1 /*- 2 * Mach Operating System 3 * Copyright (c) 1991,1990 Carnegie Mellon University 4 * All Rights Reserved. 5 * 6 * Permission to use, copy, modify and distribute this software and its 7 * documentation is hereby granted, provided that both the copyright 8 * notice and this permission notice appear in all copies of the 9 * software, derivative works or modified versions, and any portions 10 * thereof, and that both notices appear in supporting documentation. 11 * 12 * CARNEGIE MELLON ALLOWS FREE USE OF THIS SOFTWARE IN ITS 13 * CONDITION. CARNEGIE MELLON DISCLAIMS ANY LIABILITY OF ANY KIND FOR 14 * ANY DAMAGES WHATSOEVER RESULTING FROM THE USE OF THIS SOFTWARE. 15 * 16 * Carnegie Mellon requests users of this software to return to 17 * 18 * Software Distribution Coordinator or Software.Distribution@CS.CMU.EDU 19 * School of Computer Science 20 * Carnegie Mellon University 21 * Pittsburgh PA 15213-3890 22 * 23 * any improvements or extensions that they make and grant Carnegie the 24 * rights to redistribute these changes. 25 */ 26 27 #include <sys/cdefs.h> 28 __FBSDID("$FreeBSD$"); 29 30 #include <sys/param.h> 31 #include <sys/systm.h> 32 #include <sys/kdb.h> 33 #include <sys/proc.h> 34 #include <sys/reg.h> 35 36 #include <machine/cpu.h> 37 #include <machine/frame.h> 38 #include <machine/md_var.h> 39 #include <machine/pcb.h> 40 #include <machine/stack.h> 41 42 #include <vm/vm.h> 43 #include <vm/vm_param.h> 44 #include <vm/pmap.h> 45 46 #include <ddb/ddb.h> 47 #include <ddb/db_access.h> 48 #include <ddb/db_sym.h> 49 #include <ddb/db_variables.h> 50 51 static db_varfcn_t db_esp; 52 static db_varfcn_t db_frame; 53 static db_varfcn_t db_frame_seg; 54 static db_varfcn_t db_gs; 55 static db_varfcn_t db_ss; 56 57 /* 58 * Machine register set. 59 */ 60 #define DB_OFFSET(x) (db_expr_t *)offsetof(struct trapframe, x) 61 struct db_variable db_regs[] = { 62 { "cs", DB_OFFSET(tf_cs), db_frame_seg }, 63 { "ds", DB_OFFSET(tf_ds), db_frame_seg }, 64 { "es", DB_OFFSET(tf_es), db_frame_seg }, 65 { "fs", DB_OFFSET(tf_fs), db_frame_seg }, 66 { "gs", NULL, db_gs }, 67 { "ss", NULL, db_ss }, 68 { "eax", DB_OFFSET(tf_eax), db_frame }, 69 { "ecx", DB_OFFSET(tf_ecx), db_frame }, 70 { "edx", DB_OFFSET(tf_edx), db_frame }, 71 { "ebx", DB_OFFSET(tf_ebx), db_frame }, 72 { "esp", NULL, db_esp }, 73 { "ebp", DB_OFFSET(tf_ebp), db_frame }, 74 { "esi", DB_OFFSET(tf_esi), db_frame }, 75 { "edi", DB_OFFSET(tf_edi), db_frame }, 76 { "eip", DB_OFFSET(tf_eip), db_frame }, 77 { "efl", DB_OFFSET(tf_eflags), db_frame }, 78 }; 79 struct db_variable *db_eregs = db_regs + nitems(db_regs); 80 81 static __inline int 82 get_esp(struct trapframe *tf) 83 { 84 return (TF_HAS_STACKREGS(tf) ? tf->tf_esp : (intptr_t)&tf->tf_esp); 85 } 86 87 static int 88 db_frame(struct db_variable *vp, db_expr_t *valuep, int op) 89 { 90 int *reg; 91 92 if (kdb_frame == NULL) 93 return (0); 94 95 reg = (int *)((uintptr_t)kdb_frame + (db_expr_t)vp->valuep); 96 if (op == DB_VAR_GET) 97 *valuep = *reg; 98 else 99 *reg = *valuep; 100 return (1); 101 } 102 103 static int 104 db_frame_seg(struct db_variable *vp, db_expr_t *valuep, int op) 105 { 106 struct trapframe_vm86 *tfp; 107 int off; 108 uint16_t *reg; 109 110 if (kdb_frame == NULL) 111 return (0); 112 113 off = (intptr_t)vp->valuep; 114 if (kdb_frame->tf_eflags & PSL_VM) { 115 tfp = (void *)kdb_frame; 116 switch ((intptr_t)vp->valuep) { 117 case (intptr_t)DB_OFFSET(tf_cs): 118 reg = (uint16_t *)&tfp->tf_cs; 119 break; 120 case (intptr_t)DB_OFFSET(tf_ds): 121 reg = (uint16_t *)&tfp->tf_vm86_ds; 122 break; 123 case (intptr_t)DB_OFFSET(tf_es): 124 reg = (uint16_t *)&tfp->tf_vm86_es; 125 break; 126 case (intptr_t)DB_OFFSET(tf_fs): 127 reg = (uint16_t *)&tfp->tf_vm86_fs; 128 break; 129 } 130 } else 131 reg = (uint16_t *)((uintptr_t)kdb_frame + off); 132 if (op == DB_VAR_GET) 133 *valuep = *reg; 134 else 135 *reg = *valuep; 136 return (1); 137 } 138 139 static int 140 db_esp(struct db_variable *vp, db_expr_t *valuep, int op) 141 { 142 143 if (kdb_frame == NULL) 144 return (0); 145 146 if (op == DB_VAR_GET) 147 *valuep = get_esp(kdb_frame); 148 else if (TF_HAS_STACKREGS(kdb_frame)) 149 kdb_frame->tf_esp = *valuep; 150 return (1); 151 } 152 153 static int 154 db_gs(struct db_variable *vp, db_expr_t *valuep, int op) 155 { 156 struct trapframe_vm86 *tfp; 157 158 if (kdb_frame != NULL && kdb_frame->tf_eflags & PSL_VM) { 159 tfp = (void *)kdb_frame; 160 if (op == DB_VAR_GET) 161 *valuep = tfp->tf_vm86_gs; 162 else 163 tfp->tf_vm86_gs = *valuep; 164 return (1); 165 } 166 if (op == DB_VAR_GET) 167 *valuep = rgs(); 168 else 169 load_gs(*valuep); 170 return (1); 171 } 172 173 static int 174 db_ss(struct db_variable *vp, db_expr_t *valuep, int op) 175 { 176 177 if (kdb_frame == NULL) 178 return (0); 179 180 if (op == DB_VAR_GET) 181 *valuep = TF_HAS_STACKREGS(kdb_frame) ? kdb_frame->tf_ss : 182 rss(); 183 else if (TF_HAS_STACKREGS(kdb_frame)) 184 kdb_frame->tf_ss = *valuep; 185 return (1); 186 } 187 188 #define NORMAL 0 189 #define TRAP 1 190 #define INTERRUPT 2 191 #define SYSCALL 3 192 #define DOUBLE_FAULT 4 193 194 static void db_nextframe(struct i386_frame **, db_addr_t *, struct thread *); 195 static int db_numargs(struct i386_frame *); 196 static void db_print_stack_entry(const char *, int, char **, int *, db_addr_t, 197 void *); 198 199 /* 200 * Figure out how many arguments were passed into the frame at "fp". 201 */ 202 static int 203 db_numargs(fp) 204 struct i386_frame *fp; 205 { 206 char *argp; 207 int inst; 208 int args; 209 210 argp = (char *)db_get_value((int)&fp->f_retaddr, 4, false); 211 /* 212 * XXX etext is wrong for LKMs. We should attempt to interpret 213 * the instruction at the return address in all cases. This 214 * may require better fault handling. 215 */ 216 if (argp < btext || argp >= etext) { 217 args = -1; 218 } else { 219 retry: 220 inst = db_get_value((int)argp, 4, false); 221 if ((inst & 0xff) == 0x59) /* popl %ecx */ 222 args = 1; 223 else if ((inst & 0xffff) == 0xc483) /* addl $Ibs, %esp */ 224 args = ((inst >> 16) & 0xff) / 4; 225 else if ((inst & 0xf8ff) == 0xc089) { /* movl %eax, %Reg */ 226 argp += 2; 227 goto retry; 228 } else 229 args = -1; 230 } 231 return (args); 232 } 233 234 static void 235 db_print_stack_entry(name, narg, argnp, argp, callpc, frame) 236 const char *name; 237 int narg; 238 char **argnp; 239 int *argp; 240 db_addr_t callpc; 241 void *frame; 242 { 243 int n = narg >= 0 ? narg : 5; 244 245 db_printf("%s(", name); 246 while (n) { 247 if (argnp) 248 db_printf("%s=", *argnp++); 249 db_printf("%r", db_get_value((int)argp, 4, false)); 250 argp++; 251 if (--n != 0) 252 db_printf(","); 253 } 254 if (narg < 0) 255 db_printf(",..."); 256 db_printf(") at "); 257 db_printsym(callpc, DB_STGY_PROC); 258 if (frame != NULL) 259 db_printf("/frame 0x%r", (register_t)frame); 260 db_printf("\n"); 261 } 262 263 /* 264 * Figure out the next frame up in the call stack. 265 */ 266 static void 267 db_nextframe(struct i386_frame **fp, db_addr_t *ip, struct thread *td) 268 { 269 struct trapframe *tf; 270 int frame_type; 271 int eip, esp, ebp; 272 db_expr_t offset; 273 c_db_sym_t sym; 274 const char *name; 275 276 eip = db_get_value((int) &(*fp)->f_retaddr, 4, false); 277 ebp = db_get_value((int) &(*fp)->f_frame, 4, false); 278 279 /* 280 * Figure out frame type. We look at the address just before 281 * the saved instruction pointer as the saved EIP is after the 282 * call function, and if the function being called is marked as 283 * dead (such as panic() at the end of dblfault_handler()), then 284 * the instruction at the saved EIP will be part of a different 285 * function (syscall() in this example) rather than the one that 286 * actually made the call. 287 */ 288 frame_type = NORMAL; 289 290 if (eip >= PMAP_TRM_MIN_ADDRESS) { 291 sym = db_search_symbol(eip - 1 - setidt_disp, DB_STGY_ANY, 292 &offset); 293 } else { 294 sym = db_search_symbol(eip - 1, DB_STGY_ANY, &offset); 295 } 296 db_symbol_values(sym, &name, NULL); 297 if (name != NULL) { 298 if (strcmp(name, "calltrap") == 0 || 299 strcmp(name, "fork_trampoline") == 0) 300 frame_type = TRAP; 301 else if (strncmp(name, "Xatpic_intr", 11) == 0 || 302 strncmp(name, "Xapic_isr", 9) == 0) { 303 frame_type = INTERRUPT; 304 } else if (strcmp(name, "Xlcall_syscall") == 0 || 305 strcmp(name, "Xint0x80_syscall") == 0) 306 frame_type = SYSCALL; 307 else if (strcmp(name, "dblfault_handler") == 0) 308 frame_type = DOUBLE_FAULT; 309 else if (strcmp(name, "Xtimerint") == 0 || 310 strcmp(name, "Xxen_intr_upcall") == 0) 311 frame_type = INTERRUPT; 312 else if (strcmp(name, "Xcpustop") == 0 || 313 strcmp(name, "Xrendezvous") == 0 || 314 strcmp(name, "Xipi_intr_bitmap_handler") == 0) { 315 /* No arguments. */ 316 frame_type = INTERRUPT; 317 } 318 } 319 320 /* 321 * Normal frames need no special processing. 322 */ 323 if (frame_type == NORMAL) { 324 *ip = (db_addr_t) eip; 325 *fp = (struct i386_frame *) ebp; 326 return; 327 } 328 329 db_print_stack_entry(name, 0, 0, 0, eip, &(*fp)->f_frame); 330 331 /* 332 * For a double fault, we have to snag the values from the 333 * previous TSS since a double fault uses a task gate to 334 * switch to a known good state. 335 */ 336 if (frame_type == DOUBLE_FAULT) { 337 esp = PCPU_GET(common_tssp)->tss_esp; 338 eip = PCPU_GET(common_tssp)->tss_eip; 339 ebp = PCPU_GET(common_tssp)->tss_ebp; 340 db_printf( 341 "--- trap 0x17, eip = %#r, esp = %#r, ebp = %#r ---\n", 342 eip, esp, ebp); 343 *ip = (db_addr_t) eip; 344 *fp = (struct i386_frame *) ebp; 345 return; 346 } 347 348 /* 349 * Point to base of trapframe which is just above the current 350 * frame. Pointer to it was put into %ebp by the kernel entry 351 * code. 352 */ 353 tf = (struct trapframe *)(*fp)->f_frame; 354 355 /* 356 * This can be the case for e.g. fork_trampoline, last frame 357 * of a kernel thread stack. 358 */ 359 if (tf == NULL) { 360 *ip = 0; 361 *fp = 0; 362 db_printf("--- kthread start\n"); 363 return; 364 } 365 366 esp = get_esp(tf); 367 eip = tf->tf_eip; 368 ebp = tf->tf_ebp; 369 switch (frame_type) { 370 case TRAP: 371 db_printf("--- trap %#r", tf->tf_trapno); 372 break; 373 case SYSCALL: 374 db_printf("--- syscall"); 375 db_decode_syscall(td, tf->tf_eax); 376 break; 377 case INTERRUPT: 378 db_printf("--- interrupt"); 379 break; 380 default: 381 panic("The moon has moved again."); 382 } 383 db_printf(", eip = %#r, esp = %#r, ebp = %#r ---\n", eip, esp, ebp); 384 385 /* 386 * Detect the last (trap) frame on the kernel stack, where we 387 * entered kernel from usermode. Terminate tracing in this 388 * case. 389 */ 390 switch (frame_type) { 391 case TRAP: 392 case INTERRUPT: 393 if (!TRAPF_USERMODE(tf)) 394 break; 395 /* FALLTHROUGH */ 396 case SYSCALL: 397 ebp = 0; 398 eip = 0; 399 break; 400 } 401 402 *ip = (db_addr_t) eip; 403 *fp = (struct i386_frame *) ebp; 404 } 405 406 static int 407 db_backtrace(struct thread *td, struct trapframe *tf, struct i386_frame *frame, 408 db_addr_t pc, register_t sp, int count) 409 { 410 struct i386_frame *actframe; 411 #define MAXNARG 16 412 char *argnames[MAXNARG], **argnp = NULL; 413 const char *name; 414 int *argp; 415 db_expr_t offset; 416 c_db_sym_t sym; 417 int instr, narg; 418 bool first; 419 420 if (db_segsize(tf) == 16) { 421 db_printf( 422 "--- 16-bit%s, cs:eip = %#x:%#x, ss:esp = %#x:%#x, ebp = %#x, tf = %p ---\n", 423 (tf->tf_eflags & PSL_VM) ? " (vm86)" : "", 424 tf->tf_cs, tf->tf_eip, 425 TF_HAS_STACKREGS(tf) ? tf->tf_ss : rss(), 426 TF_HAS_STACKREGS(tf) ? tf->tf_esp : (intptr_t)&tf->tf_esp, 427 tf->tf_ebp, tf); 428 return (0); 429 } 430 431 /* 'frame' can be null initially. Just print the pc then. */ 432 if (frame == NULL) 433 goto out; 434 435 /* 436 * If an indirect call via an invalid pointer caused a trap, 437 * %pc contains the invalid address while the return address 438 * of the unlucky caller has been saved by CPU on the stack 439 * just before the trap frame. In this case, try to recover 440 * the caller's address so that the first frame is assigned 441 * to the right spot in the right function, for that is where 442 * the failure actually happened. 443 * 444 * This trick depends on the fault address stashed in tf_err 445 * by trap_fatal() before entering KDB. 446 */ 447 if (kdb_frame && pc == kdb_frame->tf_err) { 448 /* 449 * Find where the trap frame actually ends. 450 * It won't contain tf_esp or tf_ss unless crossing rings. 451 */ 452 if (TF_HAS_STACKREGS(kdb_frame)) 453 instr = (int)(kdb_frame + 1); 454 else 455 instr = (int)&kdb_frame->tf_esp; 456 pc = db_get_value(instr, 4, false); 457 } 458 459 if (count == -1) 460 count = 1024; 461 462 first = true; 463 while (count-- && !db_pager_quit) { 464 sym = db_search_symbol(pc, DB_STGY_ANY, &offset); 465 db_symbol_values(sym, &name, NULL); 466 467 /* 468 * Attempt to determine a (possibly fake) frame that gives 469 * the caller's pc. It may differ from `frame' if the 470 * current function never sets up a standard frame or hasn't 471 * set one up yet or has just discarded one. The last two 472 * cases can be guessed fairly reliably for code generated 473 * by gcc. The first case is too much trouble to handle in 474 * general because the amount of junk on the stack depends 475 * on the pc (the special handling of "calltrap", etc. in 476 * db_nextframe() works because the `next' pc is special). 477 */ 478 actframe = frame; 479 if (first) { 480 first = false; 481 if (sym == C_DB_SYM_NULL && sp != 0) { 482 /* 483 * If a symbol couldn't be found, we've probably 484 * jumped to a bogus location, so try and use 485 * the return address to find our caller. 486 */ 487 db_print_stack_entry(name, 0, 0, 0, pc, 488 NULL); 489 pc = db_get_value(sp, 4, false); 490 if (db_search_symbol(pc, DB_STGY_PROC, 491 &offset) == C_DB_SYM_NULL) 492 break; 493 continue; 494 } else if (tf != NULL) { 495 instr = db_get_value(pc, 4, false); 496 if ((instr & 0xffffff) == 0x00e58955) { 497 /* pushl %ebp; movl %esp, %ebp */ 498 actframe = (void *)(get_esp(tf) - 4); 499 } else if ((instr & 0xffff) == 0x0000e589) { 500 /* movl %esp, %ebp */ 501 actframe = (void *)get_esp(tf); 502 if (tf->tf_ebp == 0) { 503 /* Fake frame better. */ 504 frame = actframe; 505 } 506 } else if ((instr & 0xff) == 0x000000c3) { 507 /* ret */ 508 actframe = (void *)(get_esp(tf) - 4); 509 } else if (offset == 0) { 510 /* Probably an assembler symbol. */ 511 actframe = (void *)(get_esp(tf) - 4); 512 } 513 } else if (strcmp(name, "fork_trampoline") == 0) { 514 /* 515 * Don't try to walk back on a stack for a 516 * process that hasn't actually been run yet. 517 */ 518 db_print_stack_entry(name, 0, 0, 0, pc, 519 actframe); 520 break; 521 } 522 } 523 524 argp = &actframe->f_arg0; 525 narg = MAXNARG; 526 if (sym != NULL && db_sym_numargs(sym, &narg, argnames)) { 527 argnp = argnames; 528 } else { 529 narg = db_numargs(frame); 530 } 531 532 db_print_stack_entry(name, narg, argnp, argp, pc, actframe); 533 534 if (actframe != frame) { 535 /* `frame' belongs to caller. */ 536 pc = (db_addr_t) 537 db_get_value((int)&actframe->f_retaddr, 4, false); 538 continue; 539 } 540 541 db_nextframe(&frame, &pc, td); 542 543 out: 544 /* 545 * 'frame' can be null here, either because it was initially 546 * null or because db_nextframe() found no frame. 547 * db_nextframe() may also have found a non-kernel frame. 548 * !INKERNEL() classifies both. Stop tracing if either, 549 * after printing the pc if it is the kernel. 550 */ 551 if (frame == NULL || frame <= actframe) { 552 if (pc != 0) { 553 sym = db_search_symbol(pc, DB_STGY_ANY, 554 &offset); 555 db_symbol_values(sym, &name, NULL); 556 db_print_stack_entry(name, 0, 0, 0, pc, frame); 557 } 558 break; 559 } 560 } 561 562 return (0); 563 } 564 565 void 566 db_trace_self(void) 567 { 568 struct i386_frame *frame; 569 db_addr_t callpc; 570 register_t ebp; 571 572 __asm __volatile("movl %%ebp,%0" : "=r" (ebp)); 573 frame = (struct i386_frame *)ebp; 574 callpc = (db_addr_t)db_get_value((int)&frame->f_retaddr, 4, false); 575 frame = frame->f_frame; 576 db_backtrace(curthread, NULL, frame, callpc, 0, -1); 577 } 578 579 int 580 db_trace_thread(struct thread *thr, int count) 581 { 582 struct pcb *ctx; 583 struct trapframe *tf; 584 585 ctx = kdb_thr_ctx(thr); 586 tf = thr == kdb_thread ? kdb_frame : NULL; 587 return (db_backtrace(thr, tf, (struct i386_frame *)ctx->pcb_ebp, 588 ctx->pcb_eip, ctx->pcb_esp, count)); 589 } 590 591 void 592 db_md_list_watchpoints(void) 593 { 594 595 dbreg_list_watchpoints(); 596 } 597