1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License, Version 1.0 only
6  * (the "License").  You may not use this file except in compliance
7  * with the License.
8  *
9  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
10  * or http://www.opensolaris.org/os/licensing.
11  * See the License for the specific language governing permissions
12  * and limitations under the License.
13  *
14  * When distributing Covered Code, include this CDDL HEADER in each
15  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
16  * If applicable, add the following below this CDDL HEADER, with the
17  * fields enclosed by brackets "[]" replaced with your own identifying
18  * information: Portions Copyright [yyyy] [name of copyright owner]
19  *
20  * CDDL HEADER END
21  */
22 /*
23  * Copyright 2005 Sun Microsystems, Inc.  All rights reserved.
24  * Use is subject to license terms.
25  */
26 
27 #pragma ident	"%Z%%M%	%I%	%E% SMI"
28 
29 #include <sys/dtrace_impl.h>
30 #include <sys/atomic.h>
31 #include <sys/model.h>
32 #include <sys/frame.h>
33 #include <sys/stack.h>
34 #include <sys/machpcb.h>
35 #include <sys/procfs_isa.h>
36 #include <sys/cmn_err.h>
37 
38 #define	DTRACE_FMT3OP3_MASK	0x81000000
39 #define	DTRACE_FMT3OP3		0x80000000
40 #define	DTRACE_FMT3RS1_SHIFT	14
41 #define	DTRACE_FMT3RD_SHIFT	25
42 #define	DTRACE_RMASK		0x1f
43 #define	DTRACE_REG_L0		16
44 #define	DTRACE_REG_O7		15
45 #define	DTRACE_REG_I0		24
46 #define	DTRACE_REG_I6		30
47 #define	DTRACE_RET		0x81c7e008
48 #define	DTRACE_RETL		0x81c3e008
49 #define	DTRACE_SAVE_MASK	0xc1f80000
50 #define	DTRACE_SAVE		0x81e00000
51 #define	DTRACE_RESTORE		0x81e80000
52 #define	DTRACE_CALL_MASK	0xc0000000
53 #define	DTRACE_CALL		0x40000000
54 #define	DTRACE_JMPL_MASK	0x81f10000
55 #define	DTRACE_JMPL		0x81c00000
56 
57 extern int dtrace_getupcstack_top(uint64_t *, int, uintptr_t *);
58 extern ulong_t dtrace_getreg_win(uint_t, uint_t);
59 extern void dtrace_putreg_win(uint_t, ulong_t);
60 extern int dtrace_fish(int, int, uintptr_t *);
61 
62 /*
63  * This is similar in principle to getpcstack(), but there are several marked
64  * differences in implementation:
65  *
66  * (a)	dtrace_getpcstack() is called from probe context.  Thus, the call
67  *	to flush_windows() from getpcstack() is a call to the probe-safe
68  *	equivalent here.
69  *
70  * (b)  dtrace_getpcstack() is willing to sacrifice some performance to get
71  *	a correct stack.  While consumers of getpcstack() are largely
72  *	subsystem-specific in-kernel debugging facilities, DTrace consumers
73  *	are arbitrary user-level analysis tools; dtrace_getpcstack() must
74  *	deliver as correct a stack as possible.  Details on the issues
75  *	surrounding stack correctness are found below.
76  *
77  * (c)	dtrace_getpcstack() _always_ fills in pstack_limit pc_t's -- filling
78  *	in the difference between the stack depth and pstack_limit with NULLs.
79  *	Due to this behavior dtrace_getpcstack() returns void.
80  *
81  * (d)	dtrace_getpcstack() takes a third parameter, aframes, that
82  *	denotes the number of _artificial frames_ on the bottom of the
83  *	stack.  An artificial frame is one induced by the provider; all
84  *	artificial frames are stripped off before frames are stored to
85  *	pcstack.
86  *
87  * (e)	dtrace_getpcstack() takes a fourth parameter, pc, that indicates
88  *	an interrupted program counter (if any).  This should be a non-NULL
89  *	value if and only if the hit probe is unanchored.  (Anchored probes
90  *	don't fire through an interrupt source.)  This parameter is used to
91  *	assure (b), above.
92  */
93 void
94 dtrace_getpcstack(pc_t *pcstack, int pcstack_limit, int aframes, uint32_t *pc)
95 {
96 	struct frame *fp, *nextfp, *minfp, *stacktop;
97 	int depth = 0;
98 	int on_intr, j = 0;
99 	uint32_t i, r;
100 
101 	fp = (struct frame *)((caddr_t)dtrace_getfp() + STACK_BIAS);
102 	dtrace_flush_windows();
103 
104 	if (pc != NULL) {
105 		/*
106 		 * If we've been passed a non-NULL pc, we need to determine
107 		 * whether or not the specified program counter falls in a leaf
108 		 * function.  If it falls within a leaf function, we know that
109 		 * %o7 is valid in its frame (and we can just drive on).  If
110 		 * it's a non-leaf, however, we know that %o7 is garbage in the
111 		 * bottom frame.  To trim this frame, we simply increment
112 		 * aframes and drop into the stack-walking loop.
113 		 *
114 		 * To quickly determine if the specified program counter is in
115 		 * a leaf function, we exploit the fact that leaf functions
116 		 * tend to be short and non-leaf functions tend to frequently
117 		 * perform operations that are only permitted in a non-leaf
118 		 * function (e.g., using the %i's or %l's; calling a function;
119 		 * performing a restore).  We exploit these tendencies by
120 		 * simply scanning forward from the specified %pc -- if we see
121 		 * an operation only permitted in a non-leaf, we know we're in
122 		 * a non-leaf; if we see a retl, we know we're in a leaf.
123 		 * Fortunately, one need not perform anywhere near full
124 		 * disassembly to effectively determine the former: determining
125 		 * that an instruction is a format-3 instruction and decoding
126 		 * its rd and rs1 fields, for example, requires very little
127 		 * manipulation.  Overall, this method of leaf determination
128 		 * performs quite well:  on average, we only examine between
129 		 * 1.5 and 2.5 instructions before making the determination.
130 		 * (Outliers do exist, however; of note is the non-leaf
131 		 * function ip_sioctl_not_ours() which -- as of this writing --
132 		 * has a whopping 455 straight instructions that manipulate
133 		 * only %g's and %o's.)
134 		 */
135 		int delay = 0;
136 
137 		if (depth < pcstack_limit)
138 			pcstack[depth++] = (pc_t)pc;
139 
140 		for (;;) {
141 			i = pc[j++];
142 
143 			if ((i & DTRACE_FMT3OP3_MASK) == DTRACE_FMT3OP3) {
144 				/*
145 				 * This is a format-3 instruction.  We can
146 				 * look at rd and rs1.
147 				 */
148 				r = (i >> DTRACE_FMT3RS1_SHIFT) & DTRACE_RMASK;
149 
150 				if (r >= DTRACE_REG_L0)
151 					goto nonleaf;
152 
153 				r = (i >> DTRACE_FMT3RD_SHIFT) & DTRACE_RMASK;
154 
155 				if (r >= DTRACE_REG_L0)
156 					goto nonleaf;
157 
158 				if ((i & DTRACE_JMPL_MASK) == DTRACE_JMPL) {
159 					delay = 1;
160 					continue;
161 				}
162 
163 				/*
164 				 * If we see explicit manipulation with %o7
165 				 * as a destination register, we know that
166 				 * %o7 is likely bogus -- and we treat this
167 				 * function as a non-leaf.
168 				 */
169 				if (r == DTRACE_REG_O7) {
170 					if (delay)
171 						goto leaf;
172 
173 					i &= DTRACE_JMPL_MASK;
174 
175 					if (i == DTRACE_JMPL) {
176 						delay = 1;
177 						continue;
178 					}
179 
180 					goto nonleaf;
181 				}
182 			} else {
183 				/*
184 				 * If this is a call, it may or may not be
185 				 * a leaf; we need to check the delay slot.
186 				 */
187 				if ((i & DTRACE_CALL_MASK) == DTRACE_CALL) {
188 					delay = 1;
189 					continue;
190 				}
191 
192 				/*
193 				 * If we see a ret it's not a leaf; if we
194 				 * see a retl, it is a leaf.
195 				 */
196 				if (i == DTRACE_RET)
197 					goto nonleaf;
198 
199 				if (i == DTRACE_RETL)
200 					goto leaf;
201 
202 				/*
203 				 * Finally, if it's a save, it should be
204 				 * treated as a leaf; if it's a restore it
205 				 * should not be treated as a leaf.
206 				 */
207 				if ((i & DTRACE_SAVE_MASK) == DTRACE_SAVE)
208 					goto leaf;
209 
210 				if ((i & DTRACE_SAVE_MASK) == DTRACE_RESTORE)
211 					goto nonleaf;
212 			}
213 
214 			if (delay) {
215 				/*
216 				 * If this was a delay slot instruction and
217 				 * we didn't pick it up elsewhere, this is a
218 				 * non-leaf.
219 				 */
220 				goto nonleaf;
221 			}
222 		}
223 nonleaf:
224 		aframes++;
225 leaf:
226 		;
227 	}
228 
229 	if ((on_intr = CPU_ON_INTR(CPU)) != 0)
230 		stacktop = (struct frame *)(CPU->cpu_intr_stack + SA(MINFRAME));
231 	else
232 		stacktop = (struct frame *)curthread->t_stk;
233 	minfp = fp;
234 
235 	while (depth < pcstack_limit) {
236 		nextfp = (struct frame *)((caddr_t)fp->fr_savfp + STACK_BIAS);
237 		if (nextfp <= minfp || nextfp >= stacktop) {
238 			if (!on_intr && nextfp == stacktop && aframes != 0) {
239 				/*
240 				 * If we are exactly at the top of the stack
241 				 * with a non-zero number of artificial frames,
242 				 * it must be that the stack is filled with
243 				 * nothing _but_ artificial frames.  In this
244 				 * case, we assert that this is so, zero
245 				 * pcstack, and return.
246 				 */
247 				ASSERT(aframes == 1);
248 				ASSERT(depth == 0);
249 
250 				while (depth < pcstack_limit)
251 					pcstack[depth++] = NULL;
252 				return;
253 			}
254 
255 			if (on_intr) {
256 				/*
257 				 * Hop from interrupt stack to thread stack.
258 				 */
259 				stacktop = (struct frame *)curthread->t_stk;
260 				minfp = (struct frame *)curthread->t_stkbase;
261 
262 				on_intr = 0;
263 
264 				if (nextfp > minfp && nextfp < stacktop)
265 					continue;
266 			} else {
267 				/*
268 				 * High-level interrupts may occur when %sp is
269 				 * not necessarily contained in the stack
270 				 * bounds implied by %g7 -- interrupt thread
271 				 * management runs with %pil at DISP_LEVEL,
272 				 * and high-level interrupts may thus occur
273 				 * in windows when %sp and %g7 are not self-
274 				 * consistent.  If we call dtrace_getpcstack()
275 				 * from a high-level interrupt that has occurred
276 				 * in such a window, we will fail the above test
277 				 * of nextfp against minfp/stacktop.  If the
278 				 * high-level interrupt has in turn interrupted
279 				 * a non-passivated interrupt thread, we
280 				 * will execute the below code with non-zero
281 				 * aframes.  We therefore want to assert that
282 				 * aframes is zero _or_ we are in a high-level
283 				 * interrupt -- but because cpu_intr_actv is
284 				 * updated with high-level interrupts enabled,
285 				 * we must reduce this to only asserting that
286 				 * %pil is greater than DISP_LEVEL.
287 				 */
288 				ASSERT(aframes == 0 ||
289 				    dtrace_getipl() > DISP_LEVEL);
290 				pcstack[depth++] = (pc_t)fp->fr_savpc;
291 			}
292 
293 			while (depth < pcstack_limit)
294 				pcstack[depth++] = NULL;
295 			return;
296 		}
297 
298 		if (aframes > 0) {
299 			aframes--;
300 		} else {
301 			pcstack[depth++] = (pc_t)fp->fr_savpc;
302 		}
303 
304 		fp = nextfp;
305 		minfp = fp;
306 	}
307 }
308 
309 void
310 dtrace_getupcstack(uint64_t *pcstack, int pcstack_limit)
311 {
312 	klwp_t *lwp = ttolwp(curthread);
313 	proc_t *p = ttoproc(curthread);
314 	struct regs *rp;
315 	uintptr_t sp;
316 	int n;
317 
318 	if (lwp == NULL || p == NULL || lwp->lwp_regs == NULL)
319 		return;
320 
321 	if (pcstack_limit <= 0)
322 		return;
323 
324 	*pcstack++ = (uint64_t)p->p_pid;
325 	pcstack_limit--;
326 
327 	if (pcstack_limit <= 0)
328 		return;
329 
330 	rp = lwp->lwp_regs;
331 	*pcstack++ = (uint64_t)rp->r_pc;
332 	pcstack_limit--;
333 
334 	if (pcstack_limit <= 0)
335 		return;
336 
337 	if (DTRACE_CPUFLAG_ISSET(CPU_DTRACE_ENTRY)) {
338 		*pcstack++ = (uint64_t)rp->r_o7;
339 		pcstack_limit--;
340 		if (pcstack_limit <= 0)
341 			return;
342 	}
343 
344 	sp = rp->r_sp;
345 
346 	n = dtrace_getupcstack_top(pcstack, pcstack_limit, &sp);
347 	ASSERT(n >= 0);
348 	ASSERT(n <= pcstack_limit);
349 
350 	pcstack += n;
351 	pcstack_limit -= n;
352 
353 	if (p->p_model == DATAMODEL_NATIVE) {
354 		while (pcstack_limit > 0) {
355 			struct frame *fr = (struct frame *)(sp + STACK_BIAS);
356 			uintptr_t pc;
357 
358 			if (sp == 0 || fr == NULL ||
359 			    ((uintptr_t)&fr->fr_savpc & 3) != 0 ||
360 			    ((uintptr_t)&fr->fr_savfp & 3) != 0)
361 				break;
362 
363 			pc = dtrace_fulword(&fr->fr_savpc);
364 			sp = dtrace_fulword(&fr->fr_savfp);
365 
366 			if (pc == 0)
367 				break;
368 
369 			*pcstack++ = pc;
370 			pcstack_limit--;
371 		}
372 	} else {
373 		while (pcstack_limit > 0) {
374 			struct frame32 *fr = (struct frame32 *)sp;
375 			uint32_t pc;
376 
377 			if (sp == 0 ||
378 			    ((uintptr_t)&fr->fr_savpc & 3) != 0 ||
379 			    ((uintptr_t)&fr->fr_savfp & 3) != 0)
380 				break;
381 
382 			pc = dtrace_fuword32(&fr->fr_savpc);
383 			sp = dtrace_fuword32(&fr->fr_savfp);
384 
385 			*pcstack++ = pc;
386 			pcstack_limit--;
387 		}
388 	}
389 
390 	while (pcstack_limit-- > 0)
391 		*pcstack++ = NULL;
392 }
393 
394 void
395 dtrace_getufpstack(uint64_t *pcstack, uint64_t *fpstack, int pcstack_limit)
396 {
397 	klwp_t *lwp = ttolwp(curthread);
398 	proc_t *p = ttoproc(curthread);
399 	struct regs *rp;
400 	uintptr_t sp;
401 
402 	if (lwp == NULL || p == NULL || lwp->lwp_regs == NULL)
403 		return;
404 
405 	if (pcstack_limit <= 0)
406 		return;
407 
408 	*pcstack++ = (uint64_t)p->p_pid;
409 	pcstack_limit--;
410 
411 	if (pcstack_limit <= 0)
412 		return;
413 
414 	rp = lwp->lwp_regs;
415 
416 	if (DTRACE_CPUFLAG_ISSET(CPU_DTRACE_ENTRY)) {
417 		*fpstack++ = 0;
418 		*pcstack++ = (uint64_t)rp->r_pc;
419 		pcstack_limit--;
420 		if (pcstack_limit <= 0)
421 			return;
422 
423 		*fpstack++ = (uint64_t)rp->r_sp;
424 		*pcstack++ = (uint64_t)rp->r_o7;
425 		pcstack_limit--;
426 	} else {
427 		*fpstack++ = (uint64_t)rp->r_sp;
428 		*pcstack++ = (uint64_t)rp->r_pc;
429 		pcstack_limit--;
430 	}
431 
432 	if (pcstack_limit <= 0)
433 		return;
434 
435 	sp = rp->r_sp;
436 
437 	dtrace_flush_user_windows();
438 
439 	if (p->p_model == DATAMODEL_NATIVE) {
440 		while (pcstack_limit > 0) {
441 			struct frame *fr = (struct frame *)(sp + STACK_BIAS);
442 			uintptr_t pc;
443 
444 			if (sp == 0 || fr == NULL ||
445 			    ((uintptr_t)&fr->fr_savpc & 3) != 0 ||
446 			    ((uintptr_t)&fr->fr_savfp & 3) != 0)
447 				break;
448 
449 			pc = dtrace_fulword(&fr->fr_savpc);
450 			sp = dtrace_fulword(&fr->fr_savfp);
451 
452 			if (pc == 0)
453 				break;
454 
455 			*fpstack++ = sp;
456 			*pcstack++ = pc;
457 			pcstack_limit--;
458 		}
459 	} else {
460 		while (pcstack_limit > 0) {
461 			struct frame32 *fr = (struct frame32 *)sp;
462 			uint32_t pc;
463 
464 			if (sp == 0 ||
465 			    ((uintptr_t)&fr->fr_savpc & 3) != 0 ||
466 			    ((uintptr_t)&fr->fr_savfp & 3) != 0)
467 				break;
468 
469 			pc = dtrace_fuword32(&fr->fr_savpc);
470 			sp = dtrace_fuword32(&fr->fr_savfp);
471 
472 			*fpstack++ = sp;
473 			*pcstack++ = pc;
474 			pcstack_limit--;
475 		}
476 	}
477 
478 	while (pcstack_limit-- > 0)
479 		*pcstack++ = NULL;
480 }
481 
482 uint64_t
483 dtrace_getarg(int arg, int aframes)
484 {
485 	uintptr_t val;
486 	struct frame *fp;
487 	uint64_t rval;
488 
489 	/*
490 	 * Account for the fact that dtrace_getarg() consumes an additional
491 	 * stack frame.
492 	 */
493 	aframes++;
494 
495 	if (arg < 6) {
496 		if (dtrace_fish(aframes, DTRACE_REG_I0 + arg, &val) == 0)
497 			return (val);
498 	} else {
499 		if (dtrace_fish(aframes, DTRACE_REG_I6, &val) == 0) {
500 			/*
501 			 * We have a stack pointer; grab the argument.
502 			 */
503 			fp = (struct frame *)(val + STACK_BIAS);
504 
505 			DTRACE_CPUFLAG_SET(CPU_DTRACE_NOFAULT);
506 			rval = fp->fr_argx[arg - 6];
507 			DTRACE_CPUFLAG_CLEAR(CPU_DTRACE_NOFAULT);
508 
509 			return (rval);
510 		}
511 	}
512 
513 	/*
514 	 * There are other ways to do this.  But the slow, painful way works
515 	 * just fine.  Because this requires some loads, we need to set
516 	 * CPU_DTRACE_NOFAULT to protect against looking for an argument that
517 	 * isn't there.
518 	 */
519 	fp = (struct frame *)((caddr_t)dtrace_getfp() + STACK_BIAS);
520 	dtrace_flush_windows();
521 
522 	DTRACE_CPUFLAG_SET(CPU_DTRACE_NOFAULT);
523 
524 	for (aframes -= 1; aframes; aframes--)
525 		fp = (struct frame *)((caddr_t)fp->fr_savfp + STACK_BIAS);
526 
527 	if (arg < 6) {
528 		rval = fp->fr_arg[arg];
529 	} else {
530 		fp = (struct frame *)((caddr_t)fp->fr_savfp + STACK_BIAS);
531 		rval = fp->fr_argx[arg - 6];
532 	}
533 
534 	DTRACE_CPUFLAG_CLEAR(CPU_DTRACE_NOFAULT);
535 
536 	return (rval);
537 }
538 
539 int
540 dtrace_getstackdepth(int aframes)
541 {
542 	struct frame *fp, *nextfp, *minfp, *stacktop;
543 	int depth = 0;
544 	int on_intr;
545 
546 	fp = (struct frame *)((caddr_t)dtrace_getfp() + STACK_BIAS);
547 	dtrace_flush_windows();
548 
549 	if ((on_intr = CPU_ON_INTR(CPU)) != 0)
550 		stacktop = (struct frame *)CPU->cpu_intr_stack + SA(MINFRAME);
551 	else
552 		stacktop = (struct frame *)curthread->t_stk;
553 	minfp = fp;
554 
555 	for (;;) {
556 		nextfp = (struct frame *)((caddr_t)fp->fr_savfp + STACK_BIAS);
557 		if (nextfp <= minfp || nextfp >= stacktop) {
558 			if (on_intr) {
559 				/*
560 				 * Hop from interrupt stack to thread stack.
561 				 */
562 				stacktop = (struct frame *)curthread->t_stk;
563 				minfp = (struct frame *)curthread->t_stkbase;
564 				on_intr = 0;
565 				continue;
566 			}
567 
568 			return (++depth);
569 		}
570 
571 		if (aframes > 0) {
572 			aframes--;
573 		} else {
574 			depth++;
575 		}
576 
577 		fp = nextfp;
578 		minfp = fp;
579 	}
580 }
581 
582 /*
583  * This uses the same register numbering scheme as in sys/procfs_isa.h.
584  */
585 ulong_t
586 dtrace_getreg(struct regs *rp, uint_t reg)
587 {
588 	ulong_t value;
589 	uintptr_t fp;
590 	struct machpcb *mpcb;
591 
592 	if (reg == R_G0)
593 		return (0);
594 
595 	if (reg <= R_G7)
596 		return ((&rp->r_g1)[reg - 1]);
597 
598 	if (reg > R_I7) {
599 		switch (reg) {
600 		case R_CCR:
601 			return ((rp->r_tstate >> TSTATE_CCR_SHIFT) &
602 			    TSTATE_CCR_MASK);
603 		case R_PC:
604 			return (rp->r_pc);
605 		case R_nPC:
606 			return (rp->r_npc);
607 		case R_Y:
608 			return (rp->r_y);
609 		case R_ASI:
610 			return ((rp->r_tstate >> TSTATE_ASI_SHIFT) &
611 			    TSTATE_ASI_MASK);
612 		case R_FPRS:
613 			return (dtrace_getfprs());
614 		default:
615 			DTRACE_CPUFLAG_SET(CPU_DTRACE_ILLOP);
616 			return (0);
617 		}
618 	}
619 
620 	/*
621 	 * We reach go to the fake restore case if the probe we hit was a pid
622 	 * return probe on a restore instruction. We partially emulate the
623 	 * restore in the kernel and then execute a simple restore
624 	 * instruction that we've secreted away to do the actual register
625 	 * window manipulation. We need to go one register window further
626 	 * down to get at the %ls, and %is and we need to treat %os like %is
627 	 * to pull them out of the topmost user frame.
628 	 */
629 	if (DTRACE_CPUFLAG_ISSET(CPU_DTRACE_FAKERESTORE)) {
630 		if (reg > R_O7)
631 			goto fake_restore;
632 		else
633 			reg += R_I0 - R_O0;
634 
635 	} else if (reg <= R_O7) {
636 		return ((&rp->r_g1)[reg - 1]);
637 	}
638 
639 	if (dtrace_getotherwin() > 0)
640 		return (dtrace_getreg_win(reg, 1));
641 
642 	mpcb = (struct machpcb *)((caddr_t)rp - REGOFF);
643 
644 	if (curproc->p_model == DATAMODEL_NATIVE) {
645 		struct frame *fr = (void *)(rp->r_sp + STACK_BIAS);
646 
647 		if (mpcb->mpcb_wbcnt > 0) {
648 			struct rwindow *rwin = (void *)mpcb->mpcb_wbuf;
649 			int i = mpcb->mpcb_wbcnt;
650 			do {
651 				i--;
652 				if ((long)mpcb->mpcb_spbuf[i] == rp->r_sp)
653 					return (rwin[i].rw_local[reg - 16]);
654 			} while (i > 0);
655 		}
656 
657 		DTRACE_CPUFLAG_SET(CPU_DTRACE_NOFAULT);
658 		value = dtrace_fulword(&fr->fr_local[reg - 16]);
659 		DTRACE_CPUFLAG_CLEAR(CPU_DTRACE_NOFAULT);
660 	} else {
661 		struct frame32 *fr = (void *)(caddr32_t)rp->r_sp;
662 
663 		if (mpcb->mpcb_wbcnt > 0) {
664 			struct rwindow32 *rwin = (void *)mpcb->mpcb_wbuf;
665 			int i = mpcb->mpcb_wbcnt;
666 			do {
667 				i--;
668 				if ((long)mpcb->mpcb_spbuf[i] == rp->r_sp)
669 					return (rwin[i].rw_local[reg - 16]);
670 			} while (i > 0);
671 		}
672 
673 		DTRACE_CPUFLAG_SET(CPU_DTRACE_NOFAULT);
674 		value = dtrace_fuword32(&fr->fr_local[reg - 16]);
675 		DTRACE_CPUFLAG_CLEAR(CPU_DTRACE_NOFAULT);
676 	}
677 
678 	return (value);
679 
680 fake_restore:
681 	ASSERT(R_L0 <= reg && reg <= R_I7);
682 
683 	/*
684 	 * We first look two user windows down to see if we can dig out
685 	 * the register we're looking for.
686 	 */
687 	if (dtrace_getotherwin() > 1)
688 		return (dtrace_getreg_win(reg, 2));
689 
690 	/*
691 	 * First we need to get the frame pointer and then we perform
692 	 * the same computation as in the non-fake-o-restore case.
693 	 */
694 
695 	mpcb = (struct machpcb *)((caddr_t)rp - REGOFF);
696 
697 	if (dtrace_getotherwin() > 0) {
698 		fp = dtrace_getreg_win(R_FP, 1);
699 		goto got_fp;
700 	}
701 
702 	if (curproc->p_model == DATAMODEL_NATIVE) {
703 		struct frame *fr = (void *)(rp->r_sp + STACK_BIAS);
704 
705 		if (mpcb->mpcb_wbcnt > 0) {
706 			struct rwindow *rwin = (void *)mpcb->mpcb_wbuf;
707 			int i = mpcb->mpcb_wbcnt;
708 			do {
709 				i--;
710 				if ((long)mpcb->mpcb_spbuf[i] == rp->r_sp) {
711 					fp = rwin[i].rw_fp;
712 					goto got_fp;
713 				}
714 			} while (i > 0);
715 		}
716 
717 		DTRACE_CPUFLAG_SET(CPU_DTRACE_NOFAULT);
718 		fp = dtrace_fulword(&fr->fr_savfp);
719 		DTRACE_CPUFLAG_CLEAR(CPU_DTRACE_NOFAULT);
720 		if (cpu_core[CPU->cpu_id].cpuc_dtrace_flags & CPU_DTRACE_FAULT)
721 			return (0);
722 	} else {
723 		struct frame32 *fr = (void *)(caddr32_t)rp->r_sp;
724 
725 		if (mpcb->mpcb_wbcnt > 0) {
726 			struct rwindow32 *rwin = (void *)mpcb->mpcb_wbuf;
727 			int i = mpcb->mpcb_wbcnt;
728 			do {
729 				i--;
730 				if ((long)mpcb->mpcb_spbuf[i] == rp->r_sp) {
731 					fp = rwin[i].rw_fp;
732 					goto got_fp;
733 				}
734 			} while (i > 0);
735 		}
736 
737 		DTRACE_CPUFLAG_SET(CPU_DTRACE_NOFAULT);
738 		fp = dtrace_fuword32(&fr->fr_savfp);
739 		DTRACE_CPUFLAG_CLEAR(CPU_DTRACE_NOFAULT);
740 		if (cpu_core[CPU->cpu_id].cpuc_dtrace_flags & CPU_DTRACE_FAULT)
741 			return (0);
742 	}
743 got_fp:
744 
745 	if (curproc->p_model == DATAMODEL_NATIVE) {
746 		struct frame *fr = (void *)(fp + STACK_BIAS);
747 
748 		if (mpcb->mpcb_wbcnt > 0) {
749 			struct rwindow *rwin = (void *)mpcb->mpcb_wbuf;
750 			int i = mpcb->mpcb_wbcnt;
751 			do {
752 				i--;
753 				if ((long)mpcb->mpcb_spbuf[i] == fp)
754 					return (rwin[i].rw_local[reg - 16]);
755 			} while (i > 0);
756 		}
757 
758 		DTRACE_CPUFLAG_SET(CPU_DTRACE_NOFAULT);
759 		value = dtrace_fulword(&fr->fr_local[reg - 16]);
760 		DTRACE_CPUFLAG_CLEAR(CPU_DTRACE_NOFAULT);
761 	} else {
762 		struct frame32 *fr = (void *)(caddr32_t)fp;
763 
764 		if (mpcb->mpcb_wbcnt > 0) {
765 			struct rwindow32 *rwin = (void *)mpcb->mpcb_wbuf;
766 			int i = mpcb->mpcb_wbcnt;
767 			do {
768 				i--;
769 				if ((long)mpcb->mpcb_spbuf[i] == fp)
770 					return (rwin[i].rw_local[reg - 16]);
771 			} while (i > 0);
772 		}
773 
774 		DTRACE_CPUFLAG_SET(CPU_DTRACE_NOFAULT);
775 		value = dtrace_fuword32(&fr->fr_local[reg - 16]);
776 		DTRACE_CPUFLAG_CLEAR(CPU_DTRACE_NOFAULT);
777 	}
778 
779 	return (value);
780 }
781