1  /*
  2   * Copyright (c) 2016-2019 Apple Inc. All rights reserved.
  3   *
  4   * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
  5   *
  6   * This file contains Original Code and/or Modifications of Original Code
  7   * as defined in and that are subject to the Apple Public Source License
  8   * Version 2.0 (the 'License'). You may not use this file except in
  9   * compliance with the License. The rights granted to you under the License
 10   * may not be used to create, or enable the creation or redistribution of,
 11   * unlawful or unlicensed copies of an Apple operating system, or to
 12   * circumvent, violate, or enable the circumvention or violation of, any
 13   * terms of an Apple operating system software license agreement.
 14   *
 15   * Please obtain a copy of the License at
 16   * http://www.opensource.apple.com/apsl/ and read it before using this file.
 17   *
 18   * The Original Code and all software distributed under the License are
 19   * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
 20   * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
 21   * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
 22   * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
 23   * Please see the License for the specific language governing rights and
 24   * limitations under the License.
 25   *
 26   * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
 27   */
 28  
 29  #include <stddef.h>
 30  #include <stdint.h>
 31  
 32  #include <kern/assert.h>
 33  #include <kern/backtrace.h>
 34  #include <kern/cambria_layout.h>
 35  #include <kern/thread.h>
 36  #include <sys/errno.h>
 37  #include <vm/vm_map.h>
 38  
 39  #if defined(__arm__) || defined(__arm64__)
 40  #include <arm/cpu_data.h>
 41  #include <arm/cpu_data_internal.h>
 42  #endif
 43  
 44  #if defined(HAS_APPLE_PAC)
 45  #include <ptrauth.h>
 46  #endif
 47  
 48  #if XNU_MONITOR
 49  #define IN_PPLSTK_BOUNDS(__addr) \
 50  	(((uintptr_t)(__addr) >= (uintptr_t)pmap_stacks_start) && \
 51  	((uintptr_t)(__addr) < (uintptr_t)pmap_stacks_end))
 52  #endif
 53  
 54  unsigned int __attribute__((noinline))
 55  backtrace(uintptr_t *bt, unsigned int max_frames, bool *was_truncated_out)
 56  {
 57  	return backtrace_frame(bt, max_frames, __builtin_frame_address(0),
 58  	           was_truncated_out);
 59  }
 60  
 61  /*
 62   * This function captures a backtrace from the current stack and returns the
 63   * number of frames captured, limited by max_frames and starting at start_frame.
 64   * It's fast because it does no checking to make sure there isn't bad data.
 65   * Since it's only called from threads that we're going to keep executing,
 66   * if there's bad data we were going to die eventually.  If this function is
 67   * inlined, it doesn't record the frame of the function it's inside (because
 68   * there's no stack frame).
 69   */
 70  unsigned int __attribute__((noinline, not_tail_called))
 71  backtrace_frame(uintptr_t *bt, unsigned int max_frames, void *start_frame,
 72      bool *was_truncated_out)
 73  {
 74  	thread_t thread = current_thread();
 75  	uintptr_t *fp;
 76  	unsigned int frame_index = 0;
 77  	uintptr_t top, bottom;
 78  	bool in_valid_stack;
 79  
 80  	assert(bt != NULL);
 81  	assert(max_frames > 0);
 82  
 83  	fp = start_frame;
 84  	bottom = thread->kernel_stack;
 85  	top = bottom + kernel_stack_size;
 86  
 87  #define IN_STK_BOUNDS(__addr) \
 88  	(((uintptr_t)(__addr) >= (uintptr_t)bottom) && \
 89  	((uintptr_t)(__addr) < (uintptr_t)top))
 90  
 91  	in_valid_stack = IN_STK_BOUNDS(fp);
 92  #if XNU_MONITOR
 93  	in_valid_stack |= IN_PPLSTK_BOUNDS(fp);
 94  #endif /* XNU_MONITOR */
 95  
 96  	if (!in_valid_stack) {
 97  		fp = NULL;
 98  	}
 99  
100  	while (fp != NULL && frame_index < max_frames) {
101  		uintptr_t *next_fp = (uintptr_t *)*fp;
102  		uintptr_t ret_addr = *(fp + 1); /* return address is one word higher than frame pointer */
103  
104  		/*
105  		 * If the frame pointer is 0, backtracing has reached the top of
106  		 * the stack and there is no return address.  Some stacks might not
107  		 * have set this up, so bounds check, as well.
108  		 */
109  		in_valid_stack = IN_STK_BOUNDS(next_fp);
110  #if XNU_MONITOR
111  		in_valid_stack |= IN_PPLSTK_BOUNDS(next_fp);
112  #endif /* XNU_MONITOR */
113  
114  		if (next_fp == NULL || !in_valid_stack) {
115  			break;
116  		}
117  
118  #if defined(HAS_APPLE_PAC)
119  		/* return addresses signed by arm64e ABI */
120  		bt[frame_index++] = (uintptr_t) ptrauth_strip((void *)ret_addr, ptrauth_key_return_address);
121  #else /* defined(HAS_APPLE_PAC) */
122  		bt[frame_index++] = ret_addr;
123  #endif /* !defined(HAS_APPLE_PAC) */
124  
125  		/* stacks grow down; backtracing should be moving to higher addresses */
126  		if (next_fp <= fp) {
127  #if XNU_MONITOR
128  			bool fp_in_pplstack = IN_PPLSTK_BOUNDS(fp);
129  			bool fp_in_kstack = IN_STK_BOUNDS(fp);
130  			bool next_fp_in_pplstack = IN_PPLSTK_BOUNDS(fp);
131  			bool next_fp_in_kstack = IN_STK_BOUNDS(fp);
132  
133  			/*
134  			 * This check is verbose; it is basically checking whether
135  			 * we are switching between the kernel stack and the cpu
136  			 * stack.  If so, we ignore the fact that fp has switched
137  			 * directions (as it is a symptom of switching stacks).
138  			 */
139  			if (((fp_in_pplstack) && (next_fp_in_kstack)) ||
140  			    ((fp_in_kstack) && (next_fp_in_pplstack))) {
141  				break;
142  			}
143  #else /* XNU_MONITOR */
144  			break;
145  #endif /* !XNU_MONITOR */
146  		}
147  		fp = next_fp;
148  	}
149  
150  	/* NULL-terminate the list, if space is available */
151  	if (frame_index != max_frames) {
152  		bt[frame_index] = 0;
153  	}
154  
155  	if (fp != NULL && frame_index == max_frames && was_truncated_out) {
156  		*was_truncated_out = true;
157  	}
158  
159  	return frame_index;
160  #undef IN_STK_BOUNDS
161  }
162  
163  #if defined(__x86_64__)
164  
165  static kern_return_t
166  interrupted_kernel_pc_fp(uintptr_t *pc, uintptr_t *fp)
167  {
168  	x86_saved_state_t *state;
169  	bool state_64;
170  	uint64_t cs;
171  
172  	state = current_cpu_datap()->cpu_int_state;
173  	if (!state) {
174  		return KERN_FAILURE;
175  	}
176  
177  	state_64 = is_saved_state64(state);
178  
179  	if (state_64) {
180  		cs = saved_state64(state)->isf.cs;
181  	} else {
182  		cs = saved_state32(state)->cs;
183  	}
184  	/* return early if interrupted a thread in user space */
185  	if ((cs & SEL_PL) == SEL_PL_U) {
186  		return KERN_FAILURE;
187  	}
188  
189  	if (state_64) {
190  		*pc = saved_state64(state)->isf.rip;
191  		*fp = saved_state64(state)->rbp;
192  	} else {
193  		*pc = saved_state32(state)->eip;
194  		*fp = saved_state32(state)->ebp;
195  	}
196  	return KERN_SUCCESS;
197  }
198  
199  #elif defined(__arm64__)
200  
201  static kern_return_t
202  interrupted_kernel_pc_fp(uintptr_t *pc, uintptr_t *fp)
203  {
204  	struct arm_saved_state *state;
205  	bool state_64;
206  
207  	state = getCpuDatap()->cpu_int_state;
208  	if (!state) {
209  		return KERN_FAILURE;
210  	}
211  	state_64 = is_saved_state64(state);
212  
213  	/* return early if interrupted a thread in user space */
214  	if (PSR64_IS_USER(get_saved_state_cpsr(state))) {
215  		return KERN_FAILURE;
216  	}
217  
218  	*pc = get_saved_state_pc(state);
219  	*fp = get_saved_state_fp(state);
220  	return KERN_SUCCESS;
221  }
222  
223  #elif defined(__arm__)
224  
225  static kern_return_t
226  interrupted_kernel_pc_fp(uintptr_t *pc, uintptr_t *fp)
227  {
228  	struct arm_saved_state *state;
229  
230  	state = getCpuDatap()->cpu_int_state;
231  	if (!state) {
232  		return KERN_FAILURE;
233  	}
234  
235  	/* return early if interrupted a thread in user space */
236  	if (PSR_IS_USER(get_saved_state_cpsr(state))) {
237  		return KERN_FAILURE;
238  	}
239  
240  	*pc = get_saved_state_pc(state);
241  	*fp = get_saved_state_fp(state);
242  	return KERN_SUCCESS;
243  }
244  
245  #else /* defined(__arm__) */
246  #error "interrupted_kernel_pc_fp: unsupported architecture"
247  #endif /* !defined(__arm__) */
248  
249  unsigned int
250  backtrace_interrupted(uintptr_t *bt, unsigned int max_frames,
251      bool *was_truncated_out)
252  {
253  	uintptr_t pc;
254  	uintptr_t fp;
255  	kern_return_t kr;
256  
257  	assert(bt != NULL);
258  	assert(max_frames > 0);
259  	assert(ml_at_interrupt_context() == TRUE);
260  
261  	kr = interrupted_kernel_pc_fp(&pc, &fp);
262  	if (kr != KERN_SUCCESS) {
263  		return 0;
264  	}
265  
266  	bt[0] = pc;
267  	if (max_frames == 1) {
268  		return 1;
269  	}
270  
271  	return backtrace_frame(bt + 1, max_frames - 1, (void *)fp,
272  	           was_truncated_out) + 1;
273  }
274  
275  unsigned int
276  backtrace_user(uintptr_t *bt, unsigned int max_frames,
277      int *error_out, bool *user_64_out, bool *was_truncated_out)
278  {
279  	return backtrace_thread_user(current_thread(), bt, max_frames,
280  	           error_out, user_64_out, was_truncated_out, true);
281  }
282  
283  unsigned int
284  backtrace_thread_user(void *thread, uintptr_t *bt, unsigned int max_frames,
285      int *error_out, bool *user_64_out, bool *was_truncated_out, __unused bool faults_permitted)
286  {
287  	bool user_64;
288  	uintptr_t pc = 0, fp = 0, next_fp = 0;
289  	vm_map_t map = NULL, old_map = NULL;
290  	unsigned int frame_index = 0;
291  	int err = 0;
292  	size_t frame_size = 0;
293  
294  	assert(bt != NULL);
295  	assert(max_frames > 0);
296  	assert((max_frames == 1) || (faults_permitted == true));
297  
298  #if defined(__x86_64__)
299  
300  	/* don't allow a malformed user stack to copyin arbitrary kernel data */
301  #define INVALID_USER_FP(FP) ((FP) == 0 || !IS_USERADDR64_CANONICAL((FP)))
302  
303  	x86_saved_state_t *state = get_user_regs(thread);
304  	if (!state) {
305  		return EINVAL;
306  	}
307  
308  	user_64 = is_saved_state64(state);
309  	if (user_64) {
310  		pc = saved_state64(state)->isf.rip;
311  		fp = saved_state64(state)->rbp;
312  	} else {
313  		pc = saved_state32(state)->eip;
314  		fp = saved_state32(state)->ebp;
315  	}
316  
317  #elif defined(__arm64__)
318  
319  	struct arm_saved_state *state = get_user_regs(thread);
320  	if (!state) {
321  		return EINVAL;
322  	}
323  
324  	user_64 = is_saved_state64(state);
325  	pc = get_saved_state_pc(state);
326  	fp = get_saved_state_fp(state);
327  
328  
329  	/* ARM expects stack frames to be aligned to 16 bytes */
330  #define INVALID_USER_FP(FP) ((FP) == 0 || ((FP) & 0x3UL) != 0UL)
331  
332  
333  
334  #elif defined(__arm__)
335  
336  	/* ARM expects stack frames to be aligned to 16 bytes */
337  #define INVALID_USER_FP(FP) ((FP) == 0 || ((FP) & 0x3UL) != 0UL)
338  
339  	struct arm_saved_state *state = get_user_regs(thread);
340  	if (!state) {
341  		return EINVAL;
342  	}
343  
344  	user_64 = false;
345  	pc = get_saved_state_pc(state);
346  	fp = get_saved_state_fp(state);
347  
348  #else /* defined(__arm__) */
349  #error "backtrace_thread_user: unsupported architecture"
350  #endif /* !defined(__arm__) */
351  
352  	bt[frame_index++] = pc;
353  
354  	if (frame_index >= max_frames) {
355  		goto out;
356  	}
357  
358  	if (INVALID_USER_FP(fp)) {
359  		goto out;
360  	}
361  
362  	assert(ml_get_interrupts_enabled() == TRUE);
363  	if (!ml_get_interrupts_enabled()) {
364  		goto out;
365  	}
366  
367  	union {
368  		struct {
369  			uint64_t fp;
370  			uint64_t ret;
371  		} u64;
372  		struct {
373  			uint32_t fp;
374  			uint32_t ret;
375  		} u32;
376  	} frame;
377  
378  	frame_size = 2 * (user_64 ? 8 : 4);
379  
380  	/* switch to the correct map, for copyin */
381  	if (thread != current_thread()) {
382  		map = get_task_map_reference(get_threadtask(thread));
383  		if (map == NULL) {
384  			goto out;
385  		}
386  		old_map = vm_map_switch(map);
387  	} else {
388  		map = NULL;
389  	}
390  
391  	while (fp != 0 && frame_index < max_frames) {
392  		err = copyin(fp, (char *)&frame, frame_size);
393  		if (err) {
394  			if (was_truncated_out) {
395  				*was_truncated_out = true;
396  			}
397  			goto out;
398  		}
399  
400  		next_fp = user_64 ? frame.u64.fp : frame.u32.fp;
401  
402  		if (INVALID_USER_FP(next_fp)) {
403  			break;
404  		}
405  
406  		uintptr_t ret_addr = user_64 ? frame.u64.ret : frame.u32.ret;
407  #if defined(HAS_APPLE_PAC)
408  		/* return addresses signed by arm64e ABI */
409  		bt[frame_index++] = (uintptr_t)ptrauth_strip((void *)ret_addr,
410  		    ptrauth_key_return_address);
411  #else /* defined(HAS_APPLE_PAC) */
412  		bt[frame_index++] = ret_addr;
413  #endif /* !defined(HAS_APPLE_PAC) */
414  
415  		/* stacks grow down; backtracing should be moving to higher addresses */
416  		if (next_fp <= fp) {
417  			break;
418  		}
419  		fp = next_fp;
420  	}
421  
422  out:
423  	if (map) {
424  		(void)vm_map_switch(old_map);
425  		vm_map_deallocate(map);
426  	}
427  
428  	/* NULL-terminate the list, if space is available */
429  	if (frame_index != max_frames) {
430  		bt[frame_index] = 0;
431  	}
432  
433  	if (fp != 0 && frame_index == max_frames && was_truncated_out) {
434  		*was_truncated_out = true;
435  	}
436  
437  	if (user_64_out) {
438  		*user_64_out = user_64;
439  	}
440  	if (error_out) {
441  		*error_out = err;
442  	}
443  
444  	return frame_index;
445  #undef INVALID_USER_FP
446  }