[apple/xnu.git] / bsd / dev / i386 / dtrace_subr_x86.c

/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License (the "License").
 * You may not use this file except in compliance with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */

/*
 * Copyright 2006 Sun Microsystems, Inc.  All rights reserved.
 * Use is subject to license terms.
 */

/*
 * #pragma ident	"@(#)dtrace_subr.c	1.13	06/06/12 SMI"
 */

#include <sys/dtrace.h>
#include <sys/dtrace_glue.h>
#include <sys/dtrace_impl.h>
#include <sys/fasttrap.h>
#include <sys/vm.h>
#include <sys/user.h>
#include <sys/kauth.h>
#include <kern/debug.h>

int (*dtrace_pid_probe_ptr)(x86_saved_state_t *);
int (*dtrace_return_probe_ptr)(x86_saved_state_t *);

/*
 * HACK! There doesn't seem to be an easy way to include trap.h from
 * here. FIXME!
 */
#define	T_INT3			3		/* int 3 instruction */
#define T_DTRACE_RET		0x7f		/* DTrace pid return */

kern_return_t
dtrace_user_probe(x86_saved_state_t *);

kern_return_t
dtrace_user_probe(x86_saved_state_t *regs)
{
	x86_saved_state64_t *regs64;
	x86_saved_state32_t *regs32;
        int trapno;

	/*
	 * FIXME!
	 *
	 * The only call path into this method is always a user trap.
	 * We don't need to test for user trap, but should assert it.
	 */
	boolean_t user_mode = TRUE;

        if (is_saved_state64(regs) == TRUE) {
                regs64 = saved_state64(regs);
		regs32 = NULL;
                trapno = regs64->isf.trapno;
                user_mode = TRUE; // By default, because xnu is 32 bit only
        } else {
		regs64 = NULL;
                regs32 = saved_state32(regs);
                if (regs32->cs & 0x03) user_mode = TRUE;
                trapno = regs32->trapno;
        }

	lck_rw_t *rwp;
	struct proc *p = current_proc();

	uthread_t uthread = (uthread_t)get_bsdthread_info(current_thread());
	if (user_mode /*|| (rp->r_ps & PS_VM)*/) {
		/*
		 * DTrace accesses t_cred in probe context.  t_cred
		 * must always be either NULL, or point to a valid,
		 * allocated cred structure.
		 */
		kauth_cred_uthread_update(uthread, p);
	}

	if (trapno == T_DTRACE_RET) {
		uint8_t step = uthread->t_dtrace_step;
		uint8_t ret = uthread->t_dtrace_ret;
		user_addr_t npc = uthread->t_dtrace_npc;

		if (uthread->t_dtrace_ast) {
			printf("dtrace_user_probe() should be calling aston()\n");
			// aston(uthread);
			// uthread->t_sig_check = 1;
		}

		/*
		 * Clear all user tracing flags.
		 */
		uthread->t_dtrace_ft = 0;

		/*
		 * If we weren't expecting to take a return probe trap, kill
		 * the process as though it had just executed an unassigned
		 * trap instruction.
		 */
		if (step == 0) {
			/*
			 * APPLE NOTE: We're returning KERN_FAILURE, which causes 
			 * the generic signal handling code to take over, which will effectively
			 * deliver a EXC_BAD_INSTRUCTION to the user process.
			 */
	 		return KERN_FAILURE;
		}

		/*
		 * If we hit this trap unrelated to a return probe, we're
		 * just here to reset the AST flag since we deferred a signal
		 * until after we logically single-stepped the instruction we
		 * copied out.
		 */
		if (ret == 0) {
			if (regs64) {
				regs64->isf.rip = npc;
			} else {
				regs32->eip = npc;
			}
			return KERN_SUCCESS;
		}

		/*
		 * We need to wait until after we've called the
		 * dtrace_return_probe_ptr function pointer to set %pc.
		 */
		rwp = &CPU->cpu_ft_lock;
		lck_rw_lock_shared(rwp);

		if (dtrace_return_probe_ptr != NULL)
			(void) (*dtrace_return_probe_ptr)(regs);
		lck_rw_unlock_shared(rwp);

		if (regs64) {
			regs64->isf.rip = npc;
		} else {
			regs32->eip = npc;
		}

		return KERN_SUCCESS;
	} else if (trapno == T_INT3) {
		uint8_t instr;
		rwp = &CPU->cpu_ft_lock;

		/*
		 * The DTrace fasttrap provider uses the breakpoint trap
		 * (int 3). We let DTrace take the first crack at handling
		 * this trap; if it's not a probe that DTrace knowns about,
		 * we call into the trap() routine to handle it like a
		 * breakpoint placed by a conventional debugger.
		 */

		/*
		 * APPLE NOTE: I believe the purpose of the reader/writers lock
		 * is thus: There are times which dtrace needs to prevent calling
		 * dtrace_pid_probe_ptr(). Sun's original impl grabbed a plain
		 * mutex here. However, that serialized all probe calls, and
		 * destroyed MP behavior. So now they use a RW lock, with probes
		 * as readers, and the top level synchronization as a writer.
		 */
		lck_rw_lock_shared(rwp);
		if (dtrace_pid_probe_ptr != NULL && 
		    (*dtrace_pid_probe_ptr)(regs) == 0) {
			lck_rw_unlock_shared(rwp);
			return KERN_SUCCESS;
		}
		lck_rw_unlock_shared(rwp);


		/*
		 * If the instruction that caused the breakpoint trap doesn't
		 * look like an int 3 anymore, it may be that this tracepoint
		 * was removed just after the user thread executed it. In
		 * that case, return to user land to retry the instuction.
		 */
		user_addr_t pc = (regs64) ? regs64->isf.rip : (user_addr_t)regs32->eip;
		if (fuword8(pc - 1, &instr) == 0 && instr != FASTTRAP_INSTR) {
			if (regs64) {
				regs64->isf.rip--;
			} else {
				regs32->eip--;
			}
			return KERN_SUCCESS;
		}

	}

	return KERN_FAILURE;
}

void
dtrace_safe_synchronous_signal(void)
{
#if 0
	kthread_t *t = curthread;
	struct regs *rp = lwptoregs(ttolwp(t));
	size_t isz = t->t_dtrace_npc - t->t_dtrace_pc;

	ASSERT(t->t_dtrace_on);

	/*
	 * If we're not in the range of scratch addresses, we're not actually
	 * tracing user instructions so turn off the flags. If the instruction
	 * we copied out caused a synchonous trap, reset the pc back to its
	 * original value and turn off the flags.
	 */
	if (rp->r_pc < t->t_dtrace_scrpc ||
			rp->r_pc > t->t_dtrace_astpc + isz) {
		t->t_dtrace_ft = 0;
	} else if (rp->r_pc == t->t_dtrace_scrpc ||
			rp->r_pc == t->t_dtrace_astpc) {
		rp->r_pc = t->t_dtrace_pc;
		t->t_dtrace_ft = 0;
	}
#endif /* 0 */
}

int
dtrace_safe_defer_signal(void)
{
#if 0
	kthread_t *t = curthread;
	struct regs *rp = lwptoregs(ttolwp(t));
	size_t isz = t->t_dtrace_npc - t->t_dtrace_pc;

	ASSERT(t->t_dtrace_on);

	/*
	 * If we're not in the range of scratch addresses, we're not actually
	 * tracing user instructions so turn off the flags.
	 */
	if (rp->r_pc < t->t_dtrace_scrpc ||
			rp->r_pc > t->t_dtrace_astpc + isz) {
		t->t_dtrace_ft = 0;
		return (0);
	}

	/*
	 * If we've executed the original instruction, but haven't performed
	 * the jmp back to t->t_dtrace_npc or the clean up of any registers
	 * used to emulate %rip-relative instructions in 64-bit mode, do that
	 * here and take the signal right away. We detect this condition by
	 * seeing if the program counter is the range [scrpc + isz, astpc).
	 */
	if (t->t_dtrace_astpc - rp->r_pc <
			t->t_dtrace_astpc - t->t_dtrace_scrpc - isz) {
#ifdef __sol64
		/*
		 * If there is a scratch register and we're on the
		 * instruction immediately after the modified instruction,
		 * restore the value of that scratch register.
		 */
		if (t->t_dtrace_reg != 0 &&
				rp->r_pc == t->t_dtrace_scrpc + isz) {
			switch (t->t_dtrace_reg) {
				case REG_RAX:
					rp->r_rax = t->t_dtrace_regv;
					break;
				case REG_RCX:
					rp->r_rcx = t->t_dtrace_regv;
					break;
				case REG_R8:
					rp->r_r8 = t->t_dtrace_regv;
					break;
				case REG_R9:
					rp->r_r9 = t->t_dtrace_regv;
					break;
			}
		}
#endif
		rp->r_pc = t->t_dtrace_npc;
		t->t_dtrace_ft = 0;
		return (0);
	}

	/*
	 * Otherwise, make sure we'll return to the kernel after executing
	 * the copied out instruction and defer the signal.
	 */
	if (!t->t_dtrace_step) {
		ASSERT(rp->r_pc < t->t_dtrace_astpc);
		rp->r_pc += t->t_dtrace_astpc - t->t_dtrace_scrpc;
		t->t_dtrace_step = 1;
	}

	t->t_dtrace_ast = 1;

	return (1);

#endif /* 0 */

	return 0;
}
Commit	Line	Data
2d21ac55 A	1	/*
	2	* CDDL HEADER START
	3	*
	4	* The contents of this file are subject to the terms of the
	5	* Common Development and Distribution License (the "License").
	6	* You may not use this file except in compliance with the License.
	7	*
	8	* You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
	9	* or http://www.opensolaris.org/os/licensing.
	10	* See the License for the specific language governing permissions
	11	* and limitations under the License.
	12	*
	13	* When distributing Covered Code, include this CDDL HEADER in each
	14	* file and include the License file at usr/src/OPENSOLARIS.LICENSE.
	15	* If applicable, add the following below this CDDL HEADER, with the
	16	* fields enclosed by brackets "[]" replaced with your own identifying
	17	* information: Portions Copyright [yyyy] [name of copyright owner]
	18	*
	19	* CDDL HEADER END
	20	*/
	21
	22	/*
	23	* Copyright 2006 Sun Microsystems, Inc. All rights reserved.
	24	* Use is subject to license terms.
	25	*/
	26
	27	/*
	28	* #pragma ident "@(#)dtrace_subr.c 1.13 06/06/12 SMI"
	29	*/
	30
	31	#include <sys/dtrace.h>
	32	#include <sys/dtrace_glue.h>
	33	#include <sys/dtrace_impl.h>
	34	#include <sys/fasttrap.h>
	35	#include <sys/vm.h>
	36	#include <sys/user.h>
	37	#include <sys/kauth.h>
	38	#include <kern/debug.h>
	39
	40	int (dtrace_pid_probe_ptr)(x86_saved_state_t );
	41	int (dtrace_return_probe_ptr)(x86_saved_state_t );
	42
	43	/*
	44	* HACK! There doesn't seem to be an easy way to include trap.h from
	45	* here. FIXME!
	46	*/
	47	#define T_INT3 3 /* int 3 instruction */
	48	#define T_DTRACE_RET 0x7f /* DTrace pid return */
	49
	50	kern_return_t
	51	dtrace_user_probe(x86_saved_state_t *);
	52
	53	kern_return_t
	54	dtrace_user_probe(x86_saved_state_t *regs)
	55	{
	56	x86_saved_state64_t *regs64;
	57	x86_saved_state32_t *regs32;
	58	int trapno;
	59
	60	/*
	61	* FIXME!
	62	*
	63	* The only call path into this method is always a user trap.
	64	* We don't need to test for user trap, but should assert it.
65	*/
66	boolean_t user_mode = TRUE;
67
68	if (is_saved_state64(regs) == TRUE) {
69	regs64 = saved_state64(regs);
70	regs32 = NULL;
71	trapno = regs64->isf.trapno;
72	user_mode = TRUE; // By default, because xnu is 32 bit only
73	} else {
74	regs64 = NULL;
75	regs32 = saved_state32(regs);
76	if (regs32->cs & 0x03) user_mode = TRUE;
77	trapno = regs32->trapno;
78	}
79
80	lck_rw_t *rwp;
81	struct proc *p = current_proc();
82
83	uthread_t uthread = (uthread_t)get_bsdthread_info(current_thread());
84	if (user_mode /\|\| (rp->r_ps & PS_VM)/) {
85	/*
86	* DTrace accesses t_cred in probe context. t_cred
87	* must always be either NULL, or point to a valid,
88	* allocated cred structure.
89	*/
90	kauth_cred_uthread_update(uthread, p);
91	}
92
93	if (trapno == T_DTRACE_RET) {
94	uint8_t step = uthread->t_dtrace_step;
95	uint8_t ret = uthread->t_dtrace_ret;
96	user_addr_t npc = uthread->t_dtrace_npc;
97
98	if (uthread->t_dtrace_ast) {
99	printf("dtrace_user_probe() should be calling aston()\n");
100	// aston(uthread);
101	// uthread->t_sig_check = 1;
102	}
103
104	/*
105	* Clear all user tracing flags.
106	*/
107	uthread->t_dtrace_ft = 0;
108
109	/*
110	* If we weren't expecting to take a return probe trap, kill
111	* the process as though it had just executed an unassigned
112	* trap instruction.
113	*/
114	if (step == 0) {
115	/*
116	* APPLE NOTE: We're returning KERN_FAILURE, which causes
117	* the generic signal handling code to take over, which will effectively
118	* deliver a EXC_BAD_INSTRUCTION to the user process.
119	*/
120	return KERN_FAILURE;
121	}
122
123	/*
124	* If we hit this trap unrelated to a return probe, we're
125	* just here to reset the AST flag since we deferred a signal
126	* until after we logically single-stepped the instruction we
127	* copied out.
128	*/
129	if (ret == 0) {
130	if (regs64) {
131	regs64->isf.rip = npc;
132	} else {
133	regs32->eip = npc;
134	}
135	return KERN_SUCCESS;
136	}
137
138	/*
139	* We need to wait until after we've called the
140	* dtrace_return_probe_ptr function pointer to set %pc.
141	*/
142	rwp = &CPU->cpu_ft_lock;
143	lck_rw_lock_shared(rwp);
144
145	if (dtrace_return_probe_ptr != NULL)
146	(void) (*dtrace_return_probe_ptr)(regs);
147	lck_rw_unlock_shared(rwp);
148
149	if (regs64) {
150	regs64->isf.rip = npc;
151	} else {
152	regs32->eip = npc;
153	}
154
155	return KERN_SUCCESS;
156	} else if (trapno == T_INT3) {
157	uint8_t instr;
158	rwp = &CPU->cpu_ft_lock;
159
160	/*
161	* The DTrace fasttrap provider uses the breakpoint trap
162	* (int 3). We let DTrace take the first crack at handling
163	* this trap; if it's not a probe that DTrace knowns about,
164	* we call into the trap() routine to handle it like a
165	* breakpoint placed by a conventional debugger.
166	*/
167
168	/*
169	* APPLE NOTE: I believe the purpose of the reader/writers lock
170	* is thus: There are times which dtrace needs to prevent calling
171	* dtrace_pid_probe_ptr(). Sun's original impl grabbed a plain
172	* mutex here. However, that serialized all probe calls, and
173	* destroyed MP behavior. So now they use a RW lock, with probes
174	* as readers, and the top level synchronization as a writer.
175	*/
176	lck_rw_lock_shared(rwp);
177	if (dtrace_pid_probe_ptr != NULL &&
178	(*dtrace_pid_probe_ptr)(regs) == 0) {
179	lck_rw_unlock_shared(rwp);
180	return KERN_SUCCESS;
181	}
182	lck_rw_unlock_shared(rwp);
183
184
185	/*
186	* If the instruction that caused the breakpoint trap doesn't
187	* look like an int 3 anymore, it may be that this tracepoint
188	* was removed just after the user thread executed it. In
189	* that case, return to user land to retry the instuction.
190	*/
191	user_addr_t pc = (regs64) ? regs64->isf.rip : (user_addr_t)regs32->eip;
192	if (fuword8(pc - 1, &instr) == 0 && instr != FASTTRAP_INSTR) {
193	if (regs64) {
194	regs64->isf.rip--;
195	} else {
196	regs32->eip--;
197	}
198	return KERN_SUCCESS;
199	}
200
201	}
202
203	return KERN_FAILURE;
204	}
205
206	void
207	dtrace_safe_synchronous_signal(void)
208	{
209	#if 0
210	kthread_t *t = curthread;
211	struct regs *rp = lwptoregs(ttolwp(t));
212	size_t isz = t->t_dtrace_npc - t->t_dtrace_pc;
213
214	ASSERT(t->t_dtrace_on);
215
216	/*
217	* If we're not in the range of scratch addresses, we're not actually
218	* tracing user instructions so turn off the flags. If the instruction
219	* we copied out caused a synchonous trap, reset the pc back to its
220	* original value and turn off the flags.
221	*/
222	if (rp->r_pc < t->t_dtrace_scrpc \|\|
223	rp->r_pc > t->t_dtrace_astpc + isz) {
224	t->t_dtrace_ft = 0;
225	} else if (rp->r_pc == t->t_dtrace_scrpc \|\|
226	rp->r_pc == t->t_dtrace_astpc) {
227	rp->r_pc = t->t_dtrace_pc;
228	t->t_dtrace_ft = 0;
229	}
230	#endif /* 0 */
231	}
232
233	int
234	dtrace_safe_defer_signal(void)
235	{
236	#if 0
237	kthread_t *t = curthread;
238	struct regs *rp = lwptoregs(ttolwp(t));
239	size_t isz = t->t_dtrace_npc - t->t_dtrace_pc;
240
241	ASSERT(t->t_dtrace_on);
242
243	/*
244	* If we're not in the range of scratch addresses, we're not actually
245	* tracing user instructions so turn off the flags.
246	*/
247	if (rp->r_pc < t->t_dtrace_scrpc \|\|
248	rp->r_pc > t->t_dtrace_astpc + isz) {
249	t->t_dtrace_ft = 0;
250	return (0);
251	}
252
253	/*
254	* If we've executed the original instruction, but haven't performed
255	* the jmp back to t->t_dtrace_npc or the clean up of any registers
256	* used to emulate %rip-relative instructions in 64-bit mode, do that
257	* here and take the signal right away. We detect this condition by
258	* seeing if the program counter is the range [scrpc + isz, astpc).
259	*/
260	if (t->t_dtrace_astpc - rp->r_pc <
261	t->t_dtrace_astpc - t->t_dtrace_scrpc - isz) {
262	#ifdef __sol64
263	/*
264	* If there is a scratch register and we're on the
265	* instruction immediately after the modified instruction,
266	* restore the value of that scratch register.
267	*/
268	if (t->t_dtrace_reg != 0 &&
269	rp->r_pc == t->t_dtrace_scrpc + isz) {
270	switch (t->t_dtrace_reg) {
271	case REG_RAX:
272	rp->r_rax = t->t_dtrace_regv;
273	break;
274	case REG_RCX:
275	rp->r_rcx = t->t_dtrace_regv;
276	break;
277	case REG_R8:
278	rp->r_r8 = t->t_dtrace_regv;
279	break;
280	case REG_R9:
281	rp->r_r9 = t->t_dtrace_regv;
282	break;
283	}
284	}
285	#endif
286	rp->r_pc = t->t_dtrace_npc;
287	t->t_dtrace_ft = 0;
288	return (0);
289	}
290
291	/*
292	* Otherwise, make sure we'll return to the kernel after executing
293	* the copied out instruction and defer the signal.
294	*/
295	if (!t->t_dtrace_step) {
296	ASSERT(rp->r_pc < t->t_dtrace_astpc);
297	rp->r_pc += t->t_dtrace_astpc - t->t_dtrace_scrpc;
298	t->t_dtrace_step = 1;
299	}
300
301	t->t_dtrace_ast = 1;
302
303	return (1);
304
305	#endif /* 0 */
306
307	return 0;
308	}