1 /*-
2 * Mach Operating System
3 * Copyright (c) 1991,1990 Carnegie Mellon University
4 * All Rights Reserved.
5 *
6 * Permission to use, copy, modify and distribute this software and its
7 * documentation is hereby granted, provided that both the copyright
8 * notice and this permission notice appear in all copies of the
9 * software, derivative works or modified versions, and any portions
10 * thereof, and that both notices appear in supporting documentation.
11 *
12 * CARNEGIE MELLON ALLOWS FREE USE OF THIS SOFTWARE IN ITS
13 * CONDITION. CARNEGIE MELLON DISCLAIMS ANY LIABILITY OF ANY KIND FOR
14 * ANY DAMAGES WHATSOEVER RESULTING FROM THE USE OF THIS SOFTWARE.
15 *
16 * Carnegie Mellon requests users of this software to return to
17 *
18 * Software Distribution Coordinator or [email protected]
19 * School of Computer Science
20 * Carnegie Mellon University
21 * Pittsburgh PA 15213-3890
22 *
23 * any improvements or extensions that they make and grant Carnegie the
24 * rights to redistribute these changes.
25 */
26
27 #include <sys/cdefs.h>
28 #include <sys/param.h>
29 #include <sys/systm.h>
30 #include <sys/kdb.h>
31 #include <sys/proc.h>
32 #include <sys/reg.h>
33
34 #include <machine/cpu.h>
35 #include <machine/frame.h>
36 #include <machine/md_var.h>
37 #include <machine/pcb.h>
38 #include <machine/stack.h>
39
40 #include <vm/vm.h>
41 #include <vm/vm_param.h>
42 #include <vm/pmap.h>
43
44 #include <ddb/ddb.h>
45 #include <ddb/db_access.h>
46 #include <ddb/db_sym.h>
47 #include <ddb/db_variables.h>
48
49 static db_varfcn_t db_esp;
50 static db_varfcn_t db_frame;
51 static db_varfcn_t db_frame_seg;
52 static db_varfcn_t db_gs;
53 static db_varfcn_t db_ss;
54
55 /*
56 * Machine register set.
57 */
58 #define DB_OFFSET(x) (db_expr_t *)offsetof(struct trapframe, x)
59 struct db_variable db_regs[] = {
60 { "cs", DB_OFFSET(tf_cs), db_frame_seg },
61 { "ds", DB_OFFSET(tf_ds), db_frame_seg },
62 { "es", DB_OFFSET(tf_es), db_frame_seg },
63 { "fs", DB_OFFSET(tf_fs), db_frame_seg },
64 { "gs", NULL, db_gs },
65 { "ss", NULL, db_ss },
66 { "eax", DB_OFFSET(tf_eax), db_frame },
67 { "ecx", DB_OFFSET(tf_ecx), db_frame },
68 { "edx", DB_OFFSET(tf_edx), db_frame },
69 { "ebx", DB_OFFSET(tf_ebx), db_frame },
70 { "esp", NULL, db_esp },
71 { "ebp", DB_OFFSET(tf_ebp), db_frame },
72 { "esi", DB_OFFSET(tf_esi), db_frame },
73 { "edi", DB_OFFSET(tf_edi), db_frame },
74 { "eip", DB_OFFSET(tf_eip), db_frame },
75 { "efl", DB_OFFSET(tf_eflags), db_frame },
76 };
77 struct db_variable *db_eregs = db_regs + nitems(db_regs);
78
79 static __inline int
get_esp(struct trapframe * tf)80 get_esp(struct trapframe *tf)
81 {
82 return (TF_HAS_STACKREGS(tf) ? tf->tf_esp : (intptr_t)&tf->tf_esp);
83 }
84
85 static int
db_frame(struct db_variable * vp,db_expr_t * valuep,int op)86 db_frame(struct db_variable *vp, db_expr_t *valuep, int op)
87 {
88 int *reg;
89
90 if (kdb_frame == NULL)
91 return (0);
92
93 reg = (int *)((uintptr_t)kdb_frame + (db_expr_t)vp->valuep);
94 if (op == DB_VAR_GET)
95 *valuep = *reg;
96 else
97 *reg = *valuep;
98 return (1);
99 }
100
101 static int
db_frame_seg(struct db_variable * vp,db_expr_t * valuep,int op)102 db_frame_seg(struct db_variable *vp, db_expr_t *valuep, int op)
103 {
104 struct trapframe_vm86 *tfp;
105 int off;
106 uint16_t *reg;
107
108 if (kdb_frame == NULL)
109 return (0);
110
111 off = (intptr_t)vp->valuep;
112 if (kdb_frame->tf_eflags & PSL_VM) {
113 tfp = (void *)kdb_frame;
114 switch ((intptr_t)vp->valuep) {
115 case (intptr_t)DB_OFFSET(tf_cs):
116 reg = (uint16_t *)&tfp->tf_cs;
117 break;
118 case (intptr_t)DB_OFFSET(tf_ds):
119 reg = (uint16_t *)&tfp->tf_vm86_ds;
120 break;
121 case (intptr_t)DB_OFFSET(tf_es):
122 reg = (uint16_t *)&tfp->tf_vm86_es;
123 break;
124 case (intptr_t)DB_OFFSET(tf_fs):
125 reg = (uint16_t *)&tfp->tf_vm86_fs;
126 break;
127 }
128 } else
129 reg = (uint16_t *)((uintptr_t)kdb_frame + off);
130 if (op == DB_VAR_GET)
131 *valuep = *reg;
132 else
133 *reg = *valuep;
134 return (1);
135 }
136
137 static int
db_esp(struct db_variable * vp,db_expr_t * valuep,int op)138 db_esp(struct db_variable *vp, db_expr_t *valuep, int op)
139 {
140
141 if (kdb_frame == NULL)
142 return (0);
143
144 if (op == DB_VAR_GET)
145 *valuep = get_esp(kdb_frame);
146 else if (TF_HAS_STACKREGS(kdb_frame))
147 kdb_frame->tf_esp = *valuep;
148 return (1);
149 }
150
151 static int
db_gs(struct db_variable * vp,db_expr_t * valuep,int op)152 db_gs(struct db_variable *vp, db_expr_t *valuep, int op)
153 {
154 struct trapframe_vm86 *tfp;
155
156 if (kdb_frame != NULL && kdb_frame->tf_eflags & PSL_VM) {
157 tfp = (void *)kdb_frame;
158 if (op == DB_VAR_GET)
159 *valuep = tfp->tf_vm86_gs;
160 else
161 tfp->tf_vm86_gs = *valuep;
162 return (1);
163 }
164 if (op == DB_VAR_GET)
165 *valuep = rgs();
166 else
167 load_gs(*valuep);
168 return (1);
169 }
170
171 static int
db_ss(struct db_variable * vp,db_expr_t * valuep,int op)172 db_ss(struct db_variable *vp, db_expr_t *valuep, int op)
173 {
174
175 if (kdb_frame == NULL)
176 return (0);
177
178 if (op == DB_VAR_GET)
179 *valuep = TF_HAS_STACKREGS(kdb_frame) ? kdb_frame->tf_ss :
180 rss();
181 else if (TF_HAS_STACKREGS(kdb_frame))
182 kdb_frame->tf_ss = *valuep;
183 return (1);
184 }
185
186 #define NORMAL 0
187 #define TRAP 1
188 #define INTERRUPT 2
189 #define SYSCALL 3
190 #define DOUBLE_FAULT 4
191
192 static void db_nextframe(struct i386_frame **, db_addr_t *, struct thread *);
193 static int db_numargs(struct i386_frame *);
194 static void db_print_stack_entry(const char *, int, char **, int *, db_addr_t,
195 void *);
196
197 /*
198 * Figure out how many arguments were passed into the frame at "fp".
199 */
200 static int
db_numargs(struct i386_frame * fp)201 db_numargs(struct i386_frame *fp)
202 {
203 char *argp;
204 int inst;
205 int args;
206
207 argp = (char *)db_get_value((int)&fp->f_retaddr, 4, false);
208 /*
209 * XXX etext is wrong for LKMs. We should attempt to interpret
210 * the instruction at the return address in all cases. This
211 * may require better fault handling.
212 */
213 if (argp < btext || argp >= etext) {
214 args = -1;
215 } else {
216 retry:
217 inst = db_get_value((int)argp, 4, false);
218 if ((inst & 0xff) == 0x59) /* popl %ecx */
219 args = 1;
220 else if ((inst & 0xffff) == 0xc483) /* addl $Ibs, %esp */
221 args = ((inst >> 16) & 0xff) / 4;
222 else if ((inst & 0xf8ff) == 0xc089) { /* movl %eax, %Reg */
223 argp += 2;
224 goto retry;
225 } else
226 args = -1;
227 }
228 return (args);
229 }
230
231 static void
db_print_stack_entry(const char * name,int narg,char ** argnp,int * argp,db_addr_t callpc,void * frame)232 db_print_stack_entry(const char *name, int narg, char **argnp, int *argp,
233 db_addr_t callpc, void *frame)
234 {
235 int n = narg >= 0 ? narg : 5;
236
237 db_printf("%s(", name);
238 while (n) {
239 if (argnp)
240 db_printf("%s=", *argnp++);
241 db_printf("%r", db_get_value((int)argp, 4, false));
242 argp++;
243 if (--n != 0)
244 db_printf(",");
245 }
246 if (narg < 0)
247 db_printf(",...");
248 db_printf(") at ");
249 db_printsym(callpc, DB_STGY_PROC);
250 if (frame != NULL)
251 db_printf("/frame 0x%r", (register_t)frame);
252 db_printf("\n");
253 }
254
255 /*
256 * Figure out the next frame up in the call stack.
257 */
258 static void
db_nextframe(struct i386_frame ** fp,db_addr_t * ip,struct thread * td)259 db_nextframe(struct i386_frame **fp, db_addr_t *ip, struct thread *td)
260 {
261 struct trapframe *tf;
262 int frame_type;
263 int eip, esp, ebp;
264 db_expr_t offset;
265 c_db_sym_t sym;
266 const char *name;
267
268 eip = db_get_value((int) &(*fp)->f_retaddr, 4, false);
269 ebp = db_get_value((int) &(*fp)->f_frame, 4, false);
270
271 /*
272 * Figure out frame type. We look at the address just before
273 * the saved instruction pointer as the saved EIP is after the
274 * call function, and if the function being called is marked as
275 * dead (such as panic() at the end of dblfault_handler()), then
276 * the instruction at the saved EIP will be part of a different
277 * function (syscall() in this example) rather than the one that
278 * actually made the call.
279 */
280 frame_type = NORMAL;
281
282 if (eip >= PMAP_TRM_MIN_ADDRESS) {
283 sym = db_search_symbol(eip - 1 - setidt_disp, DB_STGY_ANY,
284 &offset);
285 } else {
286 sym = db_search_symbol(eip - 1, DB_STGY_ANY, &offset);
287 }
288 db_symbol_values(sym, &name, NULL);
289 if (name != NULL) {
290 if (strcmp(name, "calltrap") == 0 ||
291 strcmp(name, "fork_trampoline") == 0)
292 frame_type = TRAP;
293 else if (strncmp(name, "Xatpic_intr", 11) == 0 ||
294 strncmp(name, "Xapic_isr", 9) == 0) {
295 frame_type = INTERRUPT;
296 } else if (strcmp(name, "Xlcall_syscall") == 0 ||
297 strcmp(name, "Xint0x80_syscall") == 0)
298 frame_type = SYSCALL;
299 else if (strcmp(name, "dblfault_handler") == 0)
300 frame_type = DOUBLE_FAULT;
301 else if (strcmp(name, "Xtimerint") == 0 ||
302 strcmp(name, "Xxen_intr_upcall") == 0)
303 frame_type = INTERRUPT;
304 else if (strcmp(name, "Xcpustop") == 0 ||
305 strcmp(name, "Xrendezvous") == 0 ||
306 strcmp(name, "Xipi_intr_bitmap_handler") == 0) {
307 /* No arguments. */
308 frame_type = INTERRUPT;
309 }
310 }
311
312 /*
313 * Normal frames need no special processing.
314 */
315 if (frame_type == NORMAL) {
316 *ip = (db_addr_t) eip;
317 *fp = (struct i386_frame *) ebp;
318 return;
319 }
320
321 db_print_stack_entry(name, 0, 0, 0, eip, &(*fp)->f_frame);
322
323 /*
324 * For a double fault, we have to snag the values from the
325 * previous TSS since a double fault uses a task gate to
326 * switch to a known good state.
327 */
328 if (frame_type == DOUBLE_FAULT) {
329 esp = PCPU_GET(common_tssp)->tss_esp;
330 eip = PCPU_GET(common_tssp)->tss_eip;
331 ebp = PCPU_GET(common_tssp)->tss_ebp;
332 db_printf(
333 "--- trap 0x17, eip = %#r, esp = %#r, ebp = %#r ---\n",
334 eip, esp, ebp);
335 *ip = (db_addr_t) eip;
336 *fp = (struct i386_frame *) ebp;
337 return;
338 }
339
340 /*
341 * Point to base of trapframe which is just above the current
342 * frame. Pointer to it was put into %ebp by the kernel entry
343 * code.
344 */
345 tf = (struct trapframe *)(*fp)->f_frame;
346
347 /*
348 * This can be the case for e.g. fork_trampoline, last frame
349 * of a kernel thread stack.
350 */
351 if (tf == NULL) {
352 *ip = 0;
353 *fp = 0;
354 db_printf("--- kthread start\n");
355 return;
356 }
357
358 esp = get_esp(tf);
359 eip = tf->tf_eip;
360 ebp = tf->tf_ebp;
361 switch (frame_type) {
362 case TRAP:
363 db_printf("--- trap %#r", tf->tf_trapno);
364 break;
365 case SYSCALL:
366 db_printf("--- syscall");
367 db_decode_syscall(td, tf->tf_eax);
368 break;
369 case INTERRUPT:
370 db_printf("--- interrupt");
371 break;
372 default:
373 panic("The moon has moved again.");
374 }
375 db_printf(", eip = %#r, esp = %#r, ebp = %#r ---\n", eip, esp, ebp);
376
377 /*
378 * Detect the last (trap) frame on the kernel stack, where we
379 * entered kernel from usermode. Terminate tracing in this
380 * case.
381 */
382 switch (frame_type) {
383 case TRAP:
384 case INTERRUPT:
385 if (!TRAPF_USERMODE(tf))
386 break;
387 /* FALLTHROUGH */
388 case SYSCALL:
389 ebp = 0;
390 eip = 0;
391 break;
392 }
393
394 *ip = (db_addr_t) eip;
395 *fp = (struct i386_frame *) ebp;
396 }
397
398 static int
db_backtrace(struct thread * td,struct trapframe * tf,struct i386_frame * frame,db_addr_t pc,register_t sp,int count)399 db_backtrace(struct thread *td, struct trapframe *tf, struct i386_frame *frame,
400 db_addr_t pc, register_t sp, int count)
401 {
402 struct i386_frame *actframe;
403 #define MAXNARG 16
404 char *argnames[MAXNARG], **argnp = NULL;
405 const char *name;
406 int *argp;
407 db_expr_t offset;
408 c_db_sym_t sym;
409 int instr, narg;
410 bool first;
411
412 if (db_segsize(tf) == 16) {
413 db_printf(
414 "--- 16-bit%s, cs:eip = %#x:%#x, ss:esp = %#x:%#x, ebp = %#x, tf = %p ---\n",
415 (tf->tf_eflags & PSL_VM) ? " (vm86)" : "",
416 tf->tf_cs, tf->tf_eip,
417 TF_HAS_STACKREGS(tf) ? tf->tf_ss : rss(),
418 TF_HAS_STACKREGS(tf) ? tf->tf_esp : (intptr_t)&tf->tf_esp,
419 tf->tf_ebp, tf);
420 return (0);
421 }
422
423 /* 'frame' can be null initially. Just print the pc then. */
424 if (frame == NULL)
425 goto out;
426
427 /*
428 * If an indirect call via an invalid pointer caused a trap,
429 * %pc contains the invalid address while the return address
430 * of the unlucky caller has been saved by CPU on the stack
431 * just before the trap frame. In this case, try to recover
432 * the caller's address so that the first frame is assigned
433 * to the right spot in the right function, for that is where
434 * the failure actually happened.
435 *
436 * This trick depends on the fault address stashed in tf_err
437 * by trap_fatal() before entering KDB.
438 */
439 if (kdb_frame && pc == kdb_frame->tf_err) {
440 /*
441 * Find where the trap frame actually ends.
442 * It won't contain tf_esp or tf_ss unless crossing rings.
443 */
444 if (TF_HAS_STACKREGS(kdb_frame))
445 instr = (int)(kdb_frame + 1);
446 else
447 instr = (int)&kdb_frame->tf_esp;
448 pc = db_get_value(instr, 4, false);
449 }
450
451 if (count == -1)
452 count = 1024;
453
454 first = true;
455 while (count-- && !db_pager_quit) {
456 sym = db_search_symbol(pc, DB_STGY_ANY, &offset);
457 db_symbol_values(sym, &name, NULL);
458
459 /*
460 * Attempt to determine a (possibly fake) frame that gives
461 * the caller's pc. It may differ from `frame' if the
462 * current function never sets up a standard frame or hasn't
463 * set one up yet or has just discarded one. The last two
464 * cases can be guessed fairly reliably for code generated
465 * by gcc. The first case is too much trouble to handle in
466 * general because the amount of junk on the stack depends
467 * on the pc (the special handling of "calltrap", etc. in
468 * db_nextframe() works because the `next' pc is special).
469 */
470 actframe = frame;
471 if (first) {
472 first = false;
473 if (sym == C_DB_SYM_NULL && sp != 0) {
474 /*
475 * If a symbol couldn't be found, we've probably
476 * jumped to a bogus location, so try and use
477 * the return address to find our caller.
478 */
479 db_print_stack_entry(name, 0, 0, 0, pc,
480 NULL);
481 pc = db_get_value(sp, 4, false);
482 if (db_search_symbol(pc, DB_STGY_PROC,
483 &offset) == C_DB_SYM_NULL)
484 break;
485 continue;
486 } else if (tf != NULL) {
487 instr = db_get_value(pc, 4, false);
488 if ((instr & 0xffffff) == 0x00e58955) {
489 /* pushl %ebp; movl %esp, %ebp */
490 actframe = (void *)(get_esp(tf) - 4);
491 } else if ((instr & 0xffff) == 0x0000e589) {
492 /* movl %esp, %ebp */
493 actframe = (void *)get_esp(tf);
494 if (tf->tf_ebp == 0) {
495 /* Fake frame better. */
496 frame = actframe;
497 }
498 } else if ((instr & 0xff) == 0x000000c3) {
499 /* ret */
500 actframe = (void *)(get_esp(tf) - 4);
501 } else if (offset == 0) {
502 /* Probably an assembler symbol. */
503 actframe = (void *)(get_esp(tf) - 4);
504 }
505 } else if (strcmp(name, "fork_trampoline") == 0) {
506 /*
507 * Don't try to walk back on a stack for a
508 * process that hasn't actually been run yet.
509 */
510 db_print_stack_entry(name, 0, 0, 0, pc,
511 actframe);
512 break;
513 }
514 }
515
516 argp = &actframe->f_arg0;
517 narg = MAXNARG;
518 if (sym != NULL && db_sym_numargs(sym, &narg, argnames)) {
519 argnp = argnames;
520 } else {
521 narg = db_numargs(frame);
522 }
523
524 db_print_stack_entry(name, narg, argnp, argp, pc, actframe);
525
526 if (actframe != frame) {
527 /* `frame' belongs to caller. */
528 pc = (db_addr_t)
529 db_get_value((int)&actframe->f_retaddr, 4, false);
530 continue;
531 }
532
533 db_nextframe(&frame, &pc, td);
534
535 out:
536 /*
537 * 'frame' can be null here, either because it was initially
538 * null or because db_nextframe() found no frame.
539 * db_nextframe() may also have found a non-kernel frame.
540 * !INKERNEL() classifies both. Stop tracing if either,
541 * after printing the pc if it is the kernel.
542 */
543 if (frame == NULL || frame <= actframe) {
544 if (pc != 0) {
545 sym = db_search_symbol(pc, DB_STGY_ANY,
546 &offset);
547 db_symbol_values(sym, &name, NULL);
548 db_print_stack_entry(name, 0, 0, 0, pc, frame);
549 }
550 break;
551 }
552 }
553
554 return (0);
555 }
556
557 void
db_trace_self(void)558 db_trace_self(void)
559 {
560 struct i386_frame *frame;
561 db_addr_t callpc;
562 register_t ebp;
563
564 __asm __volatile("movl %%ebp,%0" : "=r" (ebp));
565 frame = (struct i386_frame *)ebp;
566 callpc = (db_addr_t)db_get_value((int)&frame->f_retaddr, 4, false);
567 frame = frame->f_frame;
568 db_backtrace(curthread, NULL, frame, callpc, 0, -1);
569 }
570
571 int
db_trace_thread(struct thread * thr,int count)572 db_trace_thread(struct thread *thr, int count)
573 {
574 struct pcb *ctx;
575 struct trapframe *tf;
576
577 ctx = kdb_thr_ctx(thr);
578 tf = thr == kdb_thread ? kdb_frame : NULL;
579 return (db_backtrace(thr, tf, (struct i386_frame *)ctx->pcb_ebp,
580 ctx->pcb_eip, ctx->pcb_esp, count));
581 }
582
583 void
db_md_list_watchpoints(void)584 db_md_list_watchpoints(void)
585 {
586
587 dbreg_list_watchpoints();
588 }
589