Make stack_save*() more robust on MIPS.
- Validate any stack addresses read from against td_kstack before reading. If an unwind operation would attempt to read outside the bounds of td_kstack, abort the unwind instead. - For stack_save_td(), don't use the PC and SP from the current thread, instead read the PC and SP from pcb_context[]. - For stack_save(), use the current PC and SP of the current thread, not the values from pcb_regs (the horribly named td_frame of the outermost trapframe). The result was that stack_trace() never logged _any_ kernel frames but only the frame from the saved userspace registers on entry from the kernel. - Inline the one use of stack_register_fetch(). - Add a VALID_PC() helper macro and simplify types to remove excessive casts in stack_capture(). - Fix stack_capture() to work on compilers written in this century. Don't treat function epilogues as function prologues by skipping additions to SP when searching for a function start. - Add some comments to stack_capture() and fix some style bugs. Reviewed by: arichardson Obtained from: CheriBSD Sponsored by: DARPA Differential Revision: https://reviews.freebsd.org/D27358
This commit is contained in:
parent
5941edfcdc
commit
f2dceb474b
Notes:
svn2git
2020-12-20 02:59:44 +00:00
svn path=/head/; revision=368241
@ -41,30 +41,33 @@ __FBSDID("$FreeBSD$");
|
|||||||
#include <machine/pcb.h>
|
#include <machine/pcb.h>
|
||||||
#include <machine/regnum.h>
|
#include <machine/regnum.h>
|
||||||
|
|
||||||
static u_register_t
|
#define VALID_PC(addr) ((addr) >= (uintptr_t)btext && (addr) % 4 == 0)
|
||||||
stack_register_fetch(u_register_t sp, u_register_t stack_pos)
|
|
||||||
{
|
|
||||||
u_register_t * stack =
|
|
||||||
((u_register_t *)(intptr_t)sp + (size_t)stack_pos/sizeof(u_register_t));
|
|
||||||
|
|
||||||
return *stack;
|
|
||||||
}
|
|
||||||
|
|
||||||
static void
|
static void
|
||||||
stack_capture(struct stack *st, u_register_t pc, u_register_t sp)
|
stack_capture(struct stack *st, struct thread *td, uintptr_t pc, uintptr_t sp)
|
||||||
{
|
{
|
||||||
u_register_t ra = 0, i, stacksize;
|
u_register_t ra;
|
||||||
short ra_stack_pos = 0;
|
uintptr_t i, ra_addr;
|
||||||
|
int ra_stack_pos, stacksize;
|
||||||
InstFmt insn;
|
InstFmt insn;
|
||||||
|
|
||||||
stack_zero(st);
|
stack_zero(st);
|
||||||
|
|
||||||
for (;;) {
|
for (;;) {
|
||||||
stacksize = 0;
|
if (!VALID_PC(pc))
|
||||||
if (pc <= (u_register_t)(intptr_t)btext)
|
|
||||||
break;
|
break;
|
||||||
for (i = pc; i >= (u_register_t)(intptr_t)btext; i -= sizeof (insn)) {
|
|
||||||
bcopy((void *)(intptr_t)i, &insn, sizeof insn);
|
/*
|
||||||
|
* Walk backward from the PC looking for the function
|
||||||
|
* start. Assume a subtraction from SP is the start
|
||||||
|
* of a function. Hope that we find the store of RA
|
||||||
|
* into the stack frame along the way and save the
|
||||||
|
* offset of the saved RA relative to SP.
|
||||||
|
*/
|
||||||
|
ra_stack_pos = -1;
|
||||||
|
stacksize = 0;
|
||||||
|
for (i = pc; VALID_PC(i); i -= sizeof(insn)) {
|
||||||
|
bcopy((void *)i, &insn, sizeof(insn));
|
||||||
switch (insn.IType.op) {
|
switch (insn.IType.op) {
|
||||||
case OP_ADDI:
|
case OP_ADDI:
|
||||||
case OP_ADDIU:
|
case OP_ADDIU:
|
||||||
@ -72,6 +75,17 @@ stack_capture(struct stack *st, u_register_t pc, u_register_t sp)
|
|||||||
case OP_DADDIU:
|
case OP_DADDIU:
|
||||||
if (insn.IType.rs != SP || insn.IType.rt != SP)
|
if (insn.IType.rs != SP || insn.IType.rt != SP)
|
||||||
break;
|
break;
|
||||||
|
|
||||||
|
/*
|
||||||
|
* Ignore stack fixups in "early"
|
||||||
|
* returns in a function, or if the
|
||||||
|
* call was from an unlikely branch
|
||||||
|
* moved after the end of the normal
|
||||||
|
* return.
|
||||||
|
*/
|
||||||
|
if ((short)insn.IType.imm > 0)
|
||||||
|
break;
|
||||||
|
|
||||||
stacksize = -(short)insn.IType.imm;
|
stacksize = -(short)insn.IType.imm;
|
||||||
break;
|
break;
|
||||||
|
|
||||||
@ -85,26 +99,35 @@ stack_capture(struct stack *st, u_register_t pc, u_register_t sp)
|
|||||||
break;
|
break;
|
||||||
}
|
}
|
||||||
|
|
||||||
if (stacksize)
|
if (stacksize != 0)
|
||||||
break;
|
break;
|
||||||
}
|
}
|
||||||
|
|
||||||
if (stack_put(st, pc) == -1)
|
if (stack_put(st, pc) == -1)
|
||||||
break;
|
break;
|
||||||
|
|
||||||
for (i = pc; !ra; i += sizeof (insn)) {
|
if (ra_stack_pos == -1)
|
||||||
bcopy((void *)(intptr_t)i, &insn, sizeof insn);
|
break;
|
||||||
|
|
||||||
|
/*
|
||||||
|
* Walk forward from the PC to find the function end
|
||||||
|
* (jr RA). If eret is hit instead, stop unwinding.
|
||||||
|
*/
|
||||||
|
ra_addr = sp + ra_stack_pos;
|
||||||
|
ra = 0;
|
||||||
|
for (i = pc; VALID_PC(i); i += sizeof(insn)) {
|
||||||
|
bcopy((void *)i, &insn, sizeof(insn));
|
||||||
|
|
||||||
switch (insn.IType.op) {
|
switch (insn.IType.op) {
|
||||||
case OP_SPECIAL:
|
case OP_SPECIAL:
|
||||||
if (insn.RType.func == OP_JR) {
|
if (insn.RType.func == OP_JR) {
|
||||||
if (ra >= (u_register_t)(intptr_t)btext)
|
|
||||||
break;
|
|
||||||
if (insn.RType.rs != RA)
|
if (insn.RType.rs != RA)
|
||||||
break;
|
break;
|
||||||
ra = stack_register_fetch(sp,
|
if (!kstack_contains(td, ra_addr,
|
||||||
ra_stack_pos);
|
sizeof(ra)))
|
||||||
if (!ra)
|
goto done;
|
||||||
|
ra = *(u_register_t *)ra_addr;
|
||||||
|
if (ra == 0)
|
||||||
goto done;
|
goto done;
|
||||||
ra -= 8;
|
ra -= 8;
|
||||||
}
|
}
|
||||||
@ -112,9 +135,13 @@ stack_capture(struct stack *st, u_register_t pc, u_register_t sp)
|
|||||||
default:
|
default:
|
||||||
break;
|
break;
|
||||||
}
|
}
|
||||||
|
|
||||||
/* eret */
|
/* eret */
|
||||||
if (insn.word == 0x42000018)
|
if (insn.word == 0x42000018)
|
||||||
goto done;
|
goto done;
|
||||||
|
|
||||||
|
if (ra != 0)
|
||||||
|
break;
|
||||||
}
|
}
|
||||||
|
|
||||||
if (pc == ra && stacksize == 0)
|
if (pc == ra && stacksize == 0)
|
||||||
@ -122,7 +149,6 @@ stack_capture(struct stack *st, u_register_t pc, u_register_t sp)
|
|||||||
|
|
||||||
sp += stacksize;
|
sp += stacksize;
|
||||||
pc = ra;
|
pc = ra;
|
||||||
ra = 0;
|
|
||||||
}
|
}
|
||||||
done:
|
done:
|
||||||
return;
|
return;
|
||||||
@ -131,7 +157,7 @@ stack_capture(struct stack *st, u_register_t pc, u_register_t sp)
|
|||||||
int
|
int
|
||||||
stack_save_td(struct stack *st, struct thread *td)
|
stack_save_td(struct stack *st, struct thread *td)
|
||||||
{
|
{
|
||||||
u_register_t pc, sp;
|
uintptr_t pc, sp;
|
||||||
|
|
||||||
THREAD_LOCK_ASSERT(td, MA_OWNED);
|
THREAD_LOCK_ASSERT(td, MA_OWNED);
|
||||||
KASSERT(!TD_IS_SWAPPED(td),
|
KASSERT(!TD_IS_SWAPPED(td),
|
||||||
@ -140,21 +166,19 @@ stack_save_td(struct stack *st, struct thread *td)
|
|||||||
if (TD_IS_RUNNING(td))
|
if (TD_IS_RUNNING(td))
|
||||||
return (EOPNOTSUPP);
|
return (EOPNOTSUPP);
|
||||||
|
|
||||||
pc = td->td_pcb->pcb_regs.pc;
|
pc = td->td_pcb->pcb_context[PCB_REG_RA];
|
||||||
sp = td->td_pcb->pcb_regs.sp;
|
sp = td->td_pcb->pcb_context[PCB_REG_SP];
|
||||||
stack_capture(st, pc, sp);
|
stack_capture(st, td, pc, sp);
|
||||||
return (0);
|
return (0);
|
||||||
}
|
}
|
||||||
|
|
||||||
void
|
void
|
||||||
stack_save(struct stack *st)
|
stack_save(struct stack *st)
|
||||||
{
|
{
|
||||||
u_register_t pc, sp;
|
uintptr_t pc, sp;
|
||||||
|
|
||||||
if (curthread == NULL)
|
pc = (uintptr_t)&&here;
|
||||||
panic("stack_save: curthread == NULL");
|
sp = (uintptr_t)__builtin_frame_address(0);
|
||||||
|
here:
|
||||||
pc = curthread->td_pcb->pcb_regs.pc;
|
stack_capture(st, curthread, pc, sp);
|
||||||
sp = curthread->td_pcb->pcb_regs.sp;
|
|
||||||
stack_capture(st, pc, sp);
|
|
||||||
}
|
}
|
||||||
|
Loading…
Reference in New Issue
Block a user