1 /* 2 * Copyright (c) 2018-2025, Arm Limited and Contributors. All rights reserved. 3 * 4 * SPDX-License-Identifier: BSD-3-Clause 5 */ 6 7 #include <assert.h> 8 #include <stdbool.h> 9 #include <stdint.h> 10 11 #include <arch_features.h> 12 #include <arch_helpers.h> 13 #include <common/debug.h> 14 #include <drivers/console.h> 15 16 /* Maximum number of entries in the backtrace to display */ 17 #define UNWIND_LIMIT 20U 18 19 /* 20 * If -fno-omit-frame-pointer is used: 21 * 22 * - AArch64: The AAPCS defines the format of the frame records and mandates the 23 * usage of r29 as frame pointer. 24 * 25 * - AArch32: The format of the frame records is not defined in the AAPCS. 26 * However, at least GCC and Clang use the same format. When they are forced 27 * to only generate A32 code (with -marm), they use r11 as frame pointer and a 28 * similar format as in AArch64. If interworking with T32 is enabled, the 29 * frame pointer is r7 and the format is different. This is not supported by 30 * this implementation of backtrace, so it is needed to use -marm. 31 */ 32 33 /* Frame records form a linked list in the stack */ 34 struct frame_record { 35 /* Previous frame record in the list */ 36 struct frame_record *parent; 37 /* Return address of the function at this level */ 38 uintptr_t return_addr; 39 }; 40 41 static inline uintptr_t extract_address(uintptr_t address) 42 { 43 uintptr_t ret = address; 44 45 /* 46 * When pointer authentication is enabled, the LR value saved on the 47 * stack contains a PAC. It must be stripped to retrieve the return 48 * address. 49 */ 50 if (is_feat_pauth_supported()) { 51 ret = xpaci(address); 52 } 53 54 return ret; 55 } 56 57 /* 58 * Returns true if the address points to a virtual address that can be read at 59 * the current EL, false otherwise. 60 */ 61 #ifdef __aarch64__ 62 static bool is_address_readable(uintptr_t address) 63 { 64 unsigned int el = get_current_el(); 65 uintptr_t addr = extract_address(address); 66 67 if (el == 3U) { 68 ats1e3r(addr); 69 } else if (el == 2U) { 70 ats1e2r(addr); 71 } else { 72 AT(ats1e1r, addr); 73 } 74 75 isb(); 76 77 /* If PAR.F == 1 the address translation was aborted. */ 78 if ((read_par_el1() & PAR_F_MASK) != 0U) 79 return false; 80 81 return true; 82 } 83 #else /* !__aarch64__ */ 84 static bool is_address_readable(uintptr_t addr) 85 { 86 unsigned int el = get_current_el(); 87 88 if (el == 3U) { 89 write_ats1cpr(addr); 90 } else if (el == 2U) { 91 write_ats1hr(addr); 92 } else { 93 write_ats1cpr(addr); 94 } 95 96 isb(); 97 98 /* If PAR.F == 1 the address translation was aborted. */ 99 if ((read64_par() & PAR_F_MASK) != 0U) 100 return false; 101 102 return true; 103 } 104 #endif /* __aarch64__ */ 105 106 /* 107 * Returns true if all the bytes in a given object are in mapped memory and an 108 * LDR using this pointer would succeed, false otherwise. 109 */ 110 static bool is_valid_object(uintptr_t addr, size_t size) 111 { 112 assert(size > 0U); 113 114 if (addr == 0U) 115 return false; 116 117 /* Detect overflows */ 118 if ((addr + size) < addr) 119 return false; 120 121 /* A pointer not aligned properly could trigger an alignment fault. */ 122 if ((addr & (sizeof(uintptr_t) - 1U)) != 0U) 123 return false; 124 125 /* Check that all the object is readable */ 126 for (size_t i = 0; i < size; i++) { 127 if (!is_address_readable(addr + i)) 128 return false; 129 } 130 131 return true; 132 } 133 134 /* 135 * Returns true if the specified address is correctly aligned and points to a 136 * valid memory region. 137 */ 138 static bool is_valid_jump_address(uintptr_t addr) 139 { 140 if (addr == 0U) 141 return false; 142 143 /* Check alignment. Both A64 and A32 use 32-bit opcodes */ 144 if ((addr & (sizeof(uint32_t) - 1U)) != 0U) 145 return false; 146 147 if (!is_address_readable(addr)) 148 return false; 149 150 return true; 151 } 152 153 /* 154 * Returns true if the pointer points at a valid frame record, false otherwise. 155 */ 156 static bool is_valid_frame_record(struct frame_record *fr) 157 { 158 return is_valid_object((uintptr_t)fr, sizeof(struct frame_record)); 159 } 160 161 /* 162 * Adjust the frame-pointer-register value by 4 bytes on AArch32 to have the 163 * same layout as AArch64. 164 */ 165 static struct frame_record *adjust_frame_record(struct frame_record *fr) 166 { 167 #ifdef __aarch64__ 168 return fr; 169 #else 170 return (struct frame_record *)((uintptr_t)fr - 4U); 171 #endif 172 } 173 174 static void unwind_stack(struct frame_record *fr, uintptr_t current_pc, 175 uintptr_t link_register) 176 { 177 uintptr_t call_site; 178 static const char *backtrace_str = "%u: %s: 0x%lx\n"; 179 const char *el_str = get_el_str(get_current_el()); 180 181 if (!is_valid_frame_record(fr)) { 182 printf("ERROR: Corrupted frame pointer (frame record address = %p)\n", 183 fr); 184 return; 185 } 186 187 call_site = extract_address(fr->return_addr); 188 if (call_site != link_register) { 189 printf("ERROR: Corrupted stack (frame record address = %p)\n", 190 fr); 191 return; 192 } 193 194 /* The level 0 of the backtrace is the current backtrace function */ 195 printf(backtrace_str, 0U, el_str, current_pc); 196 197 /* 198 * The last frame record pointer in the linked list at the beginning of 199 * the stack should be NULL unless stack is corrupted. 200 */ 201 for (unsigned int i = 1U; i < UNWIND_LIMIT; i++) { 202 /* If an invalid frame record is found, exit. */ 203 if (!is_valid_frame_record(fr)) 204 return; 205 /* 206 * A32 and A64 are fixed length so the address from where the 207 * call was made is the instruction before the return address, 208 * which is always 4 bytes before it. 209 */ 210 211 call_site = extract_address(fr->return_addr) - 4U; 212 213 /* 214 * If the address is invalid it means that the frame record is 215 * probably corrupted. 216 */ 217 if (!is_valid_jump_address(call_site)) 218 return; 219 220 printf(backtrace_str, i, el_str, call_site); 221 222 fr = adjust_frame_record(fr->parent); 223 } 224 225 printf("ERROR: Max backtrace depth reached\n"); 226 } 227 228 /* 229 * Display a backtrace. The cookie string parameter is displayed along the 230 * trace to help filter the log messages. 231 * 232 * Many things can prevent displaying the expected backtrace. For example, 233 * compiler optimizations can use a branch instead of branch with link when it 234 * detects a tail call. The backtrace level for this caller will not be 235 * displayed, as it does not appear in the call stack anymore. Also, assembly 236 * functions will not be displayed unless they setup AAPCS compliant frame 237 * records on AArch64 and compliant with GCC-specific frame record format on 238 * AArch32. 239 * 240 * Usage of the trace: addr2line can be used to map the addresses to function 241 * and source code location when given the ELF file compiled with debug 242 * information. The "-i" flag is highly recommended to improve display of 243 * inlined function. The *.dump files generated when building each image can 244 * also be used. 245 * 246 * WARNING: In case of corrupted stack, this function could display security 247 * sensitive information past the beginning of the stack so it must not be used 248 * in production build. This function is only compiled in when ENABLE_BACKTRACE 249 * is set to 1. 250 */ 251 void backtrace(const char *cookie) 252 { 253 uintptr_t return_address = (uintptr_t)__builtin_return_address(0U); 254 struct frame_record *fr = __builtin_frame_address(0U); 255 256 /* Printing the backtrace may crash the system, flush before starting */ 257 console_flush(); 258 259 fr = adjust_frame_record(fr); 260 261 printf("BACKTRACE: START: %s\n", cookie); 262 263 unwind_stack(fr, (uintptr_t)&backtrace, return_address); 264 265 printf("BACKTRACE: END: %s\n", cookie); 266 } 267