util/statetrace/arch/tracechild_amd64.cc

   1 /*
   2  * Copyright (c) 2007 The Regents of The University of Michigan
   3  * All rights reserved.
   4  *
   5  * Redistribution and use in source and binary forms, with or without
   6  * modification, are permitted provided that the following conditions are
   7  * met: redistributions of source code must retain the above copyright
   8  * notice, this list of conditions and the following disclaimer;
   9  * redistributions in binary form must reproduce the above copyright
  10  * notice, this list of conditions and the following disclaimer in the
  11  * documentation and/or other materials provided with the distribution;
  12  * neither the name of the copyright holders nor the names of its
  13  * contributors may be used to endorse or promote products derived from
  14  * this software without specific prior written permission.
  15  *
  16  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  17  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  18  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
  19  * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
  20  * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
  21  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
  22  * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
  23  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
  24  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  25  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
  26  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  27  *
  28  * Authors: Gabe Black
  29  */
  30
  31 #include <iostream>
  32 #include <iomanip>
  33 #include <errno.h>
  34 #include <sys/ptrace.h>
  35 #include <stdint.h>
  36 #include <string.h>
  37
  38 #include "tracechild_amd64.hh"
  39
  40 using namespace std;
  41
  42 const char * AMD64TraceChild::regNames[numregs] = {
  43                 //GPRs
  44                 "rax", "rbx", "rcx", "rdx",
  45                 //Index registers
  46                 "rsi", "rdi",
  47                 //Base pointer and stack pointer
  48                 "rbp", "rsp",
  49                 //New 64 bit mode registers
  50                 "r8", "r9", "r10", "r11", "r12", "r13", "r14", "r15",
  51                 //Segmentation registers
  52                 "cs", "ds", "es", "fs", "gs", "ss", "fs_base", "gs_base",
  53                 //PC
  54                 "rip",
  55                 //Flags
  56                 "eflags",
  57                 //MMX
  58                 "mmx0_0", "mmx0_1",
  59                 "mmx1_0", "mmx1_1",
  60                 "mmx2_0", "mmx2_1",
  61                 "mmx3_0", "mmx3_1",
  62                 "mmx4_0", "mmx4_1",
  63                 "mmx5_0", "mmx5_1",
  64                 "mmx6_0", "mmx6_1",
  65                 "mmx7_0", "mmx7_1",
  66                 //XMM
  67                 "xmm0_0",  "xmm0_1",  "xmm0_2",  "xmm0_3",
  68                 "xmm1_0",  "xmm1_1",  "xmm1_2",  "xmm1_3",
  69                 "xmm2_0",  "xmm2_1",  "xmm2_2",  "xmm2_3",
  70                 "xmm3_0",  "xmm3_1",  "xmm3_2",  "xmm3_3",
  71                 "xmm4_0",  "xmm4_1",  "xmm4_2",  "xmm4_3",
  72                 "xmm5_0",  "xmm5_1",  "xmm5_2",  "xmm5_3",
  73                 "xmm6_0",  "xmm6_1",  "xmm6_2",  "xmm6_3",
  74                 "xmm7_0",  "xmm7_1",  "xmm7_2",  "xmm7_3",
  75                 "xmm8_0",  "xmm8_1",  "xmm8_2",  "xmm8_3",
  76                 "xmm9_0",  "xmm9_1",  "xmm9_2",  "xmm9_3",
  77                 "xmm10_0", "xmm10_1", "xmm10_2", "xmm10_3",
  78                 "xmm11_0", "xmm11_1", "xmm11_2", "xmm11_3",
  79                 "xmm12_0", "xmm12_1", "xmm12_2", "xmm12_3",
  80                 "xmm13_0", "xmm13_1", "xmm13_2", "xmm13_3",
  81                 "xmm14_0", "xmm14_1", "xmm14_2", "xmm14_3",
  82                 "xmm15_0", "xmm15_1", "xmm15_2", "xmm15_3"};
  83
  84 bool AMD64TraceChild::sendState(int socket)
  85 {
  86     uint64_t regVal64 = 0;
  87     uint32_t regVal32 = 0;
  88     for(int x = 0; x <= R15; x++)
  89     {
  90         regVal64 = getRegVal(x);
  91         if(write(socket, &regVal64, sizeof(regVal64)) == -1)
  92         {
  93             cerr << "Write failed! " << strerror(errno) << endl;
  94             tracing = false;
  95             return false;
  96         }
  97     }
  98     regVal64 = getRegVal(RIP);
  99     if(write(socket, &regVal64, sizeof(regVal64)) == -1)
 100     {
 101         cerr << "Write failed! " << strerror(errno) << endl;
 102         tracing = false;
 103         return false;
 104     }
 105     for(int x = MMX0_0; x <= MMX7_1; x++)
 106     {
 107         regVal32 = getRegVal(x);
 108         if(write(socket, &regVal32, sizeof(regVal32)) == -1)
 109         {
 110             cerr << "Write failed! " << strerror(errno) << endl;
 111             tracing = false;
 112             return false;
 113         }
 114     }
 115     for(int x = XMM0_0; x <= XMM15_3; x++)
 116     {
 117         regVal32 = getRegVal(x);
 118         if(write(socket, &regVal32, sizeof(regVal32)) == -1)
 119         {
 120             cerr << "Write failed! " << strerror(errno) << endl;
 121             tracing = false;
 122             return false;
 123         }
 124     }
 125     return true;
 126 }
 127
 128 int64_t AMD64TraceChild::getRegs(user_regs_struct & myregs,
 129         user_fpregs_struct & myfpregs, int num)
 130 {
 131     assert(num < numregs && num >= 0);
 132     switch(num)
 133     {
 134         //GPRs
 135         case RAX: return myregs.rax;
 136         case RBX: return myregs.rbx;
 137         case RCX: return myregs.rcx;
 138         case RDX: return myregs.rdx;
 139         //Index registers
 140         case RSI: return myregs.rsi;
 141         case RDI: return myregs.rdi;
 142         //Base pointer and stack pointer
 143         case RBP: return myregs.rbp;
 144         case RSP: return myregs.rsp;
 145         //New 64 bit mode registers
 146         case R8: return myregs.r8;
 147         case R9: return myregs.r9;
 148         case R10: return myregs.r10;
 149         case R11: return myregs.r11;
 150         case R12: return myregs.r12;
 151         case R13: return myregs.r13;
 152         case R14: return myregs.r14;
 153         case R15: return myregs.r15;
 154         //Segmentation registers
 155         case CS: return myregs.cs;
 156         case DS: return myregs.ds;
 157         case ES: return myregs.es;
 158         case FS: return myregs.fs;
 159         case GS: return myregs.gs;
 160         case SS: return myregs.ss;
 161         case FS_BASE: return myregs.fs_base;
 162         case GS_BASE: return myregs.gs_base;
 163         //PC
 164         case RIP: return myregs.rip;
 165         //Flags
 166         case EFLAGS: return myregs.eflags;
 167         //MMX
 168         case MMX0_0: return myfpregs.st_space[0];
 169         case MMX0_1: return myfpregs.st_space[1];
 170         case MMX1_0: return myfpregs.st_space[2];
 171         case MMX1_1: return myfpregs.st_space[3];
 172         case MMX2_0: return myfpregs.st_space[4];
 173         case MMX2_1: return myfpregs.st_space[5];
 174         case MMX3_0: return myfpregs.st_space[6];
 175         case MMX3_1: return myfpregs.st_space[7];
 176         case MMX4_0: return myfpregs.st_space[8];
 177         case MMX4_1: return myfpregs.st_space[9];
 178         case MMX5_0: return myfpregs.st_space[10];
 179         case MMX5_1: return myfpregs.st_space[11];
 180         case MMX6_0: return myfpregs.st_space[12];
 181         case MMX6_1: return myfpregs.st_space[13];
 182         case MMX7_0: return myfpregs.st_space[14];
 183         case MMX7_1: return myfpregs.st_space[15];
 184         //XMM
 185         case XMM0_0: return myfpregs.xmm_space[0];
 186         case XMM0_1: return myfpregs.xmm_space[1];
 187         case XMM0_2: return myfpregs.xmm_space[2];
 188         case XMM0_3: return myfpregs.xmm_space[3];
 189         case XMM1_0: return myfpregs.xmm_space[4];
 190         case XMM1_1: return myfpregs.xmm_space[5];
 191         case XMM1_2: return myfpregs.xmm_space[6];
 192         case XMM1_3: return myfpregs.xmm_space[7];
 193         case XMM2_0: return myfpregs.xmm_space[8];
 194         case XMM2_1: return myfpregs.xmm_space[9];
 195         case XMM2_2: return myfpregs.xmm_space[10];
 196         case XMM2_3: return myfpregs.xmm_space[11];
 197         case XMM3_0: return myfpregs.xmm_space[12];
 198         case XMM3_1: return myfpregs.xmm_space[13];
 199         case XMM3_2: return myfpregs.xmm_space[14];
 200         case XMM3_3: return myfpregs.xmm_space[15];
 201         case XMM4_0: return myfpregs.xmm_space[16];
 202         case XMM4_1: return myfpregs.xmm_space[17];
 203         case XMM4_2: return myfpregs.xmm_space[18];
 204         case XMM4_3: return myfpregs.xmm_space[19];
 205         case XMM5_0: return myfpregs.xmm_space[20];
 206         case XMM5_1: return myfpregs.xmm_space[21];
 207         case XMM5_2: return myfpregs.xmm_space[22];
 208         case XMM5_3: return myfpregs.xmm_space[23];
 209         case XMM6_0: return myfpregs.xmm_space[24];
 210         case XMM6_1: return myfpregs.xmm_space[25];
 211         case XMM6_2: return myfpregs.xmm_space[26];
 212         case XMM6_3: return myfpregs.xmm_space[27];
 213         case XMM7_0: return myfpregs.xmm_space[28];
 214         case XMM7_1: return myfpregs.xmm_space[29];
 215         case XMM7_2: return myfpregs.xmm_space[30];
 216         case XMM7_3: return myfpregs.xmm_space[31];
 217         case XMM8_0: return myfpregs.xmm_space[32];
 218         case XMM8_1: return myfpregs.xmm_space[33];
 219         case XMM8_2: return myfpregs.xmm_space[34];
 220         case XMM8_3: return myfpregs.xmm_space[35];
 221         case XMM9_0: return myfpregs.xmm_space[36];
 222         case XMM9_1: return myfpregs.xmm_space[37];
 223         case XMM9_2: return myfpregs.xmm_space[38];
 224         case XMM9_3: return myfpregs.xmm_space[39];
 225         case XMM10_0: return myfpregs.xmm_space[40];
 226         case XMM10_1: return myfpregs.xmm_space[41];
 227         case XMM10_2: return myfpregs.xmm_space[42];
 228         case XMM10_3: return myfpregs.xmm_space[43];
 229         case XMM11_0: return myfpregs.xmm_space[44];
 230         case XMM11_1: return myfpregs.xmm_space[45];
 231         case XMM11_2: return myfpregs.xmm_space[46];
 232         case XMM11_3: return myfpregs.xmm_space[47];
 233         case XMM12_0: return myfpregs.xmm_space[48];
 234         case XMM12_1: return myfpregs.xmm_space[49];
 235         case XMM12_2: return myfpregs.xmm_space[50];
 236         case XMM12_3: return myfpregs.xmm_space[51];
 237         case XMM13_0: return myfpregs.xmm_space[52];
 238         case XMM13_1: return myfpregs.xmm_space[53];
 239         case XMM13_2: return myfpregs.xmm_space[54];
 240         case XMM13_3: return myfpregs.xmm_space[55];
 241         case XMM14_0: return myfpregs.xmm_space[56];
 242         case XMM14_1: return myfpregs.xmm_space[57];
 243         case XMM14_2: return myfpregs.xmm_space[58];
 244         case XMM14_3: return myfpregs.xmm_space[59];
 245         case XMM15_0: return myfpregs.xmm_space[60];
 246         case XMM15_1: return myfpregs.xmm_space[61];
 247         case XMM15_2: return myfpregs.xmm_space[62];
 248         case XMM15_3: return myfpregs.xmm_space[63];
 249         default:
 250                 assert(0);
 251                 return 0;
 252     }
 253 }
 254
 255 bool AMD64TraceChild::update(int pid)
 256 {
 257     oldregs = regs;
 258     oldfpregs = fpregs;
 259     if(ptrace(PTRACE_GETREGS, pid, 0, &regs) != 0)
 260     {
 261         cerr << "update: " << strerror(errno) << endl;
 262         return false;
 263     }
 264     if(ptrace(PTRACE_GETFPREGS, pid, 0, &fpregs) != 0)
 265     {
 266         cerr << "update: " << strerror(errno) << endl;
 267         return false;
 268     }
 269     for(unsigned int x = 0; x < numregs; x++)
 270         regDiffSinceUpdate[x] = (getRegVal(x) != getOldRegVal(x));
 271     return true;
 272 }
 273
 274 AMD64TraceChild::AMD64TraceChild()
 275 {
 276     for(unsigned int x = 0; x < numregs; x++)
 277         regDiffSinceUpdate[x] = false;
 278 }
 279
 280 int64_t AMD64TraceChild::getRegVal(int num)
 281 {
 282         return getRegs(regs, fpregs, num);
 283 }
 284
 285 int64_t AMD64TraceChild::getOldRegVal(int num)
 286 {
 287         return getRegs(oldregs, oldfpregs, num);
 288 }
 289
 290 char * AMD64TraceChild::printReg(int num)
 291 {
 292         sprintf(printBuffer, "0x%016lX", getRegVal(num));
 293         return printBuffer;
 294 }
 295
 296 ostream & AMD64TraceChild::outputStartState(ostream & os)
 297 {
 298     uint64_t sp = getSP();
 299     uint64_t pc = getPC();
 300     uint64_t highestInfo = 0;
 301     char obuf[1024];
 302     sprintf(obuf, "Initial stack pointer = 0x%016lx\n", sp);
 303     os << obuf;
 304     sprintf(obuf, "Initial program counter = 0x%016lx\n", pc);
 305     os << obuf;
 306
 307     //Output the argument count
 308     uint64_t cargc = ptrace(PTRACE_PEEKDATA, pid, sp, 0);
 309     sprintf(obuf, "0x%016lx: Argc = 0x%016lx\n", sp, cargc);
 310     os << obuf;
 311     sp += 8;
 312
 313     //Output argv pointers
 314     int argCount = 0;
 315     uint64_t cargv;
 316     do
 317     {
 318         cargv = ptrace(PTRACE_PEEKDATA, pid, sp, 0);
 319         sprintf(obuf, "0x%016lx: argv[%d] = 0x%016lx\n",
 320                 sp, argCount++, cargv);
 321         if(cargv)
 322             if(highestInfo < cargv)
 323                 highestInfo = cargv;
 324         os << obuf;
 325         sp += 8;
 326     } while(cargv);
 327
 328     //Output the envp pointers
 329     int envCount = 0;
 330     uint64_t cenvp;
 331     do
 332     {
 333         cenvp = ptrace(PTRACE_PEEKDATA, pid, sp, 0);
 334         sprintf(obuf, "0x%016lx: envp[%d] = 0x%016lx\n",
 335                 sp, envCount++, cenvp);
 336         os << obuf;
 337         sp += 8;
 338     } while(cenvp);
 339     uint64_t auxType, auxVal;
 340     do
 341     {
 342         auxType = ptrace(PTRACE_PEEKDATA, pid, sp, 0);
 343         sp += 8;
 344         auxVal = ptrace(PTRACE_PEEKDATA, pid, sp, 0);
 345         sp += 8;
 346         sprintf(obuf, "0x%016lx: Auxiliary vector = {0x%016lx, 0x%016lx}\n",
 347                 sp - 16, auxType, auxVal);
 348         os << obuf;
 349     } while(auxType != 0 || auxVal != 0);
 350     //Print out the argument strings, environment strings, and file name.
 351     string current;
 352     uint64_t buf;
 353     uint64_t currentStart = sp;
 354     bool clearedInitialPadding = false;
 355     do
 356     {
 357         buf = ptrace(PTRACE_PEEKDATA, pid, sp, 0);
 358         char * cbuf = (char *)&buf;
 359         for(int x = 0; x < sizeof(uint64_t); x++)
 360         {
 361             if(cbuf[x])
 362                 current += cbuf[x];
 363             else
 364             {
 365                 sprintf(obuf, "0x%016lx: \"%s\"\n",
 366                         currentStart, current.c_str());
 367                 os << obuf;
 368                 current = "";
 369                 currentStart = sp + x + 1;
 370             }
 371         }
 372         sp += 8;
 373         clearedInitialPadding = clearedInitialPadding || buf != 0;
 374     } while(!clearedInitialPadding || buf != 0 || sp <= highestInfo);
 375     return os;
 376 }
 377
 378 uint64_t AMD64TraceChild::findSyscall()
 379 {
 380     uint64_t rip = getPC();
 381     bool foundOpcode = false;
 382     bool twoByteOpcode = false;
 383     for(;;)
 384     {
 385         uint64_t buf = ptrace(PTRACE_PEEKDATA, pid, rip, 0);
 386         for(int i = 0; i < sizeof(uint64_t); i++)
 387         {
 388             unsigned char byte = buf & 0xFF;
 389             if(!foundOpcode)
 390             {
 391                 if(!(byte == 0x66 || //operand override
 392                      byte == 0x67 || //address override
 393                      byte == 0x2E || //cs
 394                      byte == 0x3E || //ds
 395                      byte == 0x26 || //es
 396                      byte == 0x64 || //fs
 397                      byte == 0x65 || //gs
 398                      byte == 0x36 || //ss
 399                      byte == 0xF0 || //lock
 400                      byte == 0xF2 || //repe
 401                      byte == 0xF3 || //repne
 402                      (byte >= 0x40 && byte <= 0x4F) // REX
 403                     ))
 404                 {
 405                     foundOpcode = true;
 406                 }
 407             }
 408             if(foundOpcode)
 409             {
 410                 if(twoByteOpcode)
 411                 {
 412                     //SYSCALL or SYSENTER
 413                     if(byte == 0x05 || byte == 0x34)
 414                         return rip + 1;
 415                     else
 416                         return 0;
 417                 }
 418                 if(!twoByteOpcode)
 419                 {
 420                     if(byte == 0xCC) // INT3
 421                         return rip + 1;
 422                     else if(byte == 0xCD) // INT with byte immediate
 423                         return rip + 2;
 424                     else if(byte == 0x0F) // two byte opcode prefix
 425                         twoByteOpcode = true;
 426                     else
 427                         return 0;
 428                 }
 429             }
 430             buf >>= 8;
 431             rip++;
 432         }
 433     }
 434 }
 435
 436 bool AMD64TraceChild::step()
 437 {
 438     uint64_t ripAfterSyscall = findSyscall();
 439     if(ripAfterSyscall)
 440     {
 441         //Get the original contents of memory
 442         uint64_t buf = ptrace(PTRACE_PEEKDATA, pid, ripAfterSyscall, 0);
 443         //Patch the first two bytes of the memory immediately after this with
 444         //jmp -2. Either single stepping will take over before this
 445         //instruction, leaving the rip where it should be, or it will take
 446         //over after this instruction, -still- leaving the rip where it should
 447         //be.
 448         uint64_t newBuf = (buf & ~0xFFFF) | 0xFEEB;
 449         //Write the patched memory to the processes address space
 450         ptrace(PTRACE_POKEDATA, pid, ripAfterSyscall, newBuf);
 451         //Step and hit it
 452         ptraceSingleStep();
 453         //Put things back to the way they started
 454         ptrace(PTRACE_POKEDATA, pid, ripAfterSyscall, buf);
 455     }
 456     else
 457     {
 458         //Get all the way past repe and repne string instructions in one shot.
 459         uint64_t newPC, origPC = getPC();
 460         do
 461         {
 462             ptraceSingleStep();
 463             newPC = getPC();
 464         } while(newPC == origPC);
 465     }
 466 }
 467
 468 TraceChild * genTraceChild()
 469 {
 470         return new AMD64TraceChild;
 471 }