1 /* 2 * CDDL HEADER START 3 * 4 * The contents of this file are subject to the terms of the 5 * Common Development and Distribution License (the "License"). 6 * You may not use this file except in compliance with the License. 7 * 8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 9 * or http://www.opensolaris.org/os/licensing. 10 * See the License for the specific language governing permissions 11 * and limitations under the License. 12 * 13 * When distributing Covered Code, include this CDDL HEADER in each 14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 15 * If applicable, add the following below this CDDL HEADER, with the 16 * fields enclosed by brackets "[]" replaced with your own identifying 17 * information: Portions Copyright [yyyy] [name of copyright owner] 18 * 19 * CDDL HEADER END 20 */ 21 /* 22 * Copyright 2007 Sun Microsystems, Inc. All rights reserved. 23 * Use is subject to license terms. 24 */ 25 /* 26 * Copyright (c) 2018, Joyent, Inc. All rights reserved. 27 * Copyright 2014 Nexenta Systems, Inc. All rights reserved. 28 */ 29 30 #include <sys/types.h> 31 #include <sys/types32.h> 32 #include <sys/reg.h> 33 #include <sys/privregs.h> 34 #include <sys/stack.h> 35 #include <sys/frame.h> 36 37 #include <mdb/mdb_isautil.h> 38 #include <mdb/mdb_ia32util.h> 39 #include <mdb/mdb_target_impl.h> 40 #include <mdb/mdb_kreg_impl.h> 41 #include <mdb/mdb_debug.h> 42 #include <mdb/mdb_modapi.h> 43 #include <mdb/mdb_err.h> 44 #include <mdb/mdb.h> 45 46 #ifndef __amd64 47 /* 48 * We also define an array of register names and their corresponding 49 * array indices. This is used by the getareg and putareg entry points, 50 * and also by our register variable discipline. 51 * 52 * When built into an amd64 mdb this won't be used as it's only a subset of 53 * mdb_amd64_kregs, hence the #ifdef. 54 */ 55 const mdb_tgt_regdesc_t mdb_ia32_kregs[] = { 56 { "savfp", KREG_SAVFP, MDB_TGT_R_EXPORT }, 57 { "savpc", KREG_SAVPC, MDB_TGT_R_EXPORT }, 58 { "eax", KREG_EAX, MDB_TGT_R_EXPORT }, 59 { "ax", KREG_EAX, MDB_TGT_R_EXPORT | MDB_TGT_R_16 }, 60 { "ah", KREG_EAX, MDB_TGT_R_EXPORT | MDB_TGT_R_8H }, 61 { "al", KREG_EAX, MDB_TGT_R_EXPORT | MDB_TGT_R_8L }, 62 { "ebx", KREG_EBX, MDB_TGT_R_EXPORT }, 63 { "bx", KREG_EBX, MDB_TGT_R_EXPORT | MDB_TGT_R_16 }, 64 { "bh", KREG_EBX, MDB_TGT_R_EXPORT | MDB_TGT_R_8H }, 65 { "bl", KREG_EBX, MDB_TGT_R_EXPORT | MDB_TGT_R_8L }, 66 { "ecx", KREG_ECX, MDB_TGT_R_EXPORT }, 67 { "cx", KREG_ECX, MDB_TGT_R_EXPORT | MDB_TGT_R_16 }, 68 { "ch", KREG_ECX, MDB_TGT_R_EXPORT | MDB_TGT_R_8H }, 69 { "cl", KREG_ECX, MDB_TGT_R_EXPORT | MDB_TGT_R_8L }, 70 { "edx", KREG_EDX, MDB_TGT_R_EXPORT }, 71 { "dx", KREG_EDX, MDB_TGT_R_EXPORT | MDB_TGT_R_16 }, 72 { "dh", KREG_EDX, MDB_TGT_R_EXPORT | MDB_TGT_R_8H }, 73 { "dl", KREG_EDX, MDB_TGT_R_EXPORT | MDB_TGT_R_8L }, 74 { "esi", KREG_ESI, MDB_TGT_R_EXPORT }, 75 { "si", KREG_ESI, MDB_TGT_R_EXPORT | MDB_TGT_R_16 }, 76 { "edi", KREG_EDI, MDB_TGT_R_EXPORT }, 77 { "di", EDI, MDB_TGT_R_EXPORT | MDB_TGT_R_16 }, 78 { "ebp", KREG_EBP, MDB_TGT_R_EXPORT }, 79 { "bp", KREG_EBP, MDB_TGT_R_EXPORT | MDB_TGT_R_16 }, 80 { "esp", KREG_ESP, MDB_TGT_R_EXPORT }, 81 { "sp", KREG_ESP, MDB_TGT_R_EXPORT | MDB_TGT_R_16 }, 82 { "cs", KREG_CS, MDB_TGT_R_EXPORT }, 83 { "ds", KREG_DS, MDB_TGT_R_EXPORT }, 84 { "ss", KREG_SS, MDB_TGT_R_EXPORT }, 85 { "es", KREG_ES, MDB_TGT_R_EXPORT }, 86 { "fs", KREG_FS, MDB_TGT_R_EXPORT }, 87 { "gs", KREG_GS, MDB_TGT_R_EXPORT }, 88 { "eflags", KREG_EFLAGS, MDB_TGT_R_EXPORT }, 89 { "eip", KREG_EIP, MDB_TGT_R_EXPORT }, 90 { "uesp", KREG_UESP, MDB_TGT_R_EXPORT | MDB_TGT_R_PRIV }, 91 { "usp", KREG_UESP, MDB_TGT_R_EXPORT | MDB_TGT_R_16 }, 92 { "trapno", KREG_TRAPNO, MDB_TGT_R_EXPORT | MDB_TGT_R_PRIV }, 93 { "err", KREG_ERR, MDB_TGT_R_EXPORT | MDB_TGT_R_PRIV }, 94 { NULL, 0, 0 } 95 }; 96 #endif 97 98 void 99 mdb_ia32_printregs(const mdb_tgt_gregset_t *gregs) 100 { 101 const kreg_t *kregs = &gregs->kregs[0]; 102 kreg_t eflags = kregs[KREG_EFLAGS]; 103 104 mdb_printf("%%cs = 0x%04x\t\t%%eax = 0x%08p %A\n", 105 kregs[KREG_CS], kregs[KREG_EAX], kregs[KREG_EAX]); 106 107 mdb_printf("%%ds = 0x%04x\t\t%%ebx = 0x%08p %A\n", 108 kregs[KREG_DS], kregs[KREG_EBX], kregs[KREG_EBX]); 109 110 mdb_printf("%%ss = 0x%04x\t\t%%ecx = 0x%08p %A\n", 111 kregs[KREG_SS], kregs[KREG_ECX], kregs[KREG_ECX]); 112 113 mdb_printf("%%es = 0x%04x\t\t%%edx = 0x%08p %A\n", 114 kregs[KREG_ES], kregs[KREG_EDX], kregs[KREG_EDX]); 115 116 mdb_printf("%%fs = 0x%04x\t\t%%esi = 0x%08p %A\n", 117 kregs[KREG_FS], kregs[KREG_ESI], kregs[KREG_ESI]); 118 119 mdb_printf("%%gs = 0x%04x\t\t%%edi = 0x%08p %A\n\n", 120 kregs[KREG_GS], kregs[KREG_EDI], kregs[KREG_EDI]); 121 122 mdb_printf("%%eip = 0x%08p %A\n", kregs[KREG_EIP], kregs[KREG_EIP]); 123 mdb_printf("%%ebp = 0x%08p\n", kregs[KREG_EBP]); 124 mdb_printf("%%esp = 0x%08p\n\n", kregs[KREG_ESP]); 125 mdb_printf("%%eflags = 0x%08x\n", eflags); 126 127 mdb_printf(" id=%u vip=%u vif=%u ac=%u vm=%u rf=%u nt=%u iopl=0x%x\n", 128 (eflags & KREG_EFLAGS_ID_MASK) >> KREG_EFLAGS_ID_SHIFT, 129 (eflags & KREG_EFLAGS_VIP_MASK) >> KREG_EFLAGS_VIP_SHIFT, 130 (eflags & KREG_EFLAGS_VIF_MASK) >> KREG_EFLAGS_VIF_SHIFT, 131 (eflags & KREG_EFLAGS_AC_MASK) >> KREG_EFLAGS_AC_SHIFT, 132 (eflags & KREG_EFLAGS_VM_MASK) >> KREG_EFLAGS_VM_SHIFT, 133 (eflags & KREG_EFLAGS_RF_MASK) >> KREG_EFLAGS_RF_SHIFT, 134 (eflags & KREG_EFLAGS_NT_MASK) >> KREG_EFLAGS_NT_SHIFT, 135 (eflags & KREG_EFLAGS_IOPL_MASK) >> KREG_EFLAGS_IOPL_SHIFT); 136 137 mdb_printf(" status=<%s,%s,%s,%s,%s,%s,%s,%s,%s>\n\n", 138 (eflags & KREG_EFLAGS_OF_MASK) ? "OF" : "of", 139 (eflags & KREG_EFLAGS_DF_MASK) ? "DF" : "df", 140 (eflags & KREG_EFLAGS_IF_MASK) ? "IF" : "if", 141 (eflags & KREG_EFLAGS_TF_MASK) ? "TF" : "tf", 142 (eflags & KREG_EFLAGS_SF_MASK) ? "SF" : "sf", 143 (eflags & KREG_EFLAGS_ZF_MASK) ? "ZF" : "zf", 144 (eflags & KREG_EFLAGS_AF_MASK) ? "AF" : "af", 145 (eflags & KREG_EFLAGS_PF_MASK) ? "PF" : "pf", 146 (eflags & KREG_EFLAGS_CF_MASK) ? "CF" : "cf"); 147 148 #if !defined(__amd64) && !defined(_KMDB) 149 mdb_printf(" %%uesp = 0x%08x\n", kregs[KREG_UESP]); 150 #endif 151 mdb_printf("%%trapno = 0x%x\n", kregs[KREG_TRAPNO]); 152 mdb_printf(" %%err = 0x%x\n", kregs[KREG_ERR]); 153 } 154 155 /* 156 * Given a return address (%eip), determine the likely number of arguments 157 * that were pushed on the stack prior to its execution. We do this by 158 * expecting that a typical call sequence consists of pushing arguments on 159 * the stack, executing a call instruction, and then performing an add 160 * on %esp to restore it to the value prior to pushing the arguments for 161 * the call. We attempt to detect such an add, and divide the addend 162 * by the size of a word to determine the number of pushed arguments. 163 */ 164 static uint_t 165 kvm_argcount(mdb_tgt_t *t, uintptr_t eip, ssize_t size) 166 { 167 uint8_t ins[6]; 168 ulong_t n; 169 170 enum { 171 M_MODRM_ESP = 0xc4, /* Mod/RM byte indicates %esp */ 172 M_ADD_IMM32 = 0x81, /* ADD imm32 to r/m32 */ 173 M_ADD_IMM8 = 0x83 /* ADD imm8 to r/m32 */ 174 }; 175 176 if (mdb_tgt_aread(t, MDB_TGT_AS_VIRT_I, ins, sizeof (ins), eip) != 177 sizeof (ins)) 178 return (0); 179 180 if (ins[1] != M_MODRM_ESP) 181 return (0); 182 183 switch (ins[0]) { 184 case M_ADD_IMM32: 185 n = ins[2] + (ins[3] << 8) + (ins[4] << 16) + (ins[5] << 24); 186 break; 187 188 case M_ADD_IMM8: 189 n = ins[2]; 190 break; 191 192 default: 193 n = 0; 194 } 195 196 return (MIN((ssize_t)n, size) / sizeof (uint32_t)); 197 } 198 199 int 200 mdb_ia32_kvm_stack_iter(mdb_tgt_t *t, const mdb_tgt_gregset_t *gsp, 201 mdb_tgt_stack_f *func, void *arg) 202 { 203 mdb_tgt_gregset_t gregs; 204 kreg_t *kregs = &gregs.kregs[0]; 205 int got_pc = (gsp->kregs[KREG_EIP] != 0); 206 int err; 207 208 struct fr { 209 uintptr32_t fr_savfp; 210 uintptr32_t fr_savpc; 211 uint32_t fr_argv[32]; 212 } fr; 213 214 uintptr_t fp = gsp->kregs[KREG_EBP]; 215 uintptr_t pc = gsp->kregs[KREG_EIP]; 216 uintptr_t lastfp = 0; 217 218 ssize_t size; 219 uint_t argc; 220 int detect_exception_frames = 0; 221 int advance_tortoise = 1; 222 uintptr_t tortoise_fp = 0; 223 #ifndef _KMDB 224 int xp; 225 226 if ((mdb_readsym(&xp, sizeof (xp), "xpv_panicking") != -1) && (xp > 0)) 227 detect_exception_frames = 1; 228 #endif 229 230 bcopy(gsp, &gregs, sizeof (gregs)); 231 232 while (fp != 0) { 233 if (fp & (STACK_ALIGN - 1)) { 234 err = EMDB_STKALIGN; 235 goto badfp; 236 } 237 if ((size = mdb_tgt_aread(t, MDB_TGT_AS_VIRT_S, &fr, 238 sizeof (fr), fp)) >= (ssize_t)(2 * sizeof (uintptr32_t))) { 239 size -= (ssize_t)(2 * sizeof (uintptr32_t)); 240 argc = kvm_argcount(t, fr.fr_savpc, size); 241 } else { 242 err = EMDB_NOMAP; 243 goto badfp; 244 } 245 246 if (tortoise_fp == 0) { 247 tortoise_fp = fp; 248 } else { 249 /* 250 * Advance tortoise_fp every other frame, so we detect 251 * cycles with Floyd's tortoise/hare. 252 */ 253 if (advance_tortoise != 0) { 254 struct fr tfr; 255 256 if (mdb_tgt_aread(t, MDB_TGT_AS_VIRT_S, &tfr, 257 sizeof (tfr), tortoise_fp) != 258 sizeof (tfr)) { 259 err = EMDB_NOMAP; 260 goto badfp; 261 } 262 263 tortoise_fp = tfr.fr_savfp; 264 } 265 266 if (fp == tortoise_fp) { 267 err = EMDB_STKFRAME; 268 goto badfp; 269 } 270 } 271 272 advance_tortoise = !advance_tortoise; 273 274 if (got_pc && 275 func(arg, pc, argc, (const long *)fr.fr_argv, &gregs) != 0) 276 break; 277 278 kregs[KREG_ESP] = kregs[KREG_EBP]; 279 280 lastfp = fp; 281 fp = fr.fr_savfp; 282 /* 283 * The Xen hypervisor marks a stack frame as belonging to 284 * an exception by inverting the bits of the pointer to 285 * that frame. We attempt to identify these frames by 286 * inverting the pointer and seeing if it is within 0xfff 287 * bytes of the last frame. 288 */ 289 if (detect_exception_frames) 290 if ((fp != 0) && (fp < lastfp) && 291 ((lastfp ^ ~fp) < 0xfff)) 292 fp = ~fp; 293 294 kregs[KREG_EBP] = fp; 295 kregs[KREG_EIP] = pc = fr.fr_savpc; 296 297 got_pc = (pc != 0); 298 } 299 300 return (0); 301 302 badfp: 303 mdb_printf("%p [%s]", fp, mdb_strerror(err)); 304 return (set_errno(err)); 305 } 306 307 #ifndef __amd64 308 /* 309 * The functions mdb_ia32_step_out and mdb_ia32_next haven't yet been adapted 310 * to work when built for an amd64 mdb. They are unused by the amd64-only bhyve 311 * target, hence the #ifdef. 312 */ 313 /* 314 * Determine the return address for the current frame. Typically this is the 315 * fr_savpc value from the current frame, but we also perform some special 316 * handling to see if we are stopped on one of the first two instructions of a 317 * typical function prologue, in which case %ebp will not be set up yet. 318 */ 319 int 320 mdb_ia32_step_out(mdb_tgt_t *t, uintptr_t *p, kreg_t pc, kreg_t fp, kreg_t sp, 321 mdb_instr_t curinstr) 322 { 323 struct frame fr; 324 GElf_Sym s; 325 char buf[1]; 326 327 enum { 328 M_PUSHL_EBP = 0x55, /* pushl %ebp */ 329 M_MOVL_EBP = 0x8b /* movl %esp, %ebp */ 330 }; 331 332 if (mdb_tgt_lookup_by_addr(t, pc, MDB_TGT_SYM_FUZZY, 333 buf, 0, &s, NULL) == 0) { 334 if (pc == s.st_value && curinstr == M_PUSHL_EBP) 335 fp = sp - 4; 336 else if (pc == s.st_value + 1 && curinstr == M_MOVL_EBP) 337 fp = sp; 338 } 339 340 if (mdb_tgt_aread(t, MDB_TGT_AS_VIRT_S, &fr, sizeof (fr), fp) == 341 sizeof (fr)) { 342 *p = fr.fr_savpc; 343 return (0); 344 } 345 346 return (-1); /* errno is set for us */ 347 } 348 349 /* 350 * Return the address of the next instruction following a call, or return -1 351 * and set errno to EAGAIN if the target should just single-step. We perform 352 * a bit of disassembly on the current instruction in order to determine if it 353 * is a call and how many bytes should be skipped, depending on the exact form 354 * of the call instruction that is being used. 355 */ 356 int 357 mdb_ia32_next(mdb_tgt_t *t, uintptr_t *p, kreg_t pc, mdb_instr_t curinstr) 358 { 359 uint8_t m; 360 361 enum { 362 M_CALL_REL = 0xe8, /* call near with relative displacement */ 363 M_CALL_REG = 0xff, /* call near indirect or call far register */ 364 365 M_MODRM_MD = 0xc0, /* mask for Mod/RM byte Mod field */ 366 M_MODRM_OP = 0x38, /* mask for Mod/RM byte opcode field */ 367 M_MODRM_RM = 0x07, /* mask for Mod/RM byte R/M field */ 368 369 M_MD_IND = 0x00, /* Mod code for [REG] */ 370 M_MD_DSP8 = 0x40, /* Mod code for disp8[REG] */ 371 M_MD_DSP32 = 0x80, /* Mod code for disp32[REG] */ 372 M_MD_REG = 0xc0, /* Mod code for REG */ 373 374 M_OP_IND = 0x10, /* Opcode for call near indirect */ 375 M_RM_DSP32 = 0x05 /* R/M code for disp32 */ 376 }; 377 378 /* 379 * If the opcode is a near call with relative displacement, assume the 380 * displacement is a rel32 from the next instruction. 381 */ 382 if (curinstr == M_CALL_REL) { 383 *p = pc + sizeof (mdb_instr_t) + sizeof (uint32_t); 384 return (0); 385 } 386 387 /* 388 * If the opcode is a call near indirect or call far register opcode, 389 * read the subsequent Mod/RM byte to perform additional decoding. 390 */ 391 if (curinstr == M_CALL_REG) { 392 if (mdb_tgt_aread(t, MDB_TGT_AS_VIRT_I, &m, sizeof (m), pc + 1) 393 != sizeof (m)) 394 return (-1); /* errno is set for us */ 395 396 /* 397 * If the Mod/RM opcode extension indicates a near indirect 398 * call, then skip the appropriate number of additional 399 * bytes depending on the addressing form that is used. 400 */ 401 if ((m & M_MODRM_OP) == M_OP_IND) { 402 switch (m & M_MODRM_MD) { 403 case M_MD_DSP8: 404 *p = pc + 3; /* skip pr_instr, m, disp8 */ 405 break; 406 case M_MD_DSP32: 407 *p = pc + 6; /* skip pr_instr, m, disp32 */ 408 break; 409 case M_MD_IND: 410 if ((m & M_MODRM_RM) == M_RM_DSP32) { 411 *p = pc + 6; 412 break; /* skip pr_instr, m, disp32 */ 413 } 414 /* FALLTHRU */ 415 case M_MD_REG: 416 *p = pc + 2; /* skip pr_instr, m */ 417 break; 418 } 419 return (0); 420 } 421 } 422 423 return (set_errno(EAGAIN)); 424 } 425 #endif 426 427 /*ARGSUSED*/ 428 int 429 mdb_ia32_kvm_frame(void *arglim, uintptr_t pc, uint_t argc, const long *largv, 430 const mdb_tgt_gregset_t *gregs) 431 { 432 const uint32_t *argv = (const uint32_t *)largv; 433 434 argc = MIN(argc, (uintptr_t)arglim); 435 mdb_printf("%a(", pc); 436 437 if (argc != 0) { 438 mdb_printf("%lr", *argv++); 439 for (argc--; argc != 0; argc--) 440 mdb_printf(", %lr", *argv++); 441 } 442 443 mdb_printf(")\n"); 444 return (0); 445 } 446 447 int 448 mdb_ia32_kvm_framev(void *arglim, uintptr_t pc, uint_t argc, const long *largv, 449 const mdb_tgt_gregset_t *gregs) 450 { 451 const uint32_t *argv = (const uint32_t *)largv; 452 453 argc = MIN(argc, (uintptr_t)arglim); 454 mdb_printf("%08lr %a(", gregs->kregs[KREG_EBP], pc); 455 456 if (argc != 0) { 457 mdb_printf("%lr", *argv++); 458 for (argc--; argc != 0; argc--) 459 mdb_printf(", %lr", *argv++); 460 } 461 462 mdb_printf(")\n"); 463 return (0); 464 } 465