1 // SPDX-License-Identifier: BSD-2-Clause 2 /* 3 * Copyright 2015 Linaro Limited 4 * Copyright 2013-2014 Andrew Turner. 5 * Copyright 2013-2014 Ian Lepore. 6 * Copyright 2013-2014 Rui Paulo. 7 * Copyright 2013 Eitan Adler. 8 * All rights reserved. 9 * 10 * Redistribution and use in source and binary forms, with or without 11 * modification, are permitted provided that the following conditions are 12 * met: 13 * 14 * 1. Redistributions of source code must retain the above copyright 15 * notice, this list of conditions and the following disclaimer. 16 * 2. Redistributions in binary form must reproduce the above copyright 17 * notice, this list of conditions and the following disclaimer in the 18 * documentation and/or other materials provided with the distribution. 19 * 20 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 21 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 22 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 23 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE 24 * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 25 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 26 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR 27 * BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, 28 * WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR 29 * OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF 30 * ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 31 */ 32 33 #include <arm.h> 34 #include <kernel/linker.h> 35 #include <kernel/misc.h> 36 #include <kernel/tee_misc.h> 37 #include <kernel/unwind.h> 38 #include <string.h> 39 #include <tee_api_types.h> 40 #include <tee/tee_svc.h> 41 #include <trace.h> 42 43 /* The register names */ 44 #define FP 11 45 #define SP 13 46 #define LR 14 47 #define PC 15 48 49 /* 50 * Definitions for the instruction interpreter. 51 * 52 * The ARM EABI specifies how to perform the frame unwinding in the 53 * Exception Handling ABI for the ARM Architecture document. To perform 54 * the unwind we need to know the initial frame pointer, stack pointer, 55 * link register and program counter. We then find the entry within the 56 * index table that points to the function the program counter is within. 57 * This gives us either a list of three instructions to process, a 31-bit 58 * relative offset to a table of instructions, or a value telling us 59 * we can't unwind any further. 60 * 61 * When we have the instructions to process we need to decode them 62 * following table 4 in section 9.3. This describes a collection of bit 63 * patterns to encode that steps to take to update the stack pointer and 64 * link register to the correct values at the start of the function. 65 */ 66 67 /* A special case when we are unable to unwind past this function */ 68 #define EXIDX_CANTUNWIND 1 69 70 /* 71 * Entry types. 72 * These are the only entry types that have been seen in the kernel. 73 */ 74 #define ENTRY_MASK 0xff000000 75 #define ENTRY_ARM_SU16 0x80000000 76 #define ENTRY_ARM_LU16 0x81000000 77 78 /* Instruction masks. */ 79 #define INSN_VSP_MASK 0xc0 80 #define INSN_VSP_SIZE_MASK 0x3f 81 #define INSN_STD_MASK 0xf0 82 #define INSN_STD_DATA_MASK 0x0f 83 #define INSN_POP_TYPE_MASK 0x08 84 #define INSN_POP_COUNT_MASK 0x07 85 #define INSN_VSP_LARGE_INC_MASK 0xff 86 87 /* Instruction definitions */ 88 #define INSN_VSP_INC 0x00 89 #define INSN_VSP_DEC 0x40 90 #define INSN_POP_MASKED 0x80 91 #define INSN_VSP_REG 0x90 92 #define INSN_POP_COUNT 0xa0 93 #define INSN_FINISH 0xb0 94 #define INSN_POP_REGS 0xb1 95 #define INSN_VSP_LARGE_INC 0xb2 96 97 /* An item in the exception index table */ 98 struct unwind_idx { 99 uint32_t offset; 100 uint32_t insn; 101 }; 102 103 static bool copy_in(void *dst, const void *src, size_t n, bool kernel_data) 104 { 105 if (!kernel_data) 106 return !tee_svc_copy_from_user(dst, src, n); 107 108 memcpy(dst, src, n); 109 return true; 110 } 111 112 /* Expand a 31-bit signed value to a 32-bit signed value */ 113 static int32_t expand_prel31(uint32_t prel31) 114 { 115 return prel31 | SHIFT_U32(prel31 & BIT32(30), 1); 116 } 117 118 /* 119 * Perform a binary search of the index table to find the function 120 * with the largest address that doesn't exceed addr. 121 */ 122 static struct unwind_idx *find_index(uint32_t addr, vaddr_t exidx, 123 size_t exidx_sz) 124 { 125 vaddr_t idx_start, idx_end; 126 unsigned int min, mid, max; 127 struct unwind_idx *start; 128 struct unwind_idx *item; 129 int32_t prel31_addr; 130 vaddr_t func_addr; 131 132 start = (struct unwind_idx *)exidx; 133 idx_start = exidx; 134 idx_end = exidx + exidx_sz; 135 136 min = 0; 137 max = (idx_end - idx_start) / sizeof(struct unwind_idx); 138 139 while (min != max) { 140 mid = min + (max - min + 1) / 2; 141 142 item = &start[mid]; 143 144 prel31_addr = expand_prel31(item->offset); 145 func_addr = (vaddr_t)&item->offset + prel31_addr; 146 147 if (func_addr <= addr) { 148 min = mid; 149 } else { 150 max = mid - 1; 151 } 152 } 153 154 return &start[min]; 155 } 156 157 /* Reads the next byte from the instruction list */ 158 static bool unwind_exec_read_byte(struct unwind_state_arm32 *state, 159 uint32_t *ret_insn, bool kernel_stack) 160 { 161 uint32_t insn; 162 163 if (!copy_in(&insn, (void *)state->insn, sizeof(insn), kernel_stack)) 164 return false; 165 166 /* Read the unwind instruction */ 167 *ret_insn = (insn >> (state->byte * 8)) & 0xff; 168 169 /* Update the location of the next instruction */ 170 if (state->byte == 0) { 171 state->byte = 3; 172 state->insn += sizeof(uint32_t); 173 state->entries--; 174 } else 175 state->byte--; 176 177 return true; 178 } 179 180 static bool pop_vsp(uint32_t *reg, vaddr_t *vsp, bool kernel_stack, 181 vaddr_t stack, size_t stack_size) 182 { 183 if (!core_is_buffer_inside(*vsp, sizeof(*reg), stack, stack_size)) { 184 DMSG("vsp out of bounds %#" PRIxVA, *vsp); 185 return false; 186 } 187 if (!copy_in(reg, (void *)*vsp, sizeof(*reg), kernel_stack)) 188 return false; 189 (*vsp) += sizeof(*reg); 190 return true; 191 } 192 193 /* Executes the next instruction on the list */ 194 static bool unwind_exec_insn(struct unwind_state_arm32 *state, 195 bool kernel_stack, vaddr_t stack, 196 size_t stack_size) 197 { 198 uint32_t insn; 199 vaddr_t vsp = state->registers[SP]; 200 int update_vsp = 0; 201 202 /* Read the next instruction */ 203 if (!unwind_exec_read_byte(state, &insn, kernel_stack)) 204 return false; 205 206 if ((insn & INSN_VSP_MASK) == INSN_VSP_INC) { 207 state->registers[SP] += ((insn & INSN_VSP_SIZE_MASK) << 2) + 4; 208 209 } else if ((insn & INSN_VSP_MASK) == INSN_VSP_DEC) { 210 state->registers[SP] -= ((insn & INSN_VSP_SIZE_MASK) << 2) + 4; 211 212 } else if ((insn & INSN_STD_MASK) == INSN_POP_MASKED) { 213 uint32_t mask; 214 unsigned int reg; 215 216 /* Load the mask */ 217 if (!unwind_exec_read_byte(state, &mask, kernel_stack)) 218 return false; 219 mask |= (insn & INSN_STD_DATA_MASK) << 8; 220 221 /* We have a refuse to unwind instruction */ 222 if (mask == 0) 223 return false; 224 225 /* Update SP */ 226 update_vsp = 1; 227 228 /* Load the registers */ 229 for (reg = 4; mask && reg < 16; mask >>= 1, reg++) { 230 if (mask & 1) { 231 if (!pop_vsp(&state->registers[reg], &vsp, 232 kernel_stack, stack, stack_size)) 233 return false; 234 state->update_mask |= 1 << reg; 235 236 /* If we have updated SP kep its value */ 237 if (reg == SP) 238 update_vsp = 0; 239 } 240 } 241 242 } else if ((insn & INSN_STD_MASK) == INSN_VSP_REG && 243 ((insn & INSN_STD_DATA_MASK) != 13) && 244 ((insn & INSN_STD_DATA_MASK) != 15)) { 245 /* sp = register */ 246 state->registers[SP] = 247 state->registers[insn & INSN_STD_DATA_MASK]; 248 249 } else if ((insn & INSN_STD_MASK) == INSN_POP_COUNT) { 250 unsigned int count, reg; 251 252 /* Read how many registers to load */ 253 count = insn & INSN_POP_COUNT_MASK; 254 255 /* Update sp */ 256 update_vsp = 1; 257 258 /* Pop the registers */ 259 for (reg = 4; reg <= 4 + count; reg++) { 260 if (!pop_vsp(&state->registers[reg], &vsp, 261 kernel_stack, stack, stack_size)) 262 return false; 263 state->update_mask |= 1 << reg; 264 } 265 266 /* Check if we are in the pop r14 version */ 267 if ((insn & INSN_POP_TYPE_MASK) != 0) { 268 if (!pop_vsp(&state->registers[14], &vsp, kernel_stack, 269 stack, stack_size)) 270 return false; 271 } 272 273 } else if (insn == INSN_FINISH) { 274 /* Stop processing */ 275 state->entries = 0; 276 277 } else if (insn == INSN_POP_REGS) { 278 uint32_t mask; 279 unsigned int reg; 280 281 if (!unwind_exec_read_byte(state, &mask, kernel_stack)) 282 return false; 283 if (mask == 0 || (mask & 0xf0) != 0) 284 return false; 285 286 /* Update SP */ 287 update_vsp = 1; 288 289 /* Load the registers */ 290 for (reg = 0; mask && reg < 4; mask >>= 1, reg++) { 291 if (mask & 1) { 292 if (!pop_vsp(&state->registers[reg], &vsp, 293 kernel_stack, stack, stack_size)) 294 return false; 295 state->update_mask |= 1 << reg; 296 } 297 } 298 299 } else if ((insn & INSN_VSP_LARGE_INC_MASK) == INSN_VSP_LARGE_INC) { 300 uint32_t uleb128; 301 302 /* Read the increment value */ 303 if (!unwind_exec_read_byte(state, &uleb128, kernel_stack)) 304 return false; 305 306 state->registers[SP] += 0x204 + (uleb128 << 2); 307 308 } else { 309 /* We hit a new instruction that needs to be implemented */ 310 DMSG("Unhandled instruction %.2x\n", insn); 311 return false; 312 } 313 314 if (update_vsp) 315 state->registers[SP] = vsp; 316 317 return true; 318 } 319 320 /* Performs the unwind of a function */ 321 static bool unwind_tab(struct unwind_state_arm32 *state, bool kernel_stack, 322 vaddr_t stack, size_t stack_size) 323 { 324 uint32_t entry; 325 uint32_t insn; 326 327 /* Set PC to a known value */ 328 state->registers[PC] = 0; 329 330 if (!copy_in(&insn, (void *)state->insn, sizeof(insn), kernel_stack)) { 331 DMSG("Bad insn addr %p", (void *)state->insn); 332 return true; 333 } 334 335 /* Read the personality */ 336 entry = insn & ENTRY_MASK; 337 338 if (entry == ENTRY_ARM_SU16) { 339 state->byte = 2; 340 state->entries = 1; 341 } else if (entry == ENTRY_ARM_LU16) { 342 state->byte = 1; 343 state->entries = ((insn >> 16) & 0xFF) + 1; 344 } else { 345 DMSG("Unknown entry: %x\n", entry); 346 return true; 347 } 348 349 while (state->entries > 0) { 350 if (!unwind_exec_insn(state, kernel_stack, stack, stack_size)) 351 return true; 352 } 353 354 /* 355 * The program counter was not updated, load it from the link register. 356 */ 357 if (state->registers[PC] == 0) { 358 state->registers[PC] = state->registers[LR]; 359 360 /* 361 * If the program counter changed, flag it in the update mask. 362 */ 363 if (state->start_pc != state->registers[PC]) 364 state->update_mask |= 1 << PC; 365 } 366 367 return false; 368 } 369 370 bool unwind_stack_arm32(struct unwind_state_arm32 *state, vaddr_t exidx, 371 size_t exidx_sz, bool kernel_stack, vaddr_t stack, 372 size_t stack_size) 373 { 374 struct unwind_idx *index; 375 bool finished; 376 377 if (!exidx_sz) 378 return false; 379 380 /* Reset the mask of updated registers */ 381 state->update_mask = 0; 382 383 /* The pc value is correct and will be overwritten, save it */ 384 state->start_pc = state->registers[PC]; 385 386 /* Find the item to run */ 387 index = find_index(state->start_pc, exidx, exidx_sz); 388 389 finished = false; 390 if (index->insn != EXIDX_CANTUNWIND) { 391 if (index->insn & (1U << 31)) { 392 /* The data is within the instruction */ 393 state->insn = (vaddr_t)&index->insn; 394 } else { 395 /* A prel31 offset to the unwind table */ 396 state->insn = (vaddr_t)&index->insn + 397 expand_prel31(index->insn); 398 } 399 400 /* Run the unwind function */ 401 finished = unwind_tab(state, kernel_stack, stack, stack_size); 402 } 403 404 /* This is the top of the stack, finish */ 405 if (index->insn == EXIDX_CANTUNWIND) 406 finished = true; 407 408 return !finished; 409 } 410 411 static uint32_t offset_prel31(uint32_t addr, int32_t offset) 412 { 413 return (addr + offset) & 0x7FFFFFFFUL; 414 } 415 416 TEE_Result relocate_exidx(void *exidx, size_t exidx_sz, int32_t offset) 417 { 418 size_t num_items = exidx_sz / sizeof(struct unwind_idx); 419 struct unwind_idx *start = (struct unwind_idx *)exidx; 420 size_t n; 421 422 for (n = 0; n < num_items; n++) { 423 struct unwind_idx *item = &start[n]; 424 425 if (item->offset & BIT32(31)) 426 return TEE_ERROR_BAD_FORMAT; 427 428 /* Offset to the start of the function has to be adjusted */ 429 item->offset = offset_prel31(item->offset, offset); 430 431 if (item->insn == EXIDX_CANTUNWIND) 432 continue; 433 if (item->insn & BIT32(31)) { 434 /* insn is a table entry itself */ 435 continue; 436 } 437 /* 438 * insn is an offset to an entry in .ARM.extab so it has to be 439 * adjusted 440 */ 441 item->insn = offset_prel31(item->insn, offset); 442 } 443 return TEE_SUCCESS; 444 } 445 446 #if defined(CFG_UNWIND) && (TRACE_LEVEL > 0) 447 448 void print_stack_arm32(int level, struct unwind_state_arm32 *state, 449 vaddr_t exidx, size_t exidx_sz, bool kernel_stack, 450 vaddr_t stack, size_t stack_size) 451 { 452 trace_printf_helper_raw(level, true, "Call stack:"); 453 do { 454 trace_printf_helper_raw(level, true, " 0x%08" PRIx32, 455 state->registers[PC]); 456 } while (unwind_stack_arm32(state, exidx, exidx_sz, 457 kernel_stack, stack, stack_size)); 458 } 459 460 #endif 461 462 #if defined(CFG_UNWIND) && defined(ARM32) && (TRACE_LEVEL > 0) 463 464 void print_kernel_stack(int level) 465 { 466 struct unwind_state_arm32 state; 467 uaddr_t exidx = (vaddr_t)__exidx_start; 468 size_t exidx_sz = (vaddr_t)__exidx_end - (vaddr_t)__exidx_start; 469 vaddr_t stack = thread_stack_start(); 470 size_t stack_size = thread_stack_size(); 471 472 memset(&state, 0, sizeof(state)); 473 /* r7: Thumb-style frame pointer */ 474 state.registers[7] = read_r7(); 475 /* r11: ARM-style frame pointer */ 476 state.registers[FP] = read_fp(); 477 state.registers[SP] = read_sp(); 478 state.registers[LR] = read_lr(); 479 state.registers[PC] = (uint32_t)print_kernel_stack; 480 481 print_stack_arm32(level, &state, exidx, exidx_sz, 482 true /*kernel_stack*/, stack, stack_size); 483 } 484 485 #endif 486