1 /*
2 * CDDL HEADER START
3 *
4 * The contents of this file are subject to the terms of the
5 * Common Development and Distribution License (the "License").
6 * You may not use this file except in compliance with the License.
7 *
8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9 * or http://www.opensolaris.org/os/licensing.
10 * See the License for the specific language governing permissions
11 * and limitations under the License.
12 *
13 * When distributing Covered Code, include this CDDL HEADER in each
14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15 * If applicable, add the following below this CDDL HEADER, with the
16 * fields enclosed by brackets "[]" replaced with your own identifying
17 * information: Portions Copyright [yyyy] [name of copyright owner]
18 *
19 * CDDL HEADER END
20 */
21
22 /*
23 * Copyright 2009 Sun Microsystems, Inc. All rights reserved.
24 * Use is subject to license terms.
25 */
26
27 #include <stdlib.h>
28 #include <assert.h>
29 #include <errno.h>
30 #include <string.h>
31 #include <libgen.h>
32
33 #include <dt_impl.h>
34 #include <dt_pid.h>
35
36 #include <dis_tables.h>
37
38 #define DT_POPL_EBP 0x5d
39 #define DT_RET 0xc3
40 #define DT_RET16 0xc2
41 #define DT_LEAVE 0xc9
42 #define DT_JMP32 0xe9
43 #define DT_JMP8 0xeb
44 #define DT_REP 0xf3
45
46 #define DT_MOVL_EBP_ESP 0xe58b
47
48 #define DT_ISJ32(op16) (((op16) & 0xfff0) == 0x0f80)
49 #define DT_ISJ8(op8) (((op8) & 0xf0) == 0x70)
50
51 #define DT_MODRM_REG(modrm) (((modrm) >> 3) & 0x7)
52
53 static int dt_instr_size(uchar_t *, dtrace_hdl_t *, pid_t, uintptr_t, char);
54
55 /*ARGSUSED*/
56 int
dt_pid_create_entry_probe(struct ps_prochandle * P,dtrace_hdl_t * dtp,fasttrap_probe_spec_t * ftp,const GElf_Sym * symp)57 dt_pid_create_entry_probe(struct ps_prochandle *P, dtrace_hdl_t *dtp,
58 fasttrap_probe_spec_t *ftp, const GElf_Sym *symp)
59 {
60 ftp->ftps_type = DTFTP_ENTRY;
61 ftp->ftps_pc = (uintptr_t)symp->st_value;
62 ftp->ftps_size = (size_t)symp->st_size;
63 ftp->ftps_noffs = 1;
64 ftp->ftps_offs[0] = 0;
65
66 if (ioctl(dtp->dt_ftfd, FASTTRAPIOC_MAKEPROBE, ftp) != 0) {
67 dt_dprintf("fasttrap probe creation ioctl failed: %s\n",
68 strerror(errno));
69 return (dt_set_errno(dtp, errno));
70 }
71
72 return (1);
73 }
74
75 static int
dt_pid_has_jump_table(struct ps_prochandle * P,dtrace_hdl_t * dtp,uint8_t * text,fasttrap_probe_spec_t * ftp,const GElf_Sym * symp)76 dt_pid_has_jump_table(struct ps_prochandle *P, dtrace_hdl_t *dtp,
77 uint8_t *text, fasttrap_probe_spec_t *ftp, const GElf_Sym *symp)
78 {
79 ulong_t i;
80 int size;
81 pid_t pid = Pstatus(P)->pr_pid;
82 char dmodel = Pstatus(P)->pr_dmodel;
83
84 /*
85 * Take a pass through the function looking for a register-dependant
86 * jmp instruction. This could be a jump table so we have to be
87 * ultra conservative.
88 */
89 for (i = 0; i < ftp->ftps_size; i += size) {
90 size = dt_instr_size(&text[i], dtp, pid, symp->st_value + i,
91 dmodel);
92
93 /*
94 * Assume the worst if we hit an illegal instruction.
95 */
96 if (size <= 0) {
97 dt_dprintf("error at %#lx (assuming jump table)\n", i);
98 return (1);
99 }
100
101 /*
102 * Register-dependant jmp instructions start with a 0xff byte
103 * and have the modrm.reg field set to 4. They can have an
104 * optional REX prefix on the 64-bit ISA.
105 */
106 if ((text[i] == 0xff && DT_MODRM_REG(text[i + 1]) == 4) ||
107 (dmodel == PR_MODEL_LP64 && (text[i] & 0xf0) == 0x40 &&
108 text[i + 1] == 0xff && DT_MODRM_REG(text[i + 2]) == 4)) {
109 dt_dprintf("found a suspected jump table at %s:%lx\n",
110 ftp->ftps_func, i);
111 return (1);
112 }
113 }
114
115 return (0);
116 }
117
118 /*ARGSUSED*/
119 int
dt_pid_create_return_probe(struct ps_prochandle * P,dtrace_hdl_t * dtp,fasttrap_probe_spec_t * ftp,const GElf_Sym * symp,uint64_t * stret)120 dt_pid_create_return_probe(struct ps_prochandle *P, dtrace_hdl_t *dtp,
121 fasttrap_probe_spec_t *ftp, const GElf_Sym *symp, uint64_t *stret)
122 {
123 uint8_t *text;
124 ulong_t i, end;
125 int size;
126 pid_t pid = Pstatus(P)->pr_pid;
127 char dmodel = Pstatus(P)->pr_dmodel;
128
129 /*
130 * We allocate a few extra bytes at the end so we don't have to check
131 * for overrunning the buffer.
132 */
133 if ((text = calloc(1, symp->st_size + 4)) == NULL) {
134 dt_dprintf("mr sparkle: malloc() failed\n");
135 return (DT_PROC_ERR);
136 }
137
138 if (Pread(P, text, symp->st_size, symp->st_value) != symp->st_size) {
139 dt_dprintf("mr sparkle: Pread() failed\n");
140 free(text);
141 return (DT_PROC_ERR);
142 }
143
144 ftp->ftps_type = DTFTP_RETURN;
145 ftp->ftps_pc = (uintptr_t)symp->st_value;
146 ftp->ftps_size = (size_t)symp->st_size;
147 ftp->ftps_noffs = 0;
148
149 /*
150 * If there's a jump table in the function we're only willing to
151 * instrument these specific (and equivalent) instruction sequences:
152 * leave
153 * [rep] ret
154 * and
155 * movl %ebp,%esp
156 * popl %ebp
157 * [rep] ret
158 *
159 * We do this to avoid accidentally interpreting jump table
160 * offsets as actual instructions.
161 */
162 if (dt_pid_has_jump_table(P, dtp, text, ftp, symp)) {
163 for (i = 0, end = ftp->ftps_size; i < end; i += size) {
164 size = dt_instr_size(&text[i], dtp, pid,
165 symp->st_value + i, dmodel);
166
167 /* bail if we hit an invalid opcode */
168 if (size <= 0)
169 break;
170
171 if (text[i] == DT_LEAVE && text[i + 1] == DT_RET) {
172 dt_dprintf("leave/ret at %lx\n", i + 1);
173 ftp->ftps_offs[ftp->ftps_noffs++] = i + 1;
174 size = 2;
175 } else if (text[i] == DT_LEAVE &&
176 text[i + 1] == DT_REP && text[i + 2] == DT_RET) {
177 dt_dprintf("leave/rep ret at %lx\n", i + 1);
178 ftp->ftps_offs[ftp->ftps_noffs++] = i + 1;
179 size = 3;
180 } else if (*(uint16_t *)&text[i] == DT_MOVL_EBP_ESP &&
181 text[i + 2] == DT_POPL_EBP &&
182 text[i + 3] == DT_RET) {
183 dt_dprintf("movl/popl/ret at %lx\n", i + 3);
184 ftp->ftps_offs[ftp->ftps_noffs++] = i + 3;
185 size = 4;
186 } else if (*(uint16_t *)&text[i] == DT_MOVL_EBP_ESP &&
187 text[i + 2] == DT_POPL_EBP &&
188 text[i + 3] == DT_REP &&
189 text[i + 4] == DT_RET) {
190 dt_dprintf("movl/popl/rep ret at %lx\n", i + 3);
191 ftp->ftps_offs[ftp->ftps_noffs++] = i + 3;
192 size = 5;
193 }
194 }
195 } else {
196 for (i = 0, end = ftp->ftps_size; i < end; i += size) {
197 size = dt_instr_size(&text[i], dtp, pid,
198 symp->st_value + i, dmodel);
199
200 /* bail if we hit an invalid opcode */
201 if (size <= 0)
202 break;
203
204 /* ordinary ret */
205 if (size == 1 && text[i] == DT_RET)
206 goto is_ret;
207
208 /* two-byte ret */
209 if (size == 2 && text[i] == DT_REP &&
210 text[i + 1] == DT_RET)
211 goto is_ret;
212
213 /* ret <imm16> */
214 if (size == 3 && text[i] == DT_RET16)
215 goto is_ret;
216
217 /* two-byte ret <imm16> */
218 if (size == 4 && text[i] == DT_REP &&
219 text[i + 1] == DT_RET16)
220 goto is_ret;
221
222 /* 32-bit displacement jmp outside of the function */
223 if (size == 5 && text[i] == DT_JMP32 && symp->st_size <=
224 (uintptr_t)(i + size + *(int32_t *)&text[i + 1]))
225 goto is_ret;
226
227 /* 8-bit displacement jmp outside of the function */
228 if (size == 2 && text[i] == DT_JMP8 && symp->st_size <=
229 (uintptr_t)(i + size + *(int8_t *)&text[i + 1]))
230 goto is_ret;
231
232 /* 32-bit disp. conditional jmp outside of the func. */
233 if (size == 6 && DT_ISJ32(*(uint16_t *)&text[i]) &&
234 symp->st_size <=
235 (uintptr_t)(i + size + *(int32_t *)&text[i + 2]))
236 goto is_ret;
237
238 /* 8-bit disp. conditional jmp outside of the func. */
239 if (size == 2 && DT_ISJ8(text[i]) && symp->st_size <=
240 (uintptr_t)(i + size + *(int8_t *)&text[i + 1]))
241 goto is_ret;
242
243 continue;
244 is_ret:
245 dt_dprintf("return at offset %lx\n", i);
246 ftp->ftps_offs[ftp->ftps_noffs++] = i;
247 }
248 }
249
250 free(text);
251 if (ftp->ftps_noffs > 0) {
252 if (ioctl(dtp->dt_ftfd, FASTTRAPIOC_MAKEPROBE, ftp) != 0) {
253 dt_dprintf("fasttrap probe creation ioctl failed: %s\n",
254 strerror(errno));
255 return (dt_set_errno(dtp, errno));
256 }
257 }
258
259 return (ftp->ftps_noffs);
260 }
261
262 /*ARGSUSED*/
263 int
dt_pid_create_offset_probe(struct ps_prochandle * P,dtrace_hdl_t * dtp,fasttrap_probe_spec_t * ftp,const GElf_Sym * symp,ulong_t off)264 dt_pid_create_offset_probe(struct ps_prochandle *P, dtrace_hdl_t *dtp,
265 fasttrap_probe_spec_t *ftp, const GElf_Sym *symp, ulong_t off)
266 {
267 ftp->ftps_type = DTFTP_OFFSETS;
268 ftp->ftps_pc = (uintptr_t)symp->st_value;
269 ftp->ftps_size = (size_t)symp->st_size;
270 ftp->ftps_noffs = 1;
271
272 if (strcmp("-", ftp->ftps_func) == 0) {
273 ftp->ftps_offs[0] = off;
274 } else {
275 uint8_t *text;
276 ulong_t i;
277 int size;
278 pid_t pid = Pstatus(P)->pr_pid;
279 char dmodel = Pstatus(P)->pr_dmodel;
280
281 if ((text = malloc(symp->st_size)) == NULL) {
282 dt_dprintf("mr sparkle: malloc() failed\n");
283 return (DT_PROC_ERR);
284 }
285
286 if (Pread(P, text, symp->st_size, symp->st_value) !=
287 symp->st_size) {
288 dt_dprintf("mr sparkle: Pread() failed\n");
289 free(text);
290 return (DT_PROC_ERR);
291 }
292
293 /*
294 * We can't instrument offsets in functions with jump tables
295 * as we might interpret a jump table offset as an
296 * instruction.
297 */
298 if (dt_pid_has_jump_table(P, dtp, text, ftp, symp)) {
299 free(text);
300 return (0);
301 }
302
303 for (i = 0; i < symp->st_size; i += size) {
304 if (i == off) {
305 ftp->ftps_offs[0] = i;
306 break;
307 }
308
309 /*
310 * If we've passed the desired offset without a
311 * match, then the given offset must not lie on a
312 * instruction boundary.
313 */
314 if (i > off) {
315 free(text);
316 return (DT_PROC_ALIGN);
317 }
318
319 size = dt_instr_size(&text[i], dtp, pid,
320 symp->st_value + i, dmodel);
321
322 /*
323 * If we hit an invalid instruction, bail as if we
324 * couldn't find the offset.
325 */
326 if (size <= 0) {
327 free(text);
328 return (DT_PROC_ALIGN);
329 }
330 }
331
332 free(text);
333 }
334
335 if (ioctl(dtp->dt_ftfd, FASTTRAPIOC_MAKEPROBE, ftp) != 0) {
336 dt_dprintf("fasttrap probe creation ioctl failed: %s\n",
337 strerror(errno));
338 return (dt_set_errno(dtp, errno));
339 }
340
341 return (ftp->ftps_noffs);
342 }
343
344 /*ARGSUSED*/
345 int
dt_pid_create_glob_offset_probes(struct ps_prochandle * P,dtrace_hdl_t * dtp,fasttrap_probe_spec_t * ftp,const GElf_Sym * symp,const char * pattern)346 dt_pid_create_glob_offset_probes(struct ps_prochandle *P, dtrace_hdl_t *dtp,
347 fasttrap_probe_spec_t *ftp, const GElf_Sym *symp, const char *pattern)
348 {
349 uint8_t *text;
350 int size;
351 ulong_t i, end = symp->st_size;
352 pid_t pid = Pstatus(P)->pr_pid;
353 char dmodel = Pstatus(P)->pr_dmodel;
354
355 ftp->ftps_type = DTFTP_OFFSETS;
356 ftp->ftps_pc = (uintptr_t)symp->st_value;
357 ftp->ftps_size = (size_t)symp->st_size;
358 ftp->ftps_noffs = 0;
359
360 if ((text = malloc(symp->st_size)) == NULL) {
361 dt_dprintf("mr sparkle: malloc() failed\n");
362 return (DT_PROC_ERR);
363 }
364
365 if (Pread(P, text, symp->st_size, symp->st_value) != symp->st_size) {
366 dt_dprintf("mr sparkle: Pread() failed\n");
367 free(text);
368 return (DT_PROC_ERR);
369 }
370
371 /*
372 * We can't instrument offsets in functions with jump tables as
373 * we might interpret a jump table offset as an instruction.
374 */
375 if (dt_pid_has_jump_table(P, dtp, text, ftp, symp)) {
376 free(text);
377 return (0);
378 }
379
380 if (strcmp("*", pattern) == 0) {
381 for (i = 0; i < end; i += size) {
382 ftp->ftps_offs[ftp->ftps_noffs++] = i;
383
384 size = dt_instr_size(&text[i], dtp, pid,
385 symp->st_value + i, dmodel);
386
387 /* bail if we hit an invalid opcode */
388 if (size <= 0)
389 break;
390 }
391 } else {
392 char name[sizeof (i) * 2 + 1];
393
394 for (i = 0; i < end; i += size) {
395 (void) snprintf(name, sizeof (name), "%x", i);
396 if (gmatch(name, pattern))
397 ftp->ftps_offs[ftp->ftps_noffs++] = i;
398
399 size = dt_instr_size(&text[i], dtp, pid,
400 symp->st_value + i, dmodel);
401
402 /* bail if we hit an invalid opcode */
403 if (size <= 0)
404 break;
405 }
406 }
407
408 free(text);
409 if (ftp->ftps_noffs > 0) {
410 if (ioctl(dtp->dt_ftfd, FASTTRAPIOC_MAKEPROBE, ftp) != 0) {
411 dt_dprintf("fasttrap probe creation ioctl failed: %s\n",
412 strerror(errno));
413 return (dt_set_errno(dtp, errno));
414 }
415 }
416
417 return (ftp->ftps_noffs);
418 }
419
420 typedef struct dtrace_dis {
421 uchar_t *instr;
422 dtrace_hdl_t *dtp;
423 pid_t pid;
424 uintptr_t addr;
425 } dtrace_dis_t;
426
427 static int
dt_getbyte(void * data)428 dt_getbyte(void *data)
429 {
430 dtrace_dis_t *dis = data;
431 int ret = *dis->instr;
432
433 if (ret == FASTTRAP_INSTR) {
434 fasttrap_instr_query_t instr;
435
436 instr.ftiq_pid = dis->pid;
437 instr.ftiq_pc = dis->addr;
438
439 /*
440 * If we hit a byte that looks like the fasttrap provider's
441 * trap instruction (which doubles as the breakpoint
442 * instruction for debuggers) we need to query the kernel
443 * for the real value. This may just be part of an immediate
444 * value so there's no need to return an error if the
445 * kernel doesn't know about this address.
446 */
447 if (ioctl(dis->dtp->dt_ftfd, FASTTRAPIOC_GETINSTR, &instr) == 0)
448 ret = instr.ftiq_instr;
449 }
450
451 dis->addr++;
452 dis->instr++;
453
454 return (ret);
455 }
456
457 static int
dt_instr_size(uchar_t * instr,dtrace_hdl_t * dtp,pid_t pid,uintptr_t addr,char dmodel)458 dt_instr_size(uchar_t *instr, dtrace_hdl_t *dtp, pid_t pid, uintptr_t addr,
459 char dmodel)
460 {
461 dtrace_dis_t data;
462 dis86_t x86dis;
463 uint_t cpu_mode;
464
465 data.instr = instr;
466 data.dtp = dtp;
467 data.pid = pid;
468 data.addr = addr;
469
470 x86dis.d86_data = &data;
471 x86dis.d86_get_byte = dt_getbyte;
472 x86dis.d86_check_func = NULL;
473
474 cpu_mode = (dmodel == PR_MODEL_ILP32) ? SIZE32 : SIZE64;
475
476 if (dtrace_disx86(&x86dis, cpu_mode) != 0)
477 return (-1);
478
479 /*
480 * If the instruction was a single-byte breakpoint, there may be
481 * another debugger attached to this process. The original instruction
482 * can't be recovered so this must fail.
483 */
484 if (x86dis.d86_len == 1 && instr[0] == FASTTRAP_INSTR)
485 return (-1);
486
487 return (x86dis.d86_len);
488 }
489