1 /*
2 * CDDL HEADER START
3 *
4 * The contents of this file are subject to the terms of the
5 * Common Development and Distribution License (the "License").
6 * You may not use this file except in compliance with the License.
7 *
8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9 * or http://www.opensolaris.org/os/licensing.
10 * See the License for the specific language governing permissions
11 * and limitations under the License.
12 *
13 * When distributing Covered Code, include this CDDL HEADER in each
14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15 * If applicable, add the following below this CDDL HEADER, with the
16 * fields enclosed by brackets "[]" replaced with your own identifying
17 * information: Portions Copyright [yyyy] [name of copyright owner]
18 *
19 * CDDL HEADER END
20 */
21
22 /*
23 * Copyright 2009 Sun Microsystems, Inc. All rights reserved.
24 * Use is subject to license terms.
25 */
26
27 /*
28 * Copyright (c) 2012 by Delphix. All rights reserved.
29 */
30
31 #include <stdlib.h>
32 #include <assert.h>
33 #include <errno.h>
34 #include <string.h>
35 #include <libgen.h>
36
37 #include <dt_impl.h>
38 #include <dt_pid.h>
39
40 #include <dis_tables.h>
41
42 #define DT_POPL_EBP 0x5d
43 #define DT_RET 0xc3
44 #define DT_RET16 0xc2
45 #define DT_LEAVE 0xc9
46 #define DT_JMP32 0xe9
47 #define DT_JMP8 0xeb
48 #define DT_REP 0xf3
49
50 #define DT_MOVL_EBP_ESP 0xe58b
51
52 #define DT_ISJ32(op16) (((op16) & 0xfff0) == 0x0f80)
53 #define DT_ISJ8(op8) (((op8) & 0xf0) == 0x70)
54
55 #define DT_MODRM_REG(modrm) (((modrm) >> 3) & 0x7)
56
57 static int dt_instr_size(uchar_t *, dtrace_hdl_t *, pid_t, uintptr_t, char);
58
59 /*ARGSUSED*/
60 int
dt_pid_create_entry_probe(struct ps_prochandle * P,dtrace_hdl_t * dtp,fasttrap_probe_spec_t * ftp,const GElf_Sym * symp)61 dt_pid_create_entry_probe(struct ps_prochandle *P, dtrace_hdl_t *dtp,
62 fasttrap_probe_spec_t *ftp, const GElf_Sym *symp)
63 {
64 ftp->ftps_type = DTFTP_ENTRY;
65 ftp->ftps_pc = (uintptr_t)symp->st_value;
66 ftp->ftps_size = (size_t)symp->st_size;
67 ftp->ftps_noffs = 1;
68 ftp->ftps_offs[0] = 0;
69
70 if (ioctl(dtp->dt_ftfd, FASTTRAPIOC_MAKEPROBE, ftp) != 0) {
71 dt_dprintf("fasttrap probe creation ioctl failed: %s\n",
72 strerror(errno));
73 return (dt_set_errno(dtp, errno));
74 }
75
76 return (1);
77 }
78
79 static int
dt_pid_has_jump_table(struct ps_prochandle * P,dtrace_hdl_t * dtp,uint8_t * text,fasttrap_probe_spec_t * ftp,const GElf_Sym * symp)80 dt_pid_has_jump_table(struct ps_prochandle *P, dtrace_hdl_t *dtp,
81 uint8_t *text, fasttrap_probe_spec_t *ftp, const GElf_Sym *symp)
82 {
83 ulong_t i;
84 int size;
85 pid_t pid = Pstatus(P)->pr_pid;
86 char dmodel = Pstatus(P)->pr_dmodel;
87
88 /*
89 * Take a pass through the function looking for a register-dependant
90 * jmp instruction. This could be a jump table so we have to be
91 * ultra conservative.
92 */
93 for (i = 0; i < ftp->ftps_size; i += size) {
94 size = dt_instr_size(&text[i], dtp, pid, symp->st_value + i,
95 dmodel);
96
97 /*
98 * Assume the worst if we hit an illegal instruction.
99 */
100 if (size <= 0) {
101 dt_dprintf("error at %#lx (assuming jump table)\n", i);
102 return (1);
103 }
104
105 /*
106 * Register-dependant jmp instructions start with a 0xff byte
107 * and have the modrm.reg field set to 4. They can have an
108 * optional REX prefix on the 64-bit ISA.
109 */
110 if ((text[i] == 0xff && DT_MODRM_REG(text[i + 1]) == 4) ||
111 (dmodel == PR_MODEL_LP64 && (text[i] & 0xf0) == 0x40 &&
112 text[i + 1] == 0xff && DT_MODRM_REG(text[i + 2]) == 4)) {
113 dt_dprintf("found a suspected jump table at %s:%lx\n",
114 ftp->ftps_func, i);
115 return (1);
116 }
117 }
118
119 return (0);
120 }
121
122 /*ARGSUSED*/
123 int
dt_pid_create_return_probe(struct ps_prochandle * P,dtrace_hdl_t * dtp,fasttrap_probe_spec_t * ftp,const GElf_Sym * symp,uint64_t * stret)124 dt_pid_create_return_probe(struct ps_prochandle *P, dtrace_hdl_t *dtp,
125 fasttrap_probe_spec_t *ftp, const GElf_Sym *symp, uint64_t *stret)
126 {
127 uint8_t *text;
128 ulong_t i, end;
129 int size;
130 pid_t pid = Pstatus(P)->pr_pid;
131 char dmodel = Pstatus(P)->pr_dmodel;
132
133 /*
134 * We allocate a few extra bytes at the end so we don't have to check
135 * for overrunning the buffer.
136 */
137 if ((text = calloc(1, symp->st_size + 4)) == NULL) {
138 dt_dprintf("mr sparkle: malloc() failed\n");
139 return (DT_PROC_ERR);
140 }
141
142 if (Pread(P, text, symp->st_size, symp->st_value) != symp->st_size) {
143 dt_dprintf("mr sparkle: Pread() failed\n");
144 free(text);
145 return (DT_PROC_ERR);
146 }
147
148 ftp->ftps_type = DTFTP_RETURN;
149 ftp->ftps_pc = (uintptr_t)symp->st_value;
150 ftp->ftps_size = (size_t)symp->st_size;
151 ftp->ftps_noffs = 0;
152
153 /*
154 * If there's a jump table in the function we're only willing to
155 * instrument these specific (and equivalent) instruction sequences:
156 * leave
157 * [rep] ret
158 * and
159 * movl %ebp,%esp
160 * popl %ebp
161 * [rep] ret
162 *
163 * We do this to avoid accidentally interpreting jump table
164 * offsets as actual instructions.
165 */
166 if (dt_pid_has_jump_table(P, dtp, text, ftp, symp)) {
167 for (i = 0, end = ftp->ftps_size; i < end; i += size) {
168 size = dt_instr_size(&text[i], dtp, pid,
169 symp->st_value + i, dmodel);
170
171 /* bail if we hit an invalid opcode */
172 if (size <= 0)
173 break;
174
175 if (text[i] == DT_LEAVE && text[i + 1] == DT_RET) {
176 dt_dprintf("leave/ret at %lx\n", i + 1);
177 ftp->ftps_offs[ftp->ftps_noffs++] = i + 1;
178 size = 2;
179 } else if (text[i] == DT_LEAVE &&
180 text[i + 1] == DT_REP && text[i + 2] == DT_RET) {
181 dt_dprintf("leave/rep ret at %lx\n", i + 1);
182 ftp->ftps_offs[ftp->ftps_noffs++] = i + 1;
183 size = 3;
184 } else if (*(uint16_t *)&text[i] == DT_MOVL_EBP_ESP &&
185 text[i + 2] == DT_POPL_EBP &&
186 text[i + 3] == DT_RET) {
187 dt_dprintf("movl/popl/ret at %lx\n", i + 3);
188 ftp->ftps_offs[ftp->ftps_noffs++] = i + 3;
189 size = 4;
190 } else if (*(uint16_t *)&text[i] == DT_MOVL_EBP_ESP &&
191 text[i + 2] == DT_POPL_EBP &&
192 text[i + 3] == DT_REP &&
193 text[i + 4] == DT_RET) {
194 dt_dprintf("movl/popl/rep ret at %lx\n", i + 3);
195 ftp->ftps_offs[ftp->ftps_noffs++] = i + 3;
196 size = 5;
197 }
198 }
199 } else {
200 for (i = 0, end = ftp->ftps_size; i < end; i += size) {
201 size = dt_instr_size(&text[i], dtp, pid,
202 symp->st_value + i, dmodel);
203
204 /* bail if we hit an invalid opcode */
205 if (size <= 0)
206 break;
207
208 /* ordinary ret */
209 if (size == 1 && text[i] == DT_RET)
210 goto is_ret;
211
212 /* two-byte ret */
213 if (size == 2 && text[i] == DT_REP &&
214 text[i + 1] == DT_RET)
215 goto is_ret;
216
217 /* ret <imm16> */
218 if (size == 3 && text[i] == DT_RET16)
219 goto is_ret;
220
221 /* two-byte ret <imm16> */
222 if (size == 4 && text[i] == DT_REP &&
223 text[i + 1] == DT_RET16)
224 goto is_ret;
225
226 /* 32-bit displacement jmp outside of the function */
227 if (size == 5 && text[i] == DT_JMP32 && symp->st_size <=
228 (uintptr_t)(i + size + *(int32_t *)&text[i + 1]))
229 goto is_ret;
230
231 /* 8-bit displacement jmp outside of the function */
232 if (size == 2 && text[i] == DT_JMP8 && symp->st_size <=
233 (uintptr_t)(i + size + *(int8_t *)&text[i + 1]))
234 goto is_ret;
235
236 /* 32-bit disp. conditional jmp outside of the func. */
237 if (size == 6 && DT_ISJ32(*(uint16_t *)&text[i]) &&
238 symp->st_size <=
239 (uintptr_t)(i + size + *(int32_t *)&text[i + 2]))
240 goto is_ret;
241
242 /* 8-bit disp. conditional jmp outside of the func. */
243 if (size == 2 && DT_ISJ8(text[i]) && symp->st_size <=
244 (uintptr_t)(i + size + *(int8_t *)&text[i + 1]))
245 goto is_ret;
246
247 continue;
248 is_ret:
249 dt_dprintf("return at offset %lx\n", i);
250 ftp->ftps_offs[ftp->ftps_noffs++] = i;
251 }
252 }
253
254 free(text);
255 if (ftp->ftps_noffs > 0) {
256 if (ioctl(dtp->dt_ftfd, FASTTRAPIOC_MAKEPROBE, ftp) != 0) {
257 dt_dprintf("fasttrap probe creation ioctl failed: %s\n",
258 strerror(errno));
259 return (dt_set_errno(dtp, errno));
260 }
261 }
262
263 return (ftp->ftps_noffs);
264 }
265
266 /*ARGSUSED*/
267 int
dt_pid_create_offset_probe(struct ps_prochandle * P,dtrace_hdl_t * dtp,fasttrap_probe_spec_t * ftp,const GElf_Sym * symp,ulong_t off)268 dt_pid_create_offset_probe(struct ps_prochandle *P, dtrace_hdl_t *dtp,
269 fasttrap_probe_spec_t *ftp, const GElf_Sym *symp, ulong_t off)
270 {
271 ftp->ftps_type = DTFTP_OFFSETS;
272 ftp->ftps_pc = (uintptr_t)symp->st_value;
273 ftp->ftps_size = (size_t)symp->st_size;
274 ftp->ftps_noffs = 1;
275
276 if (strcmp("-", ftp->ftps_func) == 0) {
277 ftp->ftps_offs[0] = off;
278 } else {
279 uint8_t *text;
280 ulong_t i;
281 int size;
282 pid_t pid = Pstatus(P)->pr_pid;
283 char dmodel = Pstatus(P)->pr_dmodel;
284
285 if ((text = malloc(symp->st_size)) == NULL) {
286 dt_dprintf("mr sparkle: malloc() failed\n");
287 return (DT_PROC_ERR);
288 }
289
290 if (Pread(P, text, symp->st_size, symp->st_value) !=
291 symp->st_size) {
292 dt_dprintf("mr sparkle: Pread() failed\n");
293 free(text);
294 return (DT_PROC_ERR);
295 }
296
297 /*
298 * We can't instrument offsets in functions with jump tables
299 * as we might interpret a jump table offset as an
300 * instruction.
301 */
302 if (dt_pid_has_jump_table(P, dtp, text, ftp, symp)) {
303 free(text);
304 return (0);
305 }
306
307 for (i = 0; i < symp->st_size; i += size) {
308 if (i == off) {
309 ftp->ftps_offs[0] = i;
310 break;
311 }
312
313 /*
314 * If we've passed the desired offset without a
315 * match, then the given offset must not lie on a
316 * instruction boundary.
317 */
318 if (i > off) {
319 free(text);
320 return (DT_PROC_ALIGN);
321 }
322
323 size = dt_instr_size(&text[i], dtp, pid,
324 symp->st_value + i, dmodel);
325
326 /*
327 * If we hit an invalid instruction, bail as if we
328 * couldn't find the offset.
329 */
330 if (size <= 0) {
331 free(text);
332 return (DT_PROC_ALIGN);
333 }
334 }
335
336 free(text);
337 }
338
339 if (ioctl(dtp->dt_ftfd, FASTTRAPIOC_MAKEPROBE, ftp) != 0) {
340 dt_dprintf("fasttrap probe creation ioctl failed: %s\n",
341 strerror(errno));
342 return (dt_set_errno(dtp, errno));
343 }
344
345 return (ftp->ftps_noffs);
346 }
347
348 /*ARGSUSED*/
349 int
dt_pid_create_glob_offset_probes(struct ps_prochandle * P,dtrace_hdl_t * dtp,fasttrap_probe_spec_t * ftp,const GElf_Sym * symp,const char * pattern)350 dt_pid_create_glob_offset_probes(struct ps_prochandle *P, dtrace_hdl_t *dtp,
351 fasttrap_probe_spec_t *ftp, const GElf_Sym *symp, const char *pattern)
352 {
353 uint8_t *text;
354 int size;
355 ulong_t i, end = symp->st_size;
356 pid_t pid = Pstatus(P)->pr_pid;
357 char dmodel = Pstatus(P)->pr_dmodel;
358
359 ftp->ftps_type = DTFTP_OFFSETS;
360 ftp->ftps_pc = (uintptr_t)symp->st_value;
361 ftp->ftps_size = (size_t)symp->st_size;
362 ftp->ftps_noffs = 0;
363
364 if ((text = malloc(symp->st_size)) == NULL) {
365 dt_dprintf("mr sparkle: malloc() failed\n");
366 return (DT_PROC_ERR);
367 }
368
369 if (Pread(P, text, symp->st_size, symp->st_value) != symp->st_size) {
370 dt_dprintf("mr sparkle: Pread() failed\n");
371 free(text);
372 return (DT_PROC_ERR);
373 }
374
375 /*
376 * We can't instrument offsets in functions with jump tables as
377 * we might interpret a jump table offset as an instruction.
378 */
379 if (dt_pid_has_jump_table(P, dtp, text, ftp, symp)) {
380 free(text);
381 return (0);
382 }
383
384 if (strcmp("*", pattern) == 0) {
385 for (i = 0; i < end; i += size) {
386 ftp->ftps_offs[ftp->ftps_noffs++] = i;
387
388 size = dt_instr_size(&text[i], dtp, pid,
389 symp->st_value + i, dmodel);
390
391 /* bail if we hit an invalid opcode */
392 if (size <= 0)
393 break;
394 }
395 } else {
396 char name[sizeof (i) * 2 + 1];
397
398 for (i = 0; i < end; i += size) {
399 (void) snprintf(name, sizeof (name), "%x", i);
400 if (gmatch(name, pattern))
401 ftp->ftps_offs[ftp->ftps_noffs++] = i;
402
403 size = dt_instr_size(&text[i], dtp, pid,
404 symp->st_value + i, dmodel);
405
406 /* bail if we hit an invalid opcode */
407 if (size <= 0)
408 break;
409 }
410 }
411
412 free(text);
413 if (ftp->ftps_noffs > 0) {
414 if (ioctl(dtp->dt_ftfd, FASTTRAPIOC_MAKEPROBE, ftp) != 0) {
415 dt_dprintf("fasttrap probe creation ioctl failed: %s\n",
416 strerror(errno));
417 return (dt_set_errno(dtp, errno));
418 }
419 }
420
421 return (ftp->ftps_noffs);
422 }
423
424 typedef struct dtrace_dis {
425 uchar_t *instr;
426 dtrace_hdl_t *dtp;
427 pid_t pid;
428 uintptr_t addr;
429 } dtrace_dis_t;
430
431 static int
dt_getbyte(void * data)432 dt_getbyte(void *data)
433 {
434 dtrace_dis_t *dis = data;
435 int ret = *dis->instr;
436
437 if (ret == FASTTRAP_INSTR) {
438 fasttrap_instr_query_t instr;
439
440 instr.ftiq_pid = dis->pid;
441 instr.ftiq_pc = dis->addr;
442
443 /*
444 * If we hit a byte that looks like the fasttrap provider's
445 * trap instruction (which doubles as the breakpoint
446 * instruction for debuggers) we need to query the kernel
447 * for the real value. This may just be part of an immediate
448 * value so there's no need to return an error if the
449 * kernel doesn't know about this address.
450 */
451 if (ioctl(dis->dtp->dt_ftfd, FASTTRAPIOC_GETINSTR, &instr) == 0)
452 ret = instr.ftiq_instr;
453 }
454
455 dis->addr++;
456 dis->instr++;
457
458 return (ret);
459 }
460
461 static int
dt_instr_size(uchar_t * instr,dtrace_hdl_t * dtp,pid_t pid,uintptr_t addr,char dmodel)462 dt_instr_size(uchar_t *instr, dtrace_hdl_t *dtp, pid_t pid, uintptr_t addr,
463 char dmodel)
464 {
465 dtrace_dis_t data;
466 dis86_t x86dis;
467 uint_t cpu_mode;
468
469 data.instr = instr;
470 data.dtp = dtp;
471 data.pid = pid;
472 data.addr = addr;
473
474 x86dis.d86_data = &data;
475 x86dis.d86_get_byte = dt_getbyte;
476 x86dis.d86_check_func = NULL;
477
478 cpu_mode = (dmodel == PR_MODEL_ILP32) ? SIZE32 : SIZE64;
479
480 if (dtrace_disx86(&x86dis, cpu_mode) != 0)
481 return (-1);
482
483 /*
484 * If the instruction was a single-byte breakpoint, there may be
485 * another debugger attached to this process. The original instruction
486 * can't be recovered so this must fail.
487 */
488 if (x86dis.d86_len == 1 &&
489 (uchar_t)x86dis.d86_bytes[0] == FASTTRAP_INSTR)
490 return (-1);
491
492 return (x86dis.d86_len);
493 }
494