1 /* 2 * Copyright (c) 2018, ARM Limited and Contributors. All rights reserved. 3 * 4 * SPDX-License-Identifier: BSD-3-Clause 5 */ 6 7 #include <arch_helpers.h> 8 #include <assert.h> 9 #include <console.h> 10 #include <debug.h> 11 #include <stdbool.h> 12 #include <stdint.h> 13 14 /* Maximum number of entries in the backtrace to display */ 15 #define UNWIND_LIMIT 20U 16 17 /* 18 * If -fno-omit-frame-pointer is used: 19 * 20 * - AArch64: The AAPCS defines the format of the frame records and mandates the 21 * usage of r29 as frame pointer. 22 * 23 * - AArch32: The format of the frame records is not defined in the AAPCS. 24 * However, at least GCC and Clang use the same format. When they are forced 25 * to only generate A32 code (with -marm), they use r11 as frame pointer and a 26 * similar format as in AArch64. If interworking with T32 is enabled, the 27 * frame pointer is r7 and the format is different. This is not supported by 28 * this implementation of backtrace, so it is needed to use -marm. 29 */ 30 31 /* Frame records form a linked list in the stack */ 32 struct frame_record { 33 /* Previous frame record in the list */ 34 struct frame_record *parent; 35 /* Return address of the function at this level */ 36 uintptr_t return_addr; 37 }; 38 39 static const char *get_el_str(unsigned int el) 40 { 41 if (el == 3U) { 42 return "EL3"; 43 } else if (el == 2U) { 44 return "EL2"; 45 } else { 46 return "S-EL1"; 47 } 48 } 49 50 /* 51 * Returns true if the address points to a virtual address that can be read at 52 * the current EL, false otherwise. 53 */ 54 #ifdef AARCH64 55 static bool is_address_readable(uintptr_t addr) 56 { 57 unsigned int el = get_current_el(); 58 59 if (el == 3U) { 60 ats1e3r(addr); 61 } else if (el == 2U) { 62 ats1e2r(addr); 63 } else { 64 ats1e1r(addr); 65 } 66 67 isb(); 68 69 /* If PAR.F == 1 the address translation was aborted. */ 70 if ((read_par_el1() & PAR_F_MASK) != 0U) 71 return false; 72 73 return true; 74 } 75 #else /* if AARCH32 */ 76 static bool is_address_readable(uintptr_t addr) 77 { 78 unsigned int el = get_current_el(); 79 80 if (el == 3U) { 81 write_ats1cpr(addr); 82 } else if (el == 2U) { 83 write_ats1hr(addr); 84 } else { 85 write_ats1cpr(addr); 86 } 87 88 isb(); 89 90 /* If PAR.F == 1 the address translation was aborted. */ 91 if ((read64_par() & PAR_F_MASK) != 0U) 92 return false; 93 94 return true; 95 } 96 #endif 97 98 /* 99 * Returns true if all the bytes in a given object are in mapped memory and an 100 * LDR using this pointer would succeed, false otherwise. 101 */ 102 static bool is_valid_object(uintptr_t addr, size_t size) 103 { 104 assert(size > 0U); 105 106 if (addr == 0U) 107 return false; 108 109 /* Detect overflows */ 110 if ((addr + size) < addr) 111 return false; 112 113 /* A pointer not aligned properly could trigger an alignment fault. */ 114 if ((addr & (sizeof(uintptr_t) - 1U)) != 0U) 115 return false; 116 117 /* Check that all the object is readable */ 118 for (size_t i = 0; i < size; i++) { 119 if (!is_address_readable(addr + i)) 120 return false; 121 } 122 123 return true; 124 } 125 126 /* 127 * Returns true if the specified address is correctly aligned and points to a 128 * valid memory region. 129 */ 130 static bool is_valid_jump_address(uintptr_t addr) 131 { 132 if (addr == 0U) 133 return false; 134 135 /* Check alignment. Both A64 and A32 use 32-bit opcodes */ 136 if ((addr & (sizeof(uint32_t) - 1U)) != 0U) 137 return false; 138 139 if (!is_address_readable(addr)) 140 return false; 141 142 return true; 143 } 144 145 /* 146 * Returns true if the pointer points at a valid frame record, false otherwise. 147 */ 148 static bool is_valid_frame_record(struct frame_record *fr) 149 { 150 return is_valid_object((uintptr_t)fr, sizeof(struct frame_record)); 151 } 152 153 /* 154 * Adjust the frame-pointer-register value by 4 bytes on AArch32 to have the 155 * same layout as AArch64. 156 */ 157 static struct frame_record *adjust_frame_record(struct frame_record *fr) 158 { 159 #ifdef AARCH64 160 return fr; 161 #else 162 return (struct frame_record *)((uintptr_t)fr - 4U); 163 #endif 164 } 165 166 static void unwind_stack(struct frame_record *fr, uintptr_t current_pc, 167 uintptr_t link_register) 168 { 169 uintptr_t call_site; 170 static const char *backtrace_str = "%u: %s: 0x%lx\n"; 171 const char *el_str = get_el_str(get_current_el()); 172 173 if (!is_valid_frame_record(fr)) { 174 printf("ERROR: Corrupted frame pointer (frame record address = %p)\n", 175 fr); 176 return; 177 } 178 179 if (fr->return_addr != link_register) { 180 printf("ERROR: Corrupted stack (frame record address = %p)\n", 181 fr); 182 return; 183 } 184 185 /* The level 0 of the backtrace is the current backtrace function */ 186 printf(backtrace_str, 0U, el_str, current_pc); 187 188 /* 189 * The last frame record pointer in the linked list at the beginning of 190 * the stack should be NULL unless stack is corrupted. 191 */ 192 for (unsigned int i = 1U; i < UNWIND_LIMIT; i++) { 193 /* If an invalid frame record is found, exit. */ 194 if (!is_valid_frame_record(fr)) 195 return; 196 /* 197 * A32 and A64 are fixed length so the address from where the 198 * call was made is the instruction before the return address, 199 * which is always 4 bytes before it. 200 */ 201 call_site = fr->return_addr - 4U; 202 203 /* 204 * If the address is invalid it means that the frame record is 205 * probably corrupted. 206 */ 207 if (!is_valid_jump_address(call_site)) 208 return; 209 210 printf(backtrace_str, i, el_str, call_site); 211 212 fr = adjust_frame_record(fr->parent); 213 } 214 215 printf("ERROR: Max backtrace depth reached\n"); 216 } 217 218 /* 219 * Display a backtrace. The cookie string parameter is displayed along the 220 * trace to help filter the log messages. 221 * 222 * Many things can prevent displaying the expected backtrace. For example, 223 * compiler optimizations can use a branch instead of branch with link when it 224 * detects a tail call. The backtrace level for this caller will not be 225 * displayed, as it does not appear in the call stack anymore. Also, assembly 226 * functions will not be displayed unless they setup AAPCS compliant frame 227 * records on AArch64 and compliant with GCC-specific frame record format on 228 * AArch32. 229 * 230 * Usage of the trace: addr2line can be used to map the addresses to function 231 * and source code location when given the ELF file compiled with debug 232 * information. The "-i" flag is highly recommended to improve display of 233 * inlined function. The *.dump files generated when buildidng each image can 234 * also be used. 235 * 236 * WARNING: In case of corrupted stack, this function could display security 237 * sensitive information past the beginning of the stack so it must not be used 238 * in production build. This function is only compiled in when ENABLE_BACKTRACE 239 * is set to 1. 240 */ 241 void backtrace(const char *cookie) 242 { 243 uintptr_t return_address = (uintptr_t)__builtin_return_address(0U); 244 struct frame_record *fr = __builtin_frame_address(0U); 245 246 /* Printing the backtrace may crash the system, flush before starting */ 247 (void)console_flush(); 248 249 fr = adjust_frame_record(fr); 250 251 printf("BACKTRACE: START: %s\n", cookie); 252 253 unwind_stack(fr, (uintptr_t)&backtrace, return_address); 254 255 printf("BACKTRACE: END: %s\n", cookie); 256 } 257