1 /*- 2 * Mach Operating System 3 * Copyright (c) 1991,1990 Carnegie Mellon University 4 * All Rights Reserved. 5 * 6 * Permission to use, copy, modify and distribute this software and its 7 * documentation is hereby granted, provided that both the copyright 8 * notice and this permission notice appear in all copies of the 9 * software, derivative works or modified versions, and any portions 10 * thereof, and that both notices appear in supporting documentation. 11 * 12 * CARNEGIE MELLON ALLOWS FREE USE OF THIS SOFTWARE IN ITS 13 * CONDITION. CARNEGIE MELLON DISCLAIMS ANY LIABILITY OF ANY KIND FOR 14 * ANY DAMAGES WHATSOEVER RESULTING FROM THE USE OF THIS SOFTWARE. 15 * 16 * Carnegie Mellon requests users of this software to return to 17 * 18 * Software Distribution Coordinator or Software.Distribution@CS.CMU.EDU 19 * School of Computer Science 20 * Carnegie Mellon University 21 * Pittsburgh PA 15213-3890 22 * 23 * any improvements or extensions that they make and grant Carnegie the 24 * rights to redistribute these changes. 25 */ 26 27 #include <sys/cdefs.h> 28 #include <sys/param.h> 29 #include <sys/systm.h> 30 #include <sys/kdb.h> 31 #include <sys/proc.h> 32 #include <sys/reg.h> 33 34 #include <machine/cpu.h> 35 #include <machine/frame.h> 36 #include <machine/md_var.h> 37 #include <machine/pcb.h> 38 #include <machine/stack.h> 39 40 #include <vm/vm.h> 41 #include <vm/vm_param.h> 42 #include <vm/pmap.h> 43 44 #include <ddb/ddb.h> 45 #include <ddb/db_access.h> 46 #include <ddb/db_sym.h> 47 #include <ddb/db_variables.h> 48 49 static db_varfcn_t db_esp; 50 static db_varfcn_t db_frame; 51 static db_varfcn_t db_frame_seg; 52 static db_varfcn_t db_gs; 53 static db_varfcn_t db_ss; 54 55 /* 56 * Machine register set. 57 */ 58 #define DB_OFFSET(x) (db_expr_t *)offsetof(struct trapframe, x) 59 struct db_variable db_regs[] = { 60 { "cs", DB_OFFSET(tf_cs), db_frame_seg }, 61 { "ds", DB_OFFSET(tf_ds), db_frame_seg }, 62 { "es", DB_OFFSET(tf_es), db_frame_seg }, 63 { "fs", DB_OFFSET(tf_fs), db_frame_seg }, 64 { "gs", NULL, db_gs }, 65 { "ss", NULL, db_ss }, 66 { "eax", DB_OFFSET(tf_eax), db_frame }, 67 { "ecx", DB_OFFSET(tf_ecx), db_frame }, 68 { "edx", DB_OFFSET(tf_edx), db_frame }, 69 { "ebx", DB_OFFSET(tf_ebx), db_frame }, 70 { "esp", NULL, db_esp }, 71 { "ebp", DB_OFFSET(tf_ebp), db_frame }, 72 { "esi", DB_OFFSET(tf_esi), db_frame }, 73 { "edi", DB_OFFSET(tf_edi), db_frame }, 74 { "eip", DB_OFFSET(tf_eip), db_frame }, 75 { "efl", DB_OFFSET(tf_eflags), db_frame }, 76 }; 77 struct db_variable *db_eregs = db_regs + nitems(db_regs); 78 79 static __inline int 80 get_esp(struct trapframe *tf) 81 { 82 return (TF_HAS_STACKREGS(tf) ? tf->tf_esp : (intptr_t)&tf->tf_esp); 83 } 84 85 static int 86 db_frame(struct db_variable *vp, db_expr_t *valuep, int op) 87 { 88 int *reg; 89 90 if (kdb_frame == NULL) 91 return (0); 92 93 reg = (int *)((uintptr_t)kdb_frame + (db_expr_t)vp->valuep); 94 if (op == DB_VAR_GET) 95 *valuep = *reg; 96 else 97 *reg = *valuep; 98 return (1); 99 } 100 101 static int 102 db_frame_seg(struct db_variable *vp, db_expr_t *valuep, int op) 103 { 104 struct trapframe_vm86 *tfp; 105 int off; 106 uint16_t *reg; 107 108 if (kdb_frame == NULL) 109 return (0); 110 111 off = (intptr_t)vp->valuep; 112 if (kdb_frame->tf_eflags & PSL_VM) { 113 tfp = (void *)kdb_frame; 114 switch ((intptr_t)vp->valuep) { 115 case (intptr_t)DB_OFFSET(tf_cs): 116 reg = (uint16_t *)&tfp->tf_cs; 117 break; 118 case (intptr_t)DB_OFFSET(tf_ds): 119 reg = (uint16_t *)&tfp->tf_vm86_ds; 120 break; 121 case (intptr_t)DB_OFFSET(tf_es): 122 reg = (uint16_t *)&tfp->tf_vm86_es; 123 break; 124 case (intptr_t)DB_OFFSET(tf_fs): 125 reg = (uint16_t *)&tfp->tf_vm86_fs; 126 break; 127 } 128 } else 129 reg = (uint16_t *)((uintptr_t)kdb_frame + off); 130 if (op == DB_VAR_GET) 131 *valuep = *reg; 132 else 133 *reg = *valuep; 134 return (1); 135 } 136 137 static int 138 db_esp(struct db_variable *vp, db_expr_t *valuep, int op) 139 { 140 141 if (kdb_frame == NULL) 142 return (0); 143 144 if (op == DB_VAR_GET) 145 *valuep = get_esp(kdb_frame); 146 else if (TF_HAS_STACKREGS(kdb_frame)) 147 kdb_frame->tf_esp = *valuep; 148 return (1); 149 } 150 151 static int 152 db_gs(struct db_variable *vp, db_expr_t *valuep, int op) 153 { 154 struct trapframe_vm86 *tfp; 155 156 if (kdb_frame != NULL && kdb_frame->tf_eflags & PSL_VM) { 157 tfp = (void *)kdb_frame; 158 if (op == DB_VAR_GET) 159 *valuep = tfp->tf_vm86_gs; 160 else 161 tfp->tf_vm86_gs = *valuep; 162 return (1); 163 } 164 if (op == DB_VAR_GET) 165 *valuep = rgs(); 166 else 167 load_gs(*valuep); 168 return (1); 169 } 170 171 static int 172 db_ss(struct db_variable *vp, db_expr_t *valuep, int op) 173 { 174 175 if (kdb_frame == NULL) 176 return (0); 177 178 if (op == DB_VAR_GET) 179 *valuep = TF_HAS_STACKREGS(kdb_frame) ? kdb_frame->tf_ss : 180 rss(); 181 else if (TF_HAS_STACKREGS(kdb_frame)) 182 kdb_frame->tf_ss = *valuep; 183 return (1); 184 } 185 186 #define NORMAL 0 187 #define TRAP 1 188 #define INTERRUPT 2 189 #define SYSCALL 3 190 #define DOUBLE_FAULT 4 191 192 static void db_nextframe(struct i386_frame **, db_addr_t *, struct thread *); 193 static int db_numargs(struct i386_frame *); 194 static void db_print_stack_entry(const char *, int, char **, int *, db_addr_t, 195 void *); 196 197 /* 198 * Figure out how many arguments were passed into the frame at "fp". 199 */ 200 static int 201 db_numargs(struct i386_frame *fp) 202 { 203 char *argp; 204 int inst; 205 int args; 206 207 argp = (char *)db_get_value((int)&fp->f_retaddr, 4, false); 208 /* 209 * XXX etext is wrong for LKMs. We should attempt to interpret 210 * the instruction at the return address in all cases. This 211 * may require better fault handling. 212 */ 213 if (argp < btext || argp >= etext) { 214 args = -1; 215 } else { 216 retry: 217 inst = db_get_value((int)argp, 4, false); 218 if ((inst & 0xff) == 0x59) /* popl %ecx */ 219 args = 1; 220 else if ((inst & 0xffff) == 0xc483) /* addl $Ibs, %esp */ 221 args = ((inst >> 16) & 0xff) / 4; 222 else if ((inst & 0xf8ff) == 0xc089) { /* movl %eax, %Reg */ 223 argp += 2; 224 goto retry; 225 } else 226 args = -1; 227 } 228 return (args); 229 } 230 231 static void 232 db_print_stack_entry(const char *name, int narg, char **argnp, int *argp, 233 db_addr_t callpc, void *frame) 234 { 235 int n = narg >= 0 ? narg : 5; 236 237 db_printf("%s(", name); 238 while (n) { 239 if (argnp) 240 db_printf("%s=", *argnp++); 241 db_printf("%r", db_get_value((int)argp, 4, false)); 242 argp++; 243 if (--n != 0) 244 db_printf(","); 245 } 246 if (narg < 0) 247 db_printf(",..."); 248 db_printf(") at "); 249 db_printsym(callpc, DB_STGY_PROC); 250 if (frame != NULL) 251 db_printf("/frame 0x%r", (register_t)frame); 252 db_printf("\n"); 253 } 254 255 /* 256 * Figure out the next frame up in the call stack. 257 */ 258 static void 259 db_nextframe(struct i386_frame **fp, db_addr_t *ip, struct thread *td) 260 { 261 struct trapframe *tf; 262 int frame_type; 263 int eip, esp, ebp; 264 db_expr_t offset; 265 c_db_sym_t sym; 266 const char *name; 267 268 eip = db_get_value((int) &(*fp)->f_retaddr, 4, false); 269 ebp = db_get_value((int) &(*fp)->f_frame, 4, false); 270 271 /* 272 * Figure out frame type. We look at the address just before 273 * the saved instruction pointer as the saved EIP is after the 274 * call function, and if the function being called is marked as 275 * dead (such as panic() at the end of dblfault_handler()), then 276 * the instruction at the saved EIP will be part of a different 277 * function (syscall() in this example) rather than the one that 278 * actually made the call. 279 */ 280 frame_type = NORMAL; 281 282 if (eip >= PMAP_TRM_MIN_ADDRESS) { 283 sym = db_search_symbol(eip - 1 - setidt_disp, DB_STGY_ANY, 284 &offset); 285 } else { 286 sym = db_search_symbol(eip - 1, DB_STGY_ANY, &offset); 287 } 288 db_symbol_values(sym, &name, NULL); 289 if (name != NULL) { 290 if (strcmp(name, "calltrap") == 0 || 291 strcmp(name, "fork_trampoline") == 0) 292 frame_type = TRAP; 293 else if (strncmp(name, "Xatpic_intr", 11) == 0 || 294 strncmp(name, "Xapic_isr", 9) == 0) { 295 frame_type = INTERRUPT; 296 } else if (strcmp(name, "Xlcall_syscall") == 0 || 297 strcmp(name, "Xint0x80_syscall") == 0) 298 frame_type = SYSCALL; 299 else if (strcmp(name, "dblfault_handler") == 0) 300 frame_type = DOUBLE_FAULT; 301 else if (strcmp(name, "Xtimerint") == 0 || 302 strcmp(name, "Xxen_intr_upcall") == 0) 303 frame_type = INTERRUPT; 304 else if (strcmp(name, "Xcpustop") == 0 || 305 strcmp(name, "Xrendezvous") == 0 || 306 strcmp(name, "Xipi_intr_bitmap_handler") == 0) { 307 /* No arguments. */ 308 frame_type = INTERRUPT; 309 } 310 } 311 312 /* 313 * Normal frames need no special processing. 314 */ 315 if (frame_type == NORMAL) { 316 *ip = (db_addr_t) eip; 317 *fp = (struct i386_frame *) ebp; 318 return; 319 } 320 321 db_print_stack_entry(name, 0, 0, 0, eip, &(*fp)->f_frame); 322 323 /* 324 * For a double fault, we have to snag the values from the 325 * previous TSS since a double fault uses a task gate to 326 * switch to a known good state. 327 */ 328 if (frame_type == DOUBLE_FAULT) { 329 esp = PCPU_GET(common_tssp)->tss_esp; 330 eip = PCPU_GET(common_tssp)->tss_eip; 331 ebp = PCPU_GET(common_tssp)->tss_ebp; 332 db_printf( 333 "--- trap 0x17, eip = %#r, esp = %#r, ebp = %#r ---\n", 334 eip, esp, ebp); 335 *ip = (db_addr_t) eip; 336 *fp = (struct i386_frame *) ebp; 337 return; 338 } 339 340 /* 341 * Point to base of trapframe which is just above the current 342 * frame. Pointer to it was put into %ebp by the kernel entry 343 * code. 344 */ 345 tf = (struct trapframe *)(*fp)->f_frame; 346 347 /* 348 * This can be the case for e.g. fork_trampoline, last frame 349 * of a kernel thread stack. 350 */ 351 if (tf == NULL) { 352 *ip = 0; 353 *fp = 0; 354 db_printf("--- kthread start\n"); 355 return; 356 } 357 358 esp = get_esp(tf); 359 eip = tf->tf_eip; 360 ebp = tf->tf_ebp; 361 switch (frame_type) { 362 case TRAP: 363 db_printf("--- trap %#r", tf->tf_trapno); 364 break; 365 case SYSCALL: 366 db_printf("--- syscall"); 367 db_decode_syscall(td, tf->tf_eax); 368 break; 369 case INTERRUPT: 370 db_printf("--- interrupt"); 371 break; 372 default: 373 panic("The moon has moved again."); 374 } 375 db_printf(", eip = %#r, esp = %#r, ebp = %#r ---\n", eip, esp, ebp); 376 377 /* 378 * Detect the last (trap) frame on the kernel stack, where we 379 * entered kernel from usermode. Terminate tracing in this 380 * case. 381 */ 382 switch (frame_type) { 383 case TRAP: 384 case INTERRUPT: 385 if (!TRAPF_USERMODE(tf)) 386 break; 387 /* FALLTHROUGH */ 388 case SYSCALL: 389 ebp = 0; 390 eip = 0; 391 break; 392 } 393 394 *ip = (db_addr_t) eip; 395 *fp = (struct i386_frame *) ebp; 396 } 397 398 static int 399 db_backtrace(struct thread *td, struct trapframe *tf, struct i386_frame *frame, 400 db_addr_t pc, register_t sp, int count) 401 { 402 struct i386_frame *actframe; 403 #define MAXNARG 16 404 char *argnames[MAXNARG], **argnp = NULL; 405 const char *name; 406 int *argp; 407 db_expr_t offset; 408 c_db_sym_t sym; 409 int instr, narg; 410 bool first; 411 412 if (db_segsize(tf) == 16) { 413 db_printf( 414 "--- 16-bit%s, cs:eip = %#x:%#x, ss:esp = %#x:%#x, ebp = %#x, tf = %p ---\n", 415 (tf->tf_eflags & PSL_VM) ? " (vm86)" : "", 416 tf->tf_cs, tf->tf_eip, 417 TF_HAS_STACKREGS(tf) ? tf->tf_ss : rss(), 418 TF_HAS_STACKREGS(tf) ? tf->tf_esp : (intptr_t)&tf->tf_esp, 419 tf->tf_ebp, tf); 420 return (0); 421 } 422 423 /* 'frame' can be null initially. Just print the pc then. */ 424 if (frame == NULL) 425 goto out; 426 427 /* 428 * If an indirect call via an invalid pointer caused a trap, 429 * %pc contains the invalid address while the return address 430 * of the unlucky caller has been saved by CPU on the stack 431 * just before the trap frame. In this case, try to recover 432 * the caller's address so that the first frame is assigned 433 * to the right spot in the right function, for that is where 434 * the failure actually happened. 435 * 436 * This trick depends on the fault address stashed in tf_err 437 * by trap_fatal() before entering KDB. 438 */ 439 if (kdb_frame && pc == kdb_frame->tf_err) { 440 /* 441 * Find where the trap frame actually ends. 442 * It won't contain tf_esp or tf_ss unless crossing rings. 443 */ 444 if (TF_HAS_STACKREGS(kdb_frame)) 445 instr = (int)(kdb_frame + 1); 446 else 447 instr = (int)&kdb_frame->tf_esp; 448 pc = db_get_value(instr, 4, false); 449 } 450 451 if (count == -1) 452 count = 1024; 453 454 first = true; 455 while (count-- && !db_pager_quit) { 456 sym = db_search_symbol(pc, DB_STGY_ANY, &offset); 457 db_symbol_values(sym, &name, NULL); 458 459 /* 460 * Attempt to determine a (possibly fake) frame that gives 461 * the caller's pc. It may differ from `frame' if the 462 * current function never sets up a standard frame or hasn't 463 * set one up yet or has just discarded one. The last two 464 * cases can be guessed fairly reliably for code generated 465 * by gcc. The first case is too much trouble to handle in 466 * general because the amount of junk on the stack depends 467 * on the pc (the special handling of "calltrap", etc. in 468 * db_nextframe() works because the `next' pc is special). 469 */ 470 actframe = frame; 471 if (first) { 472 first = false; 473 if (sym == C_DB_SYM_NULL && sp != 0) { 474 /* 475 * If a symbol couldn't be found, we've probably 476 * jumped to a bogus location, so try and use 477 * the return address to find our caller. 478 */ 479 db_print_stack_entry(name, 0, 0, 0, pc, 480 NULL); 481 pc = db_get_value(sp, 4, false); 482 if (db_search_symbol(pc, DB_STGY_PROC, 483 &offset) == C_DB_SYM_NULL) 484 break; 485 continue; 486 } else if (tf != NULL) { 487 instr = db_get_value(pc, 4, false); 488 if ((instr & 0xffffff) == 0x00e58955) { 489 /* pushl %ebp; movl %esp, %ebp */ 490 actframe = (void *)(get_esp(tf) - 4); 491 } else if ((instr & 0xffff) == 0x0000e589) { 492 /* movl %esp, %ebp */ 493 actframe = (void *)get_esp(tf); 494 if (tf->tf_ebp == 0) { 495 /* Fake frame better. */ 496 frame = actframe; 497 } 498 } else if ((instr & 0xff) == 0x000000c3) { 499 /* ret */ 500 actframe = (void *)(get_esp(tf) - 4); 501 } else if (offset == 0) { 502 /* Probably an assembler symbol. */ 503 actframe = (void *)(get_esp(tf) - 4); 504 } 505 } else if (strcmp(name, "fork_trampoline") == 0) { 506 /* 507 * Don't try to walk back on a stack for a 508 * process that hasn't actually been run yet. 509 */ 510 db_print_stack_entry(name, 0, 0, 0, pc, 511 actframe); 512 break; 513 } 514 } 515 516 argp = &actframe->f_arg0; 517 narg = MAXNARG; 518 if (sym != NULL && db_sym_numargs(sym, &narg, argnames)) { 519 argnp = argnames; 520 } else { 521 narg = db_numargs(frame); 522 } 523 524 db_print_stack_entry(name, narg, argnp, argp, pc, actframe); 525 526 if (actframe != frame) { 527 /* `frame' belongs to caller. */ 528 pc = (db_addr_t) 529 db_get_value((int)&actframe->f_retaddr, 4, false); 530 continue; 531 } 532 533 db_nextframe(&frame, &pc, td); 534 535 out: 536 /* 537 * 'frame' can be null here, either because it was initially 538 * null or because db_nextframe() found no frame. 539 * db_nextframe() may also have found a non-kernel frame. 540 * !INKERNEL() classifies both. Stop tracing if either, 541 * after printing the pc if it is the kernel. 542 */ 543 if (frame == NULL || frame <= actframe) { 544 if (pc != 0) { 545 sym = db_search_symbol(pc, DB_STGY_ANY, 546 &offset); 547 db_symbol_values(sym, &name, NULL); 548 db_print_stack_entry(name, 0, 0, 0, pc, frame); 549 } 550 break; 551 } 552 } 553 554 return (0); 555 } 556 557 void 558 db_trace_self(void) 559 { 560 struct i386_frame *frame; 561 db_addr_t callpc; 562 register_t ebp; 563 564 __asm __volatile("movl %%ebp,%0" : "=r" (ebp)); 565 frame = (struct i386_frame *)ebp; 566 callpc = (db_addr_t)db_get_value((int)&frame->f_retaddr, 4, false); 567 frame = frame->f_frame; 568 db_backtrace(curthread, NULL, frame, callpc, 0, -1); 569 } 570 571 int 572 db_trace_thread(struct thread *thr, int count) 573 { 574 struct pcb *ctx; 575 struct trapframe *tf; 576 577 ctx = kdb_thr_ctx(thr); 578 tf = thr == kdb_thread ? kdb_frame : NULL; 579 return (db_backtrace(thr, tf, (struct i386_frame *)ctx->pcb_ebp, 580 ctx->pcb_eip, ctx->pcb_esp, count)); 581 } 582 583 void 584 db_md_list_watchpoints(void) 585 { 586 587 dbreg_list_watchpoints(); 588 } 589