we were going to die eventually.  If this function is
  61  * inlined, it doesn't record the frame of the function it's inside (because
  62  * there's no stack frame).
  63  */
  64 unsigned int __attribute__((noinline, not_tail_called))
  65 backtrace_frame(uintptr_t *bt, unsigned int max_frames, void *start_frame,
  66     bool *was_truncated_out)
  67 {
  68         thread_t thread = current_thread();
  69         uintptr_t *fp;
  70         unsigned int frame_index = 0;
  71         uintptr_t top, bottom;
  72         bool in_valid_stack;
  73
  74         assert(bt != NULL);
  75         assert(max_frames > 0);
  76
  77         fp = start_frame;
  78         bottom = thread->kernel_stack;
  79         top = bottom + kernel_stack_size;
  80
  81 #define IN_STK_BOUNDS(__addr) \
  82         (((uintptr_t)(__addr) >= (uintptr_t)bottom) && \
  83         ((uintptr_t)(__addr) < (uintptr_t)top))
  84
  85         in_valid_stack = IN_STK_BOUNDS(fp);
  86
  87         if (!in_valid_stack) {
  88                 fp = NULL;
  89         }
  90
  91         while (fp != NULL && frame_index < max_frames) {
  92                 uintptr_t *next_fp = (uintptr_t *)*fp;
  93                 uintptr_t ret_addr = *(fp + 1); /* return address is one word higher than frame pointer */
  94
  95                 /*
  96                  * If the frame pointer is 0, backtracing has reached the top of
  97                  * the stack and there is no return address.  Some stacks might not
  98                  * have set this up, so bounds check, as well.
  99                  */
 100                 in_valid_stack = IN_STK_BOUNDS(next_fp);
 101
 102                 if (next_fp == NULL || !in_valid_stack) {
 103                         break;
 104                 }
 105
 106 #if defined(HAS_APPLE_PAC)
 107                 /* return addresses signed by arm64e ABI */
 108                 bt[frame_index++] = (uintptr_t) ptrauth_strip((void *)ret_addr, ptrauth_key_return_address);
 109 #else /* defined(HAS_APPLE_PAC) */
 110                 bt[frame_index++] = ret_addr;
 111 #endif /* !defined(HAS_APPLE_PAC) */
 112
 113                 /* stacks grow down; backtracing should be moving to higher addresses */
 114                 if (next_fp <= fp) {
 115                         break;
 116                 }
 117                 fp = next_fp;
 118         }
 119
 120         /* NULL-terminate the list, if space is available */
 121         if (frame_index != max_frames) {
 122                 bt[frame_index] = 0;
 123         }
 124
 125         if (fp != NULL && frame_index == max_frames && was_truncated_out) {
 126                 *was_truncated_out = true;
 127         }
 128
 129         return frame_index;
 130 #undef IN_STK_BOUNDS
 131 }
 132
 133 #if defined(__x86_64__)
 134
 135 static kern_return_t
 136 interrupted_kernel_pc_fp(uintptr_t *pc, uintptr_t *fp)
 137 {
 138         x86_saved_state_t *state;
 139         bool state_64;
 140         uint64_t cs;
 141
 142         state = current_cpu_datap()->cpu_int_state;
 143         if (!state) {
 144                 return KERN_FAILURE;
 145         }
 146
 147         state_64 = is_saved_state64(state);
 148
 149         if (state_64) {
 150                 cs = saved_state64(state)->isf.cs;
 151         } else {
 152                 cs = saved_state32(state)->cs;
 153         }
 154         /* return early if interrupted a thread in user space */
 155         if ((cs & SEL_PL) == SEL_PL_U) {
 156                 return KERN_FAILURE;
 157         }
 158
 159         if (state_64) {
 160                 *pc = saved_state64(state)->isf.rip;
 161                 *fp = saved_state64(state)->rbp;
 162         } else {
 163                 *pc = saved_state32(state)->eip;
 164                 *fp = saved_state32(state)->ebp;
 165         }
 166         return KERN_SUCCESS;
 167 }
 168
 169 #elif defined(__arm64__)
 170
 171 static kern_return_t
 172 interrupted_kernel_pc_fp(uintptr_t *pc, uintptr_t *fp)
 173 {
 174         struct arm_saved_state *state;
 175         bool state_64;
 176
 177         state = getCpuDatap()->cpu_int_state;
 178         if (!state) {
 179                 return KERN_FAILURE;
 180         }
 181         state_64 = is_saved_state64(state);
 182
 183         /* return early if interrupted a thread in user space */
 184         if (PSR64_IS_USER(get_saved_state_cpsr(state))) {
 185                 return KERN_FAILURE;
 186         }
 187
 188         *pc = get_saved_state_pc(state);
 189         *fp = get_saved_state_fp(state);
 190         return KERN_SUCCESS;
 191 }
 192
 193 #elif defined(__arm__)
 194
 195 static kern_return_t
 196 interrupted_kernel_pc_fp(uintptr_t *pc, uintptr_t *fp)
 197 {
 198         struct arm_saved_state *state;
 199
 200         state = getCpuDatap()->cpu_int_state;
 201         if (!state) {
 202                 return KERN_FAILURE;
 203         }
 204
 205         /* return early if interrupted a thread in user space */
 206         if (PSR_IS_USER(get_saved_state_cpsr(state))) {
 207                 return KERN_FAILURE;
 208         }
 209
 210         *pc = get_saved_state_pc(state);
 211         *fp = get_saved_state_fp(state);
 212         return KERN_SUCCESS;
 213 }
 214
 215 #else /* defined(__arm__) */
 216 #error "interrupted_kernel_pc_fp: unsupported architecture"
 217 #endif /* !defined(__arm__) */
 218
 219 unsigned int
 220 backtrace_interrupted(uintptr_t *bt, unsigned int max_frames,
 221     bool *was_truncated_out)
 222 {
 223         uintptr_t pc;
 224         uintptr_t fp;
 225         kern_return_t kr;
 226
 227         assert(bt != NULL);
 228         assert(max_frames > 0);
 229         assert(ml_at_interrupt_context() == TRUE);
 230
 231         kr = interrupted_kernel_pc_fp(&pc, &fp);
 232         if (kr != KERN_SUCCESS) {
 233                 return 0;
 234         }
 235
 236         bt[0] = pc;
 237         if (max_frames == 1) {
 238                 return 1;
 239         }
 240
 241         return backtrace_frame(bt + 1, max_frames - 1, (void *)fp,
 242             was_truncated_out) + 1;
 243 }
 244
 245 int
 246 backtrace_user(uintptr_t *bt, unsigned int max_frames,
 247     unsigned int *frames_out, bool *user_64_out, bool *was_truncated_out)
 248 {
 249         return backtrace_thread_user(current_thread(), bt, max_frames,
 250             frames_out, user_64_out, was_truncated_out);
 251 }
 252
 253 int
 254 backtrace_thread_user(void *thread, uintptr_t *bt, unsigned int max_frames,
 255     unsigned int *frames_out, bool *user_64_out, bool *was_truncated_out)
 256 {
 257         bool user_64;
 258         uintptr_t pc = 0, fp = 0, next_fp = 0;
 259         vm_map_t map = NULL, old_map = NULL;
 260         unsigned int frame_index = 0;
 261         int err = 0;
 262         size_t frame_size = 0;
 263
 264         assert(bt != NULL);
 265         assert(max_frames > 0);
 266         assert(frames_out != NULL);
 267
 268 #if defined(__x86_64__)
 269
 270         /* don't allow a malformed user stack to copyin arbitrary kernel data */
 271 #define INVALID_USER_FP(FP) ((FP) == 0 || !IS_USERADDR64_CANONICAL((FP)))
 272
 273         x86_saved_state_t *state = get_user_regs(thread);
 274
 275         if (!state) {
 276                 return EINVAL;
 277         }
 278
 279         user_64 = is_saved_state64(state);
 280         if (user_64) {
 281                 pc = saved_state64(state)->isf.rip;
 282                 fp = saved_state64(state)->rbp;
 283         } else {
 284                 pc = saved_state32(state)->eip;
 285                 fp = saved_state32(state)->ebp;
 286         }
 287
 288 #elif defined(__arm64__)
 289
 290         /* ARM expects stack frames to be aligned to 16 bytes */
 291 #define INVALID_USER_FP(FP) ((FP) == 0 || ((FP) & 0x3UL) != 0UL)
 292
 293         struct arm_saved_state *state = get_user_regs(thread);
 294         if (!state) {
 295                 return EINVAL;
 296         }
 297
 298         user_64 = is_saved_state64(state);
 299         pc = get_saved_state_pc(state);
 300         fp = get_saved_state_fp(state);
 301
 302 #elif defined(__arm__)
 303
 304         /* ARM expects stack frames to be aligned to 16 bytes */
 305 #define INVALID_USER_FP(FP) ((FP) == 0 || ((FP) & 0x3UL) != 0UL)
 306
 307         struct arm_saved_state *state = get_user_regs(thread);
 308         if (!state) {
 309                 return EINVAL;
 310         }
 311
 312         user_64 = false;
 313         pc = get_saved_state_pc(state);
 314         fp = get_saved_state_fp(state);
 315
 316 #else /* defined(__arm__) */
 317 #error "backtrace_thread_user: unsupported architecture"
 318 #endif /* !defined(__arm__) */
 319
 320         bt[frame_index++] = pc;
 321
 322         if (frame_index >= max_frames) {
 323                 goto out;
 324         }
 325
 326         if (INVALID_USER_FP(fp)) {
 327                 goto out;
 328         }
 329
 330         assert(ml_get_interrupts_enabled() == TRUE);
 331         if (!ml_get_interrupts_enabled()) {
 332                 goto out;
 333         }
 334
 335         union {
 336                 struct {
 337                         uint64_t fp;
 338                         uint64_t ret;
 339                 } u64;
 340                 struct {
 341                         uint32_t fp;
 342                         uint32_t ret;
 343                 } u32;
 344         } frame;
 345
 346         frame_size = 2 * (user_64 ? 8 : 4);
 347
 348         /* switch to the correct map, for copyin */
 349         if (thread != current_thread()) {
 350                 map = get_task_map_reference(get_threadtask(thread));
 351                 if (map == NULL) {
 352                         goto out;
 353                 }
 354                 old_map = vm_map_switch(map);
 355         } else {
 356                 map = NULL;
 357         }
 358
 359         while (fp != 0 && frame_index < max_frames) {
 360                 err = copyin(fp, (char *)&frame, frame_size);
 361                 if (err) {
 362                         if (was_truncated_out) {
 363                                 *was_truncated_out = true;
 364                         }
 365                         goto out;
 366                 }
 367
 368                 next_fp = user_64 ? frame.u64.fp : frame.u32.fp;
 369
 370                 if (INVALID_USER_FP(next_fp)) {
 371                         break;
 372                 }
 373
 374                 uintptr_t ret_addr = user_64 ? frame.u64.ret : frame.u32.ret;
 375 #if defined(HAS_APPLE_PAC)
 376                 /* return addresses signed by arm64e ABI */
 377                 bt[frame_index++] = (uintptr_t)ptrauth_strip((void *)ret_addr,
 378                     ptrauth_key_return_address);
 379 #else /* defined(HAS_APPLE_PAC) */
 380                 bt[frame_index++] = ret_addr;
 381 #endif /* !defined(HAS_APPLE_PAC) */
 382
 383                 /* stacks grow down; backtracing should be moving to higher addresses */
 384                 if (next_fp <= fp) {
 385                         break;
 386                 }
 387                 fp = next_fp;
 388         }
 389
 390 out:
 391         if (map) {
 392                 (void)vm_map_switch(old_map);
 393                 vm_map_deallocate(map);
 394         }
 395
 396         /* NULL-terminate the list, if space is available */
 397         if (frame_index != max_frames) {
 398                 bt[frame_index] = 0;
 399         }
 400
 401         if (fp != 0 && frame_index == max_frames && was_truncated_out) {
 402                 *was_truncated_out = true;
 403         }
 404
 405         if (user_64_out) {
 406                 *user_64_out = user_64;
 407         }
 408
 409         *frames_out = frame_index;
 410         return err;
 411 #undef INVALID_USER_FP
 412 }