1 /* 2 * CDDL HEADER START 3 * 4 * The contents of this file are subject to the terms of the 5 * Common Development and Distribution License (the "License"). 6 * You may not use this file except in compliance with the License. 7 * 8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 9 * or http://www.opensolaris.org/os/licensing. 10 * See the License for the specific language governing permissions 11 * and limitations under the License. 12 * 13 * When distributing Covered Code, include this CDDL HEADER in each 14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 15 * If applicable, add the following below this CDDL HEADER, with the 16 * fields enclosed by brackets "[]" replaced with your own identifying 17 * information: Portions Copyright [yyyy] [name of copyright owner] 18 * 19 * CDDL HEADER END 20 */ 21 22 /* 23 * Copyright 2009 Sun Microsystems, Inc. All rights reserved. 24 * Use is subject to license terms. 25 */ 26 27 /* 28 * Copyright (c) 2012 by Delphix. All rights reserved. 29 */ 30 31 #include <stdlib.h> 32 #include <assert.h> 33 #include <errno.h> 34 #include <string.h> 35 #include <libgen.h> 36 #include <sys/ioctl.h> 37 38 #include <dt_impl.h> 39 #include <dt_pid.h> 40 41 #include <dis_tables.h> 42 43 #ifndef illumos 44 #define PR_MODEL_ILP32 1 45 #define PR_MODEL_LP64 2 46 #include <libproc_compat.h> 47 #endif 48 49 #define DT_POPL_EBP 0x5d 50 #define DT_RET 0xc3 51 #define DT_RET16 0xc2 52 #define DT_LEAVE 0xc9 53 #define DT_JMP32 0xe9 54 #define DT_JMP8 0xeb 55 #define DT_REP 0xf3 56 57 #define DT_MOVL_EBP_ESP 0xe58b 58 59 #define DT_ISJ32(op16) (((op16) & 0xfff0) == 0x0f80) 60 #define DT_ISJ8(op8) (((op8) & 0xf0) == 0x70) 61 62 #define DT_MODRM_REG(modrm) (((modrm) >> 3) & 0x7) 63 64 static int dt_instr_size(uchar_t *, dtrace_hdl_t *, pid_t, uintptr_t, char); 65 66 /*ARGSUSED*/ 67 int 68 dt_pid_create_entry_probe(struct ps_prochandle *P, dtrace_hdl_t *dtp, 69 fasttrap_probe_spec_t *ftp, const GElf_Sym *symp) 70 { 71 ftp->ftps_type = DTFTP_ENTRY; 72 ftp->ftps_pc = (uintptr_t)symp->st_value; 73 ftp->ftps_size = (size_t)symp->st_size; 74 ftp->ftps_noffs = 1; 75 ftp->ftps_offs[0] = 0; 76 77 if (ioctl(dtp->dt_ftfd, FASTTRAPIOC_MAKEPROBE, ftp) != 0) { 78 dt_dprintf("fasttrap probe creation ioctl failed: %s\n", 79 strerror(errno)); 80 return (dt_set_errno(dtp, errno)); 81 } 82 83 return (1); 84 } 85 86 static int 87 dt_pid_has_jump_table(struct ps_prochandle *P, dtrace_hdl_t *dtp, 88 uint8_t *text, fasttrap_probe_spec_t *ftp, const GElf_Sym *symp) 89 { 90 ulong_t i; 91 int size; 92 #ifdef illumos 93 pid_t pid = Pstatus(P)->pr_pid; 94 char dmodel = Pstatus(P)->pr_dmodel; 95 #else 96 pid_t pid = proc_getpid(P); 97 #if __i386__ 98 char dmodel = PR_MODEL_ILP32; 99 #elif __amd64__ 100 char dmodel = PR_MODEL_LP64; 101 #endif 102 #endif 103 104 /* 105 * Take a pass through the function looking for a register-dependant 106 * jmp instruction. This could be a jump table so we have to be 107 * ultra conservative. 108 */ 109 for (i = 0; i < ftp->ftps_size; i += size) { 110 size = dt_instr_size(&text[i], dtp, pid, symp->st_value + i, 111 dmodel); 112 113 /* 114 * Assume the worst if we hit an illegal instruction. 115 */ 116 if (size <= 0) { 117 dt_dprintf("error at %#lx (assuming jump table)\n", i); 118 return (1); 119 } 120 121 #ifdef notyet 122 /* 123 * Register-dependant jmp instructions start with a 0xff byte 124 * and have the modrm.reg field set to 4. They can have an 125 * optional REX prefix on the 64-bit ISA. 126 */ 127 if ((text[i] == 0xff && DT_MODRM_REG(text[i + 1]) == 4) || 128 (dmodel == PR_MODEL_LP64 && (text[i] & 0xf0) == 0x40 && 129 text[i + 1] == 0xff && DT_MODRM_REG(text[i + 2]) == 4)) { 130 dt_dprintf("found a suspected jump table at %s:%lx\n", 131 ftp->ftps_func, i); 132 return (1); 133 } 134 #endif 135 } 136 137 return (0); 138 } 139 140 /*ARGSUSED*/ 141 int 142 dt_pid_create_return_probe(struct ps_prochandle *P, dtrace_hdl_t *dtp, 143 fasttrap_probe_spec_t *ftp, const GElf_Sym *symp, uint64_t *stret) 144 { 145 uint8_t *text; 146 ulong_t i, end; 147 int size; 148 #ifdef illumos 149 pid_t pid = Pstatus(P)->pr_pid; 150 char dmodel = Pstatus(P)->pr_dmodel; 151 #else 152 pid_t pid = proc_getpid(P); 153 #if __i386__ 154 char dmodel = PR_MODEL_ILP32; 155 #elif __amd64__ 156 char dmodel = PR_MODEL_LP64; 157 #endif 158 #endif 159 160 /* 161 * We allocate a few extra bytes at the end so we don't have to check 162 * for overrunning the buffer. 163 */ 164 if ((text = calloc(1, symp->st_size + 4)) == NULL) { 165 dt_dprintf("mr sparkle: malloc() failed\n"); 166 return (DT_PROC_ERR); 167 } 168 169 if (Pread(P, text, symp->st_size, symp->st_value) != symp->st_size) { 170 dt_dprintf("mr sparkle: Pread() failed\n"); 171 free(text); 172 return (DT_PROC_ERR); 173 } 174 175 ftp->ftps_type = DTFTP_RETURN; 176 ftp->ftps_pc = (uintptr_t)symp->st_value; 177 ftp->ftps_size = (size_t)symp->st_size; 178 ftp->ftps_noffs = 0; 179 180 /* 181 * If there's a jump table in the function we're only willing to 182 * instrument these specific (and equivalent) instruction sequences: 183 * leave 184 * [rep] ret 185 * and 186 * movl %ebp,%esp 187 * popl %ebp 188 * [rep] ret 189 * 190 * We do this to avoid accidentally interpreting jump table 191 * offsets as actual instructions. 192 */ 193 if (dt_pid_has_jump_table(P, dtp, text, ftp, symp)) { 194 for (i = 0, end = ftp->ftps_size; i < end; i += size) { 195 size = dt_instr_size(&text[i], dtp, pid, 196 symp->st_value + i, dmodel); 197 198 /* bail if we hit an invalid opcode */ 199 if (size <= 0) 200 break; 201 202 if (text[i] == DT_LEAVE && text[i + 1] == DT_RET) { 203 dt_dprintf("leave/ret at %lx\n", i + 1); 204 ftp->ftps_offs[ftp->ftps_noffs++] = i + 1; 205 size = 2; 206 } else if (text[i] == DT_LEAVE && 207 text[i + 1] == DT_REP && text[i + 2] == DT_RET) { 208 dt_dprintf("leave/rep ret at %lx\n", i + 1); 209 ftp->ftps_offs[ftp->ftps_noffs++] = i + 1; 210 size = 3; 211 } else if (*(uint16_t *)&text[i] == DT_MOVL_EBP_ESP && 212 text[i + 2] == DT_POPL_EBP && 213 text[i + 3] == DT_RET) { 214 dt_dprintf("movl/popl/ret at %lx\n", i + 3); 215 ftp->ftps_offs[ftp->ftps_noffs++] = i + 3; 216 size = 4; 217 } else if (*(uint16_t *)&text[i] == DT_MOVL_EBP_ESP && 218 text[i + 2] == DT_POPL_EBP && 219 text[i + 3] == DT_REP && 220 text[i + 4] == DT_RET) { 221 dt_dprintf("movl/popl/rep ret at %lx\n", i + 3); 222 ftp->ftps_offs[ftp->ftps_noffs++] = i + 3; 223 size = 5; 224 } 225 } 226 } else { 227 for (i = 0, end = ftp->ftps_size; i < end; i += size) { 228 size = dt_instr_size(&text[i], dtp, pid, 229 symp->st_value + i, dmodel); 230 231 /* bail if we hit an invalid opcode */ 232 if (size <= 0) 233 break; 234 235 /* ordinary ret */ 236 if (size == 1 && text[i] == DT_RET) 237 goto is_ret; 238 239 /* two-byte ret */ 240 if (size == 2 && text[i] == DT_REP && 241 text[i + 1] == DT_RET) 242 goto is_ret; 243 244 /* ret <imm16> */ 245 if (size == 3 && text[i] == DT_RET16) 246 goto is_ret; 247 248 /* two-byte ret <imm16> */ 249 if (size == 4 && text[i] == DT_REP && 250 text[i + 1] == DT_RET16) 251 goto is_ret; 252 253 /* 32-bit displacement jmp outside of the function */ 254 if (size == 5 && text[i] == DT_JMP32 && symp->st_size <= 255 (uintptr_t)(i + size + *(int32_t *)&text[i + 1])) 256 goto is_ret; 257 258 /* 8-bit displacement jmp outside of the function */ 259 if (size == 2 && text[i] == DT_JMP8 && symp->st_size <= 260 (uintptr_t)(i + size + *(int8_t *)&text[i + 1])) 261 goto is_ret; 262 263 /* 32-bit disp. conditional jmp outside of the func. */ 264 if (size == 6 && DT_ISJ32(*(uint16_t *)&text[i]) && 265 symp->st_size <= 266 (uintptr_t)(i + size + *(int32_t *)&text[i + 2])) 267 goto is_ret; 268 269 /* 8-bit disp. conditional jmp outside of the func. */ 270 if (size == 2 && DT_ISJ8(text[i]) && symp->st_size <= 271 (uintptr_t)(i + size + *(int8_t *)&text[i + 1])) 272 goto is_ret; 273 274 continue; 275 is_ret: 276 dt_dprintf("return at offset %lx\n", i); 277 ftp->ftps_offs[ftp->ftps_noffs++] = i; 278 } 279 } 280 281 free(text); 282 if (ftp->ftps_noffs > 0) { 283 if (ioctl(dtp->dt_ftfd, FASTTRAPIOC_MAKEPROBE, ftp) != 0) { 284 dt_dprintf("fasttrap probe creation ioctl failed: %s\n", 285 strerror(errno)); 286 return (dt_set_errno(dtp, errno)); 287 } 288 } 289 290 return (ftp->ftps_noffs); 291 } 292 293 /*ARGSUSED*/ 294 int 295 dt_pid_create_offset_probe(struct ps_prochandle *P, dtrace_hdl_t *dtp, 296 fasttrap_probe_spec_t *ftp, const GElf_Sym *symp, ulong_t off) 297 { 298 ftp->ftps_type = DTFTP_OFFSETS; 299 ftp->ftps_pc = (uintptr_t)symp->st_value; 300 ftp->ftps_size = (size_t)symp->st_size; 301 ftp->ftps_noffs = 1; 302 303 if (strcmp("-", ftp->ftps_func) == 0) { 304 ftp->ftps_offs[0] = off; 305 } else { 306 uint8_t *text; 307 ulong_t i; 308 int size; 309 #ifdef illumos 310 pid_t pid = Pstatus(P)->pr_pid; 311 char dmodel = Pstatus(P)->pr_dmodel; 312 #else 313 pid_t pid = proc_getpid(P); 314 #if __i386__ 315 char dmodel = PR_MODEL_ILP32; 316 #elif __amd64__ 317 char dmodel = PR_MODEL_LP64; 318 #endif 319 #endif 320 321 if ((text = malloc(symp->st_size)) == NULL) { 322 dt_dprintf("mr sparkle: malloc() failed\n"); 323 return (DT_PROC_ERR); 324 } 325 326 if (Pread(P, text, symp->st_size, symp->st_value) != 327 symp->st_size) { 328 dt_dprintf("mr sparkle: Pread() failed\n"); 329 free(text); 330 return (DT_PROC_ERR); 331 } 332 333 /* 334 * We can't instrument offsets in functions with jump tables 335 * as we might interpret a jump table offset as an 336 * instruction. 337 */ 338 if (dt_pid_has_jump_table(P, dtp, text, ftp, symp)) { 339 free(text); 340 return (0); 341 } 342 343 for (i = 0; i < symp->st_size; i += size) { 344 if (i == off) { 345 ftp->ftps_offs[0] = i; 346 break; 347 } 348 349 /* 350 * If we've passed the desired offset without a 351 * match, then the given offset must not lie on a 352 * instruction boundary. 353 */ 354 if (i > off) { 355 free(text); 356 return (DT_PROC_ALIGN); 357 } 358 359 size = dt_instr_size(&text[i], dtp, pid, 360 symp->st_value + i, dmodel); 361 362 /* 363 * If we hit an invalid instruction, bail as if we 364 * couldn't find the offset. 365 */ 366 if (size <= 0) { 367 free(text); 368 return (DT_PROC_ALIGN); 369 } 370 } 371 372 free(text); 373 } 374 375 if (ioctl(dtp->dt_ftfd, FASTTRAPIOC_MAKEPROBE, ftp) != 0) { 376 dt_dprintf("fasttrap probe creation ioctl failed: %s\n", 377 strerror(errno)); 378 return (dt_set_errno(dtp, errno)); 379 } 380 381 return (ftp->ftps_noffs); 382 } 383 384 /*ARGSUSED*/ 385 int 386 dt_pid_create_glob_offset_probes(struct ps_prochandle *P, dtrace_hdl_t *dtp, 387 fasttrap_probe_spec_t *ftp, const GElf_Sym *symp, const char *pattern) 388 { 389 uint8_t *text; 390 int size; 391 ulong_t i, end = symp->st_size; 392 #ifdef illumos 393 pid_t pid = Pstatus(P)->pr_pid; 394 char dmodel = Pstatus(P)->pr_dmodel; 395 #else 396 pid_t pid = proc_getpid(P); 397 #if __i386__ 398 char dmodel = PR_MODEL_ILP32; 399 #elif __amd64__ 400 char dmodel = PR_MODEL_LP64; 401 #endif 402 #endif 403 404 ftp->ftps_type = DTFTP_OFFSETS; 405 ftp->ftps_pc = (uintptr_t)symp->st_value; 406 ftp->ftps_size = (size_t)symp->st_size; 407 ftp->ftps_noffs = 0; 408 409 if ((text = malloc(symp->st_size)) == NULL) { 410 dt_dprintf("mr sparkle: malloc() failed\n"); 411 return (DT_PROC_ERR); 412 } 413 414 if (Pread(P, text, symp->st_size, symp->st_value) != symp->st_size) { 415 dt_dprintf("mr sparkle: Pread() failed\n"); 416 free(text); 417 return (DT_PROC_ERR); 418 } 419 420 /* 421 * We can't instrument offsets in functions with jump tables as 422 * we might interpret a jump table offset as an instruction. 423 */ 424 if (dt_pid_has_jump_table(P, dtp, text, ftp, symp)) { 425 free(text); 426 return (0); 427 } 428 429 if (strcmp("*", pattern) == 0) { 430 for (i = 0; i < end; i += size) { 431 ftp->ftps_offs[ftp->ftps_noffs++] = i; 432 433 size = dt_instr_size(&text[i], dtp, pid, 434 symp->st_value + i, dmodel); 435 436 /* bail if we hit an invalid opcode */ 437 if (size <= 0) 438 break; 439 } 440 } else { 441 char name[sizeof (i) * 2 + 1]; 442 443 for (i = 0; i < end; i += size) { 444 (void) snprintf(name, sizeof (name), "%lx", i); 445 if (gmatch(name, pattern)) 446 ftp->ftps_offs[ftp->ftps_noffs++] = i; 447 448 size = dt_instr_size(&text[i], dtp, pid, 449 symp->st_value + i, dmodel); 450 451 /* bail if we hit an invalid opcode */ 452 if (size <= 0) 453 break; 454 } 455 } 456 457 free(text); 458 if (ftp->ftps_noffs > 0) { 459 if (ioctl(dtp->dt_ftfd, FASTTRAPIOC_MAKEPROBE, ftp) != 0) { 460 dt_dprintf("fasttrap probe creation ioctl failed: %s\n", 461 strerror(errno)); 462 return (dt_set_errno(dtp, errno)); 463 } 464 } 465 466 return (ftp->ftps_noffs); 467 } 468 469 typedef struct dtrace_dis { 470 uchar_t *instr; 471 dtrace_hdl_t *dtp; 472 pid_t pid; 473 uintptr_t addr; 474 } dtrace_dis_t; 475 476 static int 477 dt_getbyte(void *data) 478 { 479 dtrace_dis_t *dis = data; 480 int ret = *dis->instr; 481 482 if (ret == FASTTRAP_INSTR) { 483 fasttrap_instr_query_t instr; 484 485 instr.ftiq_pid = dis->pid; 486 instr.ftiq_pc = dis->addr; 487 488 /* 489 * If we hit a byte that looks like the fasttrap provider's 490 * trap instruction (which doubles as the breakpoint 491 * instruction for debuggers) we need to query the kernel 492 * for the real value. This may just be part of an immediate 493 * value so there's no need to return an error if the 494 * kernel doesn't know about this address. 495 */ 496 if (ioctl(dis->dtp->dt_ftfd, FASTTRAPIOC_GETINSTR, &instr) == 0) 497 ret = instr.ftiq_instr; 498 } 499 500 dis->addr++; 501 dis->instr++; 502 503 return (ret); 504 } 505 506 static int 507 dt_instr_size(uchar_t *instr, dtrace_hdl_t *dtp, pid_t pid, uintptr_t addr, 508 char dmodel) 509 { 510 dtrace_dis_t data; 511 dis86_t x86dis; 512 uint_t cpu_mode; 513 514 data.instr = instr; 515 data.dtp = dtp; 516 data.pid = pid; 517 data.addr = addr; 518 519 x86dis.d86_data = &data; 520 x86dis.d86_get_byte = dt_getbyte; 521 x86dis.d86_check_func = NULL; 522 523 cpu_mode = (dmodel == PR_MODEL_ILP32) ? SIZE32 : SIZE64; 524 525 #ifdef notyet 526 // XXX: does not compile! 527 if (dtrace_disx86(&x86dis, cpu_mode) != 0) 528 return (-1); 529 #else 530 __USE(cpu_mode); 531 #endif 532 533 /* 534 * If the instruction was a single-byte breakpoint, there may be 535 * another debugger attached to this process. The original instruction 536 * can't be recovered so this must fail. 537 */ 538 if (x86dis.d86_len == 1 && 539 (uchar_t)x86dis.d86_bytes[0] == FASTTRAP_INSTR) 540 return (-1); 541 542 return (x86dis.d86_len); 543 } 544