xref: /freebsd/sys/cddl/dev/dtrace/dtrace_ioctl.c (revision 40a8ac8f62b535d30349faf28cf47106b7041b83)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  *
21  * $FreeBSD$
22  *
23  */
24 
25 static int dtrace_verbose_ioctl;
26 SYSCTL_INT(_debug_dtrace, OID_AUTO, verbose_ioctl, CTLFLAG_RW,
27     &dtrace_verbose_ioctl, 0, "log DTrace ioctls");
28 
29 #define DTRACE_IOCTL_PRINTF(fmt, ...)	if (dtrace_verbose_ioctl) printf(fmt, ## __VA_ARGS__ )
30 
31 static int
32 dtrace_ioctl_helper(struct cdev *dev, u_long cmd, caddr_t addr, int flags,
33     struct thread *td)
34 {
35 	int rval;
36 	dof_helper_t *dhp = NULL;
37 	dof_hdr_t *dof = NULL;
38 
39 	switch (cmd) {
40 	case DTRACEHIOC_ADDDOF:
41 		dhp = (dof_helper_t *)addr;
42 		/* XXX all because dofhp_dof is 64 bit */
43 		addr = (caddr_t)(vm_offset_t)dhp->dofhp_dof;
44 		/* FALLTHROUGH */
45 	case DTRACEHIOC_ADD:
46 		dof = dtrace_dof_copyin((intptr_t)addr, &rval);
47 
48 		if (dof == NULL)
49 			return (rval);
50 
51 		mutex_enter(&dtrace_lock);
52 		if ((rval = dtrace_helper_slurp((dof_hdr_t *)dof, dhp)) != -1) {
53 			if (dhp) {
54 				dhp->gen = rval;
55 				copyout(dhp, addr, sizeof(*dhp));
56 			}
57 			rval = 0;
58 		} else {
59 			rval = EINVAL;
60 		}
61 		mutex_exit(&dtrace_lock);
62 		return (rval);
63 	case DTRACEHIOC_REMOVE:
64 		mutex_enter(&dtrace_lock);
65 		rval = dtrace_helper_destroygen((int)*addr);
66 		mutex_exit(&dtrace_lock);
67 
68 		return (rval);
69 	default:
70 		break;
71 	}
72 
73 	return (ENOTTY);
74 }
75 
76 /* ARGSUSED */
77 static int
78 dtrace_ioctl(struct cdev *dev, u_long cmd, caddr_t addr,
79     int flags __unused, struct thread *td)
80 {
81 	dtrace_state_t *state;
82 	devfs_get_cdevpriv((void **) &state);
83 
84 	int error = 0;
85 	if (state == NULL)
86 		return (EINVAL);
87 
88 	if (state->dts_anon) {
89 		ASSERT(dtrace_anon.dta_state == NULL);
90 		state = state->dts_anon;
91 	}
92 
93 	switch (cmd) {
94 	case DTRACEIOC_AGGDESC: {
95 		dtrace_aggdesc_t **paggdesc = (dtrace_aggdesc_t **) addr;
96 		dtrace_aggdesc_t aggdesc;
97 		dtrace_action_t *act;
98 		dtrace_aggregation_t *agg;
99 		int nrecs;
100 		uint32_t offs;
101 		dtrace_recdesc_t *lrec;
102 		void *buf;
103 		size_t size;
104 		uintptr_t dest;
105 
106 		DTRACE_IOCTL_PRINTF("%s(%d): DTRACEIOC_AGGDESC\n",__func__,__LINE__);
107 
108 		if (copyin((void *) *paggdesc, &aggdesc, sizeof (aggdesc)) != 0)
109 			return (EFAULT);
110 
111 		mutex_enter(&dtrace_lock);
112 
113 		if ((agg = dtrace_aggid2agg(state, aggdesc.dtagd_id)) == NULL) {
114 			mutex_exit(&dtrace_lock);
115 			return (EINVAL);
116 		}
117 
118 		aggdesc.dtagd_epid = agg->dtag_ecb->dte_epid;
119 
120 		nrecs = aggdesc.dtagd_nrecs;
121 		aggdesc.dtagd_nrecs = 0;
122 
123 		offs = agg->dtag_base;
124 		lrec = &agg->dtag_action.dta_rec;
125 		aggdesc.dtagd_size = lrec->dtrd_offset + lrec->dtrd_size - offs;
126 
127 		for (act = agg->dtag_first; ; act = act->dta_next) {
128 			ASSERT(act->dta_intuple ||
129 			    DTRACEACT_ISAGG(act->dta_kind));
130 
131 			/*
132 			 * If this action has a record size of zero, it
133 			 * denotes an argument to the aggregating action.
134 			 * Because the presence of this record doesn't (or
135 			 * shouldn't) affect the way the data is interpreted,
136 			 * we don't copy it out to save user-level the
137 			 * confusion of dealing with a zero-length record.
138 			 */
139 			if (act->dta_rec.dtrd_size == 0) {
140 				ASSERT(agg->dtag_hasarg);
141 				continue;
142 			}
143 
144 			aggdesc.dtagd_nrecs++;
145 
146 			if (act == &agg->dtag_action)
147 				break;
148 		}
149 
150 		/*
151 		 * Now that we have the size, we need to allocate a temporary
152 		 * buffer in which to store the complete description.  We need
153 		 * the temporary buffer to be able to drop dtrace_lock()
154 		 * across the copyout(), below.
155 		 */
156 		size = sizeof (dtrace_aggdesc_t) +
157 		    (aggdesc.dtagd_nrecs * sizeof (dtrace_recdesc_t));
158 
159 		buf = kmem_alloc(size, KM_SLEEP);
160 		dest = (uintptr_t)buf;
161 
162 		bcopy(&aggdesc, (void *)dest, sizeof (aggdesc));
163 		dest += offsetof(dtrace_aggdesc_t, dtagd_rec[0]);
164 
165 		for (act = agg->dtag_first; ; act = act->dta_next) {
166 			dtrace_recdesc_t rec = act->dta_rec;
167 
168 			/*
169 			 * See the comment in the above loop for why we pass
170 			 * over zero-length records.
171 			 */
172 			if (rec.dtrd_size == 0) {
173 				ASSERT(agg->dtag_hasarg);
174 				continue;
175 			}
176 
177 			if (nrecs-- == 0)
178 				break;
179 
180 			rec.dtrd_offset -= offs;
181 			bcopy(&rec, (void *)dest, sizeof (rec));
182 			dest += sizeof (dtrace_recdesc_t);
183 
184 			if (act == &agg->dtag_action)
185 				break;
186 		}
187 
188 		mutex_exit(&dtrace_lock);
189 
190 		if (copyout(buf, (void *) *paggdesc, dest - (uintptr_t)buf) != 0) {
191 			kmem_free(buf, size);
192 			return (EFAULT);
193 		}
194 
195 		kmem_free(buf, size);
196 		return (0);
197 	}
198 	case DTRACEIOC_AGGSNAP:
199 	case DTRACEIOC_BUFSNAP: {
200 		dtrace_bufdesc_t **pdesc = (dtrace_bufdesc_t **) addr;
201 		dtrace_bufdesc_t desc;
202 		caddr_t cached;
203 		dtrace_buffer_t *buf;
204 
205 		dtrace_debug_output();
206 
207 		if (copyin((void *) *pdesc, &desc, sizeof (desc)) != 0)
208 			return (EFAULT);
209 
210 		DTRACE_IOCTL_PRINTF("%s(%d): %s curcpu %d cpu %d\n",
211 		    __func__,__LINE__,
212 		    cmd == DTRACEIOC_AGGSNAP ?
213 		    "DTRACEIOC_AGGSNAP":"DTRACEIOC_BUFSNAP",
214 		    curcpu, desc.dtbd_cpu);
215 
216 		if (desc.dtbd_cpu >= NCPU)
217 			return (ENOENT);
218 		if (pcpu_find(desc.dtbd_cpu) == NULL)
219 			return (ENOENT);
220 
221 		mutex_enter(&dtrace_lock);
222 
223 		if (cmd == DTRACEIOC_BUFSNAP) {
224 			buf = &state->dts_buffer[desc.dtbd_cpu];
225 		} else {
226 			buf = &state->dts_aggbuffer[desc.dtbd_cpu];
227 		}
228 
229 		if (buf->dtb_flags & (DTRACEBUF_RING | DTRACEBUF_FILL)) {
230 			size_t sz = buf->dtb_offset;
231 
232 			if (state->dts_activity != DTRACE_ACTIVITY_STOPPED) {
233 				mutex_exit(&dtrace_lock);
234 				return (EBUSY);
235 			}
236 
237 			/*
238 			 * If this buffer has already been consumed, we're
239 			 * going to indicate that there's nothing left here
240 			 * to consume.
241 			 */
242 			if (buf->dtb_flags & DTRACEBUF_CONSUMED) {
243 				mutex_exit(&dtrace_lock);
244 
245 				desc.dtbd_size = 0;
246 				desc.dtbd_drops = 0;
247 				desc.dtbd_errors = 0;
248 				desc.dtbd_oldest = 0;
249 				sz = sizeof (desc);
250 
251 				if (copyout(&desc, (void *) *pdesc, sz) != 0)
252 					return (EFAULT);
253 
254 				return (0);
255 			}
256 
257 			/*
258 			 * If this is a ring buffer that has wrapped, we want
259 			 * to copy the whole thing out.
260 			 */
261 			if (buf->dtb_flags & DTRACEBUF_WRAPPED) {
262 				dtrace_buffer_polish(buf);
263 				sz = buf->dtb_size;
264 			}
265 
266 			if (copyout(buf->dtb_tomax, desc.dtbd_data, sz) != 0) {
267 				mutex_exit(&dtrace_lock);
268 				return (EFAULT);
269 			}
270 
271 			desc.dtbd_size = sz;
272 			desc.dtbd_drops = buf->dtb_drops;
273 			desc.dtbd_errors = buf->dtb_errors;
274 			desc.dtbd_oldest = buf->dtb_xamot_offset;
275 			desc.dtbd_timestamp = dtrace_gethrtime();
276 
277 			mutex_exit(&dtrace_lock);
278 
279 			if (copyout(&desc, (void *) *pdesc, sizeof (desc)) != 0)
280 				return (EFAULT);
281 
282 			buf->dtb_flags |= DTRACEBUF_CONSUMED;
283 
284 			return (0);
285 		}
286 
287 		if (buf->dtb_tomax == NULL) {
288 			ASSERT(buf->dtb_xamot == NULL);
289 			mutex_exit(&dtrace_lock);
290 			return (ENOENT);
291 		}
292 
293 		cached = buf->dtb_tomax;
294 		ASSERT(!(buf->dtb_flags & DTRACEBUF_NOSWITCH));
295 
296 		dtrace_xcall(desc.dtbd_cpu,
297 		    (dtrace_xcall_t)dtrace_buffer_switch, buf);
298 
299 		state->dts_errors += buf->dtb_xamot_errors;
300 
301 		/*
302 		 * If the buffers did not actually switch, then the cross call
303 		 * did not take place -- presumably because the given CPU is
304 		 * not in the ready set.  If this is the case, we'll return
305 		 * ENOENT.
306 		 */
307 		if (buf->dtb_tomax == cached) {
308 			ASSERT(buf->dtb_xamot != cached);
309 			mutex_exit(&dtrace_lock);
310 			return (ENOENT);
311 		}
312 
313 		ASSERT(cached == buf->dtb_xamot);
314 
315 		DTRACE_IOCTL_PRINTF("%s(%d): copyout the buffer snapshot\n",__func__,__LINE__);
316 
317 		/*
318 		 * We have our snapshot; now copy it out.
319 		 */
320 		if (copyout(buf->dtb_xamot, desc.dtbd_data,
321 		    buf->dtb_xamot_offset) != 0) {
322 			mutex_exit(&dtrace_lock);
323 			return (EFAULT);
324 		}
325 
326 		desc.dtbd_size = buf->dtb_xamot_offset;
327 		desc.dtbd_drops = buf->dtb_xamot_drops;
328 		desc.dtbd_errors = buf->dtb_xamot_errors;
329 		desc.dtbd_oldest = 0;
330 		desc.dtbd_timestamp = buf->dtb_switched;
331 
332 		mutex_exit(&dtrace_lock);
333 
334 		DTRACE_IOCTL_PRINTF("%s(%d): copyout buffer desc: size %zd drops %lu errors %lu\n",__func__,__LINE__,(size_t) desc.dtbd_size,(u_long) desc.dtbd_drops,(u_long) desc.dtbd_errors);
335 
336 		/*
337 		 * Finally, copy out the buffer description.
338 		 */
339 		if (copyout(&desc, (void *) *pdesc, sizeof (desc)) != 0)
340 			return (EFAULT);
341 
342 		return (0);
343 	}
344 	case DTRACEIOC_CONF: {
345 		dtrace_conf_t conf;
346 
347 		DTRACE_IOCTL_PRINTF("%s(%d): DTRACEIOC_CONF\n",__func__,__LINE__);
348 
349 		bzero(&conf, sizeof (conf));
350 		conf.dtc_difversion = DIF_VERSION;
351 		conf.dtc_difintregs = DIF_DIR_NREGS;
352 		conf.dtc_diftupregs = DIF_DTR_NREGS;
353 		conf.dtc_ctfmodel = CTF_MODEL_NATIVE;
354 
355 		*((dtrace_conf_t *) addr) = conf;
356 
357 		return (0);
358 	}
359 	case DTRACEIOC_DOFGET: {
360 		dof_hdr_t **pdof = (dof_hdr_t **) addr;
361 		dof_hdr_t hdr, *dof = *pdof;
362 		int rval;
363 		uint64_t len;
364 
365 		DTRACE_IOCTL_PRINTF("%s(%d): DTRACEIOC_DOFGET\n",__func__,__LINE__);
366 
367 		if (copyin((void *)dof, &hdr, sizeof (hdr)) != 0)
368 			return (EFAULT);
369 
370 		mutex_enter(&dtrace_lock);
371 		dof = dtrace_dof_create(state);
372 		mutex_exit(&dtrace_lock);
373 
374 		len = MIN(hdr.dofh_loadsz, dof->dofh_loadsz);
375 		rval = copyout(dof, (void *) *pdof, len);
376 		dtrace_dof_destroy(dof);
377 
378 		return (rval == 0 ? 0 : EFAULT);
379 	}
380 	case DTRACEIOC_ENABLE: {
381 		dof_hdr_t *dof = NULL;
382 		dtrace_enabling_t *enab = NULL;
383 		dtrace_vstate_t *vstate;
384 		int err = 0;
385 		int rval;
386 		dtrace_enable_io_t *p = (dtrace_enable_io_t *) addr;
387 
388 		DTRACE_IOCTL_PRINTF("%s(%d): DTRACEIOC_ENABLE\n",__func__,__LINE__);
389 
390 		/*
391 		 * If a NULL argument has been passed, we take this as our
392 		 * cue to reevaluate our enablings.
393 		 */
394 		if (p->dof == NULL) {
395 			dtrace_enabling_matchall();
396 
397 			return (0);
398 		}
399 
400 		if ((dof = dtrace_dof_copyin((uintptr_t) p->dof, &rval)) == NULL)
401 			return (EINVAL);
402 
403 		mutex_enter(&cpu_lock);
404 		mutex_enter(&dtrace_lock);
405 		vstate = &state->dts_vstate;
406 
407 		if (state->dts_activity != DTRACE_ACTIVITY_INACTIVE) {
408 			mutex_exit(&dtrace_lock);
409 			mutex_exit(&cpu_lock);
410 			dtrace_dof_destroy(dof);
411 			return (EBUSY);
412 		}
413 
414 		if (dtrace_dof_slurp(dof, vstate, td->td_ucred, &enab, 0, B_TRUE) != 0) {
415 			mutex_exit(&dtrace_lock);
416 			mutex_exit(&cpu_lock);
417 			dtrace_dof_destroy(dof);
418 			return (EINVAL);
419 		}
420 
421 		if ((rval = dtrace_dof_options(dof, state)) != 0) {
422 			dtrace_enabling_destroy(enab);
423 			mutex_exit(&dtrace_lock);
424 			mutex_exit(&cpu_lock);
425 			dtrace_dof_destroy(dof);
426 			return (rval);
427 		}
428 
429 		if ((err = dtrace_enabling_match(enab, &p->n_matched)) == 0) {
430 			err = dtrace_enabling_retain(enab);
431 		} else {
432 			dtrace_enabling_destroy(enab);
433 		}
434 
435 		mutex_exit(&cpu_lock);
436 		mutex_exit(&dtrace_lock);
437 		dtrace_dof_destroy(dof);
438 
439 		return (err);
440 	}
441 	case DTRACEIOC_EPROBE: {
442 		dtrace_eprobedesc_t **pepdesc = (dtrace_eprobedesc_t **) addr;
443 		dtrace_eprobedesc_t epdesc;
444 		dtrace_ecb_t *ecb;
445 		dtrace_action_t *act;
446 		void *buf;
447 		size_t size;
448 		uintptr_t dest;
449 		int nrecs;
450 
451 		DTRACE_IOCTL_PRINTF("%s(%d): DTRACEIOC_EPROBE\n",__func__,__LINE__);
452 
453 		if (copyin((void *)*pepdesc, &epdesc, sizeof (epdesc)) != 0)
454 			return (EFAULT);
455 
456 		mutex_enter(&dtrace_lock);
457 
458 		if ((ecb = dtrace_epid2ecb(state, epdesc.dtepd_epid)) == NULL) {
459 			mutex_exit(&dtrace_lock);
460 			return (EINVAL);
461 		}
462 
463 		if (ecb->dte_probe == NULL) {
464 			mutex_exit(&dtrace_lock);
465 			return (EINVAL);
466 		}
467 
468 		epdesc.dtepd_probeid = ecb->dte_probe->dtpr_id;
469 		epdesc.dtepd_uarg = ecb->dte_uarg;
470 		epdesc.dtepd_size = ecb->dte_size;
471 
472 		nrecs = epdesc.dtepd_nrecs;
473 		epdesc.dtepd_nrecs = 0;
474 		for (act = ecb->dte_action; act != NULL; act = act->dta_next) {
475 			if (DTRACEACT_ISAGG(act->dta_kind) || act->dta_intuple)
476 				continue;
477 
478 			epdesc.dtepd_nrecs++;
479 		}
480 
481 		/*
482 		 * Now that we have the size, we need to allocate a temporary
483 		 * buffer in which to store the complete description.  We need
484 		 * the temporary buffer to be able to drop dtrace_lock()
485 		 * across the copyout(), below.
486 		 */
487 		size = sizeof (dtrace_eprobedesc_t) +
488 		    (epdesc.dtepd_nrecs * sizeof (dtrace_recdesc_t));
489 
490 		buf = kmem_alloc(size, KM_SLEEP);
491 		dest = (uintptr_t)buf;
492 
493 		bcopy(&epdesc, (void *)dest, sizeof (epdesc));
494 		dest += offsetof(dtrace_eprobedesc_t, dtepd_rec[0]);
495 
496 		for (act = ecb->dte_action; act != NULL; act = act->dta_next) {
497 			if (DTRACEACT_ISAGG(act->dta_kind) || act->dta_intuple)
498 				continue;
499 
500 			if (nrecs-- == 0)
501 				break;
502 
503 			bcopy(&act->dta_rec, (void *)dest,
504 			    sizeof (dtrace_recdesc_t));
505 			dest += sizeof (dtrace_recdesc_t);
506 		}
507 
508 		mutex_exit(&dtrace_lock);
509 
510 		if (copyout(buf, (void *) *pepdesc, dest - (uintptr_t)buf) != 0) {
511 			kmem_free(buf, size);
512 			return (EFAULT);
513 		}
514 
515 		kmem_free(buf, size);
516 		return (0);
517 	}
518 	case DTRACEIOC_FORMAT: {
519 		dtrace_fmtdesc_t *fmt = (dtrace_fmtdesc_t *) addr;
520 		char *str;
521 		int len;
522 
523 		DTRACE_IOCTL_PRINTF("%s(%d): DTRACEIOC_FORMAT\n",__func__,__LINE__);
524 
525 		mutex_enter(&dtrace_lock);
526 
527 		if (fmt->dtfd_format == 0 ||
528 		    fmt->dtfd_format > state->dts_nformats) {
529 			mutex_exit(&dtrace_lock);
530 			return (EINVAL);
531 		}
532 
533 		/*
534 		 * Format strings are allocated contiguously and they are
535 		 * never freed; if a format index is less than the number
536 		 * of formats, we can assert that the format map is non-NULL
537 		 * and that the format for the specified index is non-NULL.
538 		 */
539 		ASSERT(state->dts_formats != NULL);
540 		str = state->dts_formats[fmt->dtfd_format - 1];
541 		ASSERT(str != NULL);
542 
543 		len = strlen(str) + 1;
544 
545 		if (len > fmt->dtfd_length) {
546 			fmt->dtfd_length = len;
547 		} else {
548 			if (copyout(str, fmt->dtfd_string, len) != 0) {
549 				mutex_exit(&dtrace_lock);
550 				return (EINVAL);
551 			}
552 		}
553 
554 		mutex_exit(&dtrace_lock);
555 		return (0);
556 	}
557 	case DTRACEIOC_GO: {
558 		int rval;
559 		processorid_t *cpuid = (processorid_t *) addr;
560 
561 		DTRACE_IOCTL_PRINTF("%s(%d): DTRACEIOC_GO\n",__func__,__LINE__);
562 
563 		rval = dtrace_state_go(state, cpuid);
564 
565 		return (rval);
566 	}
567 	case DTRACEIOC_PROBEARG: {
568 		dtrace_argdesc_t *desc = (dtrace_argdesc_t *) addr;
569 		dtrace_probe_t *probe;
570 		dtrace_provider_t *prov;
571 
572 		DTRACE_IOCTL_PRINTF("%s(%d): DTRACEIOC_PROBEARG\n",__func__,__LINE__);
573 
574 		if (desc->dtargd_id == DTRACE_IDNONE)
575 			return (EINVAL);
576 
577 		if (desc->dtargd_ndx == DTRACE_ARGNONE)
578 			return (EINVAL);
579 
580 		mutex_enter(&dtrace_provider_lock);
581 #if defined(sun)
582 		mutex_enter(&mod_lock);
583 #endif
584 		mutex_enter(&dtrace_lock);
585 
586 		if (desc->dtargd_id > dtrace_nprobes) {
587 			mutex_exit(&dtrace_lock);
588 #if defined(sun)
589 			mutex_exit(&mod_lock);
590 #endif
591 			mutex_exit(&dtrace_provider_lock);
592 			return (EINVAL);
593 		}
594 
595 		if ((probe = dtrace_probes[desc->dtargd_id - 1]) == NULL) {
596 			mutex_exit(&dtrace_lock);
597 #if defined(sun)
598 			mutex_exit(&mod_lock);
599 #endif
600 			mutex_exit(&dtrace_provider_lock);
601 			return (EINVAL);
602 		}
603 
604 		mutex_exit(&dtrace_lock);
605 
606 		prov = probe->dtpr_provider;
607 
608 		if (prov->dtpv_pops.dtps_getargdesc == NULL) {
609 			/*
610 			 * There isn't any typed information for this probe.
611 			 * Set the argument number to DTRACE_ARGNONE.
612 			 */
613 			desc->dtargd_ndx = DTRACE_ARGNONE;
614 		} else {
615 			desc->dtargd_native[0] = '\0';
616 			desc->dtargd_xlate[0] = '\0';
617 			desc->dtargd_mapping = desc->dtargd_ndx;
618 
619 			prov->dtpv_pops.dtps_getargdesc(prov->dtpv_arg,
620 			    probe->dtpr_id, probe->dtpr_arg, desc);
621 		}
622 
623 #if defined(sun)
624 		mutex_exit(&mod_lock);
625 #endif
626 		mutex_exit(&dtrace_provider_lock);
627 
628 		return (0);
629 	}
630 	case DTRACEIOC_PROBEMATCH:
631 	case DTRACEIOC_PROBES: {
632 		dtrace_probedesc_t *p_desc = (dtrace_probedesc_t *) addr;
633 		dtrace_probe_t *probe = NULL;
634 		dtrace_probekey_t pkey;
635 		dtrace_id_t i;
636 		int m = 0;
637 		uint32_t priv = 0;
638 		uid_t uid = 0;
639 		zoneid_t zoneid = 0;
640 
641 		DTRACE_IOCTL_PRINTF("%s(%d): %s\n",__func__,__LINE__,
642 		    cmd == DTRACEIOC_PROBEMATCH ?
643 		    "DTRACEIOC_PROBEMATCH":"DTRACEIOC_PROBES");
644 
645 		p_desc->dtpd_provider[DTRACE_PROVNAMELEN - 1] = '\0';
646 		p_desc->dtpd_mod[DTRACE_MODNAMELEN - 1] = '\0';
647 		p_desc->dtpd_func[DTRACE_FUNCNAMELEN - 1] = '\0';
648 		p_desc->dtpd_name[DTRACE_NAMELEN - 1] = '\0';
649 
650 		/*
651 		 * Before we attempt to match this probe, we want to give
652 		 * all providers the opportunity to provide it.
653 		 */
654 		if (p_desc->dtpd_id == DTRACE_IDNONE) {
655 			mutex_enter(&dtrace_provider_lock);
656 			dtrace_probe_provide(p_desc, NULL);
657 			mutex_exit(&dtrace_provider_lock);
658 			p_desc->dtpd_id++;
659 		}
660 
661 		if (cmd == DTRACEIOC_PROBEMATCH)  {
662 			dtrace_probekey(p_desc, &pkey);
663 			pkey.dtpk_id = DTRACE_IDNONE;
664 		}
665 
666 		dtrace_cred2priv(td->td_ucred, &priv, &uid, &zoneid);
667 
668 		mutex_enter(&dtrace_lock);
669 
670 		if (cmd == DTRACEIOC_PROBEMATCH) {
671 			for (i = p_desc->dtpd_id; i <= dtrace_nprobes; i++) {
672 				if ((probe = dtrace_probes[i - 1]) != NULL &&
673 				    (m = dtrace_match_probe(probe, &pkey,
674 				    priv, uid, zoneid)) != 0)
675 					break;
676 			}
677 
678 			if (m < 0) {
679 				mutex_exit(&dtrace_lock);
680 				return (EINVAL);
681 			}
682 
683 		} else {
684 			for (i = p_desc->dtpd_id; i <= dtrace_nprobes; i++) {
685 				if ((probe = dtrace_probes[i - 1]) != NULL &&
686 				    dtrace_match_priv(probe, priv, uid, zoneid))
687 					break;
688 			}
689 		}
690 
691 		if (probe == NULL) {
692 			mutex_exit(&dtrace_lock);
693 			return (ESRCH);
694 		}
695 
696 		dtrace_probe_description(probe, p_desc);
697 		mutex_exit(&dtrace_lock);
698 
699 		return (0);
700 	}
701 	case DTRACEIOC_PROVIDER: {
702 		dtrace_providerdesc_t *pvd = (dtrace_providerdesc_t *) addr;
703 		dtrace_provider_t *pvp;
704 
705 		DTRACE_IOCTL_PRINTF("%s(%d): DTRACEIOC_PROVIDER\n",__func__,__LINE__);
706 
707 		pvd->dtvd_name[DTRACE_PROVNAMELEN - 1] = '\0';
708 		mutex_enter(&dtrace_provider_lock);
709 
710 		for (pvp = dtrace_provider; pvp != NULL; pvp = pvp->dtpv_next) {
711 			if (strcmp(pvp->dtpv_name, pvd->dtvd_name) == 0)
712 				break;
713 		}
714 
715 		mutex_exit(&dtrace_provider_lock);
716 
717 		if (pvp == NULL)
718 			return (ESRCH);
719 
720 		bcopy(&pvp->dtpv_priv, &pvd->dtvd_priv, sizeof (dtrace_ppriv_t));
721 		bcopy(&pvp->dtpv_attr, &pvd->dtvd_attr, sizeof (dtrace_pattr_t));
722 
723 		return (0);
724 	}
725 	case DTRACEIOC_REPLICATE: {
726 		dtrace_repldesc_t *desc = (dtrace_repldesc_t *) addr;
727 		dtrace_probedesc_t *match = &desc->dtrpd_match;
728 		dtrace_probedesc_t *create = &desc->dtrpd_create;
729 		int err;
730 
731 		DTRACE_IOCTL_PRINTF("%s(%d): DTRACEIOC_REPLICATE\n",__func__,__LINE__);
732 
733 		match->dtpd_provider[DTRACE_PROVNAMELEN - 1] = '\0';
734 		match->dtpd_mod[DTRACE_MODNAMELEN - 1] = '\0';
735 		match->dtpd_func[DTRACE_FUNCNAMELEN - 1] = '\0';
736 		match->dtpd_name[DTRACE_NAMELEN - 1] = '\0';
737 
738 		create->dtpd_provider[DTRACE_PROVNAMELEN - 1] = '\0';
739 		create->dtpd_mod[DTRACE_MODNAMELEN - 1] = '\0';
740 		create->dtpd_func[DTRACE_FUNCNAMELEN - 1] = '\0';
741 		create->dtpd_name[DTRACE_NAMELEN - 1] = '\0';
742 
743 		mutex_enter(&dtrace_lock);
744 		err = dtrace_enabling_replicate(state, match, create);
745 		mutex_exit(&dtrace_lock);
746 
747 		return (err);
748 	}
749 	case DTRACEIOC_STATUS: {
750 		dtrace_status_t *stat = (dtrace_status_t *) addr;
751 		dtrace_dstate_t *dstate;
752 		int i, j;
753 		uint64_t nerrs;
754 
755 		DTRACE_IOCTL_PRINTF("%s(%d): DTRACEIOC_STATUS\n",__func__,__LINE__);
756 
757 		/*
758 		 * See the comment in dtrace_state_deadman() for the reason
759 		 * for setting dts_laststatus to INT64_MAX before setting
760 		 * it to the correct value.
761 		 */
762 		state->dts_laststatus = INT64_MAX;
763 		dtrace_membar_producer();
764 		state->dts_laststatus = dtrace_gethrtime();
765 
766 		bzero(stat, sizeof (*stat));
767 
768 		mutex_enter(&dtrace_lock);
769 
770 		if (state->dts_activity == DTRACE_ACTIVITY_INACTIVE) {
771 			mutex_exit(&dtrace_lock);
772 			return (ENOENT);
773 		}
774 
775 		if (state->dts_activity == DTRACE_ACTIVITY_DRAINING)
776 			stat->dtst_exiting = 1;
777 
778 		nerrs = state->dts_errors;
779 		dstate = &state->dts_vstate.dtvs_dynvars;
780 
781 		for (i = 0; i < NCPU; i++) {
782 #if !defined(sun)
783 			if (pcpu_find(i) == NULL)
784 				continue;
785 #endif
786 			dtrace_dstate_percpu_t *dcpu = &dstate->dtds_percpu[i];
787 
788 			stat->dtst_dyndrops += dcpu->dtdsc_drops;
789 			stat->dtst_dyndrops_dirty += dcpu->dtdsc_dirty_drops;
790 			stat->dtst_dyndrops_rinsing += dcpu->dtdsc_rinsing_drops;
791 
792 			if (state->dts_buffer[i].dtb_flags & DTRACEBUF_FULL)
793 				stat->dtst_filled++;
794 
795 			nerrs += state->dts_buffer[i].dtb_errors;
796 
797 			for (j = 0; j < state->dts_nspeculations; j++) {
798 				dtrace_speculation_t *spec;
799 				dtrace_buffer_t *buf;
800 
801 				spec = &state->dts_speculations[j];
802 				buf = &spec->dtsp_buffer[i];
803 				stat->dtst_specdrops += buf->dtb_xamot_drops;
804 			}
805 		}
806 
807 		stat->dtst_specdrops_busy = state->dts_speculations_busy;
808 		stat->dtst_specdrops_unavail = state->dts_speculations_unavail;
809 		stat->dtst_stkstroverflows = state->dts_stkstroverflows;
810 		stat->dtst_dblerrors = state->dts_dblerrors;
811 		stat->dtst_killed =
812 		    (state->dts_activity == DTRACE_ACTIVITY_KILLED);
813 		stat->dtst_errors = nerrs;
814 
815 		mutex_exit(&dtrace_lock);
816 
817 		return (0);
818 	}
819 	case DTRACEIOC_STOP: {
820 		int rval;
821 		processorid_t *cpuid = (processorid_t *) addr;
822 
823 		DTRACE_IOCTL_PRINTF("%s(%d): DTRACEIOC_STOP\n",__func__,__LINE__);
824 
825 		mutex_enter(&dtrace_lock);
826 		rval = dtrace_state_stop(state, cpuid);
827 		mutex_exit(&dtrace_lock);
828 
829 		return (rval);
830 	}
831 	default:
832 		error = ENOTTY;
833 	}
834 	return (error);
835 }
836