1 /*
2 * Copyright (c) 2018-2022, ARM Limited and Contributors. All rights reserved.
3 *
4 * SPDX-License-Identifier: BSD-3-Clause
5 */
6
7 #include <assert.h>
8 #include <stdbool.h>
9 #include <stdint.h>
10
11 #include <arch_helpers.h>
12 #include <common/debug.h>
13 #include <drivers/console.h>
14
15 /* Maximum number of entries in the backtrace to display */
16 #define UNWIND_LIMIT 20U
17
18 /*
19 * If -fno-omit-frame-pointer is used:
20 *
21 * - AArch64: The AAPCS defines the format of the frame records and mandates the
22 * usage of r29 as frame pointer.
23 *
24 * - AArch32: The format of the frame records is not defined in the AAPCS.
25 * However, at least GCC and Clang use the same format. When they are forced
26 * to only generate A32 code (with -marm), they use r11 as frame pointer and a
27 * similar format as in AArch64. If interworking with T32 is enabled, the
28 * frame pointer is r7 and the format is different. This is not supported by
29 * this implementation of backtrace, so it is needed to use -marm.
30 */
31
32 /* Frame records form a linked list in the stack */
33 struct frame_record {
34 /* Previous frame record in the list */
35 struct frame_record *parent;
36 /* Return address of the function at this level */
37 uintptr_t return_addr;
38 };
39
extract_address(uintptr_t address)40 static inline uintptr_t extract_address(uintptr_t address)
41 {
42 uintptr_t ret = address;
43
44 #if ENABLE_PAUTH
45 /*
46 * When pointer authentication is enabled, the LR value saved on the
47 * stack contains a PAC. It must be stripped to retrieve the return
48 * address.
49 */
50
51 xpaci(ret);
52 #endif
53
54 return ret;
55 }
56
57 /*
58 * Returns true if the address points to a virtual address that can be read at
59 * the current EL, false otherwise.
60 */
61 #ifdef __aarch64__
is_address_readable(uintptr_t address)62 static bool is_address_readable(uintptr_t address)
63 {
64 unsigned int el = get_current_el();
65 uintptr_t addr = extract_address(address);
66
67 if (el == 3U) {
68 ats1e3r(addr);
69 } else if (el == 2U) {
70 ats1e2r(addr);
71 } else {
72 AT(ats1e1r, addr);
73 }
74
75 isb();
76
77 /* If PAR.F == 1 the address translation was aborted. */
78 if ((read_par_el1() & PAR_F_MASK) != 0U)
79 return false;
80
81 return true;
82 }
83 #else /* !__aarch64__ */
is_address_readable(uintptr_t addr)84 static bool is_address_readable(uintptr_t addr)
85 {
86 unsigned int el = get_current_el();
87
88 if (el == 3U) {
89 write_ats1cpr(addr);
90 } else if (el == 2U) {
91 write_ats1hr(addr);
92 } else {
93 write_ats1cpr(addr);
94 }
95
96 isb();
97
98 /* If PAR.F == 1 the address translation was aborted. */
99 if ((read64_par() & PAR_F_MASK) != 0U)
100 return false;
101
102 return true;
103 }
104 #endif /* __aarch64__ */
105
106 /*
107 * Returns true if all the bytes in a given object are in mapped memory and an
108 * LDR using this pointer would succeed, false otherwise.
109 */
is_valid_object(uintptr_t addr,size_t size)110 static bool is_valid_object(uintptr_t addr, size_t size)
111 {
112 assert(size > 0U);
113
114 if (addr == 0U)
115 return false;
116
117 /* Detect overflows */
118 if ((addr + size) < addr)
119 return false;
120
121 /* A pointer not aligned properly could trigger an alignment fault. */
122 if ((addr & (sizeof(uintptr_t) - 1U)) != 0U)
123 return false;
124
125 /* Check that all the object is readable */
126 for (size_t i = 0; i < size; i++) {
127 if (!is_address_readable(addr + i))
128 return false;
129 }
130
131 return true;
132 }
133
134 /*
135 * Returns true if the specified address is correctly aligned and points to a
136 * valid memory region.
137 */
is_valid_jump_address(uintptr_t addr)138 static bool is_valid_jump_address(uintptr_t addr)
139 {
140 if (addr == 0U)
141 return false;
142
143 /* Check alignment. Both A64 and A32 use 32-bit opcodes */
144 if ((addr & (sizeof(uint32_t) - 1U)) != 0U)
145 return false;
146
147 if (!is_address_readable(addr))
148 return false;
149
150 return true;
151 }
152
153 /*
154 * Returns true if the pointer points at a valid frame record, false otherwise.
155 */
is_valid_frame_record(struct frame_record * fr)156 static bool is_valid_frame_record(struct frame_record *fr)
157 {
158 return is_valid_object((uintptr_t)fr, sizeof(struct frame_record));
159 }
160
161 /*
162 * Adjust the frame-pointer-register value by 4 bytes on AArch32 to have the
163 * same layout as AArch64.
164 */
adjust_frame_record(struct frame_record * fr)165 static struct frame_record *adjust_frame_record(struct frame_record *fr)
166 {
167 #ifdef __aarch64__
168 return fr;
169 #else
170 return (struct frame_record *)((uintptr_t)fr - 4U);
171 #endif
172 }
173
unwind_stack(struct frame_record * fr,uintptr_t current_pc,uintptr_t link_register)174 static void unwind_stack(struct frame_record *fr, uintptr_t current_pc,
175 uintptr_t link_register)
176 {
177 uintptr_t call_site;
178 static const char *backtrace_str = "%u: %s: 0x%lx\n";
179 const char *el_str = get_el_str(get_current_el());
180
181 if (!is_valid_frame_record(fr)) {
182 printf("ERROR: Corrupted frame pointer (frame record address = %p)\n",
183 fr);
184 return;
185 }
186
187 call_site = extract_address(fr->return_addr);
188 if (call_site != link_register) {
189 printf("ERROR: Corrupted stack (frame record address = %p)\n",
190 fr);
191 return;
192 }
193
194 /* The level 0 of the backtrace is the current backtrace function */
195 printf(backtrace_str, 0U, el_str, current_pc);
196
197 /*
198 * The last frame record pointer in the linked list at the beginning of
199 * the stack should be NULL unless stack is corrupted.
200 */
201 for (unsigned int i = 1U; i < UNWIND_LIMIT; i++) {
202 /* If an invalid frame record is found, exit. */
203 if (!is_valid_frame_record(fr))
204 return;
205 /*
206 * A32 and A64 are fixed length so the address from where the
207 * call was made is the instruction before the return address,
208 * which is always 4 bytes before it.
209 */
210
211 call_site = extract_address(fr->return_addr) - 4U;
212
213 /*
214 * If the address is invalid it means that the frame record is
215 * probably corrupted.
216 */
217 if (!is_valid_jump_address(call_site))
218 return;
219
220 printf(backtrace_str, i, el_str, call_site);
221
222 fr = adjust_frame_record(fr->parent);
223 }
224
225 printf("ERROR: Max backtrace depth reached\n");
226 }
227
228 /*
229 * Display a backtrace. The cookie string parameter is displayed along the
230 * trace to help filter the log messages.
231 *
232 * Many things can prevent displaying the expected backtrace. For example,
233 * compiler optimizations can use a branch instead of branch with link when it
234 * detects a tail call. The backtrace level for this caller will not be
235 * displayed, as it does not appear in the call stack anymore. Also, assembly
236 * functions will not be displayed unless they setup AAPCS compliant frame
237 * records on AArch64 and compliant with GCC-specific frame record format on
238 * AArch32.
239 *
240 * Usage of the trace: addr2line can be used to map the addresses to function
241 * and source code location when given the ELF file compiled with debug
242 * information. The "-i" flag is highly recommended to improve display of
243 * inlined function. The *.dump files generated when building each image can
244 * also be used.
245 *
246 * WARNING: In case of corrupted stack, this function could display security
247 * sensitive information past the beginning of the stack so it must not be used
248 * in production build. This function is only compiled in when ENABLE_BACKTRACE
249 * is set to 1.
250 */
backtrace(const char * cookie)251 void backtrace(const char *cookie)
252 {
253 uintptr_t return_address = (uintptr_t)__builtin_return_address(0U);
254 struct frame_record *fr = __builtin_frame_address(0U);
255
256 /* Printing the backtrace may crash the system, flush before starting */
257 console_flush();
258
259 fr = adjust_frame_record(fr);
260
261 printf("BACKTRACE: START: %s\n", cookie);
262
263 unwind_stack(fr, (uintptr_t)&backtrace, return_address);
264
265 printf("BACKTRACE: END: %s\n", cookie);
266 }
267
