1/* SPDX-License-Identifier: GPL-2.0-only */
  2/*
  3 *  linux/arch/arm/lib/backtrace-clang.S
  4 *
  5 *  Copyright (C) 2019 Nathan Huckleberry
  6 *
  7 */
  8#include <linux/kern_levels.h>
  9#include <linux/linkage.h>
 10#include <asm/assembler.h>
 11		.text
 12
 13/* fp is 0 or stack frame */
 14
 15#define frame	r4
 16#define sv_fp	r5
 17#define sv_pc	r6
 18#define mask	r7
 19#define sv_lr	r8
 20#define loglvl	r9
 21
 22ENTRY(c_backtrace)
 23
 24#if !defined(CONFIG_FRAME_POINTER) || !defined(CONFIG_PRINTK)
 25		ret	lr
 26ENDPROC(c_backtrace)
 27#else
 28
 29
 30/*
 31 * Clang does not store pc or sp in function prologues so we don't know exactly
 32 * where the function starts.
 33 *
 34 * We can treat the current frame's lr as the saved pc and the preceding
 35 * frame's lr as the current frame's lr, but we can't trace the most recent
 36 * call.  Inserting a false stack frame allows us to reference the function
 37 * called last in the stacktrace.
 38 *
 39 * If the call instruction was a bl we can look at the callers branch
 40 * instruction to calculate the saved pc.  We can recover the pc in most cases,
 41 * but in cases such as calling function pointers we cannot. In this case,
 42 * default to using the lr. This will be some address in the function, but will
 43 * not be the function start.
 44 *
 45 * Unfortunately due to the stack frame layout we can't dump r0 - r3, but these
 46 * are less frequently saved.
 47 *
 48 * Stack frame layout:
 49 * 		<larger addresses>
 50 * 		saved lr
 51 * 	frame=> saved fp
 52 * 		optionally saved caller registers (r4 - r10)
 53 * 		optionally saved arguments (r0 - r3)
 54 * 		<top of stack frame>
 55 * 		<smaller addresses>
 56 *
 57 * Functions start with the following code sequence:
 58 * corrected pc =>  stmfd sp!, {..., fp, lr}
 59 *		add fp, sp, #x
 60 *		stmfd sp!, {r0 - r3} (optional)
 61 *
 62 *
 63 *
 64 *
 65 *
 66 *
 67 * The diagram below shows an example stack setup for dump_stack.
 68 *
 69 * The frame for c_backtrace has pointers to the code of dump_stack. This is
 70 * why the frame of c_backtrace is used to for the pc calculation of
 71 * dump_stack. This is why we must move back a frame to print dump_stack.
 72 *
 73 * The stored locals for dump_stack are in dump_stack's frame. This means that
 74 * to fully print dump_stack's frame we need both the frame for dump_stack (for
 75 * locals) and the frame that was called by dump_stack (for pc).
 76 *
 77 * To print locals we must know where the function start is. If we read the
 78 * function prologue opcodes we can determine which variables are stored in the
 79 * stack frame.
 80 *
 81 * To find the function start of dump_stack we can look at the stored LR of
 82 * show_stack. It points at the instruction directly after the bl dump_stack.
 83 * We can then read the offset from the bl opcode to determine where the branch
 84 * takes us.  The address calculated must be the start of dump_stack.
 85 *
 86 * c_backtrace frame           dump_stack:
 87 * {[LR]    }  ============|   ...
 88 * {[FP]    }  =======|    |   bl c_backtrace
 89 *                    |    |=> ...
 90 * {[R4-R10]}         |
 91 * {[R0-R3] }         |        show_stack:
 92 * dump_stack frame   |        ...
 93 * {[LR]    } =============|   bl dump_stack
 94 * {[FP]    } <=======|    |=> ...
 95 * {[R4-R10]}
 96 * {[R0-R3] }
 97 */
 98
 99		stmfd	sp!, {r4 - r9, fp, lr}	@ Save an extra register
100						@ to ensure 8 byte alignment
101		movs	frame, r0		@ if frame pointer is zero
102		beq	no_frame		@ we have no stack frames
103		mov	loglvl, r2
104		tst	r1, #0x10		@ 26 or 32-bit mode?
105		moveq	mask, #0xfc000003
106		movne	mask, #0		@ mask for 32-bit
107
108/*
109 * Switches the current frame to be the frame for dump_stack.
110 */
111		add	frame, sp, #24		@ switch to false frame
112for_each_frame:	tst	frame, mask		@ Check for address exceptions
113		bne	no_frame
114
115/*
116 * sv_fp is the stack frame with the locals for the current considered
117 * function.
118 *
119 * sv_pc is the saved lr frame the frame above. This is a pointer to a code
120 * address within the current considered function, but it is not the function
121 * start. This value gets updated to be the function start later if it is
122 * possible.
123 */
1241001:		ldr	sv_pc, [frame, #4]	@ get saved 'pc'
1251002:		ldr	sv_fp, [frame, #0]	@ get saved fp
126
127		teq	sv_fp, mask		@ make sure next frame exists
128		beq	no_frame
129
130/*
131 * sv_lr is the lr from the function that called the current function. This is
132 * a pointer to a code address in the current function's caller.  sv_lr-4 is
133 * the instruction used to call the current function.
134 *
135 * This sv_lr can be used to calculate the function start if the function was
136 * called using a bl instruction. If the function start can be recovered sv_pc
137 * is overwritten with the function start.
138 *
139 * If the current function was called using a function pointer we cannot
140 * recover the function start and instead continue with sv_pc as an arbitrary
141 * value within the current function. If this is the case we cannot print
142 * registers for the current function, but the stacktrace is still printed
143 * properly.
144 */
1451003:		ldr	sv_lr, [sv_fp, #4]	@ get saved lr from next frame
146
1471004:		ldr	r0, [sv_lr, #-4]	@ get call instruction
148		ldr	r3, .Lopcode+4
149		and	r2, r3, r0		@ is this a bl call
150		teq	r2, r3
151		bne	finished_setup		@ give up if it's not
152		and	r0, #0xffffff		@ get call offset 24-bit int
153		lsl	r0, r0, #8		@ sign extend offset
154		asr	r0, r0, #8
155		ldr	sv_pc, [sv_fp, #4]	@ get lr address
156		add	sv_pc, sv_pc, #-4	@ get call instruction address
157		add	sv_pc, sv_pc, #8	@ take care of prefetch
158		add	sv_pc, sv_pc, r0, lsl #2@ find function start
159
160finished_setup:
161
162		bic	sv_pc, sv_pc, mask	@ mask PC/LR for the mode
163
164/*
165 * Print the function (sv_pc) and where it was called from (sv_lr).
166 */
167		mov	r0, sv_pc
168
169		mov	r1, sv_lr
170		mov	r2, frame
171		bic	r1, r1, mask		@ mask PC/LR for the mode
172		mov	r3, loglvl
173		bl	dump_backtrace_entry
174
175/*
176 * Test if the function start is a stmfd instruction to determine which
177 * registers were stored in the function prologue.
178 *
179 * If we could not recover the sv_pc because we were called through a function
180 * pointer the comparison will fail and no registers will print. Unwinding will
181 * continue as if there had been no registers stored in this frame.
182 */
1831005:		ldr	r1, [sv_pc, #0]		@ if stmfd sp!, {..., fp, lr}
184		ldr	r3, .Lopcode		@ instruction exists,
185		teq	r3, r1, lsr #11
186		ldr	r0, [frame]		@ locals are stored in
187						@ the preceding frame
188		subeq	r0, r0, #4
189		mov	r2, loglvl
190		bleq	dump_backtrace_stm	@ dump saved registers
191
192/*
193 * If we are out of frames or if the next frame is invalid.
194 */
195		teq	sv_fp, #0		@ zero saved fp means
196		beq	no_frame		@ no further frames
197
198		cmp	sv_fp, frame		@ next frame must be
199		mov	frame, sv_fp		@ above the current frame
200#ifdef CONFIG_IRQSTACKS
201		@
202		@ Kernel stacks may be discontiguous in memory. If the next
203		@ frame is below the previous frame, accept it as long as it
204		@ lives in kernel memory.
205		@
206		cmpls	sv_fp, #PAGE_OFFSET
207#endif
208		bhi	for_each_frame
209
2101006:		adr	r0, .Lbad
211		mov	r1, loglvl
212		mov	r2, frame
213		bl	_printk
214no_frame:	ldmfd	sp!, {r4 - r9, fp, pc}
215ENDPROC(c_backtrace)
216		.pushsection __ex_table,"a"
217		.align	3
218		.long	1001b, 1006b
219		.long	1002b, 1006b
220		.long	1003b, 1006b
221		.long	1004b, finished_setup
222		.long   1005b, 1006b
223		.popsection
224
225.Lbad:		.asciz	"%sBacktrace aborted due to bad frame pointer <%p>\n"
226		.align
227.Lopcode:	.word	0xe92d4800 >> 11	@ stmfd sp!, {... fp, lr}
228		.word	0x0b000000		@ bl if these bits are set
229
230#endif