1/* SPDX-License-Identifier: GPL-2.0-only */ 2/* 3 * linux/arch/arm/lib/backtrace-clang.S 4 * 5 * Copyright (C) 2019 Nathan Huckleberry 6 * 7 */ 8#include <linux/kern_levels.h> 9#include <linux/linkage.h> 10#include <asm/assembler.h> 11 .text 12 13/* fp is 0 or stack frame */ 14 15#define frame r4 16#define sv_fp r5 17#define sv_pc r6 18#define mask r7 19#define sv_lr r8 20#define loglvl r9 21 22ENTRY(c_backtrace) 23 24#if !defined(CONFIG_FRAME_POINTER) || !defined(CONFIG_PRINTK) 25 ret lr 26ENDPROC(c_backtrace) 27#else 28 29 30/* 31 * Clang does not store pc or sp in function prologues so we don't know exactly 32 * where the function starts. 33 * 34 * We can treat the current frame's lr as the saved pc and the preceding 35 * frame's lr as the current frame's lr, but we can't trace the most recent 36 * call. Inserting a false stack frame allows us to reference the function 37 * called last in the stacktrace. 38 * 39 * If the call instruction was a bl we can look at the callers branch 40 * instruction to calculate the saved pc. We can recover the pc in most cases, 41 * but in cases such as calling function pointers we cannot. In this case, 42 * default to using the lr. This will be some address in the function, but will 43 * not be the function start. 44 * 45 * Unfortunately due to the stack frame layout we can't dump r0 - r3, but these 46 * are less frequently saved. 47 * 48 * Stack frame layout: 49 * <larger addresses> 50 * saved lr 51 * frame=> saved fp 52 * optionally saved caller registers (r4 - r10) 53 * optionally saved arguments (r0 - r3) 54 * <top of stack frame> 55 * <smaller addresses> 56 * 57 * Functions start with the following code sequence: 58 * corrected pc => stmfd sp!, {..., fp, lr} 59 * add fp, sp, #x 60 * stmfd sp!, {r0 - r3} (optional) 61 * 62 * 63 * 64 * 65 * 66 * 67 * The diagram below shows an example stack setup for dump_stack. 68 * 69 * The frame for c_backtrace has pointers to the code of dump_stack. This is 70 * why the frame of c_backtrace is used to for the pc calculation of 71 * dump_stack. This is why we must move back a frame to print dump_stack. 72 * 73 * The stored locals for dump_stack are in dump_stack's frame. This means that 74 * to fully print dump_stack's frame we need both the frame for dump_stack (for 75 * locals) and the frame that was called by dump_stack (for pc). 76 * 77 * To print locals we must know where the function start is. If we read the 78 * function prologue opcodes we can determine which variables are stored in the 79 * stack frame. 80 * 81 * To find the function start of dump_stack we can look at the stored LR of 82 * show_stack. It points at the instruction directly after the bl dump_stack. 83 * We can then read the offset from the bl opcode to determine where the branch 84 * takes us. The address calculated must be the start of dump_stack. 85 * 86 * c_backtrace frame dump_stack: 87 * {[LR] } ============| ... 88 * {[FP] } =======| | bl c_backtrace 89 * | |=> ... 90 * {[R4-R10]} | 91 * {[R0-R3] } | show_stack: 92 * dump_stack frame | ... 93 * {[LR] } =============| bl dump_stack 94 * {[FP] } <=======| |=> ... 95 * {[R4-R10]} 96 * {[R0-R3] } 97 */ 98 99 stmfd sp!, {r4 - r9, fp, lr} @ Save an extra register 100 @ to ensure 8 byte alignment 101 movs frame, r0 @ if frame pointer is zero 102 beq no_frame @ we have no stack frames 103 mov loglvl, r2 104 tst r1, #0x10 @ 26 or 32-bit mode? 105 moveq mask, #0xfc000003 106 movne mask, #0 @ mask for 32-bit 107 108/* 109 * Switches the current frame to be the frame for dump_stack. 110 * (Only in case of current task using current registers) 111 */ 112 cmp frame, fp 113 addeq frame, sp, #24 @ switch to false frame 114for_each_frame: tst frame, mask @ Check for address exceptions 115 bne no_frame 116 117/* 118 * sv_fp is the stack frame with the locals for the current considered 119 * function. 120 * 121 * sv_pc is the saved lr frame the frame above. This is a pointer to a code 122 * address within the current considered function, but it is not the function 123 * start. This value gets updated to be the function start later if it is 124 * possible. 125 */ 1261001: ldr sv_pc, [frame, #4] @ get saved 'pc' 1271002: ldr sv_fp, [frame, #0] @ get saved fp 128 129 teq sv_fp, mask @ make sure next frame exists 130 beq no_frame 131 132/* 133 * sv_lr is the lr from the function that called the current function. This is 134 * a pointer to a code address in the current function's caller. sv_lr-4 is 135 * the instruction used to call the current function. 136 * 137 * This sv_lr can be used to calculate the function start if the function was 138 * called using a bl instruction. If the function start can be recovered sv_pc 139 * is overwritten with the function start. 140 * 141 * If the current function was called using a function pointer we cannot 142 * recover the function start and instead continue with sv_pc as an arbitrary 143 * value within the current function. If this is the case we cannot print 144 * registers for the current function, but the stacktrace is still printed 145 * properly. 146 */ 1471003: ldr sv_lr, [sv_fp, #4] @ get saved lr from next frame 148 1491004: ldr r0, [sv_lr, #-4] @ get call instruction 150 ldr r3, .Lopcode+4 151 and r2, r3, r0 @ is this a bl call 152 teq r2, r3 153 bne finished_setup @ give up if it's not 154 and r0, #0xffffff @ get call offset 24-bit int 155 lsl r0, r0, #8 @ sign extend offset 156 asr r0, r0, #8 157 ldr sv_pc, [sv_fp, #4] @ get lr address 158 add sv_pc, sv_pc, #-4 @ get call instruction address 159 add sv_pc, sv_pc, #8 @ take care of prefetch 160 add sv_pc, sv_pc, r0, lsl #2@ find function start 161 162finished_setup: 163 164 bic sv_pc, sv_pc, mask @ mask PC/LR for the mode 165 166/* 167 * Print the function (sv_pc) and where it was called from (sv_lr). 168 */ 169 mov r0, sv_pc 170 171 mov r1, sv_lr 172 mov r2, frame 173 bic r1, r1, mask @ mask PC/LR for the mode 174 mov r3, loglvl 175 bl dump_backtrace_entry 176 177/* 178 * Test if the function start is a stmfd instruction to determine which 179 * registers were stored in the function prologue. 180 * 181 * If we could not recover the sv_pc because we were called through a function 182 * pointer the comparison will fail and no registers will print. Unwinding will 183 * continue as if there had been no registers stored in this frame. 184 */ 1851005: ldr r1, [sv_pc, #0] @ if stmfd sp!, {..., fp, lr} 186 ldr r3, .Lopcode @ instruction exists, 187 teq r3, r1, lsr #11 188 ldr r0, [frame] @ locals are stored in 189 @ the preceding frame 190 subeq r0, r0, #4 191 mov r2, loglvl 192 bleq dump_backtrace_stm @ dump saved registers 193 194/* 195 * If we are out of frames or if the next frame is invalid. 196 */ 197 teq sv_fp, #0 @ zero saved fp means 198 beq no_frame @ no further frames 199 200 cmp sv_fp, frame @ next frame must be 201 mov frame, sv_fp @ above the current frame 202#ifdef CONFIG_IRQSTACKS 203 @ 204 @ Kernel stacks may be discontiguous in memory. If the next 205 @ frame is below the previous frame, accept it as long as it 206 @ lives in kernel memory. 207 @ 208 cmpls sv_fp, #PAGE_OFFSET 209#endif 210 bhi for_each_frame 211 2121006: adr r0, .Lbad 213 mov r1, loglvl 214 mov r2, frame 215 bl _printk 216no_frame: ldmfd sp!, {r4 - r9, fp, pc} 217ENDPROC(c_backtrace) 218 .pushsection __ex_table,"a" 219 .align 3 220 .long 1001b, 1006b 221 .long 1002b, 1006b 222 .long 1003b, 1006b 223 .long 1004b, finished_setup 224 .long 1005b, 1006b 225 .popsection 226 227.Lbad: .asciz "%sBacktrace aborted due to bad frame pointer <%p>\n" 228 .align 229.Lopcode: .word 0xe92d4800 >> 11 @ stmfd sp!, {... fp, lr} 230 .word 0x0b000000 @ bl if these bits are set 231 232#endif 233