1 /* 2 * CDDL HEADER START 3 * 4 * The contents of this file are subject to the terms of the 5 * Common Development and Distribution License (the "License"). 6 * You may not use this file except in compliance with the License. 7 * 8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 9 * or http://www.opensolaris.org/os/licensing. 10 * See the License for the specific language governing permissions 11 * and limitations under the License. 12 * 13 * When distributing Covered Code, include this CDDL HEADER in each 14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 15 * If applicable, add the following below this CDDL HEADER, with the 16 * fields enclosed by brackets "[]" replaced with your own identifying 17 * information: Portions Copyright [yyyy] [name of copyright owner] 18 * 19 * CDDL HEADER END 20 */ 21 22 /* 23 * Copyright 2009 Sun Microsystems, Inc. All rights reserved. 24 * Use is subject to license terms. 25 */ 26 27 /* 28 * Copyright (c) 2012 by Delphix. All rights reserved. 29 */ 30 31 #include <stdlib.h> 32 #include <assert.h> 33 #include <errno.h> 34 #include <string.h> 35 #include <libgen.h> 36 37 #include <dt_impl.h> 38 #include <dt_pid.h> 39 40 #include <dis_tables.h> 41 42 #ifdef __FreeBSD__ 43 #include <libproc.h> 44 #include <libproc_compat.h> 45 #endif 46 47 #define DT_POPL_EBP 0x5d 48 #define DT_RET 0xc3 49 #define DT_RET16 0xc2 50 #define DT_LEAVE 0xc9 51 #define DT_JMP32 0xe9 52 #define DT_JMP8 0xeb 53 #define DT_REP 0xf3 54 55 #define DT_MOVL_EBP_ESP 0xe58b 56 57 #define DT_ISJ32(op16) (((op16) & 0xfff0) == 0x0f80) 58 #define DT_ISJ8(op8) (((op8) & 0xf0) == 0x70) 59 60 #define DT_MODRM_REG(modrm) (((modrm) >> 3) & 0x7) 61 62 static int dt_instr_size(uchar_t *, dtrace_hdl_t *, pid_t, uintptr_t, char); 63 64 /*ARGSUSED*/ 65 int 66 dt_pid_create_entry_probe(struct ps_prochandle *P, dtrace_hdl_t *dtp, 67 fasttrap_probe_spec_t *ftp, const GElf_Sym *symp) 68 { 69 ftp->ftps_type = DTFTP_ENTRY; 70 ftp->ftps_pc = (uintptr_t)symp->st_value; 71 ftp->ftps_size = (size_t)symp->st_size; 72 ftp->ftps_noffs = 1; 73 ftp->ftps_offs[0] = 0; 74 75 if (ioctl(dtp->dt_ftfd, FASTTRAPIOC_MAKEPROBE, ftp) != 0) { 76 dt_dprintf("fasttrap probe creation ioctl failed: %s\n", 77 strerror(errno)); 78 return (dt_set_errno(dtp, errno)); 79 } 80 81 return (1); 82 } 83 84 static int 85 dt_pid_has_jump_table(struct ps_prochandle *P, dtrace_hdl_t *dtp, 86 uint8_t *text, fasttrap_probe_spec_t *ftp, const GElf_Sym *symp) 87 { 88 ulong_t i; 89 int size; 90 #ifdef illumos 91 pid_t pid = Pstatus(P)->pr_pid; 92 char dmodel = Pstatus(P)->pr_dmodel; 93 #else 94 pid_t pid = proc_getpid(P); 95 char dmodel = proc_getmodel(P); 96 #endif 97 98 /* 99 * Take a pass through the function looking for a register-dependant 100 * jmp instruction. This could be a jump table so we have to be 101 * ultra conservative. 102 */ 103 for (i = 0; i < ftp->ftps_size; i += size) { 104 size = dt_instr_size(&text[i], dtp, pid, symp->st_value + i, 105 dmodel); 106 107 /* 108 * Assume the worst if we hit an illegal instruction. 109 */ 110 if (size <= 0) { 111 dt_dprintf("error at %#lx (assuming jump table)\n", i); 112 return (1); 113 } 114 115 #ifdef notyet 116 /* 117 * Register-dependant jmp instructions start with a 0xff byte 118 * and have the modrm.reg field set to 4. They can have an 119 * optional REX prefix on the 64-bit ISA. 120 */ 121 if ((text[i] == 0xff && DT_MODRM_REG(text[i + 1]) == 4) || 122 (dmodel == PR_MODEL_LP64 && (text[i] & 0xf0) == 0x40 && 123 text[i + 1] == 0xff && DT_MODRM_REG(text[i + 2]) == 4)) { 124 dt_dprintf("found a suspected jump table at %s:%lx\n", 125 ftp->ftps_func, i); 126 return (1); 127 } 128 #endif 129 } 130 131 return (0); 132 } 133 134 /*ARGSUSED*/ 135 int 136 dt_pid_create_return_probe(struct ps_prochandle *P, dtrace_hdl_t *dtp, 137 fasttrap_probe_spec_t *ftp, const GElf_Sym *symp, uint64_t *stret) 138 { 139 uint8_t *text; 140 ulong_t i, end; 141 int size; 142 #ifdef illumos 143 pid_t pid = Pstatus(P)->pr_pid; 144 char dmodel = Pstatus(P)->pr_dmodel; 145 #else 146 pid_t pid = proc_getpid(P); 147 char dmodel = proc_getmodel(P); 148 #endif 149 150 /* 151 * We allocate a few extra bytes at the end so we don't have to check 152 * for overrunning the buffer. 153 */ 154 if ((text = calloc(1, symp->st_size + 4)) == NULL) { 155 dt_dprintf("mr sparkle: malloc() failed\n"); 156 return (DT_PROC_ERR); 157 } 158 159 if (Pread(P, text, symp->st_size, symp->st_value) != symp->st_size) { 160 dt_dprintf("mr sparkle: Pread() failed\n"); 161 free(text); 162 return (DT_PROC_ERR); 163 } 164 165 ftp->ftps_type = DTFTP_RETURN; 166 ftp->ftps_pc = (uintptr_t)symp->st_value; 167 ftp->ftps_size = (size_t)symp->st_size; 168 ftp->ftps_noffs = 0; 169 170 /* 171 * If there's a jump table in the function we're only willing to 172 * instrument these specific (and equivalent) instruction sequences: 173 * leave 174 * [rep] ret 175 * and 176 * movl %ebp,%esp 177 * popl %ebp 178 * [rep] ret 179 * 180 * We do this to avoid accidentally interpreting jump table 181 * offsets as actual instructions. 182 */ 183 if (dt_pid_has_jump_table(P, dtp, text, ftp, symp)) { 184 for (i = 0, end = ftp->ftps_size; i < end; i += size) { 185 size = dt_instr_size(&text[i], dtp, pid, 186 symp->st_value + i, dmodel); 187 188 /* bail if we hit an invalid opcode */ 189 if (size <= 0) 190 break; 191 192 if (text[i] == DT_LEAVE && text[i + 1] == DT_RET) { 193 dt_dprintf("leave/ret at %lx\n", i + 1); 194 ftp->ftps_offs[ftp->ftps_noffs++] = i + 1; 195 size = 2; 196 } else if (text[i] == DT_LEAVE && 197 text[i + 1] == DT_REP && text[i + 2] == DT_RET) { 198 dt_dprintf("leave/rep ret at %lx\n", i + 1); 199 ftp->ftps_offs[ftp->ftps_noffs++] = i + 1; 200 size = 3; 201 } else if (*(uint16_t *)&text[i] == DT_MOVL_EBP_ESP && 202 text[i + 2] == DT_POPL_EBP && 203 text[i + 3] == DT_RET) { 204 dt_dprintf("movl/popl/ret at %lx\n", i + 3); 205 ftp->ftps_offs[ftp->ftps_noffs++] = i + 3; 206 size = 4; 207 } else if (*(uint16_t *)&text[i] == DT_MOVL_EBP_ESP && 208 text[i + 2] == DT_POPL_EBP && 209 text[i + 3] == DT_REP && 210 text[i + 4] == DT_RET) { 211 dt_dprintf("movl/popl/rep ret at %lx\n", i + 3); 212 ftp->ftps_offs[ftp->ftps_noffs++] = i + 3; 213 size = 5; 214 } 215 } 216 } else { 217 for (i = 0, end = ftp->ftps_size; i < end; i += size) { 218 size = dt_instr_size(&text[i], dtp, pid, 219 symp->st_value + i, dmodel); 220 221 /* bail if we hit an invalid opcode */ 222 if (size <= 0) 223 break; 224 225 /* ordinary ret */ 226 if (size == 1 && text[i] == DT_RET) 227 goto is_ret; 228 229 /* two-byte ret */ 230 if (size == 2 && text[i] == DT_REP && 231 text[i + 1] == DT_RET) 232 goto is_ret; 233 234 /* ret <imm16> */ 235 if (size == 3 && text[i] == DT_RET16) 236 goto is_ret; 237 238 /* two-byte ret <imm16> */ 239 if (size == 4 && text[i] == DT_REP && 240 text[i + 1] == DT_RET16) 241 goto is_ret; 242 243 /* 32-bit displacement jmp outside of the function */ 244 if (size == 5 && text[i] == DT_JMP32 && symp->st_size <= 245 (uintptr_t)(i + size + *(int32_t *)&text[i + 1])) 246 goto is_ret; 247 248 /* 8-bit displacement jmp outside of the function */ 249 if (size == 2 && text[i] == DT_JMP8 && symp->st_size <= 250 (uintptr_t)(i + size + *(int8_t *)&text[i + 1])) 251 goto is_ret; 252 253 /* 32-bit disp. conditional jmp outside of the func. */ 254 if (size == 6 && DT_ISJ32(*(uint16_t *)&text[i]) && 255 symp->st_size <= 256 (uintptr_t)(i + size + *(int32_t *)&text[i + 2])) 257 goto is_ret; 258 259 /* 8-bit disp. conditional jmp outside of the func. */ 260 if (size == 2 && DT_ISJ8(text[i]) && symp->st_size <= 261 (uintptr_t)(i + size + *(int8_t *)&text[i + 1])) 262 goto is_ret; 263 264 continue; 265 is_ret: 266 dt_dprintf("return at offset %lx\n", i); 267 ftp->ftps_offs[ftp->ftps_noffs++] = i; 268 } 269 } 270 271 free(text); 272 if (ftp->ftps_noffs > 0) { 273 if (ioctl(dtp->dt_ftfd, FASTTRAPIOC_MAKEPROBE, ftp) != 0) { 274 dt_dprintf("fasttrap probe creation ioctl failed: %s\n", 275 strerror(errno)); 276 return (dt_set_errno(dtp, errno)); 277 } 278 } 279 280 return (ftp->ftps_noffs); 281 } 282 283 /*ARGSUSED*/ 284 int 285 dt_pid_create_offset_probe(struct ps_prochandle *P, dtrace_hdl_t *dtp, 286 fasttrap_probe_spec_t *ftp, const GElf_Sym *symp, ulong_t off) 287 { 288 ftp->ftps_type = DTFTP_OFFSETS; 289 ftp->ftps_pc = (uintptr_t)symp->st_value; 290 ftp->ftps_size = (size_t)symp->st_size; 291 ftp->ftps_noffs = 1; 292 293 if (strcmp("-", ftp->ftps_func) == 0) { 294 ftp->ftps_offs[0] = off; 295 } else { 296 uint8_t *text; 297 ulong_t i; 298 int size; 299 #ifdef illumos 300 pid_t pid = Pstatus(P)->pr_pid; 301 char dmodel = Pstatus(P)->pr_dmodel; 302 #else 303 pid_t pid = proc_getpid(P); 304 char dmodel = proc_getmodel(P); 305 #endif 306 307 if ((text = malloc(symp->st_size)) == NULL) { 308 dt_dprintf("mr sparkle: malloc() failed\n"); 309 return (DT_PROC_ERR); 310 } 311 312 if (Pread(P, text, symp->st_size, symp->st_value) != 313 symp->st_size) { 314 dt_dprintf("mr sparkle: Pread() failed\n"); 315 free(text); 316 return (DT_PROC_ERR); 317 } 318 319 /* 320 * We can't instrument offsets in functions with jump tables 321 * as we might interpret a jump table offset as an 322 * instruction. 323 */ 324 if (dt_pid_has_jump_table(P, dtp, text, ftp, symp)) { 325 free(text); 326 return (0); 327 } 328 329 for (i = 0; i < symp->st_size; i += size) { 330 if (i == off) { 331 ftp->ftps_offs[0] = i; 332 break; 333 } 334 335 /* 336 * If we've passed the desired offset without a 337 * match, then the given offset must not lie on a 338 * instruction boundary. 339 */ 340 if (i > off) { 341 free(text); 342 return (DT_PROC_ALIGN); 343 } 344 345 size = dt_instr_size(&text[i], dtp, pid, 346 symp->st_value + i, dmodel); 347 348 /* 349 * If we hit an invalid instruction, bail as if we 350 * couldn't find the offset. 351 */ 352 if (size <= 0) { 353 free(text); 354 return (DT_PROC_ALIGN); 355 } 356 } 357 358 free(text); 359 } 360 361 if (ioctl(dtp->dt_ftfd, FASTTRAPIOC_MAKEPROBE, ftp) != 0) { 362 dt_dprintf("fasttrap probe creation ioctl failed: %s\n", 363 strerror(errno)); 364 return (dt_set_errno(dtp, errno)); 365 } 366 367 return (ftp->ftps_noffs); 368 } 369 370 /*ARGSUSED*/ 371 int 372 dt_pid_create_glob_offset_probes(struct ps_prochandle *P, dtrace_hdl_t *dtp, 373 fasttrap_probe_spec_t *ftp, const GElf_Sym *symp, const char *pattern) 374 { 375 uint8_t *text; 376 int size; 377 ulong_t i, end = symp->st_size; 378 #ifdef illumos 379 pid_t pid = Pstatus(P)->pr_pid; 380 char dmodel = Pstatus(P)->pr_dmodel; 381 #else 382 pid_t pid = proc_getpid(P); 383 char dmodel = proc_getmodel(P); 384 #endif 385 386 ftp->ftps_type = DTFTP_OFFSETS; 387 ftp->ftps_pc = (uintptr_t)symp->st_value; 388 ftp->ftps_size = (size_t)symp->st_size; 389 ftp->ftps_noffs = 0; 390 391 if ((text = malloc(symp->st_size)) == NULL) { 392 dt_dprintf("mr sparkle: malloc() failed\n"); 393 return (DT_PROC_ERR); 394 } 395 396 if (Pread(P, text, symp->st_size, symp->st_value) != symp->st_size) { 397 dt_dprintf("mr sparkle: Pread() failed\n"); 398 free(text); 399 return (DT_PROC_ERR); 400 } 401 402 /* 403 * We can't instrument offsets in functions with jump tables as 404 * we might interpret a jump table offset as an instruction. 405 */ 406 if (dt_pid_has_jump_table(P, dtp, text, ftp, symp)) { 407 free(text); 408 return (0); 409 } 410 411 if (strcmp("*", pattern) == 0) { 412 for (i = 0; i < end; i += size) { 413 ftp->ftps_offs[ftp->ftps_noffs++] = i; 414 415 size = dt_instr_size(&text[i], dtp, pid, 416 symp->st_value + i, dmodel); 417 418 /* bail if we hit an invalid opcode */ 419 if (size <= 0) 420 break; 421 } 422 } else { 423 char name[sizeof (i) * 2 + 1]; 424 425 for (i = 0; i < end; i += size) { 426 (void) snprintf(name, sizeof (name), "%lx", i); 427 if (gmatch(name, pattern)) 428 ftp->ftps_offs[ftp->ftps_noffs++] = i; 429 430 size = dt_instr_size(&text[i], dtp, pid, 431 symp->st_value + i, dmodel); 432 433 /* bail if we hit an invalid opcode */ 434 if (size <= 0) 435 break; 436 } 437 } 438 439 free(text); 440 if (ftp->ftps_noffs > 0) { 441 if (ioctl(dtp->dt_ftfd, FASTTRAPIOC_MAKEPROBE, ftp) != 0) { 442 dt_dprintf("fasttrap probe creation ioctl failed: %s\n", 443 strerror(errno)); 444 return (dt_set_errno(dtp, errno)); 445 } 446 } 447 448 return (ftp->ftps_noffs); 449 } 450 451 typedef struct dtrace_dis { 452 uchar_t *instr; 453 dtrace_hdl_t *dtp; 454 pid_t pid; 455 uintptr_t addr; 456 } dtrace_dis_t; 457 458 static int 459 dt_getbyte(void *data) 460 { 461 dtrace_dis_t *dis = data; 462 int ret = *dis->instr; 463 464 if (ret == FASTTRAP_INSTR) { 465 fasttrap_instr_query_t instr; 466 467 instr.ftiq_pid = dis->pid; 468 instr.ftiq_pc = dis->addr; 469 470 /* 471 * If we hit a byte that looks like the fasttrap provider's 472 * trap instruction (which doubles as the breakpoint 473 * instruction for debuggers) we need to query the kernel 474 * for the real value. This may just be part of an immediate 475 * value so there's no need to return an error if the 476 * kernel doesn't know about this address. 477 */ 478 if (ioctl(dis->dtp->dt_ftfd, FASTTRAPIOC_GETINSTR, &instr) == 0) 479 ret = instr.ftiq_instr; 480 } 481 482 dis->addr++; 483 dis->instr++; 484 485 return (ret); 486 } 487 488 static int 489 dt_instr_size(uchar_t *instr, dtrace_hdl_t *dtp, pid_t pid, uintptr_t addr, 490 char dmodel) 491 { 492 dtrace_dis_t data; 493 dis86_t x86dis; 494 uint_t cpu_mode; 495 496 data.instr = instr; 497 data.dtp = dtp; 498 data.pid = pid; 499 data.addr = addr; 500 501 x86dis.d86_data = &data; 502 x86dis.d86_get_byte = dt_getbyte; 503 x86dis.d86_check_func = NULL; 504 505 cpu_mode = (dmodel == PR_MODEL_ILP32) ? SIZE32 : SIZE64; 506 507 if (dtrace_disx86(&x86dis, cpu_mode) != 0) 508 return (-1); 509 510 /* 511 * If the instruction was a single-byte breakpoint, there may be 512 * another debugger attached to this process. The original instruction 513 * can't be recovered so this must fail. 514 */ 515 if (x86dis.d86_len == 1 && 516 (uchar_t)x86dis.d86_bytes[0] == FASTTRAP_INSTR) 517 return (-1); 518 519 return (x86dis.d86_len); 520 } 521