1/* 2 * CDDL HEADER START 3 * 4 * The contents of this file are subject to the terms of the 5 * Common Development and Distribution License (the "License"). 6 * You may not use this file except in compliance with the License. 7 * 8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 9 * or http://www.opensolaris.org/os/licensing. 10 * See the License for the specific language governing permissions 11 * and limitations under the License. 12 * 13 * When distributing Covered Code, include this CDDL HEADER in each 14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 15 * If applicable, add the following below this CDDL HEADER, with the 16 * fields enclosed by brackets "[]" replaced with your own identifying 17 * information: Portions Copyright [yyyy] [name of copyright owner] 18 * 19 * CDDL HEADER END 20 */ 21 22/* 23 * Copyright 2006 Sun Microsystems, Inc. All rights reserved. 24 * Use is subject to license terms. 25 */ 26 27#pragma ident "@(#)dt_isadep.c 1.14 06/02/22 SMI" 28 29#if defined(__i386__) || defined(__x86_64__) 30 31#include <stdlib.h> 32#include <assert.h> 33#include <errno.h> 34#include <string.h> 35#include <libgen.h> 36 37#include <dt_impl.h> 38#include <dt_pid.h> 39 40#include <dis_tables.h> 41 42#define DT_POPL_EBP 0x5d 43#define DT_RET 0xc3 44#define DT_RET16 0xc2 45#define DT_LEAVE 0xc9 46#define DT_JMP32 0xe9 47#define DT_JMP8 0xeb 48#define DT_REP 0xf3 49 50#define DT_MOVL_EBP_ESP 0xe58b 51 52#define DT_ISJ32(op16) (((op16) & 0xfff0) == 0x0f80) 53#define DT_ISJ8(op8) (((op8) & 0xf0) == 0x70) 54 55#define DT_MODRM_REG(modrm) (((modrm) >> 3) & 0x7) 56 57#if defined(__APPLE__) 58static int dt_instr_size(uchar_t *, dtrace_hdl_t *, pid_t, uint64_t, char); 59#else 60static int dt_instr_size(uchar_t *, dtrace_hdl_t *, pid_t, uintptr_t, char); 61#endif 62 63/*ARGSUSED*/ 64int 65dt_pid_create_entry_probe(struct ps_prochandle *P, dtrace_hdl_t *dtp, 66 fasttrap_probe_spec_t *ftp, const GElf_Sym *symp) 67{ 68#if defined(__APPLE__) 69 ftp->ftps_probe_type = DTFTP_ENTRY; 70 ftp->ftps_pc = symp->st_value; // Keep st_value as uint64_t 71#else 72 ftp->ftps_pc = (uintptr_t)symp->st_value; 73#endif 74 ftp->ftps_size = (size_t)symp->st_size; 75 ftp->ftps_noffs = 1; 76 ftp->ftps_offs[0] = 0; 77 78 if (ioctl(dtp->dt_ftfd, FASTTRAPIOC_MAKEPROBE, ftp) != 0) { 79 dt_dprintf("fasttrap probe creation ioctl failed: %s\n", 80 strerror(errno)); 81 return (dt_set_errno(dtp, errno)); 82 } 83 84 return (1); 85} 86 87static int 88dt_pid_has_jump_table(struct ps_prochandle *P, dtrace_hdl_t *dtp, 89 uint8_t *text, fasttrap_probe_spec_t *ftp, const GElf_Sym *symp) 90{ 91 ulong_t i; 92 int size; 93 pid_t pid = Pstatus(P)->pr_pid; 94 char dmodel = Pstatus(P)->pr_dmodel; 95 96 /* 97 * Take a pass through the function looking for a register-dependant 98 * jmp instruction. This could be a jump table so we have to be 99 * ultra conservative. 100 */ 101 for (i = 0; i < ftp->ftps_size; i += size) { 102 size = dt_instr_size(&text[i], dtp, pid, symp->st_value + i, 103 dmodel); 104 105 /* 106 * Assume the worst if we hit an illegal instruction. 107 */ 108 if (size <= 0) { 109 dt_dprintf("error at %#lx (assuming jump table)\n", i); 110 return (1); 111 } 112 113 /* 114 * Register-dependant jmp instructions start with a 0xff byte 115 * and have the modrm.reg field set to 4. They can have an 116 * optional REX prefix on the 64-bit ISA. 117 */ 118 if ((text[i] == 0xff && DT_MODRM_REG(text[i + 1]) == 4) || 119 (dmodel == PR_MODEL_LP64 && (text[i] & 0xf0) == 0x40 && 120 text[i + 1] == 0xff && DT_MODRM_REG(text[i + 2]) == 4)) { 121 dt_dprintf("found a suspected jump table at %s:%lx\n", 122 ftp->ftps_func, i); 123 return (1); 124 } 125 } 126 127 return (0); 128} 129 130/*ARGSUSED*/ 131int 132dt_pid_create_return_probe(struct ps_prochandle *P, dtrace_hdl_t *dtp, 133 fasttrap_probe_spec_t *ftp, const GElf_Sym *symp, uint64_t *stret) 134{ 135 uint8_t *text; 136 ulong_t i, end; 137 int size; 138 pid_t pid = Pstatus(P)->pr_pid; 139 char dmodel = Pstatus(P)->pr_dmodel; 140 141 /* 142 * We allocate a few extra bytes at the end so we don't have to check 143 * for overrunning the buffer. 144 */ 145 if ((text = calloc(1, symp->st_size + 4)) == NULL) { 146 dt_dprintf("mr sparkle: malloc() failed\n"); 147 return (DT_PROC_ERR); 148 } 149 150 if (Pread(P, text, symp->st_size, symp->st_value) != symp->st_size) { 151 dt_dprintf("mr sparkle: Pread() failed\n"); 152 free(text); 153 return (DT_PROC_ERR); 154 } 155 156#if defined(__APPLE__) 157 ftp->ftps_probe_type = DTFTP_RETURN; 158 ftp->ftps_pc = symp->st_value; 159#else 160 ftp->ftps_pc = (uintptr_t)symp->st_value; 161#endif 162 ftp->ftps_size = (size_t)symp->st_size; 163 ftp->ftps_noffs = 0; 164 165 /* 166 * If there's a jump table in the function we're only willing to 167 * instrument these specific (and equivalent) instruction sequences: 168 * leave 169 * [rep] ret 170 * and 171 * movl %ebp,%esp 172 * popl %ebp 173 * [rep] ret 174 * 175 * We do this to avoid accidentally interpreting jump table 176 * offsets as actual instructions. 177 */ 178 if (dt_pid_has_jump_table(P, dtp, text, ftp, symp)) { 179 for (i = 0, end = ftp->ftps_size; i < end; i += size) { 180 size = dt_instr_size(&text[i], dtp, pid, 181 symp->st_value + i, dmodel); 182 183 /* bail if we hit an invalid opcode */ 184 if (size <= 0) 185 break; 186 187 if (text[i] == DT_LEAVE && text[i + 1] == DT_RET) { 188 dt_dprintf("leave/ret at %lx\n", i + 1); 189 ftp->ftps_offs[ftp->ftps_noffs++] = i + 1; 190 size = 2; 191 } else if (text[i] == DT_LEAVE && 192 text[i + 1] == DT_REP && text[i + 2] == DT_RET) { 193 dt_dprintf("leave/rep ret at %lx\n", i + 1); 194 ftp->ftps_offs[ftp->ftps_noffs++] = i + 1; 195 size = 3; 196 } else if (*(uint16_t *)&text[i] == DT_MOVL_EBP_ESP && 197 text[i + 2] == DT_POPL_EBP && 198 text[i + 3] == DT_RET) { 199 dt_dprintf("movl/popl/ret at %lx\n", i + 3); 200 ftp->ftps_offs[ftp->ftps_noffs++] = i + 3; 201 size = 4; 202 } else if (*(uint16_t *)&text[i] == DT_MOVL_EBP_ESP && 203 text[i + 2] == DT_POPL_EBP && 204 text[i + 3] == DT_REP && 205 text[i + 4] == DT_RET) { 206 dt_dprintf("movl/popl/rep ret at %lx\n", i + 3); 207 ftp->ftps_offs[ftp->ftps_noffs++] = i + 3; 208 size = 5; 209 } 210 } 211 } else { 212 for (i = 0, end = ftp->ftps_size; i < end; i += size) { 213 size = dt_instr_size(&text[i], dtp, pid, 214 symp->st_value + i, dmodel); 215 216 /* bail if we hit an invalid opcode */ 217 if (size <= 0) 218 break; 219 220 /* ordinary ret */ 221 if (size == 1 && text[i] == DT_RET) 222 goto is_ret; 223 224 /* two-byte ret */ 225 if (size == 2 && text[i] == DT_REP && 226 text[i + 1] == DT_RET) 227 goto is_ret; 228 229 /* ret <imm16> */ 230 if (size == 3 && text[i] == DT_RET16) 231 goto is_ret; 232 233 /* two-byte ret <imm16> */ 234 if (size == 4 && text[i] == DT_REP && 235 text[i + 1] == DT_RET16) 236 goto is_ret; 237 238 /* 32-bit displacement jmp outside of the function */ 239 if (size == 5 && text[i] == DT_JMP32 && symp->st_size <= 240 (uintptr_t)(i + size + *(int32_t *)&text[i + 1])) 241 goto is_ret; 242 243 /* 8-bit displacement jmp outside of the function */ 244 if (size == 2 && text[i] == DT_JMP8 && symp->st_size <= 245 (uintptr_t)(i + size + *(int8_t *)&text[i + 1])) 246 goto is_ret; 247 248 /* 32-bit disp. conditional jmp outside of the func. */ 249 if (size == 6 && DT_ISJ32(*(uint16_t *)&text[i]) && 250 symp->st_size <= 251 (uintptr_t)(i + size + *(int32_t *)&text[i + 2])) 252 goto is_ret; 253 254 /* 8-bit disp. conditional jmp outside of the func. */ 255 if (size == 2 && DT_ISJ8(text[i]) && symp->st_size <= 256 (uintptr_t)(i + size + *(int8_t *)&text[i + 1])) 257 goto is_ret; 258 259 continue; 260is_ret: 261 dt_dprintf("return at offset %lx\n", i); 262 ftp->ftps_offs[ftp->ftps_noffs++] = i; 263 } 264 } 265 266 free(text); 267 if (ftp->ftps_noffs > 0) { 268 if (ioctl(dtp->dt_ftfd, FASTTRAPIOC_MAKEPROBE, ftp) != 0) { 269 dt_dprintf("fasttrap probe creation ioctl failed: %s\n", 270 strerror(errno)); 271 return (dt_set_errno(dtp, errno)); 272 } 273 } 274 275 return (ftp->ftps_noffs); 276} 277 278/*ARGSUSED*/ 279int 280dt_pid_create_offset_probe(struct ps_prochandle *P, dtrace_hdl_t *dtp, 281 fasttrap_probe_spec_t *ftp, const GElf_Sym *symp, ulong_t off) 282{ 283#if defined(__APPLE__) 284 ftp->ftps_probe_type = DTFTP_OFFSETS; 285 ftp->ftps_pc = symp->st_value; 286#else 287 ftp->ftps_pc = (uintptr_t)symp->st_value; 288#endif 289 ftp->ftps_size = (size_t)symp->st_size; 290 ftp->ftps_noffs = 1; 291 292 if (strcmp("-", ftp->ftps_func) == 0) { 293 ftp->ftps_offs[0] = off; 294 } else { 295 uint8_t *text; 296 ulong_t i; 297 int size; 298 pid_t pid = Pstatus(P)->pr_pid; 299 char dmodel = Pstatus(P)->pr_dmodel; 300 301 if ((text = malloc(symp->st_size)) == NULL) { 302 dt_dprintf("mr sparkle: malloc() failed\n"); 303 return (DT_PROC_ERR); 304 } 305 306 if (Pread(P, text, symp->st_size, symp->st_value) != 307 symp->st_size) { 308 dt_dprintf("mr sparkle: Pread() failed\n"); 309 free(text); 310 return (DT_PROC_ERR); 311 } 312 313 /* 314 * We can't instrument offsets in functions with jump tables 315 * as we might interpret a jump table offset as an 316 * instruction. 317 */ 318 if (dt_pid_has_jump_table(P, dtp, text, ftp, symp)) { 319 free(text); 320 return (0); 321 } 322 323 for (i = 0; i < symp->st_size; i += size) { 324 if (i == off) { 325 ftp->ftps_offs[0] = i; 326 break; 327 } 328 329 /* 330 * If we've passed the desired offset without a 331 * match, then the given offset must not lie on a 332 * instruction boundary. 333 */ 334 if (i > off) { 335 free(text); 336 return (DT_PROC_ALIGN); 337 } 338 339 size = dt_instr_size(&text[i], dtp, pid, 340 symp->st_value + i, dmodel); 341 342 /* 343 * If we hit an invalid instruction, bail as if we 344 * couldn't find the offset. 345 */ 346 if (size <= 0) { 347 free(text); 348 return (DT_PROC_ALIGN); 349 } 350 } 351 352 free(text); 353 } 354 355 if (ioctl(dtp->dt_ftfd, FASTTRAPIOC_MAKEPROBE, ftp) != 0) { 356 dt_dprintf("fasttrap probe creation ioctl failed: %s\n", 357 strerror(errno)); 358 return (dt_set_errno(dtp, errno)); 359 } 360 361 return (ftp->ftps_noffs); 362} 363 364/*ARGSUSED*/ 365int 366dt_pid_create_glob_offset_probes(struct ps_prochandle *P, dtrace_hdl_t *dtp, 367 fasttrap_probe_spec_t *ftp, const GElf_Sym *symp, const char *pattern) 368{ 369 uint8_t *text; 370 ulong_t i, end; 371 int size; 372 pid_t pid = Pstatus(P)->pr_pid; 373 char dmodel = Pstatus(P)->pr_dmodel; 374 375 if ((text = malloc(symp->st_size)) == NULL) { 376 dt_dprintf("mr sparkle: malloc() failed\n"); 377 return (DT_PROC_ERR); 378 } 379 380 if (Pread(P, text, symp->st_size, symp->st_value) != symp->st_size) { 381 dt_dprintf("mr sparkle: Pread() failed\n"); 382 free(text); 383 return (DT_PROC_ERR); 384 } 385 386 /* 387 * We can't instrument offsets in functions with jump tables as 388 * we might interpret a jump table offset as an instruction. 389 */ 390 if (dt_pid_has_jump_table(P, dtp, text, ftp, symp)) { 391 free(text); 392 return (0); 393 } 394 395#if defined(__APPLE__) 396 ftp->ftps_probe_type = DTFTP_OFFSETS; 397 ftp->ftps_pc = symp->st_value; 398#else 399 ftp->ftps_pc = (uintptr_t)symp->st_value; 400#endif 401 ftp->ftps_size = (size_t)symp->st_size; 402 ftp->ftps_noffs = 0; 403 404 end = ftp->ftps_size; 405 406 if (strcmp("*", pattern) == 0) { 407 for (i = 0; i < end; i += size) { 408 ftp->ftps_offs[ftp->ftps_noffs++] = i; 409 410 size = dt_instr_size(&text[i], dtp, pid, 411 symp->st_value + i, dmodel); 412 413 /* bail if we hit an invalid opcode */ 414 if (size <= 0) 415 break; 416 } 417 } else { 418 char name[sizeof (i) * 2 + 1]; 419 420 for (i = 0; i < end; i += size) { 421 (void) snprintf(name, sizeof (name), "%lx", i); 422 if (gmatch(name, pattern)) 423 ftp->ftps_offs[ftp->ftps_noffs++] = i; 424 425 size = dt_instr_size(&text[i], dtp, pid, 426 symp->st_value + i, dmodel); 427 428 /* bail if we hit an invalid opcode */ 429 if (size <= 0) 430 break; 431 } 432 } 433 434 free(text); 435 if (ftp->ftps_noffs > 0) { 436 if (ioctl(dtp->dt_ftfd, FASTTRAPIOC_MAKEPROBE, ftp) != 0) { 437 dt_dprintf("fasttrap probe creation ioctl failed: %s\n", 438 strerror(errno)); 439 return (dt_set_errno(dtp, errno)); 440 } 441 } 442 443 return (ftp->ftps_noffs); 444} 445 446typedef struct dtrace_dis { 447 uchar_t *instr; 448 dtrace_hdl_t *dtp; 449 pid_t pid; 450#if defined(__APPLE__) 451 uint64_t addr; 452#else 453 uintptr_t addr; 454#endif 455} dtrace_dis_t; 456 457static int 458dt_getbyte(void *data) 459{ 460 dtrace_dis_t *dis = data; 461 int ret = *dis->instr; 462 463 if (ret == FASTTRAP_INSTR) { 464 fasttrap_instr_query_t instr; 465 466 instr.ftiq_pid = dis->pid; 467 instr.ftiq_pc = dis->addr; 468 469 /* 470 * If we hit a byte that looks like the fasttrap provider's 471 * trap instruction (which doubles as the breakpoint 472 * instruction for debuggers) we need to query the kernel 473 * for the real value. This may just be part of an immediate 474 * value so there's no need to return an error if the 475 * kernel doesn't know about this address. 476 */ 477 if (ioctl(dis->dtp->dt_ftfd, FASTTRAPIOC_GETINSTR, &instr) == 0) { 478 ret = instr.ftiq_instr; 479#if defined(__APPLE__) 480 *dis->instr = instr.ftiq_instr; // Prevent false jump table detection 481#endif 482 } 483 } 484 485 dis->addr++; 486 dis->instr++; 487 488 return (ret); 489} 490 491#if defined(__APPLE__) 492static int dt_instr_size(uchar_t *instr, dtrace_hdl_t *dtp, pid_t pid, uint64_t addr, char dmodel) 493#else 494static int 495dt_instr_size(uchar_t *instr, dtrace_hdl_t *dtp, pid_t pid, uintptr_t addr, 496 char dmodel) 497#endif 498{ 499 dtrace_dis_t data; 500 dis86_t x86dis; 501 uint_t cpu_mode; 502 503 data.instr = instr; 504 data.dtp = dtp; 505 data.pid = pid; 506 data.addr = addr; 507 508 x86dis.d86_data = &data; 509 x86dis.d86_get_byte = dt_getbyte; 510 x86dis.d86_check_func = NULL; 511 512 cpu_mode = (dmodel == PR_MODEL_ILP32) ? SIZE32 : SIZE64; 513 514 if (dtrace_disx86(&x86dis, cpu_mode) != 0) 515 return (-1); 516 517 /* 518 * If the instruction was a single-byte breakpoint, there may be 519 * another debugger attached to this process. The original instruction 520 * can't be recovered so this must fail. 521 */ 522 if (x86dis.d86_len == 1 && instr[0] == FASTTRAP_INSTR) 523 return (-1); 524 525 return (x86dis.d86_len); 526} 527 528#endif // __i386__ || __x86_64__ 529