[PATCH v4 12/12] s390/unwind_user/fp: Enable back chain unwinding of user space
From: Jens Remus <hidden>
Date: 2026-01-27 15:20:01
Also in:
bpf, linux-s390, lkml
Subsystem:
s390 architecture, the rest · Maintainers:
Heiko Carstens, Vasily Gorbik, Alexander Gordeev, Linus Torvalds
Unwinding of user space using frame pointer (FP) is virtually impossible
on s390 for the following reasons: The s390 64-bit (s390x) ELF ABI [1]
does only designate a "preferred" FP register and does not mandate fixed
FP and return address (RA) stack save slots. Therefore neither the FP
register nor the FP/RA stack save slot offsets from CFA are known.
Compilers, such as GCC and Clang, do not necessarily setup a FP register
early in the function prologue, even not with compiler option
-fno-omit-frame-pointer. Therefore the CFA offset from FP register is
not known.
This could be resolved by having compiler option -no-omit-frame-pointer
enforce all of the following: Use the preferred FP register 11 as frame
pointer, use fixed FP/RA stack slot offsets from CFA (e.g. -72 for FP
and -48 for RA), and setup the FP register immediately after saving the
call saved registers.
Fortunately s390 provides an alternative to frame pointer: back chain,
which can be enabled using s390-specific compiler option -mbackchain.
The back chain is very similar to a frame pointer on the stack.
Leverage the unwind user fp infrastructure to enable unwinding of user
space using back chain. Enable HAVE_UNWIND_USER_FP and provide a s390-
specific implementation of unwind_user_fp_get_frame(), which uses the
back chain.
Signed-off-by: Jens Remus <redacted>
---
Notes (jremus):
Changes in v4:
- Remove flawed heuristic to detect if topmost IP in early prologue.
While it may resolve the caller getting skipped it may erroneously
inject a callee as caller.
- Fix outermost frame indication.
- Adjust to flexible CFA and FP/RA rules.
- Remove superfluous unwind_user_fp_get_frame define.
Changes in RFC v3:
- New patch. Implement unwind user fp using back chain on s390. Reuses
logic from RFC v2 patch "unwind_user/backchain: Introduce back chain
user space unwinding". (Josh)
arch/s390/Kconfig | 1 +
arch/s390/include/asm/unwind_user.h | 62 +++++++++++++++++++++++++++++
2 files changed, 63 insertions(+)
diff --git a/arch/s390/Kconfig b/arch/s390/Kconfig
index 063f0c857600..5f7e83ba54b2 100644
--- a/arch/s390/Kconfig
+++ b/arch/s390/Kconfig@@ -250,6 +250,7 @@ config S390 select HAVE_SOFTIRQ_ON_OWN_STACK select HAVE_STACKPROTECTOR if CC_HAS_STACKPROTECTOR_GLOBAL select HAVE_SYSCALL_TRACEPOINTS + select HAVE_UNWIND_USER_FP select HAVE_UNWIND_USER_SFRAME select HAVE_VIRT_CPU_ACCOUNTING select HAVE_VIRT_CPU_ACCOUNTING_IDLE
diff --git a/arch/s390/include/asm/unwind_user.h b/arch/s390/include/asm/unwind_user.h
index 941aa3f0f70f..a7b97ea01c26 100644
--- a/arch/s390/include/asm/unwind_user.h
+++ b/arch/s390/include/asm/unwind_user.h@@ -3,8 +3,12 @@ #define _ASM_S390_UNWIND_USER_H #include <linux/sched/task_stack.h> +#include <linux/security.h> #include <linux/types.h> +#include <asm/asm-offsets.h> #include <asm/fpu.h> +#include <asm/stacktrace.h> +#include <linux/unwind_user_types.h> #ifdef CONFIG_UNWIND_USER
@@ -65,6 +69,64 @@ static inline int arch_unwind_user_get_reg(unsigned long *val, #endif /* CONFIG_UNWIND_USER */ +#ifdef CONFIG_HAVE_UNWIND_USER_FP + +static inline bool ip_within_vdso(unsigned long ip) +{ + return in_range(ip, current->mm->context.vdso_base, vdso_text_size()); +} + +static inline int unwind_user_fp_get_frame(struct unwind_user_state *state, + struct unwind_user_frame *frame) +{ + struct stack_frame_user __user *sf; + unsigned long __user *ra_addr; + unsigned long sp; + + sf = (void __user *)state->sp; + if (__get_user(sp, (unsigned long __user *)&sf->back_chain)) + return -EINVAL; + if (!sp && ip_within_vdso(state->ip)) { + /* + * Assume non-standard vDSO user wrapper stack frame. + * See vDSO user wrapper code for details. + */ + struct stack_frame_vdso_wrapper *sf_vdso = (void __user *)sf; + + ra_addr = (unsigned long __user *)&sf_vdso->return_address; + sf = (void __user *)((unsigned long)sf + STACK_FRAME_VDSO_OVERHEAD); + if (__get_user(sp, (unsigned long __user *)&sf->back_chain)) + return -EINVAL; + } else if (!sp) { + /* + * Assume outermost frame reached. unwind_user_next_common() + * disregards all other fields in outermost frame. + */ + frame->outermost = true; + return 0; + } else { + /* + * Assume IP past prologue and new stack frame allocated. + * Follow back chain, which then equals the SP at entry. + * Skips caller if wrong in topmost frame. + */ + sf = (void __user *)sp; + ra_addr = (unsigned long __user *)&sf->gprs[8]; + } + + frame->cfa.rule = UNWIND_USER_CFA_RULE_SP_OFFSET; + frame->cfa.offset = sp - state->sp + 160; + frame->sp_off = -160; + frame->fp.rule = UNWIND_USER_RULE_ZERO; /* Cannot unwind FP. */ + frame->ra.rule = UNWIND_USER_RULE_CFA_OFFSET_DEREF; + frame->ra.offset = (unsigned long)ra_addr - (state->sp + frame->cfa.offset); + frame->outermost = false; + + return 0; +} + +#endif /* CONFIG_HAVE_UNWIND_USER_FP */ + #include <asm-generic/unwind_user.h> #endif /* _ASM_S390_UNWIND_USER_H */
--
2.51.0