1 /* 2 * Copyright (c) 2018-2022, ARM Limited and Contributors. All rights reserved. 3 * 4 * SPDX-License-Identifier: BSD-3-Clause 5 */ 6 7 #include <assert.h> 8 #include <stdbool.h> 9 #include <stdint.h> 10 11 #include <arch_helpers.h> 12 #include <common/debug.h> 13 #include <drivers/console.h> 14 15 /* Maximum number of entries in the backtrace to display */ 16 #define UNWIND_LIMIT 20U 17 18 /* 19 * If -fno-omit-frame-pointer is used: 20 * 21 * - AArch64: The AAPCS defines the format of the frame records and mandates the 22 * usage of r29 as frame pointer. 23 * 24 * - AArch32: The format of the frame records is not defined in the AAPCS. 25 * However, at least GCC and Clang use the same format. When they are forced 26 * to only generate A32 code (with -marm), they use r11 as frame pointer and a 27 * similar format as in AArch64. If interworking with T32 is enabled, the 28 * frame pointer is r7 and the format is different. This is not supported by 29 * this implementation of backtrace, so it is needed to use -marm. 30 */ 31 32 /* Frame records form a linked list in the stack */ 33 struct frame_record { 34 /* Previous frame record in the list */ 35 struct frame_record *parent; 36 /* Return address of the function at this level */ 37 uintptr_t return_addr; 38 }; 39 40 static inline uintptr_t extract_address(uintptr_t address) 41 { 42 uintptr_t ret = address; 43 44 #if ENABLE_PAUTH 45 /* 46 * When pointer authentication is enabled, the LR value saved on the 47 * stack contains a PAC. It must be stripped to retrieve the return 48 * address. 49 */ 50 51 xpaci(ret); 52 #endif 53 54 return ret; 55 } 56 57 const char *get_el_str(unsigned int el) 58 { 59 if (el == 3U) { 60 return "EL3"; 61 } else if (el == 2U) { 62 return "EL2"; 63 } else { 64 return "S-EL1"; 65 } 66 } 67 68 /* 69 * Returns true if the address points to a virtual address that can be read at 70 * the current EL, false otherwise. 71 */ 72 #ifdef __aarch64__ 73 static bool is_address_readable(uintptr_t address) 74 { 75 unsigned int el = get_current_el(); 76 uintptr_t addr = extract_address(address); 77 78 if (el == 3U) { 79 ats1e3r(addr); 80 } else if (el == 2U) { 81 ats1e2r(addr); 82 } else { 83 AT(ats1e1r, addr); 84 } 85 86 isb(); 87 88 /* If PAR.F == 1 the address translation was aborted. */ 89 if ((read_par_el1() & PAR_F_MASK) != 0U) 90 return false; 91 92 return true; 93 } 94 #else /* !__aarch64__ */ 95 static bool is_address_readable(uintptr_t addr) 96 { 97 unsigned int el = get_current_el(); 98 99 if (el == 3U) { 100 write_ats1cpr(addr); 101 } else if (el == 2U) { 102 write_ats1hr(addr); 103 } else { 104 write_ats1cpr(addr); 105 } 106 107 isb(); 108 109 /* If PAR.F == 1 the address translation was aborted. */ 110 if ((read64_par() & PAR_F_MASK) != 0U) 111 return false; 112 113 return true; 114 } 115 #endif /* __aarch64__ */ 116 117 /* 118 * Returns true if all the bytes in a given object are in mapped memory and an 119 * LDR using this pointer would succeed, false otherwise. 120 */ 121 static bool is_valid_object(uintptr_t addr, size_t size) 122 { 123 assert(size > 0U); 124 125 if (addr == 0U) 126 return false; 127 128 /* Detect overflows */ 129 if ((addr + size) < addr) 130 return false; 131 132 /* A pointer not aligned properly could trigger an alignment fault. */ 133 if ((addr & (sizeof(uintptr_t) - 1U)) != 0U) 134 return false; 135 136 /* Check that all the object is readable */ 137 for (size_t i = 0; i < size; i++) { 138 if (!is_address_readable(addr + i)) 139 return false; 140 } 141 142 return true; 143 } 144 145 /* 146 * Returns true if the specified address is correctly aligned and points to a 147 * valid memory region. 148 */ 149 static bool is_valid_jump_address(uintptr_t addr) 150 { 151 if (addr == 0U) 152 return false; 153 154 /* Check alignment. Both A64 and A32 use 32-bit opcodes */ 155 if ((addr & (sizeof(uint32_t) - 1U)) != 0U) 156 return false; 157 158 if (!is_address_readable(addr)) 159 return false; 160 161 return true; 162 } 163 164 /* 165 * Returns true if the pointer points at a valid frame record, false otherwise. 166 */ 167 static bool is_valid_frame_record(struct frame_record *fr) 168 { 169 return is_valid_object((uintptr_t)fr, sizeof(struct frame_record)); 170 } 171 172 /* 173 * Adjust the frame-pointer-register value by 4 bytes on AArch32 to have the 174 * same layout as AArch64. 175 */ 176 static struct frame_record *adjust_frame_record(struct frame_record *fr) 177 { 178 #ifdef __aarch64__ 179 return fr; 180 #else 181 return (struct frame_record *)((uintptr_t)fr - 4U); 182 #endif 183 } 184 185 static void unwind_stack(struct frame_record *fr, uintptr_t current_pc, 186 uintptr_t link_register) 187 { 188 uintptr_t call_site; 189 static const char *backtrace_str = "%u: %s: 0x%lx\n"; 190 const char *el_str = get_el_str(get_current_el()); 191 192 if (!is_valid_frame_record(fr)) { 193 printf("ERROR: Corrupted frame pointer (frame record address = %p)\n", 194 fr); 195 return; 196 } 197 198 call_site = extract_address(fr->return_addr); 199 if (call_site != link_register) { 200 printf("ERROR: Corrupted stack (frame record address = %p)\n", 201 fr); 202 return; 203 } 204 205 /* The level 0 of the backtrace is the current backtrace function */ 206 printf(backtrace_str, 0U, el_str, current_pc); 207 208 /* 209 * The last frame record pointer in the linked list at the beginning of 210 * the stack should be NULL unless stack is corrupted. 211 */ 212 for (unsigned int i = 1U; i < UNWIND_LIMIT; i++) { 213 /* If an invalid frame record is found, exit. */ 214 if (!is_valid_frame_record(fr)) 215 return; 216 /* 217 * A32 and A64 are fixed length so the address from where the 218 * call was made is the instruction before the return address, 219 * which is always 4 bytes before it. 220 */ 221 222 call_site = extract_address(fr->return_addr) - 4U; 223 224 /* 225 * If the address is invalid it means that the frame record is 226 * probably corrupted. 227 */ 228 if (!is_valid_jump_address(call_site)) 229 return; 230 231 printf(backtrace_str, i, el_str, call_site); 232 233 fr = adjust_frame_record(fr->parent); 234 } 235 236 printf("ERROR: Max backtrace depth reached\n"); 237 } 238 239 /* 240 * Display a backtrace. The cookie string parameter is displayed along the 241 * trace to help filter the log messages. 242 * 243 * Many things can prevent displaying the expected backtrace. For example, 244 * compiler optimizations can use a branch instead of branch with link when it 245 * detects a tail call. The backtrace level for this caller will not be 246 * displayed, as it does not appear in the call stack anymore. Also, assembly 247 * functions will not be displayed unless they setup AAPCS compliant frame 248 * records on AArch64 and compliant with GCC-specific frame record format on 249 * AArch32. 250 * 251 * Usage of the trace: addr2line can be used to map the addresses to function 252 * and source code location when given the ELF file compiled with debug 253 * information. The "-i" flag is highly recommended to improve display of 254 * inlined function. The *.dump files generated when building each image can 255 * also be used. 256 * 257 * WARNING: In case of corrupted stack, this function could display security 258 * sensitive information past the beginning of the stack so it must not be used 259 * in production build. This function is only compiled in when ENABLE_BACKTRACE 260 * is set to 1. 261 */ 262 void backtrace(const char *cookie) 263 { 264 uintptr_t return_address = (uintptr_t)__builtin_return_address(0U); 265 struct frame_record *fr = __builtin_frame_address(0U); 266 267 /* Printing the backtrace may crash the system, flush before starting */ 268 console_flush(); 269 270 fr = adjust_frame_record(fr); 271 272 printf("BACKTRACE: START: %s\n", cookie); 273 274 unwind_stack(fr, (uintptr_t)&backtrace, return_address); 275 276 printf("BACKTRACE: END: %s\n", cookie); 277 } 278