1 /*-
2 * Mach Operating System
3 * Copyright (c) 1991,1990 Carnegie Mellon University
4 * All Rights Reserved.
5 *
6 * Permission to use, copy, modify and distribute this software and its
7 * documentation is hereby granted, provided that both the copyright
8 * notice and this permission notice appear in all copies of the
9 * software, derivative works or modified versions, and any portions
10 * thereof, and that both notices appear in supporting documentation.
11 *
12 * CARNEGIE MELLON ALLOWS FREE USE OF THIS SOFTWARE IN ITS
13 * CONDITION. CARNEGIE MELLON DISCLAIMS ANY LIABILITY OF ANY KIND FOR
14 * ANY DAMAGES WHATSOEVER RESULTING FROM THE USE OF THIS SOFTWARE.
15 *
16 * Carnegie Mellon requests users of this software to return to
17 *
18 * Software Distribution Coordinator or Software.Distribution@CS.CMU.EDU
19 * School of Computer Science
20 * Carnegie Mellon University
21 * Pittsburgh PA 15213-3890
22 *
23 * any improvements or extensions that they make and grant Carnegie the
24 * rights to redistribute these changes.
25 */
26
27 #include <sys/cdefs.h>
28 __FBSDID("$FreeBSD$");
29
30 #include <sys/param.h>
31 #include <sys/systm.h>
32 #include <sys/kdb.h>
33 #include <sys/proc.h>
34 #include <sys/reg.h>
35
36 #include <machine/cpu.h>
37 #include <machine/frame.h>
38 #include <machine/md_var.h>
39 #include <machine/pcb.h>
40 #include <machine/stack.h>
41
42 #include <vm/vm.h>
43 #include <vm/vm_param.h>
44 #include <vm/pmap.h>
45
46 #include <ddb/ddb.h>
47 #include <ddb/db_access.h>
48 #include <ddb/db_sym.h>
49 #include <ddb/db_variables.h>
50
51 static db_varfcn_t db_esp;
52 static db_varfcn_t db_frame;
53 static db_varfcn_t db_frame_seg;
54 static db_varfcn_t db_gs;
55 static db_varfcn_t db_ss;
56
57 /*
58 * Machine register set.
59 */
60 #define DB_OFFSET(x) (db_expr_t *)offsetof(struct trapframe, x)
61 struct db_variable db_regs[] = {
62 { "cs", DB_OFFSET(tf_cs), db_frame_seg },
63 { "ds", DB_OFFSET(tf_ds), db_frame_seg },
64 { "es", DB_OFFSET(tf_es), db_frame_seg },
65 { "fs", DB_OFFSET(tf_fs), db_frame_seg },
66 { "gs", NULL, db_gs },
67 { "ss", NULL, db_ss },
68 { "eax", DB_OFFSET(tf_eax), db_frame },
69 { "ecx", DB_OFFSET(tf_ecx), db_frame },
70 { "edx", DB_OFFSET(tf_edx), db_frame },
71 { "ebx", DB_OFFSET(tf_ebx), db_frame },
72 { "esp", NULL, db_esp },
73 { "ebp", DB_OFFSET(tf_ebp), db_frame },
74 { "esi", DB_OFFSET(tf_esi), db_frame },
75 { "edi", DB_OFFSET(tf_edi), db_frame },
76 { "eip", DB_OFFSET(tf_eip), db_frame },
77 { "efl", DB_OFFSET(tf_eflags), db_frame },
78 };
79 struct db_variable *db_eregs = db_regs + nitems(db_regs);
80
81 static __inline int
82 get_esp(struct trapframe *tf)
83 {
84 return (TF_HAS_STACKREGS(tf) ? tf->tf_esp : (intptr_t)&tf->tf_esp);
85 }
86
87 static int
88 db_frame(struct db_variable *vp, db_expr_t *valuep, int op)
89 {
90 int *reg;
91
92 if (kdb_frame == NULL)
93 return (0);
94
95 reg = (int *)((uintptr_t)kdb_frame + (db_expr_t)vp->valuep);
96 if (op == DB_VAR_GET)
97 *valuep = *reg;
98 else
99 *reg = *valuep;
100 return (1);
101 }
102
103 static int
104 db_frame_seg(struct db_variable *vp, db_expr_t *valuep, int op)
105 {
106 struct trapframe_vm86 *tfp;
107 int off;
108 uint16_t *reg;
109
110 if (kdb_frame == NULL)
111 return (0);
112
113 off = (intptr_t)vp->valuep;
114 if (kdb_frame->tf_eflags & PSL_VM) {
115 tfp = (void *)kdb_frame;
116 switch ((intptr_t)vp->valuep) {
117 case (intptr_t)DB_OFFSET(tf_cs):
118 reg = (uint16_t *)&tfp->tf_cs;
119 break;
120 case (intptr_t)DB_OFFSET(tf_ds):
121 reg = (uint16_t *)&tfp->tf_vm86_ds;
122 break;
123 case (intptr_t)DB_OFFSET(tf_es):
124 reg = (uint16_t *)&tfp->tf_vm86_es;
125 break;
126 case (intptr_t)DB_OFFSET(tf_fs):
127 reg = (uint16_t *)&tfp->tf_vm86_fs;
128 break;
129 }
130 } else
131 reg = (uint16_t *)((uintptr_t)kdb_frame + off);
132 if (op == DB_VAR_GET)
133 *valuep = *reg;
134 else
135 *reg = *valuep;
136 return (1);
137 }
138
139 static int
140 db_esp(struct db_variable *vp, db_expr_t *valuep, int op)
141 {
142
143 if (kdb_frame == NULL)
144 return (0);
145
146 if (op == DB_VAR_GET)
147 *valuep = get_esp(kdb_frame);
148 else if (TF_HAS_STACKREGS(kdb_frame))
149 kdb_frame->tf_esp = *valuep;
150 return (1);
151 }
152
153 static int
154 db_gs(struct db_variable *vp, db_expr_t *valuep, int op)
155 {
156 struct trapframe_vm86 *tfp;
157
158 if (kdb_frame != NULL && kdb_frame->tf_eflags & PSL_VM) {
159 tfp = (void *)kdb_frame;
160 if (op == DB_VAR_GET)
161 *valuep = tfp->tf_vm86_gs;
162 else
163 tfp->tf_vm86_gs = *valuep;
164 return (1);
165 }
166 if (op == DB_VAR_GET)
167 *valuep = rgs();
168 else
169 load_gs(*valuep);
170 return (1);
171 }
172
173 static int
174 db_ss(struct db_variable *vp, db_expr_t *valuep, int op)
175 {
176
177 if (kdb_frame == NULL)
178 return (0);
179
180 if (op == DB_VAR_GET)
181 *valuep = TF_HAS_STACKREGS(kdb_frame) ? kdb_frame->tf_ss :
182 rss();
183 else if (TF_HAS_STACKREGS(kdb_frame))
184 kdb_frame->tf_ss = *valuep;
185 return (1);
186 }
187
188 #define NORMAL 0
189 #define TRAP 1
190 #define INTERRUPT 2
191 #define SYSCALL 3
192 #define DOUBLE_FAULT 4
193
194 static void db_nextframe(struct i386_frame **, db_addr_t *, struct thread *);
195 static int db_numargs(struct i386_frame *);
196 static void db_print_stack_entry(const char *, int, char **, int *, db_addr_t,
197 void *);
198
199 /*
200 * Figure out how many arguments were passed into the frame at "fp".
201 */
202 static int
203 db_numargs(fp)
204 struct i386_frame *fp;
205 {
206 char *argp;
207 int inst;
208 int args;
209
210 argp = (char *)db_get_value((int)&fp->f_retaddr, 4, false);
211 /*
212 * XXX etext is wrong for LKMs. We should attempt to interpret
213 * the instruction at the return address in all cases. This
214 * may require better fault handling.
215 */
216 if (argp < btext || argp >= etext) {
217 args = -1;
218 } else {
219 retry:
220 inst = db_get_value((int)argp, 4, false);
221 if ((inst & 0xff) == 0x59) /* popl %ecx */
222 args = 1;
223 else if ((inst & 0xffff) == 0xc483) /* addl $Ibs, %esp */
224 args = ((inst >> 16) & 0xff) / 4;
225 else if ((inst & 0xf8ff) == 0xc089) { /* movl %eax, %Reg */
226 argp += 2;
227 goto retry;
228 } else
229 args = -1;
230 }
231 return (args);
232 }
233
234 static void
235 db_print_stack_entry(name, narg, argnp, argp, callpc, frame)
236 const char *name;
237 int narg;
238 char **argnp;
239 int *argp;
240 db_addr_t callpc;
241 void *frame;
242 {
243 int n = narg >= 0 ? narg : 5;
244
245 db_printf("%s(", name);
246 while (n) {
247 if (argnp)
248 db_printf("%s=", *argnp++);
249 db_printf("%r", db_get_value((int)argp, 4, false));
250 argp++;
251 if (--n != 0)
252 db_printf(",");
253 }
254 if (narg < 0)
255 db_printf(",...");
256 db_printf(") at ");
257 db_printsym(callpc, DB_STGY_PROC);
258 if (frame != NULL)
259 db_printf("/frame 0x%r", (register_t)frame);
260 db_printf("\n");
261 }
262
263 /*
264 * Figure out the next frame up in the call stack.
265 */
266 static void
267 db_nextframe(struct i386_frame **fp, db_addr_t *ip, struct thread *td)
268 {
269 struct trapframe *tf;
270 int frame_type;
271 int eip, esp, ebp;
272 db_expr_t offset;
273 c_db_sym_t sym;
274 const char *name;
275
276 eip = db_get_value((int) &(*fp)->f_retaddr, 4, false);
277 ebp = db_get_value((int) &(*fp)->f_frame, 4, false);
278
279 /*
280 * Figure out frame type. We look at the address just before
281 * the saved instruction pointer as the saved EIP is after the
282 * call function, and if the function being called is marked as
283 * dead (such as panic() at the end of dblfault_handler()), then
284 * the instruction at the saved EIP will be part of a different
285 * function (syscall() in this example) rather than the one that
286 * actually made the call.
287 */
288 frame_type = NORMAL;
289
290 if (eip >= PMAP_TRM_MIN_ADDRESS) {
291 sym = db_search_symbol(eip - 1 - setidt_disp, DB_STGY_ANY,
292 &offset);
293 } else {
294 sym = db_search_symbol(eip - 1, DB_STGY_ANY, &offset);
295 }
296 db_symbol_values(sym, &name, NULL);
297 if (name != NULL) {
298 if (strcmp(name, "calltrap") == 0 ||
299 strcmp(name, "fork_trampoline") == 0)
300 frame_type = TRAP;
301 else if (strncmp(name, "Xatpic_intr", 11) == 0 ||
302 strncmp(name, "Xapic_isr", 9) == 0) {
303 frame_type = INTERRUPT;
304 } else if (strcmp(name, "Xlcall_syscall") == 0 ||
305 strcmp(name, "Xint0x80_syscall") == 0)
306 frame_type = SYSCALL;
307 else if (strcmp(name, "dblfault_handler") == 0)
308 frame_type = DOUBLE_FAULT;
309 else if (strcmp(name, "Xtimerint") == 0 ||
310 strcmp(name, "Xxen_intr_upcall") == 0)
311 frame_type = INTERRUPT;
312 else if (strcmp(name, "Xcpustop") == 0 ||
313 strcmp(name, "Xrendezvous") == 0 ||
314 strcmp(name, "Xipi_intr_bitmap_handler") == 0) {
315 /* No arguments. */
316 frame_type = INTERRUPT;
317 }
318 }
319
320 /*
321 * Normal frames need no special processing.
322 */
323 if (frame_type == NORMAL) {
324 *ip = (db_addr_t) eip;
325 *fp = (struct i386_frame *) ebp;
326 return;
327 }
328
329 db_print_stack_entry(name, 0, 0, 0, eip, &(*fp)->f_frame);
330
331 /*
332 * For a double fault, we have to snag the values from the
333 * previous TSS since a double fault uses a task gate to
334 * switch to a known good state.
335 */
336 if (frame_type == DOUBLE_FAULT) {
337 esp = PCPU_GET(common_tssp)->tss_esp;
338 eip = PCPU_GET(common_tssp)->tss_eip;
339 ebp = PCPU_GET(common_tssp)->tss_ebp;
340 db_printf(
341 "--- trap 0x17, eip = %#r, esp = %#r, ebp = %#r ---\n",
342 eip, esp, ebp);
343 *ip = (db_addr_t) eip;
344 *fp = (struct i386_frame *) ebp;
345 return;
346 }
347
348 /*
349 * Point to base of trapframe which is just above the current
350 * frame. Pointer to it was put into %ebp by the kernel entry
351 * code.
352 */
353 tf = (struct trapframe *)(*fp)->f_frame;
354
355 /*
356 * This can be the case for e.g. fork_trampoline, last frame
357 * of a kernel thread stack.
358 */
359 if (tf == NULL) {
360 *ip = 0;
361 *fp = 0;
362 db_printf("--- kthread start\n");
363 return;
364 }
365
366 esp = get_esp(tf);
367 eip = tf->tf_eip;
368 ebp = tf->tf_ebp;
369 switch (frame_type) {
370 case TRAP:
371 db_printf("--- trap %#r", tf->tf_trapno);
372 break;
373 case SYSCALL:
374 db_printf("--- syscall");
375 db_decode_syscall(td, tf->tf_eax);
376 break;
377 case INTERRUPT:
378 db_printf("--- interrupt");
379 break;
380 default:
381 panic("The moon has moved again.");
382 }
383 db_printf(", eip = %#r, esp = %#r, ebp = %#r ---\n", eip, esp, ebp);
384
385 /*
386 * Detect the last (trap) frame on the kernel stack, where we
387 * entered kernel from usermode. Terminate tracing in this
388 * case.
389 */
390 switch (frame_type) {
391 case TRAP:
392 case INTERRUPT:
393 if (!TRAPF_USERMODE(tf))
394 break;
395 /* FALLTHROUGH */
396 case SYSCALL:
397 ebp = 0;
398 eip = 0;
399 break;
400 }
401
402 *ip = (db_addr_t) eip;
403 *fp = (struct i386_frame *) ebp;
404 }
405
406 static int
407 db_backtrace(struct thread *td, struct trapframe *tf, struct i386_frame *frame,
408 db_addr_t pc, register_t sp, int count)
409 {
410 struct i386_frame *actframe;
411 #define MAXNARG 16
412 char *argnames[MAXNARG], **argnp = NULL;
413 const char *name;
414 int *argp;
415 db_expr_t offset;
416 c_db_sym_t sym;
417 int instr, narg;
418 bool first;
419
420 if (db_segsize(tf) == 16) {
421 db_printf(
422 "--- 16-bit%s, cs:eip = %#x:%#x, ss:esp = %#x:%#x, ebp = %#x, tf = %p ---\n",
423 (tf->tf_eflags & PSL_VM) ? " (vm86)" : "",
424 tf->tf_cs, tf->tf_eip,
425 TF_HAS_STACKREGS(tf) ? tf->tf_ss : rss(),
426 TF_HAS_STACKREGS(tf) ? tf->tf_esp : (intptr_t)&tf->tf_esp,
427 tf->tf_ebp, tf);
428 return (0);
429 }
430
431 /* 'frame' can be null initially. Just print the pc then. */
432 if (frame == NULL)
433 goto out;
434
435 /*
436 * If an indirect call via an invalid pointer caused a trap,
437 * %pc contains the invalid address while the return address
438 * of the unlucky caller has been saved by CPU on the stack
439 * just before the trap frame. In this case, try to recover
440 * the caller's address so that the first frame is assigned
441 * to the right spot in the right function, for that is where
442 * the failure actually happened.
443 *
444 * This trick depends on the fault address stashed in tf_err
445 * by trap_fatal() before entering KDB.
446 */
447 if (kdb_frame && pc == kdb_frame->tf_err) {
448 /*
449 * Find where the trap frame actually ends.
450 * It won't contain tf_esp or tf_ss unless crossing rings.
451 */
452 if (TF_HAS_STACKREGS(kdb_frame))
453 instr = (int)(kdb_frame + 1);
454 else
455 instr = (int)&kdb_frame->tf_esp;
456 pc = db_get_value(instr, 4, false);
457 }
458
459 if (count == -1)
460 count = 1024;
461
462 first = true;
463 while (count-- && !db_pager_quit) {
464 sym = db_search_symbol(pc, DB_STGY_ANY, &offset);
465 db_symbol_values(sym, &name, NULL);
466
467 /*
468 * Attempt to determine a (possibly fake) frame that gives
469 * the caller's pc. It may differ from `frame' if the
470 * current function never sets up a standard frame or hasn't
471 * set one up yet or has just discarded one. The last two
472 * cases can be guessed fairly reliably for code generated
473 * by gcc. The first case is too much trouble to handle in
474 * general because the amount of junk on the stack depends
475 * on the pc (the special handling of "calltrap", etc. in
476 * db_nextframe() works because the `next' pc is special).
477 */
478 actframe = frame;
479 if (first) {
480 first = false;
481 if (sym == C_DB_SYM_NULL && sp != 0) {
482 /*
483 * If a symbol couldn't be found, we've probably
484 * jumped to a bogus location, so try and use
485 * the return address to find our caller.
486 */
487 db_print_stack_entry(name, 0, 0, 0, pc,
488 NULL);
489 pc = db_get_value(sp, 4, false);
490 if (db_search_symbol(pc, DB_STGY_PROC,
491 &offset) == C_DB_SYM_NULL)
492 break;
493 continue;
494 } else if (tf != NULL) {
495 instr = db_get_value(pc, 4, false);
496 if ((instr & 0xffffff) == 0x00e58955) {
497 /* pushl %ebp; movl %esp, %ebp */
498 actframe = (void *)(get_esp(tf) - 4);
499 } else if ((instr & 0xffff) == 0x0000e589) {
500 /* movl %esp, %ebp */
501 actframe = (void *)get_esp(tf);
502 if (tf->tf_ebp == 0) {
503 /* Fake frame better. */
504 frame = actframe;
505 }
506 } else if ((instr & 0xff) == 0x000000c3) {
507 /* ret */
508 actframe = (void *)(get_esp(tf) - 4);
509 } else if (offset == 0) {
510 /* Probably an assembler symbol. */
511 actframe = (void *)(get_esp(tf) - 4);
512 }
513 } else if (strcmp(name, "fork_trampoline") == 0) {
514 /*
515 * Don't try to walk back on a stack for a
516 * process that hasn't actually been run yet.
517 */
518 db_print_stack_entry(name, 0, 0, 0, pc,
519 actframe);
520 break;
521 }
522 }
523
524 argp = &actframe->f_arg0;
525 narg = MAXNARG;
526 if (sym != NULL && db_sym_numargs(sym, &narg, argnames)) {
527 argnp = argnames;
528 } else {
529 narg = db_numargs(frame);
530 }
531
532 db_print_stack_entry(name, narg, argnp, argp, pc, actframe);
533
534 if (actframe != frame) {
535 /* `frame' belongs to caller. */
536 pc = (db_addr_t)
537 db_get_value((int)&actframe->f_retaddr, 4, false);
538 continue;
539 }
540
541 db_nextframe(&frame, &pc, td);
542
543 out:
544 /*
545 * 'frame' can be null here, either because it was initially
546 * null or because db_nextframe() found no frame.
547 * db_nextframe() may also have found a non-kernel frame.
548 * !INKERNEL() classifies both. Stop tracing if either,
549 * after printing the pc if it is the kernel.
550 */
551 if (frame == NULL || frame <= actframe) {
552 if (pc != 0) {
553 sym = db_search_symbol(pc, DB_STGY_ANY,
554 &offset);
555 db_symbol_values(sym, &name, NULL);
556 db_print_stack_entry(name, 0, 0, 0, pc, frame);
557 }
558 break;
559 }
560 }
561
562 return (0);
563 }
564
565 void
566 db_trace_self(void)
567 {
568 struct i386_frame *frame;
569 db_addr_t callpc;
570 register_t ebp;
571
572 __asm __volatile("movl %%ebp,%0" : "=r" (ebp));
573 frame = (struct i386_frame *)ebp;
574 callpc = (db_addr_t)db_get_value((int)&frame->f_retaddr, 4, false);
575 frame = frame->f_frame;
576 db_backtrace(curthread, NULL, frame, callpc, 0, -1);
577 }
578
579 int
580 db_trace_thread(struct thread *thr, int count)
581 {
582 struct pcb *ctx;
583 struct trapframe *tf;
584
585 ctx = kdb_thr_ctx(thr);
586 tf = thr == kdb_thread ? kdb_frame : NULL;
587 return (db_backtrace(thr, tf, (struct i386_frame *)ctx->pcb_ebp,
588 ctx->pcb_eip, ctx->pcb_esp, count));
589 }
590
591 void
592 db_md_list_watchpoints(void)
593 {
594
595 dbreg_list_watchpoints();
596 }
Cache object: c0e6ef92ce192d3b7d1f03a4f7228d42
|