1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License, Version 1.0 only
6  * (the "License").  You may not use this file except in compliance
7  * with the License.
8  *
9  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
10  * or http://www.opensolaris.org/os/licensing.
11  * See the License for the specific language governing permissions
12  * and limitations under the License.
13  *
14  * When distributing Covered Code, include this CDDL HEADER in each
15  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
16  * If applicable, add the following below this CDDL HEADER, with the
17  * fields enclosed by brackets "[]" replaced with your own identifying
18  * information: Portions Copyright [yyyy] [name of copyright owner]
19  *
20  * CDDL HEADER END
21  */
22 /*
23  * Copyright 2005 Sun Microsystems, Inc.  All rights reserved.
24  * Use is subject to license terms.
25  */
26 
27 #pragma ident	"%Z%%M%	%I%	%E% SMI"
28 
29 #include <sys/dtrace_impl.h>
30 #include <sys/atomic.h>
31 #include <sys/model.h>
32 #include <sys/frame.h>
33 #include <sys/stack.h>
34 #include <sys/machpcb.h>
35 #include <sys/procfs_isa.h>
36 #include <sys/cmn_err.h>
37 #include <sys/sysmacros.h>
38 
39 #define	DTRACE_FMT3OP3_MASK	0x81000000
40 #define	DTRACE_FMT3OP3		0x80000000
41 #define	DTRACE_FMT3RS1_SHIFT	14
42 #define	DTRACE_FMT3RD_SHIFT	25
43 #define	DTRACE_RMASK		0x1f
44 #define	DTRACE_REG_L0		16
45 #define	DTRACE_REG_O7		15
46 #define	DTRACE_REG_I0		24
47 #define	DTRACE_REG_I6		30
48 #define	DTRACE_RET		0x81c7e008
49 #define	DTRACE_RETL		0x81c3e008
50 #define	DTRACE_SAVE_MASK	0xc1f80000
51 #define	DTRACE_SAVE		0x81e00000
52 #define	DTRACE_RESTORE		0x81e80000
53 #define	DTRACE_CALL_MASK	0xc0000000
54 #define	DTRACE_CALL		0x40000000
55 #define	DTRACE_JMPL_MASK	0x81f10000
56 #define	DTRACE_JMPL		0x81c00000
57 
58 extern int dtrace_getupcstack_top(uint64_t *, int, uintptr_t *);
59 extern int dtrace_getustackdepth_top(uintptr_t *);
60 extern ulong_t dtrace_getreg_win(uint_t, uint_t);
61 extern void dtrace_putreg_win(uint_t, ulong_t);
62 extern int dtrace_fish(int, int, uintptr_t *);
63 
64 /*
65  * This is similar in principle to getpcstack(), but there are several marked
66  * differences in implementation:
67  *
68  * (a)	dtrace_getpcstack() is called from probe context.  Thus, the call
69  *	to flush_windows() from getpcstack() is a call to the probe-safe
70  *	equivalent here.
71  *
72  * (b)  dtrace_getpcstack() is willing to sacrifice some performance to get
73  *	a correct stack.  While consumers of getpcstack() are largely
74  *	subsystem-specific in-kernel debugging facilities, DTrace consumers
75  *	are arbitrary user-level analysis tools; dtrace_getpcstack() must
76  *	deliver as correct a stack as possible.  Details on the issues
77  *	surrounding stack correctness are found below.
78  *
79  * (c)	dtrace_getpcstack() _always_ fills in pcstack_limit pc_t's -- filling
80  *	in the difference between the stack depth and pcstack_limit with NULLs.
81  *	Due to this behavior dtrace_getpcstack() returns void.
82  *
83  * (d)	dtrace_getpcstack() takes a third parameter, aframes, that
84  *	denotes the number of _artificial frames_ on the bottom of the
85  *	stack.  An artificial frame is one induced by the provider; all
86  *	artificial frames are stripped off before frames are stored to
87  *	pcstack.
88  *
89  * (e)	dtrace_getpcstack() takes a fourth parameter, pc, that indicates
90  *	an interrupted program counter (if any).  This should be a non-NULL
91  *	value if and only if the hit probe is unanchored.  (Anchored probes
92  *	don't fire through an interrupt source.)  This parameter is used to
93  *	assure (b), above.
94  */
95 void
96 dtrace_getpcstack(pc_t *pcstack, int pcstack_limit, int aframes, uint32_t *pc)
97 {
98 	struct frame *fp, *nextfp, *minfp, *stacktop;
99 	int depth = 0;
100 	int on_intr, j = 0;
101 	uint32_t i, r;
102 
103 	fp = (struct frame *)((caddr_t)dtrace_getfp() + STACK_BIAS);
104 	dtrace_flush_windows();
105 
106 	if (pc != NULL) {
107 		/*
108 		 * If we've been passed a non-NULL pc, we need to determine
109 		 * whether or not the specified program counter falls in a leaf
110 		 * function.  If it falls within a leaf function, we know that
111 		 * %o7 is valid in its frame (and we can just drive on).  If
112 		 * it's a non-leaf, however, we know that %o7 is garbage in the
113 		 * bottom frame.  To trim this frame, we simply increment
114 		 * aframes and drop into the stack-walking loop.
115 		 *
116 		 * To quickly determine if the specified program counter is in
117 		 * a leaf function, we exploit the fact that leaf functions
118 		 * tend to be short and non-leaf functions tend to frequently
119 		 * perform operations that are only permitted in a non-leaf
120 		 * function (e.g., using the %i's or %l's; calling a function;
121 		 * performing a restore).  We exploit these tendencies by
122 		 * simply scanning forward from the specified %pc -- if we see
123 		 * an operation only permitted in a non-leaf, we know we're in
124 		 * a non-leaf; if we see a retl, we know we're in a leaf.
125 		 * Fortunately, one need not perform anywhere near full
126 		 * disassembly to effectively determine the former: determining
127 		 * that an instruction is a format-3 instruction and decoding
128 		 * its rd and rs1 fields, for example, requires very little
129 		 * manipulation.  Overall, this method of leaf determination
130 		 * performs quite well:  on average, we only examine between
131 		 * 1.5 and 2.5 instructions before making the determination.
132 		 * (Outliers do exist, however; of note is the non-leaf
133 		 * function ip_sioctl_not_ours() which -- as of this writing --
134 		 * has a whopping 455 straight instructions that manipulate
135 		 * only %g's and %o's.)
136 		 */
137 		int delay = 0;
138 
139 		if (depth < pcstack_limit)
140 			pcstack[depth++] = (pc_t)pc;
141 
142 		for (;;) {
143 			i = pc[j++];
144 
145 			if ((i & DTRACE_FMT3OP3_MASK) == DTRACE_FMT3OP3) {
146 				/*
147 				 * This is a format-3 instruction.  We can
148 				 * look at rd and rs1.
149 				 */
150 				r = (i >> DTRACE_FMT3RS1_SHIFT) & DTRACE_RMASK;
151 
152 				if (r >= DTRACE_REG_L0)
153 					goto nonleaf;
154 
155 				r = (i >> DTRACE_FMT3RD_SHIFT) & DTRACE_RMASK;
156 
157 				if (r >= DTRACE_REG_L0)
158 					goto nonleaf;
159 
160 				if ((i & DTRACE_JMPL_MASK) == DTRACE_JMPL) {
161 					delay = 1;
162 					continue;
163 				}
164 
165 				/*
166 				 * If we see explicit manipulation with %o7
167 				 * as a destination register, we know that
168 				 * %o7 is likely bogus -- and we treat this
169 				 * function as a non-leaf.
170 				 */
171 				if (r == DTRACE_REG_O7) {
172 					if (delay)
173 						goto leaf;
174 
175 					i &= DTRACE_JMPL_MASK;
176 
177 					if (i == DTRACE_JMPL) {
178 						delay = 1;
179 						continue;
180 					}
181 
182 					goto nonleaf;
183 				}
184 			} else {
185 				/*
186 				 * If this is a call, it may or may not be
187 				 * a leaf; we need to check the delay slot.
188 				 */
189 				if ((i & DTRACE_CALL_MASK) == DTRACE_CALL) {
190 					delay = 1;
191 					continue;
192 				}
193 
194 				/*
195 				 * If we see a ret it's not a leaf; if we
196 				 * see a retl, it is a leaf.
197 				 */
198 				if (i == DTRACE_RET)
199 					goto nonleaf;
200 
201 				if (i == DTRACE_RETL)
202 					goto leaf;
203 
204 				/*
205 				 * Finally, if it's a save, it should be
206 				 * treated as a leaf; if it's a restore it
207 				 * should not be treated as a leaf.
208 				 */
209 				if ((i & DTRACE_SAVE_MASK) == DTRACE_SAVE)
210 					goto leaf;
211 
212 				if ((i & DTRACE_SAVE_MASK) == DTRACE_RESTORE)
213 					goto nonleaf;
214 			}
215 
216 			if (delay) {
217 				/*
218 				 * If this was a delay slot instruction and
219 				 * we didn't pick it up elsewhere, this is a
220 				 * non-leaf.
221 				 */
222 				goto nonleaf;
223 			}
224 		}
225 nonleaf:
226 		aframes++;
227 leaf:
228 		;
229 	}
230 
231 	if ((on_intr = CPU_ON_INTR(CPU)) != 0)
232 		stacktop = (struct frame *)(CPU->cpu_intr_stack + SA(MINFRAME));
233 	else
234 		stacktop = (struct frame *)curthread->t_stk;
235 	minfp = fp;
236 
237 	while (depth < pcstack_limit) {
238 		nextfp = (struct frame *)((caddr_t)fp->fr_savfp + STACK_BIAS);
239 		if (nextfp <= minfp || nextfp >= stacktop) {
240 			if (!on_intr && nextfp == stacktop && aframes != 0) {
241 				/*
242 				 * If we are exactly at the top of the stack
243 				 * with a non-zero number of artificial frames,
244 				 * it must be that the stack is filled with
245 				 * nothing _but_ artificial frames.  In this
246 				 * case, we assert that this is so, zero
247 				 * pcstack, and return.
248 				 */
249 				ASSERT(aframes == 1);
250 				ASSERT(depth == 0);
251 
252 				while (depth < pcstack_limit)
253 					pcstack[depth++] = NULL;
254 				return;
255 			}
256 
257 			if (on_intr) {
258 				/*
259 				 * Hop from interrupt stack to thread stack.
260 				 */
261 				stacktop = (struct frame *)curthread->t_stk;
262 				minfp = (struct frame *)curthread->t_stkbase;
263 
264 				on_intr = 0;
265 
266 				if (nextfp > minfp && nextfp < stacktop)
267 					continue;
268 			} else {
269 				/*
270 				 * High-level interrupts may occur when %sp is
271 				 * not necessarily contained in the stack
272 				 * bounds implied by %g7 -- interrupt thread
273 				 * management runs with %pil at DISP_LEVEL,
274 				 * and high-level interrupts may thus occur
275 				 * in windows when %sp and %g7 are not self-
276 				 * consistent.  If we call dtrace_getpcstack()
277 				 * from a high-level interrupt that has occurred
278 				 * in such a window, we will fail the above test
279 				 * of nextfp against minfp/stacktop.  If the
280 				 * high-level interrupt has in turn interrupted
281 				 * a non-passivated interrupt thread, we
282 				 * will execute the below code with non-zero
283 				 * aframes.  We therefore want to assert that
284 				 * aframes is zero _or_ we are in a high-level
285 				 * interrupt -- but because cpu_intr_actv is
286 				 * updated with high-level interrupts enabled,
287 				 * we must reduce this to only asserting that
288 				 * %pil is greater than DISP_LEVEL.
289 				 */
290 				ASSERT(aframes == 0 ||
291 				    dtrace_getipl() > DISP_LEVEL);
292 				pcstack[depth++] = (pc_t)fp->fr_savpc;
293 			}
294 
295 			while (depth < pcstack_limit)
296 				pcstack[depth++] = NULL;
297 			return;
298 		}
299 
300 		if (aframes > 0) {
301 			aframes--;
302 		} else {
303 			pcstack[depth++] = (pc_t)fp->fr_savpc;
304 		}
305 
306 		fp = nextfp;
307 		minfp = fp;
308 	}
309 }
310 
311 static int
312 dtrace_getustack_common(uint64_t *pcstack, int pcstack_limit, uintptr_t sp)
313 {
314 	proc_t *p = curproc;
315 	int ret = 0;
316 
317 	ASSERT(pcstack == NULL || pcstack_limit > 0);
318 
319 	if (p->p_model == DATAMODEL_NATIVE) {
320 		for (;;) {
321 			struct frame *fr = (struct frame *)(sp + STACK_BIAS);
322 			uintptr_t pc;
323 
324 			if (sp == 0 || fr == NULL ||
325 			    !IS_P2ALIGNED((uintptr_t)fr, STACK_ALIGN))
326 				break;
327 
328 			pc = dtrace_fulword(&fr->fr_savpc);
329 			sp = dtrace_fulword(&fr->fr_savfp);
330 
331 			if (pc == 0)
332 				break;
333 
334 			ret++;
335 
336 			if (pcstack != NULL) {
337 				*pcstack++ = pc;
338 				pcstack_limit--;
339 				if (pcstack_limit == 0)
340 					break;
341 			}
342 		}
343 	} else {
344 		for (;;) {
345 			struct frame32 *fr = (struct frame32 *)sp;
346 			uint32_t pc;
347 
348 			if (sp == 0 ||
349 			    !IS_P2ALIGNED((uintptr_t)fr, STACK_ALIGN32))
350 				break;
351 
352 			pc = dtrace_fuword32(&fr->fr_savpc);
353 			sp = dtrace_fuword32(&fr->fr_savfp);
354 
355 			if (pc == 0)
356 				break;
357 
358 			ret++;
359 
360 			if (pcstack != NULL) {
361 				*pcstack++ = pc;
362 				pcstack_limit--;
363 				if (pcstack_limit == 0)
364 					break;
365 			}
366 		}
367 	}
368 
369 	return (ret);
370 }
371 
372 void
373 dtrace_getupcstack(uint64_t *pcstack, int pcstack_limit)
374 {
375 	klwp_t *lwp = ttolwp(curthread);
376 	proc_t *p = curproc;
377 	struct regs *rp;
378 	uintptr_t sp;
379 	int n;
380 
381 	if (lwp == NULL || p == NULL || (rp = lwp->lwp_regs) == NULL)
382 		return;
383 
384 	if (pcstack_limit <= 0)
385 		return;
386 
387 	*pcstack++ = (uint64_t)p->p_pid;
388 	pcstack_limit--;
389 
390 	if (pcstack_limit <= 0)
391 		return;
392 
393 	*pcstack++ = (uint64_t)rp->r_pc;
394 	pcstack_limit--;
395 
396 	if (pcstack_limit <= 0)
397 		return;
398 
399 	if (DTRACE_CPUFLAG_ISSET(CPU_DTRACE_ENTRY)) {
400 		*pcstack++ = (uint64_t)rp->r_o7;
401 		pcstack_limit--;
402 		if (pcstack_limit <= 0)
403 			return;
404 	}
405 
406 	sp = rp->r_sp;
407 
408 	n = dtrace_getupcstack_top(pcstack, pcstack_limit, &sp);
409 	ASSERT(n >= 0);
410 	ASSERT(n <= pcstack_limit);
411 
412 	pcstack += n;
413 	pcstack_limit -= n;
414 	if (pcstack_limit <= 0)
415 		return;
416 
417 	n = dtrace_getustack_common(pcstack, pcstack_limit, sp);
418 	ASSERT(n >= 0);
419 	ASSERT(n <= pcstack_limit);
420 
421 	pcstack += n;
422 	pcstack_limit -= n;
423 
424 	while (pcstack_limit-- > 0)
425 		*pcstack++ = NULL;
426 }
427 
428 int
429 dtrace_getustackdepth(void)
430 {
431 	klwp_t *lwp = ttolwp(curthread);
432 	proc_t *p = curproc;
433 	struct regs *rp;
434 	uintptr_t sp;
435 	int n = 1;
436 
437 	if (lwp == NULL || p == NULL || (rp = lwp->lwp_regs) == NULL)
438 		return (0);
439 
440 	if (DTRACE_CPUFLAG_ISSET(CPU_DTRACE_FAULT))
441 		return (-1);
442 
443 	if (DTRACE_CPUFLAG_ISSET(CPU_DTRACE_ENTRY))
444 		n++;
445 
446 	sp = rp->r_sp;
447 
448 	n += dtrace_getustackdepth_top(&sp);
449 	n += dtrace_getustack_common(NULL, 0, sp);
450 
451 	return (n);
452 }
453 
454 void
455 dtrace_getufpstack(uint64_t *pcstack, uint64_t *fpstack, int pcstack_limit)
456 {
457 	klwp_t *lwp = ttolwp(curthread);
458 	proc_t *p = ttoproc(curthread);
459 	struct regs *rp;
460 	uintptr_t sp;
461 
462 	if (lwp == NULL || p == NULL || (rp = lwp->lwp_regs) == NULL)
463 		return;
464 
465 	if (pcstack_limit <= 0)
466 		return;
467 
468 	*pcstack++ = (uint64_t)p->p_pid;
469 	pcstack_limit--;
470 
471 	if (pcstack_limit <= 0)
472 		return;
473 
474 	if (DTRACE_CPUFLAG_ISSET(CPU_DTRACE_ENTRY)) {
475 		*fpstack++ = 0;
476 		*pcstack++ = (uint64_t)rp->r_pc;
477 		pcstack_limit--;
478 		if (pcstack_limit <= 0)
479 			return;
480 
481 		*fpstack++ = (uint64_t)rp->r_sp;
482 		*pcstack++ = (uint64_t)rp->r_o7;
483 		pcstack_limit--;
484 	} else {
485 		*fpstack++ = (uint64_t)rp->r_sp;
486 		*pcstack++ = (uint64_t)rp->r_pc;
487 		pcstack_limit--;
488 	}
489 
490 	if (pcstack_limit <= 0)
491 		return;
492 
493 	sp = rp->r_sp;
494 
495 	dtrace_flush_user_windows();
496 
497 	if (p->p_model == DATAMODEL_NATIVE) {
498 		while (pcstack_limit > 0) {
499 			struct frame *fr = (struct frame *)(sp + STACK_BIAS);
500 			uintptr_t pc;
501 
502 			if (sp == 0 || fr == NULL ||
503 			    ((uintptr_t)&fr->fr_savpc & 3) != 0 ||
504 			    ((uintptr_t)&fr->fr_savfp & 3) != 0)
505 				break;
506 
507 			pc = dtrace_fulword(&fr->fr_savpc);
508 			sp = dtrace_fulword(&fr->fr_savfp);
509 
510 			if (pc == 0)
511 				break;
512 
513 			*fpstack++ = sp;
514 			*pcstack++ = pc;
515 			pcstack_limit--;
516 		}
517 	} else {
518 		while (pcstack_limit > 0) {
519 			struct frame32 *fr = (struct frame32 *)sp;
520 			uint32_t pc;
521 
522 			if (sp == 0 ||
523 			    ((uintptr_t)&fr->fr_savpc & 3) != 0 ||
524 			    ((uintptr_t)&fr->fr_savfp & 3) != 0)
525 				break;
526 
527 			pc = dtrace_fuword32(&fr->fr_savpc);
528 			sp = dtrace_fuword32(&fr->fr_savfp);
529 
530 			if (pc == 0)
531 				break;
532 
533 			*fpstack++ = sp;
534 			*pcstack++ = pc;
535 			pcstack_limit--;
536 		}
537 	}
538 
539 	while (pcstack_limit-- > 0)
540 		*pcstack++ = NULL;
541 }
542 
543 uint64_t
544 dtrace_getarg(int arg, int aframes)
545 {
546 	uintptr_t val;
547 	struct frame *fp;
548 	uint64_t rval;
549 
550 	/*
551 	 * Account for the fact that dtrace_getarg() consumes an additional
552 	 * stack frame.
553 	 */
554 	aframes++;
555 
556 	if (arg < 6) {
557 		if (dtrace_fish(aframes, DTRACE_REG_I0 + arg, &val) == 0)
558 			return (val);
559 	} else {
560 		if (dtrace_fish(aframes, DTRACE_REG_I6, &val) == 0) {
561 			/*
562 			 * We have a stack pointer; grab the argument.
563 			 */
564 			fp = (struct frame *)(val + STACK_BIAS);
565 
566 			DTRACE_CPUFLAG_SET(CPU_DTRACE_NOFAULT);
567 			rval = fp->fr_argx[arg - 6];
568 			DTRACE_CPUFLAG_CLEAR(CPU_DTRACE_NOFAULT);
569 
570 			return (rval);
571 		}
572 	}
573 
574 	/*
575 	 * There are other ways to do this.  But the slow, painful way works
576 	 * just fine.  Because this requires some loads, we need to set
577 	 * CPU_DTRACE_NOFAULT to protect against looking for an argument that
578 	 * isn't there.
579 	 */
580 	fp = (struct frame *)((caddr_t)dtrace_getfp() + STACK_BIAS);
581 	dtrace_flush_windows();
582 
583 	DTRACE_CPUFLAG_SET(CPU_DTRACE_NOFAULT);
584 
585 	for (aframes -= 1; aframes; aframes--)
586 		fp = (struct frame *)((caddr_t)fp->fr_savfp + STACK_BIAS);
587 
588 	if (arg < 6) {
589 		rval = fp->fr_arg[arg];
590 	} else {
591 		fp = (struct frame *)((caddr_t)fp->fr_savfp + STACK_BIAS);
592 		rval = fp->fr_argx[arg - 6];
593 	}
594 
595 	DTRACE_CPUFLAG_CLEAR(CPU_DTRACE_NOFAULT);
596 
597 	return (rval);
598 }
599 
600 int
601 dtrace_getstackdepth(int aframes)
602 {
603 	struct frame *fp, *nextfp, *minfp, *stacktop;
604 	int depth = 0;
605 	int on_intr;
606 
607 	fp = (struct frame *)((caddr_t)dtrace_getfp() + STACK_BIAS);
608 	dtrace_flush_windows();
609 
610 	if ((on_intr = CPU_ON_INTR(CPU)) != 0)
611 		stacktop = (struct frame *)CPU->cpu_intr_stack + SA(MINFRAME);
612 	else
613 		stacktop = (struct frame *)curthread->t_stk;
614 	minfp = fp;
615 
616 	for (;;) {
617 		nextfp = (struct frame *)((caddr_t)fp->fr_savfp + STACK_BIAS);
618 		if (nextfp <= minfp || nextfp >= stacktop) {
619 			if (on_intr) {
620 				/*
621 				 * Hop from interrupt stack to thread stack.
622 				 */
623 				stacktop = (struct frame *)curthread->t_stk;
624 				minfp = (struct frame *)curthread->t_stkbase;
625 				on_intr = 0;
626 				continue;
627 			}
628 
629 			return (++depth);
630 		}
631 
632 		if (aframes > 0) {
633 			aframes--;
634 		} else {
635 			depth++;
636 		}
637 
638 		fp = nextfp;
639 		minfp = fp;
640 	}
641 }
642 
643 /*
644  * This uses the same register numbering scheme as in sys/procfs_isa.h.
645  */
646 ulong_t
647 dtrace_getreg(struct regs *rp, uint_t reg)
648 {
649 	ulong_t value;
650 	uintptr_t fp;
651 	struct machpcb *mpcb;
652 
653 	if (reg == R_G0)
654 		return (0);
655 
656 	if (reg <= R_G7)
657 		return ((&rp->r_g1)[reg - 1]);
658 
659 	if (reg > R_I7) {
660 		switch (reg) {
661 		case R_CCR:
662 			return ((rp->r_tstate >> TSTATE_CCR_SHIFT) &
663 			    TSTATE_CCR_MASK);
664 		case R_PC:
665 			return (rp->r_pc);
666 		case R_nPC:
667 			return (rp->r_npc);
668 		case R_Y:
669 			return (rp->r_y);
670 		case R_ASI:
671 			return ((rp->r_tstate >> TSTATE_ASI_SHIFT) &
672 			    TSTATE_ASI_MASK);
673 		case R_FPRS:
674 			return (dtrace_getfprs());
675 		default:
676 			DTRACE_CPUFLAG_SET(CPU_DTRACE_ILLOP);
677 			return (0);
678 		}
679 	}
680 
681 	/*
682 	 * We reach go to the fake restore case if the probe we hit was a pid
683 	 * return probe on a restore instruction. We partially emulate the
684 	 * restore in the kernel and then execute a simple restore
685 	 * instruction that we've secreted away to do the actual register
686 	 * window manipulation. We need to go one register window further
687 	 * down to get at the %ls, and %is and we need to treat %os like %is
688 	 * to pull them out of the topmost user frame.
689 	 */
690 	if (DTRACE_CPUFLAG_ISSET(CPU_DTRACE_FAKERESTORE)) {
691 		if (reg > R_O7)
692 			goto fake_restore;
693 		else
694 			reg += R_I0 - R_O0;
695 
696 	} else if (reg <= R_O7) {
697 		return ((&rp->r_g1)[reg - 1]);
698 	}
699 
700 	if (dtrace_getotherwin() > 0)
701 		return (dtrace_getreg_win(reg, 1));
702 
703 	mpcb = (struct machpcb *)((caddr_t)rp - REGOFF);
704 
705 	if (curproc->p_model == DATAMODEL_NATIVE) {
706 		struct frame *fr = (void *)(rp->r_sp + STACK_BIAS);
707 
708 		if (mpcb->mpcb_wbcnt > 0) {
709 			struct rwindow *rwin = (void *)mpcb->mpcb_wbuf;
710 			int i = mpcb->mpcb_wbcnt;
711 			do {
712 				i--;
713 				if ((long)mpcb->mpcb_spbuf[i] == rp->r_sp)
714 					return (rwin[i].rw_local[reg - 16]);
715 			} while (i > 0);
716 		}
717 
718 		DTRACE_CPUFLAG_SET(CPU_DTRACE_NOFAULT);
719 		value = dtrace_fulword(&fr->fr_local[reg - 16]);
720 		DTRACE_CPUFLAG_CLEAR(CPU_DTRACE_NOFAULT);
721 	} else {
722 		struct frame32 *fr = (void *)(caddr32_t)rp->r_sp;
723 
724 		if (mpcb->mpcb_wbcnt > 0) {
725 			struct rwindow32 *rwin = (void *)mpcb->mpcb_wbuf;
726 			int i = mpcb->mpcb_wbcnt;
727 			do {
728 				i--;
729 				if ((long)mpcb->mpcb_spbuf[i] == rp->r_sp)
730 					return (rwin[i].rw_local[reg - 16]);
731 			} while (i > 0);
732 		}
733 
734 		DTRACE_CPUFLAG_SET(CPU_DTRACE_NOFAULT);
735 		value = dtrace_fuword32(&fr->fr_local[reg - 16]);
736 		DTRACE_CPUFLAG_CLEAR(CPU_DTRACE_NOFAULT);
737 	}
738 
739 	return (value);
740 
741 fake_restore:
742 	ASSERT(R_L0 <= reg && reg <= R_I7);
743 
744 	/*
745 	 * We first look two user windows down to see if we can dig out
746 	 * the register we're looking for.
747 	 */
748 	if (dtrace_getotherwin() > 1)
749 		return (dtrace_getreg_win(reg, 2));
750 
751 	/*
752 	 * First we need to get the frame pointer and then we perform
753 	 * the same computation as in the non-fake-o-restore case.
754 	 */
755 
756 	mpcb = (struct machpcb *)((caddr_t)rp - REGOFF);
757 
758 	if (dtrace_getotherwin() > 0) {
759 		fp = dtrace_getreg_win(R_FP, 1);
760 		goto got_fp;
761 	}
762 
763 	if (curproc->p_model == DATAMODEL_NATIVE) {
764 		struct frame *fr = (void *)(rp->r_sp + STACK_BIAS);
765 
766 		if (mpcb->mpcb_wbcnt > 0) {
767 			struct rwindow *rwin = (void *)mpcb->mpcb_wbuf;
768 			int i = mpcb->mpcb_wbcnt;
769 			do {
770 				i--;
771 				if ((long)mpcb->mpcb_spbuf[i] == rp->r_sp) {
772 					fp = rwin[i].rw_fp;
773 					goto got_fp;
774 				}
775 			} while (i > 0);
776 		}
777 
778 		DTRACE_CPUFLAG_SET(CPU_DTRACE_NOFAULT);
779 		fp = dtrace_fulword(&fr->fr_savfp);
780 		DTRACE_CPUFLAG_CLEAR(CPU_DTRACE_NOFAULT);
781 		if (cpu_core[CPU->cpu_id].cpuc_dtrace_flags & CPU_DTRACE_FAULT)
782 			return (0);
783 	} else {
784 		struct frame32 *fr = (void *)(caddr32_t)rp->r_sp;
785 
786 		if (mpcb->mpcb_wbcnt > 0) {
787 			struct rwindow32 *rwin = (void *)mpcb->mpcb_wbuf;
788 			int i = mpcb->mpcb_wbcnt;
789 			do {
790 				i--;
791 				if ((long)mpcb->mpcb_spbuf[i] == rp->r_sp) {
792 					fp = rwin[i].rw_fp;
793 					goto got_fp;
794 				}
795 			} while (i > 0);
796 		}
797 
798 		DTRACE_CPUFLAG_SET(CPU_DTRACE_NOFAULT);
799 		fp = dtrace_fuword32(&fr->fr_savfp);
800 		DTRACE_CPUFLAG_CLEAR(CPU_DTRACE_NOFAULT);
801 		if (cpu_core[CPU->cpu_id].cpuc_dtrace_flags & CPU_DTRACE_FAULT)
802 			return (0);
803 	}
804 got_fp:
805 
806 	if (curproc->p_model == DATAMODEL_NATIVE) {
807 		struct frame *fr = (void *)(fp + STACK_BIAS);
808 
809 		if (mpcb->mpcb_wbcnt > 0) {
810 			struct rwindow *rwin = (void *)mpcb->mpcb_wbuf;
811 			int i = mpcb->mpcb_wbcnt;
812 			do {
813 				i--;
814 				if ((long)mpcb->mpcb_spbuf[i] == fp)
815 					return (rwin[i].rw_local[reg - 16]);
816 			} while (i > 0);
817 		}
818 
819 		DTRACE_CPUFLAG_SET(CPU_DTRACE_NOFAULT);
820 		value = dtrace_fulword(&fr->fr_local[reg - 16]);
821 		DTRACE_CPUFLAG_CLEAR(CPU_DTRACE_NOFAULT);
822 	} else {
823 		struct frame32 *fr = (void *)(caddr32_t)fp;
824 
825 		if (mpcb->mpcb_wbcnt > 0) {
826 			struct rwindow32 *rwin = (void *)mpcb->mpcb_wbuf;
827 			int i = mpcb->mpcb_wbcnt;
828 			do {
829 				i--;
830 				if ((long)mpcb->mpcb_spbuf[i] == fp)
831 					return (rwin[i].rw_local[reg - 16]);
832 			} while (i > 0);
833 		}
834 
835 		DTRACE_CPUFLAG_SET(CPU_DTRACE_NOFAULT);
836 		value = dtrace_fuword32(&fr->fr_local[reg - 16]);
837 		DTRACE_CPUFLAG_CLEAR(CPU_DTRACE_NOFAULT);
838 	}
839 
840 	return (value);
841 }
842