1 /* 2 * Copyright (c) 2018-2019, ARM Limited and Contributors. All rights reserved. 3 * 4 * SPDX-License-Identifier: BSD-3-Clause 5 */ 6 7 #include <assert.h> 8 #include <stdbool.h> 9 #include <stdint.h> 10 11 #include <arch_helpers.h> 12 #include <common/debug.h> 13 #include <drivers/console.h> 14 15 /* Maximum number of entries in the backtrace to display */ 16 #define UNWIND_LIMIT 20U 17 18 /* 19 * If -fno-omit-frame-pointer is used: 20 * 21 * - AArch64: The AAPCS defines the format of the frame records and mandates the 22 * usage of r29 as frame pointer. 23 * 24 * - AArch32: The format of the frame records is not defined in the AAPCS. 25 * However, at least GCC and Clang use the same format. When they are forced 26 * to only generate A32 code (with -marm), they use r11 as frame pointer and a 27 * similar format as in AArch64. If interworking with T32 is enabled, the 28 * frame pointer is r7 and the format is different. This is not supported by 29 * this implementation of backtrace, so it is needed to use -marm. 30 */ 31 32 /* Frame records form a linked list in the stack */ 33 struct frame_record { 34 /* Previous frame record in the list */ 35 struct frame_record *parent; 36 /* Return address of the function at this level */ 37 uintptr_t return_addr; 38 }; 39 40 static const char *get_el_str(unsigned int el) 41 { 42 if (el == 3U) { 43 return "EL3"; 44 } else if (el == 2U) { 45 return "EL2"; 46 } else { 47 return "S-EL1"; 48 } 49 } 50 51 /* 52 * Returns true if the address points to a virtual address that can be read at 53 * the current EL, false otherwise. 54 */ 55 #ifdef AARCH64 56 static bool is_address_readable(uintptr_t addr) 57 { 58 unsigned int el = get_current_el(); 59 60 if (el == 3U) { 61 ats1e3r(addr); 62 } else if (el == 2U) { 63 ats1e2r(addr); 64 } else { 65 ats1e1r(addr); 66 } 67 68 isb(); 69 70 /* If PAR.F == 1 the address translation was aborted. */ 71 if ((read_par_el1() & PAR_F_MASK) != 0U) 72 return false; 73 74 return true; 75 } 76 #else /* if AARCH32 */ 77 static bool is_address_readable(uintptr_t addr) 78 { 79 unsigned int el = get_current_el(); 80 81 if (el == 3U) { 82 write_ats1cpr(addr); 83 } else if (el == 2U) { 84 write_ats1hr(addr); 85 } else { 86 write_ats1cpr(addr); 87 } 88 89 isb(); 90 91 /* If PAR.F == 1 the address translation was aborted. */ 92 if ((read64_par() & PAR_F_MASK) != 0U) 93 return false; 94 95 return true; 96 } 97 #endif 98 99 /* 100 * Returns true if all the bytes in a given object are in mapped memory and an 101 * LDR using this pointer would succeed, false otherwise. 102 */ 103 static bool is_valid_object(uintptr_t addr, size_t size) 104 { 105 assert(size > 0U); 106 107 if (addr == 0U) 108 return false; 109 110 /* Detect overflows */ 111 if ((addr + size) < addr) 112 return false; 113 114 /* A pointer not aligned properly could trigger an alignment fault. */ 115 if ((addr & (sizeof(uintptr_t) - 1U)) != 0U) 116 return false; 117 118 /* Check that all the object is readable */ 119 for (size_t i = 0; i < size; i++) { 120 if (!is_address_readable(addr + i)) 121 return false; 122 } 123 124 return true; 125 } 126 127 /* 128 * Returns true if the specified address is correctly aligned and points to a 129 * valid memory region. 130 */ 131 static bool is_valid_jump_address(uintptr_t addr) 132 { 133 if (addr == 0U) 134 return false; 135 136 /* Check alignment. Both A64 and A32 use 32-bit opcodes */ 137 if ((addr & (sizeof(uint32_t) - 1U)) != 0U) 138 return false; 139 140 if (!is_address_readable(addr)) 141 return false; 142 143 return true; 144 } 145 146 /* 147 * Returns true if the pointer points at a valid frame record, false otherwise. 148 */ 149 static bool is_valid_frame_record(struct frame_record *fr) 150 { 151 return is_valid_object((uintptr_t)fr, sizeof(struct frame_record)); 152 } 153 154 /* 155 * Adjust the frame-pointer-register value by 4 bytes on AArch32 to have the 156 * same layout as AArch64. 157 */ 158 static struct frame_record *adjust_frame_record(struct frame_record *fr) 159 { 160 #ifdef AARCH64 161 return fr; 162 #else 163 return (struct frame_record *)((uintptr_t)fr - 4U); 164 #endif 165 } 166 167 static void unwind_stack(struct frame_record *fr, uintptr_t current_pc, 168 uintptr_t link_register) 169 { 170 uintptr_t call_site; 171 static const char *backtrace_str = "%u: %s: 0x%lx\n"; 172 const char *el_str = get_el_str(get_current_el()); 173 174 if (!is_valid_frame_record(fr)) { 175 printf("ERROR: Corrupted frame pointer (frame record address = %p)\n", 176 fr); 177 return; 178 } 179 180 if (fr->return_addr != link_register) { 181 printf("ERROR: Corrupted stack (frame record address = %p)\n", 182 fr); 183 return; 184 } 185 186 /* The level 0 of the backtrace is the current backtrace function */ 187 printf(backtrace_str, 0U, el_str, current_pc); 188 189 /* 190 * The last frame record pointer in the linked list at the beginning of 191 * the stack should be NULL unless stack is corrupted. 192 */ 193 for (unsigned int i = 1U; i < UNWIND_LIMIT; i++) { 194 /* If an invalid frame record is found, exit. */ 195 if (!is_valid_frame_record(fr)) 196 return; 197 /* 198 * A32 and A64 are fixed length so the address from where the 199 * call was made is the instruction before the return address, 200 * which is always 4 bytes before it. 201 */ 202 call_site = fr->return_addr - 4U; 203 204 /* 205 * If the address is invalid it means that the frame record is 206 * probably corrupted. 207 */ 208 if (!is_valid_jump_address(call_site)) 209 return; 210 211 printf(backtrace_str, i, el_str, call_site); 212 213 fr = adjust_frame_record(fr->parent); 214 } 215 216 printf("ERROR: Max backtrace depth reached\n"); 217 } 218 219 /* 220 * Display a backtrace. The cookie string parameter is displayed along the 221 * trace to help filter the log messages. 222 * 223 * Many things can prevent displaying the expected backtrace. For example, 224 * compiler optimizations can use a branch instead of branch with link when it 225 * detects a tail call. The backtrace level for this caller will not be 226 * displayed, as it does not appear in the call stack anymore. Also, assembly 227 * functions will not be displayed unless they setup AAPCS compliant frame 228 * records on AArch64 and compliant with GCC-specific frame record format on 229 * AArch32. 230 * 231 * Usage of the trace: addr2line can be used to map the addresses to function 232 * and source code location when given the ELF file compiled with debug 233 * information. The "-i" flag is highly recommended to improve display of 234 * inlined function. The *.dump files generated when building each image can 235 * also be used. 236 * 237 * WARNING: In case of corrupted stack, this function could display security 238 * sensitive information past the beginning of the stack so it must not be used 239 * in production build. This function is only compiled in when ENABLE_BACKTRACE 240 * is set to 1. 241 */ 242 void backtrace(const char *cookie) 243 { 244 uintptr_t return_address = (uintptr_t)__builtin_return_address(0U); 245 struct frame_record *fr = __builtin_frame_address(0U); 246 247 /* Printing the backtrace may crash the system, flush before starting */ 248 (void)console_flush(); 249 250 fr = adjust_frame_record(fr); 251 252 printf("BACKTRACE: START: %s\n", cookie); 253 254 unwind_stack(fr, (uintptr_t)&backtrace, return_address); 255 256 printf("BACKTRACE: END: %s\n", cookie); 257 } 258