1 /*
2 * CDDL HEADER START
3 *
4 * The contents of this file are subject to the terms of the
5 * Common Development and Distribution License (the "License").
6 * You may not use this file except in compliance with the License.
7 *
8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9 * or http://www.opensolaris.org/os/licensing.
10 * See the License for the specific language governing permissions
11 * and limitations under the License.
12 *
13 * When distributing Covered Code, include this CDDL HEADER in each
14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15 * If applicable, add the following below this CDDL HEADER, with the
16 * fields enclosed by brackets "[]" replaced with your own identifying
17 * information: Portions Copyright [yyyy] [name of copyright owner]
18 *
19 * CDDL HEADER END
20 */
21
22 /*
23 * Copyright 2009 Sun Microsystems, Inc. All rights reserved.
24 * Use is subject to license terms.
25 */
26
27 /*
28 * Copyright (c) 2011, Joyent, Inc. All rights reserved.
29 */
30
31 #include <sys/dtrace.h>
32 #include <sys/fasttrap.h>
33 #include <sys/x_call.h>
34 #include <sys/cmn_err.h>
35 #include <sys/trap.h>
36 #include <sys/psw.h>
37 #include <sys/privregs.h>
38 #include <sys/machsystm.h>
39 #include <vm/seg_kmem.h>
40
41 typedef struct dtrace_invop_hdlr {
42 int (*dtih_func)(uintptr_t, uintptr_t *, uintptr_t);
43 struct dtrace_invop_hdlr *dtih_next;
44 } dtrace_invop_hdlr_t;
45
46 dtrace_invop_hdlr_t *dtrace_invop_hdlr;
47
48 int
dtrace_invop(uintptr_t addr,uintptr_t * stack,uintptr_t eax)49 dtrace_invop(uintptr_t addr, uintptr_t *stack, uintptr_t eax)
50 {
51 dtrace_invop_hdlr_t *hdlr;
52 int rval;
53
54 for (hdlr = dtrace_invop_hdlr; hdlr != NULL; hdlr = hdlr->dtih_next) {
55 if ((rval = hdlr->dtih_func(addr, stack, eax)) != 0)
56 return (rval);
57 }
58
59 return (0);
60 }
61
62 void
dtrace_invop_add(int (* func)(uintptr_t,uintptr_t *,uintptr_t))63 dtrace_invop_add(int (*func)(uintptr_t, uintptr_t *, uintptr_t))
64 {
65 dtrace_invop_hdlr_t *hdlr;
66
67 hdlr = kmem_alloc(sizeof (dtrace_invop_hdlr_t), KM_SLEEP);
68 hdlr->dtih_func = func;
69 hdlr->dtih_next = dtrace_invop_hdlr;
70 dtrace_invop_hdlr = hdlr;
71 }
72
73 void
dtrace_invop_remove(int (* func)(uintptr_t,uintptr_t *,uintptr_t))74 dtrace_invop_remove(int (*func)(uintptr_t, uintptr_t *, uintptr_t))
75 {
76 dtrace_invop_hdlr_t *hdlr = dtrace_invop_hdlr, *prev = NULL;
77
78 for (;;) {
79 if (hdlr == NULL)
80 panic("attempt to remove non-existent invop handler");
81
82 if (hdlr->dtih_func == func)
83 break;
84
85 prev = hdlr;
86 hdlr = hdlr->dtih_next;
87 }
88
89 if (prev == NULL) {
90 ASSERT(dtrace_invop_hdlr == hdlr);
91 dtrace_invop_hdlr = hdlr->dtih_next;
92 } else {
93 ASSERT(dtrace_invop_hdlr != hdlr);
94 prev->dtih_next = hdlr->dtih_next;
95 }
96
97 kmem_free(hdlr, sizeof (dtrace_invop_hdlr_t));
98 }
99
100 int
dtrace_getipl(void)101 dtrace_getipl(void)
102 {
103 return (CPU->cpu_pri);
104 }
105
106 /*ARGSUSED*/
107 void
dtrace_toxic_ranges(void (* func)(uintptr_t base,uintptr_t limit))108 dtrace_toxic_ranges(void (*func)(uintptr_t base, uintptr_t limit))
109 {
110 extern uintptr_t toxic_addr;
111 extern size_t toxic_size;
112
113 (*func)(0, _userlimit);
114
115 if (hole_end > hole_start)
116 (*func)(hole_start, hole_end);
117 (*func)(toxic_addr, toxic_addr + toxic_size);
118 (*func)(0, _userlimit);
119 }
120
121 static int
dtrace_xcall_func(xc_arg_t arg1,xc_arg_t arg2,xc_arg_t arg3 __unused)122 dtrace_xcall_func(xc_arg_t arg1, xc_arg_t arg2, xc_arg_t arg3 __unused)
123 {
124 dtrace_xcall_t func = (dtrace_xcall_t)arg1;
125 (*func)((void*)arg2);
126
127 return (0);
128 }
129
130 /*ARGSUSED*/
131 void
dtrace_xcall(processorid_t cpu,dtrace_xcall_t func,void * arg)132 dtrace_xcall(processorid_t cpu, dtrace_xcall_t func, void *arg)
133 {
134 cpuset_t set;
135
136 CPUSET_ZERO(set);
137
138 if (cpu == DTRACE_CPUALL) {
139 CPUSET_ALL(set);
140 } else {
141 CPUSET_ADD(set, cpu);
142 }
143
144 kpreempt_disable();
145 xc_sync((xc_arg_t)func, (xc_arg_t)arg, 0, CPUSET2BV(set),
146 dtrace_xcall_func);
147 kpreempt_enable();
148 }
149
150 void
dtrace_sync_func(void)151 dtrace_sync_func(void)
152 {}
153
154 void
dtrace_sync(void)155 dtrace_sync(void)
156 {
157 dtrace_xcall(DTRACE_CPUALL, (dtrace_xcall_t)dtrace_sync_func, NULL);
158 }
159
160 int (*dtrace_pid_probe_ptr)(struct regs *);
161 int (*dtrace_return_probe_ptr)(struct regs *);
162
163 void
dtrace_user_probe(struct regs * rp,caddr_t addr,processorid_t cpuid)164 dtrace_user_probe(struct regs *rp, caddr_t addr, processorid_t cpuid)
165 {
166 krwlock_t *rwp;
167 proc_t *p = curproc;
168 extern void trap(struct regs *, caddr_t, processorid_t);
169
170 if (USERMODE(rp->r_cs) || (rp->r_ps & PS_VM)) {
171 if (curthread->t_cred != p->p_cred) {
172 cred_t *oldcred = curthread->t_cred;
173 /*
174 * DTrace accesses t_cred in probe context. t_cred
175 * must always be either NULL, or point to a valid,
176 * allocated cred structure.
177 */
178 curthread->t_cred = crgetcred();
179 crfree(oldcred);
180 }
181 }
182
183 if (rp->r_trapno == T_DTRACE_RET) {
184 uint8_t step = curthread->t_dtrace_step;
185 uint8_t ret = curthread->t_dtrace_ret;
186 uintptr_t npc = curthread->t_dtrace_npc;
187
188 if (curthread->t_dtrace_ast) {
189 aston(curthread);
190 curthread->t_sig_check = 1;
191 }
192
193 /*
194 * Clear all user tracing flags.
195 */
196 curthread->t_dtrace_ft = 0;
197
198 /*
199 * If we weren't expecting to take a return probe trap, kill
200 * the process as though it had just executed an unassigned
201 * trap instruction.
202 */
203 if (step == 0) {
204 tsignal(curthread, SIGILL);
205 return;
206 }
207
208 /*
209 * If we hit this trap unrelated to a return probe, we're
210 * just here to reset the AST flag since we deferred a signal
211 * until after we logically single-stepped the instruction we
212 * copied out.
213 */
214 if (ret == 0) {
215 rp->r_pc = npc;
216 return;
217 }
218
219 /*
220 * We need to wait until after we've called the
221 * dtrace_return_probe_ptr function pointer to set %pc.
222 */
223 rwp = &CPU->cpu_ft_lock;
224 rw_enter(rwp, RW_READER);
225 if (dtrace_return_probe_ptr != NULL)
226 (void) (*dtrace_return_probe_ptr)(rp);
227 rw_exit(rwp);
228 rp->r_pc = npc;
229
230 } else if (rp->r_trapno == T_BPTFLT) {
231 uint8_t instr, instr2;
232 caddr_t linearpc;
233 rwp = &CPU->cpu_ft_lock;
234
235 /*
236 * The DTrace fasttrap provider uses the breakpoint trap
237 * (int 3). We let DTrace take the first crack at handling
238 * this trap; if it's not a probe that DTrace knowns about,
239 * we call into the trap() routine to handle it like a
240 * breakpoint placed by a conventional debugger.
241 */
242 rw_enter(rwp, RW_READER);
243 if (dtrace_pid_probe_ptr != NULL &&
244 (*dtrace_pid_probe_ptr)(rp) == 0) {
245 rw_exit(rwp);
246 return;
247 }
248 rw_exit(rwp);
249
250 if (dtrace_linear_pc(rp, p, &linearpc) != 0) {
251 trap(rp, addr, cpuid);
252 return;
253 }
254
255 /*
256 * If the instruction that caused the breakpoint trap doesn't
257 * look like an int 3 anymore, it may be that this tracepoint
258 * was removed just after the user thread executed it. In
259 * that case, return to user land to retry the instuction.
260 * Note that we assume the length of the instruction to retry
261 * is 1 byte because that's the length of FASTTRAP_INSTR.
262 * We check for r_pc > 0 and > 2 so that we don't have to
263 * deal with segment wraparound.
264 */
265 if (rp->r_pc > 0 && fuword8(linearpc - 1, &instr) == 0 &&
266 instr != FASTTRAP_INSTR &&
267 (instr != 3 || (rp->r_pc >= 2 &&
268 (fuword8(linearpc - 2, &instr2) != 0 || instr2 != 0xCD)))) {
269 rp->r_pc--;
270 return;
271 }
272
273 trap(rp, addr, cpuid);
274
275 } else {
276 trap(rp, addr, cpuid);
277 }
278 }
279
280 void
dtrace_safe_synchronous_signal(void)281 dtrace_safe_synchronous_signal(void)
282 {
283 kthread_t *t = curthread;
284 struct regs *rp = lwptoregs(ttolwp(t));
285 size_t isz = t->t_dtrace_npc - t->t_dtrace_pc;
286
287 ASSERT(t->t_dtrace_on);
288
289 /*
290 * If we're not in the range of scratch addresses, we're not actually
291 * tracing user instructions so turn off the flags. If the instruction
292 * we copied out caused a synchonous trap, reset the pc back to its
293 * original value and turn off the flags.
294 */
295 if (rp->r_pc < t->t_dtrace_scrpc ||
296 rp->r_pc > t->t_dtrace_astpc + isz) {
297 t->t_dtrace_ft = 0;
298 } else if (rp->r_pc == t->t_dtrace_scrpc ||
299 rp->r_pc == t->t_dtrace_astpc) {
300 rp->r_pc = t->t_dtrace_pc;
301 t->t_dtrace_ft = 0;
302 }
303 }
304
305 int
dtrace_safe_defer_signal(void)306 dtrace_safe_defer_signal(void)
307 {
308 kthread_t *t = curthread;
309 struct regs *rp = lwptoregs(ttolwp(t));
310 size_t isz = t->t_dtrace_npc - t->t_dtrace_pc;
311
312 ASSERT(t->t_dtrace_on);
313
314 /*
315 * If we're not in the range of scratch addresses, we're not actually
316 * tracing user instructions so turn off the flags.
317 */
318 if (rp->r_pc < t->t_dtrace_scrpc ||
319 rp->r_pc > t->t_dtrace_astpc + isz) {
320 t->t_dtrace_ft = 0;
321 return (0);
322 }
323
324 /*
325 * If we have executed the original instruction, but we have performed
326 * neither the jmp back to t->t_dtrace_npc nor the clean up of any
327 * registers used to emulate %rip-relative instructions in 64-bit mode,
328 * we'll save ourselves some effort by doing that here and taking the
329 * signal right away. We detect this condition by seeing if the program
330 * counter is the range [scrpc + isz, astpc).
331 */
332 if (rp->r_pc >= t->t_dtrace_scrpc + isz &&
333 rp->r_pc < t->t_dtrace_astpc) {
334 /*
335 * If there is a scratch register and we're on the
336 * instruction immediately after the modified instruction,
337 * restore the value of that scratch register.
338 */
339 if (t->t_dtrace_reg != 0 &&
340 rp->r_pc == t->t_dtrace_scrpc + isz) {
341 switch (t->t_dtrace_reg) {
342 case REG_RAX:
343 rp->r_rax = t->t_dtrace_regv;
344 break;
345 case REG_RCX:
346 rp->r_rcx = t->t_dtrace_regv;
347 break;
348 case REG_R8:
349 rp->r_r8 = t->t_dtrace_regv;
350 break;
351 case REG_R9:
352 rp->r_r9 = t->t_dtrace_regv;
353 break;
354 }
355 }
356 rp->r_pc = t->t_dtrace_npc;
357 t->t_dtrace_ft = 0;
358 return (0);
359 }
360
361 /*
362 * Otherwise, make sure we'll return to the kernel after executing
363 * the copied out instruction and defer the signal.
364 */
365 if (!t->t_dtrace_step) {
366 ASSERT(rp->r_pc < t->t_dtrace_astpc);
367 rp->r_pc += t->t_dtrace_astpc - t->t_dtrace_scrpc;
368 t->t_dtrace_step = 1;
369 }
370
371 t->t_dtrace_ast = 1;
372
373 return (1);
374 }
375
376 /*
377 * Additional artificial frames for the machine type. For i86pc, we're already
378 * accounted for, so return 0. On the hypervisor, we have an additional frame
379 * (xen_callback_handler).
380 */
381 int
dtrace_mach_aframes(void)382 dtrace_mach_aframes(void)
383 {
384 #ifdef __xpv
385 return (1);
386 #else
387 return (0);
388 #endif
389 }
390