x86/stacktrace: Don't dereference bad frame pointers
[linux-2.6/linux-acpi-2.6/ibm-acpi-2.6.git] / arch / x86 / kernel / dumpstack_64.c
bloba6c906c9b1937661a03f19857e9d474305035043
1 /*
2 * Copyright (C) 1991, 1992 Linus Torvalds
3 * Copyright (C) 2000, 2001, 2002 Andi Kleen, SuSE Labs
4 */
5 #include <linux/kallsyms.h>
6 #include <linux/kprobes.h>
7 #include <linux/uaccess.h>
8 #include <linux/hardirq.h>
9 #include <linux/kdebug.h>
10 #include <linux/module.h>
11 #include <linux/ptrace.h>
12 #include <linux/kexec.h>
13 #include <linux/sysfs.h>
14 #include <linux/bug.h>
15 #include <linux/nmi.h>
17 #include <asm/stacktrace.h>
19 #include "dumpstack.h"
21 #define N_EXCEPTION_STACKS_END \
22 (N_EXCEPTION_STACKS + DEBUG_STKSZ/EXCEPTION_STKSZ - 2)
24 static char x86_stack_ids[][8] = {
25 [ DEBUG_STACK-1 ] = "#DB",
26 [ NMI_STACK-1 ] = "NMI",
27 [ DOUBLEFAULT_STACK-1 ] = "#DF",
28 [ STACKFAULT_STACK-1 ] = "#SS",
29 [ MCE_STACK-1 ] = "#MC",
30 #if DEBUG_STKSZ > EXCEPTION_STKSZ
31 [ N_EXCEPTION_STACKS ...
32 N_EXCEPTION_STACKS_END ] = "#DB[?]"
33 #endif
36 int x86_is_stack_id(int id, char *name)
38 return x86_stack_ids[id - 1] == name;
41 static unsigned long *in_exception_stack(unsigned cpu, unsigned long stack,
42 unsigned *usedp, char **idp)
44 unsigned k;
47 * Iterate over all exception stacks, and figure out whether
48 * 'stack' is in one of them:
50 for (k = 0; k < N_EXCEPTION_STACKS; k++) {
51 unsigned long end = per_cpu(orig_ist, cpu).ist[k];
53 * Is 'stack' above this exception frame's end?
54 * If yes then skip to the next frame.
56 if (stack >= end)
57 continue;
59 * Is 'stack' above this exception frame's start address?
60 * If yes then we found the right frame.
62 if (stack >= end - EXCEPTION_STKSZ) {
64 * Make sure we only iterate through an exception
65 * stack once. If it comes up for the second time
66 * then there's something wrong going on - just
67 * break out and return NULL:
69 if (*usedp & (1U << k))
70 break;
71 *usedp |= 1U << k;
72 *idp = x86_stack_ids[k];
73 return (unsigned long *)end;
76 * If this is a debug stack, and if it has a larger size than
77 * the usual exception stacks, then 'stack' might still
78 * be within the lower portion of the debug stack:
80 #if DEBUG_STKSZ > EXCEPTION_STKSZ
81 if (k == DEBUG_STACK - 1 && stack >= end - DEBUG_STKSZ) {
82 unsigned j = N_EXCEPTION_STACKS - 1;
85 * Black magic. A large debug stack is composed of
86 * multiple exception stack entries, which we
87 * iterate through now. Dont look:
89 do {
90 ++j;
91 end -= EXCEPTION_STKSZ;
92 x86_stack_ids[j][4] = '1' +
93 (j - N_EXCEPTION_STACKS);
94 } while (stack < end - EXCEPTION_STKSZ);
95 if (*usedp & (1U << j))
96 break;
97 *usedp |= 1U << j;
98 *idp = x86_stack_ids[j];
99 return (unsigned long *)end;
101 #endif
103 return NULL;
106 static inline int
107 in_irq_stack(unsigned long *stack, unsigned long *irq_stack,
108 unsigned long *irq_stack_end)
110 return (stack >= irq_stack && stack < irq_stack_end);
114 * We are returning from the irq stack and go to the previous one.
115 * If the previous stack is also in the irq stack, then bp in the first
116 * frame of the irq stack points to the previous, interrupted one.
117 * Otherwise we have another level of indirection: We first save
118 * the bp of the previous stack, then we switch the stack to the irq one
119 * and save a new bp that links to the previous one.
120 * (See save_args())
122 static inline unsigned long
123 fixup_bp_irq_link(unsigned long bp, unsigned long *stack,
124 unsigned long *irq_stack, unsigned long *irq_stack_end)
126 #ifdef CONFIG_FRAME_POINTER
127 struct stack_frame *frame = (struct stack_frame *)bp;
128 unsigned long next;
130 if (!in_irq_stack(stack, irq_stack, irq_stack_end)) {
131 if (!probe_kernel_address(&frame->next_frame, next))
132 return next;
133 else
134 WARN_ONCE(1, "Perf: bad frame pointer = %p in "
135 "callchain\n", &frame->next_frame);
137 #endif
138 return bp;
142 * x86-64 can have up to three kernel stacks:
143 * process stack
144 * interrupt stack
145 * severe exception (double fault, nmi, stack fault, debug, mce) hardware stack
148 void dump_trace(struct task_struct *task, struct pt_regs *regs,
149 unsigned long *stack, unsigned long bp,
150 const struct stacktrace_ops *ops, void *data)
152 const unsigned cpu = get_cpu();
153 unsigned long *irq_stack_end =
154 (unsigned long *)per_cpu(irq_stack_ptr, cpu);
155 unsigned used = 0;
156 struct thread_info *tinfo;
157 int graph = 0;
159 if (!task)
160 task = current;
162 if (!stack) {
163 unsigned long dummy;
164 stack = &dummy;
165 if (task && task != current)
166 stack = (unsigned long *)task->thread.sp;
169 #ifdef CONFIG_FRAME_POINTER
170 if (!bp) {
171 if (task == current) {
172 /* Grab bp right from our regs */
173 get_bp(bp);
174 } else {
175 /* bp is the last reg pushed by switch_to */
176 bp = *(unsigned long *) task->thread.sp;
179 #endif
182 * Print function call entries in all stacks, starting at the
183 * current stack address. If the stacks consist of nested
184 * exceptions
186 tinfo = task_thread_info(task);
187 for (;;) {
188 char *id;
189 unsigned long *estack_end;
190 estack_end = in_exception_stack(cpu, (unsigned long)stack,
191 &used, &id);
193 if (estack_end) {
194 if (ops->stack(data, id) < 0)
195 break;
197 bp = ops->walk_stack(tinfo, stack, bp, ops,
198 data, estack_end, &graph);
199 ops->stack(data, "<EOE>");
201 * We link to the next stack via the
202 * second-to-last pointer (index -2 to end) in the
203 * exception stack:
205 stack = (unsigned long *) estack_end[-2];
206 continue;
208 if (irq_stack_end) {
209 unsigned long *irq_stack;
210 irq_stack = irq_stack_end -
211 (IRQ_STACK_SIZE - 64) / sizeof(*irq_stack);
213 if (in_irq_stack(stack, irq_stack, irq_stack_end)) {
214 if (ops->stack(data, "IRQ") < 0)
215 break;
216 bp = print_context_stack(tinfo, stack, bp,
217 ops, data, irq_stack_end, &graph);
219 * We link to the next stack (which would be
220 * the process stack normally) the last
221 * pointer (index -1 to end) in the IRQ stack:
223 stack = (unsigned long *) (irq_stack_end[-1]);
224 bp = fixup_bp_irq_link(bp, stack, irq_stack,
225 irq_stack_end);
226 irq_stack_end = NULL;
227 ops->stack(data, "EOI");
228 continue;
231 break;
235 * This handles the process stack:
237 bp = print_context_stack(tinfo, stack, bp, ops, data, NULL, &graph);
238 put_cpu();
240 EXPORT_SYMBOL(dump_trace);
242 void
243 show_stack_log_lvl(struct task_struct *task, struct pt_regs *regs,
244 unsigned long *sp, unsigned long bp, char *log_lvl)
246 unsigned long *irq_stack_end;
247 unsigned long *irq_stack;
248 unsigned long *stack;
249 int cpu;
250 int i;
252 preempt_disable();
253 cpu = smp_processor_id();
255 irq_stack_end = (unsigned long *)(per_cpu(irq_stack_ptr, cpu));
256 irq_stack = (unsigned long *)(per_cpu(irq_stack_ptr, cpu) - IRQ_STACK_SIZE);
259 * Debugging aid: "show_stack(NULL, NULL);" prints the
260 * back trace for this cpu:
262 if (sp == NULL) {
263 if (task)
264 sp = (unsigned long *)task->thread.sp;
265 else
266 sp = (unsigned long *)&sp;
269 stack = sp;
270 for (i = 0; i < kstack_depth_to_print; i++) {
271 if (stack >= irq_stack && stack <= irq_stack_end) {
272 if (stack == irq_stack_end) {
273 stack = (unsigned long *) (irq_stack_end[-1]);
274 printk(" <EOI> ");
276 } else {
277 if (((long) stack & (THREAD_SIZE-1)) == 0)
278 break;
280 if (i && ((i % STACKSLOTS_PER_LINE) == 0))
281 printk("\n%s", log_lvl);
282 printk(" %016lx", *stack++);
283 touch_nmi_watchdog();
285 preempt_enable();
287 printk("\n");
288 show_trace_log_lvl(task, regs, sp, bp, log_lvl);
291 void show_registers(struct pt_regs *regs)
293 int i;
294 unsigned long sp;
295 const int cpu = smp_processor_id();
296 struct task_struct *cur = current;
298 sp = regs->sp;
299 printk("CPU %d ", cpu);
300 __show_regs(regs, 1);
301 printk("Process %s (pid: %d, threadinfo %p, task %p)\n",
302 cur->comm, cur->pid, task_thread_info(cur), cur);
305 * When in-kernel, we also print out the stack and code at the
306 * time of the fault..
308 if (!user_mode(regs)) {
309 unsigned int code_prologue = code_bytes * 43 / 64;
310 unsigned int code_len = code_bytes;
311 unsigned char c;
312 u8 *ip;
314 printk(KERN_EMERG "Stack:\n");
315 show_stack_log_lvl(NULL, regs, (unsigned long *)sp,
316 regs->bp, KERN_EMERG);
318 printk(KERN_EMERG "Code: ");
320 ip = (u8 *)regs->ip - code_prologue;
321 if (ip < (u8 *)PAGE_OFFSET || probe_kernel_address(ip, c)) {
322 /* try starting at IP */
323 ip = (u8 *)regs->ip;
324 code_len = code_len - code_prologue + 1;
326 for (i = 0; i < code_len; i++, ip++) {
327 if (ip < (u8 *)PAGE_OFFSET ||
328 probe_kernel_address(ip, c)) {
329 printk(" Bad RIP value.");
330 break;
332 if (ip == (u8 *)regs->ip)
333 printk("<%02x> ", c);
334 else
335 printk("%02x ", c);
338 printk("\n");
341 int is_valid_bugaddr(unsigned long ip)
343 unsigned short ud2;
345 if (__copy_from_user(&ud2, (const void __user *) ip, sizeof(ud2)))
346 return 0;
348 return ud2 == 0x0b0f;