1/*-
2 * Mach Operating System
3 * Copyright (c) 1991,1990 Carnegie Mellon University
4 * All Rights Reserved.
5 *
6 * Permission to use, copy, modify and distribute this software and its
7 * documentation is hereby granted, provided that both the copyright
8 * notice and this permission notice appear in all copies of the
9 * software, derivative works or modified versions, and any portions
10 * thereof, and that both notices appear in supporting documentation.
11 *
12 * CARNEGIE MELLON ALLOWS FREE USE OF THIS SOFTWARE IN ITS
13 * CONDITION.  CARNEGIE MELLON DISCLAIMS ANY LIABILITY OF ANY KIND FOR
14 * ANY DAMAGES WHATSOEVER RESULTING FROM THE USE OF THIS SOFTWARE.
15 *
16 * Carnegie Mellon requests users of this software to return to
17 *
18 *  Software Distribution Coordinator  or  Software.Distribution@CS.CMU.EDU
19 *  School of Computer Science
20 *  Carnegie Mellon University
21 *  Pittsburgh PA 15213-3890
22 *
23 * any improvements or extensions that they make and grant Carnegie the
24 * rights to redistribute these changes.
25 */
26
27#include <sys/cdefs.h>
28__FBSDID("$FreeBSD: stable/10/sys/amd64/amd64/db_trace.c 330132 2018-02-28 22:33:07Z jhb $");
29
30#include "opt_compat.h"
31
32#include <sys/param.h>
33#include <sys/systm.h>
34#include <sys/kdb.h>
35#include <sys/proc.h>
36#include <sys/smp.h>
37#include <sys/stack.h>
38#include <sys/sysent.h>
39
40#include <machine/cpu.h>
41#include <machine/md_var.h>
42#include <machine/pcb.h>
43#include <machine/reg.h>
44#include <machine/stack.h>
45
46#include <vm/vm.h>
47#include <vm/vm_param.h>
48#include <vm/pmap.h>
49
50#include <ddb/ddb.h>
51#include <ddb/db_access.h>
52#include <ddb/db_sym.h>
53#include <ddb/db_variables.h>
54
55static db_varfcn_t db_frame;
56static db_varfcn_t db_frame_seg;
57
58CTASSERT(sizeof(struct dbreg) == sizeof(((struct pcpu *)NULL)->pc_dbreg));
59
60/*
61 * Machine register set.
62 */
63#define	DB_OFFSET(x)	(db_expr_t *)offsetof(struct trapframe, x)
64struct db_variable db_regs[] = {
65	{ "cs",		DB_OFFSET(tf_cs),	db_frame_seg },
66	{ "ds",		DB_OFFSET(tf_ds),	db_frame_seg },
67	{ "es",		DB_OFFSET(tf_es),	db_frame_seg },
68	{ "fs",		DB_OFFSET(tf_fs),	db_frame_seg },
69	{ "gs",		DB_OFFSET(tf_gs),	db_frame_seg },
70	{ "ss",		DB_OFFSET(tf_ss),	db_frame_seg },
71	{ "rax",	DB_OFFSET(tf_rax),	db_frame },
72	{ "rcx",        DB_OFFSET(tf_rcx),	db_frame },
73	{ "rdx",	DB_OFFSET(tf_rdx),	db_frame },
74	{ "rbx",	DB_OFFSET(tf_rbx),	db_frame },
75	{ "rsp",	DB_OFFSET(tf_rsp),	db_frame },
76	{ "rbp",	DB_OFFSET(tf_rbp),	db_frame },
77	{ "rsi",	DB_OFFSET(tf_rsi),	db_frame },
78	{ "rdi",	DB_OFFSET(tf_rdi),	db_frame },
79	{ "r8",		DB_OFFSET(tf_r8),	db_frame },
80	{ "r9",		DB_OFFSET(tf_r9),	db_frame },
81	{ "r10",	DB_OFFSET(tf_r10),	db_frame },
82	{ "r11",	DB_OFFSET(tf_r11),	db_frame },
83	{ "r12",	DB_OFFSET(tf_r12),	db_frame },
84	{ "r13",	DB_OFFSET(tf_r13),	db_frame },
85	{ "r14",	DB_OFFSET(tf_r14),	db_frame },
86	{ "r15",	DB_OFFSET(tf_r15),	db_frame },
87	{ "rip",	DB_OFFSET(tf_rip),	db_frame },
88	{ "rflags",	DB_OFFSET(tf_rflags),	db_frame },
89};
90struct db_variable *db_eregs = db_regs + nitems(db_regs);
91
92static int
93db_frame_seg(struct db_variable *vp, db_expr_t *valuep, int op)
94{
95	uint16_t *reg;
96
97	if (kdb_frame == NULL)
98		return (0);
99
100	reg = (uint16_t *)((uintptr_t)kdb_frame + (db_expr_t)vp->valuep);
101	if (op == DB_VAR_GET)
102		*valuep = *reg;
103	else
104		*reg = *valuep;
105	return (1);
106}
107
108static int
109db_frame(struct db_variable *vp, db_expr_t *valuep, int op)
110{
111	long *reg;
112
113	if (kdb_frame == NULL)
114		return (0);
115
116	reg = (long *)((uintptr_t)kdb_frame + (db_expr_t)vp->valuep);
117	if (op == DB_VAR_GET)
118		*valuep = *reg;
119	else
120		*reg = *valuep;
121	return (1);
122}
123
124#define NORMAL		0
125#define	TRAP		1
126#define	INTERRUPT	2
127#define	SYSCALL		3
128#define	TRAP_INTERRUPT	5
129
130static void db_nextframe(struct amd64_frame **, db_addr_t *, struct thread *);
131static void db_print_stack_entry(const char *, db_addr_t, void *);
132static void decode_syscall(int, struct thread *);
133
134static const char * watchtype_str(int type);
135int  amd64_set_watch(int watchnum, unsigned long watchaddr, int size,
136		    int access, struct dbreg *d);
137int  amd64_clr_watch(int watchnum, struct dbreg *d);
138
139static void
140db_print_stack_entry(const char *name, db_addr_t callpc, void *frame)
141{
142
143	db_printf("%s() at ", name != NULL ? name : "??");
144	db_printsym(callpc, DB_STGY_PROC);
145	if (frame != NULL)
146		db_printf("/frame 0x%lx", (register_t)frame);
147	db_printf("\n");
148}
149
150static void
151decode_syscall(int number, struct thread *td)
152{
153	struct proc *p;
154	c_db_sym_t sym;
155	db_expr_t diff;
156	sy_call_t *f;
157	const char *symname;
158
159	db_printf(" (%d", number);
160	p = (td != NULL) ? td->td_proc : NULL;
161	if (p != NULL && 0 <= number && number < p->p_sysent->sv_size) {
162		f = p->p_sysent->sv_table[number].sy_call;
163		sym = db_search_symbol((db_addr_t)f, DB_STGY_ANY, &diff);
164		if (sym != DB_SYM_NULL && diff == 0) {
165			db_symbol_values(sym, &symname, NULL);
166			db_printf(", %s, %s", p->p_sysent->sv_name, symname);
167		}
168	}
169	db_printf(")");
170}
171
172/*
173 * Figure out the next frame up in the call stack.
174 */
175static void
176db_nextframe(struct amd64_frame **fp, db_addr_t *ip, struct thread *td)
177{
178	struct trapframe *tf;
179	int frame_type;
180	long rip, rsp, rbp;
181	db_expr_t offset;
182	c_db_sym_t sym;
183	const char *name;
184
185	rip = db_get_value((long) &(*fp)->f_retaddr, 8, FALSE);
186	rbp = db_get_value((long) &(*fp)->f_frame, 8, FALSE);
187
188	/*
189	 * Figure out frame type.  We look at the address just before
190	 * the saved instruction pointer as the saved EIP is after the
191	 * call function, and if the function being called is marked as
192	 * dead (such as panic() at the end of dblfault_handler()), then
193	 * the instruction at the saved EIP will be part of a different
194	 * function (syscall() in this example) rather than the one that
195	 * actually made the call.
196	 */
197	frame_type = NORMAL;
198	sym = db_search_symbol(rip - 1, DB_STGY_ANY, &offset);
199	db_symbol_values(sym, &name, NULL);
200	if (name != NULL) {
201		if (strcmp(name, "calltrap") == 0 ||
202		    strcmp(name, "fork_trampoline") == 0 ||
203		    strcmp(name, "nmi_calltrap") == 0 ||
204		    strcmp(name, "Xdblfault") == 0)
205			frame_type = TRAP;
206		else if (strncmp(name, "Xatpic_intr", 11) == 0 ||
207		    strncmp(name, "Xapic_isr", 9) == 0 ||
208		    strcmp(name, "Xtimerint") == 0 ||
209		    strcmp(name, "Xipi_intr_bitmap_handler") == 0 ||
210		    strcmp(name, "Xcpustop") == 0 ||
211		    strcmp(name, "Xcpususpend") == 0 ||
212		    strcmp(name, "Xrendezvous") == 0)
213			frame_type = INTERRUPT;
214		else if (strcmp(name, "Xfast_syscall") == 0)
215			frame_type = SYSCALL;
216#ifdef COMPAT_FREEBSD32
217		else if (strcmp(name, "Xint0x80_syscall") == 0)
218			frame_type = SYSCALL;
219#endif
220		/* XXX: These are interrupts with trap frames. */
221		else if (strcmp(name, "Xtimerint") == 0 ||
222		    strcmp(name, "Xcpustop") == 0 ||
223		    strcmp(name, "Xcpususpend") == 0 ||
224		    strcmp(name, "Xrendezvous") == 0 ||
225		    strcmp(name, "Xipi_intr_bitmap_handler") == 0)
226			frame_type = TRAP_INTERRUPT;
227	}
228
229	/*
230	 * Normal frames need no special processing.
231	 */
232	if (frame_type == NORMAL) {
233		*ip = (db_addr_t) rip;
234		*fp = (struct amd64_frame *) rbp;
235		return;
236	}
237
238	db_print_stack_entry(name, rip, &(*fp)->f_frame);
239
240	/*
241	 * Point to base of trapframe which is just above the
242	 * current frame.
243	 */
244	tf = (struct trapframe *)((long)*fp + 16);
245
246	if (INKERNEL((long) tf)) {
247		rsp = tf->tf_rsp;
248		rip = tf->tf_rip;
249		rbp = tf->tf_rbp;
250		switch (frame_type) {
251		case TRAP:
252			db_printf("--- trap %#r", tf->tf_trapno);
253			break;
254		case SYSCALL:
255			db_printf("--- syscall");
256			decode_syscall(tf->tf_rax, td);
257			break;
258		case TRAP_INTERRUPT:
259		case INTERRUPT:
260			db_printf("--- interrupt");
261			break;
262		default:
263			panic("The moon has moved again.");
264		}
265		db_printf(", rip = %#lr, rsp = %#lr, rbp = %#lr ---\n", rip,
266		    rsp, rbp);
267	}
268
269	*ip = (db_addr_t) rip;
270	*fp = (struct amd64_frame *) rbp;
271}
272
273static int
274db_backtrace(struct thread *td, struct trapframe *tf, struct amd64_frame *frame,
275    db_addr_t pc, register_t sp, int count)
276{
277	struct amd64_frame *actframe;
278	const char *name;
279	db_expr_t offset;
280	c_db_sym_t sym;
281	boolean_t first;
282
283	if (count == -1)
284		count = 1024;
285
286	first = TRUE;
287	while (count-- && !db_pager_quit) {
288		sym = db_search_symbol(pc, DB_STGY_ANY, &offset);
289		db_symbol_values(sym, &name, NULL);
290
291		/*
292		 * Attempt to determine a (possibly fake) frame that gives
293		 * the caller's pc.  It may differ from `frame' if the
294		 * current function never sets up a standard frame or hasn't
295		 * set one up yet or has just discarded one.  The last two
296		 * cases can be guessed fairly reliably for code generated
297		 * by gcc.  The first case is too much trouble to handle in
298		 * general because the amount of junk on the stack depends
299		 * on the pc (the special handling of "calltrap", etc. in
300		 * db_nextframe() works because the `next' pc is special).
301		 */
302		actframe = frame;
303		if (first) {
304			first = FALSE;
305			if (sym == C_DB_SYM_NULL && sp != 0) {
306				/*
307				 * If a symbol couldn't be found, we've probably
308				 * jumped to a bogus location, so try and use
309				 * the return address to find our caller.
310				 */
311				db_print_stack_entry(name, pc, NULL);
312				pc = db_get_value(sp, 8, FALSE);
313				if (db_search_symbol(pc, DB_STGY_PROC,
314				    &offset) == C_DB_SYM_NULL)
315					break;
316				continue;
317			} else if (tf != NULL) {
318				int instr;
319
320				instr = db_get_value(pc, 4, FALSE);
321				if ((instr & 0xffffffff) == 0xe5894855) {
322					/* pushq %rbp; movq %rsp, %rbp */
323					actframe = (void *)(tf->tf_rsp - 8);
324				} else if ((instr & 0xffffff) == 0xe58948) {
325					/* movq %rsp, %rbp */
326					actframe = (void *)tf->tf_rsp;
327					if (tf->tf_rbp == 0) {
328						/* Fake frame better. */
329						frame = actframe;
330					}
331				} else if ((instr & 0xff) == 0xc3) {
332					/* ret */
333					actframe = (void *)(tf->tf_rsp - 8);
334				} else if (offset == 0) {
335					/* Probably an assembler symbol. */
336					actframe = (void *)(tf->tf_rsp - 8);
337				}
338			} else if (name != NULL &&
339			    strcmp(name, "fork_trampoline") == 0) {
340				/*
341				 * Don't try to walk back on a stack for a
342				 * process that hasn't actually been run yet.
343				 */
344				db_print_stack_entry(name, pc, actframe);
345				break;
346			}
347		}
348
349		db_print_stack_entry(name, pc, actframe);
350
351		if (actframe != frame) {
352			/* `frame' belongs to caller. */
353			pc = (db_addr_t)
354			    db_get_value((long)&actframe->f_retaddr, 8, FALSE);
355			continue;
356		}
357
358		db_nextframe(&frame, &pc, td);
359
360		if (INKERNEL((long)pc) && !INKERNEL((long)frame)) {
361			sym = db_search_symbol(pc, DB_STGY_ANY, &offset);
362			db_symbol_values(sym, &name, NULL);
363			db_print_stack_entry(name, pc, frame);
364			break;
365		}
366		if (!INKERNEL((long) frame)) {
367			break;
368		}
369	}
370
371	return (0);
372}
373
374void
375db_trace_self(void)
376{
377	struct amd64_frame *frame;
378	db_addr_t callpc;
379	register_t rbp;
380
381	__asm __volatile("movq %%rbp,%0" : "=r" (rbp));
382	frame = (struct amd64_frame *)rbp;
383	callpc = (db_addr_t)db_get_value((long)&frame->f_retaddr, 8, FALSE);
384	frame = frame->f_frame;
385	db_backtrace(curthread, NULL, frame, callpc, 0, -1);
386}
387
388int
389db_trace_thread(struct thread *thr, int count)
390{
391	struct pcb *ctx;
392	struct trapframe *tf;
393
394	ctx = kdb_thr_ctx(thr);
395	tf = thr == kdb_thread ? kdb_frame : NULL;
396	return (db_backtrace(thr, tf, (struct amd64_frame *)ctx->pcb_rbp,
397	    ctx->pcb_rip, ctx->pcb_rsp, count));
398}
399
400int
401amd64_set_watch(watchnum, watchaddr, size, access, d)
402	int watchnum;
403	unsigned long watchaddr;
404	int size;
405	int access;
406	struct dbreg *d;
407{
408	int i, len;
409
410	if (watchnum == -1) {
411		for (i = 0; i < 4; i++)
412			if (!DBREG_DR7_ENABLED(d->dr[7], i))
413				break;
414		if (i < 4)
415			watchnum = i;
416		else
417			return (-1);
418	}
419
420	switch (access) {
421	case DBREG_DR7_EXEC:
422		size = 1; /* size must be 1 for an execution breakpoint */
423		/* fall through */
424	case DBREG_DR7_WRONLY:
425	case DBREG_DR7_RDWR:
426		break;
427	default:
428		return (-1);
429	}
430
431	/*
432	 * we can watch a 1, 2, 4, or 8 byte sized location
433	 */
434	switch (size) {
435	case 1:
436		len = DBREG_DR7_LEN_1;
437		break;
438	case 2:
439		len = DBREG_DR7_LEN_2;
440		break;
441	case 4:
442		len = DBREG_DR7_LEN_4;
443		break;
444	case 8:
445		len = DBREG_DR7_LEN_8;
446		break;
447	default:
448		return (-1);
449	}
450
451	/* clear the bits we are about to affect */
452	d->dr[7] &= ~DBREG_DR7_MASK(watchnum);
453
454	/* set drN register to the address, N=watchnum */
455	DBREG_DRX(d, watchnum) = watchaddr;
456
457	/* enable the watchpoint */
458	d->dr[7] |= DBREG_DR7_SET(watchnum, len, access,
459	    DBREG_DR7_GLOBAL_ENABLE);
460
461	return (watchnum);
462}
463
464
465int
466amd64_clr_watch(watchnum, d)
467	int watchnum;
468	struct dbreg *d;
469{
470
471	if (watchnum < 0 || watchnum >= 4)
472		return (-1);
473
474	d->dr[7] &= ~DBREG_DR7_MASK(watchnum);
475	DBREG_DRX(d, watchnum) = 0;
476
477	return (0);
478}
479
480
481int
482db_md_set_watchpoint(addr, size)
483	db_expr_t addr;
484	db_expr_t size;
485{
486	struct dbreg *d;
487	struct pcpu *pc;
488	int avail, c, cpu, i, wsize;
489
490	d = (struct dbreg *)PCPU_PTR(dbreg);
491	cpu = PCPU_GET(cpuid);
492	fill_dbregs(NULL, d);
493
494	avail = 0;
495	for (i = 0; i < 4; i++) {
496		if (!DBREG_DR7_ENABLED(d->dr[7], i))
497			avail++;
498	}
499
500	if (avail * 8 < size)
501		return (-1);
502
503	for (i = 0; i < 4 && size > 0; i++) {
504		if (!DBREG_DR7_ENABLED(d->dr[7], i)) {
505			if (size >= 8 || (avail == 1 && size > 4))
506				wsize = 8;
507			else if (size > 2)
508				wsize = 4;
509			else
510				wsize = size;
511			amd64_set_watch(i, addr, wsize, DBREG_DR7_WRONLY, d);
512			addr += wsize;
513			size -= wsize;
514			avail--;
515		}
516	}
517
518	set_dbregs(NULL, d);
519	CPU_FOREACH(c) {
520		if (c == cpu)
521			continue;
522		pc = pcpu_find(c);
523		memcpy(pc->pc_dbreg, d, sizeof(*d));
524		pc->pc_dbreg_cmd = PC_DBREG_CMD_LOAD;
525	}
526
527	return (0);
528}
529
530int
531db_md_clr_watchpoint(addr, size)
532	db_expr_t addr;
533	db_expr_t size;
534{
535	struct dbreg *d;
536	struct pcpu *pc;
537	int i, c, cpu;
538
539	d = (struct dbreg *)PCPU_PTR(dbreg);
540	cpu = PCPU_GET(cpuid);
541	fill_dbregs(NULL, d);
542
543	for (i = 0; i < 4; i++) {
544		if (DBREG_DR7_ENABLED(d->dr[7], i)) {
545			if (DBREG_DRX((d), i) >= addr &&
546			    DBREG_DRX((d), i) < addr + size)
547				amd64_clr_watch(i, d);
548
549		}
550	}
551
552	set_dbregs(NULL, d);
553	CPU_FOREACH(c) {
554		if (c == cpu)
555			continue;
556		pc = pcpu_find(c);
557		memcpy(pc->pc_dbreg, d, sizeof(*d));
558		pc->pc_dbreg_cmd = PC_DBREG_CMD_LOAD;
559	}
560
561	return (0);
562}
563
564
565static const char *
566watchtype_str(type)
567	int type;
568{
569	switch (type) {
570		case DBREG_DR7_EXEC   : return "execute";    break;
571		case DBREG_DR7_RDWR   : return "read/write"; break;
572		case DBREG_DR7_WRONLY : return "write";	     break;
573		default		      : return "invalid";    break;
574	}
575}
576
577
578void
579db_md_list_watchpoints()
580{
581	struct dbreg d;
582	int i, len, type;
583
584	fill_dbregs(NULL, &d);
585
586	db_printf("\nhardware watchpoints:\n");
587	db_printf("  watch    status        type  len             address\n");
588	db_printf("  -----  --------  ----------  ---  ------------------\n");
589	for (i = 0; i < 4; i++) {
590		if (DBREG_DR7_ENABLED(d.dr[7], i)) {
591			type = DBREG_DR7_ACCESS(d.dr[7], i);
592			len = DBREG_DR7_LEN(d.dr[7], i);
593			if (len == DBREG_DR7_LEN_8)
594				len = 8;
595			else
596				len++;
597			db_printf("  %-5d  %-8s  %10s  %3d  ",
598			    i, "enabled", watchtype_str(type), len);
599			db_printsym((db_addr_t)DBREG_DRX((&d), i), DB_STGY_ANY);
600			db_printf("\n");
601		} else {
602			db_printf("  %-5d  disabled\n", i);
603		}
604	}
605
606	db_printf("\ndebug register values:\n");
607	for (i = 0; i < 8; i++) {
608		db_printf("  dr%d 0x%016lx\n", i, DBREG_DRX((&d), i));
609	}
610	db_printf("\n");
611}
612
613void
614amd64_db_resume_dbreg(void)
615{
616	struct dbreg *d;
617
618	switch (PCPU_GET(dbreg_cmd)) {
619	case PC_DBREG_CMD_LOAD:
620		d = (struct dbreg *)PCPU_PTR(dbreg);
621		set_dbregs(NULL, d);
622		PCPU_SET(dbreg_cmd, PC_DBREG_CMD_NONE);
623		break;
624	}
625}
626