1 /* 2 * CDDL HEADER START 3 * 4 * The contents of this file are subject to the terms of the 5 * Common Development and Distribution License (the "License"). 6 * You may not use this file except in compliance with the License. 7 * 8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 9 * or http://www.opensolaris.org/os/licensing. 10 * See the License for the specific language governing permissions 11 * and limitations under the License. 12 * 13 * When distributing Covered Code, include this CDDL HEADER in each 14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 15 * If applicable, add the following below this CDDL HEADER, with the 16 * fields enclosed by brackets "[]" replaced with your own identifying 17 * information: Portions Copyright [yyyy] [name of copyright owner] 18 * 19 * CDDL HEADER END 20 */ 21 22 /* 23 * Copyright 2006 Sun Microsystems, Inc. All rights reserved. 24 * Use is subject to license terms. 25 */ 26 27 #pragma ident "%Z%%M% %I% %E% SMI" 28 29 /* 30 * DTrace - Dynamic Tracing for Solaris 31 * 32 * This is the implementation of the Solaris Dynamic Tracing framework 33 * (DTrace). The user-visible interface to DTrace is described at length in 34 * the "Solaris Dynamic Tracing Guide". The interfaces between the libdtrace 35 * library, the in-kernel DTrace framework, and the DTrace providers are 36 * described in the block comments in the <sys/dtrace.h> header file. The 37 * internal architecture of DTrace is described in the block comments in the 38 * <sys/dtrace_impl.h> header file. The comments contained within the DTrace 39 * implementation very much assume mastery of all of these sources; if one has 40 * an unanswered question about the implementation, one should consult them 41 * first. 42 * 43 * The functions here are ordered roughly as follows: 44 * 45 * - Probe context functions 46 * - Probe hashing functions 47 * - Non-probe context utility functions 48 * - Matching functions 49 * - Provider-to-Framework API functions 50 * - Probe management functions 51 * - DIF object functions 52 * - Format functions 53 * - Predicate functions 54 * - ECB functions 55 * - Buffer functions 56 * - Enabling functions 57 * - DOF functions 58 * - Anonymous enabling functions 59 * - Consumer state functions 60 * - Helper functions 61 * - Hook functions 62 * - Driver cookbook functions 63 * 64 * Each group of functions begins with a block comment labelled the "DTrace 65 * [Group] Functions", allowing one to find each block by searching forward 66 * on capital-f functions. 67 */ 68 #include <sys/errno.h> 69 #include <sys/stat.h> 70 #include <sys/modctl.h> 71 #include <sys/conf.h> 72 #include <sys/systm.h> 73 #include <sys/ddi.h> 74 #include <sys/sunddi.h> 75 #include <sys/cpuvar.h> 76 #include <sys/kmem.h> 77 #include <sys/strsubr.h> 78 #include <sys/sysmacros.h> 79 #include <sys/dtrace_impl.h> 80 #include <sys/atomic.h> 81 #include <sys/cmn_err.h> 82 #include <sys/mutex_impl.h> 83 #include <sys/rwlock_impl.h> 84 #include <sys/ctf_api.h> 85 #include <sys/panic.h> 86 #include <sys/priv_impl.h> 87 #include <sys/policy.h> 88 #include <sys/cred_impl.h> 89 #include <sys/procfs_isa.h> 90 #include <sys/taskq.h> 91 #include <sys/mkdev.h> 92 #include <sys/kdi.h> 93 #include <sys/zone.h> 94 95 /* 96 * DTrace Tunable Variables 97 * 98 * The following variables may be tuned by adding a line to /etc/system that 99 * includes both the name of the DTrace module ("dtrace") and the name of the 100 * variable. For example: 101 * 102 * set dtrace:dtrace_destructive_disallow = 1 103 * 104 * In general, the only variables that one should be tuning this way are those 105 * that affect system-wide DTrace behavior, and for which the default behavior 106 * is undesirable. Most of these variables are tunable on a per-consumer 107 * basis using DTrace options, and need not be tuned on a system-wide basis. 108 * When tuning these variables, avoid pathological values; while some attempt 109 * is made to verify the integrity of these variables, they are not considered 110 * part of the supported interface to DTrace, and they are therefore not 111 * checked comprehensively. Further, these variables should not be tuned 112 * dynamically via "mdb -kw" or other means; they should only be tuned via 113 * /etc/system. 114 */ 115 int dtrace_destructive_disallow = 0; 116 dtrace_optval_t dtrace_nonroot_maxsize = (16 * 1024 * 1024); 117 size_t dtrace_difo_maxsize = (256 * 1024); 118 dtrace_optval_t dtrace_dof_maxsize = (256 * 1024); 119 size_t dtrace_global_maxsize = (16 * 1024); 120 size_t dtrace_actions_max = (16 * 1024); 121 size_t dtrace_retain_max = 1024; 122 dtrace_optval_t dtrace_helper_actions_max = 32; 123 dtrace_optval_t dtrace_helper_providers_max = 32; 124 dtrace_optval_t dtrace_dstate_defsize = (1 * 1024 * 1024); 125 size_t dtrace_strsize_default = 256; 126 dtrace_optval_t dtrace_cleanrate_default = 9900990; /* 101 hz */ 127 dtrace_optval_t dtrace_cleanrate_min = 200000; /* 5000 hz */ 128 dtrace_optval_t dtrace_cleanrate_max = (uint64_t)60 * NANOSEC; /* 1/minute */ 129 dtrace_optval_t dtrace_aggrate_default = NANOSEC; /* 1 hz */ 130 dtrace_optval_t dtrace_statusrate_default = NANOSEC; /* 1 hz */ 131 dtrace_optval_t dtrace_statusrate_max = (hrtime_t)10 * NANOSEC; /* 6/minute */ 132 dtrace_optval_t dtrace_switchrate_default = NANOSEC; /* 1 hz */ 133 dtrace_optval_t dtrace_nspec_default = 1; 134 dtrace_optval_t dtrace_specsize_default = 32 * 1024; 135 dtrace_optval_t dtrace_stackframes_default = 20; 136 dtrace_optval_t dtrace_ustackframes_default = 20; 137 dtrace_optval_t dtrace_jstackframes_default = 50; 138 dtrace_optval_t dtrace_jstackstrsize_default = 512; 139 int dtrace_msgdsize_max = 128; 140 hrtime_t dtrace_chill_max = 500 * (NANOSEC / MILLISEC); /* 500 ms */ 141 hrtime_t dtrace_chill_interval = NANOSEC; /* 1000 ms */ 142 int dtrace_devdepth_max = 32; 143 int dtrace_err_verbose; 144 hrtime_t dtrace_deadman_interval = NANOSEC; 145 hrtime_t dtrace_deadman_timeout = (hrtime_t)10 * NANOSEC; 146 hrtime_t dtrace_deadman_user = (hrtime_t)30 * NANOSEC; 147 148 /* 149 * DTrace External Variables 150 * 151 * As dtrace(7D) is a kernel module, any DTrace variables are obviously 152 * available to DTrace consumers via the backtick (`) syntax. One of these, 153 * dtrace_zero, is made deliberately so: it is provided as a source of 154 * well-known, zero-filled memory. While this variable is not documented, 155 * it is used by some translators as an implementation detail. 156 */ 157 const char dtrace_zero[256] = { 0 }; /* zero-filled memory */ 158 159 /* 160 * DTrace Internal Variables 161 */ 162 static dev_info_t *dtrace_devi; /* device info */ 163 static vmem_t *dtrace_arena; /* probe ID arena */ 164 static vmem_t *dtrace_minor; /* minor number arena */ 165 static taskq_t *dtrace_taskq; /* task queue */ 166 static dtrace_probe_t **dtrace_probes; /* array of all probes */ 167 static int dtrace_nprobes; /* number of probes */ 168 static dtrace_provider_t *dtrace_provider; /* provider list */ 169 static dtrace_meta_t *dtrace_meta_pid; /* user-land meta provider */ 170 static int dtrace_opens; /* number of opens */ 171 static int dtrace_helpers; /* number of helpers */ 172 static void *dtrace_softstate; /* softstate pointer */ 173 static dtrace_hash_t *dtrace_bymod; /* probes hashed by module */ 174 static dtrace_hash_t *dtrace_byfunc; /* probes hashed by function */ 175 static dtrace_hash_t *dtrace_byname; /* probes hashed by name */ 176 static dtrace_toxrange_t *dtrace_toxrange; /* toxic range array */ 177 static int dtrace_toxranges; /* number of toxic ranges */ 178 static int dtrace_toxranges_max; /* size of toxic range array */ 179 static dtrace_anon_t dtrace_anon; /* anonymous enabling */ 180 static kmem_cache_t *dtrace_state_cache; /* cache for dynamic state */ 181 static uint64_t dtrace_vtime_references; /* number of vtimestamp refs */ 182 static kthread_t *dtrace_panicked; /* panicking thread */ 183 static dtrace_ecb_t *dtrace_ecb_create_cache; /* cached created ECB */ 184 static dtrace_genid_t dtrace_probegen; /* current probe generation */ 185 static dtrace_helpers_t *dtrace_deferred_pid; /* deferred helper list */ 186 static dtrace_enabling_t *dtrace_retained; /* list of retained enablings */ 187 static dtrace_dynvar_t dtrace_dynhash_sink; /* end of dynamic hash chains */ 188 189 /* 190 * DTrace Locking 191 * DTrace is protected by three (relatively coarse-grained) locks: 192 * 193 * (1) dtrace_lock is required to manipulate essentially any DTrace state, 194 * including enabling state, probes, ECBs, consumer state, helper state, 195 * etc. Importantly, dtrace_lock is _not_ required when in probe context; 196 * probe context is lock-free -- synchronization is handled via the 197 * dtrace_sync() cross call mechanism. 198 * 199 * (2) dtrace_provider_lock is required when manipulating provider state, or 200 * when provider state must be held constant. 201 * 202 * (3) dtrace_meta_lock is required when manipulating meta provider state, or 203 * when meta provider state must be held constant. 204 * 205 * The lock ordering between these three locks is dtrace_meta_lock before 206 * dtrace_provider_lock before dtrace_lock. (In particular, there are 207 * several places where dtrace_provider_lock is held by the framework as it 208 * calls into the providers -- which then call back into the framework, 209 * grabbing dtrace_lock.) 210 * 211 * There are two other locks in the mix: mod_lock and cpu_lock. With respect 212 * to dtrace_provider_lock and dtrace_lock, cpu_lock continues its historical 213 * role as a coarse-grained lock; it is acquired before both of these locks. 214 * With respect to dtrace_meta_lock, its behavior is stranger: cpu_lock must 215 * be acquired _between_ dtrace_meta_lock and any other DTrace locks. 216 * mod_lock is similar with respect to dtrace_provider_lock in that it must be 217 * acquired _between_ dtrace_provider_lock and dtrace_lock. 218 */ 219 static kmutex_t dtrace_lock; /* probe state lock */ 220 static kmutex_t dtrace_provider_lock; /* provider state lock */ 221 static kmutex_t dtrace_meta_lock; /* meta-provider state lock */ 222 223 /* 224 * DTrace Provider Variables 225 * 226 * These are the variables relating to DTrace as a provider (that is, the 227 * provider of the BEGIN, END, and ERROR probes). 228 */ 229 static dtrace_pattr_t dtrace_provider_attr = { 230 { DTRACE_STABILITY_STABLE, DTRACE_STABILITY_STABLE, DTRACE_CLASS_COMMON }, 231 { DTRACE_STABILITY_PRIVATE, DTRACE_STABILITY_PRIVATE, DTRACE_CLASS_UNKNOWN }, 232 { DTRACE_STABILITY_PRIVATE, DTRACE_STABILITY_PRIVATE, DTRACE_CLASS_UNKNOWN }, 233 { DTRACE_STABILITY_STABLE, DTRACE_STABILITY_STABLE, DTRACE_CLASS_COMMON }, 234 { DTRACE_STABILITY_STABLE, DTRACE_STABILITY_STABLE, DTRACE_CLASS_COMMON }, 235 }; 236 237 static void 238 dtrace_nullop(void) 239 {} 240 241 static dtrace_pops_t dtrace_provider_ops = { 242 (void (*)(void *, const dtrace_probedesc_t *))dtrace_nullop, 243 (void (*)(void *, struct modctl *))dtrace_nullop, 244 (void (*)(void *, dtrace_id_t, void *))dtrace_nullop, 245 (void (*)(void *, dtrace_id_t, void *))dtrace_nullop, 246 (void (*)(void *, dtrace_id_t, void *))dtrace_nullop, 247 (void (*)(void *, dtrace_id_t, void *))dtrace_nullop, 248 NULL, 249 NULL, 250 NULL, 251 (void (*)(void *, dtrace_id_t, void *))dtrace_nullop 252 }; 253 254 static dtrace_id_t dtrace_probeid_begin; /* special BEGIN probe */ 255 static dtrace_id_t dtrace_probeid_end; /* special END probe */ 256 dtrace_id_t dtrace_probeid_error; /* special ERROR probe */ 257 258 /* 259 * DTrace Helper Tracing Variables 260 */ 261 uint32_t dtrace_helptrace_next = 0; 262 uint32_t dtrace_helptrace_nlocals; 263 char *dtrace_helptrace_buffer; 264 int dtrace_helptrace_bufsize = 512 * 1024; 265 266 #ifdef DEBUG 267 int dtrace_helptrace_enabled = 1; 268 #else 269 int dtrace_helptrace_enabled = 0; 270 #endif 271 272 /* 273 * DTrace Error Hashing 274 * 275 * On DEBUG kernels, DTrace will track the errors that has seen in a hash 276 * table. This is very useful for checking coverage of tests that are 277 * expected to induce DIF or DOF processing errors, and may be useful for 278 * debugging problems in the DIF code generator or in DOF generation . The 279 * error hash may be examined with the ::dtrace_errhash MDB dcmd. 280 */ 281 #ifdef DEBUG 282 static dtrace_errhash_t dtrace_errhash[DTRACE_ERRHASHSZ]; 283 static const char *dtrace_errlast; 284 static kthread_t *dtrace_errthread; 285 static kmutex_t dtrace_errlock; 286 #endif 287 288 /* 289 * DTrace Macros and Constants 290 * 291 * These are various macros that are useful in various spots in the 292 * implementation, along with a few random constants that have no meaning 293 * outside of the implementation. There is no real structure to this cpp 294 * mishmash -- but is there ever? 295 */ 296 #define DTRACE_HASHSTR(hash, probe) \ 297 dtrace_hash_str(*((char **)((uintptr_t)(probe) + (hash)->dth_stroffs))) 298 299 #define DTRACE_HASHNEXT(hash, probe) \ 300 (dtrace_probe_t **)((uintptr_t)(probe) + (hash)->dth_nextoffs) 301 302 #define DTRACE_HASHPREV(hash, probe) \ 303 (dtrace_probe_t **)((uintptr_t)(probe) + (hash)->dth_prevoffs) 304 305 #define DTRACE_HASHEQ(hash, lhs, rhs) \ 306 (strcmp(*((char **)((uintptr_t)(lhs) + (hash)->dth_stroffs)), \ 307 *((char **)((uintptr_t)(rhs) + (hash)->dth_stroffs))) == 0) 308 309 #define DTRACE_AGGHASHSIZE_SLEW 17 310 311 /* 312 * The key for a thread-local variable consists of the lower 61 bits of the 313 * t_did, plus the 3 bits of the highest active interrupt above LOCK_LEVEL. 314 * We add DIF_VARIABLE_MAX to t_did to assure that the thread key is never 315 * equal to a variable identifier. This is necessary (but not sufficient) to 316 * assure that global associative arrays never collide with thread-local 317 * variables. To guarantee that they cannot collide, we must also define the 318 * order for keying dynamic variables. That order is: 319 * 320 * [ key0 ] ... [ keyn ] [ variable-key ] [ tls-key ] 321 * 322 * Because the variable-key and the tls-key are in orthogonal spaces, there is 323 * no way for a global variable key signature to match a thread-local key 324 * signature. 325 */ 326 #define DTRACE_TLS_THRKEY(where) { \ 327 uint_t intr = 0; \ 328 uint_t actv = CPU->cpu_intr_actv >> (LOCK_LEVEL + 1); \ 329 for (; actv; actv >>= 1) \ 330 intr++; \ 331 ASSERT(intr < (1 << 3)); \ 332 (where) = ((curthread->t_did + DIF_VARIABLE_MAX) & \ 333 (((uint64_t)1 << 61) - 1)) | ((uint64_t)intr << 61); \ 334 } 335 336 #define DTRACE_STORE(type, tomax, offset, what) \ 337 *((type *)((uintptr_t)(tomax) + (uintptr_t)offset)) = (type)(what); 338 339 #ifndef __i386 340 #define DTRACE_ALIGNCHECK(addr, size, flags) \ 341 if (addr & (size - 1)) { \ 342 *flags |= CPU_DTRACE_BADALIGN; \ 343 cpu_core[CPU->cpu_id].cpuc_dtrace_illval = addr; \ 344 return (0); \ 345 } 346 #else 347 #define DTRACE_ALIGNCHECK(addr, size, flags) 348 #endif 349 350 #define DTRACE_LOADFUNC(bits) \ 351 /*CSTYLED*/ \ 352 uint##bits##_t \ 353 dtrace_load##bits(uintptr_t addr) \ 354 { \ 355 size_t size = bits / NBBY; \ 356 /*CSTYLED*/ \ 357 uint##bits##_t rval; \ 358 int i; \ 359 volatile uint16_t *flags = (volatile uint16_t *) \ 360 &cpu_core[CPU->cpu_id].cpuc_dtrace_flags; \ 361 \ 362 DTRACE_ALIGNCHECK(addr, size, flags); \ 363 \ 364 for (i = 0; i < dtrace_toxranges; i++) { \ 365 if (addr >= dtrace_toxrange[i].dtt_limit) \ 366 continue; \ 367 \ 368 if (addr + size <= dtrace_toxrange[i].dtt_base) \ 369 continue; \ 370 \ 371 /* \ 372 * This address falls within a toxic region; return 0. \ 373 */ \ 374 *flags |= CPU_DTRACE_BADADDR; \ 375 cpu_core[CPU->cpu_id].cpuc_dtrace_illval = addr; \ 376 return (0); \ 377 } \ 378 \ 379 *flags |= CPU_DTRACE_NOFAULT; \ 380 /*CSTYLED*/ \ 381 rval = *((volatile uint##bits##_t *)addr); \ 382 *flags &= ~CPU_DTRACE_NOFAULT; \ 383 \ 384 return (rval); \ 385 } 386 387 #ifdef _LP64 388 #define dtrace_loadptr dtrace_load64 389 #else 390 #define dtrace_loadptr dtrace_load32 391 #endif 392 393 #define DTRACE_DYNHASH_FREE 0 394 #define DTRACE_DYNHASH_SINK 1 395 #define DTRACE_DYNHASH_VALID 2 396 397 #define DTRACE_MATCH_NEXT 0 398 #define DTRACE_MATCH_DONE 1 399 #define DTRACE_ANCHORED(probe) ((probe)->dtpr_func[0] != '\0') 400 #define DTRACE_STATE_ALIGN 64 401 402 #define DTRACE_FLAGS2FLT(flags) \ 403 (((flags) & CPU_DTRACE_BADADDR) ? DTRACEFLT_BADADDR : \ 404 ((flags) & CPU_DTRACE_ILLOP) ? DTRACEFLT_ILLOP : \ 405 ((flags) & CPU_DTRACE_DIVZERO) ? DTRACEFLT_DIVZERO : \ 406 ((flags) & CPU_DTRACE_KPRIV) ? DTRACEFLT_KPRIV : \ 407 ((flags) & CPU_DTRACE_UPRIV) ? DTRACEFLT_UPRIV : \ 408 ((flags) & CPU_DTRACE_TUPOFLOW) ? DTRACEFLT_TUPOFLOW : \ 409 ((flags) & CPU_DTRACE_BADALIGN) ? DTRACEFLT_BADALIGN : \ 410 ((flags) & CPU_DTRACE_NOSCRATCH) ? DTRACEFLT_NOSCRATCH : \ 411 DTRACEFLT_UNKNOWN) 412 413 #define DTRACEACT_ISSTRING(act) \ 414 ((act)->dta_kind == DTRACEACT_DIFEXPR && \ 415 (act)->dta_difo->dtdo_rtype.dtdt_kind == DIF_TYPE_STRING) 416 417 static dtrace_probe_t *dtrace_probe_lookup_id(dtrace_id_t id); 418 static void dtrace_enabling_provide(dtrace_provider_t *); 419 static int dtrace_enabling_match(dtrace_enabling_t *, int *); 420 static void dtrace_enabling_matchall(void); 421 static dtrace_state_t *dtrace_anon_grab(void); 422 static uint64_t dtrace_helper(int, dtrace_mstate_t *, 423 dtrace_state_t *, uint64_t, uint64_t); 424 static dtrace_helpers_t *dtrace_helpers_create(proc_t *); 425 static void dtrace_buffer_drop(dtrace_buffer_t *); 426 static intptr_t dtrace_buffer_reserve(dtrace_buffer_t *, size_t, size_t, 427 dtrace_state_t *, dtrace_mstate_t *); 428 static int dtrace_state_option(dtrace_state_t *, dtrace_optid_t, 429 dtrace_optval_t); 430 static int dtrace_ecb_create_enable(dtrace_probe_t *, void *); 431 static void dtrace_helper_provider_destroy(dtrace_helper_provider_t *); 432 433 /* 434 * DTrace Probe Context Functions 435 * 436 * These functions are called from probe context. Because probe context is 437 * any context in which C may be called, arbitrarily locks may be held, 438 * interrupts may be disabled, we may be in arbitrary dispatched state, etc. 439 * As a result, functions called from probe context may only call other DTrace 440 * support functions -- they may not interact at all with the system at large. 441 * (Note that the ASSERT macro is made probe-context safe by redefining it in 442 * terms of dtrace_assfail(), a probe-context safe function.) If arbitrary 443 * loads are to be performed from probe context, they _must_ be in terms of 444 * the safe dtrace_load*() variants. 445 * 446 * Some functions in this block are not actually called from probe context; 447 * for these functions, there will be a comment above the function reading 448 * "Note: not called from probe context." 449 */ 450 void 451 dtrace_panic(const char *format, ...) 452 { 453 va_list alist; 454 455 va_start(alist, format); 456 dtrace_vpanic(format, alist); 457 va_end(alist); 458 } 459 460 int 461 dtrace_assfail(const char *a, const char *f, int l) 462 { 463 dtrace_panic("assertion failed: %s, file: %s, line: %d", a, f, l); 464 465 /* 466 * We just need something here that even the most clever compiler 467 * cannot optimize away. 468 */ 469 return (a[(uintptr_t)f]); 470 } 471 472 /* 473 * Atomically increment a specified error counter from probe context. 474 */ 475 static void 476 dtrace_error(uint32_t *counter) 477 { 478 /* 479 * Most counters stored to in probe context are per-CPU counters. 480 * However, there are some error conditions that are sufficiently 481 * arcane that they don't merit per-CPU storage. If these counters 482 * are incremented concurrently on different CPUs, scalability will be 483 * adversely affected -- but we don't expect them to be white-hot in a 484 * correctly constructed enabling... 485 */ 486 uint32_t oval, nval; 487 488 do { 489 oval = *counter; 490 491 if ((nval = oval + 1) == 0) { 492 /* 493 * If the counter would wrap, set it to 1 -- assuring 494 * that the counter is never zero when we have seen 495 * errors. (The counter must be 32-bits because we 496 * aren't guaranteed a 64-bit compare&swap operation.) 497 * To save this code both the infamy of being fingered 498 * by a priggish news story and the indignity of being 499 * the target of a neo-puritan witch trial, we're 500 * carefully avoiding any colorful description of the 501 * likelihood of this condition -- but suffice it to 502 * say that it is only slightly more likely than the 503 * overflow of predicate cache IDs, as discussed in 504 * dtrace_predicate_create(). 505 */ 506 nval = 1; 507 } 508 } while (dtrace_cas32(counter, oval, nval) != oval); 509 } 510 511 /* 512 * Use the DTRACE_LOADFUNC macro to define functions for each of loading a 513 * uint8_t, a uint16_t, a uint32_t and a uint64_t. 514 */ 515 DTRACE_LOADFUNC(8) 516 DTRACE_LOADFUNC(16) 517 DTRACE_LOADFUNC(32) 518 DTRACE_LOADFUNC(64) 519 520 static int 521 dtrace_inscratch(uintptr_t dest, size_t size, dtrace_mstate_t *mstate) 522 { 523 if (dest < mstate->dtms_scratch_base) 524 return (0); 525 526 if (dest + size < dest) 527 return (0); 528 529 if (dest + size > mstate->dtms_scratch_ptr) 530 return (0); 531 532 return (1); 533 } 534 535 static int 536 dtrace_canstore_statvar(uint64_t addr, size_t sz, 537 dtrace_statvar_t **svars, int nsvars) 538 { 539 int i; 540 541 for (i = 0; i < nsvars; i++) { 542 dtrace_statvar_t *svar = svars[i]; 543 544 if (svar == NULL || svar->dtsv_size == 0) 545 continue; 546 547 if (addr - svar->dtsv_data < svar->dtsv_size && 548 addr + sz <= svar->dtsv_data + svar->dtsv_size) 549 return (1); 550 } 551 552 return (0); 553 } 554 555 /* 556 * Check to see if the address is within a memory region to which a store may 557 * be issued. This includes the DTrace scratch areas, and any DTrace variable 558 * region. The caller of dtrace_canstore() is responsible for performing any 559 * alignment checks that are needed before stores are actually executed. 560 */ 561 static int 562 dtrace_canstore(uint64_t addr, size_t sz, dtrace_mstate_t *mstate, 563 dtrace_vstate_t *vstate) 564 { 565 uintptr_t a; 566 size_t s; 567 568 /* 569 * First, check to see if the address is in scratch space... 570 */ 571 a = mstate->dtms_scratch_base; 572 s = mstate->dtms_scratch_size; 573 574 if (addr - a < s && addr + sz <= a + s) 575 return (1); 576 577 /* 578 * Now check to see if it's a dynamic variable. This check will pick 579 * up both thread-local variables and any global dynamically-allocated 580 * variables. 581 */ 582 a = (uintptr_t)vstate->dtvs_dynvars.dtds_base; 583 s = vstate->dtvs_dynvars.dtds_size; 584 if (addr - a < s && addr + sz <= a + s) 585 return (1); 586 587 /* 588 * Finally, check the static local and global variables. These checks 589 * take the longest, so we perform them last. 590 */ 591 if (dtrace_canstore_statvar(addr, sz, 592 vstate->dtvs_locals, vstate->dtvs_nlocals)) 593 return (1); 594 595 if (dtrace_canstore_statvar(addr, sz, 596 vstate->dtvs_globals, vstate->dtvs_nglobals)) 597 return (1); 598 599 return (0); 600 } 601 602 /* 603 * Compare two strings using safe loads. 604 */ 605 static int 606 dtrace_strncmp(char *s1, char *s2, size_t limit) 607 { 608 uint8_t c1, c2; 609 volatile uint16_t *flags; 610 611 if (s1 == s2 || limit == 0) 612 return (0); 613 614 flags = (volatile uint16_t *)&cpu_core[CPU->cpu_id].cpuc_dtrace_flags; 615 616 do { 617 if (s1 == NULL) { 618 c1 = '\0'; 619 } else { 620 c1 = dtrace_load8((uintptr_t)s1++); 621 } 622 623 if (s2 == NULL) { 624 c2 = '\0'; 625 } else { 626 c2 = dtrace_load8((uintptr_t)s2++); 627 } 628 629 if (c1 != c2) 630 return (c1 - c2); 631 } while (--limit && c1 != '\0' && !(*flags & CPU_DTRACE_FAULT)); 632 633 return (0); 634 } 635 636 /* 637 * Compute strlen(s) for a string using safe memory accesses. The additional 638 * len parameter is used to specify a maximum length to ensure completion. 639 */ 640 static size_t 641 dtrace_strlen(const char *s, size_t lim) 642 { 643 uint_t len; 644 645 for (len = 0; len != lim; len++) { 646 if (dtrace_load8((uintptr_t)s++) == '\0') 647 break; 648 } 649 650 return (len); 651 } 652 653 /* 654 * Check if an address falls within a toxic region. 655 */ 656 static int 657 dtrace_istoxic(uintptr_t kaddr, size_t size) 658 { 659 uintptr_t taddr, tsize; 660 int i; 661 662 for (i = 0; i < dtrace_toxranges; i++) { 663 taddr = dtrace_toxrange[i].dtt_base; 664 tsize = dtrace_toxrange[i].dtt_limit - taddr; 665 666 if (kaddr - taddr < tsize) { 667 DTRACE_CPUFLAG_SET(CPU_DTRACE_BADADDR); 668 cpu_core[CPU->cpu_id].cpuc_dtrace_illval = kaddr; 669 return (1); 670 } 671 672 if (taddr - kaddr < size) { 673 DTRACE_CPUFLAG_SET(CPU_DTRACE_BADADDR); 674 cpu_core[CPU->cpu_id].cpuc_dtrace_illval = taddr; 675 return (1); 676 } 677 } 678 679 return (0); 680 } 681 682 /* 683 * Copy src to dst using safe memory accesses. The src is assumed to be unsafe 684 * memory specified by the DIF program. The dst is assumed to be safe memory 685 * that we can store to directly because it is managed by DTrace. As with 686 * standard bcopy, overlapping copies are handled properly. 687 */ 688 static void 689 dtrace_bcopy(const void *src, void *dst, size_t len) 690 { 691 if (len != 0) { 692 uint8_t *s1 = dst; 693 const uint8_t *s2 = src; 694 695 if (s1 <= s2) { 696 do { 697 *s1++ = dtrace_load8((uintptr_t)s2++); 698 } while (--len != 0); 699 } else { 700 s2 += len; 701 s1 += len; 702 703 do { 704 *--s1 = dtrace_load8((uintptr_t)--s2); 705 } while (--len != 0); 706 } 707 } 708 } 709 710 /* 711 * Copy src to dst using safe memory accesses, up to either the specified 712 * length, or the point that a nul byte is encountered. The src is assumed to 713 * be unsafe memory specified by the DIF program. The dst is assumed to be 714 * safe memory that we can store to directly because it is managed by DTrace. 715 * Unlike dtrace_bcopy(), overlapping regions are not handled. 716 */ 717 static void 718 dtrace_strcpy(const void *src, void *dst, size_t len) 719 { 720 if (len != 0) { 721 uint8_t *s1 = dst, c; 722 const uint8_t *s2 = src; 723 724 do { 725 *s1++ = c = dtrace_load8((uintptr_t)s2++); 726 } while (--len != 0 && c != '\0'); 727 } 728 } 729 730 /* 731 * Copy src to dst, deriving the size and type from the specified (BYREF) 732 * variable type. The src is assumed to be unsafe memory specified by the DIF 733 * program. The dst is assumed to be DTrace variable memory that is of the 734 * specified type; we assume that we can store to directly. 735 */ 736 static void 737 dtrace_vcopy(void *src, void *dst, dtrace_diftype_t *type) 738 { 739 ASSERT(type->dtdt_flags & DIF_TF_BYREF); 740 741 if (type->dtdt_kind == DIF_TYPE_STRING) { 742 dtrace_strcpy(src, dst, type->dtdt_size); 743 } else { 744 dtrace_bcopy(src, dst, type->dtdt_size); 745 } 746 } 747 748 /* 749 * Compare s1 to s2 using safe memory accesses. The s1 data is assumed to be 750 * unsafe memory specified by the DIF program. The s2 data is assumed to be 751 * safe memory that we can access directly because it is managed by DTrace. 752 */ 753 static int 754 dtrace_bcmp(const void *s1, const void *s2, size_t len) 755 { 756 volatile uint16_t *flags; 757 758 flags = (volatile uint16_t *)&cpu_core[CPU->cpu_id].cpuc_dtrace_flags; 759 760 if (s1 == s2) 761 return (0); 762 763 if (s1 == NULL || s2 == NULL) 764 return (1); 765 766 if (s1 != s2 && len != 0) { 767 const uint8_t *ps1 = s1; 768 const uint8_t *ps2 = s2; 769 770 do { 771 if (dtrace_load8((uintptr_t)ps1++) != *ps2++) 772 return (1); 773 } while (--len != 0 && !(*flags & CPU_DTRACE_FAULT)); 774 } 775 return (0); 776 } 777 778 /* 779 * Zero the specified region using a simple byte-by-byte loop. Note that this 780 * is for safe DTrace-managed memory only. 781 */ 782 static void 783 dtrace_bzero(void *dst, size_t len) 784 { 785 uchar_t *cp; 786 787 for (cp = dst; len != 0; len--) 788 *cp++ = 0; 789 } 790 791 /* 792 * This privilege check should be used by actions and subroutines to 793 * verify that the user credentials of the process that enabled the 794 * invoking ECB match the target credentials 795 */ 796 static int 797 dtrace_priv_proc_common_user(dtrace_state_t *state) 798 { 799 cred_t *cr, *s_cr = state->dts_cred.dcr_cred; 800 801 /* 802 * We should always have a non-NULL state cred here, since if cred 803 * is null (anonymous tracing), we fast-path bypass this routine. 804 */ 805 ASSERT(s_cr != NULL); 806 807 if ((cr = CRED()) != NULL && 808 s_cr->cr_uid == cr->cr_uid && 809 s_cr->cr_uid == cr->cr_ruid && 810 s_cr->cr_uid == cr->cr_suid && 811 s_cr->cr_gid == cr->cr_gid && 812 s_cr->cr_gid == cr->cr_rgid && 813 s_cr->cr_gid == cr->cr_sgid) 814 return (1); 815 816 return (0); 817 } 818 819 /* 820 * This privilege check should be used by actions and subroutines to 821 * verify that the zone of the process that enabled the invoking ECB 822 * matches the target credentials 823 */ 824 static int 825 dtrace_priv_proc_common_zone(dtrace_state_t *state) 826 { 827 cred_t *cr, *s_cr = state->dts_cred.dcr_cred; 828 829 /* 830 * We should always have a non-NULL state cred here, since if cred 831 * is null (anonymous tracing), we fast-path bypass this routine. 832 */ 833 ASSERT(s_cr != NULL); 834 835 if ((cr = CRED()) != NULL && 836 s_cr->cr_zone == cr->cr_zone) 837 return (1); 838 839 return (0); 840 } 841 842 /* 843 * This privilege check should be used by actions and subroutines to 844 * verify that the process has not setuid or changed credentials. 845 */ 846 static int 847 dtrace_priv_proc_common_nocd() 848 { 849 proc_t *proc; 850 851 if ((proc = ttoproc(curthread)) != NULL && 852 !(proc->p_flag & SNOCD)) 853 return (1); 854 855 return (0); 856 } 857 858 static int 859 dtrace_priv_proc_destructive(dtrace_state_t *state) 860 { 861 int action = state->dts_cred.dcr_action; 862 863 if (((action & DTRACE_CRA_PROC_DESTRUCTIVE_ALLZONE) == 0) && 864 dtrace_priv_proc_common_zone(state) == 0) 865 goto bad; 866 867 if (((action & DTRACE_CRA_PROC_DESTRUCTIVE_ALLUSER) == 0) && 868 dtrace_priv_proc_common_user(state) == 0) 869 goto bad; 870 871 if (((action & DTRACE_CRA_PROC_DESTRUCTIVE_CREDCHG) == 0) && 872 dtrace_priv_proc_common_nocd() == 0) 873 goto bad; 874 875 return (1); 876 877 bad: 878 cpu_core[CPU->cpu_id].cpuc_dtrace_flags |= CPU_DTRACE_UPRIV; 879 880 return (0); 881 } 882 883 static int 884 dtrace_priv_proc_control(dtrace_state_t *state) 885 { 886 if (state->dts_cred.dcr_action & DTRACE_CRA_PROC_CONTROL) 887 return (1); 888 889 if (dtrace_priv_proc_common_zone(state) && 890 dtrace_priv_proc_common_user(state) && 891 dtrace_priv_proc_common_nocd()) 892 return (1); 893 894 cpu_core[CPU->cpu_id].cpuc_dtrace_flags |= CPU_DTRACE_UPRIV; 895 896 return (0); 897 } 898 899 static int 900 dtrace_priv_proc(dtrace_state_t *state) 901 { 902 if (state->dts_cred.dcr_action & DTRACE_CRA_PROC) 903 return (1); 904 905 cpu_core[CPU->cpu_id].cpuc_dtrace_flags |= CPU_DTRACE_UPRIV; 906 907 return (0); 908 } 909 910 static int 911 dtrace_priv_kernel(dtrace_state_t *state) 912 { 913 if (state->dts_cred.dcr_action & DTRACE_CRA_KERNEL) 914 return (1); 915 916 cpu_core[CPU->cpu_id].cpuc_dtrace_flags |= CPU_DTRACE_KPRIV; 917 918 return (0); 919 } 920 921 static int 922 dtrace_priv_kernel_destructive(dtrace_state_t *state) 923 { 924 if (state->dts_cred.dcr_action & DTRACE_CRA_KERNEL_DESTRUCTIVE) 925 return (1); 926 927 cpu_core[CPU->cpu_id].cpuc_dtrace_flags |= CPU_DTRACE_KPRIV; 928 929 return (0); 930 } 931 932 /* 933 * Note: not called from probe context. This function is called 934 * asynchronously (and at a regular interval) from outside of probe context to 935 * clean the dirty dynamic variable lists on all CPUs. Dynamic variable 936 * cleaning is explained in detail in <sys/dtrace_impl.h>. 937 */ 938 void 939 dtrace_dynvar_clean(dtrace_dstate_t *dstate) 940 { 941 dtrace_dynvar_t *dirty; 942 dtrace_dstate_percpu_t *dcpu; 943 int i, work = 0; 944 945 for (i = 0; i < NCPU; i++) { 946 dcpu = &dstate->dtds_percpu[i]; 947 948 ASSERT(dcpu->dtdsc_rinsing == NULL); 949 950 /* 951 * If the dirty list is NULL, there is no dirty work to do. 952 */ 953 if (dcpu->dtdsc_dirty == NULL) 954 continue; 955 956 /* 957 * If the clean list is non-NULL, then we're not going to do 958 * any work for this CPU -- it means that there has not been 959 * a dtrace_dynvar() allocation on this CPU (or from this CPU) 960 * since the last time we cleaned house. 961 */ 962 if (dcpu->dtdsc_clean != NULL) 963 continue; 964 965 work = 1; 966 967 /* 968 * Atomically move the dirty list aside. 969 */ 970 do { 971 dirty = dcpu->dtdsc_dirty; 972 973 /* 974 * Before we zap the dirty list, set the rinsing list. 975 * (This allows for a potential assertion in 976 * dtrace_dynvar(): if a free dynamic variable appears 977 * on a hash chain, either the dirty list or the 978 * rinsing list for some CPU must be non-NULL.) 979 */ 980 dcpu->dtdsc_rinsing = dirty; 981 dtrace_membar_producer(); 982 } while (dtrace_casptr(&dcpu->dtdsc_dirty, 983 dirty, NULL) != dirty); 984 } 985 986 if (!work) { 987 /* 988 * We have no work to do; we can simply return. 989 */ 990 return; 991 } 992 993 dtrace_sync(); 994 995 for (i = 0; i < NCPU; i++) { 996 dcpu = &dstate->dtds_percpu[i]; 997 998 if (dcpu->dtdsc_rinsing == NULL) 999 continue; 1000 1001 /* 1002 * We are now guaranteed that no hash chain contains a pointer 1003 * into this dirty list; we can make it clean. 1004 */ 1005 ASSERT(dcpu->dtdsc_clean == NULL); 1006 dcpu->dtdsc_clean = dcpu->dtdsc_rinsing; 1007 dcpu->dtdsc_rinsing = NULL; 1008 } 1009 1010 /* 1011 * Before we actually set the state to be DTRACE_DSTATE_CLEAN, make 1012 * sure that all CPUs have seen all of the dtdsc_clean pointers. 1013 * This prevents a race whereby a CPU incorrectly decides that 1014 * the state should be something other than DTRACE_DSTATE_CLEAN 1015 * after dtrace_dynvar_clean() has completed. 1016 */ 1017 dtrace_sync(); 1018 1019 dstate->dtds_state = DTRACE_DSTATE_CLEAN; 1020 } 1021 1022 /* 1023 * Depending on the value of the op parameter, this function looks-up, 1024 * allocates or deallocates an arbitrarily-keyed dynamic variable. If an 1025 * allocation is requested, this function will return a pointer to a 1026 * dtrace_dynvar_t corresponding to the allocated variable -- or NULL if no 1027 * variable can be allocated. If NULL is returned, the appropriate counter 1028 * will be incremented. 1029 */ 1030 dtrace_dynvar_t * 1031 dtrace_dynvar(dtrace_dstate_t *dstate, uint_t nkeys, 1032 dtrace_key_t *key, size_t dsize, dtrace_dynvar_op_t op) 1033 { 1034 uint64_t hashval = DTRACE_DYNHASH_VALID; 1035 dtrace_dynhash_t *hash = dstate->dtds_hash; 1036 dtrace_dynvar_t *free, *new_free, *next, *dvar, *start, *prev = NULL; 1037 processorid_t me = CPU->cpu_id, cpu = me; 1038 dtrace_dstate_percpu_t *dcpu = &dstate->dtds_percpu[me]; 1039 size_t bucket, ksize; 1040 size_t chunksize = dstate->dtds_chunksize; 1041 uintptr_t kdata, lock, nstate; 1042 uint_t i; 1043 1044 ASSERT(nkeys != 0); 1045 1046 /* 1047 * Hash the key. As with aggregations, we use Jenkins' "One-at-a-time" 1048 * algorithm. For the by-value portions, we perform the algorithm in 1049 * 16-bit chunks (as opposed to 8-bit chunks). This speeds things up a 1050 * bit, and seems to have only a minute effect on distribution. For 1051 * the by-reference data, we perform "One-at-a-time" iterating (safely) 1052 * over each referenced byte. It's painful to do this, but it's much 1053 * better than pathological hash distribution. The efficacy of the 1054 * hashing algorithm (and a comparison with other algorithms) may be 1055 * found by running the ::dtrace_dynstat MDB dcmd. 1056 */ 1057 for (i = 0; i < nkeys; i++) { 1058 if (key[i].dttk_size == 0) { 1059 uint64_t val = key[i].dttk_value; 1060 1061 hashval += (val >> 48) & 0xffff; 1062 hashval += (hashval << 10); 1063 hashval ^= (hashval >> 6); 1064 1065 hashval += (val >> 32) & 0xffff; 1066 hashval += (hashval << 10); 1067 hashval ^= (hashval >> 6); 1068 1069 hashval += (val >> 16) & 0xffff; 1070 hashval += (hashval << 10); 1071 hashval ^= (hashval >> 6); 1072 1073 hashval += val & 0xffff; 1074 hashval += (hashval << 10); 1075 hashval ^= (hashval >> 6); 1076 } else { 1077 /* 1078 * This is incredibly painful, but it beats the hell 1079 * out of the alternative. 1080 */ 1081 uint64_t j, size = key[i].dttk_size; 1082 uintptr_t base = (uintptr_t)key[i].dttk_value; 1083 1084 for (j = 0; j < size; j++) { 1085 hashval += dtrace_load8(base + j); 1086 hashval += (hashval << 10); 1087 hashval ^= (hashval >> 6); 1088 } 1089 } 1090 } 1091 1092 hashval += (hashval << 3); 1093 hashval ^= (hashval >> 11); 1094 hashval += (hashval << 15); 1095 1096 /* 1097 * There is a remote chance (ideally, 1 in 2^31) that our hashval 1098 * comes out to be one of our two sentinel hash values. If this 1099 * actually happens, we set the hashval to be a value known to be a 1100 * non-sentinel value. 1101 */ 1102 if (hashval == DTRACE_DYNHASH_FREE || hashval == DTRACE_DYNHASH_SINK) 1103 hashval = DTRACE_DYNHASH_VALID; 1104 1105 /* 1106 * Yes, it's painful to do a divide here. If the cycle count becomes 1107 * important here, tricks can be pulled to reduce it. (However, it's 1108 * critical that hash collisions be kept to an absolute minimum; 1109 * they're much more painful than a divide.) It's better to have a 1110 * solution that generates few collisions and still keeps things 1111 * relatively simple. 1112 */ 1113 bucket = hashval % dstate->dtds_hashsize; 1114 1115 if (op == DTRACE_DYNVAR_DEALLOC) { 1116 volatile uintptr_t *lockp = &hash[bucket].dtdh_lock; 1117 1118 for (;;) { 1119 while ((lock = *lockp) & 1) 1120 continue; 1121 1122 if (dtrace_casptr((void *)lockp, 1123 (void *)lock, (void *)(lock + 1)) == (void *)lock) 1124 break; 1125 } 1126 1127 dtrace_membar_producer(); 1128 } 1129 1130 top: 1131 prev = NULL; 1132 lock = hash[bucket].dtdh_lock; 1133 1134 dtrace_membar_consumer(); 1135 1136 start = hash[bucket].dtdh_chain; 1137 ASSERT(start != NULL && (start->dtdv_hashval == DTRACE_DYNHASH_SINK || 1138 start->dtdv_hashval != DTRACE_DYNHASH_FREE || 1139 op != DTRACE_DYNVAR_DEALLOC)); 1140 1141 for (dvar = start; dvar != NULL; dvar = dvar->dtdv_next) { 1142 dtrace_tuple_t *dtuple = &dvar->dtdv_tuple; 1143 dtrace_key_t *dkey = &dtuple->dtt_key[0]; 1144 1145 if (dvar->dtdv_hashval != hashval) { 1146 if (dvar->dtdv_hashval == DTRACE_DYNHASH_SINK) { 1147 /* 1148 * We've reached the sink, and therefore the 1149 * end of the hash chain; we can kick out of 1150 * the loop knowing that we have seen a valid 1151 * snapshot of state. 1152 */ 1153 ASSERT(dvar->dtdv_next == NULL); 1154 ASSERT(dvar == &dtrace_dynhash_sink); 1155 break; 1156 } 1157 1158 if (dvar->dtdv_hashval == DTRACE_DYNHASH_FREE) { 1159 /* 1160 * We've gone off the rails: somewhere along 1161 * the line, one of the members of this hash 1162 * chain was deleted. Note that we could also 1163 * detect this by simply letting this loop run 1164 * to completion, as we would eventually hit 1165 * the end of the dirty list. However, we 1166 * want to avoid running the length of the 1167 * dirty list unnecessarily (it might be quite 1168 * long), so we catch this as early as 1169 * possible by detecting the hash marker. In 1170 * this case, we simply set dvar to NULL and 1171 * break; the conditional after the loop will 1172 * send us back to top. 1173 */ 1174 dvar = NULL; 1175 break; 1176 } 1177 1178 goto next; 1179 } 1180 1181 if (dtuple->dtt_nkeys != nkeys) 1182 goto next; 1183 1184 for (i = 0; i < nkeys; i++, dkey++) { 1185 if (dkey->dttk_size != key[i].dttk_size) 1186 goto next; /* size or type mismatch */ 1187 1188 if (dkey->dttk_size != 0) { 1189 if (dtrace_bcmp( 1190 (void *)(uintptr_t)key[i].dttk_value, 1191 (void *)(uintptr_t)dkey->dttk_value, 1192 dkey->dttk_size)) 1193 goto next; 1194 } else { 1195 if (dkey->dttk_value != key[i].dttk_value) 1196 goto next; 1197 } 1198 } 1199 1200 if (op != DTRACE_DYNVAR_DEALLOC) 1201 return (dvar); 1202 1203 ASSERT(dvar->dtdv_next == NULL || 1204 dvar->dtdv_next->dtdv_hashval != DTRACE_DYNHASH_FREE); 1205 1206 if (prev != NULL) { 1207 ASSERT(hash[bucket].dtdh_chain != dvar); 1208 ASSERT(start != dvar); 1209 ASSERT(prev->dtdv_next == dvar); 1210 prev->dtdv_next = dvar->dtdv_next; 1211 } else { 1212 if (dtrace_casptr(&hash[bucket].dtdh_chain, 1213 start, dvar->dtdv_next) != start) { 1214 /* 1215 * We have failed to atomically swing the 1216 * hash table head pointer, presumably because 1217 * of a conflicting allocation on another CPU. 1218 * We need to reread the hash chain and try 1219 * again. 1220 */ 1221 goto top; 1222 } 1223 } 1224 1225 dtrace_membar_producer(); 1226 1227 /* 1228 * Now set the hash value to indicate that it's free. 1229 */ 1230 ASSERT(hash[bucket].dtdh_chain != dvar); 1231 dvar->dtdv_hashval = DTRACE_DYNHASH_FREE; 1232 1233 dtrace_membar_producer(); 1234 1235 /* 1236 * Set the next pointer to point at the dirty list, and 1237 * atomically swing the dirty pointer to the newly freed dvar. 1238 */ 1239 do { 1240 next = dcpu->dtdsc_dirty; 1241 dvar->dtdv_next = next; 1242 } while (dtrace_casptr(&dcpu->dtdsc_dirty, next, dvar) != next); 1243 1244 /* 1245 * Finally, unlock this hash bucket. 1246 */ 1247 ASSERT(hash[bucket].dtdh_lock == lock); 1248 ASSERT(lock & 1); 1249 hash[bucket].dtdh_lock++; 1250 1251 return (NULL); 1252 next: 1253 prev = dvar; 1254 continue; 1255 } 1256 1257 if (dvar == NULL) { 1258 /* 1259 * If dvar is NULL, it is because we went off the rails: 1260 * one of the elements that we traversed in the hash chain 1261 * was deleted while we were traversing it. In this case, 1262 * we assert that we aren't doing a dealloc (deallocs lock 1263 * the hash bucket to prevent themselves from racing with 1264 * one another), and retry the hash chain traversal. 1265 */ 1266 ASSERT(op != DTRACE_DYNVAR_DEALLOC); 1267 goto top; 1268 } 1269 1270 if (op != DTRACE_DYNVAR_ALLOC) { 1271 /* 1272 * If we are not to allocate a new variable, we want to 1273 * return NULL now. Before we return, check that the value 1274 * of the lock word hasn't changed. If it has, we may have 1275 * seen an inconsistent snapshot. 1276 */ 1277 if (op == DTRACE_DYNVAR_NOALLOC) { 1278 if (hash[bucket].dtdh_lock != lock) 1279 goto top; 1280 } else { 1281 ASSERT(op == DTRACE_DYNVAR_DEALLOC); 1282 ASSERT(hash[bucket].dtdh_lock == lock); 1283 ASSERT(lock & 1); 1284 hash[bucket].dtdh_lock++; 1285 } 1286 1287 return (NULL); 1288 } 1289 1290 /* 1291 * We need to allocate a new dynamic variable. The size we need is the 1292 * size of dtrace_dynvar plus the size of nkeys dtrace_key_t's plus the 1293 * size of any auxiliary key data (rounded up to 8-byte alignment) plus 1294 * the size of any referred-to data (dsize). We then round the final 1295 * size up to the chunksize for allocation. 1296 */ 1297 for (ksize = 0, i = 0; i < nkeys; i++) 1298 ksize += P2ROUNDUP(key[i].dttk_size, sizeof (uint64_t)); 1299 1300 /* 1301 * This should be pretty much impossible, but could happen if, say, 1302 * strange DIF specified the tuple. Ideally, this should be an 1303 * assertion and not an error condition -- but that requires that the 1304 * chunksize calculation in dtrace_difo_chunksize() be absolutely 1305 * bullet-proof. (That is, it must not be able to be fooled by 1306 * malicious DIF.) Given the lack of backwards branches in DIF, 1307 * solving this would presumably not amount to solving the Halting 1308 * Problem -- but it still seems awfully hard. 1309 */ 1310 if (sizeof (dtrace_dynvar_t) + sizeof (dtrace_key_t) * (nkeys - 1) + 1311 ksize + dsize > chunksize) { 1312 dcpu->dtdsc_drops++; 1313 return (NULL); 1314 } 1315 1316 nstate = DTRACE_DSTATE_EMPTY; 1317 1318 do { 1319 retry: 1320 free = dcpu->dtdsc_free; 1321 1322 if (free == NULL) { 1323 dtrace_dynvar_t *clean = dcpu->dtdsc_clean; 1324 void *rval; 1325 1326 if (clean == NULL) { 1327 /* 1328 * We're out of dynamic variable space on 1329 * this CPU. Unless we have tried all CPUs, 1330 * we'll try to allocate from a different 1331 * CPU. 1332 */ 1333 switch (dstate->dtds_state) { 1334 case DTRACE_DSTATE_CLEAN: { 1335 void *sp = &dstate->dtds_state; 1336 1337 if (++cpu >= NCPU) 1338 cpu = 0; 1339 1340 if (dcpu->dtdsc_dirty != NULL && 1341 nstate == DTRACE_DSTATE_EMPTY) 1342 nstate = DTRACE_DSTATE_DIRTY; 1343 1344 if (dcpu->dtdsc_rinsing != NULL) 1345 nstate = DTRACE_DSTATE_RINSING; 1346 1347 dcpu = &dstate->dtds_percpu[cpu]; 1348 1349 if (cpu != me) 1350 goto retry; 1351 1352 (void) dtrace_cas32(sp, 1353 DTRACE_DSTATE_CLEAN, nstate); 1354 1355 /* 1356 * To increment the correct bean 1357 * counter, take another lap. 1358 */ 1359 goto retry; 1360 } 1361 1362 case DTRACE_DSTATE_DIRTY: 1363 dcpu->dtdsc_dirty_drops++; 1364 break; 1365 1366 case DTRACE_DSTATE_RINSING: 1367 dcpu->dtdsc_rinsing_drops++; 1368 break; 1369 1370 case DTRACE_DSTATE_EMPTY: 1371 dcpu->dtdsc_drops++; 1372 break; 1373 } 1374 1375 DTRACE_CPUFLAG_SET(CPU_DTRACE_DROP); 1376 return (NULL); 1377 } 1378 1379 /* 1380 * The clean list appears to be non-empty. We want to 1381 * move the clean list to the free list; we start by 1382 * moving the clean pointer aside. 1383 */ 1384 if (dtrace_casptr(&dcpu->dtdsc_clean, 1385 clean, NULL) != clean) { 1386 /* 1387 * We are in one of two situations: 1388 * 1389 * (a) The clean list was switched to the 1390 * free list by another CPU. 1391 * 1392 * (b) The clean list was added to by the 1393 * cleansing cyclic. 1394 * 1395 * In either of these situations, we can 1396 * just reattempt the free list allocation. 1397 */ 1398 goto retry; 1399 } 1400 1401 ASSERT(clean->dtdv_hashval == DTRACE_DYNHASH_FREE); 1402 1403 /* 1404 * Now we'll move the clean list to the free list. 1405 * It's impossible for this to fail: the only way 1406 * the free list can be updated is through this 1407 * code path, and only one CPU can own the clean list. 1408 * Thus, it would only be possible for this to fail if 1409 * this code were racing with dtrace_dynvar_clean(). 1410 * (That is, if dtrace_dynvar_clean() updated the clean 1411 * list, and we ended up racing to update the free 1412 * list.) This race is prevented by the dtrace_sync() 1413 * in dtrace_dynvar_clean() -- which flushes the 1414 * owners of the clean lists out before resetting 1415 * the clean lists. 1416 */ 1417 rval = dtrace_casptr(&dcpu->dtdsc_free, NULL, clean); 1418 ASSERT(rval == NULL); 1419 goto retry; 1420 } 1421 1422 dvar = free; 1423 new_free = dvar->dtdv_next; 1424 } while (dtrace_casptr(&dcpu->dtdsc_free, free, new_free) != free); 1425 1426 /* 1427 * We have now allocated a new chunk. We copy the tuple keys into the 1428 * tuple array and copy any referenced key data into the data space 1429 * following the tuple array. As we do this, we relocate dttk_value 1430 * in the final tuple to point to the key data address in the chunk. 1431 */ 1432 kdata = (uintptr_t)&dvar->dtdv_tuple.dtt_key[nkeys]; 1433 dvar->dtdv_data = (void *)(kdata + ksize); 1434 dvar->dtdv_tuple.dtt_nkeys = nkeys; 1435 1436 for (i = 0; i < nkeys; i++) { 1437 dtrace_key_t *dkey = &dvar->dtdv_tuple.dtt_key[i]; 1438 size_t kesize = key[i].dttk_size; 1439 1440 if (kesize != 0) { 1441 dtrace_bcopy( 1442 (const void *)(uintptr_t)key[i].dttk_value, 1443 (void *)kdata, kesize); 1444 dkey->dttk_value = kdata; 1445 kdata += P2ROUNDUP(kesize, sizeof (uint64_t)); 1446 } else { 1447 dkey->dttk_value = key[i].dttk_value; 1448 } 1449 1450 dkey->dttk_size = kesize; 1451 } 1452 1453 ASSERT(dvar->dtdv_hashval == DTRACE_DYNHASH_FREE); 1454 dvar->dtdv_hashval = hashval; 1455 dvar->dtdv_next = start; 1456 1457 if (dtrace_casptr(&hash[bucket].dtdh_chain, start, dvar) == start) 1458 return (dvar); 1459 1460 /* 1461 * The cas has failed. Either another CPU is adding an element to 1462 * this hash chain, or another CPU is deleting an element from this 1463 * hash chain. The simplest way to deal with both of these cases 1464 * (though not necessarily the most efficient) is to free our 1465 * allocated block and tail-call ourselves. Note that the free is 1466 * to the dirty list and _not_ to the free list. This is to prevent 1467 * races with allocators, above. 1468 */ 1469 dvar->dtdv_hashval = DTRACE_DYNHASH_FREE; 1470 1471 dtrace_membar_producer(); 1472 1473 do { 1474 free = dcpu->dtdsc_dirty; 1475 dvar->dtdv_next = free; 1476 } while (dtrace_casptr(&dcpu->dtdsc_dirty, free, dvar) != free); 1477 1478 return (dtrace_dynvar(dstate, nkeys, key, dsize, op)); 1479 } 1480 1481 /*ARGSUSED*/ 1482 static void 1483 dtrace_aggregate_min(uint64_t *oval, uint64_t nval, uint64_t arg) 1484 { 1485 if (nval < *oval) 1486 *oval = nval; 1487 } 1488 1489 /*ARGSUSED*/ 1490 static void 1491 dtrace_aggregate_max(uint64_t *oval, uint64_t nval, uint64_t arg) 1492 { 1493 if (nval > *oval) 1494 *oval = nval; 1495 } 1496 1497 static void 1498 dtrace_aggregate_quantize(uint64_t *quanta, uint64_t nval, uint64_t incr) 1499 { 1500 int i, zero = DTRACE_QUANTIZE_ZEROBUCKET; 1501 int64_t val = (int64_t)nval; 1502 1503 if (val < 0) { 1504 for (i = 0; i < zero; i++) { 1505 if (val <= DTRACE_QUANTIZE_BUCKETVAL(i)) { 1506 quanta[i] += incr; 1507 return; 1508 } 1509 } 1510 } else { 1511 for (i = zero + 1; i < DTRACE_QUANTIZE_NBUCKETS; i++) { 1512 if (val < DTRACE_QUANTIZE_BUCKETVAL(i)) { 1513 quanta[i - 1] += incr; 1514 return; 1515 } 1516 } 1517 1518 quanta[DTRACE_QUANTIZE_NBUCKETS - 1] += incr; 1519 return; 1520 } 1521 1522 ASSERT(0); 1523 } 1524 1525 static void 1526 dtrace_aggregate_lquantize(uint64_t *lquanta, uint64_t nval, uint64_t incr) 1527 { 1528 uint64_t arg = *lquanta++; 1529 int32_t base = DTRACE_LQUANTIZE_BASE(arg); 1530 uint16_t step = DTRACE_LQUANTIZE_STEP(arg); 1531 uint16_t levels = DTRACE_LQUANTIZE_LEVELS(arg); 1532 int32_t val = (int32_t)nval, level; 1533 1534 ASSERT(step != 0); 1535 ASSERT(levels != 0); 1536 1537 if (val < base) { 1538 /* 1539 * This is an underflow. 1540 */ 1541 lquanta[0] += incr; 1542 return; 1543 } 1544 1545 level = (val - base) / step; 1546 1547 if (level < levels) { 1548 lquanta[level + 1] += incr; 1549 return; 1550 } 1551 1552 /* 1553 * This is an overflow. 1554 */ 1555 lquanta[levels + 1] += incr; 1556 } 1557 1558 /*ARGSUSED*/ 1559 static void 1560 dtrace_aggregate_avg(uint64_t *data, uint64_t nval, uint64_t arg) 1561 { 1562 data[0]++; 1563 data[1] += nval; 1564 } 1565 1566 /*ARGSUSED*/ 1567 static void 1568 dtrace_aggregate_count(uint64_t *oval, uint64_t nval, uint64_t arg) 1569 { 1570 *oval = *oval + 1; 1571 } 1572 1573 /*ARGSUSED*/ 1574 static void 1575 dtrace_aggregate_sum(uint64_t *oval, uint64_t nval, uint64_t arg) 1576 { 1577 *oval += nval; 1578 } 1579 1580 /* 1581 * Aggregate given the tuple in the principal data buffer, and the aggregating 1582 * action denoted by the specified dtrace_aggregation_t. The aggregation 1583 * buffer is specified as the buf parameter. This routine does not return 1584 * failure; if there is no space in the aggregation buffer, the data will be 1585 * dropped, and a corresponding counter incremented. 1586 */ 1587 static void 1588 dtrace_aggregate(dtrace_aggregation_t *agg, dtrace_buffer_t *dbuf, 1589 intptr_t offset, dtrace_buffer_t *buf, uint64_t expr, uint64_t arg) 1590 { 1591 dtrace_recdesc_t *rec = &agg->dtag_action.dta_rec; 1592 uint32_t i, ndx, size, fsize; 1593 uint32_t align = sizeof (uint64_t) - 1; 1594 dtrace_aggbuffer_t *agb; 1595 dtrace_aggkey_t *key; 1596 uint32_t hashval = 0, limit, isstr; 1597 caddr_t tomax, data, kdata; 1598 dtrace_actkind_t action; 1599 dtrace_action_t *act; 1600 uintptr_t offs; 1601 1602 if (buf == NULL) 1603 return; 1604 1605 if (!agg->dtag_hasarg) { 1606 /* 1607 * Currently, only quantize() and lquantize() take additional 1608 * arguments, and they have the same semantics: an increment 1609 * value that defaults to 1 when not present. If additional 1610 * aggregating actions take arguments, the setting of the 1611 * default argument value will presumably have to become more 1612 * sophisticated... 1613 */ 1614 arg = 1; 1615 } 1616 1617 action = agg->dtag_action.dta_kind - DTRACEACT_AGGREGATION; 1618 size = rec->dtrd_offset - agg->dtag_base; 1619 fsize = size + rec->dtrd_size; 1620 1621 ASSERT(dbuf->dtb_tomax != NULL); 1622 data = dbuf->dtb_tomax + offset + agg->dtag_base; 1623 1624 if ((tomax = buf->dtb_tomax) == NULL) { 1625 dtrace_buffer_drop(buf); 1626 return; 1627 } 1628 1629 /* 1630 * The metastructure is always at the bottom of the buffer. 1631 */ 1632 agb = (dtrace_aggbuffer_t *)(tomax + buf->dtb_size - 1633 sizeof (dtrace_aggbuffer_t)); 1634 1635 if (buf->dtb_offset == 0) { 1636 /* 1637 * We just kludge up approximately 1/8th of the size to be 1638 * buckets. If this guess ends up being routinely 1639 * off-the-mark, we may need to dynamically readjust this 1640 * based on past performance. 1641 */ 1642 uintptr_t hashsize = (buf->dtb_size >> 3) / sizeof (uintptr_t); 1643 1644 if ((uintptr_t)agb - hashsize * sizeof (dtrace_aggkey_t *) < 1645 (uintptr_t)tomax || hashsize == 0) { 1646 /* 1647 * We've been given a ludicrously small buffer; 1648 * increment our drop count and leave. 1649 */ 1650 dtrace_buffer_drop(buf); 1651 return; 1652 } 1653 1654 /* 1655 * And now, a pathetic attempt to try to get a an odd (or 1656 * perchance, a prime) hash size for better hash distribution. 1657 */ 1658 if (hashsize > (DTRACE_AGGHASHSIZE_SLEW << 3)) 1659 hashsize -= DTRACE_AGGHASHSIZE_SLEW; 1660 1661 agb->dtagb_hashsize = hashsize; 1662 agb->dtagb_hash = (dtrace_aggkey_t **)((uintptr_t)agb - 1663 agb->dtagb_hashsize * sizeof (dtrace_aggkey_t *)); 1664 agb->dtagb_free = (uintptr_t)agb->dtagb_hash; 1665 1666 for (i = 0; i < agb->dtagb_hashsize; i++) 1667 agb->dtagb_hash[i] = NULL; 1668 } 1669 1670 ASSERT(agg->dtag_first != NULL); 1671 ASSERT(agg->dtag_first->dta_intuple); 1672 1673 /* 1674 * Calculate the hash value based on the key. Note that we _don't_ 1675 * include the aggid in the hashing (but we will store it as part of 1676 * the key). The hashing algorithm is Bob Jenkins' "One-at-a-time" 1677 * algorithm: a simple, quick algorithm that has no known funnels, and 1678 * gets good distribution in practice. The efficacy of the hashing 1679 * algorithm (and a comparison with other algorithms) may be found by 1680 * running the ::dtrace_aggstat MDB dcmd. 1681 */ 1682 for (act = agg->dtag_first; act->dta_intuple; act = act->dta_next) { 1683 i = act->dta_rec.dtrd_offset - agg->dtag_base; 1684 limit = i + act->dta_rec.dtrd_size; 1685 ASSERT(limit <= size); 1686 isstr = DTRACEACT_ISSTRING(act); 1687 1688 for (; i < limit; i++) { 1689 hashval += data[i]; 1690 hashval += (hashval << 10); 1691 hashval ^= (hashval >> 6); 1692 1693 if (isstr && data[i] == '\0') 1694 break; 1695 } 1696 } 1697 1698 hashval += (hashval << 3); 1699 hashval ^= (hashval >> 11); 1700 hashval += (hashval << 15); 1701 1702 /* 1703 * Yes, the divide here is expensive -- but it's generally the least 1704 * of the performance issues given the amount of data that we iterate 1705 * over to compute hash values, compare data, etc. 1706 */ 1707 ndx = hashval % agb->dtagb_hashsize; 1708 1709 for (key = agb->dtagb_hash[ndx]; key != NULL; key = key->dtak_next) { 1710 ASSERT((caddr_t)key >= tomax); 1711 ASSERT((caddr_t)key < tomax + buf->dtb_size); 1712 1713 if (hashval != key->dtak_hashval || key->dtak_size != size) 1714 continue; 1715 1716 kdata = key->dtak_data; 1717 ASSERT(kdata >= tomax && kdata < tomax + buf->dtb_size); 1718 1719 for (act = agg->dtag_first; act->dta_intuple; 1720 act = act->dta_next) { 1721 i = act->dta_rec.dtrd_offset - agg->dtag_base; 1722 limit = i + act->dta_rec.dtrd_size; 1723 ASSERT(limit <= size); 1724 isstr = DTRACEACT_ISSTRING(act); 1725 1726 for (; i < limit; i++) { 1727 if (kdata[i] != data[i]) 1728 goto next; 1729 1730 if (isstr && data[i] == '\0') 1731 break; 1732 } 1733 } 1734 1735 if (action != key->dtak_action) { 1736 /* 1737 * We are aggregating on the same value in the same 1738 * aggregation with two different aggregating actions. 1739 * (This should have been picked up in the compiler, 1740 * so we may be dealing with errant or devious DIF.) 1741 * This is an error condition; we indicate as much, 1742 * and return. 1743 */ 1744 DTRACE_CPUFLAG_SET(CPU_DTRACE_ILLOP); 1745 return; 1746 } 1747 1748 /* 1749 * This is a hit: we need to apply the aggregator to 1750 * the value at this key. 1751 */ 1752 agg->dtag_aggregate((uint64_t *)(kdata + size), expr, arg); 1753 return; 1754 next: 1755 continue; 1756 } 1757 1758 /* 1759 * We didn't find it. We need to allocate some zero-filled space, 1760 * link it into the hash table appropriately, and apply the aggregator 1761 * to the (zero-filled) value. 1762 */ 1763 offs = buf->dtb_offset; 1764 while (offs & (align - 1)) 1765 offs += sizeof (uint32_t); 1766 1767 /* 1768 * If we don't have enough room to both allocate a new key _and_ 1769 * its associated data, increment the drop count and return. 1770 */ 1771 if ((uintptr_t)tomax + offs + fsize > 1772 agb->dtagb_free - sizeof (dtrace_aggkey_t)) { 1773 dtrace_buffer_drop(buf); 1774 return; 1775 } 1776 1777 /*CONSTCOND*/ 1778 ASSERT(!(sizeof (dtrace_aggkey_t) & (sizeof (uintptr_t) - 1))); 1779 key = (dtrace_aggkey_t *)(agb->dtagb_free - sizeof (dtrace_aggkey_t)); 1780 agb->dtagb_free -= sizeof (dtrace_aggkey_t); 1781 1782 key->dtak_data = kdata = tomax + offs; 1783 buf->dtb_offset = offs + fsize; 1784 1785 /* 1786 * Now copy the data across. 1787 */ 1788 *((dtrace_aggid_t *)kdata) = agg->dtag_id; 1789 1790 for (i = sizeof (dtrace_aggid_t); i < size; i++) 1791 kdata[i] = data[i]; 1792 1793 /* 1794 * Because strings are not zeroed out by default, we need to iterate 1795 * looking for actions that store strings, and we need to explicitly 1796 * pad these strings out with zeroes. 1797 */ 1798 for (act = agg->dtag_first; act->dta_intuple; act = act->dta_next) { 1799 int nul; 1800 1801 if (!DTRACEACT_ISSTRING(act)) 1802 continue; 1803 1804 i = act->dta_rec.dtrd_offset - agg->dtag_base; 1805 limit = i + act->dta_rec.dtrd_size; 1806 ASSERT(limit <= size); 1807 1808 for (nul = 0; i < limit; i++) { 1809 if (nul) { 1810 kdata[i] = '\0'; 1811 continue; 1812 } 1813 1814 if (data[i] != '\0') 1815 continue; 1816 1817 nul = 1; 1818 } 1819 } 1820 1821 for (i = size; i < fsize; i++) 1822 kdata[i] = 0; 1823 1824 key->dtak_hashval = hashval; 1825 key->dtak_size = size; 1826 key->dtak_action = action; 1827 key->dtak_next = agb->dtagb_hash[ndx]; 1828 agb->dtagb_hash[ndx] = key; 1829 1830 /* 1831 * Finally, apply the aggregator. 1832 */ 1833 *((uint64_t *)(key->dtak_data + size)) = agg->dtag_initial; 1834 agg->dtag_aggregate((uint64_t *)(key->dtak_data + size), expr, arg); 1835 } 1836 1837 /* 1838 * Given consumer state, this routine finds a speculation in the INACTIVE 1839 * state and transitions it into the ACTIVE state. If there is no speculation 1840 * in the INACTIVE state, 0 is returned. In this case, no error counter is 1841 * incremented -- it is up to the caller to take appropriate action. 1842 */ 1843 static int 1844 dtrace_speculation(dtrace_state_t *state) 1845 { 1846 int i = 0; 1847 dtrace_speculation_state_t current; 1848 uint32_t *stat = &state->dts_speculations_unavail, count; 1849 1850 while (i < state->dts_nspeculations) { 1851 dtrace_speculation_t *spec = &state->dts_speculations[i]; 1852 1853 current = spec->dtsp_state; 1854 1855 if (current != DTRACESPEC_INACTIVE) { 1856 if (current == DTRACESPEC_COMMITTINGMANY || 1857 current == DTRACESPEC_COMMITTING || 1858 current == DTRACESPEC_DISCARDING) 1859 stat = &state->dts_speculations_busy; 1860 i++; 1861 continue; 1862 } 1863 1864 if (dtrace_cas32((uint32_t *)&spec->dtsp_state, 1865 current, DTRACESPEC_ACTIVE) == current) 1866 return (i + 1); 1867 } 1868 1869 /* 1870 * We couldn't find a speculation. If we found as much as a single 1871 * busy speculation buffer, we'll attribute this failure as "busy" 1872 * instead of "unavail". 1873 */ 1874 do { 1875 count = *stat; 1876 } while (dtrace_cas32(stat, count, count + 1) != count); 1877 1878 return (0); 1879 } 1880 1881 /* 1882 * This routine commits an active speculation. If the specified speculation 1883 * is not in a valid state to perform a commit(), this routine will silently do 1884 * nothing. The state of the specified speculation is transitioned according 1885 * to the state transition diagram outlined in <sys/dtrace_impl.h> 1886 */ 1887 static void 1888 dtrace_speculation_commit(dtrace_state_t *state, processorid_t cpu, 1889 dtrace_specid_t which) 1890 { 1891 dtrace_speculation_t *spec; 1892 dtrace_buffer_t *src, *dest; 1893 uintptr_t daddr, saddr, dlimit; 1894 dtrace_speculation_state_t current, new; 1895 intptr_t offs; 1896 1897 if (which == 0) 1898 return; 1899 1900 if (which > state->dts_nspeculations) { 1901 cpu_core[cpu].cpuc_dtrace_flags |= CPU_DTRACE_ILLOP; 1902 return; 1903 } 1904 1905 spec = &state->dts_speculations[which - 1]; 1906 src = &spec->dtsp_buffer[cpu]; 1907 dest = &state->dts_buffer[cpu]; 1908 1909 do { 1910 current = spec->dtsp_state; 1911 1912 if (current == DTRACESPEC_COMMITTINGMANY) 1913 break; 1914 1915 switch (current) { 1916 case DTRACESPEC_INACTIVE: 1917 case DTRACESPEC_DISCARDING: 1918 return; 1919 1920 case DTRACESPEC_COMMITTING: 1921 /* 1922 * This is only possible if we are (a) commit()'ing 1923 * without having done a prior speculate() on this CPU 1924 * and (b) racing with another commit() on a different 1925 * CPU. There's nothing to do -- we just assert that 1926 * our offset is 0. 1927 */ 1928 ASSERT(src->dtb_offset == 0); 1929 return; 1930 1931 case DTRACESPEC_ACTIVE: 1932 new = DTRACESPEC_COMMITTING; 1933 break; 1934 1935 case DTRACESPEC_ACTIVEONE: 1936 /* 1937 * This speculation is active on one CPU. If our 1938 * buffer offset is non-zero, we know that the one CPU 1939 * must be us. Otherwise, we are committing on a 1940 * different CPU from the speculate(), and we must 1941 * rely on being asynchronously cleaned. 1942 */ 1943 if (src->dtb_offset != 0) { 1944 new = DTRACESPEC_COMMITTING; 1945 break; 1946 } 1947 /*FALLTHROUGH*/ 1948 1949 case DTRACESPEC_ACTIVEMANY: 1950 new = DTRACESPEC_COMMITTINGMANY; 1951 break; 1952 1953 default: 1954 ASSERT(0); 1955 } 1956 } while (dtrace_cas32((uint32_t *)&spec->dtsp_state, 1957 current, new) != current); 1958 1959 /* 1960 * We have set the state to indicate that we are committing this 1961 * speculation. Now reserve the necessary space in the destination 1962 * buffer. 1963 */ 1964 if ((offs = dtrace_buffer_reserve(dest, src->dtb_offset, 1965 sizeof (uint64_t), state, NULL)) < 0) { 1966 dtrace_buffer_drop(dest); 1967 goto out; 1968 } 1969 1970 /* 1971 * We have the space; copy the buffer across. (Note that this is a 1972 * highly subobtimal bcopy(); in the unlikely event that this becomes 1973 * a serious performance issue, a high-performance DTrace-specific 1974 * bcopy() should obviously be invented.) 1975 */ 1976 daddr = (uintptr_t)dest->dtb_tomax + offs; 1977 dlimit = daddr + src->dtb_offset; 1978 saddr = (uintptr_t)src->dtb_tomax; 1979 1980 /* 1981 * First, the aligned portion. 1982 */ 1983 while (dlimit - daddr >= sizeof (uint64_t)) { 1984 *((uint64_t *)daddr) = *((uint64_t *)saddr); 1985 1986 daddr += sizeof (uint64_t); 1987 saddr += sizeof (uint64_t); 1988 } 1989 1990 /* 1991 * Now any left-over bit... 1992 */ 1993 while (dlimit - daddr) 1994 *((uint8_t *)daddr++) = *((uint8_t *)saddr++); 1995 1996 /* 1997 * Finally, commit the reserved space in the destination buffer. 1998 */ 1999 dest->dtb_offset = offs + src->dtb_offset; 2000 2001 out: 2002 /* 2003 * If we're lucky enough to be the only active CPU on this speculation 2004 * buffer, we can just set the state back to DTRACESPEC_INACTIVE. 2005 */ 2006 if (current == DTRACESPEC_ACTIVE || 2007 (current == DTRACESPEC_ACTIVEONE && new == DTRACESPEC_COMMITTING)) { 2008 uint32_t rval = dtrace_cas32((uint32_t *)&spec->dtsp_state, 2009 DTRACESPEC_COMMITTING, DTRACESPEC_INACTIVE); 2010 2011 ASSERT(rval == DTRACESPEC_COMMITTING); 2012 } 2013 2014 src->dtb_offset = 0; 2015 src->dtb_xamot_drops += src->dtb_drops; 2016 src->dtb_drops = 0; 2017 } 2018 2019 /* 2020 * This routine discards an active speculation. If the specified speculation 2021 * is not in a valid state to perform a discard(), this routine will silently 2022 * do nothing. The state of the specified speculation is transitioned 2023 * according to the state transition diagram outlined in <sys/dtrace_impl.h> 2024 */ 2025 static void 2026 dtrace_speculation_discard(dtrace_state_t *state, processorid_t cpu, 2027 dtrace_specid_t which) 2028 { 2029 dtrace_speculation_t *spec; 2030 dtrace_speculation_state_t current, new; 2031 dtrace_buffer_t *buf; 2032 2033 if (which == 0) 2034 return; 2035 2036 if (which > state->dts_nspeculations) { 2037 cpu_core[cpu].cpuc_dtrace_flags |= CPU_DTRACE_ILLOP; 2038 return; 2039 } 2040 2041 spec = &state->dts_speculations[which - 1]; 2042 buf = &spec->dtsp_buffer[cpu]; 2043 2044 do { 2045 current = spec->dtsp_state; 2046 2047 switch (current) { 2048 case DTRACESPEC_INACTIVE: 2049 case DTRACESPEC_COMMITTINGMANY: 2050 case DTRACESPEC_COMMITTING: 2051 case DTRACESPEC_DISCARDING: 2052 return; 2053 2054 case DTRACESPEC_ACTIVE: 2055 case DTRACESPEC_ACTIVEMANY: 2056 new = DTRACESPEC_DISCARDING; 2057 break; 2058 2059 case DTRACESPEC_ACTIVEONE: 2060 if (buf->dtb_offset != 0) { 2061 new = DTRACESPEC_INACTIVE; 2062 } else { 2063 new = DTRACESPEC_DISCARDING; 2064 } 2065 break; 2066 2067 default: 2068 ASSERT(0); 2069 } 2070 } while (dtrace_cas32((uint32_t *)&spec->dtsp_state, 2071 current, new) != current); 2072 2073 buf->dtb_offset = 0; 2074 buf->dtb_drops = 0; 2075 } 2076 2077 /* 2078 * Note: not called from probe context. This function is called 2079 * asynchronously from cross call context to clean any speculations that are 2080 * in the COMMITTINGMANY or DISCARDING states. These speculations may not be 2081 * transitioned back to the INACTIVE state until all CPUs have cleaned the 2082 * speculation. 2083 */ 2084 static void 2085 dtrace_speculation_clean_here(dtrace_state_t *state) 2086 { 2087 dtrace_icookie_t cookie; 2088 processorid_t cpu = CPU->cpu_id; 2089 dtrace_buffer_t *dest = &state->dts_buffer[cpu]; 2090 dtrace_specid_t i; 2091 2092 cookie = dtrace_interrupt_disable(); 2093 2094 if (dest->dtb_tomax == NULL) { 2095 dtrace_interrupt_enable(cookie); 2096 return; 2097 } 2098 2099 for (i = 0; i < state->dts_nspeculations; i++) { 2100 dtrace_speculation_t *spec = &state->dts_speculations[i]; 2101 dtrace_buffer_t *src = &spec->dtsp_buffer[cpu]; 2102 2103 if (src->dtb_tomax == NULL) 2104 continue; 2105 2106 if (spec->dtsp_state == DTRACESPEC_DISCARDING) { 2107 src->dtb_offset = 0; 2108 continue; 2109 } 2110 2111 if (spec->dtsp_state != DTRACESPEC_COMMITTINGMANY) 2112 continue; 2113 2114 if (src->dtb_offset == 0) 2115 continue; 2116 2117 dtrace_speculation_commit(state, cpu, i + 1); 2118 } 2119 2120 dtrace_interrupt_enable(cookie); 2121 } 2122 2123 /* 2124 * Note: not called from probe context. This function is called 2125 * asynchronously (and at a regular interval) to clean any speculations that 2126 * are in the COMMITTINGMANY or DISCARDING states. If it discovers that there 2127 * is work to be done, it cross calls all CPUs to perform that work; 2128 * COMMITMANY and DISCARDING speculations may not be transitioned back to the 2129 * INACTIVE state until they have been cleaned by all CPUs. 2130 */ 2131 static void 2132 dtrace_speculation_clean(dtrace_state_t *state) 2133 { 2134 int work = 0, rv; 2135 dtrace_specid_t i; 2136 2137 for (i = 0; i < state->dts_nspeculations; i++) { 2138 dtrace_speculation_t *spec = &state->dts_speculations[i]; 2139 2140 ASSERT(!spec->dtsp_cleaning); 2141 2142 if (spec->dtsp_state != DTRACESPEC_DISCARDING && 2143 spec->dtsp_state != DTRACESPEC_COMMITTINGMANY) 2144 continue; 2145 2146 work++; 2147 spec->dtsp_cleaning = 1; 2148 } 2149 2150 if (!work) 2151 return; 2152 2153 dtrace_xcall(DTRACE_CPUALL, 2154 (dtrace_xcall_t)dtrace_speculation_clean_here, state); 2155 2156 /* 2157 * We now know that all CPUs have committed or discarded their 2158 * speculation buffers, as appropriate. We can now set the state 2159 * to inactive. 2160 */ 2161 for (i = 0; i < state->dts_nspeculations; i++) { 2162 dtrace_speculation_t *spec = &state->dts_speculations[i]; 2163 dtrace_speculation_state_t current, new; 2164 2165 if (!spec->dtsp_cleaning) 2166 continue; 2167 2168 current = spec->dtsp_state; 2169 ASSERT(current == DTRACESPEC_DISCARDING || 2170 current == DTRACESPEC_COMMITTINGMANY); 2171 2172 new = DTRACESPEC_INACTIVE; 2173 2174 rv = dtrace_cas32((uint32_t *)&spec->dtsp_state, current, new); 2175 ASSERT(rv == current); 2176 spec->dtsp_cleaning = 0; 2177 } 2178 } 2179 2180 /* 2181 * Called as part of a speculate() to get the speculative buffer associated 2182 * with a given speculation. Returns NULL if the specified speculation is not 2183 * in an ACTIVE state. If the speculation is in the ACTIVEONE state -- and 2184 * the active CPU is not the specified CPU -- the speculation will be 2185 * atomically transitioned into the ACTIVEMANY state. 2186 */ 2187 static dtrace_buffer_t * 2188 dtrace_speculation_buffer(dtrace_state_t *state, processorid_t cpuid, 2189 dtrace_specid_t which) 2190 { 2191 dtrace_speculation_t *spec; 2192 dtrace_speculation_state_t current, new; 2193 dtrace_buffer_t *buf; 2194 2195 if (which == 0) 2196 return (NULL); 2197 2198 if (which > state->dts_nspeculations) { 2199 cpu_core[cpuid].cpuc_dtrace_flags |= CPU_DTRACE_ILLOP; 2200 return (NULL); 2201 } 2202 2203 spec = &state->dts_speculations[which - 1]; 2204 buf = &spec->dtsp_buffer[cpuid]; 2205 2206 do { 2207 current = spec->dtsp_state; 2208 2209 switch (current) { 2210 case DTRACESPEC_INACTIVE: 2211 case DTRACESPEC_COMMITTINGMANY: 2212 case DTRACESPEC_DISCARDING: 2213 return (NULL); 2214 2215 case DTRACESPEC_COMMITTING: 2216 ASSERT(buf->dtb_offset == 0); 2217 return (NULL); 2218 2219 case DTRACESPEC_ACTIVEONE: 2220 /* 2221 * This speculation is currently active on one CPU. 2222 * Check the offset in the buffer; if it's non-zero, 2223 * that CPU must be us (and we leave the state alone). 2224 * If it's zero, assume that we're starting on a new 2225 * CPU -- and change the state to indicate that the 2226 * speculation is active on more than one CPU. 2227 */ 2228 if (buf->dtb_offset != 0) 2229 return (buf); 2230 2231 new = DTRACESPEC_ACTIVEMANY; 2232 break; 2233 2234 case DTRACESPEC_ACTIVEMANY: 2235 return (buf); 2236 2237 case DTRACESPEC_ACTIVE: 2238 new = DTRACESPEC_ACTIVEONE; 2239 break; 2240 2241 default: 2242 ASSERT(0); 2243 } 2244 } while (dtrace_cas32((uint32_t *)&spec->dtsp_state, 2245 current, new) != current); 2246 2247 ASSERT(new == DTRACESPEC_ACTIVEONE || new == DTRACESPEC_ACTIVEMANY); 2248 return (buf); 2249 } 2250 2251 /* 2252 * This function implements the DIF emulator's variable lookups. The emulator 2253 * passes a reserved variable identifier and optional built-in array index. 2254 */ 2255 static uint64_t 2256 dtrace_dif_variable(dtrace_mstate_t *mstate, dtrace_state_t *state, uint64_t v, 2257 uint64_t ndx) 2258 { 2259 /* 2260 * If we're accessing one of the uncached arguments, we'll turn this 2261 * into a reference in the args array. 2262 */ 2263 if (v >= DIF_VAR_ARG0 && v <= DIF_VAR_ARG9) { 2264 ndx = v - DIF_VAR_ARG0; 2265 v = DIF_VAR_ARGS; 2266 } 2267 2268 switch (v) { 2269 case DIF_VAR_ARGS: 2270 ASSERT(mstate->dtms_present & DTRACE_MSTATE_ARGS); 2271 if (ndx >= sizeof (mstate->dtms_arg) / 2272 sizeof (mstate->dtms_arg[0])) { 2273 int aframes = mstate->dtms_probe->dtpr_aframes + 2; 2274 dtrace_provider_t *pv; 2275 uint64_t val; 2276 2277 pv = mstate->dtms_probe->dtpr_provider; 2278 if (pv->dtpv_pops.dtps_getargval != NULL) 2279 val = pv->dtpv_pops.dtps_getargval(pv->dtpv_arg, 2280 mstate->dtms_probe->dtpr_id, 2281 mstate->dtms_probe->dtpr_arg, ndx, aframes); 2282 else 2283 val = dtrace_getarg(ndx, aframes); 2284 2285 /* 2286 * This is regrettably required to keep the compiler 2287 * from tail-optimizing the call to dtrace_getarg(). 2288 * The condition always evaluates to true, but the 2289 * compiler has no way of figuring that out a priori. 2290 * (None of this would be necessary if the compiler 2291 * could be relied upon to _always_ tail-optimize 2292 * the call to dtrace_getarg() -- but it can't.) 2293 */ 2294 if (mstate->dtms_probe != NULL) 2295 return (val); 2296 2297 ASSERT(0); 2298 } 2299 2300 return (mstate->dtms_arg[ndx]); 2301 2302 case DIF_VAR_UREGS: { 2303 klwp_t *lwp; 2304 2305 if (!dtrace_priv_proc(state)) 2306 return (0); 2307 2308 if ((lwp = curthread->t_lwp) == NULL) { 2309 DTRACE_CPUFLAG_SET(CPU_DTRACE_BADADDR); 2310 cpu_core[CPU->cpu_id].cpuc_dtrace_illval = NULL; 2311 return (0); 2312 } 2313 2314 return (dtrace_getreg(lwp->lwp_regs, ndx)); 2315 } 2316 2317 case DIF_VAR_CURTHREAD: 2318 if (!dtrace_priv_kernel(state)) 2319 return (0); 2320 return ((uint64_t)(uintptr_t)curthread); 2321 2322 case DIF_VAR_TIMESTAMP: 2323 if (!(mstate->dtms_present & DTRACE_MSTATE_TIMESTAMP)) { 2324 mstate->dtms_timestamp = dtrace_gethrtime(); 2325 mstate->dtms_present |= DTRACE_MSTATE_TIMESTAMP; 2326 } 2327 return (mstate->dtms_timestamp); 2328 2329 case DIF_VAR_VTIMESTAMP: 2330 ASSERT(dtrace_vtime_references != 0); 2331 return (curthread->t_dtrace_vtime); 2332 2333 case DIF_VAR_WALLTIMESTAMP: 2334 if (!(mstate->dtms_present & DTRACE_MSTATE_WALLTIMESTAMP)) { 2335 mstate->dtms_walltimestamp = dtrace_gethrestime(); 2336 mstate->dtms_present |= DTRACE_MSTATE_WALLTIMESTAMP; 2337 } 2338 return (mstate->dtms_walltimestamp); 2339 2340 case DIF_VAR_IPL: 2341 if (!dtrace_priv_kernel(state)) 2342 return (0); 2343 if (!(mstate->dtms_present & DTRACE_MSTATE_IPL)) { 2344 mstate->dtms_ipl = dtrace_getipl(); 2345 mstate->dtms_present |= DTRACE_MSTATE_IPL; 2346 } 2347 return (mstate->dtms_ipl); 2348 2349 case DIF_VAR_EPID: 2350 ASSERT(mstate->dtms_present & DTRACE_MSTATE_EPID); 2351 return (mstate->dtms_epid); 2352 2353 case DIF_VAR_ID: 2354 ASSERT(mstate->dtms_present & DTRACE_MSTATE_PROBE); 2355 return (mstate->dtms_probe->dtpr_id); 2356 2357 case DIF_VAR_STACKDEPTH: 2358 if (!dtrace_priv_kernel(state)) 2359 return (0); 2360 if (!(mstate->dtms_present & DTRACE_MSTATE_STACKDEPTH)) { 2361 int aframes = mstate->dtms_probe->dtpr_aframes + 2; 2362 2363 mstate->dtms_stackdepth = dtrace_getstackdepth(aframes); 2364 mstate->dtms_present |= DTRACE_MSTATE_STACKDEPTH; 2365 } 2366 return (mstate->dtms_stackdepth); 2367 2368 case DIF_VAR_USTACKDEPTH: 2369 if (!dtrace_priv_proc(state)) 2370 return (0); 2371 if (!(mstate->dtms_present & DTRACE_MSTATE_USTACKDEPTH)) { 2372 /* 2373 * See comment in DIF_VAR_PID. 2374 */ 2375 if (DTRACE_ANCHORED(mstate->dtms_probe) && 2376 CPU_ON_INTR(CPU)) { 2377 mstate->dtms_ustackdepth = 0; 2378 } else { 2379 DTRACE_CPUFLAG_SET(CPU_DTRACE_NOFAULT); 2380 mstate->dtms_ustackdepth = 2381 dtrace_getustackdepth(); 2382 DTRACE_CPUFLAG_CLEAR(CPU_DTRACE_NOFAULT); 2383 } 2384 mstate->dtms_present |= DTRACE_MSTATE_USTACKDEPTH; 2385 } 2386 return (mstate->dtms_ustackdepth); 2387 2388 case DIF_VAR_CALLER: 2389 if (!dtrace_priv_kernel(state)) 2390 return (0); 2391 if (!(mstate->dtms_present & DTRACE_MSTATE_CALLER)) { 2392 int aframes = mstate->dtms_probe->dtpr_aframes + 2; 2393 2394 if (!DTRACE_ANCHORED(mstate->dtms_probe)) { 2395 /* 2396 * If this is an unanchored probe, we are 2397 * required to go through the slow path: 2398 * dtrace_caller() only guarantees correct 2399 * results for anchored probes. 2400 */ 2401 pc_t caller[2]; 2402 2403 dtrace_getpcstack(caller, 2, aframes, 2404 (uint32_t *)(uintptr_t)mstate->dtms_arg[0]); 2405 mstate->dtms_caller = caller[1]; 2406 } else if ((mstate->dtms_caller = 2407 dtrace_caller(aframes)) == -1) { 2408 /* 2409 * We have failed to do this the quick way; 2410 * we must resort to the slower approach of 2411 * calling dtrace_getpcstack(). 2412 */ 2413 pc_t caller; 2414 2415 dtrace_getpcstack(&caller, 1, aframes, NULL); 2416 mstate->dtms_caller = caller; 2417 } 2418 2419 mstate->dtms_present |= DTRACE_MSTATE_CALLER; 2420 } 2421 return (mstate->dtms_caller); 2422 2423 case DIF_VAR_UCALLER: 2424 if (!dtrace_priv_proc(state)) 2425 return (0); 2426 2427 if (!(mstate->dtms_present & DTRACE_MSTATE_UCALLER)) { 2428 uint64_t ustack[3]; 2429 2430 /* 2431 * dtrace_getupcstack() fills in the first uint64_t 2432 * with the current PID. The second uint64_t will 2433 * be the program counter at user-level. The third 2434 * uint64_t will contain the caller, which is what 2435 * we're after. 2436 */ 2437 ustack[2] = NULL; 2438 dtrace_getupcstack(ustack, 3); 2439 mstate->dtms_ucaller = ustack[2]; 2440 mstate->dtms_present |= DTRACE_MSTATE_UCALLER; 2441 } 2442 2443 return (mstate->dtms_ucaller); 2444 2445 case DIF_VAR_PROBEPROV: 2446 ASSERT(mstate->dtms_present & DTRACE_MSTATE_PROBE); 2447 return ((uint64_t)(uintptr_t) 2448 mstate->dtms_probe->dtpr_provider->dtpv_name); 2449 2450 case DIF_VAR_PROBEMOD: 2451 ASSERT(mstate->dtms_present & DTRACE_MSTATE_PROBE); 2452 return ((uint64_t)(uintptr_t) 2453 mstate->dtms_probe->dtpr_mod); 2454 2455 case DIF_VAR_PROBEFUNC: 2456 ASSERT(mstate->dtms_present & DTRACE_MSTATE_PROBE); 2457 return ((uint64_t)(uintptr_t) 2458 mstate->dtms_probe->dtpr_func); 2459 2460 case DIF_VAR_PROBENAME: 2461 ASSERT(mstate->dtms_present & DTRACE_MSTATE_PROBE); 2462 return ((uint64_t)(uintptr_t) 2463 mstate->dtms_probe->dtpr_name); 2464 2465 case DIF_VAR_PID: 2466 if (!dtrace_priv_proc(state)) 2467 return (0); 2468 2469 /* 2470 * Note that we are assuming that an unanchored probe is 2471 * always due to a high-level interrupt. (And we're assuming 2472 * that there is only a single high level interrupt.) 2473 */ 2474 if (DTRACE_ANCHORED(mstate->dtms_probe) && CPU_ON_INTR(CPU)) 2475 return (pid0.pid_id); 2476 2477 /* 2478 * It is always safe to dereference one's own t_procp pointer: 2479 * it always points to a valid, allocated proc structure. 2480 * Further, it is always safe to dereference the p_pidp member 2481 * of one's own proc structure. (These are truisms becuase 2482 * threads and processes don't clean up their own state -- 2483 * they leave that task to whomever reaps them.) 2484 */ 2485 return ((uint64_t)curthread->t_procp->p_pidp->pid_id); 2486 2487 case DIF_VAR_PPID: 2488 if (!dtrace_priv_proc(state)) 2489 return (0); 2490 2491 /* 2492 * See comment in DIF_VAR_PID. 2493 */ 2494 if (DTRACE_ANCHORED(mstate->dtms_probe) && CPU_ON_INTR(CPU)) 2495 return (pid0.pid_id); 2496 2497 return ((uint64_t)curthread->t_procp->p_ppid); 2498 2499 case DIF_VAR_TID: 2500 /* 2501 * See comment in DIF_VAR_PID. 2502 */ 2503 if (DTRACE_ANCHORED(mstate->dtms_probe) && CPU_ON_INTR(CPU)) 2504 return (0); 2505 2506 return ((uint64_t)curthread->t_tid); 2507 2508 case DIF_VAR_EXECNAME: 2509 if (!dtrace_priv_proc(state)) 2510 return (0); 2511 2512 /* 2513 * See comment in DIF_VAR_PID. 2514 */ 2515 if (DTRACE_ANCHORED(mstate->dtms_probe) && CPU_ON_INTR(CPU)) 2516 return ((uint64_t)(uintptr_t)p0.p_user.u_comm); 2517 2518 /* 2519 * It is always safe to dereference one's own t_procp pointer: 2520 * it always points to a valid, allocated proc structure. 2521 * (This is true because threads don't clean up their own 2522 * state -- they leave that task to whomever reaps them.) 2523 */ 2524 return ((uint64_t)(uintptr_t) 2525 curthread->t_procp->p_user.u_comm); 2526 2527 case DIF_VAR_ZONENAME: 2528 if (!dtrace_priv_proc(state)) 2529 return (0); 2530 2531 /* 2532 * See comment in DIF_VAR_PID. 2533 */ 2534 if (DTRACE_ANCHORED(mstate->dtms_probe) && CPU_ON_INTR(CPU)) 2535 return ((uint64_t)(uintptr_t)p0.p_zone->zone_name); 2536 2537 /* 2538 * It is always safe to dereference one's own t_procp pointer: 2539 * it always points to a valid, allocated proc structure. 2540 * (This is true because threads don't clean up their own 2541 * state -- they leave that task to whomever reaps them.) 2542 */ 2543 return ((uint64_t)(uintptr_t) 2544 curthread->t_procp->p_zone->zone_name); 2545 2546 case DIF_VAR_UID: 2547 if (!dtrace_priv_proc(state)) 2548 return (0); 2549 2550 /* 2551 * See comment in DIF_VAR_PID. 2552 */ 2553 if (DTRACE_ANCHORED(mstate->dtms_probe) && CPU_ON_INTR(CPU)) 2554 return ((uint64_t)p0.p_cred->cr_uid); 2555 2556 return ((uint64_t)curthread->t_cred->cr_uid); 2557 2558 case DIF_VAR_GID: 2559 if (!dtrace_priv_proc(state)) 2560 return (0); 2561 2562 /* 2563 * See comment in DIF_VAR_PID. 2564 */ 2565 if (DTRACE_ANCHORED(mstate->dtms_probe) && CPU_ON_INTR(CPU)) 2566 return ((uint64_t)p0.p_cred->cr_gid); 2567 2568 return ((uint64_t)curthread->t_cred->cr_gid); 2569 2570 case DIF_VAR_ERRNO: { 2571 klwp_t *lwp; 2572 if (!dtrace_priv_proc(state)) 2573 return (0); 2574 2575 /* 2576 * See comment in DIF_VAR_PID. 2577 */ 2578 if (DTRACE_ANCHORED(mstate->dtms_probe) && CPU_ON_INTR(CPU)) 2579 return (0); 2580 2581 if ((lwp = curthread->t_lwp) == NULL) 2582 return (0); 2583 2584 return ((uint64_t)lwp->lwp_errno); 2585 } 2586 default: 2587 DTRACE_CPUFLAG_SET(CPU_DTRACE_ILLOP); 2588 return (0); 2589 } 2590 } 2591 2592 /* 2593 * Emulate the execution of DTrace ID subroutines invoked by the call opcode. 2594 * Notice that we don't bother validating the proper number of arguments or 2595 * their types in the tuple stack. This isn't needed because all argument 2596 * interpretation is safe because of our load safety -- the worst that can 2597 * happen is that a bogus program can obtain bogus results. 2598 */ 2599 static void 2600 dtrace_dif_subr(uint_t subr, uint_t rd, uint64_t *regs, 2601 dtrace_key_t *tupregs, int nargs, 2602 dtrace_mstate_t *mstate, dtrace_state_t *state) 2603 { 2604 volatile uint16_t *flags = &cpu_core[CPU->cpu_id].cpuc_dtrace_flags; 2605 volatile uintptr_t *illval = &cpu_core[CPU->cpu_id].cpuc_dtrace_illval; 2606 2607 union { 2608 mutex_impl_t mi; 2609 uint64_t mx; 2610 } m; 2611 2612 union { 2613 krwlock_t ri; 2614 uintptr_t rw; 2615 } r; 2616 2617 switch (subr) { 2618 case DIF_SUBR_RAND: 2619 regs[rd] = (dtrace_gethrtime() * 2416 + 374441) % 1771875; 2620 break; 2621 2622 case DIF_SUBR_MUTEX_OWNED: 2623 m.mx = dtrace_load64(tupregs[0].dttk_value); 2624 if (MUTEX_TYPE_ADAPTIVE(&m.mi)) 2625 regs[rd] = MUTEX_OWNER(&m.mi) != MUTEX_NO_OWNER; 2626 else 2627 regs[rd] = LOCK_HELD(&m.mi.m_spin.m_spinlock); 2628 break; 2629 2630 case DIF_SUBR_MUTEX_OWNER: 2631 m.mx = dtrace_load64(tupregs[0].dttk_value); 2632 if (MUTEX_TYPE_ADAPTIVE(&m.mi) && 2633 MUTEX_OWNER(&m.mi) != MUTEX_NO_OWNER) 2634 regs[rd] = (uintptr_t)MUTEX_OWNER(&m.mi); 2635 else 2636 regs[rd] = 0; 2637 break; 2638 2639 case DIF_SUBR_MUTEX_TYPE_ADAPTIVE: 2640 m.mx = dtrace_load64(tupregs[0].dttk_value); 2641 regs[rd] = MUTEX_TYPE_ADAPTIVE(&m.mi); 2642 break; 2643 2644 case DIF_SUBR_MUTEX_TYPE_SPIN: 2645 m.mx = dtrace_load64(tupregs[0].dttk_value); 2646 regs[rd] = MUTEX_TYPE_SPIN(&m.mi); 2647 break; 2648 2649 case DIF_SUBR_RW_READ_HELD: { 2650 uintptr_t tmp; 2651 2652 r.rw = dtrace_loadptr(tupregs[0].dttk_value); 2653 regs[rd] = _RW_READ_HELD(&r.ri, tmp); 2654 break; 2655 } 2656 2657 case DIF_SUBR_RW_WRITE_HELD: 2658 r.rw = dtrace_loadptr(tupregs[0].dttk_value); 2659 regs[rd] = _RW_WRITE_HELD(&r.ri); 2660 break; 2661 2662 case DIF_SUBR_RW_ISWRITER: 2663 r.rw = dtrace_loadptr(tupregs[0].dttk_value); 2664 regs[rd] = _RW_ISWRITER(&r.ri); 2665 break; 2666 2667 case DIF_SUBR_BCOPY: { 2668 /* 2669 * We need to be sure that the destination is in the scratch 2670 * region -- no other region is allowed. 2671 */ 2672 uintptr_t src = tupregs[0].dttk_value; 2673 uintptr_t dest = tupregs[1].dttk_value; 2674 size_t size = tupregs[2].dttk_value; 2675 2676 if (!dtrace_inscratch(dest, size, mstate)) { 2677 *flags |= CPU_DTRACE_BADADDR; 2678 *illval = regs[rd]; 2679 break; 2680 } 2681 2682 dtrace_bcopy((void *)src, (void *)dest, size); 2683 break; 2684 } 2685 2686 case DIF_SUBR_ALLOCA: 2687 case DIF_SUBR_COPYIN: { 2688 uintptr_t dest = P2ROUNDUP(mstate->dtms_scratch_ptr, 8); 2689 uint64_t size = 2690 tupregs[subr == DIF_SUBR_ALLOCA ? 0 : 1].dttk_value; 2691 size_t scratch_size = (dest - mstate->dtms_scratch_ptr) + size; 2692 2693 /* 2694 * This action doesn't require any credential checks since 2695 * probes will not activate in user contexts to which the 2696 * enabling user does not have permissions. 2697 */ 2698 if (mstate->dtms_scratch_ptr + scratch_size > 2699 mstate->dtms_scratch_base + mstate->dtms_scratch_size) { 2700 DTRACE_CPUFLAG_SET(CPU_DTRACE_NOSCRATCH); 2701 regs[rd] = NULL; 2702 break; 2703 } 2704 2705 if (subr == DIF_SUBR_COPYIN) { 2706 DTRACE_CPUFLAG_SET(CPU_DTRACE_NOFAULT); 2707 dtrace_copyin(tupregs[0].dttk_value, dest, size); 2708 DTRACE_CPUFLAG_CLEAR(CPU_DTRACE_NOFAULT); 2709 } 2710 2711 mstate->dtms_scratch_ptr += scratch_size; 2712 regs[rd] = dest; 2713 break; 2714 } 2715 2716 case DIF_SUBR_COPYINTO: { 2717 uint64_t size = tupregs[1].dttk_value; 2718 uintptr_t dest = tupregs[2].dttk_value; 2719 2720 /* 2721 * This action doesn't require any credential checks since 2722 * probes will not activate in user contexts to which the 2723 * enabling user does not have permissions. 2724 */ 2725 if (!dtrace_inscratch(dest, size, mstate)) { 2726 *flags |= CPU_DTRACE_BADADDR; 2727 *illval = regs[rd]; 2728 break; 2729 } 2730 2731 DTRACE_CPUFLAG_SET(CPU_DTRACE_NOFAULT); 2732 dtrace_copyin(tupregs[0].dttk_value, dest, size); 2733 DTRACE_CPUFLAG_CLEAR(CPU_DTRACE_NOFAULT); 2734 break; 2735 } 2736 2737 case DIF_SUBR_COPYINSTR: { 2738 uintptr_t dest = mstate->dtms_scratch_ptr; 2739 uint64_t size = state->dts_options[DTRACEOPT_STRSIZE]; 2740 2741 if (nargs > 1 && tupregs[1].dttk_value < size) 2742 size = tupregs[1].dttk_value + 1; 2743 2744 /* 2745 * This action doesn't require any credential checks since 2746 * probes will not activate in user contexts to which the 2747 * enabling user does not have permissions. 2748 */ 2749 if (mstate->dtms_scratch_ptr + size > 2750 mstate->dtms_scratch_base + mstate->dtms_scratch_size) { 2751 DTRACE_CPUFLAG_SET(CPU_DTRACE_NOSCRATCH); 2752 regs[rd] = NULL; 2753 break; 2754 } 2755 2756 DTRACE_CPUFLAG_SET(CPU_DTRACE_NOFAULT); 2757 dtrace_copyinstr(tupregs[0].dttk_value, dest, size); 2758 DTRACE_CPUFLAG_CLEAR(CPU_DTRACE_NOFAULT); 2759 2760 ((char *)dest)[size - 1] = '\0'; 2761 mstate->dtms_scratch_ptr += size; 2762 regs[rd] = dest; 2763 break; 2764 } 2765 2766 case DIF_SUBR_MSGSIZE: 2767 case DIF_SUBR_MSGDSIZE: { 2768 uintptr_t baddr = tupregs[0].dttk_value, daddr; 2769 uintptr_t wptr, rptr; 2770 size_t count = 0; 2771 int cont = 0; 2772 2773 while (baddr != NULL && !(*flags & CPU_DTRACE_FAULT)) { 2774 wptr = dtrace_loadptr(baddr + 2775 offsetof(mblk_t, b_wptr)); 2776 2777 rptr = dtrace_loadptr(baddr + 2778 offsetof(mblk_t, b_rptr)); 2779 2780 if (wptr < rptr) { 2781 *flags |= CPU_DTRACE_BADADDR; 2782 *illval = tupregs[0].dttk_value; 2783 break; 2784 } 2785 2786 daddr = dtrace_loadptr(baddr + 2787 offsetof(mblk_t, b_datap)); 2788 2789 baddr = dtrace_loadptr(baddr + 2790 offsetof(mblk_t, b_cont)); 2791 2792 /* 2793 * We want to prevent against denial-of-service here, 2794 * so we're only going to search the list for 2795 * dtrace_msgdsize_max mblks. 2796 */ 2797 if (cont++ > dtrace_msgdsize_max) { 2798 *flags |= CPU_DTRACE_ILLOP; 2799 break; 2800 } 2801 2802 if (subr == DIF_SUBR_MSGDSIZE) { 2803 if (dtrace_load8(daddr + 2804 offsetof(dblk_t, db_type)) != M_DATA) 2805 continue; 2806 } 2807 2808 count += wptr - rptr; 2809 } 2810 2811 if (!(*flags & CPU_DTRACE_FAULT)) 2812 regs[rd] = count; 2813 2814 break; 2815 } 2816 2817 case DIF_SUBR_PROGENYOF: { 2818 pid_t pid = tupregs[0].dttk_value; 2819 proc_t *p; 2820 int rval = 0; 2821 2822 DTRACE_CPUFLAG_SET(CPU_DTRACE_NOFAULT); 2823 2824 for (p = curthread->t_procp; p != NULL; p = p->p_parent) { 2825 if (p->p_pidp->pid_id == pid) { 2826 rval = 1; 2827 break; 2828 } 2829 } 2830 2831 DTRACE_CPUFLAG_CLEAR(CPU_DTRACE_NOFAULT); 2832 2833 regs[rd] = rval; 2834 break; 2835 } 2836 2837 case DIF_SUBR_SPECULATION: 2838 regs[rd] = dtrace_speculation(state); 2839 break; 2840 2841 case DIF_SUBR_COPYOUT: { 2842 uintptr_t kaddr = tupregs[0].dttk_value; 2843 uintptr_t uaddr = tupregs[1].dttk_value; 2844 uint64_t size = tupregs[2].dttk_value; 2845 2846 if (!dtrace_destructive_disallow && 2847 dtrace_priv_proc_control(state) && 2848 !dtrace_istoxic(kaddr, size)) { 2849 DTRACE_CPUFLAG_SET(CPU_DTRACE_NOFAULT); 2850 dtrace_copyout(kaddr, uaddr, size); 2851 DTRACE_CPUFLAG_CLEAR(CPU_DTRACE_NOFAULT); 2852 } 2853 break; 2854 } 2855 2856 case DIF_SUBR_COPYOUTSTR: { 2857 uintptr_t kaddr = tupregs[0].dttk_value; 2858 uintptr_t uaddr = tupregs[1].dttk_value; 2859 uint64_t size = tupregs[2].dttk_value; 2860 2861 if (!dtrace_destructive_disallow && 2862 dtrace_priv_proc_control(state) && 2863 !dtrace_istoxic(kaddr, size)) { 2864 DTRACE_CPUFLAG_SET(CPU_DTRACE_NOFAULT); 2865 dtrace_copyoutstr(kaddr, uaddr, size); 2866 DTRACE_CPUFLAG_CLEAR(CPU_DTRACE_NOFAULT); 2867 } 2868 break; 2869 } 2870 2871 case DIF_SUBR_STRLEN: 2872 regs[rd] = dtrace_strlen((char *)(uintptr_t) 2873 tupregs[0].dttk_value, 2874 state->dts_options[DTRACEOPT_STRSIZE]); 2875 break; 2876 2877 case DIF_SUBR_STRCHR: 2878 case DIF_SUBR_STRRCHR: { 2879 /* 2880 * We're going to iterate over the string looking for the 2881 * specified character. We will iterate until we have reached 2882 * the string length or we have found the character. If this 2883 * is DIF_SUBR_STRRCHR, we will look for the last occurrence 2884 * of the specified character instead of the first. 2885 */ 2886 uintptr_t addr = tupregs[0].dttk_value; 2887 uintptr_t limit = addr + state->dts_options[DTRACEOPT_STRSIZE]; 2888 char c, target = (char)tupregs[1].dttk_value; 2889 2890 for (regs[rd] = NULL; addr < limit; addr++) { 2891 if ((c = dtrace_load8(addr)) == target) { 2892 regs[rd] = addr; 2893 2894 if (subr == DIF_SUBR_STRCHR) 2895 break; 2896 } 2897 2898 if (c == '\0') 2899 break; 2900 } 2901 2902 break; 2903 } 2904 2905 case DIF_SUBR_STRSTR: 2906 case DIF_SUBR_INDEX: 2907 case DIF_SUBR_RINDEX: { 2908 /* 2909 * We're going to iterate over the string looking for the 2910 * specified string. We will iterate until we have reached 2911 * the string length or we have found the string. (Yes, this 2912 * is done in the most naive way possible -- but considering 2913 * that the string we're searching for is likely to be 2914 * relatively short, the complexity of Rabin-Karp or similar 2915 * hardly seems merited.) 2916 */ 2917 char *addr = (char *)(uintptr_t)tupregs[0].dttk_value; 2918 char *substr = (char *)(uintptr_t)tupregs[1].dttk_value; 2919 uint64_t size = state->dts_options[DTRACEOPT_STRSIZE]; 2920 size_t len = dtrace_strlen(addr, size); 2921 size_t sublen = dtrace_strlen(substr, size); 2922 char *limit = addr + len, *orig = addr; 2923 int notfound = subr == DIF_SUBR_STRSTR ? 0 : -1; 2924 int inc = 1; 2925 2926 regs[rd] = notfound; 2927 2928 /* 2929 * strstr() and index()/rindex() have similar semantics if 2930 * both strings are the empty string: strstr() returns a 2931 * pointer to the (empty) string, and index() and rindex() 2932 * both return index 0 (regardless of any position argument). 2933 */ 2934 if (sublen == 0 && len == 0) { 2935 if (subr == DIF_SUBR_STRSTR) 2936 regs[rd] = (uintptr_t)addr; 2937 else 2938 regs[rd] = 0; 2939 break; 2940 } 2941 2942 if (subr != DIF_SUBR_STRSTR) { 2943 if (subr == DIF_SUBR_RINDEX) { 2944 limit = orig - 1; 2945 addr += len; 2946 inc = -1; 2947 } 2948 2949 /* 2950 * Both index() and rindex() take an optional position 2951 * argument that denotes the starting position. 2952 */ 2953 if (nargs == 3) { 2954 int64_t pos = (int64_t)tupregs[2].dttk_value; 2955 2956 /* 2957 * If the position argument to index() is 2958 * negative, Perl implicitly clamps it at 2959 * zero. This semantic is a little surprising 2960 * given the special meaning of negative 2961 * positions to similar Perl functions like 2962 * substr(), but it appears to reflect a 2963 * notion that index() can start from a 2964 * negative index and increment its way up to 2965 * the string. Given this notion, Perl's 2966 * rindex() is at least self-consistent in 2967 * that it implicitly clamps positions greater 2968 * than the string length to be the string 2969 * length. Where Perl completely loses 2970 * coherence, however, is when the specified 2971 * substring is the empty string (""). In 2972 * this case, even if the position is 2973 * negative, rindex() returns 0 -- and even if 2974 * the position is greater than the length, 2975 * index() returns the string length. These 2976 * semantics violate the notion that index() 2977 * should never return a value less than the 2978 * specified position and that rindex() should 2979 * never return a value greater than the 2980 * specified position. (One assumes that 2981 * these semantics are artifacts of Perl's 2982 * implementation and not the results of 2983 * deliberate design -- it beggars belief that 2984 * even Larry Wall could desire such oddness.) 2985 * While in the abstract one would wish for 2986 * consistent position semantics across 2987 * substr(), index() and rindex() -- or at the 2988 * very least self-consistent position 2989 * semantics for index() and rindex() -- we 2990 * instead opt to keep with the extant Perl 2991 * semantics, in all their broken glory. (Do 2992 * we have more desire to maintain Perl's 2993 * semantics than Perl does? Probably.) 2994 */ 2995 if (subr == DIF_SUBR_RINDEX) { 2996 if (pos < 0) { 2997 if (sublen == 0) 2998 regs[rd] = 0; 2999 break; 3000 } 3001 3002 if (pos > len) 3003 pos = len; 3004 } else { 3005 if (pos < 0) 3006 pos = 0; 3007 3008 if (pos >= len) { 3009 if (sublen == 0) 3010 regs[rd] = len; 3011 break; 3012 } 3013 } 3014 3015 addr = orig + pos; 3016 } 3017 } 3018 3019 for (regs[rd] = notfound; addr != limit; addr += inc) { 3020 if (dtrace_strncmp(addr, substr, sublen) == 0) { 3021 if (subr != DIF_SUBR_STRSTR) { 3022 /* 3023 * As D index() and rindex() are 3024 * modeled on Perl (and not on awk), 3025 * we return a zero-based (and not a 3026 * one-based) index. (For you Perl 3027 * weenies: no, we're not going to add 3028 * $[ -- and shouldn't you be at a con 3029 * or something?) 3030 */ 3031 regs[rd] = (uintptr_t)(addr - orig); 3032 break; 3033 } 3034 3035 ASSERT(subr == DIF_SUBR_STRSTR); 3036 regs[rd] = (uintptr_t)addr; 3037 break; 3038 } 3039 } 3040 3041 break; 3042 } 3043 3044 case DIF_SUBR_STRTOK: { 3045 uintptr_t addr = tupregs[0].dttk_value; 3046 uintptr_t tokaddr = tupregs[1].dttk_value; 3047 uint64_t size = state->dts_options[DTRACEOPT_STRSIZE]; 3048 uintptr_t limit, toklimit = tokaddr + size; 3049 uint8_t c, tokmap[32]; /* 256 / 8 */ 3050 char *dest = (char *)mstate->dtms_scratch_ptr; 3051 int i; 3052 3053 if (mstate->dtms_scratch_ptr + size > 3054 mstate->dtms_scratch_base + mstate->dtms_scratch_size) { 3055 DTRACE_CPUFLAG_SET(CPU_DTRACE_NOSCRATCH); 3056 regs[rd] = NULL; 3057 break; 3058 } 3059 3060 if (addr == NULL) { 3061 /* 3062 * If the address specified is NULL, we use our saved 3063 * strtok pointer from the mstate. Note that this 3064 * means that the saved strtok pointer is _only_ 3065 * valid within multiple enablings of the same probe -- 3066 * it behaves like an implicit clause-local variable. 3067 */ 3068 addr = mstate->dtms_strtok; 3069 } 3070 3071 /* 3072 * First, zero the token map, and then process the token 3073 * string -- setting a bit in the map for every character 3074 * found in the token string. 3075 */ 3076 for (i = 0; i < sizeof (tokmap); i++) 3077 tokmap[i] = 0; 3078 3079 for (; tokaddr < toklimit; tokaddr++) { 3080 if ((c = dtrace_load8(tokaddr)) == '\0') 3081 break; 3082 3083 ASSERT((c >> 3) < sizeof (tokmap)); 3084 tokmap[c >> 3] |= (1 << (c & 0x7)); 3085 } 3086 3087 for (limit = addr + size; addr < limit; addr++) { 3088 /* 3089 * We're looking for a character that is _not_ contained 3090 * in the token string. 3091 */ 3092 if ((c = dtrace_load8(addr)) == '\0') 3093 break; 3094 3095 if (!(tokmap[c >> 3] & (1 << (c & 0x7)))) 3096 break; 3097 } 3098 3099 if (c == '\0') { 3100 /* 3101 * We reached the end of the string without finding 3102 * any character that was not in the token string. 3103 * We return NULL in this case, and we set the saved 3104 * address to NULL as well. 3105 */ 3106 regs[rd] = NULL; 3107 mstate->dtms_strtok = NULL; 3108 break; 3109 } 3110 3111 /* 3112 * From here on, we're copying into the destination string. 3113 */ 3114 for (i = 0; addr < limit && i < size - 1; addr++) { 3115 if ((c = dtrace_load8(addr)) == '\0') 3116 break; 3117 3118 if (tokmap[c >> 3] & (1 << (c & 0x7))) 3119 break; 3120 3121 ASSERT(i < size); 3122 dest[i++] = c; 3123 } 3124 3125 ASSERT(i < size); 3126 dest[i] = '\0'; 3127 regs[rd] = (uintptr_t)dest; 3128 mstate->dtms_scratch_ptr += size; 3129 mstate->dtms_strtok = addr; 3130 break; 3131 } 3132 3133 case DIF_SUBR_SUBSTR: { 3134 uintptr_t s = tupregs[0].dttk_value; 3135 uint64_t size = state->dts_options[DTRACEOPT_STRSIZE]; 3136 char *d = (char *)mstate->dtms_scratch_ptr; 3137 int64_t index = (int64_t)tupregs[1].dttk_value; 3138 int64_t remaining = (int64_t)tupregs[2].dttk_value; 3139 size_t len = dtrace_strlen((char *)s, size); 3140 int64_t i = 0; 3141 3142 if (nargs <= 2) 3143 remaining = (int64_t)size; 3144 3145 if (mstate->dtms_scratch_ptr + size > 3146 mstate->dtms_scratch_base + mstate->dtms_scratch_size) { 3147 DTRACE_CPUFLAG_SET(CPU_DTRACE_NOSCRATCH); 3148 regs[rd] = NULL; 3149 break; 3150 } 3151 3152 if (index < 0) { 3153 index += len; 3154 3155 if (index < 0 && index + remaining > 0) { 3156 remaining += index; 3157 index = 0; 3158 } 3159 } 3160 3161 if (index >= len || index < 0) 3162 index = len; 3163 3164 for (d[0] = '\0'; remaining > 0; remaining--) { 3165 if ((d[i++] = dtrace_load8(s++ + index)) == '\0') 3166 break; 3167 3168 if (i == size) { 3169 d[i - 1] = '\0'; 3170 break; 3171 } 3172 } 3173 3174 mstate->dtms_scratch_ptr += size; 3175 regs[rd] = (uintptr_t)d; 3176 break; 3177 } 3178 3179 case DIF_SUBR_GETMAJOR: 3180 #ifdef _LP64 3181 regs[rd] = (tupregs[0].dttk_value >> NBITSMINOR64) & MAXMAJ64; 3182 #else 3183 regs[rd] = (tupregs[0].dttk_value >> NBITSMINOR) & MAXMAJ; 3184 #endif 3185 break; 3186 3187 case DIF_SUBR_GETMINOR: 3188 #ifdef _LP64 3189 regs[rd] = tupregs[0].dttk_value & MAXMIN64; 3190 #else 3191 regs[rd] = tupregs[0].dttk_value & MAXMIN; 3192 #endif 3193 break; 3194 3195 case DIF_SUBR_DDI_PATHNAME: { 3196 /* 3197 * This one is a galactic mess. We are going to roughly 3198 * emulate ddi_pathname(), but it's made more complicated 3199 * by the fact that we (a) want to include the minor name and 3200 * (b) must proceed iteratively instead of recursively. 3201 */ 3202 uintptr_t dest = mstate->dtms_scratch_ptr; 3203 uint64_t size = state->dts_options[DTRACEOPT_STRSIZE]; 3204 char *start = (char *)dest, *end = start + size - 1; 3205 uintptr_t daddr = tupregs[0].dttk_value; 3206 int64_t minor = (int64_t)tupregs[1].dttk_value; 3207 char *s; 3208 int i, len, depth = 0; 3209 3210 if (size == 0 || mstate->dtms_scratch_ptr + size > 3211 mstate->dtms_scratch_base + mstate->dtms_scratch_size) { 3212 DTRACE_CPUFLAG_SET(CPU_DTRACE_NOSCRATCH); 3213 regs[rd] = NULL; 3214 break; 3215 } 3216 3217 *end = '\0'; 3218 3219 /* 3220 * We want to have a name for the minor. In order to do this, 3221 * we need to walk the minor list from the devinfo. We want 3222 * to be sure that we don't infinitely walk a circular list, 3223 * so we check for circularity by sending a scout pointer 3224 * ahead two elements for every element that we iterate over; 3225 * if the list is circular, these will ultimately point to the 3226 * same element. You may recognize this little trick as the 3227 * answer to a stupid interview question -- one that always 3228 * seems to be asked by those who had to have it laboriously 3229 * explained to them, and who can't even concisely describe 3230 * the conditions under which one would be forced to resort to 3231 * this technique. Needless to say, those conditions are 3232 * found here -- and probably only here. Is this is the only 3233 * use of this infamous trick in shipping, production code? 3234 * If it isn't, it probably should be... 3235 */ 3236 if (minor != -1) { 3237 uintptr_t maddr = dtrace_loadptr(daddr + 3238 offsetof(struct dev_info, devi_minor)); 3239 3240 uintptr_t next = offsetof(struct ddi_minor_data, next); 3241 uintptr_t name = offsetof(struct ddi_minor_data, 3242 d_minor) + offsetof(struct ddi_minor, name); 3243 uintptr_t dev = offsetof(struct ddi_minor_data, 3244 d_minor) + offsetof(struct ddi_minor, dev); 3245 uintptr_t scout; 3246 3247 if (maddr != NULL) 3248 scout = dtrace_loadptr(maddr + next); 3249 3250 while (maddr != NULL && !(*flags & CPU_DTRACE_FAULT)) { 3251 uint64_t m; 3252 #ifdef _LP64 3253 m = dtrace_load64(maddr + dev) & MAXMIN64; 3254 #else 3255 m = dtrace_load32(maddr + dev) & MAXMIN; 3256 #endif 3257 if (m != minor) { 3258 maddr = dtrace_loadptr(maddr + next); 3259 3260 if (scout == NULL) 3261 continue; 3262 3263 scout = dtrace_loadptr(scout + next); 3264 3265 if (scout == NULL) 3266 continue; 3267 3268 scout = dtrace_loadptr(scout + next); 3269 3270 if (scout == NULL) 3271 continue; 3272 3273 if (scout == maddr) { 3274 *flags |= CPU_DTRACE_ILLOP; 3275 break; 3276 } 3277 3278 continue; 3279 } 3280 3281 /* 3282 * We have the minor data. Now we need to 3283 * copy the minor's name into the end of the 3284 * pathname. 3285 */ 3286 s = (char *)dtrace_loadptr(maddr + name); 3287 len = dtrace_strlen(s, size); 3288 3289 if (*flags & CPU_DTRACE_FAULT) 3290 break; 3291 3292 if (len != 0) { 3293 if ((end -= (len + 1)) < start) 3294 break; 3295 3296 *end = ':'; 3297 } 3298 3299 for (i = 1; i <= len; i++) 3300 end[i] = dtrace_load8((uintptr_t)s++); 3301 break; 3302 } 3303 } 3304 3305 while (daddr != NULL && !(*flags & CPU_DTRACE_FAULT)) { 3306 ddi_node_state_t devi_state; 3307 3308 devi_state = dtrace_load32(daddr + 3309 offsetof(struct dev_info, devi_node_state)); 3310 3311 if (*flags & CPU_DTRACE_FAULT) 3312 break; 3313 3314 if (devi_state >= DS_INITIALIZED) { 3315 s = (char *)dtrace_loadptr(daddr + 3316 offsetof(struct dev_info, devi_addr)); 3317 len = dtrace_strlen(s, size); 3318 3319 if (*flags & CPU_DTRACE_FAULT) 3320 break; 3321 3322 if (len != 0) { 3323 if ((end -= (len + 1)) < start) 3324 break; 3325 3326 *end = '@'; 3327 } 3328 3329 for (i = 1; i <= len; i++) 3330 end[i] = dtrace_load8((uintptr_t)s++); 3331 } 3332 3333 /* 3334 * Now for the node name... 3335 */ 3336 s = (char *)dtrace_loadptr(daddr + 3337 offsetof(struct dev_info, devi_node_name)); 3338 3339 daddr = dtrace_loadptr(daddr + 3340 offsetof(struct dev_info, devi_parent)); 3341 3342 /* 3343 * If our parent is NULL (that is, if we're the root 3344 * node), we're going to use the special path 3345 * "devices". 3346 */ 3347 if (daddr == NULL) 3348 s = "devices"; 3349 3350 len = dtrace_strlen(s, size); 3351 if (*flags & CPU_DTRACE_FAULT) 3352 break; 3353 3354 if ((end -= (len + 1)) < start) 3355 break; 3356 3357 for (i = 1; i <= len; i++) 3358 end[i] = dtrace_load8((uintptr_t)s++); 3359 *end = '/'; 3360 3361 if (depth++ > dtrace_devdepth_max) { 3362 *flags |= CPU_DTRACE_ILLOP; 3363 break; 3364 } 3365 } 3366 3367 if (end < start) 3368 DTRACE_CPUFLAG_SET(CPU_DTRACE_NOSCRATCH); 3369 3370 if (daddr == NULL) { 3371 regs[rd] = (uintptr_t)end; 3372 mstate->dtms_scratch_ptr += size; 3373 } 3374 3375 break; 3376 } 3377 3378 case DIF_SUBR_STRJOIN: { 3379 char *d = (char *)mstate->dtms_scratch_ptr; 3380 uint64_t size = state->dts_options[DTRACEOPT_STRSIZE]; 3381 uintptr_t s1 = tupregs[0].dttk_value; 3382 uintptr_t s2 = tupregs[1].dttk_value; 3383 int i = 0; 3384 3385 if (mstate->dtms_scratch_ptr + size > 3386 mstate->dtms_scratch_base + mstate->dtms_scratch_size) { 3387 DTRACE_CPUFLAG_SET(CPU_DTRACE_NOSCRATCH); 3388 regs[rd] = NULL; 3389 break; 3390 } 3391 3392 for (;;) { 3393 if (i >= size) { 3394 DTRACE_CPUFLAG_SET(CPU_DTRACE_NOSCRATCH); 3395 regs[rd] = NULL; 3396 break; 3397 } 3398 3399 if ((d[i++] = dtrace_load8(s1++)) == '\0') { 3400 i--; 3401 break; 3402 } 3403 } 3404 3405 for (;;) { 3406 if (i >= size) { 3407 DTRACE_CPUFLAG_SET(CPU_DTRACE_NOSCRATCH); 3408 regs[rd] = NULL; 3409 break; 3410 } 3411 3412 if ((d[i++] = dtrace_load8(s2++)) == '\0') 3413 break; 3414 } 3415 3416 if (i < size) { 3417 mstate->dtms_scratch_ptr += i; 3418 regs[rd] = (uintptr_t)d; 3419 } 3420 3421 break; 3422 } 3423 3424 case DIF_SUBR_LLTOSTR: { 3425 int64_t i = (int64_t)tupregs[0].dttk_value; 3426 int64_t val = i < 0 ? i * -1 : i; 3427 uint64_t size = 22; /* enough room for 2^64 in decimal */ 3428 char *end = (char *)mstate->dtms_scratch_ptr + size - 1; 3429 3430 if (mstate->dtms_scratch_ptr + size > 3431 mstate->dtms_scratch_base + mstate->dtms_scratch_size) { 3432 DTRACE_CPUFLAG_SET(CPU_DTRACE_NOSCRATCH); 3433 regs[rd] = NULL; 3434 break; 3435 } 3436 3437 for (*end-- = '\0'; val; val /= 10) 3438 *end-- = '0' + (val % 10); 3439 3440 if (i == 0) 3441 *end-- = '0'; 3442 3443 if (i < 0) 3444 *end-- = '-'; 3445 3446 regs[rd] = (uintptr_t)end + 1; 3447 mstate->dtms_scratch_ptr += size; 3448 break; 3449 } 3450 3451 case DIF_SUBR_DIRNAME: 3452 case DIF_SUBR_BASENAME: { 3453 char *dest = (char *)mstate->dtms_scratch_ptr; 3454 uint64_t size = state->dts_options[DTRACEOPT_STRSIZE]; 3455 uintptr_t src = tupregs[0].dttk_value; 3456 int i, j, len = dtrace_strlen((char *)src, size); 3457 int lastbase = -1, firstbase = -1, lastdir = -1; 3458 int start, end; 3459 3460 if (mstate->dtms_scratch_ptr + size > 3461 mstate->dtms_scratch_base + mstate->dtms_scratch_size) { 3462 DTRACE_CPUFLAG_SET(CPU_DTRACE_NOSCRATCH); 3463 regs[rd] = NULL; 3464 break; 3465 } 3466 3467 /* 3468 * The basename and dirname for a zero-length string is 3469 * defined to be "." 3470 */ 3471 if (len == 0) { 3472 len = 1; 3473 src = (uintptr_t)"."; 3474 } 3475 3476 /* 3477 * Start from the back of the string, moving back toward the 3478 * front until we see a character that isn't a slash. That 3479 * character is the last character in the basename. 3480 */ 3481 for (i = len - 1; i >= 0; i--) { 3482 if (dtrace_load8(src + i) != '/') 3483 break; 3484 } 3485 3486 if (i >= 0) 3487 lastbase = i; 3488 3489 /* 3490 * Starting from the last character in the basename, move 3491 * towards the front until we find a slash. The character 3492 * that we processed immediately before that is the first 3493 * character in the basename. 3494 */ 3495 for (; i >= 0; i--) { 3496 if (dtrace_load8(src + i) == '/') 3497 break; 3498 } 3499 3500 if (i >= 0) 3501 firstbase = i + 1; 3502 3503 /* 3504 * Now keep going until we find a non-slash character. That 3505 * character is the last character in the dirname. 3506 */ 3507 for (; i >= 0; i--) { 3508 if (dtrace_load8(src + i) != '/') 3509 break; 3510 } 3511 3512 if (i >= 0) 3513 lastdir = i; 3514 3515 ASSERT(!(lastbase == -1 && firstbase != -1)); 3516 ASSERT(!(firstbase == -1 && lastdir != -1)); 3517 3518 if (lastbase == -1) { 3519 /* 3520 * We didn't find a non-slash character. We know that 3521 * the length is non-zero, so the whole string must be 3522 * slashes. In either the dirname or the basename 3523 * case, we return '/'. 3524 */ 3525 ASSERT(firstbase == -1); 3526 firstbase = lastbase = lastdir = 0; 3527 } 3528 3529 if (firstbase == -1) { 3530 /* 3531 * The entire string consists only of a basename 3532 * component. If we're looking for dirname, we need 3533 * to change our string to be just "."; if we're 3534 * looking for a basename, we'll just set the first 3535 * character of the basename to be 0. 3536 */ 3537 if (subr == DIF_SUBR_DIRNAME) { 3538 ASSERT(lastdir == -1); 3539 src = (uintptr_t)"."; 3540 lastdir = 0; 3541 } else { 3542 firstbase = 0; 3543 } 3544 } 3545 3546 if (subr == DIF_SUBR_DIRNAME) { 3547 if (lastdir == -1) { 3548 /* 3549 * We know that we have a slash in the name -- 3550 * or lastdir would be set to 0, above. And 3551 * because lastdir is -1, we know that this 3552 * slash must be the first character. (That 3553 * is, the full string must be of the form 3554 * "/basename".) In this case, the last 3555 * character of the directory name is 0. 3556 */ 3557 lastdir = 0; 3558 } 3559 3560 start = 0; 3561 end = lastdir; 3562 } else { 3563 ASSERT(subr == DIF_SUBR_BASENAME); 3564 ASSERT(firstbase != -1 && lastbase != -1); 3565 start = firstbase; 3566 end = lastbase; 3567 } 3568 3569 for (i = start, j = 0; i <= end && j < size - 1; i++, j++) 3570 dest[j] = dtrace_load8(src + i); 3571 3572 dest[j] = '\0'; 3573 regs[rd] = (uintptr_t)dest; 3574 mstate->dtms_scratch_ptr += size; 3575 break; 3576 } 3577 3578 case DIF_SUBR_CLEANPATH: { 3579 char *dest = (char *)mstate->dtms_scratch_ptr, c; 3580 uint64_t size = state->dts_options[DTRACEOPT_STRSIZE]; 3581 uintptr_t src = tupregs[0].dttk_value; 3582 int i = 0, j = 0; 3583 3584 if (mstate->dtms_scratch_ptr + size > 3585 mstate->dtms_scratch_base + mstate->dtms_scratch_size) { 3586 DTRACE_CPUFLAG_SET(CPU_DTRACE_NOSCRATCH); 3587 regs[rd] = NULL; 3588 break; 3589 } 3590 3591 /* 3592 * Move forward, loading each character. 3593 */ 3594 do { 3595 c = dtrace_load8(src + i++); 3596 next: 3597 if (j + 5 >= size) /* 5 = strlen("/..c\0") */ 3598 break; 3599 3600 if (c != '/') { 3601 dest[j++] = c; 3602 continue; 3603 } 3604 3605 c = dtrace_load8(src + i++); 3606 3607 if (c == '/') { 3608 /* 3609 * We have two slashes -- we can just advance 3610 * to the next character. 3611 */ 3612 goto next; 3613 } 3614 3615 if (c != '.') { 3616 /* 3617 * This is not "." and it's not ".." -- we can 3618 * just store the "/" and this character and 3619 * drive on. 3620 */ 3621 dest[j++] = '/'; 3622 dest[j++] = c; 3623 continue; 3624 } 3625 3626 c = dtrace_load8(src + i++); 3627 3628 if (c == '/') { 3629 /* 3630 * This is a "/./" component. We're not going 3631 * to store anything in the destination buffer; 3632 * we're just going to go to the next component. 3633 */ 3634 goto next; 3635 } 3636 3637 if (c != '.') { 3638 /* 3639 * This is not ".." -- we can just store the 3640 * "/." and this character and continue 3641 * processing. 3642 */ 3643 dest[j++] = '/'; 3644 dest[j++] = '.'; 3645 dest[j++] = c; 3646 continue; 3647 } 3648 3649 c = dtrace_load8(src + i++); 3650 3651 if (c != '/' && c != '\0') { 3652 /* 3653 * This is not ".." -- it's "..[mumble]". 3654 * We'll store the "/.." and this character 3655 * and continue processing. 3656 */ 3657 dest[j++] = '/'; 3658 dest[j++] = '.'; 3659 dest[j++] = '.'; 3660 dest[j++] = c; 3661 continue; 3662 } 3663 3664 /* 3665 * This is "/../" or "/..\0". We need to back up 3666 * our destination pointer until we find a "/". 3667 */ 3668 i--; 3669 while (j != 0 && dest[--j] != '/') 3670 continue; 3671 3672 if (c == '\0') 3673 dest[++j] = '/'; 3674 } while (c != '\0'); 3675 3676 dest[j] = '\0'; 3677 regs[rd] = (uintptr_t)dest; 3678 mstate->dtms_scratch_ptr += size; 3679 break; 3680 } 3681 } 3682 } 3683 3684 /* 3685 * Emulate the execution of DTrace IR instructions specified by the given 3686 * DIF object. This function is deliberately void of assertions as all of 3687 * the necessary checks are handled by a call to dtrace_difo_validate(). 3688 */ 3689 static uint64_t 3690 dtrace_dif_emulate(dtrace_difo_t *difo, dtrace_mstate_t *mstate, 3691 dtrace_vstate_t *vstate, dtrace_state_t *state) 3692 { 3693 const dif_instr_t *text = difo->dtdo_buf; 3694 const uint_t textlen = difo->dtdo_len; 3695 const char *strtab = difo->dtdo_strtab; 3696 const uint64_t *inttab = difo->dtdo_inttab; 3697 3698 uint64_t rval = 0; 3699 dtrace_statvar_t *svar; 3700 dtrace_dstate_t *dstate = &vstate->dtvs_dynvars; 3701 dtrace_difv_t *v; 3702 volatile uint16_t *flags = &cpu_core[CPU->cpu_id].cpuc_dtrace_flags; 3703 volatile uintptr_t *illval = &cpu_core[CPU->cpu_id].cpuc_dtrace_illval; 3704 3705 dtrace_key_t tupregs[DIF_DTR_NREGS + 2]; /* +2 for thread and id */ 3706 uint64_t regs[DIF_DIR_NREGS]; 3707 uint64_t *tmp; 3708 3709 uint8_t cc_n = 0, cc_z = 0, cc_v = 0, cc_c = 0; 3710 int64_t cc_r; 3711 uint_t pc = 0, id, opc; 3712 uint8_t ttop = 0; 3713 dif_instr_t instr; 3714 uint_t r1, r2, rd; 3715 3716 regs[DIF_REG_R0] = 0; /* %r0 is fixed at zero */ 3717 3718 while (pc < textlen && !(*flags & CPU_DTRACE_FAULT)) { 3719 opc = pc; 3720 3721 instr = text[pc++]; 3722 r1 = DIF_INSTR_R1(instr); 3723 r2 = DIF_INSTR_R2(instr); 3724 rd = DIF_INSTR_RD(instr); 3725 3726 switch (DIF_INSTR_OP(instr)) { 3727 case DIF_OP_OR: 3728 regs[rd] = regs[r1] | regs[r2]; 3729 break; 3730 case DIF_OP_XOR: 3731 regs[rd] = regs[r1] ^ regs[r2]; 3732 break; 3733 case DIF_OP_AND: 3734 regs[rd] = regs[r1] & regs[r2]; 3735 break; 3736 case DIF_OP_SLL: 3737 regs[rd] = regs[r1] << regs[r2]; 3738 break; 3739 case DIF_OP_SRL: 3740 regs[rd] = regs[r1] >> regs[r2]; 3741 break; 3742 case DIF_OP_SUB: 3743 regs[rd] = regs[r1] - regs[r2]; 3744 break; 3745 case DIF_OP_ADD: 3746 regs[rd] = regs[r1] + regs[r2]; 3747 break; 3748 case DIF_OP_MUL: 3749 regs[rd] = regs[r1] * regs[r2]; 3750 break; 3751 case DIF_OP_SDIV: 3752 if (regs[r2] == 0) { 3753 regs[rd] = 0; 3754 *flags |= CPU_DTRACE_DIVZERO; 3755 } else { 3756 regs[rd] = (int64_t)regs[r1] / 3757 (int64_t)regs[r2]; 3758 } 3759 break; 3760 3761 case DIF_OP_UDIV: 3762 if (regs[r2] == 0) { 3763 regs[rd] = 0; 3764 *flags |= CPU_DTRACE_DIVZERO; 3765 } else { 3766 regs[rd] = regs[r1] / regs[r2]; 3767 } 3768 break; 3769 3770 case DIF_OP_SREM: 3771 if (regs[r2] == 0) { 3772 regs[rd] = 0; 3773 *flags |= CPU_DTRACE_DIVZERO; 3774 } else { 3775 regs[rd] = (int64_t)regs[r1] % 3776 (int64_t)regs[r2]; 3777 } 3778 break; 3779 3780 case DIF_OP_UREM: 3781 if (regs[r2] == 0) { 3782 regs[rd] = 0; 3783 *flags |= CPU_DTRACE_DIVZERO; 3784 } else { 3785 regs[rd] = regs[r1] % regs[r2]; 3786 } 3787 break; 3788 3789 case DIF_OP_NOT: 3790 regs[rd] = ~regs[r1]; 3791 break; 3792 case DIF_OP_MOV: 3793 regs[rd] = regs[r1]; 3794 break; 3795 case DIF_OP_CMP: 3796 cc_r = regs[r1] - regs[r2]; 3797 cc_n = cc_r < 0; 3798 cc_z = cc_r == 0; 3799 cc_v = 0; 3800 cc_c = regs[r1] < regs[r2]; 3801 break; 3802 case DIF_OP_TST: 3803 cc_n = cc_v = cc_c = 0; 3804 cc_z = regs[r1] == 0; 3805 break; 3806 case DIF_OP_BA: 3807 pc = DIF_INSTR_LABEL(instr); 3808 break; 3809 case DIF_OP_BE: 3810 if (cc_z) 3811 pc = DIF_INSTR_LABEL(instr); 3812 break; 3813 case DIF_OP_BNE: 3814 if (cc_z == 0) 3815 pc = DIF_INSTR_LABEL(instr); 3816 break; 3817 case DIF_OP_BG: 3818 if ((cc_z | (cc_n ^ cc_v)) == 0) 3819 pc = DIF_INSTR_LABEL(instr); 3820 break; 3821 case DIF_OP_BGU: 3822 if ((cc_c | cc_z) == 0) 3823 pc = DIF_INSTR_LABEL(instr); 3824 break; 3825 case DIF_OP_BGE: 3826 if ((cc_n ^ cc_v) == 0) 3827 pc = DIF_INSTR_LABEL(instr); 3828 break; 3829 case DIF_OP_BGEU: 3830 if (cc_c == 0) 3831 pc = DIF_INSTR_LABEL(instr); 3832 break; 3833 case DIF_OP_BL: 3834 if (cc_n ^ cc_v) 3835 pc = DIF_INSTR_LABEL(instr); 3836 break; 3837 case DIF_OP_BLU: 3838 if (cc_c) 3839 pc = DIF_INSTR_LABEL(instr); 3840 break; 3841 case DIF_OP_BLE: 3842 if (cc_z | (cc_n ^ cc_v)) 3843 pc = DIF_INSTR_LABEL(instr); 3844 break; 3845 case DIF_OP_BLEU: 3846 if (cc_c | cc_z) 3847 pc = DIF_INSTR_LABEL(instr); 3848 break; 3849 case DIF_OP_RLDSB: 3850 if (!dtrace_canstore(regs[r1], 1, mstate, vstate)) { 3851 *flags |= CPU_DTRACE_KPRIV; 3852 *illval = regs[r1]; 3853 break; 3854 } 3855 /*FALLTHROUGH*/ 3856 case DIF_OP_LDSB: 3857 regs[rd] = (int8_t)dtrace_load8(regs[r1]); 3858 break; 3859 case DIF_OP_RLDSH: 3860 if (!dtrace_canstore(regs[r1], 2, mstate, vstate)) { 3861 *flags |= CPU_DTRACE_KPRIV; 3862 *illval = regs[r1]; 3863 break; 3864 } 3865 /*FALLTHROUGH*/ 3866 case DIF_OP_LDSH: 3867 regs[rd] = (int16_t)dtrace_load16(regs[r1]); 3868 break; 3869 case DIF_OP_RLDSW: 3870 if (!dtrace_canstore(regs[r1], 4, mstate, vstate)) { 3871 *flags |= CPU_DTRACE_KPRIV; 3872 *illval = regs[r1]; 3873 break; 3874 } 3875 /*FALLTHROUGH*/ 3876 case DIF_OP_LDSW: 3877 regs[rd] = (int32_t)dtrace_load32(regs[r1]); 3878 break; 3879 case DIF_OP_RLDUB: 3880 if (!dtrace_canstore(regs[r1], 1, mstate, vstate)) { 3881 *flags |= CPU_DTRACE_KPRIV; 3882 *illval = regs[r1]; 3883 break; 3884 } 3885 /*FALLTHROUGH*/ 3886 case DIF_OP_LDUB: 3887 regs[rd] = dtrace_load8(regs[r1]); 3888 break; 3889 case DIF_OP_RLDUH: 3890 if (!dtrace_canstore(regs[r1], 2, mstate, vstate)) { 3891 *flags |= CPU_DTRACE_KPRIV; 3892 *illval = regs[r1]; 3893 break; 3894 } 3895 /*FALLTHROUGH*/ 3896 case DIF_OP_LDUH: 3897 regs[rd] = dtrace_load16(regs[r1]); 3898 break; 3899 case DIF_OP_RLDUW: 3900 if (!dtrace_canstore(regs[r1], 4, mstate, vstate)) { 3901 *flags |= CPU_DTRACE_KPRIV; 3902 *illval = regs[r1]; 3903 break; 3904 } 3905 /*FALLTHROUGH*/ 3906 case DIF_OP_LDUW: 3907 regs[rd] = dtrace_load32(regs[r1]); 3908 break; 3909 case DIF_OP_RLDX: 3910 if (!dtrace_canstore(regs[r1], 8, mstate, vstate)) { 3911 *flags |= CPU_DTRACE_KPRIV; 3912 *illval = regs[r1]; 3913 break; 3914 } 3915 /*FALLTHROUGH*/ 3916 case DIF_OP_LDX: 3917 regs[rd] = dtrace_load64(regs[r1]); 3918 break; 3919 case DIF_OP_ULDSB: 3920 regs[rd] = (int8_t) 3921 dtrace_fuword8((void *)(uintptr_t)regs[r1]); 3922 break; 3923 case DIF_OP_ULDSH: 3924 regs[rd] = (int16_t) 3925 dtrace_fuword16((void *)(uintptr_t)regs[r1]); 3926 break; 3927 case DIF_OP_ULDSW: 3928 regs[rd] = (int32_t) 3929 dtrace_fuword32((void *)(uintptr_t)regs[r1]); 3930 break; 3931 case DIF_OP_ULDUB: 3932 regs[rd] = 3933 dtrace_fuword8((void *)(uintptr_t)regs[r1]); 3934 break; 3935 case DIF_OP_ULDUH: 3936 regs[rd] = 3937 dtrace_fuword16((void *)(uintptr_t)regs[r1]); 3938 break; 3939 case DIF_OP_ULDUW: 3940 regs[rd] = 3941 dtrace_fuword32((void *)(uintptr_t)regs[r1]); 3942 break; 3943 case DIF_OP_ULDX: 3944 regs[rd] = 3945 dtrace_fuword64((void *)(uintptr_t)regs[r1]); 3946 break; 3947 case DIF_OP_RET: 3948 rval = regs[rd]; 3949 break; 3950 case DIF_OP_NOP: 3951 break; 3952 case DIF_OP_SETX: 3953 regs[rd] = inttab[DIF_INSTR_INTEGER(instr)]; 3954 break; 3955 case DIF_OP_SETS: 3956 regs[rd] = (uint64_t)(uintptr_t) 3957 (strtab + DIF_INSTR_STRING(instr)); 3958 break; 3959 case DIF_OP_SCMP: 3960 cc_r = dtrace_strncmp((char *)(uintptr_t)regs[r1], 3961 (char *)(uintptr_t)regs[r2], 3962 state->dts_options[DTRACEOPT_STRSIZE]); 3963 3964 cc_n = cc_r < 0; 3965 cc_z = cc_r == 0; 3966 cc_v = cc_c = 0; 3967 break; 3968 case DIF_OP_LDGA: 3969 regs[rd] = dtrace_dif_variable(mstate, state, 3970 r1, regs[r2]); 3971 break; 3972 case DIF_OP_LDGS: 3973 id = DIF_INSTR_VAR(instr); 3974 3975 if (id >= DIF_VAR_OTHER_UBASE) { 3976 uintptr_t a; 3977 3978 id -= DIF_VAR_OTHER_UBASE; 3979 svar = vstate->dtvs_globals[id]; 3980 ASSERT(svar != NULL); 3981 v = &svar->dtsv_var; 3982 3983 if (!(v->dtdv_type.dtdt_flags & DIF_TF_BYREF)) { 3984 regs[rd] = svar->dtsv_data; 3985 break; 3986 } 3987 3988 a = (uintptr_t)svar->dtsv_data; 3989 3990 if (*(uint8_t *)a == UINT8_MAX) { 3991 /* 3992 * If the 0th byte is set to UINT8_MAX 3993 * then this is to be treated as a 3994 * reference to a NULL variable. 3995 */ 3996 regs[rd] = NULL; 3997 } else { 3998 regs[rd] = a + sizeof (uint64_t); 3999 } 4000 4001 break; 4002 } 4003 4004 regs[rd] = dtrace_dif_variable(mstate, state, id, 0); 4005 break; 4006 4007 case DIF_OP_STGS: 4008 id = DIF_INSTR_VAR(instr); 4009 4010 ASSERT(id >= DIF_VAR_OTHER_UBASE); 4011 id -= DIF_VAR_OTHER_UBASE; 4012 4013 svar = vstate->dtvs_globals[id]; 4014 ASSERT(svar != NULL); 4015 v = &svar->dtsv_var; 4016 4017 if (v->dtdv_type.dtdt_flags & DIF_TF_BYREF) { 4018 uintptr_t a = (uintptr_t)svar->dtsv_data; 4019 4020 ASSERT(a != NULL); 4021 ASSERT(svar->dtsv_size != 0); 4022 4023 if (regs[rd] == NULL) { 4024 *(uint8_t *)a = UINT8_MAX; 4025 break; 4026 } else { 4027 *(uint8_t *)a = 0; 4028 a += sizeof (uint64_t); 4029 } 4030 4031 dtrace_vcopy((void *)(uintptr_t)regs[rd], 4032 (void *)a, &v->dtdv_type); 4033 break; 4034 } 4035 4036 svar->dtsv_data = regs[rd]; 4037 break; 4038 4039 case DIF_OP_LDTA: 4040 /* 4041 * There are no DTrace built-in thread-local arrays at 4042 * present. This opcode is saved for future work. 4043 */ 4044 *flags |= CPU_DTRACE_ILLOP; 4045 regs[rd] = 0; 4046 break; 4047 4048 case DIF_OP_LDLS: 4049 id = DIF_INSTR_VAR(instr); 4050 4051 if (id < DIF_VAR_OTHER_UBASE) { 4052 /* 4053 * For now, this has no meaning. 4054 */ 4055 regs[rd] = 0; 4056 break; 4057 } 4058 4059 id -= DIF_VAR_OTHER_UBASE; 4060 4061 ASSERT(id < vstate->dtvs_nlocals); 4062 ASSERT(vstate->dtvs_locals != NULL); 4063 4064 svar = vstate->dtvs_locals[id]; 4065 ASSERT(svar != NULL); 4066 v = &svar->dtsv_var; 4067 4068 if (v->dtdv_type.dtdt_flags & DIF_TF_BYREF) { 4069 uintptr_t a = (uintptr_t)svar->dtsv_data; 4070 size_t sz = v->dtdv_type.dtdt_size; 4071 4072 sz += sizeof (uint64_t); 4073 ASSERT(svar->dtsv_size == NCPU * sz); 4074 a += CPU->cpu_id * sz; 4075 4076 if (*(uint8_t *)a == UINT8_MAX) { 4077 /* 4078 * If the 0th byte is set to UINT8_MAX 4079 * then this is to be treated as a 4080 * reference to a NULL variable. 4081 */ 4082 regs[rd] = NULL; 4083 } else { 4084 regs[rd] = a + sizeof (uint64_t); 4085 } 4086 4087 break; 4088 } 4089 4090 ASSERT(svar->dtsv_size == NCPU * sizeof (uint64_t)); 4091 tmp = (uint64_t *)(uintptr_t)svar->dtsv_data; 4092 regs[rd] = tmp[CPU->cpu_id]; 4093 break; 4094 4095 case DIF_OP_STLS: 4096 id = DIF_INSTR_VAR(instr); 4097 4098 ASSERT(id >= DIF_VAR_OTHER_UBASE); 4099 id -= DIF_VAR_OTHER_UBASE; 4100 ASSERT(id < vstate->dtvs_nlocals); 4101 4102 ASSERT(vstate->dtvs_locals != NULL); 4103 svar = vstate->dtvs_locals[id]; 4104 ASSERT(svar != NULL); 4105 v = &svar->dtsv_var; 4106 4107 if (v->dtdv_type.dtdt_flags & DIF_TF_BYREF) { 4108 uintptr_t a = (uintptr_t)svar->dtsv_data; 4109 size_t sz = v->dtdv_type.dtdt_size; 4110 4111 sz += sizeof (uint64_t); 4112 ASSERT(svar->dtsv_size == NCPU * sz); 4113 a += CPU->cpu_id * sz; 4114 4115 if (regs[rd] == NULL) { 4116 *(uint8_t *)a = UINT8_MAX; 4117 break; 4118 } else { 4119 *(uint8_t *)a = 0; 4120 a += sizeof (uint64_t); 4121 } 4122 4123 dtrace_vcopy((void *)(uintptr_t)regs[rd], 4124 (void *)a, &v->dtdv_type); 4125 break; 4126 } 4127 4128 ASSERT(svar->dtsv_size == NCPU * sizeof (uint64_t)); 4129 tmp = (uint64_t *)(uintptr_t)svar->dtsv_data; 4130 tmp[CPU->cpu_id] = regs[rd]; 4131 break; 4132 4133 case DIF_OP_LDTS: { 4134 dtrace_dynvar_t *dvar; 4135 dtrace_key_t *key; 4136 4137 id = DIF_INSTR_VAR(instr); 4138 ASSERT(id >= DIF_VAR_OTHER_UBASE); 4139 id -= DIF_VAR_OTHER_UBASE; 4140 v = &vstate->dtvs_tlocals[id]; 4141 4142 key = &tupregs[DIF_DTR_NREGS]; 4143 key[0].dttk_value = (uint64_t)id; 4144 key[0].dttk_size = 0; 4145 DTRACE_TLS_THRKEY(key[1].dttk_value); 4146 key[1].dttk_size = 0; 4147 4148 dvar = dtrace_dynvar(dstate, 2, key, 4149 sizeof (uint64_t), DTRACE_DYNVAR_NOALLOC); 4150 4151 if (dvar == NULL) { 4152 regs[rd] = 0; 4153 break; 4154 } 4155 4156 if (v->dtdv_type.dtdt_flags & DIF_TF_BYREF) { 4157 regs[rd] = (uint64_t)(uintptr_t)dvar->dtdv_data; 4158 } else { 4159 regs[rd] = *((uint64_t *)dvar->dtdv_data); 4160 } 4161 4162 break; 4163 } 4164 4165 case DIF_OP_STTS: { 4166 dtrace_dynvar_t *dvar; 4167 dtrace_key_t *key; 4168 4169 id = DIF_INSTR_VAR(instr); 4170 ASSERT(id >= DIF_VAR_OTHER_UBASE); 4171 id -= DIF_VAR_OTHER_UBASE; 4172 4173 key = &tupregs[DIF_DTR_NREGS]; 4174 key[0].dttk_value = (uint64_t)id; 4175 key[0].dttk_size = 0; 4176 DTRACE_TLS_THRKEY(key[1].dttk_value); 4177 key[1].dttk_size = 0; 4178 v = &vstate->dtvs_tlocals[id]; 4179 4180 dvar = dtrace_dynvar(dstate, 2, key, 4181 v->dtdv_type.dtdt_size > sizeof (uint64_t) ? 4182 v->dtdv_type.dtdt_size : sizeof (uint64_t), 4183 regs[rd] ? DTRACE_DYNVAR_ALLOC : 4184 DTRACE_DYNVAR_DEALLOC); 4185 4186 /* 4187 * Given that we're storing to thread-local data, 4188 * we need to flush our predicate cache. 4189 */ 4190 curthread->t_predcache = NULL; 4191 4192 if (dvar == NULL) 4193 break; 4194 4195 if (v->dtdv_type.dtdt_flags & DIF_TF_BYREF) { 4196 dtrace_vcopy((void *)(uintptr_t)regs[rd], 4197 dvar->dtdv_data, &v->dtdv_type); 4198 } else { 4199 *((uint64_t *)dvar->dtdv_data) = regs[rd]; 4200 } 4201 4202 break; 4203 } 4204 4205 case DIF_OP_SRA: 4206 regs[rd] = (int64_t)regs[r1] >> regs[r2]; 4207 break; 4208 4209 case DIF_OP_CALL: 4210 dtrace_dif_subr(DIF_INSTR_SUBR(instr), rd, 4211 regs, tupregs, ttop, mstate, state); 4212 break; 4213 4214 case DIF_OP_PUSHTR: 4215 if (ttop == DIF_DTR_NREGS) { 4216 *flags |= CPU_DTRACE_TUPOFLOW; 4217 break; 4218 } 4219 4220 if (r1 == DIF_TYPE_STRING) { 4221 /* 4222 * If this is a string type and the size is 0, 4223 * we'll use the system-wide default string 4224 * size. Note that we are _not_ looking at 4225 * the value of the DTRACEOPT_STRSIZE option; 4226 * had this been set, we would expect to have 4227 * a non-zero size value in the "pushtr". 4228 */ 4229 tupregs[ttop].dttk_size = 4230 dtrace_strlen((char *)(uintptr_t)regs[rd], 4231 regs[r2] ? regs[r2] : 4232 dtrace_strsize_default) + 1; 4233 } else { 4234 tupregs[ttop].dttk_size = regs[r2]; 4235 } 4236 4237 tupregs[ttop++].dttk_value = regs[rd]; 4238 break; 4239 4240 case DIF_OP_PUSHTV: 4241 if (ttop == DIF_DTR_NREGS) { 4242 *flags |= CPU_DTRACE_TUPOFLOW; 4243 break; 4244 } 4245 4246 tupregs[ttop].dttk_value = regs[rd]; 4247 tupregs[ttop++].dttk_size = 0; 4248 break; 4249 4250 case DIF_OP_POPTS: 4251 if (ttop != 0) 4252 ttop--; 4253 break; 4254 4255 case DIF_OP_FLUSHTS: 4256 ttop = 0; 4257 break; 4258 4259 case DIF_OP_LDGAA: 4260 case DIF_OP_LDTAA: { 4261 dtrace_dynvar_t *dvar; 4262 dtrace_key_t *key = tupregs; 4263 uint_t nkeys = ttop; 4264 4265 id = DIF_INSTR_VAR(instr); 4266 ASSERT(id >= DIF_VAR_OTHER_UBASE); 4267 id -= DIF_VAR_OTHER_UBASE; 4268 4269 key[nkeys].dttk_value = (uint64_t)id; 4270 key[nkeys++].dttk_size = 0; 4271 4272 if (DIF_INSTR_OP(instr) == DIF_OP_LDTAA) { 4273 DTRACE_TLS_THRKEY(key[nkeys].dttk_value); 4274 key[nkeys++].dttk_size = 0; 4275 v = &vstate->dtvs_tlocals[id]; 4276 } else { 4277 v = &vstate->dtvs_globals[id]->dtsv_var; 4278 } 4279 4280 dvar = dtrace_dynvar(dstate, nkeys, key, 4281 v->dtdv_type.dtdt_size > sizeof (uint64_t) ? 4282 v->dtdv_type.dtdt_size : sizeof (uint64_t), 4283 DTRACE_DYNVAR_NOALLOC); 4284 4285 if (dvar == NULL) { 4286 regs[rd] = 0; 4287 break; 4288 } 4289 4290 if (v->dtdv_type.dtdt_flags & DIF_TF_BYREF) { 4291 regs[rd] = (uint64_t)(uintptr_t)dvar->dtdv_data; 4292 } else { 4293 regs[rd] = *((uint64_t *)dvar->dtdv_data); 4294 } 4295 4296 break; 4297 } 4298 4299 case DIF_OP_STGAA: 4300 case DIF_OP_STTAA: { 4301 dtrace_dynvar_t *dvar; 4302 dtrace_key_t *key = tupregs; 4303 uint_t nkeys = ttop; 4304 4305 id = DIF_INSTR_VAR(instr); 4306 ASSERT(id >= DIF_VAR_OTHER_UBASE); 4307 id -= DIF_VAR_OTHER_UBASE; 4308 4309 key[nkeys].dttk_value = (uint64_t)id; 4310 key[nkeys++].dttk_size = 0; 4311 4312 if (DIF_INSTR_OP(instr) == DIF_OP_STTAA) { 4313 DTRACE_TLS_THRKEY(key[nkeys].dttk_value); 4314 key[nkeys++].dttk_size = 0; 4315 v = &vstate->dtvs_tlocals[id]; 4316 } else { 4317 v = &vstate->dtvs_globals[id]->dtsv_var; 4318 } 4319 4320 dvar = dtrace_dynvar(dstate, nkeys, key, 4321 v->dtdv_type.dtdt_size > sizeof (uint64_t) ? 4322 v->dtdv_type.dtdt_size : sizeof (uint64_t), 4323 regs[rd] ? DTRACE_DYNVAR_ALLOC : 4324 DTRACE_DYNVAR_DEALLOC); 4325 4326 if (dvar == NULL) 4327 break; 4328 4329 if (v->dtdv_type.dtdt_flags & DIF_TF_BYREF) { 4330 dtrace_vcopy((void *)(uintptr_t)regs[rd], 4331 dvar->dtdv_data, &v->dtdv_type); 4332 } else { 4333 *((uint64_t *)dvar->dtdv_data) = regs[rd]; 4334 } 4335 4336 break; 4337 } 4338 4339 case DIF_OP_ALLOCS: { 4340 uintptr_t ptr = P2ROUNDUP(mstate->dtms_scratch_ptr, 8); 4341 size_t size = ptr - mstate->dtms_scratch_ptr + regs[r1]; 4342 4343 if (mstate->dtms_scratch_ptr + size > 4344 mstate->dtms_scratch_base + 4345 mstate->dtms_scratch_size) { 4346 DTRACE_CPUFLAG_SET(CPU_DTRACE_NOSCRATCH); 4347 regs[rd] = NULL; 4348 } else { 4349 dtrace_bzero((void *) 4350 mstate->dtms_scratch_ptr, size); 4351 mstate->dtms_scratch_ptr += size; 4352 regs[rd] = ptr; 4353 } 4354 break; 4355 } 4356 4357 case DIF_OP_COPYS: 4358 if (!dtrace_canstore(regs[rd], regs[r2], 4359 mstate, vstate)) { 4360 *flags |= CPU_DTRACE_BADADDR; 4361 *illval = regs[rd]; 4362 break; 4363 } 4364 4365 dtrace_bcopy((void *)(uintptr_t)regs[r1], 4366 (void *)(uintptr_t)regs[rd], (size_t)regs[r2]); 4367 break; 4368 4369 case DIF_OP_STB: 4370 if (!dtrace_canstore(regs[rd], 1, mstate, vstate)) { 4371 *flags |= CPU_DTRACE_BADADDR; 4372 *illval = regs[rd]; 4373 break; 4374 } 4375 *((uint8_t *)(uintptr_t)regs[rd]) = (uint8_t)regs[r1]; 4376 break; 4377 4378 case DIF_OP_STH: 4379 if (!dtrace_canstore(regs[rd], 2, mstate, vstate)) { 4380 *flags |= CPU_DTRACE_BADADDR; 4381 *illval = regs[rd]; 4382 break; 4383 } 4384 if (regs[rd] & 1) { 4385 *flags |= CPU_DTRACE_BADALIGN; 4386 *illval = regs[rd]; 4387 break; 4388 } 4389 *((uint16_t *)(uintptr_t)regs[rd]) = (uint16_t)regs[r1]; 4390 break; 4391 4392 case DIF_OP_STW: 4393 if (!dtrace_canstore(regs[rd], 4, mstate, vstate)) { 4394 *flags |= CPU_DTRACE_BADADDR; 4395 *illval = regs[rd]; 4396 break; 4397 } 4398 if (regs[rd] & 3) { 4399 *flags |= CPU_DTRACE_BADALIGN; 4400 *illval = regs[rd]; 4401 break; 4402 } 4403 *((uint32_t *)(uintptr_t)regs[rd]) = (uint32_t)regs[r1]; 4404 break; 4405 4406 case DIF_OP_STX: 4407 if (!dtrace_canstore(regs[rd], 8, mstate, vstate)) { 4408 *flags |= CPU_DTRACE_BADADDR; 4409 *illval = regs[rd]; 4410 break; 4411 } 4412 if (regs[rd] & 7) { 4413 *flags |= CPU_DTRACE_BADALIGN; 4414 *illval = regs[rd]; 4415 break; 4416 } 4417 *((uint64_t *)(uintptr_t)regs[rd]) = regs[r1]; 4418 break; 4419 } 4420 } 4421 4422 if (!(*flags & CPU_DTRACE_FAULT)) 4423 return (rval); 4424 4425 mstate->dtms_fltoffs = opc * sizeof (dif_instr_t); 4426 mstate->dtms_present |= DTRACE_MSTATE_FLTOFFS; 4427 4428 return (0); 4429 } 4430 4431 static void 4432 dtrace_action_breakpoint(dtrace_ecb_t *ecb) 4433 { 4434 dtrace_probe_t *probe = ecb->dte_probe; 4435 dtrace_provider_t *prov = probe->dtpr_provider; 4436 char c[DTRACE_FULLNAMELEN + 80], *str; 4437 char *msg = "dtrace: breakpoint action at probe "; 4438 char *ecbmsg = " (ecb "; 4439 uintptr_t mask = (0xf << (sizeof (uintptr_t) * NBBY / 4)); 4440 uintptr_t val = (uintptr_t)ecb; 4441 int shift = (sizeof (uintptr_t) * NBBY) - 4, i = 0; 4442 4443 if (dtrace_destructive_disallow) 4444 return; 4445 4446 /* 4447 * It's impossible to be taking action on the NULL probe. 4448 */ 4449 ASSERT(probe != NULL); 4450 4451 /* 4452 * This is a poor man's (destitute man's?) sprintf(): we want to 4453 * print the provider name, module name, function name and name of 4454 * the probe, along with the hex address of the ECB with the breakpoint 4455 * action -- all of which we must place in the character buffer by 4456 * hand. 4457 */ 4458 while (*msg != '\0') 4459 c[i++] = *msg++; 4460 4461 for (str = prov->dtpv_name; *str != '\0'; str++) 4462 c[i++] = *str; 4463 c[i++] = ':'; 4464 4465 for (str = probe->dtpr_mod; *str != '\0'; str++) 4466 c[i++] = *str; 4467 c[i++] = ':'; 4468 4469 for (str = probe->dtpr_func; *str != '\0'; str++) 4470 c[i++] = *str; 4471 c[i++] = ':'; 4472 4473 for (str = probe->dtpr_name; *str != '\0'; str++) 4474 c[i++] = *str; 4475 4476 while (*ecbmsg != '\0') 4477 c[i++] = *ecbmsg++; 4478 4479 while (shift >= 0) { 4480 mask = (uintptr_t)0xf << shift; 4481 4482 if (val >= ((uintptr_t)1 << shift)) 4483 c[i++] = "0123456789abcdef"[(val & mask) >> shift]; 4484 shift -= 4; 4485 } 4486 4487 c[i++] = ')'; 4488 c[i] = '\0'; 4489 4490 debug_enter(c); 4491 } 4492 4493 static void 4494 dtrace_action_panic(dtrace_ecb_t *ecb) 4495 { 4496 dtrace_probe_t *probe = ecb->dte_probe; 4497 4498 /* 4499 * It's impossible to be taking action on the NULL probe. 4500 */ 4501 ASSERT(probe != NULL); 4502 4503 if (dtrace_destructive_disallow) 4504 return; 4505 4506 if (dtrace_panicked != NULL) 4507 return; 4508 4509 if (dtrace_casptr(&dtrace_panicked, NULL, curthread) != NULL) 4510 return; 4511 4512 /* 4513 * We won the right to panic. (We want to be sure that only one 4514 * thread calls panic() from dtrace_probe(), and that panic() is 4515 * called exactly once.) 4516 */ 4517 dtrace_panic("dtrace: panic action at probe %s:%s:%s:%s (ecb %p)", 4518 probe->dtpr_provider->dtpv_name, probe->dtpr_mod, 4519 probe->dtpr_func, probe->dtpr_name, (void *)ecb); 4520 } 4521 4522 static void 4523 dtrace_action_raise(uint64_t sig) 4524 { 4525 if (dtrace_destructive_disallow) 4526 return; 4527 4528 if (sig >= NSIG) { 4529 DTRACE_CPUFLAG_SET(CPU_DTRACE_ILLOP); 4530 return; 4531 } 4532 4533 /* 4534 * raise() has a queue depth of 1 -- we ignore all subsequent 4535 * invocations of the raise() action. 4536 */ 4537 if (curthread->t_dtrace_sig == 0) 4538 curthread->t_dtrace_sig = (uint8_t)sig; 4539 4540 curthread->t_sig_check = 1; 4541 aston(curthread); 4542 } 4543 4544 static void 4545 dtrace_action_stop(void) 4546 { 4547 if (dtrace_destructive_disallow) 4548 return; 4549 4550 if (!curthread->t_dtrace_stop) { 4551 curthread->t_dtrace_stop = 1; 4552 curthread->t_sig_check = 1; 4553 aston(curthread); 4554 } 4555 } 4556 4557 static void 4558 dtrace_action_chill(dtrace_mstate_t *mstate, hrtime_t val) 4559 { 4560 hrtime_t now; 4561 volatile uint16_t *flags; 4562 cpu_t *cpu = CPU; 4563 4564 if (dtrace_destructive_disallow) 4565 return; 4566 4567 flags = (volatile uint16_t *)&cpu_core[cpu->cpu_id].cpuc_dtrace_flags; 4568 4569 now = dtrace_gethrtime(); 4570 4571 if (now - cpu->cpu_dtrace_chillmark > dtrace_chill_interval) { 4572 /* 4573 * We need to advance the mark to the current time. 4574 */ 4575 cpu->cpu_dtrace_chillmark = now; 4576 cpu->cpu_dtrace_chilled = 0; 4577 } 4578 4579 /* 4580 * Now check to see if the requested chill time would take us over 4581 * the maximum amount of time allowed in the chill interval. (Or 4582 * worse, if the calculation itself induces overflow.) 4583 */ 4584 if (cpu->cpu_dtrace_chilled + val > dtrace_chill_max || 4585 cpu->cpu_dtrace_chilled + val < cpu->cpu_dtrace_chilled) { 4586 *flags |= CPU_DTRACE_ILLOP; 4587 return; 4588 } 4589 4590 while (dtrace_gethrtime() - now < val) 4591 continue; 4592 4593 /* 4594 * Normally, we assure that the value of the variable "timestamp" does 4595 * not change within an ECB. The presence of chill() represents an 4596 * exception to this rule, however. 4597 */ 4598 mstate->dtms_present &= ~DTRACE_MSTATE_TIMESTAMP; 4599 cpu->cpu_dtrace_chilled += val; 4600 } 4601 4602 static void 4603 dtrace_action_ustack(dtrace_mstate_t *mstate, dtrace_state_t *state, 4604 uint64_t *buf, uint64_t arg) 4605 { 4606 int nframes = DTRACE_USTACK_NFRAMES(arg); 4607 int strsize = DTRACE_USTACK_STRSIZE(arg); 4608 uint64_t *pcs = &buf[1], *fps; 4609 char *str = (char *)&pcs[nframes]; 4610 int size, offs = 0, i, j; 4611 uintptr_t old = mstate->dtms_scratch_ptr, saved; 4612 uint16_t *flags = &cpu_core[CPU->cpu_id].cpuc_dtrace_flags; 4613 char *sym; 4614 4615 /* 4616 * Should be taking a faster path if string space has not been 4617 * allocated. 4618 */ 4619 ASSERT(strsize != 0); 4620 4621 /* 4622 * We will first allocate some temporary space for the frame pointers. 4623 */ 4624 fps = (uint64_t *)P2ROUNDUP(mstate->dtms_scratch_ptr, 8); 4625 size = (uintptr_t)fps - mstate->dtms_scratch_ptr + 4626 (nframes * sizeof (uint64_t)); 4627 4628 if (mstate->dtms_scratch_ptr + size > 4629 mstate->dtms_scratch_base + mstate->dtms_scratch_size) { 4630 /* 4631 * Not enough room for our frame pointers -- need to indicate 4632 * that we ran out of scratch space. 4633 */ 4634 DTRACE_CPUFLAG_SET(CPU_DTRACE_NOSCRATCH); 4635 return; 4636 } 4637 4638 mstate->dtms_scratch_ptr += size; 4639 saved = mstate->dtms_scratch_ptr; 4640 4641 /* 4642 * Now get a stack with both program counters and frame pointers. 4643 */ 4644 DTRACE_CPUFLAG_SET(CPU_DTRACE_NOFAULT); 4645 dtrace_getufpstack(buf, fps, nframes + 1); 4646 DTRACE_CPUFLAG_CLEAR(CPU_DTRACE_NOFAULT); 4647 4648 /* 4649 * If that faulted, we're cooked. 4650 */ 4651 if (*flags & CPU_DTRACE_FAULT) 4652 goto out; 4653 4654 /* 4655 * Now we want to walk up the stack, calling the USTACK helper. For 4656 * each iteration, we restore the scratch pointer. 4657 */ 4658 for (i = 0; i < nframes; i++) { 4659 mstate->dtms_scratch_ptr = saved; 4660 4661 if (offs >= strsize) 4662 break; 4663 4664 sym = (char *)(uintptr_t)dtrace_helper( 4665 DTRACE_HELPER_ACTION_USTACK, 4666 mstate, state, pcs[i], fps[i]); 4667 4668 /* 4669 * If we faulted while running the helper, we're going to 4670 * clear the fault and null out the corresponding string. 4671 */ 4672 if (*flags & CPU_DTRACE_FAULT) { 4673 *flags &= ~CPU_DTRACE_FAULT; 4674 str[offs++] = '\0'; 4675 continue; 4676 } 4677 4678 if (sym == NULL) { 4679 str[offs++] = '\0'; 4680 continue; 4681 } 4682 4683 DTRACE_CPUFLAG_SET(CPU_DTRACE_NOFAULT); 4684 4685 /* 4686 * Now copy in the string that the helper returned to us. 4687 */ 4688 for (j = 0; offs + j < strsize; j++) { 4689 if ((str[offs + j] = sym[j]) == '\0') 4690 break; 4691 } 4692 4693 DTRACE_CPUFLAG_CLEAR(CPU_DTRACE_NOFAULT); 4694 4695 offs += j + 1; 4696 } 4697 4698 if (offs >= strsize) { 4699 /* 4700 * If we didn't have room for all of the strings, we don't 4701 * abort processing -- this needn't be a fatal error -- but we 4702 * still want to increment a counter (dts_stkstroverflows) to 4703 * allow this condition to be warned about. (If this is from 4704 * a jstack() action, it is easily tuned via jstackstrsize.) 4705 */ 4706 dtrace_error(&state->dts_stkstroverflows); 4707 } 4708 4709 while (offs < strsize) 4710 str[offs++] = '\0'; 4711 4712 out: 4713 mstate->dtms_scratch_ptr = old; 4714 } 4715 4716 /* 4717 * If you're looking for the epicenter of DTrace, you just found it. This 4718 * is the function called by the provider to fire a probe -- from which all 4719 * subsequent probe-context DTrace activity emanates. 4720 */ 4721 void 4722 dtrace_probe(dtrace_id_t id, uintptr_t arg0, uintptr_t arg1, 4723 uintptr_t arg2, uintptr_t arg3, uintptr_t arg4) 4724 { 4725 processorid_t cpuid; 4726 dtrace_icookie_t cookie; 4727 dtrace_probe_t *probe; 4728 dtrace_mstate_t mstate; 4729 dtrace_ecb_t *ecb; 4730 dtrace_action_t *act; 4731 intptr_t offs; 4732 size_t size; 4733 int vtime, onintr; 4734 volatile uint16_t *flags; 4735 hrtime_t now; 4736 4737 /* 4738 * Kick out immediately if this CPU is still being born (in which case 4739 * curthread will be set to -1) 4740 */ 4741 if ((uintptr_t)curthread & 1) 4742 return; 4743 4744 cookie = dtrace_interrupt_disable(); 4745 probe = dtrace_probes[id - 1]; 4746 cpuid = CPU->cpu_id; 4747 onintr = CPU_ON_INTR(CPU); 4748 4749 if (!onintr && probe->dtpr_predcache != DTRACE_CACHEIDNONE && 4750 probe->dtpr_predcache == curthread->t_predcache) { 4751 /* 4752 * We have hit in the predicate cache; we know that 4753 * this predicate would evaluate to be false. 4754 */ 4755 dtrace_interrupt_enable(cookie); 4756 return; 4757 } 4758 4759 if (panic_quiesce) { 4760 /* 4761 * We don't trace anything if we're panicking. 4762 */ 4763 dtrace_interrupt_enable(cookie); 4764 return; 4765 } 4766 4767 now = dtrace_gethrtime(); 4768 vtime = dtrace_vtime_references != 0; 4769 4770 if (vtime && curthread->t_dtrace_start) 4771 curthread->t_dtrace_vtime += now - curthread->t_dtrace_start; 4772 4773 mstate.dtms_probe = probe; 4774 mstate.dtms_arg[0] = arg0; 4775 mstate.dtms_arg[1] = arg1; 4776 mstate.dtms_arg[2] = arg2; 4777 mstate.dtms_arg[3] = arg3; 4778 mstate.dtms_arg[4] = arg4; 4779 4780 flags = (volatile uint16_t *)&cpu_core[cpuid].cpuc_dtrace_flags; 4781 4782 for (ecb = probe->dtpr_ecb; ecb != NULL; ecb = ecb->dte_next) { 4783 dtrace_predicate_t *pred = ecb->dte_predicate; 4784 dtrace_state_t *state = ecb->dte_state; 4785 dtrace_buffer_t *buf = &state->dts_buffer[cpuid]; 4786 dtrace_buffer_t *aggbuf = &state->dts_aggbuffer[cpuid]; 4787 dtrace_vstate_t *vstate = &state->dts_vstate; 4788 dtrace_provider_t *prov = probe->dtpr_provider; 4789 int committed = 0; 4790 caddr_t tomax; 4791 4792 /* 4793 * A little subtlety with the following (seemingly innocuous) 4794 * declaration of the automatic 'val': by looking at the 4795 * code, you might think that it could be declared in the 4796 * action processing loop, below. (That is, it's only used in 4797 * the action processing loop.) However, it must be declared 4798 * out of that scope because in the case of DIF expression 4799 * arguments to aggregating actions, one iteration of the 4800 * action loop will use the last iteration's value. 4801 */ 4802 #ifdef lint 4803 uint64_t val = 0; 4804 #else 4805 uint64_t val; 4806 #endif 4807 4808 mstate.dtms_present = DTRACE_MSTATE_ARGS | DTRACE_MSTATE_PROBE; 4809 *flags &= ~CPU_DTRACE_ERROR; 4810 4811 if (prov == dtrace_provider) { 4812 /* 4813 * If dtrace itself is the provider of this probe, 4814 * we're only going to continue processing the ECB if 4815 * arg0 (the dtrace_state_t) is equal to the ECB's 4816 * creating state. (This prevents disjoint consumers 4817 * from seeing one another's metaprobes.) 4818 */ 4819 if (arg0 != (uint64_t)(uintptr_t)state) 4820 continue; 4821 } 4822 4823 if (state->dts_activity != DTRACE_ACTIVITY_ACTIVE) { 4824 /* 4825 * We're not currently active. If our provider isn't 4826 * the dtrace pseudo provider, we're not interested. 4827 */ 4828 if (prov != dtrace_provider) 4829 continue; 4830 4831 /* 4832 * Now we must further check if we are in the BEGIN 4833 * probe. If we are, we will only continue processing 4834 * if we're still in WARMUP -- if one BEGIN enabling 4835 * has invoked the exit() action, we don't want to 4836 * evaluate subsequent BEGIN enablings. 4837 */ 4838 if (probe->dtpr_id == dtrace_probeid_begin && 4839 state->dts_activity != DTRACE_ACTIVITY_WARMUP) { 4840 ASSERT(state->dts_activity == 4841 DTRACE_ACTIVITY_DRAINING); 4842 continue; 4843 } 4844 } 4845 4846 if (ecb->dte_cond) { 4847 /* 4848 * If the dte_cond bits indicate that this 4849 * consumer is only allowed to see user-mode firings 4850 * of this probe, call the provider's dtps_usermode() 4851 * entry point to check that the probe was fired 4852 * while in a user context. Skip this ECB if that's 4853 * not the case. 4854 */ 4855 if ((ecb->dte_cond & DTRACE_COND_USERMODE) && 4856 prov->dtpv_pops.dtps_usermode(prov->dtpv_arg, 4857 probe->dtpr_id, probe->dtpr_arg) == 0) 4858 continue; 4859 4860 /* 4861 * This is more subtle than it looks. We have to be 4862 * absolutely certain that CRED() isn't going to 4863 * change out from under us so it's only legit to 4864 * examine that structure if we're in constrained 4865 * situations. Currently, the only times we'll this 4866 * check is if a non-super-user has enabled the 4867 * profile or syscall providers -- providers that 4868 * allow visibility of all processes. For the 4869 * profile case, the check above will ensure that 4870 * we're examining a user context. 4871 */ 4872 if (ecb->dte_cond & DTRACE_COND_OWNER) { 4873 cred_t *cr; 4874 cred_t *s_cr = 4875 ecb->dte_state->dts_cred.dcr_cred; 4876 proc_t *proc; 4877 4878 ASSERT(s_cr != NULL); 4879 4880 if ((cr = CRED()) == NULL || 4881 s_cr->cr_uid != cr->cr_uid || 4882 s_cr->cr_uid != cr->cr_ruid || 4883 s_cr->cr_uid != cr->cr_suid || 4884 s_cr->cr_gid != cr->cr_gid || 4885 s_cr->cr_gid != cr->cr_rgid || 4886 s_cr->cr_gid != cr->cr_sgid || 4887 (proc = ttoproc(curthread)) == NULL || 4888 (proc->p_flag & SNOCD)) 4889 continue; 4890 } 4891 4892 if (ecb->dte_cond & DTRACE_COND_ZONEOWNER) { 4893 cred_t *cr; 4894 cred_t *s_cr = 4895 ecb->dte_state->dts_cred.dcr_cred; 4896 4897 ASSERT(s_cr != NULL); 4898 4899 if ((cr = CRED()) == NULL || 4900 s_cr->cr_zone->zone_id != 4901 cr->cr_zone->zone_id) 4902 continue; 4903 } 4904 } 4905 4906 if (now - state->dts_alive > dtrace_deadman_timeout) { 4907 /* 4908 * We seem to be dead. Unless we (a) have kernel 4909 * destructive permissions (b) have expicitly enabled 4910 * destructive actions and (c) destructive actions have 4911 * not been disabled, we're going to transition into 4912 * the KILLED state, from which no further processing 4913 * on this state will be performed. 4914 */ 4915 if (!dtrace_priv_kernel_destructive(state) || 4916 !state->dts_cred.dcr_destructive || 4917 dtrace_destructive_disallow) { 4918 void *activity = &state->dts_activity; 4919 dtrace_activity_t current; 4920 4921 do { 4922 current = state->dts_activity; 4923 } while (dtrace_cas32(activity, current, 4924 DTRACE_ACTIVITY_KILLED) != current); 4925 4926 continue; 4927 } 4928 } 4929 4930 if ((offs = dtrace_buffer_reserve(buf, ecb->dte_needed, 4931 ecb->dte_alignment, state, &mstate)) < 0) 4932 continue; 4933 4934 tomax = buf->dtb_tomax; 4935 ASSERT(tomax != NULL); 4936 4937 if (ecb->dte_size != 0) 4938 DTRACE_STORE(uint32_t, tomax, offs, ecb->dte_epid); 4939 4940 mstate.dtms_epid = ecb->dte_epid; 4941 mstate.dtms_present |= DTRACE_MSTATE_EPID; 4942 4943 if (pred != NULL) { 4944 dtrace_difo_t *dp = pred->dtp_difo; 4945 int rval; 4946 4947 rval = dtrace_dif_emulate(dp, &mstate, vstate, state); 4948 4949 if (!(*flags & CPU_DTRACE_ERROR) && !rval) { 4950 dtrace_cacheid_t cid = probe->dtpr_predcache; 4951 4952 if (cid != DTRACE_CACHEIDNONE && !onintr) { 4953 /* 4954 * Update the predicate cache... 4955 */ 4956 ASSERT(cid == pred->dtp_cacheid); 4957 curthread->t_predcache = cid; 4958 } 4959 4960 continue; 4961 } 4962 } 4963 4964 for (act = ecb->dte_action; !(*flags & CPU_DTRACE_ERROR) && 4965 act != NULL; act = act->dta_next) { 4966 size_t valoffs; 4967 dtrace_difo_t *dp; 4968 dtrace_recdesc_t *rec = &act->dta_rec; 4969 4970 size = rec->dtrd_size; 4971 valoffs = offs + rec->dtrd_offset; 4972 4973 if (DTRACEACT_ISAGG(act->dta_kind)) { 4974 uint64_t v = 0xbad; 4975 dtrace_aggregation_t *agg; 4976 4977 agg = (dtrace_aggregation_t *)act; 4978 4979 if ((dp = act->dta_difo) != NULL) 4980 v = dtrace_dif_emulate(dp, 4981 &mstate, vstate, state); 4982 4983 if (*flags & CPU_DTRACE_ERROR) 4984 continue; 4985 4986 /* 4987 * Note that we always pass the expression 4988 * value from the previous iteration of the 4989 * action loop. This value will only be used 4990 * if there is an expression argument to the 4991 * aggregating action, denoted by the 4992 * dtag_hasarg field. 4993 */ 4994 dtrace_aggregate(agg, buf, 4995 offs, aggbuf, v, val); 4996 continue; 4997 } 4998 4999 switch (act->dta_kind) { 5000 case DTRACEACT_STOP: 5001 if (dtrace_priv_proc_destructive(state)) 5002 dtrace_action_stop(); 5003 continue; 5004 5005 case DTRACEACT_BREAKPOINT: 5006 if (dtrace_priv_kernel_destructive(state)) 5007 dtrace_action_breakpoint(ecb); 5008 continue; 5009 5010 case DTRACEACT_PANIC: 5011 if (dtrace_priv_kernel_destructive(state)) 5012 dtrace_action_panic(ecb); 5013 continue; 5014 5015 case DTRACEACT_STACK: 5016 if (!dtrace_priv_kernel(state)) 5017 continue; 5018 5019 dtrace_getpcstack((pc_t *)(tomax + valoffs), 5020 size / sizeof (pc_t), probe->dtpr_aframes, 5021 DTRACE_ANCHORED(probe) ? NULL : 5022 (uint32_t *)arg0); 5023 5024 continue; 5025 5026 case DTRACEACT_JSTACK: 5027 case DTRACEACT_USTACK: 5028 if (!dtrace_priv_proc(state)) 5029 continue; 5030 5031 /* 5032 * See comment in DIF_VAR_PID. 5033 */ 5034 if (DTRACE_ANCHORED(mstate.dtms_probe) && 5035 CPU_ON_INTR(CPU)) { 5036 int depth = DTRACE_USTACK_NFRAMES( 5037 rec->dtrd_arg) + 1; 5038 5039 dtrace_bzero((void *)(tomax + valoffs), 5040 DTRACE_USTACK_STRSIZE(rec->dtrd_arg) 5041 + depth * sizeof (uint64_t)); 5042 5043 continue; 5044 } 5045 5046 if (DTRACE_USTACK_STRSIZE(rec->dtrd_arg) != 0 && 5047 curproc->p_dtrace_helpers != NULL) { 5048 /* 5049 * This is the slow path -- we have 5050 * allocated string space, and we're 5051 * getting the stack of a process that 5052 * has helpers. Call into a separate 5053 * routine to perform this processing. 5054 */ 5055 dtrace_action_ustack(&mstate, state, 5056 (uint64_t *)(tomax + valoffs), 5057 rec->dtrd_arg); 5058 continue; 5059 } 5060 5061 DTRACE_CPUFLAG_SET(CPU_DTRACE_NOFAULT); 5062 dtrace_getupcstack((uint64_t *) 5063 (tomax + valoffs), 5064 DTRACE_USTACK_NFRAMES(rec->dtrd_arg) + 1); 5065 DTRACE_CPUFLAG_CLEAR(CPU_DTRACE_NOFAULT); 5066 continue; 5067 5068 default: 5069 break; 5070 } 5071 5072 dp = act->dta_difo; 5073 ASSERT(dp != NULL); 5074 5075 val = dtrace_dif_emulate(dp, &mstate, vstate, state); 5076 5077 if (*flags & CPU_DTRACE_ERROR) 5078 continue; 5079 5080 switch (act->dta_kind) { 5081 case DTRACEACT_SPECULATE: 5082 ASSERT(buf == &state->dts_buffer[cpuid]); 5083 buf = dtrace_speculation_buffer(state, 5084 cpuid, val); 5085 5086 if (buf == NULL) { 5087 *flags |= CPU_DTRACE_DROP; 5088 continue; 5089 } 5090 5091 offs = dtrace_buffer_reserve(buf, 5092 ecb->dte_needed, ecb->dte_alignment, 5093 state, NULL); 5094 5095 if (offs < 0) { 5096 *flags |= CPU_DTRACE_DROP; 5097 continue; 5098 } 5099 5100 tomax = buf->dtb_tomax; 5101 ASSERT(tomax != NULL); 5102 5103 if (ecb->dte_size != 0) 5104 DTRACE_STORE(uint32_t, tomax, offs, 5105 ecb->dte_epid); 5106 continue; 5107 5108 case DTRACEACT_CHILL: 5109 if (dtrace_priv_kernel_destructive(state)) 5110 dtrace_action_chill(&mstate, val); 5111 continue; 5112 5113 case DTRACEACT_RAISE: 5114 if (dtrace_priv_proc_destructive(state)) 5115 dtrace_action_raise(val); 5116 continue; 5117 5118 case DTRACEACT_COMMIT: 5119 ASSERT(!committed); 5120 5121 /* 5122 * We need to commit our buffer state. 5123 */ 5124 if (ecb->dte_size) 5125 buf->dtb_offset = offs + ecb->dte_size; 5126 buf = &state->dts_buffer[cpuid]; 5127 dtrace_speculation_commit(state, cpuid, val); 5128 committed = 1; 5129 continue; 5130 5131 case DTRACEACT_DISCARD: 5132 dtrace_speculation_discard(state, cpuid, val); 5133 continue; 5134 5135 case DTRACEACT_DIFEXPR: 5136 case DTRACEACT_LIBACT: 5137 case DTRACEACT_PRINTF: 5138 case DTRACEACT_PRINTA: 5139 case DTRACEACT_SYSTEM: 5140 case DTRACEACT_FREOPEN: 5141 break; 5142 5143 case DTRACEACT_SYM: 5144 case DTRACEACT_MOD: 5145 if (!dtrace_priv_kernel(state)) 5146 continue; 5147 break; 5148 5149 case DTRACEACT_USYM: 5150 case DTRACEACT_UMOD: 5151 case DTRACEACT_UADDR: { 5152 struct pid *pid = curthread->t_procp->p_pidp; 5153 5154 if (!dtrace_priv_proc(state)) 5155 continue; 5156 5157 DTRACE_STORE(uint64_t, tomax, 5158 valoffs, (uint64_t)pid->pid_id); 5159 DTRACE_STORE(uint64_t, tomax, 5160 valoffs + sizeof (uint64_t), val); 5161 5162 continue; 5163 } 5164 5165 case DTRACEACT_EXIT: { 5166 /* 5167 * For the exit action, we are going to attempt 5168 * to atomically set our activity to be 5169 * draining. If this fails (either because 5170 * another CPU has beat us to the exit action, 5171 * or because our current activity is something 5172 * other than ACTIVE or WARMUP), we will 5173 * continue. This assures that the exit action 5174 * can be successfully recorded at most once 5175 * when we're in the ACTIVE state. If we're 5176 * encountering the exit() action while in 5177 * COOLDOWN, however, we want to honor the new 5178 * status code. (We know that we're the only 5179 * thread in COOLDOWN, so there is no race.) 5180 */ 5181 void *activity = &state->dts_activity; 5182 dtrace_activity_t current = state->dts_activity; 5183 5184 if (current == DTRACE_ACTIVITY_COOLDOWN) 5185 break; 5186 5187 if (current != DTRACE_ACTIVITY_WARMUP) 5188 current = DTRACE_ACTIVITY_ACTIVE; 5189 5190 if (dtrace_cas32(activity, current, 5191 DTRACE_ACTIVITY_DRAINING) != current) { 5192 *flags |= CPU_DTRACE_DROP; 5193 continue; 5194 } 5195 5196 break; 5197 } 5198 5199 default: 5200 ASSERT(0); 5201 } 5202 5203 if (dp->dtdo_rtype.dtdt_flags & DIF_TF_BYREF) { 5204 uintptr_t end = valoffs + size; 5205 5206 /* 5207 * If this is a string, we're going to only 5208 * load until we find the zero byte -- after 5209 * which we'll store zero bytes. 5210 */ 5211 if (dp->dtdo_rtype.dtdt_kind == 5212 DIF_TYPE_STRING) { 5213 char c = '\0' + 1; 5214 int intuple = act->dta_intuple; 5215 size_t s; 5216 5217 for (s = 0; s < size; s++) { 5218 if (c != '\0') 5219 c = dtrace_load8(val++); 5220 5221 DTRACE_STORE(uint8_t, tomax, 5222 valoffs++, c); 5223 5224 if (c == '\0' && intuple) 5225 break; 5226 } 5227 5228 continue; 5229 } 5230 5231 while (valoffs < end) { 5232 DTRACE_STORE(uint8_t, tomax, valoffs++, 5233 dtrace_load8(val++)); 5234 } 5235 5236 continue; 5237 } 5238 5239 switch (size) { 5240 case 0: 5241 break; 5242 5243 case sizeof (uint8_t): 5244 DTRACE_STORE(uint8_t, tomax, valoffs, val); 5245 break; 5246 case sizeof (uint16_t): 5247 DTRACE_STORE(uint16_t, tomax, valoffs, val); 5248 break; 5249 case sizeof (uint32_t): 5250 DTRACE_STORE(uint32_t, tomax, valoffs, val); 5251 break; 5252 case sizeof (uint64_t): 5253 DTRACE_STORE(uint64_t, tomax, valoffs, val); 5254 break; 5255 default: 5256 /* 5257 * Any other size should have been returned by 5258 * reference, not by value. 5259 */ 5260 ASSERT(0); 5261 break; 5262 } 5263 } 5264 5265 if (*flags & CPU_DTRACE_DROP) 5266 continue; 5267 5268 if (*flags & CPU_DTRACE_FAULT) { 5269 int ndx; 5270 dtrace_action_t *err; 5271 5272 buf->dtb_errors++; 5273 5274 if (probe->dtpr_id == dtrace_probeid_error) { 5275 /* 5276 * There's nothing we can do -- we had an 5277 * error on the error probe. We bump an 5278 * error counter to at least indicate that 5279 * this condition happened. 5280 */ 5281 dtrace_error(&state->dts_dblerrors); 5282 continue; 5283 } 5284 5285 if (vtime) { 5286 /* 5287 * Before recursing on dtrace_probe(), we 5288 * need to explicitly clear out our start 5289 * time to prevent it from being accumulated 5290 * into t_dtrace_vtime. 5291 */ 5292 curthread->t_dtrace_start = 0; 5293 } 5294 5295 /* 5296 * Iterate over the actions to figure out which action 5297 * we were processing when we experienced the error. 5298 * Note that act points _past_ the faulting action; if 5299 * act is ecb->dte_action, the fault was in the 5300 * predicate, if it's ecb->dte_action->dta_next it's 5301 * in action #1, and so on. 5302 */ 5303 for (err = ecb->dte_action, ndx = 0; 5304 err != act; err = err->dta_next, ndx++) 5305 continue; 5306 5307 dtrace_probe_error(state, ecb->dte_epid, ndx, 5308 (mstate.dtms_present & DTRACE_MSTATE_FLTOFFS) ? 5309 mstate.dtms_fltoffs : -1, DTRACE_FLAGS2FLT(*flags), 5310 cpu_core[cpuid].cpuc_dtrace_illval); 5311 5312 continue; 5313 } 5314 5315 if (!committed) 5316 buf->dtb_offset = offs + ecb->dte_size; 5317 } 5318 5319 if (vtime) 5320 curthread->t_dtrace_start = dtrace_gethrtime(); 5321 5322 dtrace_interrupt_enable(cookie); 5323 } 5324 5325 /* 5326 * DTrace Probe Hashing Functions 5327 * 5328 * The functions in this section (and indeed, the functions in remaining 5329 * sections) are not _called_ from probe context. (Any exceptions to this are 5330 * marked with a "Note:".) Rather, they are called from elsewhere in the 5331 * DTrace framework to look-up probes in, add probes to and remove probes from 5332 * the DTrace probe hashes. (Each probe is hashed by each element of the 5333 * probe tuple -- allowing for fast lookups, regardless of what was 5334 * specified.) 5335 */ 5336 static uint_t 5337 dtrace_hash_str(char *p) 5338 { 5339 unsigned int g; 5340 uint_t hval = 0; 5341 5342 while (*p) { 5343 hval = (hval << 4) + *p++; 5344 if ((g = (hval & 0xf0000000)) != 0) 5345 hval ^= g >> 24; 5346 hval &= ~g; 5347 } 5348 return (hval); 5349 } 5350 5351 static dtrace_hash_t * 5352 dtrace_hash_create(uintptr_t stroffs, uintptr_t nextoffs, uintptr_t prevoffs) 5353 { 5354 dtrace_hash_t *hash = kmem_zalloc(sizeof (dtrace_hash_t), KM_SLEEP); 5355 5356 hash->dth_stroffs = stroffs; 5357 hash->dth_nextoffs = nextoffs; 5358 hash->dth_prevoffs = prevoffs; 5359 5360 hash->dth_size = 1; 5361 hash->dth_mask = hash->dth_size - 1; 5362 5363 hash->dth_tab = kmem_zalloc(hash->dth_size * 5364 sizeof (dtrace_hashbucket_t *), KM_SLEEP); 5365 5366 return (hash); 5367 } 5368 5369 static void 5370 dtrace_hash_destroy(dtrace_hash_t *hash) 5371 { 5372 #ifdef DEBUG 5373 int i; 5374 5375 for (i = 0; i < hash->dth_size; i++) 5376 ASSERT(hash->dth_tab[i] == NULL); 5377 #endif 5378 5379 kmem_free(hash->dth_tab, 5380 hash->dth_size * sizeof (dtrace_hashbucket_t *)); 5381 kmem_free(hash, sizeof (dtrace_hash_t)); 5382 } 5383 5384 static void 5385 dtrace_hash_resize(dtrace_hash_t *hash) 5386 { 5387 int size = hash->dth_size, i, ndx; 5388 int new_size = hash->dth_size << 1; 5389 int new_mask = new_size - 1; 5390 dtrace_hashbucket_t **new_tab, *bucket, *next; 5391 5392 ASSERT((new_size & new_mask) == 0); 5393 5394 new_tab = kmem_zalloc(new_size * sizeof (void *), KM_SLEEP); 5395 5396 for (i = 0; i < size; i++) { 5397 for (bucket = hash->dth_tab[i]; bucket != NULL; bucket = next) { 5398 dtrace_probe_t *probe = bucket->dthb_chain; 5399 5400 ASSERT(probe != NULL); 5401 ndx = DTRACE_HASHSTR(hash, probe) & new_mask; 5402 5403 next = bucket->dthb_next; 5404 bucket->dthb_next = new_tab[ndx]; 5405 new_tab[ndx] = bucket; 5406 } 5407 } 5408 5409 kmem_free(hash->dth_tab, hash->dth_size * sizeof (void *)); 5410 hash->dth_tab = new_tab; 5411 hash->dth_size = new_size; 5412 hash->dth_mask = new_mask; 5413 } 5414 5415 static void 5416 dtrace_hash_add(dtrace_hash_t *hash, dtrace_probe_t *new) 5417 { 5418 int hashval = DTRACE_HASHSTR(hash, new); 5419 int ndx = hashval & hash->dth_mask; 5420 dtrace_hashbucket_t *bucket = hash->dth_tab[ndx]; 5421 dtrace_probe_t **nextp, **prevp; 5422 5423 for (; bucket != NULL; bucket = bucket->dthb_next) { 5424 if (DTRACE_HASHEQ(hash, bucket->dthb_chain, new)) 5425 goto add; 5426 } 5427 5428 if ((hash->dth_nbuckets >> 1) > hash->dth_size) { 5429 dtrace_hash_resize(hash); 5430 dtrace_hash_add(hash, new); 5431 return; 5432 } 5433 5434 bucket = kmem_zalloc(sizeof (dtrace_hashbucket_t), KM_SLEEP); 5435 bucket->dthb_next = hash->dth_tab[ndx]; 5436 hash->dth_tab[ndx] = bucket; 5437 hash->dth_nbuckets++; 5438 5439 add: 5440 nextp = DTRACE_HASHNEXT(hash, new); 5441 ASSERT(*nextp == NULL && *(DTRACE_HASHPREV(hash, new)) == NULL); 5442 *nextp = bucket->dthb_chain; 5443 5444 if (bucket->dthb_chain != NULL) { 5445 prevp = DTRACE_HASHPREV(hash, bucket->dthb_chain); 5446 ASSERT(*prevp == NULL); 5447 *prevp = new; 5448 } 5449 5450 bucket->dthb_chain = new; 5451 bucket->dthb_len++; 5452 } 5453 5454 static dtrace_probe_t * 5455 dtrace_hash_lookup(dtrace_hash_t *hash, dtrace_probe_t *template) 5456 { 5457 int hashval = DTRACE_HASHSTR(hash, template); 5458 int ndx = hashval & hash->dth_mask; 5459 dtrace_hashbucket_t *bucket = hash->dth_tab[ndx]; 5460 5461 for (; bucket != NULL; bucket = bucket->dthb_next) { 5462 if (DTRACE_HASHEQ(hash, bucket->dthb_chain, template)) 5463 return (bucket->dthb_chain); 5464 } 5465 5466 return (NULL); 5467 } 5468 5469 static int 5470 dtrace_hash_collisions(dtrace_hash_t *hash, dtrace_probe_t *template) 5471 { 5472 int hashval = DTRACE_HASHSTR(hash, template); 5473 int ndx = hashval & hash->dth_mask; 5474 dtrace_hashbucket_t *bucket = hash->dth_tab[ndx]; 5475 5476 for (; bucket != NULL; bucket = bucket->dthb_next) { 5477 if (DTRACE_HASHEQ(hash, bucket->dthb_chain, template)) 5478 return (bucket->dthb_len); 5479 } 5480 5481 return (NULL); 5482 } 5483 5484 static void 5485 dtrace_hash_remove(dtrace_hash_t *hash, dtrace_probe_t *probe) 5486 { 5487 int ndx = DTRACE_HASHSTR(hash, probe) & hash->dth_mask; 5488 dtrace_hashbucket_t *bucket = hash->dth_tab[ndx]; 5489 5490 dtrace_probe_t **prevp = DTRACE_HASHPREV(hash, probe); 5491 dtrace_probe_t **nextp = DTRACE_HASHNEXT(hash, probe); 5492 5493 /* 5494 * Find the bucket that we're removing this probe from. 5495 */ 5496 for (; bucket != NULL; bucket = bucket->dthb_next) { 5497 if (DTRACE_HASHEQ(hash, bucket->dthb_chain, probe)) 5498 break; 5499 } 5500 5501 ASSERT(bucket != NULL); 5502 5503 if (*prevp == NULL) { 5504 if (*nextp == NULL) { 5505 /* 5506 * The removed probe was the only probe on this 5507 * bucket; we need to remove the bucket. 5508 */ 5509 dtrace_hashbucket_t *b = hash->dth_tab[ndx]; 5510 5511 ASSERT(bucket->dthb_chain == probe); 5512 ASSERT(b != NULL); 5513 5514 if (b == bucket) { 5515 hash->dth_tab[ndx] = bucket->dthb_next; 5516 } else { 5517 while (b->dthb_next != bucket) 5518 b = b->dthb_next; 5519 b->dthb_next = bucket->dthb_next; 5520 } 5521 5522 ASSERT(hash->dth_nbuckets > 0); 5523 hash->dth_nbuckets--; 5524 kmem_free(bucket, sizeof (dtrace_hashbucket_t)); 5525 return; 5526 } 5527 5528 bucket->dthb_chain = *nextp; 5529 } else { 5530 *(DTRACE_HASHNEXT(hash, *prevp)) = *nextp; 5531 } 5532 5533 if (*nextp != NULL) 5534 *(DTRACE_HASHPREV(hash, *nextp)) = *prevp; 5535 } 5536 5537 /* 5538 * DTrace Utility Functions 5539 * 5540 * These are random utility functions that are _not_ called from probe context. 5541 */ 5542 static int 5543 dtrace_badattr(const dtrace_attribute_t *a) 5544 { 5545 return (a->dtat_name > DTRACE_STABILITY_MAX || 5546 a->dtat_data > DTRACE_STABILITY_MAX || 5547 a->dtat_class > DTRACE_CLASS_MAX); 5548 } 5549 5550 /* 5551 * Return a duplicate copy of a string. If the specified string is NULL, 5552 * this function returns a zero-length string. 5553 */ 5554 static char * 5555 dtrace_strdup(const char *str) 5556 { 5557 char *new = kmem_zalloc((str != NULL ? strlen(str) : 0) + 1, KM_SLEEP); 5558 5559 if (str != NULL) 5560 (void) strcpy(new, str); 5561 5562 return (new); 5563 } 5564 5565 #define DTRACE_ISALPHA(c) \ 5566 (((c) >= 'a' && (c) <= 'z') || ((c) >= 'A' && (c) <= 'Z')) 5567 5568 static int 5569 dtrace_badname(const char *s) 5570 { 5571 char c; 5572 5573 if (s == NULL || (c = *s++) == '\0') 5574 return (0); 5575 5576 if (!DTRACE_ISALPHA(c) && c != '-' && c != '_' && c != '.') 5577 return (1); 5578 5579 while ((c = *s++) != '\0') { 5580 if (!DTRACE_ISALPHA(c) && (c < '0' || c > '9') && 5581 c != '-' && c != '_' && c != '.' && c != '`') 5582 return (1); 5583 } 5584 5585 return (0); 5586 } 5587 5588 static void 5589 dtrace_cred2priv(cred_t *cr, uint32_t *privp, uid_t *uidp, zoneid_t *zoneidp) 5590 { 5591 uint32_t priv; 5592 5593 if (cr == NULL || PRIV_POLICY_ONLY(cr, PRIV_ALL, B_FALSE)) { 5594 /* 5595 * For DTRACE_PRIV_ALL, the uid and zoneid don't matter. 5596 */ 5597 priv = DTRACE_PRIV_ALL; 5598 } else { 5599 *uidp = crgetuid(cr); 5600 *zoneidp = crgetzoneid(cr); 5601 5602 priv = 0; 5603 if (PRIV_POLICY_ONLY(cr, PRIV_DTRACE_KERNEL, B_FALSE)) 5604 priv |= DTRACE_PRIV_KERNEL | DTRACE_PRIV_USER; 5605 else if (PRIV_POLICY_ONLY(cr, PRIV_DTRACE_USER, B_FALSE)) 5606 priv |= DTRACE_PRIV_USER; 5607 if (PRIV_POLICY_ONLY(cr, PRIV_DTRACE_PROC, B_FALSE)) 5608 priv |= DTRACE_PRIV_PROC; 5609 if (PRIV_POLICY_ONLY(cr, PRIV_PROC_OWNER, B_FALSE)) 5610 priv |= DTRACE_PRIV_OWNER; 5611 if (PRIV_POLICY_ONLY(cr, PRIV_PROC_ZONE, B_FALSE)) 5612 priv |= DTRACE_PRIV_ZONEOWNER; 5613 } 5614 5615 *privp = priv; 5616 } 5617 5618 #ifdef DTRACE_ERRDEBUG 5619 static void 5620 dtrace_errdebug(const char *str) 5621 { 5622 int hval = dtrace_hash_str((char *)str) % DTRACE_ERRHASHSZ; 5623 int occupied = 0; 5624 5625 mutex_enter(&dtrace_errlock); 5626 dtrace_errlast = str; 5627 dtrace_errthread = curthread; 5628 5629 while (occupied++ < DTRACE_ERRHASHSZ) { 5630 if (dtrace_errhash[hval].dter_msg == str) { 5631 dtrace_errhash[hval].dter_count++; 5632 goto out; 5633 } 5634 5635 if (dtrace_errhash[hval].dter_msg != NULL) { 5636 hval = (hval + 1) % DTRACE_ERRHASHSZ; 5637 continue; 5638 } 5639 5640 dtrace_errhash[hval].dter_msg = str; 5641 dtrace_errhash[hval].dter_count = 1; 5642 goto out; 5643 } 5644 5645 panic("dtrace: undersized error hash"); 5646 out: 5647 mutex_exit(&dtrace_errlock); 5648 } 5649 #endif 5650 5651 /* 5652 * DTrace Matching Functions 5653 * 5654 * These functions are used to match groups of probes, given some elements of 5655 * a probe tuple, or some globbed expressions for elements of a probe tuple. 5656 */ 5657 static int 5658 dtrace_match_priv(const dtrace_probe_t *prp, uint32_t priv, uid_t uid, 5659 zoneid_t zoneid) 5660 { 5661 if (priv != DTRACE_PRIV_ALL) { 5662 uint32_t ppriv = prp->dtpr_provider->dtpv_priv.dtpp_flags; 5663 uint32_t match = priv & ppriv; 5664 5665 /* 5666 * No PRIV_DTRACE_* privileges... 5667 */ 5668 if ((priv & (DTRACE_PRIV_PROC | DTRACE_PRIV_USER | 5669 DTRACE_PRIV_KERNEL)) == 0) 5670 return (0); 5671 5672 /* 5673 * No matching bits, but there were bits to match... 5674 */ 5675 if (match == 0 && ppriv != 0) 5676 return (0); 5677 5678 /* 5679 * Need to have permissions to the process, but don't... 5680 */ 5681 if (((ppriv & ~match) & DTRACE_PRIV_OWNER) != 0 && 5682 uid != prp->dtpr_provider->dtpv_priv.dtpp_uid) { 5683 return (0); 5684 } 5685 5686 /* 5687 * Need to be in the same zone unless we possess the 5688 * privilege to examine all zones. 5689 */ 5690 if (((ppriv & ~match) & DTRACE_PRIV_ZONEOWNER) != 0 && 5691 zoneid != prp->dtpr_provider->dtpv_priv.dtpp_zoneid) { 5692 return (0); 5693 } 5694 } 5695 5696 return (1); 5697 } 5698 5699 /* 5700 * dtrace_match_probe compares a dtrace_probe_t to a pre-compiled key, which 5701 * consists of input pattern strings and an ops-vector to evaluate them. 5702 * This function returns >0 for match, 0 for no match, and <0 for error. 5703 */ 5704 static int 5705 dtrace_match_probe(const dtrace_probe_t *prp, const dtrace_probekey_t *pkp, 5706 uint32_t priv, uid_t uid, zoneid_t zoneid) 5707 { 5708 dtrace_provider_t *pvp = prp->dtpr_provider; 5709 int rv; 5710 5711 if (pvp->dtpv_defunct) 5712 return (0); 5713 5714 if ((rv = pkp->dtpk_pmatch(pvp->dtpv_name, pkp->dtpk_prov, 0)) <= 0) 5715 return (rv); 5716 5717 if ((rv = pkp->dtpk_mmatch(prp->dtpr_mod, pkp->dtpk_mod, 0)) <= 0) 5718 return (rv); 5719 5720 if ((rv = pkp->dtpk_fmatch(prp->dtpr_func, pkp->dtpk_func, 0)) <= 0) 5721 return (rv); 5722 5723 if ((rv = pkp->dtpk_nmatch(prp->dtpr_name, pkp->dtpk_name, 0)) <= 0) 5724 return (rv); 5725 5726 if (dtrace_match_priv(prp, priv, uid, zoneid) == 0) 5727 return (0); 5728 5729 return (rv); 5730 } 5731 5732 /* 5733 * dtrace_match_glob() is a safe kernel implementation of the gmatch(3GEN) 5734 * interface for matching a glob pattern 'p' to an input string 's'. Unlike 5735 * libc's version, the kernel version only applies to 8-bit ASCII strings. 5736 * In addition, all of the recursion cases except for '*' matching have been 5737 * unwound. For '*', we still implement recursive evaluation, but a depth 5738 * counter is maintained and matching is aborted if we recurse too deep. 5739 * The function returns 0 if no match, >0 if match, and <0 if recursion error. 5740 */ 5741 static int 5742 dtrace_match_glob(const char *s, const char *p, int depth) 5743 { 5744 const char *olds; 5745 char s1, c; 5746 int gs; 5747 5748 if (depth > DTRACE_PROBEKEY_MAXDEPTH) 5749 return (-1); 5750 5751 if (s == NULL) 5752 s = ""; /* treat NULL as empty string */ 5753 5754 top: 5755 olds = s; 5756 s1 = *s++; 5757 5758 if (p == NULL) 5759 return (0); 5760 5761 if ((c = *p++) == '\0') 5762 return (s1 == '\0'); 5763 5764 switch (c) { 5765 case '[': { 5766 int ok = 0, notflag = 0; 5767 char lc = '\0'; 5768 5769 if (s1 == '\0') 5770 return (0); 5771 5772 if (*p == '!') { 5773 notflag = 1; 5774 p++; 5775 } 5776 5777 if ((c = *p++) == '\0') 5778 return (0); 5779 5780 do { 5781 if (c == '-' && lc != '\0' && *p != ']') { 5782 if ((c = *p++) == '\0') 5783 return (0); 5784 if (c == '\\' && (c = *p++) == '\0') 5785 return (0); 5786 5787 if (notflag) { 5788 if (s1 < lc || s1 > c) 5789 ok++; 5790 else 5791 return (0); 5792 } else if (lc <= s1 && s1 <= c) 5793 ok++; 5794 5795 } else if (c == '\\' && (c = *p++) == '\0') 5796 return (0); 5797 5798 lc = c; /* save left-hand 'c' for next iteration */ 5799 5800 if (notflag) { 5801 if (s1 != c) 5802 ok++; 5803 else 5804 return (0); 5805 } else if (s1 == c) 5806 ok++; 5807 5808 if ((c = *p++) == '\0') 5809 return (0); 5810 5811 } while (c != ']'); 5812 5813 if (ok) 5814 goto top; 5815 5816 return (0); 5817 } 5818 5819 case '\\': 5820 if ((c = *p++) == '\0') 5821 return (0); 5822 /*FALLTHRU*/ 5823 5824 default: 5825 if (c != s1) 5826 return (0); 5827 /*FALLTHRU*/ 5828 5829 case '?': 5830 if (s1 != '\0') 5831 goto top; 5832 return (0); 5833 5834 case '*': 5835 while (*p == '*') 5836 p++; /* consecutive *'s are identical to a single one */ 5837 5838 if (*p == '\0') 5839 return (1); 5840 5841 for (s = olds; *s != '\0'; s++) { 5842 if ((gs = dtrace_match_glob(s, p, depth + 1)) != 0) 5843 return (gs); 5844 } 5845 5846 return (0); 5847 } 5848 } 5849 5850 /*ARGSUSED*/ 5851 static int 5852 dtrace_match_string(const char *s, const char *p, int depth) 5853 { 5854 return (s != NULL && strcmp(s, p) == 0); 5855 } 5856 5857 /*ARGSUSED*/ 5858 static int 5859 dtrace_match_nul(const char *s, const char *p, int depth) 5860 { 5861 return (1); /* always match the empty pattern */ 5862 } 5863 5864 /*ARGSUSED*/ 5865 static int 5866 dtrace_match_nonzero(const char *s, const char *p, int depth) 5867 { 5868 return (s != NULL && s[0] != '\0'); 5869 } 5870 5871 static int 5872 dtrace_match(const dtrace_probekey_t *pkp, uint32_t priv, uid_t uid, 5873 zoneid_t zoneid, int (*matched)(dtrace_probe_t *, void *), void *arg) 5874 { 5875 dtrace_probe_t template, *probe; 5876 dtrace_hash_t *hash = NULL; 5877 int len, best = INT_MAX, nmatched = 0; 5878 dtrace_id_t i; 5879 5880 ASSERT(MUTEX_HELD(&dtrace_lock)); 5881 5882 /* 5883 * If the probe ID is specified in the key, just lookup by ID and 5884 * invoke the match callback once if a matching probe is found. 5885 */ 5886 if (pkp->dtpk_id != DTRACE_IDNONE) { 5887 if ((probe = dtrace_probe_lookup_id(pkp->dtpk_id)) != NULL && 5888 dtrace_match_probe(probe, pkp, priv, uid, zoneid) > 0) { 5889 (void) (*matched)(probe, arg); 5890 nmatched++; 5891 } 5892 return (nmatched); 5893 } 5894 5895 template.dtpr_mod = (char *)pkp->dtpk_mod; 5896 template.dtpr_func = (char *)pkp->dtpk_func; 5897 template.dtpr_name = (char *)pkp->dtpk_name; 5898 5899 /* 5900 * We want to find the most distinct of the module name, function 5901 * name, and name. So for each one that is not a glob pattern or 5902 * empty string, we perform a lookup in the corresponding hash and 5903 * use the hash table with the fewest collisions to do our search. 5904 */ 5905 if (pkp->dtpk_mmatch == &dtrace_match_string && 5906 (len = dtrace_hash_collisions(dtrace_bymod, &template)) < best) { 5907 best = len; 5908 hash = dtrace_bymod; 5909 } 5910 5911 if (pkp->dtpk_fmatch == &dtrace_match_string && 5912 (len = dtrace_hash_collisions(dtrace_byfunc, &template)) < best) { 5913 best = len; 5914 hash = dtrace_byfunc; 5915 } 5916 5917 if (pkp->dtpk_nmatch == &dtrace_match_string && 5918 (len = dtrace_hash_collisions(dtrace_byname, &template)) < best) { 5919 best = len; 5920 hash = dtrace_byname; 5921 } 5922 5923 /* 5924 * If we did not select a hash table, iterate over every probe and 5925 * invoke our callback for each one that matches our input probe key. 5926 */ 5927 if (hash == NULL) { 5928 for (i = 0; i < dtrace_nprobes; i++) { 5929 if ((probe = dtrace_probes[i]) == NULL || 5930 dtrace_match_probe(probe, pkp, priv, uid, 5931 zoneid) <= 0) 5932 continue; 5933 5934 nmatched++; 5935 5936 if ((*matched)(probe, arg) != DTRACE_MATCH_NEXT) 5937 break; 5938 } 5939 5940 return (nmatched); 5941 } 5942 5943 /* 5944 * If we selected a hash table, iterate over each probe of the same key 5945 * name and invoke the callback for every probe that matches the other 5946 * attributes of our input probe key. 5947 */ 5948 for (probe = dtrace_hash_lookup(hash, &template); probe != NULL; 5949 probe = *(DTRACE_HASHNEXT(hash, probe))) { 5950 5951 if (dtrace_match_probe(probe, pkp, priv, uid, zoneid) <= 0) 5952 continue; 5953 5954 nmatched++; 5955 5956 if ((*matched)(probe, arg) != DTRACE_MATCH_NEXT) 5957 break; 5958 } 5959 5960 return (nmatched); 5961 } 5962 5963 /* 5964 * Return the function pointer dtrace_probecmp() should use to compare the 5965 * specified pattern with a string. For NULL or empty patterns, we select 5966 * dtrace_match_nul(). For glob pattern strings, we use dtrace_match_glob(). 5967 * For non-empty non-glob strings, we use dtrace_match_string(). 5968 */ 5969 static dtrace_probekey_f * 5970 dtrace_probekey_func(const char *p) 5971 { 5972 char c; 5973 5974 if (p == NULL || *p == '\0') 5975 return (&dtrace_match_nul); 5976 5977 while ((c = *p++) != '\0') { 5978 if (c == '[' || c == '?' || c == '*' || c == '\\') 5979 return (&dtrace_match_glob); 5980 } 5981 5982 return (&dtrace_match_string); 5983 } 5984 5985 /* 5986 * Build a probe comparison key for use with dtrace_match_probe() from the 5987 * given probe description. By convention, a null key only matches anchored 5988 * probes: if each field is the empty string, reset dtpk_fmatch to 5989 * dtrace_match_nonzero(). 5990 */ 5991 static void 5992 dtrace_probekey(const dtrace_probedesc_t *pdp, dtrace_probekey_t *pkp) 5993 { 5994 pkp->dtpk_prov = pdp->dtpd_provider; 5995 pkp->dtpk_pmatch = dtrace_probekey_func(pdp->dtpd_provider); 5996 5997 pkp->dtpk_mod = pdp->dtpd_mod; 5998 pkp->dtpk_mmatch = dtrace_probekey_func(pdp->dtpd_mod); 5999 6000 pkp->dtpk_func = pdp->dtpd_func; 6001 pkp->dtpk_fmatch = dtrace_probekey_func(pdp->dtpd_func); 6002 6003 pkp->dtpk_name = pdp->dtpd_name; 6004 pkp->dtpk_nmatch = dtrace_probekey_func(pdp->dtpd_name); 6005 6006 pkp->dtpk_id = pdp->dtpd_id; 6007 6008 if (pkp->dtpk_id == DTRACE_IDNONE && 6009 pkp->dtpk_pmatch == &dtrace_match_nul && 6010 pkp->dtpk_mmatch == &dtrace_match_nul && 6011 pkp->dtpk_fmatch == &dtrace_match_nul && 6012 pkp->dtpk_nmatch == &dtrace_match_nul) 6013 pkp->dtpk_fmatch = &dtrace_match_nonzero; 6014 } 6015 6016 /* 6017 * DTrace Provider-to-Framework API Functions 6018 * 6019 * These functions implement much of the Provider-to-Framework API, as 6020 * described in <sys/dtrace.h>. The parts of the API not in this section are 6021 * the functions in the API for probe management (found below), and 6022 * dtrace_probe() itself (found above). 6023 */ 6024 6025 /* 6026 * Register the calling provider with the DTrace framework. This should 6027 * generally be called by DTrace providers in their attach(9E) entry point. 6028 */ 6029 int 6030 dtrace_register(const char *name, const dtrace_pattr_t *pap, uint32_t priv, 6031 cred_t *cr, const dtrace_pops_t *pops, void *arg, dtrace_provider_id_t *idp) 6032 { 6033 dtrace_provider_t *provider; 6034 6035 if (name == NULL || pap == NULL || pops == NULL || idp == NULL) { 6036 cmn_err(CE_WARN, "failed to register provider '%s': invalid " 6037 "arguments", name ? name : "<NULL>"); 6038 return (EINVAL); 6039 } 6040 6041 if (name[0] == '\0' || dtrace_badname(name)) { 6042 cmn_err(CE_WARN, "failed to register provider '%s': invalid " 6043 "provider name", name); 6044 return (EINVAL); 6045 } 6046 6047 if ((pops->dtps_provide == NULL && pops->dtps_provide_module == NULL) || 6048 pops->dtps_enable == NULL || pops->dtps_disable == NULL || 6049 pops->dtps_destroy == NULL || 6050 ((pops->dtps_resume == NULL) != (pops->dtps_suspend == NULL))) { 6051 cmn_err(CE_WARN, "failed to register provider '%s': invalid " 6052 "provider ops", name); 6053 return (EINVAL); 6054 } 6055 6056 if (dtrace_badattr(&pap->dtpa_provider) || 6057 dtrace_badattr(&pap->dtpa_mod) || 6058 dtrace_badattr(&pap->dtpa_func) || 6059 dtrace_badattr(&pap->dtpa_name) || 6060 dtrace_badattr(&pap->dtpa_args)) { 6061 cmn_err(CE_WARN, "failed to register provider '%s': invalid " 6062 "provider attributes", name); 6063 return (EINVAL); 6064 } 6065 6066 if (priv & ~DTRACE_PRIV_ALL) { 6067 cmn_err(CE_WARN, "failed to register provider '%s': invalid " 6068 "privilege attributes", name); 6069 return (EINVAL); 6070 } 6071 6072 if ((priv & DTRACE_PRIV_KERNEL) && 6073 (priv & (DTRACE_PRIV_USER | DTRACE_PRIV_OWNER)) && 6074 pops->dtps_usermode == NULL) { 6075 cmn_err(CE_WARN, "failed to register provider '%s': need " 6076 "dtps_usermode() op for given privilege attributes", name); 6077 return (EINVAL); 6078 } 6079 6080 provider = kmem_zalloc(sizeof (dtrace_provider_t), KM_SLEEP); 6081 provider->dtpv_name = kmem_alloc(strlen(name) + 1, KM_SLEEP); 6082 (void) strcpy(provider->dtpv_name, name); 6083 6084 provider->dtpv_attr = *pap; 6085 provider->dtpv_priv.dtpp_flags = priv; 6086 if (cr != NULL) { 6087 provider->dtpv_priv.dtpp_uid = crgetuid(cr); 6088 provider->dtpv_priv.dtpp_zoneid = crgetzoneid(cr); 6089 } 6090 provider->dtpv_pops = *pops; 6091 6092 if (pops->dtps_provide == NULL) { 6093 ASSERT(pops->dtps_provide_module != NULL); 6094 provider->dtpv_pops.dtps_provide = 6095 (void (*)(void *, const dtrace_probedesc_t *))dtrace_nullop; 6096 } 6097 6098 if (pops->dtps_provide_module == NULL) { 6099 ASSERT(pops->dtps_provide != NULL); 6100 provider->dtpv_pops.dtps_provide_module = 6101 (void (*)(void *, struct modctl *))dtrace_nullop; 6102 } 6103 6104 if (pops->dtps_suspend == NULL) { 6105 ASSERT(pops->dtps_resume == NULL); 6106 provider->dtpv_pops.dtps_suspend = 6107 (void (*)(void *, dtrace_id_t, void *))dtrace_nullop; 6108 provider->dtpv_pops.dtps_resume = 6109 (void (*)(void *, dtrace_id_t, void *))dtrace_nullop; 6110 } 6111 6112 provider->dtpv_arg = arg; 6113 *idp = (dtrace_provider_id_t)provider; 6114 6115 if (pops == &dtrace_provider_ops) { 6116 ASSERT(MUTEX_HELD(&dtrace_provider_lock)); 6117 ASSERT(MUTEX_HELD(&dtrace_lock)); 6118 ASSERT(dtrace_anon.dta_enabling == NULL); 6119 6120 /* 6121 * We make sure that the DTrace provider is at the head of 6122 * the provider chain. 6123 */ 6124 provider->dtpv_next = dtrace_provider; 6125 dtrace_provider = provider; 6126 return (0); 6127 } 6128 6129 mutex_enter(&dtrace_provider_lock); 6130 mutex_enter(&dtrace_lock); 6131 6132 /* 6133 * If there is at least one provider registered, we'll add this 6134 * provider after the first provider. 6135 */ 6136 if (dtrace_provider != NULL) { 6137 provider->dtpv_next = dtrace_provider->dtpv_next; 6138 dtrace_provider->dtpv_next = provider; 6139 } else { 6140 dtrace_provider = provider; 6141 } 6142 6143 if (dtrace_retained != NULL) { 6144 dtrace_enabling_provide(provider); 6145 6146 /* 6147 * Now we need to call dtrace_enabling_matchall() -- which 6148 * will acquire cpu_lock and dtrace_lock. We therefore need 6149 * to drop all of our locks before calling into it... 6150 */ 6151 mutex_exit(&dtrace_lock); 6152 mutex_exit(&dtrace_provider_lock); 6153 dtrace_enabling_matchall(); 6154 6155 return (0); 6156 } 6157 6158 mutex_exit(&dtrace_lock); 6159 mutex_exit(&dtrace_provider_lock); 6160 6161 return (0); 6162 } 6163 6164 /* 6165 * Unregister the specified provider from the DTrace framework. This should 6166 * generally be called by DTrace providers in their detach(9E) entry point. 6167 */ 6168 int 6169 dtrace_unregister(dtrace_provider_id_t id) 6170 { 6171 dtrace_provider_t *old = (dtrace_provider_t *)id; 6172 dtrace_provider_t *prev = NULL; 6173 int i, self = 0; 6174 dtrace_probe_t *probe, *first = NULL; 6175 6176 if (old->dtpv_pops.dtps_enable == 6177 (void (*)(void *, dtrace_id_t, void *))dtrace_nullop) { 6178 /* 6179 * If DTrace itself is the provider, we're called with locks 6180 * already held. 6181 */ 6182 ASSERT(old == dtrace_provider); 6183 ASSERT(dtrace_devi != NULL); 6184 ASSERT(MUTEX_HELD(&dtrace_provider_lock)); 6185 ASSERT(MUTEX_HELD(&dtrace_lock)); 6186 self = 1; 6187 6188 if (dtrace_provider->dtpv_next != NULL) { 6189 /* 6190 * There's another provider here; return failure. 6191 */ 6192 return (EBUSY); 6193 } 6194 } else { 6195 mutex_enter(&dtrace_provider_lock); 6196 mutex_enter(&mod_lock); 6197 mutex_enter(&dtrace_lock); 6198 } 6199 6200 /* 6201 * If anyone has /dev/dtrace open, or if there are anonymous enabled 6202 * probes, we refuse to let providers slither away, unless this 6203 * provider has already been explicitly invalidated. 6204 */ 6205 if (!old->dtpv_defunct && 6206 (dtrace_opens || (dtrace_anon.dta_state != NULL && 6207 dtrace_anon.dta_state->dts_necbs > 0))) { 6208 if (!self) { 6209 mutex_exit(&dtrace_lock); 6210 mutex_exit(&mod_lock); 6211 mutex_exit(&dtrace_provider_lock); 6212 } 6213 return (EBUSY); 6214 } 6215 6216 /* 6217 * Attempt to destroy the probes associated with this provider. 6218 */ 6219 for (i = 0; i < dtrace_nprobes; i++) { 6220 if ((probe = dtrace_probes[i]) == NULL) 6221 continue; 6222 6223 if (probe->dtpr_provider != old) 6224 continue; 6225 6226 if (probe->dtpr_ecb == NULL) 6227 continue; 6228 6229 /* 6230 * We have at least one ECB; we can't remove this provider. 6231 */ 6232 if (!self) { 6233 mutex_exit(&dtrace_lock); 6234 mutex_exit(&mod_lock); 6235 mutex_exit(&dtrace_provider_lock); 6236 } 6237 return (EBUSY); 6238 } 6239 6240 /* 6241 * All of the probes for this provider are disabled; we can safely 6242 * remove all of them from their hash chains and from the probe array. 6243 */ 6244 for (i = 0; i < dtrace_nprobes; i++) { 6245 if ((probe = dtrace_probes[i]) == NULL) 6246 continue; 6247 6248 if (probe->dtpr_provider != old) 6249 continue; 6250 6251 dtrace_probes[i] = NULL; 6252 6253 dtrace_hash_remove(dtrace_bymod, probe); 6254 dtrace_hash_remove(dtrace_byfunc, probe); 6255 dtrace_hash_remove(dtrace_byname, probe); 6256 6257 if (first == NULL) { 6258 first = probe; 6259 probe->dtpr_nextmod = NULL; 6260 } else { 6261 probe->dtpr_nextmod = first; 6262 first = probe; 6263 } 6264 } 6265 6266 /* 6267 * The provider's probes have been removed from the hash chains and 6268 * from the probe array. Now issue a dtrace_sync() to be sure that 6269 * everyone has cleared out from any probe array processing. 6270 */ 6271 dtrace_sync(); 6272 6273 for (probe = first; probe != NULL; probe = first) { 6274 first = probe->dtpr_nextmod; 6275 6276 old->dtpv_pops.dtps_destroy(old->dtpv_arg, probe->dtpr_id, 6277 probe->dtpr_arg); 6278 kmem_free(probe->dtpr_mod, strlen(probe->dtpr_mod) + 1); 6279 kmem_free(probe->dtpr_func, strlen(probe->dtpr_func) + 1); 6280 kmem_free(probe->dtpr_name, strlen(probe->dtpr_name) + 1); 6281 vmem_free(dtrace_arena, (void *)(uintptr_t)(probe->dtpr_id), 1); 6282 kmem_free(probe, sizeof (dtrace_probe_t)); 6283 } 6284 6285 if ((prev = dtrace_provider) == old) { 6286 ASSERT(self || dtrace_devi == NULL); 6287 ASSERT(old->dtpv_next == NULL || dtrace_devi == NULL); 6288 dtrace_provider = old->dtpv_next; 6289 } else { 6290 while (prev != NULL && prev->dtpv_next != old) 6291 prev = prev->dtpv_next; 6292 6293 if (prev == NULL) { 6294 panic("attempt to unregister non-existent " 6295 "dtrace provider %p\n", (void *)id); 6296 } 6297 6298 prev->dtpv_next = old->dtpv_next; 6299 } 6300 6301 if (!self) { 6302 mutex_exit(&dtrace_lock); 6303 mutex_exit(&mod_lock); 6304 mutex_exit(&dtrace_provider_lock); 6305 } 6306 6307 kmem_free(old->dtpv_name, strlen(old->dtpv_name) + 1); 6308 kmem_free(old, sizeof (dtrace_provider_t)); 6309 6310 return (0); 6311 } 6312 6313 /* 6314 * Invalidate the specified provider. All subsequent probe lookups for the 6315 * specified provider will fail, but its probes will not be removed. 6316 */ 6317 void 6318 dtrace_invalidate(dtrace_provider_id_t id) 6319 { 6320 dtrace_provider_t *pvp = (dtrace_provider_t *)id; 6321 6322 ASSERT(pvp->dtpv_pops.dtps_enable != 6323 (void (*)(void *, dtrace_id_t, void *))dtrace_nullop); 6324 6325 mutex_enter(&dtrace_provider_lock); 6326 mutex_enter(&dtrace_lock); 6327 6328 pvp->dtpv_defunct = 1; 6329 6330 mutex_exit(&dtrace_lock); 6331 mutex_exit(&dtrace_provider_lock); 6332 } 6333 6334 /* 6335 * Indicate whether or not DTrace has attached. 6336 */ 6337 int 6338 dtrace_attached(void) 6339 { 6340 /* 6341 * dtrace_provider will be non-NULL iff the DTrace driver has 6342 * attached. (It's non-NULL because DTrace is always itself a 6343 * provider.) 6344 */ 6345 return (dtrace_provider != NULL); 6346 } 6347 6348 /* 6349 * Remove all the unenabled probes for the given provider. This function is 6350 * not unlike dtrace_unregister(), except that it doesn't remove the provider 6351 * -- just as many of its associated probes as it can. 6352 */ 6353 int 6354 dtrace_condense(dtrace_provider_id_t id) 6355 { 6356 dtrace_provider_t *prov = (dtrace_provider_t *)id; 6357 int i; 6358 dtrace_probe_t *probe; 6359 6360 /* 6361 * Make sure this isn't the dtrace provider itself. 6362 */ 6363 ASSERT(prov->dtpv_pops.dtps_enable != 6364 (void (*)(void *, dtrace_id_t, void *))dtrace_nullop); 6365 6366 mutex_enter(&dtrace_provider_lock); 6367 mutex_enter(&dtrace_lock); 6368 6369 /* 6370 * Attempt to destroy the probes associated with this provider. 6371 */ 6372 for (i = 0; i < dtrace_nprobes; i++) { 6373 if ((probe = dtrace_probes[i]) == NULL) 6374 continue; 6375 6376 if (probe->dtpr_provider != prov) 6377 continue; 6378 6379 if (probe->dtpr_ecb != NULL) 6380 continue; 6381 6382 dtrace_probes[i] = NULL; 6383 6384 dtrace_hash_remove(dtrace_bymod, probe); 6385 dtrace_hash_remove(dtrace_byfunc, probe); 6386 dtrace_hash_remove(dtrace_byname, probe); 6387 6388 prov->dtpv_pops.dtps_destroy(prov->dtpv_arg, i + 1, 6389 probe->dtpr_arg); 6390 kmem_free(probe->dtpr_mod, strlen(probe->dtpr_mod) + 1); 6391 kmem_free(probe->dtpr_func, strlen(probe->dtpr_func) + 1); 6392 kmem_free(probe->dtpr_name, strlen(probe->dtpr_name) + 1); 6393 kmem_free(probe, sizeof (dtrace_probe_t)); 6394 vmem_free(dtrace_arena, (void *)((uintptr_t)i + 1), 1); 6395 } 6396 6397 mutex_exit(&dtrace_lock); 6398 mutex_exit(&dtrace_provider_lock); 6399 6400 return (0); 6401 } 6402 6403 /* 6404 * DTrace Probe Management Functions 6405 * 6406 * The functions in this section perform the DTrace probe management, 6407 * including functions to create probes, look-up probes, and call into the 6408 * providers to request that probes be provided. Some of these functions are 6409 * in the Provider-to-Framework API; these functions can be identified by the 6410 * fact that they are not declared "static". 6411 */ 6412 6413 /* 6414 * Create a probe with the specified module name, function name, and name. 6415 */ 6416 dtrace_id_t 6417 dtrace_probe_create(dtrace_provider_id_t prov, const char *mod, 6418 const char *func, const char *name, int aframes, void *arg) 6419 { 6420 dtrace_probe_t *probe, **probes; 6421 dtrace_provider_t *provider = (dtrace_provider_t *)prov; 6422 dtrace_id_t id; 6423 6424 if (provider == dtrace_provider) { 6425 ASSERT(MUTEX_HELD(&dtrace_lock)); 6426 } else { 6427 mutex_enter(&dtrace_lock); 6428 } 6429 6430 id = (dtrace_id_t)(uintptr_t)vmem_alloc(dtrace_arena, 1, 6431 VM_BESTFIT | VM_SLEEP); 6432 probe = kmem_zalloc(sizeof (dtrace_probe_t), KM_SLEEP); 6433 6434 probe->dtpr_id = id; 6435 probe->dtpr_gen = dtrace_probegen++; 6436 probe->dtpr_mod = dtrace_strdup(mod); 6437 probe->dtpr_func = dtrace_strdup(func); 6438 probe->dtpr_name = dtrace_strdup(name); 6439 probe->dtpr_arg = arg; 6440 probe->dtpr_aframes = aframes; 6441 probe->dtpr_provider = provider; 6442 6443 dtrace_hash_add(dtrace_bymod, probe); 6444 dtrace_hash_add(dtrace_byfunc, probe); 6445 dtrace_hash_add(dtrace_byname, probe); 6446 6447 if (id - 1 >= dtrace_nprobes) { 6448 size_t osize = dtrace_nprobes * sizeof (dtrace_probe_t *); 6449 size_t nsize = osize << 1; 6450 6451 if (nsize == 0) { 6452 ASSERT(osize == 0); 6453 ASSERT(dtrace_probes == NULL); 6454 nsize = sizeof (dtrace_probe_t *); 6455 } 6456 6457 probes = kmem_zalloc(nsize, KM_SLEEP); 6458 6459 if (dtrace_probes == NULL) { 6460 ASSERT(osize == 0); 6461 dtrace_probes = probes; 6462 dtrace_nprobes = 1; 6463 } else { 6464 dtrace_probe_t **oprobes = dtrace_probes; 6465 6466 bcopy(oprobes, probes, osize); 6467 dtrace_membar_producer(); 6468 dtrace_probes = probes; 6469 6470 dtrace_sync(); 6471 6472 /* 6473 * All CPUs are now seeing the new probes array; we can 6474 * safely free the old array. 6475 */ 6476 kmem_free(oprobes, osize); 6477 dtrace_nprobes <<= 1; 6478 } 6479 6480 ASSERT(id - 1 < dtrace_nprobes); 6481 } 6482 6483 ASSERT(dtrace_probes[id - 1] == NULL); 6484 dtrace_probes[id - 1] = probe; 6485 6486 if (provider != dtrace_provider) 6487 mutex_exit(&dtrace_lock); 6488 6489 return (id); 6490 } 6491 6492 static dtrace_probe_t * 6493 dtrace_probe_lookup_id(dtrace_id_t id) 6494 { 6495 ASSERT(MUTEX_HELD(&dtrace_lock)); 6496 6497 if (id == 0 || id > dtrace_nprobes) 6498 return (NULL); 6499 6500 return (dtrace_probes[id - 1]); 6501 } 6502 6503 static int 6504 dtrace_probe_lookup_match(dtrace_probe_t *probe, void *arg) 6505 { 6506 *((dtrace_id_t *)arg) = probe->dtpr_id; 6507 6508 return (DTRACE_MATCH_DONE); 6509 } 6510 6511 /* 6512 * Look up a probe based on provider and one or more of module name, function 6513 * name and probe name. 6514 */ 6515 dtrace_id_t 6516 dtrace_probe_lookup(dtrace_provider_id_t prid, const char *mod, 6517 const char *func, const char *name) 6518 { 6519 dtrace_probekey_t pkey; 6520 dtrace_id_t id; 6521 int match; 6522 6523 pkey.dtpk_prov = ((dtrace_provider_t *)prid)->dtpv_name; 6524 pkey.dtpk_pmatch = &dtrace_match_string; 6525 pkey.dtpk_mod = mod; 6526 pkey.dtpk_mmatch = mod ? &dtrace_match_string : &dtrace_match_nul; 6527 pkey.dtpk_func = func; 6528 pkey.dtpk_fmatch = func ? &dtrace_match_string : &dtrace_match_nul; 6529 pkey.dtpk_name = name; 6530 pkey.dtpk_nmatch = name ? &dtrace_match_string : &dtrace_match_nul; 6531 pkey.dtpk_id = DTRACE_IDNONE; 6532 6533 mutex_enter(&dtrace_lock); 6534 match = dtrace_match(&pkey, DTRACE_PRIV_ALL, 0, 0, 6535 dtrace_probe_lookup_match, &id); 6536 mutex_exit(&dtrace_lock); 6537 6538 ASSERT(match == 1 || match == 0); 6539 return (match ? id : 0); 6540 } 6541 6542 /* 6543 * Returns the probe argument associated with the specified probe. 6544 */ 6545 void * 6546 dtrace_probe_arg(dtrace_provider_id_t id, dtrace_id_t pid) 6547 { 6548 dtrace_probe_t *probe; 6549 void *rval = NULL; 6550 6551 mutex_enter(&dtrace_lock); 6552 6553 if ((probe = dtrace_probe_lookup_id(pid)) != NULL && 6554 probe->dtpr_provider == (dtrace_provider_t *)id) 6555 rval = probe->dtpr_arg; 6556 6557 mutex_exit(&dtrace_lock); 6558 6559 return (rval); 6560 } 6561 6562 /* 6563 * Copy a probe into a probe description. 6564 */ 6565 static void 6566 dtrace_probe_description(const dtrace_probe_t *prp, dtrace_probedesc_t *pdp) 6567 { 6568 bzero(pdp, sizeof (dtrace_probedesc_t)); 6569 pdp->dtpd_id = prp->dtpr_id; 6570 6571 (void) strncpy(pdp->dtpd_provider, 6572 prp->dtpr_provider->dtpv_name, DTRACE_PROVNAMELEN - 1); 6573 6574 (void) strncpy(pdp->dtpd_mod, prp->dtpr_mod, DTRACE_MODNAMELEN - 1); 6575 (void) strncpy(pdp->dtpd_func, prp->dtpr_func, DTRACE_FUNCNAMELEN - 1); 6576 (void) strncpy(pdp->dtpd_name, prp->dtpr_name, DTRACE_NAMELEN - 1); 6577 } 6578 6579 /* 6580 * Called to indicate that a probe -- or probes -- should be provided by a 6581 * specfied provider. If the specified description is NULL, the provider will 6582 * be told to provide all of its probes. (This is done whenever a new 6583 * consumer comes along, or whenever a retained enabling is to be matched.) If 6584 * the specified description is non-NULL, the provider is given the 6585 * opportunity to dynamically provide the specified probe, allowing providers 6586 * to support the creation of probes on-the-fly. (So-called _autocreated_ 6587 * probes.) If the provider is NULL, the operations will be applied to all 6588 * providers; if the provider is non-NULL the operations will only be applied 6589 * to the specified provider. The dtrace_provider_lock must be held, and the 6590 * dtrace_lock must _not_ be held -- the provider's dtps_provide() operation 6591 * will need to grab the dtrace_lock when it reenters the framework through 6592 * dtrace_probe_lookup(), dtrace_probe_create(), etc. 6593 */ 6594 static void 6595 dtrace_probe_provide(dtrace_probedesc_t *desc, dtrace_provider_t *prv) 6596 { 6597 struct modctl *ctl; 6598 int all = 0; 6599 6600 ASSERT(MUTEX_HELD(&dtrace_provider_lock)); 6601 6602 if (prv == NULL) { 6603 all = 1; 6604 prv = dtrace_provider; 6605 } 6606 6607 do { 6608 /* 6609 * First, call the blanket provide operation. 6610 */ 6611 prv->dtpv_pops.dtps_provide(prv->dtpv_arg, desc); 6612 6613 /* 6614 * Now call the per-module provide operation. We will grab 6615 * mod_lock to prevent the list from being modified. Note 6616 * that this also prevents the mod_busy bits from changing. 6617 * (mod_busy can only be changed with mod_lock held.) 6618 */ 6619 mutex_enter(&mod_lock); 6620 6621 ctl = &modules; 6622 do { 6623 if (ctl->mod_busy || ctl->mod_mp == NULL) 6624 continue; 6625 6626 prv->dtpv_pops.dtps_provide_module(prv->dtpv_arg, ctl); 6627 6628 } while ((ctl = ctl->mod_next) != &modules); 6629 6630 mutex_exit(&mod_lock); 6631 } while (all && (prv = prv->dtpv_next) != NULL); 6632 } 6633 6634 /* 6635 * Iterate over each probe, and call the Framework-to-Provider API function 6636 * denoted by offs. 6637 */ 6638 static void 6639 dtrace_probe_foreach(uintptr_t offs) 6640 { 6641 dtrace_provider_t *prov; 6642 void (*func)(void *, dtrace_id_t, void *); 6643 dtrace_probe_t *probe; 6644 dtrace_icookie_t cookie; 6645 int i; 6646 6647 /* 6648 * We disable interrupts to walk through the probe array. This is 6649 * safe -- the dtrace_sync() in dtrace_unregister() assures that we 6650 * won't see stale data. 6651 */ 6652 cookie = dtrace_interrupt_disable(); 6653 6654 for (i = 0; i < dtrace_nprobes; i++) { 6655 if ((probe = dtrace_probes[i]) == NULL) 6656 continue; 6657 6658 if (probe->dtpr_ecb == NULL) { 6659 /* 6660 * This probe isn't enabled -- don't call the function. 6661 */ 6662 continue; 6663 } 6664 6665 prov = probe->dtpr_provider; 6666 func = *((void(**)(void *, dtrace_id_t, void *)) 6667 ((uintptr_t)&prov->dtpv_pops + offs)); 6668 6669 func(prov->dtpv_arg, i + 1, probe->dtpr_arg); 6670 } 6671 6672 dtrace_interrupt_enable(cookie); 6673 } 6674 6675 static int 6676 dtrace_probe_enable(const dtrace_probedesc_t *desc, dtrace_enabling_t *enab) 6677 { 6678 dtrace_probekey_t pkey; 6679 uint32_t priv; 6680 uid_t uid; 6681 zoneid_t zoneid; 6682 6683 ASSERT(MUTEX_HELD(&dtrace_lock)); 6684 dtrace_ecb_create_cache = NULL; 6685 6686 if (desc == NULL) { 6687 /* 6688 * If we're passed a NULL description, we're being asked to 6689 * create an ECB with a NULL probe. 6690 */ 6691 (void) dtrace_ecb_create_enable(NULL, enab); 6692 return (0); 6693 } 6694 6695 dtrace_probekey(desc, &pkey); 6696 dtrace_cred2priv(enab->dten_vstate->dtvs_state->dts_cred.dcr_cred, 6697 &priv, &uid, &zoneid); 6698 6699 return (dtrace_match(&pkey, priv, uid, zoneid, dtrace_ecb_create_enable, 6700 enab)); 6701 } 6702 6703 /* 6704 * DTrace Helper Provider Functions 6705 */ 6706 static void 6707 dtrace_dofattr2attr(dtrace_attribute_t *attr, const dof_attr_t dofattr) 6708 { 6709 attr->dtat_name = DOF_ATTR_NAME(dofattr); 6710 attr->dtat_data = DOF_ATTR_DATA(dofattr); 6711 attr->dtat_class = DOF_ATTR_CLASS(dofattr); 6712 } 6713 6714 static void 6715 dtrace_dofprov2hprov(dtrace_helper_provdesc_t *hprov, 6716 const dof_provider_t *dofprov, char *strtab) 6717 { 6718 hprov->dthpv_provname = strtab + dofprov->dofpv_name; 6719 dtrace_dofattr2attr(&hprov->dthpv_pattr.dtpa_provider, 6720 dofprov->dofpv_provattr); 6721 dtrace_dofattr2attr(&hprov->dthpv_pattr.dtpa_mod, 6722 dofprov->dofpv_modattr); 6723 dtrace_dofattr2attr(&hprov->dthpv_pattr.dtpa_func, 6724 dofprov->dofpv_funcattr); 6725 dtrace_dofattr2attr(&hprov->dthpv_pattr.dtpa_name, 6726 dofprov->dofpv_nameattr); 6727 dtrace_dofattr2attr(&hprov->dthpv_pattr.dtpa_args, 6728 dofprov->dofpv_argsattr); 6729 } 6730 6731 static void 6732 dtrace_helper_provide_one(dof_helper_t *dhp, dof_sec_t *sec, pid_t pid) 6733 { 6734 uintptr_t daddr = (uintptr_t)dhp->dofhp_dof; 6735 dof_hdr_t *dof = (dof_hdr_t *)daddr; 6736 dof_sec_t *str_sec, *prb_sec, *arg_sec, *off_sec, *enoff_sec; 6737 dof_provider_t *provider; 6738 dof_probe_t *probe; 6739 uint32_t *off, *enoff; 6740 uint8_t *arg; 6741 char *strtab; 6742 uint_t i, nprobes; 6743 dtrace_helper_provdesc_t dhpv; 6744 dtrace_helper_probedesc_t dhpb; 6745 dtrace_meta_t *meta = dtrace_meta_pid; 6746 dtrace_mops_t *mops = &meta->dtm_mops; 6747 void *parg; 6748 6749 provider = (dof_provider_t *)(uintptr_t)(daddr + sec->dofs_offset); 6750 str_sec = (dof_sec_t *)(uintptr_t)(daddr + dof->dofh_secoff + 6751 provider->dofpv_strtab * dof->dofh_secsize); 6752 prb_sec = (dof_sec_t *)(uintptr_t)(daddr + dof->dofh_secoff + 6753 provider->dofpv_probes * dof->dofh_secsize); 6754 arg_sec = (dof_sec_t *)(uintptr_t)(daddr + dof->dofh_secoff + 6755 provider->dofpv_prargs * dof->dofh_secsize); 6756 off_sec = (dof_sec_t *)(uintptr_t)(daddr + dof->dofh_secoff + 6757 provider->dofpv_proffs * dof->dofh_secsize); 6758 6759 strtab = (char *)(uintptr_t)(daddr + str_sec->dofs_offset); 6760 off = (uint32_t *)(uintptr_t)(daddr + off_sec->dofs_offset); 6761 arg = (uint8_t *)(uintptr_t)(daddr + arg_sec->dofs_offset); 6762 enoff = NULL; 6763 6764 /* 6765 * See dtrace_helper_provider_validate(). 6766 */ 6767 if (dof->dofh_ident[DOF_ID_VERSION] != DOF_VERSION_1 && 6768 provider->dofpv_prenoffs != DOF_SECT_NONE) { 6769 enoff_sec = (dof_sec_t *)(uintptr_t)(daddr + dof->dofh_secoff + 6770 provider->dofpv_prenoffs * dof->dofh_secsize); 6771 enoff = (uint32_t *)(uintptr_t)(daddr + enoff_sec->dofs_offset); 6772 } 6773 6774 nprobes = prb_sec->dofs_size / prb_sec->dofs_entsize; 6775 6776 /* 6777 * Create the provider. 6778 */ 6779 dtrace_dofprov2hprov(&dhpv, provider, strtab); 6780 6781 if ((parg = mops->dtms_provide_pid(meta->dtm_arg, &dhpv, pid)) == NULL) 6782 return; 6783 6784 meta->dtm_count++; 6785 6786 /* 6787 * Create the probes. 6788 */ 6789 for (i = 0; i < nprobes; i++) { 6790 probe = (dof_probe_t *)(uintptr_t)(daddr + 6791 prb_sec->dofs_offset + i * prb_sec->dofs_entsize); 6792 6793 dhpb.dthpb_mod = dhp->dofhp_mod; 6794 dhpb.dthpb_func = strtab + probe->dofpr_func; 6795 dhpb.dthpb_name = strtab + probe->dofpr_name; 6796 dhpb.dthpb_base = probe->dofpr_addr; 6797 dhpb.dthpb_offs = off + probe->dofpr_offidx; 6798 dhpb.dthpb_noffs = probe->dofpr_noffs; 6799 if (enoff != NULL) { 6800 dhpb.dthpb_enoffs = enoff + probe->dofpr_enoffidx; 6801 dhpb.dthpb_nenoffs = probe->dofpr_nenoffs; 6802 } else { 6803 dhpb.dthpb_enoffs = NULL; 6804 dhpb.dthpb_nenoffs = 0; 6805 } 6806 dhpb.dthpb_args = arg + probe->dofpr_argidx; 6807 dhpb.dthpb_nargc = probe->dofpr_nargc; 6808 dhpb.dthpb_xargc = probe->dofpr_xargc; 6809 dhpb.dthpb_ntypes = strtab + probe->dofpr_nargv; 6810 dhpb.dthpb_xtypes = strtab + probe->dofpr_xargv; 6811 6812 mops->dtms_create_probe(meta->dtm_arg, parg, &dhpb); 6813 } 6814 } 6815 6816 static void 6817 dtrace_helper_provide(dof_helper_t *dhp, pid_t pid) 6818 { 6819 uintptr_t daddr = (uintptr_t)dhp->dofhp_dof; 6820 dof_hdr_t *dof = (dof_hdr_t *)daddr; 6821 int i; 6822 6823 ASSERT(MUTEX_HELD(&dtrace_meta_lock)); 6824 6825 for (i = 0; i < dof->dofh_secnum; i++) { 6826 dof_sec_t *sec = (dof_sec_t *)(uintptr_t)(daddr + 6827 dof->dofh_secoff + i * dof->dofh_secsize); 6828 6829 if (sec->dofs_type != DOF_SECT_PROVIDER) 6830 continue; 6831 6832 dtrace_helper_provide_one(dhp, sec, pid); 6833 } 6834 6835 /* 6836 * We may have just created probes, so we must now rematch against 6837 * any retained enablings. Note that this call will acquire both 6838 * cpu_lock and dtrace_lock; the fact that we are holding 6839 * dtrace_meta_lock now is what defines the ordering with respect to 6840 * these three locks. 6841 */ 6842 dtrace_enabling_matchall(); 6843 } 6844 6845 static void 6846 dtrace_helper_provider_remove_one(dof_helper_t *dhp, dof_sec_t *sec, pid_t pid) 6847 { 6848 uintptr_t daddr = (uintptr_t)dhp->dofhp_dof; 6849 dof_hdr_t *dof = (dof_hdr_t *)daddr; 6850 dof_sec_t *str_sec; 6851 dof_provider_t *provider; 6852 char *strtab; 6853 dtrace_helper_provdesc_t dhpv; 6854 dtrace_meta_t *meta = dtrace_meta_pid; 6855 dtrace_mops_t *mops = &meta->dtm_mops; 6856 6857 provider = (dof_provider_t *)(uintptr_t)(daddr + sec->dofs_offset); 6858 str_sec = (dof_sec_t *)(uintptr_t)(daddr + dof->dofh_secoff + 6859 provider->dofpv_strtab * dof->dofh_secsize); 6860 6861 strtab = (char *)(uintptr_t)(daddr + str_sec->dofs_offset); 6862 6863 /* 6864 * Create the provider. 6865 */ 6866 dtrace_dofprov2hprov(&dhpv, provider, strtab); 6867 6868 mops->dtms_remove_pid(meta->dtm_arg, &dhpv, pid); 6869 6870 meta->dtm_count--; 6871 } 6872 6873 static void 6874 dtrace_helper_provider_remove(dof_helper_t *dhp, pid_t pid) 6875 { 6876 uintptr_t daddr = (uintptr_t)dhp->dofhp_dof; 6877 dof_hdr_t *dof = (dof_hdr_t *)daddr; 6878 int i; 6879 6880 ASSERT(MUTEX_HELD(&dtrace_meta_lock)); 6881 6882 for (i = 0; i < dof->dofh_secnum; i++) { 6883 dof_sec_t *sec = (dof_sec_t *)(uintptr_t)(daddr + 6884 dof->dofh_secoff + i * dof->dofh_secsize); 6885 6886 if (sec->dofs_type != DOF_SECT_PROVIDER) 6887 continue; 6888 6889 dtrace_helper_provider_remove_one(dhp, sec, pid); 6890 } 6891 } 6892 6893 /* 6894 * DTrace Meta Provider-to-Framework API Functions 6895 * 6896 * These functions implement the Meta Provider-to-Framework API, as described 6897 * in <sys/dtrace.h>. 6898 */ 6899 int 6900 dtrace_meta_register(const char *name, const dtrace_mops_t *mops, void *arg, 6901 dtrace_meta_provider_id_t *idp) 6902 { 6903 dtrace_meta_t *meta; 6904 dtrace_helpers_t *help, *next; 6905 int i; 6906 6907 *idp = DTRACE_METAPROVNONE; 6908 6909 /* 6910 * We strictly don't need the name, but we hold onto it for 6911 * debuggability. All hail error queues! 6912 */ 6913 if (name == NULL) { 6914 cmn_err(CE_WARN, "failed to register meta-provider: " 6915 "invalid name"); 6916 return (EINVAL); 6917 } 6918 6919 if (mops == NULL || 6920 mops->dtms_create_probe == NULL || 6921 mops->dtms_provide_pid == NULL || 6922 mops->dtms_remove_pid == NULL) { 6923 cmn_err(CE_WARN, "failed to register meta-register %s: " 6924 "invalid ops", name); 6925 return (EINVAL); 6926 } 6927 6928 meta = kmem_zalloc(sizeof (dtrace_meta_t), KM_SLEEP); 6929 meta->dtm_mops = *mops; 6930 meta->dtm_name = kmem_alloc(strlen(name) + 1, KM_SLEEP); 6931 (void) strcpy(meta->dtm_name, name); 6932 meta->dtm_arg = arg; 6933 6934 mutex_enter(&dtrace_meta_lock); 6935 mutex_enter(&dtrace_lock); 6936 6937 if (dtrace_meta_pid != NULL) { 6938 mutex_exit(&dtrace_lock); 6939 mutex_exit(&dtrace_meta_lock); 6940 cmn_err(CE_WARN, "failed to register meta-register %s: " 6941 "user-land meta-provider exists", name); 6942 kmem_free(meta->dtm_name, strlen(meta->dtm_name) + 1); 6943 kmem_free(meta, sizeof (dtrace_meta_t)); 6944 return (EINVAL); 6945 } 6946 6947 dtrace_meta_pid = meta; 6948 *idp = (dtrace_meta_provider_id_t)meta; 6949 6950 /* 6951 * If there are providers and probes ready to go, pass them 6952 * off to the new meta provider now. 6953 */ 6954 6955 help = dtrace_deferred_pid; 6956 dtrace_deferred_pid = NULL; 6957 6958 mutex_exit(&dtrace_lock); 6959 6960 while (help != NULL) { 6961 for (i = 0; i < help->dthps_nprovs; i++) { 6962 dtrace_helper_provide(&help->dthps_provs[i]->dthp_prov, 6963 help->dthps_pid); 6964 } 6965 6966 next = help->dthps_next; 6967 help->dthps_next = NULL; 6968 help->dthps_prev = NULL; 6969 help->dthps_deferred = 0; 6970 help = next; 6971 } 6972 6973 mutex_exit(&dtrace_meta_lock); 6974 6975 return (0); 6976 } 6977 6978 int 6979 dtrace_meta_unregister(dtrace_meta_provider_id_t id) 6980 { 6981 dtrace_meta_t **pp, *old = (dtrace_meta_t *)id; 6982 6983 mutex_enter(&dtrace_meta_lock); 6984 mutex_enter(&dtrace_lock); 6985 6986 if (old == dtrace_meta_pid) { 6987 pp = &dtrace_meta_pid; 6988 } else { 6989 panic("attempt to unregister non-existent " 6990 "dtrace meta-provider %p\n", (void *)old); 6991 } 6992 6993 if (old->dtm_count != 0) { 6994 mutex_exit(&dtrace_lock); 6995 mutex_exit(&dtrace_meta_lock); 6996 return (EBUSY); 6997 } 6998 6999 *pp = NULL; 7000 7001 mutex_exit(&dtrace_lock); 7002 mutex_exit(&dtrace_meta_lock); 7003 7004 kmem_free(old->dtm_name, strlen(old->dtm_name) + 1); 7005 kmem_free(old, sizeof (dtrace_meta_t)); 7006 7007 return (0); 7008 } 7009 7010 7011 /* 7012 * DTrace DIF Object Functions 7013 */ 7014 static int 7015 dtrace_difo_err(uint_t pc, const char *format, ...) 7016 { 7017 if (dtrace_err_verbose) { 7018 va_list alist; 7019 7020 (void) uprintf("dtrace DIF object error: [%u]: ", pc); 7021 va_start(alist, format); 7022 (void) vuprintf(format, alist); 7023 va_end(alist); 7024 } 7025 7026 #ifdef DTRACE_ERRDEBUG 7027 dtrace_errdebug(format); 7028 #endif 7029 return (1); 7030 } 7031 7032 /* 7033 * Validate a DTrace DIF object by checking the IR instructions. The following 7034 * rules are currently enforced by dtrace_difo_validate(): 7035 * 7036 * 1. Each instruction must have a valid opcode 7037 * 2. Each register, string, variable, or subroutine reference must be valid 7038 * 3. No instruction can modify register %r0 (must be zero) 7039 * 4. All instruction reserved bits must be set to zero 7040 * 5. The last instruction must be a "ret" instruction 7041 * 6. All branch targets must reference a valid instruction _after_ the branch 7042 */ 7043 static int 7044 dtrace_difo_validate(dtrace_difo_t *dp, dtrace_vstate_t *vstate, uint_t nregs, 7045 cred_t *cr) 7046 { 7047 int err = 0, i; 7048 int (*efunc)(uint_t pc, const char *, ...) = dtrace_difo_err; 7049 int kcheck; 7050 uint_t pc; 7051 7052 kcheck = cr == NULL || 7053 PRIV_POLICY_ONLY(cr, PRIV_DTRACE_KERNEL, B_FALSE) == 0; 7054 7055 dp->dtdo_destructive = 0; 7056 7057 for (pc = 0; pc < dp->dtdo_len && err == 0; pc++) { 7058 dif_instr_t instr = dp->dtdo_buf[pc]; 7059 7060 uint_t r1 = DIF_INSTR_R1(instr); 7061 uint_t r2 = DIF_INSTR_R2(instr); 7062 uint_t rd = DIF_INSTR_RD(instr); 7063 uint_t rs = DIF_INSTR_RS(instr); 7064 uint_t label = DIF_INSTR_LABEL(instr); 7065 uint_t v = DIF_INSTR_VAR(instr); 7066 uint_t subr = DIF_INSTR_SUBR(instr); 7067 uint_t type = DIF_INSTR_TYPE(instr); 7068 uint_t op = DIF_INSTR_OP(instr); 7069 7070 switch (op) { 7071 case DIF_OP_OR: 7072 case DIF_OP_XOR: 7073 case DIF_OP_AND: 7074 case DIF_OP_SLL: 7075 case DIF_OP_SRL: 7076 case DIF_OP_SRA: 7077 case DIF_OP_SUB: 7078 case DIF_OP_ADD: 7079 case DIF_OP_MUL: 7080 case DIF_OP_SDIV: 7081 case DIF_OP_UDIV: 7082 case DIF_OP_SREM: 7083 case DIF_OP_UREM: 7084 case DIF_OP_COPYS: 7085 if (r1 >= nregs) 7086 err += efunc(pc, "invalid register %u\n", r1); 7087 if (r2 >= nregs) 7088 err += efunc(pc, "invalid register %u\n", r2); 7089 if (rd >= nregs) 7090 err += efunc(pc, "invalid register %u\n", rd); 7091 if (rd == 0) 7092 err += efunc(pc, "cannot write to %r0\n"); 7093 break; 7094 case DIF_OP_NOT: 7095 case DIF_OP_MOV: 7096 case DIF_OP_ALLOCS: 7097 if (r1 >= nregs) 7098 err += efunc(pc, "invalid register %u\n", r1); 7099 if (r2 != 0) 7100 err += efunc(pc, "non-zero reserved bits\n"); 7101 if (rd >= nregs) 7102 err += efunc(pc, "invalid register %u\n", rd); 7103 if (rd == 0) 7104 err += efunc(pc, "cannot write to %r0\n"); 7105 break; 7106 case DIF_OP_LDSB: 7107 case DIF_OP_LDSH: 7108 case DIF_OP_LDSW: 7109 case DIF_OP_LDUB: 7110 case DIF_OP_LDUH: 7111 case DIF_OP_LDUW: 7112 case DIF_OP_LDX: 7113 if (r1 >= nregs) 7114 err += efunc(pc, "invalid register %u\n", r1); 7115 if (r2 != 0) 7116 err += efunc(pc, "non-zero reserved bits\n"); 7117 if (rd >= nregs) 7118 err += efunc(pc, "invalid register %u\n", rd); 7119 if (rd == 0) 7120 err += efunc(pc, "cannot write to %r0\n"); 7121 if (kcheck) 7122 dp->dtdo_buf[pc] = DIF_INSTR_LOAD(op + 7123 DIF_OP_RLDSB - DIF_OP_LDSB, r1, rd); 7124 break; 7125 case DIF_OP_RLDSB: 7126 case DIF_OP_RLDSH: 7127 case DIF_OP_RLDSW: 7128 case DIF_OP_RLDUB: 7129 case DIF_OP_RLDUH: 7130 case DIF_OP_RLDUW: 7131 case DIF_OP_RLDX: 7132 if (r1 >= nregs) 7133 err += efunc(pc, "invalid register %u\n", r1); 7134 if (r2 != 0) 7135 err += efunc(pc, "non-zero reserved bits\n"); 7136 if (rd >= nregs) 7137 err += efunc(pc, "invalid register %u\n", rd); 7138 if (rd == 0) 7139 err += efunc(pc, "cannot write to %r0\n"); 7140 break; 7141 case DIF_OP_ULDSB: 7142 case DIF_OP_ULDSH: 7143 case DIF_OP_ULDSW: 7144 case DIF_OP_ULDUB: 7145 case DIF_OP_ULDUH: 7146 case DIF_OP_ULDUW: 7147 case DIF_OP_ULDX: 7148 if (r1 >= nregs) 7149 err += efunc(pc, "invalid register %u\n", r1); 7150 if (r2 != 0) 7151 err += efunc(pc, "non-zero reserved bits\n"); 7152 if (rd >= nregs) 7153 err += efunc(pc, "invalid register %u\n", rd); 7154 if (rd == 0) 7155 err += efunc(pc, "cannot write to %r0\n"); 7156 break; 7157 case DIF_OP_STB: 7158 case DIF_OP_STH: 7159 case DIF_OP_STW: 7160 case DIF_OP_STX: 7161 if (r1 >= nregs) 7162 err += efunc(pc, "invalid register %u\n", r1); 7163 if (r2 != 0) 7164 err += efunc(pc, "non-zero reserved bits\n"); 7165 if (rd >= nregs) 7166 err += efunc(pc, "invalid register %u\n", rd); 7167 if (rd == 0) 7168 err += efunc(pc, "cannot write to 0 address\n"); 7169 break; 7170 case DIF_OP_CMP: 7171 case DIF_OP_SCMP: 7172 if (r1 >= nregs) 7173 err += efunc(pc, "invalid register %u\n", r1); 7174 if (r2 >= nregs) 7175 err += efunc(pc, "invalid register %u\n", r2); 7176 if (rd != 0) 7177 err += efunc(pc, "non-zero reserved bits\n"); 7178 break; 7179 case DIF_OP_TST: 7180 if (r1 >= nregs) 7181 err += efunc(pc, "invalid register %u\n", r1); 7182 if (r2 != 0 || rd != 0) 7183 err += efunc(pc, "non-zero reserved bits\n"); 7184 break; 7185 case DIF_OP_BA: 7186 case DIF_OP_BE: 7187 case DIF_OP_BNE: 7188 case DIF_OP_BG: 7189 case DIF_OP_BGU: 7190 case DIF_OP_BGE: 7191 case DIF_OP_BGEU: 7192 case DIF_OP_BL: 7193 case DIF_OP_BLU: 7194 case DIF_OP_BLE: 7195 case DIF_OP_BLEU: 7196 if (label >= dp->dtdo_len) { 7197 err += efunc(pc, "invalid branch target %u\n", 7198 label); 7199 } 7200 if (label <= pc) { 7201 err += efunc(pc, "backward branch to %u\n", 7202 label); 7203 } 7204 break; 7205 case DIF_OP_RET: 7206 if (r1 != 0 || r2 != 0) 7207 err += efunc(pc, "non-zero reserved bits\n"); 7208 if (rd >= nregs) 7209 err += efunc(pc, "invalid register %u\n", rd); 7210 break; 7211 case DIF_OP_NOP: 7212 case DIF_OP_POPTS: 7213 case DIF_OP_FLUSHTS: 7214 if (r1 != 0 || r2 != 0 || rd != 0) 7215 err += efunc(pc, "non-zero reserved bits\n"); 7216 break; 7217 case DIF_OP_SETX: 7218 if (DIF_INSTR_INTEGER(instr) >= dp->dtdo_intlen) { 7219 err += efunc(pc, "invalid integer ref %u\n", 7220 DIF_INSTR_INTEGER(instr)); 7221 } 7222 if (rd >= nregs) 7223 err += efunc(pc, "invalid register %u\n", rd); 7224 if (rd == 0) 7225 err += efunc(pc, "cannot write to %r0\n"); 7226 break; 7227 case DIF_OP_SETS: 7228 if (DIF_INSTR_STRING(instr) >= dp->dtdo_strlen) { 7229 err += efunc(pc, "invalid string ref %u\n", 7230 DIF_INSTR_STRING(instr)); 7231 } 7232 if (rd >= nregs) 7233 err += efunc(pc, "invalid register %u\n", rd); 7234 if (rd == 0) 7235 err += efunc(pc, "cannot write to %r0\n"); 7236 break; 7237 case DIF_OP_LDGA: 7238 case DIF_OP_LDTA: 7239 if (r1 > DIF_VAR_ARRAY_MAX) 7240 err += efunc(pc, "invalid array %u\n", r1); 7241 if (r2 >= nregs) 7242 err += efunc(pc, "invalid register %u\n", r2); 7243 if (rd >= nregs) 7244 err += efunc(pc, "invalid register %u\n", rd); 7245 if (rd == 0) 7246 err += efunc(pc, "cannot write to %r0\n"); 7247 break; 7248 case DIF_OP_LDGS: 7249 case DIF_OP_LDTS: 7250 case DIF_OP_LDLS: 7251 case DIF_OP_LDGAA: 7252 case DIF_OP_LDTAA: 7253 if (v < DIF_VAR_OTHER_MIN || v > DIF_VAR_OTHER_MAX) 7254 err += efunc(pc, "invalid variable %u\n", v); 7255 if (rd >= nregs) 7256 err += efunc(pc, "invalid register %u\n", rd); 7257 if (rd == 0) 7258 err += efunc(pc, "cannot write to %r0\n"); 7259 break; 7260 case DIF_OP_STGS: 7261 case DIF_OP_STTS: 7262 case DIF_OP_STLS: 7263 case DIF_OP_STGAA: 7264 case DIF_OP_STTAA: 7265 if (v < DIF_VAR_OTHER_UBASE || v > DIF_VAR_OTHER_MAX) 7266 err += efunc(pc, "invalid variable %u\n", v); 7267 if (rs >= nregs) 7268 err += efunc(pc, "invalid register %u\n", rd); 7269 break; 7270 case DIF_OP_CALL: 7271 if (subr > DIF_SUBR_MAX) 7272 err += efunc(pc, "invalid subr %u\n", subr); 7273 if (rd >= nregs) 7274 err += efunc(pc, "invalid register %u\n", rd); 7275 if (rd == 0) 7276 err += efunc(pc, "cannot write to %r0\n"); 7277 7278 if (subr == DIF_SUBR_COPYOUT || 7279 subr == DIF_SUBR_COPYOUTSTR) { 7280 dp->dtdo_destructive = 1; 7281 } 7282 break; 7283 case DIF_OP_PUSHTR: 7284 if (type != DIF_TYPE_STRING && type != DIF_TYPE_CTF) 7285 err += efunc(pc, "invalid ref type %u\n", type); 7286 if (r2 >= nregs) 7287 err += efunc(pc, "invalid register %u\n", r2); 7288 if (rs >= nregs) 7289 err += efunc(pc, "invalid register %u\n", rs); 7290 break; 7291 case DIF_OP_PUSHTV: 7292 if (type != DIF_TYPE_CTF) 7293 err += efunc(pc, "invalid val type %u\n", type); 7294 if (r2 >= nregs) 7295 err += efunc(pc, "invalid register %u\n", r2); 7296 if (rs >= nregs) 7297 err += efunc(pc, "invalid register %u\n", rs); 7298 break; 7299 default: 7300 err += efunc(pc, "invalid opcode %u\n", 7301 DIF_INSTR_OP(instr)); 7302 } 7303 } 7304 7305 if (dp->dtdo_len != 0 && 7306 DIF_INSTR_OP(dp->dtdo_buf[dp->dtdo_len - 1]) != DIF_OP_RET) { 7307 err += efunc(dp->dtdo_len - 1, 7308 "expected 'ret' as last DIF instruction\n"); 7309 } 7310 7311 if (!(dp->dtdo_rtype.dtdt_flags & DIF_TF_BYREF)) { 7312 /* 7313 * If we're not returning by reference, the size must be either 7314 * 0 or the size of one of the base types. 7315 */ 7316 switch (dp->dtdo_rtype.dtdt_size) { 7317 case 0: 7318 case sizeof (uint8_t): 7319 case sizeof (uint16_t): 7320 case sizeof (uint32_t): 7321 case sizeof (uint64_t): 7322 break; 7323 7324 default: 7325 err += efunc(dp->dtdo_len - 1, "bad return size"); 7326 } 7327 } 7328 7329 for (i = 0; i < dp->dtdo_varlen && err == 0; i++) { 7330 dtrace_difv_t *v = &dp->dtdo_vartab[i], *existing = NULL; 7331 dtrace_diftype_t *vt, *et; 7332 uint_t id, ndx; 7333 7334 if (v->dtdv_scope != DIFV_SCOPE_GLOBAL && 7335 v->dtdv_scope != DIFV_SCOPE_THREAD && 7336 v->dtdv_scope != DIFV_SCOPE_LOCAL) { 7337 err += efunc(i, "unrecognized variable scope %d\n", 7338 v->dtdv_scope); 7339 break; 7340 } 7341 7342 if (v->dtdv_kind != DIFV_KIND_ARRAY && 7343 v->dtdv_kind != DIFV_KIND_SCALAR) { 7344 err += efunc(i, "unrecognized variable type %d\n", 7345 v->dtdv_kind); 7346 break; 7347 } 7348 7349 if ((id = v->dtdv_id) > DIF_VARIABLE_MAX) { 7350 err += efunc(i, "%d exceeds variable id limit\n", id); 7351 break; 7352 } 7353 7354 if (id < DIF_VAR_OTHER_UBASE) 7355 continue; 7356 7357 /* 7358 * For user-defined variables, we need to check that this 7359 * definition is identical to any previous definition that we 7360 * encountered. 7361 */ 7362 ndx = id - DIF_VAR_OTHER_UBASE; 7363 7364 switch (v->dtdv_scope) { 7365 case DIFV_SCOPE_GLOBAL: 7366 if (ndx < vstate->dtvs_nglobals) { 7367 dtrace_statvar_t *svar; 7368 7369 if ((svar = vstate->dtvs_globals[ndx]) != NULL) 7370 existing = &svar->dtsv_var; 7371 } 7372 7373 break; 7374 7375 case DIFV_SCOPE_THREAD: 7376 if (ndx < vstate->dtvs_ntlocals) 7377 existing = &vstate->dtvs_tlocals[ndx]; 7378 break; 7379 7380 case DIFV_SCOPE_LOCAL: 7381 if (ndx < vstate->dtvs_nlocals) { 7382 dtrace_statvar_t *svar; 7383 7384 if ((svar = vstate->dtvs_locals[ndx]) != NULL) 7385 existing = &svar->dtsv_var; 7386 } 7387 7388 break; 7389 } 7390 7391 vt = &v->dtdv_type; 7392 7393 if (vt->dtdt_flags & DIF_TF_BYREF) { 7394 if (vt->dtdt_size == 0) { 7395 err += efunc(i, "zero-sized variable\n"); 7396 break; 7397 } 7398 7399 if (v->dtdv_scope == DIFV_SCOPE_GLOBAL && 7400 vt->dtdt_size > dtrace_global_maxsize) { 7401 err += efunc(i, "oversized by-ref global\n"); 7402 break; 7403 } 7404 } 7405 7406 if (existing == NULL || existing->dtdv_id == 0) 7407 continue; 7408 7409 ASSERT(existing->dtdv_id == v->dtdv_id); 7410 ASSERT(existing->dtdv_scope == v->dtdv_scope); 7411 7412 if (existing->dtdv_kind != v->dtdv_kind) 7413 err += efunc(i, "%d changed variable kind\n", id); 7414 7415 et = &existing->dtdv_type; 7416 7417 if (vt->dtdt_flags != et->dtdt_flags) { 7418 err += efunc(i, "%d changed variable type flags\n", id); 7419 break; 7420 } 7421 7422 if (vt->dtdt_size != 0 && vt->dtdt_size != et->dtdt_size) { 7423 err += efunc(i, "%d changed variable type size\n", id); 7424 break; 7425 } 7426 } 7427 7428 return (err); 7429 } 7430 7431 /* 7432 * Validate a DTrace DIF object that it is to be used as a helper. Helpers 7433 * are much more constrained than normal DIFOs. Specifically, they may 7434 * not: 7435 * 7436 * 1. Make calls to subroutines other than copyin(), copyinstr() or 7437 * miscellaneous string routines 7438 * 2. Access DTrace variables other than the args[] array, and the 7439 * curthread, pid, ppid, tid, execname, zonename, uid and gid variables. 7440 * 3. Have thread-local variables. 7441 * 4. Have dynamic variables. 7442 */ 7443 static int 7444 dtrace_difo_validate_helper(dtrace_difo_t *dp) 7445 { 7446 int (*efunc)(uint_t pc, const char *, ...) = dtrace_difo_err; 7447 int err = 0; 7448 uint_t pc; 7449 7450 for (pc = 0; pc < dp->dtdo_len; pc++) { 7451 dif_instr_t instr = dp->dtdo_buf[pc]; 7452 7453 uint_t v = DIF_INSTR_VAR(instr); 7454 uint_t subr = DIF_INSTR_SUBR(instr); 7455 uint_t op = DIF_INSTR_OP(instr); 7456 7457 switch (op) { 7458 case DIF_OP_OR: 7459 case DIF_OP_XOR: 7460 case DIF_OP_AND: 7461 case DIF_OP_SLL: 7462 case DIF_OP_SRL: 7463 case DIF_OP_SRA: 7464 case DIF_OP_SUB: 7465 case DIF_OP_ADD: 7466 case DIF_OP_MUL: 7467 case DIF_OP_SDIV: 7468 case DIF_OP_UDIV: 7469 case DIF_OP_SREM: 7470 case DIF_OP_UREM: 7471 case DIF_OP_COPYS: 7472 case DIF_OP_NOT: 7473 case DIF_OP_MOV: 7474 case DIF_OP_RLDSB: 7475 case DIF_OP_RLDSH: 7476 case DIF_OP_RLDSW: 7477 case DIF_OP_RLDUB: 7478 case DIF_OP_RLDUH: 7479 case DIF_OP_RLDUW: 7480 case DIF_OP_RLDX: 7481 case DIF_OP_ULDSB: 7482 case DIF_OP_ULDSH: 7483 case DIF_OP_ULDSW: 7484 case DIF_OP_ULDUB: 7485 case DIF_OP_ULDUH: 7486 case DIF_OP_ULDUW: 7487 case DIF_OP_ULDX: 7488 case DIF_OP_STB: 7489 case DIF_OP_STH: 7490 case DIF_OP_STW: 7491 case DIF_OP_STX: 7492 case DIF_OP_ALLOCS: 7493 case DIF_OP_CMP: 7494 case DIF_OP_SCMP: 7495 case DIF_OP_TST: 7496 case DIF_OP_BA: 7497 case DIF_OP_BE: 7498 case DIF_OP_BNE: 7499 case DIF_OP_BG: 7500 case DIF_OP_BGU: 7501 case DIF_OP_BGE: 7502 case DIF_OP_BGEU: 7503 case DIF_OP_BL: 7504 case DIF_OP_BLU: 7505 case DIF_OP_BLE: 7506 case DIF_OP_BLEU: 7507 case DIF_OP_RET: 7508 case DIF_OP_NOP: 7509 case DIF_OP_POPTS: 7510 case DIF_OP_FLUSHTS: 7511 case DIF_OP_SETX: 7512 case DIF_OP_SETS: 7513 case DIF_OP_LDGA: 7514 case DIF_OP_LDLS: 7515 case DIF_OP_STGS: 7516 case DIF_OP_STLS: 7517 case DIF_OP_PUSHTR: 7518 case DIF_OP_PUSHTV: 7519 break; 7520 7521 case DIF_OP_LDGS: 7522 if (v >= DIF_VAR_OTHER_UBASE) 7523 break; 7524 7525 if (v >= DIF_VAR_ARG0 && v <= DIF_VAR_ARG9) 7526 break; 7527 7528 if (v == DIF_VAR_CURTHREAD || v == DIF_VAR_PID || 7529 v == DIF_VAR_PPID || v == DIF_VAR_TID || 7530 v == DIF_VAR_EXECNAME || v == DIF_VAR_ZONENAME || 7531 v == DIF_VAR_UID || v == DIF_VAR_GID) 7532 break; 7533 7534 err += efunc(pc, "illegal variable %u\n", v); 7535 break; 7536 7537 case DIF_OP_LDTA: 7538 case DIF_OP_LDTS: 7539 case DIF_OP_LDGAA: 7540 case DIF_OP_LDTAA: 7541 err += efunc(pc, "illegal dynamic variable load\n"); 7542 break; 7543 7544 case DIF_OP_STTS: 7545 case DIF_OP_STGAA: 7546 case DIF_OP_STTAA: 7547 err += efunc(pc, "illegal dynamic variable store\n"); 7548 break; 7549 7550 case DIF_OP_CALL: 7551 if (subr == DIF_SUBR_ALLOCA || 7552 subr == DIF_SUBR_BCOPY || 7553 subr == DIF_SUBR_COPYIN || 7554 subr == DIF_SUBR_COPYINTO || 7555 subr == DIF_SUBR_COPYINSTR || 7556 subr == DIF_SUBR_INDEX || 7557 subr == DIF_SUBR_LLTOSTR || 7558 subr == DIF_SUBR_RINDEX || 7559 subr == DIF_SUBR_STRCHR || 7560 subr == DIF_SUBR_STRJOIN || 7561 subr == DIF_SUBR_STRRCHR || 7562 subr == DIF_SUBR_STRSTR) 7563 break; 7564 7565 err += efunc(pc, "invalid subr %u\n", subr); 7566 break; 7567 7568 default: 7569 err += efunc(pc, "invalid opcode %u\n", 7570 DIF_INSTR_OP(instr)); 7571 } 7572 } 7573 7574 return (err); 7575 } 7576 7577 /* 7578 * Returns 1 if the expression in the DIF object can be cached on a per-thread 7579 * basis; 0 if not. 7580 */ 7581 static int 7582 dtrace_difo_cacheable(dtrace_difo_t *dp) 7583 { 7584 int i; 7585 7586 if (dp == NULL) 7587 return (0); 7588 7589 for (i = 0; i < dp->dtdo_varlen; i++) { 7590 dtrace_difv_t *v = &dp->dtdo_vartab[i]; 7591 7592 if (v->dtdv_scope != DIFV_SCOPE_GLOBAL) 7593 continue; 7594 7595 switch (v->dtdv_id) { 7596 case DIF_VAR_CURTHREAD: 7597 case DIF_VAR_PID: 7598 case DIF_VAR_TID: 7599 case DIF_VAR_EXECNAME: 7600 case DIF_VAR_ZONENAME: 7601 break; 7602 7603 default: 7604 return (0); 7605 } 7606 } 7607 7608 /* 7609 * This DIF object may be cacheable. Now we need to look for any 7610 * array loading instructions, any memory loading instructions, or 7611 * any stores to thread-local variables. 7612 */ 7613 for (i = 0; i < dp->dtdo_len; i++) { 7614 uint_t op = DIF_INSTR_OP(dp->dtdo_buf[i]); 7615 7616 if ((op >= DIF_OP_LDSB && op <= DIF_OP_LDX) || 7617 (op >= DIF_OP_ULDSB && op <= DIF_OP_ULDX) || 7618 (op >= DIF_OP_RLDSB && op <= DIF_OP_RLDX) || 7619 op == DIF_OP_LDGA || op == DIF_OP_STTS) 7620 return (0); 7621 } 7622 7623 return (1); 7624 } 7625 7626 static void 7627 dtrace_difo_hold(dtrace_difo_t *dp) 7628 { 7629 int i; 7630 7631 ASSERT(MUTEX_HELD(&dtrace_lock)); 7632 7633 dp->dtdo_refcnt++; 7634 ASSERT(dp->dtdo_refcnt != 0); 7635 7636 /* 7637 * We need to check this DIF object for references to the variable 7638 * DIF_VAR_VTIMESTAMP. 7639 */ 7640 for (i = 0; i < dp->dtdo_varlen; i++) { 7641 dtrace_difv_t *v = &dp->dtdo_vartab[i]; 7642 7643 if (v->dtdv_id != DIF_VAR_VTIMESTAMP) 7644 continue; 7645 7646 if (dtrace_vtime_references++ == 0) 7647 dtrace_vtime_enable(); 7648 } 7649 } 7650 7651 /* 7652 * This routine calculates the dynamic variable chunksize for a given DIF 7653 * object. The calculation is not fool-proof, and can probably be tricked by 7654 * malicious DIF -- but it works for all compiler-generated DIF. Because this 7655 * calculation is likely imperfect, dtrace_dynvar() is able to gracefully fail 7656 * if a dynamic variable size exceeds the chunksize. 7657 */ 7658 static void 7659 dtrace_difo_chunksize(dtrace_difo_t *dp, dtrace_vstate_t *vstate) 7660 { 7661 uint64_t sval; 7662 dtrace_key_t tupregs[DIF_DTR_NREGS + 2]; /* +2 for thread and id */ 7663 const dif_instr_t *text = dp->dtdo_buf; 7664 uint_t pc, srd = 0; 7665 uint_t ttop = 0; 7666 size_t size, ksize; 7667 uint_t id, i; 7668 7669 for (pc = 0; pc < dp->dtdo_len; pc++) { 7670 dif_instr_t instr = text[pc]; 7671 uint_t op = DIF_INSTR_OP(instr); 7672 uint_t rd = DIF_INSTR_RD(instr); 7673 uint_t r1 = DIF_INSTR_R1(instr); 7674 uint_t nkeys = 0; 7675 uchar_t scope; 7676 7677 dtrace_key_t *key = tupregs; 7678 7679 switch (op) { 7680 case DIF_OP_SETX: 7681 sval = dp->dtdo_inttab[DIF_INSTR_INTEGER(instr)]; 7682 srd = rd; 7683 continue; 7684 7685 case DIF_OP_STTS: 7686 key = &tupregs[DIF_DTR_NREGS]; 7687 key[0].dttk_size = 0; 7688 key[1].dttk_size = 0; 7689 nkeys = 2; 7690 scope = DIFV_SCOPE_THREAD; 7691 break; 7692 7693 case DIF_OP_STGAA: 7694 case DIF_OP_STTAA: 7695 nkeys = ttop; 7696 7697 if (DIF_INSTR_OP(instr) == DIF_OP_STTAA) 7698 key[nkeys++].dttk_size = 0; 7699 7700 key[nkeys++].dttk_size = 0; 7701 7702 if (op == DIF_OP_STTAA) { 7703 scope = DIFV_SCOPE_THREAD; 7704 } else { 7705 scope = DIFV_SCOPE_GLOBAL; 7706 } 7707 7708 break; 7709 7710 case DIF_OP_PUSHTR: 7711 if (ttop == DIF_DTR_NREGS) 7712 return; 7713 7714 if ((srd == 0 || sval == 0) && r1 == DIF_TYPE_STRING) { 7715 /* 7716 * If the register for the size of the "pushtr" 7717 * is %r0 (or the value is 0) and the type is 7718 * a string, we'll use the system-wide default 7719 * string size. 7720 */ 7721 tupregs[ttop++].dttk_size = 7722 dtrace_strsize_default; 7723 } else { 7724 if (srd == 0) 7725 return; 7726 7727 tupregs[ttop++].dttk_size = sval; 7728 } 7729 7730 break; 7731 7732 case DIF_OP_PUSHTV: 7733 if (ttop == DIF_DTR_NREGS) 7734 return; 7735 7736 tupregs[ttop++].dttk_size = 0; 7737 break; 7738 7739 case DIF_OP_FLUSHTS: 7740 ttop = 0; 7741 break; 7742 7743 case DIF_OP_POPTS: 7744 if (ttop != 0) 7745 ttop--; 7746 break; 7747 } 7748 7749 sval = 0; 7750 srd = 0; 7751 7752 if (nkeys == 0) 7753 continue; 7754 7755 /* 7756 * We have a dynamic variable allocation; calculate its size. 7757 */ 7758 for (ksize = 0, i = 0; i < nkeys; i++) 7759 ksize += P2ROUNDUP(key[i].dttk_size, sizeof (uint64_t)); 7760 7761 size = sizeof (dtrace_dynvar_t); 7762 size += sizeof (dtrace_key_t) * (nkeys - 1); 7763 size += ksize; 7764 7765 /* 7766 * Now we need to determine the size of the stored data. 7767 */ 7768 id = DIF_INSTR_VAR(instr); 7769 7770 for (i = 0; i < dp->dtdo_varlen; i++) { 7771 dtrace_difv_t *v = &dp->dtdo_vartab[i]; 7772 7773 if (v->dtdv_id == id && v->dtdv_scope == scope) { 7774 size += v->dtdv_type.dtdt_size; 7775 break; 7776 } 7777 } 7778 7779 if (i == dp->dtdo_varlen) 7780 return; 7781 7782 /* 7783 * We have the size. If this is larger than the chunk size 7784 * for our dynamic variable state, reset the chunk size. 7785 */ 7786 size = P2ROUNDUP(size, sizeof (uint64_t)); 7787 7788 if (size > vstate->dtvs_dynvars.dtds_chunksize) 7789 vstate->dtvs_dynvars.dtds_chunksize = size; 7790 } 7791 } 7792 7793 static void 7794 dtrace_difo_init(dtrace_difo_t *dp, dtrace_vstate_t *vstate) 7795 { 7796 int i, oldsvars, osz, nsz, otlocals, ntlocals; 7797 uint_t id; 7798 7799 ASSERT(MUTEX_HELD(&dtrace_lock)); 7800 ASSERT(dp->dtdo_buf != NULL && dp->dtdo_len != 0); 7801 7802 for (i = 0; i < dp->dtdo_varlen; i++) { 7803 dtrace_difv_t *v = &dp->dtdo_vartab[i]; 7804 dtrace_statvar_t *svar, ***svarp; 7805 size_t dsize = 0; 7806 uint8_t scope = v->dtdv_scope; 7807 int *np; 7808 7809 if ((id = v->dtdv_id) < DIF_VAR_OTHER_UBASE) 7810 continue; 7811 7812 id -= DIF_VAR_OTHER_UBASE; 7813 7814 switch (scope) { 7815 case DIFV_SCOPE_THREAD: 7816 while (id >= (otlocals = vstate->dtvs_ntlocals)) { 7817 dtrace_difv_t *tlocals; 7818 7819 if ((ntlocals = (otlocals << 1)) == 0) 7820 ntlocals = 1; 7821 7822 osz = otlocals * sizeof (dtrace_difv_t); 7823 nsz = ntlocals * sizeof (dtrace_difv_t); 7824 7825 tlocals = kmem_zalloc(nsz, KM_SLEEP); 7826 7827 if (osz != 0) { 7828 bcopy(vstate->dtvs_tlocals, 7829 tlocals, osz); 7830 kmem_free(vstate->dtvs_tlocals, osz); 7831 } 7832 7833 vstate->dtvs_tlocals = tlocals; 7834 vstate->dtvs_ntlocals = ntlocals; 7835 } 7836 7837 vstate->dtvs_tlocals[id] = *v; 7838 continue; 7839 7840 case DIFV_SCOPE_LOCAL: 7841 np = &vstate->dtvs_nlocals; 7842 svarp = &vstate->dtvs_locals; 7843 7844 if (v->dtdv_type.dtdt_flags & DIF_TF_BYREF) 7845 dsize = NCPU * (v->dtdv_type.dtdt_size + 7846 sizeof (uint64_t)); 7847 else 7848 dsize = NCPU * sizeof (uint64_t); 7849 7850 break; 7851 7852 case DIFV_SCOPE_GLOBAL: 7853 np = &vstate->dtvs_nglobals; 7854 svarp = &vstate->dtvs_globals; 7855 7856 if (v->dtdv_type.dtdt_flags & DIF_TF_BYREF) 7857 dsize = v->dtdv_type.dtdt_size + 7858 sizeof (uint64_t); 7859 7860 break; 7861 7862 default: 7863 ASSERT(0); 7864 } 7865 7866 while (id >= (oldsvars = *np)) { 7867 dtrace_statvar_t **statics; 7868 int newsvars, oldsize, newsize; 7869 7870 if ((newsvars = (oldsvars << 1)) == 0) 7871 newsvars = 1; 7872 7873 oldsize = oldsvars * sizeof (dtrace_statvar_t *); 7874 newsize = newsvars * sizeof (dtrace_statvar_t *); 7875 7876 statics = kmem_zalloc(newsize, KM_SLEEP); 7877 7878 if (oldsize != 0) { 7879 bcopy(*svarp, statics, oldsize); 7880 kmem_free(*svarp, oldsize); 7881 } 7882 7883 *svarp = statics; 7884 *np = newsvars; 7885 } 7886 7887 if ((svar = (*svarp)[id]) == NULL) { 7888 svar = kmem_zalloc(sizeof (dtrace_statvar_t), KM_SLEEP); 7889 svar->dtsv_var = *v; 7890 7891 if ((svar->dtsv_size = dsize) != 0) { 7892 svar->dtsv_data = (uint64_t)(uintptr_t) 7893 kmem_zalloc(dsize, KM_SLEEP); 7894 } 7895 7896 (*svarp)[id] = svar; 7897 } 7898 7899 svar->dtsv_refcnt++; 7900 } 7901 7902 dtrace_difo_chunksize(dp, vstate); 7903 dtrace_difo_hold(dp); 7904 } 7905 7906 static dtrace_difo_t * 7907 dtrace_difo_duplicate(dtrace_difo_t *dp, dtrace_vstate_t *vstate) 7908 { 7909 dtrace_difo_t *new; 7910 size_t sz; 7911 7912 ASSERT(dp->dtdo_buf != NULL); 7913 ASSERT(dp->dtdo_refcnt != 0); 7914 7915 new = kmem_zalloc(sizeof (dtrace_difo_t), KM_SLEEP); 7916 7917 ASSERT(dp->dtdo_buf != NULL); 7918 sz = dp->dtdo_len * sizeof (dif_instr_t); 7919 new->dtdo_buf = kmem_alloc(sz, KM_SLEEP); 7920 bcopy(dp->dtdo_buf, new->dtdo_buf, sz); 7921 new->dtdo_len = dp->dtdo_len; 7922 7923 if (dp->dtdo_strtab != NULL) { 7924 ASSERT(dp->dtdo_strlen != 0); 7925 new->dtdo_strtab = kmem_alloc(dp->dtdo_strlen, KM_SLEEP); 7926 bcopy(dp->dtdo_strtab, new->dtdo_strtab, dp->dtdo_strlen); 7927 new->dtdo_strlen = dp->dtdo_strlen; 7928 } 7929 7930 if (dp->dtdo_inttab != NULL) { 7931 ASSERT(dp->dtdo_intlen != 0); 7932 sz = dp->dtdo_intlen * sizeof (uint64_t); 7933 new->dtdo_inttab = kmem_alloc(sz, KM_SLEEP); 7934 bcopy(dp->dtdo_inttab, new->dtdo_inttab, sz); 7935 new->dtdo_intlen = dp->dtdo_intlen; 7936 } 7937 7938 if (dp->dtdo_vartab != NULL) { 7939 ASSERT(dp->dtdo_varlen != 0); 7940 sz = dp->dtdo_varlen * sizeof (dtrace_difv_t); 7941 new->dtdo_vartab = kmem_alloc(sz, KM_SLEEP); 7942 bcopy(dp->dtdo_vartab, new->dtdo_vartab, sz); 7943 new->dtdo_varlen = dp->dtdo_varlen; 7944 } 7945 7946 dtrace_difo_init(new, vstate); 7947 return (new); 7948 } 7949 7950 static void 7951 dtrace_difo_destroy(dtrace_difo_t *dp, dtrace_vstate_t *vstate) 7952 { 7953 int i; 7954 7955 ASSERT(dp->dtdo_refcnt == 0); 7956 7957 for (i = 0; i < dp->dtdo_varlen; i++) { 7958 dtrace_difv_t *v = &dp->dtdo_vartab[i]; 7959 dtrace_statvar_t *svar, **svarp; 7960 uint_t id; 7961 uint8_t scope = v->dtdv_scope; 7962 int *np; 7963 7964 switch (scope) { 7965 case DIFV_SCOPE_THREAD: 7966 continue; 7967 7968 case DIFV_SCOPE_LOCAL: 7969 np = &vstate->dtvs_nlocals; 7970 svarp = vstate->dtvs_locals; 7971 break; 7972 7973 case DIFV_SCOPE_GLOBAL: 7974 np = &vstate->dtvs_nglobals; 7975 svarp = vstate->dtvs_globals; 7976 break; 7977 7978 default: 7979 ASSERT(0); 7980 } 7981 7982 if ((id = v->dtdv_id) < DIF_VAR_OTHER_UBASE) 7983 continue; 7984 7985 id -= DIF_VAR_OTHER_UBASE; 7986 ASSERT(id < *np); 7987 7988 svar = svarp[id]; 7989 ASSERT(svar != NULL); 7990 ASSERT(svar->dtsv_refcnt > 0); 7991 7992 if (--svar->dtsv_refcnt > 0) 7993 continue; 7994 7995 if (svar->dtsv_size != 0) { 7996 ASSERT(svar->dtsv_data != NULL); 7997 kmem_free((void *)(uintptr_t)svar->dtsv_data, 7998 svar->dtsv_size); 7999 } 8000 8001 kmem_free(svar, sizeof (dtrace_statvar_t)); 8002 svarp[id] = NULL; 8003 } 8004 8005 kmem_free(dp->dtdo_buf, dp->dtdo_len * sizeof (dif_instr_t)); 8006 kmem_free(dp->dtdo_inttab, dp->dtdo_intlen * sizeof (uint64_t)); 8007 kmem_free(dp->dtdo_strtab, dp->dtdo_strlen); 8008 kmem_free(dp->dtdo_vartab, dp->dtdo_varlen * sizeof (dtrace_difv_t)); 8009 8010 kmem_free(dp, sizeof (dtrace_difo_t)); 8011 } 8012 8013 static void 8014 dtrace_difo_release(dtrace_difo_t *dp, dtrace_vstate_t *vstate) 8015 { 8016 int i; 8017 8018 ASSERT(MUTEX_HELD(&dtrace_lock)); 8019 ASSERT(dp->dtdo_refcnt != 0); 8020 8021 for (i = 0; i < dp->dtdo_varlen; i++) { 8022 dtrace_difv_t *v = &dp->dtdo_vartab[i]; 8023 8024 if (v->dtdv_id != DIF_VAR_VTIMESTAMP) 8025 continue; 8026 8027 ASSERT(dtrace_vtime_references > 0); 8028 if (--dtrace_vtime_references == 0) 8029 dtrace_vtime_disable(); 8030 } 8031 8032 if (--dp->dtdo_refcnt == 0) 8033 dtrace_difo_destroy(dp, vstate); 8034 } 8035 8036 /* 8037 * DTrace Format Functions 8038 */ 8039 static uint16_t 8040 dtrace_format_add(dtrace_state_t *state, char *str) 8041 { 8042 char *fmt, **new; 8043 uint16_t ndx, len = strlen(str) + 1; 8044 8045 fmt = kmem_zalloc(len, KM_SLEEP); 8046 bcopy(str, fmt, len); 8047 8048 for (ndx = 0; ndx < state->dts_nformats; ndx++) { 8049 if (state->dts_formats[ndx] == NULL) { 8050 state->dts_formats[ndx] = fmt; 8051 return (ndx + 1); 8052 } 8053 } 8054 8055 if (state->dts_nformats == USHRT_MAX) { 8056 /* 8057 * This is only likely if a denial-of-service attack is being 8058 * attempted. As such, it's okay to fail silently here. 8059 */ 8060 kmem_free(fmt, len); 8061 return (0); 8062 } 8063 8064 /* 8065 * For simplicity, we always resize the formats array to be exactly the 8066 * number of formats. 8067 */ 8068 ndx = state->dts_nformats++; 8069 new = kmem_alloc((ndx + 1) * sizeof (char *), KM_SLEEP); 8070 8071 if (state->dts_formats != NULL) { 8072 ASSERT(ndx != 0); 8073 bcopy(state->dts_formats, new, ndx * sizeof (char *)); 8074 kmem_free(state->dts_formats, ndx * sizeof (char *)); 8075 } 8076 8077 state->dts_formats = new; 8078 state->dts_formats[ndx] = fmt; 8079 8080 return (ndx + 1); 8081 } 8082 8083 static void 8084 dtrace_format_remove(dtrace_state_t *state, uint16_t format) 8085 { 8086 char *fmt; 8087 8088 ASSERT(state->dts_formats != NULL); 8089 ASSERT(format <= state->dts_nformats); 8090 ASSERT(state->dts_formats[format - 1] != NULL); 8091 8092 fmt = state->dts_formats[format - 1]; 8093 kmem_free(fmt, strlen(fmt) + 1); 8094 state->dts_formats[format - 1] = NULL; 8095 } 8096 8097 static void 8098 dtrace_format_destroy(dtrace_state_t *state) 8099 { 8100 int i; 8101 8102 if (state->dts_nformats == 0) { 8103 ASSERT(state->dts_formats == NULL); 8104 return; 8105 } 8106 8107 ASSERT(state->dts_formats != NULL); 8108 8109 for (i = 0; i < state->dts_nformats; i++) { 8110 char *fmt = state->dts_formats[i]; 8111 8112 if (fmt == NULL) 8113 continue; 8114 8115 kmem_free(fmt, strlen(fmt) + 1); 8116 } 8117 8118 kmem_free(state->dts_formats, state->dts_nformats * sizeof (char *)); 8119 state->dts_nformats = 0; 8120 state->dts_formats = NULL; 8121 } 8122 8123 /* 8124 * DTrace Predicate Functions 8125 */ 8126 static dtrace_predicate_t * 8127 dtrace_predicate_create(dtrace_difo_t *dp) 8128 { 8129 dtrace_predicate_t *pred; 8130 8131 ASSERT(MUTEX_HELD(&dtrace_lock)); 8132 ASSERT(dp->dtdo_refcnt != 0); 8133 8134 pred = kmem_zalloc(sizeof (dtrace_predicate_t), KM_SLEEP); 8135 pred->dtp_difo = dp; 8136 pred->dtp_refcnt = 1; 8137 8138 if (!dtrace_difo_cacheable(dp)) 8139 return (pred); 8140 8141 if (dtrace_predcache_id == DTRACE_CACHEIDNONE) { 8142 /* 8143 * This is only theoretically possible -- we have had 2^32 8144 * cacheable predicates on this machine. We cannot allow any 8145 * more predicates to become cacheable: as unlikely as it is, 8146 * there may be a thread caching a (now stale) predicate cache 8147 * ID. (N.B.: the temptation is being successfully resisted to 8148 * have this cmn_err() "Holy shit -- we executed this code!") 8149 */ 8150 return (pred); 8151 } 8152 8153 pred->dtp_cacheid = dtrace_predcache_id++; 8154 8155 return (pred); 8156 } 8157 8158 static void 8159 dtrace_predicate_hold(dtrace_predicate_t *pred) 8160 { 8161 ASSERT(MUTEX_HELD(&dtrace_lock)); 8162 ASSERT(pred->dtp_difo != NULL && pred->dtp_difo->dtdo_refcnt != 0); 8163 ASSERT(pred->dtp_refcnt > 0); 8164 8165 pred->dtp_refcnt++; 8166 } 8167 8168 static void 8169 dtrace_predicate_release(dtrace_predicate_t *pred, dtrace_vstate_t *vstate) 8170 { 8171 dtrace_difo_t *dp = pred->dtp_difo; 8172 8173 ASSERT(MUTEX_HELD(&dtrace_lock)); 8174 ASSERT(dp != NULL && dp->dtdo_refcnt != 0); 8175 ASSERT(pred->dtp_refcnt > 0); 8176 8177 if (--pred->dtp_refcnt == 0) { 8178 dtrace_difo_release(pred->dtp_difo, vstate); 8179 kmem_free(pred, sizeof (dtrace_predicate_t)); 8180 } 8181 } 8182 8183 /* 8184 * DTrace Action Description Functions 8185 */ 8186 static dtrace_actdesc_t * 8187 dtrace_actdesc_create(dtrace_actkind_t kind, uint32_t ntuple, 8188 uint64_t uarg, uint64_t arg) 8189 { 8190 dtrace_actdesc_t *act; 8191 8192 ASSERT(!DTRACEACT_ISPRINTFLIKE(kind) || (arg != NULL && 8193 arg >= KERNELBASE) || (arg == NULL && kind == DTRACEACT_PRINTA)); 8194 8195 act = kmem_zalloc(sizeof (dtrace_actdesc_t), KM_SLEEP); 8196 act->dtad_kind = kind; 8197 act->dtad_ntuple = ntuple; 8198 act->dtad_uarg = uarg; 8199 act->dtad_arg = arg; 8200 act->dtad_refcnt = 1; 8201 8202 return (act); 8203 } 8204 8205 static void 8206 dtrace_actdesc_hold(dtrace_actdesc_t *act) 8207 { 8208 ASSERT(act->dtad_refcnt >= 1); 8209 act->dtad_refcnt++; 8210 } 8211 8212 static void 8213 dtrace_actdesc_release(dtrace_actdesc_t *act, dtrace_vstate_t *vstate) 8214 { 8215 dtrace_actkind_t kind = act->dtad_kind; 8216 dtrace_difo_t *dp; 8217 8218 ASSERT(act->dtad_refcnt >= 1); 8219 8220 if (--act->dtad_refcnt != 0) 8221 return; 8222 8223 if ((dp = act->dtad_difo) != NULL) 8224 dtrace_difo_release(dp, vstate); 8225 8226 if (DTRACEACT_ISPRINTFLIKE(kind)) { 8227 char *str = (char *)(uintptr_t)act->dtad_arg; 8228 8229 ASSERT((str != NULL && (uintptr_t)str >= KERNELBASE) || 8230 (str == NULL && act->dtad_kind == DTRACEACT_PRINTA)); 8231 8232 if (str != NULL) 8233 kmem_free(str, strlen(str) + 1); 8234 } 8235 8236 kmem_free(act, sizeof (dtrace_actdesc_t)); 8237 } 8238 8239 /* 8240 * DTrace ECB Functions 8241 */ 8242 static dtrace_ecb_t * 8243 dtrace_ecb_add(dtrace_state_t *state, dtrace_probe_t *probe) 8244 { 8245 dtrace_ecb_t *ecb; 8246 dtrace_epid_t epid; 8247 8248 ASSERT(MUTEX_HELD(&dtrace_lock)); 8249 8250 ecb = kmem_zalloc(sizeof (dtrace_ecb_t), KM_SLEEP); 8251 ecb->dte_predicate = NULL; 8252 ecb->dte_probe = probe; 8253 8254 /* 8255 * The default size is the size of the default action: recording 8256 * the epid. 8257 */ 8258 ecb->dte_size = ecb->dte_needed = sizeof (dtrace_epid_t); 8259 ecb->dte_alignment = sizeof (dtrace_epid_t); 8260 8261 epid = state->dts_epid++; 8262 8263 if (epid - 1 >= state->dts_necbs) { 8264 dtrace_ecb_t **oecbs = state->dts_ecbs, **ecbs; 8265 int necbs = state->dts_necbs << 1; 8266 8267 ASSERT(epid == state->dts_necbs + 1); 8268 8269 if (necbs == 0) { 8270 ASSERT(oecbs == NULL); 8271 necbs = 1; 8272 } 8273 8274 ecbs = kmem_zalloc(necbs * sizeof (*ecbs), KM_SLEEP); 8275 8276 if (oecbs != NULL) 8277 bcopy(oecbs, ecbs, state->dts_necbs * sizeof (*ecbs)); 8278 8279 dtrace_membar_producer(); 8280 state->dts_ecbs = ecbs; 8281 8282 if (oecbs != NULL) { 8283 /* 8284 * If this state is active, we must dtrace_sync() 8285 * before we can free the old dts_ecbs array: we're 8286 * coming in hot, and there may be active ring 8287 * buffer processing (which indexes into the dts_ecbs 8288 * array) on another CPU. 8289 */ 8290 if (state->dts_activity != DTRACE_ACTIVITY_INACTIVE) 8291 dtrace_sync(); 8292 8293 kmem_free(oecbs, state->dts_necbs * sizeof (*ecbs)); 8294 } 8295 8296 dtrace_membar_producer(); 8297 state->dts_necbs = necbs; 8298 } 8299 8300 ecb->dte_state = state; 8301 8302 ASSERT(state->dts_ecbs[epid - 1] == NULL); 8303 dtrace_membar_producer(); 8304 state->dts_ecbs[(ecb->dte_epid = epid) - 1] = ecb; 8305 8306 return (ecb); 8307 } 8308 8309 static void 8310 dtrace_ecb_enable(dtrace_ecb_t *ecb) 8311 { 8312 dtrace_probe_t *probe = ecb->dte_probe; 8313 8314 ASSERT(MUTEX_HELD(&cpu_lock)); 8315 ASSERT(MUTEX_HELD(&dtrace_lock)); 8316 ASSERT(ecb->dte_next == NULL); 8317 8318 if (probe == NULL) { 8319 /* 8320 * This is the NULL probe -- there's nothing to do. 8321 */ 8322 return; 8323 } 8324 8325 if (probe->dtpr_ecb == NULL) { 8326 dtrace_provider_t *prov = probe->dtpr_provider; 8327 8328 /* 8329 * We're the first ECB on this probe. 8330 */ 8331 probe->dtpr_ecb = probe->dtpr_ecb_last = ecb; 8332 8333 if (ecb->dte_predicate != NULL) 8334 probe->dtpr_predcache = ecb->dte_predicate->dtp_cacheid; 8335 8336 prov->dtpv_pops.dtps_enable(prov->dtpv_arg, 8337 probe->dtpr_id, probe->dtpr_arg); 8338 } else { 8339 /* 8340 * This probe is already active. Swing the last pointer to 8341 * point to the new ECB, and issue a dtrace_sync() to assure 8342 * that all CPUs have seen the change. 8343 */ 8344 ASSERT(probe->dtpr_ecb_last != NULL); 8345 probe->dtpr_ecb_last->dte_next = ecb; 8346 probe->dtpr_ecb_last = ecb; 8347 probe->dtpr_predcache = 0; 8348 8349 dtrace_sync(); 8350 } 8351 } 8352 8353 static void 8354 dtrace_ecb_resize(dtrace_ecb_t *ecb) 8355 { 8356 uint32_t maxalign = sizeof (dtrace_epid_t); 8357 uint32_t align = sizeof (uint8_t), offs, diff; 8358 dtrace_action_t *act; 8359 int wastuple = 0; 8360 uint32_t aggbase = UINT32_MAX; 8361 dtrace_state_t *state = ecb->dte_state; 8362 8363 /* 8364 * If we record anything, we always record the epid. (And we always 8365 * record it first.) 8366 */ 8367 offs = sizeof (dtrace_epid_t); 8368 ecb->dte_size = ecb->dte_needed = sizeof (dtrace_epid_t); 8369 8370 for (act = ecb->dte_action; act != NULL; act = act->dta_next) { 8371 dtrace_recdesc_t *rec = &act->dta_rec; 8372 8373 if ((align = rec->dtrd_alignment) > maxalign) 8374 maxalign = align; 8375 8376 if (!wastuple && act->dta_intuple) { 8377 /* 8378 * This is the first record in a tuple. Align the 8379 * offset to be at offset 4 in an 8-byte aligned 8380 * block. 8381 */ 8382 diff = offs + sizeof (dtrace_aggid_t); 8383 8384 if (diff = (diff & (sizeof (uint64_t) - 1))) 8385 offs += sizeof (uint64_t) - diff; 8386 8387 aggbase = offs - sizeof (dtrace_aggid_t); 8388 ASSERT(!(aggbase & (sizeof (uint64_t) - 1))); 8389 } 8390 8391 /*LINTED*/ 8392 if (rec->dtrd_size != 0 && (diff = (offs & (align - 1)))) { 8393 /* 8394 * The current offset is not properly aligned; align it. 8395 */ 8396 offs += align - diff; 8397 } 8398 8399 rec->dtrd_offset = offs; 8400 8401 if (offs + rec->dtrd_size > ecb->dte_needed) { 8402 ecb->dte_needed = offs + rec->dtrd_size; 8403 8404 if (ecb->dte_needed > state->dts_needed) 8405 state->dts_needed = ecb->dte_needed; 8406 } 8407 8408 if (DTRACEACT_ISAGG(act->dta_kind)) { 8409 dtrace_aggregation_t *agg = (dtrace_aggregation_t *)act; 8410 dtrace_action_t *first = agg->dtag_first, *prev; 8411 8412 ASSERT(rec->dtrd_size != 0 && first != NULL); 8413 ASSERT(wastuple); 8414 ASSERT(aggbase != UINT32_MAX); 8415 8416 agg->dtag_base = aggbase; 8417 8418 while ((prev = first->dta_prev) != NULL && 8419 DTRACEACT_ISAGG(prev->dta_kind)) { 8420 agg = (dtrace_aggregation_t *)prev; 8421 first = agg->dtag_first; 8422 } 8423 8424 if (prev != NULL) { 8425 offs = prev->dta_rec.dtrd_offset + 8426 prev->dta_rec.dtrd_size; 8427 } else { 8428 offs = sizeof (dtrace_epid_t); 8429 } 8430 wastuple = 0; 8431 } else { 8432 if (!act->dta_intuple) 8433 ecb->dte_size = offs + rec->dtrd_size; 8434 8435 offs += rec->dtrd_size; 8436 } 8437 8438 wastuple = act->dta_intuple; 8439 } 8440 8441 if ((act = ecb->dte_action) != NULL && 8442 !(act->dta_kind == DTRACEACT_SPECULATE && act->dta_next == NULL) && 8443 ecb->dte_size == sizeof (dtrace_epid_t)) { 8444 /* 8445 * If the size is still sizeof (dtrace_epid_t), then all 8446 * actions store no data; set the size to 0. 8447 */ 8448 ecb->dte_alignment = maxalign; 8449 ecb->dte_size = 0; 8450 8451 /* 8452 * If the needed space is still sizeof (dtrace_epid_t), then 8453 * all actions need no additional space; set the needed 8454 * size to 0. 8455 */ 8456 if (ecb->dte_needed == sizeof (dtrace_epid_t)) 8457 ecb->dte_needed = 0; 8458 8459 return; 8460 } 8461 8462 /* 8463 * Set our alignment, and make sure that the dte_size and dte_needed 8464 * are aligned to the size of an EPID. 8465 */ 8466 ecb->dte_alignment = maxalign; 8467 ecb->dte_size = (ecb->dte_size + (sizeof (dtrace_epid_t) - 1)) & 8468 ~(sizeof (dtrace_epid_t) - 1); 8469 ecb->dte_needed = (ecb->dte_needed + (sizeof (dtrace_epid_t) - 1)) & 8470 ~(sizeof (dtrace_epid_t) - 1); 8471 ASSERT(ecb->dte_size <= ecb->dte_needed); 8472 } 8473 8474 static dtrace_action_t * 8475 dtrace_ecb_aggregation_create(dtrace_ecb_t *ecb, dtrace_actdesc_t *desc) 8476 { 8477 dtrace_aggregation_t *agg; 8478 size_t size = sizeof (uint64_t); 8479 int ntuple = desc->dtad_ntuple; 8480 dtrace_action_t *act; 8481 dtrace_recdesc_t *frec; 8482 dtrace_aggid_t aggid; 8483 dtrace_state_t *state = ecb->dte_state; 8484 8485 agg = kmem_zalloc(sizeof (dtrace_aggregation_t), KM_SLEEP); 8486 agg->dtag_ecb = ecb; 8487 8488 ASSERT(DTRACEACT_ISAGG(desc->dtad_kind)); 8489 8490 switch (desc->dtad_kind) { 8491 case DTRACEAGG_MIN: 8492 agg->dtag_initial = UINT64_MAX; 8493 agg->dtag_aggregate = dtrace_aggregate_min; 8494 break; 8495 8496 case DTRACEAGG_MAX: 8497 agg->dtag_aggregate = dtrace_aggregate_max; 8498 break; 8499 8500 case DTRACEAGG_COUNT: 8501 agg->dtag_aggregate = dtrace_aggregate_count; 8502 break; 8503 8504 case DTRACEAGG_QUANTIZE: 8505 agg->dtag_aggregate = dtrace_aggregate_quantize; 8506 size = (((sizeof (uint64_t) * NBBY) - 1) * 2 + 1) * 8507 sizeof (uint64_t); 8508 break; 8509 8510 case DTRACEAGG_LQUANTIZE: { 8511 uint16_t step = DTRACE_LQUANTIZE_STEP(desc->dtad_arg); 8512 uint16_t levels = DTRACE_LQUANTIZE_LEVELS(desc->dtad_arg); 8513 8514 agg->dtag_initial = desc->dtad_arg; 8515 agg->dtag_aggregate = dtrace_aggregate_lquantize; 8516 8517 if (step == 0 || levels == 0) 8518 goto err; 8519 8520 size = levels * sizeof (uint64_t) + 3 * sizeof (uint64_t); 8521 break; 8522 } 8523 8524 case DTRACEAGG_AVG: 8525 agg->dtag_aggregate = dtrace_aggregate_avg; 8526 size = sizeof (uint64_t) * 2; 8527 break; 8528 8529 case DTRACEAGG_SUM: 8530 agg->dtag_aggregate = dtrace_aggregate_sum; 8531 break; 8532 8533 default: 8534 goto err; 8535 } 8536 8537 agg->dtag_action.dta_rec.dtrd_size = size; 8538 8539 if (ntuple == 0) 8540 goto err; 8541 8542 /* 8543 * We must make sure that we have enough actions for the n-tuple. 8544 */ 8545 for (act = ecb->dte_action_last; act != NULL; act = act->dta_prev) { 8546 if (DTRACEACT_ISAGG(act->dta_kind)) 8547 break; 8548 8549 if (--ntuple == 0) { 8550 /* 8551 * This is the action with which our n-tuple begins. 8552 */ 8553 agg->dtag_first = act; 8554 goto success; 8555 } 8556 } 8557 8558 /* 8559 * This n-tuple is short by ntuple elements. Return failure. 8560 */ 8561 ASSERT(ntuple != 0); 8562 err: 8563 kmem_free(agg, sizeof (dtrace_aggregation_t)); 8564 return (NULL); 8565 8566 success: 8567 /* 8568 * If the last action in the tuple has a size of zero, it's actually 8569 * an expression argument for the aggregating action. 8570 */ 8571 ASSERT(ecb->dte_action_last != NULL); 8572 act = ecb->dte_action_last; 8573 8574 if (act->dta_kind == DTRACEACT_DIFEXPR) { 8575 ASSERT(act->dta_difo != NULL); 8576 8577 if (act->dta_difo->dtdo_rtype.dtdt_size == 0) 8578 agg->dtag_hasarg = 1; 8579 } 8580 8581 /* 8582 * We need to allocate an id for this aggregation. 8583 */ 8584 aggid = (dtrace_aggid_t)(uintptr_t)vmem_alloc(state->dts_aggid_arena, 1, 8585 VM_BESTFIT | VM_SLEEP); 8586 8587 if (aggid - 1 >= state->dts_naggregations) { 8588 dtrace_aggregation_t **oaggs = state->dts_aggregations; 8589 dtrace_aggregation_t **aggs; 8590 int naggs = state->dts_naggregations << 1; 8591 int onaggs = state->dts_naggregations; 8592 8593 ASSERT(aggid == state->dts_naggregations + 1); 8594 8595 if (naggs == 0) { 8596 ASSERT(oaggs == NULL); 8597 naggs = 1; 8598 } 8599 8600 aggs = kmem_zalloc(naggs * sizeof (*aggs), KM_SLEEP); 8601 8602 if (oaggs != NULL) { 8603 bcopy(oaggs, aggs, onaggs * sizeof (*aggs)); 8604 kmem_free(oaggs, onaggs * sizeof (*aggs)); 8605 } 8606 8607 state->dts_aggregations = aggs; 8608 state->dts_naggregations = naggs; 8609 } 8610 8611 ASSERT(state->dts_aggregations[aggid - 1] == NULL); 8612 state->dts_aggregations[(agg->dtag_id = aggid) - 1] = agg; 8613 8614 frec = &agg->dtag_first->dta_rec; 8615 if (frec->dtrd_alignment < sizeof (dtrace_aggid_t)) 8616 frec->dtrd_alignment = sizeof (dtrace_aggid_t); 8617 8618 for (act = agg->dtag_first; act != NULL; act = act->dta_next) { 8619 ASSERT(!act->dta_intuple); 8620 act->dta_intuple = 1; 8621 } 8622 8623 return (&agg->dtag_action); 8624 } 8625 8626 static void 8627 dtrace_ecb_aggregation_destroy(dtrace_ecb_t *ecb, dtrace_action_t *act) 8628 { 8629 dtrace_aggregation_t *agg = (dtrace_aggregation_t *)act; 8630 dtrace_state_t *state = ecb->dte_state; 8631 dtrace_aggid_t aggid = agg->dtag_id; 8632 8633 ASSERT(DTRACEACT_ISAGG(act->dta_kind)); 8634 vmem_free(state->dts_aggid_arena, (void *)(uintptr_t)aggid, 1); 8635 8636 ASSERT(state->dts_aggregations[aggid - 1] == agg); 8637 state->dts_aggregations[aggid - 1] = NULL; 8638 8639 kmem_free(agg, sizeof (dtrace_aggregation_t)); 8640 } 8641 8642 static int 8643 dtrace_ecb_action_add(dtrace_ecb_t *ecb, dtrace_actdesc_t *desc) 8644 { 8645 dtrace_action_t *action, *last; 8646 dtrace_difo_t *dp = desc->dtad_difo; 8647 uint32_t size = 0, align = sizeof (uint8_t), mask; 8648 uint16_t format = 0; 8649 dtrace_recdesc_t *rec; 8650 dtrace_state_t *state = ecb->dte_state; 8651 dtrace_optval_t *opt = state->dts_options, nframes, strsize; 8652 uint64_t arg = desc->dtad_arg; 8653 8654 ASSERT(MUTEX_HELD(&dtrace_lock)); 8655 ASSERT(ecb->dte_action == NULL || ecb->dte_action->dta_refcnt == 1); 8656 8657 if (DTRACEACT_ISAGG(desc->dtad_kind)) { 8658 /* 8659 * If this is an aggregating action, there must be neither 8660 * a speculate nor a commit on the action chain. 8661 */ 8662 dtrace_action_t *act; 8663 8664 for (act = ecb->dte_action; act != NULL; act = act->dta_next) { 8665 if (act->dta_kind == DTRACEACT_COMMIT) 8666 return (EINVAL); 8667 8668 if (act->dta_kind == DTRACEACT_SPECULATE) 8669 return (EINVAL); 8670 } 8671 8672 action = dtrace_ecb_aggregation_create(ecb, desc); 8673 8674 if (action == NULL) 8675 return (EINVAL); 8676 } else { 8677 if (DTRACEACT_ISDESTRUCTIVE(desc->dtad_kind) || 8678 (desc->dtad_kind == DTRACEACT_DIFEXPR && 8679 dp != NULL && dp->dtdo_destructive)) { 8680 state->dts_destructive = 1; 8681 } 8682 8683 switch (desc->dtad_kind) { 8684 case DTRACEACT_PRINTF: 8685 case DTRACEACT_PRINTA: 8686 case DTRACEACT_SYSTEM: 8687 case DTRACEACT_FREOPEN: 8688 /* 8689 * We know that our arg is a string -- turn it into a 8690 * format. 8691 */ 8692 if (arg == NULL) { 8693 ASSERT(desc->dtad_kind == DTRACEACT_PRINTA); 8694 format = 0; 8695 } else { 8696 ASSERT(arg != NULL); 8697 ASSERT(arg > KERNELBASE); 8698 format = dtrace_format_add(state, 8699 (char *)(uintptr_t)arg); 8700 } 8701 8702 /*FALLTHROUGH*/ 8703 case DTRACEACT_LIBACT: 8704 case DTRACEACT_DIFEXPR: 8705 if (dp == NULL) 8706 return (EINVAL); 8707 8708 if ((size = dp->dtdo_rtype.dtdt_size) != 0) 8709 break; 8710 8711 if (dp->dtdo_rtype.dtdt_kind == DIF_TYPE_STRING) { 8712 if (!(dp->dtdo_rtype.dtdt_flags & DIF_TF_BYREF)) 8713 return (EINVAL); 8714 8715 size = opt[DTRACEOPT_STRSIZE]; 8716 } 8717 8718 break; 8719 8720 case DTRACEACT_STACK: 8721 if ((nframes = arg) == 0) { 8722 nframes = opt[DTRACEOPT_STACKFRAMES]; 8723 ASSERT(nframes > 0); 8724 arg = nframes; 8725 } 8726 8727 size = nframes * sizeof (pc_t); 8728 break; 8729 8730 case DTRACEACT_JSTACK: 8731 if ((strsize = DTRACE_USTACK_STRSIZE(arg)) == 0) 8732 strsize = opt[DTRACEOPT_JSTACKSTRSIZE]; 8733 8734 if ((nframes = DTRACE_USTACK_NFRAMES(arg)) == 0) 8735 nframes = opt[DTRACEOPT_JSTACKFRAMES]; 8736 8737 arg = DTRACE_USTACK_ARG(nframes, strsize); 8738 8739 /*FALLTHROUGH*/ 8740 case DTRACEACT_USTACK: 8741 if (desc->dtad_kind != DTRACEACT_JSTACK && 8742 (nframes = DTRACE_USTACK_NFRAMES(arg)) == 0) { 8743 strsize = DTRACE_USTACK_STRSIZE(arg); 8744 nframes = opt[DTRACEOPT_USTACKFRAMES]; 8745 ASSERT(nframes > 0); 8746 arg = DTRACE_USTACK_ARG(nframes, strsize); 8747 } 8748 8749 /* 8750 * Save a slot for the pid. 8751 */ 8752 size = (nframes + 1) * sizeof (uint64_t); 8753 size += DTRACE_USTACK_STRSIZE(arg); 8754 size = P2ROUNDUP(size, (uint32_t)(sizeof (uintptr_t))); 8755 8756 break; 8757 8758 case DTRACEACT_SYM: 8759 case DTRACEACT_MOD: 8760 if (dp == NULL || ((size = dp->dtdo_rtype.dtdt_size) != 8761 sizeof (uint64_t)) || 8762 (dp->dtdo_rtype.dtdt_flags & DIF_TF_BYREF)) 8763 return (EINVAL); 8764 break; 8765 8766 case DTRACEACT_USYM: 8767 case DTRACEACT_UMOD: 8768 case DTRACEACT_UADDR: 8769 if (dp == NULL || 8770 (dp->dtdo_rtype.dtdt_size != sizeof (uint64_t)) || 8771 (dp->dtdo_rtype.dtdt_flags & DIF_TF_BYREF)) 8772 return (EINVAL); 8773 8774 /* 8775 * We have a slot for the pid, plus a slot for the 8776 * argument. To keep things simple (aligned with 8777 * bitness-neutral sizing), we store each as a 64-bit 8778 * quantity. 8779 */ 8780 size = 2 * sizeof (uint64_t); 8781 break; 8782 8783 case DTRACEACT_STOP: 8784 case DTRACEACT_BREAKPOINT: 8785 case DTRACEACT_PANIC: 8786 break; 8787 8788 case DTRACEACT_CHILL: 8789 case DTRACEACT_DISCARD: 8790 case DTRACEACT_RAISE: 8791 if (dp == NULL) 8792 return (EINVAL); 8793 break; 8794 8795 case DTRACEACT_EXIT: 8796 if (dp == NULL || 8797 (size = dp->dtdo_rtype.dtdt_size) != sizeof (int) || 8798 (dp->dtdo_rtype.dtdt_flags & DIF_TF_BYREF)) 8799 return (EINVAL); 8800 break; 8801 8802 case DTRACEACT_SPECULATE: 8803 if (ecb->dte_size > sizeof (dtrace_epid_t)) 8804 return (EINVAL); 8805 8806 if (dp == NULL) 8807 return (EINVAL); 8808 8809 state->dts_speculates = 1; 8810 break; 8811 8812 case DTRACEACT_COMMIT: { 8813 dtrace_action_t *act = ecb->dte_action; 8814 8815 for (; act != NULL; act = act->dta_next) { 8816 if (act->dta_kind == DTRACEACT_COMMIT) 8817 return (EINVAL); 8818 } 8819 8820 if (dp == NULL) 8821 return (EINVAL); 8822 break; 8823 } 8824 8825 default: 8826 return (EINVAL); 8827 } 8828 8829 if (size != 0 || desc->dtad_kind == DTRACEACT_SPECULATE) { 8830 /* 8831 * If this is a data-storing action or a speculate, 8832 * we must be sure that there isn't a commit on the 8833 * action chain. 8834 */ 8835 dtrace_action_t *act = ecb->dte_action; 8836 8837 for (; act != NULL; act = act->dta_next) { 8838 if (act->dta_kind == DTRACEACT_COMMIT) 8839 return (EINVAL); 8840 } 8841 } 8842 8843 action = kmem_zalloc(sizeof (dtrace_action_t), KM_SLEEP); 8844 action->dta_rec.dtrd_size = size; 8845 } 8846 8847 action->dta_refcnt = 1; 8848 rec = &action->dta_rec; 8849 size = rec->dtrd_size; 8850 8851 for (mask = sizeof (uint64_t) - 1; size != 0 && mask > 0; mask >>= 1) { 8852 if (!(size & mask)) { 8853 align = mask + 1; 8854 break; 8855 } 8856 } 8857 8858 action->dta_kind = desc->dtad_kind; 8859 8860 if ((action->dta_difo = dp) != NULL) 8861 dtrace_difo_hold(dp); 8862 8863 rec->dtrd_action = action->dta_kind; 8864 rec->dtrd_arg = arg; 8865 rec->dtrd_uarg = desc->dtad_uarg; 8866 rec->dtrd_alignment = (uint16_t)align; 8867 rec->dtrd_format = format; 8868 8869 if ((last = ecb->dte_action_last) != NULL) { 8870 ASSERT(ecb->dte_action != NULL); 8871 action->dta_prev = last; 8872 last->dta_next = action; 8873 } else { 8874 ASSERT(ecb->dte_action == NULL); 8875 ecb->dte_action = action; 8876 } 8877 8878 ecb->dte_action_last = action; 8879 8880 return (0); 8881 } 8882 8883 static void 8884 dtrace_ecb_action_remove(dtrace_ecb_t *ecb) 8885 { 8886 dtrace_action_t *act = ecb->dte_action, *next; 8887 dtrace_vstate_t *vstate = &ecb->dte_state->dts_vstate; 8888 dtrace_difo_t *dp; 8889 uint16_t format; 8890 8891 if (act != NULL && act->dta_refcnt > 1) { 8892 ASSERT(act->dta_next == NULL || act->dta_next->dta_refcnt == 1); 8893 act->dta_refcnt--; 8894 } else { 8895 for (; act != NULL; act = next) { 8896 next = act->dta_next; 8897 ASSERT(next != NULL || act == ecb->dte_action_last); 8898 ASSERT(act->dta_refcnt == 1); 8899 8900 if ((format = act->dta_rec.dtrd_format) != 0) 8901 dtrace_format_remove(ecb->dte_state, format); 8902 8903 if ((dp = act->dta_difo) != NULL) 8904 dtrace_difo_release(dp, vstate); 8905 8906 if (DTRACEACT_ISAGG(act->dta_kind)) { 8907 dtrace_ecb_aggregation_destroy(ecb, act); 8908 } else { 8909 kmem_free(act, sizeof (dtrace_action_t)); 8910 } 8911 } 8912 } 8913 8914 ecb->dte_action = NULL; 8915 ecb->dte_action_last = NULL; 8916 ecb->dte_size = sizeof (dtrace_epid_t); 8917 } 8918 8919 static void 8920 dtrace_ecb_disable(dtrace_ecb_t *ecb) 8921 { 8922 /* 8923 * We disable the ECB by removing it from its probe. 8924 */ 8925 dtrace_ecb_t *pecb, *prev = NULL; 8926 dtrace_probe_t *probe = ecb->dte_probe; 8927 8928 ASSERT(MUTEX_HELD(&dtrace_lock)); 8929 8930 if (probe == NULL) { 8931 /* 8932 * This is the NULL probe; there is nothing to disable. 8933 */ 8934 return; 8935 } 8936 8937 for (pecb = probe->dtpr_ecb; pecb != NULL; pecb = pecb->dte_next) { 8938 if (pecb == ecb) 8939 break; 8940 prev = pecb; 8941 } 8942 8943 ASSERT(pecb != NULL); 8944 8945 if (prev == NULL) { 8946 probe->dtpr_ecb = ecb->dte_next; 8947 } else { 8948 prev->dte_next = ecb->dte_next; 8949 } 8950 8951 if (ecb == probe->dtpr_ecb_last) { 8952 ASSERT(ecb->dte_next == NULL); 8953 probe->dtpr_ecb_last = prev; 8954 } 8955 8956 /* 8957 * The ECB has been disconnected from the probe; now sync to assure 8958 * that all CPUs have seen the change before returning. 8959 */ 8960 dtrace_sync(); 8961 8962 if (probe->dtpr_ecb == NULL) { 8963 /* 8964 * That was the last ECB on the probe; clear the predicate 8965 * cache ID for the probe, disable it and sync one more time 8966 * to assure that we'll never hit it again. 8967 */ 8968 dtrace_provider_t *prov = probe->dtpr_provider; 8969 8970 ASSERT(ecb->dte_next == NULL); 8971 ASSERT(probe->dtpr_ecb_last == NULL); 8972 probe->dtpr_predcache = DTRACE_CACHEIDNONE; 8973 prov->dtpv_pops.dtps_disable(prov->dtpv_arg, 8974 probe->dtpr_id, probe->dtpr_arg); 8975 dtrace_sync(); 8976 } else { 8977 /* 8978 * There is at least one ECB remaining on the probe. If there 8979 * is _exactly_ one, set the probe's predicate cache ID to be 8980 * the predicate cache ID of the remaining ECB. 8981 */ 8982 ASSERT(probe->dtpr_ecb_last != NULL); 8983 ASSERT(probe->dtpr_predcache == DTRACE_CACHEIDNONE); 8984 8985 if (probe->dtpr_ecb == probe->dtpr_ecb_last) { 8986 dtrace_predicate_t *p = probe->dtpr_ecb->dte_predicate; 8987 8988 ASSERT(probe->dtpr_ecb->dte_next == NULL); 8989 8990 if (p != NULL) 8991 probe->dtpr_predcache = p->dtp_cacheid; 8992 } 8993 8994 ecb->dte_next = NULL; 8995 } 8996 } 8997 8998 static void 8999 dtrace_ecb_destroy(dtrace_ecb_t *ecb) 9000 { 9001 dtrace_state_t *state = ecb->dte_state; 9002 dtrace_vstate_t *vstate = &state->dts_vstate; 9003 dtrace_predicate_t *pred; 9004 dtrace_epid_t epid = ecb->dte_epid; 9005 9006 ASSERT(MUTEX_HELD(&dtrace_lock)); 9007 ASSERT(ecb->dte_next == NULL); 9008 ASSERT(ecb->dte_probe == NULL || ecb->dte_probe->dtpr_ecb != ecb); 9009 9010 if ((pred = ecb->dte_predicate) != NULL) 9011 dtrace_predicate_release(pred, vstate); 9012 9013 dtrace_ecb_action_remove(ecb); 9014 9015 ASSERT(state->dts_ecbs[epid - 1] == ecb); 9016 state->dts_ecbs[epid - 1] = NULL; 9017 9018 kmem_free(ecb, sizeof (dtrace_ecb_t)); 9019 } 9020 9021 static dtrace_ecb_t * 9022 dtrace_ecb_create(dtrace_state_t *state, dtrace_probe_t *probe, 9023 dtrace_enabling_t *enab) 9024 { 9025 dtrace_ecb_t *ecb; 9026 dtrace_predicate_t *pred; 9027 dtrace_actdesc_t *act; 9028 dtrace_provider_t *prov; 9029 dtrace_ecbdesc_t *desc = enab->dten_current; 9030 9031 ASSERT(MUTEX_HELD(&dtrace_lock)); 9032 ASSERT(state != NULL); 9033 9034 ecb = dtrace_ecb_add(state, probe); 9035 ecb->dte_uarg = desc->dted_uarg; 9036 9037 if ((pred = desc->dted_pred.dtpdd_predicate) != NULL) { 9038 dtrace_predicate_hold(pred); 9039 ecb->dte_predicate = pred; 9040 } 9041 9042 if (probe != NULL) { 9043 /* 9044 * If the provider shows more leg than the consumer is old 9045 * enough to see, we need to enable the appropriate implicit 9046 * predicate bits to prevent the ecb from activating at 9047 * revealing times. 9048 * 9049 * Providers specifying DTRACE_PRIV_USER at register time 9050 * are stating that they need the /proc-style privilege 9051 * model to be enforced, and this is what DTRACE_COND_OWNER 9052 * and DTRACE_COND_ZONEOWNER will then do at probe time. 9053 */ 9054 prov = probe->dtpr_provider; 9055 if (!(state->dts_cred.dcr_visible & DTRACE_CRV_ALLPROC) && 9056 (prov->dtpv_priv.dtpp_flags & DTRACE_PRIV_USER)) 9057 ecb->dte_cond |= DTRACE_COND_OWNER; 9058 9059 if (!(state->dts_cred.dcr_visible & DTRACE_CRV_ALLZONE) && 9060 (prov->dtpv_priv.dtpp_flags & DTRACE_PRIV_USER)) 9061 ecb->dte_cond |= DTRACE_COND_ZONEOWNER; 9062 9063 /* 9064 * If the provider shows us kernel innards and the user 9065 * is lacking sufficient privilege, enable the 9066 * DTRACE_COND_USERMODE implicit predicate. 9067 */ 9068 if (!(state->dts_cred.dcr_visible & DTRACE_CRV_KERNEL) && 9069 (prov->dtpv_priv.dtpp_flags & DTRACE_PRIV_KERNEL)) 9070 ecb->dte_cond |= DTRACE_COND_USERMODE; 9071 } 9072 9073 if (dtrace_ecb_create_cache != NULL) { 9074 /* 9075 * If we have a cached ecb, we'll use its action list instead 9076 * of creating our own (saving both time and space). 9077 */ 9078 dtrace_ecb_t *cached = dtrace_ecb_create_cache; 9079 dtrace_action_t *act = cached->dte_action; 9080 9081 if (act != NULL) { 9082 ASSERT(act->dta_refcnt > 0); 9083 act->dta_refcnt++; 9084 ecb->dte_action = act; 9085 ecb->dte_action_last = cached->dte_action_last; 9086 ecb->dte_needed = cached->dte_needed; 9087 ecb->dte_size = cached->dte_size; 9088 ecb->dte_alignment = cached->dte_alignment; 9089 } 9090 9091 return (ecb); 9092 } 9093 9094 for (act = desc->dted_action; act != NULL; act = act->dtad_next) { 9095 if ((enab->dten_error = dtrace_ecb_action_add(ecb, act)) != 0) { 9096 dtrace_ecb_destroy(ecb); 9097 return (NULL); 9098 } 9099 } 9100 9101 dtrace_ecb_resize(ecb); 9102 9103 return (dtrace_ecb_create_cache = ecb); 9104 } 9105 9106 static int 9107 dtrace_ecb_create_enable(dtrace_probe_t *probe, void *arg) 9108 { 9109 dtrace_ecb_t *ecb; 9110 dtrace_enabling_t *enab = arg; 9111 dtrace_state_t *state = enab->dten_vstate->dtvs_state; 9112 9113 ASSERT(state != NULL); 9114 9115 if (probe != NULL && probe->dtpr_gen < enab->dten_probegen) { 9116 /* 9117 * This probe was created in a generation for which this 9118 * enabling has previously created ECBs; we don't want to 9119 * enable it again, so just kick out. 9120 */ 9121 return (DTRACE_MATCH_NEXT); 9122 } 9123 9124 if ((ecb = dtrace_ecb_create(state, probe, enab)) == NULL) 9125 return (DTRACE_MATCH_DONE); 9126 9127 dtrace_ecb_enable(ecb); 9128 return (DTRACE_MATCH_NEXT); 9129 } 9130 9131 static dtrace_ecb_t * 9132 dtrace_epid2ecb(dtrace_state_t *state, dtrace_epid_t id) 9133 { 9134 dtrace_ecb_t *ecb; 9135 9136 ASSERT(MUTEX_HELD(&dtrace_lock)); 9137 9138 if (id == 0 || id > state->dts_necbs) 9139 return (NULL); 9140 9141 ASSERT(state->dts_necbs > 0 && state->dts_ecbs != NULL); 9142 ASSERT((ecb = state->dts_ecbs[id - 1]) == NULL || ecb->dte_epid == id); 9143 9144 return (state->dts_ecbs[id - 1]); 9145 } 9146 9147 static dtrace_aggregation_t * 9148 dtrace_aggid2agg(dtrace_state_t *state, dtrace_aggid_t id) 9149 { 9150 dtrace_aggregation_t *agg; 9151 9152 ASSERT(MUTEX_HELD(&dtrace_lock)); 9153 9154 if (id == 0 || id > state->dts_naggregations) 9155 return (NULL); 9156 9157 ASSERT(state->dts_naggregations > 0 && state->dts_aggregations != NULL); 9158 ASSERT((agg = state->dts_aggregations[id - 1]) == NULL || 9159 agg->dtag_id == id); 9160 9161 return (state->dts_aggregations[id - 1]); 9162 } 9163 9164 /* 9165 * DTrace Buffer Functions 9166 * 9167 * The following functions manipulate DTrace buffers. Most of these functions 9168 * are called in the context of establishing or processing consumer state; 9169 * exceptions are explicitly noted. 9170 */ 9171 9172 /* 9173 * Note: called from cross call context. This function switches the two 9174 * buffers on a given CPU. The atomicity of this operation is assured by 9175 * disabling interrupts while the actual switch takes place; the disabling of 9176 * interrupts serializes the execution with any execution of dtrace_probe() on 9177 * the same CPU. 9178 */ 9179 static void 9180 dtrace_buffer_switch(dtrace_buffer_t *buf) 9181 { 9182 caddr_t tomax = buf->dtb_tomax; 9183 caddr_t xamot = buf->dtb_xamot; 9184 dtrace_icookie_t cookie; 9185 9186 ASSERT(!(buf->dtb_flags & DTRACEBUF_NOSWITCH)); 9187 ASSERT(!(buf->dtb_flags & DTRACEBUF_RING)); 9188 9189 cookie = dtrace_interrupt_disable(); 9190 buf->dtb_tomax = xamot; 9191 buf->dtb_xamot = tomax; 9192 buf->dtb_xamot_drops = buf->dtb_drops; 9193 buf->dtb_xamot_offset = buf->dtb_offset; 9194 buf->dtb_xamot_errors = buf->dtb_errors; 9195 buf->dtb_xamot_flags = buf->dtb_flags; 9196 buf->dtb_offset = 0; 9197 buf->dtb_drops = 0; 9198 buf->dtb_errors = 0; 9199 buf->dtb_flags &= ~(DTRACEBUF_ERROR | DTRACEBUF_DROPPED); 9200 dtrace_interrupt_enable(cookie); 9201 } 9202 9203 /* 9204 * Note: called from cross call context. This function activates a buffer 9205 * on a CPU. As with dtrace_buffer_switch(), the atomicity of the operation 9206 * is guaranteed by the disabling of interrupts. 9207 */ 9208 static void 9209 dtrace_buffer_activate(dtrace_state_t *state) 9210 { 9211 dtrace_buffer_t *buf; 9212 dtrace_icookie_t cookie = dtrace_interrupt_disable(); 9213 9214 buf = &state->dts_buffer[CPU->cpu_id]; 9215 9216 if (buf->dtb_tomax != NULL) { 9217 /* 9218 * We might like to assert that the buffer is marked inactive, 9219 * but this isn't necessarily true: the buffer for the CPU 9220 * that processes the BEGIN probe has its buffer activated 9221 * manually. In this case, we take the (harmless) action 9222 * re-clearing the bit INACTIVE bit. 9223 */ 9224 buf->dtb_flags &= ~DTRACEBUF_INACTIVE; 9225 } 9226 9227 dtrace_interrupt_enable(cookie); 9228 } 9229 9230 static int 9231 dtrace_buffer_alloc(dtrace_buffer_t *bufs, size_t size, int flags, 9232 processorid_t cpu) 9233 { 9234 cpu_t *cp; 9235 dtrace_buffer_t *buf; 9236 9237 ASSERT(MUTEX_HELD(&cpu_lock)); 9238 ASSERT(MUTEX_HELD(&dtrace_lock)); 9239 9240 if (size > dtrace_nonroot_maxsize && 9241 !PRIV_POLICY_CHOICE(CRED(), PRIV_ALL, B_FALSE)) 9242 return (EFBIG); 9243 9244 cp = cpu_list; 9245 9246 do { 9247 if (cpu != DTRACE_CPUALL && cpu != cp->cpu_id) 9248 continue; 9249 9250 buf = &bufs[cp->cpu_id]; 9251 9252 /* 9253 * If there is already a buffer allocated for this CPU, it 9254 * is only possible that this is a DR event. In this case, 9255 * the buffer size must match our specified size. 9256 */ 9257 if (buf->dtb_tomax != NULL) { 9258 ASSERT(buf->dtb_size == size); 9259 continue; 9260 } 9261 9262 ASSERT(buf->dtb_xamot == NULL); 9263 9264 if ((buf->dtb_tomax = kmem_zalloc(size, KM_NOSLEEP)) == NULL) 9265 goto err; 9266 9267 buf->dtb_size = size; 9268 buf->dtb_flags = flags; 9269 buf->dtb_offset = 0; 9270 buf->dtb_drops = 0; 9271 9272 if (flags & DTRACEBUF_NOSWITCH) 9273 continue; 9274 9275 if ((buf->dtb_xamot = kmem_zalloc(size, KM_NOSLEEP)) == NULL) 9276 goto err; 9277 } while ((cp = cp->cpu_next) != cpu_list); 9278 9279 return (0); 9280 9281 err: 9282 cp = cpu_list; 9283 9284 do { 9285 if (cpu != DTRACE_CPUALL && cpu != cp->cpu_id) 9286 continue; 9287 9288 buf = &bufs[cp->cpu_id]; 9289 9290 if (buf->dtb_xamot != NULL) { 9291 ASSERT(buf->dtb_tomax != NULL); 9292 ASSERT(buf->dtb_size == size); 9293 kmem_free(buf->dtb_xamot, size); 9294 } 9295 9296 if (buf->dtb_tomax != NULL) { 9297 ASSERT(buf->dtb_size == size); 9298 kmem_free(buf->dtb_tomax, size); 9299 } 9300 9301 buf->dtb_tomax = NULL; 9302 buf->dtb_xamot = NULL; 9303 buf->dtb_size = 0; 9304 } while ((cp = cp->cpu_next) != cpu_list); 9305 9306 return (ENOMEM); 9307 } 9308 9309 /* 9310 * Note: called from probe context. This function just increments the drop 9311 * count on a buffer. It has been made a function to allow for the 9312 * possibility of understanding the source of mysterious drop counts. (A 9313 * problem for which one may be particularly disappointed that DTrace cannot 9314 * be used to understand DTrace.) 9315 */ 9316 static void 9317 dtrace_buffer_drop(dtrace_buffer_t *buf) 9318 { 9319 buf->dtb_drops++; 9320 } 9321 9322 /* 9323 * Note: called from probe context. This function is called to reserve space 9324 * in a buffer. If mstate is non-NULL, sets the scratch base and size in the 9325 * mstate. Returns the new offset in the buffer, or a negative value if an 9326 * error has occurred. 9327 */ 9328 static intptr_t 9329 dtrace_buffer_reserve(dtrace_buffer_t *buf, size_t needed, size_t align, 9330 dtrace_state_t *state, dtrace_mstate_t *mstate) 9331 { 9332 intptr_t offs = buf->dtb_offset, soffs; 9333 intptr_t woffs; 9334 caddr_t tomax; 9335 size_t total; 9336 9337 if (buf->dtb_flags & DTRACEBUF_INACTIVE) 9338 return (-1); 9339 9340 if ((tomax = buf->dtb_tomax) == NULL) { 9341 dtrace_buffer_drop(buf); 9342 return (-1); 9343 } 9344 9345 if (!(buf->dtb_flags & (DTRACEBUF_RING | DTRACEBUF_FILL))) { 9346 while (offs & (align - 1)) { 9347 /* 9348 * Assert that our alignment is off by a number which 9349 * is itself sizeof (uint32_t) aligned. 9350 */ 9351 ASSERT(!((align - (offs & (align - 1))) & 9352 (sizeof (uint32_t) - 1))); 9353 DTRACE_STORE(uint32_t, tomax, offs, DTRACE_EPIDNONE); 9354 offs += sizeof (uint32_t); 9355 } 9356 9357 if ((soffs = offs + needed) > buf->dtb_size) { 9358 dtrace_buffer_drop(buf); 9359 return (-1); 9360 } 9361 9362 if (mstate == NULL) 9363 return (offs); 9364 9365 mstate->dtms_scratch_base = (uintptr_t)tomax + soffs; 9366 mstate->dtms_scratch_size = buf->dtb_size - soffs; 9367 mstate->dtms_scratch_ptr = mstate->dtms_scratch_base; 9368 9369 return (offs); 9370 } 9371 9372 if (buf->dtb_flags & DTRACEBUF_FILL) { 9373 if (state->dts_activity != DTRACE_ACTIVITY_COOLDOWN && 9374 (buf->dtb_flags & DTRACEBUF_FULL)) 9375 return (-1); 9376 goto out; 9377 } 9378 9379 total = needed + (offs & (align - 1)); 9380 9381 /* 9382 * For a ring buffer, life is quite a bit more complicated. Before 9383 * we can store any padding, we need to adjust our wrapping offset. 9384 * (If we've never before wrapped or we're not about to, no adjustment 9385 * is required.) 9386 */ 9387 if ((buf->dtb_flags & DTRACEBUF_WRAPPED) || 9388 offs + total > buf->dtb_size) { 9389 woffs = buf->dtb_xamot_offset; 9390 9391 if (offs + total > buf->dtb_size) { 9392 /* 9393 * We can't fit in the end of the buffer. First, a 9394 * sanity check that we can fit in the buffer at all. 9395 */ 9396 if (total > buf->dtb_size) { 9397 dtrace_buffer_drop(buf); 9398 return (-1); 9399 } 9400 9401 /* 9402 * We're going to be storing at the top of the buffer, 9403 * so now we need to deal with the wrapped offset. We 9404 * only reset our wrapped offset to 0 if it is 9405 * currently greater than the current offset. If it 9406 * is less than the current offset, it is because a 9407 * previous allocation induced a wrap -- but the 9408 * allocation didn't subsequently take the space due 9409 * to an error or false predicate evaluation. In this 9410 * case, we'll just leave the wrapped offset alone: if 9411 * the wrapped offset hasn't been advanced far enough 9412 * for this allocation, it will be adjusted in the 9413 * lower loop. 9414 */ 9415 if (buf->dtb_flags & DTRACEBUF_WRAPPED) { 9416 if (woffs >= offs) 9417 woffs = 0; 9418 } else { 9419 woffs = 0; 9420 } 9421 9422 /* 9423 * Now we know that we're going to be storing to the 9424 * top of the buffer and that there is room for us 9425 * there. We need to clear the buffer from the current 9426 * offset to the end (there may be old gunk there). 9427 */ 9428 while (offs < buf->dtb_size) 9429 tomax[offs++] = 0; 9430 9431 /* 9432 * We need to set our offset to zero. And because we 9433 * are wrapping, we need to set the bit indicating as 9434 * much. We can also adjust our needed space back 9435 * down to the space required by the ECB -- we know 9436 * that the top of the buffer is aligned. 9437 */ 9438 offs = 0; 9439 total = needed; 9440 buf->dtb_flags |= DTRACEBUF_WRAPPED; 9441 } else { 9442 /* 9443 * There is room for us in the buffer, so we simply 9444 * need to check the wrapped offset. 9445 */ 9446 if (woffs < offs) { 9447 /* 9448 * The wrapped offset is less than the offset. 9449 * This can happen if we allocated buffer space 9450 * that induced a wrap, but then we didn't 9451 * subsequently take the space due to an error 9452 * or false predicate evaluation. This is 9453 * okay; we know that _this_ allocation isn't 9454 * going to induce a wrap. We still can't 9455 * reset the wrapped offset to be zero, 9456 * however: the space may have been trashed in 9457 * the previous failed probe attempt. But at 9458 * least the wrapped offset doesn't need to 9459 * be adjusted at all... 9460 */ 9461 goto out; 9462 } 9463 } 9464 9465 while (offs + total > woffs) { 9466 dtrace_epid_t epid = *(uint32_t *)(tomax + woffs); 9467 size_t size; 9468 9469 if (epid == DTRACE_EPIDNONE) { 9470 size = sizeof (uint32_t); 9471 } else { 9472 ASSERT(epid <= state->dts_necbs); 9473 ASSERT(state->dts_ecbs[epid - 1] != NULL); 9474 9475 size = state->dts_ecbs[epid - 1]->dte_size; 9476 } 9477 9478 ASSERT(woffs + size <= buf->dtb_size); 9479 ASSERT(size != 0); 9480 9481 if (woffs + size == buf->dtb_size) { 9482 /* 9483 * We've reached the end of the buffer; we want 9484 * to set the wrapped offset to 0 and break 9485 * out. However, if the offs is 0, then we're 9486 * in a strange edge-condition: the amount of 9487 * space that we want to reserve plus the size 9488 * of the record that we're overwriting is 9489 * greater than the size of the buffer. This 9490 * is problematic because if we reserve the 9491 * space but subsequently don't consume it (due 9492 * to a failed predicate or error) the wrapped 9493 * offset will be 0 -- yet the EPID at offset 0 9494 * will not be committed. This situation is 9495 * relatively easy to deal with: if we're in 9496 * this case, the buffer is indistinguishable 9497 * from one that hasn't wrapped; we need only 9498 * finish the job by clearing the wrapped bit, 9499 * explicitly setting the offset to be 0, and 9500 * zero'ing out the old data in the buffer. 9501 */ 9502 if (offs == 0) { 9503 buf->dtb_flags &= ~DTRACEBUF_WRAPPED; 9504 buf->dtb_offset = 0; 9505 woffs = total; 9506 9507 while (woffs < buf->dtb_size) 9508 tomax[woffs++] = 0; 9509 } 9510 9511 woffs = 0; 9512 break; 9513 } 9514 9515 woffs += size; 9516 } 9517 9518 /* 9519 * We have a wrapped offset. It may be that the wrapped offset 9520 * has become zero -- that's okay. 9521 */ 9522 buf->dtb_xamot_offset = woffs; 9523 } 9524 9525 out: 9526 /* 9527 * Now we can plow the buffer with any necessary padding. 9528 */ 9529 while (offs & (align - 1)) { 9530 /* 9531 * Assert that our alignment is off by a number which 9532 * is itself sizeof (uint32_t) aligned. 9533 */ 9534 ASSERT(!((align - (offs & (align - 1))) & 9535 (sizeof (uint32_t) - 1))); 9536 DTRACE_STORE(uint32_t, tomax, offs, DTRACE_EPIDNONE); 9537 offs += sizeof (uint32_t); 9538 } 9539 9540 if (buf->dtb_flags & DTRACEBUF_FILL) { 9541 if (offs + needed > buf->dtb_size - state->dts_reserve) { 9542 buf->dtb_flags |= DTRACEBUF_FULL; 9543 return (-1); 9544 } 9545 } 9546 9547 if (mstate == NULL) 9548 return (offs); 9549 9550 /* 9551 * For ring buffers and fill buffers, the scratch space is always 9552 * the inactive buffer. 9553 */ 9554 mstate->dtms_scratch_base = (uintptr_t)buf->dtb_xamot; 9555 mstate->dtms_scratch_size = buf->dtb_size; 9556 mstate->dtms_scratch_ptr = mstate->dtms_scratch_base; 9557 9558 return (offs); 9559 } 9560 9561 static void 9562 dtrace_buffer_polish(dtrace_buffer_t *buf) 9563 { 9564 ASSERT(buf->dtb_flags & DTRACEBUF_RING); 9565 ASSERT(MUTEX_HELD(&dtrace_lock)); 9566 9567 if (!(buf->dtb_flags & DTRACEBUF_WRAPPED)) 9568 return; 9569 9570 /* 9571 * We need to polish the ring buffer. There are three cases: 9572 * 9573 * - The first (and presumably most common) is that there is no gap 9574 * between the buffer offset and the wrapped offset. In this case, 9575 * there is nothing in the buffer that isn't valid data; we can 9576 * mark the buffer as polished and return. 9577 * 9578 * - The second (less common than the first but still more common 9579 * than the third) is that there is a gap between the buffer offset 9580 * and the wrapped offset, and the wrapped offset is larger than the 9581 * buffer offset. This can happen because of an alignment issue, or 9582 * can happen because of a call to dtrace_buffer_reserve() that 9583 * didn't subsequently consume the buffer space. In this case, 9584 * we need to zero the data from the buffer offset to the wrapped 9585 * offset. 9586 * 9587 * - The third (and least common) is that there is a gap between the 9588 * buffer offset and the wrapped offset, but the wrapped offset is 9589 * _less_ than the buffer offset. This can only happen because a 9590 * call to dtrace_buffer_reserve() induced a wrap, but the space 9591 * was not subsequently consumed. In this case, we need to zero the 9592 * space from the offset to the end of the buffer _and_ from the 9593 * top of the buffer to the wrapped offset. 9594 */ 9595 if (buf->dtb_offset < buf->dtb_xamot_offset) { 9596 bzero(buf->dtb_tomax + buf->dtb_offset, 9597 buf->dtb_xamot_offset - buf->dtb_offset); 9598 } 9599 9600 if (buf->dtb_offset > buf->dtb_xamot_offset) { 9601 bzero(buf->dtb_tomax + buf->dtb_offset, 9602 buf->dtb_size - buf->dtb_offset); 9603 bzero(buf->dtb_tomax, buf->dtb_xamot_offset); 9604 } 9605 } 9606 9607 static void 9608 dtrace_buffer_free(dtrace_buffer_t *bufs) 9609 { 9610 int i; 9611 9612 for (i = 0; i < NCPU; i++) { 9613 dtrace_buffer_t *buf = &bufs[i]; 9614 9615 if (buf->dtb_tomax == NULL) { 9616 ASSERT(buf->dtb_xamot == NULL); 9617 ASSERT(buf->dtb_size == 0); 9618 continue; 9619 } 9620 9621 if (buf->dtb_xamot != NULL) { 9622 ASSERT(!(buf->dtb_flags & DTRACEBUF_NOSWITCH)); 9623 kmem_free(buf->dtb_xamot, buf->dtb_size); 9624 } 9625 9626 kmem_free(buf->dtb_tomax, buf->dtb_size); 9627 buf->dtb_size = 0; 9628 buf->dtb_tomax = NULL; 9629 buf->dtb_xamot = NULL; 9630 } 9631 } 9632 9633 /* 9634 * DTrace Enabling Functions 9635 */ 9636 static dtrace_enabling_t * 9637 dtrace_enabling_create(dtrace_vstate_t *vstate) 9638 { 9639 dtrace_enabling_t *enab; 9640 9641 enab = kmem_zalloc(sizeof (dtrace_enabling_t), KM_SLEEP); 9642 enab->dten_vstate = vstate; 9643 9644 return (enab); 9645 } 9646 9647 static void 9648 dtrace_enabling_add(dtrace_enabling_t *enab, dtrace_ecbdesc_t *ecb) 9649 { 9650 dtrace_ecbdesc_t **ndesc; 9651 size_t osize, nsize; 9652 9653 /* 9654 * We can't add to enablings after we've enabled them, or after we've 9655 * retained them. 9656 */ 9657 ASSERT(enab->dten_probegen == 0); 9658 ASSERT(enab->dten_next == NULL && enab->dten_prev == NULL); 9659 9660 if (enab->dten_ndesc < enab->dten_maxdesc) { 9661 enab->dten_desc[enab->dten_ndesc++] = ecb; 9662 return; 9663 } 9664 9665 osize = enab->dten_maxdesc * sizeof (dtrace_enabling_t *); 9666 9667 if (enab->dten_maxdesc == 0) { 9668 enab->dten_maxdesc = 1; 9669 } else { 9670 enab->dten_maxdesc <<= 1; 9671 } 9672 9673 ASSERT(enab->dten_ndesc < enab->dten_maxdesc); 9674 9675 nsize = enab->dten_maxdesc * sizeof (dtrace_enabling_t *); 9676 ndesc = kmem_zalloc(nsize, KM_SLEEP); 9677 bcopy(enab->dten_desc, ndesc, osize); 9678 kmem_free(enab->dten_desc, osize); 9679 9680 enab->dten_desc = ndesc; 9681 enab->dten_desc[enab->dten_ndesc++] = ecb; 9682 } 9683 9684 static void 9685 dtrace_enabling_addlike(dtrace_enabling_t *enab, dtrace_ecbdesc_t *ecb, 9686 dtrace_probedesc_t *pd) 9687 { 9688 dtrace_ecbdesc_t *new; 9689 dtrace_predicate_t *pred; 9690 dtrace_actdesc_t *act; 9691 9692 /* 9693 * We're going to create a new ECB description that matches the 9694 * specified ECB in every way, but has the specified probe description. 9695 */ 9696 new = kmem_zalloc(sizeof (dtrace_ecbdesc_t), KM_SLEEP); 9697 9698 if ((pred = ecb->dted_pred.dtpdd_predicate) != NULL) 9699 dtrace_predicate_hold(pred); 9700 9701 for (act = ecb->dted_action; act != NULL; act = act->dtad_next) 9702 dtrace_actdesc_hold(act); 9703 9704 new->dted_action = ecb->dted_action; 9705 new->dted_pred = ecb->dted_pred; 9706 new->dted_probe = *pd; 9707 new->dted_uarg = ecb->dted_uarg; 9708 9709 dtrace_enabling_add(enab, new); 9710 } 9711 9712 static void 9713 dtrace_enabling_dump(dtrace_enabling_t *enab) 9714 { 9715 int i; 9716 9717 for (i = 0; i < enab->dten_ndesc; i++) { 9718 dtrace_probedesc_t *desc = &enab->dten_desc[i]->dted_probe; 9719 9720 cmn_err(CE_NOTE, "enabling probe %d (%s:%s:%s:%s)", i, 9721 desc->dtpd_provider, desc->dtpd_mod, 9722 desc->dtpd_func, desc->dtpd_name); 9723 } 9724 } 9725 9726 static void 9727 dtrace_enabling_destroy(dtrace_enabling_t *enab) 9728 { 9729 int i; 9730 dtrace_ecbdesc_t *ep; 9731 dtrace_vstate_t *vstate = enab->dten_vstate; 9732 9733 ASSERT(MUTEX_HELD(&dtrace_lock)); 9734 9735 for (i = 0; i < enab->dten_ndesc; i++) { 9736 dtrace_actdesc_t *act, *next; 9737 dtrace_predicate_t *pred; 9738 9739 ep = enab->dten_desc[i]; 9740 9741 if ((pred = ep->dted_pred.dtpdd_predicate) != NULL) 9742 dtrace_predicate_release(pred, vstate); 9743 9744 for (act = ep->dted_action; act != NULL; act = next) { 9745 next = act->dtad_next; 9746 dtrace_actdesc_release(act, vstate); 9747 } 9748 9749 kmem_free(ep, sizeof (dtrace_ecbdesc_t)); 9750 } 9751 9752 kmem_free(enab->dten_desc, 9753 enab->dten_maxdesc * sizeof (dtrace_enabling_t *)); 9754 9755 /* 9756 * If this was a retained enabling, decrement the dts_nretained count 9757 * and take it off of the dtrace_retained list. 9758 */ 9759 if (enab->dten_prev != NULL || enab->dten_next != NULL || 9760 dtrace_retained == enab) { 9761 ASSERT(enab->dten_vstate->dtvs_state != NULL); 9762 ASSERT(enab->dten_vstate->dtvs_state->dts_nretained > 0); 9763 enab->dten_vstate->dtvs_state->dts_nretained--; 9764 } 9765 9766 if (enab->dten_prev == NULL) { 9767 if (dtrace_retained == enab) { 9768 dtrace_retained = enab->dten_next; 9769 9770 if (dtrace_retained != NULL) 9771 dtrace_retained->dten_prev = NULL; 9772 } 9773 } else { 9774 ASSERT(enab != dtrace_retained); 9775 ASSERT(dtrace_retained != NULL); 9776 enab->dten_prev->dten_next = enab->dten_next; 9777 } 9778 9779 if (enab->dten_next != NULL) { 9780 ASSERT(dtrace_retained != NULL); 9781 enab->dten_next->dten_prev = enab->dten_prev; 9782 } 9783 9784 kmem_free(enab, sizeof (dtrace_enabling_t)); 9785 } 9786 9787 static int 9788 dtrace_enabling_retain(dtrace_enabling_t *enab) 9789 { 9790 dtrace_state_t *state; 9791 9792 ASSERT(MUTEX_HELD(&dtrace_lock)); 9793 ASSERT(enab->dten_next == NULL && enab->dten_prev == NULL); 9794 ASSERT(enab->dten_vstate != NULL); 9795 9796 state = enab->dten_vstate->dtvs_state; 9797 ASSERT(state != NULL); 9798 9799 /* 9800 * We only allow each state to retain dtrace_retain_max enablings. 9801 */ 9802 if (state->dts_nretained >= dtrace_retain_max) 9803 return (ENOSPC); 9804 9805 state->dts_nretained++; 9806 9807 if (dtrace_retained == NULL) { 9808 dtrace_retained = enab; 9809 return (0); 9810 } 9811 9812 enab->dten_next = dtrace_retained; 9813 dtrace_retained->dten_prev = enab; 9814 dtrace_retained = enab; 9815 9816 return (0); 9817 } 9818 9819 static int 9820 dtrace_enabling_replicate(dtrace_state_t *state, dtrace_probedesc_t *match, 9821 dtrace_probedesc_t *create) 9822 { 9823 dtrace_enabling_t *new, *enab; 9824 int found = 0, err = ENOENT; 9825 9826 ASSERT(MUTEX_HELD(&dtrace_lock)); 9827 ASSERT(strlen(match->dtpd_provider) < DTRACE_PROVNAMELEN); 9828 ASSERT(strlen(match->dtpd_mod) < DTRACE_MODNAMELEN); 9829 ASSERT(strlen(match->dtpd_func) < DTRACE_FUNCNAMELEN); 9830 ASSERT(strlen(match->dtpd_name) < DTRACE_NAMELEN); 9831 9832 new = dtrace_enabling_create(&state->dts_vstate); 9833 9834 /* 9835 * Iterate over all retained enablings, looking for enablings that 9836 * match the specified state. 9837 */ 9838 for (enab = dtrace_retained; enab != NULL; enab = enab->dten_next) { 9839 int i; 9840 9841 /* 9842 * dtvs_state can only be NULL for helper enablings -- and 9843 * helper enablings can't be retained. 9844 */ 9845 ASSERT(enab->dten_vstate->dtvs_state != NULL); 9846 9847 if (enab->dten_vstate->dtvs_state != state) 9848 continue; 9849 9850 /* 9851 * Now iterate over each probe description; we're looking for 9852 * an exact match to the specified probe description. 9853 */ 9854 for (i = 0; i < enab->dten_ndesc; i++) { 9855 dtrace_ecbdesc_t *ep = enab->dten_desc[i]; 9856 dtrace_probedesc_t *pd = &ep->dted_probe; 9857 9858 if (strcmp(pd->dtpd_provider, match->dtpd_provider)) 9859 continue; 9860 9861 if (strcmp(pd->dtpd_mod, match->dtpd_mod)) 9862 continue; 9863 9864 if (strcmp(pd->dtpd_func, match->dtpd_func)) 9865 continue; 9866 9867 if (strcmp(pd->dtpd_name, match->dtpd_name)) 9868 continue; 9869 9870 /* 9871 * We have a winning probe! Add it to our growing 9872 * enabling. 9873 */ 9874 found = 1; 9875 dtrace_enabling_addlike(new, ep, create); 9876 } 9877 } 9878 9879 if (!found || (err = dtrace_enabling_retain(new)) != 0) { 9880 dtrace_enabling_destroy(new); 9881 return (err); 9882 } 9883 9884 return (0); 9885 } 9886 9887 static void 9888 dtrace_enabling_retract(dtrace_state_t *state) 9889 { 9890 dtrace_enabling_t *enab, *next; 9891 9892 ASSERT(MUTEX_HELD(&dtrace_lock)); 9893 9894 /* 9895 * Iterate over all retained enablings, destroy the enablings retained 9896 * for the specified state. 9897 */ 9898 for (enab = dtrace_retained; enab != NULL; enab = next) { 9899 next = enab->dten_next; 9900 9901 /* 9902 * dtvs_state can only be NULL for helper enablings -- and 9903 * helper enablings can't be retained. 9904 */ 9905 ASSERT(enab->dten_vstate->dtvs_state != NULL); 9906 9907 if (enab->dten_vstate->dtvs_state == state) { 9908 ASSERT(state->dts_nretained > 0); 9909 dtrace_enabling_destroy(enab); 9910 } 9911 } 9912 9913 ASSERT(state->dts_nretained == 0); 9914 } 9915 9916 static int 9917 dtrace_enabling_match(dtrace_enabling_t *enab, int *nmatched) 9918 { 9919 int i = 0; 9920 int matched = 0; 9921 9922 ASSERT(MUTEX_HELD(&cpu_lock)); 9923 ASSERT(MUTEX_HELD(&dtrace_lock)); 9924 9925 for (i = 0; i < enab->dten_ndesc; i++) { 9926 dtrace_ecbdesc_t *ep = enab->dten_desc[i]; 9927 9928 enab->dten_current = ep; 9929 enab->dten_error = 0; 9930 9931 matched += dtrace_probe_enable(&ep->dted_probe, enab); 9932 9933 if (enab->dten_error != 0) { 9934 /* 9935 * If we get an error half-way through enabling the 9936 * probes, we kick out -- perhaps with some number of 9937 * them enabled. Leaving enabled probes enabled may 9938 * be slightly confusing for user-level, but we expect 9939 * that no one will attempt to actually drive on in 9940 * the face of such errors. If this is an anonymous 9941 * enabling (indicated with a NULL nmatched pointer), 9942 * we cmn_err() a message. We aren't expecting to 9943 * get such an error -- such as it can exist at all, 9944 * it would be a result of corrupted DOF in the driver 9945 * properties. 9946 */ 9947 if (nmatched == NULL) { 9948 cmn_err(CE_WARN, "dtrace_enabling_match() " 9949 "error on %p: %d", (void *)ep, 9950 enab->dten_error); 9951 } 9952 9953 return (enab->dten_error); 9954 } 9955 } 9956 9957 enab->dten_probegen = dtrace_probegen; 9958 if (nmatched != NULL) 9959 *nmatched = matched; 9960 9961 return (0); 9962 } 9963 9964 static void 9965 dtrace_enabling_matchall(void) 9966 { 9967 dtrace_enabling_t *enab; 9968 9969 mutex_enter(&cpu_lock); 9970 mutex_enter(&dtrace_lock); 9971 9972 /* 9973 * Because we can be called after dtrace_detach() has been called, we 9974 * cannot assert that there are retained enablings. We can safely 9975 * load from dtrace_retained, however: the taskq_destroy() at the 9976 * end of dtrace_detach() will block pending our completion. 9977 */ 9978 for (enab = dtrace_retained; enab != NULL; enab = enab->dten_next) 9979 (void) dtrace_enabling_match(enab, NULL); 9980 9981 mutex_exit(&dtrace_lock); 9982 mutex_exit(&cpu_lock); 9983 } 9984 9985 static int 9986 dtrace_enabling_matchstate(dtrace_state_t *state, int *nmatched) 9987 { 9988 dtrace_enabling_t *enab; 9989 int matched, total = 0, err; 9990 9991 ASSERT(MUTEX_HELD(&cpu_lock)); 9992 ASSERT(MUTEX_HELD(&dtrace_lock)); 9993 9994 for (enab = dtrace_retained; enab != NULL; enab = enab->dten_next) { 9995 ASSERT(enab->dten_vstate->dtvs_state != NULL); 9996 9997 if (enab->dten_vstate->dtvs_state != state) 9998 continue; 9999 10000 if ((err = dtrace_enabling_match(enab, &matched)) != 0) 10001 return (err); 10002 10003 total += matched; 10004 } 10005 10006 if (nmatched != NULL) 10007 *nmatched = total; 10008 10009 return (0); 10010 } 10011 10012 /* 10013 * If an enabling is to be enabled without having matched probes (that is, if 10014 * dtrace_state_go() is to be called on the underlying dtrace_state_t), the 10015 * enabling must be _primed_ by creating an ECB for every ECB description. 10016 * This must be done to assure that we know the number of speculations, the 10017 * number of aggregations, the minimum buffer size needed, etc. before we 10018 * transition out of DTRACE_ACTIVITY_INACTIVE. To do this without actually 10019 * enabling any probes, we create ECBs for every ECB decription, but with a 10020 * NULL probe -- which is exactly what this function does. 10021 */ 10022 static void 10023 dtrace_enabling_prime(dtrace_state_t *state) 10024 { 10025 dtrace_enabling_t *enab; 10026 int i; 10027 10028 for (enab = dtrace_retained; enab != NULL; enab = enab->dten_next) { 10029 ASSERT(enab->dten_vstate->dtvs_state != NULL); 10030 10031 if (enab->dten_vstate->dtvs_state != state) 10032 continue; 10033 10034 /* 10035 * We don't want to prime an enabling more than once, lest 10036 * we allow a malicious user to induce resource exhaustion. 10037 * (The ECBs that result from priming an enabling aren't 10038 * leaked -- but they also aren't deallocated until the 10039 * consumer state is destroyed.) 10040 */ 10041 if (enab->dten_primed) 10042 continue; 10043 10044 for (i = 0; i < enab->dten_ndesc; i++) { 10045 enab->dten_current = enab->dten_desc[i]; 10046 (void) dtrace_probe_enable(NULL, enab); 10047 } 10048 10049 enab->dten_primed = 1; 10050 } 10051 } 10052 10053 /* 10054 * Called to indicate that probes should be provided due to retained 10055 * enablings. This is implemented in terms of dtrace_probe_provide(), but it 10056 * must take an initial lap through the enabling calling the dtps_provide() 10057 * entry point explicitly to allow for autocreated probes. 10058 */ 10059 static void 10060 dtrace_enabling_provide(dtrace_provider_t *prv) 10061 { 10062 int i, all = 0; 10063 dtrace_probedesc_t desc; 10064 10065 ASSERT(MUTEX_HELD(&dtrace_lock)); 10066 ASSERT(MUTEX_HELD(&dtrace_provider_lock)); 10067 10068 if (prv == NULL) { 10069 all = 1; 10070 prv = dtrace_provider; 10071 } 10072 10073 do { 10074 dtrace_enabling_t *enab = dtrace_retained; 10075 void *parg = prv->dtpv_arg; 10076 10077 for (; enab != NULL; enab = enab->dten_next) { 10078 for (i = 0; i < enab->dten_ndesc; i++) { 10079 desc = enab->dten_desc[i]->dted_probe; 10080 mutex_exit(&dtrace_lock); 10081 prv->dtpv_pops.dtps_provide(parg, &desc); 10082 mutex_enter(&dtrace_lock); 10083 } 10084 } 10085 } while (all && (prv = prv->dtpv_next) != NULL); 10086 10087 mutex_exit(&dtrace_lock); 10088 dtrace_probe_provide(NULL, all ? NULL : prv); 10089 mutex_enter(&dtrace_lock); 10090 } 10091 10092 /* 10093 * DTrace DOF Functions 10094 */ 10095 /*ARGSUSED*/ 10096 static void 10097 dtrace_dof_error(dof_hdr_t *dof, const char *str) 10098 { 10099 if (dtrace_err_verbose) 10100 cmn_err(CE_WARN, "failed to process DOF: %s", str); 10101 10102 #ifdef DTRACE_ERRDEBUG 10103 dtrace_errdebug(str); 10104 #endif 10105 } 10106 10107 /* 10108 * Create DOF out of a currently enabled state. Right now, we only create 10109 * DOF containing the run-time options -- but this could be expanded to create 10110 * complete DOF representing the enabled state. 10111 */ 10112 static dof_hdr_t * 10113 dtrace_dof_create(dtrace_state_t *state) 10114 { 10115 dof_hdr_t *dof; 10116 dof_sec_t *sec; 10117 dof_optdesc_t *opt; 10118 int i, len = sizeof (dof_hdr_t) + 10119 roundup(sizeof (dof_sec_t), sizeof (uint64_t)) + 10120 sizeof (dof_optdesc_t) * DTRACEOPT_MAX; 10121 10122 ASSERT(MUTEX_HELD(&dtrace_lock)); 10123 10124 dof = kmem_zalloc(len, KM_SLEEP); 10125 dof->dofh_ident[DOF_ID_MAG0] = DOF_MAG_MAG0; 10126 dof->dofh_ident[DOF_ID_MAG1] = DOF_MAG_MAG1; 10127 dof->dofh_ident[DOF_ID_MAG2] = DOF_MAG_MAG2; 10128 dof->dofh_ident[DOF_ID_MAG3] = DOF_MAG_MAG3; 10129 10130 dof->dofh_ident[DOF_ID_MODEL] = DOF_MODEL_NATIVE; 10131 dof->dofh_ident[DOF_ID_ENCODING] = DOF_ENCODE_NATIVE; 10132 dof->dofh_ident[DOF_ID_VERSION] = DOF_VERSION; 10133 dof->dofh_ident[DOF_ID_DIFVERS] = DIF_VERSION; 10134 dof->dofh_ident[DOF_ID_DIFIREG] = DIF_DIR_NREGS; 10135 dof->dofh_ident[DOF_ID_DIFTREG] = DIF_DTR_NREGS; 10136 10137 dof->dofh_flags = 0; 10138 dof->dofh_hdrsize = sizeof (dof_hdr_t); 10139 dof->dofh_secsize = sizeof (dof_sec_t); 10140 dof->dofh_secnum = 1; /* only DOF_SECT_OPTDESC */ 10141 dof->dofh_secoff = sizeof (dof_hdr_t); 10142 dof->dofh_loadsz = len; 10143 dof->dofh_filesz = len; 10144 dof->dofh_pad = 0; 10145 10146 /* 10147 * Fill in the option section header... 10148 */ 10149 sec = (dof_sec_t *)((uintptr_t)dof + sizeof (dof_hdr_t)); 10150 sec->dofs_type = DOF_SECT_OPTDESC; 10151 sec->dofs_align = sizeof (uint64_t); 10152 sec->dofs_flags = DOF_SECF_LOAD; 10153 sec->dofs_entsize = sizeof (dof_optdesc_t); 10154 10155 opt = (dof_optdesc_t *)((uintptr_t)sec + 10156 roundup(sizeof (dof_sec_t), sizeof (uint64_t))); 10157 10158 sec->dofs_offset = (uintptr_t)opt - (uintptr_t)dof; 10159 sec->dofs_size = sizeof (dof_optdesc_t) * DTRACEOPT_MAX; 10160 10161 for (i = 0; i < DTRACEOPT_MAX; i++) { 10162 opt[i].dofo_option = i; 10163 opt[i].dofo_strtab = DOF_SECIDX_NONE; 10164 opt[i].dofo_value = state->dts_options[i]; 10165 } 10166 10167 return (dof); 10168 } 10169 10170 static dof_hdr_t * 10171 dtrace_dof_copyin(uintptr_t uarg, int *errp) 10172 { 10173 dof_hdr_t hdr, *dof; 10174 10175 ASSERT(!MUTEX_HELD(&dtrace_lock)); 10176 10177 /* 10178 * First, we're going to copyin() the sizeof (dof_hdr_t). 10179 */ 10180 if (copyin((void *)uarg, &hdr, sizeof (hdr)) != 0) { 10181 dtrace_dof_error(NULL, "failed to copyin DOF header"); 10182 *errp = EFAULT; 10183 return (NULL); 10184 } 10185 10186 /* 10187 * Now we'll allocate the entire DOF and copy it in -- provided 10188 * that the length isn't outrageous. 10189 */ 10190 if (hdr.dofh_loadsz >= dtrace_dof_maxsize) { 10191 dtrace_dof_error(&hdr, "load size exceeds maximum"); 10192 *errp = E2BIG; 10193 return (NULL); 10194 } 10195 10196 if (hdr.dofh_loadsz < sizeof (hdr)) { 10197 dtrace_dof_error(&hdr, "invalid load size"); 10198 *errp = EINVAL; 10199 return (NULL); 10200 } 10201 10202 dof = kmem_alloc(hdr.dofh_loadsz, KM_SLEEP); 10203 10204 if (copyin((void *)uarg, dof, hdr.dofh_loadsz) != 0) { 10205 kmem_free(dof, hdr.dofh_loadsz); 10206 *errp = EFAULT; 10207 return (NULL); 10208 } 10209 10210 return (dof); 10211 } 10212 10213 static dof_hdr_t * 10214 dtrace_dof_property(const char *name) 10215 { 10216 uchar_t *buf; 10217 uint64_t loadsz; 10218 unsigned int len, i; 10219 dof_hdr_t *dof; 10220 10221 /* 10222 * Unfortunately, array of values in .conf files are always (and 10223 * only) interpreted to be integer arrays. We must read our DOF 10224 * as an integer array, and then squeeze it into a byte array. 10225 */ 10226 if (ddi_prop_lookup_int_array(DDI_DEV_T_ANY, dtrace_devi, 0, 10227 (char *)name, (int **)&buf, &len) != DDI_PROP_SUCCESS) 10228 return (NULL); 10229 10230 for (i = 0; i < len; i++) 10231 buf[i] = (uchar_t)(((int *)buf)[i]); 10232 10233 if (len < sizeof (dof_hdr_t)) { 10234 ddi_prop_free(buf); 10235 dtrace_dof_error(NULL, "truncated header"); 10236 return (NULL); 10237 } 10238 10239 if (len < (loadsz = ((dof_hdr_t *)buf)->dofh_loadsz)) { 10240 ddi_prop_free(buf); 10241 dtrace_dof_error(NULL, "truncated DOF"); 10242 return (NULL); 10243 } 10244 10245 if (loadsz >= dtrace_dof_maxsize) { 10246 ddi_prop_free(buf); 10247 dtrace_dof_error(NULL, "oversized DOF"); 10248 return (NULL); 10249 } 10250 10251 dof = kmem_alloc(loadsz, KM_SLEEP); 10252 bcopy(buf, dof, loadsz); 10253 ddi_prop_free(buf); 10254 10255 return (dof); 10256 } 10257 10258 static void 10259 dtrace_dof_destroy(dof_hdr_t *dof) 10260 { 10261 kmem_free(dof, dof->dofh_loadsz); 10262 } 10263 10264 /* 10265 * Return the dof_sec_t pointer corresponding to a given section index. If the 10266 * index is not valid, dtrace_dof_error() is called and NULL is returned. If 10267 * a type other than DOF_SECT_NONE is specified, the header is checked against 10268 * this type and NULL is returned if the types do not match. 10269 */ 10270 static dof_sec_t * 10271 dtrace_dof_sect(dof_hdr_t *dof, uint32_t type, dof_secidx_t i) 10272 { 10273 dof_sec_t *sec = (dof_sec_t *)(uintptr_t) 10274 ((uintptr_t)dof + dof->dofh_secoff + i * dof->dofh_secsize); 10275 10276 if (i >= dof->dofh_secnum) { 10277 dtrace_dof_error(dof, "referenced section index is invalid"); 10278 return (NULL); 10279 } 10280 10281 if (!(sec->dofs_flags & DOF_SECF_LOAD)) { 10282 dtrace_dof_error(dof, "referenced section is not loadable"); 10283 return (NULL); 10284 } 10285 10286 if (type != DOF_SECT_NONE && type != sec->dofs_type) { 10287 dtrace_dof_error(dof, "referenced section is the wrong type"); 10288 return (NULL); 10289 } 10290 10291 return (sec); 10292 } 10293 10294 static dtrace_probedesc_t * 10295 dtrace_dof_probedesc(dof_hdr_t *dof, dof_sec_t *sec, dtrace_probedesc_t *desc) 10296 { 10297 dof_probedesc_t *probe; 10298 dof_sec_t *strtab; 10299 uintptr_t daddr = (uintptr_t)dof; 10300 uintptr_t str; 10301 size_t size; 10302 10303 if (sec->dofs_type != DOF_SECT_PROBEDESC) { 10304 dtrace_dof_error(dof, "invalid probe section"); 10305 return (NULL); 10306 } 10307 10308 if (sec->dofs_align != sizeof (dof_secidx_t)) { 10309 dtrace_dof_error(dof, "bad alignment in probe description"); 10310 return (NULL); 10311 } 10312 10313 if (sec->dofs_offset + sizeof (dof_probedesc_t) > dof->dofh_loadsz) { 10314 dtrace_dof_error(dof, "truncated probe description"); 10315 return (NULL); 10316 } 10317 10318 probe = (dof_probedesc_t *)(uintptr_t)(daddr + sec->dofs_offset); 10319 strtab = dtrace_dof_sect(dof, DOF_SECT_STRTAB, probe->dofp_strtab); 10320 10321 if (strtab == NULL) 10322 return (NULL); 10323 10324 str = daddr + strtab->dofs_offset; 10325 size = strtab->dofs_size; 10326 10327 if (probe->dofp_provider >= strtab->dofs_size) { 10328 dtrace_dof_error(dof, "corrupt probe provider"); 10329 return (NULL); 10330 } 10331 10332 (void) strncpy(desc->dtpd_provider, 10333 (char *)(str + probe->dofp_provider), 10334 MIN(DTRACE_PROVNAMELEN - 1, size - probe->dofp_provider)); 10335 10336 if (probe->dofp_mod >= strtab->dofs_size) { 10337 dtrace_dof_error(dof, "corrupt probe module"); 10338 return (NULL); 10339 } 10340 10341 (void) strncpy(desc->dtpd_mod, (char *)(str + probe->dofp_mod), 10342 MIN(DTRACE_MODNAMELEN - 1, size - probe->dofp_mod)); 10343 10344 if (probe->dofp_func >= strtab->dofs_size) { 10345 dtrace_dof_error(dof, "corrupt probe function"); 10346 return (NULL); 10347 } 10348 10349 (void) strncpy(desc->dtpd_func, (char *)(str + probe->dofp_func), 10350 MIN(DTRACE_FUNCNAMELEN - 1, size - probe->dofp_func)); 10351 10352 if (probe->dofp_name >= strtab->dofs_size) { 10353 dtrace_dof_error(dof, "corrupt probe name"); 10354 return (NULL); 10355 } 10356 10357 (void) strncpy(desc->dtpd_name, (char *)(str + probe->dofp_name), 10358 MIN(DTRACE_NAMELEN - 1, size - probe->dofp_name)); 10359 10360 return (desc); 10361 } 10362 10363 static dtrace_difo_t * 10364 dtrace_dof_difo(dof_hdr_t *dof, dof_sec_t *sec, dtrace_vstate_t *vstate, 10365 cred_t *cr) 10366 { 10367 dtrace_difo_t *dp; 10368 size_t ttl = 0; 10369 dof_difohdr_t *dofd; 10370 uintptr_t daddr = (uintptr_t)dof; 10371 size_t max = dtrace_difo_maxsize; 10372 int i, l, n; 10373 10374 static const struct { 10375 int section; 10376 int bufoffs; 10377 int lenoffs; 10378 int entsize; 10379 int align; 10380 const char *msg; 10381 } difo[] = { 10382 { DOF_SECT_DIF, offsetof(dtrace_difo_t, dtdo_buf), 10383 offsetof(dtrace_difo_t, dtdo_len), sizeof (dif_instr_t), 10384 sizeof (dif_instr_t), "multiple DIF sections" }, 10385 10386 { DOF_SECT_INTTAB, offsetof(dtrace_difo_t, dtdo_inttab), 10387 offsetof(dtrace_difo_t, dtdo_intlen), sizeof (uint64_t), 10388 sizeof (uint64_t), "multiple integer tables" }, 10389 10390 { DOF_SECT_STRTAB, offsetof(dtrace_difo_t, dtdo_strtab), 10391 offsetof(dtrace_difo_t, dtdo_strlen), 0, 10392 sizeof (char), "multiple string tables" }, 10393 10394 { DOF_SECT_VARTAB, offsetof(dtrace_difo_t, dtdo_vartab), 10395 offsetof(dtrace_difo_t, dtdo_varlen), sizeof (dtrace_difv_t), 10396 sizeof (uint_t), "multiple variable tables" }, 10397 10398 { DOF_SECT_NONE, 0, 0, 0, NULL } 10399 }; 10400 10401 if (sec->dofs_type != DOF_SECT_DIFOHDR) { 10402 dtrace_dof_error(dof, "invalid DIFO header section"); 10403 return (NULL); 10404 } 10405 10406 if (sec->dofs_align != sizeof (dof_secidx_t)) { 10407 dtrace_dof_error(dof, "bad alignment in DIFO header"); 10408 return (NULL); 10409 } 10410 10411 if (sec->dofs_size < sizeof (dof_difohdr_t) || 10412 sec->dofs_size % sizeof (dof_secidx_t)) { 10413 dtrace_dof_error(dof, "bad size in DIFO header"); 10414 return (NULL); 10415 } 10416 10417 dofd = (dof_difohdr_t *)(uintptr_t)(daddr + sec->dofs_offset); 10418 n = (sec->dofs_size - sizeof (*dofd)) / sizeof (dof_secidx_t) + 1; 10419 10420 dp = kmem_zalloc(sizeof (dtrace_difo_t), KM_SLEEP); 10421 dp->dtdo_rtype = dofd->dofd_rtype; 10422 10423 for (l = 0; l < n; l++) { 10424 dof_sec_t *subsec; 10425 void **bufp; 10426 uint32_t *lenp; 10427 10428 if ((subsec = dtrace_dof_sect(dof, DOF_SECT_NONE, 10429 dofd->dofd_links[l])) == NULL) 10430 goto err; /* invalid section link */ 10431 10432 if (ttl + subsec->dofs_size > max) { 10433 dtrace_dof_error(dof, "exceeds maximum size"); 10434 goto err; 10435 } 10436 10437 ttl += subsec->dofs_size; 10438 10439 for (i = 0; difo[i].section != DOF_SECT_NONE; i++) { 10440 if (subsec->dofs_type != difo[i].section) 10441 continue; 10442 10443 if (!(subsec->dofs_flags & DOF_SECF_LOAD)) { 10444 dtrace_dof_error(dof, "section not loaded"); 10445 goto err; 10446 } 10447 10448 if (subsec->dofs_align != difo[i].align) { 10449 dtrace_dof_error(dof, "bad alignment"); 10450 goto err; 10451 } 10452 10453 bufp = (void **)((uintptr_t)dp + difo[i].bufoffs); 10454 lenp = (uint32_t *)((uintptr_t)dp + difo[i].lenoffs); 10455 10456 if (*bufp != NULL) { 10457 dtrace_dof_error(dof, difo[i].msg); 10458 goto err; 10459 } 10460 10461 if (difo[i].entsize != subsec->dofs_entsize) { 10462 dtrace_dof_error(dof, "entry size mismatch"); 10463 goto err; 10464 } 10465 10466 if (subsec->dofs_entsize != 0 && 10467 (subsec->dofs_size % subsec->dofs_entsize) != 0) { 10468 dtrace_dof_error(dof, "corrupt entry size"); 10469 goto err; 10470 } 10471 10472 *lenp = subsec->dofs_size; 10473 *bufp = kmem_alloc(subsec->dofs_size, KM_SLEEP); 10474 bcopy((char *)(uintptr_t)(daddr + subsec->dofs_offset), 10475 *bufp, subsec->dofs_size); 10476 10477 if (subsec->dofs_entsize != 0) 10478 *lenp /= subsec->dofs_entsize; 10479 10480 break; 10481 } 10482 10483 /* 10484 * If we encounter a loadable DIFO sub-section that is not 10485 * known to us, assume this is a broken program and fail. 10486 */ 10487 if (difo[i].section == DOF_SECT_NONE && 10488 (subsec->dofs_flags & DOF_SECF_LOAD)) { 10489 dtrace_dof_error(dof, "unrecognized DIFO subsection"); 10490 goto err; 10491 } 10492 } 10493 10494 if (dp->dtdo_buf == NULL) { 10495 /* 10496 * We can't have a DIF object without DIF text. 10497 */ 10498 dtrace_dof_error(dof, "missing DIF text"); 10499 goto err; 10500 } 10501 10502 /* 10503 * Before we validate the DIF object, run through the variable table 10504 * looking for the strings -- if any of their size are under, we'll set 10505 * their size to be the system-wide default string size. Note that 10506 * this should _not_ happen if the "strsize" option has been set -- 10507 * in this case, the compiler should have set the size to reflect the 10508 * setting of the option. 10509 */ 10510 for (i = 0; i < dp->dtdo_varlen; i++) { 10511 dtrace_difv_t *v = &dp->dtdo_vartab[i]; 10512 dtrace_diftype_t *t = &v->dtdv_type; 10513 10514 if (v->dtdv_id < DIF_VAR_OTHER_UBASE) 10515 continue; 10516 10517 if (t->dtdt_kind == DIF_TYPE_STRING && t->dtdt_size == 0) 10518 t->dtdt_size = dtrace_strsize_default; 10519 } 10520 10521 if (dtrace_difo_validate(dp, vstate, DIF_DIR_NREGS, cr) != 0) 10522 goto err; 10523 10524 dtrace_difo_init(dp, vstate); 10525 return (dp); 10526 10527 err: 10528 kmem_free(dp->dtdo_buf, dp->dtdo_len * sizeof (dif_instr_t)); 10529 kmem_free(dp->dtdo_inttab, dp->dtdo_intlen * sizeof (uint64_t)); 10530 kmem_free(dp->dtdo_strtab, dp->dtdo_strlen); 10531 kmem_free(dp->dtdo_vartab, dp->dtdo_varlen * sizeof (dtrace_difv_t)); 10532 10533 kmem_free(dp, sizeof (dtrace_difo_t)); 10534 return (NULL); 10535 } 10536 10537 static dtrace_predicate_t * 10538 dtrace_dof_predicate(dof_hdr_t *dof, dof_sec_t *sec, dtrace_vstate_t *vstate, 10539 cred_t *cr) 10540 { 10541 dtrace_difo_t *dp; 10542 10543 if ((dp = dtrace_dof_difo(dof, sec, vstate, cr)) == NULL) 10544 return (NULL); 10545 10546 return (dtrace_predicate_create(dp)); 10547 } 10548 10549 static dtrace_actdesc_t * 10550 dtrace_dof_actdesc(dof_hdr_t *dof, dof_sec_t *sec, dtrace_vstate_t *vstate, 10551 cred_t *cr) 10552 { 10553 dtrace_actdesc_t *act, *first = NULL, *last = NULL, *next; 10554 dof_actdesc_t *desc; 10555 dof_sec_t *difosec; 10556 size_t offs; 10557 uintptr_t daddr = (uintptr_t)dof; 10558 uint64_t arg; 10559 dtrace_actkind_t kind; 10560 10561 if (sec->dofs_type != DOF_SECT_ACTDESC) { 10562 dtrace_dof_error(dof, "invalid action section"); 10563 return (NULL); 10564 } 10565 10566 if (sec->dofs_offset + sizeof (dof_actdesc_t) > dof->dofh_loadsz) { 10567 dtrace_dof_error(dof, "truncated action description"); 10568 return (NULL); 10569 } 10570 10571 if (sec->dofs_align != sizeof (uint64_t)) { 10572 dtrace_dof_error(dof, "bad alignment in action description"); 10573 return (NULL); 10574 } 10575 10576 if (sec->dofs_size < sec->dofs_entsize) { 10577 dtrace_dof_error(dof, "section entry size exceeds total size"); 10578 return (NULL); 10579 } 10580 10581 if (sec->dofs_entsize != sizeof (dof_actdesc_t)) { 10582 dtrace_dof_error(dof, "bad entry size in action description"); 10583 return (NULL); 10584 } 10585 10586 if (sec->dofs_size / sec->dofs_entsize > dtrace_actions_max) { 10587 dtrace_dof_error(dof, "actions exceed dtrace_actions_max"); 10588 return (NULL); 10589 } 10590 10591 for (offs = 0; offs < sec->dofs_size; offs += sec->dofs_entsize) { 10592 desc = (dof_actdesc_t *)(daddr + 10593 (uintptr_t)sec->dofs_offset + offs); 10594 kind = (dtrace_actkind_t)desc->dofa_kind; 10595 10596 if (DTRACEACT_ISPRINTFLIKE(kind) && 10597 (kind != DTRACEACT_PRINTA || 10598 desc->dofa_strtab != DOF_SECIDX_NONE)) { 10599 dof_sec_t *strtab; 10600 char *str, *fmt; 10601 uint64_t i; 10602 10603 /* 10604 * printf()-like actions must have a format string. 10605 */ 10606 if ((strtab = dtrace_dof_sect(dof, 10607 DOF_SECT_STRTAB, desc->dofa_strtab)) == NULL) 10608 goto err; 10609 10610 str = (char *)((uintptr_t)dof + 10611 (uintptr_t)strtab->dofs_offset); 10612 10613 for (i = desc->dofa_arg; i < strtab->dofs_size; i++) { 10614 if (str[i] == '\0') 10615 break; 10616 } 10617 10618 if (i >= strtab->dofs_size) { 10619 dtrace_dof_error(dof, "bogus format string"); 10620 goto err; 10621 } 10622 10623 if (i == desc->dofa_arg) { 10624 dtrace_dof_error(dof, "empty format string"); 10625 goto err; 10626 } 10627 10628 i -= desc->dofa_arg; 10629 fmt = kmem_alloc(i + 1, KM_SLEEP); 10630 bcopy(&str[desc->dofa_arg], fmt, i + 1); 10631 arg = (uint64_t)(uintptr_t)fmt; 10632 } else { 10633 if (kind == DTRACEACT_PRINTA) { 10634 ASSERT(desc->dofa_strtab == DOF_SECIDX_NONE); 10635 arg = 0; 10636 } else { 10637 arg = desc->dofa_arg; 10638 } 10639 } 10640 10641 act = dtrace_actdesc_create(kind, desc->dofa_ntuple, 10642 desc->dofa_uarg, arg); 10643 10644 if (last != NULL) { 10645 last->dtad_next = act; 10646 } else { 10647 first = act; 10648 } 10649 10650 last = act; 10651 10652 if (desc->dofa_difo == DOF_SECIDX_NONE) 10653 continue; 10654 10655 if ((difosec = dtrace_dof_sect(dof, 10656 DOF_SECT_DIFOHDR, desc->dofa_difo)) == NULL) 10657 goto err; 10658 10659 act->dtad_difo = dtrace_dof_difo(dof, difosec, vstate, cr); 10660 10661 if (act->dtad_difo == NULL) 10662 goto err; 10663 } 10664 10665 ASSERT(first != NULL); 10666 return (first); 10667 10668 err: 10669 for (act = first; act != NULL; act = next) { 10670 next = act->dtad_next; 10671 dtrace_actdesc_release(act, vstate); 10672 } 10673 10674 return (NULL); 10675 } 10676 10677 static dtrace_ecbdesc_t * 10678 dtrace_dof_ecbdesc(dof_hdr_t *dof, dof_sec_t *sec, dtrace_vstate_t *vstate, 10679 cred_t *cr) 10680 { 10681 dtrace_ecbdesc_t *ep; 10682 dof_ecbdesc_t *ecb; 10683 dtrace_probedesc_t *desc; 10684 dtrace_predicate_t *pred = NULL; 10685 10686 if (sec->dofs_size < sizeof (dof_ecbdesc_t)) { 10687 dtrace_dof_error(dof, "truncated ECB description"); 10688 return (NULL); 10689 } 10690 10691 if (sec->dofs_align != sizeof (uint64_t)) { 10692 dtrace_dof_error(dof, "bad alignment in ECB description"); 10693 return (NULL); 10694 } 10695 10696 ecb = (dof_ecbdesc_t *)((uintptr_t)dof + (uintptr_t)sec->dofs_offset); 10697 sec = dtrace_dof_sect(dof, DOF_SECT_PROBEDESC, ecb->dofe_probes); 10698 10699 if (sec == NULL) 10700 return (NULL); 10701 10702 ep = kmem_zalloc(sizeof (dtrace_ecbdesc_t), KM_SLEEP); 10703 ep->dted_uarg = ecb->dofe_uarg; 10704 desc = &ep->dted_probe; 10705 10706 if (dtrace_dof_probedesc(dof, sec, desc) == NULL) 10707 goto err; 10708 10709 if (ecb->dofe_pred != DOF_SECIDX_NONE) { 10710 if ((sec = dtrace_dof_sect(dof, 10711 DOF_SECT_DIFOHDR, ecb->dofe_pred)) == NULL) 10712 goto err; 10713 10714 if ((pred = dtrace_dof_predicate(dof, sec, vstate, cr)) == NULL) 10715 goto err; 10716 10717 ep->dted_pred.dtpdd_predicate = pred; 10718 } 10719 10720 if (ecb->dofe_actions != DOF_SECIDX_NONE) { 10721 if ((sec = dtrace_dof_sect(dof, 10722 DOF_SECT_ACTDESC, ecb->dofe_actions)) == NULL) 10723 goto err; 10724 10725 ep->dted_action = dtrace_dof_actdesc(dof, sec, vstate, cr); 10726 10727 if (ep->dted_action == NULL) 10728 goto err; 10729 } 10730 10731 return (ep); 10732 10733 err: 10734 if (pred != NULL) 10735 dtrace_predicate_release(pred, vstate); 10736 kmem_free(ep, sizeof (dtrace_ecbdesc_t)); 10737 return (NULL); 10738 } 10739 10740 /* 10741 * Apply the relocations from the specified 'sec' (a DOF_SECT_URELHDR) to the 10742 * specified DOF. At present, this amounts to simply adding 'ubase' to the 10743 * site of any user SETX relocations to account for load object base address. 10744 * In the future, if we need other relocations, this function can be extended. 10745 */ 10746 static int 10747 dtrace_dof_relocate(dof_hdr_t *dof, dof_sec_t *sec, uint64_t ubase) 10748 { 10749 uintptr_t daddr = (uintptr_t)dof; 10750 dof_relohdr_t *dofr = 10751 (dof_relohdr_t *)(uintptr_t)(daddr + sec->dofs_offset); 10752 dof_sec_t *ss, *rs, *ts; 10753 dof_relodesc_t *r; 10754 uint_t i, n; 10755 10756 if (sec->dofs_size < sizeof (dof_relohdr_t) || 10757 sec->dofs_align != sizeof (dof_secidx_t)) { 10758 dtrace_dof_error(dof, "invalid relocation header"); 10759 return (-1); 10760 } 10761 10762 ss = dtrace_dof_sect(dof, DOF_SECT_STRTAB, dofr->dofr_strtab); 10763 rs = dtrace_dof_sect(dof, DOF_SECT_RELTAB, dofr->dofr_relsec); 10764 ts = dtrace_dof_sect(dof, DOF_SECT_NONE, dofr->dofr_tgtsec); 10765 10766 if (ss == NULL || rs == NULL || ts == NULL) 10767 return (-1); /* dtrace_dof_error() has been called already */ 10768 10769 if (rs->dofs_entsize < sizeof (dof_relodesc_t) || 10770 rs->dofs_align != sizeof (uint64_t)) { 10771 dtrace_dof_error(dof, "invalid relocation section"); 10772 return (-1); 10773 } 10774 10775 r = (dof_relodesc_t *)(uintptr_t)(daddr + rs->dofs_offset); 10776 n = rs->dofs_size / rs->dofs_entsize; 10777 10778 for (i = 0; i < n; i++) { 10779 uintptr_t taddr = daddr + ts->dofs_offset + r->dofr_offset; 10780 10781 switch (r->dofr_type) { 10782 case DOF_RELO_NONE: 10783 break; 10784 case DOF_RELO_SETX: 10785 if (r->dofr_offset >= ts->dofs_size || r->dofr_offset + 10786 sizeof (uint64_t) > ts->dofs_size) { 10787 dtrace_dof_error(dof, "bad relocation offset"); 10788 return (-1); 10789 } 10790 10791 if (!IS_P2ALIGNED(taddr, sizeof (uint64_t))) { 10792 dtrace_dof_error(dof, "misaligned setx relo"); 10793 return (-1); 10794 } 10795 10796 *(uint64_t *)taddr += ubase; 10797 break; 10798 default: 10799 dtrace_dof_error(dof, "invalid relocation type"); 10800 return (-1); 10801 } 10802 10803 r = (dof_relodesc_t *)((uintptr_t)r + rs->dofs_entsize); 10804 } 10805 10806 return (0); 10807 } 10808 10809 /* 10810 * The dof_hdr_t passed to dtrace_dof_slurp() should be a partially validated 10811 * header: it should be at the front of a memory region that is at least 10812 * sizeof (dof_hdr_t) in size -- and then at least dof_hdr.dofh_loadsz in 10813 * size. It need not be validated in any other way. 10814 */ 10815 static int 10816 dtrace_dof_slurp(dof_hdr_t *dof, dtrace_vstate_t *vstate, cred_t *cr, 10817 dtrace_enabling_t **enabp, uint64_t ubase, int noprobes) 10818 { 10819 uint64_t len = dof->dofh_loadsz, seclen; 10820 uintptr_t daddr = (uintptr_t)dof; 10821 dtrace_ecbdesc_t *ep; 10822 dtrace_enabling_t *enab; 10823 uint_t i; 10824 10825 ASSERT(MUTEX_HELD(&dtrace_lock)); 10826 ASSERT(dof->dofh_loadsz >= sizeof (dof_hdr_t)); 10827 10828 /* 10829 * Check the DOF header identification bytes. In addition to checking 10830 * valid settings, we also verify that unused bits/bytes are zeroed so 10831 * we can use them later without fear of regressing existing binaries. 10832 */ 10833 if (bcmp(&dof->dofh_ident[DOF_ID_MAG0], 10834 DOF_MAG_STRING, DOF_MAG_STRLEN) != 0) { 10835 dtrace_dof_error(dof, "DOF magic string mismatch"); 10836 return (-1); 10837 } 10838 10839 if (dof->dofh_ident[DOF_ID_MODEL] != DOF_MODEL_ILP32 && 10840 dof->dofh_ident[DOF_ID_MODEL] != DOF_MODEL_LP64) { 10841 dtrace_dof_error(dof, "DOF has invalid data model"); 10842 return (-1); 10843 } 10844 10845 if (dof->dofh_ident[DOF_ID_ENCODING] != DOF_ENCODE_NATIVE) { 10846 dtrace_dof_error(dof, "DOF encoding mismatch"); 10847 return (-1); 10848 } 10849 10850 if (dof->dofh_ident[DOF_ID_VERSION] != DOF_VERSION_1 && 10851 dof->dofh_ident[DOF_ID_VERSION] != DOF_VERSION_2) { 10852 dtrace_dof_error(dof, "DOF version mismatch"); 10853 return (-1); 10854 } 10855 10856 if (dof->dofh_ident[DOF_ID_DIFVERS] != DIF_VERSION_2) { 10857 dtrace_dof_error(dof, "DOF uses unsupported instruction set"); 10858 return (-1); 10859 } 10860 10861 if (dof->dofh_ident[DOF_ID_DIFIREG] > DIF_DIR_NREGS) { 10862 dtrace_dof_error(dof, "DOF uses too many integer registers"); 10863 return (-1); 10864 } 10865 10866 if (dof->dofh_ident[DOF_ID_DIFTREG] > DIF_DTR_NREGS) { 10867 dtrace_dof_error(dof, "DOF uses too many tuple registers"); 10868 return (-1); 10869 } 10870 10871 for (i = DOF_ID_PAD; i < DOF_ID_SIZE; i++) { 10872 if (dof->dofh_ident[i] != 0) { 10873 dtrace_dof_error(dof, "DOF has invalid ident byte set"); 10874 return (-1); 10875 } 10876 } 10877 10878 if (dof->dofh_flags & ~DOF_FL_VALID) { 10879 dtrace_dof_error(dof, "DOF has invalid flag bits set"); 10880 return (-1); 10881 } 10882 10883 if (dof->dofh_secsize == 0) { 10884 dtrace_dof_error(dof, "zero section header size"); 10885 return (-1); 10886 } 10887 10888 /* 10889 * Check that the section headers don't exceed the amount of DOF 10890 * data. Note that we cast the section size and number of sections 10891 * to uint64_t's to prevent possible overflow in the multiplication. 10892 */ 10893 seclen = (uint64_t)dof->dofh_secnum * (uint64_t)dof->dofh_secsize; 10894 10895 if (dof->dofh_secoff > len || seclen > len || 10896 dof->dofh_secoff + seclen > len) { 10897 dtrace_dof_error(dof, "truncated section headers"); 10898 return (-1); 10899 } 10900 10901 if (!IS_P2ALIGNED(dof->dofh_secoff, sizeof (uint64_t))) { 10902 dtrace_dof_error(dof, "misaligned section headers"); 10903 return (-1); 10904 } 10905 10906 if (!IS_P2ALIGNED(dof->dofh_secsize, sizeof (uint64_t))) { 10907 dtrace_dof_error(dof, "misaligned section size"); 10908 return (-1); 10909 } 10910 10911 /* 10912 * Take an initial pass through the section headers to be sure that 10913 * the headers don't have stray offsets. If the 'noprobes' flag is 10914 * set, do not permit sections relating to providers, probes, or args. 10915 */ 10916 for (i = 0; i < dof->dofh_secnum; i++) { 10917 dof_sec_t *sec = (dof_sec_t *)(daddr + 10918 (uintptr_t)dof->dofh_secoff + i * dof->dofh_secsize); 10919 10920 if (noprobes) { 10921 switch (sec->dofs_type) { 10922 case DOF_SECT_PROVIDER: 10923 case DOF_SECT_PROBES: 10924 case DOF_SECT_PRARGS: 10925 case DOF_SECT_PROFFS: 10926 dtrace_dof_error(dof, "illegal sections " 10927 "for enabling"); 10928 return (-1); 10929 } 10930 } 10931 10932 if (!(sec->dofs_flags & DOF_SECF_LOAD)) 10933 continue; /* just ignore non-loadable sections */ 10934 10935 if (sec->dofs_align & (sec->dofs_align - 1)) { 10936 dtrace_dof_error(dof, "bad section alignment"); 10937 return (-1); 10938 } 10939 10940 if (sec->dofs_offset & (sec->dofs_align - 1)) { 10941 dtrace_dof_error(dof, "misaligned section"); 10942 return (-1); 10943 } 10944 10945 if (sec->dofs_offset > len || sec->dofs_size > len || 10946 sec->dofs_offset + sec->dofs_size > len) { 10947 dtrace_dof_error(dof, "corrupt section header"); 10948 return (-1); 10949 } 10950 10951 if (sec->dofs_type == DOF_SECT_STRTAB && *((char *)daddr + 10952 sec->dofs_offset + sec->dofs_size - 1) != '\0') { 10953 dtrace_dof_error(dof, "non-terminating string table"); 10954 return (-1); 10955 } 10956 } 10957 10958 /* 10959 * Take a second pass through the sections and locate and perform any 10960 * relocations that are present. We do this after the first pass to 10961 * be sure that all sections have had their headers validated. 10962 */ 10963 for (i = 0; i < dof->dofh_secnum; i++) { 10964 dof_sec_t *sec = (dof_sec_t *)(daddr + 10965 (uintptr_t)dof->dofh_secoff + i * dof->dofh_secsize); 10966 10967 if (!(sec->dofs_flags & DOF_SECF_LOAD)) 10968 continue; /* skip sections that are not loadable */ 10969 10970 switch (sec->dofs_type) { 10971 case DOF_SECT_URELHDR: 10972 if (dtrace_dof_relocate(dof, sec, ubase) != 0) 10973 return (-1); 10974 break; 10975 } 10976 } 10977 10978 if ((enab = *enabp) == NULL) 10979 enab = *enabp = dtrace_enabling_create(vstate); 10980 10981 for (i = 0; i < dof->dofh_secnum; i++) { 10982 dof_sec_t *sec = (dof_sec_t *)(daddr + 10983 (uintptr_t)dof->dofh_secoff + i * dof->dofh_secsize); 10984 10985 if (sec->dofs_type != DOF_SECT_ECBDESC) 10986 continue; 10987 10988 if ((ep = dtrace_dof_ecbdesc(dof, sec, vstate, cr)) == NULL) { 10989 dtrace_enabling_destroy(enab); 10990 *enabp = NULL; 10991 return (-1); 10992 } 10993 10994 dtrace_enabling_add(enab, ep); 10995 } 10996 10997 return (0); 10998 } 10999 11000 /* 11001 * Process DOF for any options. This routine assumes that the DOF has been 11002 * at least processed by dtrace_dof_slurp(). 11003 */ 11004 static int 11005 dtrace_dof_options(dof_hdr_t *dof, dtrace_state_t *state) 11006 { 11007 int i, rval; 11008 uint32_t entsize; 11009 size_t offs; 11010 dof_optdesc_t *desc; 11011 11012 for (i = 0; i < dof->dofh_secnum; i++) { 11013 dof_sec_t *sec = (dof_sec_t *)((uintptr_t)dof + 11014 (uintptr_t)dof->dofh_secoff + i * dof->dofh_secsize); 11015 11016 if (sec->dofs_type != DOF_SECT_OPTDESC) 11017 continue; 11018 11019 if (sec->dofs_align != sizeof (uint64_t)) { 11020 dtrace_dof_error(dof, "bad alignment in " 11021 "option description"); 11022 return (EINVAL); 11023 } 11024 11025 if ((entsize = sec->dofs_entsize) == 0) { 11026 dtrace_dof_error(dof, "zeroed option entry size"); 11027 return (EINVAL); 11028 } 11029 11030 if (entsize < sizeof (dof_optdesc_t)) { 11031 dtrace_dof_error(dof, "bad option entry size"); 11032 return (EINVAL); 11033 } 11034 11035 for (offs = 0; offs < sec->dofs_size; offs += entsize) { 11036 desc = (dof_optdesc_t *)((uintptr_t)dof + 11037 (uintptr_t)sec->dofs_offset + offs); 11038 11039 if (desc->dofo_strtab != DOF_SECIDX_NONE) { 11040 dtrace_dof_error(dof, "non-zero option string"); 11041 return (EINVAL); 11042 } 11043 11044 if (desc->dofo_value == DTRACEOPT_UNSET) { 11045 dtrace_dof_error(dof, "unset option"); 11046 return (EINVAL); 11047 } 11048 11049 if ((rval = dtrace_state_option(state, 11050 desc->dofo_option, desc->dofo_value)) != 0) { 11051 dtrace_dof_error(dof, "rejected option"); 11052 return (rval); 11053 } 11054 } 11055 } 11056 11057 return (0); 11058 } 11059 11060 /* 11061 * DTrace Consumer State Functions 11062 */ 11063 int 11064 dtrace_dstate_init(dtrace_dstate_t *dstate, size_t size) 11065 { 11066 size_t hashsize, maxper, min, chunksize = dstate->dtds_chunksize; 11067 void *base; 11068 uintptr_t limit; 11069 dtrace_dynvar_t *dvar, *next, *start; 11070 int i; 11071 11072 ASSERT(MUTEX_HELD(&dtrace_lock)); 11073 ASSERT(dstate->dtds_base == NULL && dstate->dtds_percpu == NULL); 11074 11075 bzero(dstate, sizeof (dtrace_dstate_t)); 11076 11077 if ((dstate->dtds_chunksize = chunksize) == 0) 11078 dstate->dtds_chunksize = DTRACE_DYNVAR_CHUNKSIZE; 11079 11080 if (size < (min = dstate->dtds_chunksize + sizeof (dtrace_dynhash_t))) 11081 size = min; 11082 11083 if ((base = kmem_zalloc(size, KM_NOSLEEP)) == NULL) 11084 return (ENOMEM); 11085 11086 dstate->dtds_size = size; 11087 dstate->dtds_base = base; 11088 dstate->dtds_percpu = kmem_cache_alloc(dtrace_state_cache, KM_SLEEP); 11089 bzero(dstate->dtds_percpu, NCPU * sizeof (dtrace_dstate_percpu_t)); 11090 11091 hashsize = size / (dstate->dtds_chunksize + sizeof (dtrace_dynhash_t)); 11092 11093 if (hashsize != 1 && (hashsize & 1)) 11094 hashsize--; 11095 11096 dstate->dtds_hashsize = hashsize; 11097 dstate->dtds_hash = dstate->dtds_base; 11098 11099 /* 11100 * Set all of our hash buckets to point to the single sink, and (if 11101 * it hasn't already been set), set the sink's hash value to be the 11102 * sink sentinel value. The sink is needed for dynamic variable 11103 * lookups to know that they have iterated over an entire, valid hash 11104 * chain. 11105 */ 11106 for (i = 0; i < hashsize; i++) 11107 dstate->dtds_hash[i].dtdh_chain = &dtrace_dynhash_sink; 11108 11109 if (dtrace_dynhash_sink.dtdv_hashval != DTRACE_DYNHASH_SINK) 11110 dtrace_dynhash_sink.dtdv_hashval = DTRACE_DYNHASH_SINK; 11111 11112 /* 11113 * Determine number of active CPUs. Divide free list evenly among 11114 * active CPUs. 11115 */ 11116 start = (dtrace_dynvar_t *) 11117 ((uintptr_t)base + hashsize * sizeof (dtrace_dynhash_t)); 11118 limit = (uintptr_t)base + size; 11119 11120 maxper = (limit - (uintptr_t)start) / NCPU; 11121 maxper = (maxper / dstate->dtds_chunksize) * dstate->dtds_chunksize; 11122 11123 for (i = 0; i < NCPU; i++) { 11124 dstate->dtds_percpu[i].dtdsc_free = dvar = start; 11125 11126 /* 11127 * If we don't even have enough chunks to make it once through 11128 * NCPUs, we're just going to allocate everything to the first 11129 * CPU. And if we're on the last CPU, we're going to allocate 11130 * whatever is left over. In either case, we set the limit to 11131 * be the limit of the dynamic variable space. 11132 */ 11133 if (maxper == 0 || i == NCPU - 1) { 11134 limit = (uintptr_t)base + size; 11135 start = NULL; 11136 } else { 11137 limit = (uintptr_t)start + maxper; 11138 start = (dtrace_dynvar_t *)limit; 11139 } 11140 11141 ASSERT(limit <= (uintptr_t)base + size); 11142 11143 for (;;) { 11144 next = (dtrace_dynvar_t *)((uintptr_t)dvar + 11145 dstate->dtds_chunksize); 11146 11147 if ((uintptr_t)next + dstate->dtds_chunksize >= limit) 11148 break; 11149 11150 dvar->dtdv_next = next; 11151 dvar = next; 11152 } 11153 11154 if (maxper == 0) 11155 break; 11156 } 11157 11158 return (0); 11159 } 11160 11161 void 11162 dtrace_dstate_fini(dtrace_dstate_t *dstate) 11163 { 11164 ASSERT(MUTEX_HELD(&cpu_lock)); 11165 11166 if (dstate->dtds_base == NULL) 11167 return; 11168 11169 kmem_free(dstate->dtds_base, dstate->dtds_size); 11170 kmem_cache_free(dtrace_state_cache, dstate->dtds_percpu); 11171 } 11172 11173 static void 11174 dtrace_vstate_fini(dtrace_vstate_t *vstate) 11175 { 11176 /* 11177 * Logical XOR, where are you? 11178 */ 11179 ASSERT((vstate->dtvs_nglobals == 0) ^ (vstate->dtvs_globals != NULL)); 11180 11181 if (vstate->dtvs_nglobals > 0) { 11182 kmem_free(vstate->dtvs_globals, vstate->dtvs_nglobals * 11183 sizeof (dtrace_statvar_t *)); 11184 } 11185 11186 if (vstate->dtvs_ntlocals > 0) { 11187 kmem_free(vstate->dtvs_tlocals, vstate->dtvs_ntlocals * 11188 sizeof (dtrace_difv_t)); 11189 } 11190 11191 ASSERT((vstate->dtvs_nlocals == 0) ^ (vstate->dtvs_locals != NULL)); 11192 11193 if (vstate->dtvs_nlocals > 0) { 11194 kmem_free(vstate->dtvs_locals, vstate->dtvs_nlocals * 11195 sizeof (dtrace_statvar_t *)); 11196 } 11197 } 11198 11199 static void 11200 dtrace_state_clean(dtrace_state_t *state) 11201 { 11202 if (state->dts_activity == DTRACE_ACTIVITY_INACTIVE) 11203 return; 11204 11205 dtrace_dynvar_clean(&state->dts_vstate.dtvs_dynvars); 11206 dtrace_speculation_clean(state); 11207 } 11208 11209 static void 11210 dtrace_state_deadman(dtrace_state_t *state) 11211 { 11212 hrtime_t now; 11213 11214 dtrace_sync(); 11215 11216 now = dtrace_gethrtime(); 11217 11218 if (state != dtrace_anon.dta_state && 11219 now - state->dts_laststatus >= dtrace_deadman_user) 11220 return; 11221 11222 /* 11223 * We must be sure that dts_alive never appears to be less than the 11224 * value upon entry to dtrace_state_deadman(), and because we lack a 11225 * dtrace_cas64(), we cannot store to it atomically. We thus instead 11226 * store INT64_MAX to it, followed by a memory barrier, followed by 11227 * the new value. This assures that dts_alive never appears to be 11228 * less than its true value, regardless of the order in which the 11229 * stores to the underlying storage are issued. 11230 */ 11231 state->dts_alive = INT64_MAX; 11232 dtrace_membar_producer(); 11233 state->dts_alive = now; 11234 } 11235 11236 dtrace_state_t * 11237 dtrace_state_create(dev_t *devp, cred_t *cr) 11238 { 11239 minor_t minor; 11240 major_t major; 11241 char c[30]; 11242 dtrace_state_t *state; 11243 dtrace_optval_t *opt; 11244 int bufsize = NCPU * sizeof (dtrace_buffer_t), i; 11245 11246 ASSERT(MUTEX_HELD(&dtrace_lock)); 11247 ASSERT(MUTEX_HELD(&cpu_lock)); 11248 11249 minor = (minor_t)(uintptr_t)vmem_alloc(dtrace_minor, 1, 11250 VM_BESTFIT | VM_SLEEP); 11251 11252 if (ddi_soft_state_zalloc(dtrace_softstate, minor) != DDI_SUCCESS) { 11253 vmem_free(dtrace_minor, (void *)(uintptr_t)minor, 1); 11254 return (NULL); 11255 } 11256 11257 state = ddi_get_soft_state(dtrace_softstate, minor); 11258 state->dts_epid = DTRACE_EPIDNONE + 1; 11259 11260 (void) snprintf(c, sizeof (c), "dtrace_aggid_%d", minor); 11261 state->dts_aggid_arena = vmem_create(c, (void *)1, UINT32_MAX, 1, 11262 NULL, NULL, NULL, 0, VM_SLEEP | VMC_IDENTIFIER); 11263 11264 if (devp != NULL) { 11265 major = getemajor(*devp); 11266 } else { 11267 major = ddi_driver_major(dtrace_devi); 11268 } 11269 11270 state->dts_dev = makedevice(major, minor); 11271 11272 if (devp != NULL) 11273 *devp = state->dts_dev; 11274 11275 /* 11276 * We allocate NCPU buffers. On the one hand, this can be quite 11277 * a bit of memory per instance (nearly 36K on a Starcat). On the 11278 * other hand, it saves an additional memory reference in the probe 11279 * path. 11280 */ 11281 state->dts_buffer = kmem_zalloc(bufsize, KM_SLEEP); 11282 state->dts_aggbuffer = kmem_zalloc(bufsize, KM_SLEEP); 11283 state->dts_cleaner = CYCLIC_NONE; 11284 state->dts_deadman = CYCLIC_NONE; 11285 state->dts_vstate.dtvs_state = state; 11286 11287 for (i = 0; i < DTRACEOPT_MAX; i++) 11288 state->dts_options[i] = DTRACEOPT_UNSET; 11289 11290 /* 11291 * Set the default options. 11292 */ 11293 opt = state->dts_options; 11294 opt[DTRACEOPT_BUFPOLICY] = DTRACEOPT_BUFPOLICY_SWITCH; 11295 opt[DTRACEOPT_BUFRESIZE] = DTRACEOPT_BUFRESIZE_AUTO; 11296 opt[DTRACEOPT_NSPEC] = dtrace_nspec_default; 11297 opt[DTRACEOPT_SPECSIZE] = dtrace_specsize_default; 11298 opt[DTRACEOPT_CPU] = (dtrace_optval_t)DTRACE_CPUALL; 11299 opt[DTRACEOPT_STRSIZE] = dtrace_strsize_default; 11300 opt[DTRACEOPT_STACKFRAMES] = dtrace_stackframes_default; 11301 opt[DTRACEOPT_USTACKFRAMES] = dtrace_ustackframes_default; 11302 opt[DTRACEOPT_CLEANRATE] = dtrace_cleanrate_default; 11303 opt[DTRACEOPT_AGGRATE] = dtrace_aggrate_default; 11304 opt[DTRACEOPT_SWITCHRATE] = dtrace_switchrate_default; 11305 opt[DTRACEOPT_STATUSRATE] = dtrace_statusrate_default; 11306 opt[DTRACEOPT_JSTACKFRAMES] = dtrace_jstackframes_default; 11307 opt[DTRACEOPT_JSTACKSTRSIZE] = dtrace_jstackstrsize_default; 11308 11309 state->dts_activity = DTRACE_ACTIVITY_INACTIVE; 11310 11311 /* 11312 * Depending on the user credentials, we set flag bits which alter probe 11313 * visibility or the amount of destructiveness allowed. In the case of 11314 * actual anonymous tracing, or the possession of all privileges, all of 11315 * the normal checks are bypassed. 11316 */ 11317 if (cr == NULL || PRIV_POLICY_ONLY(cr, PRIV_ALL, B_FALSE)) { 11318 state->dts_cred.dcr_visible = DTRACE_CRV_ALL; 11319 state->dts_cred.dcr_action = DTRACE_CRA_ALL; 11320 } else { 11321 /* 11322 * Set up the credentials for this instantiation. We take a 11323 * hold on the credential to prevent it from disappearing on 11324 * us; this in turn prevents the zone_t referenced by this 11325 * credential from disappearing. This means that we can 11326 * examine the credential and the zone from probe context. 11327 */ 11328 crhold(cr); 11329 state->dts_cred.dcr_cred = cr; 11330 11331 /* 11332 * CRA_PROC means "we have *some* privilege for dtrace" and 11333 * unlocks the use of variables like pid, zonename, etc. 11334 */ 11335 if (PRIV_POLICY_ONLY(cr, PRIV_DTRACE_USER, B_FALSE) || 11336 PRIV_POLICY_ONLY(cr, PRIV_DTRACE_PROC, B_FALSE)) { 11337 state->dts_cred.dcr_action |= DTRACE_CRA_PROC; 11338 } 11339 11340 /* 11341 * dtrace_user allows use of syscall and profile providers. 11342 * If the user also has proc_owner and/or proc_zone, we 11343 * extend the scope to include additional visibility and 11344 * destructive power. 11345 */ 11346 if (PRIV_POLICY_ONLY(cr, PRIV_DTRACE_USER, B_FALSE)) { 11347 if (PRIV_POLICY_ONLY(cr, PRIV_PROC_OWNER, B_FALSE)) { 11348 state->dts_cred.dcr_visible |= 11349 DTRACE_CRV_ALLPROC; 11350 11351 state->dts_cred.dcr_action |= 11352 DTRACE_CRA_PROC_DESTRUCTIVE_ALLUSER; 11353 } 11354 11355 if (PRIV_POLICY_ONLY(cr, PRIV_PROC_ZONE, B_FALSE)) { 11356 state->dts_cred.dcr_visible |= 11357 DTRACE_CRV_ALLZONE; 11358 11359 state->dts_cred.dcr_action |= 11360 DTRACE_CRA_PROC_DESTRUCTIVE_ALLZONE; 11361 } 11362 11363 /* 11364 * If we have all privs in whatever zone this is, 11365 * we can do destructive things to processes which 11366 * have altered credentials. 11367 */ 11368 if (priv_isequalset(priv_getset(cr, PRIV_EFFECTIVE), 11369 cr->cr_zone->zone_privset)) { 11370 state->dts_cred.dcr_action |= 11371 DTRACE_CRA_PROC_DESTRUCTIVE_CREDCHG; 11372 } 11373 } 11374 11375 /* 11376 * Holding the dtrace_kernel privilege also implies that 11377 * the user has the dtrace_user privilege from a visibility 11378 * perspective. But without further privileges, some 11379 * destructive actions are not available. 11380 */ 11381 if (PRIV_POLICY_ONLY(cr, PRIV_DTRACE_KERNEL, B_FALSE)) { 11382 /* 11383 * Make all probes in all zones visible. However, 11384 * this doesn't mean that all actions become available 11385 * to all zones. 11386 */ 11387 state->dts_cred.dcr_visible |= DTRACE_CRV_KERNEL | 11388 DTRACE_CRV_ALLPROC | DTRACE_CRV_ALLZONE; 11389 11390 state->dts_cred.dcr_action |= DTRACE_CRA_KERNEL | 11391 DTRACE_CRA_PROC; 11392 /* 11393 * Holding proc_owner means that destructive actions 11394 * for *this* zone are allowed. 11395 */ 11396 if (PRIV_POLICY_ONLY(cr, PRIV_PROC_OWNER, B_FALSE)) 11397 state->dts_cred.dcr_action |= 11398 DTRACE_CRA_PROC_DESTRUCTIVE_ALLUSER; 11399 11400 /* 11401 * Holding proc_zone means that destructive actions 11402 * for this user/group ID in all zones is allowed. 11403 */ 11404 if (PRIV_POLICY_ONLY(cr, PRIV_PROC_ZONE, B_FALSE)) 11405 state->dts_cred.dcr_action |= 11406 DTRACE_CRA_PROC_DESTRUCTIVE_ALLZONE; 11407 11408 /* 11409 * If we have all privs in whatever zone this is, 11410 * we can do destructive things to processes which 11411 * have altered credentials. 11412 */ 11413 if (priv_isequalset(priv_getset(cr, PRIV_EFFECTIVE), 11414 cr->cr_zone->zone_privset)) { 11415 state->dts_cred.dcr_action |= 11416 DTRACE_CRA_PROC_DESTRUCTIVE_CREDCHG; 11417 } 11418 } 11419 11420 /* 11421 * Holding the dtrace_proc privilege gives control over fasttrap 11422 * and pid providers. We need to grant wider destructive 11423 * privileges in the event that the user has proc_owner and/or 11424 * proc_zone. 11425 */ 11426 if (PRIV_POLICY_ONLY(cr, PRIV_DTRACE_PROC, B_FALSE)) { 11427 if (PRIV_POLICY_ONLY(cr, PRIV_PROC_OWNER, B_FALSE)) 11428 state->dts_cred.dcr_action |= 11429 DTRACE_CRA_PROC_DESTRUCTIVE_ALLUSER; 11430 11431 if (PRIV_POLICY_ONLY(cr, PRIV_PROC_ZONE, B_FALSE)) 11432 state->dts_cred.dcr_action |= 11433 DTRACE_CRA_PROC_DESTRUCTIVE_ALLZONE; 11434 } 11435 } 11436 11437 return (state); 11438 } 11439 11440 static int 11441 dtrace_state_buffer(dtrace_state_t *state, dtrace_buffer_t *buf, int which) 11442 { 11443 dtrace_optval_t *opt = state->dts_options, size; 11444 processorid_t cpu; 11445 int flags = 0, rval; 11446 11447 ASSERT(MUTEX_HELD(&dtrace_lock)); 11448 ASSERT(MUTEX_HELD(&cpu_lock)); 11449 ASSERT(which < DTRACEOPT_MAX); 11450 ASSERT(state->dts_activity == DTRACE_ACTIVITY_INACTIVE || 11451 (state == dtrace_anon.dta_state && 11452 state->dts_activity == DTRACE_ACTIVITY_ACTIVE)); 11453 11454 if (opt[which] == DTRACEOPT_UNSET || opt[which] == 0) 11455 return (0); 11456 11457 if (opt[DTRACEOPT_CPU] != DTRACEOPT_UNSET) 11458 cpu = opt[DTRACEOPT_CPU]; 11459 11460 if (which == DTRACEOPT_SPECSIZE) 11461 flags |= DTRACEBUF_NOSWITCH; 11462 11463 if (which == DTRACEOPT_BUFSIZE) { 11464 if (opt[DTRACEOPT_BUFPOLICY] == DTRACEOPT_BUFPOLICY_RING) 11465 flags |= DTRACEBUF_RING; 11466 11467 if (opt[DTRACEOPT_BUFPOLICY] == DTRACEOPT_BUFPOLICY_FILL) 11468 flags |= DTRACEBUF_FILL; 11469 11470 flags |= DTRACEBUF_INACTIVE; 11471 } 11472 11473 for (size = opt[which]; size >= sizeof (uint64_t); size >>= 1) { 11474 /* 11475 * The size must be 8-byte aligned. If the size is not 8-byte 11476 * aligned, drop it down by the difference. 11477 */ 11478 if (size & (sizeof (uint64_t) - 1)) 11479 size -= size & (sizeof (uint64_t) - 1); 11480 11481 if (size < state->dts_reserve) { 11482 /* 11483 * Buffers always must be large enough to accommodate 11484 * their prereserved space. We return E2BIG instead 11485 * of ENOMEM in this case to allow for user-level 11486 * software to differentiate the cases. 11487 */ 11488 return (E2BIG); 11489 } 11490 11491 rval = dtrace_buffer_alloc(buf, size, flags, cpu); 11492 11493 if (rval != ENOMEM) { 11494 opt[which] = size; 11495 return (rval); 11496 } 11497 11498 if (opt[DTRACEOPT_BUFRESIZE] == DTRACEOPT_BUFRESIZE_MANUAL) 11499 return (rval); 11500 } 11501 11502 return (ENOMEM); 11503 } 11504 11505 static int 11506 dtrace_state_buffers(dtrace_state_t *state) 11507 { 11508 dtrace_speculation_t *spec = state->dts_speculations; 11509 int rval, i; 11510 11511 if ((rval = dtrace_state_buffer(state, state->dts_buffer, 11512 DTRACEOPT_BUFSIZE)) != 0) 11513 return (rval); 11514 11515 if ((rval = dtrace_state_buffer(state, state->dts_aggbuffer, 11516 DTRACEOPT_AGGSIZE)) != 0) 11517 return (rval); 11518 11519 for (i = 0; i < state->dts_nspeculations; i++) { 11520 if ((rval = dtrace_state_buffer(state, 11521 spec[i].dtsp_buffer, DTRACEOPT_SPECSIZE)) != 0) 11522 return (rval); 11523 } 11524 11525 return (0); 11526 } 11527 11528 static void 11529 dtrace_state_prereserve(dtrace_state_t *state) 11530 { 11531 dtrace_ecb_t *ecb; 11532 dtrace_probe_t *probe; 11533 11534 state->dts_reserve = 0; 11535 11536 if (state->dts_options[DTRACEOPT_BUFPOLICY] != DTRACEOPT_BUFPOLICY_FILL) 11537 return; 11538 11539 /* 11540 * If our buffer policy is a "fill" buffer policy, we need to set the 11541 * prereserved space to be the space required by the END probes. 11542 */ 11543 probe = dtrace_probes[dtrace_probeid_end - 1]; 11544 ASSERT(probe != NULL); 11545 11546 for (ecb = probe->dtpr_ecb; ecb != NULL; ecb = ecb->dte_next) { 11547 if (ecb->dte_state != state) 11548 continue; 11549 11550 state->dts_reserve += ecb->dte_needed + ecb->dte_alignment; 11551 } 11552 } 11553 11554 static int 11555 dtrace_state_go(dtrace_state_t *state, processorid_t *cpu) 11556 { 11557 dtrace_optval_t *opt = state->dts_options, sz, nspec; 11558 dtrace_speculation_t *spec; 11559 dtrace_buffer_t *buf; 11560 cyc_handler_t hdlr; 11561 cyc_time_t when; 11562 int rval = 0, i, bufsize = NCPU * sizeof (dtrace_buffer_t); 11563 dtrace_icookie_t cookie; 11564 11565 mutex_enter(&cpu_lock); 11566 mutex_enter(&dtrace_lock); 11567 11568 if (state->dts_activity != DTRACE_ACTIVITY_INACTIVE) { 11569 rval = EBUSY; 11570 goto out; 11571 } 11572 11573 /* 11574 * Before we can perform any checks, we must prime all of the 11575 * retained enablings that correspond to this state. 11576 */ 11577 dtrace_enabling_prime(state); 11578 11579 if (state->dts_destructive && !state->dts_cred.dcr_destructive) { 11580 rval = EACCES; 11581 goto out; 11582 } 11583 11584 dtrace_state_prereserve(state); 11585 11586 /* 11587 * Now we want to do is try to allocate our speculations. 11588 * We do not automatically resize the number of speculations; if 11589 * this fails, we will fail the operation. 11590 */ 11591 nspec = opt[DTRACEOPT_NSPEC]; 11592 ASSERT(nspec != DTRACEOPT_UNSET); 11593 11594 if (nspec > INT_MAX) { 11595 rval = ENOMEM; 11596 goto out; 11597 } 11598 11599 spec = kmem_zalloc(nspec * sizeof (dtrace_speculation_t), KM_NOSLEEP); 11600 11601 if (spec == NULL) { 11602 rval = ENOMEM; 11603 goto out; 11604 } 11605 11606 state->dts_speculations = spec; 11607 state->dts_nspeculations = (int)nspec; 11608 11609 for (i = 0; i < nspec; i++) { 11610 if ((buf = kmem_zalloc(bufsize, KM_NOSLEEP)) == NULL) { 11611 rval = ENOMEM; 11612 goto err; 11613 } 11614 11615 spec[i].dtsp_buffer = buf; 11616 } 11617 11618 if (opt[DTRACEOPT_GRABANON] != DTRACEOPT_UNSET) { 11619 if (dtrace_anon.dta_state == NULL) { 11620 rval = ENOENT; 11621 goto out; 11622 } 11623 11624 if (state->dts_necbs != 0) { 11625 rval = EALREADY; 11626 goto out; 11627 } 11628 11629 state->dts_anon = dtrace_anon_grab(); 11630 ASSERT(state->dts_anon != NULL); 11631 state = state->dts_anon; 11632 11633 /* 11634 * We want "grabanon" to be set in the grabbed state, so we'll 11635 * copy that option value from the grabbing state into the 11636 * grabbed state. 11637 */ 11638 state->dts_options[DTRACEOPT_GRABANON] = 11639 opt[DTRACEOPT_GRABANON]; 11640 11641 *cpu = dtrace_anon.dta_beganon; 11642 11643 /* 11644 * If the anonymous state is active (as it almost certainly 11645 * is if the anonymous enabling ultimately matched anything), 11646 * we don't allow any further option processing -- but we 11647 * don't return failure. 11648 */ 11649 if (state->dts_activity != DTRACE_ACTIVITY_INACTIVE) 11650 goto out; 11651 } 11652 11653 if (opt[DTRACEOPT_AGGSIZE] != DTRACEOPT_UNSET && 11654 opt[DTRACEOPT_AGGSIZE] != 0) { 11655 if (state->dts_aggregations == NULL) { 11656 /* 11657 * We're not going to create an aggregation buffer 11658 * because we don't have any ECBs that contain 11659 * aggregations -- set this option to 0. 11660 */ 11661 opt[DTRACEOPT_AGGSIZE] = 0; 11662 } else { 11663 /* 11664 * If we have an aggregation buffer, we must also have 11665 * a buffer to use as scratch. 11666 */ 11667 if (opt[DTRACEOPT_BUFSIZE] == DTRACEOPT_UNSET || 11668 opt[DTRACEOPT_BUFSIZE] < state->dts_needed) { 11669 opt[DTRACEOPT_BUFSIZE] = state->dts_needed; 11670 } 11671 } 11672 } 11673 11674 if (opt[DTRACEOPT_SPECSIZE] != DTRACEOPT_UNSET && 11675 opt[DTRACEOPT_SPECSIZE] != 0) { 11676 if (!state->dts_speculates) { 11677 /* 11678 * We're not going to create speculation buffers 11679 * because we don't have any ECBs that actually 11680 * speculate -- set the speculation size to 0. 11681 */ 11682 opt[DTRACEOPT_SPECSIZE] = 0; 11683 } 11684 } 11685 11686 /* 11687 * The bare minimum size for any buffer that we're actually going to 11688 * do anything to is sizeof (uint64_t). 11689 */ 11690 sz = sizeof (uint64_t); 11691 11692 if ((state->dts_needed != 0 && opt[DTRACEOPT_BUFSIZE] < sz) || 11693 (state->dts_speculates && opt[DTRACEOPT_SPECSIZE] < sz) || 11694 (state->dts_aggregations != NULL && opt[DTRACEOPT_AGGSIZE] < sz)) { 11695 /* 11696 * A buffer size has been explicitly set to 0 (or to a size 11697 * that will be adjusted to 0) and we need the space -- we 11698 * need to return failure. We return ENOSPC to differentiate 11699 * it from failing to allocate a buffer due to failure to meet 11700 * the reserve (for which we return E2BIG). 11701 */ 11702 rval = ENOSPC; 11703 goto out; 11704 } 11705 11706 if ((rval = dtrace_state_buffers(state)) != 0) 11707 goto err; 11708 11709 if ((sz = opt[DTRACEOPT_DYNVARSIZE]) == DTRACEOPT_UNSET) 11710 sz = dtrace_dstate_defsize; 11711 11712 do { 11713 rval = dtrace_dstate_init(&state->dts_vstate.dtvs_dynvars, sz); 11714 11715 if (rval == 0) 11716 break; 11717 11718 if (opt[DTRACEOPT_BUFRESIZE] == DTRACEOPT_BUFRESIZE_MANUAL) 11719 goto err; 11720 } while (sz >>= 1); 11721 11722 opt[DTRACEOPT_DYNVARSIZE] = sz; 11723 11724 if (rval != 0) 11725 goto err; 11726 11727 if (opt[DTRACEOPT_STATUSRATE] > dtrace_statusrate_max) 11728 opt[DTRACEOPT_STATUSRATE] = dtrace_statusrate_max; 11729 11730 if (opt[DTRACEOPT_CLEANRATE] == 0) 11731 opt[DTRACEOPT_CLEANRATE] = dtrace_cleanrate_max; 11732 11733 if (opt[DTRACEOPT_CLEANRATE] < dtrace_cleanrate_min) 11734 opt[DTRACEOPT_CLEANRATE] = dtrace_cleanrate_min; 11735 11736 if (opt[DTRACEOPT_CLEANRATE] > dtrace_cleanrate_max) 11737 opt[DTRACEOPT_CLEANRATE] = dtrace_cleanrate_max; 11738 11739 hdlr.cyh_func = (cyc_func_t)dtrace_state_clean; 11740 hdlr.cyh_arg = state; 11741 hdlr.cyh_level = CY_LOW_LEVEL; 11742 11743 when.cyt_when = 0; 11744 when.cyt_interval = opt[DTRACEOPT_CLEANRATE]; 11745 11746 state->dts_cleaner = cyclic_add(&hdlr, &when); 11747 11748 hdlr.cyh_func = (cyc_func_t)dtrace_state_deadman; 11749 hdlr.cyh_arg = state; 11750 hdlr.cyh_level = CY_LOW_LEVEL; 11751 11752 when.cyt_when = 0; 11753 when.cyt_interval = dtrace_deadman_interval; 11754 11755 state->dts_alive = state->dts_laststatus = dtrace_gethrtime(); 11756 state->dts_deadman = cyclic_add(&hdlr, &when); 11757 11758 state->dts_activity = DTRACE_ACTIVITY_WARMUP; 11759 11760 /* 11761 * Now it's time to actually fire the BEGIN probe. We need to disable 11762 * interrupts here both to record the CPU on which we fired the BEGIN 11763 * probe (the data from this CPU will be processed first at user 11764 * level) and to manually activate the buffer for this CPU. 11765 */ 11766 cookie = dtrace_interrupt_disable(); 11767 *cpu = CPU->cpu_id; 11768 ASSERT(state->dts_buffer[*cpu].dtb_flags & DTRACEBUF_INACTIVE); 11769 state->dts_buffer[*cpu].dtb_flags &= ~DTRACEBUF_INACTIVE; 11770 11771 dtrace_probe(dtrace_probeid_begin, 11772 (uint64_t)(uintptr_t)state, 0, 0, 0, 0); 11773 dtrace_interrupt_enable(cookie); 11774 /* 11775 * We may have had an exit action from a BEGIN probe; only change our 11776 * state to ACTIVE if we're still in WARMUP. 11777 */ 11778 ASSERT(state->dts_activity == DTRACE_ACTIVITY_WARMUP || 11779 state->dts_activity == DTRACE_ACTIVITY_DRAINING); 11780 11781 if (state->dts_activity == DTRACE_ACTIVITY_WARMUP) 11782 state->dts_activity = DTRACE_ACTIVITY_ACTIVE; 11783 11784 /* 11785 * Regardless of whether or not now we're in ACTIVE or DRAINING, we 11786 * want each CPU to transition its principal buffer out of the 11787 * INACTIVE state. Doing this assures that no CPU will suddenly begin 11788 * processing an ECB halfway down a probe's ECB chain; all CPUs will 11789 * atomically transition from processing none of a state's ECBs to 11790 * processing all of them. 11791 */ 11792 dtrace_xcall(DTRACE_CPUALL, 11793 (dtrace_xcall_t)dtrace_buffer_activate, state); 11794 goto out; 11795 11796 err: 11797 dtrace_buffer_free(state->dts_buffer); 11798 dtrace_buffer_free(state->dts_aggbuffer); 11799 11800 if ((nspec = state->dts_nspeculations) == 0) { 11801 ASSERT(state->dts_speculations == NULL); 11802 goto out; 11803 } 11804 11805 spec = state->dts_speculations; 11806 ASSERT(spec != NULL); 11807 11808 for (i = 0; i < state->dts_nspeculations; i++) { 11809 if ((buf = spec[i].dtsp_buffer) == NULL) 11810 break; 11811 11812 dtrace_buffer_free(buf); 11813 kmem_free(buf, bufsize); 11814 } 11815 11816 kmem_free(spec, nspec * sizeof (dtrace_speculation_t)); 11817 state->dts_nspeculations = 0; 11818 state->dts_speculations = NULL; 11819 11820 out: 11821 mutex_exit(&dtrace_lock); 11822 mutex_exit(&cpu_lock); 11823 11824 return (rval); 11825 } 11826 11827 static int 11828 dtrace_state_stop(dtrace_state_t *state, processorid_t *cpu) 11829 { 11830 dtrace_icookie_t cookie; 11831 11832 ASSERT(MUTEX_HELD(&dtrace_lock)); 11833 11834 if (state->dts_activity != DTRACE_ACTIVITY_ACTIVE && 11835 state->dts_activity != DTRACE_ACTIVITY_DRAINING) 11836 return (EINVAL); 11837 11838 /* 11839 * We'll set the activity to DTRACE_ACTIVITY_DRAINING, and issue a sync 11840 * to be sure that every CPU has seen it. See below for the details 11841 * on why this is done. 11842 */ 11843 state->dts_activity = DTRACE_ACTIVITY_DRAINING; 11844 dtrace_sync(); 11845 11846 /* 11847 * By this point, it is impossible for any CPU to be still processing 11848 * with DTRACE_ACTIVITY_ACTIVE. We can thus set our activity to 11849 * DTRACE_ACTIVITY_COOLDOWN and know that we're not racing with any 11850 * other CPU in dtrace_buffer_reserve(). This allows dtrace_probe() 11851 * and callees to know that the activity is DTRACE_ACTIVITY_COOLDOWN 11852 * iff we're in the END probe. 11853 */ 11854 state->dts_activity = DTRACE_ACTIVITY_COOLDOWN; 11855 dtrace_sync(); 11856 ASSERT(state->dts_activity == DTRACE_ACTIVITY_COOLDOWN); 11857 11858 /* 11859 * Finally, we can release the reserve and call the END probe. We 11860 * disable interrupts across calling the END probe to allow us to 11861 * return the CPU on which we actually called the END probe. This 11862 * allows user-land to be sure that this CPU's principal buffer is 11863 * processed last. 11864 */ 11865 state->dts_reserve = 0; 11866 11867 cookie = dtrace_interrupt_disable(); 11868 *cpu = CPU->cpu_id; 11869 dtrace_probe(dtrace_probeid_end, 11870 (uint64_t)(uintptr_t)state, 0, 0, 0, 0); 11871 dtrace_interrupt_enable(cookie); 11872 11873 state->dts_activity = DTRACE_ACTIVITY_STOPPED; 11874 dtrace_sync(); 11875 11876 return (0); 11877 } 11878 11879 static int 11880 dtrace_state_option(dtrace_state_t *state, dtrace_optid_t option, 11881 dtrace_optval_t val) 11882 { 11883 ASSERT(MUTEX_HELD(&dtrace_lock)); 11884 11885 if (state->dts_activity != DTRACE_ACTIVITY_INACTIVE) 11886 return (EBUSY); 11887 11888 if (option >= DTRACEOPT_MAX) 11889 return (EINVAL); 11890 11891 if (option != DTRACEOPT_CPU && val < 0) 11892 return (EINVAL); 11893 11894 switch (option) { 11895 case DTRACEOPT_DESTRUCTIVE: 11896 if (dtrace_destructive_disallow) 11897 return (EACCES); 11898 11899 state->dts_cred.dcr_destructive = 1; 11900 break; 11901 11902 case DTRACEOPT_BUFSIZE: 11903 case DTRACEOPT_DYNVARSIZE: 11904 case DTRACEOPT_AGGSIZE: 11905 case DTRACEOPT_SPECSIZE: 11906 case DTRACEOPT_STRSIZE: 11907 if (val < 0) 11908 return (EINVAL); 11909 11910 if (val >= LONG_MAX) { 11911 /* 11912 * If this is an otherwise negative value, set it to 11913 * the highest multiple of 128m less than LONG_MAX. 11914 * Technically, we're adjusting the size without 11915 * regard to the buffer resizing policy, but in fact, 11916 * this has no effect -- if we set the buffer size to 11917 * ~LONG_MAX and the buffer policy is ultimately set to 11918 * be "manual", the buffer allocation is guaranteed to 11919 * fail, if only because the allocation requires two 11920 * buffers. (We set the the size to the highest 11921 * multiple of 128m because it ensures that the size 11922 * will remain a multiple of a megabyte when 11923 * repeatedly halved -- all the way down to 15m.) 11924 */ 11925 val = LONG_MAX - (1 << 27) + 1; 11926 } 11927 } 11928 11929 state->dts_options[option] = val; 11930 11931 return (0); 11932 } 11933 11934 static void 11935 dtrace_state_destroy(dtrace_state_t *state) 11936 { 11937 dtrace_ecb_t *ecb; 11938 dtrace_vstate_t *vstate = &state->dts_vstate; 11939 minor_t minor = getminor(state->dts_dev); 11940 int i, bufsize = NCPU * sizeof (dtrace_buffer_t); 11941 dtrace_speculation_t *spec = state->dts_speculations; 11942 int nspec = state->dts_nspeculations; 11943 uint32_t match; 11944 11945 ASSERT(MUTEX_HELD(&dtrace_lock)); 11946 ASSERT(MUTEX_HELD(&cpu_lock)); 11947 11948 /* 11949 * First, retract any retained enablings for this state. 11950 */ 11951 dtrace_enabling_retract(state); 11952 ASSERT(state->dts_nretained == 0); 11953 11954 if (state->dts_activity == DTRACE_ACTIVITY_ACTIVE || 11955 state->dts_activity == DTRACE_ACTIVITY_DRAINING) { 11956 /* 11957 * We have managed to come into dtrace_state_destroy() on a 11958 * hot enabling -- almost certainly because of a disorderly 11959 * shutdown of a consumer. (That is, a consumer that is 11960 * exiting without having called dtrace_stop().) In this case, 11961 * we're going to set our activity to be KILLED, and then 11962 * issue a sync to be sure that everyone is out of probe 11963 * context before we start blowing away ECBs. 11964 */ 11965 state->dts_activity = DTRACE_ACTIVITY_KILLED; 11966 dtrace_sync(); 11967 } 11968 11969 /* 11970 * Release the credential hold we took in dtrace_state_create(). 11971 */ 11972 if (state->dts_cred.dcr_cred != NULL) 11973 crfree(state->dts_cred.dcr_cred); 11974 11975 /* 11976 * Now we can safely disable and destroy any enabled probes. Because 11977 * any DTRACE_PRIV_KERNEL probes may actually be slowing our progress 11978 * (especially if they're all enabled), we take two passes through the 11979 * ECBs: in the first, we disable just DTRACE_PRIV_KERNEL probes, and 11980 * in the second we disable whatever is left over. 11981 */ 11982 for (match = DTRACE_PRIV_KERNEL; ; match = 0) { 11983 for (i = 0; i < state->dts_necbs; i++) { 11984 if ((ecb = state->dts_ecbs[i]) == NULL) 11985 continue; 11986 11987 if (match && ecb->dte_probe != NULL) { 11988 dtrace_probe_t *probe = ecb->dte_probe; 11989 dtrace_provider_t *prov = probe->dtpr_provider; 11990 11991 if (!(prov->dtpv_priv.dtpp_flags & match)) 11992 continue; 11993 } 11994 11995 dtrace_ecb_disable(ecb); 11996 dtrace_ecb_destroy(ecb); 11997 } 11998 11999 if (!match) 12000 break; 12001 } 12002 12003 /* 12004 * Before we free the buffers, perform one more sync to assure that 12005 * every CPU is out of probe context. 12006 */ 12007 dtrace_sync(); 12008 12009 dtrace_buffer_free(state->dts_buffer); 12010 dtrace_buffer_free(state->dts_aggbuffer); 12011 12012 for (i = 0; i < nspec; i++) 12013 dtrace_buffer_free(spec[i].dtsp_buffer); 12014 12015 if (state->dts_cleaner != CYCLIC_NONE) 12016 cyclic_remove(state->dts_cleaner); 12017 12018 if (state->dts_deadman != CYCLIC_NONE) 12019 cyclic_remove(state->dts_deadman); 12020 12021 dtrace_dstate_fini(&vstate->dtvs_dynvars); 12022 dtrace_vstate_fini(vstate); 12023 kmem_free(state->dts_ecbs, state->dts_necbs * sizeof (dtrace_ecb_t *)); 12024 12025 if (state->dts_aggregations != NULL) { 12026 #ifdef DEBUG 12027 for (i = 0; i < state->dts_naggregations; i++) 12028 ASSERT(state->dts_aggregations[i] == NULL); 12029 #endif 12030 ASSERT(state->dts_naggregations > 0); 12031 kmem_free(state->dts_aggregations, 12032 state->dts_naggregations * sizeof (dtrace_aggregation_t *)); 12033 } 12034 12035 kmem_free(state->dts_buffer, bufsize); 12036 kmem_free(state->dts_aggbuffer, bufsize); 12037 12038 for (i = 0; i < nspec; i++) 12039 kmem_free(spec[i].dtsp_buffer, bufsize); 12040 12041 kmem_free(spec, nspec * sizeof (dtrace_speculation_t)); 12042 12043 dtrace_format_destroy(state); 12044 12045 vmem_destroy(state->dts_aggid_arena); 12046 ddi_soft_state_free(dtrace_softstate, minor); 12047 vmem_free(dtrace_minor, (void *)(uintptr_t)minor, 1); 12048 } 12049 12050 /* 12051 * DTrace Anonymous Enabling Functions 12052 */ 12053 static dtrace_state_t * 12054 dtrace_anon_grab(void) 12055 { 12056 dtrace_state_t *state; 12057 12058 ASSERT(MUTEX_HELD(&dtrace_lock)); 12059 12060 if ((state = dtrace_anon.dta_state) == NULL) { 12061 ASSERT(dtrace_anon.dta_enabling == NULL); 12062 return (NULL); 12063 } 12064 12065 ASSERT(dtrace_anon.dta_enabling != NULL); 12066 ASSERT(dtrace_retained != NULL); 12067 12068 dtrace_enabling_destroy(dtrace_anon.dta_enabling); 12069 dtrace_anon.dta_enabling = NULL; 12070 dtrace_anon.dta_state = NULL; 12071 12072 return (state); 12073 } 12074 12075 static void 12076 dtrace_anon_property(void) 12077 { 12078 int i, rv; 12079 dtrace_state_t *state; 12080 dof_hdr_t *dof; 12081 char c[32]; /* enough for "dof-data-" + digits */ 12082 12083 ASSERT(MUTEX_HELD(&dtrace_lock)); 12084 ASSERT(MUTEX_HELD(&cpu_lock)); 12085 12086 for (i = 0; ; i++) { 12087 (void) snprintf(c, sizeof (c), "dof-data-%d", i); 12088 12089 dtrace_err_verbose = 1; 12090 12091 if ((dof = dtrace_dof_property(c)) == NULL) { 12092 dtrace_err_verbose = 0; 12093 break; 12094 } 12095 12096 /* 12097 * We want to create anonymous state, so we need to transition 12098 * the kernel debugger to indicate that DTrace is active. If 12099 * this fails (e.g. because the debugger has modified text in 12100 * some way), we won't continue with the processing. 12101 */ 12102 if (kdi_dtrace_set(KDI_DTSET_DTRACE_ACTIVATE) != 0) { 12103 cmn_err(CE_NOTE, "kernel debugger active; anonymous " 12104 "enabling ignored."); 12105 dtrace_dof_destroy(dof); 12106 break; 12107 } 12108 12109 /* 12110 * If we haven't allocated an anonymous state, we'll do so now. 12111 */ 12112 if ((state = dtrace_anon.dta_state) == NULL) { 12113 state = dtrace_state_create(NULL, NULL); 12114 dtrace_anon.dta_state = state; 12115 12116 if (state == NULL) { 12117 /* 12118 * This basically shouldn't happen: the only 12119 * failure mode from dtrace_state_create() is a 12120 * failure of ddi_soft_state_zalloc() that 12121 * itself should never happen. Still, the 12122 * interface allows for a failure mode, and 12123 * we want to fail as gracefully as possible: 12124 * we'll emit an error message and cease 12125 * processing anonymous state in this case. 12126 */ 12127 cmn_err(CE_WARN, "failed to create " 12128 "anonymous state"); 12129 dtrace_dof_destroy(dof); 12130 break; 12131 } 12132 } 12133 12134 rv = dtrace_dof_slurp(dof, &state->dts_vstate, CRED(), 12135 &dtrace_anon.dta_enabling, 0, B_TRUE); 12136 12137 if (rv == 0) 12138 rv = dtrace_dof_options(dof, state); 12139 12140 dtrace_err_verbose = 0; 12141 dtrace_dof_destroy(dof); 12142 12143 if (rv != 0) { 12144 /* 12145 * This is malformed DOF; chuck any anonymous state 12146 * that we created. 12147 */ 12148 ASSERT(dtrace_anon.dta_enabling == NULL); 12149 dtrace_state_destroy(state); 12150 dtrace_anon.dta_state = NULL; 12151 break; 12152 } 12153 12154 ASSERT(dtrace_anon.dta_enabling != NULL); 12155 } 12156 12157 if (dtrace_anon.dta_enabling != NULL) { 12158 int rval; 12159 12160 /* 12161 * dtrace_enabling_retain() can only fail because we are 12162 * trying to retain more enablings than are allowed -- but 12163 * we only have one anonymous enabling, and we are guaranteed 12164 * to be allowed at least one retained enabling; we assert 12165 * that dtrace_enabling_retain() returns success. 12166 */ 12167 rval = dtrace_enabling_retain(dtrace_anon.dta_enabling); 12168 ASSERT(rval == 0); 12169 12170 dtrace_enabling_dump(dtrace_anon.dta_enabling); 12171 } 12172 } 12173 12174 /* 12175 * DTrace Helper Functions 12176 */ 12177 static void 12178 dtrace_helper_trace(dtrace_helper_action_t *helper, 12179 dtrace_mstate_t *mstate, dtrace_vstate_t *vstate, int where) 12180 { 12181 uint32_t size, next, nnext, i; 12182 dtrace_helptrace_t *ent; 12183 uint16_t flags = cpu_core[CPU->cpu_id].cpuc_dtrace_flags; 12184 12185 if (!dtrace_helptrace_enabled) 12186 return; 12187 12188 ASSERT(vstate->dtvs_nlocals <= dtrace_helptrace_nlocals); 12189 12190 /* 12191 * What would a tracing framework be without its own tracing 12192 * framework? (Well, a hell of a lot simpler, for starters...) 12193 */ 12194 size = sizeof (dtrace_helptrace_t) + dtrace_helptrace_nlocals * 12195 sizeof (uint64_t) - sizeof (uint64_t); 12196 12197 /* 12198 * Iterate until we can allocate a slot in the trace buffer. 12199 */ 12200 do { 12201 next = dtrace_helptrace_next; 12202 12203 if (next + size < dtrace_helptrace_bufsize) { 12204 nnext = next + size; 12205 } else { 12206 nnext = size; 12207 } 12208 } while (dtrace_cas32(&dtrace_helptrace_next, next, nnext) != next); 12209 12210 /* 12211 * We have our slot; fill it in. 12212 */ 12213 if (nnext == size) 12214 next = 0; 12215 12216 ent = (dtrace_helptrace_t *)&dtrace_helptrace_buffer[next]; 12217 ent->dtht_helper = helper; 12218 ent->dtht_where = where; 12219 ent->dtht_nlocals = vstate->dtvs_nlocals; 12220 12221 ent->dtht_fltoffs = (mstate->dtms_present & DTRACE_MSTATE_FLTOFFS) ? 12222 mstate->dtms_fltoffs : -1; 12223 ent->dtht_fault = DTRACE_FLAGS2FLT(flags); 12224 ent->dtht_illval = cpu_core[CPU->cpu_id].cpuc_dtrace_illval; 12225 12226 for (i = 0; i < vstate->dtvs_nlocals; i++) { 12227 dtrace_statvar_t *svar; 12228 12229 if ((svar = vstate->dtvs_locals[i]) == NULL) 12230 continue; 12231 12232 ASSERT(svar->dtsv_size >= NCPU * sizeof (uint64_t)); 12233 ent->dtht_locals[i] = 12234 ((uint64_t *)(uintptr_t)svar->dtsv_data)[CPU->cpu_id]; 12235 } 12236 } 12237 12238 static uint64_t 12239 dtrace_helper(int which, dtrace_mstate_t *mstate, 12240 dtrace_state_t *state, uint64_t arg0, uint64_t arg1) 12241 { 12242 uint16_t *flags = &cpu_core[CPU->cpu_id].cpuc_dtrace_flags; 12243 uint64_t sarg0 = mstate->dtms_arg[0]; 12244 uint64_t sarg1 = mstate->dtms_arg[1]; 12245 uint64_t rval; 12246 dtrace_helpers_t *helpers = curproc->p_dtrace_helpers; 12247 dtrace_helper_action_t *helper; 12248 dtrace_vstate_t *vstate; 12249 dtrace_difo_t *pred; 12250 int i, trace = dtrace_helptrace_enabled; 12251 12252 ASSERT(which >= 0 && which < DTRACE_NHELPER_ACTIONS); 12253 12254 if (helpers == NULL) 12255 return (0); 12256 12257 if ((helper = helpers->dthps_actions[which]) == NULL) 12258 return (0); 12259 12260 vstate = &helpers->dthps_vstate; 12261 mstate->dtms_arg[0] = arg0; 12262 mstate->dtms_arg[1] = arg1; 12263 12264 /* 12265 * Now iterate over each helper. If its predicate evaluates to 'true', 12266 * we'll call the corresponding actions. Note that the below calls 12267 * to dtrace_dif_emulate() may set faults in machine state. This is 12268 * okay: our caller (the outer dtrace_dif_emulate()) will simply plow 12269 * the stored DIF offset with its own (which is the desired behavior). 12270 * Also, note the calls to dtrace_dif_emulate() may allocate scratch 12271 * from machine state; this is okay, too. 12272 */ 12273 for (; helper != NULL; helper = helper->dtha_next) { 12274 if ((pred = helper->dtha_predicate) != NULL) { 12275 if (trace) 12276 dtrace_helper_trace(helper, mstate, vstate, 0); 12277 12278 if (!dtrace_dif_emulate(pred, mstate, vstate, state)) 12279 goto next; 12280 12281 if (*flags & CPU_DTRACE_FAULT) 12282 goto err; 12283 } 12284 12285 for (i = 0; i < helper->dtha_nactions; i++) { 12286 if (trace) 12287 dtrace_helper_trace(helper, 12288 mstate, vstate, i + 1); 12289 12290 rval = dtrace_dif_emulate(helper->dtha_actions[i], 12291 mstate, vstate, state); 12292 12293 if (*flags & CPU_DTRACE_FAULT) 12294 goto err; 12295 } 12296 12297 next: 12298 if (trace) 12299 dtrace_helper_trace(helper, mstate, vstate, 12300 DTRACE_HELPTRACE_NEXT); 12301 } 12302 12303 if (trace) 12304 dtrace_helper_trace(helper, mstate, vstate, 12305 DTRACE_HELPTRACE_DONE); 12306 12307 /* 12308 * Restore the arg0 that we saved upon entry. 12309 */ 12310 mstate->dtms_arg[0] = sarg0; 12311 mstate->dtms_arg[1] = sarg1; 12312 12313 return (rval); 12314 12315 err: 12316 if (trace) 12317 dtrace_helper_trace(helper, mstate, vstate, 12318 DTRACE_HELPTRACE_ERR); 12319 12320 /* 12321 * Restore the arg0 that we saved upon entry. 12322 */ 12323 mstate->dtms_arg[0] = sarg0; 12324 mstate->dtms_arg[1] = sarg1; 12325 12326 return (NULL); 12327 } 12328 12329 static void 12330 dtrace_helper_action_destroy(dtrace_helper_action_t *helper, 12331 dtrace_vstate_t *vstate) 12332 { 12333 int i; 12334 12335 if (helper->dtha_predicate != NULL) 12336 dtrace_difo_release(helper->dtha_predicate, vstate); 12337 12338 for (i = 0; i < helper->dtha_nactions; i++) { 12339 ASSERT(helper->dtha_actions[i] != NULL); 12340 dtrace_difo_release(helper->dtha_actions[i], vstate); 12341 } 12342 12343 kmem_free(helper->dtha_actions, 12344 helper->dtha_nactions * sizeof (dtrace_difo_t *)); 12345 kmem_free(helper, sizeof (dtrace_helper_action_t)); 12346 } 12347 12348 static int 12349 dtrace_helper_destroygen(int gen) 12350 { 12351 proc_t *p = curproc; 12352 dtrace_helpers_t *help = p->p_dtrace_helpers; 12353 dtrace_vstate_t *vstate; 12354 int i; 12355 12356 ASSERT(MUTEX_HELD(&dtrace_lock)); 12357 12358 if (help == NULL || gen > help->dthps_generation) 12359 return (EINVAL); 12360 12361 vstate = &help->dthps_vstate; 12362 12363 for (i = 0; i < DTRACE_NHELPER_ACTIONS; i++) { 12364 dtrace_helper_action_t *last = NULL, *h, *next; 12365 12366 for (h = help->dthps_actions[i]; h != NULL; h = next) { 12367 next = h->dtha_next; 12368 12369 if (h->dtha_generation == gen) { 12370 if (last != NULL) { 12371 last->dtha_next = next; 12372 } else { 12373 help->dthps_actions[i] = next; 12374 } 12375 12376 dtrace_helper_action_destroy(h, vstate); 12377 } else { 12378 last = h; 12379 } 12380 } 12381 } 12382 12383 /* 12384 * Interate until we've cleared out all helper providers with the 12385 * given generation number. 12386 */ 12387 for (;;) { 12388 dtrace_helper_provider_t *prov; 12389 12390 /* 12391 * Look for a helper provider with the right generation. We 12392 * have to start back at the beginning of the list each time 12393 * because we drop dtrace_lock. It's unlikely that we'll make 12394 * more than two passes. 12395 */ 12396 for (i = 0; i < help->dthps_nprovs; i++) { 12397 prov = help->dthps_provs[i]; 12398 12399 if (prov->dthp_generation == gen) 12400 break; 12401 } 12402 12403 /* 12404 * If there were no matches, we're done. 12405 */ 12406 if (i == help->dthps_nprovs) 12407 break; 12408 12409 /* 12410 * Move the last helper provider into this slot. 12411 */ 12412 help->dthps_nprovs--; 12413 help->dthps_provs[i] = help->dthps_provs[help->dthps_nprovs]; 12414 help->dthps_provs[help->dthps_nprovs] = NULL; 12415 12416 mutex_exit(&dtrace_lock); 12417 12418 /* 12419 * If we have a meta provider, remove this helper provider. 12420 */ 12421 mutex_enter(&dtrace_meta_lock); 12422 if (dtrace_meta_pid != NULL) { 12423 ASSERT(dtrace_deferred_pid == NULL); 12424 dtrace_helper_provider_remove(&prov->dthp_prov, 12425 p->p_pid); 12426 } 12427 mutex_exit(&dtrace_meta_lock); 12428 12429 dtrace_helper_provider_destroy(prov); 12430 12431 mutex_enter(&dtrace_lock); 12432 } 12433 12434 return (0); 12435 } 12436 12437 static int 12438 dtrace_helper_validate(dtrace_helper_action_t *helper) 12439 { 12440 int err = 0, i; 12441 dtrace_difo_t *dp; 12442 12443 if ((dp = helper->dtha_predicate) != NULL) 12444 err += dtrace_difo_validate_helper(dp); 12445 12446 for (i = 0; i < helper->dtha_nactions; i++) 12447 err += dtrace_difo_validate_helper(helper->dtha_actions[i]); 12448 12449 return (err == 0); 12450 } 12451 12452 static int 12453 dtrace_helper_action_add(int which, dtrace_ecbdesc_t *ep) 12454 { 12455 dtrace_helpers_t *help; 12456 dtrace_helper_action_t *helper, *last; 12457 dtrace_actdesc_t *act; 12458 dtrace_vstate_t *vstate; 12459 dtrace_predicate_t *pred; 12460 int count = 0, nactions = 0, i; 12461 12462 if (which < 0 || which >= DTRACE_NHELPER_ACTIONS) 12463 return (EINVAL); 12464 12465 help = curproc->p_dtrace_helpers; 12466 last = help->dthps_actions[which]; 12467 vstate = &help->dthps_vstate; 12468 12469 for (count = 0; last != NULL; last = last->dtha_next) { 12470 count++; 12471 if (last->dtha_next == NULL) 12472 break; 12473 } 12474 12475 /* 12476 * If we already have dtrace_helper_actions_max helper actions for this 12477 * helper action type, we'll refuse to add a new one. 12478 */ 12479 if (count >= dtrace_helper_actions_max) 12480 return (ENOSPC); 12481 12482 helper = kmem_zalloc(sizeof (dtrace_helper_action_t), KM_SLEEP); 12483 helper->dtha_generation = help->dthps_generation; 12484 12485 if ((pred = ep->dted_pred.dtpdd_predicate) != NULL) { 12486 ASSERT(pred->dtp_difo != NULL); 12487 dtrace_difo_hold(pred->dtp_difo); 12488 helper->dtha_predicate = pred->dtp_difo; 12489 } 12490 12491 for (act = ep->dted_action; act != NULL; act = act->dtad_next) { 12492 if (act->dtad_kind != DTRACEACT_DIFEXPR) 12493 goto err; 12494 12495 if (act->dtad_difo == NULL) 12496 goto err; 12497 12498 nactions++; 12499 } 12500 12501 helper->dtha_actions = kmem_zalloc(sizeof (dtrace_difo_t *) * 12502 (helper->dtha_nactions = nactions), KM_SLEEP); 12503 12504 for (act = ep->dted_action, i = 0; act != NULL; act = act->dtad_next) { 12505 dtrace_difo_hold(act->dtad_difo); 12506 helper->dtha_actions[i++] = act->dtad_difo; 12507 } 12508 12509 if (!dtrace_helper_validate(helper)) 12510 goto err; 12511 12512 if (last == NULL) { 12513 help->dthps_actions[which] = helper; 12514 } else { 12515 last->dtha_next = helper; 12516 } 12517 12518 if (vstate->dtvs_nlocals > dtrace_helptrace_nlocals) { 12519 dtrace_helptrace_nlocals = vstate->dtvs_nlocals; 12520 dtrace_helptrace_next = 0; 12521 } 12522 12523 return (0); 12524 err: 12525 dtrace_helper_action_destroy(helper, vstate); 12526 return (EINVAL); 12527 } 12528 12529 static void 12530 dtrace_helper_provider_register(proc_t *p, dtrace_helpers_t *help, 12531 dof_helper_t *dofhp) 12532 { 12533 ASSERT(MUTEX_NOT_HELD(&dtrace_lock)); 12534 12535 mutex_enter(&dtrace_meta_lock); 12536 mutex_enter(&dtrace_lock); 12537 12538 if (!dtrace_attached() || dtrace_meta_pid == NULL) { 12539 /* 12540 * If the dtrace module is loaded but not attached, or if 12541 * there aren't isn't a meta provider registered to deal with 12542 * these provider descriptions, we need to postpone creating 12543 * the actual providers until later. 12544 */ 12545 12546 if (help->dthps_next == NULL && help->dthps_prev == NULL && 12547 dtrace_deferred_pid != help) { 12548 help->dthps_deferred = 1; 12549 help->dthps_pid = p->p_pid; 12550 help->dthps_next = dtrace_deferred_pid; 12551 help->dthps_prev = NULL; 12552 if (dtrace_deferred_pid != NULL) 12553 dtrace_deferred_pid->dthps_prev = help; 12554 dtrace_deferred_pid = help; 12555 } 12556 12557 mutex_exit(&dtrace_lock); 12558 12559 } else if (dofhp != NULL) { 12560 /* 12561 * If the dtrace module is loaded and we have a particular 12562 * helper provider description, pass that off to the 12563 * meta provider. 12564 */ 12565 12566 mutex_exit(&dtrace_lock); 12567 12568 dtrace_helper_provide(dofhp, p->p_pid); 12569 12570 } else { 12571 /* 12572 * Otherwise, just pass all the helper provider descriptions 12573 * off to the meta provider. 12574 */ 12575 12576 int i; 12577 mutex_exit(&dtrace_lock); 12578 12579 for (i = 0; i < help->dthps_nprovs; i++) { 12580 dtrace_helper_provide(&help->dthps_provs[i]->dthp_prov, 12581 p->p_pid); 12582 } 12583 } 12584 12585 mutex_exit(&dtrace_meta_lock); 12586 } 12587 12588 static int 12589 dtrace_helper_provider_add(dof_helper_t *dofhp, int gen) 12590 { 12591 dtrace_helpers_t *help; 12592 dtrace_helper_provider_t *hprov, **tmp_provs; 12593 uint_t tmp_maxprovs, i; 12594 12595 ASSERT(MUTEX_HELD(&dtrace_lock)); 12596 12597 help = curproc->p_dtrace_helpers; 12598 ASSERT(help != NULL); 12599 12600 /* 12601 * If we already have dtrace_helper_providers_max helper providers, 12602 * we're refuse to add a new one. 12603 */ 12604 if (help->dthps_nprovs >= dtrace_helper_providers_max) 12605 return (ENOSPC); 12606 12607 /* 12608 * Check to make sure this isn't a duplicate. 12609 */ 12610 for (i = 0; i < help->dthps_nprovs; i++) { 12611 if (dofhp->dofhp_addr == 12612 help->dthps_provs[i]->dthp_prov.dofhp_addr) 12613 return (EALREADY); 12614 } 12615 12616 hprov = kmem_zalloc(sizeof (dtrace_helper_provider_t), KM_SLEEP); 12617 hprov->dthp_prov = *dofhp; 12618 hprov->dthp_ref = 1; 12619 hprov->dthp_generation = gen; 12620 12621 /* 12622 * Allocate a bigger table for helper providers if it's already full. 12623 */ 12624 if (help->dthps_maxprovs == help->dthps_nprovs) { 12625 tmp_maxprovs = help->dthps_maxprovs; 12626 tmp_provs = help->dthps_provs; 12627 12628 if (help->dthps_maxprovs == 0) 12629 help->dthps_maxprovs = 2; 12630 else 12631 help->dthps_maxprovs *= 2; 12632 if (help->dthps_maxprovs > dtrace_helper_providers_max) 12633 help->dthps_maxprovs = dtrace_helper_providers_max; 12634 12635 ASSERT(tmp_maxprovs < help->dthps_maxprovs); 12636 12637 help->dthps_provs = kmem_zalloc(help->dthps_maxprovs * 12638 sizeof (dtrace_helper_provider_t *), KM_SLEEP); 12639 12640 if (tmp_provs != NULL) { 12641 bcopy(tmp_provs, help->dthps_provs, tmp_maxprovs * 12642 sizeof (dtrace_helper_provider_t *)); 12643 kmem_free(tmp_provs, tmp_maxprovs * 12644 sizeof (dtrace_helper_provider_t *)); 12645 } 12646 } 12647 12648 help->dthps_provs[help->dthps_nprovs] = hprov; 12649 help->dthps_nprovs++; 12650 12651 return (0); 12652 } 12653 12654 static void 12655 dtrace_helper_provider_destroy(dtrace_helper_provider_t *hprov) 12656 { 12657 mutex_enter(&dtrace_lock); 12658 12659 if (--hprov->dthp_ref == 0) { 12660 dof_hdr_t *dof; 12661 mutex_exit(&dtrace_lock); 12662 dof = (dof_hdr_t *)(uintptr_t)hprov->dthp_prov.dofhp_dof; 12663 dtrace_dof_destroy(dof); 12664 kmem_free(hprov, sizeof (dtrace_helper_provider_t)); 12665 } else { 12666 mutex_exit(&dtrace_lock); 12667 } 12668 } 12669 12670 static int 12671 dtrace_helper_provider_validate(dof_hdr_t *dof, dof_sec_t *sec) 12672 { 12673 uintptr_t daddr = (uintptr_t)dof; 12674 dof_sec_t *str_sec, *prb_sec, *arg_sec, *off_sec, *enoff_sec; 12675 dof_provider_t *provider; 12676 dof_probe_t *probe; 12677 uint8_t *arg; 12678 char *strtab, *typestr; 12679 dof_stridx_t typeidx; 12680 size_t typesz; 12681 uint_t nprobes, j, k; 12682 12683 ASSERT(sec->dofs_type == DOF_SECT_PROVIDER); 12684 12685 if (sec->dofs_offset & (sizeof (uint_t) - 1)) { 12686 dtrace_dof_error(dof, "misaligned section offset"); 12687 return (-1); 12688 } 12689 12690 /* 12691 * The section needs to be large enough to contain the DOF provider 12692 * structure appropriate for the given version. 12693 */ 12694 if (sec->dofs_size < 12695 ((dof->dofh_ident[DOF_ID_VERSION] == DOF_VERSION_1) ? 12696 offsetof(dof_provider_t, dofpv_prenoffs) : 12697 sizeof (dof_provider_t))) { 12698 dtrace_dof_error(dof, "provider section too small"); 12699 return (-1); 12700 } 12701 12702 provider = (dof_provider_t *)(uintptr_t)(daddr + sec->dofs_offset); 12703 str_sec = dtrace_dof_sect(dof, DOF_SECT_STRTAB, provider->dofpv_strtab); 12704 prb_sec = dtrace_dof_sect(dof, DOF_SECT_PROBES, provider->dofpv_probes); 12705 arg_sec = dtrace_dof_sect(dof, DOF_SECT_PRARGS, provider->dofpv_prargs); 12706 off_sec = dtrace_dof_sect(dof, DOF_SECT_PROFFS, provider->dofpv_proffs); 12707 12708 if (str_sec == NULL || prb_sec == NULL || 12709 arg_sec == NULL || off_sec == NULL) 12710 return (-1); 12711 12712 enoff_sec = NULL; 12713 12714 if (dof->dofh_ident[DOF_ID_VERSION] != DOF_VERSION_1 && 12715 provider->dofpv_prenoffs != DOF_SECT_NONE && 12716 (enoff_sec = dtrace_dof_sect(dof, DOF_SECT_PRENOFFS, 12717 provider->dofpv_prenoffs)) == NULL) 12718 return (-1); 12719 12720 strtab = (char *)(uintptr_t)(daddr + str_sec->dofs_offset); 12721 12722 if (provider->dofpv_name >= str_sec->dofs_size || 12723 strlen(strtab + provider->dofpv_name) >= DTRACE_PROVNAMELEN) { 12724 dtrace_dof_error(dof, "invalid provider name"); 12725 return (-1); 12726 } 12727 12728 if (prb_sec->dofs_entsize == 0 || 12729 prb_sec->dofs_entsize > prb_sec->dofs_size) { 12730 dtrace_dof_error(dof, "invalid entry size"); 12731 return (-1); 12732 } 12733 12734 if (prb_sec->dofs_entsize & (sizeof (uintptr_t) - 1)) { 12735 dtrace_dof_error(dof, "misaligned entry size"); 12736 return (-1); 12737 } 12738 12739 if (off_sec->dofs_entsize != sizeof (uint32_t)) { 12740 dtrace_dof_error(dof, "invalid entry size"); 12741 return (-1); 12742 } 12743 12744 if (off_sec->dofs_offset & (sizeof (uint32_t) - 1)) { 12745 dtrace_dof_error(dof, "misaligned section offset"); 12746 return (-1); 12747 } 12748 12749 if (arg_sec->dofs_entsize != sizeof (uint8_t)) { 12750 dtrace_dof_error(dof, "invalid entry size"); 12751 return (-1); 12752 } 12753 12754 arg = (uint8_t *)(uintptr_t)(daddr + arg_sec->dofs_offset); 12755 12756 nprobes = prb_sec->dofs_size / prb_sec->dofs_entsize; 12757 12758 /* 12759 * Take a pass through the probes to check for errors. 12760 */ 12761 for (j = 0; j < nprobes; j++) { 12762 probe = (dof_probe_t *)(uintptr_t)(daddr + 12763 prb_sec->dofs_offset + j * prb_sec->dofs_entsize); 12764 12765 if (probe->dofpr_func >= str_sec->dofs_size) { 12766 dtrace_dof_error(dof, "invalid function name"); 12767 return (-1); 12768 } 12769 12770 if (strlen(strtab + probe->dofpr_func) >= DTRACE_FUNCNAMELEN) { 12771 dtrace_dof_error(dof, "function name too long"); 12772 return (-1); 12773 } 12774 12775 if (probe->dofpr_name >= str_sec->dofs_size || 12776 strlen(strtab + probe->dofpr_name) >= DTRACE_NAMELEN) { 12777 dtrace_dof_error(dof, "invalid probe name"); 12778 return (-1); 12779 } 12780 12781 /* 12782 * The offset count must not wrap the index, and the offsets 12783 * must also not overflow the section's data. 12784 */ 12785 if (probe->dofpr_offidx + probe->dofpr_noffs < 12786 probe->dofpr_offidx || 12787 (probe->dofpr_offidx + probe->dofpr_noffs) * 12788 off_sec->dofs_entsize > off_sec->dofs_size) { 12789 dtrace_dof_error(dof, "invalid probe offset"); 12790 return (-1); 12791 } 12792 12793 if (dof->dofh_ident[DOF_ID_VERSION] != DOF_VERSION_1) { 12794 /* 12795 * If there's no is-enabled offset section, make sure 12796 * there aren't any is-enabled offsets. Otherwise 12797 * perform the same checks as for probe offsets 12798 * (immediately above). 12799 */ 12800 if (enoff_sec == NULL) { 12801 if (probe->dofpr_enoffidx != 0 || 12802 probe->dofpr_nenoffs != 0) { 12803 dtrace_dof_error(dof, "is-enabled " 12804 "offsets with null section"); 12805 return (-1); 12806 } 12807 } else if (probe->dofpr_enoffidx + 12808 probe->dofpr_nenoffs < probe->dofpr_enoffidx || 12809 (probe->dofpr_enoffidx + probe->dofpr_nenoffs) * 12810 enoff_sec->dofs_entsize > enoff_sec->dofs_size) { 12811 dtrace_dof_error(dof, "invalid is-enabled " 12812 "offset"); 12813 return (-1); 12814 } 12815 12816 if (probe->dofpr_noffs + probe->dofpr_nenoffs == 0) { 12817 dtrace_dof_error(dof, "zero probe and " 12818 "is-enabled offsets"); 12819 return (-1); 12820 } 12821 } else if (probe->dofpr_noffs == 0) { 12822 dtrace_dof_error(dof, "zero probe offsets"); 12823 return (-1); 12824 } 12825 12826 if (probe->dofpr_argidx + probe->dofpr_xargc < 12827 probe->dofpr_argidx || 12828 (probe->dofpr_argidx + probe->dofpr_xargc) * 12829 arg_sec->dofs_entsize > arg_sec->dofs_size) { 12830 dtrace_dof_error(dof, "invalid args"); 12831 return (-1); 12832 } 12833 12834 typeidx = probe->dofpr_nargv; 12835 typestr = strtab + probe->dofpr_nargv; 12836 for (k = 0; k < probe->dofpr_nargc; k++) { 12837 if (typeidx >= str_sec->dofs_size) { 12838 dtrace_dof_error(dof, "bad " 12839 "native argument type"); 12840 return (-1); 12841 } 12842 12843 typesz = strlen(typestr) + 1; 12844 if (typesz > DTRACE_ARGTYPELEN) { 12845 dtrace_dof_error(dof, "native " 12846 "argument type too long"); 12847 return (-1); 12848 } 12849 typeidx += typesz; 12850 typestr += typesz; 12851 } 12852 12853 typeidx = probe->dofpr_xargv; 12854 typestr = strtab + probe->dofpr_xargv; 12855 for (k = 0; k < probe->dofpr_xargc; k++) { 12856 if (arg[probe->dofpr_argidx + k] > probe->dofpr_nargc) { 12857 dtrace_dof_error(dof, "bad " 12858 "native argument index"); 12859 return (-1); 12860 } 12861 12862 if (typeidx >= str_sec->dofs_size) { 12863 dtrace_dof_error(dof, "bad " 12864 "translated argument type"); 12865 return (-1); 12866 } 12867 12868 typesz = strlen(typestr) + 1; 12869 if (typesz > DTRACE_ARGTYPELEN) { 12870 dtrace_dof_error(dof, "translated argument " 12871 "type too long"); 12872 return (-1); 12873 } 12874 12875 typeidx += typesz; 12876 typestr += typesz; 12877 } 12878 } 12879 12880 return (0); 12881 } 12882 12883 static int 12884 dtrace_helper_slurp(dof_hdr_t *dof, dof_helper_t *dhp) 12885 { 12886 dtrace_helpers_t *help; 12887 dtrace_vstate_t *vstate; 12888 dtrace_enabling_t *enab = NULL; 12889 int i, gen, rv, nhelpers = 0, nprovs = 0, destroy = 1; 12890 uintptr_t daddr = (uintptr_t)dof; 12891 12892 ASSERT(MUTEX_HELD(&dtrace_lock)); 12893 12894 if ((help = curproc->p_dtrace_helpers) == NULL) 12895 help = dtrace_helpers_create(curproc); 12896 12897 vstate = &help->dthps_vstate; 12898 12899 if ((rv = dtrace_dof_slurp(dof, vstate, NULL, &enab, 12900 dhp != NULL ? dhp->dofhp_addr : 0, B_FALSE)) != 0) { 12901 dtrace_dof_destroy(dof); 12902 return (rv); 12903 } 12904 12905 /* 12906 * Look for helper providers and validate their descriptions. 12907 */ 12908 if (dhp != NULL) { 12909 for (i = 0; i < dof->dofh_secnum; i++) { 12910 dof_sec_t *sec = (dof_sec_t *)(uintptr_t)(daddr + 12911 dof->dofh_secoff + i * dof->dofh_secsize); 12912 12913 if (sec->dofs_type != DOF_SECT_PROVIDER) 12914 continue; 12915 12916 if (dtrace_helper_provider_validate(dof, sec) != 0) { 12917 dtrace_enabling_destroy(enab); 12918 dtrace_dof_destroy(dof); 12919 return (-1); 12920 } 12921 12922 nprovs++; 12923 } 12924 } 12925 12926 /* 12927 * Now we need to walk through the ECB descriptions in the enabling. 12928 */ 12929 for (i = 0; i < enab->dten_ndesc; i++) { 12930 dtrace_ecbdesc_t *ep = enab->dten_desc[i]; 12931 dtrace_probedesc_t *desc = &ep->dted_probe; 12932 12933 if (strcmp(desc->dtpd_provider, "dtrace") != 0) 12934 continue; 12935 12936 if (strcmp(desc->dtpd_mod, "helper") != 0) 12937 continue; 12938 12939 if (strcmp(desc->dtpd_func, "ustack") != 0) 12940 continue; 12941 12942 if ((rv = dtrace_helper_action_add(DTRACE_HELPER_ACTION_USTACK, 12943 ep)) != 0) { 12944 /* 12945 * Adding this helper action failed -- we are now going 12946 * to rip out the entire generation and return failure. 12947 */ 12948 (void) dtrace_helper_destroygen(help->dthps_generation); 12949 dtrace_enabling_destroy(enab); 12950 dtrace_dof_destroy(dof); 12951 return (-1); 12952 } 12953 12954 nhelpers++; 12955 } 12956 12957 if (nhelpers < enab->dten_ndesc) 12958 dtrace_dof_error(dof, "unmatched helpers"); 12959 12960 gen = help->dthps_generation++; 12961 dtrace_enabling_destroy(enab); 12962 12963 if (dhp != NULL && nprovs > 0) { 12964 dhp->dofhp_dof = (uint64_t)(uintptr_t)dof; 12965 if (dtrace_helper_provider_add(dhp, gen) == 0) { 12966 mutex_exit(&dtrace_lock); 12967 dtrace_helper_provider_register(curproc, help, dhp); 12968 mutex_enter(&dtrace_lock); 12969 12970 destroy = 0; 12971 } 12972 } 12973 12974 if (destroy) 12975 dtrace_dof_destroy(dof); 12976 12977 return (gen); 12978 } 12979 12980 static dtrace_helpers_t * 12981 dtrace_helpers_create(proc_t *p) 12982 { 12983 dtrace_helpers_t *help; 12984 12985 ASSERT(MUTEX_HELD(&dtrace_lock)); 12986 ASSERT(p->p_dtrace_helpers == NULL); 12987 12988 help = kmem_zalloc(sizeof (dtrace_helpers_t), KM_SLEEP); 12989 help->dthps_actions = kmem_zalloc(sizeof (dtrace_helper_action_t *) * 12990 DTRACE_NHELPER_ACTIONS, KM_SLEEP); 12991 12992 p->p_dtrace_helpers = help; 12993 dtrace_helpers++; 12994 12995 return (help); 12996 } 12997 12998 static void 12999 dtrace_helpers_destroy(void) 13000 { 13001 dtrace_helpers_t *help; 13002 dtrace_vstate_t *vstate; 13003 proc_t *p = curproc; 13004 int i; 13005 13006 mutex_enter(&dtrace_lock); 13007 13008 ASSERT(p->p_dtrace_helpers != NULL); 13009 ASSERT(dtrace_helpers > 0); 13010 13011 help = p->p_dtrace_helpers; 13012 vstate = &help->dthps_vstate; 13013 13014 /* 13015 * We're now going to lose the help from this process. 13016 */ 13017 p->p_dtrace_helpers = NULL; 13018 dtrace_sync(); 13019 13020 /* 13021 * Destory the helper actions. 13022 */ 13023 for (i = 0; i < DTRACE_NHELPER_ACTIONS; i++) { 13024 dtrace_helper_action_t *h, *next; 13025 13026 for (h = help->dthps_actions[i]; h != NULL; h = next) { 13027 next = h->dtha_next; 13028 dtrace_helper_action_destroy(h, vstate); 13029 h = next; 13030 } 13031 } 13032 13033 mutex_exit(&dtrace_lock); 13034 13035 /* 13036 * Destroy the helper providers. 13037 */ 13038 if (help->dthps_maxprovs > 0) { 13039 mutex_enter(&dtrace_meta_lock); 13040 if (dtrace_meta_pid != NULL) { 13041 ASSERT(dtrace_deferred_pid == NULL); 13042 13043 for (i = 0; i < help->dthps_nprovs; i++) { 13044 dtrace_helper_provider_remove( 13045 &help->dthps_provs[i]->dthp_prov, p->p_pid); 13046 } 13047 } else { 13048 mutex_enter(&dtrace_lock); 13049 ASSERT(help->dthps_deferred == 0 || 13050 help->dthps_next != NULL || 13051 help->dthps_prev != NULL || 13052 help == dtrace_deferred_pid); 13053 13054 /* 13055 * Remove the helper from the deferred list. 13056 */ 13057 if (help->dthps_next != NULL) 13058 help->dthps_next->dthps_prev = help->dthps_prev; 13059 if (help->dthps_prev != NULL) 13060 help->dthps_prev->dthps_next = help->dthps_next; 13061 if (dtrace_deferred_pid == help) { 13062 dtrace_deferred_pid = help->dthps_next; 13063 ASSERT(help->dthps_prev == NULL); 13064 } 13065 13066 mutex_exit(&dtrace_lock); 13067 } 13068 13069 mutex_exit(&dtrace_meta_lock); 13070 13071 for (i = 0; i < help->dthps_nprovs; i++) { 13072 dtrace_helper_provider_destroy(help->dthps_provs[i]); 13073 } 13074 13075 kmem_free(help->dthps_provs, help->dthps_maxprovs * 13076 sizeof (dtrace_helper_provider_t *)); 13077 } 13078 13079 mutex_enter(&dtrace_lock); 13080 13081 dtrace_vstate_fini(&help->dthps_vstate); 13082 kmem_free(help->dthps_actions, 13083 sizeof (dtrace_helper_action_t *) * DTRACE_NHELPER_ACTIONS); 13084 kmem_free(help, sizeof (dtrace_helpers_t)); 13085 13086 --dtrace_helpers; 13087 mutex_exit(&dtrace_lock); 13088 } 13089 13090 static void 13091 dtrace_helpers_duplicate(proc_t *from, proc_t *to) 13092 { 13093 dtrace_helpers_t *help, *newhelp; 13094 dtrace_helper_action_t *helper, *new, *last; 13095 dtrace_difo_t *dp; 13096 dtrace_vstate_t *vstate; 13097 int i, j, sz, hasprovs = 0; 13098 13099 mutex_enter(&dtrace_lock); 13100 ASSERT(from->p_dtrace_helpers != NULL); 13101 ASSERT(dtrace_helpers > 0); 13102 13103 help = from->p_dtrace_helpers; 13104 newhelp = dtrace_helpers_create(to); 13105 ASSERT(to->p_dtrace_helpers != NULL); 13106 13107 newhelp->dthps_generation = help->dthps_generation; 13108 vstate = &newhelp->dthps_vstate; 13109 13110 /* 13111 * Duplicate the helper actions. 13112 */ 13113 for (i = 0; i < DTRACE_NHELPER_ACTIONS; i++) { 13114 if ((helper = help->dthps_actions[i]) == NULL) 13115 continue; 13116 13117 for (last = NULL; helper != NULL; helper = helper->dtha_next) { 13118 new = kmem_zalloc(sizeof (dtrace_helper_action_t), 13119 KM_SLEEP); 13120 new->dtha_generation = helper->dtha_generation; 13121 13122 if ((dp = helper->dtha_predicate) != NULL) { 13123 dp = dtrace_difo_duplicate(dp, vstate); 13124 new->dtha_predicate = dp; 13125 } 13126 13127 new->dtha_nactions = helper->dtha_nactions; 13128 sz = sizeof (dtrace_difo_t *) * new->dtha_nactions; 13129 new->dtha_actions = kmem_alloc(sz, KM_SLEEP); 13130 13131 for (j = 0; j < new->dtha_nactions; j++) { 13132 dtrace_difo_t *dp = helper->dtha_actions[j]; 13133 13134 ASSERT(dp != NULL); 13135 dp = dtrace_difo_duplicate(dp, vstate); 13136 new->dtha_actions[j] = dp; 13137 } 13138 13139 if (last != NULL) { 13140 last->dtha_next = new; 13141 } else { 13142 newhelp->dthps_actions[i] = new; 13143 } 13144 13145 last = new; 13146 } 13147 } 13148 13149 /* 13150 * Duplicate the helper providers and register them with the 13151 * DTrace framework. 13152 */ 13153 if (help->dthps_nprovs > 0) { 13154 newhelp->dthps_nprovs = help->dthps_nprovs; 13155 newhelp->dthps_maxprovs = help->dthps_nprovs; 13156 newhelp->dthps_provs = kmem_alloc(newhelp->dthps_nprovs * 13157 sizeof (dtrace_helper_provider_t *), KM_SLEEP); 13158 for (i = 0; i < newhelp->dthps_nprovs; i++) { 13159 newhelp->dthps_provs[i] = help->dthps_provs[i]; 13160 newhelp->dthps_provs[i]->dthp_ref++; 13161 } 13162 13163 hasprovs = 1; 13164 } 13165 13166 mutex_exit(&dtrace_lock); 13167 13168 if (hasprovs) 13169 dtrace_helper_provider_register(to, newhelp, NULL); 13170 } 13171 13172 /* 13173 * DTrace Hook Functions 13174 */ 13175 static void 13176 dtrace_module_loaded(struct modctl *ctl) 13177 { 13178 dtrace_provider_t *prv; 13179 13180 mutex_enter(&dtrace_provider_lock); 13181 mutex_enter(&mod_lock); 13182 13183 ASSERT(ctl->mod_busy); 13184 13185 /* 13186 * We're going to call each providers per-module provide operation 13187 * specifying only this module. 13188 */ 13189 for (prv = dtrace_provider; prv != NULL; prv = prv->dtpv_next) 13190 prv->dtpv_pops.dtps_provide_module(prv->dtpv_arg, ctl); 13191 13192 mutex_exit(&mod_lock); 13193 mutex_exit(&dtrace_provider_lock); 13194 13195 /* 13196 * If we have any retained enablings, we need to match against them. 13197 * Enabling probes requires that cpu_lock be held, and we cannot hold 13198 * cpu_lock here -- it is legal for cpu_lock to be held when loading a 13199 * module. (In particular, this happens when loading scheduling 13200 * classes.) So if we have any retained enablings, we need to dispatch 13201 * our task queue to do the match for us. 13202 */ 13203 mutex_enter(&dtrace_lock); 13204 13205 if (dtrace_retained == NULL) { 13206 mutex_exit(&dtrace_lock); 13207 return; 13208 } 13209 13210 (void) taskq_dispatch(dtrace_taskq, 13211 (task_func_t *)dtrace_enabling_matchall, NULL, TQ_SLEEP); 13212 13213 mutex_exit(&dtrace_lock); 13214 13215 /* 13216 * And now, for a little heuristic sleaze: in general, we want to 13217 * match modules as soon as they load. However, we cannot guarantee 13218 * this, because it would lead us to the lock ordering violation 13219 * outlined above. The common case, of course, is that cpu_lock is 13220 * _not_ held -- so we delay here for a clock tick, hoping that that's 13221 * long enough for the task queue to do its work. If it's not, it's 13222 * not a serious problem -- it just means that the module that we 13223 * just loaded may not be immediately instrumentable. 13224 */ 13225 delay(1); 13226 } 13227 13228 static void 13229 dtrace_module_unloaded(struct modctl *ctl) 13230 { 13231 dtrace_probe_t template, *probe, *first, *next; 13232 dtrace_provider_t *prov; 13233 13234 template.dtpr_mod = ctl->mod_modname; 13235 13236 mutex_enter(&dtrace_provider_lock); 13237 mutex_enter(&mod_lock); 13238 mutex_enter(&dtrace_lock); 13239 13240 if (dtrace_bymod == NULL) { 13241 /* 13242 * The DTrace module is loaded (obviously) but not attached; 13243 * we don't have any work to do. 13244 */ 13245 mutex_exit(&dtrace_provider_lock); 13246 mutex_exit(&mod_lock); 13247 mutex_exit(&dtrace_lock); 13248 return; 13249 } 13250 13251 for (probe = first = dtrace_hash_lookup(dtrace_bymod, &template); 13252 probe != NULL; probe = probe->dtpr_nextmod) { 13253 if (probe->dtpr_ecb != NULL) { 13254 mutex_exit(&dtrace_provider_lock); 13255 mutex_exit(&mod_lock); 13256 mutex_exit(&dtrace_lock); 13257 13258 /* 13259 * This shouldn't _actually_ be possible -- we're 13260 * unloading a module that has an enabled probe in it. 13261 * (It's normally up to the provider to make sure that 13262 * this can't happen.) However, because dtps_enable() 13263 * doesn't have a failure mode, there can be an 13264 * enable/unload race. Upshot: we don't want to 13265 * assert, but we're not going to disable the 13266 * probe, either. 13267 */ 13268 if (dtrace_err_verbose) { 13269 cmn_err(CE_WARN, "unloaded module '%s' had " 13270 "enabled probes", ctl->mod_modname); 13271 } 13272 13273 return; 13274 } 13275 } 13276 13277 probe = first; 13278 13279 for (first = NULL; probe != NULL; probe = next) { 13280 ASSERT(dtrace_probes[probe->dtpr_id - 1] == probe); 13281 13282 dtrace_probes[probe->dtpr_id - 1] = NULL; 13283 13284 next = probe->dtpr_nextmod; 13285 dtrace_hash_remove(dtrace_bymod, probe); 13286 dtrace_hash_remove(dtrace_byfunc, probe); 13287 dtrace_hash_remove(dtrace_byname, probe); 13288 13289 if (first == NULL) { 13290 first = probe; 13291 probe->dtpr_nextmod = NULL; 13292 } else { 13293 probe->dtpr_nextmod = first; 13294 first = probe; 13295 } 13296 } 13297 13298 /* 13299 * We've removed all of the module's probes from the hash chains and 13300 * from the probe array. Now issue a dtrace_sync() to be sure that 13301 * everyone has cleared out from any probe array processing. 13302 */ 13303 dtrace_sync(); 13304 13305 for (probe = first; probe != NULL; probe = first) { 13306 first = probe->dtpr_nextmod; 13307 prov = probe->dtpr_provider; 13308 prov->dtpv_pops.dtps_destroy(prov->dtpv_arg, probe->dtpr_id, 13309 probe->dtpr_arg); 13310 kmem_free(probe->dtpr_mod, strlen(probe->dtpr_mod) + 1); 13311 kmem_free(probe->dtpr_func, strlen(probe->dtpr_func) + 1); 13312 kmem_free(probe->dtpr_name, strlen(probe->dtpr_name) + 1); 13313 vmem_free(dtrace_arena, (void *)(uintptr_t)probe->dtpr_id, 1); 13314 kmem_free(probe, sizeof (dtrace_probe_t)); 13315 } 13316 13317 mutex_exit(&dtrace_lock); 13318 mutex_exit(&mod_lock); 13319 mutex_exit(&dtrace_provider_lock); 13320 } 13321 13322 void 13323 dtrace_suspend(void) 13324 { 13325 dtrace_probe_foreach(offsetof(dtrace_pops_t, dtps_suspend)); 13326 } 13327 13328 void 13329 dtrace_resume(void) 13330 { 13331 dtrace_probe_foreach(offsetof(dtrace_pops_t, dtps_resume)); 13332 } 13333 13334 static int 13335 dtrace_cpu_setup(cpu_setup_t what, processorid_t cpu) 13336 { 13337 ASSERT(MUTEX_HELD(&cpu_lock)); 13338 mutex_enter(&dtrace_lock); 13339 13340 switch (what) { 13341 case CPU_CONFIG: { 13342 dtrace_state_t *state; 13343 dtrace_optval_t *opt, rs, c; 13344 13345 /* 13346 * For now, we only allocate a new buffer for anonymous state. 13347 */ 13348 if ((state = dtrace_anon.dta_state) == NULL) 13349 break; 13350 13351 if (state->dts_activity != DTRACE_ACTIVITY_ACTIVE) 13352 break; 13353 13354 opt = state->dts_options; 13355 c = opt[DTRACEOPT_CPU]; 13356 13357 if (c != DTRACE_CPUALL && c != DTRACEOPT_UNSET && c != cpu) 13358 break; 13359 13360 /* 13361 * Regardless of what the actual policy is, we're going to 13362 * temporarily set our resize policy to be manual. We're 13363 * also going to temporarily set our CPU option to denote 13364 * the newly configured CPU. 13365 */ 13366 rs = opt[DTRACEOPT_BUFRESIZE]; 13367 opt[DTRACEOPT_BUFRESIZE] = DTRACEOPT_BUFRESIZE_MANUAL; 13368 opt[DTRACEOPT_CPU] = (dtrace_optval_t)cpu; 13369 13370 (void) dtrace_state_buffers(state); 13371 13372 opt[DTRACEOPT_BUFRESIZE] = rs; 13373 opt[DTRACEOPT_CPU] = c; 13374 13375 break; 13376 } 13377 13378 case CPU_UNCONFIG: 13379 /* 13380 * We don't free the buffer in the CPU_UNCONFIG case. (The 13381 * buffer will be freed when the consumer exits.) 13382 */ 13383 break; 13384 13385 default: 13386 break; 13387 } 13388 13389 mutex_exit(&dtrace_lock); 13390 return (0); 13391 } 13392 13393 static void 13394 dtrace_cpu_setup_initial(processorid_t cpu) 13395 { 13396 (void) dtrace_cpu_setup(CPU_CONFIG, cpu); 13397 } 13398 13399 static void 13400 dtrace_toxrange_add(uintptr_t base, uintptr_t limit) 13401 { 13402 if (dtrace_toxranges >= dtrace_toxranges_max) { 13403 int osize, nsize; 13404 dtrace_toxrange_t *range; 13405 13406 osize = dtrace_toxranges_max * sizeof (dtrace_toxrange_t); 13407 13408 if (osize == 0) { 13409 ASSERT(dtrace_toxrange == NULL); 13410 ASSERT(dtrace_toxranges_max == 0); 13411 dtrace_toxranges_max = 1; 13412 } else { 13413 dtrace_toxranges_max <<= 1; 13414 } 13415 13416 nsize = dtrace_toxranges_max * sizeof (dtrace_toxrange_t); 13417 range = kmem_zalloc(nsize, KM_SLEEP); 13418 13419 if (dtrace_toxrange != NULL) { 13420 ASSERT(osize != 0); 13421 bcopy(dtrace_toxrange, range, osize); 13422 kmem_free(dtrace_toxrange, osize); 13423 } 13424 13425 dtrace_toxrange = range; 13426 } 13427 13428 ASSERT(dtrace_toxrange[dtrace_toxranges].dtt_base == NULL); 13429 ASSERT(dtrace_toxrange[dtrace_toxranges].dtt_limit == NULL); 13430 13431 dtrace_toxrange[dtrace_toxranges].dtt_base = base; 13432 dtrace_toxrange[dtrace_toxranges].dtt_limit = limit; 13433 dtrace_toxranges++; 13434 } 13435 13436 /* 13437 * DTrace Driver Cookbook Functions 13438 */ 13439 /*ARGSUSED*/ 13440 static int 13441 dtrace_attach(dev_info_t *devi, ddi_attach_cmd_t cmd) 13442 { 13443 dtrace_provider_id_t id; 13444 dtrace_state_t *state = NULL; 13445 dtrace_enabling_t *enab; 13446 13447 mutex_enter(&cpu_lock); 13448 mutex_enter(&dtrace_provider_lock); 13449 mutex_enter(&dtrace_lock); 13450 13451 if (ddi_soft_state_init(&dtrace_softstate, 13452 sizeof (dtrace_state_t), 0) != 0) { 13453 cmn_err(CE_NOTE, "/dev/dtrace failed to initialize soft state"); 13454 mutex_exit(&cpu_lock); 13455 mutex_exit(&dtrace_provider_lock); 13456 mutex_exit(&dtrace_lock); 13457 return (DDI_FAILURE); 13458 } 13459 13460 if (ddi_create_minor_node(devi, DTRACEMNR_DTRACE, S_IFCHR, 13461 DTRACEMNRN_DTRACE, DDI_PSEUDO, NULL) == DDI_FAILURE || 13462 ddi_create_minor_node(devi, DTRACEMNR_HELPER, S_IFCHR, 13463 DTRACEMNRN_HELPER, DDI_PSEUDO, NULL) == DDI_FAILURE) { 13464 cmn_err(CE_NOTE, "/dev/dtrace couldn't create minor nodes"); 13465 ddi_remove_minor_node(devi, NULL); 13466 ddi_soft_state_fini(&dtrace_softstate); 13467 mutex_exit(&cpu_lock); 13468 mutex_exit(&dtrace_provider_lock); 13469 mutex_exit(&dtrace_lock); 13470 return (DDI_FAILURE); 13471 } 13472 13473 ddi_report_dev(devi); 13474 dtrace_devi = devi; 13475 13476 dtrace_modload = dtrace_module_loaded; 13477 dtrace_modunload = dtrace_module_unloaded; 13478 dtrace_cpu_init = dtrace_cpu_setup_initial; 13479 dtrace_helpers_cleanup = dtrace_helpers_destroy; 13480 dtrace_helpers_fork = dtrace_helpers_duplicate; 13481 dtrace_cpustart_init = dtrace_suspend; 13482 dtrace_cpustart_fini = dtrace_resume; 13483 dtrace_debugger_init = dtrace_suspend; 13484 dtrace_debugger_fini = dtrace_resume; 13485 dtrace_kreloc_init = dtrace_suspend; 13486 dtrace_kreloc_fini = dtrace_resume; 13487 13488 register_cpu_setup_func((cpu_setup_func_t *)dtrace_cpu_setup, NULL); 13489 13490 ASSERT(MUTEX_HELD(&cpu_lock)); 13491 13492 dtrace_arena = vmem_create("dtrace", (void *)1, UINT32_MAX, 1, 13493 NULL, NULL, NULL, 0, VM_SLEEP | VMC_IDENTIFIER); 13494 dtrace_minor = vmem_create("dtrace_minor", (void *)DTRACEMNRN_CLONE, 13495 UINT32_MAX - DTRACEMNRN_CLONE, 1, NULL, NULL, NULL, 0, 13496 VM_SLEEP | VMC_IDENTIFIER); 13497 dtrace_taskq = taskq_create("dtrace_taskq", 1, maxclsyspri, 13498 1, INT_MAX, 0); 13499 13500 dtrace_state_cache = kmem_cache_create("dtrace_state_cache", 13501 sizeof (dtrace_dstate_percpu_t) * NCPU, DTRACE_STATE_ALIGN, 13502 NULL, NULL, NULL, NULL, NULL, 0); 13503 13504 ASSERT(MUTEX_HELD(&cpu_lock)); 13505 dtrace_bymod = dtrace_hash_create(offsetof(dtrace_probe_t, dtpr_mod), 13506 offsetof(dtrace_probe_t, dtpr_nextmod), 13507 offsetof(dtrace_probe_t, dtpr_prevmod)); 13508 13509 dtrace_byfunc = dtrace_hash_create(offsetof(dtrace_probe_t, dtpr_func), 13510 offsetof(dtrace_probe_t, dtpr_nextfunc), 13511 offsetof(dtrace_probe_t, dtpr_prevfunc)); 13512 13513 dtrace_byname = dtrace_hash_create(offsetof(dtrace_probe_t, dtpr_name), 13514 offsetof(dtrace_probe_t, dtpr_nextname), 13515 offsetof(dtrace_probe_t, dtpr_prevname)); 13516 13517 if (dtrace_retain_max < 1) { 13518 cmn_err(CE_WARN, "illegal value (%lu) for dtrace_retain_max; " 13519 "setting to 1", dtrace_retain_max); 13520 dtrace_retain_max = 1; 13521 } 13522 13523 /* 13524 * Now discover our toxic ranges. 13525 */ 13526 dtrace_toxic_ranges(dtrace_toxrange_add); 13527 13528 /* 13529 * Before we register ourselves as a provider to our own framework, 13530 * we would like to assert that dtrace_provider is NULL -- but that's 13531 * not true if we were loaded as a dependency of a DTrace provider. 13532 * Once we've registered, we can assert that dtrace_provider is our 13533 * pseudo provider. 13534 */ 13535 (void) dtrace_register("dtrace", &dtrace_provider_attr, 13536 DTRACE_PRIV_NONE, 0, &dtrace_provider_ops, NULL, &id); 13537 13538 ASSERT(dtrace_provider != NULL); 13539 ASSERT((dtrace_provider_id_t)dtrace_provider == id); 13540 13541 dtrace_probeid_begin = dtrace_probe_create((dtrace_provider_id_t) 13542 dtrace_provider, NULL, NULL, "BEGIN", 0, NULL); 13543 dtrace_probeid_end = dtrace_probe_create((dtrace_provider_id_t) 13544 dtrace_provider, NULL, NULL, "END", 0, NULL); 13545 dtrace_probeid_error = dtrace_probe_create((dtrace_provider_id_t) 13546 dtrace_provider, NULL, NULL, "ERROR", 1, NULL); 13547 13548 dtrace_anon_property(); 13549 mutex_exit(&cpu_lock); 13550 13551 /* 13552 * If DTrace helper tracing is enabled, we need to allocate the 13553 * trace buffer and initialize the values. 13554 */ 13555 if (dtrace_helptrace_enabled) { 13556 ASSERT(dtrace_helptrace_buffer == NULL); 13557 dtrace_helptrace_buffer = 13558 kmem_zalloc(dtrace_helptrace_bufsize, KM_SLEEP); 13559 dtrace_helptrace_next = 0; 13560 } 13561 13562 /* 13563 * If there are already providers, we must ask them to provide their 13564 * probes, and then match any anonymous enabling against them. Note 13565 * that there should be no other retained enablings at this time: 13566 * the only retained enablings at this time should be the anonymous 13567 * enabling. 13568 */ 13569 if (dtrace_anon.dta_enabling != NULL) { 13570 ASSERT(dtrace_retained == dtrace_anon.dta_enabling); 13571 13572 dtrace_enabling_provide(NULL); 13573 state = dtrace_anon.dta_state; 13574 13575 /* 13576 * We couldn't hold cpu_lock across the above call to 13577 * dtrace_enabling_provide(), but we must hold it to actually 13578 * enable the probes. We have to drop all of our locks, pick 13579 * up cpu_lock, and regain our locks before matching the 13580 * retained anonymous enabling. 13581 */ 13582 mutex_exit(&dtrace_lock); 13583 mutex_exit(&dtrace_provider_lock); 13584 13585 mutex_enter(&cpu_lock); 13586 mutex_enter(&dtrace_provider_lock); 13587 mutex_enter(&dtrace_lock); 13588 13589 if ((enab = dtrace_anon.dta_enabling) != NULL) 13590 (void) dtrace_enabling_match(enab, NULL); 13591 13592 mutex_exit(&cpu_lock); 13593 } 13594 13595 mutex_exit(&dtrace_lock); 13596 mutex_exit(&dtrace_provider_lock); 13597 13598 if (state != NULL) { 13599 /* 13600 * If we created any anonymous state, set it going now. 13601 */ 13602 (void) dtrace_state_go(state, &dtrace_anon.dta_beganon); 13603 } 13604 13605 return (DDI_SUCCESS); 13606 } 13607 13608 /*ARGSUSED*/ 13609 static int 13610 dtrace_open(dev_t *devp, int flag, int otyp, cred_t *cred_p) 13611 { 13612 dtrace_state_t *state; 13613 uint32_t priv; 13614 uid_t uid; 13615 zoneid_t zoneid; 13616 13617 if (getminor(*devp) == DTRACEMNRN_HELPER) 13618 return (0); 13619 13620 /* 13621 * If this wasn't an open with the "helper" minor, then it must be 13622 * the "dtrace" minor. 13623 */ 13624 ASSERT(getminor(*devp) == DTRACEMNRN_DTRACE); 13625 13626 /* 13627 * If no DTRACE_PRIV_* bits are set in the credential, then the 13628 * caller lacks sufficient permission to do anything with DTrace. 13629 */ 13630 dtrace_cred2priv(cred_p, &priv, &uid, &zoneid); 13631 if (priv == DTRACE_PRIV_NONE) 13632 return (EACCES); 13633 13634 /* 13635 * Ask all providers to provide all their probes. 13636 */ 13637 mutex_enter(&dtrace_provider_lock); 13638 dtrace_probe_provide(NULL, NULL); 13639 mutex_exit(&dtrace_provider_lock); 13640 13641 mutex_enter(&cpu_lock); 13642 mutex_enter(&dtrace_lock); 13643 dtrace_opens++; 13644 dtrace_membar_producer(); 13645 13646 /* 13647 * If the kernel debugger is active (that is, if the kernel debugger 13648 * modified text in some way), we won't allow the open. 13649 */ 13650 if (kdi_dtrace_set(KDI_DTSET_DTRACE_ACTIVATE) != 0) { 13651 dtrace_opens--; 13652 mutex_exit(&cpu_lock); 13653 mutex_exit(&dtrace_lock); 13654 return (EBUSY); 13655 } 13656 13657 state = dtrace_state_create(devp, cred_p); 13658 mutex_exit(&cpu_lock); 13659 13660 if (state == NULL) { 13661 if (--dtrace_opens == 0) 13662 (void) kdi_dtrace_set(KDI_DTSET_DTRACE_DEACTIVATE); 13663 mutex_exit(&dtrace_lock); 13664 return (EAGAIN); 13665 } 13666 13667 mutex_exit(&dtrace_lock); 13668 13669 return (0); 13670 } 13671 13672 /*ARGSUSED*/ 13673 static int 13674 dtrace_close(dev_t dev, int flag, int otyp, cred_t *cred_p) 13675 { 13676 minor_t minor = getminor(dev); 13677 dtrace_state_t *state; 13678 13679 if (minor == DTRACEMNRN_HELPER) 13680 return (0); 13681 13682 state = ddi_get_soft_state(dtrace_softstate, minor); 13683 13684 mutex_enter(&cpu_lock); 13685 mutex_enter(&dtrace_lock); 13686 13687 if (state->dts_anon) { 13688 /* 13689 * There is anonymous state. Destroy that first. 13690 */ 13691 ASSERT(dtrace_anon.dta_state == NULL); 13692 dtrace_state_destroy(state->dts_anon); 13693 } 13694 13695 dtrace_state_destroy(state); 13696 ASSERT(dtrace_opens > 0); 13697 if (--dtrace_opens == 0) 13698 (void) kdi_dtrace_set(KDI_DTSET_DTRACE_DEACTIVATE); 13699 13700 mutex_exit(&dtrace_lock); 13701 mutex_exit(&cpu_lock); 13702 13703 return (0); 13704 } 13705 13706 /*ARGSUSED*/ 13707 static int 13708 dtrace_ioctl_helper(int cmd, intptr_t arg, int *rv) 13709 { 13710 int rval; 13711 dof_helper_t help, *dhp = NULL; 13712 13713 switch (cmd) { 13714 case DTRACEHIOC_ADDDOF: 13715 if (copyin((void *)arg, &help, sizeof (help)) != 0) { 13716 dtrace_dof_error(NULL, "failed to copyin DOF helper"); 13717 return (EFAULT); 13718 } 13719 13720 dhp = &help; 13721 arg = (intptr_t)help.dofhp_dof; 13722 /*FALLTHROUGH*/ 13723 13724 case DTRACEHIOC_ADD: { 13725 dof_hdr_t *dof = dtrace_dof_copyin(arg, &rval); 13726 13727 if (dof == NULL) 13728 return (rval); 13729 13730 mutex_enter(&dtrace_lock); 13731 13732 /* 13733 * dtrace_helper_slurp() takes responsibility for the dof -- 13734 * it may free it now or it may save it and free it later. 13735 */ 13736 if ((rval = dtrace_helper_slurp(dof, dhp)) != -1) { 13737 *rv = rval; 13738 rval = 0; 13739 } else { 13740 rval = EINVAL; 13741 } 13742 13743 mutex_exit(&dtrace_lock); 13744 return (rval); 13745 } 13746 13747 case DTRACEHIOC_REMOVE: { 13748 mutex_enter(&dtrace_lock); 13749 rval = dtrace_helper_destroygen(arg); 13750 mutex_exit(&dtrace_lock); 13751 13752 return (rval); 13753 } 13754 13755 default: 13756 break; 13757 } 13758 13759 return (ENOTTY); 13760 } 13761 13762 /*ARGSUSED*/ 13763 static int 13764 dtrace_ioctl(dev_t dev, int cmd, intptr_t arg, int md, cred_t *cr, int *rv) 13765 { 13766 minor_t minor = getminor(dev); 13767 dtrace_state_t *state; 13768 int rval; 13769 13770 if (minor == DTRACEMNRN_HELPER) 13771 return (dtrace_ioctl_helper(cmd, arg, rv)); 13772 13773 state = ddi_get_soft_state(dtrace_softstate, minor); 13774 13775 if (state->dts_anon) { 13776 ASSERT(dtrace_anon.dta_state == NULL); 13777 state = state->dts_anon; 13778 } 13779 13780 switch (cmd) { 13781 case DTRACEIOC_PROVIDER: { 13782 dtrace_providerdesc_t pvd; 13783 dtrace_provider_t *pvp; 13784 13785 if (copyin((void *)arg, &pvd, sizeof (pvd)) != 0) 13786 return (EFAULT); 13787 13788 pvd.dtvd_name[DTRACE_PROVNAMELEN - 1] = '\0'; 13789 mutex_enter(&dtrace_provider_lock); 13790 13791 for (pvp = dtrace_provider; pvp != NULL; pvp = pvp->dtpv_next) { 13792 if (strcmp(pvp->dtpv_name, pvd.dtvd_name) == 0) 13793 break; 13794 } 13795 13796 mutex_exit(&dtrace_provider_lock); 13797 13798 if (pvp == NULL) 13799 return (ESRCH); 13800 13801 bcopy(&pvp->dtpv_priv, &pvd.dtvd_priv, sizeof (dtrace_ppriv_t)); 13802 bcopy(&pvp->dtpv_attr, &pvd.dtvd_attr, sizeof (dtrace_pattr_t)); 13803 if (copyout(&pvd, (void *)arg, sizeof (pvd)) != 0) 13804 return (EFAULT); 13805 13806 return (0); 13807 } 13808 13809 case DTRACEIOC_EPROBE: { 13810 dtrace_eprobedesc_t epdesc; 13811 dtrace_ecb_t *ecb; 13812 dtrace_action_t *act; 13813 void *buf; 13814 size_t size; 13815 uintptr_t dest; 13816 int nrecs; 13817 13818 if (copyin((void *)arg, &epdesc, sizeof (epdesc)) != 0) 13819 return (EFAULT); 13820 13821 mutex_enter(&dtrace_lock); 13822 13823 if ((ecb = dtrace_epid2ecb(state, epdesc.dtepd_epid)) == NULL) { 13824 mutex_exit(&dtrace_lock); 13825 return (EINVAL); 13826 } 13827 13828 if (ecb->dte_probe == NULL) { 13829 mutex_exit(&dtrace_lock); 13830 return (EINVAL); 13831 } 13832 13833 epdesc.dtepd_probeid = ecb->dte_probe->dtpr_id; 13834 epdesc.dtepd_uarg = ecb->dte_uarg; 13835 epdesc.dtepd_size = ecb->dte_size; 13836 13837 nrecs = epdesc.dtepd_nrecs; 13838 epdesc.dtepd_nrecs = 0; 13839 for (act = ecb->dte_action; act != NULL; act = act->dta_next) { 13840 if (DTRACEACT_ISAGG(act->dta_kind) || act->dta_intuple) 13841 continue; 13842 13843 epdesc.dtepd_nrecs++; 13844 } 13845 13846 /* 13847 * Now that we have the size, we need to allocate a temporary 13848 * buffer in which to store the complete description. We need 13849 * the temporary buffer to be able to drop dtrace_lock() 13850 * across the copyout(), below. 13851 */ 13852 size = sizeof (dtrace_eprobedesc_t) + 13853 (epdesc.dtepd_nrecs * sizeof (dtrace_recdesc_t)); 13854 13855 buf = kmem_alloc(size, KM_SLEEP); 13856 dest = (uintptr_t)buf; 13857 13858 bcopy(&epdesc, (void *)dest, sizeof (epdesc)); 13859 dest += offsetof(dtrace_eprobedesc_t, dtepd_rec[0]); 13860 13861 for (act = ecb->dte_action; act != NULL; act = act->dta_next) { 13862 if (DTRACEACT_ISAGG(act->dta_kind) || act->dta_intuple) 13863 continue; 13864 13865 if (nrecs-- == 0) 13866 break; 13867 13868 bcopy(&act->dta_rec, (void *)dest, 13869 sizeof (dtrace_recdesc_t)); 13870 dest += sizeof (dtrace_recdesc_t); 13871 } 13872 13873 mutex_exit(&dtrace_lock); 13874 13875 if (copyout(buf, (void *)arg, dest - (uintptr_t)buf) != 0) { 13876 kmem_free(buf, size); 13877 return (EFAULT); 13878 } 13879 13880 kmem_free(buf, size); 13881 return (0); 13882 } 13883 13884 case DTRACEIOC_AGGDESC: { 13885 dtrace_aggdesc_t aggdesc; 13886 dtrace_action_t *act; 13887 dtrace_aggregation_t *agg; 13888 int nrecs; 13889 uint32_t offs; 13890 dtrace_recdesc_t *lrec; 13891 void *buf; 13892 size_t size; 13893 uintptr_t dest; 13894 13895 if (copyin((void *)arg, &aggdesc, sizeof (aggdesc)) != 0) 13896 return (EFAULT); 13897 13898 mutex_enter(&dtrace_lock); 13899 13900 if ((agg = dtrace_aggid2agg(state, aggdesc.dtagd_id)) == NULL) { 13901 mutex_exit(&dtrace_lock); 13902 return (EINVAL); 13903 } 13904 13905 aggdesc.dtagd_epid = agg->dtag_ecb->dte_epid; 13906 13907 nrecs = aggdesc.dtagd_nrecs; 13908 aggdesc.dtagd_nrecs = 0; 13909 13910 offs = agg->dtag_base; 13911 lrec = &agg->dtag_action.dta_rec; 13912 aggdesc.dtagd_size = lrec->dtrd_offset + lrec->dtrd_size - offs; 13913 13914 for (act = agg->dtag_first; ; act = act->dta_next) { 13915 ASSERT(act->dta_intuple || 13916 DTRACEACT_ISAGG(act->dta_kind)); 13917 13918 /* 13919 * If this action has a record size of zero, it 13920 * denotes an argument to the aggregating action. 13921 * Because the presence of this record doesn't (or 13922 * shouldn't) affect the way the data is interpreted, 13923 * we don't copy it out to save user-level the 13924 * confusion of dealing with a zero-length record. 13925 */ 13926 if (act->dta_rec.dtrd_size == 0) { 13927 ASSERT(agg->dtag_hasarg); 13928 continue; 13929 } 13930 13931 aggdesc.dtagd_nrecs++; 13932 13933 if (act == &agg->dtag_action) 13934 break; 13935 } 13936 13937 /* 13938 * Now that we have the size, we need to allocate a temporary 13939 * buffer in which to store the complete description. We need 13940 * the temporary buffer to be able to drop dtrace_lock() 13941 * across the copyout(), below. 13942 */ 13943 size = sizeof (dtrace_aggdesc_t) + 13944 (aggdesc.dtagd_nrecs * sizeof (dtrace_recdesc_t)); 13945 13946 buf = kmem_alloc(size, KM_SLEEP); 13947 dest = (uintptr_t)buf; 13948 13949 bcopy(&aggdesc, (void *)dest, sizeof (aggdesc)); 13950 dest += offsetof(dtrace_aggdesc_t, dtagd_rec[0]); 13951 13952 for (act = agg->dtag_first; ; act = act->dta_next) { 13953 dtrace_recdesc_t rec = act->dta_rec; 13954 13955 /* 13956 * See the comment in the above loop for why we pass 13957 * over zero-length records. 13958 */ 13959 if (rec.dtrd_size == 0) { 13960 ASSERT(agg->dtag_hasarg); 13961 continue; 13962 } 13963 13964 if (nrecs-- == 0) 13965 break; 13966 13967 rec.dtrd_offset -= offs; 13968 bcopy(&rec, (void *)dest, sizeof (rec)); 13969 dest += sizeof (dtrace_recdesc_t); 13970 13971 if (act == &agg->dtag_action) 13972 break; 13973 } 13974 13975 mutex_exit(&dtrace_lock); 13976 13977 if (copyout(buf, (void *)arg, dest - (uintptr_t)buf) != 0) { 13978 kmem_free(buf, size); 13979 return (EFAULT); 13980 } 13981 13982 kmem_free(buf, size); 13983 return (0); 13984 } 13985 13986 case DTRACEIOC_ENABLE: { 13987 dof_hdr_t *dof; 13988 dtrace_enabling_t *enab = NULL; 13989 dtrace_vstate_t *vstate; 13990 int err = 0; 13991 13992 *rv = 0; 13993 13994 /* 13995 * If a NULL argument has been passed, we take this as our 13996 * cue to reevaluate our enablings. 13997 */ 13998 if (arg == NULL) { 13999 mutex_enter(&cpu_lock); 14000 mutex_enter(&dtrace_lock); 14001 err = dtrace_enabling_matchstate(state, rv); 14002 mutex_exit(&dtrace_lock); 14003 mutex_exit(&cpu_lock); 14004 14005 return (err); 14006 } 14007 14008 if ((dof = dtrace_dof_copyin(arg, &rval)) == NULL) 14009 return (rval); 14010 14011 mutex_enter(&cpu_lock); 14012 mutex_enter(&dtrace_lock); 14013 vstate = &state->dts_vstate; 14014 14015 if (state->dts_activity != DTRACE_ACTIVITY_INACTIVE) { 14016 mutex_exit(&dtrace_lock); 14017 mutex_exit(&cpu_lock); 14018 dtrace_dof_destroy(dof); 14019 return (EBUSY); 14020 } 14021 14022 if (dtrace_dof_slurp(dof, vstate, cr, &enab, 0, B_TRUE) != 0) { 14023 mutex_exit(&dtrace_lock); 14024 mutex_exit(&cpu_lock); 14025 dtrace_dof_destroy(dof); 14026 return (EINVAL); 14027 } 14028 14029 if ((rval = dtrace_dof_options(dof, state)) != 0) { 14030 dtrace_enabling_destroy(enab); 14031 mutex_exit(&dtrace_lock); 14032 mutex_exit(&cpu_lock); 14033 dtrace_dof_destroy(dof); 14034 return (rval); 14035 } 14036 14037 if ((err = dtrace_enabling_match(enab, rv)) == 0) { 14038 err = dtrace_enabling_retain(enab); 14039 } else { 14040 dtrace_enabling_destroy(enab); 14041 } 14042 14043 mutex_exit(&cpu_lock); 14044 mutex_exit(&dtrace_lock); 14045 dtrace_dof_destroy(dof); 14046 14047 return (err); 14048 } 14049 14050 case DTRACEIOC_REPLICATE: { 14051 dtrace_repldesc_t desc; 14052 dtrace_probedesc_t *match = &desc.dtrpd_match; 14053 dtrace_probedesc_t *create = &desc.dtrpd_create; 14054 int err; 14055 14056 if (copyin((void *)arg, &desc, sizeof (desc)) != 0) 14057 return (EFAULT); 14058 14059 match->dtpd_provider[DTRACE_PROVNAMELEN - 1] = '\0'; 14060 match->dtpd_mod[DTRACE_MODNAMELEN - 1] = '\0'; 14061 match->dtpd_func[DTRACE_FUNCNAMELEN - 1] = '\0'; 14062 match->dtpd_name[DTRACE_NAMELEN - 1] = '\0'; 14063 14064 create->dtpd_provider[DTRACE_PROVNAMELEN - 1] = '\0'; 14065 create->dtpd_mod[DTRACE_MODNAMELEN - 1] = '\0'; 14066 create->dtpd_func[DTRACE_FUNCNAMELEN - 1] = '\0'; 14067 create->dtpd_name[DTRACE_NAMELEN - 1] = '\0'; 14068 14069 mutex_enter(&dtrace_lock); 14070 err = dtrace_enabling_replicate(state, match, create); 14071 mutex_exit(&dtrace_lock); 14072 14073 return (err); 14074 } 14075 14076 case DTRACEIOC_PROBEMATCH: 14077 case DTRACEIOC_PROBES: { 14078 dtrace_probe_t *probe = NULL; 14079 dtrace_probedesc_t desc; 14080 dtrace_probekey_t pkey; 14081 dtrace_id_t i; 14082 int m = 0; 14083 uint32_t priv; 14084 uid_t uid; 14085 zoneid_t zoneid; 14086 14087 if (copyin((void *)arg, &desc, sizeof (desc)) != 0) 14088 return (EFAULT); 14089 14090 desc.dtpd_provider[DTRACE_PROVNAMELEN - 1] = '\0'; 14091 desc.dtpd_mod[DTRACE_MODNAMELEN - 1] = '\0'; 14092 desc.dtpd_func[DTRACE_FUNCNAMELEN - 1] = '\0'; 14093 desc.dtpd_name[DTRACE_NAMELEN - 1] = '\0'; 14094 14095 /* 14096 * Before we attempt to match this probe, we want to give 14097 * all providers the opportunity to provide it. 14098 */ 14099 if (desc.dtpd_id == DTRACE_IDNONE) { 14100 mutex_enter(&dtrace_provider_lock); 14101 dtrace_probe_provide(&desc, NULL); 14102 mutex_exit(&dtrace_provider_lock); 14103 desc.dtpd_id++; 14104 } 14105 14106 if (cmd == DTRACEIOC_PROBEMATCH) { 14107 dtrace_probekey(&desc, &pkey); 14108 pkey.dtpk_id = DTRACE_IDNONE; 14109 } 14110 14111 dtrace_cred2priv(cr, &priv, &uid, &zoneid); 14112 14113 mutex_enter(&dtrace_lock); 14114 14115 if (cmd == DTRACEIOC_PROBEMATCH) { 14116 for (i = desc.dtpd_id; i <= dtrace_nprobes; i++) { 14117 if ((probe = dtrace_probes[i - 1]) != NULL && 14118 (m = dtrace_match_probe(probe, &pkey, 14119 priv, uid, zoneid)) != 0) 14120 break; 14121 } 14122 14123 if (m < 0) { 14124 mutex_exit(&dtrace_lock); 14125 return (EINVAL); 14126 } 14127 14128 } else { 14129 for (i = desc.dtpd_id; i <= dtrace_nprobes; i++) { 14130 if ((probe = dtrace_probes[i - 1]) != NULL && 14131 dtrace_match_priv(probe, priv, uid, zoneid)) 14132 break; 14133 } 14134 } 14135 14136 if (probe == NULL) { 14137 mutex_exit(&dtrace_lock); 14138 return (ESRCH); 14139 } 14140 14141 dtrace_probe_description(probe, &desc); 14142 mutex_exit(&dtrace_lock); 14143 14144 if (copyout(&desc, (void *)arg, sizeof (desc)) != 0) 14145 return (EFAULT); 14146 14147 return (0); 14148 } 14149 14150 case DTRACEIOC_PROBEARG: { 14151 dtrace_argdesc_t desc; 14152 dtrace_probe_t *probe; 14153 dtrace_provider_t *prov; 14154 14155 if (copyin((void *)arg, &desc, sizeof (desc)) != 0) 14156 return (EFAULT); 14157 14158 if (desc.dtargd_id == DTRACE_IDNONE) 14159 return (EINVAL); 14160 14161 if (desc.dtargd_ndx == DTRACE_ARGNONE) 14162 return (EINVAL); 14163 14164 mutex_enter(&dtrace_provider_lock); 14165 mutex_enter(&mod_lock); 14166 mutex_enter(&dtrace_lock); 14167 14168 if (desc.dtargd_id > dtrace_nprobes) { 14169 mutex_exit(&dtrace_lock); 14170 mutex_exit(&mod_lock); 14171 mutex_exit(&dtrace_provider_lock); 14172 return (EINVAL); 14173 } 14174 14175 if ((probe = dtrace_probes[desc.dtargd_id - 1]) == NULL) { 14176 mutex_exit(&dtrace_lock); 14177 mutex_exit(&mod_lock); 14178 mutex_exit(&dtrace_provider_lock); 14179 return (EINVAL); 14180 } 14181 14182 mutex_exit(&dtrace_lock); 14183 14184 prov = probe->dtpr_provider; 14185 14186 if (prov->dtpv_pops.dtps_getargdesc == NULL) { 14187 /* 14188 * There isn't any typed information for this probe. 14189 * Set the argument number to DTRACE_ARGNONE. 14190 */ 14191 desc.dtargd_ndx = DTRACE_ARGNONE; 14192 } else { 14193 desc.dtargd_native[0] = '\0'; 14194 desc.dtargd_xlate[0] = '\0'; 14195 desc.dtargd_mapping = desc.dtargd_ndx; 14196 14197 prov->dtpv_pops.dtps_getargdesc(prov->dtpv_arg, 14198 probe->dtpr_id, probe->dtpr_arg, &desc); 14199 } 14200 14201 mutex_exit(&mod_lock); 14202 mutex_exit(&dtrace_provider_lock); 14203 14204 if (copyout(&desc, (void *)arg, sizeof (desc)) != 0) 14205 return (EFAULT); 14206 14207 return (0); 14208 } 14209 14210 case DTRACEIOC_GO: { 14211 processorid_t cpuid; 14212 rval = dtrace_state_go(state, &cpuid); 14213 14214 if (rval != 0) 14215 return (rval); 14216 14217 if (copyout(&cpuid, (void *)arg, sizeof (cpuid)) != 0) 14218 return (EFAULT); 14219 14220 return (0); 14221 } 14222 14223 case DTRACEIOC_STOP: { 14224 processorid_t cpuid; 14225 14226 mutex_enter(&dtrace_lock); 14227 rval = dtrace_state_stop(state, &cpuid); 14228 mutex_exit(&dtrace_lock); 14229 14230 if (rval != 0) 14231 return (rval); 14232 14233 if (copyout(&cpuid, (void *)arg, sizeof (cpuid)) != 0) 14234 return (EFAULT); 14235 14236 return (0); 14237 } 14238 14239 case DTRACEIOC_DOFGET: { 14240 dof_hdr_t hdr, *dof; 14241 uint64_t len; 14242 14243 if (copyin((void *)arg, &hdr, sizeof (hdr)) != 0) 14244 return (EFAULT); 14245 14246 mutex_enter(&dtrace_lock); 14247 dof = dtrace_dof_create(state); 14248 mutex_exit(&dtrace_lock); 14249 14250 len = MIN(hdr.dofh_loadsz, dof->dofh_loadsz); 14251 rval = copyout(dof, (void *)arg, len); 14252 dtrace_dof_destroy(dof); 14253 14254 return (rval == 0 ? 0 : EFAULT); 14255 } 14256 14257 case DTRACEIOC_AGGSNAP: 14258 case DTRACEIOC_BUFSNAP: { 14259 dtrace_bufdesc_t desc; 14260 caddr_t cached; 14261 dtrace_buffer_t *buf; 14262 14263 if (copyin((void *)arg, &desc, sizeof (desc)) != 0) 14264 return (EFAULT); 14265 14266 if (desc.dtbd_cpu < 0 || desc.dtbd_cpu >= NCPU) 14267 return (EINVAL); 14268 14269 mutex_enter(&dtrace_lock); 14270 14271 if (cmd == DTRACEIOC_BUFSNAP) { 14272 buf = &state->dts_buffer[desc.dtbd_cpu]; 14273 } else { 14274 buf = &state->dts_aggbuffer[desc.dtbd_cpu]; 14275 } 14276 14277 if (buf->dtb_flags & (DTRACEBUF_RING | DTRACEBUF_FILL)) { 14278 size_t sz = buf->dtb_offset; 14279 14280 if (state->dts_activity != DTRACE_ACTIVITY_STOPPED) { 14281 mutex_exit(&dtrace_lock); 14282 return (EBUSY); 14283 } 14284 14285 /* 14286 * If this buffer has already been consumed, we're 14287 * going to indicate that there's nothing left here 14288 * to consume. 14289 */ 14290 if (buf->dtb_flags & DTRACEBUF_CONSUMED) { 14291 mutex_exit(&dtrace_lock); 14292 14293 desc.dtbd_size = 0; 14294 desc.dtbd_drops = 0; 14295 desc.dtbd_errors = 0; 14296 desc.dtbd_oldest = 0; 14297 sz = sizeof (desc); 14298 14299 if (copyout(&desc, (void *)arg, sz) != 0) 14300 return (EFAULT); 14301 14302 return (0); 14303 } 14304 14305 /* 14306 * If this is a ring buffer that has wrapped, we want 14307 * to copy the whole thing out. 14308 */ 14309 if (buf->dtb_flags & DTRACEBUF_WRAPPED) { 14310 dtrace_buffer_polish(buf); 14311 sz = buf->dtb_size; 14312 } 14313 14314 if (copyout(buf->dtb_tomax, desc.dtbd_data, sz) != 0) { 14315 mutex_exit(&dtrace_lock); 14316 return (EFAULT); 14317 } 14318 14319 desc.dtbd_size = sz; 14320 desc.dtbd_drops = buf->dtb_drops; 14321 desc.dtbd_errors = buf->dtb_errors; 14322 desc.dtbd_oldest = buf->dtb_xamot_offset; 14323 14324 mutex_exit(&dtrace_lock); 14325 14326 if (copyout(&desc, (void *)arg, sizeof (desc)) != 0) 14327 return (EFAULT); 14328 14329 buf->dtb_flags |= DTRACEBUF_CONSUMED; 14330 14331 return (0); 14332 } 14333 14334 if (buf->dtb_tomax == NULL) { 14335 ASSERT(buf->dtb_xamot == NULL); 14336 mutex_exit(&dtrace_lock); 14337 return (ENOENT); 14338 } 14339 14340 cached = buf->dtb_tomax; 14341 ASSERT(!(buf->dtb_flags & DTRACEBUF_NOSWITCH)); 14342 14343 dtrace_xcall(desc.dtbd_cpu, 14344 (dtrace_xcall_t)dtrace_buffer_switch, buf); 14345 14346 state->dts_errors += buf->dtb_xamot_errors; 14347 14348 /* 14349 * If the buffers did not actually switch, then the cross call 14350 * did not take place -- presumably because the given CPU is 14351 * not in the ready set. If this is the case, we'll return 14352 * ENOENT. 14353 */ 14354 if (buf->dtb_tomax == cached) { 14355 ASSERT(buf->dtb_xamot != cached); 14356 mutex_exit(&dtrace_lock); 14357 return (ENOENT); 14358 } 14359 14360 ASSERT(cached == buf->dtb_xamot); 14361 14362 /* 14363 * We have our snapshot; now copy it out. 14364 */ 14365 if (copyout(buf->dtb_xamot, desc.dtbd_data, 14366 buf->dtb_xamot_offset) != 0) { 14367 mutex_exit(&dtrace_lock); 14368 return (EFAULT); 14369 } 14370 14371 desc.dtbd_size = buf->dtb_xamot_offset; 14372 desc.dtbd_drops = buf->dtb_xamot_drops; 14373 desc.dtbd_errors = buf->dtb_xamot_errors; 14374 desc.dtbd_oldest = 0; 14375 14376 mutex_exit(&dtrace_lock); 14377 14378 /* 14379 * Finally, copy out the buffer description. 14380 */ 14381 if (copyout(&desc, (void *)arg, sizeof (desc)) != 0) 14382 return (EFAULT); 14383 14384 return (0); 14385 } 14386 14387 case DTRACEIOC_CONF: { 14388 dtrace_conf_t conf; 14389 14390 bzero(&conf, sizeof (conf)); 14391 conf.dtc_difversion = DIF_VERSION; 14392 conf.dtc_difintregs = DIF_DIR_NREGS; 14393 conf.dtc_diftupregs = DIF_DTR_NREGS; 14394 conf.dtc_ctfmodel = CTF_MODEL_NATIVE; 14395 14396 if (copyout(&conf, (void *)arg, sizeof (conf)) != 0) 14397 return (EFAULT); 14398 14399 return (0); 14400 } 14401 14402 case DTRACEIOC_STATUS: { 14403 dtrace_status_t stat; 14404 dtrace_dstate_t *dstate; 14405 int i, j; 14406 uint64_t nerrs; 14407 14408 /* 14409 * See the comment in dtrace_state_deadman() for the reason 14410 * for setting dts_laststatus to INT64_MAX before setting 14411 * it to the correct value. 14412 */ 14413 state->dts_laststatus = INT64_MAX; 14414 dtrace_membar_producer(); 14415 state->dts_laststatus = dtrace_gethrtime(); 14416 14417 bzero(&stat, sizeof (stat)); 14418 14419 mutex_enter(&dtrace_lock); 14420 14421 if (state->dts_activity == DTRACE_ACTIVITY_INACTIVE) { 14422 mutex_exit(&dtrace_lock); 14423 return (ENOENT); 14424 } 14425 14426 if (state->dts_activity == DTRACE_ACTIVITY_DRAINING) 14427 stat.dtst_exiting = 1; 14428 14429 nerrs = state->dts_errors; 14430 dstate = &state->dts_vstate.dtvs_dynvars; 14431 14432 for (i = 0; i < NCPU; i++) { 14433 dtrace_dstate_percpu_t *dcpu = &dstate->dtds_percpu[i]; 14434 14435 stat.dtst_dyndrops += dcpu->dtdsc_drops; 14436 stat.dtst_dyndrops_dirty += dcpu->dtdsc_dirty_drops; 14437 stat.dtst_dyndrops_rinsing += dcpu->dtdsc_rinsing_drops; 14438 14439 if (state->dts_buffer[i].dtb_flags & DTRACEBUF_FULL) 14440 stat.dtst_filled++; 14441 14442 nerrs += state->dts_buffer[i].dtb_errors; 14443 14444 for (j = 0; j < state->dts_nspeculations; j++) { 14445 dtrace_speculation_t *spec; 14446 dtrace_buffer_t *buf; 14447 14448 spec = &state->dts_speculations[j]; 14449 buf = &spec->dtsp_buffer[i]; 14450 stat.dtst_specdrops += buf->dtb_xamot_drops; 14451 } 14452 } 14453 14454 stat.dtst_specdrops_busy = state->dts_speculations_busy; 14455 stat.dtst_specdrops_unavail = state->dts_speculations_unavail; 14456 stat.dtst_stkstroverflows = state->dts_stkstroverflows; 14457 stat.dtst_dblerrors = state->dts_dblerrors; 14458 stat.dtst_killed = 14459 (state->dts_activity == DTRACE_ACTIVITY_KILLED); 14460 stat.dtst_errors = nerrs; 14461 14462 mutex_exit(&dtrace_lock); 14463 14464 if (copyout(&stat, (void *)arg, sizeof (stat)) != 0) 14465 return (EFAULT); 14466 14467 return (0); 14468 } 14469 14470 case DTRACEIOC_FORMAT: { 14471 dtrace_fmtdesc_t fmt; 14472 char *str; 14473 int len; 14474 14475 if (copyin((void *)arg, &fmt, sizeof (fmt)) != 0) 14476 return (EFAULT); 14477 14478 mutex_enter(&dtrace_lock); 14479 14480 if (fmt.dtfd_format == 0 || 14481 fmt.dtfd_format > state->dts_nformats) { 14482 mutex_exit(&dtrace_lock); 14483 return (EINVAL); 14484 } 14485 14486 /* 14487 * Format strings are allocated contiguously and they are 14488 * never freed; if a format index is less than the number 14489 * of formats, we can assert that the format map is non-NULL 14490 * and that the format for the specified index is non-NULL. 14491 */ 14492 ASSERT(state->dts_formats != NULL); 14493 str = state->dts_formats[fmt.dtfd_format - 1]; 14494 ASSERT(str != NULL); 14495 14496 len = strlen(str) + 1; 14497 14498 if (len > fmt.dtfd_length) { 14499 fmt.dtfd_length = len; 14500 14501 if (copyout(&fmt, (void *)arg, sizeof (fmt)) != 0) { 14502 mutex_exit(&dtrace_lock); 14503 return (EINVAL); 14504 } 14505 } else { 14506 if (copyout(str, fmt.dtfd_string, len) != 0) { 14507 mutex_exit(&dtrace_lock); 14508 return (EINVAL); 14509 } 14510 } 14511 14512 mutex_exit(&dtrace_lock); 14513 return (0); 14514 } 14515 14516 default: 14517 break; 14518 } 14519 14520 return (ENOTTY); 14521 } 14522 14523 /*ARGSUSED*/ 14524 static int 14525 dtrace_detach(dev_info_t *dip, ddi_detach_cmd_t cmd) 14526 { 14527 dtrace_state_t *state; 14528 14529 switch (cmd) { 14530 case DDI_DETACH: 14531 break; 14532 14533 case DDI_SUSPEND: 14534 return (DDI_SUCCESS); 14535 14536 default: 14537 return (DDI_FAILURE); 14538 } 14539 14540 mutex_enter(&cpu_lock); 14541 mutex_enter(&dtrace_provider_lock); 14542 mutex_enter(&dtrace_lock); 14543 14544 ASSERT(dtrace_opens == 0); 14545 14546 if (dtrace_helpers > 0) { 14547 mutex_exit(&dtrace_provider_lock); 14548 mutex_exit(&dtrace_lock); 14549 mutex_exit(&cpu_lock); 14550 return (DDI_FAILURE); 14551 } 14552 14553 if (dtrace_unregister((dtrace_provider_id_t)dtrace_provider) != 0) { 14554 mutex_exit(&dtrace_provider_lock); 14555 mutex_exit(&dtrace_lock); 14556 mutex_exit(&cpu_lock); 14557 return (DDI_FAILURE); 14558 } 14559 14560 dtrace_provider = NULL; 14561 14562 if ((state = dtrace_anon_grab()) != NULL) { 14563 /* 14564 * If there were ECBs on this state, the provider should 14565 * have not been allowed to detach; assert that there is 14566 * none. 14567 */ 14568 ASSERT(state->dts_necbs == 0); 14569 dtrace_state_destroy(state); 14570 14571 /* 14572 * If we're being detached with anonymous state, we need to 14573 * indicate to the kernel debugger that DTrace is now inactive. 14574 */ 14575 (void) kdi_dtrace_set(KDI_DTSET_DTRACE_DEACTIVATE); 14576 } 14577 14578 bzero(&dtrace_anon, sizeof (dtrace_anon_t)); 14579 unregister_cpu_setup_func((cpu_setup_func_t *)dtrace_cpu_setup, NULL); 14580 dtrace_cpu_init = NULL; 14581 dtrace_helpers_cleanup = NULL; 14582 dtrace_helpers_fork = NULL; 14583 dtrace_cpustart_init = NULL; 14584 dtrace_cpustart_fini = NULL; 14585 dtrace_debugger_init = NULL; 14586 dtrace_debugger_fini = NULL; 14587 dtrace_kreloc_init = NULL; 14588 dtrace_kreloc_fini = NULL; 14589 dtrace_modload = NULL; 14590 dtrace_modunload = NULL; 14591 14592 mutex_exit(&cpu_lock); 14593 14594 if (dtrace_helptrace_enabled) { 14595 kmem_free(dtrace_helptrace_buffer, dtrace_helptrace_bufsize); 14596 dtrace_helptrace_buffer = NULL; 14597 } 14598 14599 kmem_free(dtrace_probes, dtrace_nprobes * sizeof (dtrace_probe_t *)); 14600 dtrace_probes = NULL; 14601 dtrace_nprobes = 0; 14602 14603 dtrace_hash_destroy(dtrace_bymod); 14604 dtrace_hash_destroy(dtrace_byfunc); 14605 dtrace_hash_destroy(dtrace_byname); 14606 dtrace_bymod = NULL; 14607 dtrace_byfunc = NULL; 14608 dtrace_byname = NULL; 14609 14610 kmem_cache_destroy(dtrace_state_cache); 14611 vmem_destroy(dtrace_minor); 14612 vmem_destroy(dtrace_arena); 14613 14614 if (dtrace_toxrange != NULL) { 14615 kmem_free(dtrace_toxrange, 14616 dtrace_toxranges_max * sizeof (dtrace_toxrange_t)); 14617 dtrace_toxrange = NULL; 14618 dtrace_toxranges = 0; 14619 dtrace_toxranges_max = 0; 14620 } 14621 14622 ddi_remove_minor_node(dtrace_devi, NULL); 14623 dtrace_devi = NULL; 14624 14625 ddi_soft_state_fini(&dtrace_softstate); 14626 14627 ASSERT(dtrace_vtime_references == 0); 14628 ASSERT(dtrace_opens == 0); 14629 ASSERT(dtrace_retained == NULL); 14630 14631 mutex_exit(&dtrace_lock); 14632 mutex_exit(&dtrace_provider_lock); 14633 14634 /* 14635 * We don't destroy the task queue until after we have dropped our 14636 * locks (taskq_destroy() may block on running tasks). To prevent 14637 * attempting to do work after we have effectively detached but before 14638 * the task queue has been destroyed, all tasks dispatched via the 14639 * task queue must check that DTrace is still attached before 14640 * performing any operation. 14641 */ 14642 taskq_destroy(dtrace_taskq); 14643 dtrace_taskq = NULL; 14644 14645 return (DDI_SUCCESS); 14646 } 14647 14648 /*ARGSUSED*/ 14649 static int 14650 dtrace_info(dev_info_t *dip, ddi_info_cmd_t infocmd, void *arg, void **result) 14651 { 14652 int error; 14653 14654 switch (infocmd) { 14655 case DDI_INFO_DEVT2DEVINFO: 14656 *result = (void *)dtrace_devi; 14657 error = DDI_SUCCESS; 14658 break; 14659 case DDI_INFO_DEVT2INSTANCE: 14660 *result = (void *)0; 14661 error = DDI_SUCCESS; 14662 break; 14663 default: 14664 error = DDI_FAILURE; 14665 } 14666 return (error); 14667 } 14668 14669 static struct cb_ops dtrace_cb_ops = { 14670 dtrace_open, /* open */ 14671 dtrace_close, /* close */ 14672 nulldev, /* strategy */ 14673 nulldev, /* print */ 14674 nodev, /* dump */ 14675 nodev, /* read */ 14676 nodev, /* write */ 14677 dtrace_ioctl, /* ioctl */ 14678 nodev, /* devmap */ 14679 nodev, /* mmap */ 14680 nodev, /* segmap */ 14681 nochpoll, /* poll */ 14682 ddi_prop_op, /* cb_prop_op */ 14683 0, /* streamtab */ 14684 D_NEW | D_MP /* Driver compatibility flag */ 14685 }; 14686 14687 static struct dev_ops dtrace_ops = { 14688 DEVO_REV, /* devo_rev */ 14689 0, /* refcnt */ 14690 dtrace_info, /* get_dev_info */ 14691 nulldev, /* identify */ 14692 nulldev, /* probe */ 14693 dtrace_attach, /* attach */ 14694 dtrace_detach, /* detach */ 14695 nodev, /* reset */ 14696 &dtrace_cb_ops, /* driver operations */ 14697 NULL, /* bus operations */ 14698 nodev /* dev power */ 14699 }; 14700 14701 static struct modldrv modldrv = { 14702 &mod_driverops, /* module type (this is a pseudo driver) */ 14703 "Dynamic Tracing", /* name of module */ 14704 &dtrace_ops, /* driver ops */ 14705 }; 14706 14707 static struct modlinkage modlinkage = { 14708 MODREV_1, 14709 (void *)&modldrv, 14710 NULL 14711 }; 14712 14713 int 14714 _init(void) 14715 { 14716 return (mod_install(&modlinkage)); 14717 } 14718 14719 int 14720 _info(struct modinfo *modinfop) 14721 { 14722 return (mod_info(&modlinkage, modinfop)); 14723 } 14724 14725 int 14726 _fini(void) 14727 { 14728 return (mod_remove(&modlinkage)); 14729 } 14730