tracechild.cc revision 4955
14826Ssaidi@eecs.umich.edu/*
24826Ssaidi@eecs.umich.edu * Copyright (c) 2007 The Regents of The University of Michigan
34826Ssaidi@eecs.umich.edu * All rights reserved.
44826Ssaidi@eecs.umich.edu *
54826Ssaidi@eecs.umich.edu * Redistribution and use in source and binary forms, with or without
64826Ssaidi@eecs.umich.edu * modification, are permitted provided that the following conditions are
74826Ssaidi@eecs.umich.edu * met: redistributions of source code must retain the above copyright
84826Ssaidi@eecs.umich.edu * notice, this list of conditions and the following disclaimer;
94826Ssaidi@eecs.umich.edu * redistributions in binary form must reproduce the above copyright
104826Ssaidi@eecs.umich.edu * notice, this list of conditions and the following disclaimer in the
114826Ssaidi@eecs.umich.edu * documentation and/or other materials provided with the distribution;
124826Ssaidi@eecs.umich.edu * neither the name of the copyright holders nor the names of its
134826Ssaidi@eecs.umich.edu * contributors may be used to endorse or promote products derived from
144826Ssaidi@eecs.umich.edu * this software without specific prior written permission.
154826Ssaidi@eecs.umich.edu *
164826Ssaidi@eecs.umich.edu * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
174826Ssaidi@eecs.umich.edu * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
184826Ssaidi@eecs.umich.edu * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
194826Ssaidi@eecs.umich.edu * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
204826Ssaidi@eecs.umich.edu * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
214826Ssaidi@eecs.umich.edu * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
224826Ssaidi@eecs.umich.edu * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
234826Ssaidi@eecs.umich.edu * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
244826Ssaidi@eecs.umich.edu * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
254826Ssaidi@eecs.umich.edu * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
264826Ssaidi@eecs.umich.edu * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
274826Ssaidi@eecs.umich.edu *
284826Ssaidi@eecs.umich.edu * Authors: Gabe Black
294826Ssaidi@eecs.umich.edu */
304826Ssaidi@eecs.umich.edu
314826Ssaidi@eecs.umich.edu#include <iostream>
324826Ssaidi@eecs.umich.edu#include <iomanip>
334826Ssaidi@eecs.umich.edu#include <errno.h>
344826Ssaidi@eecs.umich.edu#include <sys/ptrace.h>
354826Ssaidi@eecs.umich.edu#include <stdint.h>
364826Ssaidi@eecs.umich.edu
374826Ssaidi@eecs.umich.edu#include "tracechild_amd64.hh"
384826Ssaidi@eecs.umich.edu
395569Snate@binkert.orgusing namespace std;
404826Ssaidi@eecs.umich.edu
415569Snate@binkert.orgchar * AMD64TraceChild::regNames[numregs] = {
425569Snate@binkert.org                //GPRs
434826Ssaidi@eecs.umich.edu                "rax", "rbx", "rcx", "rdx",
444826Ssaidi@eecs.umich.edu                //Index registers
455958Sgblack@eecs.umich.edu                "rsi", "rdi",
464826Ssaidi@eecs.umich.edu                //Base pointer and stack pointer
474826Ssaidi@eecs.umich.edu                "rbp", "rsp",
485958Sgblack@eecs.umich.edu                //New 64 bit mode registers
494826Ssaidi@eecs.umich.edu                "r8", "r9", "r10", "r11", "r12", "r13", "r14", "r15",
505958Sgblack@eecs.umich.edu                //Segmentation registers
514826Ssaidi@eecs.umich.edu                "cs", "ds", "es", "fs", "gs", "ss", "fs_base", "gs_base",
524826Ssaidi@eecs.umich.edu                //PC
535498Ssaidi@eecs.umich.edu                "rip",
544826Ssaidi@eecs.umich.edu                //Flags
554826Ssaidi@eecs.umich.edu                "eflags"};
564826Ssaidi@eecs.umich.edu
574826Ssaidi@eecs.umich.edubool AMD64TraceChild::sendState(int socket)
584826Ssaidi@eecs.umich.edu{
594826Ssaidi@eecs.umich.edu    uint64_t regVal = 0;
605569Snate@binkert.org    for(int x = 0; x <= R15; x++)
614826Ssaidi@eecs.umich.edu    {
624826Ssaidi@eecs.umich.edu        regVal = getRegVal(x);
634826Ssaidi@eecs.umich.edu        if(write(socket, &regVal, sizeof(regVal)) == -1)
644826Ssaidi@eecs.umich.edu        {
654826Ssaidi@eecs.umich.edu            cerr << "Write failed! " << strerror(errno) << endl;
66            tracing = false;
67            return false;
68        }
69    }
70    regVal = getRegVal(RIP);
71    if(write(socket, &regVal, sizeof(regVal)) == -1)
72    {
73        cerr << "Write failed! " << strerror(errno) << endl;
74        tracing = false;
75        return false;
76    }
77    return true;
78}
79
80int64_t AMD64TraceChild::getRegs(user_regs_struct & myregs, int num)
81{
82        assert(num < numregs && num >= 0);
83        switch(num)
84        {
85                //GPRs
86                case RAX: return myregs.rax;
87                case RBX: return myregs.rbx;
88                case RCX: return myregs.rcx;
89                case RDX: return myregs.rdx;
90                //Index registers
91                case RSI: return myregs.rsi;
92                case RDI: return myregs.rdi;
93                //Base pointer and stack pointer
94                case RBP: return myregs.rbp;
95                case RSP: return myregs.rsp;
96                //New 64 bit mode registers
97                case R8: return myregs.r8;
98                case R9: return myregs.r9;
99                case R10: return myregs.r10;
100                case R11: return myregs.r11;
101                case R12: return myregs.r12;
102                case R13: return myregs.r13;
103                case R14: return myregs.r14;
104                case R15: return myregs.r15;
105                //Segmentation registers
106                case CS: return myregs.cs;
107                case DS: return myregs.ds;
108                case ES: return myregs.es;
109                case FS: return myregs.fs;
110                case GS: return myregs.gs;
111                case SS: return myregs.ss;
112                case FS_BASE: return myregs.fs_base;
113                case GS_BASE: return myregs.gs_base;
114                //PC
115                case RIP: return myregs.rip;
116                //Flags
117                case EFLAGS: return myregs.eflags;
118                default:
119                        assert(0);
120                        return 0;
121        }
122}
123
124bool AMD64TraceChild::update(int pid)
125{
126    oldregs = regs;
127    if(ptrace(PTRACE_GETREGS, pid, 0, &regs) != 0)
128    {
129        cerr << "update: " << strerror(errno) << endl;
130        return false;
131    }
132    for(unsigned int x = 0; x < numregs; x++)
133        regDiffSinceUpdate[x] = (getRegVal(x) != getOldRegVal(x));
134    return true;
135}
136
137AMD64TraceChild::AMD64TraceChild()
138{
139    for(unsigned int x = 0; x < numregs; x++)
140        regDiffSinceUpdate[x] = false;
141}
142
143int64_t AMD64TraceChild::getRegVal(int num)
144{
145        return getRegs(regs, num);
146}
147
148int64_t AMD64TraceChild::getOldRegVal(int num)
149{
150        return getRegs(oldregs, num);
151}
152
153char * AMD64TraceChild::printReg(int num)
154{
155        sprintf(printBuffer, "0x%08X", getRegVal(num));
156        return printBuffer;
157}
158
159ostream & AMD64TraceChild::outputStartState(ostream & os)
160{
161    uint64_t sp = getSP();
162    uint64_t pc = getPC();
163    uint64_t highestInfo = 0;
164    char obuf[1024];
165    sprintf(obuf, "Initial stack pointer = 0x%016llx\n", sp);
166    os << obuf;
167    sprintf(obuf, "Initial program counter = 0x%016llx\n", pc);
168    os << obuf;
169
170    //Output the argument count
171    uint64_t cargc = ptrace(PTRACE_PEEKDATA, pid, sp, 0);
172    sprintf(obuf, "0x%016llx: Argc = 0x%016llx\n", sp, cargc);
173    os << obuf;
174    sp += 8;
175
176    //Output argv pointers
177    int argCount = 0;
178    uint64_t cargv;
179    do
180    {
181        cargv = ptrace(PTRACE_PEEKDATA, pid, sp, 0);
182        sprintf(obuf, "0x%016llx: argv[%d] = 0x%016llx\n",
183                sp, argCount++, cargv);
184        if(cargv)
185            if(highestInfo < cargv)
186                highestInfo = cargv;
187        os << obuf;
188        sp += 8;
189    } while(cargv);
190
191    //Output the envp pointers
192    int envCount = 0;
193    uint64_t cenvp;
194    do
195    {
196        cenvp = ptrace(PTRACE_PEEKDATA, pid, sp, 0);
197        sprintf(obuf, "0x%016llx: envp[%d] = 0x%016llx\n",
198                sp, envCount++, cenvp);
199        os << obuf;
200        sp += 8;
201    } while(cenvp);
202    uint64_t auxType, auxVal;
203    do
204    {
205        auxType = ptrace(PTRACE_PEEKDATA, pid, sp, 0);
206        sp += 8;
207        auxVal = ptrace(PTRACE_PEEKDATA, pid, sp, 0);
208        sp += 8;
209        sprintf(obuf, "0x%016llx: Auxiliary vector = {0x%016llx, 0x%016llx}\n",
210                sp - 16, auxType, auxVal);
211        os << obuf;
212    } while(auxType != 0 || auxVal != 0);
213    //Print out the argument strings, environment strings, and file name.
214    string current;
215    uint64_t buf;
216    uint64_t currentStart = sp;
217    bool clearedInitialPadding = false;
218    do
219    {
220        buf = ptrace(PTRACE_PEEKDATA, pid, sp, 0);
221        char * cbuf = (char *)&buf;
222        for(int x = 0; x < sizeof(uint64_t); x++)
223        {
224            if(cbuf[x])
225                current += cbuf[x];
226            else
227            {
228                sprintf(obuf, "0x%016llx: \"%s\"\n",
229                        currentStart, current.c_str());
230                os << obuf;
231                current = "";
232                currentStart = sp + x + 1;
233            }
234        }
235        sp += 8;
236        clearedInitialPadding = clearedInitialPadding || buf != 0;
237    } while(!clearedInitialPadding || buf != 0 || sp <= highestInfo);
238    return os;
239}
240
241uint64_t AMD64TraceChild::findSyscall()
242{
243    uint64_t rip = getPC();
244    bool foundOpcode = false;
245    bool twoByteOpcode = false;
246    for(;;)
247    {
248        uint64_t buf = ptrace(PTRACE_PEEKDATA, pid, rip, 0);
249        for(int i = 0; i < sizeof(uint64_t); i++)
250        {
251            unsigned char byte = buf & 0xFF;
252            if(!foundOpcode)
253            {
254                if(!(byte == 0x66 || //operand override
255                     byte == 0x67 || //address override
256                     byte == 0x2E || //cs
257                     byte == 0x3E || //ds
258                     byte == 0x26 || //es
259                     byte == 0x64 || //fs
260                     byte == 0x65 || //gs
261                     byte == 0x36 || //ss
262                     byte == 0xF0 || //lock
263                     byte == 0xF2 || //repe
264                     byte == 0xF3 || //repne
265                     (byte >= 0x40 && byte <= 0x4F) // REX
266                    ))
267                {
268                    foundOpcode = true;
269                }
270            }
271            if(foundOpcode)
272            {
273                if(twoByteOpcode)
274                {
275                    //SYSCALL or SYSENTER
276                    if(byte == 0x05 || byte == 0x34)
277                        return rip + 1;
278                    else
279                        return 0;
280                }
281                if(!twoByteOpcode)
282                {
283                    if(byte == 0xCC) // INT3
284                        return rip + 1;
285                    else if(byte == 0xCD) // INT with byte immediate
286                        return rip + 2;
287                    else if(byte == 0x0F) // two byte opcode prefix
288                        twoByteOpcode = true;
289                    else
290                        return 0;
291                }
292            }
293            buf >>= 8;
294            rip++;
295        }
296    }
297}
298
299bool AMD64TraceChild::step()
300{
301    uint64_t ripAfterSyscall = findSyscall();
302    if(ripAfterSyscall)
303    {
304        //Get the original contents of memory
305        uint64_t buf = ptrace(PTRACE_PEEKDATA, pid, ripAfterSyscall, 0);
306        //Patch the first two bytes of the memory immediately after this with
307        //jmp -2. Either single stepping will take over before this
308        //instruction, leaving the rip where it should be, or it will take
309        //over after this instruction, -still- leaving the rip where it should
310        //be.
311        uint64_t newBuf = (buf & ~0xFFFF) | 0xFEEB;
312        //Write the patched memory to the processes address space
313        ptrace(PTRACE_POKEDATA, pid, ripAfterSyscall, newBuf);
314        //Step and hit it
315        ptraceSingleStep();
316        //Put things back to the way they started
317        ptrace(PTRACE_POKEDATA, pid, ripAfterSyscall, buf);
318    }
319    else
320    {
321        //Get all the way past repe and repne string instructions in one shot.
322        uint64_t newPC, origPC = getPC();
323        do
324        {
325            ptraceSingleStep();
326            newPC = getPC();
327        } while(newPC == origPC);
328    }
329}
330
331TraceChild * genTraceChild()
332{
333        return new AMD64TraceChild;
334}
335