1 /*
2 * CDDL HEADER START
3 *
4 * The contents of this file are subject to the terms of the
5 * Common Development and Distribution License (the "License").
6 * You may not use this file except in compliance with the License.
7 *
8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9 * or http://www.opensolaris.org/os/licensing.
10 * See the License for the specific language governing permissions
11 * and limitations under the License.
12 *
13 * When distributing Covered Code, include this CDDL HEADER in each
14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15 * If applicable, add the following below this CDDL HEADER, with the
16 * fields enclosed by brackets "[]" replaced with your own identifying
17 * information: Portions Copyright [yyyy] [name of copyright owner]
18 *
19 * CDDL HEADER END
20 */
21
22 /*
23 * Copyright 2009 Sun Microsystems, Inc. All rights reserved.
24 * Use is subject to license terms.
25 */
26
27 /*
28 * Copyright (c) 2012 by Delphix. All rights reserved.
29 */
30
31 #include <stdlib.h>
32 #include <assert.h>
33 #include <errno.h>
34 #include <string.h>
35 #include <libgen.h>
36 #include <sys/ioctl.h>
37
38 #include <dt_impl.h>
39 #include <dt_pid.h>
40
41 #include <dis_tables.h>
42
43 #ifndef illumos
44 #define PR_MODEL_ILP32 1
45 #define PR_MODEL_LP64 2
46 #include <libproc_compat.h>
47 #endif
48
49 #define DT_POPL_EBP 0x5d
50 #define DT_RET 0xc3
51 #define DT_RET16 0xc2
52 #define DT_LEAVE 0xc9
53 #define DT_JMP32 0xe9
54 #define DT_JMP8 0xeb
55 #define DT_REP 0xf3
56
57 #define DT_MOVL_EBP_ESP 0xe58b
58
59 #define DT_ISJ32(op16) (((op16) & 0xfff0) == 0x0f80)
60 #define DT_ISJ8(op8) (((op8) & 0xf0) == 0x70)
61
62 #define DT_MODRM_REG(modrm) (((modrm) >> 3) & 0x7)
63
64 static int dt_instr_size(uchar_t *, dtrace_hdl_t *, pid_t, uintptr_t, char);
65
66 /*ARGSUSED*/
67 int
dt_pid_create_entry_probe(struct ps_prochandle * P,dtrace_hdl_t * dtp,fasttrap_probe_spec_t * ftp,const GElf_Sym * symp)68 dt_pid_create_entry_probe(struct ps_prochandle *P, dtrace_hdl_t *dtp,
69 fasttrap_probe_spec_t *ftp, const GElf_Sym *symp)
70 {
71 ftp->ftps_type = DTFTP_ENTRY;
72 ftp->ftps_pc = (uintptr_t)symp->st_value;
73 ftp->ftps_size = (size_t)symp->st_size;
74 ftp->ftps_noffs = 1;
75 ftp->ftps_offs[0] = 0;
76
77 if (ioctl(dtp->dt_ftfd, FASTTRAPIOC_MAKEPROBE, ftp) != 0) {
78 dt_dprintf("fasttrap probe creation ioctl failed: %s\n",
79 strerror(errno));
80 return (dt_set_errno(dtp, errno));
81 }
82
83 return (1);
84 }
85
86 static int
dt_pid_has_jump_table(struct ps_prochandle * P,dtrace_hdl_t * dtp,uint8_t * text,fasttrap_probe_spec_t * ftp,const GElf_Sym * symp)87 dt_pid_has_jump_table(struct ps_prochandle *P, dtrace_hdl_t *dtp,
88 uint8_t *text, fasttrap_probe_spec_t *ftp, const GElf_Sym *symp)
89 {
90 ulong_t i;
91 int size;
92 #ifdef illumos
93 pid_t pid = Pstatus(P)->pr_pid;
94 char dmodel = Pstatus(P)->pr_dmodel;
95 #else
96 pid_t pid = proc_getpid(P);
97 #if __i386__
98 char dmodel = PR_MODEL_ILP32;
99 #elif __amd64__
100 char dmodel = PR_MODEL_LP64;
101 #endif
102 #endif
103
104 /*
105 * Take a pass through the function looking for a register-dependant
106 * jmp instruction. This could be a jump table so we have to be
107 * ultra conservative.
108 */
109 for (i = 0; i < ftp->ftps_size; i += size) {
110 size = dt_instr_size(&text[i], dtp, pid, symp->st_value + i,
111 dmodel);
112
113 /*
114 * Assume the worst if we hit an illegal instruction.
115 */
116 if (size <= 0) {
117 dt_dprintf("error at %#lx (assuming jump table)\n", i);
118 return (1);
119 }
120
121 #ifdef notyet
122 /*
123 * Register-dependant jmp instructions start with a 0xff byte
124 * and have the modrm.reg field set to 4. They can have an
125 * optional REX prefix on the 64-bit ISA.
126 */
127 if ((text[i] == 0xff && DT_MODRM_REG(text[i + 1]) == 4) ||
128 (dmodel == PR_MODEL_LP64 && (text[i] & 0xf0) == 0x40 &&
129 text[i + 1] == 0xff && DT_MODRM_REG(text[i + 2]) == 4)) {
130 dt_dprintf("found a suspected jump table at %s:%lx\n",
131 ftp->ftps_func, i);
132 return (1);
133 }
134 #endif
135 }
136
137 return (0);
138 }
139
140 /*ARGSUSED*/
141 int
dt_pid_create_return_probe(struct ps_prochandle * P,dtrace_hdl_t * dtp,fasttrap_probe_spec_t * ftp,const GElf_Sym * symp,uint64_t * stret)142 dt_pid_create_return_probe(struct ps_prochandle *P, dtrace_hdl_t *dtp,
143 fasttrap_probe_spec_t *ftp, const GElf_Sym *symp, uint64_t *stret)
144 {
145 uint8_t *text;
146 ulong_t i, end;
147 int size;
148 #ifdef illumos
149 pid_t pid = Pstatus(P)->pr_pid;
150 char dmodel = Pstatus(P)->pr_dmodel;
151 #else
152 pid_t pid = proc_getpid(P);
153 #if __i386__
154 char dmodel = PR_MODEL_ILP32;
155 #elif __amd64__
156 char dmodel = PR_MODEL_LP64;
157 #endif
158 #endif
159
160 /*
161 * We allocate a few extra bytes at the end so we don't have to check
162 * for overrunning the buffer.
163 */
164 if ((text = calloc(1, symp->st_size + 4)) == NULL) {
165 dt_dprintf("mr sparkle: malloc() failed\n");
166 return (DT_PROC_ERR);
167 }
168
169 if (Pread(P, text, symp->st_size, symp->st_value) != symp->st_size) {
170 dt_dprintf("mr sparkle: Pread() failed\n");
171 free(text);
172 return (DT_PROC_ERR);
173 }
174
175 ftp->ftps_type = DTFTP_RETURN;
176 ftp->ftps_pc = (uintptr_t)symp->st_value;
177 ftp->ftps_size = (size_t)symp->st_size;
178 ftp->ftps_noffs = 0;
179
180 /*
181 * If there's a jump table in the function we're only willing to
182 * instrument these specific (and equivalent) instruction sequences:
183 * leave
184 * [rep] ret
185 * and
186 * movl %ebp,%esp
187 * popl %ebp
188 * [rep] ret
189 *
190 * We do this to avoid accidentally interpreting jump table
191 * offsets as actual instructions.
192 */
193 if (dt_pid_has_jump_table(P, dtp, text, ftp, symp)) {
194 for (i = 0, end = ftp->ftps_size; i < end; i += size) {
195 size = dt_instr_size(&text[i], dtp, pid,
196 symp->st_value + i, dmodel);
197
198 /* bail if we hit an invalid opcode */
199 if (size <= 0)
200 break;
201
202 if (text[i] == DT_LEAVE && text[i + 1] == DT_RET) {
203 dt_dprintf("leave/ret at %lx\n", i + 1);
204 ftp->ftps_offs[ftp->ftps_noffs++] = i + 1;
205 size = 2;
206 } else if (text[i] == DT_LEAVE &&
207 text[i + 1] == DT_REP && text[i + 2] == DT_RET) {
208 dt_dprintf("leave/rep ret at %lx\n", i + 1);
209 ftp->ftps_offs[ftp->ftps_noffs++] = i + 1;
210 size = 3;
211 } else if (*(uint16_t *)&text[i] == DT_MOVL_EBP_ESP &&
212 text[i + 2] == DT_POPL_EBP &&
213 text[i + 3] == DT_RET) {
214 dt_dprintf("movl/popl/ret at %lx\n", i + 3);
215 ftp->ftps_offs[ftp->ftps_noffs++] = i + 3;
216 size = 4;
217 } else if (*(uint16_t *)&text[i] == DT_MOVL_EBP_ESP &&
218 text[i + 2] == DT_POPL_EBP &&
219 text[i + 3] == DT_REP &&
220 text[i + 4] == DT_RET) {
221 dt_dprintf("movl/popl/rep ret at %lx\n", i + 3);
222 ftp->ftps_offs[ftp->ftps_noffs++] = i + 3;
223 size = 5;
224 }
225 }
226 } else {
227 for (i = 0, end = ftp->ftps_size; i < end; i += size) {
228 size = dt_instr_size(&text[i], dtp, pid,
229 symp->st_value + i, dmodel);
230
231 /* bail if we hit an invalid opcode */
232 if (size <= 0)
233 break;
234
235 /* ordinary ret */
236 if (size == 1 && text[i] == DT_RET)
237 goto is_ret;
238
239 /* two-byte ret */
240 if (size == 2 && text[i] == DT_REP &&
241 text[i + 1] == DT_RET)
242 goto is_ret;
243
244 /* ret <imm16> */
245 if (size == 3 && text[i] == DT_RET16)
246 goto is_ret;
247
248 /* two-byte ret <imm16> */
249 if (size == 4 && text[i] == DT_REP &&
250 text[i + 1] == DT_RET16)
251 goto is_ret;
252
253 /* 32-bit displacement jmp outside of the function */
254 if (size == 5 && text[i] == DT_JMP32 && symp->st_size <=
255 (uintptr_t)(i + size + *(int32_t *)&text[i + 1]))
256 goto is_ret;
257
258 /* 8-bit displacement jmp outside of the function */
259 if (size == 2 && text[i] == DT_JMP8 && symp->st_size <=
260 (uintptr_t)(i + size + *(int8_t *)&text[i + 1]))
261 goto is_ret;
262
263 /* 32-bit disp. conditional jmp outside of the func. */
264 if (size == 6 && DT_ISJ32(*(uint16_t *)&text[i]) &&
265 symp->st_size <=
266 (uintptr_t)(i + size + *(int32_t *)&text[i + 2]))
267 goto is_ret;
268
269 /* 8-bit disp. conditional jmp outside of the func. */
270 if (size == 2 && DT_ISJ8(text[i]) && symp->st_size <=
271 (uintptr_t)(i + size + *(int8_t *)&text[i + 1]))
272 goto is_ret;
273
274 continue;
275 is_ret:
276 dt_dprintf("return at offset %lx\n", i);
277 ftp->ftps_offs[ftp->ftps_noffs++] = i;
278 }
279 }
280
281 free(text);
282 if (ftp->ftps_noffs > 0) {
283 if (ioctl(dtp->dt_ftfd, FASTTRAPIOC_MAKEPROBE, ftp) != 0) {
284 dt_dprintf("fasttrap probe creation ioctl failed: %s\n",
285 strerror(errno));
286 return (dt_set_errno(dtp, errno));
287 }
288 }
289
290 return (ftp->ftps_noffs);
291 }
292
293 /*ARGSUSED*/
294 int
dt_pid_create_offset_probe(struct ps_prochandle * P,dtrace_hdl_t * dtp,fasttrap_probe_spec_t * ftp,const GElf_Sym * symp,ulong_t off)295 dt_pid_create_offset_probe(struct ps_prochandle *P, dtrace_hdl_t *dtp,
296 fasttrap_probe_spec_t *ftp, const GElf_Sym *symp, ulong_t off)
297 {
298 ftp->ftps_type = DTFTP_OFFSETS;
299 ftp->ftps_pc = (uintptr_t)symp->st_value;
300 ftp->ftps_size = (size_t)symp->st_size;
301 ftp->ftps_noffs = 1;
302
303 if (strcmp("-", ftp->ftps_func) == 0) {
304 ftp->ftps_offs[0] = off;
305 } else {
306 uint8_t *text;
307 ulong_t i;
308 int size;
309 #ifdef illumos
310 pid_t pid = Pstatus(P)->pr_pid;
311 char dmodel = Pstatus(P)->pr_dmodel;
312 #else
313 pid_t pid = proc_getpid(P);
314 #if __i386__
315 char dmodel = PR_MODEL_ILP32;
316 #elif __amd64__
317 char dmodel = PR_MODEL_LP64;
318 #endif
319 #endif
320
321 if ((text = malloc(symp->st_size)) == NULL) {
322 dt_dprintf("mr sparkle: malloc() failed\n");
323 return (DT_PROC_ERR);
324 }
325
326 if (Pread(P, text, symp->st_size, symp->st_value) !=
327 symp->st_size) {
328 dt_dprintf("mr sparkle: Pread() failed\n");
329 free(text);
330 return (DT_PROC_ERR);
331 }
332
333 /*
334 * We can't instrument offsets in functions with jump tables
335 * as we might interpret a jump table offset as an
336 * instruction.
337 */
338 if (dt_pid_has_jump_table(P, dtp, text, ftp, symp)) {
339 free(text);
340 return (0);
341 }
342
343 for (i = 0; i < symp->st_size; i += size) {
344 if (i == off) {
345 ftp->ftps_offs[0] = i;
346 break;
347 }
348
349 /*
350 * If we've passed the desired offset without a
351 * match, then the given offset must not lie on a
352 * instruction boundary.
353 */
354 if (i > off) {
355 free(text);
356 return (DT_PROC_ALIGN);
357 }
358
359 size = dt_instr_size(&text[i], dtp, pid,
360 symp->st_value + i, dmodel);
361
362 /*
363 * If we hit an invalid instruction, bail as if we
364 * couldn't find the offset.
365 */
366 if (size <= 0) {
367 free(text);
368 return (DT_PROC_ALIGN);
369 }
370 }
371
372 free(text);
373 }
374
375 if (ioctl(dtp->dt_ftfd, FASTTRAPIOC_MAKEPROBE, ftp) != 0) {
376 dt_dprintf("fasttrap probe creation ioctl failed: %s\n",
377 strerror(errno));
378 return (dt_set_errno(dtp, errno));
379 }
380
381 return (ftp->ftps_noffs);
382 }
383
384 /*ARGSUSED*/
385 int
dt_pid_create_glob_offset_probes(struct ps_prochandle * P,dtrace_hdl_t * dtp,fasttrap_probe_spec_t * ftp,const GElf_Sym * symp,const char * pattern)386 dt_pid_create_glob_offset_probes(struct ps_prochandle *P, dtrace_hdl_t *dtp,
387 fasttrap_probe_spec_t *ftp, const GElf_Sym *symp, const char *pattern)
388 {
389 uint8_t *text;
390 int size;
391 ulong_t i, end = symp->st_size;
392 #ifdef illumos
393 pid_t pid = Pstatus(P)->pr_pid;
394 char dmodel = Pstatus(P)->pr_dmodel;
395 #else
396 pid_t pid = proc_getpid(P);
397 #if __i386__
398 char dmodel = PR_MODEL_ILP32;
399 #elif __amd64__
400 char dmodel = PR_MODEL_LP64;
401 #endif
402 #endif
403
404 ftp->ftps_type = DTFTP_OFFSETS;
405 ftp->ftps_pc = (uintptr_t)symp->st_value;
406 ftp->ftps_size = (size_t)symp->st_size;
407 ftp->ftps_noffs = 0;
408
409 if ((text = malloc(symp->st_size)) == NULL) {
410 dt_dprintf("mr sparkle: malloc() failed\n");
411 return (DT_PROC_ERR);
412 }
413
414 if (Pread(P, text, symp->st_size, symp->st_value) != symp->st_size) {
415 dt_dprintf("mr sparkle: Pread() failed\n");
416 free(text);
417 return (DT_PROC_ERR);
418 }
419
420 /*
421 * We can't instrument offsets in functions with jump tables as
422 * we might interpret a jump table offset as an instruction.
423 */
424 if (dt_pid_has_jump_table(P, dtp, text, ftp, symp)) {
425 free(text);
426 return (0);
427 }
428
429 if (strcmp("*", pattern) == 0) {
430 for (i = 0; i < end; i += size) {
431 ftp->ftps_offs[ftp->ftps_noffs++] = i;
432
433 size = dt_instr_size(&text[i], dtp, pid,
434 symp->st_value + i, dmodel);
435
436 /* bail if we hit an invalid opcode */
437 if (size <= 0)
438 break;
439 }
440 } else {
441 char name[sizeof (i) * 2 + 1];
442
443 for (i = 0; i < end; i += size) {
444 (void) snprintf(name, sizeof (name), "%lx", i);
445 if (gmatch(name, pattern))
446 ftp->ftps_offs[ftp->ftps_noffs++] = i;
447
448 size = dt_instr_size(&text[i], dtp, pid,
449 symp->st_value + i, dmodel);
450
451 /* bail if we hit an invalid opcode */
452 if (size <= 0)
453 break;
454 }
455 }
456
457 free(text);
458 if (ftp->ftps_noffs > 0) {
459 if (ioctl(dtp->dt_ftfd, FASTTRAPIOC_MAKEPROBE, ftp) != 0) {
460 dt_dprintf("fasttrap probe creation ioctl failed: %s\n",
461 strerror(errno));
462 return (dt_set_errno(dtp, errno));
463 }
464 }
465
466 return (ftp->ftps_noffs);
467 }
468
469 typedef struct dtrace_dis {
470 uchar_t *instr;
471 dtrace_hdl_t *dtp;
472 pid_t pid;
473 uintptr_t addr;
474 } dtrace_dis_t;
475
476 static int
dt_getbyte(void * data)477 dt_getbyte(void *data)
478 {
479 dtrace_dis_t *dis = data;
480 int ret = *dis->instr;
481
482 if (ret == FASTTRAP_INSTR) {
483 fasttrap_instr_query_t instr;
484
485 instr.ftiq_pid = dis->pid;
486 instr.ftiq_pc = dis->addr;
487
488 /*
489 * If we hit a byte that looks like the fasttrap provider's
490 * trap instruction (which doubles as the breakpoint
491 * instruction for debuggers) we need to query the kernel
492 * for the real value. This may just be part of an immediate
493 * value so there's no need to return an error if the
494 * kernel doesn't know about this address.
495 */
496 if (ioctl(dis->dtp->dt_ftfd, FASTTRAPIOC_GETINSTR, &instr) == 0)
497 ret = instr.ftiq_instr;
498 }
499
500 dis->addr++;
501 dis->instr++;
502
503 return (ret);
504 }
505
506 static int
dt_instr_size(uchar_t * instr,dtrace_hdl_t * dtp,pid_t pid,uintptr_t addr,char dmodel)507 dt_instr_size(uchar_t *instr, dtrace_hdl_t *dtp, pid_t pid, uintptr_t addr,
508 char dmodel)
509 {
510 dtrace_dis_t data;
511 dis86_t x86dis;
512 uint_t cpu_mode;
513
514 data.instr = instr;
515 data.dtp = dtp;
516 data.pid = pid;
517 data.addr = addr;
518
519 x86dis.d86_data = &data;
520 x86dis.d86_get_byte = dt_getbyte;
521 x86dis.d86_check_func = NULL;
522
523 cpu_mode = (dmodel == PR_MODEL_ILP32) ? SIZE32 : SIZE64;
524
525 #ifdef notyet
526 // XXX: does not compile!
527 if (dtrace_disx86(&x86dis, cpu_mode) != 0)
528 return (-1);
529 #else
530 __USE(cpu_mode);
531 #endif
532
533 /*
534 * If the instruction was a single-byte breakpoint, there may be
535 * another debugger attached to this process. The original instruction
536 * can't be recovered so this must fail.
537 */
538 if (x86dis.d86_len == 1 &&
539 (uchar_t)x86dis.d86_bytes[0] == FASTTRAP_INSTR)
540 return (-1);
541
542 return (x86dis.d86_len);
543 }
544