xref: /titanic_41/usr/src/cmd/mdb/intel/mdb/mdb_ia32util.c (revision c6be10f66609993ae7587428b9ac3847e4bc8b10)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 /*
22  * Copyright 2007 Sun Microsystems, Inc.  All rights reserved.
23  * Use is subject to license terms.
24  */
25 /*
26  * Copyright (c) 2012, Joyent, Inc.  All rights reserved.
27  * Copyright 2014 Nexenta Systems, Inc.  All rights reserved.
28  */
29 
30 #include <sys/types.h>
31 #include <sys/reg.h>
32 #include <sys/privregs.h>
33 #include <sys/stack.h>
34 #include <sys/frame.h>
35 
36 #include <mdb/mdb_ia32util.h>
37 #include <mdb/mdb_target_impl.h>
38 #include <mdb/mdb_kreg_impl.h>
39 #include <mdb/mdb_debug.h>
40 #include <mdb/mdb_modapi.h>
41 #include <mdb/mdb_err.h>
42 #include <mdb/mdb.h>
43 
44 /*
45  * We also define an array of register names and their corresponding
46  * array indices.  This is used by the getareg and putareg entry points,
47  * and also by our register variable discipline.
48  */
49 const mdb_tgt_regdesc_t mdb_ia32_kregs[] = {
50 	{ "savfp", KREG_SAVFP, MDB_TGT_R_EXPORT },
51 	{ "savpc", KREG_SAVPC, MDB_TGT_R_EXPORT },
52 	{ "eax", KREG_EAX, MDB_TGT_R_EXPORT },
53 	{ "ax", KREG_EAX, MDB_TGT_R_EXPORT | MDB_TGT_R_16 },
54 	{ "ah", KREG_EAX, MDB_TGT_R_EXPORT | MDB_TGT_R_8H },
55 	{ "al", KREG_EAX, MDB_TGT_R_EXPORT | MDB_TGT_R_8L },
56 	{ "ebx", KREG_EBX, MDB_TGT_R_EXPORT },
57 	{ "bx", KREG_EBX, MDB_TGT_R_EXPORT | MDB_TGT_R_16 },
58 	{ "bh", KREG_EBX, MDB_TGT_R_EXPORT | MDB_TGT_R_8H },
59 	{ "bl", KREG_EBX, MDB_TGT_R_EXPORT | MDB_TGT_R_8L },
60 	{ "ecx", KREG_ECX, MDB_TGT_R_EXPORT },
61 	{ "cx", KREG_ECX, MDB_TGT_R_EXPORT | MDB_TGT_R_16 },
62 	{ "ch", KREG_ECX, MDB_TGT_R_EXPORT | MDB_TGT_R_8H },
63 	{ "cl", KREG_ECX, MDB_TGT_R_EXPORT | MDB_TGT_R_8L },
64 	{ "edx", KREG_EDX, MDB_TGT_R_EXPORT },
65 	{ "dx", KREG_EDX, MDB_TGT_R_EXPORT | MDB_TGT_R_16 },
66 	{ "dh", KREG_EDX, MDB_TGT_R_EXPORT | MDB_TGT_R_8H },
67 	{ "dl", KREG_EDX, MDB_TGT_R_EXPORT | MDB_TGT_R_8L },
68 	{ "esi", KREG_ESI, MDB_TGT_R_EXPORT },
69 	{ "si", KREG_ESI, MDB_TGT_R_EXPORT | MDB_TGT_R_16 },
70 	{ "edi", KREG_EDI, MDB_TGT_R_EXPORT },
71 	{ "di",	EDI, MDB_TGT_R_EXPORT | MDB_TGT_R_16 },
72 	{ "ebp", KREG_EBP, MDB_TGT_R_EXPORT },
73 	{ "bp", KREG_EBP, MDB_TGT_R_EXPORT | MDB_TGT_R_16 },
74 	{ "esp", KREG_ESP, MDB_TGT_R_EXPORT },
75 	{ "sp", KREG_ESP, MDB_TGT_R_EXPORT | MDB_TGT_R_16 },
76 	{ "cs", KREG_CS, MDB_TGT_R_EXPORT },
77 	{ "ds", KREG_DS, MDB_TGT_R_EXPORT },
78 	{ "ss", KREG_SS, MDB_TGT_R_EXPORT },
79 	{ "es", KREG_ES, MDB_TGT_R_EXPORT },
80 	{ "fs", KREG_FS, MDB_TGT_R_EXPORT },
81 	{ "gs", KREG_GS, MDB_TGT_R_EXPORT },
82 	{ "eflags", KREG_EFLAGS, MDB_TGT_R_EXPORT },
83 	{ "eip", KREG_EIP, MDB_TGT_R_EXPORT },
84 	{ "uesp", KREG_UESP, MDB_TGT_R_EXPORT | MDB_TGT_R_PRIV },
85 	{ "usp", KREG_UESP, MDB_TGT_R_EXPORT | MDB_TGT_R_16 },
86 	{ "trapno", KREG_TRAPNO, MDB_TGT_R_EXPORT | MDB_TGT_R_PRIV },
87 	{ "err", KREG_ERR, MDB_TGT_R_EXPORT | MDB_TGT_R_PRIV },
88 	{ NULL, 0, 0 }
89 };
90 
91 void
mdb_ia32_printregs(const mdb_tgt_gregset_t * gregs)92 mdb_ia32_printregs(const mdb_tgt_gregset_t *gregs)
93 {
94 	const kreg_t *kregs = &gregs->kregs[0];
95 	kreg_t eflags = kregs[KREG_EFLAGS];
96 
97 	mdb_printf("%%cs = 0x%04x\t\t%%eax = 0x%0?p %A\n",
98 	    kregs[KREG_CS], kregs[KREG_EAX], kregs[KREG_EAX]);
99 
100 	mdb_printf("%%ds = 0x%04x\t\t%%ebx = 0x%0?p %A\n",
101 	    kregs[KREG_DS], kregs[KREG_EBX], kregs[KREG_EBX]);
102 
103 	mdb_printf("%%ss = 0x%04x\t\t%%ecx = 0x%0?p %A\n",
104 	    kregs[KREG_SS], kregs[KREG_ECX], kregs[KREG_ECX]);
105 
106 	mdb_printf("%%es = 0x%04x\t\t%%edx = 0x%0?p %A\n",
107 	    kregs[KREG_ES], kregs[KREG_EDX], kregs[KREG_EDX]);
108 
109 	mdb_printf("%%fs = 0x%04x\t\t%%esi = 0x%0?p %A\n",
110 	    kregs[KREG_FS], kregs[KREG_ESI], kregs[KREG_ESI]);
111 
112 	mdb_printf("%%gs = 0x%04x\t\t%%edi = 0x%0?p %A\n\n",
113 	    kregs[KREG_GS], kregs[KREG_EDI], kregs[KREG_EDI]);
114 
115 	mdb_printf("%%eip = 0x%0?p %A\n", kregs[KREG_EIP], kregs[KREG_EIP]);
116 	mdb_printf("%%ebp = 0x%0?p\n", kregs[KREG_EBP]);
117 	mdb_printf("%%esp = 0x%0?p\n\n", kregs[KREG_ESP]);
118 	mdb_printf("%%eflags = 0x%08x\n", eflags);
119 
120 	mdb_printf("  id=%u vip=%u vif=%u ac=%u vm=%u rf=%u nt=%u iopl=0x%x\n",
121 	    (eflags & KREG_EFLAGS_ID_MASK) >> KREG_EFLAGS_ID_SHIFT,
122 	    (eflags & KREG_EFLAGS_VIP_MASK) >> KREG_EFLAGS_VIP_SHIFT,
123 	    (eflags & KREG_EFLAGS_VIF_MASK) >> KREG_EFLAGS_VIF_SHIFT,
124 	    (eflags & KREG_EFLAGS_AC_MASK) >> KREG_EFLAGS_AC_SHIFT,
125 	    (eflags & KREG_EFLAGS_VM_MASK) >> KREG_EFLAGS_VM_SHIFT,
126 	    (eflags & KREG_EFLAGS_RF_MASK) >> KREG_EFLAGS_RF_SHIFT,
127 	    (eflags & KREG_EFLAGS_NT_MASK) >> KREG_EFLAGS_NT_SHIFT,
128 	    (eflags & KREG_EFLAGS_IOPL_MASK) >> KREG_EFLAGS_IOPL_SHIFT);
129 
130 	mdb_printf("  status=<%s,%s,%s,%s,%s,%s,%s,%s,%s>\n\n",
131 	    (eflags & KREG_EFLAGS_OF_MASK) ? "OF" : "of",
132 	    (eflags & KREG_EFLAGS_DF_MASK) ? "DF" : "df",
133 	    (eflags & KREG_EFLAGS_IF_MASK) ? "IF" : "if",
134 	    (eflags & KREG_EFLAGS_TF_MASK) ? "TF" : "tf",
135 	    (eflags & KREG_EFLAGS_SF_MASK) ? "SF" : "sf",
136 	    (eflags & KREG_EFLAGS_ZF_MASK) ? "ZF" : "zf",
137 	    (eflags & KREG_EFLAGS_AF_MASK) ? "AF" : "af",
138 	    (eflags & KREG_EFLAGS_PF_MASK) ? "PF" : "pf",
139 	    (eflags & KREG_EFLAGS_CF_MASK) ? "CF" : "cf");
140 
141 #ifndef _KMDB
142 	mdb_printf("  %%uesp = 0x%0?x\n", kregs[KREG_UESP]);
143 #endif
144 	mdb_printf("%%trapno = 0x%x\n", kregs[KREG_TRAPNO]);
145 	mdb_printf("   %%err = 0x%x\n", kregs[KREG_ERR]);
146 }
147 
148 /*
149  * Given a return address (%eip), determine the likely number of arguments
150  * that were pushed on the stack prior to its execution.  We do this by
151  * expecting that a typical call sequence consists of pushing arguments on
152  * the stack, executing a call instruction, and then performing an add
153  * on %esp to restore it to the value prior to pushing the arguments for
154  * the call.  We attempt to detect such an add, and divide the addend
155  * by the size of a word to determine the number of pushed arguments.
156  */
157 static uint_t
kvm_argcount(mdb_tgt_t * t,uintptr_t eip,ssize_t size)158 kvm_argcount(mdb_tgt_t *t, uintptr_t eip, ssize_t size)
159 {
160 	uint8_t ins[6];
161 	ulong_t n;
162 
163 	enum {
164 		M_MODRM_ESP = 0xc4,	/* Mod/RM byte indicates %esp */
165 		M_ADD_IMM32 = 0x81,	/* ADD imm32 to r/m32 */
166 		M_ADD_IMM8  = 0x83	/* ADD imm8 to r/m32 */
167 	};
168 
169 	if (mdb_tgt_vread(t, ins, sizeof (ins), eip) != sizeof (ins))
170 		return (0);
171 
172 	if (ins[1] != M_MODRM_ESP)
173 		return (0);
174 
175 	switch (ins[0]) {
176 	case M_ADD_IMM32:
177 		n = ins[2] + (ins[3] << 8) + (ins[4] << 16) + (ins[5] << 24);
178 		break;
179 
180 	case M_ADD_IMM8:
181 		n = ins[2];
182 		break;
183 
184 	default:
185 		n = 0;
186 	}
187 
188 	return (MIN((ssize_t)n, size) / sizeof (long));
189 }
190 
191 int
mdb_ia32_kvm_stack_iter(mdb_tgt_t * t,const mdb_tgt_gregset_t * gsp,mdb_tgt_stack_f * func,void * arg)192 mdb_ia32_kvm_stack_iter(mdb_tgt_t *t, const mdb_tgt_gregset_t *gsp,
193     mdb_tgt_stack_f *func, void *arg)
194 {
195 	mdb_tgt_gregset_t gregs;
196 	kreg_t *kregs = &gregs.kregs[0];
197 	int got_pc = (gsp->kregs[KREG_EIP] != 0);
198 	int err;
199 
200 	struct fr {
201 		uintptr_t fr_savfp;
202 		uintptr_t fr_savpc;
203 		long fr_argv[32];
204 	} fr;
205 
206 	uintptr_t fp = gsp->kregs[KREG_EBP];
207 	uintptr_t pc = gsp->kregs[KREG_EIP];
208 	uintptr_t lastfp = 0;
209 
210 	ssize_t size;
211 	uint_t argc;
212 	int detect_exception_frames = 0;
213 	int advance_tortoise = 1;
214 	uintptr_t tortoise_fp = 0;
215 #ifndef	_KMDB
216 	int xp;
217 
218 	if ((mdb_readsym(&xp, sizeof (xp), "xpv_panicking") != -1) && (xp > 0))
219 		detect_exception_frames = 1;
220 #endif
221 
222 	bcopy(gsp, &gregs, sizeof (gregs));
223 
224 	while (fp != 0) {
225 		if (fp & (STACK_ALIGN - 1)) {
226 			err = EMDB_STKALIGN;
227 			goto badfp;
228 		}
229 		if ((size = mdb_tgt_vread(t, &fr, sizeof (fr), fp)) >=
230 		    (ssize_t)(2 * sizeof (uintptr_t))) {
231 			size -= (ssize_t)(2 * sizeof (uintptr_t));
232 			argc = kvm_argcount(t, fr.fr_savpc, size);
233 		} else {
234 			err = EMDB_NOMAP;
235 			goto badfp;
236 		}
237 
238 		if (tortoise_fp == 0) {
239 			tortoise_fp = fp;
240 		} else {
241 			/*
242 			 * Advance tortoise_fp every other frame, so we detect
243 			 * cycles with Floyd's tortoise/hare.
244 			 */
245 			if (advance_tortoise != 0) {
246 				struct fr tfr;
247 
248 				if (mdb_tgt_vread(t, &tfr, sizeof (tfr),
249 				    tortoise_fp) != sizeof (tfr)) {
250 					err = EMDB_NOMAP;
251 					goto badfp;
252 				}
253 
254 				tortoise_fp = tfr.fr_savfp;
255 			}
256 
257 			if (fp == tortoise_fp) {
258 				err = EMDB_STKFRAME;
259 				goto badfp;
260 			}
261 		}
262 
263 		advance_tortoise = !advance_tortoise;
264 
265 		if (got_pc && func(arg, pc, argc, fr.fr_argv, &gregs) != 0)
266 			break;
267 
268 		kregs[KREG_ESP] = kregs[KREG_EBP];
269 
270 		lastfp = fp;
271 		fp = fr.fr_savfp;
272 		/*
273 		 * The Xen hypervisor marks a stack frame as belonging to
274 		 * an exception by inverting the bits of the pointer to
275 		 * that frame.  We attempt to identify these frames by
276 		 * inverting the pointer and seeing if it is within 0xfff
277 		 * bytes of the last frame.
278 		 */
279 		if (detect_exception_frames)
280 			if ((fp != 0) && (fp < lastfp) &&
281 			    ((lastfp ^ ~fp) < 0xfff))
282 				fp = ~fp;
283 
284 		kregs[KREG_EBP] = fp;
285 		kregs[KREG_EIP] = pc = fr.fr_savpc;
286 
287 		got_pc = (pc != 0);
288 	}
289 
290 	return (0);
291 
292 badfp:
293 	mdb_printf("%p [%s]", fp, mdb_strerror(err));
294 	return (set_errno(err));
295 }
296 
297 /*
298  * Determine the return address for the current frame.  Typically this is the
299  * fr_savpc value from the current frame, but we also perform some special
300  * handling to see if we are stopped on one of the first two instructions of a
301  * typical function prologue, in which case %ebp will not be set up yet.
302  */
303 int
mdb_ia32_step_out(mdb_tgt_t * t,uintptr_t * p,kreg_t pc,kreg_t fp,kreg_t sp,mdb_instr_t curinstr)304 mdb_ia32_step_out(mdb_tgt_t *t, uintptr_t *p, kreg_t pc, kreg_t fp, kreg_t sp,
305     mdb_instr_t curinstr)
306 {
307 	struct frame fr;
308 	GElf_Sym s;
309 	char buf[1];
310 
311 	enum {
312 		M_PUSHL_EBP	= 0x55, /* pushl %ebp */
313 		M_MOVL_EBP	= 0x8b  /* movl %esp, %ebp */
314 	};
315 
316 	if (mdb_tgt_lookup_by_addr(t, pc, MDB_TGT_SYM_FUZZY,
317 	    buf, 0, &s, NULL) == 0) {
318 		if (pc == s.st_value && curinstr == M_PUSHL_EBP)
319 			fp = sp - 4;
320 		else if (pc == s.st_value + 1 && curinstr == M_MOVL_EBP)
321 			fp = sp;
322 	}
323 
324 	if (mdb_tgt_vread(t, &fr, sizeof (fr), fp) == sizeof (fr)) {
325 		*p = fr.fr_savpc;
326 		return (0);
327 	}
328 
329 	return (-1); /* errno is set for us */
330 }
331 
332 /*
333  * Return the address of the next instruction following a call, or return -1
334  * and set errno to EAGAIN if the target should just single-step.  We perform
335  * a bit of disassembly on the current instruction in order to determine if it
336  * is a call and how many bytes should be skipped, depending on the exact form
337  * of the call instruction that is being used.
338  */
339 int
mdb_ia32_next(mdb_tgt_t * t,uintptr_t * p,kreg_t pc,mdb_instr_t curinstr)340 mdb_ia32_next(mdb_tgt_t *t, uintptr_t *p, kreg_t pc, mdb_instr_t curinstr)
341 {
342 	uint8_t m;
343 
344 	enum {
345 		M_CALL_REL = 0xe8, /* call near with relative displacement */
346 		M_CALL_REG = 0xff, /* call near indirect or call far register */
347 
348 		M_MODRM_MD = 0xc0, /* mask for Mod/RM byte Mod field */
349 		M_MODRM_OP = 0x38, /* mask for Mod/RM byte opcode field */
350 		M_MODRM_RM = 0x07, /* mask for Mod/RM byte R/M field */
351 
352 		M_MD_IND   = 0x00, /* Mod code for [REG] */
353 		M_MD_DSP8  = 0x40, /* Mod code for disp8[REG] */
354 		M_MD_DSP32 = 0x80, /* Mod code for disp32[REG] */
355 		M_MD_REG   = 0xc0, /* Mod code for REG */
356 
357 		M_OP_IND   = 0x10, /* Opcode for call near indirect */
358 		M_RM_DSP32 = 0x05  /* R/M code for disp32 */
359 	};
360 
361 	/*
362 	 * If the opcode is a near call with relative displacement, assume the
363 	 * displacement is a rel32 from the next instruction.
364 	 */
365 	if (curinstr == M_CALL_REL) {
366 		*p = pc + sizeof (mdb_instr_t) + sizeof (uint32_t);
367 		return (0);
368 	}
369 
370 	/*
371 	 * If the opcode is a call near indirect or call far register opcode,
372 	 * read the subsequent Mod/RM byte to perform additional decoding.
373 	 */
374 	if (curinstr == M_CALL_REG) {
375 		if (mdb_tgt_vread(t, &m, sizeof (m), pc + 1) != sizeof (m))
376 			return (-1); /* errno is set for us */
377 
378 		/*
379 		 * If the Mod/RM opcode extension indicates a near indirect
380 		 * call, then skip the appropriate number of additional
381 		 * bytes depending on the addressing form that is used.
382 		 */
383 		if ((m & M_MODRM_OP) == M_OP_IND) {
384 			switch (m & M_MODRM_MD) {
385 			case M_MD_DSP8:
386 				*p = pc + 3; /* skip pr_instr, m, disp8 */
387 				break;
388 			case M_MD_DSP32:
389 				*p = pc + 6; /* skip pr_instr, m, disp32 */
390 				break;
391 			case M_MD_IND:
392 				if ((m & M_MODRM_RM) == M_RM_DSP32) {
393 					*p = pc + 6;
394 					break; /* skip pr_instr, m, disp32 */
395 				}
396 				/* FALLTHRU */
397 			case M_MD_REG:
398 				*p = pc + 2; /* skip pr_instr, m */
399 				break;
400 			}
401 			return (0);
402 		}
403 	}
404 
405 	return (set_errno(EAGAIN));
406 }
407 
408 /*ARGSUSED*/
409 int
mdb_ia32_kvm_frame(void * arglim,uintptr_t pc,uint_t argc,const long * argv,const mdb_tgt_gregset_t * gregs)410 mdb_ia32_kvm_frame(void *arglim, uintptr_t pc, uint_t argc, const long *argv,
411     const mdb_tgt_gregset_t *gregs)
412 {
413 	argc = MIN(argc, (uint_t)arglim);
414 	mdb_printf("%a(", pc);
415 
416 	if (argc != 0) {
417 		mdb_printf("%lr", *argv++);
418 		for (argc--; argc != 0; argc--)
419 			mdb_printf(", %lr", *argv++);
420 	}
421 
422 	mdb_printf(")\n");
423 	return (0);
424 }
425 
426 int
mdb_ia32_kvm_framev(void * arglim,uintptr_t pc,uint_t argc,const long * argv,const mdb_tgt_gregset_t * gregs)427 mdb_ia32_kvm_framev(void *arglim, uintptr_t pc, uint_t argc, const long *argv,
428     const mdb_tgt_gregset_t *gregs)
429 {
430 	argc = MIN(argc, (uint_t)arglim);
431 	mdb_printf("%0?lr %a(", gregs->kregs[KREG_EBP], pc);
432 
433 	if (argc != 0) {
434 		mdb_printf("%lr", *argv++);
435 		for (argc--; argc != 0; argc--)
436 			mdb_printf(", %lr", *argv++);
437 	}
438 
439 	mdb_printf(")\n");
440 	return (0);
441 }
442