From: Jens Remus <jremus@linux.ibm.com>
To: linux-kernel@vger.kernel.org, linux-trace-kernel@vger.kernel.org,
linux-s390@vger.kernel.org, x86@kernel.org,
Steven Rostedt <rostedt@kernel.org>,
Josh Poimboeuf <jpoimboe@kernel.org>,
Peter Zijlstra <peterz@infradead.org>,
Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
Cc: Jens Remus <jremus@linux.ibm.com>,
Heiko Carstens <hca@linux.ibm.com>,
Vasily Gorbik <gor@linux.ibm.com>,
Alexander Gordeev <agordeev@linux.ibm.com>,
Ilya Leoshkevich <iii@linux.ibm.com>,
Indu Bhagat <ibhagatgnu@gmail.com>,
Thomas Gleixner <tglx@kernel.org>, Ingo Molnar <mingo@redhat.com>,
Borislav Petkov <bp@alien8.de>,
Dave Hansen <dave.hansen@linux.intel.com>,
"H. Peter Anvin" <hpa@zytor.com>,
Namhyung Kim <namhyung@kernel.org>,
Andrii Nakryiko <andrii@kernel.org>, Kees Cook <kees@kernel.org>,
Sam James <sam@gentoo.org>, Fangrui Song <i@maskray.me>
Subject: [RFC PATCH v2 21/24] unwind_user/eh_frame/x86: Handle DRAP expressions
Date: Fri, 21 Aug 2026 21:52:56 +0200 [thread overview]
Message-ID: <20260821195259.2688377-22-jremus@linux.ibm.com> (raw)
In-Reply-To: <20260821195259.2688377-1-jremus@linux.ibm.com>
GCC uses DRAP (Dynamic Realign Argument Pointer) when the stack needs
to be dynamically realigned (e.g. for aligned local variables). This
uses DWARF expressions to describe how to unwind through such frames.
Add x86-specific handling for the CFA and FP expressions patterns:
1. CFA expression (DW_OP_breg<FP> + offset, DW_OP_deref):
- Semantics: CFA = *(FP + offset)
- Restores the CFA from the saved SP at FP-4 (i386) or FP-8 (x86-64).
2. FP expression (DW_OP_breg<FP> +0):
- Semantics: FP = *(FP + 0)
- Restores FP from DRAP location (FP+0).
The implementation uses mask-based pattern matching similar to the
existing x86 PLT expression support.
Signed-off-by: Jens Remus <jremus@linux.ibm.com>
---
arch/x86/include/asm/unwind_user_eh_frame.h | 65 +++++++++++++++++++++
include/linux/unwind_user_eh_frame_types.h | 4 ++
kernel/unwind/eh_frame.c | 57 ++++++++++++++----
3 files changed, 115 insertions(+), 11 deletions(-)
diff --git a/arch/x86/include/asm/unwind_user_eh_frame.h b/arch/x86/include/asm/unwind_user_eh_frame.h
index 8268eb1a0ff5..670740cdbd8c 100644
--- a/arch/x86/include/asm/unwind_user_eh_frame.h
+++ b/arch/x86/include/asm/unwind_user_eh_frame.h
@@ -79,10 +79,75 @@ static inline int eh_frame_do_def_cfa_expression(const char *expr,
return 0;
}
+ /*
+ * DRAP (Dynamic Realignment Pointer) CFA expression:
+ *
+ * DW_OP_breg<FP> + <FP_offset> // 5 (EBP) - 4 or 6 (RBP) - 8
+ * DW_OP_deref
+ *
+ * CFA = *(FP + FP_offset)
+ */
+ static const char drap_expr[] = {0x70, 0x00, 0x06};
+ static const char drap_mask[] = {0xf0, 0x80, 0xff};
+
+ if (size == sizeof(drap_expr) &&
+ !memcmp_masked(expr, drap_expr, drap_mask, sizeof(drap_expr))) {
+ unsigned char fp_reg = DW_OP_breg_register(expr[0]);
+ unsigned char fp_offset_byte = expr[1];
+ long fp_offset;
+
+ if (fp_reg != EH_FRAME_REG_FP)
+ return -EOPNOTSUPP;
+
+ fp_offset = (long)(fp_offset_byte);
+ if (fp_offset_byte & 0x40)
+ fp_offset |= -(1L << 7); /* Sign extend */
+
+ /* CFA = *(FP + offset) */
+ reg_state->cfa_rule = CFA_REG_OFFSET_DEREF;
+ reg_state->cfa_regnum = EH_FRAME_REG_FP;
+ reg_state->cfa_offset = fp_offset;
+ return 0;
+ }
+
return -EOPNOTSUPP;
}
#define eh_frame_do_def_cfa_expression eh_frame_do_def_cfa_expression
+static inline int eh_frame_do_expression(unsigned int reg,
+ const char *expr,
+ int size,
+ unsigned long ip,
+ struct eh_frame_reg_state *reg_state)
+{
+ /*
+ * DRAP (Dynamic Realignment Pointer) FP expression:
+ *
+ * DW_OP_breg<FP> +0 // 5 (EBP) or 6 (RBP)
+ *
+ * FP = *(FP + 0)
+ */
+ static const char drap_fp_expr[] = {0x70, 0x00};
+ static const char drap_fp_mask[] = {0xf0, 0xff};
+
+ if (reg == EH_FRAME_REG_FP && size == sizeof(drap_fp_expr) &&
+ !memcmp_masked(expr, drap_fp_expr, drap_fp_mask, sizeof(drap_fp_expr))) {
+ unsigned char fp_reg = DW_OP_breg_register(expr[0]);
+
+ if (fp_reg != EH_FRAME_REG_FP)
+ return -EOPNOTSUPP;
+
+ /* FP = *(FP + 0) */
+ reg_state->reg_rule[FP_IDX] = REG_REGISTER_OFFSET_DEREF;
+ reg_state->reg_regnum[FP_IDX] = EH_FRAME_REG_FP;
+ reg_state->reg_offset[FP_IDX] = 0;
+ return 0;
+ }
+
+ return -EOPNOTSUPP;
+}
+#define eh_frame_do_expression eh_frame_do_expression
+
#include <asm-generic/unwind_user_eh_frame.h>
#endif /* _ASM_X86_UNWIND_USER_EH_FRAME_H */
diff --git a/include/linux/unwind_user_eh_frame_types.h b/include/linux/unwind_user_eh_frame_types.h
index e9f9d1abb76f..9547e963bb5f 100644
--- a/include/linux/unwind_user_eh_frame_types.h
+++ b/include/linux/unwind_user_eh_frame_types.h
@@ -5,6 +5,8 @@
enum eh_frame_cfa_rule {
CFA_UNDEFINED, /* unrecoverable */
CFA_REG_OFFSET, /* CFA = reg + offset */
+ /* CFA expressions rules */
+ CFA_REG_OFFSET_DEREF, /* CFA = *(reg + offset) */
};
enum eh_frame_reg_rule {
@@ -14,6 +16,8 @@ enum eh_frame_reg_rule {
REG_OFFSET, /* reg = *(CFA + offset) */
REG_VAL_OFFSET, /* reg = CFA + offset */
REG_REGISTER, /* reg = other_reg */
+ /* expressions rules */
+ REG_REGISTER_OFFSET_DEREF, /* reg = *(other_reg + offset) */
};
enum eh_frame_reg_index {
diff --git a/kernel/unwind/eh_frame.c b/kernel/unwind/eh_frame.c
index 0a81ba1a0377..d1656f5d40f1 100644
--- a/kernel/unwind/eh_frame.c
+++ b/kernel/unwind/eh_frame.c
@@ -1098,18 +1098,33 @@ static __always_inline int __find_frame_row(struct eh_frame_section *sec,
return ret;
/* Convert CFA rule */
- if (ctx.state.cfa_rule != CFA_REG_OFFSET)
+ switch (ctx.state.cfa_rule) {
+ case CFA_REG_OFFSET:
+ if (ctx.state.cfa_regnum == EH_FRAME_REG_SP)
+ frame->cfa.rule = UNWIND_USER_CFA_RULE_SP_OFFSET;
+ else if (ctx.state.cfa_regnum == EH_FRAME_REG_FP)
+ frame->cfa.rule = UNWIND_USER_CFA_RULE_FP_OFFSET;
+ else {
+ if (ctx.state.cfa_regnum > UINT_MAX)
+ return -EINVAL;
+ frame->cfa.rule = UNWIND_USER_CFA_RULE_REG_OFFSET;
+ frame->cfa.regnum = ctx.state.cfa_regnum;
+ }
+ break;
+ case CFA_REG_OFFSET_DEREF:
+ if (ctx.state.cfa_regnum == EH_FRAME_REG_SP)
+ frame->cfa.rule = UNWIND_USER_CFA_RULE_SP_OFFSET_DEREF;
+ else if (ctx.state.cfa_regnum == EH_FRAME_REG_FP)
+ frame->cfa.rule = UNWIND_USER_CFA_RULE_FP_OFFSET_DEREF;
+ else {
+ if (ctx.state.cfa_regnum > UINT_MAX)
+ return -EINVAL;
+ frame->cfa.rule = UNWIND_USER_CFA_RULE_REG_OFFSET_DEREF;
+ frame->cfa.regnum = ctx.state.cfa_regnum;
+ }
+ break;
+ default:
return -EINVAL;
-
- if (ctx.state.cfa_regnum == EH_FRAME_REG_SP)
- frame->cfa.rule = UNWIND_USER_CFA_RULE_SP_OFFSET;
- else if (ctx.state.cfa_regnum == EH_FRAME_REG_FP)
- frame->cfa.rule = UNWIND_USER_CFA_RULE_FP_OFFSET;
- else {
- if (ctx.state.cfa_regnum > UINT_MAX)
- return -EINVAL;
- frame->cfa.rule = UNWIND_USER_CFA_RULE_REG_OFFSET;
- frame->cfa.regnum = ctx.state.cfa_regnum;
}
if (ctx.state.cfa_offset < INT_MIN ||
@@ -1150,6 +1165,16 @@ static __always_inline int __find_frame_row(struct eh_frame_section *sec,
frame->ra.regnum = ctx.state.reg_regnum[RA_IDX];
frame->ra.offset = 0;
break;
+ case REG_REGISTER_OFFSET_DEREF:
+ if (ctx.state.reg_regnum[RA_IDX] > UINT_MAX)
+ return -EINVAL;
+ if (ctx.state.reg_offset[RA_IDX] < INT_MIN ||
+ ctx.state.reg_offset[RA_IDX] > INT_MAX)
+ return -EOPNOTSUPP;
+ frame->ra.rule = UNWIND_USER_RULE_REG_OFFSET_DEREF;
+ frame->ra.regnum = ctx.state.reg_regnum[RA_IDX];
+ frame->ra.offset = ctx.state.reg_offset[RA_IDX];
+ break;
default:
return -EINVAL;
}
@@ -1184,6 +1209,16 @@ static __always_inline int __find_frame_row(struct eh_frame_section *sec,
frame->fp.regnum = ctx.state.reg_regnum[FP_IDX];
frame->fp.offset = 0;
break;
+ case REG_REGISTER_OFFSET_DEREF:
+ if (ctx.state.reg_regnum[FP_IDX] > UINT_MAX)
+ return -EINVAL;
+ if (ctx.state.reg_offset[FP_IDX] < INT_MIN ||
+ ctx.state.reg_offset[FP_IDX] > INT_MAX)
+ return -EOPNOTSUPP;
+ frame->fp.rule = UNWIND_USER_RULE_REG_OFFSET_DEREF;
+ frame->fp.regnum = ctx.state.reg_regnum[FP_IDX];
+ frame->fp.offset = ctx.state.reg_offset[FP_IDX];
+ break;
default:
return -EINVAL;
}
--
2.53.0
next prev parent reply other threads:[~2026-08-21 19:53 UTC|newest]
Thread overview: 25+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-08-21 19:52 [RFC PATCH v2 00/24] unwind_user: Implement .eh_frame handling Jens Remus
2026-08-21 19:52 ` [RFC PATCH v2 01/24] unwind_user: Add generic and arch-specific headers to MAINTAINERS Jens Remus
2026-08-21 19:52 ` [RFC PATCH v2 02/24] unwind_user: Stop when reaching an outermost frame Jens Remus
2026-08-21 19:52 ` [RFC PATCH v2 03/24] unwind_user: Enable archs that pass RA in a register Jens Remus
2026-08-21 19:52 ` [RFC PATCH v2 04/24] unwind_user: Flexible FP/RA recovery rules Jens Remus
2026-08-21 19:52 ` [RFC PATCH v2 05/24] unwind_user: Flexible CFA " Jens Remus
2026-08-21 19:52 ` [RFC PATCH v2 06/24] unwind_user: Enable archs that define CFA = SP_callsite + offset Jens Remus
2026-08-21 19:52 ` [RFC PATCH v2 07/24] unwind_user/eh_frame: Add support for reading .eh_frame_hdr section Jens Remus
2026-08-21 19:52 ` [RFC PATCH v2 08/24] unwind_user/eh_frame: Store .eh_frame_hdr section data in per-mm maple tree Jens Remus
2026-08-21 19:52 ` [RFC PATCH v2 09/24] unwind_user/eh_frame: Add support for reading .eh_frame section Jens Remus
2026-08-21 19:52 ` [RFC PATCH v2 10/24] unwind_user/eh_frame: Detect .eh_frame_hdr sections in executables Jens Remus
2026-08-21 19:52 ` [RFC PATCH v2 11/24] unwind_user/eh_frame: Wire up unwind_user to eh_frame Jens Remus
2026-08-21 19:52 ` [RFC PATCH v2 12/24] unwind_user/eh_frame: Remove .eh_frame[_hdr] section on detected corruption Jens Remus
2026-08-21 19:52 ` [RFC PATCH v2 13/24] unwind_user/eh_frame: Show file name in debug output Jens Remus
2026-08-21 19:52 ` [RFC PATCH v2 14/24] unwind_user/eh_frame: Add .eh_frame[_hdr] validation option Jens Remus
2026-08-21 19:52 ` [RFC PATCH v2 15/24] unwind_user/eh_frame: Duplicate registered .eh_frame[_hdr] section data on clone/fork Jens Remus
2026-08-21 19:52 ` [RFC PATCH v2 16/24] unwind_user/eh_frame: Ignore DW_CFA_GNU_args_size Jens Remus
2026-08-21 19:52 ` [RFC PATCH v2 17/24] unwind_user/eh_frame: Add support for DWARF expressions Jens Remus
2026-08-21 19:52 ` [RFC PATCH v2 18/24] x86/uaccess: Add unsafe_copy_from_user() implementation Jens Remus
2026-08-21 19:52 ` [RFC PATCH v2 19/24] unwind_user/eh_frame/x86: Enable eh_frame unwinding on x86 Jens Remus
2026-08-21 19:52 ` [RFC PATCH v2 20/24] unwind_user/eh_frame/x86: Handle PLT expressions Jens Remus
2026-08-21 19:52 ` Jens Remus [this message]
2026-08-21 19:52 ` [RFC PATCH v2 22/24] s390/ptrace: Provide frame_pointer() Jens Remus
2026-08-21 19:52 ` [RFC PATCH v2 23/24] unwind_user/eh_frame/s390: Enable eh_frame unwinding on s390 Jens Remus
2026-08-21 19:52 ` [RFC PATCH v2 24/24] unwind_user/eh_frame: Add prctl() interface for (un)registering .eh_frame_hdr sections Jens Remus
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260821195259.2688377-22-jremus@linux.ibm.com \
--to=jremus@linux.ibm.com \
--cc=agordeev@linux.ibm.com \
--cc=andrii@kernel.org \
--cc=bp@alien8.de \
--cc=dave.hansen@linux.intel.com \
--cc=gor@linux.ibm.com \
--cc=hca@linux.ibm.com \
--cc=hpa@zytor.com \
--cc=i@maskray.me \
--cc=ibhagatgnu@gmail.com \
--cc=iii@linux.ibm.com \
--cc=jpoimboe@kernel.org \
--cc=kees@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-s390@vger.kernel.org \
--cc=linux-trace-kernel@vger.kernel.org \
--cc=mathieu.desnoyers@efficios.com \
--cc=mingo@redhat.com \
--cc=namhyung@kernel.org \
--cc=peterz@infradead.org \
--cc=rostedt@kernel.org \
--cc=sam@gentoo.org \
--cc=tglx@kernel.org \
--cc=x86@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox