1/*
2 * CDDL HEADER START
3 *
4 * The contents of this file are subject to the terms of the
5 * Common Development and Distribution License (the "License").
6 * You may not use this file except in compliance with the License.
7 *
8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9 * or http://www.opensolaris.org/os/licensing.
10 * See the License for the specific language governing permissions
11 * and limitations under the License.
12 *
13 * When distributing Covered Code, include this CDDL HEADER in each
14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15 * If applicable, add the following below this CDDL HEADER, with the
16 * fields enclosed by brackets "[]" replaced with your own identifying
17 * information: Portions Copyright [yyyy] [name of copyright owner]
18 *
19 * CDDL HEADER END
20 */
21
22/*
23 * Copyright 2006 Sun Microsystems, Inc.  All rights reserved.
24 * Use is subject to license terms.
25 */
26
27#pragma ident	"@(#)dt_isadep.c	1.14	06/02/22 SMI"
28
29#if defined(__i386__) || defined(__x86_64__)
30
31#include <stdlib.h>
32#include <assert.h>
33#include <errno.h>
34#include <string.h>
35#include <libgen.h>
36
37#include <dt_impl.h>
38#include <dt_pid.h>
39
40#include <dis_tables.h>
41
42#define	DT_POPL_EBP	0x5d
43#define	DT_RET		0xc3
44#define	DT_RET16	0xc2
45#define	DT_LEAVE	0xc9
46#define	DT_JMP32	0xe9
47#define	DT_JMP8		0xeb
48#define	DT_REP		0xf3
49
50#define	DT_MOVL_EBP_ESP	0xe58b
51
52#define	DT_ISJ32(op16)	(((op16) & 0xfff0) == 0x0f80)
53#define	DT_ISJ8(op8)	(((op8) & 0xf0) == 0x70)
54
55#define	DT_MODRM_REG(modrm)	(((modrm) >> 3) & 0x7)
56
57#if defined(__APPLE__)
58static int dt_instr_size(uchar_t *, dtrace_hdl_t *, pid_t, uint64_t, char);
59#else
60static int dt_instr_size(uchar_t *, dtrace_hdl_t *, pid_t, uintptr_t, char);
61#endif
62
63/*ARGSUSED*/
64int
65dt_pid_create_entry_probe(struct ps_prochandle *P, dtrace_hdl_t *dtp,
66    fasttrap_probe_spec_t *ftp, const GElf_Sym *symp)
67{
68#if defined(__APPLE__)
69	ftp->ftps_probe_type = DTFTP_ENTRY;
70	ftp->ftps_pc = symp->st_value; // Keep st_value as uint64_t
71#else
72        ftp->ftps_pc = (uintptr_t)symp->st_value;
73#endif
74	ftp->ftps_size = (size_t)symp->st_size;
75	ftp->ftps_noffs = 1;
76	ftp->ftps_offs[0] = 0;
77
78	if (ioctl(dtp->dt_ftfd, FASTTRAPIOC_MAKEPROBE, ftp) != 0) {
79		dt_dprintf("fasttrap probe creation ioctl failed: %s\n",
80		    strerror(errno));
81		return (dt_set_errno(dtp, errno));
82	}
83
84	return (1);
85}
86
87static int
88dt_pid_has_jump_table(struct ps_prochandle *P, dtrace_hdl_t *dtp,
89    uint8_t *text, fasttrap_probe_spec_t *ftp, const GElf_Sym *symp)
90{
91	ulong_t i;
92	int size;
93	pid_t pid = Pstatus(P)->pr_pid;
94	char dmodel = Pstatus(P)->pr_dmodel;
95
96	/*
97	 * Take a pass through the function looking for a register-dependant
98	 * jmp instruction. This could be a jump table so we have to be
99	 * ultra conservative.
100	 */
101	for (i = 0; i < ftp->ftps_size; i += size) {
102		size = dt_instr_size(&text[i], dtp, pid, symp->st_value + i,
103		    dmodel);
104
105		/*
106		 * Assume the worst if we hit an illegal instruction.
107		 */
108		if (size <= 0) {
109			dt_dprintf("error at %#lx (assuming jump table)\n", i);
110			return (1);
111		}
112
113		/*
114		 * Register-dependant jmp instructions start with a 0xff byte
115		 * and have the modrm.reg field set to 4. They can have an
116		 * optional REX prefix on the 64-bit ISA.
117		 */
118		if ((text[i] == 0xff && DT_MODRM_REG(text[i + 1]) == 4) ||
119		    (dmodel == PR_MODEL_LP64 && (text[i] & 0xf0) == 0x40 &&
120		    text[i + 1] == 0xff && DT_MODRM_REG(text[i + 2]) == 4)) {
121			dt_dprintf("found a suspected jump table at %s:%lx\n",
122			    ftp->ftps_func, i);
123			return (1);
124		}
125	}
126
127	return (0);
128}
129
130/*ARGSUSED*/
131int
132dt_pid_create_return_probe(struct ps_prochandle *P, dtrace_hdl_t *dtp,
133    fasttrap_probe_spec_t *ftp, const GElf_Sym *symp, uint64_t *stret)
134{
135	uint8_t *text;
136	ulong_t i, end;
137	int size;
138	pid_t pid = Pstatus(P)->pr_pid;
139	char dmodel = Pstatus(P)->pr_dmodel;
140
141	/*
142	 * We allocate a few extra bytes at the end so we don't have to check
143	 * for overrunning the buffer.
144	 */
145	if ((text = calloc(1, symp->st_size + 4)) == NULL) {
146		dt_dprintf("mr sparkle: malloc() failed\n");
147		return (DT_PROC_ERR);
148	}
149
150	if (Pread(P, text, symp->st_size, symp->st_value) != symp->st_size) {
151		dt_dprintf("mr sparkle: Pread() failed\n");
152		free(text);
153		return (DT_PROC_ERR);
154	}
155
156#if defined(__APPLE__)
157	ftp->ftps_probe_type = DTFTP_RETURN;
158	ftp->ftps_pc = symp->st_value;
159#else
160	ftp->ftps_pc = (uintptr_t)symp->st_value;
161#endif
162	ftp->ftps_size = (size_t)symp->st_size;
163	ftp->ftps_noffs = 0;
164
165	/*
166	 * If there's a jump table in the function we're only willing to
167	 * instrument these specific (and equivalent) instruction sequences:
168	 *	leave
169	 *	[rep] ret
170	 * and
171	 *	movl	%ebp,%esp
172	 *	popl	%ebp
173	 *	[rep] ret
174	 *
175	 * We do this to avoid accidentally interpreting jump table
176	 * offsets as actual instructions.
177	 */
178	if (dt_pid_has_jump_table(P, dtp, text, ftp, symp)) {
179		for (i = 0, end = ftp->ftps_size; i < end; i += size) {
180			size = dt_instr_size(&text[i], dtp, pid,
181			    symp->st_value + i, dmodel);
182
183			/* bail if we hit an invalid opcode */
184			if (size <= 0)
185				break;
186
187			if (text[i] == DT_LEAVE && text[i + 1] == DT_RET) {
188				dt_dprintf("leave/ret at %lx\n", i + 1);
189				ftp->ftps_offs[ftp->ftps_noffs++] = i + 1;
190				size = 2;
191			} else if (text[i] == DT_LEAVE &&
192			    text[i + 1] == DT_REP && text[i + 2] == DT_RET) {
193				dt_dprintf("leave/rep ret at %lx\n", i + 1);
194				ftp->ftps_offs[ftp->ftps_noffs++] = i + 1;
195				size = 3;
196			} else if (*(uint16_t *)&text[i] == DT_MOVL_EBP_ESP &&
197			    text[i + 2] == DT_POPL_EBP &&
198			    text[i + 3] == DT_RET) {
199				dt_dprintf("movl/popl/ret at %lx\n", i + 3);
200				ftp->ftps_offs[ftp->ftps_noffs++] = i + 3;
201				size = 4;
202			} else if (*(uint16_t *)&text[i] == DT_MOVL_EBP_ESP &&
203			    text[i + 2] == DT_POPL_EBP &&
204			    text[i + 3] == DT_REP &&
205			    text[i + 4] == DT_RET) {
206				dt_dprintf("movl/popl/rep ret at %lx\n", i + 3);
207				ftp->ftps_offs[ftp->ftps_noffs++] = i + 3;
208				size = 5;
209			}
210		}
211	} else {
212		for (i = 0, end = ftp->ftps_size; i < end; i += size) {
213			size = dt_instr_size(&text[i], dtp, pid,
214			    symp->st_value + i, dmodel);
215
216			/* bail if we hit an invalid opcode */
217			if (size <= 0)
218				break;
219
220			/* ordinary ret */
221			if (size == 1 && text[i] == DT_RET)
222				goto is_ret;
223
224			/* two-byte ret */
225			if (size == 2 && text[i] == DT_REP &&
226			    text[i + 1] == DT_RET)
227				goto is_ret;
228
229			/* ret <imm16> */
230			if (size == 3 && text[i] == DT_RET16)
231				goto is_ret;
232
233			/* two-byte ret <imm16> */
234			if (size == 4 && text[i] == DT_REP &&
235			    text[i + 1] == DT_RET16)
236				goto is_ret;
237
238			/* 32-bit displacement jmp outside of the function */
239			if (size == 5 && text[i] == DT_JMP32 && symp->st_size <=
240			    (uintptr_t)(i + size + *(int32_t *)&text[i + 1]))
241				goto is_ret;
242
243			/* 8-bit displacement jmp outside of the function */
244			if (size == 2 && text[i] == DT_JMP8 && symp->st_size <=
245			    (uintptr_t)(i + size + *(int8_t *)&text[i + 1]))
246				goto is_ret;
247
248			/* 32-bit disp. conditional jmp outside of the func. */
249			if (size == 6 && DT_ISJ32(*(uint16_t *)&text[i]) &&
250			    symp->st_size <=
251			    (uintptr_t)(i + size + *(int32_t *)&text[i + 2]))
252				goto is_ret;
253
254			/* 8-bit disp. conditional jmp outside of the func. */
255			if (size == 2 && DT_ISJ8(text[i]) && symp->st_size <=
256			    (uintptr_t)(i + size + *(int8_t *)&text[i + 1]))
257				goto is_ret;
258
259			continue;
260is_ret:
261			dt_dprintf("return at offset %lx\n", i);
262			ftp->ftps_offs[ftp->ftps_noffs++] = i;
263		}
264	}
265
266	free(text);
267	if (ftp->ftps_noffs > 0) {
268		if (ioctl(dtp->dt_ftfd, FASTTRAPIOC_MAKEPROBE, ftp) != 0) {
269			dt_dprintf("fasttrap probe creation ioctl failed: %s\n",
270			    strerror(errno));
271			return (dt_set_errno(dtp, errno));
272		}
273	}
274
275	return (ftp->ftps_noffs);
276}
277
278/*ARGSUSED*/
279int
280dt_pid_create_offset_probe(struct ps_prochandle *P, dtrace_hdl_t *dtp,
281    fasttrap_probe_spec_t *ftp, const GElf_Sym *symp, ulong_t off)
282{
283#if defined(__APPLE__)
284	ftp->ftps_probe_type = DTFTP_OFFSETS;
285	ftp->ftps_pc = symp->st_value;
286#else
287	ftp->ftps_pc = (uintptr_t)symp->st_value;
288#endif
289	ftp->ftps_size = (size_t)symp->st_size;
290	ftp->ftps_noffs = 1;
291
292	if (strcmp("-", ftp->ftps_func) == 0) {
293		ftp->ftps_offs[0] = off;
294	} else {
295		uint8_t *text;
296		ulong_t i;
297		int size;
298		pid_t pid = Pstatus(P)->pr_pid;
299		char dmodel = Pstatus(P)->pr_dmodel;
300
301		if ((text = malloc(symp->st_size)) == NULL) {
302			dt_dprintf("mr sparkle: malloc() failed\n");
303			return (DT_PROC_ERR);
304		}
305
306		if (Pread(P, text, symp->st_size, symp->st_value) !=
307		    symp->st_size) {
308			dt_dprintf("mr sparkle: Pread() failed\n");
309			free(text);
310			return (DT_PROC_ERR);
311		}
312
313		/*
314		 * We can't instrument offsets in functions with jump tables
315		 * as we might interpret a jump table offset as an
316		 * instruction.
317		 */
318		if (dt_pid_has_jump_table(P, dtp, text, ftp, symp)) {
319			free(text);
320			return (0);
321		}
322
323		for (i = 0; i < symp->st_size; i += size) {
324			if (i == off) {
325				ftp->ftps_offs[0] = i;
326				break;
327			}
328
329			/*
330			 * If we've passed the desired offset without a
331			 * match, then the given offset must not lie on a
332			 * instruction boundary.
333			 */
334			if (i > off) {
335				free(text);
336				return (DT_PROC_ALIGN);
337			}
338
339			size = dt_instr_size(&text[i], dtp, pid,
340			    symp->st_value + i, dmodel);
341
342			/*
343			 * If we hit an invalid instruction, bail as if we
344			 * couldn't find the offset.
345			 */
346			if (size <= 0) {
347				free(text);
348				return (DT_PROC_ALIGN);
349			}
350		}
351
352		free(text);
353	}
354
355	if (ioctl(dtp->dt_ftfd, FASTTRAPIOC_MAKEPROBE, ftp) != 0) {
356		dt_dprintf("fasttrap probe creation ioctl failed: %s\n",
357		    strerror(errno));
358		return (dt_set_errno(dtp, errno));
359	}
360
361	return (ftp->ftps_noffs);
362}
363
364/*ARGSUSED*/
365int
366dt_pid_create_glob_offset_probes(struct ps_prochandle *P, dtrace_hdl_t *dtp,
367    fasttrap_probe_spec_t *ftp, const GElf_Sym *symp, const char *pattern)
368{
369	uint8_t *text;
370	ulong_t i, end;
371	int size;
372	pid_t pid = Pstatus(P)->pr_pid;
373	char dmodel = Pstatus(P)->pr_dmodel;
374
375	if ((text = malloc(symp->st_size)) == NULL) {
376		dt_dprintf("mr sparkle: malloc() failed\n");
377		return (DT_PROC_ERR);
378	}
379
380	if (Pread(P, text, symp->st_size, symp->st_value) != symp->st_size) {
381		dt_dprintf("mr sparkle: Pread() failed\n");
382		free(text);
383		return (DT_PROC_ERR);
384	}
385
386	/*
387	 * We can't instrument offsets in functions with jump tables as
388	 * we might interpret a jump table offset as an instruction.
389	 */
390	if (dt_pid_has_jump_table(P, dtp, text, ftp, symp)) {
391		free(text);
392		return (0);
393	}
394
395#if defined(__APPLE__)
396	ftp->ftps_probe_type = DTFTP_OFFSETS;
397	ftp->ftps_pc = symp->st_value;
398#else
399	ftp->ftps_pc = (uintptr_t)symp->st_value;
400#endif
401	ftp->ftps_size = (size_t)symp->st_size;
402	ftp->ftps_noffs = 0;
403
404	end = ftp->ftps_size;
405
406	if (strcmp("*", pattern) == 0) {
407		for (i = 0; i < end; i += size) {
408			ftp->ftps_offs[ftp->ftps_noffs++] = i;
409
410			size = dt_instr_size(&text[i], dtp, pid,
411			    symp->st_value + i, dmodel);
412
413			/* bail if we hit an invalid opcode */
414			if (size <= 0)
415				break;
416		}
417	} else {
418		char name[sizeof (i) * 2 + 1];
419
420		for (i = 0; i < end; i += size) {
421			(void) snprintf(name, sizeof (name), "%lx", i);
422			if (gmatch(name, pattern))
423				ftp->ftps_offs[ftp->ftps_noffs++] = i;
424
425			size = dt_instr_size(&text[i], dtp, pid,
426			    symp->st_value + i, dmodel);
427
428			/* bail if we hit an invalid opcode */
429			if (size <= 0)
430				break;
431		}
432	}
433
434	free(text);
435	if (ftp->ftps_noffs > 0) {
436		if (ioctl(dtp->dt_ftfd, FASTTRAPIOC_MAKEPROBE, ftp) != 0) {
437			dt_dprintf("fasttrap probe creation ioctl failed: %s\n",
438			    strerror(errno));
439			return (dt_set_errno(dtp, errno));
440		}
441	}
442
443	return (ftp->ftps_noffs);
444}
445
446typedef struct dtrace_dis {
447	uchar_t	*instr;
448	dtrace_hdl_t *dtp;
449	pid_t pid;
450#if defined(__APPLE__)
451	uint64_t addr;
452#else
453	uintptr_t addr;
454#endif
455} dtrace_dis_t;
456
457static int
458dt_getbyte(void *data)
459{
460	dtrace_dis_t	*dis = data;
461	int ret = *dis->instr;
462
463	if (ret == FASTTRAP_INSTR) {
464		fasttrap_instr_query_t instr;
465
466		instr.ftiq_pid = dis->pid;
467		instr.ftiq_pc = dis->addr;
468
469		/*
470		 * If we hit a byte that looks like the fasttrap provider's
471		 * trap instruction (which doubles as the breakpoint
472		 * instruction for debuggers) we need to query the kernel
473		 * for the real value. This may just be part of an immediate
474		 * value so there's no need to return an error if the
475		 * kernel doesn't know about this address.
476		 */
477		if (ioctl(dis->dtp->dt_ftfd, FASTTRAPIOC_GETINSTR, &instr) == 0) {
478			ret = instr.ftiq_instr;
479#if defined(__APPLE__)
480			*dis->instr = instr.ftiq_instr; // Prevent false jump table detection
481#endif
482		}
483	}
484
485	dis->addr++;
486	dis->instr++;
487
488	return (ret);
489}
490
491#if defined(__APPLE__)
492static int dt_instr_size(uchar_t *instr, dtrace_hdl_t *dtp, pid_t pid, uint64_t addr, char dmodel)
493#else
494static int
495dt_instr_size(uchar_t *instr, dtrace_hdl_t *dtp, pid_t pid, uintptr_t addr,
496    char dmodel)
497#endif
498{
499	dtrace_dis_t data;
500	dis86_t x86dis;
501	uint_t cpu_mode;
502
503	data.instr = instr;
504	data.dtp = dtp;
505	data.pid = pid;
506	data.addr = addr;
507
508	x86dis.d86_data = &data;
509	x86dis.d86_get_byte = dt_getbyte;
510	x86dis.d86_check_func = NULL;
511
512	cpu_mode = (dmodel == PR_MODEL_ILP32) ? SIZE32 : SIZE64;
513
514	if (dtrace_disx86(&x86dis, cpu_mode) != 0)
515		return (-1);
516
517	/*
518	 * If the instruction was a single-byte breakpoint, there may be
519	 * another debugger attached to this process. The original instruction
520	 * can't be recovered so this must fail.
521	 */
522	if (x86dis.d86_len == 1 && instr[0] == FASTTRAP_INSTR)
523		return (-1);
524
525	return (x86dis.d86_len);
526}
527
528#endif // __i386__ || __x86_64__
529