1 /*
2 * CDDL HEADER START
3 *
4 * The contents of this file are subject to the terms of the
5 * Common Development and Distribution License (the "License").
6 * You may not use this file except in compliance with the License.
7 *
8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9 * or http://www.opensolaris.org/os/licensing.
10 * See the License for the specific language governing permissions
11 * and limitations under the License.
12 *
13 * When distributing Covered Code, include this CDDL HEADER in each
14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15 * If applicable, add the following below this CDDL HEADER, with the
16 * fields enclosed by brackets "[]" replaced with your own identifying
17 * information: Portions Copyright [yyyy] [name of copyright owner]
18 *
19 * CDDL HEADER END
20 */
21
22 /*
23 * Copyright 2007 Sun Microsystems, Inc. All rights reserved.
24 * Use is subject to license terms.
25 */
26
27 #include <sys/dtrace.h>
28 #include <sys/dtrace_glue.h>
29 #include <sys/dtrace_impl.h>
30 #include <sys/fasttrap.h>
31 #include <sys/vm.h>
32 #include <sys/user.h>
33 #include <sys/kauth.h>
34 #include <kern/debug.h>
35
36 int (*dtrace_pid_probe_ptr)(x86_saved_state_t *);
37 int (*dtrace_return_probe_ptr)(x86_saved_state_t *);
38
39 /*
40 * HACK! There doesn't seem to be an easy way to include trap.h from
41 * here. FIXME!
42 */
43 #define T_INT3 3 /* int 3 instruction */
44
45 kern_return_t
46 dtrace_user_probe(x86_saved_state_t *);
47
48 kern_return_t
dtrace_user_probe(x86_saved_state_t * regs)49 dtrace_user_probe(x86_saved_state_t *regs)
50 {
51 x86_saved_state64_t *regs64;
52 x86_saved_state32_t *regs32;
53 int trapno;
54
55 /*
56 * FIXME!
57 *
58 * The only call path into this method is always a user trap.
59 * We don't need to test for user trap, but should assert it.
60 */
61 boolean_t user_mode = TRUE;
62
63 if (is_saved_state64(regs) == TRUE) {
64 regs64 = saved_state64(regs);
65 regs32 = NULL;
66 trapno = regs64->isf.trapno;
67 user_mode = TRUE; // By default, because xnu is 32 bit only
68 } else {
69 regs64 = NULL;
70 regs32 = saved_state32(regs);
71 if (regs32->cs & 0x03) user_mode = TRUE;
72 trapno = regs32->trapno;
73 }
74
75 lck_rw_t *rwp;
76
77 uthread_t uthread = current_uthread();
78 if (user_mode /*|| (rp->r_ps & PS_VM)*/) {
79 /*
80 * DTrace accesses t_cred in probe context. t_cred
81 * must always be either NULL, or point to a valid,
82 * allocated cred structure.
83 */
84 current_cached_proc_cred_update();
85 }
86
87 if (trapno == T_DTRACE_RET) {
88 uint8_t step = uthread->t_dtrace_step;
89 uint8_t ret = uthread->t_dtrace_ret;
90 user_addr_t npc = uthread->t_dtrace_npc;
91
92 if (uthread->t_dtrace_ast) {
93 printf("dtrace_user_probe() should be calling aston()\n");
94 // aston(uthread);
95 // uthread->t_sig_check = 1;
96 }
97
98 /*
99 * Clear all user tracing flags.
100 */
101 uthread->t_dtrace_ft = 0;
102
103 /*
104 * If we weren't expecting to take a return probe trap, kill
105 * the process as though it had just executed an unassigned
106 * trap instruction.
107 */
108 if (step == 0) {
109 /*
110 * APPLE NOTE: We're returning KERN_FAILURE, which causes
111 * the generic signal handling code to take over, which will effectively
112 * deliver a EXC_BAD_INSTRUCTION to the user process.
113 */
114 return KERN_FAILURE;
115 }
116
117 /*
118 * If we hit this trap unrelated to a return probe, we're
119 * just here to reset the AST flag since we deferred a signal
120 * until after we logically single-stepped the instruction we
121 * copied out.
122 */
123 if (ret == 0) {
124 if (regs64) {
125 regs64->isf.rip = npc;
126 } else {
127 regs32->eip = (uint32_t)npc;
128 }
129 return KERN_SUCCESS;
130 }
131
132 /*
133 * We need to wait until after we've called the
134 * dtrace_return_probe_ptr function pointer to set %pc.
135 */
136 rwp = &CPU->cpu_ft_lock;
137 lck_rw_lock_shared(rwp);
138
139 if (dtrace_return_probe_ptr != NULL)
140 (void) (*dtrace_return_probe_ptr)(regs);
141 lck_rw_unlock_shared(rwp);
142
143 if (regs64) {
144 regs64->isf.rip = npc;
145 } else {
146 regs32->eip = (uint32_t)npc;
147 }
148
149 return KERN_SUCCESS;
150 } else if (trapno == T_INT3) {
151 uint8_t instr, instr2;
152 rwp = &CPU->cpu_ft_lock;
153
154 /*
155 * The DTrace fasttrap provider uses the breakpoint trap
156 * (int 3). We let DTrace take the first crack at handling
157 * this trap; if it's not a probe that DTrace knowns about,
158 * we call into the trap() routine to handle it like a
159 * breakpoint placed by a conventional debugger.
160 */
161
162 /*
163 * APPLE NOTE: I believe the purpose of the reader/writers lock
164 * is thus: There are times which dtrace needs to prevent calling
165 * dtrace_pid_probe_ptr(). Sun's original impl grabbed a plain
166 * mutex here. However, that serialized all probe calls, and
167 * destroyed MP behavior. So now they use a RW lock, with probes
168 * as readers, and the top level synchronization as a writer.
169 */
170 lck_rw_lock_shared(rwp);
171 if (dtrace_pid_probe_ptr != NULL &&
172 (*dtrace_pid_probe_ptr)(regs) == 0) {
173 lck_rw_unlock_shared(rwp);
174 return KERN_SUCCESS;
175 }
176 lck_rw_unlock_shared(rwp);
177
178
179 /*
180 * If the instruction that caused the breakpoint trap doesn't
181 * look like an int 3 anymore, it may be that this tracepoint
182 * was removed just after the user thread executed it. In
183 * that case, return to user land to retry the instuction.
184 */
185 user_addr_t pc = (regs64) ? regs64->isf.rip : (user_addr_t)regs32->eip;
186 if (fuword8(pc - 1, &instr) == 0 && instr != FASTTRAP_INSTR && // neither single-byte INT3 (0xCC)
187 !(instr == 3 && fuword8(pc - 2, &instr2) == 0 && instr2 == 0xCD)) { // nor two-byte INT 3 (0xCD03)
188 if (regs64) {
189 regs64->isf.rip--;
190 } else {
191 regs32->eip--;
192 }
193 return KERN_SUCCESS;
194 }
195
196 }
197
198 return KERN_FAILURE;
199 }
200
201 void
dtrace_flush_caches(void)202 dtrace_flush_caches(void)
203 {
204
205 }
206