1 /*
2 * CDDL HEADER START
3 *
4 * The contents of this file are subject to the terms of the
5 * Common Development and Distribution License (the "License").
6 * You may not use this file except in compliance with the License.
7 *
8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9 * or http://www.opensolaris.org/os/licensing.
10 * See the License for the specific language governing permissions
11 * and limitations under the License.
12 *
13 * When distributing Covered Code, include this CDDL HEADER in each
14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15 * If applicable, add the following below this CDDL HEADER, with the
16 * fields enclosed by brackets "[]" replaced with your own identifying
17 * information: Portions Copyright [yyyy] [name of copyright owner]
18 *
19 * CDDL HEADER END
20 */
21
22 /*
23 * Copyright 2009 Sun Microsystems, Inc. All rights reserved.
24 * Use is subject to license terms.
25 */
26
27 /*
28 * Copyright (c) 2012 by Delphix. All rights reserved.
29 */
30
31 #include <stdlib.h>
32 #include <assert.h>
33 #include <errno.h>
34 #include <string.h>
35 #include <libgen.h>
36
37 #include <dt_impl.h>
38 #include <dt_pid.h>
39
40 #include <dis_tables.h>
41
42 #ifdef __FreeBSD__
43 #include <libproc.h>
44 #include <libproc_compat.h>
45 #endif
46
47 #define DT_POPL_EBP 0x5d
48 #define DT_RET 0xc3
49 #define DT_RET16 0xc2
50 #define DT_LEAVE 0xc9
51 #define DT_JMP32 0xe9
52 #define DT_JMP8 0xeb
53 #define DT_REP 0xf3
54
55 #define DT_MOVL_EBP_ESP 0xe58b
56
57 #define DT_ISJ32(op16) (((op16) & 0xfff0) == 0x0f80)
58 #define DT_ISJ8(op8) (((op8) & 0xf0) == 0x70)
59
60 #define DT_MODRM_REG(modrm) (((modrm) >> 3) & 0x7)
61
62 static int dt_instr_size(uchar_t *, dtrace_hdl_t *, pid_t, uintptr_t, char);
63
64 /*ARGSUSED*/
65 int
dt_pid_create_entry_probe(struct ps_prochandle * P,dtrace_hdl_t * dtp,fasttrap_probe_spec_t * ftp,const GElf_Sym * symp)66 dt_pid_create_entry_probe(struct ps_prochandle *P, dtrace_hdl_t *dtp,
67 fasttrap_probe_spec_t *ftp, const GElf_Sym *symp)
68 {
69 ftp->ftps_type = DTFTP_ENTRY;
70 ftp->ftps_pc = (uintptr_t)symp->st_value;
71 ftp->ftps_size = (size_t)symp->st_size;
72 ftp->ftps_noffs = 1;
73 ftp->ftps_offs[0] = 0;
74
75 if (ioctl(dtp->dt_ftfd, FASTTRAPIOC_MAKEPROBE, ftp) != 0) {
76 dt_dprintf("fasttrap probe creation ioctl failed: %s\n",
77 strerror(errno));
78 return (dt_set_errno(dtp, errno));
79 }
80
81 return (1);
82 }
83
84 static int
dt_pid_has_jump_table(struct ps_prochandle * P,dtrace_hdl_t * dtp,uint8_t * text,fasttrap_probe_spec_t * ftp,const GElf_Sym * symp)85 dt_pid_has_jump_table(struct ps_prochandle *P, dtrace_hdl_t *dtp,
86 uint8_t *text, fasttrap_probe_spec_t *ftp, const GElf_Sym *symp)
87 {
88 ulong_t i;
89 int size;
90 #ifdef illumos
91 pid_t pid = Pstatus(P)->pr_pid;
92 char dmodel = Pstatus(P)->pr_dmodel;
93 #else
94 pid_t pid = proc_getpid(P);
95 char dmodel = proc_getmodel(P);
96 #endif
97
98 /*
99 * Take a pass through the function looking for a register-dependant
100 * jmp instruction. This could be a jump table so we have to be
101 * ultra conservative.
102 */
103 for (i = 0; i < ftp->ftps_size; i += size) {
104 size = dt_instr_size(&text[i], dtp, pid, symp->st_value + i,
105 dmodel);
106
107 /*
108 * Assume the worst if we hit an illegal instruction.
109 */
110 if (size <= 0) {
111 dt_dprintf("error at %#lx (assuming jump table)\n", i);
112 return (1);
113 }
114
115 #ifdef notyet
116 /*
117 * Register-dependant jmp instructions start with a 0xff byte
118 * and have the modrm.reg field set to 4. They can have an
119 * optional REX prefix on the 64-bit ISA.
120 */
121 if ((text[i] == 0xff && DT_MODRM_REG(text[i + 1]) == 4) ||
122 (dmodel == PR_MODEL_LP64 && (text[i] & 0xf0) == 0x40 &&
123 text[i + 1] == 0xff && DT_MODRM_REG(text[i + 2]) == 4)) {
124 dt_dprintf("found a suspected jump table at %s:%lx\n",
125 ftp->ftps_func, i);
126 return (1);
127 }
128 #endif
129 }
130
131 return (0);
132 }
133
134 /*ARGSUSED*/
135 int
dt_pid_create_return_probe(struct ps_prochandle * P,dtrace_hdl_t * dtp,fasttrap_probe_spec_t * ftp,const GElf_Sym * symp,uint64_t * stret)136 dt_pid_create_return_probe(struct ps_prochandle *P, dtrace_hdl_t *dtp,
137 fasttrap_probe_spec_t *ftp, const GElf_Sym *symp, uint64_t *stret)
138 {
139 uint8_t *text;
140 ulong_t i, end;
141 int size;
142 #ifdef illumos
143 pid_t pid = Pstatus(P)->pr_pid;
144 char dmodel = Pstatus(P)->pr_dmodel;
145 #else
146 pid_t pid = proc_getpid(P);
147 char dmodel = proc_getmodel(P);
148 #endif
149
150 /*
151 * We allocate a few extra bytes at the end so we don't have to check
152 * for overrunning the buffer.
153 */
154 if ((text = calloc(1, symp->st_size + 4)) == NULL) {
155 dt_dprintf("mr sparkle: malloc() failed\n");
156 return (DT_PROC_ERR);
157 }
158
159 if (Pread(P, text, symp->st_size, symp->st_value) != symp->st_size) {
160 dt_dprintf("mr sparkle: Pread() failed\n");
161 free(text);
162 return (DT_PROC_ERR);
163 }
164
165 ftp->ftps_type = DTFTP_RETURN;
166 ftp->ftps_pc = (uintptr_t)symp->st_value;
167 ftp->ftps_size = (size_t)symp->st_size;
168 ftp->ftps_noffs = 0;
169
170 /*
171 * If there's a jump table in the function we're only willing to
172 * instrument these specific (and equivalent) instruction sequences:
173 * leave
174 * [rep] ret
175 * and
176 * movl %ebp,%esp
177 * popl %ebp
178 * [rep] ret
179 *
180 * We do this to avoid accidentally interpreting jump table
181 * offsets as actual instructions.
182 */
183 if (dt_pid_has_jump_table(P, dtp, text, ftp, symp)) {
184 for (i = 0, end = ftp->ftps_size; i < end; i += size) {
185 size = dt_instr_size(&text[i], dtp, pid,
186 symp->st_value + i, dmodel);
187
188 /* bail if we hit an invalid opcode */
189 if (size <= 0)
190 break;
191
192 if (text[i] == DT_LEAVE && text[i + 1] == DT_RET) {
193 dt_dprintf("leave/ret at %lx\n", i + 1);
194 ftp->ftps_offs[ftp->ftps_noffs++] = i + 1;
195 size = 2;
196 } else if (text[i] == DT_LEAVE &&
197 text[i + 1] == DT_REP && text[i + 2] == DT_RET) {
198 dt_dprintf("leave/rep ret at %lx\n", i + 1);
199 ftp->ftps_offs[ftp->ftps_noffs++] = i + 1;
200 size = 3;
201 } else if (*(uint16_t *)&text[i] == DT_MOVL_EBP_ESP &&
202 text[i + 2] == DT_POPL_EBP &&
203 text[i + 3] == DT_RET) {
204 dt_dprintf("movl/popl/ret at %lx\n", i + 3);
205 ftp->ftps_offs[ftp->ftps_noffs++] = i + 3;
206 size = 4;
207 } else if (*(uint16_t *)&text[i] == DT_MOVL_EBP_ESP &&
208 text[i + 2] == DT_POPL_EBP &&
209 text[i + 3] == DT_REP &&
210 text[i + 4] == DT_RET) {
211 dt_dprintf("movl/popl/rep ret at %lx\n", i + 3);
212 ftp->ftps_offs[ftp->ftps_noffs++] = i + 3;
213 size = 5;
214 }
215 }
216 } else {
217 for (i = 0, end = ftp->ftps_size; i < end; i += size) {
218 size = dt_instr_size(&text[i], dtp, pid,
219 symp->st_value + i, dmodel);
220
221 /* bail if we hit an invalid opcode */
222 if (size <= 0)
223 break;
224
225 /* ordinary ret */
226 if (size == 1 && text[i] == DT_RET)
227 goto is_ret;
228
229 /* two-byte ret */
230 if (size == 2 && text[i] == DT_REP &&
231 text[i + 1] == DT_RET)
232 goto is_ret;
233
234 /* ret <imm16> */
235 if (size == 3 && text[i] == DT_RET16)
236 goto is_ret;
237
238 /* two-byte ret <imm16> */
239 if (size == 4 && text[i] == DT_REP &&
240 text[i + 1] == DT_RET16)
241 goto is_ret;
242
243 /* 32-bit displacement jmp outside of the function */
244 if (size == 5 && text[i] == DT_JMP32 && symp->st_size <=
245 (uintptr_t)(i + size + *(int32_t *)&text[i + 1]))
246 goto is_ret;
247
248 /* 8-bit displacement jmp outside of the function */
249 if (size == 2 && text[i] == DT_JMP8 && symp->st_size <=
250 (uintptr_t)(i + size + *(int8_t *)&text[i + 1]))
251 goto is_ret;
252
253 /* 32-bit disp. conditional jmp outside of the func. */
254 if (size == 6 && DT_ISJ32(*(uint16_t *)&text[i]) &&
255 symp->st_size <=
256 (uintptr_t)(i + size + *(int32_t *)&text[i + 2]))
257 goto is_ret;
258
259 /* 8-bit disp. conditional jmp outside of the func. */
260 if (size == 2 && DT_ISJ8(text[i]) && symp->st_size <=
261 (uintptr_t)(i + size + *(int8_t *)&text[i + 1]))
262 goto is_ret;
263
264 continue;
265 is_ret:
266 dt_dprintf("return at offset %lx\n", i);
267 ftp->ftps_offs[ftp->ftps_noffs++] = i;
268 }
269 }
270
271 free(text);
272 if (ftp->ftps_noffs > 0) {
273 if (ioctl(dtp->dt_ftfd, FASTTRAPIOC_MAKEPROBE, ftp) != 0) {
274 dt_dprintf("fasttrap probe creation ioctl failed: %s\n",
275 strerror(errno));
276 return (dt_set_errno(dtp, errno));
277 }
278 }
279
280 return (ftp->ftps_noffs);
281 }
282
283 /*ARGSUSED*/
284 int
dt_pid_create_offset_probe(struct ps_prochandle * P,dtrace_hdl_t * dtp,fasttrap_probe_spec_t * ftp,const GElf_Sym * symp,ulong_t off)285 dt_pid_create_offset_probe(struct ps_prochandle *P, dtrace_hdl_t *dtp,
286 fasttrap_probe_spec_t *ftp, const GElf_Sym *symp, ulong_t off)
287 {
288 ftp->ftps_type = DTFTP_OFFSETS;
289 ftp->ftps_pc = (uintptr_t)symp->st_value;
290 ftp->ftps_size = (size_t)symp->st_size;
291 ftp->ftps_noffs = 1;
292
293 if (strcmp("-", ftp->ftps_func) == 0) {
294 ftp->ftps_offs[0] = off;
295 } else {
296 uint8_t *text;
297 ulong_t i;
298 int size;
299 #ifdef illumos
300 pid_t pid = Pstatus(P)->pr_pid;
301 char dmodel = Pstatus(P)->pr_dmodel;
302 #else
303 pid_t pid = proc_getpid(P);
304 char dmodel = proc_getmodel(P);
305 #endif
306
307 if ((text = malloc(symp->st_size)) == NULL) {
308 dt_dprintf("mr sparkle: malloc() failed\n");
309 return (DT_PROC_ERR);
310 }
311
312 if (Pread(P, text, symp->st_size, symp->st_value) !=
313 symp->st_size) {
314 dt_dprintf("mr sparkle: Pread() failed\n");
315 free(text);
316 return (DT_PROC_ERR);
317 }
318
319 /*
320 * We can't instrument offsets in functions with jump tables
321 * as we might interpret a jump table offset as an
322 * instruction.
323 */
324 if (dt_pid_has_jump_table(P, dtp, text, ftp, symp)) {
325 free(text);
326 return (0);
327 }
328
329 for (i = 0; i < symp->st_size; i += size) {
330 if (i == off) {
331 ftp->ftps_offs[0] = i;
332 break;
333 }
334
335 /*
336 * If we've passed the desired offset without a
337 * match, then the given offset must not lie on a
338 * instruction boundary.
339 */
340 if (i > off) {
341 free(text);
342 return (DT_PROC_ALIGN);
343 }
344
345 size = dt_instr_size(&text[i], dtp, pid,
346 symp->st_value + i, dmodel);
347
348 /*
349 * If we hit an invalid instruction, bail as if we
350 * couldn't find the offset.
351 */
352 if (size <= 0) {
353 free(text);
354 return (DT_PROC_ALIGN);
355 }
356 }
357
358 free(text);
359 }
360
361 if (ioctl(dtp->dt_ftfd, FASTTRAPIOC_MAKEPROBE, ftp) != 0) {
362 dt_dprintf("fasttrap probe creation ioctl failed: %s\n",
363 strerror(errno));
364 return (dt_set_errno(dtp, errno));
365 }
366
367 return (ftp->ftps_noffs);
368 }
369
370 /*ARGSUSED*/
371 int
dt_pid_create_glob_offset_probes(struct ps_prochandle * P,dtrace_hdl_t * dtp,fasttrap_probe_spec_t * ftp,const GElf_Sym * symp,const char * pattern)372 dt_pid_create_glob_offset_probes(struct ps_prochandle *P, dtrace_hdl_t *dtp,
373 fasttrap_probe_spec_t *ftp, const GElf_Sym *symp, const char *pattern)
374 {
375 uint8_t *text;
376 int size;
377 ulong_t i, end = symp->st_size;
378 #ifdef illumos
379 pid_t pid = Pstatus(P)->pr_pid;
380 char dmodel = Pstatus(P)->pr_dmodel;
381 #else
382 pid_t pid = proc_getpid(P);
383 char dmodel = proc_getmodel(P);
384 #endif
385
386 ftp->ftps_type = DTFTP_OFFSETS;
387 ftp->ftps_pc = (uintptr_t)symp->st_value;
388 ftp->ftps_size = (size_t)symp->st_size;
389 ftp->ftps_noffs = 0;
390
391 if ((text = malloc(symp->st_size)) == NULL) {
392 dt_dprintf("mr sparkle: malloc() failed\n");
393 return (DT_PROC_ERR);
394 }
395
396 if (Pread(P, text, symp->st_size, symp->st_value) != symp->st_size) {
397 dt_dprintf("mr sparkle: Pread() failed\n");
398 free(text);
399 return (DT_PROC_ERR);
400 }
401
402 /*
403 * We can't instrument offsets in functions with jump tables as
404 * we might interpret a jump table offset as an instruction.
405 */
406 if (dt_pid_has_jump_table(P, dtp, text, ftp, symp)) {
407 free(text);
408 return (0);
409 }
410
411 if (strcmp("*", pattern) == 0) {
412 for (i = 0; i < end; i += size) {
413 ftp->ftps_offs[ftp->ftps_noffs++] = i;
414
415 size = dt_instr_size(&text[i], dtp, pid,
416 symp->st_value + i, dmodel);
417
418 /* bail if we hit an invalid opcode */
419 if (size <= 0)
420 break;
421 }
422 } else {
423 char name[sizeof (i) * 2 + 1];
424
425 for (i = 0; i < end; i += size) {
426 (void) snprintf(name, sizeof (name), "%lx", i);
427 if (gmatch(name, pattern))
428 ftp->ftps_offs[ftp->ftps_noffs++] = i;
429
430 size = dt_instr_size(&text[i], dtp, pid,
431 symp->st_value + i, dmodel);
432
433 /* bail if we hit an invalid opcode */
434 if (size <= 0)
435 break;
436 }
437 }
438
439 free(text);
440 if (ftp->ftps_noffs > 0) {
441 if (ioctl(dtp->dt_ftfd, FASTTRAPIOC_MAKEPROBE, ftp) != 0) {
442 dt_dprintf("fasttrap probe creation ioctl failed: %s\n",
443 strerror(errno));
444 return (dt_set_errno(dtp, errno));
445 }
446 }
447
448 return (ftp->ftps_noffs);
449 }
450
451 typedef struct dtrace_dis {
452 uchar_t *instr;
453 dtrace_hdl_t *dtp;
454 pid_t pid;
455 uintptr_t addr;
456 } dtrace_dis_t;
457
458 static int
dt_getbyte(void * data)459 dt_getbyte(void *data)
460 {
461 dtrace_dis_t *dis = data;
462 int ret = *dis->instr;
463
464 if (ret == FASTTRAP_INSTR) {
465 fasttrap_instr_query_t instr;
466
467 instr.ftiq_pid = dis->pid;
468 instr.ftiq_pc = dis->addr;
469
470 /*
471 * If we hit a byte that looks like the fasttrap provider's
472 * trap instruction (which doubles as the breakpoint
473 * instruction for debuggers) we need to query the kernel
474 * for the real value. This may just be part of an immediate
475 * value so there's no need to return an error if the
476 * kernel doesn't know about this address.
477 */
478 if (ioctl(dis->dtp->dt_ftfd, FASTTRAPIOC_GETINSTR, &instr) == 0)
479 ret = instr.ftiq_instr;
480 }
481
482 dis->addr++;
483 dis->instr++;
484
485 return (ret);
486 }
487
488 static int
dt_instr_size(uchar_t * instr,dtrace_hdl_t * dtp,pid_t pid,uintptr_t addr,char dmodel)489 dt_instr_size(uchar_t *instr, dtrace_hdl_t *dtp, pid_t pid, uintptr_t addr,
490 char dmodel)
491 {
492 dtrace_dis_t data;
493 dis86_t x86dis;
494 uint_t cpu_mode;
495
496 data.instr = instr;
497 data.dtp = dtp;
498 data.pid = pid;
499 data.addr = addr;
500
501 x86dis.d86_data = &data;
502 x86dis.d86_get_byte = dt_getbyte;
503 x86dis.d86_check_func = NULL;
504
505 cpu_mode = (dmodel == PR_MODEL_ILP32) ? SIZE32 : SIZE64;
506
507 if (dtrace_disx86(&x86dis, cpu_mode) != 0)
508 return (-1);
509
510 /*
511 * If the instruction was a single-byte breakpoint, there may be
512 * another debugger attached to this process. The original instruction
513 * can't be recovered so this must fail.
514 */
515 if (x86dis.d86_len == 1 &&
516 (uchar_t)x86dis.d86_bytes[0] == FASTTRAP_INSTR)
517 return (-1);
518
519 return (x86dis.d86_len);
520 }
521