1 /*- 2 * Mach Operating System 3 * Copyright (c) 1991,1990 Carnegie Mellon University 4 * All Rights Reserved. 5 * 6 * Permission to use, copy, modify and distribute this software and its 7 * documentation is hereby granted, provided that both the copyright 8 * notice and this permission notice appear in all copies of the 9 * software, derivative works or modified versions, and any portions 10 * thereof, and that both notices appear in supporting documentation. 11 * 12 * CARNEGIE MELLON ALLOWS FREE USE OF THIS SOFTWARE IN ITS 13 * CONDITION. CARNEGIE MELLON DISCLAIMS ANY LIABILITY OF ANY KIND FOR 14 * ANY DAMAGES WHATSOEVER RESULTING FROM THE USE OF THIS SOFTWARE. 15 * 16 * Carnegie Mellon requests users of this software to return to 17 * 18 * Software Distribution Coordinator or Software.Distribution@CS.CMU.EDU 19 * School of Computer Science 20 * Carnegie Mellon University 21 * Pittsburgh PA 15213-3890 22 * 23 * any improvements or extensions that they make and grant Carnegie the 24 * rights to redistribute these changes. 25 */ 26 27 #include <sys/cdefs.h> 28 __FBSDID("$FreeBSD$"); 29 30 #include <sys/param.h> 31 #include <sys/systm.h> 32 #include <sys/kdb.h> 33 #include <sys/proc.h> 34 #include <sys/reg.h> 35 #include <sys/sysent.h> 36 37 #include <machine/cpu.h> 38 #include <machine/frame.h> 39 #include <machine/md_var.h> 40 #include <machine/pcb.h> 41 #include <machine/stack.h> 42 43 #include <vm/vm.h> 44 #include <vm/vm_param.h> 45 #include <vm/pmap.h> 46 47 #include <ddb/ddb.h> 48 #include <ddb/db_access.h> 49 #include <ddb/db_sym.h> 50 #include <ddb/db_variables.h> 51 52 static db_varfcn_t db_esp; 53 static db_varfcn_t db_frame; 54 static db_varfcn_t db_frame_seg; 55 static db_varfcn_t db_gs; 56 static db_varfcn_t db_ss; 57 58 /* 59 * Machine register set. 60 */ 61 #define DB_OFFSET(x) (db_expr_t *)offsetof(struct trapframe, x) 62 struct db_variable db_regs[] = { 63 { "cs", DB_OFFSET(tf_cs), db_frame_seg }, 64 { "ds", DB_OFFSET(tf_ds), db_frame_seg }, 65 { "es", DB_OFFSET(tf_es), db_frame_seg }, 66 { "fs", DB_OFFSET(tf_fs), db_frame_seg }, 67 { "gs", NULL, db_gs }, 68 { "ss", NULL, db_ss }, 69 { "eax", DB_OFFSET(tf_eax), db_frame }, 70 { "ecx", DB_OFFSET(tf_ecx), db_frame }, 71 { "edx", DB_OFFSET(tf_edx), db_frame }, 72 { "ebx", DB_OFFSET(tf_ebx), db_frame }, 73 { "esp", NULL, db_esp }, 74 { "ebp", DB_OFFSET(tf_ebp), db_frame }, 75 { "esi", DB_OFFSET(tf_esi), db_frame }, 76 { "edi", DB_OFFSET(tf_edi), db_frame }, 77 { "eip", DB_OFFSET(tf_eip), db_frame }, 78 { "efl", DB_OFFSET(tf_eflags), db_frame }, 79 }; 80 struct db_variable *db_eregs = db_regs + nitems(db_regs); 81 82 static __inline int 83 get_esp(struct trapframe *tf) 84 { 85 return (TF_HAS_STACKREGS(tf) ? tf->tf_esp : (intptr_t)&tf->tf_esp); 86 } 87 88 static int 89 db_frame(struct db_variable *vp, db_expr_t *valuep, int op) 90 { 91 int *reg; 92 93 if (kdb_frame == NULL) 94 return (0); 95 96 reg = (int *)((uintptr_t)kdb_frame + (db_expr_t)vp->valuep); 97 if (op == DB_VAR_GET) 98 *valuep = *reg; 99 else 100 *reg = *valuep; 101 return (1); 102 } 103 104 static int 105 db_frame_seg(struct db_variable *vp, db_expr_t *valuep, int op) 106 { 107 struct trapframe_vm86 *tfp; 108 int off; 109 uint16_t *reg; 110 111 if (kdb_frame == NULL) 112 return (0); 113 114 off = (intptr_t)vp->valuep; 115 if (kdb_frame->tf_eflags & PSL_VM) { 116 tfp = (void *)kdb_frame; 117 switch ((intptr_t)vp->valuep) { 118 case (intptr_t)DB_OFFSET(tf_cs): 119 reg = (uint16_t *)&tfp->tf_cs; 120 break; 121 case (intptr_t)DB_OFFSET(tf_ds): 122 reg = (uint16_t *)&tfp->tf_vm86_ds; 123 break; 124 case (intptr_t)DB_OFFSET(tf_es): 125 reg = (uint16_t *)&tfp->tf_vm86_es; 126 break; 127 case (intptr_t)DB_OFFSET(tf_fs): 128 reg = (uint16_t *)&tfp->tf_vm86_fs; 129 break; 130 } 131 } else 132 reg = (uint16_t *)((uintptr_t)kdb_frame + off); 133 if (op == DB_VAR_GET) 134 *valuep = *reg; 135 else 136 *reg = *valuep; 137 return (1); 138 } 139 140 static int 141 db_esp(struct db_variable *vp, db_expr_t *valuep, int op) 142 { 143 144 if (kdb_frame == NULL) 145 return (0); 146 147 if (op == DB_VAR_GET) 148 *valuep = get_esp(kdb_frame); 149 else if (TF_HAS_STACKREGS(kdb_frame)) 150 kdb_frame->tf_esp = *valuep; 151 return (1); 152 } 153 154 static int 155 db_gs(struct db_variable *vp, db_expr_t *valuep, int op) 156 { 157 struct trapframe_vm86 *tfp; 158 159 if (kdb_frame != NULL && kdb_frame->tf_eflags & PSL_VM) { 160 tfp = (void *)kdb_frame; 161 if (op == DB_VAR_GET) 162 *valuep = tfp->tf_vm86_gs; 163 else 164 tfp->tf_vm86_gs = *valuep; 165 return (1); 166 } 167 if (op == DB_VAR_GET) 168 *valuep = rgs(); 169 else 170 load_gs(*valuep); 171 return (1); 172 } 173 174 static int 175 db_ss(struct db_variable *vp, db_expr_t *valuep, int op) 176 { 177 178 if (kdb_frame == NULL) 179 return (0); 180 181 if (op == DB_VAR_GET) 182 *valuep = TF_HAS_STACKREGS(kdb_frame) ? kdb_frame->tf_ss : 183 rss(); 184 else if (TF_HAS_STACKREGS(kdb_frame)) 185 kdb_frame->tf_ss = *valuep; 186 return (1); 187 } 188 189 #define NORMAL 0 190 #define TRAP 1 191 #define INTERRUPT 2 192 #define SYSCALL 3 193 #define DOUBLE_FAULT 4 194 195 static void db_nextframe(struct i386_frame **, db_addr_t *, struct thread *); 196 static int db_numargs(struct i386_frame *); 197 static void db_print_stack_entry(const char *, int, char **, int *, db_addr_t, 198 void *); 199 static void decode_syscall(int, struct thread *); 200 201 /* 202 * Figure out how many arguments were passed into the frame at "fp". 203 */ 204 static int 205 db_numargs(fp) 206 struct i386_frame *fp; 207 { 208 char *argp; 209 int inst; 210 int args; 211 212 argp = (char *)db_get_value((int)&fp->f_retaddr, 4, false); 213 /* 214 * XXX etext is wrong for LKMs. We should attempt to interpret 215 * the instruction at the return address in all cases. This 216 * may require better fault handling. 217 */ 218 if (argp < btext || argp >= etext) { 219 args = -1; 220 } else { 221 retry: 222 inst = db_get_value((int)argp, 4, false); 223 if ((inst & 0xff) == 0x59) /* popl %ecx */ 224 args = 1; 225 else if ((inst & 0xffff) == 0xc483) /* addl $Ibs, %esp */ 226 args = ((inst >> 16) & 0xff) / 4; 227 else if ((inst & 0xf8ff) == 0xc089) { /* movl %eax, %Reg */ 228 argp += 2; 229 goto retry; 230 } else 231 args = -1; 232 } 233 return (args); 234 } 235 236 static void 237 db_print_stack_entry(name, narg, argnp, argp, callpc, frame) 238 const char *name; 239 int narg; 240 char **argnp; 241 int *argp; 242 db_addr_t callpc; 243 void *frame; 244 { 245 int n = narg >= 0 ? narg : 5; 246 247 db_printf("%s(", name); 248 while (n) { 249 if (argnp) 250 db_printf("%s=", *argnp++); 251 db_printf("%r", db_get_value((int)argp, 4, false)); 252 argp++; 253 if (--n != 0) 254 db_printf(","); 255 } 256 if (narg < 0) 257 db_printf(",..."); 258 db_printf(") at "); 259 db_printsym(callpc, DB_STGY_PROC); 260 if (frame != NULL) 261 db_printf("/frame 0x%r", (register_t)frame); 262 db_printf("\n"); 263 } 264 265 static void 266 decode_syscall(int number, struct thread *td) 267 { 268 struct proc *p; 269 c_db_sym_t sym; 270 db_expr_t diff; 271 sy_call_t *f; 272 const char *symname; 273 274 db_printf(" (%d", number); 275 p = (td != NULL) ? td->td_proc : NULL; 276 if (p != NULL && 0 <= number && number < p->p_sysent->sv_size) { 277 f = p->p_sysent->sv_table[number].sy_call; 278 sym = db_search_symbol((db_addr_t)f, DB_STGY_ANY, &diff); 279 if (sym != DB_SYM_NULL && diff == 0) { 280 db_symbol_values(sym, &symname, NULL); 281 db_printf(", %s, %s", p->p_sysent->sv_name, symname); 282 } 283 } 284 db_printf(")"); 285 } 286 287 /* 288 * Figure out the next frame up in the call stack. 289 */ 290 static void 291 db_nextframe(struct i386_frame **fp, db_addr_t *ip, struct thread *td) 292 { 293 struct trapframe *tf; 294 int frame_type; 295 int eip, esp, ebp; 296 db_expr_t offset; 297 c_db_sym_t sym; 298 const char *name; 299 300 eip = db_get_value((int) &(*fp)->f_retaddr, 4, false); 301 ebp = db_get_value((int) &(*fp)->f_frame, 4, false); 302 303 /* 304 * Figure out frame type. We look at the address just before 305 * the saved instruction pointer as the saved EIP is after the 306 * call function, and if the function being called is marked as 307 * dead (such as panic() at the end of dblfault_handler()), then 308 * the instruction at the saved EIP will be part of a different 309 * function (syscall() in this example) rather than the one that 310 * actually made the call. 311 */ 312 frame_type = NORMAL; 313 314 if (eip >= PMAP_TRM_MIN_ADDRESS) { 315 sym = db_search_symbol(eip - 1 - setidt_disp, DB_STGY_ANY, 316 &offset); 317 } else { 318 sym = db_search_symbol(eip - 1, DB_STGY_ANY, &offset); 319 } 320 db_symbol_values(sym, &name, NULL); 321 if (name != NULL) { 322 if (strcmp(name, "calltrap") == 0 || 323 strcmp(name, "fork_trampoline") == 0) 324 frame_type = TRAP; 325 else if (strncmp(name, "Xatpic_intr", 11) == 0 || 326 strncmp(name, "Xapic_isr", 9) == 0) { 327 frame_type = INTERRUPT; 328 } else if (strcmp(name, "Xlcall_syscall") == 0 || 329 strcmp(name, "Xint0x80_syscall") == 0) 330 frame_type = SYSCALL; 331 else if (strcmp(name, "dblfault_handler") == 0) 332 frame_type = DOUBLE_FAULT; 333 else if (strcmp(name, "Xtimerint") == 0 || 334 strcmp(name, "Xxen_intr_upcall") == 0) 335 frame_type = INTERRUPT; 336 else if (strcmp(name, "Xcpustop") == 0 || 337 strcmp(name, "Xrendezvous") == 0 || 338 strcmp(name, "Xipi_intr_bitmap_handler") == 0) { 339 /* No arguments. */ 340 frame_type = INTERRUPT; 341 } 342 } 343 344 /* 345 * Normal frames need no special processing. 346 */ 347 if (frame_type == NORMAL) { 348 *ip = (db_addr_t) eip; 349 *fp = (struct i386_frame *) ebp; 350 return; 351 } 352 353 db_print_stack_entry(name, 0, 0, 0, eip, &(*fp)->f_frame); 354 355 /* 356 * For a double fault, we have to snag the values from the 357 * previous TSS since a double fault uses a task gate to 358 * switch to a known good state. 359 */ 360 if (frame_type == DOUBLE_FAULT) { 361 esp = PCPU_GET(common_tssp)->tss_esp; 362 eip = PCPU_GET(common_tssp)->tss_eip; 363 ebp = PCPU_GET(common_tssp)->tss_ebp; 364 db_printf( 365 "--- trap 0x17, eip = %#r, esp = %#r, ebp = %#r ---\n", 366 eip, esp, ebp); 367 *ip = (db_addr_t) eip; 368 *fp = (struct i386_frame *) ebp; 369 return; 370 } 371 372 /* 373 * Point to base of trapframe which is just above the current 374 * frame. Pointer to it was put into %ebp by the kernel entry 375 * code. 376 */ 377 tf = (struct trapframe *)(*fp)->f_frame; 378 379 /* 380 * This can be the case for e.g. fork_trampoline, last frame 381 * of a kernel thread stack. 382 */ 383 if (tf == NULL) { 384 *ip = 0; 385 *fp = 0; 386 db_printf("--- kthread start\n"); 387 return; 388 } 389 390 esp = get_esp(tf); 391 eip = tf->tf_eip; 392 ebp = tf->tf_ebp; 393 switch (frame_type) { 394 case TRAP: 395 db_printf("--- trap %#r", tf->tf_trapno); 396 break; 397 case SYSCALL: 398 db_printf("--- syscall"); 399 decode_syscall(tf->tf_eax, td); 400 break; 401 case INTERRUPT: 402 db_printf("--- interrupt"); 403 break; 404 default: 405 panic("The moon has moved again."); 406 } 407 db_printf(", eip = %#r, esp = %#r, ebp = %#r ---\n", eip, esp, ebp); 408 409 /* 410 * Detect the last (trap) frame on the kernel stack, where we 411 * entered kernel from usermode. Terminate tracing in this 412 * case. 413 */ 414 switch (frame_type) { 415 case TRAP: 416 case INTERRUPT: 417 if (!TRAPF_USERMODE(tf)) 418 break; 419 /* FALLTHROUGH */ 420 case SYSCALL: 421 ebp = 0; 422 eip = 0; 423 break; 424 } 425 426 *ip = (db_addr_t) eip; 427 *fp = (struct i386_frame *) ebp; 428 } 429 430 static int 431 db_backtrace(struct thread *td, struct trapframe *tf, struct i386_frame *frame, 432 db_addr_t pc, register_t sp, int count) 433 { 434 struct i386_frame *actframe; 435 #define MAXNARG 16 436 char *argnames[MAXNARG], **argnp = NULL; 437 const char *name; 438 int *argp; 439 db_expr_t offset; 440 c_db_sym_t sym; 441 int instr, narg; 442 bool first; 443 444 if (db_segsize(tf) == 16) { 445 db_printf( 446 "--- 16-bit%s, cs:eip = %#x:%#x, ss:esp = %#x:%#x, ebp = %#x, tf = %p ---\n", 447 (tf->tf_eflags & PSL_VM) ? " (vm86)" : "", 448 tf->tf_cs, tf->tf_eip, 449 TF_HAS_STACKREGS(tf) ? tf->tf_ss : rss(), 450 TF_HAS_STACKREGS(tf) ? tf->tf_esp : (intptr_t)&tf->tf_esp, 451 tf->tf_ebp, tf); 452 return (0); 453 } 454 455 /* 'frame' can be null initially. Just print the pc then. */ 456 if (frame == NULL) 457 goto out; 458 459 /* 460 * If an indirect call via an invalid pointer caused a trap, 461 * %pc contains the invalid address while the return address 462 * of the unlucky caller has been saved by CPU on the stack 463 * just before the trap frame. In this case, try to recover 464 * the caller's address so that the first frame is assigned 465 * to the right spot in the right function, for that is where 466 * the failure actually happened. 467 * 468 * This trick depends on the fault address stashed in tf_err 469 * by trap_fatal() before entering KDB. 470 */ 471 if (kdb_frame && pc == kdb_frame->tf_err) { 472 /* 473 * Find where the trap frame actually ends. 474 * It won't contain tf_esp or tf_ss unless crossing rings. 475 */ 476 if (TF_HAS_STACKREGS(kdb_frame)) 477 instr = (int)(kdb_frame + 1); 478 else 479 instr = (int)&kdb_frame->tf_esp; 480 pc = db_get_value(instr, 4, false); 481 } 482 483 if (count == -1) 484 count = 1024; 485 486 first = true; 487 while (count-- && !db_pager_quit) { 488 sym = db_search_symbol(pc, DB_STGY_ANY, &offset); 489 db_symbol_values(sym, &name, NULL); 490 491 /* 492 * Attempt to determine a (possibly fake) frame that gives 493 * the caller's pc. It may differ from `frame' if the 494 * current function never sets up a standard frame or hasn't 495 * set one up yet or has just discarded one. The last two 496 * cases can be guessed fairly reliably for code generated 497 * by gcc. The first case is too much trouble to handle in 498 * general because the amount of junk on the stack depends 499 * on the pc (the special handling of "calltrap", etc. in 500 * db_nextframe() works because the `next' pc is special). 501 */ 502 actframe = frame; 503 if (first) { 504 first = false; 505 if (sym == C_DB_SYM_NULL && sp != 0) { 506 /* 507 * If a symbol couldn't be found, we've probably 508 * jumped to a bogus location, so try and use 509 * the return address to find our caller. 510 */ 511 db_print_stack_entry(name, 0, 0, 0, pc, 512 NULL); 513 pc = db_get_value(sp, 4, false); 514 if (db_search_symbol(pc, DB_STGY_PROC, 515 &offset) == C_DB_SYM_NULL) 516 break; 517 continue; 518 } else if (tf != NULL) { 519 instr = db_get_value(pc, 4, false); 520 if ((instr & 0xffffff) == 0x00e58955) { 521 /* pushl %ebp; movl %esp, %ebp */ 522 actframe = (void *)(get_esp(tf) - 4); 523 } else if ((instr & 0xffff) == 0x0000e589) { 524 /* movl %esp, %ebp */ 525 actframe = (void *)get_esp(tf); 526 if (tf->tf_ebp == 0) { 527 /* Fake frame better. */ 528 frame = actframe; 529 } 530 } else if ((instr & 0xff) == 0x000000c3) { 531 /* ret */ 532 actframe = (void *)(get_esp(tf) - 4); 533 } else if (offset == 0) { 534 /* Probably an assembler symbol. */ 535 actframe = (void *)(get_esp(tf) - 4); 536 } 537 } else if (strcmp(name, "fork_trampoline") == 0) { 538 /* 539 * Don't try to walk back on a stack for a 540 * process that hasn't actually been run yet. 541 */ 542 db_print_stack_entry(name, 0, 0, 0, pc, 543 actframe); 544 break; 545 } 546 } 547 548 argp = &actframe->f_arg0; 549 narg = MAXNARG; 550 if (sym != NULL && db_sym_numargs(sym, &narg, argnames)) { 551 argnp = argnames; 552 } else { 553 narg = db_numargs(frame); 554 } 555 556 db_print_stack_entry(name, narg, argnp, argp, pc, actframe); 557 558 if (actframe != frame) { 559 /* `frame' belongs to caller. */ 560 pc = (db_addr_t) 561 db_get_value((int)&actframe->f_retaddr, 4, false); 562 continue; 563 } 564 565 db_nextframe(&frame, &pc, td); 566 567 out: 568 /* 569 * 'frame' can be null here, either because it was initially 570 * null or because db_nextframe() found no frame. 571 * db_nextframe() may also have found a non-kernel frame. 572 * !INKERNEL() classifies both. Stop tracing if either, 573 * after printing the pc if it is the kernel. 574 */ 575 if (frame == NULL || frame <= actframe) { 576 if (pc != 0) { 577 sym = db_search_symbol(pc, DB_STGY_ANY, 578 &offset); 579 db_symbol_values(sym, &name, NULL); 580 db_print_stack_entry(name, 0, 0, 0, pc, frame); 581 } 582 break; 583 } 584 } 585 586 return (0); 587 } 588 589 void 590 db_trace_self(void) 591 { 592 struct i386_frame *frame; 593 db_addr_t callpc; 594 register_t ebp; 595 596 __asm __volatile("movl %%ebp,%0" : "=r" (ebp)); 597 frame = (struct i386_frame *)ebp; 598 callpc = (db_addr_t)db_get_value((int)&frame->f_retaddr, 4, false); 599 frame = frame->f_frame; 600 db_backtrace(curthread, NULL, frame, callpc, 0, -1); 601 } 602 603 int 604 db_trace_thread(struct thread *thr, int count) 605 { 606 struct pcb *ctx; 607 struct trapframe *tf; 608 609 ctx = kdb_thr_ctx(thr); 610 tf = thr == kdb_thread ? kdb_frame : NULL; 611 return (db_backtrace(thr, tf, (struct i386_frame *)ctx->pcb_ebp, 612 ctx->pcb_eip, ctx->pcb_esp, count)); 613 } 614 615 void 616 db_md_list_watchpoints(void) 617 { 618 619 dbreg_list_watchpoints(); 620 } 621