2 * Copyright (c) 2005-2018 Apple Computer, Inc. All rights reserved.
4 * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
6 * This file contains Original Code and/or Modifications of Original Code
7 * as defined in and that are subject to the Apple Public Source License
8 * Version 2.0 (the 'License'). You may not use this file except in
9 * compliance with the License. The rights granted to you under the License
10 * may not be used to create, or enable the creation or redistribution of,
11 * unlawful or unlicensed copies of an Apple operating system, or to
12 * circumvent, violate, or enable the circumvention or violation of, any
13 * terms of an Apple operating system software license agreement.
15 * Please obtain a copy of the License at
16 * http://www.opensource.apple.com/apsl/ and read it before using this file.
18 * The Original Code and all software distributed under the License are
19 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
20 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
21 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
22 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
23 * Please see the License for the specific language governing rights and
24 * limitations under the License.
26 * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
29 #include <arm/caches_internal.h>
30 #include <kern/thread.h>
32 #if __has_include(<ptrauth.h>)
37 #include <sys/systm.h>
39 #include <sys/proc_internal.h>
40 #include <sys/kauth.h>
41 #include <sys/dtrace.h>
42 #include <sys/dtrace_impl.h>
43 #include <machine/atomic.h>
44 #include <kern/simple_lock.h>
45 #include <kern/sched_prim.h> /* for thread_wakeup() */
46 #include <kern/thread_call.h>
47 #include <kern/task.h>
49 extern struct arm_saved_state
*find_kern_regs(thread_t
);
51 extern dtrace_id_t dtrace_probeid_error
; /* special ERROR probe */
52 typedef arm_saved_state_t savearea_t
;
54 extern lck_attr_t
*dtrace_lck_attr
;
55 extern lck_grp_t
*dtrace_lck_grp
;
58 extern void * pmap_stacks_start
;
59 extern void * pmap_stacks_end
;
63 struct frame
*backchain
;
68 * Atomicity and synchronization
71 dtrace_membar_producer(void)
74 __asm__
volatile ("dmb ish" : : : "memory");
76 __asm__
volatile ("nop" : : : "memory");
81 dtrace_membar_consumer(void)
84 __asm__
volatile ("dmb ish" : : : "memory");
86 __asm__
volatile ("nop" : : : "memory");
91 * Interrupt manipulation
92 * XXX dtrace_getipl() can be called from probe context.
98 * XXX Drat, get_interrupt_level is MACH_KERNEL_PRIVATE
99 * in osfmk/kern/cpu_data.h
101 /* return get_interrupt_level(); */
102 return ml_at_interrupt_context() ? 1 : 0;
110 decl_lck_mtx_data(static, dt_xc_lock
);
111 static uint32_t dt_xc_sync
;
113 typedef struct xcArg
{
122 xcArg_t
*pArg
= (xcArg_t
*) foo
;
124 if (pArg
->cpu
== CPU
->cpu_id
|| pArg
->cpu
== DTRACE_CPUALL
) {
125 (pArg
->f
)(pArg
->arg
);
128 if (os_atomic_dec(&dt_xc_sync
, relaxed
) == 0) {
129 thread_wakeup((event_t
) &dt_xc_sync
);
135 * dtrace_xcall() is not called from probe context.
138 dtrace_xcall(processorid_t cpu
, dtrace_xcall_t f
, void *arg
)
141 /* Only one dtrace_xcall in flight allowed */
142 lck_mtx_lock(&dt_xc_lock
);
150 cpu_broadcast_xcall(&dt_xc_sync
, TRUE
, xcRemote
, (void*) &xcArg
);
152 lck_mtx_unlock(&dt_xc_lock
);
156 /* On uniprocessor systems, the cpu should always be either ourselves or all */
157 ASSERT(cpu
== CPU
->cpu_id
|| cpu
== DTRACE_CPUALL
);
168 dtrace_isa_init(void)
170 lck_mtx_init(&dt_xc_lock
, dtrace_lck_grp
, dtrace_lck_attr
);
176 * Register definitions
182 #define ARM64_CPSR 33
188 dtrace_getreg(struct regs
* savearea
, uint_t reg
)
190 struct arm_saved_state
*regs
= (struct arm_saved_state
*) savearea
;
193 DTRACE_CPUFLAG_SET(CPU_DTRACE_ILLOP
);
197 if (!check_saved_state_reglimit(regs
, reg
)) {
198 DTRACE_CPUFLAG_SET(CPU_DTRACE_ILLOP
);
202 return (uint64_t)get_saved_state_reg(regs
, reg
);
205 #define RETURN_OFFSET64 8
208 dtrace_getustack_common(uint64_t * pcstack
, int pcstack_limit
, user_addr_t pc
,
213 ASSERT(pcstack
== NULL
|| pcstack_limit
> 0);
217 if (pcstack
!= NULL
) {
218 *pcstack
++ = (uint64_t) pc
;
220 if (pcstack_limit
<= 0) {
229 pc
= dtrace_fuword64((sp
+ RETURN_OFFSET64
));
230 sp
= dtrace_fuword64(sp
);
237 dtrace_getupcstack(uint64_t * pcstack
, int pcstack_limit
)
239 thread_t thread
= current_thread();
241 user_addr_t pc
, sp
, fp
;
242 volatile uint16_t *flags
= (volatile uint16_t *) &cpu_core
[CPU
->cpu_id
].cpuc_dtrace_flags
;
245 if (*flags
& CPU_DTRACE_FAULT
) {
249 if (pcstack_limit
<= 0) {
254 * If there's no user context we still need to zero the stack.
256 if (thread
== NULL
) {
260 regs
= (savearea_t
*) find_user_regs(thread
);
265 *pcstack
++ = (uint64_t)dtrace_proc_selfpid();
268 if (pcstack_limit
<= 0) {
272 pc
= get_saved_state_pc(regs
);
273 sp
= get_saved_state_sp(regs
);
274 fp
= get_saved_state_fp(regs
);
276 if (DTRACE_CPUFLAG_ISSET(CPU_DTRACE_ENTRY
)) {
277 *pcstack
++ = (uint64_t) pc
;
279 if (pcstack_limit
<= 0) {
283 pc
= get_saved_state_lr(regs
);
286 n
= dtrace_getustack_common(pcstack
, pcstack_limit
, pc
, fp
);
289 ASSERT(n
<= pcstack_limit
);
295 while (pcstack_limit
-- > 0) {
301 dtrace_getustackdepth(void)
303 thread_t thread
= current_thread();
305 user_addr_t pc
, sp
, fp
;
308 if (thread
== NULL
) {
312 if (DTRACE_CPUFLAG_ISSET(CPU_DTRACE_FAULT
)) {
316 regs
= (savearea_t
*) find_user_regs(thread
);
321 pc
= get_saved_state_pc(regs
);
322 sp
= get_saved_state_sp(regs
);
323 fp
= get_saved_state_fp(regs
);
325 if (DTRACE_CPUFLAG_ISSET(CPU_DTRACE_ENTRY
)) {
327 pc
= get_saved_state_lr(regs
);
331 * Note that unlike ppc, the arm code does not use
332 * CPU_DTRACE_USTACK_FP. This is because arm always
333 * traces from the sp, even in syscall/profile/fbt
337 n
+= dtrace_getustack_common(NULL
, 0, pc
, fp
);
343 dtrace_getufpstack(uint64_t * pcstack
, uint64_t * fpstack
, int pcstack_limit
)
345 thread_t thread
= current_thread();
346 boolean_t is64bit
= proc_is64bit_data(current_proc());
349 volatile uint16_t *flags
= (volatile uint16_t *) &cpu_core
[CPU
->cpu_id
].cpuc_dtrace_flags
;
352 if (*flags
& CPU_DTRACE_FAULT
) {
356 if (pcstack_limit
<= 0) {
361 * If there's no user context we still need to zero the stack.
363 if (thread
== NULL
) {
367 regs
= (savearea_t
*) find_user_regs(thread
);
372 *pcstack
++ = (uint64_t)dtrace_proc_selfpid();
375 if (pcstack_limit
<= 0) {
379 pc
= get_saved_state_pc(regs
);
380 sp
= get_saved_state_lr(regs
);
382 #if 0 /* XXX signal stack crawl */
383 oldcontext
= lwp
->lwp_oldcontext
;
385 if (p
->p_model
== DATAMODEL_NATIVE
) {
386 s1
= sizeof(struct frame
) + 2 * sizeof(long);
387 s2
= s1
+ sizeof(siginfo_t
);
389 s1
= sizeof(struct frame32
) + 3 * sizeof(int);
390 s2
= s1
+ sizeof(siginfo32_t
);
394 if (DTRACE_CPUFLAG_ISSET(CPU_DTRACE_ENTRY
)) {
395 *pcstack
++ = (uint64_t) pc
;
398 if (pcstack_limit
<= 0) {
403 pc
= dtrace_fuword64(sp
);
405 pc
= dtrace_fuword32(sp
);
408 while (pc
!= 0 && sp
!= 0) {
409 *pcstack
++ = (uint64_t) pc
;
412 if (pcstack_limit
<= 0) {
416 #if 0 /* XXX signal stack crawl */
417 if (oldcontext
== sp
+ s1
|| oldcontext
== sp
+ s2
) {
418 if (p
->p_model
== DATAMODEL_NATIVE
) {
419 ucontext_t
*ucp
= (ucontext_t
*) oldcontext
;
420 greg_t
*gregs
= ucp
->uc_mcontext
.gregs
;
422 sp
= dtrace_fulword(&gregs
[REG_FP
]);
423 pc
= dtrace_fulword(&gregs
[REG_PC
]);
425 oldcontext
= dtrace_fulword(&ucp
->uc_link
);
427 ucontext_t
*ucp
= (ucontext_t
*) oldcontext
;
428 greg_t
*gregs
= ucp
->uc_mcontext
.gregs
;
430 sp
= dtrace_fuword32(&gregs
[EBP
]);
431 pc
= dtrace_fuword32(&gregs
[EIP
]);
433 oldcontext
= dtrace_fuword32(&ucp
->uc_link
);
438 pc
= dtrace_fuword64((sp
+ RETURN_OFFSET64
));
439 sp
= dtrace_fuword64(sp
);
445 * This is totally bogus: if we faulted, we're going to clear
446 * the fault and break. This is to deal with the apparently
447 * broken Java stacks on x86.
449 if (*flags
& CPU_DTRACE_FAULT
) {
450 *flags
&= ~CPU_DTRACE_FAULT
;
457 while (pcstack_limit
-- > 0) {
463 static inline boolean_t
464 dtrace_frame_in_ppl_stack(struct frame
* fp
)
466 return ((void *)fp
>= pmap_stacks_start
) &&
467 ((void *)fp
< pmap_stacks_end
);
472 dtrace_getpcstack(pc_t
* pcstack
, int pcstack_limit
, int aframes
,
475 struct frame
*fp
= (struct frame
*) __builtin_frame_address(0);
476 struct frame
*nextfp
, *minfp
, *stacktop
;
484 uintptr_t caller
= CPU
->cpu_dtrace_caller
;
486 if ((on_intr
= CPU_ON_INTR(CPU
)) != 0) {
487 stacktop
= (struct frame
*) dtrace_get_cpu_int_stack_top();
490 else if ((on_ppl_stack
= dtrace_frame_in_ppl_stack(fp
))) {
491 stacktop
= (struct frame
*) pmap_stacks_end
;
495 stacktop
= (struct frame
*) (dtrace_get_kernel_stack(current_thread()) + kernel_stack_size
);
502 if (intrpc
!= NULL
&& depth
< pcstack_limit
) {
503 pcstack
[depth
++] = (pc_t
) intrpc
;
506 while (depth
< pcstack_limit
) {
507 nextfp
= *(struct frame
**) fp
;
508 pc
= *(uintptr_t *) (((uintptr_t) fp
) + RETURN_OFFSET64
);
510 if (nextfp
<= minfp
|| nextfp
>= stacktop
) {
513 * Hop from interrupt stack to thread stack.
515 arm_saved_state_t
*arm_kern_regs
= (arm_saved_state_t
*) find_kern_regs(current_thread());
517 nextfp
= (struct frame
*)(saved_state64(arm_kern_regs
)->fp
);
520 on_ppl_stack
= dtrace_frame_in_ppl_stack(nextfp
);
523 minfp
= pmap_stacks_start
;
524 stacktop
= pmap_stacks_end
;
528 vm_offset_t kstack_base
= dtrace_get_kernel_stack(current_thread());
530 minfp
= (struct frame
*)kstack_base
;
531 stacktop
= (struct frame
*)(kstack_base
+ kernel_stack_size
);
536 if (nextfp
<= minfp
|| nextfp
>= stacktop
) {
541 * If this thread was on the interrupt stack, but did not
542 * take an interrupt (i.e, the idle thread), there is no
543 * explicit saved state for us to use.
549 if ((!on_ppl_stack
) && dtrace_frame_in_ppl_stack(nextfp
)) {
551 * We are switching from the kernel stack
555 minfp
= pmap_stacks_start
;
556 stacktop
= pmap_stacks_end
;
557 } else if (on_ppl_stack
) {
559 * We could be going from the PPL stack
560 * to the kernel stack.
562 vm_offset_t kstack_base
= dtrace_get_kernel_stack(current_thread());
564 minfp
= (struct frame
*)kstack_base
;
565 stacktop
= (struct frame
*)(kstack_base
+ kernel_stack_size
);
567 if (nextfp
<= minfp
|| nextfp
>= stacktop
) {
574 * This is the last frame we can process; indicate
575 * that we should return after processing this frame.
582 if (--aframes
== 0 && caller
!= (uintptr_t)NULL
) {
584 * We've just run out of artificial frames,
585 * and we have a valid caller -- fill it in
588 ASSERT(depth
< pcstack_limit
);
589 pcstack
[depth
++] = (pc_t
) caller
;
590 caller
= (uintptr_t)NULL
;
593 if (depth
< pcstack_limit
) {
594 pcstack
[depth
++] = (pc_t
) pc
;
599 while (depth
< pcstack_limit
) {
600 pcstack
[depth
++] = (pc_t
) NULL
;
610 dtrace_getarg(int arg
, int aframes
, dtrace_mstate_t
*mstate
, dtrace_vstate_t
*vstate
)
612 #pragma unused(arg, aframes)
614 struct frame
*fp
= (struct frame
*)__builtin_frame_address(0);
620 * A total of 8 arguments are passed via registers; any argument with
621 * index of 7 or lower is therefore in a register.
625 for (i
= 1; i
<= aframes
; ++i
) {
627 #if __has_feature(ptrauth_returns)
628 pc
= (uintptr_t)ptrauth_strip((void*)fp
->retaddr
, ptrauth_key_return_address
);
633 if (dtrace_invop_callsite_pre
!= NULL
634 && pc
> (uintptr_t) dtrace_invop_callsite_pre
635 && pc
<= (uintptr_t) dtrace_invop_callsite_post
) {
636 /* fp points to frame of dtrace_invop() activation */
637 fp
= fp
->backchain
; /* to fbt_perfCallback activation */
638 fp
= fp
->backchain
; /* to sleh_synchronous activation */
639 fp
= fp
->backchain
; /* to fleh_synchronous activation */
641 arm_saved_state_t
*tagged_regs
= (arm_saved_state_t
*) ((void*) &fp
[1]);
642 arm_saved_state64_t
*saved_state
= saved_state64(tagged_regs
);
645 /* the argument will be found in a register */
646 stack
= (uintptr_t*) &saved_state
->x
[0];
648 /* the argument will be found in the stack */
649 fp
= (struct frame
*) saved_state
->sp
;
650 stack
= (uintptr_t*) &fp
[1];
659 * We know that we did not come through a trap to get into
660 * dtrace_probe() -- We arrive here when the provider has
661 * called dtrace_probe() directly.
662 * The probe ID is the first argument to dtrace_probe().
663 * We must advance beyond that to get the argX.
665 arg
++; /* Advance past probeID */
669 * This shouldn't happen. If the argument is passed in a
670 * register then it should have been, well, passed in a
673 DTRACE_CPUFLAG_SET(CPU_DTRACE_ILLOP
);
678 stack
= (uintptr_t*) &fp
[1]; /* Find marshalled arguments */
681 if (dtrace_canload((uint64_t)(stack
+ arg
), sizeof(uint64_t),
683 /* dtrace_probe arguments arg0 ... arg4 are 64bits wide */
684 val
= dtrace_load64((uint64_t)(stack
+ arg
));
691 dtrace_probe_error(dtrace_state_t
*state
, dtrace_epid_t epid
, int which
,
692 int fltoffs
, int fault
, uint64_t illval
)
696 * For the case of the error probe firing lets
697 * stash away "illval" here, and special-case retrieving it in DIF_VARIABLE_ARG.
699 state
->dts_arg_error_illval
= illval
;
700 dtrace_probe( dtrace_probeid_error
, (uint64_t)(uintptr_t)state
, epid
, which
, fltoffs
, fault
);
704 dtrace_toxic_ranges(void (*func
)(uintptr_t base
, uintptr_t limit
))
706 /* XXX ARMTODO check copied from ppc/x86*/
708 * "base" is the smallest toxic address in the range, "limit" is the first
709 * VALID address greater than "base".
711 func(0x0, VM_MIN_KERNEL_ADDRESS
);
712 if (VM_MAX_KERNEL_ADDRESS
< ~(uintptr_t)0) {
713 func(VM_MAX_KERNEL_ADDRESS
+ 1, ~(uintptr_t)0);
718 dtrace_flush_caches(void)
720 /* TODO There were some problems with flushing just the cache line that had been modified.
721 * For now, we'll flush the entire cache, until we figure out how to flush just the patched block.
724 InvalidatePoU_Icache();