util/statetrace/arch/amd64/tracechild.cc

   1 /*
   2  * Copyright (c) 2007 The Regents of The University of Michigan
   3  * All rights reserved.
   4  *
   5  * Redistribution and use in source and binary forms, with or without
   6  * modification, are permitted provided that the following conditions are
   7  * met: redistributions of source code must retain the above copyright
   8  * notice, this list of conditions and the following disclaimer;
   9  * redistributions in binary form must reproduce the above copyright
  10  * notice, this list of conditions and the following disclaimer in the
  11  * documentation and/or other materials provided with the distribution;
  12  * neither the name of the copyright holders nor the names of its
  13  * contributors may be used to endorse or promote products derived from
  14  * this software without specific prior written permission.
  15  *
  16  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  17  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  18  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
  19  * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
  20  * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
  21  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
  22  * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
  23  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
  24  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  25  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
  26  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  27  *
  28  * Authors: Gabe Black
  29  */
  30
  31 #include <iostream>
  32 #include <iomanip>
  33 #include <errno.h>
  34 #include <sys/ptrace.h>
  35 #include <stdint.h>
  36 #include <string.h>
  37
  38 #include "arch/amd64/tracechild.hh"
  39
  40 using namespace std;
  41
  42 bool
  43 AMD64TraceChild::sendState(int socket)
  44 {
  45     uint64_t regVal64 = 0;
  46     uint32_t regVal32 = 0;
  47     for (int x = 0; x <= R15; x++) {
  48         regVal64 = getRegVal(x);
  49         if (write(socket, &regVal64, sizeof(regVal64)) == -1) {
  50             cerr << "Write failed! " << strerror(errno) << endl;
  51             tracing = false;
  52             return false;
  53         }
  54     }
  55     regVal64 = getRegVal(RIP);
  56     if (write(socket, &regVal64, sizeof(regVal64)) == -1) {
  57         cerr << "Write failed! " << strerror(errno) << endl;
  58         tracing = false;
  59         return false;
  60     }
  61     for (int x = MMX0_0; x <= MMX7_1; x++) {
  62         regVal32 = getRegVal(x);
  63         if (write(socket, &regVal32, sizeof(regVal32)) == -1) {
  64             cerr << "Write failed! " << strerror(errno) << endl;
  65             tracing = false;
  66             return false;
  67         }
  68     }
  69     for (int x = XMM0_0; x <= XMM15_3; x++) {
  70         regVal32 = getRegVal(x);
  71         if (write(socket, &regVal32, sizeof(regVal32)) == -1) {
  72             cerr << "Write failed! " << strerror(errno) << endl;
  73             tracing = false;
  74             return false;
  75         }
  76     }
  77     return true;
  78 }
  79
  80 int64_t
  81 AMD64TraceChild::getRegs(user_regs_struct & myregs,
  82         user_fpregs_struct & myfpregs, int num)
  83 {
  84     assert(num < numregs && num >= 0);
  85     switch (num) {
  86       //GPRs
  87       case RAX: return myregs.rax;
  88       case RBX: return myregs.rbx;
  89       case RCX: return myregs.rcx;
  90       case RDX: return myregs.rdx;
  91       //Index registers
  92       case RSI: return myregs.rsi;
  93       case RDI: return myregs.rdi;
  94       //Base pointer and stack pointer
  95       case RBP: return myregs.rbp;
  96       case RSP: return myregs.rsp;
  97       //New 64 bit mode registers
  98       case R8: return myregs.r8;
  99       case R9: return myregs.r9;
 100       case R10: return myregs.r10;
 101       case R11: return myregs.r11;
 102       case R12: return myregs.r12;
 103       case R13: return myregs.r13;
 104       case R14: return myregs.r14;
 105       case R15: return myregs.r15;
 106       //Segmentation registers
 107       case CS: return myregs.cs;
 108       case DS: return myregs.ds;
 109       case ES: return myregs.es;
 110       case FS: return myregs.fs;
 111       case GS: return myregs.gs;
 112       case SS: return myregs.ss;
 113       case FS_BASE: return myregs.fs_base;
 114       case GS_BASE: return myregs.gs_base;
 115       //PC
 116       case RIP: return myregs.rip;
 117       //Flags
 118       case EFLAGS: return myregs.eflags;
 119       //MMX
 120       case MMX0_0: return myfpregs.st_space[0];
 121       case MMX0_1: return myfpregs.st_space[1];
 122       case MMX1_0: return myfpregs.st_space[2];
 123       case MMX1_1: return myfpregs.st_space[3];
 124       case MMX2_0: return myfpregs.st_space[4];
 125       case MMX2_1: return myfpregs.st_space[5];
 126       case MMX3_0: return myfpregs.st_space[6];
 127       case MMX3_1: return myfpregs.st_space[7];
 128       case MMX4_0: return myfpregs.st_space[8];
 129       case MMX4_1: return myfpregs.st_space[9];
 130       case MMX5_0: return myfpregs.st_space[10];
 131       case MMX5_1: return myfpregs.st_space[11];
 132       case MMX6_0: return myfpregs.st_space[12];
 133       case MMX6_1: return myfpregs.st_space[13];
 134       case MMX7_0: return myfpregs.st_space[14];
 135       case MMX7_1: return myfpregs.st_space[15];
 136       //XMM
 137       case XMM0_0: return myfpregs.xmm_space[0];
 138       case XMM0_1: return myfpregs.xmm_space[1];
 139       case XMM0_2: return myfpregs.xmm_space[2];
 140       case XMM0_3: return myfpregs.xmm_space[3];
 141       case XMM1_0: return myfpregs.xmm_space[4];
 142       case XMM1_1: return myfpregs.xmm_space[5];
 143       case XMM1_2: return myfpregs.xmm_space[6];
 144       case XMM1_3: return myfpregs.xmm_space[7];
 145       case XMM2_0: return myfpregs.xmm_space[8];
 146       case XMM2_1: return myfpregs.xmm_space[9];
 147       case XMM2_2: return myfpregs.xmm_space[10];
 148       case XMM2_3: return myfpregs.xmm_space[11];
 149       case XMM3_0: return myfpregs.xmm_space[12];
 150       case XMM3_1: return myfpregs.xmm_space[13];
 151       case XMM3_2: return myfpregs.xmm_space[14];
 152       case XMM3_3: return myfpregs.xmm_space[15];
 153       case XMM4_0: return myfpregs.xmm_space[16];
 154       case XMM4_1: return myfpregs.xmm_space[17];
 155       case XMM4_2: return myfpregs.xmm_space[18];
 156       case XMM4_3: return myfpregs.xmm_space[19];
 157       case XMM5_0: return myfpregs.xmm_space[20];
 158       case XMM5_1: return myfpregs.xmm_space[21];
 159       case XMM5_2: return myfpregs.xmm_space[22];
 160       case XMM5_3: return myfpregs.xmm_space[23];
 161       case XMM6_0: return myfpregs.xmm_space[24];
 162       case XMM6_1: return myfpregs.xmm_space[25];
 163       case XMM6_2: return myfpregs.xmm_space[26];
 164       case XMM6_3: return myfpregs.xmm_space[27];
 165       case XMM7_0: return myfpregs.xmm_space[28];
 166       case XMM7_1: return myfpregs.xmm_space[29];
 167       case XMM7_2: return myfpregs.xmm_space[30];
 168       case XMM7_3: return myfpregs.xmm_space[31];
 169       case XMM8_0: return myfpregs.xmm_space[32];
 170       case XMM8_1: return myfpregs.xmm_space[33];
 171       case XMM8_2: return myfpregs.xmm_space[34];
 172       case XMM8_3: return myfpregs.xmm_space[35];
 173       case XMM9_0: return myfpregs.xmm_space[36];
 174       case XMM9_1: return myfpregs.xmm_space[37];
 175       case XMM9_2: return myfpregs.xmm_space[38];
 176       case XMM9_3: return myfpregs.xmm_space[39];
 177       case XMM10_0: return myfpregs.xmm_space[40];
 178       case XMM10_1: return myfpregs.xmm_space[41];
 179       case XMM10_2: return myfpregs.xmm_space[42];
 180       case XMM10_3: return myfpregs.xmm_space[43];
 181       case XMM11_0: return myfpregs.xmm_space[44];
 182       case XMM11_1: return myfpregs.xmm_space[45];
 183       case XMM11_2: return myfpregs.xmm_space[46];
 184       case XMM11_3: return myfpregs.xmm_space[47];
 185       case XMM12_0: return myfpregs.xmm_space[48];
 186       case XMM12_1: return myfpregs.xmm_space[49];
 187       case XMM12_2: return myfpregs.xmm_space[50];
 188       case XMM12_3: return myfpregs.xmm_space[51];
 189       case XMM13_0: return myfpregs.xmm_space[52];
 190       case XMM13_1: return myfpregs.xmm_space[53];
 191       case XMM13_2: return myfpregs.xmm_space[54];
 192       case XMM13_3: return myfpregs.xmm_space[55];
 193       case XMM14_0: return myfpregs.xmm_space[56];
 194       case XMM14_1: return myfpregs.xmm_space[57];
 195       case XMM14_2: return myfpregs.xmm_space[58];
 196       case XMM14_3: return myfpregs.xmm_space[59];
 197       case XMM15_0: return myfpregs.xmm_space[60];
 198       case XMM15_1: return myfpregs.xmm_space[61];
 199       case XMM15_2: return myfpregs.xmm_space[62];
 200       case XMM15_3: return myfpregs.xmm_space[63];
 201       default:
 202         assert(0);
 203         return 0;
 204     }
 205 }
 206
 207 bool
 208 AMD64TraceChild::update(int pid)
 209 {
 210     oldregs = regs;
 211     oldfpregs = fpregs;
 212     if (ptrace(PTRACE_GETREGS, pid, 0, &regs) != 0) {
 213         cerr << "update: " << strerror(errno) << endl;
 214         return false;
 215     }
 216     if (ptrace(PTRACE_GETFPREGS, pid, 0, &fpregs) != 0) {
 217         cerr << "update: " << strerror(errno) << endl;
 218         return false;
 219     }
 220     for (unsigned int x = 0; x < numregs; x++)
 221         regDiffSinceUpdate[x] = (getRegVal(x) != getOldRegVal(x));
 222     return true;
 223 }
 224
 225 AMD64TraceChild::AMD64TraceChild()
 226 {
 227     for (unsigned int x = 0; x < numregs; x++)
 228         regDiffSinceUpdate[x] = false;
 229 }
 230
 231 int64_t
 232 AMD64TraceChild::getRegVal(int num)
 233 {
 234     return getRegs(regs, fpregs, num);
 235 }
 236
 237 int64_t
 238 AMD64TraceChild::getOldRegVal(int num)
 239 {
 240     return getRegs(oldregs, oldfpregs, num);
 241 }
 242
 243 ostream &
 244 AMD64TraceChild::outputStartState(ostream & os)
 245 {
 246     uint64_t sp = getSP();
 247     uint64_t pc = getPC();
 248     uint64_t highestInfo = 0;
 249     char obuf[1024];
 250     sprintf(obuf, "Initial stack pointer = 0x%016lx\n", sp);
 251     os << obuf;
 252     sprintf(obuf, "Initial program counter = 0x%016lx\n", pc);
 253     os << obuf;
 254
 255     //Output the argument count
 256     uint64_t cargc = ptrace(PTRACE_PEEKDATA, pid, sp, 0);
 257     sprintf(obuf, "0x%016lx: Argc = 0x%016lx\n", sp, cargc);
 258     os << obuf;
 259     sp += 8;
 260
 261     //Output argv pointers
 262     int argCount = 0;
 263     uint64_t cargv;
 264     do {
 265         cargv = ptrace(PTRACE_PEEKDATA, pid, sp, 0);
 266         sprintf(obuf, "0x%016lx: argv[%d] = 0x%016lx\n",
 267                 sp, argCount++, cargv);
 268         if (cargv)
 269             if (highestInfo < cargv)
 270                 highestInfo = cargv;
 271         os << obuf;
 272         sp += 8;
 273     } while(cargv);
 274
 275     //Output the envp pointers
 276     int envCount = 0;
 277     uint64_t cenvp;
 278     do {
 279         cenvp = ptrace(PTRACE_PEEKDATA, pid, sp, 0);
 280         sprintf(obuf, "0x%016lx: envp[%d] = 0x%016lx\n",
 281                 sp, envCount++, cenvp);
 282         os << obuf;
 283         sp += 8;
 284     } while(cenvp);
 285     uint64_t auxType, auxVal;
 286     do {
 287         auxType = ptrace(PTRACE_PEEKDATA, pid, sp, 0);
 288         sp += 8;
 289         auxVal = ptrace(PTRACE_PEEKDATA, pid, sp, 0);
 290         sp += 8;
 291         sprintf(obuf, "0x%016lx: Auxiliary vector = {0x%016lx, 0x%016lx}\n",
 292                 sp - 16, auxType, auxVal);
 293         os << obuf;
 294     } while(auxType != 0 || auxVal != 0);
 295     //Print out the argument strings, environment strings, and file name.
 296     string current;
 297     uint64_t buf;
 298     uint64_t currentStart = sp;
 299     bool clearedInitialPadding = false;
 300     do {
 301         buf = ptrace(PTRACE_PEEKDATA, pid, sp, 0);
 302         char * cbuf = (char *)&buf;
 303         for (int x = 0; x < sizeof(uint64_t); x++) {
 304             if (cbuf[x])
 305                 current += cbuf[x];
 306             else {
 307                 sprintf(obuf, "0x%016lx: \"%s\"\n",
 308                         currentStart, current.c_str());
 309                 os << obuf;
 310                 current = "";
 311                 currentStart = sp + x + 1;
 312             }
 313         }
 314         sp += 8;
 315         clearedInitialPadding = clearedInitialPadding || buf != 0;
 316     } while (!clearedInitialPadding || buf != 0 || sp <= highestInfo);
 317     return os;
 318 }
 319
 320 uint64_t
 321 AMD64TraceChild::findSyscall()
 322 {
 323     uint64_t rip = getPC();
 324     bool foundOpcode = false;
 325     bool twoByteOpcode = false;
 326     for (;;) {
 327         uint64_t buf = ptrace(PTRACE_PEEKDATA, pid, rip, 0);
 328         for (int i = 0; i < sizeof(uint64_t); i++) {
 329             unsigned char byte = buf & 0xFF;
 330             if (!foundOpcode) {
 331                 if(!(byte == 0x66 || //operand override
 332                      byte == 0x67 || //address override
 333                      byte == 0x2E || //cs
 334                      byte == 0x3E || //ds
 335                      byte == 0x26 || //es
 336                      byte == 0x64 || //fs
 337                      byte == 0x65 || //gs
 338                      byte == 0x36 || //ss
 339                      byte == 0xF0 || //lock
 340                      byte == 0xF2 || //repe
 341                      byte == 0xF3 || //repne
 342                      (byte >= 0x40 && byte <= 0x4F) // REX
 343                     )) {
 344                     foundOpcode = true;
 345                 }
 346             }
 347             if (foundOpcode) {
 348                 if (twoByteOpcode) {
 349                     //SYSCALL or SYSENTER
 350                     if (byte == 0x05 || byte == 0x34)
 351                         return rip + 1;
 352                     else
 353                         return 0;
 354                 }
 355                 if (!twoByteOpcode) {
 356                     if (byte == 0xCC) // INT3
 357                         return rip + 1;
 358                     else if (byte == 0xCD) // INT with byte immediate
 359                         return rip + 2;
 360                     else if (byte == 0x0F) // two byte opcode prefix
 361                         twoByteOpcode = true;
 362                     else
 363                         return 0;
 364                 }
 365             }
 366             buf >>= 8;
 367             rip++;
 368         }
 369     }
 370 }
 371
 372 bool
 373 AMD64TraceChild::step()
 374 {
 375     uint64_t ripAfterSyscall = findSyscall();
 376     if (ripAfterSyscall) {
 377         //Get the original contents of memory
 378         uint64_t buf = ptrace(PTRACE_PEEKDATA, pid, ripAfterSyscall, 0);
 379         //Patch the first two bytes of the memory immediately after this with
 380         //jmp -2. Either single stepping will take over before this
 381         //instruction, leaving the rip where it should be, or it will take
 382         //over after this instruction, -still- leaving the rip where it should
 383         //be.
 384         uint64_t newBuf = (buf & ~0xFFFF) | 0xFEEB;
 385         //Write the patched memory to the processes address space
 386         ptrace(PTRACE_POKEDATA, pid, ripAfterSyscall, newBuf);
 387         //Step and hit it
 388         ptraceSingleStep();
 389         //Put things back to the way they started
 390         ptrace(PTRACE_POKEDATA, pid, ripAfterSyscall, buf);
 391     } else {
 392         //Get all the way past repe and repne string instructions in one shot.
 393         uint64_t newPC, origPC = getPC();
 394         do {
 395             ptraceSingleStep();
 396             newPC = getPC();
 397         } while(newPC == origPC);
 398     }
 399 }
 400
 401 TraceChild * genTraceChild()
 402 {
 403     return new AMD64TraceChild;
 404 }