2 * Copyright (c) 2011 Apple Computer, Inc. All rights reserved.
4 * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
6 * This file contains Original Code and/or Modifications of Original Code
7 * as defined in and that are subject to the Apple Public Source License
8 * Version 2.0 (the 'License'). You may not use this file except in
9 * compliance with the License. The rights granted to you under the License
10 * may not be used to create, or enable the creation or redistribution of,
11 * unlawful or unlicensed copies of an Apple operating system, or to
12 * circumvent, violate, or enable the circumvention or violation of, any
13 * terms of an Apple operating system software license agreement.
15 * Please obtain a copy of the License at
16 * http://www.opensource.apple.com/apsl/ and read it before using this file.
18 * The Original Code and all software distributed under the License are
19 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
20 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
21 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
22 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
23 * Please see the License for the specific language governing rights and
24 * limitations under the License.
26 * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
29 /* Collect kernel callstacks */
31 #include <mach/mach_types.h>
32 #include <kern/thread.h>
33 #include <kern/backtrace.h>
34 #include <vm/vm_map.h>
35 #include <kperf/buffer.h>
36 #include <kperf/context.h>
37 #include <kperf/callstack.h>
38 #include <kperf/ast.h>
39 #include <sys/errno.h>
41 #if defined(__arm__) || defined(__arm64__)
42 #include <arm/cpu_data.h>
43 #include <arm/cpu_data_internal.h>
47 callstack_fixup_user(struct callstack
*cs
, thread_t thread
)
49 uint64_t fixup_val
= 0;
50 assert(cs
->nframes
< MAX_CALLSTACK_FRAMES
);
52 #if defined(__x86_64__)
55 x86_saved_state_t
*state
;
57 state
= get_user_regs(thread
);
62 user_64
= is_saved_state64(state
);
64 sp_user
= saved_state64(state
)->isf
.rsp
;
66 sp_user
= saved_state32(state
)->uesp
;
69 if (thread
== current_thread()) {
70 (void)copyin(sp_user
, (char *)&fixup_val
,
71 user_64
? sizeof(uint64_t) : sizeof(uint32_t));
73 (void)vm_map_read_user(get_task_map(get_threadtask(thread
)), sp_user
,
74 &fixup_val
, user_64
? sizeof(uint64_t) : sizeof(uint32_t));
77 #elif defined(__arm64__) || defined(__arm__)
79 struct arm_saved_state
*state
= get_user_regs(thread
);
84 /* encode thumb mode into low bit of PC */
85 if (get_saved_state_cpsr(state
) & PSR_TF
) {
86 cs
->frames
[0] |= 1ULL;
89 fixup_val
= get_saved_state_lr(state
);
92 #error "callstack_fixup_user: unsupported architecture"
96 cs
->frames
[cs
->nframes
++] = fixup_val
;
99 #if defined(__x86_64__)
101 __attribute__((used
))
103 interrupted_kernel_sp_value(uintptr_t *sp_val
)
105 x86_saved_state_t
*state
;
109 uintptr_t top
, bottom
;
111 state
= current_cpu_datap()->cpu_int_state
;
116 state_64
= is_saved_state64(state
);
119 cs
= saved_state64(state
)->isf
.cs
;
121 cs
= saved_state32(state
)->cs
;
123 /* return early if interrupted a thread in user space */
124 if ((cs
& SEL_PL
) == SEL_PL_U
) {
129 sp
= saved_state64(state
)->isf
.rsp
;
131 sp
= saved_state32(state
)->uesp
;
134 /* make sure the stack pointer is pointing somewhere in this stack */
135 bottom
= current_thread()->kernel_stack
;
136 top
= bottom
+ kernel_stack_size
;
137 if (sp
>= bottom
&& sp
< top
) {
141 *sp_val
= *(uintptr_t *)sp
;
145 #elif defined(__arm64__)
147 __attribute__((used
))
149 interrupted_kernel_lr(uintptr_t *lr
)
151 struct arm_saved_state
*state
;
153 state
= getCpuDatap()->cpu_int_state
;
155 /* return early if interrupted a thread in user space */
156 if (PSR64_IS_USER(get_saved_state_cpsr(state
))) {
160 *lr
= get_saved_state_lr(state
);
164 #elif defined(__arm__)
166 __attribute__((used
))
168 interrupted_kernel_lr(uintptr_t *lr
)
170 struct arm_saved_state
*state
;
172 state
= getCpuDatap()->cpu_int_state
;
174 /* return early if interrupted a thread in user space */
175 if (PSR_IS_USER(get_saved_state_cpsr(state
))) {
179 *lr
= get_saved_state_lr(state
);
183 #else /* defined(__arm__) */
184 #error "interrupted_kernel_{sp,lr}: unsupported architecture"
185 #endif /* !defined(__arm__) */
189 callstack_fixup_interrupted(struct callstack
*cs
)
191 uintptr_t fixup_val
= 0;
192 assert(cs
->nframes
< MAX_CALLSTACK_FRAMES
);
195 * Only provide arbitrary data on development or debug kernels.
197 #if DEVELOPMENT || DEBUG
198 #if defined(__x86_64__)
199 (void)interrupted_kernel_sp_value(&fixup_val
);
200 #elif defined(__arm64__) || defined(__arm__)
201 (void)interrupted_kernel_lr(&fixup_val
);
202 #endif /* defined(__x86_64__) */
203 #endif /* DEVELOPMENT || DEBUG */
205 assert(cs
->flags
& CALLSTACK_KERNEL
);
206 cs
->frames
[cs
->nframes
++] = fixup_val
;
210 kperf_continuation_sample(struct callstack
*cs
, struct kperf_context
*context
)
215 assert(context
!= NULL
);
217 thread
= context
->cur_thread
;
218 assert(thread
!= NULL
);
219 assert(thread
->continuation
!= NULL
);
221 cs
->flags
= CALLSTACK_CONTINUATION
| CALLSTACK_VALID
| CALLSTACK_KERNEL
;
223 cs
->flags
|= CALLSTACK_64BIT
;
227 cs
->frames
[0] = VM_KERNEL_UNSLIDE(thread
->continuation
);
231 kperf_backtrace_sample(struct callstack
*cs
, struct kperf_context
*context
)
234 assert(context
!= NULL
);
235 assert(context
->cur_thread
== current_thread());
237 cs
->flags
= CALLSTACK_KERNEL
| CALLSTACK_KERNEL_WORDS
;
239 cs
->flags
|= CALLSTACK_64BIT
;
242 BUF_VERB(PERF_CS_BACKTRACE
| DBG_FUNC_START
, 1);
244 cs
->nframes
= backtrace_frame((uintptr_t *)&(cs
->frames
), cs
->nframes
- 1,
245 context
->starting_fp
);
246 if (cs
->nframes
> 0) {
247 cs
->flags
|= CALLSTACK_VALID
;
249 * Fake the value pointed to by the stack pointer or the link
250 * register for symbolicators.
252 cs
->frames
[cs
->nframes
+ 1] = 0;
256 BUF_VERB(PERF_CS_BACKTRACE
| DBG_FUNC_END
, cs
->nframes
);
259 kern_return_t
chudxnu_thread_get_callstack64_kperf(thread_t thread
,
260 uint64_t *callStack
, mach_msg_type_number_t
*count
,
261 boolean_t user_only
);
264 kperf_kcallstack_sample(struct callstack
*cs
, struct kperf_context
*context
)
269 assert(context
!= NULL
);
270 assert(cs
->nframes
<= MAX_CALLSTACK_FRAMES
);
272 thread
= context
->cur_thread
;
273 assert(thread
!= NULL
);
275 BUF_INFO(PERF_CS_KSAMPLE
| DBG_FUNC_START
, (uintptr_t)thread_tid(thread
),
278 cs
->flags
= CALLSTACK_KERNEL
;
281 cs
->flags
|= CALLSTACK_64BIT
;
284 if (ml_at_interrupt_context()) {
285 assert(thread
== current_thread());
286 cs
->flags
|= CALLSTACK_KERNEL_WORDS
;
287 cs
->nframes
= backtrace_interrupted((uintptr_t *)cs
->frames
,
289 if (cs
->nframes
!= 0) {
290 callstack_fixup_interrupted(cs
);
294 * Rely on legacy CHUD backtracer to backtrace kernel stacks on
298 kr
= chudxnu_thread_get_callstack64_kperf(thread
, cs
->frames
,
299 &cs
->nframes
, FALSE
);
300 if (kr
== KERN_SUCCESS
) {
301 cs
->flags
|= CALLSTACK_VALID
;
302 } else if (kr
== KERN_RESOURCE_SHORTAGE
) {
303 cs
->flags
|= CALLSTACK_VALID
;
304 cs
->flags
|= CALLSTACK_TRUNCATED
;
310 if (cs
->nframes
== 0) {
311 BUF_INFO(PERF_CS_ERROR
, ERR_GETSTACK
);
314 BUF_INFO(PERF_CS_KSAMPLE
| DBG_FUNC_END
, (uintptr_t)thread_tid(thread
), cs
->flags
, cs
->nframes
);
318 kperf_ucallstack_sample(struct callstack
*cs
, struct kperf_context
*context
)
321 bool user_64
= false;
325 assert(context
!= NULL
);
326 assert(cs
->nframes
<= MAX_CALLSTACK_FRAMES
);
327 assert(ml_get_interrupts_enabled() == TRUE
);
329 thread
= context
->cur_thread
;
330 assert(thread
!= NULL
);
332 BUF_INFO(PERF_CS_USAMPLE
| DBG_FUNC_START
, (uintptr_t)thread_tid(thread
),
337 err
= backtrace_thread_user(thread
, (uintptr_t *)cs
->frames
,
338 cs
->nframes
- 1, &cs
->nframes
, &user_64
);
339 cs
->flags
|= CALLSTACK_KERNEL_WORDS
;
341 cs
->flags
|= CALLSTACK_64BIT
;
344 if (!err
|| err
== EFAULT
) {
345 callstack_fixup_user(cs
, thread
);
346 cs
->flags
|= CALLSTACK_VALID
;
349 BUF_INFO(PERF_CS_ERROR
, ERR_GETSTACK
, err
);
352 BUF_INFO(PERF_CS_USAMPLE
| DBG_FUNC_END
, (uintptr_t)thread_tid(thread
),
353 cs
->flags
, cs
->nframes
);
356 static inline uintptr_t
357 scrub_word(uintptr_t *bt
, int n_frames
, int frame
, bool kern
)
359 if (frame
< n_frames
) {
361 return VM_KERNEL_UNSLIDE(bt
[frame
]);
370 static inline uintptr_t
371 scrub_frame(uint64_t *bt
, int n_frames
, int frame
)
373 if (frame
< n_frames
) {
374 return (uintptr_t)(bt
[frame
]);
381 callstack_log(struct callstack
*cs
, uint32_t hcode
, uint32_t dcode
)
383 BUF_VERB(PERF_CS_LOG
| DBG_FUNC_START
, cs
->flags
, cs
->nframes
);
385 /* framing information for the stack */
386 BUF_DATA(hcode
, cs
->flags
, cs
->nframes
);
388 /* how many batches of 4 */
389 unsigned int nframes
= cs
->nframes
;
390 unsigned int n
= nframes
/ 4;
391 unsigned int ovf
= nframes
% 4;
396 bool kern
= cs
->flags
& CALLSTACK_KERNEL
;
398 if (cs
->flags
& CALLSTACK_KERNEL_WORDS
) {
399 uintptr_t *frames
= (uintptr_t *)cs
->frames
;
400 for (unsigned int i
= 0; i
< n
; i
++) {
401 unsigned int j
= i
* 4;
403 scrub_word(frames
, nframes
, j
+ 0, kern
),
404 scrub_word(frames
, nframes
, j
+ 1, kern
),
405 scrub_word(frames
, nframes
, j
+ 2, kern
),
406 scrub_word(frames
, nframes
, j
+ 3, kern
));
409 for (unsigned int i
= 0; i
< n
; i
++) {
410 uint64_t *frames
= cs
->frames
;
411 unsigned int j
= i
* 4;
413 scrub_frame(frames
, nframes
, j
+ 0),
414 scrub_frame(frames
, nframes
, j
+ 1),
415 scrub_frame(frames
, nframes
, j
+ 2),
416 scrub_frame(frames
, nframes
, j
+ 3));
420 BUF_VERB(PERF_CS_LOG
| DBG_FUNC_END
, cs
->flags
, cs
->nframes
);
424 kperf_kcallstack_log( struct callstack
*cs
)
426 callstack_log(cs
, PERF_CS_KHDR
, PERF_CS_KDATA
);
430 kperf_ucallstack_log( struct callstack
*cs
)
432 callstack_log(cs
, PERF_CS_UHDR
, PERF_CS_UDATA
);
436 kperf_ucallstack_pend(struct kperf_context
* context
, uint32_t depth
)
438 int did_pend
= kperf_ast_pend(context
->cur_thread
, T_KPERF_AST_CALLSTACK
);
439 kperf_ast_set_callstack_depth(context
->cur_thread
, depth
);
445 chudxnu_kern_read(void *dstaddr
, vm_offset_t srcaddr
, vm_size_t size
)
447 return (ml_nofault_copy(srcaddr
, (vm_offset_t
)dstaddr
, size
) == size
) ?
448 KERN_SUCCESS
: KERN_FAILURE
;
458 //ppc version ported to arm
459 kern_return_t ret
= KERN_SUCCESS
;
461 if (ml_at_interrupt_context()) {
462 return KERN_FAILURE
; // can't look at tasks on interrupt stack
465 if (current_task() == task
) {
466 if (copyin(usraddr
, kernaddr
, size
)) {
470 vm_map_t map
= get_task_map(task
);
471 ret
= vm_map_read_user(map
, usraddr
, kernaddr
, size
);
477 static inline uint64_t
478 chudxnu_vm_unslide( uint64_t ptr
, int kaddr
)
484 return VM_KERNEL_UNSLIDE(ptr
);
488 #define ARM_SUPERVISOR_MODE(cpsr) ((((cpsr) & PSR_MODE_MASK) != PSR_USER_MODE) ? TRUE : FALSE)
489 #define CS_FLAG_EXTRASP 1 // capture extra sp register
491 chudxnu_thread_get_callstack64_internal(
494 mach_msg_type_number_t
*count
,
500 uint64_t currPC
= 0ULL, currLR
= 0ULL, currSP
= 0ULL;
501 uint64_t prevPC
= 0ULL;
502 uint32_t kernStackMin
= thread
->kernel_stack
;
503 uint32_t kernStackMax
= kernStackMin
+ kernel_stack_size
;
504 uint64_t *buffer
= callStack
;
507 int bufferMaxIndex
= 0;
508 boolean_t supervisor
= FALSE
;
509 struct arm_saved_state
*state
= NULL
;
510 uint32_t *fp
= NULL
, *nextFramePointer
= NULL
, *topfp
= NULL
;
513 task
= get_threadtask(thread
);
515 bufferMaxIndex
= *count
;
518 state
= find_user_regs(thread
);
520 state
= find_kern_regs(thread
);
528 /* make sure it is safe to dereference before you do it */
529 supervisor
= ARM_SUPERVISOR_MODE(state
->cpsr
);
531 /* can't take a kernel callstack if we've got a user frame */
532 if (!user_only
&& !supervisor
) {
537 * Reserve space for saving LR (and sometimes SP) at the end of the
540 if (flags
& CS_FLAG_EXTRASP
) {
546 if (bufferMaxIndex
< 2) {
548 return KERN_RESOURCE_SHORTAGE
;
551 currPC
= (uint64_t)state
->pc
; /* r15 */
552 if (state
->cpsr
& PSR_TF
) {
553 currPC
|= 1ULL; /* encode thumb mode into low bit of PC */
555 currLR
= (uint64_t)state
->lr
; /* r14 */
556 currSP
= (uint64_t)state
->sp
; /* r13 */
558 fp
= (uint32_t *)state
->r
[7]; /* frame pointer */
561 bufferIndex
= 0; // start with a stack of size zero
562 buffer
[bufferIndex
++] = chudxnu_vm_unslide(currPC
, supervisor
); // save PC in position 0.
564 // Now, fill buffer with stack backtraces.
565 while (bufferIndex
< bufferMaxIndex
) {
568 * Below the frame pointer, the following values are saved:
573 * Note that we read the pc even for the first stack frame
574 * (which, in theory, is always empty because the callee fills
575 * it in just before it lowers the stack. However, if we
576 * catch the program in between filling in the return address
577 * and lowering the stack, we want to still have a valid
578 * backtrace. FixupStack correctly disregards this value if
582 if ((uint32_t)fp
== 0 || ((uint32_t)fp
& 0x3) != 0) {
583 /* frame pointer is invalid - stop backtracing */
589 if (((uint32_t)fp
> kernStackMax
) ||
590 ((uint32_t)fp
< kernStackMin
)) {
593 kr
= chudxnu_kern_read(&frame
,
595 (vm_size_t
)sizeof(frame
));
596 if (kr
== KERN_SUCCESS
) {
597 pc
= (uint64_t)frame
[1];
598 nextFramePointer
= (uint32_t *) (frame
[0]);
601 nextFramePointer
= 0ULL;
606 kr
= chudxnu_task_read(task
,
608 (((uint64_t)(uint32_t)fp
) & 0x00000000FFFFFFFFULL
),
610 if (kr
== KERN_SUCCESS
) {
611 pc
= (uint64_t) frame
[1];
612 nextFramePointer
= (uint32_t *) (frame
[0]);
615 nextFramePointer
= 0ULL;
620 if (kr
!= KERN_SUCCESS
) {
625 if (nextFramePointer
) {
626 buffer
[bufferIndex
++] = chudxnu_vm_unslide(pc
, supervisor
);
630 if (nextFramePointer
< fp
) {
633 fp
= nextFramePointer
;
637 if (bufferIndex
>= bufferMaxIndex
) {
638 bufferIndex
= bufferMaxIndex
;
639 kr
= KERN_RESOURCE_SHORTAGE
;
644 // Save link register and R13 (sp) at bottom of stack (used for later fixup).
645 buffer
[bufferIndex
++] = chudxnu_vm_unslide(currLR
, supervisor
);
646 if (flags
& CS_FLAG_EXTRASP
) {
647 buffer
[bufferIndex
++] = chudxnu_vm_unslide(currSP
, supervisor
);
650 *count
= bufferIndex
;
655 chudxnu_thread_get_callstack64_kperf(
658 mach_msg_type_number_t
*count
,
661 return chudxnu_thread_get_callstack64_internal( thread
, callStack
, count
, user_only
, 0 );
666 // chudxnu_thread_get_callstack gathers a raw callstack along with any information needed to
667 // fix it up later (in case we stopped program as it was saving values into prev stack frame, etc.)
668 // after sampling has finished.
670 // For an N-entry callstack:
673 // [1..N-3] stack frames (including current one)
674 // [N-2] current LR (return value if we're in a leaf function)
675 // [N-1] current r0 (in case we've saved LR in r0) (optional)
678 #define ARM_SUPERVISOR_MODE(cpsr) ((((cpsr) & PSR_MODE_MASK) != PSR_USER_MODE) ? TRUE : FALSE)
680 #define CS_FLAG_EXTRASP 1 // capture extra sp register
683 chudxnu_thread_get_callstack64_internal(
686 mach_msg_type_number_t
*count
,
690 kern_return_t kr
= KERN_SUCCESS
;
692 uint64_t currPC
= 0ULL, currLR
= 0ULL, currSP
= 0ULL;
693 uint64_t prevPC
= 0ULL;
694 uint64_t kernStackMin
= thread
->kernel_stack
;
695 uint64_t kernStackMax
= kernStackMin
+ kernel_stack_size
;
696 uint64_t *buffer
= callStack
;
698 int bufferMaxIndex
= 0;
699 boolean_t kernel
= FALSE
;
700 struct arm_saved_state
*sstate
= NULL
;
703 task
= get_threadtask(thread
);
704 bufferMaxIndex
= *count
;
707 sstate
= find_user_regs(thread
);
709 sstate
= find_kern_regs(thread
);
717 if (is_saved_state64(sstate
)) {
718 struct arm_saved_state64
*state
= NULL
;
719 uint64_t *fp
= NULL
, *nextFramePointer
= NULL
, *topfp
= NULL
;
722 state
= saved_state64(sstate
);
724 /* make sure it is safe to dereference before you do it */
725 kernel
= PSR64_IS_KERNEL(state
->cpsr
);
727 /* can't take a kernel callstack if we've got a user frame */
728 if (!user_only
&& !kernel
) {
733 * Reserve space for saving LR (and sometimes SP) at the end of the
736 if (flags
& CS_FLAG_EXTRASP
) {
742 if (bufferMaxIndex
< 2) {
744 return KERN_RESOURCE_SHORTAGE
;
751 fp
= (uint64_t *)state
->fp
; /* frame pointer */
754 bufferIndex
= 0; // start with a stack of size zero
755 buffer
[bufferIndex
++] = chudxnu_vm_unslide(currPC
, kernel
); // save PC in position 0.
757 BUF_VERB(PERF_CS_BACKTRACE
| DBG_FUNC_START
, kernel
, 0);
759 // Now, fill buffer with stack backtraces.
760 while (bufferIndex
< bufferMaxIndex
) {
763 * Below the frame pointer, the following values are saved:
768 * Note that we read the pc even for the first stack frame
769 * (which, in theory, is always empty because the callee fills
770 * it in just before it lowers the stack. However, if we
771 * catch the program in between filling in the return address
772 * and lowering the stack, we want to still have a valid
773 * backtrace. FixupStack correctly disregards this value if
777 if ((uint64_t)fp
== 0 || ((uint64_t)fp
& 0x3) != 0) {
778 /* frame pointer is invalid - stop backtracing */
784 if (((uint64_t)fp
> kernStackMax
) ||
785 ((uint64_t)fp
< kernStackMin
)) {
788 kr
= chudxnu_kern_read(&frame
,
790 (vm_size_t
)sizeof(frame
));
791 if (kr
== KERN_SUCCESS
) {
793 nextFramePointer
= (uint64_t *)frame
[0];
796 nextFramePointer
= 0ULL;
801 kr
= chudxnu_task_read(task
,
804 (vm_size_t
)sizeof(frame
));
805 if (kr
== KERN_SUCCESS
) {
807 nextFramePointer
= (uint64_t *)(frame
[0]);
810 nextFramePointer
= 0ULL;
815 if (kr
!= KERN_SUCCESS
) {
820 if (nextFramePointer
) {
821 buffer
[bufferIndex
++] = chudxnu_vm_unslide(pc
, kernel
);
825 if (nextFramePointer
< fp
) {
828 fp
= nextFramePointer
;
832 BUF_VERB(PERF_CS_BACKTRACE
| DBG_FUNC_END
, bufferIndex
);
834 if (bufferIndex
>= bufferMaxIndex
) {
835 bufferIndex
= bufferMaxIndex
;
836 kr
= KERN_RESOURCE_SHORTAGE
;
841 // Save link register and SP at bottom of stack (used for later fixup).
842 buffer
[bufferIndex
++] = chudxnu_vm_unslide(currLR
, kernel
);
843 if (flags
& CS_FLAG_EXTRASP
) {
844 buffer
[bufferIndex
++] = chudxnu_vm_unslide(currSP
, kernel
);
847 struct arm_saved_state32
*state
= NULL
;
848 uint32_t *fp
= NULL
, *nextFramePointer
= NULL
, *topfp
= NULL
;
850 /* 64-bit kernel stacks, 32-bit user stacks */
854 state
= saved_state32(sstate
);
856 /* make sure it is safe to dereference before you do it */
857 kernel
= ARM_SUPERVISOR_MODE(state
->cpsr
);
859 /* can't take a kernel callstack if we've got a user frame */
860 if (!user_only
&& !kernel
) {
865 * Reserve space for saving LR (and sometimes SP) at the end of the
868 if (flags
& CS_FLAG_EXTRASP
) {
874 if (bufferMaxIndex
< 2) {
876 return KERN_RESOURCE_SHORTAGE
;
879 currPC
= (uint64_t)state
->pc
; /* r15 */
880 if (state
->cpsr
& PSR_TF
) {
881 currPC
|= 1ULL; /* encode thumb mode into low bit of PC */
883 currLR
= (uint64_t)state
->lr
; /* r14 */
884 currSP
= (uint64_t)state
->sp
; /* r13 */
886 fp
= (uint32_t *)(uintptr_t)state
->r
[7]; /* frame pointer */
889 bufferIndex
= 0; // start with a stack of size zero
890 buffer
[bufferIndex
++] = chudxnu_vm_unslide(currPC
, kernel
); // save PC in position 0.
892 BUF_VERB(PERF_CS_BACKTRACE
| DBG_FUNC_START
, kernel
, 1);
894 // Now, fill buffer with stack backtraces.
895 while (bufferIndex
< bufferMaxIndex
) {
898 * Below the frame pointer, the following values are saved:
903 * Note that we read the pc even for the first stack frame
904 * (which, in theory, is always empty because the callee fills
905 * it in just before it lowers the stack. However, if we
906 * catch the program in between filling in the return address
907 * and lowering the stack, we want to still have a valid
908 * backtrace. FixupStack correctly disregards this value if
912 if ((uint32_t)fp
== 0 || ((uint32_t)fp
& 0x3) != 0) {
913 /* frame pointer is invalid - stop backtracing */
919 if (((uint32_t)fp
> kernStackMax
) ||
920 ((uint32_t)fp
< kernStackMin
)) {
923 kr
= chudxnu_kern_read(&frame
,
925 (vm_size_t
)sizeof(frame
));
926 if (kr
== KERN_SUCCESS
) {
927 pc
= (uint64_t)frame
[1];
928 nextFramePointer
= (uint32_t *) (frame
[0]);
931 nextFramePointer
= 0ULL;
936 kr
= chudxnu_task_read(task
,
938 (((uint64_t)(uint32_t)fp
) & 0x00000000FFFFFFFFULL
),
940 if (kr
== KERN_SUCCESS
) {
941 pc
= (uint64_t)frame32
[1];
942 nextFramePointer
= (uint32_t *)(uintptr_t)(frame32
[0]);
945 nextFramePointer
= 0ULL;
950 if (kr
!= KERN_SUCCESS
) {
955 if (nextFramePointer
) {
956 buffer
[bufferIndex
++] = chudxnu_vm_unslide(pc
, kernel
);
960 if (nextFramePointer
< fp
) {
963 fp
= nextFramePointer
;
967 BUF_VERB(PERF_CS_BACKTRACE
| DBG_FUNC_END
, bufferIndex
);
969 /* clamp callstack size to max */
970 if (bufferIndex
>= bufferMaxIndex
) {
971 bufferIndex
= bufferMaxIndex
;
972 kr
= KERN_RESOURCE_SHORTAGE
;
974 /* ignore all other failures */
978 // Save link register and R13 (sp) at bottom of stack (used for later fixup).
979 buffer
[bufferIndex
++] = chudxnu_vm_unslide(currLR
, kernel
);
980 if (flags
& CS_FLAG_EXTRASP
) {
981 buffer
[bufferIndex
++] = chudxnu_vm_unslide(currSP
, kernel
);
985 *count
= bufferIndex
;
990 chudxnu_thread_get_callstack64_kperf(
993 mach_msg_type_number_t
*count
,
996 return chudxnu_thread_get_callstack64_internal( thread
, callStack
, count
, user_only
, 0 );
1000 #define VALID_STACK_ADDRESS(supervisor, addr, minKernAddr, maxKernAddr) (supervisor ? (addr>=minKernAddr && addr<=maxKernAddr) : TRUE)
1001 // don't try to read in the hole
1002 #define VALID_STACK_ADDRESS64(supervisor, addr, minKernAddr, maxKernAddr) \
1003 (supervisor ? ((uint64_t)addr >= minKernAddr && (uint64_t)addr <= maxKernAddr) : \
1004 ((uint64_t)addr != 0ULL && ((uint64_t)addr <= 0x00007FFFFFFFFFFFULL || (uint64_t)addr >= 0xFFFF800000000000ULL)))
1006 typedef struct _cframe64_t
{
1007 uint64_t prevFP
; // can't use a real pointer here until we're a 64 bit kernel
1013 typedef struct _cframe_t
{
1014 uint32_t prev
; // this is really a user32-space pointer to the previous frame
1019 extern void * find_user_regs(thread_t
);
1020 extern x86_saved_state32_t
*find_kern_regs(thread_t
);
1022 static kern_return_t
1023 do_kernel_backtrace(
1025 struct x86_kernel_state
*regs
,
1027 mach_msg_type_number_t
*start_idx
,
1028 mach_msg_type_number_t max_idx
)
1030 uint64_t kernStackMin
= (uint64_t)thread
->kernel_stack
;
1031 uint64_t kernStackMax
= (uint64_t)kernStackMin
+ kernel_stack_size
;
1032 mach_msg_type_number_t ct
= *start_idx
;
1033 kern_return_t kr
= KERN_FAILURE
;
1036 uint64_t currPC
= 0ULL;
1037 uint64_t currFP
= 0ULL;
1038 uint64_t prevPC
= 0ULL;
1039 uint64_t prevFP
= 0ULL;
1040 if (KERN_SUCCESS
!= chudxnu_kern_read(&currPC
, (vm_offset_t
)&(regs
->k_rip
), sizeof(uint64_t))) {
1041 return KERN_FAILURE
;
1043 if (KERN_SUCCESS
!= chudxnu_kern_read(&currFP
, (vm_offset_t
)&(regs
->k_rbp
), sizeof(uint64_t))) {
1044 return KERN_FAILURE
;
1047 uint32_t currPC
= 0U;
1048 uint32_t currFP
= 0U;
1049 uint32_t prevPC
= 0U;
1050 uint32_t prevFP
= 0U;
1051 if (KERN_SUCCESS
!= chudxnu_kern_read(&currPC
, (vm_offset_t
)&(regs
->k_eip
), sizeof(uint32_t))) {
1052 return KERN_FAILURE
;
1054 if (KERN_SUCCESS
!= chudxnu_kern_read(&currFP
, (vm_offset_t
)&(regs
->k_ebp
), sizeof(uint32_t))) {
1055 return KERN_FAILURE
;
1059 if (*start_idx
>= max_idx
) {
1060 return KERN_RESOURCE_SHORTAGE
; // no frames traced
1063 return KERN_FAILURE
;
1066 frames
[ct
++] = chudxnu_vm_unslide((uint64_t)currPC
, 1);
1068 // build a backtrace of this kernel state
1070 while (VALID_STACK_ADDRESS64(TRUE
, currFP
, kernStackMin
, kernStackMax
)) {
1071 // this is the address where caller lives in the user thread
1072 uint64_t caller
= currFP
+ sizeof(uint64_t);
1074 while (VALID_STACK_ADDRESS(TRUE
, currFP
, kernStackMin
, kernStackMax
)) {
1075 uint32_t caller
= (uint32_t)currFP
+ sizeof(uint32_t);
1078 if (!currFP
|| !currPC
) {
1083 if (ct
>= max_idx
) {
1085 return KERN_RESOURCE_SHORTAGE
;
1088 /* read our caller */
1089 kr
= chudxnu_kern_read(&currPC
, (vm_offset_t
)caller
, sizeof(currPC
));
1091 if (kr
!= KERN_SUCCESS
|| !currPC
) {
1097 * retrive contents of the frame pointer and advance to the next stack
1098 * frame if it's valid
1101 kr
= chudxnu_kern_read(&prevFP
, (vm_offset_t
)currFP
, sizeof(currPC
));
1104 if (VALID_STACK_ADDRESS64(TRUE
, prevFP
, kernStackMin
, kernStackMax
)) {
1106 if (VALID_STACK_ADDRESS(TRUE
, prevFP
, kernStackMin
, kernStackMax
)) {
1108 frames
[ct
++] = chudxnu_vm_unslide((uint64_t)currPC
, 1);
1111 if (prevFP
<= currFP
) {
1119 return KERN_SUCCESS
;
1124 static kern_return_t
1128 x86_saved_state32_t
*regs
,
1130 mach_msg_type_number_t
*start_idx
,
1131 mach_msg_type_number_t max_idx
,
1132 boolean_t supervisor
)
1134 uint32_t tmpWord
= 0UL;
1135 uint64_t currPC
= (uint64_t) regs
->eip
;
1136 uint64_t currFP
= (uint64_t) regs
->ebp
;
1137 uint64_t prevPC
= 0ULL;
1138 uint64_t prevFP
= 0ULL;
1139 uint64_t kernStackMin
= thread
->kernel_stack
;
1140 uint64_t kernStackMax
= kernStackMin
+ kernel_stack_size
;
1141 mach_msg_type_number_t ct
= *start_idx
;
1142 kern_return_t kr
= KERN_FAILURE
;
1144 if (ct
>= max_idx
) {
1145 return KERN_RESOURCE_SHORTAGE
; // no frames traced
1147 frames
[ct
++] = chudxnu_vm_unslide(currPC
, supervisor
);
1149 // build a backtrace of this 32 bit state.
1150 while (VALID_STACK_ADDRESS(supervisor
, currFP
, kernStackMin
, kernStackMax
)) {
1151 cframe_t
*fp
= (cframe_t
*) (uintptr_t) currFP
;
1158 if (ct
>= max_idx
) {
1160 return KERN_RESOURCE_SHORTAGE
;
1163 /* read our caller */
1165 kr
= chudxnu_kern_read(&tmpWord
, (vm_offset_t
) &fp
->caller
, sizeof(uint32_t));
1167 kr
= chudxnu_task_read(task
, &tmpWord
, (vm_offset_t
) &fp
->caller
, sizeof(uint32_t));
1170 if (kr
!= KERN_SUCCESS
) {
1175 currPC
= (uint64_t) tmpWord
; // promote 32 bit address
1178 * retrive contents of the frame pointer and advance to the next stack
1179 * frame if it's valid
1183 kr
= chudxnu_kern_read(&tmpWord
, (vm_offset_t
)&fp
->prev
, sizeof(uint32_t));
1185 kr
= chudxnu_task_read(task
, &tmpWord
, (vm_offset_t
)&fp
->prev
, sizeof(uint32_t));
1187 prevFP
= (uint64_t) tmpWord
; // promote 32 bit address
1190 frames
[ct
++] = chudxnu_vm_unslide(currPC
, supervisor
);
1193 if (prevFP
< currFP
) {
1201 return KERN_SUCCESS
;
1204 static kern_return_t
1208 x86_saved_state64_t
*regs
,
1210 mach_msg_type_number_t
*start_idx
,
1211 mach_msg_type_number_t max_idx
,
1212 boolean_t supervisor
)
1214 uint64_t currPC
= regs
->isf
.rip
;
1215 uint64_t currFP
= regs
->rbp
;
1216 uint64_t prevPC
= 0ULL;
1217 uint64_t prevFP
= 0ULL;
1218 uint64_t kernStackMin
= (uint64_t)thread
->kernel_stack
;
1219 uint64_t kernStackMax
= (uint64_t)kernStackMin
+ kernel_stack_size
;
1220 mach_msg_type_number_t ct
= *start_idx
;
1221 kern_return_t kr
= KERN_FAILURE
;
1223 if (*start_idx
>= max_idx
) {
1224 return KERN_RESOURCE_SHORTAGE
; // no frames traced
1226 frames
[ct
++] = chudxnu_vm_unslide(currPC
, supervisor
);
1228 // build a backtrace of this 32 bit state.
1229 while (VALID_STACK_ADDRESS64(supervisor
, currFP
, kernStackMin
, kernStackMax
)) {
1230 // this is the address where caller lives in the user thread
1231 uint64_t caller
= currFP
+ sizeof(uint64_t);
1238 if (ct
>= max_idx
) {
1240 return KERN_RESOURCE_SHORTAGE
;
1243 /* read our caller */
1245 kr
= chudxnu_kern_read(&currPC
, (vm_offset_t
)caller
, sizeof(uint64_t));
1247 kr
= chudxnu_task_read(task
, &currPC
, caller
, sizeof(uint64_t));
1250 if (kr
!= KERN_SUCCESS
) {
1256 * retrive contents of the frame pointer and advance to the next stack
1257 * frame if it's valid
1261 kr
= chudxnu_kern_read(&prevFP
, (vm_offset_t
)currFP
, sizeof(uint64_t));
1263 kr
= chudxnu_task_read(task
, &prevFP
, currFP
, sizeof(uint64_t));
1266 if (VALID_STACK_ADDRESS64(supervisor
, prevFP
, kernStackMin
, kernStackMax
)) {
1267 frames
[ct
++] = chudxnu_vm_unslide(currPC
, supervisor
);
1270 if (prevFP
< currFP
) {
1278 return KERN_SUCCESS
;
1281 static kern_return_t
1282 chudxnu_thread_get_callstack64_internal(
1284 uint64_t *callstack
,
1285 mach_msg_type_number_t
*count
,
1286 boolean_t user_only
,
1287 boolean_t kern_only
)
1289 kern_return_t kr
= KERN_FAILURE
;
1290 task_t task
= thread
->task
;
1291 uint64_t currPC
= 0ULL;
1292 boolean_t supervisor
= FALSE
;
1293 mach_msg_type_number_t bufferIndex
= 0;
1294 mach_msg_type_number_t bufferMaxIndex
= *count
;
1295 x86_saved_state_t
*tagged_regs
= NULL
; // kernel register state
1296 x86_saved_state64_t
*regs64
= NULL
;
1297 x86_saved_state32_t
*regs32
= NULL
;
1298 x86_saved_state32_t
*u_regs32
= NULL
;
1299 x86_saved_state64_t
*u_regs64
= NULL
;
1300 struct x86_kernel_state
*kregs
= NULL
;
1302 if (ml_at_interrupt_context()) {
1304 /* can't backtrace user state on interrupt stack. */
1305 return KERN_FAILURE
;
1308 /* backtracing at interrupt context? */
1309 if (thread
== current_thread() && current_cpu_datap()->cpu_int_state
) {
1311 * Locate the registers for the interrupted thread, assuming it is
1314 tagged_regs
= current_cpu_datap()->cpu_int_state
;
1316 if (is_saved_state64(tagged_regs
)) {
1317 /* 64 bit registers */
1318 regs64
= saved_state64(tagged_regs
);
1319 supervisor
= ((regs64
->isf
.cs
& SEL_PL
) != SEL_PL_U
);
1321 /* 32 bit registers */
1322 regs32
= saved_state32(tagged_regs
);
1323 supervisor
= ((regs32
->cs
& SEL_PL
) != SEL_PL_U
);
1328 if (!ml_at_interrupt_context() && kernel_task
== task
) {
1329 if (!thread
->kernel_stack
) {
1330 return KERN_FAILURE
;
1333 // Kernel thread not at interrupt context
1334 kregs
= (struct x86_kernel_state
*)NULL
;
1336 // nofault read of the thread->kernel_stack pointer
1337 if (KERN_SUCCESS
!= chudxnu_kern_read(&kregs
, (vm_offset_t
)&(thread
->kernel_stack
), sizeof(void *))) {
1338 return KERN_FAILURE
;
1341 // Adjust to find the saved kernel state
1342 kregs
= STACK_IKS((vm_offset_t
)(uintptr_t)kregs
);
1345 } else if (!tagged_regs
) {
1347 * not at interrupt context, or tracing a different thread than
1348 * current_thread() at interrupt context
1350 tagged_regs
= USER_STATE(thread
);
1351 if (is_saved_state64(tagged_regs
)) {
1352 /* 64 bit registers */
1353 regs64
= saved_state64(tagged_regs
);
1354 supervisor
= ((regs64
->isf
.cs
& SEL_PL
) != SEL_PL_U
);
1356 /* 32 bit registers */
1357 regs32
= saved_state32(tagged_regs
);
1358 supervisor
= ((regs32
->cs
& SEL_PL
) != SEL_PL_U
);
1365 // the caller only wants a user callstack.
1367 // bail - we've only got kernel state
1368 return KERN_FAILURE
;
1371 // regs32(64) is not in supervisor mode.
1379 /* we only want to backtrace the user mode */
1380 if (!(u_regs32
|| u_regs64
)) {
1381 /* no user state to look at */
1382 return KERN_FAILURE
;
1387 * Order of preference for top of stack:
1388 * 64 bit kernel state (not likely)
1389 * 32 bit kernel state
1390 * 64 bit user land state
1391 * 32 bit user land state
1396 * nofault read of the registers from the kernel stack (as they can
1397 * disappear on the fly).
1400 if (KERN_SUCCESS
!= chudxnu_kern_read(&currPC
, (vm_offset_t
)&(kregs
->k_rip
), sizeof(uint64_t))) {
1401 return KERN_FAILURE
;
1403 } else if (regs64
) {
1404 currPC
= regs64
->isf
.rip
;
1405 } else if (regs32
) {
1406 currPC
= (uint64_t) regs32
->eip
;
1407 } else if (u_regs64
) {
1408 currPC
= u_regs64
->isf
.rip
;
1409 } else if (u_regs32
) {
1410 currPC
= (uint64_t) u_regs32
->eip
;
1414 /* no top of the stack, bail out */
1415 return KERN_FAILURE
;
1420 if (bufferMaxIndex
< 1) {
1422 return KERN_RESOURCE_SHORTAGE
;
1425 /* backtrace kernel */
1427 addr64_t address
= 0ULL;
1431 kr
= do_kernel_backtrace(thread
, kregs
, callstack
, &bufferIndex
, bufferMaxIndex
);
1433 // and do a nofault read of (r|e)sp
1434 uint64_t rsp
= 0ULL;
1435 size
= sizeof(uint64_t);
1437 if (KERN_SUCCESS
!= chudxnu_kern_read(&address
, (vm_offset_t
)&(kregs
->k_rsp
), size
)) {
1441 if (address
&& KERN_SUCCESS
== chudxnu_kern_read(&rsp
, (vm_offset_t
)address
, size
) && bufferIndex
< bufferMaxIndex
) {
1442 callstack
[bufferIndex
++] = (uint64_t)rsp
;
1444 } else if (regs64
) {
1445 uint64_t rsp
= 0ULL;
1447 // backtrace the 64bit side.
1448 kr
= do_backtrace64(task
, thread
, regs64
, callstack
, &bufferIndex
,
1449 bufferMaxIndex
- 1, TRUE
);
1451 if (KERN_SUCCESS
== chudxnu_kern_read(&rsp
, (vm_offset_t
) regs64
->isf
.rsp
, sizeof(uint64_t)) &&
1452 bufferIndex
< bufferMaxIndex
) {
1453 callstack
[bufferIndex
++] = rsp
;
1455 } else if (regs32
) {
1458 // backtrace the 32bit side.
1459 kr
= do_backtrace32(task
, thread
, regs32
, callstack
, &bufferIndex
,
1460 bufferMaxIndex
- 1, TRUE
);
1462 if (KERN_SUCCESS
== chudxnu_kern_read(&esp
, (vm_offset_t
) regs32
->uesp
, sizeof(uint32_t)) &&
1463 bufferIndex
< bufferMaxIndex
) {
1464 callstack
[bufferIndex
++] = (uint64_t) esp
;
1466 } else if (u_regs64
&& !kern_only
) {
1467 /* backtrace user land */
1468 uint64_t rsp
= 0ULL;
1470 kr
= do_backtrace64(task
, thread
, u_regs64
, callstack
, &bufferIndex
,
1471 bufferMaxIndex
- 1, FALSE
);
1473 if (KERN_SUCCESS
== chudxnu_task_read(task
, &rsp
, (addr64_t
) u_regs64
->isf
.rsp
, sizeof(uint64_t)) &&
1474 bufferIndex
< bufferMaxIndex
) {
1475 callstack
[bufferIndex
++] = rsp
;
1477 } else if (u_regs32
&& !kern_only
) {
1480 kr
= do_backtrace32(task
, thread
, u_regs32
, callstack
, &bufferIndex
,
1481 bufferMaxIndex
- 1, FALSE
);
1483 if (KERN_SUCCESS
== chudxnu_task_read(task
, &esp
, (addr64_t
) u_regs32
->uesp
, sizeof(uint32_t)) &&
1484 bufferIndex
< bufferMaxIndex
) {
1485 callstack
[bufferIndex
++] = (uint64_t) esp
;
1489 *count
= bufferIndex
;
1495 chudxnu_thread_get_callstack64_kperf(
1497 uint64_t *callstack
,
1498 mach_msg_type_number_t
*count
,
1501 return chudxnu_thread_get_callstack64_internal(thread
, callstack
, count
, is_user
, !is_user
);
1503 #else /* !__arm__ && !__arm64__ && !__x86_64__ */
1504 #error kperf: unsupported architecture
1505 #endif /* !__arm__ && !__arm64__ && !__x86_64__ */