xref: /titanic_52/usr/src/lib/libdtrace/i386/dt_isadep.c (revision e5803b76927480e8f9b67b22201c484ccf4c2bcf)
17c478bd9Sstevel@tonic-gate /*
27c478bd9Sstevel@tonic-gate  * CDDL HEADER START
37c478bd9Sstevel@tonic-gate  *
47c478bd9Sstevel@tonic-gate  * The contents of this file are subject to the terms of the
5351346dbSahl  * Common Development and Distribution License (the "License").
6351346dbSahl  * You may not use this file except in compliance with the License.
77c478bd9Sstevel@tonic-gate  *
87c478bd9Sstevel@tonic-gate  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
97c478bd9Sstevel@tonic-gate  * or http://www.opensolaris.org/os/licensing.
107c478bd9Sstevel@tonic-gate  * See the License for the specific language governing permissions
117c478bd9Sstevel@tonic-gate  * and limitations under the License.
127c478bd9Sstevel@tonic-gate  *
137c478bd9Sstevel@tonic-gate  * When distributing Covered Code, include this CDDL HEADER in each
147c478bd9Sstevel@tonic-gate  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
157c478bd9Sstevel@tonic-gate  * If applicable, add the following below this CDDL HEADER, with the
167c478bd9Sstevel@tonic-gate  * fields enclosed by brackets "[]" replaced with your own identifying
177c478bd9Sstevel@tonic-gate  * information: Portions Copyright [yyyy] [name of copyright owner]
187c478bd9Sstevel@tonic-gate  *
197c478bd9Sstevel@tonic-gate  * CDDL HEADER END
207c478bd9Sstevel@tonic-gate  */
21351346dbSahl 
227c478bd9Sstevel@tonic-gate /*
2396400bb6SJonathan Haslam  * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
247c478bd9Sstevel@tonic-gate  * Use is subject to license terms.
257c478bd9Sstevel@tonic-gate  */
267c478bd9Sstevel@tonic-gate 
27*e5803b76SAdam H. Leventhal /*
28*e5803b76SAdam H. Leventhal  * Copyright (c) 2012 by Delphix. All rights reserved.
29*e5803b76SAdam H. Leventhal  */
30*e5803b76SAdam H. Leventhal 
317c478bd9Sstevel@tonic-gate #include <stdlib.h>
327c478bd9Sstevel@tonic-gate #include <assert.h>
337c478bd9Sstevel@tonic-gate #include <errno.h>
347c478bd9Sstevel@tonic-gate #include <string.h>
357c478bd9Sstevel@tonic-gate #include <libgen.h>
367c478bd9Sstevel@tonic-gate 
377c478bd9Sstevel@tonic-gate #include <dt_impl.h>
387c478bd9Sstevel@tonic-gate #include <dt_pid.h>
397c478bd9Sstevel@tonic-gate 
407c478bd9Sstevel@tonic-gate #include <dis_tables.h>
417c478bd9Sstevel@tonic-gate 
427c478bd9Sstevel@tonic-gate #define	DT_POPL_EBP	0x5d
437c478bd9Sstevel@tonic-gate #define	DT_RET		0xc3
447c478bd9Sstevel@tonic-gate #define	DT_RET16	0xc2
457c478bd9Sstevel@tonic-gate #define	DT_LEAVE	0xc9
467c478bd9Sstevel@tonic-gate #define	DT_JMP32	0xe9
477c478bd9Sstevel@tonic-gate #define	DT_JMP8		0xeb
487c478bd9Sstevel@tonic-gate #define	DT_REP		0xf3
497c478bd9Sstevel@tonic-gate 
507c478bd9Sstevel@tonic-gate #define	DT_MOVL_EBP_ESP	0xe58b
517c478bd9Sstevel@tonic-gate 
527c478bd9Sstevel@tonic-gate #define	DT_ISJ32(op16)	(((op16) & 0xfff0) == 0x0f80)
537c478bd9Sstevel@tonic-gate #define	DT_ISJ8(op8)	(((op8) & 0xf0) == 0x70)
547c478bd9Sstevel@tonic-gate 
557c478bd9Sstevel@tonic-gate #define	DT_MODRM_REG(modrm)	(((modrm) >> 3) & 0x7)
567c478bd9Sstevel@tonic-gate 
577c478bd9Sstevel@tonic-gate static int dt_instr_size(uchar_t *, dtrace_hdl_t *, pid_t, uintptr_t, char);
587c478bd9Sstevel@tonic-gate 
597c478bd9Sstevel@tonic-gate /*ARGSUSED*/
607c478bd9Sstevel@tonic-gate int
617c478bd9Sstevel@tonic-gate dt_pid_create_entry_probe(struct ps_prochandle *P, dtrace_hdl_t *dtp,
627c478bd9Sstevel@tonic-gate     fasttrap_probe_spec_t *ftp, const GElf_Sym *symp)
637c478bd9Sstevel@tonic-gate {
647c478bd9Sstevel@tonic-gate 	ftp->ftps_type = DTFTP_ENTRY;
657c478bd9Sstevel@tonic-gate 	ftp->ftps_pc = (uintptr_t)symp->st_value;
667c478bd9Sstevel@tonic-gate 	ftp->ftps_size = (size_t)symp->st_size;
677c478bd9Sstevel@tonic-gate 	ftp->ftps_noffs = 1;
687c478bd9Sstevel@tonic-gate 	ftp->ftps_offs[0] = 0;
697c478bd9Sstevel@tonic-gate 
707c478bd9Sstevel@tonic-gate 	if (ioctl(dtp->dt_ftfd, FASTTRAPIOC_MAKEPROBE, ftp) != 0) {
717c478bd9Sstevel@tonic-gate 		dt_dprintf("fasttrap probe creation ioctl failed: %s\n",
727c478bd9Sstevel@tonic-gate 		    strerror(errno));
737c478bd9Sstevel@tonic-gate 		return (dt_set_errno(dtp, errno));
747c478bd9Sstevel@tonic-gate 	}
757c478bd9Sstevel@tonic-gate 
767c478bd9Sstevel@tonic-gate 	return (1);
777c478bd9Sstevel@tonic-gate }
787c478bd9Sstevel@tonic-gate 
797c478bd9Sstevel@tonic-gate static int
807c478bd9Sstevel@tonic-gate dt_pid_has_jump_table(struct ps_prochandle *P, dtrace_hdl_t *dtp,
817c478bd9Sstevel@tonic-gate     uint8_t *text, fasttrap_probe_spec_t *ftp, const GElf_Sym *symp)
827c478bd9Sstevel@tonic-gate {
837c478bd9Sstevel@tonic-gate 	ulong_t i;
847c478bd9Sstevel@tonic-gate 	int size;
857c478bd9Sstevel@tonic-gate 	pid_t pid = Pstatus(P)->pr_pid;
867c478bd9Sstevel@tonic-gate 	char dmodel = Pstatus(P)->pr_dmodel;
877c478bd9Sstevel@tonic-gate 
887c478bd9Sstevel@tonic-gate 	/*
897c478bd9Sstevel@tonic-gate 	 * Take a pass through the function looking for a register-dependant
907c478bd9Sstevel@tonic-gate 	 * jmp instruction. This could be a jump table so we have to be
917c478bd9Sstevel@tonic-gate 	 * ultra conservative.
927c478bd9Sstevel@tonic-gate 	 */
937c478bd9Sstevel@tonic-gate 	for (i = 0; i < ftp->ftps_size; i += size) {
947c478bd9Sstevel@tonic-gate 		size = dt_instr_size(&text[i], dtp, pid, symp->st_value + i,
957c478bd9Sstevel@tonic-gate 		    dmodel);
967c478bd9Sstevel@tonic-gate 
977c478bd9Sstevel@tonic-gate 		/*
987c478bd9Sstevel@tonic-gate 		 * Assume the worst if we hit an illegal instruction.
997c478bd9Sstevel@tonic-gate 		 */
1007c478bd9Sstevel@tonic-gate 		if (size <= 0) {
1017c478bd9Sstevel@tonic-gate 			dt_dprintf("error at %#lx (assuming jump table)\n", i);
1027c478bd9Sstevel@tonic-gate 			return (1);
1037c478bd9Sstevel@tonic-gate 		}
1047c478bd9Sstevel@tonic-gate 
105351346dbSahl 		/*
106351346dbSahl 		 * Register-dependant jmp instructions start with a 0xff byte
107351346dbSahl 		 * and have the modrm.reg field set to 4. They can have an
108351346dbSahl 		 * optional REX prefix on the 64-bit ISA.
109351346dbSahl 		 */
110351346dbSahl 		if ((text[i] == 0xff && DT_MODRM_REG(text[i + 1]) == 4) ||
111351346dbSahl 		    (dmodel == PR_MODEL_LP64 && (text[i] & 0xf0) == 0x40 &&
112351346dbSahl 		    text[i + 1] == 0xff && DT_MODRM_REG(text[i + 2]) == 4)) {
1137c478bd9Sstevel@tonic-gate 			dt_dprintf("found a suspected jump table at %s:%lx\n",
1147c478bd9Sstevel@tonic-gate 			    ftp->ftps_func, i);
1157c478bd9Sstevel@tonic-gate 			return (1);
1167c478bd9Sstevel@tonic-gate 		}
1177c478bd9Sstevel@tonic-gate 	}
1187c478bd9Sstevel@tonic-gate 
1197c478bd9Sstevel@tonic-gate 	return (0);
1207c478bd9Sstevel@tonic-gate }
1217c478bd9Sstevel@tonic-gate 
1227c478bd9Sstevel@tonic-gate /*ARGSUSED*/
1237c478bd9Sstevel@tonic-gate int
1247c478bd9Sstevel@tonic-gate dt_pid_create_return_probe(struct ps_prochandle *P, dtrace_hdl_t *dtp,
1257c478bd9Sstevel@tonic-gate     fasttrap_probe_spec_t *ftp, const GElf_Sym *symp, uint64_t *stret)
1267c478bd9Sstevel@tonic-gate {
1277c478bd9Sstevel@tonic-gate 	uint8_t *text;
1287c478bd9Sstevel@tonic-gate 	ulong_t i, end;
1297c478bd9Sstevel@tonic-gate 	int size;
1307c478bd9Sstevel@tonic-gate 	pid_t pid = Pstatus(P)->pr_pid;
1317c478bd9Sstevel@tonic-gate 	char dmodel = Pstatus(P)->pr_dmodel;
1327c478bd9Sstevel@tonic-gate 
1337c478bd9Sstevel@tonic-gate 	/*
1347c478bd9Sstevel@tonic-gate 	 * We allocate a few extra bytes at the end so we don't have to check
1357c478bd9Sstevel@tonic-gate 	 * for overrunning the buffer.
1367c478bd9Sstevel@tonic-gate 	 */
1377c478bd9Sstevel@tonic-gate 	if ((text = calloc(1, symp->st_size + 4)) == NULL) {
1387c478bd9Sstevel@tonic-gate 		dt_dprintf("mr sparkle: malloc() failed\n");
1397c478bd9Sstevel@tonic-gate 		return (DT_PROC_ERR);
1407c478bd9Sstevel@tonic-gate 	}
1417c478bd9Sstevel@tonic-gate 
1427c478bd9Sstevel@tonic-gate 	if (Pread(P, text, symp->st_size, symp->st_value) != symp->st_size) {
1437c478bd9Sstevel@tonic-gate 		dt_dprintf("mr sparkle: Pread() failed\n");
1447c478bd9Sstevel@tonic-gate 		free(text);
1457c478bd9Sstevel@tonic-gate 		return (DT_PROC_ERR);
1467c478bd9Sstevel@tonic-gate 	}
1477c478bd9Sstevel@tonic-gate 
1487c478bd9Sstevel@tonic-gate 	ftp->ftps_type = DTFTP_RETURN;
1497c478bd9Sstevel@tonic-gate 	ftp->ftps_pc = (uintptr_t)symp->st_value;
1507c478bd9Sstevel@tonic-gate 	ftp->ftps_size = (size_t)symp->st_size;
1517c478bd9Sstevel@tonic-gate 	ftp->ftps_noffs = 0;
1527c478bd9Sstevel@tonic-gate 
1537c478bd9Sstevel@tonic-gate 	/*
1547c478bd9Sstevel@tonic-gate 	 * If there's a jump table in the function we're only willing to
1557c478bd9Sstevel@tonic-gate 	 * instrument these specific (and equivalent) instruction sequences:
1567c478bd9Sstevel@tonic-gate 	 *	leave
1577c478bd9Sstevel@tonic-gate 	 *	[rep] ret
1587c478bd9Sstevel@tonic-gate 	 * and
1597c478bd9Sstevel@tonic-gate 	 *	movl	%ebp,%esp
1607c478bd9Sstevel@tonic-gate 	 *	popl	%ebp
1617c478bd9Sstevel@tonic-gate 	 *	[rep] ret
1627c478bd9Sstevel@tonic-gate 	 *
1637c478bd9Sstevel@tonic-gate 	 * We do this to avoid accidentally interpreting jump table
1647c478bd9Sstevel@tonic-gate 	 * offsets as actual instructions.
1657c478bd9Sstevel@tonic-gate 	 */
1667c478bd9Sstevel@tonic-gate 	if (dt_pid_has_jump_table(P, dtp, text, ftp, symp)) {
1677c478bd9Sstevel@tonic-gate 		for (i = 0, end = ftp->ftps_size; i < end; i += size) {
1687c478bd9Sstevel@tonic-gate 			size = dt_instr_size(&text[i], dtp, pid,
1697c478bd9Sstevel@tonic-gate 			    symp->st_value + i, dmodel);
1707c478bd9Sstevel@tonic-gate 
1717c478bd9Sstevel@tonic-gate 			/* bail if we hit an invalid opcode */
1727c478bd9Sstevel@tonic-gate 			if (size <= 0)
1737c478bd9Sstevel@tonic-gate 				break;
1747c478bd9Sstevel@tonic-gate 
1757c478bd9Sstevel@tonic-gate 			if (text[i] == DT_LEAVE && text[i + 1] == DT_RET) {
1767c478bd9Sstevel@tonic-gate 				dt_dprintf("leave/ret at %lx\n", i + 1);
1777c478bd9Sstevel@tonic-gate 				ftp->ftps_offs[ftp->ftps_noffs++] = i + 1;
1787c478bd9Sstevel@tonic-gate 				size = 2;
1797c478bd9Sstevel@tonic-gate 			} else if (text[i] == DT_LEAVE &&
1807c478bd9Sstevel@tonic-gate 			    text[i + 1] == DT_REP && text[i + 2] == DT_RET) {
1817c478bd9Sstevel@tonic-gate 				dt_dprintf("leave/rep ret at %lx\n", i + 1);
1827c478bd9Sstevel@tonic-gate 				ftp->ftps_offs[ftp->ftps_noffs++] = i + 1;
1837c478bd9Sstevel@tonic-gate 				size = 3;
1847c478bd9Sstevel@tonic-gate 			} else if (*(uint16_t *)&text[i] == DT_MOVL_EBP_ESP &&
1857c478bd9Sstevel@tonic-gate 			    text[i + 2] == DT_POPL_EBP &&
1867c478bd9Sstevel@tonic-gate 			    text[i + 3] == DT_RET) {
1877c478bd9Sstevel@tonic-gate 				dt_dprintf("movl/popl/ret at %lx\n", i + 3);
1887c478bd9Sstevel@tonic-gate 				ftp->ftps_offs[ftp->ftps_noffs++] = i + 3;
1897c478bd9Sstevel@tonic-gate 				size = 4;
1907c478bd9Sstevel@tonic-gate 			} else if (*(uint16_t *)&text[i] == DT_MOVL_EBP_ESP &&
1917c478bd9Sstevel@tonic-gate 			    text[i + 2] == DT_POPL_EBP &&
1927c478bd9Sstevel@tonic-gate 			    text[i + 3] == DT_REP &&
1937c478bd9Sstevel@tonic-gate 			    text[i + 4] == DT_RET) {
1947c478bd9Sstevel@tonic-gate 				dt_dprintf("movl/popl/rep ret at %lx\n", i + 3);
1957c478bd9Sstevel@tonic-gate 				ftp->ftps_offs[ftp->ftps_noffs++] = i + 3;
1967c478bd9Sstevel@tonic-gate 				size = 5;
1977c478bd9Sstevel@tonic-gate 			}
1987c478bd9Sstevel@tonic-gate 		}
1997c478bd9Sstevel@tonic-gate 	} else {
2007c478bd9Sstevel@tonic-gate 		for (i = 0, end = ftp->ftps_size; i < end; i += size) {
2017c478bd9Sstevel@tonic-gate 			size = dt_instr_size(&text[i], dtp, pid,
2027c478bd9Sstevel@tonic-gate 			    symp->st_value + i, dmodel);
2037c478bd9Sstevel@tonic-gate 
2047c478bd9Sstevel@tonic-gate 			/* bail if we hit an invalid opcode */
2057c478bd9Sstevel@tonic-gate 			if (size <= 0)
2067c478bd9Sstevel@tonic-gate 				break;
2077c478bd9Sstevel@tonic-gate 
2087c478bd9Sstevel@tonic-gate 			/* ordinary ret */
2097c478bd9Sstevel@tonic-gate 			if (size == 1 && text[i] == DT_RET)
2107c478bd9Sstevel@tonic-gate 				goto is_ret;
2117c478bd9Sstevel@tonic-gate 
2127c478bd9Sstevel@tonic-gate 			/* two-byte ret */
2137c478bd9Sstevel@tonic-gate 			if (size == 2 && text[i] == DT_REP &&
2147c478bd9Sstevel@tonic-gate 			    text[i + 1] == DT_RET)
2157c478bd9Sstevel@tonic-gate 				goto is_ret;
2167c478bd9Sstevel@tonic-gate 
2177c478bd9Sstevel@tonic-gate 			/* ret <imm16> */
2187c478bd9Sstevel@tonic-gate 			if (size == 3 && text[i] == DT_RET16)
2197c478bd9Sstevel@tonic-gate 				goto is_ret;
2207c478bd9Sstevel@tonic-gate 
2217c478bd9Sstevel@tonic-gate 			/* two-byte ret <imm16> */
2227c478bd9Sstevel@tonic-gate 			if (size == 4 && text[i] == DT_REP &&
2237c478bd9Sstevel@tonic-gate 			    text[i + 1] == DT_RET16)
2247c478bd9Sstevel@tonic-gate 				goto is_ret;
2257c478bd9Sstevel@tonic-gate 
2267c478bd9Sstevel@tonic-gate 			/* 32-bit displacement jmp outside of the function */
2277c478bd9Sstevel@tonic-gate 			if (size == 5 && text[i] == DT_JMP32 && symp->st_size <=
2287c478bd9Sstevel@tonic-gate 			    (uintptr_t)(i + size + *(int32_t *)&text[i + 1]))
2297c478bd9Sstevel@tonic-gate 				goto is_ret;
2307c478bd9Sstevel@tonic-gate 
2317c478bd9Sstevel@tonic-gate 			/* 8-bit displacement jmp outside of the function */
2327c478bd9Sstevel@tonic-gate 			if (size == 2 && text[i] == DT_JMP8 && symp->st_size <=
2337c478bd9Sstevel@tonic-gate 			    (uintptr_t)(i + size + *(int8_t *)&text[i + 1]))
2347c478bd9Sstevel@tonic-gate 				goto is_ret;
2357c478bd9Sstevel@tonic-gate 
2367c478bd9Sstevel@tonic-gate 			/* 32-bit disp. conditional jmp outside of the func. */
2377c478bd9Sstevel@tonic-gate 			if (size == 6 && DT_ISJ32(*(uint16_t *)&text[i]) &&
2387c478bd9Sstevel@tonic-gate 			    symp->st_size <=
2397c478bd9Sstevel@tonic-gate 			    (uintptr_t)(i + size + *(int32_t *)&text[i + 2]))
2407c478bd9Sstevel@tonic-gate 				goto is_ret;
2417c478bd9Sstevel@tonic-gate 
2427c478bd9Sstevel@tonic-gate 			/* 8-bit disp. conditional jmp outside of the func. */
2437c478bd9Sstevel@tonic-gate 			if (size == 2 && DT_ISJ8(text[i]) && symp->st_size <=
2447c478bd9Sstevel@tonic-gate 			    (uintptr_t)(i + size + *(int8_t *)&text[i + 1]))
2457c478bd9Sstevel@tonic-gate 				goto is_ret;
2467c478bd9Sstevel@tonic-gate 
2477c478bd9Sstevel@tonic-gate 			continue;
2487c478bd9Sstevel@tonic-gate is_ret:
2497c478bd9Sstevel@tonic-gate 			dt_dprintf("return at offset %lx\n", i);
2507c478bd9Sstevel@tonic-gate 			ftp->ftps_offs[ftp->ftps_noffs++] = i;
2517c478bd9Sstevel@tonic-gate 		}
2527c478bd9Sstevel@tonic-gate 	}
2537c478bd9Sstevel@tonic-gate 
2547c478bd9Sstevel@tonic-gate 	free(text);
2557c478bd9Sstevel@tonic-gate 	if (ftp->ftps_noffs > 0) {
2567c478bd9Sstevel@tonic-gate 		if (ioctl(dtp->dt_ftfd, FASTTRAPIOC_MAKEPROBE, ftp) != 0) {
2577c478bd9Sstevel@tonic-gate 			dt_dprintf("fasttrap probe creation ioctl failed: %s\n",
2587c478bd9Sstevel@tonic-gate 			    strerror(errno));
2597c478bd9Sstevel@tonic-gate 			return (dt_set_errno(dtp, errno));
2607c478bd9Sstevel@tonic-gate 		}
2617c478bd9Sstevel@tonic-gate 	}
2627c478bd9Sstevel@tonic-gate 
2637c478bd9Sstevel@tonic-gate 	return (ftp->ftps_noffs);
2647c478bd9Sstevel@tonic-gate }
2657c478bd9Sstevel@tonic-gate 
2667c478bd9Sstevel@tonic-gate /*ARGSUSED*/
2677c478bd9Sstevel@tonic-gate int
2687c478bd9Sstevel@tonic-gate dt_pid_create_offset_probe(struct ps_prochandle *P, dtrace_hdl_t *dtp,
2697c478bd9Sstevel@tonic-gate     fasttrap_probe_spec_t *ftp, const GElf_Sym *symp, ulong_t off)
2707c478bd9Sstevel@tonic-gate {
2717c478bd9Sstevel@tonic-gate 	ftp->ftps_type = DTFTP_OFFSETS;
2727c478bd9Sstevel@tonic-gate 	ftp->ftps_pc = (uintptr_t)symp->st_value;
2737c478bd9Sstevel@tonic-gate 	ftp->ftps_size = (size_t)symp->st_size;
2747c478bd9Sstevel@tonic-gate 	ftp->ftps_noffs = 1;
2757c478bd9Sstevel@tonic-gate 
2767c478bd9Sstevel@tonic-gate 	if (strcmp("-", ftp->ftps_func) == 0) {
2777c478bd9Sstevel@tonic-gate 		ftp->ftps_offs[0] = off;
2787c478bd9Sstevel@tonic-gate 	} else {
2797c478bd9Sstevel@tonic-gate 		uint8_t *text;
2807c478bd9Sstevel@tonic-gate 		ulong_t i;
2817c478bd9Sstevel@tonic-gate 		int size;
2827c478bd9Sstevel@tonic-gate 		pid_t pid = Pstatus(P)->pr_pid;
2837c478bd9Sstevel@tonic-gate 		char dmodel = Pstatus(P)->pr_dmodel;
2847c478bd9Sstevel@tonic-gate 
2857c478bd9Sstevel@tonic-gate 		if ((text = malloc(symp->st_size)) == NULL) {
2867c478bd9Sstevel@tonic-gate 			dt_dprintf("mr sparkle: malloc() failed\n");
2877c478bd9Sstevel@tonic-gate 			return (DT_PROC_ERR);
2887c478bd9Sstevel@tonic-gate 		}
2897c478bd9Sstevel@tonic-gate 
2907c478bd9Sstevel@tonic-gate 		if (Pread(P, text, symp->st_size, symp->st_value) !=
2917c478bd9Sstevel@tonic-gate 		    symp->st_size) {
2927c478bd9Sstevel@tonic-gate 			dt_dprintf("mr sparkle: Pread() failed\n");
2937c478bd9Sstevel@tonic-gate 			free(text);
2947c478bd9Sstevel@tonic-gate 			return (DT_PROC_ERR);
2957c478bd9Sstevel@tonic-gate 		}
2967c478bd9Sstevel@tonic-gate 
2977c478bd9Sstevel@tonic-gate 		/*
2987c478bd9Sstevel@tonic-gate 		 * We can't instrument offsets in functions with jump tables
2997c478bd9Sstevel@tonic-gate 		 * as we might interpret a jump table offset as an
3007c478bd9Sstevel@tonic-gate 		 * instruction.
3017c478bd9Sstevel@tonic-gate 		 */
3027c478bd9Sstevel@tonic-gate 		if (dt_pid_has_jump_table(P, dtp, text, ftp, symp)) {
3037c478bd9Sstevel@tonic-gate 			free(text);
3047c478bd9Sstevel@tonic-gate 			return (0);
3057c478bd9Sstevel@tonic-gate 		}
3067c478bd9Sstevel@tonic-gate 
3077c478bd9Sstevel@tonic-gate 		for (i = 0; i < symp->st_size; i += size) {
3087c478bd9Sstevel@tonic-gate 			if (i == off) {
3097c478bd9Sstevel@tonic-gate 				ftp->ftps_offs[0] = i;
3107c478bd9Sstevel@tonic-gate 				break;
3117c478bd9Sstevel@tonic-gate 			}
3127c478bd9Sstevel@tonic-gate 
3137c478bd9Sstevel@tonic-gate 			/*
3147c478bd9Sstevel@tonic-gate 			 * If we've passed the desired offset without a
3157c478bd9Sstevel@tonic-gate 			 * match, then the given offset must not lie on a
3167c478bd9Sstevel@tonic-gate 			 * instruction boundary.
3177c478bd9Sstevel@tonic-gate 			 */
3187c478bd9Sstevel@tonic-gate 			if (i > off) {
3197c478bd9Sstevel@tonic-gate 				free(text);
3207c478bd9Sstevel@tonic-gate 				return (DT_PROC_ALIGN);
3217c478bd9Sstevel@tonic-gate 			}
3227c478bd9Sstevel@tonic-gate 
3237c478bd9Sstevel@tonic-gate 			size = dt_instr_size(&text[i], dtp, pid,
3247c478bd9Sstevel@tonic-gate 			    symp->st_value + i, dmodel);
3257c478bd9Sstevel@tonic-gate 
3267c478bd9Sstevel@tonic-gate 			/*
3277c478bd9Sstevel@tonic-gate 			 * If we hit an invalid instruction, bail as if we
3287c478bd9Sstevel@tonic-gate 			 * couldn't find the offset.
3297c478bd9Sstevel@tonic-gate 			 */
3307c478bd9Sstevel@tonic-gate 			if (size <= 0) {
3317c478bd9Sstevel@tonic-gate 				free(text);
3327c478bd9Sstevel@tonic-gate 				return (DT_PROC_ALIGN);
3337c478bd9Sstevel@tonic-gate 			}
3347c478bd9Sstevel@tonic-gate 		}
3357c478bd9Sstevel@tonic-gate 
3367c478bd9Sstevel@tonic-gate 		free(text);
3377c478bd9Sstevel@tonic-gate 	}
3387c478bd9Sstevel@tonic-gate 
3397c478bd9Sstevel@tonic-gate 	if (ioctl(dtp->dt_ftfd, FASTTRAPIOC_MAKEPROBE, ftp) != 0) {
3407c478bd9Sstevel@tonic-gate 		dt_dprintf("fasttrap probe creation ioctl failed: %s\n",
3417c478bd9Sstevel@tonic-gate 		    strerror(errno));
3427c478bd9Sstevel@tonic-gate 		return (dt_set_errno(dtp, errno));
3437c478bd9Sstevel@tonic-gate 	}
3447c478bd9Sstevel@tonic-gate 
3457c478bd9Sstevel@tonic-gate 	return (ftp->ftps_noffs);
3467c478bd9Sstevel@tonic-gate }
3477c478bd9Sstevel@tonic-gate 
3487c478bd9Sstevel@tonic-gate /*ARGSUSED*/
3497c478bd9Sstevel@tonic-gate int
3507c478bd9Sstevel@tonic-gate dt_pid_create_glob_offset_probes(struct ps_prochandle *P, dtrace_hdl_t *dtp,
3517c478bd9Sstevel@tonic-gate     fasttrap_probe_spec_t *ftp, const GElf_Sym *symp, const char *pattern)
3527c478bd9Sstevel@tonic-gate {
3537c478bd9Sstevel@tonic-gate 	uint8_t *text;
3547c478bd9Sstevel@tonic-gate 	int size;
35596400bb6SJonathan Haslam 	ulong_t i, end = symp->st_size;
3567c478bd9Sstevel@tonic-gate 	pid_t pid = Pstatus(P)->pr_pid;
3577c478bd9Sstevel@tonic-gate 	char dmodel = Pstatus(P)->pr_dmodel;
3587c478bd9Sstevel@tonic-gate 
35996400bb6SJonathan Haslam 	ftp->ftps_type = DTFTP_OFFSETS;
36096400bb6SJonathan Haslam 	ftp->ftps_pc = (uintptr_t)symp->st_value;
36196400bb6SJonathan Haslam 	ftp->ftps_size = (size_t)symp->st_size;
36296400bb6SJonathan Haslam 	ftp->ftps_noffs = 0;
36396400bb6SJonathan Haslam 
3647c478bd9Sstevel@tonic-gate 	if ((text = malloc(symp->st_size)) == NULL) {
3657c478bd9Sstevel@tonic-gate 		dt_dprintf("mr sparkle: malloc() failed\n");
3667c478bd9Sstevel@tonic-gate 		return (DT_PROC_ERR);
3677c478bd9Sstevel@tonic-gate 	}
3687c478bd9Sstevel@tonic-gate 
3697c478bd9Sstevel@tonic-gate 	if (Pread(P, text, symp->st_size, symp->st_value) != symp->st_size) {
3707c478bd9Sstevel@tonic-gate 		dt_dprintf("mr sparkle: Pread() failed\n");
3717c478bd9Sstevel@tonic-gate 		free(text);
3727c478bd9Sstevel@tonic-gate 		return (DT_PROC_ERR);
3737c478bd9Sstevel@tonic-gate 	}
3747c478bd9Sstevel@tonic-gate 
3757c478bd9Sstevel@tonic-gate 	/*
3767c478bd9Sstevel@tonic-gate 	 * We can't instrument offsets in functions with jump tables as
3777c478bd9Sstevel@tonic-gate 	 * we might interpret a jump table offset as an instruction.
3787c478bd9Sstevel@tonic-gate 	 */
3797c478bd9Sstevel@tonic-gate 	if (dt_pid_has_jump_table(P, dtp, text, ftp, symp)) {
3807c478bd9Sstevel@tonic-gate 		free(text);
3817c478bd9Sstevel@tonic-gate 		return (0);
3827c478bd9Sstevel@tonic-gate 	}
3837c478bd9Sstevel@tonic-gate 
3847c478bd9Sstevel@tonic-gate 	if (strcmp("*", pattern) == 0) {
3857c478bd9Sstevel@tonic-gate 		for (i = 0; i < end; i += size) {
3867c478bd9Sstevel@tonic-gate 			ftp->ftps_offs[ftp->ftps_noffs++] = i;
3877c478bd9Sstevel@tonic-gate 
3887c478bd9Sstevel@tonic-gate 			size = dt_instr_size(&text[i], dtp, pid,
3897c478bd9Sstevel@tonic-gate 			    symp->st_value + i, dmodel);
3907c478bd9Sstevel@tonic-gate 
3917c478bd9Sstevel@tonic-gate 			/* bail if we hit an invalid opcode */
3927c478bd9Sstevel@tonic-gate 			if (size <= 0)
3937c478bd9Sstevel@tonic-gate 				break;
3947c478bd9Sstevel@tonic-gate 		}
3957c478bd9Sstevel@tonic-gate 	} else {
3967c478bd9Sstevel@tonic-gate 		char name[sizeof (i) * 2 + 1];
3977c478bd9Sstevel@tonic-gate 
3987c478bd9Sstevel@tonic-gate 		for (i = 0; i < end; i += size) {
3997c478bd9Sstevel@tonic-gate 			(void) snprintf(name, sizeof (name), "%x", i);
4007c478bd9Sstevel@tonic-gate 			if (gmatch(name, pattern))
4017c478bd9Sstevel@tonic-gate 				ftp->ftps_offs[ftp->ftps_noffs++] = i;
4027c478bd9Sstevel@tonic-gate 
4037c478bd9Sstevel@tonic-gate 			size = dt_instr_size(&text[i], dtp, pid,
4047c478bd9Sstevel@tonic-gate 			    symp->st_value + i, dmodel);
4057c478bd9Sstevel@tonic-gate 
4067c478bd9Sstevel@tonic-gate 			/* bail if we hit an invalid opcode */
4077c478bd9Sstevel@tonic-gate 			if (size <= 0)
4087c478bd9Sstevel@tonic-gate 				break;
4097c478bd9Sstevel@tonic-gate 		}
4107c478bd9Sstevel@tonic-gate 	}
4117c478bd9Sstevel@tonic-gate 
4127c478bd9Sstevel@tonic-gate 	free(text);
4137c478bd9Sstevel@tonic-gate 	if (ftp->ftps_noffs > 0) {
4147c478bd9Sstevel@tonic-gate 		if (ioctl(dtp->dt_ftfd, FASTTRAPIOC_MAKEPROBE, ftp) != 0) {
4157c478bd9Sstevel@tonic-gate 			dt_dprintf("fasttrap probe creation ioctl failed: %s\n",
4167c478bd9Sstevel@tonic-gate 			    strerror(errno));
4177c478bd9Sstevel@tonic-gate 			return (dt_set_errno(dtp, errno));
4187c478bd9Sstevel@tonic-gate 		}
4197c478bd9Sstevel@tonic-gate 	}
4207c478bd9Sstevel@tonic-gate 
4217c478bd9Sstevel@tonic-gate 	return (ftp->ftps_noffs);
4227c478bd9Sstevel@tonic-gate }
4237c478bd9Sstevel@tonic-gate 
4247c478bd9Sstevel@tonic-gate typedef struct dtrace_dis {
4257c478bd9Sstevel@tonic-gate 	uchar_t	*instr;
4267c478bd9Sstevel@tonic-gate 	dtrace_hdl_t *dtp;
4277c478bd9Sstevel@tonic-gate 	pid_t pid;
4287c478bd9Sstevel@tonic-gate 	uintptr_t addr;
4297c478bd9Sstevel@tonic-gate } dtrace_dis_t;
4307c478bd9Sstevel@tonic-gate 
4317c478bd9Sstevel@tonic-gate static int
4327c478bd9Sstevel@tonic-gate dt_getbyte(void *data)
4337c478bd9Sstevel@tonic-gate {
4347c478bd9Sstevel@tonic-gate 	dtrace_dis_t	*dis = data;
4357c478bd9Sstevel@tonic-gate 	int ret = *dis->instr;
4367c478bd9Sstevel@tonic-gate 
4377c478bd9Sstevel@tonic-gate 	if (ret == FASTTRAP_INSTR) {
4387c478bd9Sstevel@tonic-gate 		fasttrap_instr_query_t instr;
4397c478bd9Sstevel@tonic-gate 
4407c478bd9Sstevel@tonic-gate 		instr.ftiq_pid = dis->pid;
4417c478bd9Sstevel@tonic-gate 		instr.ftiq_pc = dis->addr;
4427c478bd9Sstevel@tonic-gate 
4437c478bd9Sstevel@tonic-gate 		/*
4447c478bd9Sstevel@tonic-gate 		 * If we hit a byte that looks like the fasttrap provider's
4457c478bd9Sstevel@tonic-gate 		 * trap instruction (which doubles as the breakpoint
4467c478bd9Sstevel@tonic-gate 		 * instruction for debuggers) we need to query the kernel
4477c478bd9Sstevel@tonic-gate 		 * for the real value. This may just be part of an immediate
4487c478bd9Sstevel@tonic-gate 		 * value so there's no need to return an error if the
4497c478bd9Sstevel@tonic-gate 		 * kernel doesn't know about this address.
4507c478bd9Sstevel@tonic-gate 		 */
4517c478bd9Sstevel@tonic-gate 		if (ioctl(dis->dtp->dt_ftfd, FASTTRAPIOC_GETINSTR, &instr) == 0)
4527c478bd9Sstevel@tonic-gate 			ret = instr.ftiq_instr;
4537c478bd9Sstevel@tonic-gate 	}
4547c478bd9Sstevel@tonic-gate 
4557c478bd9Sstevel@tonic-gate 	dis->addr++;
4567c478bd9Sstevel@tonic-gate 	dis->instr++;
4577c478bd9Sstevel@tonic-gate 
4587c478bd9Sstevel@tonic-gate 	return (ret);
4597c478bd9Sstevel@tonic-gate }
4607c478bd9Sstevel@tonic-gate 
4617c478bd9Sstevel@tonic-gate static int
4627c478bd9Sstevel@tonic-gate dt_instr_size(uchar_t *instr, dtrace_hdl_t *dtp, pid_t pid, uintptr_t addr,
4637c478bd9Sstevel@tonic-gate     char dmodel)
4647c478bd9Sstevel@tonic-gate {
4657c478bd9Sstevel@tonic-gate 	dtrace_dis_t data;
4667c478bd9Sstevel@tonic-gate 	dis86_t x86dis;
4677c478bd9Sstevel@tonic-gate 	uint_t cpu_mode;
4687c478bd9Sstevel@tonic-gate 
4697c478bd9Sstevel@tonic-gate 	data.instr = instr;
4707c478bd9Sstevel@tonic-gate 	data.dtp = dtp;
4717c478bd9Sstevel@tonic-gate 	data.pid = pid;
4727c478bd9Sstevel@tonic-gate 	data.addr = addr;
4737c478bd9Sstevel@tonic-gate 
4747c478bd9Sstevel@tonic-gate 	x86dis.d86_data = &data;
4757c478bd9Sstevel@tonic-gate 	x86dis.d86_get_byte = dt_getbyte;
4767c478bd9Sstevel@tonic-gate 	x86dis.d86_check_func = NULL;
4777c478bd9Sstevel@tonic-gate 
4787c478bd9Sstevel@tonic-gate 	cpu_mode = (dmodel == PR_MODEL_ILP32) ? SIZE32 : SIZE64;
4797c478bd9Sstevel@tonic-gate 
4807c478bd9Sstevel@tonic-gate 	if (dtrace_disx86(&x86dis, cpu_mode) != 0)
4817c478bd9Sstevel@tonic-gate 		return (-1);
4827c478bd9Sstevel@tonic-gate 
4837c478bd9Sstevel@tonic-gate 	/*
4847c478bd9Sstevel@tonic-gate 	 * If the instruction was a single-byte breakpoint, there may be
4857c478bd9Sstevel@tonic-gate 	 * another debugger attached to this process. The original instruction
4867c478bd9Sstevel@tonic-gate 	 * can't be recovered so this must fail.
4877c478bd9Sstevel@tonic-gate 	 */
488*e5803b76SAdam H. Leventhal 	if (x86dis.d86_len == 1 &&
489*e5803b76SAdam H. Leventhal 	    (uchar_t)x86dis.d86_bytes[0] == FASTTRAP_INSTR)
4907c478bd9Sstevel@tonic-gate 		return (-1);
4917c478bd9Sstevel@tonic-gate 
4927c478bd9Sstevel@tonic-gate 	return (x86dis.d86_len);
4937c478bd9Sstevel@tonic-gate }
494