1 /* 2 * CDDL HEADER START 3 * 4 * The contents of this file are subject to the terms of the 5 * Common Development and Distribution License (the "License"). 6 * You may not use this file except in compliance with the License. 7 * 8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 9 * or http://www.opensolaris.org/os/licensing. 10 * See the License for the specific language governing permissions 11 * and limitations under the License. 12 * 13 * When distributing Covered Code, include this CDDL HEADER in each 14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 15 * If applicable, add the following below this CDDL HEADER, with the 16 * fields enclosed by brackets "[]" replaced with your own identifying 17 * information: Portions Copyright [yyyy] [name of copyright owner] 18 * 19 * CDDL HEADER END 20 */ 21 22 /* 23 * Copyright 2009 Sun Microsystems, Inc. All rights reserved. 24 * Use is subject to license terms. 25 */ 26 27 /* 28 * Copyright (c) 2012 by Delphix. All rights reserved. 29 */ 30 31 #include <stdlib.h> 32 #include <assert.h> 33 #include <errno.h> 34 #include <string.h> 35 #include <libgen.h> 36 37 #include <dt_impl.h> 38 #include <dt_pid.h> 39 40 #include <dis_tables.h> 41 42 #define DT_POPL_EBP 0x5d 43 #define DT_RET 0xc3 44 #define DT_RET16 0xc2 45 #define DT_LEAVE 0xc9 46 #define DT_JMP32 0xe9 47 #define DT_JMP8 0xeb 48 #define DT_REP 0xf3 49 50 #define DT_MOVL_EBP_ESP 0xe58b 51 52 #define DT_ISJ32(op16) (((op16) & 0xfff0) == 0x0f80) 53 #define DT_ISJ8(op8) (((op8) & 0xf0) == 0x70) 54 55 #define DT_MODRM_REG(modrm) (((modrm) >> 3) & 0x7) 56 57 static int dt_instr_size(uchar_t *, dtrace_hdl_t *, pid_t, uintptr_t, char); 58 59 /*ARGSUSED*/ 60 int 61 dt_pid_create_entry_probe(struct ps_prochandle *P, dtrace_hdl_t *dtp, 62 fasttrap_probe_spec_t *ftp, const GElf_Sym *symp) 63 { 64 ftp->ftps_type = DTFTP_ENTRY; 65 ftp->ftps_pc = (uintptr_t)symp->st_value; 66 ftp->ftps_size = (size_t)symp->st_size; 67 ftp->ftps_noffs = 1; 68 ftp->ftps_offs[0] = 0; 69 70 if (ioctl(dtp->dt_ftfd, FASTTRAPIOC_MAKEPROBE, ftp) != 0) { 71 dt_dprintf("fasttrap probe creation ioctl failed: %s\n", 72 strerror(errno)); 73 return (dt_set_errno(dtp, errno)); 74 } 75 76 return (1); 77 } 78 79 static int 80 dt_pid_has_jump_table(struct ps_prochandle *P, dtrace_hdl_t *dtp, 81 uint8_t *text, fasttrap_probe_spec_t *ftp, const GElf_Sym *symp) 82 { 83 ulong_t i; 84 int size; 85 pid_t pid = Pstatus(P)->pr_pid; 86 char dmodel = Pstatus(P)->pr_dmodel; 87 88 /* 89 * Take a pass through the function looking for a register-dependant 90 * jmp instruction. This could be a jump table so we have to be 91 * ultra conservative. 92 */ 93 for (i = 0; i < ftp->ftps_size; i += size) { 94 size = dt_instr_size(&text[i], dtp, pid, symp->st_value + i, 95 dmodel); 96 97 /* 98 * Assume the worst if we hit an illegal instruction. 99 */ 100 if (size <= 0) { 101 dt_dprintf("error at %#lx (assuming jump table)\n", i); 102 return (1); 103 } 104 105 /* 106 * Register-dependant jmp instructions start with a 0xff byte 107 * and have the modrm.reg field set to 4. They can have an 108 * optional REX prefix on the 64-bit ISA. 109 */ 110 if ((text[i] == 0xff && DT_MODRM_REG(text[i + 1]) == 4) || 111 (dmodel == PR_MODEL_LP64 && (text[i] & 0xf0) == 0x40 && 112 text[i + 1] == 0xff && DT_MODRM_REG(text[i + 2]) == 4)) { 113 dt_dprintf("found a suspected jump table at %s:%lx\n", 114 ftp->ftps_func, i); 115 return (1); 116 } 117 } 118 119 return (0); 120 } 121 122 /*ARGSUSED*/ 123 int 124 dt_pid_create_return_probe(struct ps_prochandle *P, dtrace_hdl_t *dtp, 125 fasttrap_probe_spec_t *ftp, const GElf_Sym *symp, uint64_t *stret) 126 { 127 uint8_t *text; 128 ulong_t i, end; 129 int size; 130 pid_t pid = Pstatus(P)->pr_pid; 131 char dmodel = Pstatus(P)->pr_dmodel; 132 133 /* 134 * We allocate a few extra bytes at the end so we don't have to check 135 * for overrunning the buffer. 136 */ 137 if ((text = calloc(1, symp->st_size + 4)) == NULL) { 138 dt_dprintf("mr sparkle: malloc() failed\n"); 139 return (DT_PROC_ERR); 140 } 141 142 if (Pread(P, text, symp->st_size, symp->st_value) != symp->st_size) { 143 dt_dprintf("mr sparkle: Pread() failed\n"); 144 free(text); 145 return (DT_PROC_ERR); 146 } 147 148 ftp->ftps_type = DTFTP_RETURN; 149 ftp->ftps_pc = (uintptr_t)symp->st_value; 150 ftp->ftps_size = (size_t)symp->st_size; 151 ftp->ftps_noffs = 0; 152 153 /* 154 * If there's a jump table in the function we're only willing to 155 * instrument these specific (and equivalent) instruction sequences: 156 * leave 157 * [rep] ret 158 * and 159 * movl %ebp,%esp 160 * popl %ebp 161 * [rep] ret 162 * 163 * We do this to avoid accidentally interpreting jump table 164 * offsets as actual instructions. 165 */ 166 if (dt_pid_has_jump_table(P, dtp, text, ftp, symp)) { 167 for (i = 0, end = ftp->ftps_size; i < end; i += size) { 168 size = dt_instr_size(&text[i], dtp, pid, 169 symp->st_value + i, dmodel); 170 171 /* bail if we hit an invalid opcode */ 172 if (size <= 0) 173 break; 174 175 if (text[i] == DT_LEAVE && text[i + 1] == DT_RET) { 176 dt_dprintf("leave/ret at %lx\n", i + 1); 177 ftp->ftps_offs[ftp->ftps_noffs++] = i + 1; 178 size = 2; 179 } else if (text[i] == DT_LEAVE && 180 text[i + 1] == DT_REP && text[i + 2] == DT_RET) { 181 dt_dprintf("leave/rep ret at %lx\n", i + 1); 182 ftp->ftps_offs[ftp->ftps_noffs++] = i + 1; 183 size = 3; 184 } else if (*(uint16_t *)&text[i] == DT_MOVL_EBP_ESP && 185 text[i + 2] == DT_POPL_EBP && 186 text[i + 3] == DT_RET) { 187 dt_dprintf("movl/popl/ret at %lx\n", i + 3); 188 ftp->ftps_offs[ftp->ftps_noffs++] = i + 3; 189 size = 4; 190 } else if (*(uint16_t *)&text[i] == DT_MOVL_EBP_ESP && 191 text[i + 2] == DT_POPL_EBP && 192 text[i + 3] == DT_REP && 193 text[i + 4] == DT_RET) { 194 dt_dprintf("movl/popl/rep ret at %lx\n", i + 3); 195 ftp->ftps_offs[ftp->ftps_noffs++] = i + 3; 196 size = 5; 197 } 198 } 199 } else { 200 for (i = 0, end = ftp->ftps_size; i < end; i += size) { 201 size = dt_instr_size(&text[i], dtp, pid, 202 symp->st_value + i, dmodel); 203 204 /* bail if we hit an invalid opcode */ 205 if (size <= 0) 206 break; 207 208 /* ordinary ret */ 209 if (size == 1 && text[i] == DT_RET) 210 goto is_ret; 211 212 /* two-byte ret */ 213 if (size == 2 && text[i] == DT_REP && 214 text[i + 1] == DT_RET) 215 goto is_ret; 216 217 /* ret <imm16> */ 218 if (size == 3 && text[i] == DT_RET16) 219 goto is_ret; 220 221 /* two-byte ret <imm16> */ 222 if (size == 4 && text[i] == DT_REP && 223 text[i + 1] == DT_RET16) 224 goto is_ret; 225 226 /* 32-bit displacement jmp outside of the function */ 227 if (size == 5 && text[i] == DT_JMP32 && symp->st_size <= 228 (uintptr_t)(i + size + *(int32_t *)&text[i + 1])) 229 goto is_ret; 230 231 /* 8-bit displacement jmp outside of the function */ 232 if (size == 2 && text[i] == DT_JMP8 && symp->st_size <= 233 (uintptr_t)(i + size + *(int8_t *)&text[i + 1])) 234 goto is_ret; 235 236 /* 32-bit disp. conditional jmp outside of the func. */ 237 if (size == 6 && DT_ISJ32(*(uint16_t *)&text[i]) && 238 symp->st_size <= 239 (uintptr_t)(i + size + *(int32_t *)&text[i + 2])) 240 goto is_ret; 241 242 /* 8-bit disp. conditional jmp outside of the func. */ 243 if (size == 2 && DT_ISJ8(text[i]) && symp->st_size <= 244 (uintptr_t)(i + size + *(int8_t *)&text[i + 1])) 245 goto is_ret; 246 247 continue; 248 is_ret: 249 dt_dprintf("return at offset %lx\n", i); 250 ftp->ftps_offs[ftp->ftps_noffs++] = i; 251 } 252 } 253 254 free(text); 255 if (ftp->ftps_noffs > 0) { 256 if (ioctl(dtp->dt_ftfd, FASTTRAPIOC_MAKEPROBE, ftp) != 0) { 257 dt_dprintf("fasttrap probe creation ioctl failed: %s\n", 258 strerror(errno)); 259 return (dt_set_errno(dtp, errno)); 260 } 261 } 262 263 return (ftp->ftps_noffs); 264 } 265 266 /*ARGSUSED*/ 267 int 268 dt_pid_create_offset_probe(struct ps_prochandle *P, dtrace_hdl_t *dtp, 269 fasttrap_probe_spec_t *ftp, const GElf_Sym *symp, ulong_t off) 270 { 271 ftp->ftps_type = DTFTP_OFFSETS; 272 ftp->ftps_pc = (uintptr_t)symp->st_value; 273 ftp->ftps_size = (size_t)symp->st_size; 274 ftp->ftps_noffs = 1; 275 276 if (strcmp("-", ftp->ftps_func) == 0) { 277 ftp->ftps_offs[0] = off; 278 } else { 279 uint8_t *text; 280 ulong_t i; 281 int size; 282 pid_t pid = Pstatus(P)->pr_pid; 283 char dmodel = Pstatus(P)->pr_dmodel; 284 285 if ((text = malloc(symp->st_size)) == NULL) { 286 dt_dprintf("mr sparkle: malloc() failed\n"); 287 return (DT_PROC_ERR); 288 } 289 290 if (Pread(P, text, symp->st_size, symp->st_value) != 291 symp->st_size) { 292 dt_dprintf("mr sparkle: Pread() failed\n"); 293 free(text); 294 return (DT_PROC_ERR); 295 } 296 297 /* 298 * We can't instrument offsets in functions with jump tables 299 * as we might interpret a jump table offset as an 300 * instruction. 301 */ 302 if (dt_pid_has_jump_table(P, dtp, text, ftp, symp)) { 303 free(text); 304 return (0); 305 } 306 307 for (i = 0; i < symp->st_size; i += size) { 308 if (i == off) { 309 ftp->ftps_offs[0] = i; 310 break; 311 } 312 313 /* 314 * If we've passed the desired offset without a 315 * match, then the given offset must not lie on a 316 * instruction boundary. 317 */ 318 if (i > off) { 319 free(text); 320 return (DT_PROC_ALIGN); 321 } 322 323 size = dt_instr_size(&text[i], dtp, pid, 324 symp->st_value + i, dmodel); 325 326 /* 327 * If we hit an invalid instruction, bail as if we 328 * couldn't find the offset. 329 */ 330 if (size <= 0) { 331 free(text); 332 return (DT_PROC_ALIGN); 333 } 334 } 335 336 free(text); 337 } 338 339 if (ioctl(dtp->dt_ftfd, FASTTRAPIOC_MAKEPROBE, ftp) != 0) { 340 dt_dprintf("fasttrap probe creation ioctl failed: %s\n", 341 strerror(errno)); 342 return (dt_set_errno(dtp, errno)); 343 } 344 345 return (ftp->ftps_noffs); 346 } 347 348 /*ARGSUSED*/ 349 int 350 dt_pid_create_glob_offset_probes(struct ps_prochandle *P, dtrace_hdl_t *dtp, 351 fasttrap_probe_spec_t *ftp, const GElf_Sym *symp, const char *pattern) 352 { 353 uint8_t *text; 354 int size; 355 ulong_t i, end = symp->st_size; 356 pid_t pid = Pstatus(P)->pr_pid; 357 char dmodel = Pstatus(P)->pr_dmodel; 358 359 ftp->ftps_type = DTFTP_OFFSETS; 360 ftp->ftps_pc = (uintptr_t)symp->st_value; 361 ftp->ftps_size = (size_t)symp->st_size; 362 ftp->ftps_noffs = 0; 363 364 if ((text = malloc(symp->st_size)) == NULL) { 365 dt_dprintf("mr sparkle: malloc() failed\n"); 366 return (DT_PROC_ERR); 367 } 368 369 if (Pread(P, text, symp->st_size, symp->st_value) != symp->st_size) { 370 dt_dprintf("mr sparkle: Pread() failed\n"); 371 free(text); 372 return (DT_PROC_ERR); 373 } 374 375 /* 376 * We can't instrument offsets in functions with jump tables as 377 * we might interpret a jump table offset as an instruction. 378 */ 379 if (dt_pid_has_jump_table(P, dtp, text, ftp, symp)) { 380 free(text); 381 return (0); 382 } 383 384 if (strcmp("*", pattern) == 0) { 385 for (i = 0; i < end; i += size) { 386 ftp->ftps_offs[ftp->ftps_noffs++] = i; 387 388 size = dt_instr_size(&text[i], dtp, pid, 389 symp->st_value + i, dmodel); 390 391 /* bail if we hit an invalid opcode */ 392 if (size <= 0) 393 break; 394 } 395 } else { 396 char name[sizeof (i) * 2 + 1]; 397 398 for (i = 0; i < end; i += size) { 399 (void) snprintf(name, sizeof (name), "%x", i); 400 if (gmatch(name, pattern)) 401 ftp->ftps_offs[ftp->ftps_noffs++] = i; 402 403 size = dt_instr_size(&text[i], dtp, pid, 404 symp->st_value + i, dmodel); 405 406 /* bail if we hit an invalid opcode */ 407 if (size <= 0) 408 break; 409 } 410 } 411 412 free(text); 413 if (ftp->ftps_noffs > 0) { 414 if (ioctl(dtp->dt_ftfd, FASTTRAPIOC_MAKEPROBE, ftp) != 0) { 415 dt_dprintf("fasttrap probe creation ioctl failed: %s\n", 416 strerror(errno)); 417 return (dt_set_errno(dtp, errno)); 418 } 419 } 420 421 return (ftp->ftps_noffs); 422 } 423 424 typedef struct dtrace_dis { 425 uchar_t *instr; 426 dtrace_hdl_t *dtp; 427 pid_t pid; 428 uintptr_t addr; 429 } dtrace_dis_t; 430 431 static int 432 dt_getbyte(void *data) 433 { 434 dtrace_dis_t *dis = data; 435 int ret = *dis->instr; 436 437 if (ret == FASTTRAP_INSTR) { 438 fasttrap_instr_query_t instr; 439 440 instr.ftiq_pid = dis->pid; 441 instr.ftiq_pc = dis->addr; 442 443 /* 444 * If we hit a byte that looks like the fasttrap provider's 445 * trap instruction (which doubles as the breakpoint 446 * instruction for debuggers) we need to query the kernel 447 * for the real value. This may just be part of an immediate 448 * value so there's no need to return an error if the 449 * kernel doesn't know about this address. 450 */ 451 if (ioctl(dis->dtp->dt_ftfd, FASTTRAPIOC_GETINSTR, &instr) == 0) 452 ret = instr.ftiq_instr; 453 } 454 455 dis->addr++; 456 dis->instr++; 457 458 return (ret); 459 } 460 461 static int 462 dt_instr_size(uchar_t *instr, dtrace_hdl_t *dtp, pid_t pid, uintptr_t addr, 463 char dmodel) 464 { 465 dtrace_dis_t data; 466 dis86_t x86dis; 467 uint_t cpu_mode; 468 469 data.instr = instr; 470 data.dtp = dtp; 471 data.pid = pid; 472 data.addr = addr; 473 474 x86dis.d86_data = &data; 475 x86dis.d86_get_byte = dt_getbyte; 476 x86dis.d86_check_func = NULL; 477 478 cpu_mode = (dmodel == PR_MODEL_ILP32) ? SIZE32 : SIZE64; 479 480 if (dtrace_disx86(&x86dis, cpu_mode) != 0) 481 return (-1); 482 483 /* 484 * If the instruction was a single-byte breakpoint, there may be 485 * another debugger attached to this process. The original instruction 486 * can't be recovered so this must fail. 487 */ 488 if (x86dis.d86_len == 1 && 489 (uchar_t)x86dis.d86_bytes[0] == FASTTRAP_INSTR) 490 return (-1); 491 492 return (x86dis.d86_len); 493 } 494