1 /*
2 * Copyright (c) 2000-2016 Apple Inc. All rights reserved.
3 *
4 * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
5 *
6 * This file contains Original Code and/or Modifications of Original Code
7 * as defined in and that are subject to the Apple Public Source License
8 * Version 2.0 (the 'License'). You may not use this file except in
9 * compliance with the License. The rights granted to you under the License
10 * may not be used to create, or enable the creation or redistribution of,
11 * unlawful or unlicensed copies of an Apple operating system, or to
12 * circumvent, violate, or enable the circumvention or violation of, any
13 * terms of an Apple operating system software license agreement.
14 *
15 * Please obtain a copy of the License at
16 * http://www.opensource.apple.com/apsl/ and read it before using this file.
17 *
18 * The Original Code and all software distributed under the License are
19 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
20 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
21 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
22 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
23 * Please see the License for the specific language governing rights and
24 * limitations under the License.
25 *
26 * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
27 */
28
29 #include <mach/mach_types.h>
30 #include <mach/exception_types.h>
31 #include <arm/exception.h>
32 #include <arm/pmap.h>
33 #include <arm64/proc_reg.h>
34 #include <arm/thread.h>
35 #include <arm/trap_internal.h>
36 #include <arm/cpu_data_internal.h>
37 #include <kdp/kdp_internal.h>
38 #include <kern/debug.h>
39 #include <IOKit/IOPlatformExpert.h>
40 #include <libkern/OSAtomic.h>
41 #include <vm/vm_map.h>
42 #include <arm/misc_protos.h>
43
44 #if defined(HAS_APPLE_PAC)
45 #include <ptrauth.h>
46 #endif
47
48 #define KDP_TEST_HARNESS 0
49 #if KDP_TEST_HARNESS
50 #define dprintf(x) kprintf x
51 #else
52 #define dprintf(x) do {} while (0)
53 #endif
54
55 void halt_all_cpus(boolean_t);
56 void kdp_call(void);
57 int kdp_getc(void);
58 int machine_trace_thread(thread_t thread,
59 char * tracepos,
60 char * tracebound,
61 int nframes,
62 uint32_t * thread_trace_flags);
63 int machine_trace_thread64(thread_t thread,
64 char * tracepos,
65 char * tracebound,
66 int nframes,
67 uint32_t * thread_trace_flags);
68
69 void kdp_trap(unsigned int, struct arm_saved_state * saved_state);
70
71 extern bool machine_trace_thread_validate_kva(vm_offset_t addr);
72
73 #if CONFIG_KDP_INTERACTIVE_DEBUGGING
74 void
kdp_exception(unsigned char * pkt,int * len,unsigned short * remote_port,unsigned int exception,unsigned int code,unsigned int subcode)75 kdp_exception(
76 unsigned char * pkt, int * len, unsigned short * remote_port, unsigned int exception, unsigned int code, unsigned int subcode)
77 {
78 struct {
79 kdp_exception_t pkt;
80 kdp_exc_info_t exc;
81 } aligned_pkt;
82
83 kdp_exception_t * rq = (kdp_exception_t *)&aligned_pkt;
84
85 bcopy((char *)pkt, (char *)rq, sizeof(*rq));
86 rq->hdr.request = KDP_EXCEPTION;
87 rq->hdr.is_reply = 0;
88 rq->hdr.seq = kdp.exception_seq;
89 rq->hdr.key = 0;
90 rq->hdr.len = sizeof(*rq) + sizeof(kdp_exc_info_t);
91
92 rq->n_exc_info = 1;
93 rq->exc_info[0].cpu = 0;
94 rq->exc_info[0].exception = exception;
95 rq->exc_info[0].code = code;
96 rq->exc_info[0].subcode = subcode;
97
98 rq->hdr.len += rq->n_exc_info * sizeof(kdp_exc_info_t);
99
100 bcopy((char *)rq, (char *)pkt, rq->hdr.len);
101
102 kdp.exception_ack_needed = TRUE;
103
104 *remote_port = kdp.exception_port;
105 *len = rq->hdr.len;
106 }
107
108 boolean_t
kdp_exception_ack(unsigned char * pkt,int len)109 kdp_exception_ack(unsigned char * pkt, int len)
110 {
111 kdp_exception_ack_t aligned_pkt;
112 kdp_exception_ack_t * rq = (kdp_exception_ack_t *)&aligned_pkt;
113
114 if ((unsigned)len < sizeof(*rq)) {
115 return FALSE;
116 }
117
118 bcopy((char *)pkt, (char *)rq, sizeof(*rq));
119
120 if (!rq->hdr.is_reply || rq->hdr.request != KDP_EXCEPTION) {
121 return FALSE;
122 }
123
124 dprintf(("kdp_exception_ack seq %x %x\n", rq->hdr.seq, kdp.exception_seq));
125
126 if (rq->hdr.seq == kdp.exception_seq) {
127 kdp.exception_ack_needed = FALSE;
128 kdp.exception_seq++;
129 }
130 return TRUE;
131 }
132
133 static void
kdp_getintegerstate(char * out_state)134 kdp_getintegerstate(char * out_state)
135 {
136 #if defined(__arm64__)
137 struct arm_thread_state64 thread_state64;
138 arm_saved_state_t *saved_state;
139
140 saved_state = kdp.saved_state;
141 assert(is_saved_state64(saved_state));
142
143 bzero((char *) &thread_state64, sizeof(struct arm_thread_state64));
144
145 saved_state_to_thread_state64(saved_state, &thread_state64);
146
147 bcopy((char *) &thread_state64, (char *) out_state, sizeof(struct arm_thread_state64));
148 #else
149 #error Unknown architecture.
150 #endif
151 }
152
153 kdp_error_t
kdp_machine_read_regs(__unused unsigned int cpu,unsigned int flavor,char * data,int * size)154 kdp_machine_read_regs(__unused unsigned int cpu, unsigned int flavor, char * data, int * size)
155 {
156 switch (flavor) {
157 #if defined(__arm64__)
158 case ARM_THREAD_STATE64:
159 dprintf(("kdp_readregs THREAD_STATE64\n"));
160 kdp_getintegerstate(data);
161 *size = ARM_THREAD_STATE64_COUNT * sizeof(int);
162 return KDPERR_NO_ERROR;
163 #endif
164
165 case ARM_VFP_STATE:
166 dprintf(("kdp_readregs THREAD_FPSTATE\n"));
167 bzero((char *) data, sizeof(struct arm_vfp_state));
168 *size = ARM_VFP_STATE_COUNT * sizeof(int);
169 return KDPERR_NO_ERROR;
170
171 default:
172 dprintf(("kdp_readregs bad flavor %d\n"));
173 return KDPERR_BADFLAVOR;
174 }
175 }
176
177 static void
kdp_setintegerstate(char * state_in)178 kdp_setintegerstate(char * state_in)
179 {
180 #if defined(__arm64__)
181 struct arm_thread_state64 thread_state64;
182 struct arm_saved_state *saved_state;
183
184 bcopy((char *) state_in, (char *) &thread_state64, sizeof(struct arm_thread_state64));
185 saved_state = kdp.saved_state;
186 assert(is_saved_state64(saved_state));
187
188 /*
189 * thread_state64_to_saved_state() expects the target thread to be EL0
190 * state and ignores attempts to change many CPSR bits.
191 * kdp_setintegerstate() is rarely used and is gated behind significant
192 * security boundaries. So rather than creating a variant of
193 * thread_state64_to_saved_state() just for kdp_setintegerstate(), it's
194 * simpler to reset CPSR.M before converting, then adjust CPSR after
195 * conversion.
196 */
197 uint32_t cpsr = get_saved_state_cpsr(saved_state);
198 cpsr &= ~(PSR64_MODE_EL_MASK);
199 cpsr |= PSR64_MODE_EL0;
200 set_saved_state_cpsr(saved_state, cpsr);
201 thread_state64_to_saved_state(&thread_state64, saved_state);
202 set_saved_state_cpsr(saved_state, thread_state64.cpsr);
203 #else
204 #error Unknown architecture.
205 #endif
206 }
207
208 kdp_error_t
kdp_machine_write_regs(__unused unsigned int cpu,unsigned int flavor,char * data,__unused int * size)209 kdp_machine_write_regs(__unused unsigned int cpu, unsigned int flavor, char * data, __unused int * size)
210 {
211 switch (flavor) {
212 #if defined(__arm64__)
213 case ARM_THREAD_STATE64:
214 dprintf(("kdp_writeregs THREAD_STATE64\n"));
215 kdp_setintegerstate(data);
216 return KDPERR_NO_ERROR;
217 #endif
218
219 case ARM_VFP_STATE:
220 dprintf(("kdp_writeregs THREAD_FPSTATE\n"));
221 return KDPERR_NO_ERROR;
222
223 default:
224 dprintf(("kdp_writeregs bad flavor %d\n"));
225 return KDPERR_BADFLAVOR;
226 }
227 }
228
229 void
kdp_machine_hostinfo(kdp_hostinfo_t * hostinfo)230 kdp_machine_hostinfo(kdp_hostinfo_t * hostinfo)
231 {
232 hostinfo->cpus_mask = 1;
233 hostinfo->cpu_type = slot_type(0);
234 hostinfo->cpu_subtype = slot_subtype(0);
235 }
236
237 __attribute__((noreturn))
238 void
kdp_panic(const char * fmt,...)239 kdp_panic(const char * fmt, ...)
240 {
241 #pragma clang diagnostic push
242 #pragma clang diagnostic ignored "-Wformat-nonliteral"
243 #pragma clang diagnostic ignored "-Wformat"
244 char kdp_fmt[256];
245 va_list args;
246
247 va_start(args, fmt);
248 (void) snprintf(kdp_fmt, sizeof(kdp_fmt), "kdp panic: %s", fmt);
249 vprintf(kdp_fmt, args);
250 va_end(args);
251
252 while (1) {
253 }
254 ;
255 #pragma clang diagnostic pop
256 }
257
258 int
kdp_intr_disbl(void)259 kdp_intr_disbl(void)
260 {
261 return splhigh();
262 }
263
264 void
kdp_intr_enbl(int s)265 kdp_intr_enbl(int s)
266 {
267 splx(s);
268 }
269
270 void
kdp_us_spin(int usec)271 kdp_us_spin(int usec)
272 {
273 delay(usec / 100);
274 }
275
276 void
kdp_call(void)277 kdp_call(void)
278 {
279 Debugger("inline call to debugger(machine_startup)");
280 }
281
282 int
kdp_getc(void)283 kdp_getc(void)
284 {
285 return console_try_read_char();
286 }
287
288 void
kdp_machine_get_breakinsn(uint8_t * bytes,uint32_t * size)289 kdp_machine_get_breakinsn(uint8_t * bytes, uint32_t * size)
290 {
291 *(uint32_t *)bytes = GDB_TRAP_INSTR1;
292 *size = sizeof(uint32_t);
293 }
294
295 void
kdp_sync_cache(void)296 kdp_sync_cache(void)
297 {
298 }
299
300 int
kdp_machine_ioport_read(kdp_readioport_req_t * rq,caddr_t data,uint16_t lcpu)301 kdp_machine_ioport_read(kdp_readioport_req_t * rq, caddr_t data, uint16_t lcpu)
302 {
303 #pragma unused(rq, data, lcpu)
304 return 0;
305 }
306
307 int
kdp_machine_ioport_write(kdp_writeioport_req_t * rq,caddr_t data,uint16_t lcpu)308 kdp_machine_ioport_write(kdp_writeioport_req_t * rq, caddr_t data, uint16_t lcpu)
309 {
310 #pragma unused(rq, data, lcpu)
311 return 0;
312 }
313
314 int
kdp_machine_msr64_read(kdp_readmsr64_req_t * rq,caddr_t data,uint16_t lcpu)315 kdp_machine_msr64_read(kdp_readmsr64_req_t *rq, caddr_t data, uint16_t lcpu)
316 {
317 #pragma unused(rq, data, lcpu)
318 return 0;
319 }
320
321 int
kdp_machine_msr64_write(kdp_writemsr64_req_t * rq,caddr_t data,uint16_t lcpu)322 kdp_machine_msr64_write(kdp_writemsr64_req_t *rq, caddr_t data, uint16_t lcpu)
323 {
324 #pragma unused(rq, data, lcpu)
325 return 0;
326 }
327 #endif /* CONFIG_KDP_INTERACTIVE_DEBUGGING */
328
329 void
kdp_trap(unsigned int exception,struct arm_saved_state * saved_state)330 kdp_trap(unsigned int exception, struct arm_saved_state * saved_state)
331 {
332 handle_debugger_trap(exception, 0, 0, saved_state);
333
334 #if defined(__arm64__)
335 assert(is_saved_state64(saved_state));
336
337 #if HAS_APPLE_PAC
338 MANIPULATE_SIGNED_THREAD_STATE(saved_state,
339 "ldr w6, [x1] \n"
340 "mov w7, %[GDB_TRAP_INSTR1_L] \n"
341 "movk w7, %[GDB_TRAP_INSTR1_H], lsl #16 \n"
342 "cmp w6, w7 \n"
343 "b.eq 1f \n"
344 "mov w7, %[GDB_TRAP_INSTR2_L] \n"
345 "movk w7, %[GDB_TRAP_INSTR2_H], lsl #16 \n"
346 "cmp w6, w7 \n"
347 "b.ne 0f \n"
348 "1: \n"
349 "add x1, x1, #4 \n"
350 "str x1, [x0, %[SS64_PC]] \n",
351 [GDB_TRAP_INSTR1_L] "i" (GDB_TRAP_INSTR1 & 0xFFFF),
352 [GDB_TRAP_INSTR1_H] "i" (GDB_TRAP_INSTR1 >> 16),
353 [GDB_TRAP_INSTR2_L] "i" (GDB_TRAP_INSTR2 & 0xFFFF),
354 [GDB_TRAP_INSTR2_H] "i" (GDB_TRAP_INSTR2 >> 16)
355 );
356 #else
357 uint32_t instr = *((uint32_t *)get_saved_state_pc(saved_state));
358
359 /*
360 * As long as we are using the arm32 trap encoding to handling
361 * traps to the debugger, we should identify both variants and
362 * increment for both of them.
363 */
364 if ((instr == GDB_TRAP_INSTR1) || (instr == GDB_TRAP_INSTR2)) {
365 saved_state64(saved_state)->pc += 4;
366 }
367 #endif
368
369 #else
370 #error Unknown architecture.
371 #endif
372 }
373
374 #define ARM32_LR_OFFSET 4
375 #define ARM64_LR_OFFSET 8
376
377 /*
378 * Since sizeof (struct thread_snapshot) % 4 == 2
379 * make sure the compiler does not try to use word-aligned
380 * access to this data, which can result in alignment faults
381 * that can't be emulated in KDP context.
382 */
383 typedef uint32_t uint32_align2_t __attribute__((aligned(2)));
384
385 /*
386 * @function _was_in_userspace
387 *
388 * @abstract Unused function used to indicate that a CPU was in userspace
389 * before it was IPI'd to enter the Debugger context.
390 *
391 * @discussion This function should never actually be called.
392 */
393 void __attribute__((__noreturn__))
_was_in_userspace(void)394 _was_in_userspace(void)
395 {
396 panic("%s: should not have been invoked.", __FUNCTION__);
397 }
398
399 int
machine_trace_thread64(thread_t thread,char * tracepos,char * tracebound,int nframes,uint32_t * thread_trace_flags)400 machine_trace_thread64(thread_t thread,
401 char * tracepos,
402 char * tracebound,
403 int nframes,
404 uint32_t * thread_trace_flags)
405 {
406 #if defined(__arm64__)
407
408 uint64_t * tracebuf = (uint64_t *)tracepos;
409 vm_size_t framesize = sizeof(uint64_t);
410
411 vm_offset_t stacklimit = 0;
412 vm_offset_t stacklimit_bottom = 0;
413 int framecount = 0;
414 vm_offset_t pc = 0;
415 vm_offset_t fp = 0;
416 vm_offset_t sp = 0;
417 vm_offset_t prevfp = 0;
418 uint64_t prevlr = 0;
419 vm_offset_t kern_virt_addr = 0;
420
421 nframes = (tracebound > tracepos) ? MIN(nframes, (int)((tracebound - tracepos) / framesize)) : 0;
422 if (!nframes) {
423 return 0;
424 }
425 framecount = 0;
426
427 struct arm_saved_state *state = thread->machine.kpcb;
428 if (state != NULL) {
429 fp = state->ss_64.fp;
430
431 prevlr = state->ss_64.lr;
432 pc = state->ss_64.pc;
433 sp = state->ss_64.sp;
434 } else {
435 /* kstackptr may not always be there, so recompute it */
436 arm_kernel_saved_state_t *kstate = &thread_get_kernel_state(thread)->machine.ss;
437
438 fp = kstate->fp;
439 prevlr = kstate->lr;
440 pc = kstate->pc_was_in_userspace ? (register_t)ptrauth_strip((void *)&_was_in_userspace, ptrauth_key_function_pointer) : 0;
441 sp = kstate->sp;
442 }
443
444 stacklimit = VM_MAX_KERNEL_ADDRESS;
445 stacklimit_bottom = VM_MIN_KERNEL_ADDRESS;
446
447 if (!prevlr && !fp && !sp && !pc) {
448 return 0;
449 }
450
451 prevlr = VM_KERNEL_UNSLIDE(prevlr);
452
453 for (; framecount < nframes; framecount++) {
454 *tracebuf++ = prevlr;
455
456 /* Invalid frame */
457 if (!fp) {
458 break;
459 }
460 /*
461 * Unaligned frame; given that the stack register must always be
462 * 16-byte aligned, we are assured 8-byte alignment of the saved
463 * frame pointer and link register.
464 */
465 if (fp & 0x0000007) {
466 break;
467 }
468 /* Frame is out of range, maybe a user FP while doing kernel BT */
469 if (fp > stacklimit) {
470 break;
471 }
472 if (fp < stacklimit_bottom) {
473 break;
474 }
475 /* Stack grows downward */
476 if (fp < prevfp) {
477 bool switched_stacks = false;
478
479 /*
480 * As a special case, sometimes we are backtracing out of an interrupt
481 * handler, and the stack jumps downward because of the memory allocation
482 * pattern during early boot due to KASLR.
483 */
484 int cpu;
485 int max_cpu = ml_get_max_cpu_number();
486
487 for (cpu = 0; cpu <= max_cpu; cpu++) {
488 cpu_data_t *target_cpu_datap;
489
490 target_cpu_datap = (cpu_data_t *)CpuDataEntries[cpu].cpu_data_vaddr;
491 if (target_cpu_datap == (cpu_data_t *)NULL) {
492 continue;
493 }
494
495 if (prevfp >= (target_cpu_datap->intstack_top - INTSTACK_SIZE) && prevfp < target_cpu_datap->intstack_top) {
496 switched_stacks = true;
497 break;
498 }
499 #if defined(__arm64__)
500 if (prevfp >= (target_cpu_datap->excepstack_top - EXCEPSTACK_SIZE) && prevfp < target_cpu_datap->excepstack_top) {
501 switched_stacks = true;
502 break;
503 }
504 #endif
505 }
506
507 /**
508 * The stack could be "growing upwards" because this frame is
509 * stitching two different stacks together. There can be more than
510 * one non-XNU stack so if both frames are in non-XNU stacks but it
511 * looks like the stack is growing upward, then assume that we've
512 * switched from one non-XNU stack to another.
513 */
514 if ((ml_addr_in_non_xnu_stack(prevfp) != ml_addr_in_non_xnu_stack(fp)) ||
515 (ml_addr_in_non_xnu_stack(prevfp) && ml_addr_in_non_xnu_stack(fp))) {
516 switched_stacks = true;
517 }
518
519 if (!switched_stacks) {
520 /* Corrupt frame pointer? */
521 break;
522 }
523 }
524
525 /* Assume there's a saved link register, and read it */
526 kern_virt_addr = fp + ARM64_LR_OFFSET;
527 bool ok = machine_trace_thread_validate_kva(kern_virt_addr);
528 if (!ok) {
529 if (thread_trace_flags != NULL) {
530 *thread_trace_flags |= kThreadTruncatedBT;
531 }
532
533 break;
534 }
535
536 prevlr = *(uint64_t *)kern_virt_addr;
537 #if defined(HAS_APPLE_PAC)
538 /* return addresses on stack signed by arm64e ABI */
539 prevlr = (uint64_t) ptrauth_strip((void *)prevlr, ptrauth_key_return_address);
540 #endif
541 prevlr = VM_KERNEL_UNSLIDE(prevlr);
542
543 prevfp = fp;
544 /* Next frame */
545 kern_virt_addr = fp;
546 ok = machine_trace_thread_validate_kva(kern_virt_addr);
547 if (!ok) {
548 if (thread_trace_flags != NULL) {
549 *thread_trace_flags |= kThreadTruncatedBT;
550 }
551 fp = 0;
552 break;
553 }
554
555 fp = *(uint64_t *)kern_virt_addr;
556 #if defined(HAS_APPLE_PAC)
557 /* frame pointers on stack signed by arm64e ABI */
558 fp = (uint64_t) ptrauth_strip((void *)fp, ptrauth_key_frame_pointer);
559 #endif
560 }
561 return (int)(((char *)tracebuf) - tracepos);
562 #else
563 #error Unknown architecture.
564 #endif
565 }
566
567 void
kdp_ml_enter_debugger(void)568 kdp_ml_enter_debugger(void)
569 {
570 __asm__ volatile (".long 0xe7ffdefe");
571 }
572