1/*
2 * CDDL HEADER START
3 *
4 * The contents of this file are subject to the terms of the
5 * Common Development and Distribution License (the "License").
6 * You may not use this file except in compliance with the License.
7 *
8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9 * or http://www.opensolaris.org/os/licensing.
10 * See the License for the specific language governing permissions
11 * and limitations under the License.
12 *
13 * When distributing Covered Code, include this CDDL HEADER in each
14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15 * If applicable, add the following below this CDDL HEADER, with the
16 * fields enclosed by brackets "[]" replaced with your own identifying
17 * information: Portions Copyright [yyyy] [name of copyright owner]
18 *
19 * CDDL HEADER END
20 *
21 * $FreeBSD: releng/11.0/sys/cddl/dev/dtrace/dtrace_ioctl.c 296480 2016-03-08 00:46:03Z markj $
22 *
23 */
24
25static int dtrace_verbose_ioctl;
26SYSCTL_INT(_debug_dtrace, OID_AUTO, verbose_ioctl, CTLFLAG_RW,
27    &dtrace_verbose_ioctl, 0, "log DTrace ioctls");
28
29#define DTRACE_IOCTL_PRINTF(fmt, ...)	if (dtrace_verbose_ioctl) printf(fmt, ## __VA_ARGS__ )
30
31static int
32dtrace_ioctl_helper(struct cdev *dev, u_long cmd, caddr_t addr, int flags,
33    struct thread *td)
34{
35	struct proc *p;
36	dof_helper_t *dhp;
37	dof_hdr_t *dof;
38	int rval;
39
40	dhp = NULL;
41	dof = NULL;
42	rval = 0;
43	switch (cmd) {
44	case DTRACEHIOC_ADDDOF:
45		dhp = (dof_helper_t *)addr;
46		addr = (caddr_t)(uintptr_t)dhp->dofhp_dof;
47		/* FALLTHROUGH */
48	case DTRACEHIOC_ADD:
49		p = curproc;
50		if (dhp == NULL || p->p_pid == dhp->dofhp_pid) {
51			dof = dtrace_dof_copyin((uintptr_t)addr, &rval);
52		} else {
53			p = pfind(dhp->dofhp_pid);
54			if (p == NULL)
55				return (EINVAL);
56			if (!P_SHOULDSTOP(p) ||
57			    (p->p_flag & (P_TRACED | P_WEXIT)) != P_TRACED ||
58			    p->p_pptr != curproc) {
59				PROC_UNLOCK(p);
60				return (EINVAL);
61			}
62			_PHOLD(p);
63			PROC_UNLOCK(p);
64			dof = dtrace_dof_copyin_proc(p, (uintptr_t)addr, &rval);
65		}
66
67		if (dof == NULL) {
68			if (p != curproc)
69				PRELE(p);
70			break;
71		}
72
73		mutex_enter(&dtrace_lock);
74		if ((rval = dtrace_helper_slurp(dof, dhp, p)) != -1) {
75			if (dhp != NULL) {
76				dhp->dofhp_gen = rval;
77				copyout(dhp, addr, sizeof(*dhp));
78			}
79			rval = 0;
80		} else {
81			rval = EINVAL;
82		}
83		mutex_exit(&dtrace_lock);
84		if (p != curproc)
85			PRELE(p);
86		break;
87	case DTRACEHIOC_REMOVE:
88		mutex_enter(&dtrace_lock);
89		rval = dtrace_helper_destroygen(NULL, *(int *)(uintptr_t)addr);
90		mutex_exit(&dtrace_lock);
91		break;
92	default:
93		rval = ENOTTY;
94		break;
95	}
96	return (rval);
97}
98
99/* ARGSUSED */
100static int
101dtrace_ioctl(struct cdev *dev, u_long cmd, caddr_t addr,
102    int flags __unused, struct thread *td)
103{
104	dtrace_state_t *state;
105	devfs_get_cdevpriv((void **) &state);
106
107	int error = 0;
108	if (state == NULL)
109		return (EINVAL);
110
111	if (state->dts_anon) {
112		ASSERT(dtrace_anon.dta_state == NULL);
113		state = state->dts_anon;
114	}
115
116	switch (cmd) {
117	case DTRACEIOC_AGGDESC: {
118		dtrace_aggdesc_t **paggdesc = (dtrace_aggdesc_t **) addr;
119		dtrace_aggdesc_t aggdesc;
120		dtrace_action_t *act;
121		dtrace_aggregation_t *agg;
122		int nrecs;
123		uint32_t offs;
124		dtrace_recdesc_t *lrec;
125		void *buf;
126		size_t size;
127		uintptr_t dest;
128
129		DTRACE_IOCTL_PRINTF("%s(%d): DTRACEIOC_AGGDESC\n",__func__,__LINE__);
130
131		if (copyin((void *) *paggdesc, &aggdesc, sizeof (aggdesc)) != 0)
132			return (EFAULT);
133
134		mutex_enter(&dtrace_lock);
135
136		if ((agg = dtrace_aggid2agg(state, aggdesc.dtagd_id)) == NULL) {
137			mutex_exit(&dtrace_lock);
138			return (EINVAL);
139		}
140
141		aggdesc.dtagd_epid = agg->dtag_ecb->dte_epid;
142
143		nrecs = aggdesc.dtagd_nrecs;
144		aggdesc.dtagd_nrecs = 0;
145
146		offs = agg->dtag_base;
147		lrec = &agg->dtag_action.dta_rec;
148		aggdesc.dtagd_size = lrec->dtrd_offset + lrec->dtrd_size - offs;
149
150		for (act = agg->dtag_first; ; act = act->dta_next) {
151			ASSERT(act->dta_intuple ||
152			    DTRACEACT_ISAGG(act->dta_kind));
153
154			/*
155			 * If this action has a record size of zero, it
156			 * denotes an argument to the aggregating action.
157			 * Because the presence of this record doesn't (or
158			 * shouldn't) affect the way the data is interpreted,
159			 * we don't copy it out to save user-level the
160			 * confusion of dealing with a zero-length record.
161			 */
162			if (act->dta_rec.dtrd_size == 0) {
163				ASSERT(agg->dtag_hasarg);
164				continue;
165			}
166
167			aggdesc.dtagd_nrecs++;
168
169			if (act == &agg->dtag_action)
170				break;
171		}
172
173		/*
174		 * Now that we have the size, we need to allocate a temporary
175		 * buffer in which to store the complete description.  We need
176		 * the temporary buffer to be able to drop dtrace_lock()
177		 * across the copyout(), below.
178		 */
179		size = sizeof (dtrace_aggdesc_t) +
180		    (aggdesc.dtagd_nrecs * sizeof (dtrace_recdesc_t));
181
182		buf = kmem_alloc(size, KM_SLEEP);
183		dest = (uintptr_t)buf;
184
185		bcopy(&aggdesc, (void *)dest, sizeof (aggdesc));
186		dest += offsetof(dtrace_aggdesc_t, dtagd_rec[0]);
187
188		for (act = agg->dtag_first; ; act = act->dta_next) {
189			dtrace_recdesc_t rec = act->dta_rec;
190
191			/*
192			 * See the comment in the above loop for why we pass
193			 * over zero-length records.
194			 */
195			if (rec.dtrd_size == 0) {
196				ASSERT(agg->dtag_hasarg);
197				continue;
198			}
199
200			if (nrecs-- == 0)
201				break;
202
203			rec.dtrd_offset -= offs;
204			bcopy(&rec, (void *)dest, sizeof (rec));
205			dest += sizeof (dtrace_recdesc_t);
206
207			if (act == &agg->dtag_action)
208				break;
209		}
210
211		mutex_exit(&dtrace_lock);
212
213		if (copyout(buf, (void *) *paggdesc, dest - (uintptr_t)buf) != 0) {
214			kmem_free(buf, size);
215			return (EFAULT);
216		}
217
218		kmem_free(buf, size);
219		return (0);
220	}
221	case DTRACEIOC_AGGSNAP:
222	case DTRACEIOC_BUFSNAP: {
223		dtrace_bufdesc_t **pdesc = (dtrace_bufdesc_t **) addr;
224		dtrace_bufdesc_t desc;
225		caddr_t cached;
226		dtrace_buffer_t *buf;
227
228		dtrace_debug_output();
229
230		if (copyin((void *) *pdesc, &desc, sizeof (desc)) != 0)
231			return (EFAULT);
232
233		DTRACE_IOCTL_PRINTF("%s(%d): %s curcpu %d cpu %d\n",
234		    __func__,__LINE__,
235		    cmd == DTRACEIOC_AGGSNAP ?
236		    "DTRACEIOC_AGGSNAP":"DTRACEIOC_BUFSNAP",
237		    curcpu, desc.dtbd_cpu);
238
239		if (desc.dtbd_cpu >= NCPU)
240			return (ENOENT);
241		if (pcpu_find(desc.dtbd_cpu) == NULL)
242			return (ENOENT);
243
244		mutex_enter(&dtrace_lock);
245
246		if (cmd == DTRACEIOC_BUFSNAP) {
247			buf = &state->dts_buffer[desc.dtbd_cpu];
248		} else {
249			buf = &state->dts_aggbuffer[desc.dtbd_cpu];
250		}
251
252		if (buf->dtb_flags & (DTRACEBUF_RING | DTRACEBUF_FILL)) {
253			size_t sz = buf->dtb_offset;
254
255			if (state->dts_activity != DTRACE_ACTIVITY_STOPPED) {
256				mutex_exit(&dtrace_lock);
257				return (EBUSY);
258			}
259
260			/*
261			 * If this buffer has already been consumed, we're
262			 * going to indicate that there's nothing left here
263			 * to consume.
264			 */
265			if (buf->dtb_flags & DTRACEBUF_CONSUMED) {
266				mutex_exit(&dtrace_lock);
267
268				desc.dtbd_size = 0;
269				desc.dtbd_drops = 0;
270				desc.dtbd_errors = 0;
271				desc.dtbd_oldest = 0;
272				sz = sizeof (desc);
273
274				if (copyout(&desc, (void *) *pdesc, sz) != 0)
275					return (EFAULT);
276
277				return (0);
278			}
279
280			/*
281			 * If this is a ring buffer that has wrapped, we want
282			 * to copy the whole thing out.
283			 */
284			if (buf->dtb_flags & DTRACEBUF_WRAPPED) {
285				dtrace_buffer_polish(buf);
286				sz = buf->dtb_size;
287			}
288
289			if (copyout(buf->dtb_tomax, desc.dtbd_data, sz) != 0) {
290				mutex_exit(&dtrace_lock);
291				return (EFAULT);
292			}
293
294			desc.dtbd_size = sz;
295			desc.dtbd_drops = buf->dtb_drops;
296			desc.dtbd_errors = buf->dtb_errors;
297			desc.dtbd_oldest = buf->dtb_xamot_offset;
298			desc.dtbd_timestamp = dtrace_gethrtime();
299
300			mutex_exit(&dtrace_lock);
301
302			if (copyout(&desc, (void *) *pdesc, sizeof (desc)) != 0)
303				return (EFAULT);
304
305			buf->dtb_flags |= DTRACEBUF_CONSUMED;
306
307			return (0);
308		}
309
310		if (buf->dtb_tomax == NULL) {
311			ASSERT(buf->dtb_xamot == NULL);
312			mutex_exit(&dtrace_lock);
313			return (ENOENT);
314		}
315
316		cached = buf->dtb_tomax;
317		ASSERT(!(buf->dtb_flags & DTRACEBUF_NOSWITCH));
318
319		dtrace_xcall(desc.dtbd_cpu,
320		    (dtrace_xcall_t)dtrace_buffer_switch, buf);
321
322		state->dts_errors += buf->dtb_xamot_errors;
323
324		/*
325		 * If the buffers did not actually switch, then the cross call
326		 * did not take place -- presumably because the given CPU is
327		 * not in the ready set.  If this is the case, we'll return
328		 * ENOENT.
329		 */
330		if (buf->dtb_tomax == cached) {
331			ASSERT(buf->dtb_xamot != cached);
332			mutex_exit(&dtrace_lock);
333			return (ENOENT);
334		}
335
336		ASSERT(cached == buf->dtb_xamot);
337
338		DTRACE_IOCTL_PRINTF("%s(%d): copyout the buffer snapshot\n",__func__,__LINE__);
339
340		/*
341		 * We have our snapshot; now copy it out.
342		 */
343		if (copyout(buf->dtb_xamot, desc.dtbd_data,
344		    buf->dtb_xamot_offset) != 0) {
345			mutex_exit(&dtrace_lock);
346			return (EFAULT);
347		}
348
349		desc.dtbd_size = buf->dtb_xamot_offset;
350		desc.dtbd_drops = buf->dtb_xamot_drops;
351		desc.dtbd_errors = buf->dtb_xamot_errors;
352		desc.dtbd_oldest = 0;
353		desc.dtbd_timestamp = buf->dtb_switched;
354
355		mutex_exit(&dtrace_lock);
356
357		DTRACE_IOCTL_PRINTF("%s(%d): copyout buffer desc: size %zd drops %lu errors %lu\n",__func__,__LINE__,(size_t) desc.dtbd_size,(u_long) desc.dtbd_drops,(u_long) desc.dtbd_errors);
358
359		/*
360		 * Finally, copy out the buffer description.
361		 */
362		if (copyout(&desc, (void *) *pdesc, sizeof (desc)) != 0)
363			return (EFAULT);
364
365		return (0);
366	}
367	case DTRACEIOC_CONF: {
368		dtrace_conf_t conf;
369
370		DTRACE_IOCTL_PRINTF("%s(%d): DTRACEIOC_CONF\n",__func__,__LINE__);
371
372		bzero(&conf, sizeof (conf));
373		conf.dtc_difversion = DIF_VERSION;
374		conf.dtc_difintregs = DIF_DIR_NREGS;
375		conf.dtc_diftupregs = DIF_DTR_NREGS;
376		conf.dtc_ctfmodel = CTF_MODEL_NATIVE;
377
378		*((dtrace_conf_t *) addr) = conf;
379
380		return (0);
381	}
382	case DTRACEIOC_DOFGET: {
383		dof_hdr_t **pdof = (dof_hdr_t **) addr;
384		dof_hdr_t hdr, *dof = *pdof;
385		int rval;
386		uint64_t len;
387
388		DTRACE_IOCTL_PRINTF("%s(%d): DTRACEIOC_DOFGET\n",__func__,__LINE__);
389
390		if (copyin((void *)dof, &hdr, sizeof (hdr)) != 0)
391			return (EFAULT);
392
393		mutex_enter(&dtrace_lock);
394		dof = dtrace_dof_create(state);
395		mutex_exit(&dtrace_lock);
396
397		len = MIN(hdr.dofh_loadsz, dof->dofh_loadsz);
398		rval = copyout(dof, (void *) *pdof, len);
399		dtrace_dof_destroy(dof);
400
401		return (rval == 0 ? 0 : EFAULT);
402	}
403	case DTRACEIOC_ENABLE: {
404		dof_hdr_t *dof = NULL;
405		dtrace_enabling_t *enab = NULL;
406		dtrace_vstate_t *vstate;
407		int err = 0;
408		int rval;
409		dtrace_enable_io_t *p = (dtrace_enable_io_t *) addr;
410
411		DTRACE_IOCTL_PRINTF("%s(%d): DTRACEIOC_ENABLE\n",__func__,__LINE__);
412
413		/*
414		 * If a NULL argument has been passed, we take this as our
415		 * cue to reevaluate our enablings.
416		 */
417		if (p->dof == NULL) {
418			dtrace_enabling_matchall();
419
420			return (0);
421		}
422
423		if ((dof = dtrace_dof_copyin((uintptr_t) p->dof, &rval)) == NULL)
424			return (EINVAL);
425
426		mutex_enter(&cpu_lock);
427		mutex_enter(&dtrace_lock);
428		vstate = &state->dts_vstate;
429
430		if (state->dts_activity != DTRACE_ACTIVITY_INACTIVE) {
431			mutex_exit(&dtrace_lock);
432			mutex_exit(&cpu_lock);
433			dtrace_dof_destroy(dof);
434			return (EBUSY);
435		}
436
437		if (dtrace_dof_slurp(dof, vstate, td->td_ucred, &enab, 0, B_TRUE) != 0) {
438			mutex_exit(&dtrace_lock);
439			mutex_exit(&cpu_lock);
440			dtrace_dof_destroy(dof);
441			return (EINVAL);
442		}
443
444		if ((rval = dtrace_dof_options(dof, state)) != 0) {
445			dtrace_enabling_destroy(enab);
446			mutex_exit(&dtrace_lock);
447			mutex_exit(&cpu_lock);
448			dtrace_dof_destroy(dof);
449			return (rval);
450		}
451
452		if ((err = dtrace_enabling_match(enab, &p->n_matched)) == 0) {
453			err = dtrace_enabling_retain(enab);
454		} else {
455			dtrace_enabling_destroy(enab);
456		}
457
458		mutex_exit(&cpu_lock);
459		mutex_exit(&dtrace_lock);
460		dtrace_dof_destroy(dof);
461
462		return (err);
463	}
464	case DTRACEIOC_EPROBE: {
465		dtrace_eprobedesc_t **pepdesc = (dtrace_eprobedesc_t **) addr;
466		dtrace_eprobedesc_t epdesc;
467		dtrace_ecb_t *ecb;
468		dtrace_action_t *act;
469		void *buf;
470		size_t size;
471		uintptr_t dest;
472		int nrecs;
473
474		DTRACE_IOCTL_PRINTF("%s(%d): DTRACEIOC_EPROBE\n",__func__,__LINE__);
475
476		if (copyin((void *)*pepdesc, &epdesc, sizeof (epdesc)) != 0)
477			return (EFAULT);
478
479		mutex_enter(&dtrace_lock);
480
481		if ((ecb = dtrace_epid2ecb(state, epdesc.dtepd_epid)) == NULL) {
482			mutex_exit(&dtrace_lock);
483			return (EINVAL);
484		}
485
486		if (ecb->dte_probe == NULL) {
487			mutex_exit(&dtrace_lock);
488			return (EINVAL);
489		}
490
491		epdesc.dtepd_probeid = ecb->dte_probe->dtpr_id;
492		epdesc.dtepd_uarg = ecb->dte_uarg;
493		epdesc.dtepd_size = ecb->dte_size;
494
495		nrecs = epdesc.dtepd_nrecs;
496		epdesc.dtepd_nrecs = 0;
497		for (act = ecb->dte_action; act != NULL; act = act->dta_next) {
498			if (DTRACEACT_ISAGG(act->dta_kind) || act->dta_intuple)
499				continue;
500
501			epdesc.dtepd_nrecs++;
502		}
503
504		/*
505		 * Now that we have the size, we need to allocate a temporary
506		 * buffer in which to store the complete description.  We need
507		 * the temporary buffer to be able to drop dtrace_lock()
508		 * across the copyout(), below.
509		 */
510		size = sizeof (dtrace_eprobedesc_t) +
511		    (epdesc.dtepd_nrecs * sizeof (dtrace_recdesc_t));
512
513		buf = kmem_alloc(size, KM_SLEEP);
514		dest = (uintptr_t)buf;
515
516		bcopy(&epdesc, (void *)dest, sizeof (epdesc));
517		dest += offsetof(dtrace_eprobedesc_t, dtepd_rec[0]);
518
519		for (act = ecb->dte_action; act != NULL; act = act->dta_next) {
520			if (DTRACEACT_ISAGG(act->dta_kind) || act->dta_intuple)
521				continue;
522
523			if (nrecs-- == 0)
524				break;
525
526			bcopy(&act->dta_rec, (void *)dest,
527			    sizeof (dtrace_recdesc_t));
528			dest += sizeof (dtrace_recdesc_t);
529		}
530
531		mutex_exit(&dtrace_lock);
532
533		if (copyout(buf, (void *) *pepdesc, dest - (uintptr_t)buf) != 0) {
534			kmem_free(buf, size);
535			return (EFAULT);
536		}
537
538		kmem_free(buf, size);
539		return (0);
540	}
541	case DTRACEIOC_FORMAT: {
542		dtrace_fmtdesc_t *fmt = (dtrace_fmtdesc_t *) addr;
543		char *str;
544		int len;
545
546		DTRACE_IOCTL_PRINTF("%s(%d): DTRACEIOC_FORMAT\n",__func__,__LINE__);
547
548		mutex_enter(&dtrace_lock);
549
550		if (fmt->dtfd_format == 0 ||
551		    fmt->dtfd_format > state->dts_nformats) {
552			mutex_exit(&dtrace_lock);
553			return (EINVAL);
554		}
555
556		/*
557		 * Format strings are allocated contiguously and they are
558		 * never freed; if a format index is less than the number
559		 * of formats, we can assert that the format map is non-NULL
560		 * and that the format for the specified index is non-NULL.
561		 */
562		ASSERT(state->dts_formats != NULL);
563		str = state->dts_formats[fmt->dtfd_format - 1];
564		ASSERT(str != NULL);
565
566		len = strlen(str) + 1;
567
568		if (len > fmt->dtfd_length) {
569			fmt->dtfd_length = len;
570		} else {
571			if (copyout(str, fmt->dtfd_string, len) != 0) {
572				mutex_exit(&dtrace_lock);
573				return (EINVAL);
574			}
575		}
576
577		mutex_exit(&dtrace_lock);
578		return (0);
579	}
580	case DTRACEIOC_GO: {
581		int rval;
582		processorid_t *cpuid = (processorid_t *) addr;
583
584		DTRACE_IOCTL_PRINTF("%s(%d): DTRACEIOC_GO\n",__func__,__LINE__);
585
586		rval = dtrace_state_go(state, cpuid);
587
588		return (rval);
589	}
590	case DTRACEIOC_PROBEARG: {
591		dtrace_argdesc_t *desc = (dtrace_argdesc_t *) addr;
592		dtrace_probe_t *probe;
593		dtrace_provider_t *prov;
594
595		DTRACE_IOCTL_PRINTF("%s(%d): DTRACEIOC_PROBEARG\n",__func__,__LINE__);
596
597		if (desc->dtargd_id == DTRACE_IDNONE)
598			return (EINVAL);
599
600		if (desc->dtargd_ndx == DTRACE_ARGNONE)
601			return (EINVAL);
602
603		mutex_enter(&dtrace_provider_lock);
604#ifdef illumos
605		mutex_enter(&mod_lock);
606#endif
607		mutex_enter(&dtrace_lock);
608
609		if (desc->dtargd_id > dtrace_nprobes) {
610			mutex_exit(&dtrace_lock);
611#ifdef illumos
612			mutex_exit(&mod_lock);
613#endif
614			mutex_exit(&dtrace_provider_lock);
615			return (EINVAL);
616		}
617
618		if ((probe = dtrace_probes[desc->dtargd_id - 1]) == NULL) {
619			mutex_exit(&dtrace_lock);
620#ifdef illumos
621			mutex_exit(&mod_lock);
622#endif
623			mutex_exit(&dtrace_provider_lock);
624			return (EINVAL);
625		}
626
627		mutex_exit(&dtrace_lock);
628
629		prov = probe->dtpr_provider;
630
631		if (prov->dtpv_pops.dtps_getargdesc == NULL) {
632			/*
633			 * There isn't any typed information for this probe.
634			 * Set the argument number to DTRACE_ARGNONE.
635			 */
636			desc->dtargd_ndx = DTRACE_ARGNONE;
637		} else {
638			desc->dtargd_native[0] = '\0';
639			desc->dtargd_xlate[0] = '\0';
640			desc->dtargd_mapping = desc->dtargd_ndx;
641
642			prov->dtpv_pops.dtps_getargdesc(prov->dtpv_arg,
643			    probe->dtpr_id, probe->dtpr_arg, desc);
644		}
645
646#ifdef illumos
647		mutex_exit(&mod_lock);
648#endif
649		mutex_exit(&dtrace_provider_lock);
650
651		return (0);
652	}
653	case DTRACEIOC_PROBEMATCH:
654	case DTRACEIOC_PROBES: {
655		dtrace_probedesc_t *p_desc = (dtrace_probedesc_t *) addr;
656		dtrace_probe_t *probe = NULL;
657		dtrace_probekey_t pkey;
658		dtrace_id_t i;
659		int m = 0;
660		uint32_t priv = 0;
661		uid_t uid = 0;
662		zoneid_t zoneid = 0;
663
664		DTRACE_IOCTL_PRINTF("%s(%d): %s\n",__func__,__LINE__,
665		    cmd == DTRACEIOC_PROBEMATCH ?
666		    "DTRACEIOC_PROBEMATCH":"DTRACEIOC_PROBES");
667
668		p_desc->dtpd_provider[DTRACE_PROVNAMELEN - 1] = '\0';
669		p_desc->dtpd_mod[DTRACE_MODNAMELEN - 1] = '\0';
670		p_desc->dtpd_func[DTRACE_FUNCNAMELEN - 1] = '\0';
671		p_desc->dtpd_name[DTRACE_NAMELEN - 1] = '\0';
672
673		/*
674		 * Before we attempt to match this probe, we want to give
675		 * all providers the opportunity to provide it.
676		 */
677		if (p_desc->dtpd_id == DTRACE_IDNONE) {
678			mutex_enter(&dtrace_provider_lock);
679			dtrace_probe_provide(p_desc, NULL);
680			mutex_exit(&dtrace_provider_lock);
681			p_desc->dtpd_id++;
682		}
683
684		if (cmd == DTRACEIOC_PROBEMATCH)  {
685			dtrace_probekey(p_desc, &pkey);
686			pkey.dtpk_id = DTRACE_IDNONE;
687		}
688
689		dtrace_cred2priv(td->td_ucred, &priv, &uid, &zoneid);
690
691		mutex_enter(&dtrace_lock);
692
693		if (cmd == DTRACEIOC_PROBEMATCH) {
694			for (i = p_desc->dtpd_id; i <= dtrace_nprobes; i++) {
695				if ((probe = dtrace_probes[i - 1]) != NULL &&
696				    (m = dtrace_match_probe(probe, &pkey,
697				    priv, uid, zoneid)) != 0)
698					break;
699			}
700
701			if (m < 0) {
702				mutex_exit(&dtrace_lock);
703				return (EINVAL);
704			}
705
706		} else {
707			for (i = p_desc->dtpd_id; i <= dtrace_nprobes; i++) {
708				if ((probe = dtrace_probes[i - 1]) != NULL &&
709				    dtrace_match_priv(probe, priv, uid, zoneid))
710					break;
711			}
712		}
713
714		if (probe == NULL) {
715			mutex_exit(&dtrace_lock);
716			return (ESRCH);
717		}
718
719		dtrace_probe_description(probe, p_desc);
720		mutex_exit(&dtrace_lock);
721
722		return (0);
723	}
724	case DTRACEIOC_PROVIDER: {
725		dtrace_providerdesc_t *pvd = (dtrace_providerdesc_t *) addr;
726		dtrace_provider_t *pvp;
727
728		DTRACE_IOCTL_PRINTF("%s(%d): DTRACEIOC_PROVIDER\n",__func__,__LINE__);
729
730		pvd->dtvd_name[DTRACE_PROVNAMELEN - 1] = '\0';
731		mutex_enter(&dtrace_provider_lock);
732
733		for (pvp = dtrace_provider; pvp != NULL; pvp = pvp->dtpv_next) {
734			if (strcmp(pvp->dtpv_name, pvd->dtvd_name) == 0)
735				break;
736		}
737
738		mutex_exit(&dtrace_provider_lock);
739
740		if (pvp == NULL)
741			return (ESRCH);
742
743		bcopy(&pvp->dtpv_priv, &pvd->dtvd_priv, sizeof (dtrace_ppriv_t));
744		bcopy(&pvp->dtpv_attr, &pvd->dtvd_attr, sizeof (dtrace_pattr_t));
745
746		return (0);
747	}
748	case DTRACEIOC_REPLICATE: {
749		dtrace_repldesc_t *desc = (dtrace_repldesc_t *) addr;
750		dtrace_probedesc_t *match = &desc->dtrpd_match;
751		dtrace_probedesc_t *create = &desc->dtrpd_create;
752		int err;
753
754		DTRACE_IOCTL_PRINTF("%s(%d): DTRACEIOC_REPLICATE\n",__func__,__LINE__);
755
756		match->dtpd_provider[DTRACE_PROVNAMELEN - 1] = '\0';
757		match->dtpd_mod[DTRACE_MODNAMELEN - 1] = '\0';
758		match->dtpd_func[DTRACE_FUNCNAMELEN - 1] = '\0';
759		match->dtpd_name[DTRACE_NAMELEN - 1] = '\0';
760
761		create->dtpd_provider[DTRACE_PROVNAMELEN - 1] = '\0';
762		create->dtpd_mod[DTRACE_MODNAMELEN - 1] = '\0';
763		create->dtpd_func[DTRACE_FUNCNAMELEN - 1] = '\0';
764		create->dtpd_name[DTRACE_NAMELEN - 1] = '\0';
765
766		mutex_enter(&dtrace_lock);
767		err = dtrace_enabling_replicate(state, match, create);
768		mutex_exit(&dtrace_lock);
769
770		return (err);
771	}
772	case DTRACEIOC_STATUS: {
773		dtrace_status_t *stat = (dtrace_status_t *) addr;
774		dtrace_dstate_t *dstate;
775		int i, j;
776		uint64_t nerrs;
777
778		DTRACE_IOCTL_PRINTF("%s(%d): DTRACEIOC_STATUS\n",__func__,__LINE__);
779
780		/*
781		 * See the comment in dtrace_state_deadman() for the reason
782		 * for setting dts_laststatus to INT64_MAX before setting
783		 * it to the correct value.
784		 */
785		state->dts_laststatus = INT64_MAX;
786		dtrace_membar_producer();
787		state->dts_laststatus = dtrace_gethrtime();
788
789		bzero(stat, sizeof (*stat));
790
791		mutex_enter(&dtrace_lock);
792
793		if (state->dts_activity == DTRACE_ACTIVITY_INACTIVE) {
794			mutex_exit(&dtrace_lock);
795			return (ENOENT);
796		}
797
798		if (state->dts_activity == DTRACE_ACTIVITY_DRAINING)
799			stat->dtst_exiting = 1;
800
801		nerrs = state->dts_errors;
802		dstate = &state->dts_vstate.dtvs_dynvars;
803
804		for (i = 0; i < NCPU; i++) {
805#ifndef illumos
806			if (pcpu_find(i) == NULL)
807				continue;
808#endif
809			dtrace_dstate_percpu_t *dcpu = &dstate->dtds_percpu[i];
810
811			stat->dtst_dyndrops += dcpu->dtdsc_drops;
812			stat->dtst_dyndrops_dirty += dcpu->dtdsc_dirty_drops;
813			stat->dtst_dyndrops_rinsing += dcpu->dtdsc_rinsing_drops;
814
815			if (state->dts_buffer[i].dtb_flags & DTRACEBUF_FULL)
816				stat->dtst_filled++;
817
818			nerrs += state->dts_buffer[i].dtb_errors;
819
820			for (j = 0; j < state->dts_nspeculations; j++) {
821				dtrace_speculation_t *spec;
822				dtrace_buffer_t *buf;
823
824				spec = &state->dts_speculations[j];
825				buf = &spec->dtsp_buffer[i];
826				stat->dtst_specdrops += buf->dtb_xamot_drops;
827			}
828		}
829
830		stat->dtst_specdrops_busy = state->dts_speculations_busy;
831		stat->dtst_specdrops_unavail = state->dts_speculations_unavail;
832		stat->dtst_stkstroverflows = state->dts_stkstroverflows;
833		stat->dtst_dblerrors = state->dts_dblerrors;
834		stat->dtst_killed =
835		    (state->dts_activity == DTRACE_ACTIVITY_KILLED);
836		stat->dtst_errors = nerrs;
837
838		mutex_exit(&dtrace_lock);
839
840		return (0);
841	}
842	case DTRACEIOC_STOP: {
843		int rval;
844		processorid_t *cpuid = (processorid_t *) addr;
845
846		DTRACE_IOCTL_PRINTF("%s(%d): DTRACEIOC_STOP\n",__func__,__LINE__);
847
848		mutex_enter(&dtrace_lock);
849		rval = dtrace_state_stop(state, cpuid);
850		mutex_exit(&dtrace_lock);
851
852		return (rval);
853	}
854	default:
855		error = ENOTTY;
856	}
857	return (error);
858}
859