17c478bd9Sstevel@tonic-gate /* 27c478bd9Sstevel@tonic-gate * CDDL HEADER START 37c478bd9Sstevel@tonic-gate * 47c478bd9Sstevel@tonic-gate * The contents of this file are subject to the terms of the 57c478bd9Sstevel@tonic-gate * Common Development and Distribution License, Version 1.0 only 67c478bd9Sstevel@tonic-gate * (the "License"). You may not use this file except in compliance 77c478bd9Sstevel@tonic-gate * with the License. 87c478bd9Sstevel@tonic-gate * 97c478bd9Sstevel@tonic-gate * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 107c478bd9Sstevel@tonic-gate * or http://www.opensolaris.org/os/licensing. 117c478bd9Sstevel@tonic-gate * See the License for the specific language governing permissions 127c478bd9Sstevel@tonic-gate * and limitations under the License. 137c478bd9Sstevel@tonic-gate * 147c478bd9Sstevel@tonic-gate * When distributing Covered Code, include this CDDL HEADER in each 157c478bd9Sstevel@tonic-gate * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 167c478bd9Sstevel@tonic-gate * If applicable, add the following below this CDDL HEADER, with the 177c478bd9Sstevel@tonic-gate * fields enclosed by brackets "[]" replaced with your own identifying 187c478bd9Sstevel@tonic-gate * information: Portions Copyright [yyyy] [name of copyright owner] 197c478bd9Sstevel@tonic-gate * 207c478bd9Sstevel@tonic-gate * CDDL HEADER END 217c478bd9Sstevel@tonic-gate */ 22*75521904Sraf 237c478bd9Sstevel@tonic-gate /* 247c478bd9Sstevel@tonic-gate * Copyright 2005 Sun Microsystems, Inc. All rights reserved. 257c478bd9Sstevel@tonic-gate * Use is subject to license terms. 267c478bd9Sstevel@tonic-gate */ 277c478bd9Sstevel@tonic-gate 287c478bd9Sstevel@tonic-gate #pragma ident "%Z%%M% %I% %E% SMI" 297c478bd9Sstevel@tonic-gate 307c478bd9Sstevel@tonic-gate #include <sys/fasttrap_isa.h> 317c478bd9Sstevel@tonic-gate #include <sys/fasttrap_impl.h> 327c478bd9Sstevel@tonic-gate #include <sys/dtrace.h> 337c478bd9Sstevel@tonic-gate #include <sys/dtrace_impl.h> 347c478bd9Sstevel@tonic-gate #include <sys/cmn_err.h> 357c478bd9Sstevel@tonic-gate #include <sys/frame.h> 367c478bd9Sstevel@tonic-gate #include <sys/stack.h> 377c478bd9Sstevel@tonic-gate #include <sys/sysmacros.h> 387c478bd9Sstevel@tonic-gate #include <sys/trap.h> 397c478bd9Sstevel@tonic-gate 407c478bd9Sstevel@tonic-gate #include <v9/sys/machpcb.h> 417c478bd9Sstevel@tonic-gate #include <v9/sys/privregs.h> 427c478bd9Sstevel@tonic-gate 437c478bd9Sstevel@tonic-gate /* 447c478bd9Sstevel@tonic-gate * Lossless User-Land Tracing on SPARC 457c478bd9Sstevel@tonic-gate * ----------------------------------- 467c478bd9Sstevel@tonic-gate * 477c478bd9Sstevel@tonic-gate * The Basic Idea 487c478bd9Sstevel@tonic-gate * 497c478bd9Sstevel@tonic-gate * The most important design constraint is, of course, correct execution of 507c478bd9Sstevel@tonic-gate * the user thread above all else. The next most important goal is rapid 517c478bd9Sstevel@tonic-gate * execution. We combine execution of instructions in user-land with 527c478bd9Sstevel@tonic-gate * emulation of certain instructions in the kernel to aim for complete 537c478bd9Sstevel@tonic-gate * correctness and maximal performance. 547c478bd9Sstevel@tonic-gate * 557c478bd9Sstevel@tonic-gate * We take advantage of the split PC/NPC architecture to speed up logical 567c478bd9Sstevel@tonic-gate * single-stepping; when we copy an instruction out to the scratch space in 577c478bd9Sstevel@tonic-gate * the ulwp_t structure (held in the %g7 register on SPARC), we can 587c478bd9Sstevel@tonic-gate * effectively single step by setting the PC to our scratch space and leaving 597c478bd9Sstevel@tonic-gate * the NPC alone. This executes the replaced instruction and then continues 607c478bd9Sstevel@tonic-gate * on without having to reenter the kernel as with single- stepping. The 617c478bd9Sstevel@tonic-gate * obvious caveat is for instructions whose execution is PC dependant -- 627c478bd9Sstevel@tonic-gate * branches, call and link instructions (call and jmpl), and the rdpc 637c478bd9Sstevel@tonic-gate * instruction. These instructions cannot be executed in the manner described 647c478bd9Sstevel@tonic-gate * so they must be emulated in the kernel. 657c478bd9Sstevel@tonic-gate * 667c478bd9Sstevel@tonic-gate * Emulation for this small set of instructions if fairly simple; the most 677c478bd9Sstevel@tonic-gate * difficult part being emulating branch conditions. 687c478bd9Sstevel@tonic-gate * 697c478bd9Sstevel@tonic-gate * 707c478bd9Sstevel@tonic-gate * A Cache Heavy Portfolio 717c478bd9Sstevel@tonic-gate * 727c478bd9Sstevel@tonic-gate * It's important to note at this time that copying an instruction out to the 737c478bd9Sstevel@tonic-gate * ulwp_t scratch space in user-land is rather complicated. SPARC has 747c478bd9Sstevel@tonic-gate * separate data and instruction caches so any writes to the D$ (using a 757c478bd9Sstevel@tonic-gate * store instruction for example) aren't necessarily reflected in the I$. 767c478bd9Sstevel@tonic-gate * The flush instruction can be used to synchronize the two and must be used 777c478bd9Sstevel@tonic-gate * for any self-modifying code, but the flush instruction only applies to the 787c478bd9Sstevel@tonic-gate * primary address space (the absence of a flusha analogue to the flush 797c478bd9Sstevel@tonic-gate * instruction that accepts an ASI argument is an obvious omission from SPARC 807c478bd9Sstevel@tonic-gate * v9 where the notion of the alternate address space was introduced on 817c478bd9Sstevel@tonic-gate * SPARC). To correctly copy out the instruction we must use a block store 827c478bd9Sstevel@tonic-gate * that doesn't allocate in the D$ and ensures synchronization with the I$; 837c478bd9Sstevel@tonic-gate * see dtrace_blksuword32() for the implementation (this function uses 847c478bd9Sstevel@tonic-gate * ASI_BLK_COMMIT_S to write a block through the secondary ASI in the manner 857c478bd9Sstevel@tonic-gate * described). Refer to the UltraSPARC I/II manual for details on the 867c478bd9Sstevel@tonic-gate * ASI_BLK_COMMIT_S ASI. 877c478bd9Sstevel@tonic-gate * 887c478bd9Sstevel@tonic-gate * 897c478bd9Sstevel@tonic-gate * Return Subtleties 907c478bd9Sstevel@tonic-gate * 917c478bd9Sstevel@tonic-gate * When we're firing a return probe we need to expose the value returned by 927c478bd9Sstevel@tonic-gate * the function being traced. Since the function can set the return value 937c478bd9Sstevel@tonic-gate * in its last instruction, we need to fire the return probe only _after_ 947c478bd9Sstevel@tonic-gate * the effects of the instruction are apparent. For instructions that we 957c478bd9Sstevel@tonic-gate * emulate, we can call dtrace_probe() after we've performed the emulation; 967c478bd9Sstevel@tonic-gate * for instructions that we execute after we return to user-land, we set 977c478bd9Sstevel@tonic-gate * %pc to the instruction we copied out (as described above) and set %npc 987c478bd9Sstevel@tonic-gate * to a trap instruction stashed in the ulwp_t structure. After the traced 997c478bd9Sstevel@tonic-gate * instruction is executed, the trap instruction returns control to the 1007c478bd9Sstevel@tonic-gate * kernel where we can fire the return probe. 1017c478bd9Sstevel@tonic-gate * 1027c478bd9Sstevel@tonic-gate * This need for a second trap in cases where we execute the traced 1037c478bd9Sstevel@tonic-gate * instruction makes it all the more important to emulate the most common 1047c478bd9Sstevel@tonic-gate * instructions to avoid the second trip in and out of the kernel. 1057c478bd9Sstevel@tonic-gate * 1067c478bd9Sstevel@tonic-gate * 1077c478bd9Sstevel@tonic-gate * Making it Fast 1087c478bd9Sstevel@tonic-gate * 1097c478bd9Sstevel@tonic-gate * Since copying out an instruction is neither simple nor inexpensive for the 1107c478bd9Sstevel@tonic-gate * CPU, we should attempt to avoid doing it in as many cases as possible. 1117c478bd9Sstevel@tonic-gate * Since function entry and return are usually the most interesting probe 1127c478bd9Sstevel@tonic-gate * sites, we attempt to tune the performance of the fasttrap provider around 1137c478bd9Sstevel@tonic-gate * instructions typically in those places. 1147c478bd9Sstevel@tonic-gate * 1157c478bd9Sstevel@tonic-gate * Looking at a bunch of functions in libraries and executables reveals that 1167c478bd9Sstevel@tonic-gate * most functions begin with either a save or a sethi (to setup a larger 1177c478bd9Sstevel@tonic-gate * argument to the save) and end with a restore or an or (in the case of leaf 1187c478bd9Sstevel@tonic-gate * functions). To try to improve performance, we emulate all of these 1197c478bd9Sstevel@tonic-gate * instructions in the kernel. 1207c478bd9Sstevel@tonic-gate * 1217c478bd9Sstevel@tonic-gate * The save and restore instructions are a little tricky since they perform 1227c478bd9Sstevel@tonic-gate * register window maniplulation. Rather than trying to tinker with the 1237c478bd9Sstevel@tonic-gate * register windows from the kernel, we emulate the implicit add that takes 1247c478bd9Sstevel@tonic-gate * place as part of those instructions and set the %pc to point to a simple 1257c478bd9Sstevel@tonic-gate * save or restore we've hidden in the ulwp_t structure. If we're in a return 1267c478bd9Sstevel@tonic-gate * probe so want to make it seem as though the tracepoint has been completely 1277c478bd9Sstevel@tonic-gate * executed we need to remember that we've pulled this trick with restore and 1287c478bd9Sstevel@tonic-gate * pull registers from the previous window (the one that we'll switch to once 1297c478bd9Sstevel@tonic-gate * the simple store instruction is executed) rather than the current one. This 1307c478bd9Sstevel@tonic-gate * is why in the case of emulating a restore we set the DTrace CPU flag 1317c478bd9Sstevel@tonic-gate * CPU_DTRACE_FAKERESTORE before calling dtrace_probe() for the return probes 1327c478bd9Sstevel@tonic-gate * (see fasttrap_return_common()). 1337c478bd9Sstevel@tonic-gate */ 1347c478bd9Sstevel@tonic-gate 1357c478bd9Sstevel@tonic-gate #define OP(x) ((x) >> 30) 1367c478bd9Sstevel@tonic-gate #define OP2(x) (((x) >> 22) & 0x07) 1377c478bd9Sstevel@tonic-gate #define OP3(x) (((x) >> 19) & 0x3f) 1387c478bd9Sstevel@tonic-gate #define RCOND(x) (((x) >> 25) & 0x07) 1397c478bd9Sstevel@tonic-gate #define COND(x) (((x) >> 25) & 0x0f) 1407c478bd9Sstevel@tonic-gate #define A(x) (((x) >> 29) & 0x01) 1417c478bd9Sstevel@tonic-gate #define I(x) (((x) >> 13) & 0x01) 1427c478bd9Sstevel@tonic-gate #define RD(x) (((x) >> 25) & 0x1f) 1437c478bd9Sstevel@tonic-gate #define RS1(x) (((x) >> 14) & 0x1f) 1447c478bd9Sstevel@tonic-gate #define RS2(x) (((x) >> 0) & 0x1f) 1457c478bd9Sstevel@tonic-gate #define CC(x) (((x) >> 20) & 0x03) 1467c478bd9Sstevel@tonic-gate #define DISP16(x) ((((x) >> 6) & 0xc000) | ((x) & 0x3fff)) 1477c478bd9Sstevel@tonic-gate #define DISP22(x) ((x) & 0x3fffff) 1487c478bd9Sstevel@tonic-gate #define DISP19(x) ((x) & 0x7ffff) 1497c478bd9Sstevel@tonic-gate #define DISP30(x) ((x) & 0x3fffffff) 1507c478bd9Sstevel@tonic-gate #define SW_TRAP(x) ((x) & 0x7f) 1517c478bd9Sstevel@tonic-gate 1527c478bd9Sstevel@tonic-gate #define OP3_OR 0x02 1537c478bd9Sstevel@tonic-gate #define OP3_RD 0x28 1547c478bd9Sstevel@tonic-gate #define OP3_JMPL 0x38 1557c478bd9Sstevel@tonic-gate #define OP3_RETURN 0x39 1567c478bd9Sstevel@tonic-gate #define OP3_TCC 0x3a 1577c478bd9Sstevel@tonic-gate #define OP3_SAVE 0x3c 1587c478bd9Sstevel@tonic-gate #define OP3_RESTORE 0x3d 1597c478bd9Sstevel@tonic-gate 1607c478bd9Sstevel@tonic-gate #define OP3_PREFETCH 0x2d 1617c478bd9Sstevel@tonic-gate #define OP3_CASA 0x3c 1627c478bd9Sstevel@tonic-gate #define OP3_PREFETCHA 0x3d 1637c478bd9Sstevel@tonic-gate #define OP3_CASXA 0x3e 1647c478bd9Sstevel@tonic-gate 1657c478bd9Sstevel@tonic-gate #define OP2_ILLTRAP 0x0 1667c478bd9Sstevel@tonic-gate #define OP2_BPcc 0x1 1677c478bd9Sstevel@tonic-gate #define OP2_Bicc 0x2 1687c478bd9Sstevel@tonic-gate #define OP2_BPr 0x3 1697c478bd9Sstevel@tonic-gate #define OP2_SETHI 0x4 1707c478bd9Sstevel@tonic-gate #define OP2_FBPfcc 0x5 1717c478bd9Sstevel@tonic-gate #define OP2_FBfcc 0x6 1727c478bd9Sstevel@tonic-gate 1737c478bd9Sstevel@tonic-gate #define R_G0 0 1747c478bd9Sstevel@tonic-gate #define R_O0 8 1757c478bd9Sstevel@tonic-gate #define R_SP 14 1767c478bd9Sstevel@tonic-gate #define R_I0 24 1777c478bd9Sstevel@tonic-gate #define R_I1 25 1787c478bd9Sstevel@tonic-gate #define R_I2 26 1797c478bd9Sstevel@tonic-gate #define R_I3 27 1807c478bd9Sstevel@tonic-gate 1817c478bd9Sstevel@tonic-gate /* 1827c478bd9Sstevel@tonic-gate * Check the comment in fasttrap.h when changing these offsets or adding 1837c478bd9Sstevel@tonic-gate * new instructions. 1847c478bd9Sstevel@tonic-gate */ 1857c478bd9Sstevel@tonic-gate #define FASTTRAP_OFF_SAVE 64 1867c478bd9Sstevel@tonic-gate #define FASTTRAP_OFF_RESTORE 68 1877c478bd9Sstevel@tonic-gate #define FASTTRAP_OFF_FTRET 72 1887c478bd9Sstevel@tonic-gate #define FASTTRAP_OFF_RETURN 76 1897c478bd9Sstevel@tonic-gate 1907c478bd9Sstevel@tonic-gate #define BREAKPOINT_INSTR 0x91d02001 /* ta 1 */ 1917c478bd9Sstevel@tonic-gate 1927c478bd9Sstevel@tonic-gate /* 1937c478bd9Sstevel@tonic-gate * Tunable to let users turn off the fancy save instruction optimization. 1947c478bd9Sstevel@tonic-gate * If a program is non-ABI compliant, there's a possibility that the save 1957c478bd9Sstevel@tonic-gate * instruction optimization could cause an error. 1967c478bd9Sstevel@tonic-gate */ 1977c478bd9Sstevel@tonic-gate int fasttrap_optimize_save = 1; 1987c478bd9Sstevel@tonic-gate 1997c478bd9Sstevel@tonic-gate static uint64_t 2007c478bd9Sstevel@tonic-gate fasttrap_anarg(struct regs *rp, int argno) 2017c478bd9Sstevel@tonic-gate { 2027c478bd9Sstevel@tonic-gate uint64_t value; 2037c478bd9Sstevel@tonic-gate 2047c478bd9Sstevel@tonic-gate if (argno < 6) 2057c478bd9Sstevel@tonic-gate return ((&rp->r_o0)[argno]); 2067c478bd9Sstevel@tonic-gate 2077c478bd9Sstevel@tonic-gate if (curproc->p_model == DATAMODEL_NATIVE) { 2087c478bd9Sstevel@tonic-gate struct frame *fr = (struct frame *)(rp->r_sp + STACK_BIAS); 2097c478bd9Sstevel@tonic-gate 2107c478bd9Sstevel@tonic-gate DTRACE_CPUFLAG_SET(CPU_DTRACE_NOFAULT); 2117c478bd9Sstevel@tonic-gate value = dtrace_fulword(&fr->fr_argd[argno]); 2127c478bd9Sstevel@tonic-gate DTRACE_CPUFLAG_CLEAR(CPU_DTRACE_NOFAULT | CPU_DTRACE_BADADDR | 2137c478bd9Sstevel@tonic-gate CPU_DTRACE_BADALIGN); 2147c478bd9Sstevel@tonic-gate } else { 2157c478bd9Sstevel@tonic-gate struct frame32 *fr = (struct frame32 *)rp->r_sp; 2167c478bd9Sstevel@tonic-gate 2177c478bd9Sstevel@tonic-gate DTRACE_CPUFLAG_SET(CPU_DTRACE_NOFAULT); 2187c478bd9Sstevel@tonic-gate value = dtrace_fuword32(&fr->fr_argd[argno]); 2197c478bd9Sstevel@tonic-gate DTRACE_CPUFLAG_CLEAR(CPU_DTRACE_NOFAULT | CPU_DTRACE_BADADDR | 2207c478bd9Sstevel@tonic-gate CPU_DTRACE_BADALIGN); 2217c478bd9Sstevel@tonic-gate } 2227c478bd9Sstevel@tonic-gate 2237c478bd9Sstevel@tonic-gate return (value); 2247c478bd9Sstevel@tonic-gate } 2257c478bd9Sstevel@tonic-gate 2267c478bd9Sstevel@tonic-gate static ulong_t fasttrap_getreg(struct regs *, uint_t); 2277c478bd9Sstevel@tonic-gate static void fasttrap_putreg(struct regs *, uint_t, ulong_t); 2287c478bd9Sstevel@tonic-gate 2297c478bd9Sstevel@tonic-gate int 2307c478bd9Sstevel@tonic-gate fasttrap_probe(struct regs *rp) 2317c478bd9Sstevel@tonic-gate { 2327c478bd9Sstevel@tonic-gate dtrace_probe(fasttrap_probe_id, 2337c478bd9Sstevel@tonic-gate rp->r_o0, rp->r_o1, rp->r_o2, rp->r_o3, rp->r_o4); 2347c478bd9Sstevel@tonic-gate 2357c478bd9Sstevel@tonic-gate rp->r_pc = rp->r_npc; 2367c478bd9Sstevel@tonic-gate rp->r_npc = rp->r_pc + 4; 2377c478bd9Sstevel@tonic-gate 2387c478bd9Sstevel@tonic-gate return (0); 2397c478bd9Sstevel@tonic-gate } 2407c478bd9Sstevel@tonic-gate 2417c478bd9Sstevel@tonic-gate static void 2427c478bd9Sstevel@tonic-gate fasttrap_usdt_args(fasttrap_probe_t *probe, struct regs *rp, int argc, 2437c478bd9Sstevel@tonic-gate uintptr_t *argv) 2447c478bd9Sstevel@tonic-gate { 2457c478bd9Sstevel@tonic-gate int i, x, cap = MIN(argc, probe->ftp_nargs); 2467c478bd9Sstevel@tonic-gate 2477c478bd9Sstevel@tonic-gate if (curproc->p_model == DATAMODEL_NATIVE) { 2487c478bd9Sstevel@tonic-gate struct frame *fr = (struct frame *)(rp->r_sp + STACK_BIAS); 2497c478bd9Sstevel@tonic-gate uintptr_t v; 2507c478bd9Sstevel@tonic-gate 2517c478bd9Sstevel@tonic-gate for (i = 0; i < cap; i++) { 2527c478bd9Sstevel@tonic-gate x = probe->ftp_argmap[i]; 2537c478bd9Sstevel@tonic-gate 2547c478bd9Sstevel@tonic-gate if (x < 6) 2557c478bd9Sstevel@tonic-gate argv[i] = (&rp->r_o0)[x]; 2567c478bd9Sstevel@tonic-gate else if (fasttrap_fulword(&fr->fr_argd[x], &v) != 0) 2577c478bd9Sstevel@tonic-gate argv[i] = 0; 2587c478bd9Sstevel@tonic-gate } 2597c478bd9Sstevel@tonic-gate 2607c478bd9Sstevel@tonic-gate } else { 2617c478bd9Sstevel@tonic-gate struct frame32 *fr = (struct frame32 *)rp->r_sp; 2627c478bd9Sstevel@tonic-gate uint32_t v; 2637c478bd9Sstevel@tonic-gate 2647c478bd9Sstevel@tonic-gate for (i = 0; i < cap; i++) { 2657c478bd9Sstevel@tonic-gate x = probe->ftp_argmap[i]; 2667c478bd9Sstevel@tonic-gate 2677c478bd9Sstevel@tonic-gate if (x < 6) 2687c478bd9Sstevel@tonic-gate argv[i] = (&rp->r_o0)[x]; 2697c478bd9Sstevel@tonic-gate else if (fasttrap_fuword32(&fr->fr_argd[x], &v) != 0) 2707c478bd9Sstevel@tonic-gate argv[i] = 0; 2717c478bd9Sstevel@tonic-gate } 2727c478bd9Sstevel@tonic-gate } 2737c478bd9Sstevel@tonic-gate 2747c478bd9Sstevel@tonic-gate for (; i < argc; i++) { 2757c478bd9Sstevel@tonic-gate argv[i] = 0; 2767c478bd9Sstevel@tonic-gate } 2777c478bd9Sstevel@tonic-gate } 2787c478bd9Sstevel@tonic-gate 2797c478bd9Sstevel@tonic-gate static void 2807c478bd9Sstevel@tonic-gate fasttrap_return_common(struct regs *rp, uintptr_t pc, pid_t pid, 2817c478bd9Sstevel@tonic-gate uint_t fake_restore) 2827c478bd9Sstevel@tonic-gate { 2837c478bd9Sstevel@tonic-gate fasttrap_tracepoint_t *tp; 2847c478bd9Sstevel@tonic-gate fasttrap_bucket_t *bucket; 2857c478bd9Sstevel@tonic-gate fasttrap_id_t *id; 2867c478bd9Sstevel@tonic-gate kmutex_t *pid_mtx; 2877c478bd9Sstevel@tonic-gate dtrace_icookie_t cookie; 2887c478bd9Sstevel@tonic-gate 2897c478bd9Sstevel@tonic-gate pid_mtx = &cpu_core[CPU->cpu_id].cpuc_pid_lock; 2907c478bd9Sstevel@tonic-gate mutex_enter(pid_mtx); 2917c478bd9Sstevel@tonic-gate bucket = &fasttrap_tpoints.fth_table[FASTTRAP_TPOINTS_INDEX(pid, pc)]; 2927c478bd9Sstevel@tonic-gate 2937c478bd9Sstevel@tonic-gate for (tp = bucket->ftb_data; tp != NULL; tp = tp->ftt_next) { 2947c478bd9Sstevel@tonic-gate if (pid == tp->ftt_pid && pc == tp->ftt_pc && 295b096140dSahl !tp->ftt_proc->ftpc_defunct) 2967c478bd9Sstevel@tonic-gate break; 2977c478bd9Sstevel@tonic-gate } 2987c478bd9Sstevel@tonic-gate 2997c478bd9Sstevel@tonic-gate /* 3007c478bd9Sstevel@tonic-gate * Don't sweat it if we can't find the tracepoint again; unlike 3017c478bd9Sstevel@tonic-gate * when we're in fasttrap_pid_probe(), finding the tracepoint here 3027c478bd9Sstevel@tonic-gate * is not essential to the correct execution of the process. 3037c478bd9Sstevel@tonic-gate */ 3047c478bd9Sstevel@tonic-gate if (tp == NULL || tp->ftt_retids == NULL) { 3057c478bd9Sstevel@tonic-gate mutex_exit(pid_mtx); 3067c478bd9Sstevel@tonic-gate return; 3077c478bd9Sstevel@tonic-gate } 3087c478bd9Sstevel@tonic-gate 3097c478bd9Sstevel@tonic-gate for (id = tp->ftt_retids; id != NULL; id = id->fti_next) { 3107c478bd9Sstevel@tonic-gate fasttrap_probe_t *probe = id->fti_probe; 3117c478bd9Sstevel@tonic-gate 3127c478bd9Sstevel@tonic-gate if (probe->ftp_type == DTFTP_POST_OFFSETS) { 3137c478bd9Sstevel@tonic-gate if (probe->ftp_argmap == NULL) { 3147c478bd9Sstevel@tonic-gate dtrace_probe(probe->ftp_id, rp->r_o0, rp->r_o1, 3157c478bd9Sstevel@tonic-gate rp->r_o2, rp->r_o3, rp->r_o4); 3167c478bd9Sstevel@tonic-gate } else { 3177c478bd9Sstevel@tonic-gate uintptr_t t[5]; 3187c478bd9Sstevel@tonic-gate 3197c478bd9Sstevel@tonic-gate fasttrap_usdt_args(probe, rp, 3207c478bd9Sstevel@tonic-gate sizeof (t) / sizeof (t[0]), t); 3217c478bd9Sstevel@tonic-gate 3227c478bd9Sstevel@tonic-gate dtrace_probe(probe->ftp_id, t[0], t[1], 3237c478bd9Sstevel@tonic-gate t[2], t[3], t[4]); 3247c478bd9Sstevel@tonic-gate } 3257c478bd9Sstevel@tonic-gate continue; 3267c478bd9Sstevel@tonic-gate } 3277c478bd9Sstevel@tonic-gate 3287c478bd9Sstevel@tonic-gate /* 3297c478bd9Sstevel@tonic-gate * If this is only a possible return point, we must 3307c478bd9Sstevel@tonic-gate * be looking at a potential tail call in leaf context. 3317c478bd9Sstevel@tonic-gate * If the %npc is still within this function, then we 3327c478bd9Sstevel@tonic-gate * must have misidentified a jmpl as a tail-call when it 3337c478bd9Sstevel@tonic-gate * is, in fact, part of a jump table. It would be nice to 3347c478bd9Sstevel@tonic-gate * remove this tracepoint, but this is neither the time 3357c478bd9Sstevel@tonic-gate * nor the place. 3367c478bd9Sstevel@tonic-gate */ 3377c478bd9Sstevel@tonic-gate if ((tp->ftt_flags & FASTTRAP_F_RETMAYBE) && 3387c478bd9Sstevel@tonic-gate rp->r_npc - probe->ftp_faddr < probe->ftp_fsize) 3397c478bd9Sstevel@tonic-gate continue; 3407c478bd9Sstevel@tonic-gate 3417c478bd9Sstevel@tonic-gate /* 3427c478bd9Sstevel@tonic-gate * It's possible for a function to branch to the delay slot 3437c478bd9Sstevel@tonic-gate * of an instruction that we've identified as a return site. 3447c478bd9Sstevel@tonic-gate * We can dectect this spurious return probe activation by 3457c478bd9Sstevel@tonic-gate * observing that in this case %npc will be %pc + 4 and %npc 3467c478bd9Sstevel@tonic-gate * will be inside the current function (unless the user is 3477c478bd9Sstevel@tonic-gate * doing _crazy_ instruction picking in which case there's 3487c478bd9Sstevel@tonic-gate * very little we can do). The second check is important 3497c478bd9Sstevel@tonic-gate * in case the last instructions of a function make a tail- 3507c478bd9Sstevel@tonic-gate * call to the function located immediately subsequent. 3517c478bd9Sstevel@tonic-gate */ 3527c478bd9Sstevel@tonic-gate if (rp->r_npc == rp->r_pc + 4 && 3537c478bd9Sstevel@tonic-gate rp->r_npc - probe->ftp_faddr < probe->ftp_fsize) 3547c478bd9Sstevel@tonic-gate continue; 3557c478bd9Sstevel@tonic-gate 3567c478bd9Sstevel@tonic-gate /* 3577c478bd9Sstevel@tonic-gate * The first argument is the offset of return tracepoint 3587c478bd9Sstevel@tonic-gate * in the function; the remaining arguments are the return 3597c478bd9Sstevel@tonic-gate * values. 3607c478bd9Sstevel@tonic-gate * 3617c478bd9Sstevel@tonic-gate * If fake_restore is set, we need to pull the return values 3627c478bd9Sstevel@tonic-gate * out of the %i's rather than the %o's -- a little trickier. 3637c478bd9Sstevel@tonic-gate */ 3647c478bd9Sstevel@tonic-gate if (!fake_restore) { 3657c478bd9Sstevel@tonic-gate dtrace_probe(probe->ftp_id, pc - probe->ftp_faddr, 3667c478bd9Sstevel@tonic-gate rp->r_o0, rp->r_o1, rp->r_o2, rp->r_o3); 3677c478bd9Sstevel@tonic-gate } else { 3687c478bd9Sstevel@tonic-gate uintptr_t arg0 = fasttrap_getreg(rp, R_I0); 3697c478bd9Sstevel@tonic-gate uintptr_t arg1 = fasttrap_getreg(rp, R_I1); 3707c478bd9Sstevel@tonic-gate uintptr_t arg2 = fasttrap_getreg(rp, R_I2); 3717c478bd9Sstevel@tonic-gate uintptr_t arg3 = fasttrap_getreg(rp, R_I3); 3727c478bd9Sstevel@tonic-gate 3737c478bd9Sstevel@tonic-gate cookie = dtrace_interrupt_disable(); 3747c478bd9Sstevel@tonic-gate DTRACE_CPUFLAG_SET(CPU_DTRACE_FAKERESTORE); 3757c478bd9Sstevel@tonic-gate dtrace_probe(probe->ftp_id, pc - probe->ftp_faddr, 3767c478bd9Sstevel@tonic-gate arg0, arg1, arg2, arg3); 3777c478bd9Sstevel@tonic-gate DTRACE_CPUFLAG_CLEAR(CPU_DTRACE_FAKERESTORE); 3787c478bd9Sstevel@tonic-gate dtrace_interrupt_enable(cookie); 3797c478bd9Sstevel@tonic-gate } 3807c478bd9Sstevel@tonic-gate } 3817c478bd9Sstevel@tonic-gate 3827c478bd9Sstevel@tonic-gate mutex_exit(pid_mtx); 3837c478bd9Sstevel@tonic-gate } 3847c478bd9Sstevel@tonic-gate 3857c478bd9Sstevel@tonic-gate int 3867c478bd9Sstevel@tonic-gate fasttrap_pid_probe(struct regs *rp) 3877c478bd9Sstevel@tonic-gate { 3887c478bd9Sstevel@tonic-gate proc_t *p = curproc; 3897c478bd9Sstevel@tonic-gate fasttrap_tracepoint_t *tp, tp_local; 3907c478bd9Sstevel@tonic-gate fasttrap_id_t *id; 3917c478bd9Sstevel@tonic-gate pid_t pid; 3927c478bd9Sstevel@tonic-gate uintptr_t pc = rp->r_pc; 3937c478bd9Sstevel@tonic-gate uintptr_t npc = rp->r_npc; 3947c478bd9Sstevel@tonic-gate uintptr_t orig_pc = pc; 3957c478bd9Sstevel@tonic-gate fasttrap_bucket_t *bucket; 3967c478bd9Sstevel@tonic-gate kmutex_t *pid_mtx; 3977c478bd9Sstevel@tonic-gate uint_t fake_restore = 0; 3987c478bd9Sstevel@tonic-gate dtrace_icookie_t cookie; 3997c478bd9Sstevel@tonic-gate 4007c478bd9Sstevel@tonic-gate /* 4017c478bd9Sstevel@tonic-gate * It's possible that a user (in a veritable orgy of bad planning) 4027c478bd9Sstevel@tonic-gate * could redirect this thread's flow of control before it reached the 4037c478bd9Sstevel@tonic-gate * return probe fasttrap. In this case we need to kill the process 4047c478bd9Sstevel@tonic-gate * since it's in a unrecoverable state. 4057c478bd9Sstevel@tonic-gate */ 4067c478bd9Sstevel@tonic-gate if (curthread->t_dtrace_step) { 4077c478bd9Sstevel@tonic-gate ASSERT(curthread->t_dtrace_on); 4087c478bd9Sstevel@tonic-gate fasttrap_sigtrap(p, curthread, pc); 4097c478bd9Sstevel@tonic-gate return (0); 4107c478bd9Sstevel@tonic-gate } 4117c478bd9Sstevel@tonic-gate 4127c478bd9Sstevel@tonic-gate /* 4137c478bd9Sstevel@tonic-gate * Clear all user tracing flags. 4147c478bd9Sstevel@tonic-gate */ 4157c478bd9Sstevel@tonic-gate curthread->t_dtrace_ft = 0; 4167c478bd9Sstevel@tonic-gate curthread->t_dtrace_pc = 0; 4177c478bd9Sstevel@tonic-gate curthread->t_dtrace_npc = 0; 4187c478bd9Sstevel@tonic-gate curthread->t_dtrace_scrpc = 0; 4197c478bd9Sstevel@tonic-gate curthread->t_dtrace_astpc = 0; 4207c478bd9Sstevel@tonic-gate 4217c478bd9Sstevel@tonic-gate /* 4227c478bd9Sstevel@tonic-gate * Treat a child created by a call to vfork(2) as if it were its 4237c478bd9Sstevel@tonic-gate * parent. We know that there's only one thread of control in such a 4247c478bd9Sstevel@tonic-gate * process: this one. 4257c478bd9Sstevel@tonic-gate */ 4267c478bd9Sstevel@tonic-gate while (p->p_flag & SVFORK) { 4277c478bd9Sstevel@tonic-gate p = p->p_parent; 4287c478bd9Sstevel@tonic-gate } 4297c478bd9Sstevel@tonic-gate 4307c478bd9Sstevel@tonic-gate pid = p->p_pid; 4317c478bd9Sstevel@tonic-gate pid_mtx = &cpu_core[CPU->cpu_id].cpuc_pid_lock; 4327c478bd9Sstevel@tonic-gate mutex_enter(pid_mtx); 4337c478bd9Sstevel@tonic-gate bucket = &fasttrap_tpoints.fth_table[FASTTRAP_TPOINTS_INDEX(pid, pc)]; 4347c478bd9Sstevel@tonic-gate 4357c478bd9Sstevel@tonic-gate /* 4367c478bd9Sstevel@tonic-gate * Lookup the tracepoint that the process just hit. 4377c478bd9Sstevel@tonic-gate */ 4387c478bd9Sstevel@tonic-gate for (tp = bucket->ftb_data; tp != NULL; tp = tp->ftt_next) { 4397c478bd9Sstevel@tonic-gate if (pid == tp->ftt_pid && pc == tp->ftt_pc && 440b096140dSahl !tp->ftt_proc->ftpc_defunct) 4417c478bd9Sstevel@tonic-gate break; 4427c478bd9Sstevel@tonic-gate } 4437c478bd9Sstevel@tonic-gate 4447c478bd9Sstevel@tonic-gate /* 4457c478bd9Sstevel@tonic-gate * If we couldn't find a matching tracepoint, either a tracepoint has 4467c478bd9Sstevel@tonic-gate * been inserted without using the pid<pid> ioctl interface (see 4477c478bd9Sstevel@tonic-gate * fasttrap_ioctl), or somehow we have mislaid this tracepoint. 4487c478bd9Sstevel@tonic-gate */ 4497c478bd9Sstevel@tonic-gate if (tp == NULL) { 4507c478bd9Sstevel@tonic-gate mutex_exit(pid_mtx); 4517c478bd9Sstevel@tonic-gate return (-1); 4527c478bd9Sstevel@tonic-gate } 4537c478bd9Sstevel@tonic-gate 4547c478bd9Sstevel@tonic-gate for (id = tp->ftt_ids; id != NULL; id = id->fti_next) { 4557c478bd9Sstevel@tonic-gate fasttrap_probe_t *probe = id->fti_probe; 4567c478bd9Sstevel@tonic-gate int isentry; 4577c478bd9Sstevel@tonic-gate /* 4587c478bd9Sstevel@tonic-gate * We note that this was an entry probe to help ustack() find 4597c478bd9Sstevel@tonic-gate * the first caller. 4607c478bd9Sstevel@tonic-gate */ 4617c478bd9Sstevel@tonic-gate if ((isentry = (probe->ftp_type == DTFTP_ENTRY)) != 0) { 4627c478bd9Sstevel@tonic-gate cookie = dtrace_interrupt_disable(); 4637c478bd9Sstevel@tonic-gate DTRACE_CPUFLAG_SET(CPU_DTRACE_ENTRY); 4647c478bd9Sstevel@tonic-gate } 4657c478bd9Sstevel@tonic-gate dtrace_probe(probe->ftp_id, rp->r_o0, rp->r_o1, rp->r_o2, 4667c478bd9Sstevel@tonic-gate rp->r_o3, rp->r_o4); 4677c478bd9Sstevel@tonic-gate if (isentry) { 4687c478bd9Sstevel@tonic-gate DTRACE_CPUFLAG_CLEAR(CPU_DTRACE_ENTRY); 4697c478bd9Sstevel@tonic-gate dtrace_interrupt_enable(cookie); 4707c478bd9Sstevel@tonic-gate } 4717c478bd9Sstevel@tonic-gate } 4727c478bd9Sstevel@tonic-gate 4737c478bd9Sstevel@tonic-gate /* 4747c478bd9Sstevel@tonic-gate * We're about to do a bunch of work so we cache a local copy of 4757c478bd9Sstevel@tonic-gate * the tracepoint to emulate the instruction, and then find the 4767c478bd9Sstevel@tonic-gate * tracepoint again later if we need to light up any return probes. 4777c478bd9Sstevel@tonic-gate */ 4787c478bd9Sstevel@tonic-gate tp_local = *tp; 4797c478bd9Sstevel@tonic-gate mutex_exit(pid_mtx); 4807c478bd9Sstevel@tonic-gate tp = &tp_local; 4817c478bd9Sstevel@tonic-gate 4827c478bd9Sstevel@tonic-gate /* 4837c478bd9Sstevel@tonic-gate * We emulate certain types of instructions do ensure correctness 4847c478bd9Sstevel@tonic-gate * (in the case of position dependent instructions) or optimize 4857c478bd9Sstevel@tonic-gate * common cases. The rest we have the thread execute back in user- 4867c478bd9Sstevel@tonic-gate * land. 4877c478bd9Sstevel@tonic-gate */ 4887c478bd9Sstevel@tonic-gate switch (tp->ftt_type) { 4897c478bd9Sstevel@tonic-gate case FASTTRAP_T_SAVE: 4907c478bd9Sstevel@tonic-gate { 4917c478bd9Sstevel@tonic-gate int32_t imm; 4927c478bd9Sstevel@tonic-gate 4937c478bd9Sstevel@tonic-gate /* 4947c478bd9Sstevel@tonic-gate * This an optimization to let us handle function entry 4957c478bd9Sstevel@tonic-gate * probes more efficiently. Many functions begin with a save 4967c478bd9Sstevel@tonic-gate * instruction that follows the pattern: 4977c478bd9Sstevel@tonic-gate * save %sp, <imm>, %sp 4987c478bd9Sstevel@tonic-gate * 4997c478bd9Sstevel@tonic-gate * Meanwhile, we've stashed the instruction: 5007c478bd9Sstevel@tonic-gate * save %g1, %g0, %sp 5017c478bd9Sstevel@tonic-gate * 5027c478bd9Sstevel@tonic-gate * off of %g7, so all we have to do is stick the right value 5037c478bd9Sstevel@tonic-gate * into %g1 and reset %pc to point to the instruction we've 5047c478bd9Sstevel@tonic-gate * cleverly hidden (%npc should not be touched). 5057c478bd9Sstevel@tonic-gate */ 5067c478bd9Sstevel@tonic-gate 5077c478bd9Sstevel@tonic-gate imm = tp->ftt_instr << 19; 5087c478bd9Sstevel@tonic-gate imm >>= 19; 5097c478bd9Sstevel@tonic-gate rp->r_g1 = rp->r_sp + imm; 5107c478bd9Sstevel@tonic-gate pc = rp->r_g7 + FASTTRAP_OFF_SAVE; 5117c478bd9Sstevel@tonic-gate break; 5127c478bd9Sstevel@tonic-gate } 5137c478bd9Sstevel@tonic-gate 5147c478bd9Sstevel@tonic-gate case FASTTRAP_T_RESTORE: 5157c478bd9Sstevel@tonic-gate { 5167c478bd9Sstevel@tonic-gate ulong_t value; 5177c478bd9Sstevel@tonic-gate uint_t rd; 5187c478bd9Sstevel@tonic-gate 5197c478bd9Sstevel@tonic-gate /* 5207c478bd9Sstevel@tonic-gate * This is an optimization to let us handle function 5217c478bd9Sstevel@tonic-gate * return probes more efficiently. Most non-leaf functions 5227c478bd9Sstevel@tonic-gate * end with the sequence: 5237c478bd9Sstevel@tonic-gate * ret 5247c478bd9Sstevel@tonic-gate * restore <reg>, <reg_or_imm>, %oX 5257c478bd9Sstevel@tonic-gate * 5267c478bd9Sstevel@tonic-gate * We've stashed the instruction: 5277c478bd9Sstevel@tonic-gate * restore %g0, %g0, %g0 5287c478bd9Sstevel@tonic-gate * 5297c478bd9Sstevel@tonic-gate * off of %g7 so we just need to place the correct value 5307c478bd9Sstevel@tonic-gate * in the right %i register (since after our fake-o 5317c478bd9Sstevel@tonic-gate * restore, the %i's will become the %o's) and set the %pc 5327c478bd9Sstevel@tonic-gate * to point to our hidden restore. We also set fake_restore to 5337c478bd9Sstevel@tonic-gate * let fasttrap_return_common() know that it will find the 5347c478bd9Sstevel@tonic-gate * return values in the %i's rather than the %o's. 5357c478bd9Sstevel@tonic-gate */ 5367c478bd9Sstevel@tonic-gate 5377c478bd9Sstevel@tonic-gate if (I(tp->ftt_instr)) { 5387c478bd9Sstevel@tonic-gate int32_t imm; 5397c478bd9Sstevel@tonic-gate 5407c478bd9Sstevel@tonic-gate imm = tp->ftt_instr << 19; 5417c478bd9Sstevel@tonic-gate imm >>= 19; 5427c478bd9Sstevel@tonic-gate value = fasttrap_getreg(rp, RS1(tp->ftt_instr)) + imm; 5437c478bd9Sstevel@tonic-gate } else { 5447c478bd9Sstevel@tonic-gate value = fasttrap_getreg(rp, RS1(tp->ftt_instr)) + 5457c478bd9Sstevel@tonic-gate fasttrap_getreg(rp, RS2(tp->ftt_instr)); 5467c478bd9Sstevel@tonic-gate } 5477c478bd9Sstevel@tonic-gate 5487c478bd9Sstevel@tonic-gate /* 5497c478bd9Sstevel@tonic-gate * Convert %o's to %i's; leave %g's as they are. 5507c478bd9Sstevel@tonic-gate */ 5517c478bd9Sstevel@tonic-gate rd = RD(tp->ftt_instr); 5527c478bd9Sstevel@tonic-gate fasttrap_putreg(rp, ((rd & 0x18) == 0x8) ? rd + 16 : rd, value); 5537c478bd9Sstevel@tonic-gate 5547c478bd9Sstevel@tonic-gate pc = rp->r_g7 + FASTTRAP_OFF_RESTORE; 5557c478bd9Sstevel@tonic-gate fake_restore = 1; 5567c478bd9Sstevel@tonic-gate break; 5577c478bd9Sstevel@tonic-gate } 5587c478bd9Sstevel@tonic-gate 5597c478bd9Sstevel@tonic-gate case FASTTRAP_T_RETURN: 5607c478bd9Sstevel@tonic-gate { 5617c478bd9Sstevel@tonic-gate uintptr_t target; 5627c478bd9Sstevel@tonic-gate 5637c478bd9Sstevel@tonic-gate /* 5647c478bd9Sstevel@tonic-gate * A return instruction is like a jmpl (without the link 5657c478bd9Sstevel@tonic-gate * part) that executes an implicit restore. We've stashed 5667c478bd9Sstevel@tonic-gate * the instruction: 5677c478bd9Sstevel@tonic-gate * return %o0 5687c478bd9Sstevel@tonic-gate * 5697c478bd9Sstevel@tonic-gate * off of %g7 so we just need to place the target in %o0 5707c478bd9Sstevel@tonic-gate * and set the %pc to point to the stashed return instruction. 5717c478bd9Sstevel@tonic-gate * We use %o0 since that register disappears after the return 5727c478bd9Sstevel@tonic-gate * executes, erasing any evidence of this tampering. 5737c478bd9Sstevel@tonic-gate */ 5747c478bd9Sstevel@tonic-gate if (I(tp->ftt_instr)) { 5757c478bd9Sstevel@tonic-gate int32_t imm; 5767c478bd9Sstevel@tonic-gate 5777c478bd9Sstevel@tonic-gate imm = tp->ftt_instr << 19; 5787c478bd9Sstevel@tonic-gate imm >>= 19; 5797c478bd9Sstevel@tonic-gate target = fasttrap_getreg(rp, RS1(tp->ftt_instr)) + imm; 5807c478bd9Sstevel@tonic-gate } else { 5817c478bd9Sstevel@tonic-gate target = fasttrap_getreg(rp, RS1(tp->ftt_instr)) + 5827c478bd9Sstevel@tonic-gate fasttrap_getreg(rp, RS2(tp->ftt_instr)); 5837c478bd9Sstevel@tonic-gate } 5847c478bd9Sstevel@tonic-gate 5857c478bd9Sstevel@tonic-gate fasttrap_putreg(rp, R_O0, target); 5867c478bd9Sstevel@tonic-gate 5877c478bd9Sstevel@tonic-gate pc = rp->r_g7 + FASTTRAP_OFF_RETURN; 5887c478bd9Sstevel@tonic-gate fake_restore = 1; 5897c478bd9Sstevel@tonic-gate break; 5907c478bd9Sstevel@tonic-gate } 5917c478bd9Sstevel@tonic-gate 5927c478bd9Sstevel@tonic-gate case FASTTRAP_T_OR: 5937c478bd9Sstevel@tonic-gate { 5947c478bd9Sstevel@tonic-gate ulong_t value; 5957c478bd9Sstevel@tonic-gate 5967c478bd9Sstevel@tonic-gate if (I(tp->ftt_instr)) { 5977c478bd9Sstevel@tonic-gate int32_t imm; 5987c478bd9Sstevel@tonic-gate 5997c478bd9Sstevel@tonic-gate imm = tp->ftt_instr << 19; 6007c478bd9Sstevel@tonic-gate imm >>= 19; 6017c478bd9Sstevel@tonic-gate value = fasttrap_getreg(rp, RS1(tp->ftt_instr)) | imm; 6027c478bd9Sstevel@tonic-gate } else { 6037c478bd9Sstevel@tonic-gate value = fasttrap_getreg(rp, RS1(tp->ftt_instr)) | 6047c478bd9Sstevel@tonic-gate fasttrap_getreg(rp, RS2(tp->ftt_instr)); 6057c478bd9Sstevel@tonic-gate } 6067c478bd9Sstevel@tonic-gate 6077c478bd9Sstevel@tonic-gate fasttrap_putreg(rp, RD(tp->ftt_instr), value); 6087c478bd9Sstevel@tonic-gate pc = rp->r_npc; 6097c478bd9Sstevel@tonic-gate npc = pc + 4; 6107c478bd9Sstevel@tonic-gate break; 6117c478bd9Sstevel@tonic-gate } 6127c478bd9Sstevel@tonic-gate 6137c478bd9Sstevel@tonic-gate case FASTTRAP_T_SETHI: 6147c478bd9Sstevel@tonic-gate if (RD(tp->ftt_instr) != R_G0) { 6157c478bd9Sstevel@tonic-gate uint32_t imm32 = tp->ftt_instr << 10; 6167c478bd9Sstevel@tonic-gate fasttrap_putreg(rp, RD(tp->ftt_instr), (ulong_t)imm32); 6177c478bd9Sstevel@tonic-gate } 6187c478bd9Sstevel@tonic-gate pc = rp->r_npc; 6197c478bd9Sstevel@tonic-gate npc = pc + 4; 6207c478bd9Sstevel@tonic-gate break; 6217c478bd9Sstevel@tonic-gate 6227c478bd9Sstevel@tonic-gate case FASTTRAP_T_CCR: 6237c478bd9Sstevel@tonic-gate { 6247c478bd9Sstevel@tonic-gate uint_t c, v, z, n, taken; 6257c478bd9Sstevel@tonic-gate uint_t ccr = rp->r_tstate >> TSTATE_CCR_SHIFT; 6267c478bd9Sstevel@tonic-gate 6277c478bd9Sstevel@tonic-gate if (tp->ftt_cc != 0) 6287c478bd9Sstevel@tonic-gate ccr >>= 4; 6297c478bd9Sstevel@tonic-gate 6307c478bd9Sstevel@tonic-gate c = (ccr >> 0) & 1; 6317c478bd9Sstevel@tonic-gate v = (ccr >> 1) & 1; 6327c478bd9Sstevel@tonic-gate z = (ccr >> 2) & 1; 6337c478bd9Sstevel@tonic-gate n = (ccr >> 3) & 1; 6347c478bd9Sstevel@tonic-gate 6357c478bd9Sstevel@tonic-gate switch (tp->ftt_code) { 6367c478bd9Sstevel@tonic-gate case 0x0: /* BN */ 6377c478bd9Sstevel@tonic-gate taken = 0; break; 6387c478bd9Sstevel@tonic-gate case 0x1: /* BE */ 6397c478bd9Sstevel@tonic-gate taken = z; break; 6407c478bd9Sstevel@tonic-gate case 0x2: /* BLE */ 6417c478bd9Sstevel@tonic-gate taken = z | (n ^ v); break; 6427c478bd9Sstevel@tonic-gate case 0x3: /* BL */ 6437c478bd9Sstevel@tonic-gate taken = n ^ v; break; 6447c478bd9Sstevel@tonic-gate case 0x4: /* BLEU */ 6457c478bd9Sstevel@tonic-gate taken = c | z; break; 6467c478bd9Sstevel@tonic-gate case 0x5: /* BCS (BLU) */ 6477c478bd9Sstevel@tonic-gate taken = c; break; 6487c478bd9Sstevel@tonic-gate case 0x6: /* BNEG */ 6497c478bd9Sstevel@tonic-gate taken = n; break; 6507c478bd9Sstevel@tonic-gate case 0x7: /* BVS */ 6517c478bd9Sstevel@tonic-gate taken = v; break; 6527c478bd9Sstevel@tonic-gate case 0x8: /* BA */ 6537c478bd9Sstevel@tonic-gate /* 6547c478bd9Sstevel@tonic-gate * We handle the BA case differently since the annul 6557c478bd9Sstevel@tonic-gate * bit means something slightly different. 6567c478bd9Sstevel@tonic-gate */ 6577c478bd9Sstevel@tonic-gate panic("fasttrap: mishandled a branch"); 6587c478bd9Sstevel@tonic-gate taken = 1; break; 6597c478bd9Sstevel@tonic-gate case 0x9: /* BNE */ 6607c478bd9Sstevel@tonic-gate taken = ~z; break; 6617c478bd9Sstevel@tonic-gate case 0xa: /* BG */ 6627c478bd9Sstevel@tonic-gate taken = ~(z | (n ^ v)); break; 6637c478bd9Sstevel@tonic-gate case 0xb: /* BGE */ 6647c478bd9Sstevel@tonic-gate taken = ~(n ^ v); break; 6657c478bd9Sstevel@tonic-gate case 0xc: /* BGU */ 6667c478bd9Sstevel@tonic-gate taken = ~(c | z); break; 6677c478bd9Sstevel@tonic-gate case 0xd: /* BCC (BGEU) */ 6687c478bd9Sstevel@tonic-gate taken = ~c; break; 6697c478bd9Sstevel@tonic-gate case 0xe: /* BPOS */ 6707c478bd9Sstevel@tonic-gate taken = ~n; break; 6717c478bd9Sstevel@tonic-gate case 0xf: /* BVC */ 6727c478bd9Sstevel@tonic-gate taken = ~v; break; 6737c478bd9Sstevel@tonic-gate } 6747c478bd9Sstevel@tonic-gate 6757c478bd9Sstevel@tonic-gate if (taken & 1) { 6767c478bd9Sstevel@tonic-gate pc = rp->r_npc; 6777c478bd9Sstevel@tonic-gate npc = tp->ftt_dest; 6787c478bd9Sstevel@tonic-gate } else if (tp->ftt_flags & FASTTRAP_F_ANNUL) { 6797c478bd9Sstevel@tonic-gate /* 6807c478bd9Sstevel@tonic-gate * Untaken annulled branches don't execute the 6817c478bd9Sstevel@tonic-gate * instruction in the delay slot. 6827c478bd9Sstevel@tonic-gate */ 6837c478bd9Sstevel@tonic-gate pc = rp->r_npc + 4; 6847c478bd9Sstevel@tonic-gate npc = pc + 4; 6857c478bd9Sstevel@tonic-gate } else { 6867c478bd9Sstevel@tonic-gate pc = rp->r_npc; 6877c478bd9Sstevel@tonic-gate npc = pc + 4; 6887c478bd9Sstevel@tonic-gate } 6897c478bd9Sstevel@tonic-gate break; 6907c478bd9Sstevel@tonic-gate } 6917c478bd9Sstevel@tonic-gate 6927c478bd9Sstevel@tonic-gate case FASTTRAP_T_FCC: 6937c478bd9Sstevel@tonic-gate { 6947c478bd9Sstevel@tonic-gate uint_t fcc; 6957c478bd9Sstevel@tonic-gate uint_t taken; 6967c478bd9Sstevel@tonic-gate uint64_t fsr; 6977c478bd9Sstevel@tonic-gate 6987c478bd9Sstevel@tonic-gate dtrace_getfsr(&fsr); 6997c478bd9Sstevel@tonic-gate 7007c478bd9Sstevel@tonic-gate if (tp->ftt_cc == 0) { 7017c478bd9Sstevel@tonic-gate fcc = (fsr >> 10) & 0x3; 7027c478bd9Sstevel@tonic-gate } else { 7037c478bd9Sstevel@tonic-gate uint_t shift; 7047c478bd9Sstevel@tonic-gate ASSERT(tp->ftt_cc <= 3); 7057c478bd9Sstevel@tonic-gate shift = 30 + tp->ftt_cc * 2; 7067c478bd9Sstevel@tonic-gate fcc = (fsr >> shift) & 0x3; 7077c478bd9Sstevel@tonic-gate } 7087c478bd9Sstevel@tonic-gate 7097c478bd9Sstevel@tonic-gate switch (tp->ftt_code) { 7107c478bd9Sstevel@tonic-gate case 0x0: /* FBN */ 7117c478bd9Sstevel@tonic-gate taken = (1 << fcc) & (0|0|0|0); break; 7127c478bd9Sstevel@tonic-gate case 0x1: /* FBNE */ 7137c478bd9Sstevel@tonic-gate taken = (1 << fcc) & (8|4|2|0); break; 7147c478bd9Sstevel@tonic-gate case 0x2: /* FBLG */ 7157c478bd9Sstevel@tonic-gate taken = (1 << fcc) & (0|4|2|0); break; 7167c478bd9Sstevel@tonic-gate case 0x3: /* FBUL */ 7177c478bd9Sstevel@tonic-gate taken = (1 << fcc) & (8|0|2|0); break; 7187c478bd9Sstevel@tonic-gate case 0x4: /* FBL */ 7197c478bd9Sstevel@tonic-gate taken = (1 << fcc) & (0|0|2|0); break; 7207c478bd9Sstevel@tonic-gate case 0x5: /* FBUG */ 7217c478bd9Sstevel@tonic-gate taken = (1 << fcc) & (8|4|0|0); break; 7227c478bd9Sstevel@tonic-gate case 0x6: /* FBG */ 7237c478bd9Sstevel@tonic-gate taken = (1 << fcc) & (0|4|0|0); break; 7247c478bd9Sstevel@tonic-gate case 0x7: /* FBU */ 7257c478bd9Sstevel@tonic-gate taken = (1 << fcc) & (8|0|0|0); break; 7267c478bd9Sstevel@tonic-gate case 0x8: /* FBA */ 7277c478bd9Sstevel@tonic-gate /* 7287c478bd9Sstevel@tonic-gate * We handle the FBA case differently since the annul 7297c478bd9Sstevel@tonic-gate * bit means something slightly different. 7307c478bd9Sstevel@tonic-gate */ 7317c478bd9Sstevel@tonic-gate panic("fasttrap: mishandled a branch"); 7327c478bd9Sstevel@tonic-gate taken = (1 << fcc) & (8|4|2|1); break; 7337c478bd9Sstevel@tonic-gate case 0x9: /* FBE */ 7347c478bd9Sstevel@tonic-gate taken = (1 << fcc) & (0|0|0|1); break; 7357c478bd9Sstevel@tonic-gate case 0xa: /* FBUE */ 7367c478bd9Sstevel@tonic-gate taken = (1 << fcc) & (8|0|0|1); break; 7377c478bd9Sstevel@tonic-gate case 0xb: /* FBGE */ 7387c478bd9Sstevel@tonic-gate taken = (1 << fcc) & (0|4|0|1); break; 7397c478bd9Sstevel@tonic-gate case 0xc: /* FBUGE */ 7407c478bd9Sstevel@tonic-gate taken = (1 << fcc) & (8|4|0|1); break; 7417c478bd9Sstevel@tonic-gate case 0xd: /* FBLE */ 7427c478bd9Sstevel@tonic-gate taken = (1 << fcc) & (0|0|2|1); break; 7437c478bd9Sstevel@tonic-gate case 0xe: /* FBULE */ 7447c478bd9Sstevel@tonic-gate taken = (1 << fcc) & (8|0|2|1); break; 7457c478bd9Sstevel@tonic-gate case 0xf: /* FBO */ 7467c478bd9Sstevel@tonic-gate taken = (1 << fcc) & (0|4|2|1); break; 7477c478bd9Sstevel@tonic-gate } 7487c478bd9Sstevel@tonic-gate 7497c478bd9Sstevel@tonic-gate if (taken) { 7507c478bd9Sstevel@tonic-gate pc = rp->r_npc; 7517c478bd9Sstevel@tonic-gate npc = tp->ftt_dest; 7527c478bd9Sstevel@tonic-gate } else if (tp->ftt_flags & FASTTRAP_F_ANNUL) { 7537c478bd9Sstevel@tonic-gate /* 7547c478bd9Sstevel@tonic-gate * Untaken annulled branches don't execute the 7557c478bd9Sstevel@tonic-gate * instruction in the delay slot. 7567c478bd9Sstevel@tonic-gate */ 7577c478bd9Sstevel@tonic-gate pc = rp->r_npc + 4; 7587c478bd9Sstevel@tonic-gate npc = pc + 4; 7597c478bd9Sstevel@tonic-gate } else { 7607c478bd9Sstevel@tonic-gate pc = rp->r_npc; 7617c478bd9Sstevel@tonic-gate npc = pc + 4; 7627c478bd9Sstevel@tonic-gate } 7637c478bd9Sstevel@tonic-gate break; 7647c478bd9Sstevel@tonic-gate } 7657c478bd9Sstevel@tonic-gate 7667c478bd9Sstevel@tonic-gate case FASTTRAP_T_REG: 7677c478bd9Sstevel@tonic-gate { 7687c478bd9Sstevel@tonic-gate uint64_t value; 7697c478bd9Sstevel@tonic-gate uint_t taken; 7707c478bd9Sstevel@tonic-gate uint_t reg = RS1(tp->ftt_instr); 7717c478bd9Sstevel@tonic-gate 7727c478bd9Sstevel@tonic-gate /* 7737c478bd9Sstevel@tonic-gate * An ILP32 process shouldn't be using a branch predicated on 7747c478bd9Sstevel@tonic-gate * an %i or an %l since it would violate the ABI. It's a 7757c478bd9Sstevel@tonic-gate * violation of the ABI because we can't ensure deterministic 7767c478bd9Sstevel@tonic-gate * behavior. We should have identified this case when we 7777c478bd9Sstevel@tonic-gate * enabled the probe. 7787c478bd9Sstevel@tonic-gate */ 7797c478bd9Sstevel@tonic-gate ASSERT(p->p_model == DATAMODEL_LP64 || reg < 16); 7807c478bd9Sstevel@tonic-gate 7817c478bd9Sstevel@tonic-gate value = fasttrap_getreg(rp, reg); 7827c478bd9Sstevel@tonic-gate 7837c478bd9Sstevel@tonic-gate switch (tp->ftt_code) { 7847c478bd9Sstevel@tonic-gate case 0x1: /* BRZ */ 7857c478bd9Sstevel@tonic-gate taken = (value == 0); break; 7867c478bd9Sstevel@tonic-gate case 0x2: /* BRLEZ */ 7877c478bd9Sstevel@tonic-gate taken = (value <= 0); break; 7887c478bd9Sstevel@tonic-gate case 0x3: /* BRLZ */ 7897c478bd9Sstevel@tonic-gate taken = (value < 0); break; 7907c478bd9Sstevel@tonic-gate case 0x5: /* BRNZ */ 7917c478bd9Sstevel@tonic-gate taken = (value != 0); break; 7927c478bd9Sstevel@tonic-gate case 0x6: /* BRGZ */ 7937c478bd9Sstevel@tonic-gate taken = (value > 0); break; 7947c478bd9Sstevel@tonic-gate case 0x7: /* BRGEZ */ 7957c478bd9Sstevel@tonic-gate taken = (value <= 0); break; 7967c478bd9Sstevel@tonic-gate default: 7977c478bd9Sstevel@tonic-gate case 0x0: 7987c478bd9Sstevel@tonic-gate case 0x4: 7997c478bd9Sstevel@tonic-gate panic("fasttrap: mishandled a branch"); 8007c478bd9Sstevel@tonic-gate } 8017c478bd9Sstevel@tonic-gate 8027c478bd9Sstevel@tonic-gate if (taken) { 8037c478bd9Sstevel@tonic-gate pc = rp->r_npc; 8047c478bd9Sstevel@tonic-gate npc = tp->ftt_dest; 8057c478bd9Sstevel@tonic-gate } else if (tp->ftt_flags & FASTTRAP_F_ANNUL) { 8067c478bd9Sstevel@tonic-gate /* 8077c478bd9Sstevel@tonic-gate * Untaken annulled branches don't execute the 8087c478bd9Sstevel@tonic-gate * instruction in the delay slot. 8097c478bd9Sstevel@tonic-gate */ 8107c478bd9Sstevel@tonic-gate pc = rp->r_npc + 4; 8117c478bd9Sstevel@tonic-gate npc = pc + 4; 8127c478bd9Sstevel@tonic-gate } else { 8137c478bd9Sstevel@tonic-gate pc = rp->r_npc; 8147c478bd9Sstevel@tonic-gate npc = pc + 4; 8157c478bd9Sstevel@tonic-gate } 8167c478bd9Sstevel@tonic-gate break; 8177c478bd9Sstevel@tonic-gate } 8187c478bd9Sstevel@tonic-gate 8197c478bd9Sstevel@tonic-gate case FASTTRAP_T_ALWAYS: 8207c478bd9Sstevel@tonic-gate /* 8217c478bd9Sstevel@tonic-gate * BAs, BA,As... 8227c478bd9Sstevel@tonic-gate */ 8237c478bd9Sstevel@tonic-gate 8247c478bd9Sstevel@tonic-gate if (tp->ftt_flags & FASTTRAP_F_ANNUL) { 8257c478bd9Sstevel@tonic-gate /* 8267c478bd9Sstevel@tonic-gate * Annulled branch always instructions never execute 8277c478bd9Sstevel@tonic-gate * the instruction in the delay slot. 8287c478bd9Sstevel@tonic-gate */ 8297c478bd9Sstevel@tonic-gate pc = tp->ftt_dest; 8307c478bd9Sstevel@tonic-gate npc = tp->ftt_dest + 4; 8317c478bd9Sstevel@tonic-gate } else { 8327c478bd9Sstevel@tonic-gate pc = rp->r_npc; 8337c478bd9Sstevel@tonic-gate npc = tp->ftt_dest; 8347c478bd9Sstevel@tonic-gate } 8357c478bd9Sstevel@tonic-gate break; 8367c478bd9Sstevel@tonic-gate 8377c478bd9Sstevel@tonic-gate case FASTTRAP_T_RDPC: 8387c478bd9Sstevel@tonic-gate fasttrap_putreg(rp, RD(tp->ftt_instr), rp->r_pc); 8397c478bd9Sstevel@tonic-gate pc = rp->r_npc; 8407c478bd9Sstevel@tonic-gate npc = pc + 4; 8417c478bd9Sstevel@tonic-gate break; 8427c478bd9Sstevel@tonic-gate 8437c478bd9Sstevel@tonic-gate case FASTTRAP_T_CALL: 8447c478bd9Sstevel@tonic-gate /* 8457c478bd9Sstevel@tonic-gate * It's a call _and_ link remember... 8467c478bd9Sstevel@tonic-gate */ 8477c478bd9Sstevel@tonic-gate rp->r_o7 = rp->r_pc; 8487c478bd9Sstevel@tonic-gate pc = rp->r_npc; 8497c478bd9Sstevel@tonic-gate npc = tp->ftt_dest; 8507c478bd9Sstevel@tonic-gate break; 8517c478bd9Sstevel@tonic-gate 8527c478bd9Sstevel@tonic-gate case FASTTRAP_T_JMPL: 8537c478bd9Sstevel@tonic-gate pc = rp->r_npc; 8547c478bd9Sstevel@tonic-gate 8557c478bd9Sstevel@tonic-gate if (I(tp->ftt_instr)) { 8567c478bd9Sstevel@tonic-gate uint_t rs1 = RS1(tp->ftt_instr); 8577c478bd9Sstevel@tonic-gate int32_t imm; 8587c478bd9Sstevel@tonic-gate 8597c478bd9Sstevel@tonic-gate imm = tp->ftt_instr << 19; 8607c478bd9Sstevel@tonic-gate imm >>= 19; 8617c478bd9Sstevel@tonic-gate npc = fasttrap_getreg(rp, rs1) + imm; 8627c478bd9Sstevel@tonic-gate } else { 8637c478bd9Sstevel@tonic-gate uint_t rs1 = RS1(tp->ftt_instr); 8647c478bd9Sstevel@tonic-gate uint_t rs2 = RS2(tp->ftt_instr); 8657c478bd9Sstevel@tonic-gate 8667c478bd9Sstevel@tonic-gate npc = fasttrap_getreg(rp, rs1) + 8677c478bd9Sstevel@tonic-gate fasttrap_getreg(rp, rs2); 8687c478bd9Sstevel@tonic-gate } 8697c478bd9Sstevel@tonic-gate 8707c478bd9Sstevel@tonic-gate /* 8717c478bd9Sstevel@tonic-gate * Do the link part of the jump-and-link instruction. 8727c478bd9Sstevel@tonic-gate */ 8737c478bd9Sstevel@tonic-gate fasttrap_putreg(rp, RD(tp->ftt_instr), rp->r_pc); 8747c478bd9Sstevel@tonic-gate 8757c478bd9Sstevel@tonic-gate break; 8767c478bd9Sstevel@tonic-gate 8777c478bd9Sstevel@tonic-gate case FASTTRAP_T_COMMON: 8787c478bd9Sstevel@tonic-gate { 8797c478bd9Sstevel@tonic-gate curthread->t_dtrace_scrpc = rp->r_g7; 8807c478bd9Sstevel@tonic-gate curthread->t_dtrace_astpc = rp->r_g7 + FASTTRAP_OFF_FTRET; 8817c478bd9Sstevel@tonic-gate 8827c478bd9Sstevel@tonic-gate /* 8837c478bd9Sstevel@tonic-gate * Copy the instruction to a reserved location in the 8847c478bd9Sstevel@tonic-gate * user-land thread structure, then set the PC to that 8857c478bd9Sstevel@tonic-gate * location and leave the NPC alone. We take pains to ensure 8867c478bd9Sstevel@tonic-gate * consistency in the instruction stream (See SPARC 8877c478bd9Sstevel@tonic-gate * Architecture Manual Version 9, sections 8.4.7, A.20, and 8887c478bd9Sstevel@tonic-gate * H.1.6; UltraSPARC I/II User's Manual, sections 3.1.1.1, 8897c478bd9Sstevel@tonic-gate * and 13.6.4) by using the ASI ASI_BLK_COMMIT_S to copy the 8907c478bd9Sstevel@tonic-gate * instruction into the user's address space without 8917c478bd9Sstevel@tonic-gate * bypassing the I$. There's no AS_USER version of this ASI 8927c478bd9Sstevel@tonic-gate * (as exist for other ASIs) so we use the lofault 8937c478bd9Sstevel@tonic-gate * mechanism to catch faults. 8947c478bd9Sstevel@tonic-gate */ 8957c478bd9Sstevel@tonic-gate if (dtrace_blksuword32(rp->r_g7, &tp->ftt_instr, 1) == -1) { 8967c478bd9Sstevel@tonic-gate /* 8977c478bd9Sstevel@tonic-gate * If the copyout fails, then the process's state 8987c478bd9Sstevel@tonic-gate * is not consistent (the effects of the traced 8997c478bd9Sstevel@tonic-gate * instruction will never be seen). This process 9007c478bd9Sstevel@tonic-gate * cannot be allowed to continue execution. 9017c478bd9Sstevel@tonic-gate */ 9027c478bd9Sstevel@tonic-gate fasttrap_sigtrap(curproc, curthread, pc); 9037c478bd9Sstevel@tonic-gate return (0); 9047c478bd9Sstevel@tonic-gate } 9057c478bd9Sstevel@tonic-gate 9067c478bd9Sstevel@tonic-gate curthread->t_dtrace_pc = pc; 9077c478bd9Sstevel@tonic-gate curthread->t_dtrace_npc = npc; 9087c478bd9Sstevel@tonic-gate curthread->t_dtrace_on = 1; 9097c478bd9Sstevel@tonic-gate 9107c478bd9Sstevel@tonic-gate pc = curthread->t_dtrace_scrpc; 9117c478bd9Sstevel@tonic-gate 9127c478bd9Sstevel@tonic-gate if (tp->ftt_retids != NULL) { 9137c478bd9Sstevel@tonic-gate curthread->t_dtrace_step = 1; 9147c478bd9Sstevel@tonic-gate curthread->t_dtrace_ret = 1; 9157c478bd9Sstevel@tonic-gate npc = curthread->t_dtrace_astpc; 9167c478bd9Sstevel@tonic-gate } 9177c478bd9Sstevel@tonic-gate break; 9187c478bd9Sstevel@tonic-gate } 9197c478bd9Sstevel@tonic-gate 9207c478bd9Sstevel@tonic-gate default: 9217c478bd9Sstevel@tonic-gate panic("fasttrap: mishandled an instruction"); 9227c478bd9Sstevel@tonic-gate } 9237c478bd9Sstevel@tonic-gate 9247c478bd9Sstevel@tonic-gate /* 9257c478bd9Sstevel@tonic-gate * This bit me in the ass a couple of times, so lets toss this 9267c478bd9Sstevel@tonic-gate * in as a cursory sanity check. 9277c478bd9Sstevel@tonic-gate */ 9287c478bd9Sstevel@tonic-gate ASSERT(pc != rp->r_g7 + 4); 9297c478bd9Sstevel@tonic-gate ASSERT(pc != rp->r_g7 + 8); 9307c478bd9Sstevel@tonic-gate 9317c478bd9Sstevel@tonic-gate /* 9327c478bd9Sstevel@tonic-gate * If there were no return probes when we first found the tracepoint, 9337c478bd9Sstevel@tonic-gate * we should feel no obligation to honor any return probes that were 9347c478bd9Sstevel@tonic-gate * subsequently enabled -- they'll just have to wait until the next 9357c478bd9Sstevel@tonic-gate * time around. 9367c478bd9Sstevel@tonic-gate */ 9377c478bd9Sstevel@tonic-gate if (tp->ftt_retids != NULL) { 9387c478bd9Sstevel@tonic-gate /* 9397c478bd9Sstevel@tonic-gate * We need to wait until the results of the instruction are 9407c478bd9Sstevel@tonic-gate * apparent before invoking any return probes. If this 9417c478bd9Sstevel@tonic-gate * instruction was emulated we can just call 9427c478bd9Sstevel@tonic-gate * fasttrap_return_common(); if it needs to be executed, we 9437c478bd9Sstevel@tonic-gate * need to wait until we return to the kernel. 9447c478bd9Sstevel@tonic-gate */ 9457c478bd9Sstevel@tonic-gate if (tp->ftt_type != FASTTRAP_T_COMMON) { 9467c478bd9Sstevel@tonic-gate fasttrap_return_common(rp, orig_pc, pid, fake_restore); 9477c478bd9Sstevel@tonic-gate } else { 9487c478bd9Sstevel@tonic-gate ASSERT(curthread->t_dtrace_ret != 0); 9497c478bd9Sstevel@tonic-gate ASSERT(curthread->t_dtrace_pc == orig_pc); 9507c478bd9Sstevel@tonic-gate ASSERT(curthread->t_dtrace_scrpc == rp->r_g7); 9517c478bd9Sstevel@tonic-gate ASSERT(npc == curthread->t_dtrace_astpc); 9527c478bd9Sstevel@tonic-gate } 9537c478bd9Sstevel@tonic-gate } 9547c478bd9Sstevel@tonic-gate 9557c478bd9Sstevel@tonic-gate ASSERT(pc != 0); 9567c478bd9Sstevel@tonic-gate rp->r_pc = pc; 9577c478bd9Sstevel@tonic-gate rp->r_npc = npc; 9587c478bd9Sstevel@tonic-gate 9597c478bd9Sstevel@tonic-gate return (0); 9607c478bd9Sstevel@tonic-gate } 9617c478bd9Sstevel@tonic-gate 9627c478bd9Sstevel@tonic-gate int 9637c478bd9Sstevel@tonic-gate fasttrap_return_probe(struct regs *rp) 9647c478bd9Sstevel@tonic-gate { 9657c478bd9Sstevel@tonic-gate proc_t *p = ttoproc(curthread); 9667c478bd9Sstevel@tonic-gate pid_t pid; 9677c478bd9Sstevel@tonic-gate uintptr_t pc = curthread->t_dtrace_pc; 9687c478bd9Sstevel@tonic-gate uintptr_t npc = curthread->t_dtrace_npc; 9697c478bd9Sstevel@tonic-gate 9707c478bd9Sstevel@tonic-gate curthread->t_dtrace_pc = 0; 9717c478bd9Sstevel@tonic-gate curthread->t_dtrace_npc = 0; 9727c478bd9Sstevel@tonic-gate curthread->t_dtrace_scrpc = 0; 9737c478bd9Sstevel@tonic-gate curthread->t_dtrace_astpc = 0; 9747c478bd9Sstevel@tonic-gate 9757c478bd9Sstevel@tonic-gate /* 9767c478bd9Sstevel@tonic-gate * Treat a child created by a call to vfork(2) as if it were its 9777c478bd9Sstevel@tonic-gate * parent. We know there's only one thread of control in such a 9787c478bd9Sstevel@tonic-gate * process: this one. 9797c478bd9Sstevel@tonic-gate */ 9807c478bd9Sstevel@tonic-gate while (p->p_flag & SVFORK) { 9817c478bd9Sstevel@tonic-gate p = p->p_parent; 9827c478bd9Sstevel@tonic-gate } 9837c478bd9Sstevel@tonic-gate 9847c478bd9Sstevel@tonic-gate /* 9857c478bd9Sstevel@tonic-gate * We set the %pc and %npc to their values when the traced 9867c478bd9Sstevel@tonic-gate * instruction was initially executed so that it appears to 9877c478bd9Sstevel@tonic-gate * dtrace_probe() that we're on the original instruction, and so that 9887c478bd9Sstevel@tonic-gate * the user can't easily detect our complex web of lies. 9897c478bd9Sstevel@tonic-gate * dtrace_return_probe() (our caller) will correctly set %pc and %npc 9907c478bd9Sstevel@tonic-gate * after we return. 9917c478bd9Sstevel@tonic-gate */ 9927c478bd9Sstevel@tonic-gate rp->r_pc = pc; 9937c478bd9Sstevel@tonic-gate rp->r_npc = npc; 9947c478bd9Sstevel@tonic-gate 9957c478bd9Sstevel@tonic-gate pid = p->p_pid; 9967c478bd9Sstevel@tonic-gate fasttrap_return_common(rp, pc, pid, 0); 9977c478bd9Sstevel@tonic-gate 9987c478bd9Sstevel@tonic-gate return (0); 9997c478bd9Sstevel@tonic-gate } 10007c478bd9Sstevel@tonic-gate 10017c478bd9Sstevel@tonic-gate int 10027c478bd9Sstevel@tonic-gate fasttrap_tracepoint_install(proc_t *p, fasttrap_tracepoint_t *tp) 10037c478bd9Sstevel@tonic-gate { 10047c478bd9Sstevel@tonic-gate fasttrap_instr_t instr = FASTTRAP_INSTR; 10057c478bd9Sstevel@tonic-gate 10067c478bd9Sstevel@tonic-gate if (uwrite(p, &instr, 4, tp->ftt_pc) != 0) 10077c478bd9Sstevel@tonic-gate return (-1); 10087c478bd9Sstevel@tonic-gate 10097c478bd9Sstevel@tonic-gate return (0); 10107c478bd9Sstevel@tonic-gate } 10117c478bd9Sstevel@tonic-gate 10127c478bd9Sstevel@tonic-gate int 10137c478bd9Sstevel@tonic-gate fasttrap_tracepoint_remove(proc_t *p, fasttrap_tracepoint_t *tp) 10147c478bd9Sstevel@tonic-gate { 10157c478bd9Sstevel@tonic-gate fasttrap_instr_t instr; 10167c478bd9Sstevel@tonic-gate 10177c478bd9Sstevel@tonic-gate /* 10187c478bd9Sstevel@tonic-gate * Distinguish between read or write failures and a changed 10197c478bd9Sstevel@tonic-gate * instruction. 10207c478bd9Sstevel@tonic-gate */ 10217c478bd9Sstevel@tonic-gate if (uread(p, &instr, 4, tp->ftt_pc) != 0) 10227c478bd9Sstevel@tonic-gate return (0); 10237c478bd9Sstevel@tonic-gate if (instr != FASTTRAP_INSTR && instr != BREAKPOINT_INSTR) 10247c478bd9Sstevel@tonic-gate return (0); 10257c478bd9Sstevel@tonic-gate if (uwrite(p, &tp->ftt_instr, 4, tp->ftt_pc) != 0) 10267c478bd9Sstevel@tonic-gate return (-1); 10277c478bd9Sstevel@tonic-gate 10287c478bd9Sstevel@tonic-gate return (0); 10297c478bd9Sstevel@tonic-gate } 10307c478bd9Sstevel@tonic-gate 10317c478bd9Sstevel@tonic-gate int 10327c478bd9Sstevel@tonic-gate fasttrap_tracepoint_init(proc_t *p, fasttrap_probe_t *probe, 10337c478bd9Sstevel@tonic-gate fasttrap_tracepoint_t *tp, uintptr_t pc) 10347c478bd9Sstevel@tonic-gate { 10357c478bd9Sstevel@tonic-gate uint32_t instr; 10367c478bd9Sstevel@tonic-gate int32_t disp; 10377c478bd9Sstevel@tonic-gate 10387c478bd9Sstevel@tonic-gate /* 10397c478bd9Sstevel@tonic-gate * Read the instruction at the given address out of the process's 10407c478bd9Sstevel@tonic-gate * address space. We don't have to worry about a debugger 10417c478bd9Sstevel@tonic-gate * changing this instruction before we overwrite it with our trap 10427c478bd9Sstevel@tonic-gate * instruction since P_PR_LOCK is set. 10437c478bd9Sstevel@tonic-gate */ 10447c478bd9Sstevel@tonic-gate if (uread(p, &instr, 4, pc) != 0) 10457c478bd9Sstevel@tonic-gate return (-1); 10467c478bd9Sstevel@tonic-gate 10477c478bd9Sstevel@tonic-gate /* 10487c478bd9Sstevel@tonic-gate * Decode the instruction to fill in the probe flags. We can have 10497c478bd9Sstevel@tonic-gate * the process execute most instructions on its own using a pc/npc 10507c478bd9Sstevel@tonic-gate * trick, but pc-relative control transfer present a problem since 10517c478bd9Sstevel@tonic-gate * we're relocating the instruction. We emulate these instructions 10527c478bd9Sstevel@tonic-gate * in the kernel. We assume a default type and over-write that as 10537c478bd9Sstevel@tonic-gate * needed. 10547c478bd9Sstevel@tonic-gate * 10557c478bd9Sstevel@tonic-gate * pc-relative instructions must be emulated for correctness; 10567c478bd9Sstevel@tonic-gate * other instructions (which represent a large set of commonly traced 10577c478bd9Sstevel@tonic-gate * instructions) are emulated or otherwise optimized for performance. 10587c478bd9Sstevel@tonic-gate */ 10597c478bd9Sstevel@tonic-gate tp->ftt_type = FASTTRAP_T_COMMON; 10607c478bd9Sstevel@tonic-gate if (OP(instr) == 1) { 10617c478bd9Sstevel@tonic-gate /* 10627c478bd9Sstevel@tonic-gate * Call instructions. 10637c478bd9Sstevel@tonic-gate */ 10647c478bd9Sstevel@tonic-gate tp->ftt_type = FASTTRAP_T_CALL; 10657c478bd9Sstevel@tonic-gate disp = DISP30(instr) << 2; 10667c478bd9Sstevel@tonic-gate tp->ftt_dest = pc + (intptr_t)disp; 10677c478bd9Sstevel@tonic-gate 10687c478bd9Sstevel@tonic-gate } else if (OP(instr) == 0) { 10697c478bd9Sstevel@tonic-gate /* 10707c478bd9Sstevel@tonic-gate * Branch instructions. 10717c478bd9Sstevel@tonic-gate * 10727c478bd9Sstevel@tonic-gate * Unconditional branches need careful attention when they're 10737c478bd9Sstevel@tonic-gate * annulled: annulled unconditional branches never execute 10747c478bd9Sstevel@tonic-gate * the instruction in the delay slot. 10757c478bd9Sstevel@tonic-gate */ 10767c478bd9Sstevel@tonic-gate switch (OP2(instr)) { 10777c478bd9Sstevel@tonic-gate case OP2_ILLTRAP: 10787c478bd9Sstevel@tonic-gate case 0x7: 10797c478bd9Sstevel@tonic-gate /* 10807c478bd9Sstevel@tonic-gate * The compiler may place an illtrap after a call to 10817c478bd9Sstevel@tonic-gate * a function that returns a structure. In the case of 10827c478bd9Sstevel@tonic-gate * a returned structure, the compiler places an illtrap 10837c478bd9Sstevel@tonic-gate * whose const22 field is the size of the returned 10847c478bd9Sstevel@tonic-gate * structure immediately following the delay slot of 10857c478bd9Sstevel@tonic-gate * the call. To stay out of the way, we refuse to 10867c478bd9Sstevel@tonic-gate * place tracepoints on top of illtrap instructions. 10877c478bd9Sstevel@tonic-gate * 10887c478bd9Sstevel@tonic-gate * This is one of the dumbest architectural decisions 10897c478bd9Sstevel@tonic-gate * I've ever had to work around. 10907c478bd9Sstevel@tonic-gate * 10917c478bd9Sstevel@tonic-gate * We also identify the only illegal op2 value (See 10927c478bd9Sstevel@tonic-gate * SPARC Architecture Manual Version 9, E.2 table 31). 10937c478bd9Sstevel@tonic-gate */ 10947c478bd9Sstevel@tonic-gate return (-1); 10957c478bd9Sstevel@tonic-gate 10967c478bd9Sstevel@tonic-gate case OP2_BPcc: 10977c478bd9Sstevel@tonic-gate if (COND(instr) == 8) { 10987c478bd9Sstevel@tonic-gate tp->ftt_type = FASTTRAP_T_ALWAYS; 10997c478bd9Sstevel@tonic-gate } else { 11007c478bd9Sstevel@tonic-gate /* 11017c478bd9Sstevel@tonic-gate * Check for an illegal instruction. 11027c478bd9Sstevel@tonic-gate */ 11037c478bd9Sstevel@tonic-gate if (CC(instr) & 1) 11047c478bd9Sstevel@tonic-gate return (-1); 11057c478bd9Sstevel@tonic-gate tp->ftt_type = FASTTRAP_T_CCR; 11067c478bd9Sstevel@tonic-gate tp->ftt_cc = CC(instr); 11077c478bd9Sstevel@tonic-gate tp->ftt_code = COND(instr); 11087c478bd9Sstevel@tonic-gate } 11097c478bd9Sstevel@tonic-gate 11107c478bd9Sstevel@tonic-gate if (A(instr) != 0) 11117c478bd9Sstevel@tonic-gate tp->ftt_flags |= FASTTRAP_F_ANNUL; 11127c478bd9Sstevel@tonic-gate 11137c478bd9Sstevel@tonic-gate disp = DISP19(instr); 11147c478bd9Sstevel@tonic-gate disp <<= 13; 11157c478bd9Sstevel@tonic-gate disp >>= 11; 11167c478bd9Sstevel@tonic-gate tp->ftt_dest = pc + (intptr_t)disp; 11177c478bd9Sstevel@tonic-gate break; 11187c478bd9Sstevel@tonic-gate 11197c478bd9Sstevel@tonic-gate case OP2_Bicc: 11207c478bd9Sstevel@tonic-gate if (COND(instr) == 8) { 11217c478bd9Sstevel@tonic-gate tp->ftt_type = FASTTRAP_T_ALWAYS; 11227c478bd9Sstevel@tonic-gate } else { 11237c478bd9Sstevel@tonic-gate tp->ftt_type = FASTTRAP_T_CCR; 11247c478bd9Sstevel@tonic-gate tp->ftt_cc = 0; 11257c478bd9Sstevel@tonic-gate tp->ftt_code = COND(instr); 11267c478bd9Sstevel@tonic-gate } 11277c478bd9Sstevel@tonic-gate 11287c478bd9Sstevel@tonic-gate if (A(instr) != 0) 11297c478bd9Sstevel@tonic-gate tp->ftt_flags |= FASTTRAP_F_ANNUL; 11307c478bd9Sstevel@tonic-gate 11317c478bd9Sstevel@tonic-gate disp = DISP22(instr); 11327c478bd9Sstevel@tonic-gate disp <<= 10; 11337c478bd9Sstevel@tonic-gate disp >>= 8; 11347c478bd9Sstevel@tonic-gate tp->ftt_dest = pc + (intptr_t)disp; 11357c478bd9Sstevel@tonic-gate break; 11367c478bd9Sstevel@tonic-gate 11377c478bd9Sstevel@tonic-gate case OP2_BPr: 11387c478bd9Sstevel@tonic-gate /* 11397c478bd9Sstevel@tonic-gate * Check for an illegal instruction. 11407c478bd9Sstevel@tonic-gate */ 11417c478bd9Sstevel@tonic-gate if ((RCOND(instr) & 3) == 0) 11427c478bd9Sstevel@tonic-gate return (-1); 11437c478bd9Sstevel@tonic-gate 11447c478bd9Sstevel@tonic-gate /* 11457c478bd9Sstevel@tonic-gate * It's a violation of the v8plus ABI to use a 11467c478bd9Sstevel@tonic-gate * register-predicated branch in a 32-bit app if 11477c478bd9Sstevel@tonic-gate * the register used is an %l or an %i (%gs and %os 11487c478bd9Sstevel@tonic-gate * are legit because they're not saved to the stack 11497c478bd9Sstevel@tonic-gate * in 32-bit words when we take a trap). 11507c478bd9Sstevel@tonic-gate */ 11517c478bd9Sstevel@tonic-gate if (p->p_model == DATAMODEL_ILP32 && RS1(instr) >= 16) 11527c478bd9Sstevel@tonic-gate return (-1); 11537c478bd9Sstevel@tonic-gate 11547c478bd9Sstevel@tonic-gate tp->ftt_type = FASTTRAP_T_REG; 11557c478bd9Sstevel@tonic-gate if (A(instr) != 0) 11567c478bd9Sstevel@tonic-gate tp->ftt_flags |= FASTTRAP_F_ANNUL; 11577c478bd9Sstevel@tonic-gate disp = DISP16(instr); 11587c478bd9Sstevel@tonic-gate disp <<= 16; 11597c478bd9Sstevel@tonic-gate disp >>= 14; 11607c478bd9Sstevel@tonic-gate tp->ftt_dest = pc + (intptr_t)disp; 11617c478bd9Sstevel@tonic-gate tp->ftt_code = RCOND(instr); 11627c478bd9Sstevel@tonic-gate break; 11637c478bd9Sstevel@tonic-gate 11647c478bd9Sstevel@tonic-gate case OP2_SETHI: 11657c478bd9Sstevel@tonic-gate tp->ftt_type = FASTTRAP_T_SETHI; 11667c478bd9Sstevel@tonic-gate break; 11677c478bd9Sstevel@tonic-gate 11687c478bd9Sstevel@tonic-gate case OP2_FBPfcc: 11697c478bd9Sstevel@tonic-gate if (COND(instr) == 8) { 11707c478bd9Sstevel@tonic-gate tp->ftt_type = FASTTRAP_T_ALWAYS; 11717c478bd9Sstevel@tonic-gate } else { 11727c478bd9Sstevel@tonic-gate tp->ftt_type = FASTTRAP_T_FCC; 11737c478bd9Sstevel@tonic-gate tp->ftt_cc = CC(instr); 11747c478bd9Sstevel@tonic-gate tp->ftt_code = COND(instr); 11757c478bd9Sstevel@tonic-gate } 11767c478bd9Sstevel@tonic-gate 11777c478bd9Sstevel@tonic-gate if (A(instr) != 0) 11787c478bd9Sstevel@tonic-gate tp->ftt_flags |= FASTTRAP_F_ANNUL; 11797c478bd9Sstevel@tonic-gate 11807c478bd9Sstevel@tonic-gate disp = DISP19(instr); 11817c478bd9Sstevel@tonic-gate disp <<= 13; 11827c478bd9Sstevel@tonic-gate disp >>= 11; 11837c478bd9Sstevel@tonic-gate tp->ftt_dest = pc + (intptr_t)disp; 11847c478bd9Sstevel@tonic-gate break; 11857c478bd9Sstevel@tonic-gate 11867c478bd9Sstevel@tonic-gate case OP2_FBfcc: 11877c478bd9Sstevel@tonic-gate if (COND(instr) == 8) { 11887c478bd9Sstevel@tonic-gate tp->ftt_type = FASTTRAP_T_ALWAYS; 11897c478bd9Sstevel@tonic-gate } else { 11907c478bd9Sstevel@tonic-gate tp->ftt_type = FASTTRAP_T_FCC; 11917c478bd9Sstevel@tonic-gate tp->ftt_cc = 0; 11927c478bd9Sstevel@tonic-gate tp->ftt_code = COND(instr); 11937c478bd9Sstevel@tonic-gate } 11947c478bd9Sstevel@tonic-gate 11957c478bd9Sstevel@tonic-gate if (A(instr) != 0) 11967c478bd9Sstevel@tonic-gate tp->ftt_flags |= FASTTRAP_F_ANNUL; 11977c478bd9Sstevel@tonic-gate 11987c478bd9Sstevel@tonic-gate disp = DISP22(instr); 11997c478bd9Sstevel@tonic-gate disp <<= 10; 12007c478bd9Sstevel@tonic-gate disp >>= 8; 12017c478bd9Sstevel@tonic-gate tp->ftt_dest = pc + (intptr_t)disp; 12027c478bd9Sstevel@tonic-gate break; 12037c478bd9Sstevel@tonic-gate } 12047c478bd9Sstevel@tonic-gate 12057c478bd9Sstevel@tonic-gate } else if (OP(instr) == 2) { 12067c478bd9Sstevel@tonic-gate switch (OP3(instr)) { 12077c478bd9Sstevel@tonic-gate case OP3_RETURN: 12087c478bd9Sstevel@tonic-gate tp->ftt_type = FASTTRAP_T_RETURN; 12097c478bd9Sstevel@tonic-gate break; 12107c478bd9Sstevel@tonic-gate 12117c478bd9Sstevel@tonic-gate case OP3_JMPL: 12127c478bd9Sstevel@tonic-gate tp->ftt_type = FASTTRAP_T_JMPL; 12137c478bd9Sstevel@tonic-gate break; 12147c478bd9Sstevel@tonic-gate 12157c478bd9Sstevel@tonic-gate case OP3_RD: 12167c478bd9Sstevel@tonic-gate if (RS1(instr) == 5) 12177c478bd9Sstevel@tonic-gate tp->ftt_type = FASTTRAP_T_RDPC; 12187c478bd9Sstevel@tonic-gate break; 12197c478bd9Sstevel@tonic-gate 12207c478bd9Sstevel@tonic-gate case OP3_SAVE: 12217c478bd9Sstevel@tonic-gate /* 12227c478bd9Sstevel@tonic-gate * We optimize for save instructions at function 12237c478bd9Sstevel@tonic-gate * entry; see the comment in fasttrap_pid_probe() 12247c478bd9Sstevel@tonic-gate * (near FASTTRAP_T_SAVE) for details. 12257c478bd9Sstevel@tonic-gate */ 12267c478bd9Sstevel@tonic-gate if (fasttrap_optimize_save != 0 && 12277c478bd9Sstevel@tonic-gate probe->ftp_type == DTFTP_ENTRY && 12287c478bd9Sstevel@tonic-gate I(instr) == 1 && RD(instr) == R_SP) 12297c478bd9Sstevel@tonic-gate tp->ftt_type = FASTTRAP_T_SAVE; 12307c478bd9Sstevel@tonic-gate break; 12317c478bd9Sstevel@tonic-gate 12327c478bd9Sstevel@tonic-gate case OP3_RESTORE: 12337c478bd9Sstevel@tonic-gate /* 12347c478bd9Sstevel@tonic-gate * We optimize restore instructions at function 12357c478bd9Sstevel@tonic-gate * return; see the comment in fasttrap_pid_probe() 12367c478bd9Sstevel@tonic-gate * (near FASTTRAP_T_RESTORE) for details. 12377c478bd9Sstevel@tonic-gate * 12387c478bd9Sstevel@tonic-gate * rd must be an %o or %g register. 12397c478bd9Sstevel@tonic-gate */ 12407c478bd9Sstevel@tonic-gate if ((RD(instr) & 0x10) == 0) 12417c478bd9Sstevel@tonic-gate tp->ftt_type = FASTTRAP_T_RESTORE; 12427c478bd9Sstevel@tonic-gate break; 12437c478bd9Sstevel@tonic-gate 12447c478bd9Sstevel@tonic-gate case OP3_OR: 12457c478bd9Sstevel@tonic-gate /* 12467c478bd9Sstevel@tonic-gate * A large proportion of instructions in the delay 12477c478bd9Sstevel@tonic-gate * slot of retl instructions are or's so we emulate 12487c478bd9Sstevel@tonic-gate * these downstairs as an optimization. 12497c478bd9Sstevel@tonic-gate */ 12507c478bd9Sstevel@tonic-gate tp->ftt_type = FASTTRAP_T_OR; 12517c478bd9Sstevel@tonic-gate break; 12527c478bd9Sstevel@tonic-gate 12537c478bd9Sstevel@tonic-gate case OP3_TCC: 12547c478bd9Sstevel@tonic-gate /* 12557c478bd9Sstevel@tonic-gate * Breakpoint instructions are effectively position- 12567c478bd9Sstevel@tonic-gate * dependent since the debugger uses the %pc value 12577c478bd9Sstevel@tonic-gate * to lookup which breakpoint was executed. As a 12587c478bd9Sstevel@tonic-gate * result, we can't actually instrument breakpoints. 12597c478bd9Sstevel@tonic-gate */ 12607c478bd9Sstevel@tonic-gate if (SW_TRAP(instr) == ST_BREAKPOINT) 12617c478bd9Sstevel@tonic-gate return (-1); 12627c478bd9Sstevel@tonic-gate break; 12637c478bd9Sstevel@tonic-gate 12647c478bd9Sstevel@tonic-gate case 0x19: 12657c478bd9Sstevel@tonic-gate case 0x1d: 12667c478bd9Sstevel@tonic-gate case 0x29: 12677c478bd9Sstevel@tonic-gate case 0x33: 12687c478bd9Sstevel@tonic-gate case 0x3f: 12697c478bd9Sstevel@tonic-gate /* 12707c478bd9Sstevel@tonic-gate * Identify illegal instructions (See SPARC 12717c478bd9Sstevel@tonic-gate * Architecture Manual Version 9, E.2 table 32). 12727c478bd9Sstevel@tonic-gate */ 12737c478bd9Sstevel@tonic-gate return (-1); 12747c478bd9Sstevel@tonic-gate } 12757c478bd9Sstevel@tonic-gate } else if (OP(instr) == 3) { 12767c478bd9Sstevel@tonic-gate uint32_t op3 = OP3(instr); 12777c478bd9Sstevel@tonic-gate 12787c478bd9Sstevel@tonic-gate /* 12797c478bd9Sstevel@tonic-gate * Identify illegal instructions (See SPARC Architecture 12807c478bd9Sstevel@tonic-gate * Manual Version 9, E.2 table 33). 12817c478bd9Sstevel@tonic-gate */ 12827c478bd9Sstevel@tonic-gate if ((op3 & 0x28) == 0x28) { 12837c478bd9Sstevel@tonic-gate if (op3 != OP3_PREFETCH && op3 != OP3_CASA && 12847c478bd9Sstevel@tonic-gate op3 != OP3_PREFETCHA && op3 != OP3_CASXA) 12857c478bd9Sstevel@tonic-gate return (-1); 12867c478bd9Sstevel@tonic-gate } else { 12877c478bd9Sstevel@tonic-gate if ((op3 & 0x0f) == 0x0c || (op3 & 0x3b) == 0x31) 12887c478bd9Sstevel@tonic-gate return (-1); 12897c478bd9Sstevel@tonic-gate } 12907c478bd9Sstevel@tonic-gate } 12917c478bd9Sstevel@tonic-gate 12927c478bd9Sstevel@tonic-gate tp->ftt_instr = instr; 12937c478bd9Sstevel@tonic-gate 12947c478bd9Sstevel@tonic-gate /* 12957c478bd9Sstevel@tonic-gate * We don't know how this tracepoint is going to be used, but in case 12967c478bd9Sstevel@tonic-gate * it's used as part of a function return probe, we need to indicate 12977c478bd9Sstevel@tonic-gate * whether it's always a return site or only potentially a return 12987c478bd9Sstevel@tonic-gate * site. If it's part of a return probe, it's always going to be a 12997c478bd9Sstevel@tonic-gate * return from that function if it's a restore instruction or if 13007c478bd9Sstevel@tonic-gate * the previous instruction was a return. If we could reliably 13017c478bd9Sstevel@tonic-gate * distinguish jump tables from return sites, this wouldn't be 13027c478bd9Sstevel@tonic-gate * necessary. 13037c478bd9Sstevel@tonic-gate */ 13047c478bd9Sstevel@tonic-gate if (tp->ftt_type != FASTTRAP_T_RESTORE && 13057c478bd9Sstevel@tonic-gate (uread(p, &instr, 4, pc - sizeof (instr)) != 0 || 13067c478bd9Sstevel@tonic-gate !(OP(instr) == 2 && OP3(instr) == OP3_RETURN))) 13077c478bd9Sstevel@tonic-gate tp->ftt_flags |= FASTTRAP_F_RETMAYBE; 13087c478bd9Sstevel@tonic-gate 13097c478bd9Sstevel@tonic-gate return (0); 13107c478bd9Sstevel@tonic-gate } 13117c478bd9Sstevel@tonic-gate 13127c478bd9Sstevel@tonic-gate /*ARGSUSED*/ 13137c478bd9Sstevel@tonic-gate uint64_t 13147c478bd9Sstevel@tonic-gate fasttrap_getarg(void *arg, dtrace_id_t id, void *parg, int argno, int aframes) 13157c478bd9Sstevel@tonic-gate { 13167c478bd9Sstevel@tonic-gate return (fasttrap_anarg(ttolwp(curthread)->lwp_regs, argno)); 13177c478bd9Sstevel@tonic-gate } 13187c478bd9Sstevel@tonic-gate 13197c478bd9Sstevel@tonic-gate /*ARGSUSED*/ 13207c478bd9Sstevel@tonic-gate uint64_t 13217c478bd9Sstevel@tonic-gate fasttrap_usdt_getarg(void *arg, dtrace_id_t id, void *parg, int argno, 13227c478bd9Sstevel@tonic-gate int aframes) 13237c478bd9Sstevel@tonic-gate { 13247c478bd9Sstevel@tonic-gate return (fasttrap_anarg(ttolwp(curthread)->lwp_regs, argno)); 13257c478bd9Sstevel@tonic-gate } 13267c478bd9Sstevel@tonic-gate 13277c478bd9Sstevel@tonic-gate static uint64_t fasttrap_getreg_fast_cnt; 13287c478bd9Sstevel@tonic-gate static uint64_t fasttrap_getreg_mpcb_cnt; 13297c478bd9Sstevel@tonic-gate static uint64_t fasttrap_getreg_slow_cnt; 13307c478bd9Sstevel@tonic-gate 13317c478bd9Sstevel@tonic-gate static ulong_t 13327c478bd9Sstevel@tonic-gate fasttrap_getreg(struct regs *rp, uint_t reg) 13337c478bd9Sstevel@tonic-gate { 13347c478bd9Sstevel@tonic-gate ulong_t value; 13357c478bd9Sstevel@tonic-gate dtrace_icookie_t cookie; 13367c478bd9Sstevel@tonic-gate struct machpcb *mpcb; 13377c478bd9Sstevel@tonic-gate extern ulong_t dtrace_getreg_win(uint_t, uint_t); 13387c478bd9Sstevel@tonic-gate 13397c478bd9Sstevel@tonic-gate /* 13407c478bd9Sstevel@tonic-gate * We have the %os and %gs in our struct regs, but if we need to 13417c478bd9Sstevel@tonic-gate * snag a %l or %i we need to go scrounging around in the process's 13427c478bd9Sstevel@tonic-gate * address space. 13437c478bd9Sstevel@tonic-gate */ 13447c478bd9Sstevel@tonic-gate if (reg == 0) 13457c478bd9Sstevel@tonic-gate return (0); 13467c478bd9Sstevel@tonic-gate 13477c478bd9Sstevel@tonic-gate if (reg < 16) 13487c478bd9Sstevel@tonic-gate return ((&rp->r_g1)[reg - 1]); 13497c478bd9Sstevel@tonic-gate 13507c478bd9Sstevel@tonic-gate /* 13517c478bd9Sstevel@tonic-gate * Before we look at the user's stack, we'll check the register 13527c478bd9Sstevel@tonic-gate * windows to see if the information we want is in there. 13537c478bd9Sstevel@tonic-gate */ 13547c478bd9Sstevel@tonic-gate cookie = dtrace_interrupt_disable(); 13557c478bd9Sstevel@tonic-gate if (dtrace_getotherwin() > 0) { 13567c478bd9Sstevel@tonic-gate value = dtrace_getreg_win(reg, 1); 13577c478bd9Sstevel@tonic-gate dtrace_interrupt_enable(cookie); 13587c478bd9Sstevel@tonic-gate 13597c478bd9Sstevel@tonic-gate atomic_add_64(&fasttrap_getreg_fast_cnt, 1); 13607c478bd9Sstevel@tonic-gate 13617c478bd9Sstevel@tonic-gate return (value); 13627c478bd9Sstevel@tonic-gate } 13637c478bd9Sstevel@tonic-gate dtrace_interrupt_enable(cookie); 13647c478bd9Sstevel@tonic-gate 13657c478bd9Sstevel@tonic-gate /* 13667c478bd9Sstevel@tonic-gate * First check the machpcb structure to see if we've already read 13677c478bd9Sstevel@tonic-gate * in the register window we're looking for; if we haven't, (and 13687c478bd9Sstevel@tonic-gate * we probably haven't) try to copy in the value of the register. 13697c478bd9Sstevel@tonic-gate */ 13707c478bd9Sstevel@tonic-gate mpcb = (struct machpcb *)((caddr_t)rp - REGOFF); 13717c478bd9Sstevel@tonic-gate 13727c478bd9Sstevel@tonic-gate if (get_udatamodel() == DATAMODEL_NATIVE) { 13737c478bd9Sstevel@tonic-gate struct frame *fr = (struct frame *)(rp->r_sp + STACK_BIAS); 13747c478bd9Sstevel@tonic-gate 13757c478bd9Sstevel@tonic-gate if (mpcb->mpcb_wbcnt > 0) { 13767c478bd9Sstevel@tonic-gate struct rwindow *rwin = (void *)mpcb->mpcb_wbuf; 13777c478bd9Sstevel@tonic-gate int i = mpcb->mpcb_wbcnt; 13787c478bd9Sstevel@tonic-gate do { 13797c478bd9Sstevel@tonic-gate i--; 13807c478bd9Sstevel@tonic-gate if ((long)mpcb->mpcb_spbuf[i] != rp->r_sp) 13817c478bd9Sstevel@tonic-gate continue; 13827c478bd9Sstevel@tonic-gate 13837c478bd9Sstevel@tonic-gate atomic_add_64(&fasttrap_getreg_mpcb_cnt, 1); 13847c478bd9Sstevel@tonic-gate return (rwin[i].rw_local[reg - 16]); 13857c478bd9Sstevel@tonic-gate } while (i > 0); 13867c478bd9Sstevel@tonic-gate } 13877c478bd9Sstevel@tonic-gate 13887c478bd9Sstevel@tonic-gate if (fasttrap_fulword(&fr->fr_local[reg - 16], &value) != 0) 13897c478bd9Sstevel@tonic-gate goto err; 13907c478bd9Sstevel@tonic-gate } else { 1391*75521904Sraf struct frame32 *fr = 1392*75521904Sraf (struct frame32 *)(uintptr_t)(caddr32_t)rp->r_sp; 13937c478bd9Sstevel@tonic-gate uint32_t *v32 = (uint32_t *)&value; 13947c478bd9Sstevel@tonic-gate 13957c478bd9Sstevel@tonic-gate if (mpcb->mpcb_wbcnt > 0) { 13967c478bd9Sstevel@tonic-gate struct rwindow32 *rwin = (void *)mpcb->mpcb_wbuf; 13977c478bd9Sstevel@tonic-gate int i = mpcb->mpcb_wbcnt; 13987c478bd9Sstevel@tonic-gate do { 13997c478bd9Sstevel@tonic-gate i--; 14007c478bd9Sstevel@tonic-gate if ((long)mpcb->mpcb_spbuf[i] != rp->r_sp) 14017c478bd9Sstevel@tonic-gate continue; 14027c478bd9Sstevel@tonic-gate 14037c478bd9Sstevel@tonic-gate atomic_add_64(&fasttrap_getreg_mpcb_cnt, 1); 14047c478bd9Sstevel@tonic-gate return (rwin[i].rw_local[reg - 16]); 14057c478bd9Sstevel@tonic-gate } while (i > 0); 14067c478bd9Sstevel@tonic-gate } 14077c478bd9Sstevel@tonic-gate 14087c478bd9Sstevel@tonic-gate if (fasttrap_fuword32(&fr->fr_local[reg - 16], &v32[1]) != 0) 14097c478bd9Sstevel@tonic-gate goto err; 14107c478bd9Sstevel@tonic-gate 14117c478bd9Sstevel@tonic-gate v32[0] = 0; 14127c478bd9Sstevel@tonic-gate } 14137c478bd9Sstevel@tonic-gate 14147c478bd9Sstevel@tonic-gate atomic_add_64(&fasttrap_getreg_slow_cnt, 1); 14157c478bd9Sstevel@tonic-gate return (value); 14167c478bd9Sstevel@tonic-gate 14177c478bd9Sstevel@tonic-gate err: 14187c478bd9Sstevel@tonic-gate /* 14197c478bd9Sstevel@tonic-gate * If the copy in failed, the process will be in a irrecoverable 14207c478bd9Sstevel@tonic-gate * state, and we have no choice but to kill it. 14217c478bd9Sstevel@tonic-gate */ 14227c478bd9Sstevel@tonic-gate psignal(ttoproc(curthread), SIGILL); 14237c478bd9Sstevel@tonic-gate return (0); 14247c478bd9Sstevel@tonic-gate } 14257c478bd9Sstevel@tonic-gate 14267c478bd9Sstevel@tonic-gate static uint64_t fasttrap_putreg_fast_cnt; 14277c478bd9Sstevel@tonic-gate static uint64_t fasttrap_putreg_mpcb_cnt; 14287c478bd9Sstevel@tonic-gate static uint64_t fasttrap_putreg_slow_cnt; 14297c478bd9Sstevel@tonic-gate 14307c478bd9Sstevel@tonic-gate static void 14317c478bd9Sstevel@tonic-gate fasttrap_putreg(struct regs *rp, uint_t reg, ulong_t value) 14327c478bd9Sstevel@tonic-gate { 14337c478bd9Sstevel@tonic-gate dtrace_icookie_t cookie; 14347c478bd9Sstevel@tonic-gate struct machpcb *mpcb; 14357c478bd9Sstevel@tonic-gate extern void dtrace_putreg_win(uint_t, ulong_t); 14367c478bd9Sstevel@tonic-gate 14377c478bd9Sstevel@tonic-gate if (reg == 0) 14387c478bd9Sstevel@tonic-gate return; 14397c478bd9Sstevel@tonic-gate 14407c478bd9Sstevel@tonic-gate if (reg < 16) { 14417c478bd9Sstevel@tonic-gate (&rp->r_g1)[reg - 1] = value; 14427c478bd9Sstevel@tonic-gate return; 14437c478bd9Sstevel@tonic-gate } 14447c478bd9Sstevel@tonic-gate 14457c478bd9Sstevel@tonic-gate /* 14467c478bd9Sstevel@tonic-gate * If the user process is still using some register windows, we 14477c478bd9Sstevel@tonic-gate * can just place the value in the correct window. 14487c478bd9Sstevel@tonic-gate */ 14497c478bd9Sstevel@tonic-gate cookie = dtrace_interrupt_disable(); 14507c478bd9Sstevel@tonic-gate if (dtrace_getotherwin() > 0) { 14517c478bd9Sstevel@tonic-gate dtrace_putreg_win(reg, value); 14527c478bd9Sstevel@tonic-gate dtrace_interrupt_enable(cookie); 14537c478bd9Sstevel@tonic-gate atomic_add_64(&fasttrap_putreg_fast_cnt, 1); 14547c478bd9Sstevel@tonic-gate return; 14557c478bd9Sstevel@tonic-gate } 14567c478bd9Sstevel@tonic-gate dtrace_interrupt_enable(cookie); 14577c478bd9Sstevel@tonic-gate 14587c478bd9Sstevel@tonic-gate /* 14597c478bd9Sstevel@tonic-gate * First see if there's a copy of the register window in the 14607c478bd9Sstevel@tonic-gate * machpcb structure that we can modify; if there isn't try to 14617c478bd9Sstevel@tonic-gate * copy out the value. If that fails, we try to create a new 14627c478bd9Sstevel@tonic-gate * register window in the machpcb structure. While this isn't 14637c478bd9Sstevel@tonic-gate * _precisely_ the intended use of the machpcb structure, it 14647c478bd9Sstevel@tonic-gate * can't cause any problems since we know at this point in the 14657c478bd9Sstevel@tonic-gate * code that all of the user's data have been flushed out of the 14667c478bd9Sstevel@tonic-gate * register file (since %otherwin is 0). 14677c478bd9Sstevel@tonic-gate */ 14687c478bd9Sstevel@tonic-gate mpcb = (struct machpcb *)((caddr_t)rp - REGOFF); 14697c478bd9Sstevel@tonic-gate 14707c478bd9Sstevel@tonic-gate if (get_udatamodel() == DATAMODEL_NATIVE) { 14717c478bd9Sstevel@tonic-gate struct frame *fr = (struct frame *)(rp->r_sp + STACK_BIAS); 14727c478bd9Sstevel@tonic-gate struct rwindow *rwin = (struct rwindow *)mpcb->mpcb_wbuf; 14737c478bd9Sstevel@tonic-gate 14747c478bd9Sstevel@tonic-gate if (mpcb->mpcb_wbcnt > 0) { 14757c478bd9Sstevel@tonic-gate int i = mpcb->mpcb_wbcnt; 14767c478bd9Sstevel@tonic-gate do { 14777c478bd9Sstevel@tonic-gate i--; 14787c478bd9Sstevel@tonic-gate if ((long)mpcb->mpcb_spbuf[i] != rp->r_sp) 14797c478bd9Sstevel@tonic-gate continue; 14807c478bd9Sstevel@tonic-gate 14817c478bd9Sstevel@tonic-gate rwin[i].rw_local[reg - 16] = value; 14827c478bd9Sstevel@tonic-gate atomic_add_64(&fasttrap_putreg_mpcb_cnt, 1); 14837c478bd9Sstevel@tonic-gate return; 14847c478bd9Sstevel@tonic-gate } while (i > 0); 14857c478bd9Sstevel@tonic-gate } 14867c478bd9Sstevel@tonic-gate 14877c478bd9Sstevel@tonic-gate if (fasttrap_sulword(&fr->fr_local[reg - 16], value) != 0) { 14887c478bd9Sstevel@tonic-gate if (mpcb->mpcb_wbcnt >= MAXWIN || copyin(fr, 14897c478bd9Sstevel@tonic-gate &rwin[mpcb->mpcb_wbcnt], sizeof (*rwin)) != 0) 14907c478bd9Sstevel@tonic-gate goto err; 14917c478bd9Sstevel@tonic-gate 14927c478bd9Sstevel@tonic-gate rwin[mpcb->mpcb_wbcnt].rw_local[reg - 16] = value; 14937c478bd9Sstevel@tonic-gate mpcb->mpcb_spbuf[mpcb->mpcb_wbcnt] = (caddr_t)rp->r_sp; 14947c478bd9Sstevel@tonic-gate mpcb->mpcb_wbcnt++; 14957c478bd9Sstevel@tonic-gate atomic_add_64(&fasttrap_putreg_mpcb_cnt, 1); 14967c478bd9Sstevel@tonic-gate return; 14977c478bd9Sstevel@tonic-gate } 14987c478bd9Sstevel@tonic-gate } else { 1499*75521904Sraf struct frame32 *fr = 1500*75521904Sraf (struct frame32 *)(uintptr_t)(caddr32_t)rp->r_sp; 15017c478bd9Sstevel@tonic-gate struct rwindow32 *rwin = (struct rwindow32 *)mpcb->mpcb_wbuf; 15027c478bd9Sstevel@tonic-gate uint32_t v32 = (uint32_t)value; 15037c478bd9Sstevel@tonic-gate 15047c478bd9Sstevel@tonic-gate if (mpcb->mpcb_wbcnt > 0) { 15057c478bd9Sstevel@tonic-gate int i = mpcb->mpcb_wbcnt; 15067c478bd9Sstevel@tonic-gate do { 15077c478bd9Sstevel@tonic-gate i--; 15087c478bd9Sstevel@tonic-gate if ((long)mpcb->mpcb_spbuf[i] != rp->r_sp) 15097c478bd9Sstevel@tonic-gate continue; 15107c478bd9Sstevel@tonic-gate 15117c478bd9Sstevel@tonic-gate rwin[i].rw_local[reg - 16] = v32; 15127c478bd9Sstevel@tonic-gate atomic_add_64(&fasttrap_putreg_mpcb_cnt, 1); 15137c478bd9Sstevel@tonic-gate return; 15147c478bd9Sstevel@tonic-gate } while (i > 0); 15157c478bd9Sstevel@tonic-gate } 15167c478bd9Sstevel@tonic-gate 15177c478bd9Sstevel@tonic-gate if (fasttrap_suword32(&fr->fr_local[reg - 16], v32) != 0) { 15187c478bd9Sstevel@tonic-gate if (mpcb->mpcb_wbcnt >= MAXWIN || copyin(fr, 15197c478bd9Sstevel@tonic-gate &rwin[mpcb->mpcb_wbcnt], sizeof (*rwin)) != 0) 15207c478bd9Sstevel@tonic-gate goto err; 15217c478bd9Sstevel@tonic-gate 15227c478bd9Sstevel@tonic-gate rwin[mpcb->mpcb_wbcnt].rw_local[reg - 16] = v32; 15237c478bd9Sstevel@tonic-gate mpcb->mpcb_spbuf[mpcb->mpcb_wbcnt] = (caddr_t)rp->r_sp; 15247c478bd9Sstevel@tonic-gate mpcb->mpcb_wbcnt++; 15257c478bd9Sstevel@tonic-gate atomic_add_64(&fasttrap_putreg_mpcb_cnt, 1); 15267c478bd9Sstevel@tonic-gate return; 15277c478bd9Sstevel@tonic-gate } 15287c478bd9Sstevel@tonic-gate } 15297c478bd9Sstevel@tonic-gate 15307c478bd9Sstevel@tonic-gate atomic_add_64(&fasttrap_putreg_slow_cnt, 1); 15317c478bd9Sstevel@tonic-gate return; 15327c478bd9Sstevel@tonic-gate 15337c478bd9Sstevel@tonic-gate err: 15347c478bd9Sstevel@tonic-gate /* 15357c478bd9Sstevel@tonic-gate * If we couldn't record this register's value, the process is in an 15367c478bd9Sstevel@tonic-gate * irrecoverable state and we have no choice but to euthanize it. 15377c478bd9Sstevel@tonic-gate */ 15387c478bd9Sstevel@tonic-gate psignal(ttoproc(curthread), SIGILL); 15397c478bd9Sstevel@tonic-gate } 1540