diff --git a/sys/cddl/dev/fbt/x86/fbt_isa.c b/sys/cddl/dev/fbt/x86/fbt_isa.c index 05ec87ab437f..b05ae4cb2c44 100644 --- a/sys/cddl/dev/fbt/x86/fbt_isa.c +++ b/sys/cddl/dev/fbt/x86/fbt_isa.c @@ -1,356 +1,364 @@ /* * CDDL HEADER START * * The contents of this file are subject to the terms of the * Common Development and Distribution License (the "License"). * You may not use this file except in compliance with the License. * * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE * or http://www.opensolaris.org/os/licensing. * See the License for the specific language governing permissions * and limitations under the License. * * When distributing Covered Code, include this CDDL HEADER in each * file and include the License file at usr/src/OPENSOLARIS.LICENSE. * If applicable, add the following below this CDDL HEADER, with the * fields enclosed by brackets "[]" replaced with your own identifying * information: Portions Copyright [yyyy] [name of copyright owner] * * CDDL HEADER END * * Portions Copyright 2006-2008 John Birrell jb@freebsd.org * * $FreeBSD$ * */ /* * Copyright 2006 Sun Microsystems, Inc. All rights reserved. * Use is subject to license terms. */ #include #include #include #include #include #include "fbt.h" #define FBT_PUSHL_EBP 0x55 #define FBT_MOVL_ESP_EBP0_V0 0x8b #define FBT_MOVL_ESP_EBP1_V0 0xec #define FBT_MOVL_ESP_EBP0_V1 0x89 #define FBT_MOVL_ESP_EBP1_V1 0xe5 #define FBT_REX_RSP_RBP 0x48 #define FBT_POPL_EBP 0x5d #define FBT_RET 0xc3 #define FBT_RET_IMM16 0xc2 #define FBT_LEAVE 0xc9 #ifdef __amd64__ #define FBT_PATCHVAL 0xcc #else #define FBT_PATCHVAL 0xf0 #endif #define FBT_ENTRY "entry" #define FBT_RETURN "return" int fbt_invop(uintptr_t addr, struct trapframe *frame, uintptr_t scratch __unused) { solaris_cpu_t *cpu; uintptr_t *stack; uintptr_t arg0, arg1, arg2, arg3, arg4, rval; fbt_probe_t *fbt; int8_t fbtrval; #ifdef __amd64__ stack = (uintptr_t *)frame->tf_rsp; rval = frame->tf_rax; #else /* Skip hardware-saved registers. */ stack = (uintptr_t *)frame->tf_isp + 3; rval = frame->tf_eax; #endif cpu = &solaris_cpu[curcpu]; fbt = fbt_probetab[FBT_ADDR2NDX(addr)]; for (; fbt != NULL; fbt = fbt->fbtp_hashnext) { if ((uintptr_t)fbt->fbtp_patchpoint != addr) continue; fbtrval = fbt->fbtp_rval; + + /* + * Report the address of the breakpoint for the benefit + * of consumers fetching register values with regs[]. + */ + frame->tf_rip--; for (; fbt != NULL; fbt = fbt->fbtp_tracenext) { ASSERT(fbt->fbtp_rval == fbtrval); if (fbt->fbtp_roffset == 0) { #ifdef __amd64__ /* fbt->fbtp_rval == DTRACE_INVOP_PUSHQ_RBP */ DTRACE_CPUFLAG_SET(CPU_DTRACE_NOFAULT); cpu->cpu_dtrace_caller = stack[0]; DTRACE_CPUFLAG_CLEAR(CPU_DTRACE_NOFAULT | CPU_DTRACE_BADADDR); arg0 = frame->tf_rdi; arg1 = frame->tf_rsi; arg2 = frame->tf_rdx; arg3 = frame->tf_rcx; arg4 = frame->tf_r8; #else int i = 0; /* * When accessing the arguments on the stack, * we must protect against accessing beyond * the stack. We can safely set NOFAULT here * -- we know that interrupts are already * disabled. */ DTRACE_CPUFLAG_SET(CPU_DTRACE_NOFAULT); cpu->cpu_dtrace_caller = stack[i++]; arg0 = stack[i++]; arg1 = stack[i++]; arg2 = stack[i++]; arg3 = stack[i++]; arg4 = stack[i++]; DTRACE_CPUFLAG_CLEAR(CPU_DTRACE_NOFAULT | CPU_DTRACE_BADADDR); #endif dtrace_probe(fbt->fbtp_id, arg0, arg1, arg2, arg3, arg4); cpu->cpu_dtrace_caller = 0; } else { #ifdef __amd64__ /* * On amd64, we instrument the ret, not the * leave. We therefore need to set the caller * to ensure that the top frame of a stack() * action is correct. */ DTRACE_CPUFLAG_SET(CPU_DTRACE_NOFAULT); cpu->cpu_dtrace_caller = stack[0]; DTRACE_CPUFLAG_CLEAR(CPU_DTRACE_NOFAULT | CPU_DTRACE_BADADDR); #endif dtrace_probe(fbt->fbtp_id, fbt->fbtp_roffset, rval, 0, 0, 0); cpu->cpu_dtrace_caller = 0; } } + /* Advance to the instruction following the breakpoint. */ + frame->tf_rip++; return (fbtrval); } return (0); } void fbt_patch_tracepoint(fbt_probe_t *fbt, fbt_patchval_t val) { register_t intr; bool old_wp; intr = intr_disable(); old_wp = disable_wp(); *fbt->fbtp_patchpoint = val; restore_wp(old_wp); intr_restore(intr); } int fbt_provide_module_function(linker_file_t lf, int symindx, linker_symval_t *symval, void *opaque) { char *modname = opaque; const char *name = symval->name; fbt_probe_t *fbt, *hash, *retfbt; int j; int size; uint8_t *instr, *limit; if (fbt_excluded(name)) return (0); /* * trap_check() is a wrapper for DTrace's fault handler, so we don't * want to be able to instrument it. */ if (strcmp(name, "trap_check") == 0) return (0); size = symval->size; instr = (uint8_t *) symval->value; limit = (uint8_t *) symval->value + symval->size; #ifdef __amd64__ while (instr < limit) { if (*instr == FBT_PUSHL_EBP) break; if ((size = dtrace_instr_size(instr)) <= 0) break; instr += size; } if (instr >= limit || *instr != FBT_PUSHL_EBP) { /* * We either don't save the frame pointer in this * function, or we ran into some disassembly * screw-up. Either way, we bail. */ return (0); } #else if (instr[0] != FBT_PUSHL_EBP) return (0); if (!(instr[1] == FBT_MOVL_ESP_EBP0_V0 && instr[2] == FBT_MOVL_ESP_EBP1_V0) && !(instr[1] == FBT_MOVL_ESP_EBP0_V1 && instr[2] == FBT_MOVL_ESP_EBP1_V1)) return (0); #endif fbt = malloc(sizeof (fbt_probe_t), M_FBT, M_WAITOK | M_ZERO); fbt->fbtp_name = name; fbt->fbtp_id = dtrace_probe_create(fbt_id, modname, name, FBT_ENTRY, 3, fbt); fbt->fbtp_patchpoint = instr; fbt->fbtp_ctl = lf; fbt->fbtp_loadcnt = lf->loadcnt; fbt->fbtp_rval = DTRACE_INVOP_PUSHL_EBP; fbt->fbtp_savedval = *instr; fbt->fbtp_patchval = FBT_PATCHVAL; fbt->fbtp_symindx = symindx; for (hash = fbt_probetab[FBT_ADDR2NDX(instr)]; hash != NULL; hash = hash->fbtp_hashnext) { if (hash->fbtp_patchpoint == fbt->fbtp_patchpoint) { fbt->fbtp_tracenext = hash->fbtp_tracenext; hash->fbtp_tracenext = fbt; break; } } if (hash == NULL) { fbt->fbtp_hashnext = fbt_probetab[FBT_ADDR2NDX(instr)]; fbt_probetab[FBT_ADDR2NDX(instr)] = fbt; } lf->fbt_nentries++; retfbt = NULL; again: if (instr >= limit) return (0); /* * If this disassembly fails, then we've likely walked off into * a jump table or some other unsuitable area. Bail out of the * disassembly now. */ if ((size = dtrace_instr_size(instr)) <= 0) return (0); #ifdef __amd64__ /* * We only instrument "ret" on amd64 -- we don't yet instrument * ret imm16, largely because the compiler doesn't seem to * (yet) emit them in the kernel... */ if (*instr != FBT_RET) { instr += size; goto again; } #else if (!(size == 1 && (*instr == FBT_POPL_EBP || *instr == FBT_LEAVE) && (*(instr + 1) == FBT_RET || *(instr + 1) == FBT_RET_IMM16))) { instr += size; goto again; } #endif /* * We (desperately) want to avoid erroneously instrumenting a * jump table, especially given that our markers are pretty * short: two bytes on x86, and just one byte on amd64. To * determine if we're looking at a true instruction sequence * or an inline jump table that happens to contain the same * byte sequences, we resort to some heuristic sleeze: we * treat this instruction as being contained within a pointer, * and see if that pointer points to within the body of the * function. If it does, we refuse to instrument it. */ for (j = 0; j < sizeof (uintptr_t); j++) { caddr_t check = (caddr_t) instr - j; uint8_t *ptr; if (check < symval->value) break; if (check + sizeof (caddr_t) > (caddr_t)limit) continue; ptr = *(uint8_t **)check; if (ptr >= (uint8_t *) symval->value && ptr < limit) { instr += size; goto again; } } /* * We have a winner! */ fbt = malloc(sizeof (fbt_probe_t), M_FBT, M_WAITOK | M_ZERO); fbt->fbtp_name = name; if (retfbt == NULL) { fbt->fbtp_id = dtrace_probe_create(fbt_id, modname, name, FBT_RETURN, 3, fbt); } else { retfbt->fbtp_probenext = fbt; fbt->fbtp_id = retfbt->fbtp_id; } retfbt = fbt; fbt->fbtp_patchpoint = instr; fbt->fbtp_ctl = lf; fbt->fbtp_loadcnt = lf->loadcnt; fbt->fbtp_symindx = symindx; #ifndef __amd64__ if (*instr == FBT_POPL_EBP) { fbt->fbtp_rval = DTRACE_INVOP_POPL_EBP; } else { ASSERT(*instr == FBT_LEAVE); fbt->fbtp_rval = DTRACE_INVOP_LEAVE; } fbt->fbtp_roffset = (uintptr_t)(instr - (uint8_t *) symval->value) + 1; #else ASSERT(*instr == FBT_RET); fbt->fbtp_rval = DTRACE_INVOP_RET; fbt->fbtp_roffset = (uintptr_t)(instr - (uint8_t *) symval->value); #endif fbt->fbtp_savedval = *instr; fbt->fbtp_patchval = FBT_PATCHVAL; fbt->fbtp_hashnext = fbt_probetab[FBT_ADDR2NDX(instr)]; fbt_probetab[FBT_ADDR2NDX(instr)] = fbt; lf->fbt_nentries++; instr += size; goto again; } diff --git a/sys/cddl/dev/kinst/amd64/kinst_isa.c b/sys/cddl/dev/kinst/amd64/kinst_isa.c index 6d8d5d521617..e47cfbbf4d4e 100644 --- a/sys/cddl/dev/kinst/amd64/kinst_isa.c +++ b/sys/cddl/dev/kinst/amd64/kinst_isa.c @@ -1,550 +1,556 @@ /* * SPDX-License-Identifier: CDDL 1.0 * * Copyright 2022 Christos Margiolis * Copyright 2022 Mark Johnston */ #include #include #include #include #include #include #include "kinst.h" #define KINST_PUSHL_RBP 0x55 #define KINST_STI 0xfb #define KINST_POPF 0x9d #define KINST_MODRM_MOD(b) (((b) & 0xc0) >> 6) #define KINST_MODRM_REG(b) (((b) & 0x38) >> 3) #define KINST_MODRM_RM(b) ((b) & 0x07) #define KINST_SIB_SCALE(s) (((s) & 0xc0) >> 6) #define KINST_SIB_INDEX(s) (((s) & 0x38) >> 3) #define KINST_SIB_BASE(s) (((s) & 0x07) >> 0) #define KINST_REX_W(r) (((r) & 0x08) >> 3) #define KINST_REX_R(r) (((r) & 0x04) >> 2) #define KINST_REX_X(r) (((r) & 0x02) >> 1) #define KINST_REX_B(r) (((r) & 0x01) >> 0) #define KINST_F_CALL 0x0001 /* instruction is a "call" */ #define KINST_F_DIRECT_CALL 0x0002 /* instruction is a direct call */ #define KINST_F_RIPREL 0x0004 /* instruction is position-dependent */ #define KINST_F_JMP 0x0008 /* instruction is a %rip-relative jmp */ #define KINST_F_MOD_DIRECT 0x0010 /* operand is not a memory address */ /* * Map ModR/M register bits to a trapframe offset. */ static int kinst_regoff(int reg) { #define _MATCH_REG(i, reg) \ case i: \ return (offsetof(struct trapframe, tf_ ## reg) / \ sizeof(register_t)) switch (reg) { _MATCH_REG( 0, rax); _MATCH_REG( 1, rcx); _MATCH_REG( 2, rdx); _MATCH_REG( 3, rbx); _MATCH_REG( 4, rsp); /* SIB when mod != 3 */ _MATCH_REG( 5, rbp); _MATCH_REG( 6, rsi); _MATCH_REG( 7, rdi); _MATCH_REG( 8, r8); /* REX.R is set */ _MATCH_REG( 9, r9); _MATCH_REG(10, r10); _MATCH_REG(11, r11); _MATCH_REG(12, r12); _MATCH_REG(13, r13); _MATCH_REG(14, r14); _MATCH_REG(15, r15); } #undef _MATCH_REG panic("%s: unhandled register index %d", __func__, reg); } /* * Obtain the specified register's value. */ static uint64_t kinst_regval(struct trapframe *frame, int reg) { if (reg == -1) return (0); return (((register_t *)frame)[kinst_regoff(reg)]); } static uint32_t kinst_riprel_disp(struct kinst_probe *kp, void *dst) { return ((uint32_t)((intptr_t)kp->kp_patchpoint + kp->kp_md.disp - (intptr_t)dst)); } static void kinst_trampoline_populate(struct kinst_probe *kp, uint8_t *tramp) { uint8_t *instr; uint32_t disp; int ilen; ilen = kp->kp_md.tinstlen; memcpy(tramp, kp->kp_md.template, ilen); if ((kp->kp_md.flags & KINST_F_RIPREL) != 0) { disp = kinst_riprel_disp(kp, tramp); memcpy(&tramp[kp->kp_md.dispoff], &disp, sizeof(uint32_t)); } /* * The following position-independent jmp takes us back to the * original code. It is encoded as "jmp *0(%rip)" (six bytes), * followed by the absolute address of the instruction following * the one that was traced (eight bytes). */ tramp[ilen + 0] = 0xff; tramp[ilen + 1] = 0x25; tramp[ilen + 2] = 0x00; tramp[ilen + 3] = 0x00; tramp[ilen + 4] = 0x00; tramp[ilen + 5] = 0x00; instr = kp->kp_patchpoint + kp->kp_md.instlen; memcpy(&tramp[ilen + 6], &instr, sizeof(uintptr_t)); } int kinst_invop(uintptr_t addr, struct trapframe *frame, uintptr_t scratch) { solaris_cpu_t *cpu; uintptr_t *stack, retaddr; struct kinst_probe *kp; struct kinst_probe_md *kpmd; uint8_t *tramp; stack = (uintptr_t *)frame->tf_rsp; cpu = &solaris_cpu[curcpu]; LIST_FOREACH(kp, KINST_GETPROBE(addr), kp_hashnext) { if ((uintptr_t)kp->kp_patchpoint == addr) break; } if (kp == NULL) return (0); + /* + * Report the address of the breakpoint for the benefit of consumers + * fetching register values with regs[]. + */ + frame->tf_rip--; + DTRACE_CPUFLAG_SET(CPU_DTRACE_NOFAULT); cpu->cpu_dtrace_caller = stack[0]; DTRACE_CPUFLAG_CLEAR(CPU_DTRACE_NOFAULT | CPU_DTRACE_BADADDR); dtrace_probe(kp->kp_id, 0, 0, 0, 0, 0); cpu->cpu_dtrace_caller = 0; kpmd = &kp->kp_md; if ((kpmd->flags & KINST_F_CALL) != 0) { /* * dtrace_invop_start() reserves space on the stack to * store the return address of the call instruction. */ retaddr = (uintptr_t)(kp->kp_patchpoint + kpmd->instlen); *(uintptr_t *)scratch = retaddr; if ((kpmd->flags & KINST_F_DIRECT_CALL) != 0) { frame->tf_rip = (uintptr_t)(kp->kp_patchpoint + kpmd->disp + kpmd->instlen); } else { register_t rval; if (kpmd->reg1 == -1 && kpmd->reg2 == -1) { /* rip-relative */ - rval = frame->tf_rip - 1 + kpmd->instlen; + rval = frame->tf_rip + kpmd->instlen; } else { /* indirect */ rval = kinst_regval(frame, kpmd->reg1) + (kinst_regval(frame, kpmd->reg2) << kpmd->scale); } if ((kpmd->flags & KINST_F_MOD_DIRECT) != 0) { frame->tf_rip = rval + kpmd->disp; } else { frame->tf_rip = *(uintptr_t *)(rval + kpmd->disp); } } return (DTRACE_INVOP_CALL); } else { tramp = curthread->t_kinst; if (tramp == NULL) { /* * A trampoline allocation failed, so this probe is * effectively disabled. Restore the original * instruction. * * We can't safely print anything here, but the * trampoline allocator should have left a breadcrumb in * the dmesg. */ kinst_patch_tracepoint(kp, kp->kp_savedval); frame->tf_rip = (register_t)kp->kp_patchpoint; } else { kinst_trampoline_populate(kp, tramp); frame->tf_rip = (register_t)tramp; } return (DTRACE_INVOP_NOP); } } void kinst_patch_tracepoint(struct kinst_probe *kp, kinst_patchval_t val) { register_t reg; int oldwp; reg = intr_disable(); oldwp = disable_wp(); *kp->kp_patchpoint = val; restore_wp(oldwp); intr_restore(reg); } static void kinst_set_disp8(struct kinst_probe *kp, uint8_t byte) { kp->kp_md.disp = (int64_t)(int8_t)byte; } static void kinst_set_disp32(struct kinst_probe *kp, uint8_t *bytes) { int32_t disp32; memcpy(&disp32, bytes, sizeof(disp32)); kp->kp_md.disp = (int64_t)disp32; } static int kinst_dis_get_byte(void *p) { int ret; uint8_t **instr = p; ret = **instr; (*instr)++; return (ret); } /* * Set up all of the state needed to faithfully execute a probed instruction. * * In the simple case, we copy the instruction unmodified to a per-thread * trampoline, wherein it is followed by a jump back to the original code. * - Instructions can have %rip as an operand: * - with %rip-relative addressing encoded in ModR/M, or * - implicitly as a part of the instruction definition (jmp, call). * - Call instructions (which may be %rip-relative) need to push the correct * return address onto the stack. * * Call instructions are simple enough to be emulated in software, so we simply * do not use the trampoline mechanism in that case. kinst_invop() will compute * the branch target using the address info computed here (register operands and * displacement). * * %rip-relative operands encoded using the ModR/M byte always use a 32-bit * displacement; when populating the trampoline the displacement is adjusted to * be relative to the trampoline address. Trampolines are always allocated * above KERNBASE for this reason. * * For other %rip-relative operands (just jumps) we take the same approach. * Instructions which specify an 8-bit displacement must be rewritten to use a * 32-bit displacement. */ static int kinst_instr_dissect(struct kinst_probe *kp, uint8_t **instr) { struct kinst_probe_md *kpmd; dis86_t d86; uint8_t *bytes, modrm, rex; int dispoff, i, ilen, opcidx; kpmd = &kp->kp_md; d86.d86_data = instr; d86.d86_get_byte = kinst_dis_get_byte; d86.d86_check_func = NULL; if (dtrace_disx86(&d86, SIZE64) != 0) { KINST_LOG("failed to disassemble instruction at: %p", *instr); return (EINVAL); } bytes = d86.d86_bytes; kpmd->instlen = kpmd->tinstlen = d86.d86_len; /* * Skip over prefixes, save REX. */ rex = 0; for (i = 0; i < kpmd->instlen; i++) { switch (bytes[i]) { case 0xf0 ... 0xf3: /* group 1 */ continue; case 0x26: case 0x2e: case 0x36: case 0x3e: case 0x64: case 0x65: /* group 2 */ continue; case 0x66: /* group 3 */ continue; case 0x67: /* group 4 */ continue; case 0x40 ... 0x4f: /* REX */ rex = bytes[i]; continue; } break; } KASSERT(i < kpmd->instlen, ("%s: failed to disassemble instruction at %p", __func__, bytes)); opcidx = i; /* * Identify instructions of interest by opcode: calls and jumps. * Extract displacements. */ dispoff = -1; switch (bytes[opcidx]) { case 0x0f: switch (bytes[opcidx + 1]) { case 0x80 ... 0x8f: /* conditional jmp near */ kpmd->flags |= KINST_F_JMP | KINST_F_RIPREL; dispoff = opcidx + 2; kinst_set_disp32(kp, &bytes[dispoff]); break; } break; case 0xe3: /* * There is no straightforward way to translate this instruction * to use a 32-bit displacement. Fortunately, it is rarely * used. */ return (EINVAL); case 0x70 ... 0x7f: /* conditional jmp short */ kpmd->flags |= KINST_F_JMP | KINST_F_RIPREL; dispoff = opcidx + 1; kinst_set_disp8(kp, bytes[dispoff]); break; case 0xe9: /* unconditional jmp near */ kpmd->flags |= KINST_F_JMP | KINST_F_RIPREL; dispoff = opcidx + 1; kinst_set_disp32(kp, &bytes[dispoff]); break; case 0xeb: /* unconditional jmp short */ kpmd->flags |= KINST_F_JMP | KINST_F_RIPREL; dispoff = opcidx + 1; kinst_set_disp8(kp, bytes[dispoff]); break; case 0xe8: case 0x9a: /* direct call */ kpmd->flags |= KINST_F_CALL | KINST_F_DIRECT_CALL; dispoff = opcidx + 1; kinst_set_disp32(kp, &bytes[dispoff]); break; case 0xff: KASSERT(d86.d86_got_modrm, ("no ModR/M byte for instr at %p", *instr - kpmd->instlen)); switch (KINST_MODRM_REG(bytes[d86.d86_rmindex])) { case 0x02: case 0x03: /* indirect call */ kpmd->flags |= KINST_F_CALL; break; case 0x04: case 0x05: /* indirect jump */ kpmd->flags |= KINST_F_JMP; break; } } /* * If there's a ModR/M byte, we need to check it to see if the operand * is %rip-relative, and rewrite the displacement if so. If not, we * might still have to extract operand info if this is a call * instruction. */ if (d86.d86_got_modrm) { uint8_t mod, rm, sib; kpmd->reg1 = kpmd->reg2 = -1; modrm = bytes[d86.d86_rmindex]; mod = KINST_MODRM_MOD(modrm); rm = KINST_MODRM_RM(modrm); if (mod == 0 && rm == 5) { kpmd->flags |= KINST_F_RIPREL; dispoff = d86.d86_rmindex + 1; kinst_set_disp32(kp, &bytes[dispoff]); } else if ((kpmd->flags & KINST_F_CALL) != 0) { bool havesib; havesib = (mod != 3 && rm == 4); dispoff = d86.d86_rmindex + (havesib ? 2 : 1); if (mod == 1) kinst_set_disp8(kp, bytes[dispoff]); else if (mod == 2) kinst_set_disp32(kp, &bytes[dispoff]); else if (mod == 3) kpmd->flags |= KINST_F_MOD_DIRECT; if (havesib) { sib = bytes[d86.d86_rmindex + 1]; if (KINST_SIB_BASE(sib) != 5) { kpmd->reg1 = KINST_SIB_BASE(sib) | (KINST_REX_B(rex) << 3); } kpmd->scale = KINST_SIB_SCALE(sib); kpmd->reg2 = KINST_SIB_INDEX(sib) | (KINST_REX_X(rex) << 3); } else { kpmd->reg1 = rm | (KINST_REX_B(rex) << 3); } } } /* * Calls are emulated in software; once operands are decoded we have * nothing else to do. */ if ((kpmd->flags & KINST_F_CALL) != 0) return (0); /* * Allocate and populate an instruction trampoline template. * * Position-independent instructions can simply be copied, but * position-dependent instructions require some surgery: jump * instructions with an 8-bit displacement need to be converted to use a * 32-bit displacement, and the adjusted displacement needs to be * computed. */ ilen = kpmd->instlen; if ((kpmd->flags & KINST_F_RIPREL) != 0) { if ((kpmd->flags & KINST_F_JMP) == 0 || bytes[opcidx] == 0x0f || bytes[opcidx] == 0xe9 || bytes[opcidx] == 0xff) { memcpy(kpmd->template, bytes, dispoff); memcpy(&kpmd->template[dispoff + 4], &bytes[dispoff + 4], ilen - (dispoff + 4)); kpmd->dispoff = dispoff; } else if (bytes[opcidx] == 0xeb) { memcpy(kpmd->template, bytes, opcidx); kpmd->template[opcidx] = 0xe9; kpmd->dispoff = opcidx + 1; /* Instruction length changes from 2 to 5. */ kpmd->tinstlen = 5; kpmd->disp -= 3; } else if (bytes[opcidx] >= 0x70 && bytes[opcidx] <= 0x7f) { memcpy(kpmd->template, bytes, opcidx); kpmd->template[opcidx] = 0x0f; kpmd->template[opcidx + 1] = bytes[opcidx] + 0x10; kpmd->dispoff = opcidx + 2; /* Instruction length changes from 2 to 6. */ kpmd->tinstlen = 6; kpmd->disp -= 4; } else { panic("unhandled opcode %#x", bytes[opcidx]); } } else { memcpy(kpmd->template, bytes, ilen); } return (0); } int kinst_make_probe(linker_file_t lf, int symindx, linker_symval_t *symval, void *opaque) { struct kinst_probe *kp; dtrace_kinst_probedesc_t *pd; const char *func; int error, n, off; uint8_t *instr, *limit; pd = opaque; func = symval->name; if (strcmp(func, pd->kpd_func) != 0 || strcmp(func, "trap_check") == 0) return (0); instr = (uint8_t *)symval->value; limit = (uint8_t *)symval->value + symval->size; if (instr >= limit) return (0); /* * Ignore functions not beginning with the usual function prologue. * These might correspond to assembly routines with which we should not * meddle. */ if (*instr != KINST_PUSHL_RBP) return (0); n = 0; while (instr < limit) { off = (int)(instr - (uint8_t *)symval->value); if (pd->kpd_off != -1 && off != pd->kpd_off) { instr += dtrace_instr_size(instr); continue; } /* * Prevent separate dtrace(1) instances from creating copies of * the same probe. */ LIST_FOREACH(kp, KINST_GETPROBE(instr), kp_hashnext) { if (strcmp(kp->kp_func, func) == 0 && strtol(kp->kp_name, NULL, 10) == off) return (0); } if (++n > KINST_PROBETAB_MAX) { KINST_LOG("probe list full: %d entries", n); return (ENOMEM); } kp = malloc(sizeof(struct kinst_probe), M_KINST, M_WAITOK | M_ZERO); kp->kp_func = func; snprintf(kp->kp_name, sizeof(kp->kp_name), "%d", off); kp->kp_savedval = *instr; kp->kp_patchval = KINST_PATCHVAL; kp->kp_patchpoint = instr; error = kinst_instr_dissect(kp, &instr); if (error != 0) return (error); kinst_probe_create(kp, lf); } return (0); }