Aksal/nuttx
3
1
Fork 1
mirror of https://github.com/apache/nuttx.git synced 2026-08-01 20:28:58 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

arch/risc-v: switch to target addrenv when backtracing another tcb

Browse source 
up_backtrace() on a different tcb dereferences that task's own stack
to walk its frame pointer chain, but never selected that task's
address environment first. Under CONFIG_ARCH_ADDRENV each task's
stack lives behind its own page tables mapped at the same fixed
virtual range, so reading tcb->stack_base_ptr without first switching
to that task's addrenv reads whatever physical page the caller's own
mapping of that virtual range happens to point to, not the target
task's real stack. A cross-tid dumpstack of a task running in a
different address environment therefore returns garbage or an
all-zero backtrace instead of failing cleanly or resolving the real
call chain.

Add an addrenv parameter to backtrace() and select the target tcb's
addrenv_own only around the two dereferences that read the target's
saved ra/fp (ra = *(fp - 1), next_fp = *(fp - 2)), then restore the
caller's own addrenv before writing the result into buffer. buffer
belongs to the caller, not the target tcb, so it must always be
written back in the caller's own address environment; writing it
while the target's addrenv is still selected would corrupt the
access instead of fixing it.

Signed-off-by: liang.huang <liang.huang@houmo.ai>
This commit is contained in:
liang.huang 2026-07-15 12:13:14 +08:00 • committed by Xiang Xiao
parent 16a4ab53fa
commit 73b3487e70
1 changed files with 64 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

72
arch/risc-v/src/common/riscv_backtrace.c
View file

@ -26,6 +26,7 @@
#include <nuttx/config.h>
#include <nuttx/arch.h>
#include <nuttx/addrenv.h>
#include "sched/sched.h"
#include "riscv_internal.h"
@ -65,9 +66,14 @@ static inline uintptr_t getfp(void)
nosanitize_address
static int backtrace(uintptr_t *base, uintptr_t *limit,
uintptr_t *fp, uintptr_t *ra,
void **buffer, int size, int *skip)
void **buffer, int size, int *skip
#ifdef CONFIG_ARCH_ADDRENV
, FAR struct addrenv_s *addrenv
#endif
)
{
int i = 0;
uintptr_t *next_fp;
#if CONFIG_ARCH_INTERRUPTSTACK > 15
int cpu = up_cpu_index();
uintptr_t *intstack_limit =
@ -77,6 +83,9 @@ static int backtrace(uintptr_t *base, uintptr_t *limit,
uintptr_t *intstack_base =
(uintptr_t *)((uintptr_t)intstack_limit - CONFIG_ARCH_INTERRUPTSTACK);
#endif
#ifdef CONFIG_ARCH_ADDRENV
FAR struct addrenv_s *oldenv;
#endif
if (ra)
{
@ -86,7 +95,7 @@ static int backtrace(uintptr_t *base, uintptr_t *limit,
}
}
for (; i < size; fp = (uintptr_t *)*(fp - 2))
for (; i < size; fp = next_fp)
{
if ((fp > limit || fp < base)
#if CONFIG_ARCH_INTERRUPTSTACK > 15
@ -97,7 +106,30 @@ static int backtrace(uintptr_t *base, uintptr_t *limit,
break;
}
/* fp/fp-1/fp-2 are addresses in the *target* tcb's stack. If that
* tcb has its own address environment, switch to it only for these
* two dereferences. buffer belongs to the caller, not the target,
* and must always be written using the caller's own address
* environment.
*/
#ifdef CONFIG_ARCH_ADDRENV
if (addrenv != NULL)
{
addrenv_select(addrenv, &oldenv);
}
#endif
ra = (uintptr_t *)*(fp - 1);
next_fp = (uintptr_t *)*(fp - 2);
#ifdef CONFIG_ARCH_ADDRENV
if (addrenv != NULL)
{
addrenv_restore(oldenv);
}
#endif
if (ra == NULL)
{
break;
@ -166,7 +198,11 @@ int up_backtrace(struct tcb_s *tcb, void **buffer, int size, int skip)
ret = backtrace(rtcb->stack_base_ptr,
(uintptr_t *)((uintptr_t)rtcb->stack_base_ptr +
rtcb->adj_stack_size),
(void *)getfp(), NULL, buffer, size, &skip);
(void *)getfp(), NULL, buffer, size, &skip
#ifdef CONFIG_ARCH_ADDRENV
, NULL
#endif
);
if (ret < size)
{
ret += backtrace(rtcb->stack_base_ptr, (uintptr_t *)
@ -174,7 +210,11 @@ int up_backtrace(struct tcb_s *tcb, void **buffer, int size, int skip)
rtcb->adj_stack_size),
running_regs()[REG_FP],
running_regs()[REG_EPC],
&buffer[ret], size - ret, &skip);
&buffer[ret], size - ret, &skip
#ifdef CONFIG_ARCH_ADDRENV
, NULL
#endif
);
}
}
else
@ -187,7 +227,11 @@ int up_backtrace(struct tcb_s *tcb, void **buffer, int size, int skip)
rtcb->adj_stack_size),
(void *)rtcb->xcp.sregs[REG_FP],
(void *)rtcb->xcp.sregs[REG_EPC],
buffer, size, &skip);
buffer, size, &skip
#ifdef CONFIG_ARCH_ADDRENV
, NULL
#endif
);
}
else
#endif
@ -195,7 +239,11 @@ int up_backtrace(struct tcb_s *tcb, void **buffer, int size, int skip)
ret = backtrace(rtcb->stack_base_ptr, (uintptr_t *)
((uintptr_t)rtcb->stack_base_ptr +
rtcb->adj_stack_size),
(void *)getfp(), NULL, buffer, size, &skip);
(void *)getfp(), NULL, buffer, size, &skip
#ifdef CONFIG_ARCH_ADDRENV
, NULL
#endif
);
}
}
}
@ -209,7 +257,11 @@ int up_backtrace(struct tcb_s *tcb, void **buffer, int size, int skip)
tcb->adj_stack_size),
(void *)tcb->xcp.sregs[REG_FP],
(void *)tcb->xcp.sregs[REG_EPC],
buffer, size, &skip);
buffer, size, &skip
#ifdef CONFIG_ARCH_ADDRENV
, tcb->addrenv_own
#endif
);
}
else
#endif
@ -219,7 +271,11 @@ int up_backtrace(struct tcb_s *tcb, void **buffer, int size, int skip)
tcb->adj_stack_size),
(void *)tcb->xcp.regs[REG_FP],
(void *)tcb->xcp.regs[REG_EPC],
buffer, size, &skip);
buffer, size, &skip
#ifdef CONFIG_ARCH_ADDRENV
, tcb->addrenv_own
#endif
);
}
}