minix/commands/swifi/db_sym.c

/*
 * Mach Operating System
 * Copyright (c) 1991,1990 Carnegie Mellon University
 * All Rights Reserved.
 *
 * Permission to use, copy, modify and distribute this software and its
 * documentation is hereby granted, provided that both the copyright
 * notice and this permission notice appear in all copies of the
 * software, derivative works or modified versions, and any portions
 * thereof, and that both notices appear in supporting documentation.
 *
 * CARNEGIE MELLON ALLOWS FREE USE OF THIS SOFTWARE IN ITS
 * CONDITION.  CARNEGIE MELLON DISCLAIMS ANY LIABILITY OF ANY KIND FOR
 * ANY DAMAGES WHATSOEVER RESULTING FROM THE USE OF THIS SOFTWARE.
 *
 * Carnegie Mellon requests users of this software to return to
 *
 *  Software Distribution Coordinator  or  Software.Distribution@CS.CMU.EDU
 *  School of Computer Science
 *  Carnegie Mellon University
 *  Pittsburgh PA 15213-3890
 *
 * any improvements or extensions that they make and grant Carnegie the
 * rights to redistribute these changes.
 */

/*
 * 	Author: David B. Golub, Carnegie Mellon University
 *	Date:	7/90
 */
#if 0
//#include <sys/param.h>
//#include <sys/systm.h>
#endif
#if 0
#include <linux/kernel.h>
#include <linux/string.h>
#include <linux/kallsyms.h>
#endif
#include "ddb.h"
#include "db_sym.h"
#include "swifi.h"

#include "extra.h"

/*
 * Multiple symbol tables
 */
#ifndef MAXNOSYMTABS
#define	MAXNOSYMTABS	3	/* mach, ux, emulator */
#endif
#if 0

static db_symtab_t	db_symtabs[MAXNOSYMTABS] = {{0,},};
static int db_nsymtab = 0;

static db_symtab_t	*db_last_symtab;

static db_sym_t		db_lookup __P(( char *symstr));
static char		*db_qualify __P((db_sym_t sym, char *symtabname));
static boolean_t	db_symbol_is_ambiguous __P((db_sym_t sym));
static boolean_t	db_line_at_pc __P((db_sym_t, char **, int *, 
				db_expr_t));

/*
 * Add symbol table, with given name, to list of symbol tables.
 */
void
db_add_symbol_table(start, end, name, ref)
	char *start;
	char *end;
	char *name;
	char *ref;
{
	if (db_nsymtab >= MAXNOSYMTABS) {
		printk ("No slots left for %s symbol table", name);
		panic ("db_sym.c: db_add_symbol_table");
	}

	db_symtabs[db_nsymtab].start = start;
	db_symtabs[db_nsymtab].end = end;
	db_symtabs[db_nsymtab].name = name;
	db_symtabs[db_nsymtab].private = ref;
	db_nsymtab++;
}

/*
 *  db_qualify("vm_map", "ux") returns "unix:vm_map".
 *
 *  Note: return value points to static data whose content is
 *  overwritten by each call... but in practice this seems okay.
 */
static char *
db_qualify(sym, symtabname)
	db_sym_t	sym;
	register char	*symtabname;
{
	char		*symname;
	static char     tmp[256];

	db_symbol_values(sym, &symname, 0);
	strcpy(tmp,symtabname);
	strcat(tmp,":");
	strcat(tmp,symname);
	return tmp;
}


boolean_t
db_eqname(src, dst, c)
	char *src;
	char *dst;
	char c;
{
	if (!strcmp(src, dst))
	    return (TRUE);
	if (src[0] == c)
	    return (!strcmp(src+1,dst));
	return (FALSE);
}

boolean_t
db_value_of_name(name, valuep)
	char		*name;
	db_expr_t	*valuep;
{
	db_sym_t	sym;

	sym = db_lookup(name);
	if (sym == DB_SYM_NULL)
	    return (FALSE);
	db_symbol_values(sym, &name, valuep);
	return (TRUE);
}


/*
 * Lookup a symbol.
 * If the symbol has a qualifier (e.g., ux:vm_map),
 * then only the specified symbol table will be searched;
 * otherwise, all symbol tables will be searched.
 */
static db_sym_t
db_lookup(symstr)
	char *symstr;
{
	db_sym_t sp;
	register int i;
	int symtab_start = 0;
	int symtab_end = db_nsymtab;
	register char *cp;

	/*
	 * Look for, remove, and remember any symbol table specifier.
	 */
	for (cp = symstr; *cp; cp++) {
		if (*cp == ':') {
			*cp = '\0';
			for (i = 0; i < db_nsymtab; i++) {
				if (! strcmp(symstr, db_symtabs[i].name)) {
					symtab_start = i;
					symtab_end = i + 1;
					break;
				}
			}
			*cp = ':';
			if (i == db_nsymtab) {
				db_error("invalid symbol table name");
			}
			symstr = cp+1;
		}
	}

	/*
	 * Look in the specified set of symbol tables.
	 * Return on first match.
	 */
	for (i = symtab_start; i < symtab_end; i++) {
		sp = X_db_lookup(&db_symtabs[i], symstr);
		if (sp) {
			db_last_symtab = &db_symtabs[i];
			return sp;
		}
	}
	return 0;
}

/*
 * Does this symbol name appear in more than one symbol table?
 * Used by db_symbol_values to decide whether to qualify a symbol.
 */
static boolean_t db_qualify_ambiguous_names = FALSE;

static boolean_t
db_symbol_is_ambiguous(sym)
	db_sym_t	sym;
{
	char		*sym_name;
	register int	i;
	register
	boolean_t	found_once = FALSE;

	if (!db_qualify_ambiguous_names)
		return FALSE;

	db_symbol_values(sym, &sym_name, 0);
	for (i = 0; i < db_nsymtab; i++) {
		if (X_db_lookup(&db_symtabs[i], sym_name)) {
			if (found_once)
				return TRUE;
			found_once = TRUE;
		}
	}
	return FALSE;
}

/*
 * Find the closest symbol to val, and return its name
 * and the difference between val and the symbol found.
 */
db_sym_t
db_search_symbol( val, strategy, offp)
	register db_addr_t	val;
	db_strategy_t		strategy;
	db_expr_t		*offp;
{
	register
	unsigned int	diff;
	unsigned int	newdiff;
	register int	i;
	db_sym_t	ret = DB_SYM_NULL, sym;

	newdiff = diff = ~0;
	db_last_symtab = 0;
	for (i = 0; i < db_nsymtab; i++) {
	    sym = X_db_search_symbol(&db_symtabs[i], val, strategy, &newdiff);
	    if (newdiff < diff) {
		db_last_symtab = &db_symtabs[i];
		diff = newdiff;
		ret = sym;
	    }
	}
	*offp = diff;
	return ret;
}

/*
 * Return name and value of a symbol
 */
void
db_symbol_values(sym, namep, valuep)
	db_sym_t	sym;
	char		**namep;
	db_expr_t	*valuep;
{
	db_expr_t	value;

	if (sym == DB_SYM_NULL) {
		*namep = 0;
		return;
	}

	X_db_symbol_values(sym, namep, &value);
	if (db_symbol_is_ambiguous(sym))
		*namep = db_qualify(sym, db_last_symtab->name);
	if (valuep)
		*valuep = value;
}


/*
 * Print a the closest symbol to value
 *
 * After matching the symbol according to the given strategy
 * we print it in the name+offset format, provided the symbol's
 * value is close enough (eg smaller than db_maxoff).
 * We also attempt to print [filename:linenum] when applicable
 * (eg for procedure names).
 *
 * If we could not find a reasonable name+offset representation,
 * then we just print the value in hex.  Small values might get
 * bogus symbol associations, e.g. 3 might get some absolute
 * value like _INCLUDE_VERSION or something, therefore we do
 * not accept symbols whose value is "small" (and use plain hex).
 */


void
db_printsym(off, strategy)
	db_expr_t	off;
	db_strategy_t	strategy;
{
	db_expr_t	d;
	char 		*filename;
	char		*name;
	db_expr_t	value;
	int 		linenum;
	db_sym_t	cursym;

	cursym = db_search_symbol(off, strategy, &d);
	db_symbol_values(cursym, &name, &value);
	if (name == 0)
		value = off;
	if (value >= DB_SMALL_VALUE_MIN && value <= DB_SMALL_VALUE_MAX) {
		printk("0x%x", off);
		return;
	}
	if (name == 0 || d >= db_maxoff) {
		printk("0x%x", off);
		return;
	}
	printk("%s", name);
	if (d)
		printk("+0x%x", d);
	if (strategy == DB_STGY_PROC) {
	  //		if (db_line_at_pc(cursym, &filename, &linenum, off))
	  //			printk(" [%s:%d]", filename, linenum);
	}
}

#endif 

unsigned int	db_maxoff = 0x10000;
unsigned long modAddr = 0;

/* NWT: fault injection routine only. 
 * figure out start of function address given an address (off) in kernel text.
 * 	name = function name
 *	value = function address
 *  d = difference between off and function address
 * input is the desired address off and fault type
 * returns closest instruction address (if found), NULL otherwise
 */
unsigned long
find_faulty_instr(db_expr_t off, int type, int *instr_len)
{
  db_expr_t       d;
  char            *name;
  db_expr_t       value, cur_value, prev_value = 0;
  int		verbose=0, found=0;
  const char * mod_name = NULL;
  unsigned long mod_start;
  unsigned long mod_end;
  const char * sec_name = NULL;
  unsigned long sec_start;
  unsigned long sec_end;
  const char * sym_name = NULL;
  unsigned long sym_start;
  unsigned long sym_end;
  

  *instr_len = 0;
  if (kallsyms_address_to_symbol(off,
				 &mod_name, &mod_start, &mod_end,
				 &sec_name, &sec_start, &sec_end,
				 &sym_name, &sym_start, &sym_end) == 0) {
    return(0);
  }
  
  value = (db_expr_t) sym_start;
  d = off - sym_start;
  name = (char *) sym_name;

  if (name == 0) {
    value = off;
  }

  if (value >= DB_SMALL_VALUE_MIN && value <= DB_SMALL_VALUE_MAX) {
    printk("0x%x", off);
    return 0;
  }

  if (name == 0 || d >= db_maxoff) {
    printk("0x%x", off);
    return 0 ;
  }
  /* 2) backup to start of function (SOF) 
   * 3) delineate instruction boundaries, find instruction length too.
   */

  if(verbose) {
    printk("function %s", sym_name);
  }

  /* 4)  skip instructions until we get to our faulty address */
  cur_value = value;
  while(cur_value < sec_end) {
    if(verbose) { 
#if 0
      //	db_printsym(cur_value, DB_STGY_PROC); 
      //	printk(":\t");
#endif
    }
    prev_value=cur_value;
    modAddr=0;
    if(verbose) {
#if 0
      //cur_value=db_disasm(prev_value, FALSE); 
#endif
    } else {
      cur_value=my_disasm(prev_value, FALSE); 
    }
    
    /* 4a) bail out if instruction is leave (0xc9) */
    if(cur_value-prev_value == 1) {
      unsigned char *c;
      c=(unsigned char *) prev_value;
      if(text_read_ub(c)==0xc9)	{
	if(verbose) printk("bailing out as we hit a leave\n");
	found=0;
	break;
      }
    }
    /* 5a) init fault: from SOF, look for movl $X, -Y(%ebp), 
     *     (C645Fxxx or C745Fxxx) and replace with nop.
     */
    if(type==INIT_FAULT) {
      unsigned char *c;
      c=(unsigned char *) prev_value;

      if(*c==0x66 || *c==0x67) 
	c++;	/* override prefix */

      if(*c==0xC6 || *c==0xC7) 
	c++;	/* movb or movl imm */
      else 
	continue;

      if(*c==0x45) 
	c++;				/* [ebp]	*/
      else 
	continue;

      if(*c & 0x80) 
	found=1;			/* negative displacement */
      else 
	continue;

      found=1;	
      break;
    } else if(type==NOP_FAULT) {
      /* 5b) nop*: replace instruction with nop */
      if(cur_value> off) {
	found=1;
	break;
      }
    } else if(type==DST_FAULT || type==SRC_FAULT) {
      /* 5c) dst/src: flip bits in mod/rm, sib, disp or imm fields */
      if(cur_value>off && (cur_value-prev_value) > 1) {
	found=1;
	break;
      }
    } else if(type==BRANCH_FAULT || type==LOOP_FAULT) {
      /* 5e) brc*: search forward utnil we hit a Jxx or rep (F3 or F2). 
       *     replace instr with nop.
       */
      unsigned char *c;

      c=(unsigned char *) prev_value;

      /* look for repX prefix */

      if(text_read_ub(c)==0xf3 || text_read_ub(c)==0xf2) {	
	if(verbose) 
	  printk("found repX prefix\n");
	/* take out repX prefix only */
	found=1;	
	cur_value=prev_value+1;		
	break;
      } else if( (text_read_ub(c)&0xf0)==0x70 ||
		(text_read_ub(c)>=0xe0 && text_read_ub(c)<=0xe2) ) {	
	/* look for jXX 8 (7X), loop,jcx (e0-3), jXX 16/32 (0f 8X) */
	found=1;	
	if(verbose) 
	  printk("found jXX rel8, loop or jcx\n");
	break;
      } else if(text_read_ub(c)==0x66 ||
		text_read_ub(c)==0x67)	{ 	/* override prefix */
	c++;
      } else if(text_read_ub(c++)==0xf && (text_read_ub(c)&0xf0)==0x80 ) {
	found=1;	/* 0x0f 0x8X */
	if(verbose) printk("found branch!\n");
	break;
      }
    } else if(type==PTR_FAULT) {
      /* 5f) ptr: if instruction has regmodrm byte (i_has_modrm), 
       *     and mod field has address ([eyy]dispxx), eyy!=ebp
       *     flip 1 bit in lower byte (0x0f) or any bit in following 
       *     bytes (sib, imm or disp).
       */
      if(cur_value>off && modAddr) {
	unsigned char *c;
	c=(unsigned char *) modAddr;
	if( text_read_ub(c)>0x3f && text_read_ub(c)<0xc0 &&
		(text_read_ub(c)&7)!=5 ) {
	  found=1;
	  break;
	}
      }
    } else if(type==INTERFACE_FAULT) {
      /* 5f) i/f: look for movl XX(ebp), reg or movb XX(ebp), reg,
       *     where XX is positive. replace instr with nop.
       *     movl=0x8a, movb=0x8b, mod=01XXX101 (disp8[ebp]), disp>0 
       */
      unsigned char *c;
      c=(unsigned char *) prev_value;
      if( text_read_ub(c)==0x8a || text_read_ub(c)==0x8b) {
	c++;
	if( ((text_read_ub(c++))&0xc7)==0x45 && (text_read_ub(c)&0x80)==0 ) {
	  /* 75% chance that we'll choose the next arg */
	  if(random()&0x3) {
	    found=1;
	    break;
	  } else {
	    if(verbose) printk("skipped...\n");
	  }
	}
      }
    }else if(type==IRQ_FAULT) {
      /* 5g) i/f: look for push reg or offset(reg) / popf,
       *     where XX is positive. replace instr with nop.
       *     movl=0x8a, movb=0x8b, mod=01XXX101 (disp8[ebp]), disp>0 
       */
      unsigned char *c;
      c=(unsigned char *) prev_value;
      if (((text_read_ub(c) & 0xf8) == 0x50) || 
	  (text_read_ub(c) == 0xff)) {
	if (text_read_ub(c) == 0xff) {
	  c++;
#if 0
	  //
	  // Look for push x(ebp)
#endif
	  if ((text_read_ub(c) & 0x78) != 0x70) {
	    continue;
	  }
	  /* 
	  // Skip the offset
	  */
	  c++;
	}
	c++;
	if (text_read_ub(c) == 0x9d) {
	  /*
	  // Increment cur_value to include the 
	  // popf instruction
	  */
	  cur_value++;
	  found = 1;
	  break;
	}
      }
      
    }
  }
  /* if we're doing nop fault, then we're done. 
   */
  if(found) {
    *instr_len=cur_value-prev_value;
    off=prev_value;
    if(verbose) {
      printk("%s", name);
      if (d) printk("+0x%x", d);
      printk(" @ %x, ", value);
      printk("instr @ %x, len=%d, ", off, *instr_len);
#if 0
				// db_disasm(prev_value, FALSE); 
#endif
    }
    return off;
  } else {
    if(verbose) printk("cannot locate instruction in function\n"); 
    *instr_len=0;
    return 0;
  }
}

#if 0
static boolean_t
db_line_at_pc( sym, filename, linenum, pc)
	db_sym_t	sym;
	char		**filename;
	int		*linenum;
	db_expr_t	pc;
{
	return X_db_line_at_pc( db_last_symtab, sym, filename, linenum, pc);
}

int
db_sym_numargs(sym, nargp, argnames)
	db_sym_t	sym;
	int		*nargp;
	char		**argnames;
{
	return X_db_sym_numargs(db_last_symtab, sym, nargp, argnames);
}

#endif