1 | /* |
2 | * Copyright (c) 2007-2018 Apple Inc. All rights reserved. |
3 | */ |
4 | /* |
5 | * CDDL HEADER START |
6 | * |
7 | * The contents of this file are subject to the terms of the |
8 | * Common Development and Distribution License, Version 1.0 only |
9 | * (the "License"). You may not use this file except in compliance |
10 | * with the License. |
11 | * |
12 | * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE |
13 | * or http://www.opensolaris.org/os/licensing. |
14 | * See the License for the specific language governing permissions |
15 | * and limitations under the License. |
16 | * |
17 | * When distributing Covered Code, include this CDDL HEADER in each |
18 | * file and include the License file at usr/src/OPENSOLARIS.LICENSE. |
19 | * If applicable, add the following below this CDDL HEADER, with the |
20 | * fields enclosed by brackets "[]" replaced with your own identifying |
21 | * information: Portions Copyright [yyyy] [name of copyright owner] |
22 | * |
23 | * CDDL HEADER END |
24 | */ |
25 | /* |
26 | * Copyright 2005 Sun Microsystems, Inc. All rights reserved. |
27 | * Use is subject to license terms. |
28 | */ |
29 | |
30 | #include <sys/dtrace.h> |
31 | #include <sys/dtrace_glue.h> |
32 | #include <sys/dtrace_impl.h> |
33 | #include <sys/fasttrap.h> |
34 | #include <sys/vm.h> |
35 | #include <sys/user.h> |
36 | #include <sys/kauth.h> |
37 | #include <kern/debug.h> |
38 | #include <arm64/proc_reg.h> |
39 | |
40 | int (*dtrace_pid_probe_ptr)(arm_saved_state_t *); |
41 | int (*dtrace_return_probe_ptr) (arm_saved_state_t *); |
42 | |
43 | kern_return_t |
44 | dtrace_user_probe(arm_saved_state_t *); |
45 | |
46 | kern_return_t |
47 | dtrace_user_probe(arm_saved_state_t *regs) |
48 | { |
49 | /* |
50 | * FIXME |
51 | * |
52 | * The only call path into this method is always a user trap. |
53 | * We don't need to test for user trap, but should assert it. |
54 | */ |
55 | |
56 | lck_rw_t *rwp; |
57 | int is_fasttrap = 0; |
58 | uthread_t uthread = current_uthread(); |
59 | |
60 | current_cached_proc_cred_update(); |
61 | |
62 | uint32_t pc; |
63 | if (copyin((user_addr_t)saved_state64(regs)->pc, &pc, sizeof(uint32_t))) { |
64 | return KERN_FAILURE; |
65 | } |
66 | is_fasttrap = (pc == FASTTRAP_ARM64_RET_INSTR); |
67 | |
68 | if (is_fasttrap) { |
69 | uint8_t step = uthread->t_dtrace_step; |
70 | uint8_t ret = uthread->t_dtrace_ret; |
71 | user_addr_t npc = uthread->t_dtrace_npc; |
72 | |
73 | if (uthread->t_dtrace_ast) { |
74 | printf("dtrace_user_probe() should be calling aston()\n" ); |
75 | // aston(thread); |
76 | // uthread->t_sig_check = 1; |
77 | } |
78 | |
79 | /* |
80 | * Clear all user tracing flags. |
81 | */ |
82 | uthread->t_dtrace_ft = 0; |
83 | |
84 | /* |
85 | * If we weren't expecting a quick return to the kernel, just kill |
86 | * the process as though it had just executed an unassigned |
87 | * trap instruction. |
88 | */ |
89 | if (step == 0) { |
90 | /* |
91 | * APPLE NOTE: We're returning KERN_FAILURE, which causes |
92 | * the generic signal handling code to take over, which will effectively |
93 | * deliver a EXC_BAD_INSTRUCTION to the user process. |
94 | */ |
95 | return KERN_FAILURE; |
96 | } |
97 | |
98 | /* |
99 | * If we hit this trap unrelated to a return probe, we're |
100 | * here to either: |
101 | * |
102 | * 1. Reset the AST flag, since we deferred a signal |
103 | * until after we logically single-stepped the instruction we |
104 | * copied out. |
105 | * |
106 | * 2. Just return to normal execution (required for U64). |
107 | */ |
108 | if (ret == 0) { |
109 | set_saved_state_pc(regs, pc: npc); |
110 | return KERN_SUCCESS; |
111 | } |
112 | |
113 | /* |
114 | * We need to wait until after we've called the |
115 | * dtrace_return_probe_ptr function pointer to step the pc. |
116 | */ |
117 | rwp = &CPU->cpu_ft_lock; |
118 | lck_rw_lock_shared(lck: rwp); |
119 | |
120 | if (dtrace_return_probe_ptr != NULL) { |
121 | (void) (*dtrace_return_probe_ptr)(regs); |
122 | } |
123 | lck_rw_unlock_shared(lck: rwp); |
124 | |
125 | set_saved_state_pc(regs, pc: npc); |
126 | |
127 | return KERN_SUCCESS; |
128 | } else { |
129 | rwp = &CPU->cpu_ft_lock; |
130 | |
131 | /* |
132 | * The DTrace fasttrap provider uses a trap, |
133 | * FASTTRAP_{ARM,THUMB}_INSTR. We let |
134 | * DTrace take the first crack at handling |
135 | * this trap; if it's not a probe that DTrace knows about, |
136 | * we call into the trap() routine to handle it like a |
137 | * breakpoint placed by a conventional debugger. |
138 | */ |
139 | |
140 | /* |
141 | * APPLE NOTE: I believe the purpose of the reader/writers lock |
142 | * is thus: There are times which dtrace needs to prevent calling |
143 | * dtrace_pid_probe_ptr(). Sun's original impl grabbed a plain |
144 | * mutex here. However, that serialized all probe calls, and |
145 | * destroyed MP behavior. So now they use a RW lock, with probes |
146 | * as readers, and the top level synchronization as a writer. |
147 | */ |
148 | lck_rw_lock_shared(lck: rwp); |
149 | if (dtrace_pid_probe_ptr != NULL && |
150 | (*dtrace_pid_probe_ptr)(regs) == 0) { |
151 | lck_rw_unlock_shared(lck: rwp); |
152 | return KERN_SUCCESS; |
153 | } |
154 | lck_rw_unlock_shared(lck: rwp); |
155 | |
156 | /* |
157 | * If the instruction that caused the breakpoint trap doesn't |
158 | * look like our trap anymore, it may be that this tracepoint |
159 | * was removed just after the user thread executed it. In |
160 | * that case, return to user land to retry the instuction. |
161 | * |
162 | * Note that the PC points to the instruction that caused the fault. |
163 | */ |
164 | uint32_t instr; |
165 | if (fuword32(saved_state64(regs)->pc, &instr) == 0 && instr != FASTTRAP_ARM64_INSTR) { |
166 | return KERN_SUCCESS; |
167 | } |
168 | } |
169 | |
170 | return KERN_FAILURE; |
171 | } |
172 | |