1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License, Version 1.0 only
6  * (the "License").  You may not use this file except in compliance
7  * with the License.
8  *
9  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
10  * or http://www.opensolaris.org/os/licensing.
11  * See the License for the specific language governing permissions
12  * and limitations under the License.
13  *
14  * When distributing Covered Code, include this CDDL HEADER in each
15  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
16  * If applicable, add the following below this CDDL HEADER, with the
17  * fields enclosed by brackets "[]" replaced with your own identifying
18  * information: Portions Copyright [yyyy] [name of copyright owner]
19  *
20  * CDDL HEADER END
21  */
22 
23 /*
24  * Copyright 2006 Sun Microsystems, Inc.  All rights reserved.
25  * Use is subject to license terms.
26  */
27 
28 #pragma ident	"%Z%%M%	%I%	%E% SMI"
29 
30 #include <sys/dtrace_impl.h>
31 #include <sys/atomic.h>
32 #include <sys/model.h>
33 #include <sys/frame.h>
34 #include <sys/stack.h>
35 #include <sys/machpcb.h>
36 #include <sys/procfs_isa.h>
37 #include <sys/cmn_err.h>
38 #include <sys/sysmacros.h>
39 
40 #define	DTRACE_FMT3OP3_MASK	0x81000000
41 #define	DTRACE_FMT3OP3		0x80000000
42 #define	DTRACE_FMT3RS1_SHIFT	14
43 #define	DTRACE_FMT3RD_SHIFT	25
44 #define	DTRACE_DISP22_SHIFT	10
45 #define	DTRACE_RMASK		0x1f
46 #define	DTRACE_REG_L0		16
47 #define	DTRACE_REG_O7		15
48 #define	DTRACE_REG_I0		24
49 #define	DTRACE_REG_I6		30
50 #define	DTRACE_RET		0x81c7e008
51 #define	DTRACE_RETL		0x81c3e008
52 #define	DTRACE_SAVE_MASK	0xc1f80000
53 #define	DTRACE_SAVE		0x81e00000
54 #define	DTRACE_RESTORE		0x81e80000
55 #define	DTRACE_CALL_MASK	0xc0000000
56 #define	DTRACE_CALL		0x40000000
57 #define	DTRACE_JMPL_MASK	0x81f10000
58 #define	DTRACE_JMPL		0x81c00000
59 #define	DTRACE_BA_MASK		0xdfc00000
60 #define	DTRACE_BA		0x10800000
61 #define	DTRACE_BA_MAX		10
62 
63 extern int dtrace_getupcstack_top(uint64_t *, int, uintptr_t *);
64 extern int dtrace_getustackdepth_top(uintptr_t *);
65 extern ulong_t dtrace_getreg_win(uint_t, uint_t);
66 extern void dtrace_putreg_win(uint_t, ulong_t);
67 extern int dtrace_fish(int, int, uintptr_t *);
68 
69 /*
70  * This is similar in principle to getpcstack(), but there are several marked
71  * differences in implementation:
72  *
73  * (a)	dtrace_getpcstack() is called from probe context.  Thus, the call
74  *	to flush_windows() from getpcstack() is a call to the probe-safe
75  *	equivalent here.
76  *
77  * (b)  dtrace_getpcstack() is willing to sacrifice some performance to get
78  *	a correct stack.  While consumers of getpcstack() are largely
79  *	subsystem-specific in-kernel debugging facilities, DTrace consumers
80  *	are arbitrary user-level analysis tools; dtrace_getpcstack() must
81  *	deliver as correct a stack as possible.  Details on the issues
82  *	surrounding stack correctness are found below.
83  *
84  * (c)	dtrace_getpcstack() _always_ fills in pcstack_limit pc_t's -- filling
85  *	in the difference between the stack depth and pcstack_limit with NULLs.
86  *	Due to this behavior dtrace_getpcstack() returns void.
87  *
88  * (d)	dtrace_getpcstack() takes a third parameter, aframes, that
89  *	denotes the number of _artificial frames_ on the bottom of the
90  *	stack.  An artificial frame is one induced by the provider; all
91  *	artificial frames are stripped off before frames are stored to
92  *	pcstack.
93  *
94  * (e)	dtrace_getpcstack() takes a fourth parameter, pc, that indicates
95  *	an interrupted program counter (if any).  This should be a non-NULL
96  *	value if and only if the hit probe is unanchored.  (Anchored probes
97  *	don't fire through an interrupt source.)  This parameter is used to
98  *	assure (b), above.
99  */
100 void
101 dtrace_getpcstack(pc_t *pcstack, int pcstack_limit, int aframes, uint32_t *pc)
102 {
103 	struct frame *fp, *nextfp, *minfp, *stacktop;
104 	int depth = 0;
105 	int on_intr, j = 0;
106 	uint32_t i, r;
107 
108 	fp = (struct frame *)((caddr_t)dtrace_getfp() + STACK_BIAS);
109 	dtrace_flush_windows();
110 
111 	if (pc != NULL) {
112 		/*
113 		 * If we've been passed a non-NULL pc, we need to determine
114 		 * whether or not the specified program counter falls in a leaf
115 		 * function.  If it falls within a leaf function, we know that
116 		 * %o7 is valid in its frame (and we can just drive on).  If
117 		 * it's a non-leaf, however, we know that %o7 is garbage in the
118 		 * bottom frame.  To trim this frame, we simply increment
119 		 * aframes and drop into the stack-walking loop.
120 		 *
121 		 * To quickly determine if the specified program counter is in
122 		 * a leaf function, we exploit the fact that leaf functions
123 		 * tend to be short and non-leaf functions tend to frequently
124 		 * perform operations that are only permitted in a non-leaf
125 		 * function (e.g., using the %i's or %l's; calling a function;
126 		 * performing a restore).  We exploit these tendencies by
127 		 * simply scanning forward from the specified %pc -- if we see
128 		 * an operation only permitted in a non-leaf, we know we're in
129 		 * a non-leaf; if we see a retl, we know we're in a leaf.
130 		 * Fortunately, one need not perform anywhere near full
131 		 * disassembly to effectively determine the former: determining
132 		 * that an instruction is a format-3 instruction and decoding
133 		 * its rd and rs1 fields, for example, requires very little
134 		 * manipulation.  Overall, this method of leaf determination
135 		 * performs quite well:  on average, we only examine between
136 		 * 1.5 and 2.5 instructions before making the determination.
137 		 * (Outliers do exist, however; of note is the non-leaf
138 		 * function ip_sioctl_not_ours() which -- as of this writing --
139 		 * has a whopping 455 straight instructions that manipulate
140 		 * only %g's and %o's.)
141 		 */
142 		int delay = 0, branches = 0, taken = 0;
143 
144 		if (depth < pcstack_limit)
145 			pcstack[depth++] = (pc_t)(uintptr_t)pc;
146 
147 		/*
148 		 * Our heuristic is exactly that -- a heuristic -- and there
149 		 * exists a possibility that we could be either be vectored
150 		 * off into the weeds (by following a bogus branch) or could
151 		 * wander off the end of the function and off the end of a
152 		 * text mapping (by not following a conditional branch at the
153 		 * end of the function that is effectively always taken).  So
154 		 * as a precautionary measure, we set the NOFAULT flag.
155 		 */
156 		DTRACE_CPUFLAG_SET(CPU_DTRACE_NOFAULT);
157 
158 		for (;;) {
159 			i = pc[j++];
160 
161 			if ((i & DTRACE_FMT3OP3_MASK) == DTRACE_FMT3OP3) {
162 				/*
163 				 * This is a format-3 instruction.  We can
164 				 * look at rd and rs1.
165 				 */
166 				r = (i >> DTRACE_FMT3RS1_SHIFT) & DTRACE_RMASK;
167 
168 				if (r >= DTRACE_REG_L0)
169 					goto nonleaf;
170 
171 				r = (i >> DTRACE_FMT3RD_SHIFT) & DTRACE_RMASK;
172 
173 				if (r >= DTRACE_REG_L0)
174 					goto nonleaf;
175 
176 				if ((i & DTRACE_JMPL_MASK) == DTRACE_JMPL) {
177 					delay = 1;
178 					continue;
179 				}
180 
181 				/*
182 				 * If we see explicit manipulation with %o7
183 				 * as a destination register, we know that
184 				 * %o7 is likely bogus -- and we treat this
185 				 * function as a non-leaf.
186 				 */
187 				if (r == DTRACE_REG_O7) {
188 					if (delay)
189 						goto leaf;
190 
191 					i &= DTRACE_JMPL_MASK;
192 
193 					if (i == DTRACE_JMPL) {
194 						delay = 1;
195 						continue;
196 					}
197 
198 					goto nonleaf;
199 				}
200 			} else {
201 				/*
202 				 * If this is a call, it may or may not be
203 				 * a leaf; we need to check the delay slot.
204 				 */
205 				if ((i & DTRACE_CALL_MASK) == DTRACE_CALL) {
206 					delay = 1;
207 					continue;
208 				}
209 
210 				/*
211 				 * If we see a ret it's not a leaf; if we
212 				 * see a retl, it is a leaf.
213 				 */
214 				if (i == DTRACE_RET)
215 					goto nonleaf;
216 
217 				if (i == DTRACE_RETL)
218 					goto leaf;
219 
220 				/*
221 				 * If this is a ba (annulled or not), then we
222 				 * need to actually follow the branch.  No, we
223 				 * don't look at the delay slot -- hopefully
224 				 * anything that can be gleaned from the delay
225 				 * slot can also be gleaned from the branch
226 				 * target.  To prevent ourselves from iterating
227 				 * infinitely, we clamp the number of branches
228 				 * that we'll follow, and we refuse to follow
229 				 * the same branch twice consecutively.  In
230 				 * both cases, we abort by deciding that we're
231 				 * looking at a leaf.  While in theory this
232 				 * could be wrong (we could be in the middle of
233 				 * a loop in a non-leaf that ends with a ba and
234 				 * only manipulates outputs and globals in the
235 				 * body of the loop -- therefore leading us to
236 				 * the wrong conclusion), this doesn't seem to
237 				 * crop up in practice.  (Or rather, this
238 				 * condition could not be deliberately induced,
239 				 * despite concerted effort.)
240 				 */
241 				if ((i & DTRACE_BA_MASK) == DTRACE_BA) {
242 					if (++branches == DTRACE_BA_MAX ||
243 					    taken == j)
244 						goto nonleaf;
245 
246 					taken = j;
247 					j += ((int)(i << DTRACE_DISP22_SHIFT) >>
248 					    DTRACE_DISP22_SHIFT) - 1;
249 					continue;
250 				}
251 
252 				/*
253 				 * Finally, if it's a save, it should be
254 				 * treated as a leaf; if it's a restore it
255 				 * should not be treated as a leaf.
256 				 */
257 				if ((i & DTRACE_SAVE_MASK) == DTRACE_SAVE)
258 					goto leaf;
259 
260 				if ((i & DTRACE_SAVE_MASK) == DTRACE_RESTORE)
261 					goto nonleaf;
262 			}
263 
264 			if (delay) {
265 				/*
266 				 * If this was a delay slot instruction and
267 				 * we didn't pick it up elsewhere, this is a
268 				 * non-leaf.
269 				 */
270 				goto nonleaf;
271 			}
272 		}
273 nonleaf:
274 		aframes++;
275 leaf:
276 		DTRACE_CPUFLAG_CLEAR(CPU_DTRACE_NOFAULT);
277 	}
278 
279 	if ((on_intr = CPU_ON_INTR(CPU)) != 0)
280 		stacktop = (struct frame *)(CPU->cpu_intr_stack + SA(MINFRAME));
281 	else
282 		stacktop = (struct frame *)curthread->t_stk;
283 	minfp = fp;
284 
285 	while (depth < pcstack_limit) {
286 		nextfp = (struct frame *)((caddr_t)fp->fr_savfp + STACK_BIAS);
287 		if (nextfp <= minfp || nextfp >= stacktop) {
288 			if (!on_intr && nextfp == stacktop && aframes != 0) {
289 				/*
290 				 * If we are exactly at the top of the stack
291 				 * with a non-zero number of artificial frames,
292 				 * it must be that the stack is filled with
293 				 * nothing _but_ artificial frames.  In this
294 				 * case, we assert that this is so, zero
295 				 * pcstack, and return.
296 				 */
297 				ASSERT(aframes == 1);
298 				ASSERT(depth == 0);
299 
300 				while (depth < pcstack_limit)
301 					pcstack[depth++] = NULL;
302 				return;
303 			}
304 
305 			if (on_intr) {
306 				/*
307 				 * Hop from interrupt stack to thread stack.
308 				 */
309 				stacktop = (struct frame *)curthread->t_stk;
310 				minfp = (struct frame *)curthread->t_stkbase;
311 
312 				on_intr = 0;
313 
314 				if (nextfp > minfp && nextfp < stacktop)
315 					continue;
316 			} else {
317 				/*
318 				 * High-level interrupts may occur when %sp is
319 				 * not necessarily contained in the stack
320 				 * bounds implied by %g7 -- interrupt thread
321 				 * management runs with %pil at DISP_LEVEL,
322 				 * and high-level interrupts may thus occur
323 				 * in windows when %sp and %g7 are not self-
324 				 * consistent.  If we call dtrace_getpcstack()
325 				 * from a high-level interrupt that has occurred
326 				 * in such a window, we will fail the above test
327 				 * of nextfp against minfp/stacktop.  If the
328 				 * high-level interrupt has in turn interrupted
329 				 * a non-passivated interrupt thread, we
330 				 * will execute the below code with non-zero
331 				 * aframes.  We therefore want to assert that
332 				 * aframes is zero _or_ we are in a high-level
333 				 * interrupt -- but because cpu_intr_actv is
334 				 * updated with high-level interrupts enabled,
335 				 * we must reduce this to only asserting that
336 				 * %pil is greater than DISP_LEVEL.
337 				 */
338 				ASSERT(aframes == 0 ||
339 				    dtrace_getipl() > DISP_LEVEL);
340 				pcstack[depth++] = (pc_t)fp->fr_savpc;
341 			}
342 
343 			while (depth < pcstack_limit)
344 				pcstack[depth++] = NULL;
345 			return;
346 		}
347 
348 		if (aframes > 0) {
349 			aframes--;
350 		} else {
351 			pcstack[depth++] = (pc_t)fp->fr_savpc;
352 		}
353 
354 		fp = nextfp;
355 		minfp = fp;
356 	}
357 }
358 
359 static int
360 dtrace_getustack_common(uint64_t *pcstack, int pcstack_limit, uintptr_t sp)
361 {
362 	proc_t *p = curproc;
363 	int ret = 0;
364 
365 	ASSERT(pcstack == NULL || pcstack_limit > 0);
366 
367 	if (p->p_model == DATAMODEL_NATIVE) {
368 		for (;;) {
369 			struct frame *fr = (struct frame *)(sp + STACK_BIAS);
370 			uintptr_t pc;
371 
372 			if (sp == 0 || fr == NULL ||
373 			    !IS_P2ALIGNED((uintptr_t)fr, STACK_ALIGN))
374 				break;
375 
376 			pc = dtrace_fulword(&fr->fr_savpc);
377 			sp = dtrace_fulword(&fr->fr_savfp);
378 
379 			if (pc == 0)
380 				break;
381 
382 			ret++;
383 
384 			if (pcstack != NULL) {
385 				*pcstack++ = pc;
386 				pcstack_limit--;
387 				if (pcstack_limit == 0)
388 					break;
389 			}
390 		}
391 	} else {
392 		/*
393 		 * Truncate the stack pointer to 32-bits as there may be
394 		 * garbage in the upper bits which would normally be ignored
395 		 * by the processor in 32-bit mode.
396 		 */
397 		sp = (uint32_t)sp;
398 
399 		for (;;) {
400 			struct frame32 *fr = (struct frame32 *)sp;
401 			uint32_t pc;
402 
403 			if (sp == 0 ||
404 			    !IS_P2ALIGNED((uintptr_t)fr, STACK_ALIGN32))
405 				break;
406 
407 			pc = dtrace_fuword32(&fr->fr_savpc);
408 			sp = dtrace_fuword32(&fr->fr_savfp);
409 
410 			if (pc == 0)
411 				break;
412 
413 			ret++;
414 
415 			if (pcstack != NULL) {
416 				*pcstack++ = pc;
417 				pcstack_limit--;
418 				if (pcstack_limit == 0)
419 					break;
420 			}
421 		}
422 	}
423 
424 	return (ret);
425 }
426 
427 void
428 dtrace_getupcstack(uint64_t *pcstack, int pcstack_limit)
429 {
430 	klwp_t *lwp = ttolwp(curthread);
431 	proc_t *p = curproc;
432 	struct regs *rp;
433 	uintptr_t sp;
434 	int n;
435 
436 	if (pcstack_limit <= 0)
437 		return;
438 
439 	/*
440 	 * If there's no user context we still need to zero the stack.
441 	 */
442 	if (lwp == NULL || p == NULL || (rp = lwp->lwp_regs) == NULL)
443 		goto zero;
444 
445 	*pcstack++ = (uint64_t)p->p_pid;
446 	pcstack_limit--;
447 
448 	if (pcstack_limit <= 0)
449 		return;
450 
451 	*pcstack++ = (uint64_t)rp->r_pc;
452 	pcstack_limit--;
453 
454 	if (pcstack_limit <= 0)
455 		return;
456 
457 	if (DTRACE_CPUFLAG_ISSET(CPU_DTRACE_ENTRY)) {
458 		*pcstack++ = (uint64_t)rp->r_o7;
459 		pcstack_limit--;
460 		if (pcstack_limit <= 0)
461 			return;
462 	}
463 
464 	sp = rp->r_sp;
465 
466 	n = dtrace_getupcstack_top(pcstack, pcstack_limit, &sp);
467 	ASSERT(n >= 0);
468 	ASSERT(n <= pcstack_limit);
469 
470 	pcstack += n;
471 	pcstack_limit -= n;
472 	if (pcstack_limit <= 0)
473 		return;
474 
475 	n = dtrace_getustack_common(pcstack, pcstack_limit, sp);
476 	ASSERT(n >= 0);
477 	ASSERT(n <= pcstack_limit);
478 
479 	pcstack += n;
480 	pcstack_limit -= n;
481 
482 zero:
483 	while (pcstack_limit-- > 0)
484 		*pcstack++ = NULL;
485 }
486 
487 int
488 dtrace_getustackdepth(void)
489 {
490 	klwp_t *lwp = ttolwp(curthread);
491 	proc_t *p = curproc;
492 	struct regs *rp;
493 	uintptr_t sp;
494 	int n = 1;
495 
496 	if (lwp == NULL || p == NULL || (rp = lwp->lwp_regs) == NULL)
497 		return (0);
498 
499 	if (DTRACE_CPUFLAG_ISSET(CPU_DTRACE_FAULT))
500 		return (-1);
501 
502 	sp = rp->r_sp;
503 
504 	n += dtrace_getustackdepth_top(&sp);
505 	n += dtrace_getustack_common(NULL, 0, sp);
506 
507 	/*
508 	 * Add one more to the stack depth if we're in an entry probe as long
509 	 * as the return address is non-NULL or there are additional frames
510 	 * beyond that NULL return address.
511 	 */
512 	if (DTRACE_CPUFLAG_ISSET(CPU_DTRACE_ENTRY) &&
513 	    (rp->r_o7 != NULL || n != 1))
514 		n++;
515 
516 	return (n);
517 }
518 
519 void
520 dtrace_getufpstack(uint64_t *pcstack, uint64_t *fpstack, int pcstack_limit)
521 {
522 	klwp_t *lwp = ttolwp(curthread);
523 	proc_t *p = ttoproc(curthread);
524 	struct regs *rp;
525 	uintptr_t sp;
526 
527 	if (pcstack_limit <= 0)
528 		return;
529 
530 	/*
531 	 * If there's no user context we still need to zero the stack.
532 	 */
533 	if (lwp == NULL || p == NULL || (rp = lwp->lwp_regs) == NULL)
534 		goto zero;
535 
536 	*pcstack++ = (uint64_t)p->p_pid;
537 	pcstack_limit--;
538 
539 	if (pcstack_limit <= 0)
540 		return;
541 
542 	if (DTRACE_CPUFLAG_ISSET(CPU_DTRACE_ENTRY)) {
543 		*fpstack++ = 0;
544 		*pcstack++ = (uint64_t)rp->r_pc;
545 		pcstack_limit--;
546 		if (pcstack_limit <= 0)
547 			return;
548 
549 		*fpstack++ = (uint64_t)rp->r_sp;
550 		*pcstack++ = (uint64_t)rp->r_o7;
551 		pcstack_limit--;
552 	} else {
553 		*fpstack++ = (uint64_t)rp->r_sp;
554 		*pcstack++ = (uint64_t)rp->r_pc;
555 		pcstack_limit--;
556 	}
557 
558 	if (pcstack_limit <= 0)
559 		return;
560 
561 	sp = rp->r_sp;
562 
563 	dtrace_flush_user_windows();
564 
565 	if (p->p_model == DATAMODEL_NATIVE) {
566 		while (pcstack_limit > 0) {
567 			struct frame *fr = (struct frame *)(sp + STACK_BIAS);
568 			uintptr_t pc;
569 
570 			if (sp == 0 || fr == NULL ||
571 			    ((uintptr_t)&fr->fr_savpc & 3) != 0 ||
572 			    ((uintptr_t)&fr->fr_savfp & 3) != 0)
573 				break;
574 
575 			pc = dtrace_fulword(&fr->fr_savpc);
576 			sp = dtrace_fulword(&fr->fr_savfp);
577 
578 			if (pc == 0)
579 				break;
580 
581 			*fpstack++ = sp;
582 			*pcstack++ = pc;
583 			pcstack_limit--;
584 		}
585 	} else {
586 		/*
587 		 * Truncate the stack pointer to 32-bits as there may be
588 		 * garbage in the upper bits which would normally be ignored
589 		 * by the processor in 32-bit mode.
590 		 */
591 		sp = (uint32_t)sp;
592 
593 		while (pcstack_limit > 0) {
594 			struct frame32 *fr = (struct frame32 *)sp;
595 			uint32_t pc;
596 
597 			if (sp == 0 ||
598 			    ((uintptr_t)&fr->fr_savpc & 3) != 0 ||
599 			    ((uintptr_t)&fr->fr_savfp & 3) != 0)
600 				break;
601 
602 			pc = dtrace_fuword32(&fr->fr_savpc);
603 			sp = dtrace_fuword32(&fr->fr_savfp);
604 
605 			if (pc == 0)
606 				break;
607 
608 			*fpstack++ = sp;
609 			*pcstack++ = pc;
610 			pcstack_limit--;
611 		}
612 	}
613 
614 zero:
615 	while (pcstack_limit-- > 0)
616 		*pcstack++ = NULL;
617 }
618 
619 uint64_t
620 dtrace_getarg(int arg, int aframes)
621 {
622 	uintptr_t val;
623 	struct frame *fp;
624 	uint64_t rval;
625 
626 	/*
627 	 * Account for the fact that dtrace_getarg() consumes an additional
628 	 * stack frame.
629 	 */
630 	aframes++;
631 
632 	if (arg < 6) {
633 		if (dtrace_fish(aframes, DTRACE_REG_I0 + arg, &val) == 0)
634 			return (val);
635 	} else {
636 		if (dtrace_fish(aframes, DTRACE_REG_I6, &val) == 0) {
637 			/*
638 			 * We have a stack pointer; grab the argument.
639 			 */
640 			fp = (struct frame *)(val + STACK_BIAS);
641 
642 			DTRACE_CPUFLAG_SET(CPU_DTRACE_NOFAULT);
643 			rval = fp->fr_argx[arg - 6];
644 			DTRACE_CPUFLAG_CLEAR(CPU_DTRACE_NOFAULT);
645 
646 			return (rval);
647 		}
648 	}
649 
650 	/*
651 	 * There are other ways to do this.  But the slow, painful way works
652 	 * just fine.  Because this requires some loads, we need to set
653 	 * CPU_DTRACE_NOFAULT to protect against looking for an argument that
654 	 * isn't there.
655 	 */
656 	fp = (struct frame *)((caddr_t)dtrace_getfp() + STACK_BIAS);
657 	dtrace_flush_windows();
658 
659 	DTRACE_CPUFLAG_SET(CPU_DTRACE_NOFAULT);
660 
661 	for (aframes -= 1; aframes; aframes--)
662 		fp = (struct frame *)((caddr_t)fp->fr_savfp + STACK_BIAS);
663 
664 	if (arg < 6) {
665 		rval = fp->fr_arg[arg];
666 	} else {
667 		fp = (struct frame *)((caddr_t)fp->fr_savfp + STACK_BIAS);
668 		rval = fp->fr_argx[arg - 6];
669 	}
670 
671 	DTRACE_CPUFLAG_CLEAR(CPU_DTRACE_NOFAULT);
672 
673 	return (rval);
674 }
675 
676 int
677 dtrace_getstackdepth(int aframes)
678 {
679 	struct frame *fp, *nextfp, *minfp, *stacktop;
680 	int depth = 0;
681 	int on_intr;
682 
683 	fp = (struct frame *)((caddr_t)dtrace_getfp() + STACK_BIAS);
684 	dtrace_flush_windows();
685 
686 	if ((on_intr = CPU_ON_INTR(CPU)) != 0)
687 		stacktop = (struct frame *)CPU->cpu_intr_stack + SA(MINFRAME);
688 	else
689 		stacktop = (struct frame *)curthread->t_stk;
690 	minfp = fp;
691 
692 	for (;;) {
693 		nextfp = (struct frame *)((caddr_t)fp->fr_savfp + STACK_BIAS);
694 		if (nextfp <= minfp || nextfp >= stacktop) {
695 			if (on_intr) {
696 				/*
697 				 * Hop from interrupt stack to thread stack.
698 				 */
699 				stacktop = (struct frame *)curthread->t_stk;
700 				minfp = (struct frame *)curthread->t_stkbase;
701 				on_intr = 0;
702 				continue;
703 			}
704 
705 			return (++depth);
706 		}
707 
708 		if (aframes > 0) {
709 			aframes--;
710 		} else {
711 			depth++;
712 		}
713 
714 		fp = nextfp;
715 		minfp = fp;
716 	}
717 }
718 
719 /*
720  * This uses the same register numbering scheme as in sys/procfs_isa.h.
721  */
722 ulong_t
723 dtrace_getreg(struct regs *rp, uint_t reg)
724 {
725 	ulong_t value;
726 	uintptr_t fp;
727 	struct machpcb *mpcb;
728 
729 	if (reg == R_G0)
730 		return (0);
731 
732 	if (reg <= R_G7)
733 		return ((&rp->r_g1)[reg - 1]);
734 
735 	if (reg > R_I7) {
736 		switch (reg) {
737 		case R_CCR:
738 			return ((rp->r_tstate >> TSTATE_CCR_SHIFT) &
739 			    TSTATE_CCR_MASK);
740 		case R_PC:
741 			return (rp->r_pc);
742 		case R_nPC:
743 			return (rp->r_npc);
744 		case R_Y:
745 			return (rp->r_y);
746 		case R_ASI:
747 			return ((rp->r_tstate >> TSTATE_ASI_SHIFT) &
748 			    TSTATE_ASI_MASK);
749 		case R_FPRS:
750 			return (dtrace_getfprs());
751 		default:
752 			DTRACE_CPUFLAG_SET(CPU_DTRACE_ILLOP);
753 			return (0);
754 		}
755 	}
756 
757 	/*
758 	 * We reach go to the fake restore case if the probe we hit was a pid
759 	 * return probe on a restore instruction. We partially emulate the
760 	 * restore in the kernel and then execute a simple restore
761 	 * instruction that we've secreted away to do the actual register
762 	 * window manipulation. We need to go one register window further
763 	 * down to get at the %ls, and %is and we need to treat %os like %is
764 	 * to pull them out of the topmost user frame.
765 	 */
766 	if (DTRACE_CPUFLAG_ISSET(CPU_DTRACE_FAKERESTORE)) {
767 		if (reg > R_O7)
768 			goto fake_restore;
769 		else
770 			reg += R_I0 - R_O0;
771 
772 	} else if (reg <= R_O7) {
773 		return ((&rp->r_g1)[reg - 1]);
774 	}
775 
776 	if (dtrace_getotherwin() > 0)
777 		return (dtrace_getreg_win(reg, 1));
778 
779 	mpcb = (struct machpcb *)((caddr_t)rp - REGOFF);
780 
781 	if (curproc->p_model == DATAMODEL_NATIVE) {
782 		struct frame *fr = (void *)(rp->r_sp + STACK_BIAS);
783 
784 		if (mpcb->mpcb_wbcnt > 0) {
785 			struct rwindow *rwin = (void *)mpcb->mpcb_wbuf;
786 			int i = mpcb->mpcb_wbcnt;
787 			do {
788 				i--;
789 				if ((long)mpcb->mpcb_spbuf[i] == rp->r_sp)
790 					return (rwin[i].rw_local[reg - 16]);
791 			} while (i > 0);
792 		}
793 
794 		DTRACE_CPUFLAG_SET(CPU_DTRACE_NOFAULT);
795 		value = dtrace_fulword(&fr->fr_local[reg - 16]);
796 		DTRACE_CPUFLAG_CLEAR(CPU_DTRACE_NOFAULT);
797 	} else {
798 		struct frame32 *fr = (void *)(uintptr_t)(caddr32_t)rp->r_sp;
799 
800 		if (mpcb->mpcb_wbcnt > 0) {
801 			struct rwindow32 *rwin = (void *)mpcb->mpcb_wbuf;
802 			int i = mpcb->mpcb_wbcnt;
803 			do {
804 				i--;
805 				if ((long)mpcb->mpcb_spbuf[i] == rp->r_sp)
806 					return (rwin[i].rw_local[reg - 16]);
807 			} while (i > 0);
808 		}
809 
810 		DTRACE_CPUFLAG_SET(CPU_DTRACE_NOFAULT);
811 		value = dtrace_fuword32(&fr->fr_local[reg - 16]);
812 		DTRACE_CPUFLAG_CLEAR(CPU_DTRACE_NOFAULT);
813 	}
814 
815 	return (value);
816 
817 fake_restore:
818 	ASSERT(R_L0 <= reg && reg <= R_I7);
819 
820 	/*
821 	 * We first look two user windows down to see if we can dig out
822 	 * the register we're looking for.
823 	 */
824 	if (dtrace_getotherwin() > 1)
825 		return (dtrace_getreg_win(reg, 2));
826 
827 	/*
828 	 * First we need to get the frame pointer and then we perform
829 	 * the same computation as in the non-fake-o-restore case.
830 	 */
831 
832 	mpcb = (struct machpcb *)((caddr_t)rp - REGOFF);
833 
834 	if (dtrace_getotherwin() > 0) {
835 		fp = dtrace_getreg_win(R_FP, 1);
836 		goto got_fp;
837 	}
838 
839 	if (curproc->p_model == DATAMODEL_NATIVE) {
840 		struct frame *fr = (void *)(rp->r_sp + STACK_BIAS);
841 
842 		if (mpcb->mpcb_wbcnt > 0) {
843 			struct rwindow *rwin = (void *)mpcb->mpcb_wbuf;
844 			int i = mpcb->mpcb_wbcnt;
845 			do {
846 				i--;
847 				if ((long)mpcb->mpcb_spbuf[i] == rp->r_sp) {
848 					fp = rwin[i].rw_fp;
849 					goto got_fp;
850 				}
851 			} while (i > 0);
852 		}
853 
854 		DTRACE_CPUFLAG_SET(CPU_DTRACE_NOFAULT);
855 		fp = dtrace_fulword(&fr->fr_savfp);
856 		DTRACE_CPUFLAG_CLEAR(CPU_DTRACE_NOFAULT);
857 		if (cpu_core[CPU->cpu_id].cpuc_dtrace_flags & CPU_DTRACE_FAULT)
858 			return (0);
859 	} else {
860 		struct frame32 *fr = (void *)(uintptr_t)(caddr32_t)rp->r_sp;
861 
862 		if (mpcb->mpcb_wbcnt > 0) {
863 			struct rwindow32 *rwin = (void *)mpcb->mpcb_wbuf;
864 			int i = mpcb->mpcb_wbcnt;
865 			do {
866 				i--;
867 				if ((long)mpcb->mpcb_spbuf[i] == rp->r_sp) {
868 					fp = rwin[i].rw_fp;
869 					goto got_fp;
870 				}
871 			} while (i > 0);
872 		}
873 
874 		DTRACE_CPUFLAG_SET(CPU_DTRACE_NOFAULT);
875 		fp = dtrace_fuword32(&fr->fr_savfp);
876 		DTRACE_CPUFLAG_CLEAR(CPU_DTRACE_NOFAULT);
877 		if (cpu_core[CPU->cpu_id].cpuc_dtrace_flags & CPU_DTRACE_FAULT)
878 			return (0);
879 	}
880 got_fp:
881 
882 	if (curproc->p_model == DATAMODEL_NATIVE) {
883 		struct frame *fr = (void *)(fp + STACK_BIAS);
884 
885 		if (mpcb->mpcb_wbcnt > 0) {
886 			struct rwindow *rwin = (void *)mpcb->mpcb_wbuf;
887 			int i = mpcb->mpcb_wbcnt;
888 			do {
889 				i--;
890 				if ((long)mpcb->mpcb_spbuf[i] == fp)
891 					return (rwin[i].rw_local[reg - 16]);
892 			} while (i > 0);
893 		}
894 
895 		DTRACE_CPUFLAG_SET(CPU_DTRACE_NOFAULT);
896 		value = dtrace_fulword(&fr->fr_local[reg - 16]);
897 		DTRACE_CPUFLAG_CLEAR(CPU_DTRACE_NOFAULT);
898 	} else {
899 		struct frame32 *fr = (void *)(uintptr_t)(caddr32_t)fp;
900 
901 		if (mpcb->mpcb_wbcnt > 0) {
902 			struct rwindow32 *rwin = (void *)mpcb->mpcb_wbuf;
903 			int i = mpcb->mpcb_wbcnt;
904 			do {
905 				i--;
906 				if ((long)mpcb->mpcb_spbuf[i] == fp)
907 					return (rwin[i].rw_local[reg - 16]);
908 			} while (i > 0);
909 		}
910 
911 		DTRACE_CPUFLAG_SET(CPU_DTRACE_NOFAULT);
912 		value = dtrace_fuword32(&fr->fr_local[reg - 16]);
913 		DTRACE_CPUFLAG_CLEAR(CPU_DTRACE_NOFAULT);
914 	}
915 
916 	return (value);
917 }
918