17c478bd9Sstevel@tonic-gate /* 27c478bd9Sstevel@tonic-gate * CDDL HEADER START 37c478bd9Sstevel@tonic-gate * 47c478bd9Sstevel@tonic-gate * The contents of this file are subject to the terms of the 5ac448965Sahl * Common Development and Distribution License (the "License"). 6ac448965Sahl * You may not use this file except in compliance with the License. 77c478bd9Sstevel@tonic-gate * 87c478bd9Sstevel@tonic-gate * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 97c478bd9Sstevel@tonic-gate * or http://www.opensolaris.org/os/licensing. 107c478bd9Sstevel@tonic-gate * See the License for the specific language governing permissions 117c478bd9Sstevel@tonic-gate * and limitations under the License. 127c478bd9Sstevel@tonic-gate * 137c478bd9Sstevel@tonic-gate * When distributing Covered Code, include this CDDL HEADER in each 147c478bd9Sstevel@tonic-gate * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 157c478bd9Sstevel@tonic-gate * If applicable, add the following below this CDDL HEADER, with the 167c478bd9Sstevel@tonic-gate * fields enclosed by brackets "[]" replaced with your own identifying 177c478bd9Sstevel@tonic-gate * information: Portions Copyright [yyyy] [name of copyright owner] 187c478bd9Sstevel@tonic-gate * 197c478bd9Sstevel@tonic-gate * CDDL HEADER END 207c478bd9Sstevel@tonic-gate */ 2175521904Sraf 227c478bd9Sstevel@tonic-gate /* 23*73427c57Sahl * Copyright 2007 Sun Microsystems, Inc. All rights reserved. 247c478bd9Sstevel@tonic-gate * Use is subject to license terms. 257c478bd9Sstevel@tonic-gate */ 267c478bd9Sstevel@tonic-gate 277c478bd9Sstevel@tonic-gate #pragma ident "%Z%%M% %I% %E% SMI" 287c478bd9Sstevel@tonic-gate 297c478bd9Sstevel@tonic-gate #include <sys/fasttrap_isa.h> 307c478bd9Sstevel@tonic-gate #include <sys/fasttrap_impl.h> 317c478bd9Sstevel@tonic-gate #include <sys/dtrace.h> 327c478bd9Sstevel@tonic-gate #include <sys/dtrace_impl.h> 337c478bd9Sstevel@tonic-gate #include <sys/cmn_err.h> 347c478bd9Sstevel@tonic-gate #include <sys/frame.h> 357c478bd9Sstevel@tonic-gate #include <sys/stack.h> 367c478bd9Sstevel@tonic-gate #include <sys/sysmacros.h> 377c478bd9Sstevel@tonic-gate #include <sys/trap.h> 387c478bd9Sstevel@tonic-gate 397c478bd9Sstevel@tonic-gate #include <v9/sys/machpcb.h> 407c478bd9Sstevel@tonic-gate #include <v9/sys/privregs.h> 417c478bd9Sstevel@tonic-gate 427c478bd9Sstevel@tonic-gate /* 437c478bd9Sstevel@tonic-gate * Lossless User-Land Tracing on SPARC 447c478bd9Sstevel@tonic-gate * ----------------------------------- 457c478bd9Sstevel@tonic-gate * 467c478bd9Sstevel@tonic-gate * The Basic Idea 477c478bd9Sstevel@tonic-gate * 487c478bd9Sstevel@tonic-gate * The most important design constraint is, of course, correct execution of 497c478bd9Sstevel@tonic-gate * the user thread above all else. The next most important goal is rapid 507c478bd9Sstevel@tonic-gate * execution. We combine execution of instructions in user-land with 517c478bd9Sstevel@tonic-gate * emulation of certain instructions in the kernel to aim for complete 527c478bd9Sstevel@tonic-gate * correctness and maximal performance. 537c478bd9Sstevel@tonic-gate * 547c478bd9Sstevel@tonic-gate * We take advantage of the split PC/NPC architecture to speed up logical 557c478bd9Sstevel@tonic-gate * single-stepping; when we copy an instruction out to the scratch space in 567c478bd9Sstevel@tonic-gate * the ulwp_t structure (held in the %g7 register on SPARC), we can 577c478bd9Sstevel@tonic-gate * effectively single step by setting the PC to our scratch space and leaving 587c478bd9Sstevel@tonic-gate * the NPC alone. This executes the replaced instruction and then continues 597c478bd9Sstevel@tonic-gate * on without having to reenter the kernel as with single- stepping. The 607c478bd9Sstevel@tonic-gate * obvious caveat is for instructions whose execution is PC dependant -- 617c478bd9Sstevel@tonic-gate * branches, call and link instructions (call and jmpl), and the rdpc 627c478bd9Sstevel@tonic-gate * instruction. These instructions cannot be executed in the manner described 637c478bd9Sstevel@tonic-gate * so they must be emulated in the kernel. 647c478bd9Sstevel@tonic-gate * 657c478bd9Sstevel@tonic-gate * Emulation for this small set of instructions if fairly simple; the most 667c478bd9Sstevel@tonic-gate * difficult part being emulating branch conditions. 677c478bd9Sstevel@tonic-gate * 687c478bd9Sstevel@tonic-gate * 697c478bd9Sstevel@tonic-gate * A Cache Heavy Portfolio 707c478bd9Sstevel@tonic-gate * 717c478bd9Sstevel@tonic-gate * It's important to note at this time that copying an instruction out to the 727c478bd9Sstevel@tonic-gate * ulwp_t scratch space in user-land is rather complicated. SPARC has 737c478bd9Sstevel@tonic-gate * separate data and instruction caches so any writes to the D$ (using a 747c478bd9Sstevel@tonic-gate * store instruction for example) aren't necessarily reflected in the I$. 757c478bd9Sstevel@tonic-gate * The flush instruction can be used to synchronize the two and must be used 767c478bd9Sstevel@tonic-gate * for any self-modifying code, but the flush instruction only applies to the 777c478bd9Sstevel@tonic-gate * primary address space (the absence of a flusha analogue to the flush 787c478bd9Sstevel@tonic-gate * instruction that accepts an ASI argument is an obvious omission from SPARC 797c478bd9Sstevel@tonic-gate * v9 where the notion of the alternate address space was introduced on 807c478bd9Sstevel@tonic-gate * SPARC). To correctly copy out the instruction we must use a block store 817c478bd9Sstevel@tonic-gate * that doesn't allocate in the D$ and ensures synchronization with the I$; 827c478bd9Sstevel@tonic-gate * see dtrace_blksuword32() for the implementation (this function uses 837c478bd9Sstevel@tonic-gate * ASI_BLK_COMMIT_S to write a block through the secondary ASI in the manner 847c478bd9Sstevel@tonic-gate * described). Refer to the UltraSPARC I/II manual for details on the 857c478bd9Sstevel@tonic-gate * ASI_BLK_COMMIT_S ASI. 867c478bd9Sstevel@tonic-gate * 877c478bd9Sstevel@tonic-gate * 887c478bd9Sstevel@tonic-gate * Return Subtleties 897c478bd9Sstevel@tonic-gate * 907c478bd9Sstevel@tonic-gate * When we're firing a return probe we need to expose the value returned by 917c478bd9Sstevel@tonic-gate * the function being traced. Since the function can set the return value 927c478bd9Sstevel@tonic-gate * in its last instruction, we need to fire the return probe only _after_ 937c478bd9Sstevel@tonic-gate * the effects of the instruction are apparent. For instructions that we 947c478bd9Sstevel@tonic-gate * emulate, we can call dtrace_probe() after we've performed the emulation; 957c478bd9Sstevel@tonic-gate * for instructions that we execute after we return to user-land, we set 967c478bd9Sstevel@tonic-gate * %pc to the instruction we copied out (as described above) and set %npc 977c478bd9Sstevel@tonic-gate * to a trap instruction stashed in the ulwp_t structure. After the traced 987c478bd9Sstevel@tonic-gate * instruction is executed, the trap instruction returns control to the 997c478bd9Sstevel@tonic-gate * kernel where we can fire the return probe. 1007c478bd9Sstevel@tonic-gate * 1017c478bd9Sstevel@tonic-gate * This need for a second trap in cases where we execute the traced 1027c478bd9Sstevel@tonic-gate * instruction makes it all the more important to emulate the most common 1037c478bd9Sstevel@tonic-gate * instructions to avoid the second trip in and out of the kernel. 1047c478bd9Sstevel@tonic-gate * 1057c478bd9Sstevel@tonic-gate * 1067c478bd9Sstevel@tonic-gate * Making it Fast 1077c478bd9Sstevel@tonic-gate * 1087c478bd9Sstevel@tonic-gate * Since copying out an instruction is neither simple nor inexpensive for the 1097c478bd9Sstevel@tonic-gate * CPU, we should attempt to avoid doing it in as many cases as possible. 1107c478bd9Sstevel@tonic-gate * Since function entry and return are usually the most interesting probe 1117c478bd9Sstevel@tonic-gate * sites, we attempt to tune the performance of the fasttrap provider around 1127c478bd9Sstevel@tonic-gate * instructions typically in those places. 1137c478bd9Sstevel@tonic-gate * 1147c478bd9Sstevel@tonic-gate * Looking at a bunch of functions in libraries and executables reveals that 1157c478bd9Sstevel@tonic-gate * most functions begin with either a save or a sethi (to setup a larger 1167c478bd9Sstevel@tonic-gate * argument to the save) and end with a restore or an or (in the case of leaf 1177c478bd9Sstevel@tonic-gate * functions). To try to improve performance, we emulate all of these 1187c478bd9Sstevel@tonic-gate * instructions in the kernel. 1197c478bd9Sstevel@tonic-gate * 1207c478bd9Sstevel@tonic-gate * The save and restore instructions are a little tricky since they perform 1217c478bd9Sstevel@tonic-gate * register window maniplulation. Rather than trying to tinker with the 1227c478bd9Sstevel@tonic-gate * register windows from the kernel, we emulate the implicit add that takes 1237c478bd9Sstevel@tonic-gate * place as part of those instructions and set the %pc to point to a simple 1247c478bd9Sstevel@tonic-gate * save or restore we've hidden in the ulwp_t structure. If we're in a return 1257c478bd9Sstevel@tonic-gate * probe so want to make it seem as though the tracepoint has been completely 1267c478bd9Sstevel@tonic-gate * executed we need to remember that we've pulled this trick with restore and 1277c478bd9Sstevel@tonic-gate * pull registers from the previous window (the one that we'll switch to once 1287c478bd9Sstevel@tonic-gate * the simple store instruction is executed) rather than the current one. This 1297c478bd9Sstevel@tonic-gate * is why in the case of emulating a restore we set the DTrace CPU flag 1307c478bd9Sstevel@tonic-gate * CPU_DTRACE_FAKERESTORE before calling dtrace_probe() for the return probes 1317c478bd9Sstevel@tonic-gate * (see fasttrap_return_common()). 1327c478bd9Sstevel@tonic-gate */ 1337c478bd9Sstevel@tonic-gate 1347c478bd9Sstevel@tonic-gate #define OP(x) ((x) >> 30) 1357c478bd9Sstevel@tonic-gate #define OP2(x) (((x) >> 22) & 0x07) 1367c478bd9Sstevel@tonic-gate #define OP3(x) (((x) >> 19) & 0x3f) 1377c478bd9Sstevel@tonic-gate #define RCOND(x) (((x) >> 25) & 0x07) 1387c478bd9Sstevel@tonic-gate #define COND(x) (((x) >> 25) & 0x0f) 1397c478bd9Sstevel@tonic-gate #define A(x) (((x) >> 29) & 0x01) 1407c478bd9Sstevel@tonic-gate #define I(x) (((x) >> 13) & 0x01) 1417c478bd9Sstevel@tonic-gate #define RD(x) (((x) >> 25) & 0x1f) 1427c478bd9Sstevel@tonic-gate #define RS1(x) (((x) >> 14) & 0x1f) 1437c478bd9Sstevel@tonic-gate #define RS2(x) (((x) >> 0) & 0x1f) 1447c478bd9Sstevel@tonic-gate #define CC(x) (((x) >> 20) & 0x03) 1457c478bd9Sstevel@tonic-gate #define DISP16(x) ((((x) >> 6) & 0xc000) | ((x) & 0x3fff)) 1467c478bd9Sstevel@tonic-gate #define DISP22(x) ((x) & 0x3fffff) 1477c478bd9Sstevel@tonic-gate #define DISP19(x) ((x) & 0x7ffff) 1487c478bd9Sstevel@tonic-gate #define DISP30(x) ((x) & 0x3fffffff) 1497c478bd9Sstevel@tonic-gate #define SW_TRAP(x) ((x) & 0x7f) 1507c478bd9Sstevel@tonic-gate 1517c478bd9Sstevel@tonic-gate #define OP3_OR 0x02 1527c478bd9Sstevel@tonic-gate #define OP3_RD 0x28 1537c478bd9Sstevel@tonic-gate #define OP3_JMPL 0x38 1547c478bd9Sstevel@tonic-gate #define OP3_RETURN 0x39 1557c478bd9Sstevel@tonic-gate #define OP3_TCC 0x3a 1567c478bd9Sstevel@tonic-gate #define OP3_SAVE 0x3c 1577c478bd9Sstevel@tonic-gate #define OP3_RESTORE 0x3d 1587c478bd9Sstevel@tonic-gate 1597c478bd9Sstevel@tonic-gate #define OP3_PREFETCH 0x2d 1607c478bd9Sstevel@tonic-gate #define OP3_CASA 0x3c 1617c478bd9Sstevel@tonic-gate #define OP3_PREFETCHA 0x3d 1627c478bd9Sstevel@tonic-gate #define OP3_CASXA 0x3e 1637c478bd9Sstevel@tonic-gate 1647c478bd9Sstevel@tonic-gate #define OP2_ILLTRAP 0x0 1657c478bd9Sstevel@tonic-gate #define OP2_BPcc 0x1 1667c478bd9Sstevel@tonic-gate #define OP2_Bicc 0x2 1677c478bd9Sstevel@tonic-gate #define OP2_BPr 0x3 1687c478bd9Sstevel@tonic-gate #define OP2_SETHI 0x4 1697c478bd9Sstevel@tonic-gate #define OP2_FBPfcc 0x5 1707c478bd9Sstevel@tonic-gate #define OP2_FBfcc 0x6 1717c478bd9Sstevel@tonic-gate 1727c478bd9Sstevel@tonic-gate #define R_G0 0 1737c478bd9Sstevel@tonic-gate #define R_O0 8 1747c478bd9Sstevel@tonic-gate #define R_SP 14 1757c478bd9Sstevel@tonic-gate #define R_I0 24 1767c478bd9Sstevel@tonic-gate #define R_I1 25 1777c478bd9Sstevel@tonic-gate #define R_I2 26 1787c478bd9Sstevel@tonic-gate #define R_I3 27 1797c478bd9Sstevel@tonic-gate 1807c478bd9Sstevel@tonic-gate /* 1817c478bd9Sstevel@tonic-gate * Check the comment in fasttrap.h when changing these offsets or adding 1827c478bd9Sstevel@tonic-gate * new instructions. 1837c478bd9Sstevel@tonic-gate */ 1847c478bd9Sstevel@tonic-gate #define FASTTRAP_OFF_SAVE 64 1857c478bd9Sstevel@tonic-gate #define FASTTRAP_OFF_RESTORE 68 1867c478bd9Sstevel@tonic-gate #define FASTTRAP_OFF_FTRET 72 1877c478bd9Sstevel@tonic-gate #define FASTTRAP_OFF_RETURN 76 1887c478bd9Sstevel@tonic-gate 1897c478bd9Sstevel@tonic-gate #define BREAKPOINT_INSTR 0x91d02001 /* ta 1 */ 1907c478bd9Sstevel@tonic-gate 1917c478bd9Sstevel@tonic-gate /* 1927c478bd9Sstevel@tonic-gate * Tunable to let users turn off the fancy save instruction optimization. 1937c478bd9Sstevel@tonic-gate * If a program is non-ABI compliant, there's a possibility that the save 1947c478bd9Sstevel@tonic-gate * instruction optimization could cause an error. 1957c478bd9Sstevel@tonic-gate */ 1967c478bd9Sstevel@tonic-gate int fasttrap_optimize_save = 1; 1977c478bd9Sstevel@tonic-gate 1987c478bd9Sstevel@tonic-gate static uint64_t 1997c478bd9Sstevel@tonic-gate fasttrap_anarg(struct regs *rp, int argno) 2007c478bd9Sstevel@tonic-gate { 2017c478bd9Sstevel@tonic-gate uint64_t value; 2027c478bd9Sstevel@tonic-gate 2037c478bd9Sstevel@tonic-gate if (argno < 6) 2047c478bd9Sstevel@tonic-gate return ((&rp->r_o0)[argno]); 2057c478bd9Sstevel@tonic-gate 2067c478bd9Sstevel@tonic-gate if (curproc->p_model == DATAMODEL_NATIVE) { 2077c478bd9Sstevel@tonic-gate struct frame *fr = (struct frame *)(rp->r_sp + STACK_BIAS); 2087c478bd9Sstevel@tonic-gate 2097c478bd9Sstevel@tonic-gate DTRACE_CPUFLAG_SET(CPU_DTRACE_NOFAULT); 2107c478bd9Sstevel@tonic-gate value = dtrace_fulword(&fr->fr_argd[argno]); 2117c478bd9Sstevel@tonic-gate DTRACE_CPUFLAG_CLEAR(CPU_DTRACE_NOFAULT | CPU_DTRACE_BADADDR | 2127c478bd9Sstevel@tonic-gate CPU_DTRACE_BADALIGN); 2137c478bd9Sstevel@tonic-gate } else { 2147c478bd9Sstevel@tonic-gate struct frame32 *fr = (struct frame32 *)rp->r_sp; 2157c478bd9Sstevel@tonic-gate 2167c478bd9Sstevel@tonic-gate DTRACE_CPUFLAG_SET(CPU_DTRACE_NOFAULT); 2177c478bd9Sstevel@tonic-gate value = dtrace_fuword32(&fr->fr_argd[argno]); 2187c478bd9Sstevel@tonic-gate DTRACE_CPUFLAG_CLEAR(CPU_DTRACE_NOFAULT | CPU_DTRACE_BADADDR | 2197c478bd9Sstevel@tonic-gate CPU_DTRACE_BADALIGN); 2207c478bd9Sstevel@tonic-gate } 2217c478bd9Sstevel@tonic-gate 2227c478bd9Sstevel@tonic-gate return (value); 2237c478bd9Sstevel@tonic-gate } 2247c478bd9Sstevel@tonic-gate 2257c478bd9Sstevel@tonic-gate static ulong_t fasttrap_getreg(struct regs *, uint_t); 2267c478bd9Sstevel@tonic-gate static void fasttrap_putreg(struct regs *, uint_t, ulong_t); 2277c478bd9Sstevel@tonic-gate 2287c478bd9Sstevel@tonic-gate static void 2297c478bd9Sstevel@tonic-gate fasttrap_usdt_args(fasttrap_probe_t *probe, struct regs *rp, int argc, 2307c478bd9Sstevel@tonic-gate uintptr_t *argv) 2317c478bd9Sstevel@tonic-gate { 2327c478bd9Sstevel@tonic-gate int i, x, cap = MIN(argc, probe->ftp_nargs); 2337c478bd9Sstevel@tonic-gate 2347c478bd9Sstevel@tonic-gate if (curproc->p_model == DATAMODEL_NATIVE) { 2357c478bd9Sstevel@tonic-gate struct frame *fr = (struct frame *)(rp->r_sp + STACK_BIAS); 2367c478bd9Sstevel@tonic-gate uintptr_t v; 2377c478bd9Sstevel@tonic-gate 2387c478bd9Sstevel@tonic-gate for (i = 0; i < cap; i++) { 2397c478bd9Sstevel@tonic-gate x = probe->ftp_argmap[i]; 2407c478bd9Sstevel@tonic-gate 2417c478bd9Sstevel@tonic-gate if (x < 6) 2427c478bd9Sstevel@tonic-gate argv[i] = (&rp->r_o0)[x]; 2437c478bd9Sstevel@tonic-gate else if (fasttrap_fulword(&fr->fr_argd[x], &v) != 0) 2447c478bd9Sstevel@tonic-gate argv[i] = 0; 2457c478bd9Sstevel@tonic-gate } 2467c478bd9Sstevel@tonic-gate 2477c478bd9Sstevel@tonic-gate } else { 2487c478bd9Sstevel@tonic-gate struct frame32 *fr = (struct frame32 *)rp->r_sp; 2497c478bd9Sstevel@tonic-gate uint32_t v; 2507c478bd9Sstevel@tonic-gate 2517c478bd9Sstevel@tonic-gate for (i = 0; i < cap; i++) { 2527c478bd9Sstevel@tonic-gate x = probe->ftp_argmap[i]; 2537c478bd9Sstevel@tonic-gate 2547c478bd9Sstevel@tonic-gate if (x < 6) 2557c478bd9Sstevel@tonic-gate argv[i] = (&rp->r_o0)[x]; 2567c478bd9Sstevel@tonic-gate else if (fasttrap_fuword32(&fr->fr_argd[x], &v) != 0) 2577c478bd9Sstevel@tonic-gate argv[i] = 0; 2587c478bd9Sstevel@tonic-gate } 2597c478bd9Sstevel@tonic-gate } 2607c478bd9Sstevel@tonic-gate 2617c478bd9Sstevel@tonic-gate for (; i < argc; i++) { 2627c478bd9Sstevel@tonic-gate argv[i] = 0; 2637c478bd9Sstevel@tonic-gate } 2647c478bd9Sstevel@tonic-gate } 2657c478bd9Sstevel@tonic-gate 2667c478bd9Sstevel@tonic-gate static void 2677c478bd9Sstevel@tonic-gate fasttrap_return_common(struct regs *rp, uintptr_t pc, pid_t pid, 2687c478bd9Sstevel@tonic-gate uint_t fake_restore) 2697c478bd9Sstevel@tonic-gate { 2707c478bd9Sstevel@tonic-gate fasttrap_tracepoint_t *tp; 2717c478bd9Sstevel@tonic-gate fasttrap_bucket_t *bucket; 2727c478bd9Sstevel@tonic-gate fasttrap_id_t *id; 2737c478bd9Sstevel@tonic-gate kmutex_t *pid_mtx; 2747c478bd9Sstevel@tonic-gate dtrace_icookie_t cookie; 2757c478bd9Sstevel@tonic-gate 2767c478bd9Sstevel@tonic-gate pid_mtx = &cpu_core[CPU->cpu_id].cpuc_pid_lock; 2777c478bd9Sstevel@tonic-gate mutex_enter(pid_mtx); 2787c478bd9Sstevel@tonic-gate bucket = &fasttrap_tpoints.fth_table[FASTTRAP_TPOINTS_INDEX(pid, pc)]; 2797c478bd9Sstevel@tonic-gate 2807c478bd9Sstevel@tonic-gate for (tp = bucket->ftb_data; tp != NULL; tp = tp->ftt_next) { 2817c478bd9Sstevel@tonic-gate if (pid == tp->ftt_pid && pc == tp->ftt_pc && 282b096140dSahl !tp->ftt_proc->ftpc_defunct) 2837c478bd9Sstevel@tonic-gate break; 2847c478bd9Sstevel@tonic-gate } 2857c478bd9Sstevel@tonic-gate 2867c478bd9Sstevel@tonic-gate /* 2877c478bd9Sstevel@tonic-gate * Don't sweat it if we can't find the tracepoint again; unlike 2887c478bd9Sstevel@tonic-gate * when we're in fasttrap_pid_probe(), finding the tracepoint here 2897c478bd9Sstevel@tonic-gate * is not essential to the correct execution of the process. 2907c478bd9Sstevel@tonic-gate */ 2917c478bd9Sstevel@tonic-gate if (tp == NULL || tp->ftt_retids == NULL) { 2927c478bd9Sstevel@tonic-gate mutex_exit(pid_mtx); 2937c478bd9Sstevel@tonic-gate return; 2947c478bd9Sstevel@tonic-gate } 2957c478bd9Sstevel@tonic-gate 2967c478bd9Sstevel@tonic-gate for (id = tp->ftt_retids; id != NULL; id = id->fti_next) { 2977c478bd9Sstevel@tonic-gate fasttrap_probe_t *probe = id->fti_probe; 2987c478bd9Sstevel@tonic-gate 299ac448965Sahl if (id->fti_ptype == DTFTP_POST_OFFSETS) { 3007c478bd9Sstevel@tonic-gate if (probe->ftp_argmap == NULL) { 3017c478bd9Sstevel@tonic-gate dtrace_probe(probe->ftp_id, rp->r_o0, rp->r_o1, 3027c478bd9Sstevel@tonic-gate rp->r_o2, rp->r_o3, rp->r_o4); 3037c478bd9Sstevel@tonic-gate } else { 3047c478bd9Sstevel@tonic-gate uintptr_t t[5]; 3057c478bd9Sstevel@tonic-gate 3067c478bd9Sstevel@tonic-gate fasttrap_usdt_args(probe, rp, 3077c478bd9Sstevel@tonic-gate sizeof (t) / sizeof (t[0]), t); 3087c478bd9Sstevel@tonic-gate 3097c478bd9Sstevel@tonic-gate dtrace_probe(probe->ftp_id, t[0], t[1], 3107c478bd9Sstevel@tonic-gate t[2], t[3], t[4]); 3117c478bd9Sstevel@tonic-gate } 3127c478bd9Sstevel@tonic-gate continue; 3137c478bd9Sstevel@tonic-gate } 3147c478bd9Sstevel@tonic-gate 3157c478bd9Sstevel@tonic-gate /* 3167c478bd9Sstevel@tonic-gate * If this is only a possible return point, we must 3177c478bd9Sstevel@tonic-gate * be looking at a potential tail call in leaf context. 3187c478bd9Sstevel@tonic-gate * If the %npc is still within this function, then we 3197c478bd9Sstevel@tonic-gate * must have misidentified a jmpl as a tail-call when it 3207c478bd9Sstevel@tonic-gate * is, in fact, part of a jump table. It would be nice to 3217c478bd9Sstevel@tonic-gate * remove this tracepoint, but this is neither the time 3227c478bd9Sstevel@tonic-gate * nor the place. 3237c478bd9Sstevel@tonic-gate */ 3247c478bd9Sstevel@tonic-gate if ((tp->ftt_flags & FASTTRAP_F_RETMAYBE) && 3257c478bd9Sstevel@tonic-gate rp->r_npc - probe->ftp_faddr < probe->ftp_fsize) 3267c478bd9Sstevel@tonic-gate continue; 3277c478bd9Sstevel@tonic-gate 3287c478bd9Sstevel@tonic-gate /* 3297c478bd9Sstevel@tonic-gate * It's possible for a function to branch to the delay slot 3307c478bd9Sstevel@tonic-gate * of an instruction that we've identified as a return site. 3317c478bd9Sstevel@tonic-gate * We can dectect this spurious return probe activation by 3327c478bd9Sstevel@tonic-gate * observing that in this case %npc will be %pc + 4 and %npc 3337c478bd9Sstevel@tonic-gate * will be inside the current function (unless the user is 3347c478bd9Sstevel@tonic-gate * doing _crazy_ instruction picking in which case there's 3357c478bd9Sstevel@tonic-gate * very little we can do). The second check is important 3367c478bd9Sstevel@tonic-gate * in case the last instructions of a function make a tail- 3377c478bd9Sstevel@tonic-gate * call to the function located immediately subsequent. 3387c478bd9Sstevel@tonic-gate */ 3397c478bd9Sstevel@tonic-gate if (rp->r_npc == rp->r_pc + 4 && 3407c478bd9Sstevel@tonic-gate rp->r_npc - probe->ftp_faddr < probe->ftp_fsize) 3417c478bd9Sstevel@tonic-gate continue; 3427c478bd9Sstevel@tonic-gate 3437c478bd9Sstevel@tonic-gate /* 3447c478bd9Sstevel@tonic-gate * The first argument is the offset of return tracepoint 3457c478bd9Sstevel@tonic-gate * in the function; the remaining arguments are the return 3467c478bd9Sstevel@tonic-gate * values. 3477c478bd9Sstevel@tonic-gate * 3487c478bd9Sstevel@tonic-gate * If fake_restore is set, we need to pull the return values 3497c478bd9Sstevel@tonic-gate * out of the %i's rather than the %o's -- a little trickier. 3507c478bd9Sstevel@tonic-gate */ 3517c478bd9Sstevel@tonic-gate if (!fake_restore) { 3527c478bd9Sstevel@tonic-gate dtrace_probe(probe->ftp_id, pc - probe->ftp_faddr, 3537c478bd9Sstevel@tonic-gate rp->r_o0, rp->r_o1, rp->r_o2, rp->r_o3); 3547c478bd9Sstevel@tonic-gate } else { 3557c478bd9Sstevel@tonic-gate uintptr_t arg0 = fasttrap_getreg(rp, R_I0); 3567c478bd9Sstevel@tonic-gate uintptr_t arg1 = fasttrap_getreg(rp, R_I1); 3577c478bd9Sstevel@tonic-gate uintptr_t arg2 = fasttrap_getreg(rp, R_I2); 3587c478bd9Sstevel@tonic-gate uintptr_t arg3 = fasttrap_getreg(rp, R_I3); 3597c478bd9Sstevel@tonic-gate 3607c478bd9Sstevel@tonic-gate cookie = dtrace_interrupt_disable(); 3617c478bd9Sstevel@tonic-gate DTRACE_CPUFLAG_SET(CPU_DTRACE_FAKERESTORE); 3627c478bd9Sstevel@tonic-gate dtrace_probe(probe->ftp_id, pc - probe->ftp_faddr, 3637c478bd9Sstevel@tonic-gate arg0, arg1, arg2, arg3); 3647c478bd9Sstevel@tonic-gate DTRACE_CPUFLAG_CLEAR(CPU_DTRACE_FAKERESTORE); 3657c478bd9Sstevel@tonic-gate dtrace_interrupt_enable(cookie); 3667c478bd9Sstevel@tonic-gate } 3677c478bd9Sstevel@tonic-gate } 3687c478bd9Sstevel@tonic-gate 3697c478bd9Sstevel@tonic-gate mutex_exit(pid_mtx); 3707c478bd9Sstevel@tonic-gate } 3717c478bd9Sstevel@tonic-gate 3727c478bd9Sstevel@tonic-gate int 3737c478bd9Sstevel@tonic-gate fasttrap_pid_probe(struct regs *rp) 3747c478bd9Sstevel@tonic-gate { 3757c478bd9Sstevel@tonic-gate proc_t *p = curproc; 3767c478bd9Sstevel@tonic-gate fasttrap_tracepoint_t *tp, tp_local; 3777c478bd9Sstevel@tonic-gate fasttrap_id_t *id; 3787c478bd9Sstevel@tonic-gate pid_t pid; 3797c478bd9Sstevel@tonic-gate uintptr_t pc = rp->r_pc; 3807c478bd9Sstevel@tonic-gate uintptr_t npc = rp->r_npc; 3817c478bd9Sstevel@tonic-gate uintptr_t orig_pc = pc; 3827c478bd9Sstevel@tonic-gate fasttrap_bucket_t *bucket; 3837c478bd9Sstevel@tonic-gate kmutex_t *pid_mtx; 384ac448965Sahl uint_t fake_restore = 0, is_enabled = 0; 3857c478bd9Sstevel@tonic-gate dtrace_icookie_t cookie; 3867c478bd9Sstevel@tonic-gate 3877c478bd9Sstevel@tonic-gate /* 3887c478bd9Sstevel@tonic-gate * It's possible that a user (in a veritable orgy of bad planning) 3897c478bd9Sstevel@tonic-gate * could redirect this thread's flow of control before it reached the 3907c478bd9Sstevel@tonic-gate * return probe fasttrap. In this case we need to kill the process 3917c478bd9Sstevel@tonic-gate * since it's in a unrecoverable state. 3927c478bd9Sstevel@tonic-gate */ 3937c478bd9Sstevel@tonic-gate if (curthread->t_dtrace_step) { 3947c478bd9Sstevel@tonic-gate ASSERT(curthread->t_dtrace_on); 3957c478bd9Sstevel@tonic-gate fasttrap_sigtrap(p, curthread, pc); 3967c478bd9Sstevel@tonic-gate return (0); 3977c478bd9Sstevel@tonic-gate } 3987c478bd9Sstevel@tonic-gate 3997c478bd9Sstevel@tonic-gate /* 4007c478bd9Sstevel@tonic-gate * Clear all user tracing flags. 4017c478bd9Sstevel@tonic-gate */ 4027c478bd9Sstevel@tonic-gate curthread->t_dtrace_ft = 0; 4037c478bd9Sstevel@tonic-gate curthread->t_dtrace_pc = 0; 4047c478bd9Sstevel@tonic-gate curthread->t_dtrace_npc = 0; 4057c478bd9Sstevel@tonic-gate curthread->t_dtrace_scrpc = 0; 4067c478bd9Sstevel@tonic-gate curthread->t_dtrace_astpc = 0; 4077c478bd9Sstevel@tonic-gate 4087c478bd9Sstevel@tonic-gate /* 4097c478bd9Sstevel@tonic-gate * Treat a child created by a call to vfork(2) as if it were its 4107c478bd9Sstevel@tonic-gate * parent. We know that there's only one thread of control in such a 4117c478bd9Sstevel@tonic-gate * process: this one. 4127c478bd9Sstevel@tonic-gate */ 4137c478bd9Sstevel@tonic-gate while (p->p_flag & SVFORK) { 4147c478bd9Sstevel@tonic-gate p = p->p_parent; 4157c478bd9Sstevel@tonic-gate } 4167c478bd9Sstevel@tonic-gate 4177c478bd9Sstevel@tonic-gate pid = p->p_pid; 4187c478bd9Sstevel@tonic-gate pid_mtx = &cpu_core[CPU->cpu_id].cpuc_pid_lock; 4197c478bd9Sstevel@tonic-gate mutex_enter(pid_mtx); 4207c478bd9Sstevel@tonic-gate bucket = &fasttrap_tpoints.fth_table[FASTTRAP_TPOINTS_INDEX(pid, pc)]; 4217c478bd9Sstevel@tonic-gate 4227c478bd9Sstevel@tonic-gate /* 4237c478bd9Sstevel@tonic-gate * Lookup the tracepoint that the process just hit. 4247c478bd9Sstevel@tonic-gate */ 4257c478bd9Sstevel@tonic-gate for (tp = bucket->ftb_data; tp != NULL; tp = tp->ftt_next) { 4267c478bd9Sstevel@tonic-gate if (pid == tp->ftt_pid && pc == tp->ftt_pc && 427b096140dSahl !tp->ftt_proc->ftpc_defunct) 4287c478bd9Sstevel@tonic-gate break; 4297c478bd9Sstevel@tonic-gate } 4307c478bd9Sstevel@tonic-gate 4317c478bd9Sstevel@tonic-gate /* 4327c478bd9Sstevel@tonic-gate * If we couldn't find a matching tracepoint, either a tracepoint has 4337c478bd9Sstevel@tonic-gate * been inserted without using the pid<pid> ioctl interface (see 4347c478bd9Sstevel@tonic-gate * fasttrap_ioctl), or somehow we have mislaid this tracepoint. 4357c478bd9Sstevel@tonic-gate */ 4367c478bd9Sstevel@tonic-gate if (tp == NULL) { 4377c478bd9Sstevel@tonic-gate mutex_exit(pid_mtx); 4387c478bd9Sstevel@tonic-gate return (-1); 4397c478bd9Sstevel@tonic-gate } 4407c478bd9Sstevel@tonic-gate 4417c478bd9Sstevel@tonic-gate for (id = tp->ftt_ids; id != NULL; id = id->fti_next) { 4427c478bd9Sstevel@tonic-gate fasttrap_probe_t *probe = id->fti_probe; 443ac448965Sahl int isentry = (id->fti_ptype == DTFTP_ENTRY); 444ac448965Sahl 445ac448965Sahl if (id->fti_ptype == DTFTP_IS_ENABLED) { 446ac448965Sahl is_enabled = 1; 447ac448965Sahl continue; 448ac448965Sahl } 449ac448965Sahl 4507c478bd9Sstevel@tonic-gate /* 4517c478bd9Sstevel@tonic-gate * We note that this was an entry probe to help ustack() find 4527c478bd9Sstevel@tonic-gate * the first caller. 4537c478bd9Sstevel@tonic-gate */ 454ac448965Sahl if (isentry) { 4557c478bd9Sstevel@tonic-gate cookie = dtrace_interrupt_disable(); 4567c478bd9Sstevel@tonic-gate DTRACE_CPUFLAG_SET(CPU_DTRACE_ENTRY); 4577c478bd9Sstevel@tonic-gate } 4587c478bd9Sstevel@tonic-gate dtrace_probe(probe->ftp_id, rp->r_o0, rp->r_o1, rp->r_o2, 4597c478bd9Sstevel@tonic-gate rp->r_o3, rp->r_o4); 4607c478bd9Sstevel@tonic-gate if (isentry) { 4617c478bd9Sstevel@tonic-gate DTRACE_CPUFLAG_CLEAR(CPU_DTRACE_ENTRY); 4627c478bd9Sstevel@tonic-gate dtrace_interrupt_enable(cookie); 4637c478bd9Sstevel@tonic-gate } 4647c478bd9Sstevel@tonic-gate } 4657c478bd9Sstevel@tonic-gate 4667c478bd9Sstevel@tonic-gate /* 4677c478bd9Sstevel@tonic-gate * We're about to do a bunch of work so we cache a local copy of 4687c478bd9Sstevel@tonic-gate * the tracepoint to emulate the instruction, and then find the 4697c478bd9Sstevel@tonic-gate * tracepoint again later if we need to light up any return probes. 4707c478bd9Sstevel@tonic-gate */ 4717c478bd9Sstevel@tonic-gate tp_local = *tp; 4727c478bd9Sstevel@tonic-gate mutex_exit(pid_mtx); 4737c478bd9Sstevel@tonic-gate tp = &tp_local; 4747c478bd9Sstevel@tonic-gate 4757c478bd9Sstevel@tonic-gate /* 476ac448965Sahl * If there's an is-enabled probe conntected to this tracepoint it 477ac448965Sahl * means that there was a 'mov %g0, %o0' instruction that was placed 478ac448965Sahl * there by DTrace when the binary was linked. As this probe is, in 479ac448965Sahl * fact, enabled, we need to stuff 1 into %o0. Accordingly, we can 480ac448965Sahl * bypass all the instruction emulation logic since we know the 481ac448965Sahl * inevitable result. It's possible that a user could construct a 482ac448965Sahl * scenario where the 'is-enabled' probe was on some other 483ac448965Sahl * instruction, but that would be a rather exotic way to shoot oneself 484ac448965Sahl * in the foot. 485ac448965Sahl */ 486ac448965Sahl if (is_enabled) { 487ac448965Sahl rp->r_o0 = 1; 488ac448965Sahl pc = rp->r_npc; 489ac448965Sahl npc = pc + 4; 490ac448965Sahl goto done; 491ac448965Sahl } 492ac448965Sahl 493ac448965Sahl /* 494ac448965Sahl * We emulate certain types of instructions to ensure correctness 4957c478bd9Sstevel@tonic-gate * (in the case of position dependent instructions) or optimize 4967c478bd9Sstevel@tonic-gate * common cases. The rest we have the thread execute back in user- 4977c478bd9Sstevel@tonic-gate * land. 4987c478bd9Sstevel@tonic-gate */ 4997c478bd9Sstevel@tonic-gate switch (tp->ftt_type) { 5007c478bd9Sstevel@tonic-gate case FASTTRAP_T_SAVE: 5017c478bd9Sstevel@tonic-gate { 5027c478bd9Sstevel@tonic-gate int32_t imm; 5037c478bd9Sstevel@tonic-gate 5047c478bd9Sstevel@tonic-gate /* 5057c478bd9Sstevel@tonic-gate * This an optimization to let us handle function entry 5067c478bd9Sstevel@tonic-gate * probes more efficiently. Many functions begin with a save 5077c478bd9Sstevel@tonic-gate * instruction that follows the pattern: 5087c478bd9Sstevel@tonic-gate * save %sp, <imm>, %sp 5097c478bd9Sstevel@tonic-gate * 5107c478bd9Sstevel@tonic-gate * Meanwhile, we've stashed the instruction: 5117c478bd9Sstevel@tonic-gate * save %g1, %g0, %sp 5127c478bd9Sstevel@tonic-gate * 5137c478bd9Sstevel@tonic-gate * off of %g7, so all we have to do is stick the right value 5147c478bd9Sstevel@tonic-gate * into %g1 and reset %pc to point to the instruction we've 5157c478bd9Sstevel@tonic-gate * cleverly hidden (%npc should not be touched). 5167c478bd9Sstevel@tonic-gate */ 5177c478bd9Sstevel@tonic-gate 5187c478bd9Sstevel@tonic-gate imm = tp->ftt_instr << 19; 5197c478bd9Sstevel@tonic-gate imm >>= 19; 5207c478bd9Sstevel@tonic-gate rp->r_g1 = rp->r_sp + imm; 5217c478bd9Sstevel@tonic-gate pc = rp->r_g7 + FASTTRAP_OFF_SAVE; 5227c478bd9Sstevel@tonic-gate break; 5237c478bd9Sstevel@tonic-gate } 5247c478bd9Sstevel@tonic-gate 5257c478bd9Sstevel@tonic-gate case FASTTRAP_T_RESTORE: 5267c478bd9Sstevel@tonic-gate { 5277c478bd9Sstevel@tonic-gate ulong_t value; 5287c478bd9Sstevel@tonic-gate uint_t rd; 5297c478bd9Sstevel@tonic-gate 5307c478bd9Sstevel@tonic-gate /* 5317c478bd9Sstevel@tonic-gate * This is an optimization to let us handle function 5327c478bd9Sstevel@tonic-gate * return probes more efficiently. Most non-leaf functions 5337c478bd9Sstevel@tonic-gate * end with the sequence: 5347c478bd9Sstevel@tonic-gate * ret 5357c478bd9Sstevel@tonic-gate * restore <reg>, <reg_or_imm>, %oX 5367c478bd9Sstevel@tonic-gate * 5377c478bd9Sstevel@tonic-gate * We've stashed the instruction: 5387c478bd9Sstevel@tonic-gate * restore %g0, %g0, %g0 5397c478bd9Sstevel@tonic-gate * 5407c478bd9Sstevel@tonic-gate * off of %g7 so we just need to place the correct value 5417c478bd9Sstevel@tonic-gate * in the right %i register (since after our fake-o 5427c478bd9Sstevel@tonic-gate * restore, the %i's will become the %o's) and set the %pc 5437c478bd9Sstevel@tonic-gate * to point to our hidden restore. We also set fake_restore to 5447c478bd9Sstevel@tonic-gate * let fasttrap_return_common() know that it will find the 5457c478bd9Sstevel@tonic-gate * return values in the %i's rather than the %o's. 5467c478bd9Sstevel@tonic-gate */ 5477c478bd9Sstevel@tonic-gate 5487c478bd9Sstevel@tonic-gate if (I(tp->ftt_instr)) { 5497c478bd9Sstevel@tonic-gate int32_t imm; 5507c478bd9Sstevel@tonic-gate 5517c478bd9Sstevel@tonic-gate imm = tp->ftt_instr << 19; 5527c478bd9Sstevel@tonic-gate imm >>= 19; 5537c478bd9Sstevel@tonic-gate value = fasttrap_getreg(rp, RS1(tp->ftt_instr)) + imm; 5547c478bd9Sstevel@tonic-gate } else { 5557c478bd9Sstevel@tonic-gate value = fasttrap_getreg(rp, RS1(tp->ftt_instr)) + 5567c478bd9Sstevel@tonic-gate fasttrap_getreg(rp, RS2(tp->ftt_instr)); 5577c478bd9Sstevel@tonic-gate } 5587c478bd9Sstevel@tonic-gate 5597c478bd9Sstevel@tonic-gate /* 5607c478bd9Sstevel@tonic-gate * Convert %o's to %i's; leave %g's as they are. 5617c478bd9Sstevel@tonic-gate */ 5627c478bd9Sstevel@tonic-gate rd = RD(tp->ftt_instr); 5637c478bd9Sstevel@tonic-gate fasttrap_putreg(rp, ((rd & 0x18) == 0x8) ? rd + 16 : rd, value); 5647c478bd9Sstevel@tonic-gate 5657c478bd9Sstevel@tonic-gate pc = rp->r_g7 + FASTTRAP_OFF_RESTORE; 5667c478bd9Sstevel@tonic-gate fake_restore = 1; 5677c478bd9Sstevel@tonic-gate break; 5687c478bd9Sstevel@tonic-gate } 5697c478bd9Sstevel@tonic-gate 5707c478bd9Sstevel@tonic-gate case FASTTRAP_T_RETURN: 5717c478bd9Sstevel@tonic-gate { 5727c478bd9Sstevel@tonic-gate uintptr_t target; 5737c478bd9Sstevel@tonic-gate 5747c478bd9Sstevel@tonic-gate /* 5757c478bd9Sstevel@tonic-gate * A return instruction is like a jmpl (without the link 5767c478bd9Sstevel@tonic-gate * part) that executes an implicit restore. We've stashed 5777c478bd9Sstevel@tonic-gate * the instruction: 5787c478bd9Sstevel@tonic-gate * return %o0 5797c478bd9Sstevel@tonic-gate * 5807c478bd9Sstevel@tonic-gate * off of %g7 so we just need to place the target in %o0 5817c478bd9Sstevel@tonic-gate * and set the %pc to point to the stashed return instruction. 5827c478bd9Sstevel@tonic-gate * We use %o0 since that register disappears after the return 5837c478bd9Sstevel@tonic-gate * executes, erasing any evidence of this tampering. 5847c478bd9Sstevel@tonic-gate */ 5857c478bd9Sstevel@tonic-gate if (I(tp->ftt_instr)) { 5867c478bd9Sstevel@tonic-gate int32_t imm; 5877c478bd9Sstevel@tonic-gate 5887c478bd9Sstevel@tonic-gate imm = tp->ftt_instr << 19; 5897c478bd9Sstevel@tonic-gate imm >>= 19; 5907c478bd9Sstevel@tonic-gate target = fasttrap_getreg(rp, RS1(tp->ftt_instr)) + imm; 5917c478bd9Sstevel@tonic-gate } else { 5927c478bd9Sstevel@tonic-gate target = fasttrap_getreg(rp, RS1(tp->ftt_instr)) + 5937c478bd9Sstevel@tonic-gate fasttrap_getreg(rp, RS2(tp->ftt_instr)); 5947c478bd9Sstevel@tonic-gate } 5957c478bd9Sstevel@tonic-gate 5967c478bd9Sstevel@tonic-gate fasttrap_putreg(rp, R_O0, target); 5977c478bd9Sstevel@tonic-gate 5987c478bd9Sstevel@tonic-gate pc = rp->r_g7 + FASTTRAP_OFF_RETURN; 5997c478bd9Sstevel@tonic-gate fake_restore = 1; 6007c478bd9Sstevel@tonic-gate break; 6017c478bd9Sstevel@tonic-gate } 6027c478bd9Sstevel@tonic-gate 6037c478bd9Sstevel@tonic-gate case FASTTRAP_T_OR: 6047c478bd9Sstevel@tonic-gate { 6057c478bd9Sstevel@tonic-gate ulong_t value; 6067c478bd9Sstevel@tonic-gate 6077c478bd9Sstevel@tonic-gate if (I(tp->ftt_instr)) { 6087c478bd9Sstevel@tonic-gate int32_t imm; 6097c478bd9Sstevel@tonic-gate 6107c478bd9Sstevel@tonic-gate imm = tp->ftt_instr << 19; 6117c478bd9Sstevel@tonic-gate imm >>= 19; 6127c478bd9Sstevel@tonic-gate value = fasttrap_getreg(rp, RS1(tp->ftt_instr)) | imm; 6137c478bd9Sstevel@tonic-gate } else { 6147c478bd9Sstevel@tonic-gate value = fasttrap_getreg(rp, RS1(tp->ftt_instr)) | 6157c478bd9Sstevel@tonic-gate fasttrap_getreg(rp, RS2(tp->ftt_instr)); 6167c478bd9Sstevel@tonic-gate } 6177c478bd9Sstevel@tonic-gate 6187c478bd9Sstevel@tonic-gate fasttrap_putreg(rp, RD(tp->ftt_instr), value); 6197c478bd9Sstevel@tonic-gate pc = rp->r_npc; 6207c478bd9Sstevel@tonic-gate npc = pc + 4; 6217c478bd9Sstevel@tonic-gate break; 6227c478bd9Sstevel@tonic-gate } 6237c478bd9Sstevel@tonic-gate 6247c478bd9Sstevel@tonic-gate case FASTTRAP_T_SETHI: 6257c478bd9Sstevel@tonic-gate if (RD(tp->ftt_instr) != R_G0) { 6267c478bd9Sstevel@tonic-gate uint32_t imm32 = tp->ftt_instr << 10; 6277c478bd9Sstevel@tonic-gate fasttrap_putreg(rp, RD(tp->ftt_instr), (ulong_t)imm32); 6287c478bd9Sstevel@tonic-gate } 6297c478bd9Sstevel@tonic-gate pc = rp->r_npc; 6307c478bd9Sstevel@tonic-gate npc = pc + 4; 6317c478bd9Sstevel@tonic-gate break; 6327c478bd9Sstevel@tonic-gate 6337c478bd9Sstevel@tonic-gate case FASTTRAP_T_CCR: 6347c478bd9Sstevel@tonic-gate { 6357c478bd9Sstevel@tonic-gate uint_t c, v, z, n, taken; 6367c478bd9Sstevel@tonic-gate uint_t ccr = rp->r_tstate >> TSTATE_CCR_SHIFT; 6377c478bd9Sstevel@tonic-gate 6387c478bd9Sstevel@tonic-gate if (tp->ftt_cc != 0) 6397c478bd9Sstevel@tonic-gate ccr >>= 4; 6407c478bd9Sstevel@tonic-gate 6417c478bd9Sstevel@tonic-gate c = (ccr >> 0) & 1; 6427c478bd9Sstevel@tonic-gate v = (ccr >> 1) & 1; 6437c478bd9Sstevel@tonic-gate z = (ccr >> 2) & 1; 6447c478bd9Sstevel@tonic-gate n = (ccr >> 3) & 1; 6457c478bd9Sstevel@tonic-gate 6467c478bd9Sstevel@tonic-gate switch (tp->ftt_code) { 6477c478bd9Sstevel@tonic-gate case 0x0: /* BN */ 6487c478bd9Sstevel@tonic-gate taken = 0; break; 6497c478bd9Sstevel@tonic-gate case 0x1: /* BE */ 6507c478bd9Sstevel@tonic-gate taken = z; break; 6517c478bd9Sstevel@tonic-gate case 0x2: /* BLE */ 6527c478bd9Sstevel@tonic-gate taken = z | (n ^ v); break; 6537c478bd9Sstevel@tonic-gate case 0x3: /* BL */ 6547c478bd9Sstevel@tonic-gate taken = n ^ v; break; 6557c478bd9Sstevel@tonic-gate case 0x4: /* BLEU */ 6567c478bd9Sstevel@tonic-gate taken = c | z; break; 6577c478bd9Sstevel@tonic-gate case 0x5: /* BCS (BLU) */ 6587c478bd9Sstevel@tonic-gate taken = c; break; 6597c478bd9Sstevel@tonic-gate case 0x6: /* BNEG */ 6607c478bd9Sstevel@tonic-gate taken = n; break; 6617c478bd9Sstevel@tonic-gate case 0x7: /* BVS */ 6627c478bd9Sstevel@tonic-gate taken = v; break; 6637c478bd9Sstevel@tonic-gate case 0x8: /* BA */ 6647c478bd9Sstevel@tonic-gate /* 6657c478bd9Sstevel@tonic-gate * We handle the BA case differently since the annul 6667c478bd9Sstevel@tonic-gate * bit means something slightly different. 6677c478bd9Sstevel@tonic-gate */ 6687c478bd9Sstevel@tonic-gate panic("fasttrap: mishandled a branch"); 6697c478bd9Sstevel@tonic-gate taken = 1; break; 6707c478bd9Sstevel@tonic-gate case 0x9: /* BNE */ 6717c478bd9Sstevel@tonic-gate taken = ~z; break; 6727c478bd9Sstevel@tonic-gate case 0xa: /* BG */ 6737c478bd9Sstevel@tonic-gate taken = ~(z | (n ^ v)); break; 6747c478bd9Sstevel@tonic-gate case 0xb: /* BGE */ 6757c478bd9Sstevel@tonic-gate taken = ~(n ^ v); break; 6767c478bd9Sstevel@tonic-gate case 0xc: /* BGU */ 6777c478bd9Sstevel@tonic-gate taken = ~(c | z); break; 6787c478bd9Sstevel@tonic-gate case 0xd: /* BCC (BGEU) */ 6797c478bd9Sstevel@tonic-gate taken = ~c; break; 6807c478bd9Sstevel@tonic-gate case 0xe: /* BPOS */ 6817c478bd9Sstevel@tonic-gate taken = ~n; break; 6827c478bd9Sstevel@tonic-gate case 0xf: /* BVC */ 6837c478bd9Sstevel@tonic-gate taken = ~v; break; 6847c478bd9Sstevel@tonic-gate } 6857c478bd9Sstevel@tonic-gate 6867c478bd9Sstevel@tonic-gate if (taken & 1) { 6877c478bd9Sstevel@tonic-gate pc = rp->r_npc; 6887c478bd9Sstevel@tonic-gate npc = tp->ftt_dest; 6897c478bd9Sstevel@tonic-gate } else if (tp->ftt_flags & FASTTRAP_F_ANNUL) { 6907c478bd9Sstevel@tonic-gate /* 6917c478bd9Sstevel@tonic-gate * Untaken annulled branches don't execute the 6927c478bd9Sstevel@tonic-gate * instruction in the delay slot. 6937c478bd9Sstevel@tonic-gate */ 6947c478bd9Sstevel@tonic-gate pc = rp->r_npc + 4; 6957c478bd9Sstevel@tonic-gate npc = pc + 4; 6967c478bd9Sstevel@tonic-gate } else { 6977c478bd9Sstevel@tonic-gate pc = rp->r_npc; 6987c478bd9Sstevel@tonic-gate npc = pc + 4; 6997c478bd9Sstevel@tonic-gate } 7007c478bd9Sstevel@tonic-gate break; 7017c478bd9Sstevel@tonic-gate } 7027c478bd9Sstevel@tonic-gate 7037c478bd9Sstevel@tonic-gate case FASTTRAP_T_FCC: 7047c478bd9Sstevel@tonic-gate { 7057c478bd9Sstevel@tonic-gate uint_t fcc; 7067c478bd9Sstevel@tonic-gate uint_t taken; 7077c478bd9Sstevel@tonic-gate uint64_t fsr; 7087c478bd9Sstevel@tonic-gate 7097c478bd9Sstevel@tonic-gate dtrace_getfsr(&fsr); 7107c478bd9Sstevel@tonic-gate 7117c478bd9Sstevel@tonic-gate if (tp->ftt_cc == 0) { 7127c478bd9Sstevel@tonic-gate fcc = (fsr >> 10) & 0x3; 7137c478bd9Sstevel@tonic-gate } else { 7147c478bd9Sstevel@tonic-gate uint_t shift; 7157c478bd9Sstevel@tonic-gate ASSERT(tp->ftt_cc <= 3); 7167c478bd9Sstevel@tonic-gate shift = 30 + tp->ftt_cc * 2; 7177c478bd9Sstevel@tonic-gate fcc = (fsr >> shift) & 0x3; 7187c478bd9Sstevel@tonic-gate } 7197c478bd9Sstevel@tonic-gate 7207c478bd9Sstevel@tonic-gate switch (tp->ftt_code) { 7217c478bd9Sstevel@tonic-gate case 0x0: /* FBN */ 7227c478bd9Sstevel@tonic-gate taken = (1 << fcc) & (0|0|0|0); break; 7237c478bd9Sstevel@tonic-gate case 0x1: /* FBNE */ 7247c478bd9Sstevel@tonic-gate taken = (1 << fcc) & (8|4|2|0); break; 7257c478bd9Sstevel@tonic-gate case 0x2: /* FBLG */ 7267c478bd9Sstevel@tonic-gate taken = (1 << fcc) & (0|4|2|0); break; 7277c478bd9Sstevel@tonic-gate case 0x3: /* FBUL */ 7287c478bd9Sstevel@tonic-gate taken = (1 << fcc) & (8|0|2|0); break; 7297c478bd9Sstevel@tonic-gate case 0x4: /* FBL */ 7307c478bd9Sstevel@tonic-gate taken = (1 << fcc) & (0|0|2|0); break; 7317c478bd9Sstevel@tonic-gate case 0x5: /* FBUG */ 7327c478bd9Sstevel@tonic-gate taken = (1 << fcc) & (8|4|0|0); break; 7337c478bd9Sstevel@tonic-gate case 0x6: /* FBG */ 7347c478bd9Sstevel@tonic-gate taken = (1 << fcc) & (0|4|0|0); break; 7357c478bd9Sstevel@tonic-gate case 0x7: /* FBU */ 7367c478bd9Sstevel@tonic-gate taken = (1 << fcc) & (8|0|0|0); break; 7377c478bd9Sstevel@tonic-gate case 0x8: /* FBA */ 7387c478bd9Sstevel@tonic-gate /* 7397c478bd9Sstevel@tonic-gate * We handle the FBA case differently since the annul 7407c478bd9Sstevel@tonic-gate * bit means something slightly different. 7417c478bd9Sstevel@tonic-gate */ 7427c478bd9Sstevel@tonic-gate panic("fasttrap: mishandled a branch"); 7437c478bd9Sstevel@tonic-gate taken = (1 << fcc) & (8|4|2|1); break; 7447c478bd9Sstevel@tonic-gate case 0x9: /* FBE */ 7457c478bd9Sstevel@tonic-gate taken = (1 << fcc) & (0|0|0|1); break; 7467c478bd9Sstevel@tonic-gate case 0xa: /* FBUE */ 7477c478bd9Sstevel@tonic-gate taken = (1 << fcc) & (8|0|0|1); break; 7487c478bd9Sstevel@tonic-gate case 0xb: /* FBGE */ 7497c478bd9Sstevel@tonic-gate taken = (1 << fcc) & (0|4|0|1); break; 7507c478bd9Sstevel@tonic-gate case 0xc: /* FBUGE */ 7517c478bd9Sstevel@tonic-gate taken = (1 << fcc) & (8|4|0|1); break; 7527c478bd9Sstevel@tonic-gate case 0xd: /* FBLE */ 7537c478bd9Sstevel@tonic-gate taken = (1 << fcc) & (0|0|2|1); break; 7547c478bd9Sstevel@tonic-gate case 0xe: /* FBULE */ 7557c478bd9Sstevel@tonic-gate taken = (1 << fcc) & (8|0|2|1); break; 7567c478bd9Sstevel@tonic-gate case 0xf: /* FBO */ 7577c478bd9Sstevel@tonic-gate taken = (1 << fcc) & (0|4|2|1); break; 7587c478bd9Sstevel@tonic-gate } 7597c478bd9Sstevel@tonic-gate 7607c478bd9Sstevel@tonic-gate if (taken) { 7617c478bd9Sstevel@tonic-gate pc = rp->r_npc; 7627c478bd9Sstevel@tonic-gate npc = tp->ftt_dest; 7637c478bd9Sstevel@tonic-gate } else if (tp->ftt_flags & FASTTRAP_F_ANNUL) { 7647c478bd9Sstevel@tonic-gate /* 7657c478bd9Sstevel@tonic-gate * Untaken annulled branches don't execute the 7667c478bd9Sstevel@tonic-gate * instruction in the delay slot. 7677c478bd9Sstevel@tonic-gate */ 7687c478bd9Sstevel@tonic-gate pc = rp->r_npc + 4; 7697c478bd9Sstevel@tonic-gate npc = pc + 4; 7707c478bd9Sstevel@tonic-gate } else { 7717c478bd9Sstevel@tonic-gate pc = rp->r_npc; 7727c478bd9Sstevel@tonic-gate npc = pc + 4; 7737c478bd9Sstevel@tonic-gate } 7747c478bd9Sstevel@tonic-gate break; 7757c478bd9Sstevel@tonic-gate } 7767c478bd9Sstevel@tonic-gate 7777c478bd9Sstevel@tonic-gate case FASTTRAP_T_REG: 7787c478bd9Sstevel@tonic-gate { 779*73427c57Sahl int64_t value; 7807c478bd9Sstevel@tonic-gate uint_t taken; 7817c478bd9Sstevel@tonic-gate uint_t reg = RS1(tp->ftt_instr); 7827c478bd9Sstevel@tonic-gate 7837c478bd9Sstevel@tonic-gate /* 7847c478bd9Sstevel@tonic-gate * An ILP32 process shouldn't be using a branch predicated on 7857c478bd9Sstevel@tonic-gate * an %i or an %l since it would violate the ABI. It's a 7867c478bd9Sstevel@tonic-gate * violation of the ABI because we can't ensure deterministic 7877c478bd9Sstevel@tonic-gate * behavior. We should have identified this case when we 7887c478bd9Sstevel@tonic-gate * enabled the probe. 7897c478bd9Sstevel@tonic-gate */ 7907c478bd9Sstevel@tonic-gate ASSERT(p->p_model == DATAMODEL_LP64 || reg < 16); 7917c478bd9Sstevel@tonic-gate 792*73427c57Sahl value = (int64_t)fasttrap_getreg(rp, reg); 7937c478bd9Sstevel@tonic-gate 7947c478bd9Sstevel@tonic-gate switch (tp->ftt_code) { 7957c478bd9Sstevel@tonic-gate case 0x1: /* BRZ */ 7967c478bd9Sstevel@tonic-gate taken = (value == 0); break; 7977c478bd9Sstevel@tonic-gate case 0x2: /* BRLEZ */ 7987c478bd9Sstevel@tonic-gate taken = (value <= 0); break; 7997c478bd9Sstevel@tonic-gate case 0x3: /* BRLZ */ 8007c478bd9Sstevel@tonic-gate taken = (value < 0); break; 8017c478bd9Sstevel@tonic-gate case 0x5: /* BRNZ */ 8027c478bd9Sstevel@tonic-gate taken = (value != 0); break; 8037c478bd9Sstevel@tonic-gate case 0x6: /* BRGZ */ 8047c478bd9Sstevel@tonic-gate taken = (value > 0); break; 8057c478bd9Sstevel@tonic-gate case 0x7: /* BRGEZ */ 806*73427c57Sahl taken = (value >= 0); break; 8077c478bd9Sstevel@tonic-gate default: 8087c478bd9Sstevel@tonic-gate case 0x0: 8097c478bd9Sstevel@tonic-gate case 0x4: 8107c478bd9Sstevel@tonic-gate panic("fasttrap: mishandled a branch"); 8117c478bd9Sstevel@tonic-gate } 8127c478bd9Sstevel@tonic-gate 8137c478bd9Sstevel@tonic-gate if (taken) { 8147c478bd9Sstevel@tonic-gate pc = rp->r_npc; 8157c478bd9Sstevel@tonic-gate npc = tp->ftt_dest; 8167c478bd9Sstevel@tonic-gate } else if (tp->ftt_flags & FASTTRAP_F_ANNUL) { 8177c478bd9Sstevel@tonic-gate /* 8187c478bd9Sstevel@tonic-gate * Untaken annulled branches don't execute the 8197c478bd9Sstevel@tonic-gate * instruction in the delay slot. 8207c478bd9Sstevel@tonic-gate */ 8217c478bd9Sstevel@tonic-gate pc = rp->r_npc + 4; 8227c478bd9Sstevel@tonic-gate npc = pc + 4; 8237c478bd9Sstevel@tonic-gate } else { 8247c478bd9Sstevel@tonic-gate pc = rp->r_npc; 8257c478bd9Sstevel@tonic-gate npc = pc + 4; 8267c478bd9Sstevel@tonic-gate } 8277c478bd9Sstevel@tonic-gate break; 8287c478bd9Sstevel@tonic-gate } 8297c478bd9Sstevel@tonic-gate 8307c478bd9Sstevel@tonic-gate case FASTTRAP_T_ALWAYS: 8317c478bd9Sstevel@tonic-gate /* 8327c478bd9Sstevel@tonic-gate * BAs, BA,As... 8337c478bd9Sstevel@tonic-gate */ 8347c478bd9Sstevel@tonic-gate 8357c478bd9Sstevel@tonic-gate if (tp->ftt_flags & FASTTRAP_F_ANNUL) { 8367c478bd9Sstevel@tonic-gate /* 8377c478bd9Sstevel@tonic-gate * Annulled branch always instructions never execute 8387c478bd9Sstevel@tonic-gate * the instruction in the delay slot. 8397c478bd9Sstevel@tonic-gate */ 8407c478bd9Sstevel@tonic-gate pc = tp->ftt_dest; 8417c478bd9Sstevel@tonic-gate npc = tp->ftt_dest + 4; 8427c478bd9Sstevel@tonic-gate } else { 8437c478bd9Sstevel@tonic-gate pc = rp->r_npc; 8447c478bd9Sstevel@tonic-gate npc = tp->ftt_dest; 8457c478bd9Sstevel@tonic-gate } 8467c478bd9Sstevel@tonic-gate break; 8477c478bd9Sstevel@tonic-gate 8487c478bd9Sstevel@tonic-gate case FASTTRAP_T_RDPC: 8497c478bd9Sstevel@tonic-gate fasttrap_putreg(rp, RD(tp->ftt_instr), rp->r_pc); 8507c478bd9Sstevel@tonic-gate pc = rp->r_npc; 8517c478bd9Sstevel@tonic-gate npc = pc + 4; 8527c478bd9Sstevel@tonic-gate break; 8537c478bd9Sstevel@tonic-gate 8547c478bd9Sstevel@tonic-gate case FASTTRAP_T_CALL: 8557c478bd9Sstevel@tonic-gate /* 8567c478bd9Sstevel@tonic-gate * It's a call _and_ link remember... 8577c478bd9Sstevel@tonic-gate */ 8587c478bd9Sstevel@tonic-gate rp->r_o7 = rp->r_pc; 8597c478bd9Sstevel@tonic-gate pc = rp->r_npc; 8607c478bd9Sstevel@tonic-gate npc = tp->ftt_dest; 8617c478bd9Sstevel@tonic-gate break; 8627c478bd9Sstevel@tonic-gate 8637c478bd9Sstevel@tonic-gate case FASTTRAP_T_JMPL: 8647c478bd9Sstevel@tonic-gate pc = rp->r_npc; 8657c478bd9Sstevel@tonic-gate 8667c478bd9Sstevel@tonic-gate if (I(tp->ftt_instr)) { 8677c478bd9Sstevel@tonic-gate uint_t rs1 = RS1(tp->ftt_instr); 8687c478bd9Sstevel@tonic-gate int32_t imm; 8697c478bd9Sstevel@tonic-gate 8707c478bd9Sstevel@tonic-gate imm = tp->ftt_instr << 19; 8717c478bd9Sstevel@tonic-gate imm >>= 19; 8727c478bd9Sstevel@tonic-gate npc = fasttrap_getreg(rp, rs1) + imm; 8737c478bd9Sstevel@tonic-gate } else { 8747c478bd9Sstevel@tonic-gate uint_t rs1 = RS1(tp->ftt_instr); 8757c478bd9Sstevel@tonic-gate uint_t rs2 = RS2(tp->ftt_instr); 8767c478bd9Sstevel@tonic-gate 8777c478bd9Sstevel@tonic-gate npc = fasttrap_getreg(rp, rs1) + 8787c478bd9Sstevel@tonic-gate fasttrap_getreg(rp, rs2); 8797c478bd9Sstevel@tonic-gate } 8807c478bd9Sstevel@tonic-gate 8817c478bd9Sstevel@tonic-gate /* 8827c478bd9Sstevel@tonic-gate * Do the link part of the jump-and-link instruction. 8837c478bd9Sstevel@tonic-gate */ 8847c478bd9Sstevel@tonic-gate fasttrap_putreg(rp, RD(tp->ftt_instr), rp->r_pc); 8857c478bd9Sstevel@tonic-gate 8867c478bd9Sstevel@tonic-gate break; 8877c478bd9Sstevel@tonic-gate 8887c478bd9Sstevel@tonic-gate case FASTTRAP_T_COMMON: 8897c478bd9Sstevel@tonic-gate { 8907c478bd9Sstevel@tonic-gate curthread->t_dtrace_scrpc = rp->r_g7; 8917c478bd9Sstevel@tonic-gate curthread->t_dtrace_astpc = rp->r_g7 + FASTTRAP_OFF_FTRET; 8927c478bd9Sstevel@tonic-gate 8937c478bd9Sstevel@tonic-gate /* 8947c478bd9Sstevel@tonic-gate * Copy the instruction to a reserved location in the 8957c478bd9Sstevel@tonic-gate * user-land thread structure, then set the PC to that 8967c478bd9Sstevel@tonic-gate * location and leave the NPC alone. We take pains to ensure 8977c478bd9Sstevel@tonic-gate * consistency in the instruction stream (See SPARC 8987c478bd9Sstevel@tonic-gate * Architecture Manual Version 9, sections 8.4.7, A.20, and 8997c478bd9Sstevel@tonic-gate * H.1.6; UltraSPARC I/II User's Manual, sections 3.1.1.1, 9007c478bd9Sstevel@tonic-gate * and 13.6.4) by using the ASI ASI_BLK_COMMIT_S to copy the 9017c478bd9Sstevel@tonic-gate * instruction into the user's address space without 9027c478bd9Sstevel@tonic-gate * bypassing the I$. There's no AS_USER version of this ASI 9037c478bd9Sstevel@tonic-gate * (as exist for other ASIs) so we use the lofault 9047c478bd9Sstevel@tonic-gate * mechanism to catch faults. 9057c478bd9Sstevel@tonic-gate */ 9067c478bd9Sstevel@tonic-gate if (dtrace_blksuword32(rp->r_g7, &tp->ftt_instr, 1) == -1) { 9077c478bd9Sstevel@tonic-gate /* 9087c478bd9Sstevel@tonic-gate * If the copyout fails, then the process's state 9097c478bd9Sstevel@tonic-gate * is not consistent (the effects of the traced 9107c478bd9Sstevel@tonic-gate * instruction will never be seen). This process 9117c478bd9Sstevel@tonic-gate * cannot be allowed to continue execution. 9127c478bd9Sstevel@tonic-gate */ 9137c478bd9Sstevel@tonic-gate fasttrap_sigtrap(curproc, curthread, pc); 9147c478bd9Sstevel@tonic-gate return (0); 9157c478bd9Sstevel@tonic-gate } 9167c478bd9Sstevel@tonic-gate 9177c478bd9Sstevel@tonic-gate curthread->t_dtrace_pc = pc; 9187c478bd9Sstevel@tonic-gate curthread->t_dtrace_npc = npc; 9197c478bd9Sstevel@tonic-gate curthread->t_dtrace_on = 1; 9207c478bd9Sstevel@tonic-gate 9217c478bd9Sstevel@tonic-gate pc = curthread->t_dtrace_scrpc; 9227c478bd9Sstevel@tonic-gate 9237c478bd9Sstevel@tonic-gate if (tp->ftt_retids != NULL) { 9247c478bd9Sstevel@tonic-gate curthread->t_dtrace_step = 1; 9257c478bd9Sstevel@tonic-gate curthread->t_dtrace_ret = 1; 9267c478bd9Sstevel@tonic-gate npc = curthread->t_dtrace_astpc; 9277c478bd9Sstevel@tonic-gate } 9287c478bd9Sstevel@tonic-gate break; 9297c478bd9Sstevel@tonic-gate } 9307c478bd9Sstevel@tonic-gate 9317c478bd9Sstevel@tonic-gate default: 9327c478bd9Sstevel@tonic-gate panic("fasttrap: mishandled an instruction"); 9337c478bd9Sstevel@tonic-gate } 9347c478bd9Sstevel@tonic-gate 9357c478bd9Sstevel@tonic-gate /* 9367c478bd9Sstevel@tonic-gate * This bit me in the ass a couple of times, so lets toss this 9377c478bd9Sstevel@tonic-gate * in as a cursory sanity check. 9387c478bd9Sstevel@tonic-gate */ 9397c478bd9Sstevel@tonic-gate ASSERT(pc != rp->r_g7 + 4); 9407c478bd9Sstevel@tonic-gate ASSERT(pc != rp->r_g7 + 8); 9417c478bd9Sstevel@tonic-gate 942ac448965Sahl done: 9437c478bd9Sstevel@tonic-gate /* 9447c478bd9Sstevel@tonic-gate * If there were no return probes when we first found the tracepoint, 9457c478bd9Sstevel@tonic-gate * we should feel no obligation to honor any return probes that were 9467c478bd9Sstevel@tonic-gate * subsequently enabled -- they'll just have to wait until the next 9477c478bd9Sstevel@tonic-gate * time around. 9487c478bd9Sstevel@tonic-gate */ 9497c478bd9Sstevel@tonic-gate if (tp->ftt_retids != NULL) { 9507c478bd9Sstevel@tonic-gate /* 9517c478bd9Sstevel@tonic-gate * We need to wait until the results of the instruction are 9527c478bd9Sstevel@tonic-gate * apparent before invoking any return probes. If this 9537c478bd9Sstevel@tonic-gate * instruction was emulated we can just call 9547c478bd9Sstevel@tonic-gate * fasttrap_return_common(); if it needs to be executed, we 9557c478bd9Sstevel@tonic-gate * need to wait until we return to the kernel. 9567c478bd9Sstevel@tonic-gate */ 9577c478bd9Sstevel@tonic-gate if (tp->ftt_type != FASTTRAP_T_COMMON) { 9587c478bd9Sstevel@tonic-gate fasttrap_return_common(rp, orig_pc, pid, fake_restore); 9597c478bd9Sstevel@tonic-gate } else { 9607c478bd9Sstevel@tonic-gate ASSERT(curthread->t_dtrace_ret != 0); 9617c478bd9Sstevel@tonic-gate ASSERT(curthread->t_dtrace_pc == orig_pc); 9627c478bd9Sstevel@tonic-gate ASSERT(curthread->t_dtrace_scrpc == rp->r_g7); 9637c478bd9Sstevel@tonic-gate ASSERT(npc == curthread->t_dtrace_astpc); 9647c478bd9Sstevel@tonic-gate } 9657c478bd9Sstevel@tonic-gate } 9667c478bd9Sstevel@tonic-gate 9677c478bd9Sstevel@tonic-gate ASSERT(pc != 0); 9687c478bd9Sstevel@tonic-gate rp->r_pc = pc; 9697c478bd9Sstevel@tonic-gate rp->r_npc = npc; 9707c478bd9Sstevel@tonic-gate 9717c478bd9Sstevel@tonic-gate return (0); 9727c478bd9Sstevel@tonic-gate } 9737c478bd9Sstevel@tonic-gate 9747c478bd9Sstevel@tonic-gate int 9757c478bd9Sstevel@tonic-gate fasttrap_return_probe(struct regs *rp) 9767c478bd9Sstevel@tonic-gate { 9777c478bd9Sstevel@tonic-gate proc_t *p = ttoproc(curthread); 9787c478bd9Sstevel@tonic-gate pid_t pid; 9797c478bd9Sstevel@tonic-gate uintptr_t pc = curthread->t_dtrace_pc; 9807c478bd9Sstevel@tonic-gate uintptr_t npc = curthread->t_dtrace_npc; 9817c478bd9Sstevel@tonic-gate 9827c478bd9Sstevel@tonic-gate curthread->t_dtrace_pc = 0; 9837c478bd9Sstevel@tonic-gate curthread->t_dtrace_npc = 0; 9847c478bd9Sstevel@tonic-gate curthread->t_dtrace_scrpc = 0; 9857c478bd9Sstevel@tonic-gate curthread->t_dtrace_astpc = 0; 9867c478bd9Sstevel@tonic-gate 9877c478bd9Sstevel@tonic-gate /* 9887c478bd9Sstevel@tonic-gate * Treat a child created by a call to vfork(2) as if it were its 9897c478bd9Sstevel@tonic-gate * parent. We know there's only one thread of control in such a 9907c478bd9Sstevel@tonic-gate * process: this one. 9917c478bd9Sstevel@tonic-gate */ 9927c478bd9Sstevel@tonic-gate while (p->p_flag & SVFORK) { 9937c478bd9Sstevel@tonic-gate p = p->p_parent; 9947c478bd9Sstevel@tonic-gate } 9957c478bd9Sstevel@tonic-gate 9967c478bd9Sstevel@tonic-gate /* 9977c478bd9Sstevel@tonic-gate * We set the %pc and %npc to their values when the traced 9987c478bd9Sstevel@tonic-gate * instruction was initially executed so that it appears to 9997c478bd9Sstevel@tonic-gate * dtrace_probe() that we're on the original instruction, and so that 10007c478bd9Sstevel@tonic-gate * the user can't easily detect our complex web of lies. 10017c478bd9Sstevel@tonic-gate * dtrace_return_probe() (our caller) will correctly set %pc and %npc 10027c478bd9Sstevel@tonic-gate * after we return. 10037c478bd9Sstevel@tonic-gate */ 10047c478bd9Sstevel@tonic-gate rp->r_pc = pc; 10057c478bd9Sstevel@tonic-gate rp->r_npc = npc; 10067c478bd9Sstevel@tonic-gate 10077c478bd9Sstevel@tonic-gate pid = p->p_pid; 10087c478bd9Sstevel@tonic-gate fasttrap_return_common(rp, pc, pid, 0); 10097c478bd9Sstevel@tonic-gate 10107c478bd9Sstevel@tonic-gate return (0); 10117c478bd9Sstevel@tonic-gate } 10127c478bd9Sstevel@tonic-gate 10137c478bd9Sstevel@tonic-gate int 10147c478bd9Sstevel@tonic-gate fasttrap_tracepoint_install(proc_t *p, fasttrap_tracepoint_t *tp) 10157c478bd9Sstevel@tonic-gate { 10167c478bd9Sstevel@tonic-gate fasttrap_instr_t instr = FASTTRAP_INSTR; 10177c478bd9Sstevel@tonic-gate 10187c478bd9Sstevel@tonic-gate if (uwrite(p, &instr, 4, tp->ftt_pc) != 0) 10197c478bd9Sstevel@tonic-gate return (-1); 10207c478bd9Sstevel@tonic-gate 10217c478bd9Sstevel@tonic-gate return (0); 10227c478bd9Sstevel@tonic-gate } 10237c478bd9Sstevel@tonic-gate 10247c478bd9Sstevel@tonic-gate int 10257c478bd9Sstevel@tonic-gate fasttrap_tracepoint_remove(proc_t *p, fasttrap_tracepoint_t *tp) 10267c478bd9Sstevel@tonic-gate { 10277c478bd9Sstevel@tonic-gate fasttrap_instr_t instr; 10287c478bd9Sstevel@tonic-gate 10297c478bd9Sstevel@tonic-gate /* 10307c478bd9Sstevel@tonic-gate * Distinguish between read or write failures and a changed 10317c478bd9Sstevel@tonic-gate * instruction. 10327c478bd9Sstevel@tonic-gate */ 10337c478bd9Sstevel@tonic-gate if (uread(p, &instr, 4, tp->ftt_pc) != 0) 10347c478bd9Sstevel@tonic-gate return (0); 10357c478bd9Sstevel@tonic-gate if (instr != FASTTRAP_INSTR && instr != BREAKPOINT_INSTR) 10367c478bd9Sstevel@tonic-gate return (0); 10377c478bd9Sstevel@tonic-gate if (uwrite(p, &tp->ftt_instr, 4, tp->ftt_pc) != 0) 10387c478bd9Sstevel@tonic-gate return (-1); 10397c478bd9Sstevel@tonic-gate 10407c478bd9Sstevel@tonic-gate return (0); 10417c478bd9Sstevel@tonic-gate } 10427c478bd9Sstevel@tonic-gate 10437c478bd9Sstevel@tonic-gate int 1044ac448965Sahl fasttrap_tracepoint_init(proc_t *p, fasttrap_tracepoint_t *tp, uintptr_t pc, 1045ac448965Sahl fasttrap_probe_type_t type) 10467c478bd9Sstevel@tonic-gate { 10477c478bd9Sstevel@tonic-gate uint32_t instr; 10487c478bd9Sstevel@tonic-gate int32_t disp; 10497c478bd9Sstevel@tonic-gate 10507c478bd9Sstevel@tonic-gate /* 10517c478bd9Sstevel@tonic-gate * Read the instruction at the given address out of the process's 10527c478bd9Sstevel@tonic-gate * address space. We don't have to worry about a debugger 10537c478bd9Sstevel@tonic-gate * changing this instruction before we overwrite it with our trap 10547c478bd9Sstevel@tonic-gate * instruction since P_PR_LOCK is set. 10557c478bd9Sstevel@tonic-gate */ 10567c478bd9Sstevel@tonic-gate if (uread(p, &instr, 4, pc) != 0) 10577c478bd9Sstevel@tonic-gate return (-1); 10587c478bd9Sstevel@tonic-gate 10597c478bd9Sstevel@tonic-gate /* 10607c478bd9Sstevel@tonic-gate * Decode the instruction to fill in the probe flags. We can have 10617c478bd9Sstevel@tonic-gate * the process execute most instructions on its own using a pc/npc 10627c478bd9Sstevel@tonic-gate * trick, but pc-relative control transfer present a problem since 10637c478bd9Sstevel@tonic-gate * we're relocating the instruction. We emulate these instructions 10647c478bd9Sstevel@tonic-gate * in the kernel. We assume a default type and over-write that as 10657c478bd9Sstevel@tonic-gate * needed. 10667c478bd9Sstevel@tonic-gate * 10677c478bd9Sstevel@tonic-gate * pc-relative instructions must be emulated for correctness; 10687c478bd9Sstevel@tonic-gate * other instructions (which represent a large set of commonly traced 10697c478bd9Sstevel@tonic-gate * instructions) are emulated or otherwise optimized for performance. 10707c478bd9Sstevel@tonic-gate */ 10717c478bd9Sstevel@tonic-gate tp->ftt_type = FASTTRAP_T_COMMON; 10727c478bd9Sstevel@tonic-gate if (OP(instr) == 1) { 10737c478bd9Sstevel@tonic-gate /* 10747c478bd9Sstevel@tonic-gate * Call instructions. 10757c478bd9Sstevel@tonic-gate */ 10767c478bd9Sstevel@tonic-gate tp->ftt_type = FASTTRAP_T_CALL; 10777c478bd9Sstevel@tonic-gate disp = DISP30(instr) << 2; 10787c478bd9Sstevel@tonic-gate tp->ftt_dest = pc + (intptr_t)disp; 10797c478bd9Sstevel@tonic-gate 10807c478bd9Sstevel@tonic-gate } else if (OP(instr) == 0) { 10817c478bd9Sstevel@tonic-gate /* 10827c478bd9Sstevel@tonic-gate * Branch instructions. 10837c478bd9Sstevel@tonic-gate * 10847c478bd9Sstevel@tonic-gate * Unconditional branches need careful attention when they're 10857c478bd9Sstevel@tonic-gate * annulled: annulled unconditional branches never execute 10867c478bd9Sstevel@tonic-gate * the instruction in the delay slot. 10877c478bd9Sstevel@tonic-gate */ 10887c478bd9Sstevel@tonic-gate switch (OP2(instr)) { 10897c478bd9Sstevel@tonic-gate case OP2_ILLTRAP: 10907c478bd9Sstevel@tonic-gate case 0x7: 10917c478bd9Sstevel@tonic-gate /* 10927c478bd9Sstevel@tonic-gate * The compiler may place an illtrap after a call to 10937c478bd9Sstevel@tonic-gate * a function that returns a structure. In the case of 10947c478bd9Sstevel@tonic-gate * a returned structure, the compiler places an illtrap 10957c478bd9Sstevel@tonic-gate * whose const22 field is the size of the returned 10967c478bd9Sstevel@tonic-gate * structure immediately following the delay slot of 10977c478bd9Sstevel@tonic-gate * the call. To stay out of the way, we refuse to 10987c478bd9Sstevel@tonic-gate * place tracepoints on top of illtrap instructions. 10997c478bd9Sstevel@tonic-gate * 11007c478bd9Sstevel@tonic-gate * This is one of the dumbest architectural decisions 11017c478bd9Sstevel@tonic-gate * I've ever had to work around. 11027c478bd9Sstevel@tonic-gate * 11037c478bd9Sstevel@tonic-gate * We also identify the only illegal op2 value (See 11047c478bd9Sstevel@tonic-gate * SPARC Architecture Manual Version 9, E.2 table 31). 11057c478bd9Sstevel@tonic-gate */ 11067c478bd9Sstevel@tonic-gate return (-1); 11077c478bd9Sstevel@tonic-gate 11087c478bd9Sstevel@tonic-gate case OP2_BPcc: 11097c478bd9Sstevel@tonic-gate if (COND(instr) == 8) { 11107c478bd9Sstevel@tonic-gate tp->ftt_type = FASTTRAP_T_ALWAYS; 11117c478bd9Sstevel@tonic-gate } else { 11127c478bd9Sstevel@tonic-gate /* 11137c478bd9Sstevel@tonic-gate * Check for an illegal instruction. 11147c478bd9Sstevel@tonic-gate */ 11157c478bd9Sstevel@tonic-gate if (CC(instr) & 1) 11167c478bd9Sstevel@tonic-gate return (-1); 11177c478bd9Sstevel@tonic-gate tp->ftt_type = FASTTRAP_T_CCR; 11187c478bd9Sstevel@tonic-gate tp->ftt_cc = CC(instr); 11197c478bd9Sstevel@tonic-gate tp->ftt_code = COND(instr); 11207c478bd9Sstevel@tonic-gate } 11217c478bd9Sstevel@tonic-gate 11227c478bd9Sstevel@tonic-gate if (A(instr) != 0) 11237c478bd9Sstevel@tonic-gate tp->ftt_flags |= FASTTRAP_F_ANNUL; 11247c478bd9Sstevel@tonic-gate 11257c478bd9Sstevel@tonic-gate disp = DISP19(instr); 11267c478bd9Sstevel@tonic-gate disp <<= 13; 11277c478bd9Sstevel@tonic-gate disp >>= 11; 11287c478bd9Sstevel@tonic-gate tp->ftt_dest = pc + (intptr_t)disp; 11297c478bd9Sstevel@tonic-gate break; 11307c478bd9Sstevel@tonic-gate 11317c478bd9Sstevel@tonic-gate case OP2_Bicc: 11327c478bd9Sstevel@tonic-gate if (COND(instr) == 8) { 11337c478bd9Sstevel@tonic-gate tp->ftt_type = FASTTRAP_T_ALWAYS; 11347c478bd9Sstevel@tonic-gate } else { 11357c478bd9Sstevel@tonic-gate tp->ftt_type = FASTTRAP_T_CCR; 11367c478bd9Sstevel@tonic-gate tp->ftt_cc = 0; 11377c478bd9Sstevel@tonic-gate tp->ftt_code = COND(instr); 11387c478bd9Sstevel@tonic-gate } 11397c478bd9Sstevel@tonic-gate 11407c478bd9Sstevel@tonic-gate if (A(instr) != 0) 11417c478bd9Sstevel@tonic-gate tp->ftt_flags |= FASTTRAP_F_ANNUL; 11427c478bd9Sstevel@tonic-gate 11437c478bd9Sstevel@tonic-gate disp = DISP22(instr); 11447c478bd9Sstevel@tonic-gate disp <<= 10; 11457c478bd9Sstevel@tonic-gate disp >>= 8; 11467c478bd9Sstevel@tonic-gate tp->ftt_dest = pc + (intptr_t)disp; 11477c478bd9Sstevel@tonic-gate break; 11487c478bd9Sstevel@tonic-gate 11497c478bd9Sstevel@tonic-gate case OP2_BPr: 11507c478bd9Sstevel@tonic-gate /* 11517c478bd9Sstevel@tonic-gate * Check for an illegal instruction. 11527c478bd9Sstevel@tonic-gate */ 11537c478bd9Sstevel@tonic-gate if ((RCOND(instr) & 3) == 0) 11547c478bd9Sstevel@tonic-gate return (-1); 11557c478bd9Sstevel@tonic-gate 11567c478bd9Sstevel@tonic-gate /* 11577c478bd9Sstevel@tonic-gate * It's a violation of the v8plus ABI to use a 11587c478bd9Sstevel@tonic-gate * register-predicated branch in a 32-bit app if 11597c478bd9Sstevel@tonic-gate * the register used is an %l or an %i (%gs and %os 11607c478bd9Sstevel@tonic-gate * are legit because they're not saved to the stack 11617c478bd9Sstevel@tonic-gate * in 32-bit words when we take a trap). 11627c478bd9Sstevel@tonic-gate */ 11637c478bd9Sstevel@tonic-gate if (p->p_model == DATAMODEL_ILP32 && RS1(instr) >= 16) 11647c478bd9Sstevel@tonic-gate return (-1); 11657c478bd9Sstevel@tonic-gate 11667c478bd9Sstevel@tonic-gate tp->ftt_type = FASTTRAP_T_REG; 11677c478bd9Sstevel@tonic-gate if (A(instr) != 0) 11687c478bd9Sstevel@tonic-gate tp->ftt_flags |= FASTTRAP_F_ANNUL; 11697c478bd9Sstevel@tonic-gate disp = DISP16(instr); 11707c478bd9Sstevel@tonic-gate disp <<= 16; 11717c478bd9Sstevel@tonic-gate disp >>= 14; 11727c478bd9Sstevel@tonic-gate tp->ftt_dest = pc + (intptr_t)disp; 11737c478bd9Sstevel@tonic-gate tp->ftt_code = RCOND(instr); 11747c478bd9Sstevel@tonic-gate break; 11757c478bd9Sstevel@tonic-gate 11767c478bd9Sstevel@tonic-gate case OP2_SETHI: 11777c478bd9Sstevel@tonic-gate tp->ftt_type = FASTTRAP_T_SETHI; 11787c478bd9Sstevel@tonic-gate break; 11797c478bd9Sstevel@tonic-gate 11807c478bd9Sstevel@tonic-gate case OP2_FBPfcc: 11817c478bd9Sstevel@tonic-gate if (COND(instr) == 8) { 11827c478bd9Sstevel@tonic-gate tp->ftt_type = FASTTRAP_T_ALWAYS; 11837c478bd9Sstevel@tonic-gate } else { 11847c478bd9Sstevel@tonic-gate tp->ftt_type = FASTTRAP_T_FCC; 11857c478bd9Sstevel@tonic-gate tp->ftt_cc = CC(instr); 11867c478bd9Sstevel@tonic-gate tp->ftt_code = COND(instr); 11877c478bd9Sstevel@tonic-gate } 11887c478bd9Sstevel@tonic-gate 11897c478bd9Sstevel@tonic-gate if (A(instr) != 0) 11907c478bd9Sstevel@tonic-gate tp->ftt_flags |= FASTTRAP_F_ANNUL; 11917c478bd9Sstevel@tonic-gate 11927c478bd9Sstevel@tonic-gate disp = DISP19(instr); 11937c478bd9Sstevel@tonic-gate disp <<= 13; 11947c478bd9Sstevel@tonic-gate disp >>= 11; 11957c478bd9Sstevel@tonic-gate tp->ftt_dest = pc + (intptr_t)disp; 11967c478bd9Sstevel@tonic-gate break; 11977c478bd9Sstevel@tonic-gate 11987c478bd9Sstevel@tonic-gate case OP2_FBfcc: 11997c478bd9Sstevel@tonic-gate if (COND(instr) == 8) { 12007c478bd9Sstevel@tonic-gate tp->ftt_type = FASTTRAP_T_ALWAYS; 12017c478bd9Sstevel@tonic-gate } else { 12027c478bd9Sstevel@tonic-gate tp->ftt_type = FASTTRAP_T_FCC; 12037c478bd9Sstevel@tonic-gate tp->ftt_cc = 0; 12047c478bd9Sstevel@tonic-gate tp->ftt_code = COND(instr); 12057c478bd9Sstevel@tonic-gate } 12067c478bd9Sstevel@tonic-gate 12077c478bd9Sstevel@tonic-gate if (A(instr) != 0) 12087c478bd9Sstevel@tonic-gate tp->ftt_flags |= FASTTRAP_F_ANNUL; 12097c478bd9Sstevel@tonic-gate 12107c478bd9Sstevel@tonic-gate disp = DISP22(instr); 12117c478bd9Sstevel@tonic-gate disp <<= 10; 12127c478bd9Sstevel@tonic-gate disp >>= 8; 12137c478bd9Sstevel@tonic-gate tp->ftt_dest = pc + (intptr_t)disp; 12147c478bd9Sstevel@tonic-gate break; 12157c478bd9Sstevel@tonic-gate } 12167c478bd9Sstevel@tonic-gate 12177c478bd9Sstevel@tonic-gate } else if (OP(instr) == 2) { 12187c478bd9Sstevel@tonic-gate switch (OP3(instr)) { 12197c478bd9Sstevel@tonic-gate case OP3_RETURN: 12207c478bd9Sstevel@tonic-gate tp->ftt_type = FASTTRAP_T_RETURN; 12217c478bd9Sstevel@tonic-gate break; 12227c478bd9Sstevel@tonic-gate 12237c478bd9Sstevel@tonic-gate case OP3_JMPL: 12247c478bd9Sstevel@tonic-gate tp->ftt_type = FASTTRAP_T_JMPL; 12257c478bd9Sstevel@tonic-gate break; 12267c478bd9Sstevel@tonic-gate 12277c478bd9Sstevel@tonic-gate case OP3_RD: 12287c478bd9Sstevel@tonic-gate if (RS1(instr) == 5) 12297c478bd9Sstevel@tonic-gate tp->ftt_type = FASTTRAP_T_RDPC; 12307c478bd9Sstevel@tonic-gate break; 12317c478bd9Sstevel@tonic-gate 12327c478bd9Sstevel@tonic-gate case OP3_SAVE: 12337c478bd9Sstevel@tonic-gate /* 12347c478bd9Sstevel@tonic-gate * We optimize for save instructions at function 12357c478bd9Sstevel@tonic-gate * entry; see the comment in fasttrap_pid_probe() 12367c478bd9Sstevel@tonic-gate * (near FASTTRAP_T_SAVE) for details. 12377c478bd9Sstevel@tonic-gate */ 12387c478bd9Sstevel@tonic-gate if (fasttrap_optimize_save != 0 && 1239ac448965Sahl type == DTFTP_ENTRY && 12407c478bd9Sstevel@tonic-gate I(instr) == 1 && RD(instr) == R_SP) 12417c478bd9Sstevel@tonic-gate tp->ftt_type = FASTTRAP_T_SAVE; 12427c478bd9Sstevel@tonic-gate break; 12437c478bd9Sstevel@tonic-gate 12447c478bd9Sstevel@tonic-gate case OP3_RESTORE: 12457c478bd9Sstevel@tonic-gate /* 12467c478bd9Sstevel@tonic-gate * We optimize restore instructions at function 12477c478bd9Sstevel@tonic-gate * return; see the comment in fasttrap_pid_probe() 12487c478bd9Sstevel@tonic-gate * (near FASTTRAP_T_RESTORE) for details. 12497c478bd9Sstevel@tonic-gate * 12507c478bd9Sstevel@tonic-gate * rd must be an %o or %g register. 12517c478bd9Sstevel@tonic-gate */ 12527c478bd9Sstevel@tonic-gate if ((RD(instr) & 0x10) == 0) 12537c478bd9Sstevel@tonic-gate tp->ftt_type = FASTTRAP_T_RESTORE; 12547c478bd9Sstevel@tonic-gate break; 12557c478bd9Sstevel@tonic-gate 12567c478bd9Sstevel@tonic-gate case OP3_OR: 12577c478bd9Sstevel@tonic-gate /* 12587c478bd9Sstevel@tonic-gate * A large proportion of instructions in the delay 12597c478bd9Sstevel@tonic-gate * slot of retl instructions are or's so we emulate 12607c478bd9Sstevel@tonic-gate * these downstairs as an optimization. 12617c478bd9Sstevel@tonic-gate */ 12627c478bd9Sstevel@tonic-gate tp->ftt_type = FASTTRAP_T_OR; 12637c478bd9Sstevel@tonic-gate break; 12647c478bd9Sstevel@tonic-gate 12657c478bd9Sstevel@tonic-gate case OP3_TCC: 12667c478bd9Sstevel@tonic-gate /* 12677c478bd9Sstevel@tonic-gate * Breakpoint instructions are effectively position- 12687c478bd9Sstevel@tonic-gate * dependent since the debugger uses the %pc value 12697c478bd9Sstevel@tonic-gate * to lookup which breakpoint was executed. As a 12707c478bd9Sstevel@tonic-gate * result, we can't actually instrument breakpoints. 12717c478bd9Sstevel@tonic-gate */ 12727c478bd9Sstevel@tonic-gate if (SW_TRAP(instr) == ST_BREAKPOINT) 12737c478bd9Sstevel@tonic-gate return (-1); 12747c478bd9Sstevel@tonic-gate break; 12757c478bd9Sstevel@tonic-gate 12767c478bd9Sstevel@tonic-gate case 0x19: 12777c478bd9Sstevel@tonic-gate case 0x1d: 12787c478bd9Sstevel@tonic-gate case 0x29: 12797c478bd9Sstevel@tonic-gate case 0x33: 12807c478bd9Sstevel@tonic-gate case 0x3f: 12817c478bd9Sstevel@tonic-gate /* 12827c478bd9Sstevel@tonic-gate * Identify illegal instructions (See SPARC 12837c478bd9Sstevel@tonic-gate * Architecture Manual Version 9, E.2 table 32). 12847c478bd9Sstevel@tonic-gate */ 12857c478bd9Sstevel@tonic-gate return (-1); 12867c478bd9Sstevel@tonic-gate } 12877c478bd9Sstevel@tonic-gate } else if (OP(instr) == 3) { 12887c478bd9Sstevel@tonic-gate uint32_t op3 = OP3(instr); 12897c478bd9Sstevel@tonic-gate 12907c478bd9Sstevel@tonic-gate /* 12917c478bd9Sstevel@tonic-gate * Identify illegal instructions (See SPARC Architecture 12927c478bd9Sstevel@tonic-gate * Manual Version 9, E.2 table 33). 12937c478bd9Sstevel@tonic-gate */ 12947c478bd9Sstevel@tonic-gate if ((op3 & 0x28) == 0x28) { 12957c478bd9Sstevel@tonic-gate if (op3 != OP3_PREFETCH && op3 != OP3_CASA && 12967c478bd9Sstevel@tonic-gate op3 != OP3_PREFETCHA && op3 != OP3_CASXA) 12977c478bd9Sstevel@tonic-gate return (-1); 12987c478bd9Sstevel@tonic-gate } else { 12997c478bd9Sstevel@tonic-gate if ((op3 & 0x0f) == 0x0c || (op3 & 0x3b) == 0x31) 13007c478bd9Sstevel@tonic-gate return (-1); 13017c478bd9Sstevel@tonic-gate } 13027c478bd9Sstevel@tonic-gate } 13037c478bd9Sstevel@tonic-gate 13047c478bd9Sstevel@tonic-gate tp->ftt_instr = instr; 13057c478bd9Sstevel@tonic-gate 13067c478bd9Sstevel@tonic-gate /* 13077c478bd9Sstevel@tonic-gate * We don't know how this tracepoint is going to be used, but in case 13087c478bd9Sstevel@tonic-gate * it's used as part of a function return probe, we need to indicate 13097c478bd9Sstevel@tonic-gate * whether it's always a return site or only potentially a return 13107c478bd9Sstevel@tonic-gate * site. If it's part of a return probe, it's always going to be a 13117c478bd9Sstevel@tonic-gate * return from that function if it's a restore instruction or if 13127c478bd9Sstevel@tonic-gate * the previous instruction was a return. If we could reliably 13137c478bd9Sstevel@tonic-gate * distinguish jump tables from return sites, this wouldn't be 13147c478bd9Sstevel@tonic-gate * necessary. 13157c478bd9Sstevel@tonic-gate */ 13167c478bd9Sstevel@tonic-gate if (tp->ftt_type != FASTTRAP_T_RESTORE && 13177c478bd9Sstevel@tonic-gate (uread(p, &instr, 4, pc - sizeof (instr)) != 0 || 13187c478bd9Sstevel@tonic-gate !(OP(instr) == 2 && OP3(instr) == OP3_RETURN))) 13197c478bd9Sstevel@tonic-gate tp->ftt_flags |= FASTTRAP_F_RETMAYBE; 13207c478bd9Sstevel@tonic-gate 13217c478bd9Sstevel@tonic-gate return (0); 13227c478bd9Sstevel@tonic-gate } 13237c478bd9Sstevel@tonic-gate 13247c478bd9Sstevel@tonic-gate /*ARGSUSED*/ 13257c478bd9Sstevel@tonic-gate uint64_t 1326f498645aSahl fasttrap_pid_getarg(void *arg, dtrace_id_t id, void *parg, int argno, 1327f498645aSahl int aframes) 13287c478bd9Sstevel@tonic-gate { 13297c478bd9Sstevel@tonic-gate return (fasttrap_anarg(ttolwp(curthread)->lwp_regs, argno)); 13307c478bd9Sstevel@tonic-gate } 13317c478bd9Sstevel@tonic-gate 13327c478bd9Sstevel@tonic-gate /*ARGSUSED*/ 13337c478bd9Sstevel@tonic-gate uint64_t 13347c478bd9Sstevel@tonic-gate fasttrap_usdt_getarg(void *arg, dtrace_id_t id, void *parg, int argno, 13357c478bd9Sstevel@tonic-gate int aframes) 13367c478bd9Sstevel@tonic-gate { 13377c478bd9Sstevel@tonic-gate return (fasttrap_anarg(ttolwp(curthread)->lwp_regs, argno)); 13387c478bd9Sstevel@tonic-gate } 13397c478bd9Sstevel@tonic-gate 13407c478bd9Sstevel@tonic-gate static uint64_t fasttrap_getreg_fast_cnt; 13417c478bd9Sstevel@tonic-gate static uint64_t fasttrap_getreg_mpcb_cnt; 13427c478bd9Sstevel@tonic-gate static uint64_t fasttrap_getreg_slow_cnt; 13437c478bd9Sstevel@tonic-gate 13447c478bd9Sstevel@tonic-gate static ulong_t 13457c478bd9Sstevel@tonic-gate fasttrap_getreg(struct regs *rp, uint_t reg) 13467c478bd9Sstevel@tonic-gate { 13477c478bd9Sstevel@tonic-gate ulong_t value; 13487c478bd9Sstevel@tonic-gate dtrace_icookie_t cookie; 13497c478bd9Sstevel@tonic-gate struct machpcb *mpcb; 13507c478bd9Sstevel@tonic-gate extern ulong_t dtrace_getreg_win(uint_t, uint_t); 13517c478bd9Sstevel@tonic-gate 13527c478bd9Sstevel@tonic-gate /* 13537c478bd9Sstevel@tonic-gate * We have the %os and %gs in our struct regs, but if we need to 13547c478bd9Sstevel@tonic-gate * snag a %l or %i we need to go scrounging around in the process's 13557c478bd9Sstevel@tonic-gate * address space. 13567c478bd9Sstevel@tonic-gate */ 13577c478bd9Sstevel@tonic-gate if (reg == 0) 13587c478bd9Sstevel@tonic-gate return (0); 13597c478bd9Sstevel@tonic-gate 13607c478bd9Sstevel@tonic-gate if (reg < 16) 13617c478bd9Sstevel@tonic-gate return ((&rp->r_g1)[reg - 1]); 13627c478bd9Sstevel@tonic-gate 13637c478bd9Sstevel@tonic-gate /* 13647c478bd9Sstevel@tonic-gate * Before we look at the user's stack, we'll check the register 13657c478bd9Sstevel@tonic-gate * windows to see if the information we want is in there. 13667c478bd9Sstevel@tonic-gate */ 13677c478bd9Sstevel@tonic-gate cookie = dtrace_interrupt_disable(); 13687c478bd9Sstevel@tonic-gate if (dtrace_getotherwin() > 0) { 13697c478bd9Sstevel@tonic-gate value = dtrace_getreg_win(reg, 1); 13707c478bd9Sstevel@tonic-gate dtrace_interrupt_enable(cookie); 13717c478bd9Sstevel@tonic-gate 13727c478bd9Sstevel@tonic-gate atomic_add_64(&fasttrap_getreg_fast_cnt, 1); 13737c478bd9Sstevel@tonic-gate 13747c478bd9Sstevel@tonic-gate return (value); 13757c478bd9Sstevel@tonic-gate } 13767c478bd9Sstevel@tonic-gate dtrace_interrupt_enable(cookie); 13777c478bd9Sstevel@tonic-gate 13787c478bd9Sstevel@tonic-gate /* 13797c478bd9Sstevel@tonic-gate * First check the machpcb structure to see if we've already read 13807c478bd9Sstevel@tonic-gate * in the register window we're looking for; if we haven't, (and 13817c478bd9Sstevel@tonic-gate * we probably haven't) try to copy in the value of the register. 13827c478bd9Sstevel@tonic-gate */ 1383*73427c57Sahl /* LINTED - alignment */ 13847c478bd9Sstevel@tonic-gate mpcb = (struct machpcb *)((caddr_t)rp - REGOFF); 13857c478bd9Sstevel@tonic-gate 13867c478bd9Sstevel@tonic-gate if (get_udatamodel() == DATAMODEL_NATIVE) { 13877c478bd9Sstevel@tonic-gate struct frame *fr = (struct frame *)(rp->r_sp + STACK_BIAS); 13887c478bd9Sstevel@tonic-gate 13897c478bd9Sstevel@tonic-gate if (mpcb->mpcb_wbcnt > 0) { 13907c478bd9Sstevel@tonic-gate struct rwindow *rwin = (void *)mpcb->mpcb_wbuf; 13917c478bd9Sstevel@tonic-gate int i = mpcb->mpcb_wbcnt; 13927c478bd9Sstevel@tonic-gate do { 13937c478bd9Sstevel@tonic-gate i--; 13947c478bd9Sstevel@tonic-gate if ((long)mpcb->mpcb_spbuf[i] != rp->r_sp) 13957c478bd9Sstevel@tonic-gate continue; 13967c478bd9Sstevel@tonic-gate 13977c478bd9Sstevel@tonic-gate atomic_add_64(&fasttrap_getreg_mpcb_cnt, 1); 13987c478bd9Sstevel@tonic-gate return (rwin[i].rw_local[reg - 16]); 13997c478bd9Sstevel@tonic-gate } while (i > 0); 14007c478bd9Sstevel@tonic-gate } 14017c478bd9Sstevel@tonic-gate 14027c478bd9Sstevel@tonic-gate if (fasttrap_fulword(&fr->fr_local[reg - 16], &value) != 0) 14037c478bd9Sstevel@tonic-gate goto err; 14047c478bd9Sstevel@tonic-gate } else { 140575521904Sraf struct frame32 *fr = 140675521904Sraf (struct frame32 *)(uintptr_t)(caddr32_t)rp->r_sp; 14077c478bd9Sstevel@tonic-gate uint32_t *v32 = (uint32_t *)&value; 14087c478bd9Sstevel@tonic-gate 14097c478bd9Sstevel@tonic-gate if (mpcb->mpcb_wbcnt > 0) { 14107c478bd9Sstevel@tonic-gate struct rwindow32 *rwin = (void *)mpcb->mpcb_wbuf; 14117c478bd9Sstevel@tonic-gate int i = mpcb->mpcb_wbcnt; 14127c478bd9Sstevel@tonic-gate do { 14137c478bd9Sstevel@tonic-gate i--; 14147c478bd9Sstevel@tonic-gate if ((long)mpcb->mpcb_spbuf[i] != rp->r_sp) 14157c478bd9Sstevel@tonic-gate continue; 14167c478bd9Sstevel@tonic-gate 14177c478bd9Sstevel@tonic-gate atomic_add_64(&fasttrap_getreg_mpcb_cnt, 1); 14187c478bd9Sstevel@tonic-gate return (rwin[i].rw_local[reg - 16]); 14197c478bd9Sstevel@tonic-gate } while (i > 0); 14207c478bd9Sstevel@tonic-gate } 14217c478bd9Sstevel@tonic-gate 14227c478bd9Sstevel@tonic-gate if (fasttrap_fuword32(&fr->fr_local[reg - 16], &v32[1]) != 0) 14237c478bd9Sstevel@tonic-gate goto err; 14247c478bd9Sstevel@tonic-gate 14257c478bd9Sstevel@tonic-gate v32[0] = 0; 14267c478bd9Sstevel@tonic-gate } 14277c478bd9Sstevel@tonic-gate 14287c478bd9Sstevel@tonic-gate atomic_add_64(&fasttrap_getreg_slow_cnt, 1); 14297c478bd9Sstevel@tonic-gate return (value); 14307c478bd9Sstevel@tonic-gate 14317c478bd9Sstevel@tonic-gate err: 14327c478bd9Sstevel@tonic-gate /* 14337c478bd9Sstevel@tonic-gate * If the copy in failed, the process will be in a irrecoverable 14347c478bd9Sstevel@tonic-gate * state, and we have no choice but to kill it. 14357c478bd9Sstevel@tonic-gate */ 14367c478bd9Sstevel@tonic-gate psignal(ttoproc(curthread), SIGILL); 14377c478bd9Sstevel@tonic-gate return (0); 14387c478bd9Sstevel@tonic-gate } 14397c478bd9Sstevel@tonic-gate 14407c478bd9Sstevel@tonic-gate static uint64_t fasttrap_putreg_fast_cnt; 14417c478bd9Sstevel@tonic-gate static uint64_t fasttrap_putreg_mpcb_cnt; 14427c478bd9Sstevel@tonic-gate static uint64_t fasttrap_putreg_slow_cnt; 14437c478bd9Sstevel@tonic-gate 14447c478bd9Sstevel@tonic-gate static void 14457c478bd9Sstevel@tonic-gate fasttrap_putreg(struct regs *rp, uint_t reg, ulong_t value) 14467c478bd9Sstevel@tonic-gate { 14477c478bd9Sstevel@tonic-gate dtrace_icookie_t cookie; 14487c478bd9Sstevel@tonic-gate struct machpcb *mpcb; 14497c478bd9Sstevel@tonic-gate extern void dtrace_putreg_win(uint_t, ulong_t); 14507c478bd9Sstevel@tonic-gate 14517c478bd9Sstevel@tonic-gate if (reg == 0) 14527c478bd9Sstevel@tonic-gate return; 14537c478bd9Sstevel@tonic-gate 14547c478bd9Sstevel@tonic-gate if (reg < 16) { 14557c478bd9Sstevel@tonic-gate (&rp->r_g1)[reg - 1] = value; 14567c478bd9Sstevel@tonic-gate return; 14577c478bd9Sstevel@tonic-gate } 14587c478bd9Sstevel@tonic-gate 14597c478bd9Sstevel@tonic-gate /* 14607c478bd9Sstevel@tonic-gate * If the user process is still using some register windows, we 14617c478bd9Sstevel@tonic-gate * can just place the value in the correct window. 14627c478bd9Sstevel@tonic-gate */ 14637c478bd9Sstevel@tonic-gate cookie = dtrace_interrupt_disable(); 14647c478bd9Sstevel@tonic-gate if (dtrace_getotherwin() > 0) { 14657c478bd9Sstevel@tonic-gate dtrace_putreg_win(reg, value); 14667c478bd9Sstevel@tonic-gate dtrace_interrupt_enable(cookie); 14677c478bd9Sstevel@tonic-gate atomic_add_64(&fasttrap_putreg_fast_cnt, 1); 14687c478bd9Sstevel@tonic-gate return; 14697c478bd9Sstevel@tonic-gate } 14707c478bd9Sstevel@tonic-gate dtrace_interrupt_enable(cookie); 14717c478bd9Sstevel@tonic-gate 14727c478bd9Sstevel@tonic-gate /* 14737c478bd9Sstevel@tonic-gate * First see if there's a copy of the register window in the 14747c478bd9Sstevel@tonic-gate * machpcb structure that we can modify; if there isn't try to 14757c478bd9Sstevel@tonic-gate * copy out the value. If that fails, we try to create a new 14767c478bd9Sstevel@tonic-gate * register window in the machpcb structure. While this isn't 14777c478bd9Sstevel@tonic-gate * _precisely_ the intended use of the machpcb structure, it 14787c478bd9Sstevel@tonic-gate * can't cause any problems since we know at this point in the 14797c478bd9Sstevel@tonic-gate * code that all of the user's data have been flushed out of the 14807c478bd9Sstevel@tonic-gate * register file (since %otherwin is 0). 14817c478bd9Sstevel@tonic-gate */ 1482*73427c57Sahl /* LINTED - alignment */ 14837c478bd9Sstevel@tonic-gate mpcb = (struct machpcb *)((caddr_t)rp - REGOFF); 14847c478bd9Sstevel@tonic-gate 14857c478bd9Sstevel@tonic-gate if (get_udatamodel() == DATAMODEL_NATIVE) { 14867c478bd9Sstevel@tonic-gate struct frame *fr = (struct frame *)(rp->r_sp + STACK_BIAS); 1487*73427c57Sahl /* LINTED - alignment */ 14887c478bd9Sstevel@tonic-gate struct rwindow *rwin = (struct rwindow *)mpcb->mpcb_wbuf; 14897c478bd9Sstevel@tonic-gate 14907c478bd9Sstevel@tonic-gate if (mpcb->mpcb_wbcnt > 0) { 14917c478bd9Sstevel@tonic-gate int i = mpcb->mpcb_wbcnt; 14927c478bd9Sstevel@tonic-gate do { 14937c478bd9Sstevel@tonic-gate i--; 14947c478bd9Sstevel@tonic-gate if ((long)mpcb->mpcb_spbuf[i] != rp->r_sp) 14957c478bd9Sstevel@tonic-gate continue; 14967c478bd9Sstevel@tonic-gate 14977c478bd9Sstevel@tonic-gate rwin[i].rw_local[reg - 16] = value; 14987c478bd9Sstevel@tonic-gate atomic_add_64(&fasttrap_putreg_mpcb_cnt, 1); 14997c478bd9Sstevel@tonic-gate return; 15007c478bd9Sstevel@tonic-gate } while (i > 0); 15017c478bd9Sstevel@tonic-gate } 15027c478bd9Sstevel@tonic-gate 15037c478bd9Sstevel@tonic-gate if (fasttrap_sulword(&fr->fr_local[reg - 16], value) != 0) { 15047c478bd9Sstevel@tonic-gate if (mpcb->mpcb_wbcnt >= MAXWIN || copyin(fr, 15057c478bd9Sstevel@tonic-gate &rwin[mpcb->mpcb_wbcnt], sizeof (*rwin)) != 0) 15067c478bd9Sstevel@tonic-gate goto err; 15077c478bd9Sstevel@tonic-gate 15087c478bd9Sstevel@tonic-gate rwin[mpcb->mpcb_wbcnt].rw_local[reg - 16] = value; 15097c478bd9Sstevel@tonic-gate mpcb->mpcb_spbuf[mpcb->mpcb_wbcnt] = (caddr_t)rp->r_sp; 15107c478bd9Sstevel@tonic-gate mpcb->mpcb_wbcnt++; 15117c478bd9Sstevel@tonic-gate atomic_add_64(&fasttrap_putreg_mpcb_cnt, 1); 15127c478bd9Sstevel@tonic-gate return; 15137c478bd9Sstevel@tonic-gate } 15147c478bd9Sstevel@tonic-gate } else { 151575521904Sraf struct frame32 *fr = 151675521904Sraf (struct frame32 *)(uintptr_t)(caddr32_t)rp->r_sp; 1517*73427c57Sahl /* LINTED - alignment */ 15187c478bd9Sstevel@tonic-gate struct rwindow32 *rwin = (struct rwindow32 *)mpcb->mpcb_wbuf; 15197c478bd9Sstevel@tonic-gate uint32_t v32 = (uint32_t)value; 15207c478bd9Sstevel@tonic-gate 15217c478bd9Sstevel@tonic-gate if (mpcb->mpcb_wbcnt > 0) { 15227c478bd9Sstevel@tonic-gate int i = mpcb->mpcb_wbcnt; 15237c478bd9Sstevel@tonic-gate do { 15247c478bd9Sstevel@tonic-gate i--; 15257c478bd9Sstevel@tonic-gate if ((long)mpcb->mpcb_spbuf[i] != rp->r_sp) 15267c478bd9Sstevel@tonic-gate continue; 15277c478bd9Sstevel@tonic-gate 15287c478bd9Sstevel@tonic-gate rwin[i].rw_local[reg - 16] = v32; 15297c478bd9Sstevel@tonic-gate atomic_add_64(&fasttrap_putreg_mpcb_cnt, 1); 15307c478bd9Sstevel@tonic-gate return; 15317c478bd9Sstevel@tonic-gate } while (i > 0); 15327c478bd9Sstevel@tonic-gate } 15337c478bd9Sstevel@tonic-gate 15347c478bd9Sstevel@tonic-gate if (fasttrap_suword32(&fr->fr_local[reg - 16], v32) != 0) { 15357c478bd9Sstevel@tonic-gate if (mpcb->mpcb_wbcnt >= MAXWIN || copyin(fr, 15367c478bd9Sstevel@tonic-gate &rwin[mpcb->mpcb_wbcnt], sizeof (*rwin)) != 0) 15377c478bd9Sstevel@tonic-gate goto err; 15387c478bd9Sstevel@tonic-gate 15397c478bd9Sstevel@tonic-gate rwin[mpcb->mpcb_wbcnt].rw_local[reg - 16] = v32; 15407c478bd9Sstevel@tonic-gate mpcb->mpcb_spbuf[mpcb->mpcb_wbcnt] = (caddr_t)rp->r_sp; 15417c478bd9Sstevel@tonic-gate mpcb->mpcb_wbcnt++; 15427c478bd9Sstevel@tonic-gate atomic_add_64(&fasttrap_putreg_mpcb_cnt, 1); 15437c478bd9Sstevel@tonic-gate return; 15447c478bd9Sstevel@tonic-gate } 15457c478bd9Sstevel@tonic-gate } 15467c478bd9Sstevel@tonic-gate 15477c478bd9Sstevel@tonic-gate atomic_add_64(&fasttrap_putreg_slow_cnt, 1); 15487c478bd9Sstevel@tonic-gate return; 15497c478bd9Sstevel@tonic-gate 15507c478bd9Sstevel@tonic-gate err: 15517c478bd9Sstevel@tonic-gate /* 15527c478bd9Sstevel@tonic-gate * If we couldn't record this register's value, the process is in an 15537c478bd9Sstevel@tonic-gate * irrecoverable state and we have no choice but to euthanize it. 15547c478bd9Sstevel@tonic-gate */ 15557c478bd9Sstevel@tonic-gate psignal(ttoproc(curthread), SIGILL); 15567c478bd9Sstevel@tonic-gate } 1557