From patchwork Mon Apr 5 20:43:10 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Madhavan T. Venkataraman" X-Patchwork-Id: 12183589 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-16.8 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER, INCLUDES_PATCH,MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED, USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id B77CDC43460 for ; Mon, 5 Apr 2021 20:45:10 +0000 (UTC) Received: from desiato.infradead.org (desiato.infradead.org [90.155.92.199]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id 5FAC7613C6 for ; Mon, 5 Apr 2021 20:45:10 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 5FAC7613C6 Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=linux.microsoft.com Authentication-Results: mail.kernel.org; spf=none smtp.mailfrom=linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=desiato.20200630; h=Sender:Content-Transfer-Encoding :Content-Type:List-Subscribe:List-Help:List-Post:List-Archive: List-Unsubscribe:List-Id:MIME-Version:References:In-Reply-To:Message-Id:Date: Subject:To:From:Reply-To:Cc:Content-ID:Content-Description:Resent-Date: Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:List-Owner; bh=7OpoRiZPHBmTMRepcdJEco7fCujXiH9L55YkXtdyVqM=; b=UfZafT1xaCHo4FpMbYMKRsz6d r7PjEIFfFbSK9adagwJcmmc0ClxNkkC4jvtAwcSxdNjPlaWNI8gLW3/7FHdoFiECSuhss6azEJbhs opzSc5t95/CnV4JkiVzLazXxN/cnTmYW1dZJyeWLdrHKY7AR050mWAjX1Xsbd/qwWl3p4DKQc0ZFN LVWdNSGTCZLpD0fPivwrs8qz6DYw1IG+9H0oXcetYE8hfXBVjl//7bNoYDRPwKDZ7Qe81A3KTg8lA CMr/t8WEndT+2puMTPi1bTr1eyUIFfdbwe2cjmVPfmCA89Bu9rlHn9tNliKdGpDNMJloGRzMCwzVS SP+Pd86ag==; Received: from localhost ([::1] helo=desiato.infradead.org) by desiato.infradead.org with esmtp (Exim 4.94 #2 (Red Hat Linux)) id 1lTW4I-000dZc-TM; Mon, 05 Apr 2021 20:43:30 +0000 Received: from linux.microsoft.com ([13.77.154.182]) by desiato.infradead.org with esmtp (Exim 4.94 #2 (Red Hat Linux)) id 1lTW4D-000dXu-Ur for linux-arm-kernel@lists.infradead.org; Mon, 05 Apr 2021 20:43:27 +0000 Received: from x64host.home (unknown [47.187.194.202]) by linux.microsoft.com (Postfix) with ESMTPSA id D0A9120B5680; Mon, 5 Apr 2021 13:43:23 -0700 (PDT) DKIM-Filter: OpenDKIM Filter v2.11.0 linux.microsoft.com D0A9120B5680 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.microsoft.com; s=default; t=1617655404; bh=3vjl15rMiDqv4mSST8OwRNwQRjNnBcJQwVTVSJPcYkA=; h=From:To:Subject:Date:In-Reply-To:References:From; b=hZp/7PiOyWv/RbE7eT/geBSDlVqU4jfhQfGR1weB0Z2iISStiTC/KzpKnVj9f6jBJ jCeZ3hkIyOOtPEZrOGHpNwwkhHO9028vBX7qES7qrMaJbdmdGyGFwqgUJtivrt8UGf +F5HbAdGBMOinF3E8YctgCYWbZwJqb211LKnnyBw= From: madvenka@linux.microsoft.com To: mark.rutland@arm.com, broonie@kernel.org, jpoimboe@redhat.com, jthierry@redhat.com, catalin.marinas@arm.com, will@kernel.org, linux-arm-kernel@lists.infradead.org, live-patching@vger.kernel.org, linux-kernel@vger.kernel.org, madvenka@linux.microsoft.com Subject: [RFC PATCH v2 1/4] arm64: Implement infrastructure for stack trace reliability checks Date: Mon, 5 Apr 2021 15:43:10 -0500 Message-Id: <20210405204313.21346-2-madvenka@linux.microsoft.com> X-Mailer: git-send-email 2.25.1 In-Reply-To: <20210405204313.21346-1-madvenka@linux.microsoft.com> References: <705993ccb34a611c75cdae0a8cb1b40f9b218ebd> <20210405204313.21346-1-madvenka@linux.microsoft.com> MIME-Version: 1.0 X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20210405_214326_354452_7460FDA4 X-CRM114-Status: GOOD ( 19.08 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org From: "Madhavan T. Venkataraman" Implement a check_reliability() function that will contain checks for the presence of various features and conditions that can render the stack trace unreliable. Introduce the first reliability check - If a return PC encountered in a stack trace is not a valid kernel text address, the stack trace is considered unreliable. It could be some generated code. Other reliability checks will be added in the future. These checks will involve checking the return PC to see if it falls inside any special functions where the stack trace is considered unreliable. Implement the infrastructure needed for this. Signed-off-by: Madhavan T. Venkataraman Reviewed-by: Mark Brown --- arch/arm64/include/asm/stacktrace.h | 2 + arch/arm64/kernel/stacktrace.c | 80 +++++++++++++++++++++++++++++ 2 files changed, 82 insertions(+) diff --git a/arch/arm64/include/asm/stacktrace.h b/arch/arm64/include/asm/stacktrace.h index eb29b1fe8255..684f65808394 100644 --- a/arch/arm64/include/asm/stacktrace.h +++ b/arch/arm64/include/asm/stacktrace.h @@ -59,6 +59,7 @@ struct stackframe { #ifdef CONFIG_FUNCTION_GRAPH_TRACER int graph; #endif + bool reliable; }; extern int unwind_frame(struct task_struct *tsk, struct stackframe *frame); @@ -169,6 +170,7 @@ static inline void start_backtrace(struct stackframe *frame, bitmap_zero(frame->stacks_done, __NR_STACK_TYPES); frame->prev_fp = 0; frame->prev_type = STACK_TYPE_UNKNOWN; + frame->reliable = true; } #endif /* __ASM_STACKTRACE_H */ diff --git a/arch/arm64/kernel/stacktrace.c b/arch/arm64/kernel/stacktrace.c index ad20981dfda4..557657d6e6bd 100644 --- a/arch/arm64/kernel/stacktrace.c +++ b/arch/arm64/kernel/stacktrace.c @@ -18,6 +18,84 @@ #include #include +struct function_range { + unsigned long start; + unsigned long end; +}; + +/* + * Special functions where the stack trace is unreliable. + */ +static struct function_range special_functions[] = { + { /* sentinel */ } +}; + +static bool is_reliable_function(unsigned long pc) +{ + static bool inited = false; + struct function_range *func; + + if (!inited) { + static char sym[KSYM_NAME_LEN]; + unsigned long size, offset; + + for (func = special_functions; func->start; func++) { + if (kallsyms_lookup(func->start, &size, &offset, + NULL, sym)) { + func->start -= offset; + func->end = func->start + size; + } else { + /* + * This is just a label. So, we only need to + * consider that particular location. So, size + * is the size of one Aarch64 instruction. + */ + func->end = func->start + 4; + } + } + inited = true; + } + + for (func = special_functions; func->start; func++) { + if (pc >= func->start && pc < func->end) + return false; + } + return true; +} + +/* + * Check for the presence of features and conditions that render the stack + * trace unreliable. + * + * Once all such cases have been addressed, this function can aid live + * patching (and this comment can be removed). + */ +static void check_reliability(struct stackframe *frame) +{ + /* + * If the stack trace has already been marked unreliable, just return. + */ + if (!frame->reliable) + return; + + /* + * First, make sure that the return address is a proper kernel text + * address. A NULL or invalid return address probably means there's + * some generated code which __kernel_text_address() doesn't know + * about. Mark the stack trace as not reliable. + */ + if (!__kernel_text_address(frame->pc)) { + frame->reliable = false; + return; + } + + /* + * Check the reliability of the return PC's function. + */ + if (!is_reliable_function(frame->pc)) + frame->reliable = false; +} + /* * AArch64 PCS assigns the frame pointer to x29. * @@ -108,6 +186,8 @@ int notrace unwind_frame(struct task_struct *tsk, struct stackframe *frame) frame->pc = ptrauth_strip_insn_pac(frame->pc); + check_reliability(frame); + return 0; } NOKPROBE_SYMBOL(unwind_frame); From patchwork Mon Apr 5 20:43:11 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Madhavan T. Venkataraman" X-Patchwork-Id: 12183591 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-16.8 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER, INCLUDES_PATCH,MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED, USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 7F048C433ED for ; Mon, 5 Apr 2021 20:45:19 +0000 (UTC) Received: from desiato.infradead.org (desiato.infradead.org [90.155.92.199]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id 1A53B613C6 for ; Mon, 5 Apr 2021 20:45:19 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 1A53B613C6 Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=linux.microsoft.com Authentication-Results: mail.kernel.org; spf=none smtp.mailfrom=linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=desiato.20200630; h=Sender:Content-Transfer-Encoding :Content-Type:List-Subscribe:List-Help:List-Post:List-Archive: List-Unsubscribe:List-Id:MIME-Version:References:In-Reply-To:Message-Id:Date: Subject:To:From:Reply-To:Cc:Content-ID:Content-Description:Resent-Date: Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:List-Owner; bh=Bb9o9SWkuekQBfXjPJIUqS3XRWR+DhgDnD6m/4HxBoM=; b=murbw5guJ3MKXy+mVAecT/u3K dOJgrfbe3dtIAB6dYfcEbRfRhSHhDQpEC4IsuQowZTwLR3GxXpiGARt1gkQH8VD6QIcWBLHuymIcl ICmvRp7opWGruOfxff2BIgSpXvja2LEp/P8SjdhYLUvgPQ/zNJmxPjsj8QAlWe8jKTTzl4gcnpQ1P 8wA6BAkVmL6USF51BLqLOLg3/DGFDBIeYN/UiATOuTrC7ZlVckRLfeVldSpA21124OevidQBHKtXn i4YXppHhL/h/TmTTBj4hGATWH7Jwy1i4QIzMwRnA9r5MttjdkJWVOpzM2me1rSxCU8msw9OhPT5PW zIo9f7ZMQ==; Received: from localhost ([::1] helo=desiato.infradead.org) by desiato.infradead.org with esmtp (Exim 4.94 #2 (Red Hat Linux)) id 1lTW4a-000dam-0q; Mon, 05 Apr 2021 20:43:48 +0000 Received: from linux.microsoft.com ([13.77.154.182]) by desiato.infradead.org with esmtp (Exim 4.94 #2 (Red Hat Linux)) id 1lTW4E-000dYB-B8 for linux-arm-kernel@lists.infradead.org; Mon, 05 Apr 2021 20:43:29 +0000 Received: from x64host.home (unknown [47.187.194.202]) by linux.microsoft.com (Postfix) with ESMTPSA id C4E4520B5681; Mon, 5 Apr 2021 13:43:24 -0700 (PDT) DKIM-Filter: OpenDKIM Filter v2.11.0 linux.microsoft.com C4E4520B5681 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.microsoft.com; s=default; t=1617655405; bh=FXJKTTAJEFg3bLgFKMRC+t8B2UTIYo8NHYupcKiM3Rw=; h=From:To:Subject:Date:In-Reply-To:References:From; b=MWcmvYhNmA3PSzFB6RSUtxu3mMOaUhE+umk9IWFD54y1pFcddpg5sfAbyy1/ve1++ x9uRas75ssraEYzaEk598CaW6miKKHWVfWYXXuPn1I8bqaMPHCCy/T4pf6XTpzgoT4 xLiG5bykpfyx+7LflqID6iEcd6RwZ3gx7t4ncNFc= From: madvenka@linux.microsoft.com To: mark.rutland@arm.com, broonie@kernel.org, jpoimboe@redhat.com, jthierry@redhat.com, catalin.marinas@arm.com, will@kernel.org, linux-arm-kernel@lists.infradead.org, live-patching@vger.kernel.org, linux-kernel@vger.kernel.org, madvenka@linux.microsoft.com Subject: [RFC PATCH v2 2/4] arm64: Mark a stack trace unreliable if an EL1 exception frame is detected Date: Mon, 5 Apr 2021 15:43:11 -0500 Message-Id: <20210405204313.21346-3-madvenka@linux.microsoft.com> X-Mailer: git-send-email 2.25.1 In-Reply-To: <20210405204313.21346-1-madvenka@linux.microsoft.com> References: <705993ccb34a611c75cdae0a8cb1b40f9b218ebd> <20210405204313.21346-1-madvenka@linux.microsoft.com> MIME-Version: 1.0 X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20210405_214327_036265_E6165B11 X-CRM114-Status: GOOD ( 17.71 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org From: "Madhavan T. Venkataraman" EL1 exceptions can happen on any instruction including instructions in the frame pointer prolog or epilog. Depending on where exactly they happen, they could render the stack trace unreliable. If an EL1 exception frame is found on the stack, mark the stack trace as unreliable. Now, the EL1 exception frame is not at any well-known offset on the stack. It can be anywhere on the stack. In order to properly detect an EL1 exception frame, the return address must be checked against all of the possible EL1 exception handlers. Preemption ========== Interrupts encountered in kernel code are also EL1 exceptions. At the end of an interrupt, the interrupt handler checks if the current task must be preempted for any reason. If so, it calls the preemption code which takes the task off the CPU. A stack trace taken on the task after the preemption will show the EL1 frame and will be considered unreliable. This is correct behavior as preemption can happen practically at any point in code. Probing ======= Breakpoints encountered in kernel code are also EL1 exceptions. The probing infrastructure uses breakpoints for executing probe code. While in the probe code, the stack trace will show an EL1 frame and will be considered unreliable. This is also correct behavior. Reviewed-by: Mark Brown Signed-off-by: Madhavan T. Venkataraman --- arch/arm64/include/asm/exception.h | 8 +++++++ arch/arm64/kernel/entry.S | 14 +++++------ arch/arm64/kernel/stacktrace.c | 37 ++++++++++++++++++++++++++++++ 3 files changed, 52 insertions(+), 7 deletions(-) diff --git a/arch/arm64/include/asm/exception.h b/arch/arm64/include/asm/exception.h index 6546158d2f2d..4ebd2390ef54 100644 --- a/arch/arm64/include/asm/exception.h +++ b/arch/arm64/include/asm/exception.h @@ -35,6 +35,14 @@ asmlinkage void el1_sync_handler(struct pt_regs *regs); asmlinkage void el0_sync_handler(struct pt_regs *regs); asmlinkage void el0_sync_compat_handler(struct pt_regs *regs); +asmlinkage void el1_sync(void); +asmlinkage void el1_irq(void); +asmlinkage void el1_error(void); +asmlinkage void el1_sync_invalid(void); +asmlinkage void el1_irq_invalid(void); +asmlinkage void el1_fiq_invalid(void); +asmlinkage void el1_error_invalid(void); + asmlinkage void noinstr enter_el1_irq_or_nmi(struct pt_regs *regs); asmlinkage void noinstr exit_el1_irq_or_nmi(struct pt_regs *regs); asmlinkage void enter_from_user_mode(void); diff --git a/arch/arm64/kernel/entry.S b/arch/arm64/kernel/entry.S index a31a0a713c85..9fe3aaeff019 100644 --- a/arch/arm64/kernel/entry.S +++ b/arch/arm64/kernel/entry.S @@ -630,19 +630,19 @@ SYM_CODE_START_LOCAL(el0_fiq_invalid_compat) SYM_CODE_END(el0_fiq_invalid_compat) #endif -SYM_CODE_START_LOCAL(el1_sync_invalid) +SYM_CODE_START(el1_sync_invalid) inv_entry 1, BAD_SYNC SYM_CODE_END(el1_sync_invalid) -SYM_CODE_START_LOCAL(el1_irq_invalid) +SYM_CODE_START(el1_irq_invalid) inv_entry 1, BAD_IRQ SYM_CODE_END(el1_irq_invalid) -SYM_CODE_START_LOCAL(el1_fiq_invalid) +SYM_CODE_START(el1_fiq_invalid) inv_entry 1, BAD_FIQ SYM_CODE_END(el1_fiq_invalid) -SYM_CODE_START_LOCAL(el1_error_invalid) +SYM_CODE_START(el1_error_invalid) inv_entry 1, BAD_ERROR SYM_CODE_END(el1_error_invalid) @@ -650,7 +650,7 @@ SYM_CODE_END(el1_error_invalid) * EL1 mode handlers. */ .align 6 -SYM_CODE_START_LOCAL_NOALIGN(el1_sync) +SYM_CODE_START_NOALIGN(el1_sync) kernel_entry 1 mov x0, sp bl el1_sync_handler @@ -658,7 +658,7 @@ SYM_CODE_START_LOCAL_NOALIGN(el1_sync) SYM_CODE_END(el1_sync) .align 6 -SYM_CODE_START_LOCAL_NOALIGN(el1_irq) +SYM_CODE_START_NOALIGN(el1_irq) kernel_entry 1 gic_prio_irq_setup pmr=x20, tmp=x1 enable_da_f @@ -737,7 +737,7 @@ el0_irq_naked: b ret_to_user SYM_CODE_END(el0_irq) -SYM_CODE_START_LOCAL(el1_error) +SYM_CODE_START(el1_error) kernel_entry 1 mrs x1, esr_el1 gic_prio_kentry_setup tmp=x2 diff --git a/arch/arm64/kernel/stacktrace.c b/arch/arm64/kernel/stacktrace.c index 557657d6e6bd..fb11e4372891 100644 --- a/arch/arm64/kernel/stacktrace.c +++ b/arch/arm64/kernel/stacktrace.c @@ -14,6 +14,7 @@ #include #include +#include #include #include #include @@ -25,8 +26,44 @@ struct function_range { /* * Special functions where the stack trace is unreliable. + * + * EL1 exceptions + * ============== + * + * EL1 exceptions can happen on any instruction including instructions in + * the frame pointer prolog or epilog. Depending on where exactly they happen, + * they could render the stack trace unreliable. + * + * If an EL1 exception frame is found on the stack, mark the stack trace as + * unreliable. Now, the EL1 exception frame is not at any well-known offset + * on the stack. It can be anywhere on the stack. In order to properly detect + * an EL1 exception frame, the return address must be checked against all of + * the possible EL1 exception handlers. + * + * Interrupts encountered in kernel code are also EL1 exceptions. At the end + * of an interrupt, the current task can get preempted. A stack trace taken + * on the task after the preemption will show the EL1 frame and will be + * considered unreliable. This is correct behavior as preemption can happen + * practically at any point in code. + * + * Breakpoints encountered in kernel code are also EL1 exceptions. Breakpoints + * can happen practically on any instruction. Mark the stack trace as + * unreliable. Breakpoints are used for executing probe code. Stack traces + * taken while in the probe code will show an EL1 frame and will be considered + * unreliable. This is correct behavior. */ static struct function_range special_functions[] = { + /* + * EL1 exception handlers. + */ + { (unsigned long) el1_sync, 0 }, + { (unsigned long) el1_irq, 0 }, + { (unsigned long) el1_error, 0 }, + { (unsigned long) el1_sync_invalid, 0 }, + { (unsigned long) el1_irq_invalid, 0 }, + { (unsigned long) el1_fiq_invalid, 0 }, + { (unsigned long) el1_error_invalid, 0 }, + { /* sentinel */ } }; From patchwork Mon Apr 5 20:43:12 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Madhavan T. Venkataraman" X-Patchwork-Id: 12183593 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-16.8 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER, INCLUDES_PATCH,MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED, USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 9D057C433ED for ; Mon, 5 Apr 2021 20:45:22 +0000 (UTC) Received: from desiato.infradead.org (desiato.infradead.org [90.155.92.199]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id 3E0F2613C6 for ; Mon, 5 Apr 2021 20:45:22 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 3E0F2613C6 Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=linux.microsoft.com Authentication-Results: mail.kernel.org; spf=none smtp.mailfrom=linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=desiato.20200630; h=Sender:Content-Transfer-Encoding :Content-Type:List-Subscribe:List-Help:List-Post:List-Archive: List-Unsubscribe:List-Id:MIME-Version:References:In-Reply-To:Message-Id:Date: Subject:To:From:Reply-To:Cc:Content-ID:Content-Description:Resent-Date: Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:List-Owner; bh=eqstGhICW5f5ZfvmFpfgx9HXHXvriYSelS0U0d8NKFA=; b=D0vBRZ7ovLhy7zxyAwY7w/SKb QsAgvGlYXgC/y4koBReJjIJpbyZOgo6z35kM5W73AbVSa/taMJLkMhdGRvTKjm8IooL7QclrxyO7k 7XC1SYR5vn+rz789xRuQGZ7jT1Gn5MUKQXHyauHGbcJX+94catKQk0L9m9gxfZSWMSCAOrQsYyZKR XUNBGCQOdXOof5zIncuJpoDFyzCZz0jzl+aHFcnmcOlpeg9eHGi78Y7Bub8anb0igVTeDdELClLsh uj0UHSuN5k5mEU/CKWAqbN3cr2BUgRBOsHA4bJc/d3PpQ7mFjM5N2jXFkOG/TwsCEAqd1uFrTTOgh o9dgrSY5Q==; Received: from localhost ([::1] helo=desiato.infradead.org) by desiato.infradead.org with esmtp (Exim 4.94 #2 (Red Hat Linux)) id 1lTW4g-000dbp-Sq; Mon, 05 Apr 2021 20:43:55 +0000 Received: from linux.microsoft.com ([13.77.154.182]) by desiato.infradead.org with esmtp (Exim 4.94 #2 (Red Hat Linux)) id 1lTW4F-000dYS-8v for linux-arm-kernel@lists.infradead.org; Mon, 05 Apr 2021 20:43:30 +0000 Received: from x64host.home (unknown [47.187.194.202]) by linux.microsoft.com (Postfix) with ESMTPSA id B91F620B5683; Mon, 5 Apr 2021 13:43:25 -0700 (PDT) DKIM-Filter: OpenDKIM Filter v2.11.0 linux.microsoft.com B91F620B5683 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.microsoft.com; s=default; t=1617655406; bh=syB2zPgGDplCermE8pzh/3xNAVmQD2QmALo8binCuMg=; h=From:To:Subject:Date:In-Reply-To:References:From; b=X3UivgY8YLad4RgjUyS4RJ8kx+eDKQmoa9UmEOulhHZvy5TFKwMAkCB4WV9cikMW7 +MqOMeWw0xV9903+IGW5qBwvRID5FSkWXMEW+h598M4YDkjMC8CxUL8VQ2zlm0wC26 omNEA/ABHrZPlTIAAfUJdof2csUUJmleD3cxLTvA= From: madvenka@linux.microsoft.com To: mark.rutland@arm.com, broonie@kernel.org, jpoimboe@redhat.com, jthierry@redhat.com, catalin.marinas@arm.com, will@kernel.org, linux-arm-kernel@lists.infradead.org, live-patching@vger.kernel.org, linux-kernel@vger.kernel.org, madvenka@linux.microsoft.com Subject: [RFC PATCH v2 3/4] arm64: Detect FTRACE cases that make the stack trace unreliable Date: Mon, 5 Apr 2021 15:43:12 -0500 Message-Id: <20210405204313.21346-4-madvenka@linux.microsoft.com> X-Mailer: git-send-email 2.25.1 In-Reply-To: <20210405204313.21346-1-madvenka@linux.microsoft.com> References: <705993ccb34a611c75cdae0a8cb1b40f9b218ebd> <20210405204313.21346-1-madvenka@linux.microsoft.com> MIME-Version: 1.0 X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20210405_214328_479342_20D051CF X-CRM114-Status: GOOD ( 25.75 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org From: "Madhavan T. Venkataraman" When CONFIG_DYNAMIC_FTRACE_WITH_REGS is enabled and tracing is activated for a function, the ftrace infrastructure is called for the function at the very beginning. Ftrace creates two frames: - One for the traced function - One for the caller of the traced function That gives a reliable stack trace while executing in the ftrace code. When ftrace returns to the traced function, the frames are popped and everything is back to normal. However, in cases like live patch, a tracer function may redirect execution to a different function when it returns. A stack trace taken while still in the tracer function will not show the target function. The target function is the real function that we want to track. So, if an FTRACE frame is detected on the stack, just mark the stack trace as unreliable. The detection is done by checking the return PC against FTRACE trampolines. Also, the Function Graph Tracer modifies the return address of a traced function to a return trampoline to gather tracing data on function return. Stack traces taken from that trampoline and functions it calls are unreliable as the original return address may not be available in that context. Mark the stack trace unreliable accordingly. Signed-off-by: Madhavan T. Venkataraman --- arch/arm64/kernel/entry-ftrace.S | 12 +++++++ arch/arm64/kernel/stacktrace.c | 61 ++++++++++++++++++++++++++++++++ 2 files changed, 73 insertions(+) diff --git a/arch/arm64/kernel/entry-ftrace.S b/arch/arm64/kernel/entry-ftrace.S index b3e4f9a088b1..1f0714a50c71 100644 --- a/arch/arm64/kernel/entry-ftrace.S +++ b/arch/arm64/kernel/entry-ftrace.S @@ -86,6 +86,18 @@ SYM_CODE_START(ftrace_caller) b ftrace_common SYM_CODE_END(ftrace_caller) +/* + * A stack trace taken from anywhere in the FTRACE trampoline code should be + * considered unreliable as a tracer function (patched at ftrace_call) could + * potentially set pt_regs->pc and redirect execution to a function different + * than the traced function. E.g., livepatch. + * + * No stack traces are taken in this FTRACE trampoline assembly code. But + * they can be taken from C functions that get called from here. The unwinder + * checks if a return address falls in this FTRACE trampoline code. See + * stacktrace.c. If function calls in this code are changed, please keep the + * special_functions[] array in stacktrace.c in sync. + */ SYM_CODE_START(ftrace_common) sub x0, x30, #AARCH64_INSN_SIZE // ip (callsite's BL insn) mov x1, x9 // parent_ip (callsite's LR) diff --git a/arch/arm64/kernel/stacktrace.c b/arch/arm64/kernel/stacktrace.c index fb11e4372891..7a3c638d4aeb 100644 --- a/arch/arm64/kernel/stacktrace.c +++ b/arch/arm64/kernel/stacktrace.c @@ -51,6 +51,52 @@ struct function_range { * unreliable. Breakpoints are used for executing probe code. Stack traces * taken while in the probe code will show an EL1 frame and will be considered * unreliable. This is correct behavior. + * + * FTRACE + * ====== + * + * When CONFIG_DYNAMIC_FTRACE_WITH_REGS is enabled, the FTRACE trampoline code + * is called from a traced function even before the frame pointer prolog. + * FTRACE sets up two stack frames (one for the traced function and one for + * its caller) so that the unwinder can provide a sensible stack trace for + * any tracer function called from the FTRACE trampoline code. + * + * There are two cases where the stack trace is not reliable. + * + * (1) The task gets preempted before the two frames are set up. Preemption + * involves an interrupt which is an EL1 exception. The unwinder already + * handles EL1 exceptions. + * + * (2) The tracer function that gets called by the FTRACE trampoline code + * changes the return PC (e.g., livepatch). + * + * Not all tracer functions do that. But to err on the side of safety, + * consider the stack trace as unreliable in all cases. + * + * When Function Graph Tracer is used, FTRACE modifies the return address of + * the traced function in its stack frame to an FTRACE return trampoline + * (return_to_handler). When the traced function returns, control goes to + * return_to_handler. return_to_handler calls FTRACE to gather tracing data + * and to obtain the original return address. Then, return_to_handler returns + * to the original return address. + * + * There are two cases to consider from a stack trace reliability point of + * view: + * + * (1) Stack traces taken within the traced function (and functions that get + * called from there) will show return_to_handler instead of the original + * return address. The original return address can be obtained from FTRACE. + * The unwinder already obtains it and modifies the return PC in its copy + * of the stack frame to the original return address. So, this is handled. + * + * (2) return_to_handler calls FTRACE as mentioned before. FTRACE discards + * the record of the original return address along the way as it does not + * need to maintain it anymore. This means that the unwinder cannot get + * the original return address beyond that point while the task is still + * executing in return_to_handler. So, consider the stack trace unreliable + * if return_to_handler is detected on the stack. + * + * NOTE: The unwinder must do (1) before (2). */ static struct function_range special_functions[] = { /* @@ -64,6 +110,21 @@ static struct function_range special_functions[] = { { (unsigned long) el1_fiq_invalid, 0 }, { (unsigned long) el1_error_invalid, 0 }, + /* + * FTRACE trampolines. + * + * Tracer function gets patched at the label ftrace_call. Its return + * address is the next instruction address. + */ +#ifdef CONFIG_DYNAMIC_FTRACE_WITH_REGS + { (unsigned long) ftrace_call + 4, 0 }, +#endif + +#ifdef CONFIG_FUNCTION_GRAPH_TRACER + { (unsigned long) ftrace_graph_caller, 0 }, + { (unsigned long) return_to_handler, 0 }, +#endif + { /* sentinel */ } }; From patchwork Mon Apr 5 20:43:13 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Madhavan T. Venkataraman" X-Patchwork-Id: 12183595 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-16.8 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER, INCLUDES_PATCH,MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED, USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id F0727C433B4 for ; Mon, 5 Apr 2021 20:45:26 +0000 (UTC) Received: from desiato.infradead.org (desiato.infradead.org [90.155.92.199]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id 90D13613CA for ; Mon, 5 Apr 2021 20:45:26 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 90D13613CA Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=linux.microsoft.com Authentication-Results: mail.kernel.org; spf=none smtp.mailfrom=linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=desiato.20200630; h=Sender:Content-Transfer-Encoding :Content-Type:List-Subscribe:List-Help:List-Post:List-Archive: List-Unsubscribe:List-Id:MIME-Version:References:In-Reply-To:Message-Id:Date: Subject:To:From:Reply-To:Cc:Content-ID:Content-Description:Resent-Date: Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:List-Owner; bh=DhubNAmoGx2kg7Bh9/Hto3OxZmmSZePgRi0YTIINopI=; b=nM8B8Oxzi7ce4PxnQfecgK7xu A92+cozlscwyvZqTxacCuYSkaYeHKEFqey5Um5l3NVxXapcp5HLOh70/ph1x4s4N0G82kd9An1dRh 8mgwUQnQl7lauS4gy46p5LftFITor6LwKv1ezJNpFYMMXoSe3Nl94phQyLZqxsnR0r5iUDzMqKxXy jcOd6/Cau3qdS4To2+zQvpsMv3zpIT/+1EP+2R63Xi561u0TDi+12NWfQNbBeY8FxrAUIczkiONKU dAxNOMyxejoUcFBrjSflfuIM4T7mtRa/CzuY6TDUBfk9Vuaz5mAwpQgdIW0piirLNv2UUxh2msTYX PZwecOL7g==; Received: from localhost ([::1] helo=desiato.infradead.org) by desiato.infradead.org with esmtp (Exim 4.94 #2 (Red Hat Linux)) id 1lTW4o-000ddd-8h; Mon, 05 Apr 2021 20:44:02 +0000 Received: from linux.microsoft.com ([13.77.154.182]) by desiato.infradead.org with esmtp (Exim 4.94 #2 (Red Hat Linux)) id 1lTW4G-000dYi-NS for linux-arm-kernel@lists.infradead.org; Mon, 05 Apr 2021 20:43:30 +0000 Received: from x64host.home (unknown [47.187.194.202]) by linux.microsoft.com (Postfix) with ESMTPSA id AC7E720B5682; Mon, 5 Apr 2021 13:43:26 -0700 (PDT) DKIM-Filter: OpenDKIM Filter v2.11.0 linux.microsoft.com AC7E720B5682 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.microsoft.com; s=default; t=1617655407; bh=yDT+jIiz7wCIuh3VIPo6ld85uNay301YWbDV3aNDMqA=; h=From:To:Subject:Date:In-Reply-To:References:From; b=Z3vvbfm2TSebdVOzNIyJPrBIuoK2e4oDYd4pX+TzUmv8aTa6WhM+DfGi7lPSbeSau iz9eqWtr5gH0YNqIM1GkGRPgCvO9PEtA+1Q85m39nfPdLSVY3shJ9AV3BuDTbPbOMX t6PyC99bx8VfaJ1iV0yeonsrX9fjxzhw2MIu8CTg= From: madvenka@linux.microsoft.com To: mark.rutland@arm.com, broonie@kernel.org, jpoimboe@redhat.com, jthierry@redhat.com, catalin.marinas@arm.com, will@kernel.org, linux-arm-kernel@lists.infradead.org, live-patching@vger.kernel.org, linux-kernel@vger.kernel.org, madvenka@linux.microsoft.com Subject: [RFC PATCH v2 4/4] arm64: Mark stack trace as unreliable if kretprobed functions are present Date: Mon, 5 Apr 2021 15:43:13 -0500 Message-Id: <20210405204313.21346-5-madvenka@linux.microsoft.com> X-Mailer: git-send-email 2.25.1 In-Reply-To: <20210405204313.21346-1-madvenka@linux.microsoft.com> References: <705993ccb34a611c75cdae0a8cb1b40f9b218ebd> <20210405204313.21346-1-madvenka@linux.microsoft.com> MIME-Version: 1.0 X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20210405_214329_138704_E0B2A95B X-CRM114-Status: GOOD ( 20.27 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org From: "Madhavan T. Venkataraman" When a kretprobe is active for a function, the function's return address in its stack frame is modified to point to the kretprobe trampoline. When the function returns, the frame is popped and control is transferred to the trampoline. The trampoline eventually returns to the original return address. If a stack walk is done within the function (or any functions that get called from there), the stack trace will only show the trampoline and the not the original caller. Also, if the trampoline itself and the functions it calls do a stack trace, that stack trace will also have the same problem. Detect this as well. If the trampoline is detected in the stack trace, mark the stack trace as unreliable. Reviewed-by: Mark Brown Signed-off-by: Madhavan T. Venkataraman --- arch/arm64/kernel/stacktrace.c | 37 ++++++++++++++++++++++++++++++++++ 1 file changed, 37 insertions(+) diff --git a/arch/arm64/kernel/stacktrace.c b/arch/arm64/kernel/stacktrace.c index 7a3c638d4aeb..926bd91ffb3f 100644 --- a/arch/arm64/kernel/stacktrace.c +++ b/arch/arm64/kernel/stacktrace.c @@ -97,6 +97,36 @@ struct function_range { * if return_to_handler is detected on the stack. * * NOTE: The unwinder must do (1) before (2). + * + * KPROBES + * ======= + * + * There are two types of kprobes: + * + * (1) Regular kprobes that are placed anywhere in a probed function. + * This is implemented by replacing the probed instruction with a + * breakpoint. When the breakpoint is hit, the kprobe code emulates + * the original instruction in-situ and returns to the next + * instruction. + * + * Breakpoints are EL1 exceptions. When the unwinder detects them, + * the stack trace is marked as unreliable as it does not know where + * exactly the exception happened. Detection of EL1 exceptions in + * a stack trace will be done separately. + * + * (2) Return kprobes that are placed on the return of a probed function. + * In this case, Kprobes sets up an initial breakpoint at the + * beginning of the probed function. When the breakpoint is hit, + * Kprobes replaces the return address in the stack frame with the + * kretprobe_trampoline and records the original return address. + * When the probed function returns, control goes to the trampoline + * which eventually returns to the original return address. + * + * Stack traces taken while in the probed function or while in the + * trampoline will show kretprobe_trampoline instead of the original + * return address. Detect this and mark the stack trace unreliable. + * The detection is done by checking if the return PC falls anywhere + * in kretprobe_trampoline. */ static struct function_range special_functions[] = { /* @@ -125,6 +155,13 @@ static struct function_range special_functions[] = { { (unsigned long) return_to_handler, 0 }, #endif + /* + * Kprobe trampolines. + */ +#ifdef CONFIG_KRETPROBES + { (unsigned long) kretprobe_trampoline, 0 }, +#endif + { /* sentinel */ } };