17c478bd9Sstevel@tonic-gate /* 27c478bd9Sstevel@tonic-gate * CDDL HEADER START 37c478bd9Sstevel@tonic-gate * 47c478bd9Sstevel@tonic-gate * The contents of this file are subject to the terms of the 5*ac448965Sahl * Common Development and Distribution License (the "License"). 6*ac448965Sahl * You may not use this file except in compliance with the License. 77c478bd9Sstevel@tonic-gate * 87c478bd9Sstevel@tonic-gate * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 97c478bd9Sstevel@tonic-gate * or http://www.opensolaris.org/os/licensing. 107c478bd9Sstevel@tonic-gate * See the License for the specific language governing permissions 117c478bd9Sstevel@tonic-gate * and limitations under the License. 127c478bd9Sstevel@tonic-gate * 137c478bd9Sstevel@tonic-gate * When distributing Covered Code, include this CDDL HEADER in each 147c478bd9Sstevel@tonic-gate * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 157c478bd9Sstevel@tonic-gate * If applicable, add the following below this CDDL HEADER, with the 167c478bd9Sstevel@tonic-gate * fields enclosed by brackets "[]" replaced with your own identifying 177c478bd9Sstevel@tonic-gate * information: Portions Copyright [yyyy] [name of copyright owner] 187c478bd9Sstevel@tonic-gate * 197c478bd9Sstevel@tonic-gate * CDDL HEADER END 207c478bd9Sstevel@tonic-gate */ 2175521904Sraf 227c478bd9Sstevel@tonic-gate /* 23*ac448965Sahl * Copyright 2006 Sun Microsystems, Inc. All rights reserved. 247c478bd9Sstevel@tonic-gate * Use is subject to license terms. 257c478bd9Sstevel@tonic-gate */ 267c478bd9Sstevel@tonic-gate 277c478bd9Sstevel@tonic-gate #pragma ident "%Z%%M% %I% %E% SMI" 287c478bd9Sstevel@tonic-gate 297c478bd9Sstevel@tonic-gate #include <sys/fasttrap_isa.h> 307c478bd9Sstevel@tonic-gate #include <sys/fasttrap_impl.h> 317c478bd9Sstevel@tonic-gate #include <sys/dtrace.h> 327c478bd9Sstevel@tonic-gate #include <sys/dtrace_impl.h> 337c478bd9Sstevel@tonic-gate #include <sys/cmn_err.h> 347c478bd9Sstevel@tonic-gate #include <sys/frame.h> 357c478bd9Sstevel@tonic-gate #include <sys/stack.h> 367c478bd9Sstevel@tonic-gate #include <sys/sysmacros.h> 377c478bd9Sstevel@tonic-gate #include <sys/trap.h> 387c478bd9Sstevel@tonic-gate 397c478bd9Sstevel@tonic-gate #include <v9/sys/machpcb.h> 407c478bd9Sstevel@tonic-gate #include <v9/sys/privregs.h> 417c478bd9Sstevel@tonic-gate 427c478bd9Sstevel@tonic-gate /* 437c478bd9Sstevel@tonic-gate * Lossless User-Land Tracing on SPARC 447c478bd9Sstevel@tonic-gate * ----------------------------------- 457c478bd9Sstevel@tonic-gate * 467c478bd9Sstevel@tonic-gate * The Basic Idea 477c478bd9Sstevel@tonic-gate * 487c478bd9Sstevel@tonic-gate * The most important design constraint is, of course, correct execution of 497c478bd9Sstevel@tonic-gate * the user thread above all else. The next most important goal is rapid 507c478bd9Sstevel@tonic-gate * execution. We combine execution of instructions in user-land with 517c478bd9Sstevel@tonic-gate * emulation of certain instructions in the kernel to aim for complete 527c478bd9Sstevel@tonic-gate * correctness and maximal performance. 537c478bd9Sstevel@tonic-gate * 547c478bd9Sstevel@tonic-gate * We take advantage of the split PC/NPC architecture to speed up logical 557c478bd9Sstevel@tonic-gate * single-stepping; when we copy an instruction out to the scratch space in 567c478bd9Sstevel@tonic-gate * the ulwp_t structure (held in the %g7 register on SPARC), we can 577c478bd9Sstevel@tonic-gate * effectively single step by setting the PC to our scratch space and leaving 587c478bd9Sstevel@tonic-gate * the NPC alone. This executes the replaced instruction and then continues 597c478bd9Sstevel@tonic-gate * on without having to reenter the kernel as with single- stepping. The 607c478bd9Sstevel@tonic-gate * obvious caveat is for instructions whose execution is PC dependant -- 617c478bd9Sstevel@tonic-gate * branches, call and link instructions (call and jmpl), and the rdpc 627c478bd9Sstevel@tonic-gate * instruction. These instructions cannot be executed in the manner described 637c478bd9Sstevel@tonic-gate * so they must be emulated in the kernel. 647c478bd9Sstevel@tonic-gate * 657c478bd9Sstevel@tonic-gate * Emulation for this small set of instructions if fairly simple; the most 667c478bd9Sstevel@tonic-gate * difficult part being emulating branch conditions. 677c478bd9Sstevel@tonic-gate * 687c478bd9Sstevel@tonic-gate * 697c478bd9Sstevel@tonic-gate * A Cache Heavy Portfolio 707c478bd9Sstevel@tonic-gate * 717c478bd9Sstevel@tonic-gate * It's important to note at this time that copying an instruction out to the 727c478bd9Sstevel@tonic-gate * ulwp_t scratch space in user-land is rather complicated. SPARC has 737c478bd9Sstevel@tonic-gate * separate data and instruction caches so any writes to the D$ (using a 747c478bd9Sstevel@tonic-gate * store instruction for example) aren't necessarily reflected in the I$. 757c478bd9Sstevel@tonic-gate * The flush instruction can be used to synchronize the two and must be used 767c478bd9Sstevel@tonic-gate * for any self-modifying code, but the flush instruction only applies to the 777c478bd9Sstevel@tonic-gate * primary address space (the absence of a flusha analogue to the flush 787c478bd9Sstevel@tonic-gate * instruction that accepts an ASI argument is an obvious omission from SPARC 797c478bd9Sstevel@tonic-gate * v9 where the notion of the alternate address space was introduced on 807c478bd9Sstevel@tonic-gate * SPARC). To correctly copy out the instruction we must use a block store 817c478bd9Sstevel@tonic-gate * that doesn't allocate in the D$ and ensures synchronization with the I$; 827c478bd9Sstevel@tonic-gate * see dtrace_blksuword32() for the implementation (this function uses 837c478bd9Sstevel@tonic-gate * ASI_BLK_COMMIT_S to write a block through the secondary ASI in the manner 847c478bd9Sstevel@tonic-gate * described). Refer to the UltraSPARC I/II manual for details on the 857c478bd9Sstevel@tonic-gate * ASI_BLK_COMMIT_S ASI. 867c478bd9Sstevel@tonic-gate * 877c478bd9Sstevel@tonic-gate * 887c478bd9Sstevel@tonic-gate * Return Subtleties 897c478bd9Sstevel@tonic-gate * 907c478bd9Sstevel@tonic-gate * When we're firing a return probe we need to expose the value returned by 917c478bd9Sstevel@tonic-gate * the function being traced. Since the function can set the return value 927c478bd9Sstevel@tonic-gate * in its last instruction, we need to fire the return probe only _after_ 937c478bd9Sstevel@tonic-gate * the effects of the instruction are apparent. For instructions that we 947c478bd9Sstevel@tonic-gate * emulate, we can call dtrace_probe() after we've performed the emulation; 957c478bd9Sstevel@tonic-gate * for instructions that we execute after we return to user-land, we set 967c478bd9Sstevel@tonic-gate * %pc to the instruction we copied out (as described above) and set %npc 977c478bd9Sstevel@tonic-gate * to a trap instruction stashed in the ulwp_t structure. After the traced 987c478bd9Sstevel@tonic-gate * instruction is executed, the trap instruction returns control to the 997c478bd9Sstevel@tonic-gate * kernel where we can fire the return probe. 1007c478bd9Sstevel@tonic-gate * 1017c478bd9Sstevel@tonic-gate * This need for a second trap in cases where we execute the traced 1027c478bd9Sstevel@tonic-gate * instruction makes it all the more important to emulate the most common 1037c478bd9Sstevel@tonic-gate * instructions to avoid the second trip in and out of the kernel. 1047c478bd9Sstevel@tonic-gate * 1057c478bd9Sstevel@tonic-gate * 1067c478bd9Sstevel@tonic-gate * Making it Fast 1077c478bd9Sstevel@tonic-gate * 1087c478bd9Sstevel@tonic-gate * Since copying out an instruction is neither simple nor inexpensive for the 1097c478bd9Sstevel@tonic-gate * CPU, we should attempt to avoid doing it in as many cases as possible. 1107c478bd9Sstevel@tonic-gate * Since function entry and return are usually the most interesting probe 1117c478bd9Sstevel@tonic-gate * sites, we attempt to tune the performance of the fasttrap provider around 1127c478bd9Sstevel@tonic-gate * instructions typically in those places. 1137c478bd9Sstevel@tonic-gate * 1147c478bd9Sstevel@tonic-gate * Looking at a bunch of functions in libraries and executables reveals that 1157c478bd9Sstevel@tonic-gate * most functions begin with either a save or a sethi (to setup a larger 1167c478bd9Sstevel@tonic-gate * argument to the save) and end with a restore or an or (in the case of leaf 1177c478bd9Sstevel@tonic-gate * functions). To try to improve performance, we emulate all of these 1187c478bd9Sstevel@tonic-gate * instructions in the kernel. 1197c478bd9Sstevel@tonic-gate * 1207c478bd9Sstevel@tonic-gate * The save and restore instructions are a little tricky since they perform 1217c478bd9Sstevel@tonic-gate * register window maniplulation. Rather than trying to tinker with the 1227c478bd9Sstevel@tonic-gate * register windows from the kernel, we emulate the implicit add that takes 1237c478bd9Sstevel@tonic-gate * place as part of those instructions and set the %pc to point to a simple 1247c478bd9Sstevel@tonic-gate * save or restore we've hidden in the ulwp_t structure. If we're in a return 1257c478bd9Sstevel@tonic-gate * probe so want to make it seem as though the tracepoint has been completely 1267c478bd9Sstevel@tonic-gate * executed we need to remember that we've pulled this trick with restore and 1277c478bd9Sstevel@tonic-gate * pull registers from the previous window (the one that we'll switch to once 1287c478bd9Sstevel@tonic-gate * the simple store instruction is executed) rather than the current one. This 1297c478bd9Sstevel@tonic-gate * is why in the case of emulating a restore we set the DTrace CPU flag 1307c478bd9Sstevel@tonic-gate * CPU_DTRACE_FAKERESTORE before calling dtrace_probe() for the return probes 1317c478bd9Sstevel@tonic-gate * (see fasttrap_return_common()). 1327c478bd9Sstevel@tonic-gate */ 1337c478bd9Sstevel@tonic-gate 1347c478bd9Sstevel@tonic-gate #define OP(x) ((x) >> 30) 1357c478bd9Sstevel@tonic-gate #define OP2(x) (((x) >> 22) & 0x07) 1367c478bd9Sstevel@tonic-gate #define OP3(x) (((x) >> 19) & 0x3f) 1377c478bd9Sstevel@tonic-gate #define RCOND(x) (((x) >> 25) & 0x07) 1387c478bd9Sstevel@tonic-gate #define COND(x) (((x) >> 25) & 0x0f) 1397c478bd9Sstevel@tonic-gate #define A(x) (((x) >> 29) & 0x01) 1407c478bd9Sstevel@tonic-gate #define I(x) (((x) >> 13) & 0x01) 1417c478bd9Sstevel@tonic-gate #define RD(x) (((x) >> 25) & 0x1f) 1427c478bd9Sstevel@tonic-gate #define RS1(x) (((x) >> 14) & 0x1f) 1437c478bd9Sstevel@tonic-gate #define RS2(x) (((x) >> 0) & 0x1f) 1447c478bd9Sstevel@tonic-gate #define CC(x) (((x) >> 20) & 0x03) 1457c478bd9Sstevel@tonic-gate #define DISP16(x) ((((x) >> 6) & 0xc000) | ((x) & 0x3fff)) 1467c478bd9Sstevel@tonic-gate #define DISP22(x) ((x) & 0x3fffff) 1477c478bd9Sstevel@tonic-gate #define DISP19(x) ((x) & 0x7ffff) 1487c478bd9Sstevel@tonic-gate #define DISP30(x) ((x) & 0x3fffffff) 1497c478bd9Sstevel@tonic-gate #define SW_TRAP(x) ((x) & 0x7f) 1507c478bd9Sstevel@tonic-gate 1517c478bd9Sstevel@tonic-gate #define OP3_OR 0x02 1527c478bd9Sstevel@tonic-gate #define OP3_RD 0x28 1537c478bd9Sstevel@tonic-gate #define OP3_JMPL 0x38 1547c478bd9Sstevel@tonic-gate #define OP3_RETURN 0x39 1557c478bd9Sstevel@tonic-gate #define OP3_TCC 0x3a 1567c478bd9Sstevel@tonic-gate #define OP3_SAVE 0x3c 1577c478bd9Sstevel@tonic-gate #define OP3_RESTORE 0x3d 1587c478bd9Sstevel@tonic-gate 1597c478bd9Sstevel@tonic-gate #define OP3_PREFETCH 0x2d 1607c478bd9Sstevel@tonic-gate #define OP3_CASA 0x3c 1617c478bd9Sstevel@tonic-gate #define OP3_PREFETCHA 0x3d 1627c478bd9Sstevel@tonic-gate #define OP3_CASXA 0x3e 1637c478bd9Sstevel@tonic-gate 1647c478bd9Sstevel@tonic-gate #define OP2_ILLTRAP 0x0 1657c478bd9Sstevel@tonic-gate #define OP2_BPcc 0x1 1667c478bd9Sstevel@tonic-gate #define OP2_Bicc 0x2 1677c478bd9Sstevel@tonic-gate #define OP2_BPr 0x3 1687c478bd9Sstevel@tonic-gate #define OP2_SETHI 0x4 1697c478bd9Sstevel@tonic-gate #define OP2_FBPfcc 0x5 1707c478bd9Sstevel@tonic-gate #define OP2_FBfcc 0x6 1717c478bd9Sstevel@tonic-gate 1727c478bd9Sstevel@tonic-gate #define R_G0 0 1737c478bd9Sstevel@tonic-gate #define R_O0 8 1747c478bd9Sstevel@tonic-gate #define R_SP 14 1757c478bd9Sstevel@tonic-gate #define R_I0 24 1767c478bd9Sstevel@tonic-gate #define R_I1 25 1777c478bd9Sstevel@tonic-gate #define R_I2 26 1787c478bd9Sstevel@tonic-gate #define R_I3 27 1797c478bd9Sstevel@tonic-gate 1807c478bd9Sstevel@tonic-gate /* 1817c478bd9Sstevel@tonic-gate * Check the comment in fasttrap.h when changing these offsets or adding 1827c478bd9Sstevel@tonic-gate * new instructions. 1837c478bd9Sstevel@tonic-gate */ 1847c478bd9Sstevel@tonic-gate #define FASTTRAP_OFF_SAVE 64 1857c478bd9Sstevel@tonic-gate #define FASTTRAP_OFF_RESTORE 68 1867c478bd9Sstevel@tonic-gate #define FASTTRAP_OFF_FTRET 72 1877c478bd9Sstevel@tonic-gate #define FASTTRAP_OFF_RETURN 76 1887c478bd9Sstevel@tonic-gate 1897c478bd9Sstevel@tonic-gate #define BREAKPOINT_INSTR 0x91d02001 /* ta 1 */ 1907c478bd9Sstevel@tonic-gate 1917c478bd9Sstevel@tonic-gate /* 1927c478bd9Sstevel@tonic-gate * Tunable to let users turn off the fancy save instruction optimization. 1937c478bd9Sstevel@tonic-gate * If a program is non-ABI compliant, there's a possibility that the save 1947c478bd9Sstevel@tonic-gate * instruction optimization could cause an error. 1957c478bd9Sstevel@tonic-gate */ 1967c478bd9Sstevel@tonic-gate int fasttrap_optimize_save = 1; 1977c478bd9Sstevel@tonic-gate 1987c478bd9Sstevel@tonic-gate static uint64_t 1997c478bd9Sstevel@tonic-gate fasttrap_anarg(struct regs *rp, int argno) 2007c478bd9Sstevel@tonic-gate { 2017c478bd9Sstevel@tonic-gate uint64_t value; 2027c478bd9Sstevel@tonic-gate 2037c478bd9Sstevel@tonic-gate if (argno < 6) 2047c478bd9Sstevel@tonic-gate return ((&rp->r_o0)[argno]); 2057c478bd9Sstevel@tonic-gate 2067c478bd9Sstevel@tonic-gate if (curproc->p_model == DATAMODEL_NATIVE) { 2077c478bd9Sstevel@tonic-gate struct frame *fr = (struct frame *)(rp->r_sp + STACK_BIAS); 2087c478bd9Sstevel@tonic-gate 2097c478bd9Sstevel@tonic-gate DTRACE_CPUFLAG_SET(CPU_DTRACE_NOFAULT); 2107c478bd9Sstevel@tonic-gate value = dtrace_fulword(&fr->fr_argd[argno]); 2117c478bd9Sstevel@tonic-gate DTRACE_CPUFLAG_CLEAR(CPU_DTRACE_NOFAULT | CPU_DTRACE_BADADDR | 2127c478bd9Sstevel@tonic-gate CPU_DTRACE_BADALIGN); 2137c478bd9Sstevel@tonic-gate } else { 2147c478bd9Sstevel@tonic-gate struct frame32 *fr = (struct frame32 *)rp->r_sp; 2157c478bd9Sstevel@tonic-gate 2167c478bd9Sstevel@tonic-gate DTRACE_CPUFLAG_SET(CPU_DTRACE_NOFAULT); 2177c478bd9Sstevel@tonic-gate value = dtrace_fuword32(&fr->fr_argd[argno]); 2187c478bd9Sstevel@tonic-gate DTRACE_CPUFLAG_CLEAR(CPU_DTRACE_NOFAULT | CPU_DTRACE_BADADDR | 2197c478bd9Sstevel@tonic-gate CPU_DTRACE_BADALIGN); 2207c478bd9Sstevel@tonic-gate } 2217c478bd9Sstevel@tonic-gate 2227c478bd9Sstevel@tonic-gate return (value); 2237c478bd9Sstevel@tonic-gate } 2247c478bd9Sstevel@tonic-gate 2257c478bd9Sstevel@tonic-gate static ulong_t fasttrap_getreg(struct regs *, uint_t); 2267c478bd9Sstevel@tonic-gate static void fasttrap_putreg(struct regs *, uint_t, ulong_t); 2277c478bd9Sstevel@tonic-gate 2287c478bd9Sstevel@tonic-gate int 2297c478bd9Sstevel@tonic-gate fasttrap_probe(struct regs *rp) 2307c478bd9Sstevel@tonic-gate { 2317c478bd9Sstevel@tonic-gate dtrace_probe(fasttrap_probe_id, 2327c478bd9Sstevel@tonic-gate rp->r_o0, rp->r_o1, rp->r_o2, rp->r_o3, rp->r_o4); 2337c478bd9Sstevel@tonic-gate 2347c478bd9Sstevel@tonic-gate rp->r_pc = rp->r_npc; 2357c478bd9Sstevel@tonic-gate rp->r_npc = rp->r_pc + 4; 2367c478bd9Sstevel@tonic-gate 2377c478bd9Sstevel@tonic-gate return (0); 2387c478bd9Sstevel@tonic-gate } 2397c478bd9Sstevel@tonic-gate 2407c478bd9Sstevel@tonic-gate static void 2417c478bd9Sstevel@tonic-gate fasttrap_usdt_args(fasttrap_probe_t *probe, struct regs *rp, int argc, 2427c478bd9Sstevel@tonic-gate uintptr_t *argv) 2437c478bd9Sstevel@tonic-gate { 2447c478bd9Sstevel@tonic-gate int i, x, cap = MIN(argc, probe->ftp_nargs); 2457c478bd9Sstevel@tonic-gate 2467c478bd9Sstevel@tonic-gate if (curproc->p_model == DATAMODEL_NATIVE) { 2477c478bd9Sstevel@tonic-gate struct frame *fr = (struct frame *)(rp->r_sp + STACK_BIAS); 2487c478bd9Sstevel@tonic-gate uintptr_t v; 2497c478bd9Sstevel@tonic-gate 2507c478bd9Sstevel@tonic-gate for (i = 0; i < cap; i++) { 2517c478bd9Sstevel@tonic-gate x = probe->ftp_argmap[i]; 2527c478bd9Sstevel@tonic-gate 2537c478bd9Sstevel@tonic-gate if (x < 6) 2547c478bd9Sstevel@tonic-gate argv[i] = (&rp->r_o0)[x]; 2557c478bd9Sstevel@tonic-gate else if (fasttrap_fulword(&fr->fr_argd[x], &v) != 0) 2567c478bd9Sstevel@tonic-gate argv[i] = 0; 2577c478bd9Sstevel@tonic-gate } 2587c478bd9Sstevel@tonic-gate 2597c478bd9Sstevel@tonic-gate } else { 2607c478bd9Sstevel@tonic-gate struct frame32 *fr = (struct frame32 *)rp->r_sp; 2617c478bd9Sstevel@tonic-gate uint32_t v; 2627c478bd9Sstevel@tonic-gate 2637c478bd9Sstevel@tonic-gate for (i = 0; i < cap; i++) { 2647c478bd9Sstevel@tonic-gate x = probe->ftp_argmap[i]; 2657c478bd9Sstevel@tonic-gate 2667c478bd9Sstevel@tonic-gate if (x < 6) 2677c478bd9Sstevel@tonic-gate argv[i] = (&rp->r_o0)[x]; 2687c478bd9Sstevel@tonic-gate else if (fasttrap_fuword32(&fr->fr_argd[x], &v) != 0) 2697c478bd9Sstevel@tonic-gate argv[i] = 0; 2707c478bd9Sstevel@tonic-gate } 2717c478bd9Sstevel@tonic-gate } 2727c478bd9Sstevel@tonic-gate 2737c478bd9Sstevel@tonic-gate for (; i < argc; i++) { 2747c478bd9Sstevel@tonic-gate argv[i] = 0; 2757c478bd9Sstevel@tonic-gate } 2767c478bd9Sstevel@tonic-gate } 2777c478bd9Sstevel@tonic-gate 2787c478bd9Sstevel@tonic-gate static void 2797c478bd9Sstevel@tonic-gate fasttrap_return_common(struct regs *rp, uintptr_t pc, pid_t pid, 2807c478bd9Sstevel@tonic-gate uint_t fake_restore) 2817c478bd9Sstevel@tonic-gate { 2827c478bd9Sstevel@tonic-gate fasttrap_tracepoint_t *tp; 2837c478bd9Sstevel@tonic-gate fasttrap_bucket_t *bucket; 2847c478bd9Sstevel@tonic-gate fasttrap_id_t *id; 2857c478bd9Sstevel@tonic-gate kmutex_t *pid_mtx; 2867c478bd9Sstevel@tonic-gate dtrace_icookie_t cookie; 2877c478bd9Sstevel@tonic-gate 2887c478bd9Sstevel@tonic-gate pid_mtx = &cpu_core[CPU->cpu_id].cpuc_pid_lock; 2897c478bd9Sstevel@tonic-gate mutex_enter(pid_mtx); 2907c478bd9Sstevel@tonic-gate bucket = &fasttrap_tpoints.fth_table[FASTTRAP_TPOINTS_INDEX(pid, pc)]; 2917c478bd9Sstevel@tonic-gate 2927c478bd9Sstevel@tonic-gate for (tp = bucket->ftb_data; tp != NULL; tp = tp->ftt_next) { 2937c478bd9Sstevel@tonic-gate if (pid == tp->ftt_pid && pc == tp->ftt_pc && 294b096140dSahl !tp->ftt_proc->ftpc_defunct) 2957c478bd9Sstevel@tonic-gate break; 2967c478bd9Sstevel@tonic-gate } 2977c478bd9Sstevel@tonic-gate 2987c478bd9Sstevel@tonic-gate /* 2997c478bd9Sstevel@tonic-gate * Don't sweat it if we can't find the tracepoint again; unlike 3007c478bd9Sstevel@tonic-gate * when we're in fasttrap_pid_probe(), finding the tracepoint here 3017c478bd9Sstevel@tonic-gate * is not essential to the correct execution of the process. 3027c478bd9Sstevel@tonic-gate */ 3037c478bd9Sstevel@tonic-gate if (tp == NULL || tp->ftt_retids == NULL) { 3047c478bd9Sstevel@tonic-gate mutex_exit(pid_mtx); 3057c478bd9Sstevel@tonic-gate return; 3067c478bd9Sstevel@tonic-gate } 3077c478bd9Sstevel@tonic-gate 3087c478bd9Sstevel@tonic-gate for (id = tp->ftt_retids; id != NULL; id = id->fti_next) { 3097c478bd9Sstevel@tonic-gate fasttrap_probe_t *probe = id->fti_probe; 3107c478bd9Sstevel@tonic-gate 311*ac448965Sahl if (id->fti_ptype == DTFTP_POST_OFFSETS) { 3127c478bd9Sstevel@tonic-gate if (probe->ftp_argmap == NULL) { 3137c478bd9Sstevel@tonic-gate dtrace_probe(probe->ftp_id, rp->r_o0, rp->r_o1, 3147c478bd9Sstevel@tonic-gate rp->r_o2, rp->r_o3, rp->r_o4); 3157c478bd9Sstevel@tonic-gate } else { 3167c478bd9Sstevel@tonic-gate uintptr_t t[5]; 3177c478bd9Sstevel@tonic-gate 3187c478bd9Sstevel@tonic-gate fasttrap_usdt_args(probe, rp, 3197c478bd9Sstevel@tonic-gate sizeof (t) / sizeof (t[0]), t); 3207c478bd9Sstevel@tonic-gate 3217c478bd9Sstevel@tonic-gate dtrace_probe(probe->ftp_id, t[0], t[1], 3227c478bd9Sstevel@tonic-gate t[2], t[3], t[4]); 3237c478bd9Sstevel@tonic-gate } 3247c478bd9Sstevel@tonic-gate continue; 3257c478bd9Sstevel@tonic-gate } 3267c478bd9Sstevel@tonic-gate 3277c478bd9Sstevel@tonic-gate /* 3287c478bd9Sstevel@tonic-gate * If this is only a possible return point, we must 3297c478bd9Sstevel@tonic-gate * be looking at a potential tail call in leaf context. 3307c478bd9Sstevel@tonic-gate * If the %npc is still within this function, then we 3317c478bd9Sstevel@tonic-gate * must have misidentified a jmpl as a tail-call when it 3327c478bd9Sstevel@tonic-gate * is, in fact, part of a jump table. It would be nice to 3337c478bd9Sstevel@tonic-gate * remove this tracepoint, but this is neither the time 3347c478bd9Sstevel@tonic-gate * nor the place. 3357c478bd9Sstevel@tonic-gate */ 3367c478bd9Sstevel@tonic-gate if ((tp->ftt_flags & FASTTRAP_F_RETMAYBE) && 3377c478bd9Sstevel@tonic-gate rp->r_npc - probe->ftp_faddr < probe->ftp_fsize) 3387c478bd9Sstevel@tonic-gate continue; 3397c478bd9Sstevel@tonic-gate 3407c478bd9Sstevel@tonic-gate /* 3417c478bd9Sstevel@tonic-gate * It's possible for a function to branch to the delay slot 3427c478bd9Sstevel@tonic-gate * of an instruction that we've identified as a return site. 3437c478bd9Sstevel@tonic-gate * We can dectect this spurious return probe activation by 3447c478bd9Sstevel@tonic-gate * observing that in this case %npc will be %pc + 4 and %npc 3457c478bd9Sstevel@tonic-gate * will be inside the current function (unless the user is 3467c478bd9Sstevel@tonic-gate * doing _crazy_ instruction picking in which case there's 3477c478bd9Sstevel@tonic-gate * very little we can do). The second check is important 3487c478bd9Sstevel@tonic-gate * in case the last instructions of a function make a tail- 3497c478bd9Sstevel@tonic-gate * call to the function located immediately subsequent. 3507c478bd9Sstevel@tonic-gate */ 3517c478bd9Sstevel@tonic-gate if (rp->r_npc == rp->r_pc + 4 && 3527c478bd9Sstevel@tonic-gate rp->r_npc - probe->ftp_faddr < probe->ftp_fsize) 3537c478bd9Sstevel@tonic-gate continue; 3547c478bd9Sstevel@tonic-gate 3557c478bd9Sstevel@tonic-gate /* 3567c478bd9Sstevel@tonic-gate * The first argument is the offset of return tracepoint 3577c478bd9Sstevel@tonic-gate * in the function; the remaining arguments are the return 3587c478bd9Sstevel@tonic-gate * values. 3597c478bd9Sstevel@tonic-gate * 3607c478bd9Sstevel@tonic-gate * If fake_restore is set, we need to pull the return values 3617c478bd9Sstevel@tonic-gate * out of the %i's rather than the %o's -- a little trickier. 3627c478bd9Sstevel@tonic-gate */ 3637c478bd9Sstevel@tonic-gate if (!fake_restore) { 3647c478bd9Sstevel@tonic-gate dtrace_probe(probe->ftp_id, pc - probe->ftp_faddr, 3657c478bd9Sstevel@tonic-gate rp->r_o0, rp->r_o1, rp->r_o2, rp->r_o3); 3667c478bd9Sstevel@tonic-gate } else { 3677c478bd9Sstevel@tonic-gate uintptr_t arg0 = fasttrap_getreg(rp, R_I0); 3687c478bd9Sstevel@tonic-gate uintptr_t arg1 = fasttrap_getreg(rp, R_I1); 3697c478bd9Sstevel@tonic-gate uintptr_t arg2 = fasttrap_getreg(rp, R_I2); 3707c478bd9Sstevel@tonic-gate uintptr_t arg3 = fasttrap_getreg(rp, R_I3); 3717c478bd9Sstevel@tonic-gate 3727c478bd9Sstevel@tonic-gate cookie = dtrace_interrupt_disable(); 3737c478bd9Sstevel@tonic-gate DTRACE_CPUFLAG_SET(CPU_DTRACE_FAKERESTORE); 3747c478bd9Sstevel@tonic-gate dtrace_probe(probe->ftp_id, pc - probe->ftp_faddr, 3757c478bd9Sstevel@tonic-gate arg0, arg1, arg2, arg3); 3767c478bd9Sstevel@tonic-gate DTRACE_CPUFLAG_CLEAR(CPU_DTRACE_FAKERESTORE); 3777c478bd9Sstevel@tonic-gate dtrace_interrupt_enable(cookie); 3787c478bd9Sstevel@tonic-gate } 3797c478bd9Sstevel@tonic-gate } 3807c478bd9Sstevel@tonic-gate 3817c478bd9Sstevel@tonic-gate mutex_exit(pid_mtx); 3827c478bd9Sstevel@tonic-gate } 3837c478bd9Sstevel@tonic-gate 3847c478bd9Sstevel@tonic-gate int 3857c478bd9Sstevel@tonic-gate fasttrap_pid_probe(struct regs *rp) 3867c478bd9Sstevel@tonic-gate { 3877c478bd9Sstevel@tonic-gate proc_t *p = curproc; 3887c478bd9Sstevel@tonic-gate fasttrap_tracepoint_t *tp, tp_local; 3897c478bd9Sstevel@tonic-gate fasttrap_id_t *id; 3907c478bd9Sstevel@tonic-gate pid_t pid; 3917c478bd9Sstevel@tonic-gate uintptr_t pc = rp->r_pc; 3927c478bd9Sstevel@tonic-gate uintptr_t npc = rp->r_npc; 3937c478bd9Sstevel@tonic-gate uintptr_t orig_pc = pc; 3947c478bd9Sstevel@tonic-gate fasttrap_bucket_t *bucket; 3957c478bd9Sstevel@tonic-gate kmutex_t *pid_mtx; 396*ac448965Sahl uint_t fake_restore = 0, is_enabled = 0; 3977c478bd9Sstevel@tonic-gate dtrace_icookie_t cookie; 3987c478bd9Sstevel@tonic-gate 3997c478bd9Sstevel@tonic-gate /* 4007c478bd9Sstevel@tonic-gate * It's possible that a user (in a veritable orgy of bad planning) 4017c478bd9Sstevel@tonic-gate * could redirect this thread's flow of control before it reached the 4027c478bd9Sstevel@tonic-gate * return probe fasttrap. In this case we need to kill the process 4037c478bd9Sstevel@tonic-gate * since it's in a unrecoverable state. 4047c478bd9Sstevel@tonic-gate */ 4057c478bd9Sstevel@tonic-gate if (curthread->t_dtrace_step) { 4067c478bd9Sstevel@tonic-gate ASSERT(curthread->t_dtrace_on); 4077c478bd9Sstevel@tonic-gate fasttrap_sigtrap(p, curthread, pc); 4087c478bd9Sstevel@tonic-gate return (0); 4097c478bd9Sstevel@tonic-gate } 4107c478bd9Sstevel@tonic-gate 4117c478bd9Sstevel@tonic-gate /* 4127c478bd9Sstevel@tonic-gate * Clear all user tracing flags. 4137c478bd9Sstevel@tonic-gate */ 4147c478bd9Sstevel@tonic-gate curthread->t_dtrace_ft = 0; 4157c478bd9Sstevel@tonic-gate curthread->t_dtrace_pc = 0; 4167c478bd9Sstevel@tonic-gate curthread->t_dtrace_npc = 0; 4177c478bd9Sstevel@tonic-gate curthread->t_dtrace_scrpc = 0; 4187c478bd9Sstevel@tonic-gate curthread->t_dtrace_astpc = 0; 4197c478bd9Sstevel@tonic-gate 4207c478bd9Sstevel@tonic-gate /* 4217c478bd9Sstevel@tonic-gate * Treat a child created by a call to vfork(2) as if it were its 4227c478bd9Sstevel@tonic-gate * parent. We know that there's only one thread of control in such a 4237c478bd9Sstevel@tonic-gate * process: this one. 4247c478bd9Sstevel@tonic-gate */ 4257c478bd9Sstevel@tonic-gate while (p->p_flag & SVFORK) { 4267c478bd9Sstevel@tonic-gate p = p->p_parent; 4277c478bd9Sstevel@tonic-gate } 4287c478bd9Sstevel@tonic-gate 4297c478bd9Sstevel@tonic-gate pid = p->p_pid; 4307c478bd9Sstevel@tonic-gate pid_mtx = &cpu_core[CPU->cpu_id].cpuc_pid_lock; 4317c478bd9Sstevel@tonic-gate mutex_enter(pid_mtx); 4327c478bd9Sstevel@tonic-gate bucket = &fasttrap_tpoints.fth_table[FASTTRAP_TPOINTS_INDEX(pid, pc)]; 4337c478bd9Sstevel@tonic-gate 4347c478bd9Sstevel@tonic-gate /* 4357c478bd9Sstevel@tonic-gate * Lookup the tracepoint that the process just hit. 4367c478bd9Sstevel@tonic-gate */ 4377c478bd9Sstevel@tonic-gate for (tp = bucket->ftb_data; tp != NULL; tp = tp->ftt_next) { 4387c478bd9Sstevel@tonic-gate if (pid == tp->ftt_pid && pc == tp->ftt_pc && 439b096140dSahl !tp->ftt_proc->ftpc_defunct) 4407c478bd9Sstevel@tonic-gate break; 4417c478bd9Sstevel@tonic-gate } 4427c478bd9Sstevel@tonic-gate 4437c478bd9Sstevel@tonic-gate /* 4447c478bd9Sstevel@tonic-gate * If we couldn't find a matching tracepoint, either a tracepoint has 4457c478bd9Sstevel@tonic-gate * been inserted without using the pid<pid> ioctl interface (see 4467c478bd9Sstevel@tonic-gate * fasttrap_ioctl), or somehow we have mislaid this tracepoint. 4477c478bd9Sstevel@tonic-gate */ 4487c478bd9Sstevel@tonic-gate if (tp == NULL) { 4497c478bd9Sstevel@tonic-gate mutex_exit(pid_mtx); 4507c478bd9Sstevel@tonic-gate return (-1); 4517c478bd9Sstevel@tonic-gate } 4527c478bd9Sstevel@tonic-gate 4537c478bd9Sstevel@tonic-gate for (id = tp->ftt_ids; id != NULL; id = id->fti_next) { 4547c478bd9Sstevel@tonic-gate fasttrap_probe_t *probe = id->fti_probe; 455*ac448965Sahl int isentry = (id->fti_ptype == DTFTP_ENTRY); 456*ac448965Sahl 457*ac448965Sahl if (id->fti_ptype == DTFTP_IS_ENABLED) { 458*ac448965Sahl is_enabled = 1; 459*ac448965Sahl continue; 460*ac448965Sahl } 461*ac448965Sahl 4627c478bd9Sstevel@tonic-gate /* 4637c478bd9Sstevel@tonic-gate * We note that this was an entry probe to help ustack() find 4647c478bd9Sstevel@tonic-gate * the first caller. 4657c478bd9Sstevel@tonic-gate */ 466*ac448965Sahl if (isentry) { 4677c478bd9Sstevel@tonic-gate cookie = dtrace_interrupt_disable(); 4687c478bd9Sstevel@tonic-gate DTRACE_CPUFLAG_SET(CPU_DTRACE_ENTRY); 4697c478bd9Sstevel@tonic-gate } 4707c478bd9Sstevel@tonic-gate dtrace_probe(probe->ftp_id, rp->r_o0, rp->r_o1, rp->r_o2, 4717c478bd9Sstevel@tonic-gate rp->r_o3, rp->r_o4); 4727c478bd9Sstevel@tonic-gate if (isentry) { 4737c478bd9Sstevel@tonic-gate DTRACE_CPUFLAG_CLEAR(CPU_DTRACE_ENTRY); 4747c478bd9Sstevel@tonic-gate dtrace_interrupt_enable(cookie); 4757c478bd9Sstevel@tonic-gate } 4767c478bd9Sstevel@tonic-gate } 4777c478bd9Sstevel@tonic-gate 4787c478bd9Sstevel@tonic-gate /* 4797c478bd9Sstevel@tonic-gate * We're about to do a bunch of work so we cache a local copy of 4807c478bd9Sstevel@tonic-gate * the tracepoint to emulate the instruction, and then find the 4817c478bd9Sstevel@tonic-gate * tracepoint again later if we need to light up any return probes. 4827c478bd9Sstevel@tonic-gate */ 4837c478bd9Sstevel@tonic-gate tp_local = *tp; 4847c478bd9Sstevel@tonic-gate mutex_exit(pid_mtx); 4857c478bd9Sstevel@tonic-gate tp = &tp_local; 4867c478bd9Sstevel@tonic-gate 4877c478bd9Sstevel@tonic-gate /* 488*ac448965Sahl * If there's an is-enabled probe conntected to this tracepoint it 489*ac448965Sahl * means that there was a 'mov %g0, %o0' instruction that was placed 490*ac448965Sahl * there by DTrace when the binary was linked. As this probe is, in 491*ac448965Sahl * fact, enabled, we need to stuff 1 into %o0. Accordingly, we can 492*ac448965Sahl * bypass all the instruction emulation logic since we know the 493*ac448965Sahl * inevitable result. It's possible that a user could construct a 494*ac448965Sahl * scenario where the 'is-enabled' probe was on some other 495*ac448965Sahl * instruction, but that would be a rather exotic way to shoot oneself 496*ac448965Sahl * in the foot. 497*ac448965Sahl */ 498*ac448965Sahl if (is_enabled) { 499*ac448965Sahl rp->r_o0 = 1; 500*ac448965Sahl pc = rp->r_npc; 501*ac448965Sahl npc = pc + 4; 502*ac448965Sahl goto done; 503*ac448965Sahl } 504*ac448965Sahl 505*ac448965Sahl /* 506*ac448965Sahl * We emulate certain types of instructions to ensure correctness 5077c478bd9Sstevel@tonic-gate * (in the case of position dependent instructions) or optimize 5087c478bd9Sstevel@tonic-gate * common cases. The rest we have the thread execute back in user- 5097c478bd9Sstevel@tonic-gate * land. 5107c478bd9Sstevel@tonic-gate */ 5117c478bd9Sstevel@tonic-gate switch (tp->ftt_type) { 5127c478bd9Sstevel@tonic-gate case FASTTRAP_T_SAVE: 5137c478bd9Sstevel@tonic-gate { 5147c478bd9Sstevel@tonic-gate int32_t imm; 5157c478bd9Sstevel@tonic-gate 5167c478bd9Sstevel@tonic-gate /* 5177c478bd9Sstevel@tonic-gate * This an optimization to let us handle function entry 5187c478bd9Sstevel@tonic-gate * probes more efficiently. Many functions begin with a save 5197c478bd9Sstevel@tonic-gate * instruction that follows the pattern: 5207c478bd9Sstevel@tonic-gate * save %sp, <imm>, %sp 5217c478bd9Sstevel@tonic-gate * 5227c478bd9Sstevel@tonic-gate * Meanwhile, we've stashed the instruction: 5237c478bd9Sstevel@tonic-gate * save %g1, %g0, %sp 5247c478bd9Sstevel@tonic-gate * 5257c478bd9Sstevel@tonic-gate * off of %g7, so all we have to do is stick the right value 5267c478bd9Sstevel@tonic-gate * into %g1 and reset %pc to point to the instruction we've 5277c478bd9Sstevel@tonic-gate * cleverly hidden (%npc should not be touched). 5287c478bd9Sstevel@tonic-gate */ 5297c478bd9Sstevel@tonic-gate 5307c478bd9Sstevel@tonic-gate imm = tp->ftt_instr << 19; 5317c478bd9Sstevel@tonic-gate imm >>= 19; 5327c478bd9Sstevel@tonic-gate rp->r_g1 = rp->r_sp + imm; 5337c478bd9Sstevel@tonic-gate pc = rp->r_g7 + FASTTRAP_OFF_SAVE; 5347c478bd9Sstevel@tonic-gate break; 5357c478bd9Sstevel@tonic-gate } 5367c478bd9Sstevel@tonic-gate 5377c478bd9Sstevel@tonic-gate case FASTTRAP_T_RESTORE: 5387c478bd9Sstevel@tonic-gate { 5397c478bd9Sstevel@tonic-gate ulong_t value; 5407c478bd9Sstevel@tonic-gate uint_t rd; 5417c478bd9Sstevel@tonic-gate 5427c478bd9Sstevel@tonic-gate /* 5437c478bd9Sstevel@tonic-gate * This is an optimization to let us handle function 5447c478bd9Sstevel@tonic-gate * return probes more efficiently. Most non-leaf functions 5457c478bd9Sstevel@tonic-gate * end with the sequence: 5467c478bd9Sstevel@tonic-gate * ret 5477c478bd9Sstevel@tonic-gate * restore <reg>, <reg_or_imm>, %oX 5487c478bd9Sstevel@tonic-gate * 5497c478bd9Sstevel@tonic-gate * We've stashed the instruction: 5507c478bd9Sstevel@tonic-gate * restore %g0, %g0, %g0 5517c478bd9Sstevel@tonic-gate * 5527c478bd9Sstevel@tonic-gate * off of %g7 so we just need to place the correct value 5537c478bd9Sstevel@tonic-gate * in the right %i register (since after our fake-o 5547c478bd9Sstevel@tonic-gate * restore, the %i's will become the %o's) and set the %pc 5557c478bd9Sstevel@tonic-gate * to point to our hidden restore. We also set fake_restore to 5567c478bd9Sstevel@tonic-gate * let fasttrap_return_common() know that it will find the 5577c478bd9Sstevel@tonic-gate * return values in the %i's rather than the %o's. 5587c478bd9Sstevel@tonic-gate */ 5597c478bd9Sstevel@tonic-gate 5607c478bd9Sstevel@tonic-gate if (I(tp->ftt_instr)) { 5617c478bd9Sstevel@tonic-gate int32_t imm; 5627c478bd9Sstevel@tonic-gate 5637c478bd9Sstevel@tonic-gate imm = tp->ftt_instr << 19; 5647c478bd9Sstevel@tonic-gate imm >>= 19; 5657c478bd9Sstevel@tonic-gate value = fasttrap_getreg(rp, RS1(tp->ftt_instr)) + imm; 5667c478bd9Sstevel@tonic-gate } else { 5677c478bd9Sstevel@tonic-gate value = fasttrap_getreg(rp, RS1(tp->ftt_instr)) + 5687c478bd9Sstevel@tonic-gate fasttrap_getreg(rp, RS2(tp->ftt_instr)); 5697c478bd9Sstevel@tonic-gate } 5707c478bd9Sstevel@tonic-gate 5717c478bd9Sstevel@tonic-gate /* 5727c478bd9Sstevel@tonic-gate * Convert %o's to %i's; leave %g's as they are. 5737c478bd9Sstevel@tonic-gate */ 5747c478bd9Sstevel@tonic-gate rd = RD(tp->ftt_instr); 5757c478bd9Sstevel@tonic-gate fasttrap_putreg(rp, ((rd & 0x18) == 0x8) ? rd + 16 : rd, value); 5767c478bd9Sstevel@tonic-gate 5777c478bd9Sstevel@tonic-gate pc = rp->r_g7 + FASTTRAP_OFF_RESTORE; 5787c478bd9Sstevel@tonic-gate fake_restore = 1; 5797c478bd9Sstevel@tonic-gate break; 5807c478bd9Sstevel@tonic-gate } 5817c478bd9Sstevel@tonic-gate 5827c478bd9Sstevel@tonic-gate case FASTTRAP_T_RETURN: 5837c478bd9Sstevel@tonic-gate { 5847c478bd9Sstevel@tonic-gate uintptr_t target; 5857c478bd9Sstevel@tonic-gate 5867c478bd9Sstevel@tonic-gate /* 5877c478bd9Sstevel@tonic-gate * A return instruction is like a jmpl (without the link 5887c478bd9Sstevel@tonic-gate * part) that executes an implicit restore. We've stashed 5897c478bd9Sstevel@tonic-gate * the instruction: 5907c478bd9Sstevel@tonic-gate * return %o0 5917c478bd9Sstevel@tonic-gate * 5927c478bd9Sstevel@tonic-gate * off of %g7 so we just need to place the target in %o0 5937c478bd9Sstevel@tonic-gate * and set the %pc to point to the stashed return instruction. 5947c478bd9Sstevel@tonic-gate * We use %o0 since that register disappears after the return 5957c478bd9Sstevel@tonic-gate * executes, erasing any evidence of this tampering. 5967c478bd9Sstevel@tonic-gate */ 5977c478bd9Sstevel@tonic-gate if (I(tp->ftt_instr)) { 5987c478bd9Sstevel@tonic-gate int32_t imm; 5997c478bd9Sstevel@tonic-gate 6007c478bd9Sstevel@tonic-gate imm = tp->ftt_instr << 19; 6017c478bd9Sstevel@tonic-gate imm >>= 19; 6027c478bd9Sstevel@tonic-gate target = fasttrap_getreg(rp, RS1(tp->ftt_instr)) + imm; 6037c478bd9Sstevel@tonic-gate } else { 6047c478bd9Sstevel@tonic-gate target = fasttrap_getreg(rp, RS1(tp->ftt_instr)) + 6057c478bd9Sstevel@tonic-gate fasttrap_getreg(rp, RS2(tp->ftt_instr)); 6067c478bd9Sstevel@tonic-gate } 6077c478bd9Sstevel@tonic-gate 6087c478bd9Sstevel@tonic-gate fasttrap_putreg(rp, R_O0, target); 6097c478bd9Sstevel@tonic-gate 6107c478bd9Sstevel@tonic-gate pc = rp->r_g7 + FASTTRAP_OFF_RETURN; 6117c478bd9Sstevel@tonic-gate fake_restore = 1; 6127c478bd9Sstevel@tonic-gate break; 6137c478bd9Sstevel@tonic-gate } 6147c478bd9Sstevel@tonic-gate 6157c478bd9Sstevel@tonic-gate case FASTTRAP_T_OR: 6167c478bd9Sstevel@tonic-gate { 6177c478bd9Sstevel@tonic-gate ulong_t value; 6187c478bd9Sstevel@tonic-gate 6197c478bd9Sstevel@tonic-gate if (I(tp->ftt_instr)) { 6207c478bd9Sstevel@tonic-gate int32_t imm; 6217c478bd9Sstevel@tonic-gate 6227c478bd9Sstevel@tonic-gate imm = tp->ftt_instr << 19; 6237c478bd9Sstevel@tonic-gate imm >>= 19; 6247c478bd9Sstevel@tonic-gate value = fasttrap_getreg(rp, RS1(tp->ftt_instr)) | imm; 6257c478bd9Sstevel@tonic-gate } else { 6267c478bd9Sstevel@tonic-gate value = fasttrap_getreg(rp, RS1(tp->ftt_instr)) | 6277c478bd9Sstevel@tonic-gate fasttrap_getreg(rp, RS2(tp->ftt_instr)); 6287c478bd9Sstevel@tonic-gate } 6297c478bd9Sstevel@tonic-gate 6307c478bd9Sstevel@tonic-gate fasttrap_putreg(rp, RD(tp->ftt_instr), value); 6317c478bd9Sstevel@tonic-gate pc = rp->r_npc; 6327c478bd9Sstevel@tonic-gate npc = pc + 4; 6337c478bd9Sstevel@tonic-gate break; 6347c478bd9Sstevel@tonic-gate } 6357c478bd9Sstevel@tonic-gate 6367c478bd9Sstevel@tonic-gate case FASTTRAP_T_SETHI: 6377c478bd9Sstevel@tonic-gate if (RD(tp->ftt_instr) != R_G0) { 6387c478bd9Sstevel@tonic-gate uint32_t imm32 = tp->ftt_instr << 10; 6397c478bd9Sstevel@tonic-gate fasttrap_putreg(rp, RD(tp->ftt_instr), (ulong_t)imm32); 6407c478bd9Sstevel@tonic-gate } 6417c478bd9Sstevel@tonic-gate pc = rp->r_npc; 6427c478bd9Sstevel@tonic-gate npc = pc + 4; 6437c478bd9Sstevel@tonic-gate break; 6447c478bd9Sstevel@tonic-gate 6457c478bd9Sstevel@tonic-gate case FASTTRAP_T_CCR: 6467c478bd9Sstevel@tonic-gate { 6477c478bd9Sstevel@tonic-gate uint_t c, v, z, n, taken; 6487c478bd9Sstevel@tonic-gate uint_t ccr = rp->r_tstate >> TSTATE_CCR_SHIFT; 6497c478bd9Sstevel@tonic-gate 6507c478bd9Sstevel@tonic-gate if (tp->ftt_cc != 0) 6517c478bd9Sstevel@tonic-gate ccr >>= 4; 6527c478bd9Sstevel@tonic-gate 6537c478bd9Sstevel@tonic-gate c = (ccr >> 0) & 1; 6547c478bd9Sstevel@tonic-gate v = (ccr >> 1) & 1; 6557c478bd9Sstevel@tonic-gate z = (ccr >> 2) & 1; 6567c478bd9Sstevel@tonic-gate n = (ccr >> 3) & 1; 6577c478bd9Sstevel@tonic-gate 6587c478bd9Sstevel@tonic-gate switch (tp->ftt_code) { 6597c478bd9Sstevel@tonic-gate case 0x0: /* BN */ 6607c478bd9Sstevel@tonic-gate taken = 0; break; 6617c478bd9Sstevel@tonic-gate case 0x1: /* BE */ 6627c478bd9Sstevel@tonic-gate taken = z; break; 6637c478bd9Sstevel@tonic-gate case 0x2: /* BLE */ 6647c478bd9Sstevel@tonic-gate taken = z | (n ^ v); break; 6657c478bd9Sstevel@tonic-gate case 0x3: /* BL */ 6667c478bd9Sstevel@tonic-gate taken = n ^ v; break; 6677c478bd9Sstevel@tonic-gate case 0x4: /* BLEU */ 6687c478bd9Sstevel@tonic-gate taken = c | z; break; 6697c478bd9Sstevel@tonic-gate case 0x5: /* BCS (BLU) */ 6707c478bd9Sstevel@tonic-gate taken = c; break; 6717c478bd9Sstevel@tonic-gate case 0x6: /* BNEG */ 6727c478bd9Sstevel@tonic-gate taken = n; break; 6737c478bd9Sstevel@tonic-gate case 0x7: /* BVS */ 6747c478bd9Sstevel@tonic-gate taken = v; break; 6757c478bd9Sstevel@tonic-gate case 0x8: /* BA */ 6767c478bd9Sstevel@tonic-gate /* 6777c478bd9Sstevel@tonic-gate * We handle the BA case differently since the annul 6787c478bd9Sstevel@tonic-gate * bit means something slightly different. 6797c478bd9Sstevel@tonic-gate */ 6807c478bd9Sstevel@tonic-gate panic("fasttrap: mishandled a branch"); 6817c478bd9Sstevel@tonic-gate taken = 1; break; 6827c478bd9Sstevel@tonic-gate case 0x9: /* BNE */ 6837c478bd9Sstevel@tonic-gate taken = ~z; break; 6847c478bd9Sstevel@tonic-gate case 0xa: /* BG */ 6857c478bd9Sstevel@tonic-gate taken = ~(z | (n ^ v)); break; 6867c478bd9Sstevel@tonic-gate case 0xb: /* BGE */ 6877c478bd9Sstevel@tonic-gate taken = ~(n ^ v); break; 6887c478bd9Sstevel@tonic-gate case 0xc: /* BGU */ 6897c478bd9Sstevel@tonic-gate taken = ~(c | z); break; 6907c478bd9Sstevel@tonic-gate case 0xd: /* BCC (BGEU) */ 6917c478bd9Sstevel@tonic-gate taken = ~c; break; 6927c478bd9Sstevel@tonic-gate case 0xe: /* BPOS */ 6937c478bd9Sstevel@tonic-gate taken = ~n; break; 6947c478bd9Sstevel@tonic-gate case 0xf: /* BVC */ 6957c478bd9Sstevel@tonic-gate taken = ~v; break; 6967c478bd9Sstevel@tonic-gate } 6977c478bd9Sstevel@tonic-gate 6987c478bd9Sstevel@tonic-gate if (taken & 1) { 6997c478bd9Sstevel@tonic-gate pc = rp->r_npc; 7007c478bd9Sstevel@tonic-gate npc = tp->ftt_dest; 7017c478bd9Sstevel@tonic-gate } else if (tp->ftt_flags & FASTTRAP_F_ANNUL) { 7027c478bd9Sstevel@tonic-gate /* 7037c478bd9Sstevel@tonic-gate * Untaken annulled branches don't execute the 7047c478bd9Sstevel@tonic-gate * instruction in the delay slot. 7057c478bd9Sstevel@tonic-gate */ 7067c478bd9Sstevel@tonic-gate pc = rp->r_npc + 4; 7077c478bd9Sstevel@tonic-gate npc = pc + 4; 7087c478bd9Sstevel@tonic-gate } else { 7097c478bd9Sstevel@tonic-gate pc = rp->r_npc; 7107c478bd9Sstevel@tonic-gate npc = pc + 4; 7117c478bd9Sstevel@tonic-gate } 7127c478bd9Sstevel@tonic-gate break; 7137c478bd9Sstevel@tonic-gate } 7147c478bd9Sstevel@tonic-gate 7157c478bd9Sstevel@tonic-gate case FASTTRAP_T_FCC: 7167c478bd9Sstevel@tonic-gate { 7177c478bd9Sstevel@tonic-gate uint_t fcc; 7187c478bd9Sstevel@tonic-gate uint_t taken; 7197c478bd9Sstevel@tonic-gate uint64_t fsr; 7207c478bd9Sstevel@tonic-gate 7217c478bd9Sstevel@tonic-gate dtrace_getfsr(&fsr); 7227c478bd9Sstevel@tonic-gate 7237c478bd9Sstevel@tonic-gate if (tp->ftt_cc == 0) { 7247c478bd9Sstevel@tonic-gate fcc = (fsr >> 10) & 0x3; 7257c478bd9Sstevel@tonic-gate } else { 7267c478bd9Sstevel@tonic-gate uint_t shift; 7277c478bd9Sstevel@tonic-gate ASSERT(tp->ftt_cc <= 3); 7287c478bd9Sstevel@tonic-gate shift = 30 + tp->ftt_cc * 2; 7297c478bd9Sstevel@tonic-gate fcc = (fsr >> shift) & 0x3; 7307c478bd9Sstevel@tonic-gate } 7317c478bd9Sstevel@tonic-gate 7327c478bd9Sstevel@tonic-gate switch (tp->ftt_code) { 7337c478bd9Sstevel@tonic-gate case 0x0: /* FBN */ 7347c478bd9Sstevel@tonic-gate taken = (1 << fcc) & (0|0|0|0); break; 7357c478bd9Sstevel@tonic-gate case 0x1: /* FBNE */ 7367c478bd9Sstevel@tonic-gate taken = (1 << fcc) & (8|4|2|0); break; 7377c478bd9Sstevel@tonic-gate case 0x2: /* FBLG */ 7387c478bd9Sstevel@tonic-gate taken = (1 << fcc) & (0|4|2|0); break; 7397c478bd9Sstevel@tonic-gate case 0x3: /* FBUL */ 7407c478bd9Sstevel@tonic-gate taken = (1 << fcc) & (8|0|2|0); break; 7417c478bd9Sstevel@tonic-gate case 0x4: /* FBL */ 7427c478bd9Sstevel@tonic-gate taken = (1 << fcc) & (0|0|2|0); break; 7437c478bd9Sstevel@tonic-gate case 0x5: /* FBUG */ 7447c478bd9Sstevel@tonic-gate taken = (1 << fcc) & (8|4|0|0); break; 7457c478bd9Sstevel@tonic-gate case 0x6: /* FBG */ 7467c478bd9Sstevel@tonic-gate taken = (1 << fcc) & (0|4|0|0); break; 7477c478bd9Sstevel@tonic-gate case 0x7: /* FBU */ 7487c478bd9Sstevel@tonic-gate taken = (1 << fcc) & (8|0|0|0); break; 7497c478bd9Sstevel@tonic-gate case 0x8: /* FBA */ 7507c478bd9Sstevel@tonic-gate /* 7517c478bd9Sstevel@tonic-gate * We handle the FBA case differently since the annul 7527c478bd9Sstevel@tonic-gate * bit means something slightly different. 7537c478bd9Sstevel@tonic-gate */ 7547c478bd9Sstevel@tonic-gate panic("fasttrap: mishandled a branch"); 7557c478bd9Sstevel@tonic-gate taken = (1 << fcc) & (8|4|2|1); break; 7567c478bd9Sstevel@tonic-gate case 0x9: /* FBE */ 7577c478bd9Sstevel@tonic-gate taken = (1 << fcc) & (0|0|0|1); break; 7587c478bd9Sstevel@tonic-gate case 0xa: /* FBUE */ 7597c478bd9Sstevel@tonic-gate taken = (1 << fcc) & (8|0|0|1); break; 7607c478bd9Sstevel@tonic-gate case 0xb: /* FBGE */ 7617c478bd9Sstevel@tonic-gate taken = (1 << fcc) & (0|4|0|1); break; 7627c478bd9Sstevel@tonic-gate case 0xc: /* FBUGE */ 7637c478bd9Sstevel@tonic-gate taken = (1 << fcc) & (8|4|0|1); break; 7647c478bd9Sstevel@tonic-gate case 0xd: /* FBLE */ 7657c478bd9Sstevel@tonic-gate taken = (1 << fcc) & (0|0|2|1); break; 7667c478bd9Sstevel@tonic-gate case 0xe: /* FBULE */ 7677c478bd9Sstevel@tonic-gate taken = (1 << fcc) & (8|0|2|1); break; 7687c478bd9Sstevel@tonic-gate case 0xf: /* FBO */ 7697c478bd9Sstevel@tonic-gate taken = (1 << fcc) & (0|4|2|1); break; 7707c478bd9Sstevel@tonic-gate } 7717c478bd9Sstevel@tonic-gate 7727c478bd9Sstevel@tonic-gate if (taken) { 7737c478bd9Sstevel@tonic-gate pc = rp->r_npc; 7747c478bd9Sstevel@tonic-gate npc = tp->ftt_dest; 7757c478bd9Sstevel@tonic-gate } else if (tp->ftt_flags & FASTTRAP_F_ANNUL) { 7767c478bd9Sstevel@tonic-gate /* 7777c478bd9Sstevel@tonic-gate * Untaken annulled branches don't execute the 7787c478bd9Sstevel@tonic-gate * instruction in the delay slot. 7797c478bd9Sstevel@tonic-gate */ 7807c478bd9Sstevel@tonic-gate pc = rp->r_npc + 4; 7817c478bd9Sstevel@tonic-gate npc = pc + 4; 7827c478bd9Sstevel@tonic-gate } else { 7837c478bd9Sstevel@tonic-gate pc = rp->r_npc; 7847c478bd9Sstevel@tonic-gate npc = pc + 4; 7857c478bd9Sstevel@tonic-gate } 7867c478bd9Sstevel@tonic-gate break; 7877c478bd9Sstevel@tonic-gate } 7887c478bd9Sstevel@tonic-gate 7897c478bd9Sstevel@tonic-gate case FASTTRAP_T_REG: 7907c478bd9Sstevel@tonic-gate { 7917c478bd9Sstevel@tonic-gate uint64_t value; 7927c478bd9Sstevel@tonic-gate uint_t taken; 7937c478bd9Sstevel@tonic-gate uint_t reg = RS1(tp->ftt_instr); 7947c478bd9Sstevel@tonic-gate 7957c478bd9Sstevel@tonic-gate /* 7967c478bd9Sstevel@tonic-gate * An ILP32 process shouldn't be using a branch predicated on 7977c478bd9Sstevel@tonic-gate * an %i or an %l since it would violate the ABI. It's a 7987c478bd9Sstevel@tonic-gate * violation of the ABI because we can't ensure deterministic 7997c478bd9Sstevel@tonic-gate * behavior. We should have identified this case when we 8007c478bd9Sstevel@tonic-gate * enabled the probe. 8017c478bd9Sstevel@tonic-gate */ 8027c478bd9Sstevel@tonic-gate ASSERT(p->p_model == DATAMODEL_LP64 || reg < 16); 8037c478bd9Sstevel@tonic-gate 8047c478bd9Sstevel@tonic-gate value = fasttrap_getreg(rp, reg); 8057c478bd9Sstevel@tonic-gate 8067c478bd9Sstevel@tonic-gate switch (tp->ftt_code) { 8077c478bd9Sstevel@tonic-gate case 0x1: /* BRZ */ 8087c478bd9Sstevel@tonic-gate taken = (value == 0); break; 8097c478bd9Sstevel@tonic-gate case 0x2: /* BRLEZ */ 8107c478bd9Sstevel@tonic-gate taken = (value <= 0); break; 8117c478bd9Sstevel@tonic-gate case 0x3: /* BRLZ */ 8127c478bd9Sstevel@tonic-gate taken = (value < 0); break; 8137c478bd9Sstevel@tonic-gate case 0x5: /* BRNZ */ 8147c478bd9Sstevel@tonic-gate taken = (value != 0); break; 8157c478bd9Sstevel@tonic-gate case 0x6: /* BRGZ */ 8167c478bd9Sstevel@tonic-gate taken = (value > 0); break; 8177c478bd9Sstevel@tonic-gate case 0x7: /* BRGEZ */ 8187c478bd9Sstevel@tonic-gate taken = (value <= 0); break; 8197c478bd9Sstevel@tonic-gate default: 8207c478bd9Sstevel@tonic-gate case 0x0: 8217c478bd9Sstevel@tonic-gate case 0x4: 8227c478bd9Sstevel@tonic-gate panic("fasttrap: mishandled a branch"); 8237c478bd9Sstevel@tonic-gate } 8247c478bd9Sstevel@tonic-gate 8257c478bd9Sstevel@tonic-gate if (taken) { 8267c478bd9Sstevel@tonic-gate pc = rp->r_npc; 8277c478bd9Sstevel@tonic-gate npc = tp->ftt_dest; 8287c478bd9Sstevel@tonic-gate } else if (tp->ftt_flags & FASTTRAP_F_ANNUL) { 8297c478bd9Sstevel@tonic-gate /* 8307c478bd9Sstevel@tonic-gate * Untaken annulled branches don't execute the 8317c478bd9Sstevel@tonic-gate * instruction in the delay slot. 8327c478bd9Sstevel@tonic-gate */ 8337c478bd9Sstevel@tonic-gate pc = rp->r_npc + 4; 8347c478bd9Sstevel@tonic-gate npc = pc + 4; 8357c478bd9Sstevel@tonic-gate } else { 8367c478bd9Sstevel@tonic-gate pc = rp->r_npc; 8377c478bd9Sstevel@tonic-gate npc = pc + 4; 8387c478bd9Sstevel@tonic-gate } 8397c478bd9Sstevel@tonic-gate break; 8407c478bd9Sstevel@tonic-gate } 8417c478bd9Sstevel@tonic-gate 8427c478bd9Sstevel@tonic-gate case FASTTRAP_T_ALWAYS: 8437c478bd9Sstevel@tonic-gate /* 8447c478bd9Sstevel@tonic-gate * BAs, BA,As... 8457c478bd9Sstevel@tonic-gate */ 8467c478bd9Sstevel@tonic-gate 8477c478bd9Sstevel@tonic-gate if (tp->ftt_flags & FASTTRAP_F_ANNUL) { 8487c478bd9Sstevel@tonic-gate /* 8497c478bd9Sstevel@tonic-gate * Annulled branch always instructions never execute 8507c478bd9Sstevel@tonic-gate * the instruction in the delay slot. 8517c478bd9Sstevel@tonic-gate */ 8527c478bd9Sstevel@tonic-gate pc = tp->ftt_dest; 8537c478bd9Sstevel@tonic-gate npc = tp->ftt_dest + 4; 8547c478bd9Sstevel@tonic-gate } else { 8557c478bd9Sstevel@tonic-gate pc = rp->r_npc; 8567c478bd9Sstevel@tonic-gate npc = tp->ftt_dest; 8577c478bd9Sstevel@tonic-gate } 8587c478bd9Sstevel@tonic-gate break; 8597c478bd9Sstevel@tonic-gate 8607c478bd9Sstevel@tonic-gate case FASTTRAP_T_RDPC: 8617c478bd9Sstevel@tonic-gate fasttrap_putreg(rp, RD(tp->ftt_instr), rp->r_pc); 8627c478bd9Sstevel@tonic-gate pc = rp->r_npc; 8637c478bd9Sstevel@tonic-gate npc = pc + 4; 8647c478bd9Sstevel@tonic-gate break; 8657c478bd9Sstevel@tonic-gate 8667c478bd9Sstevel@tonic-gate case FASTTRAP_T_CALL: 8677c478bd9Sstevel@tonic-gate /* 8687c478bd9Sstevel@tonic-gate * It's a call _and_ link remember... 8697c478bd9Sstevel@tonic-gate */ 8707c478bd9Sstevel@tonic-gate rp->r_o7 = rp->r_pc; 8717c478bd9Sstevel@tonic-gate pc = rp->r_npc; 8727c478bd9Sstevel@tonic-gate npc = tp->ftt_dest; 8737c478bd9Sstevel@tonic-gate break; 8747c478bd9Sstevel@tonic-gate 8757c478bd9Sstevel@tonic-gate case FASTTRAP_T_JMPL: 8767c478bd9Sstevel@tonic-gate pc = rp->r_npc; 8777c478bd9Sstevel@tonic-gate 8787c478bd9Sstevel@tonic-gate if (I(tp->ftt_instr)) { 8797c478bd9Sstevel@tonic-gate uint_t rs1 = RS1(tp->ftt_instr); 8807c478bd9Sstevel@tonic-gate int32_t imm; 8817c478bd9Sstevel@tonic-gate 8827c478bd9Sstevel@tonic-gate imm = tp->ftt_instr << 19; 8837c478bd9Sstevel@tonic-gate imm >>= 19; 8847c478bd9Sstevel@tonic-gate npc = fasttrap_getreg(rp, rs1) + imm; 8857c478bd9Sstevel@tonic-gate } else { 8867c478bd9Sstevel@tonic-gate uint_t rs1 = RS1(tp->ftt_instr); 8877c478bd9Sstevel@tonic-gate uint_t rs2 = RS2(tp->ftt_instr); 8887c478bd9Sstevel@tonic-gate 8897c478bd9Sstevel@tonic-gate npc = fasttrap_getreg(rp, rs1) + 8907c478bd9Sstevel@tonic-gate fasttrap_getreg(rp, rs2); 8917c478bd9Sstevel@tonic-gate } 8927c478bd9Sstevel@tonic-gate 8937c478bd9Sstevel@tonic-gate /* 8947c478bd9Sstevel@tonic-gate * Do the link part of the jump-and-link instruction. 8957c478bd9Sstevel@tonic-gate */ 8967c478bd9Sstevel@tonic-gate fasttrap_putreg(rp, RD(tp->ftt_instr), rp->r_pc); 8977c478bd9Sstevel@tonic-gate 8987c478bd9Sstevel@tonic-gate break; 8997c478bd9Sstevel@tonic-gate 9007c478bd9Sstevel@tonic-gate case FASTTRAP_T_COMMON: 9017c478bd9Sstevel@tonic-gate { 9027c478bd9Sstevel@tonic-gate curthread->t_dtrace_scrpc = rp->r_g7; 9037c478bd9Sstevel@tonic-gate curthread->t_dtrace_astpc = rp->r_g7 + FASTTRAP_OFF_FTRET; 9047c478bd9Sstevel@tonic-gate 9057c478bd9Sstevel@tonic-gate /* 9067c478bd9Sstevel@tonic-gate * Copy the instruction to a reserved location in the 9077c478bd9Sstevel@tonic-gate * user-land thread structure, then set the PC to that 9087c478bd9Sstevel@tonic-gate * location and leave the NPC alone. We take pains to ensure 9097c478bd9Sstevel@tonic-gate * consistency in the instruction stream (See SPARC 9107c478bd9Sstevel@tonic-gate * Architecture Manual Version 9, sections 8.4.7, A.20, and 9117c478bd9Sstevel@tonic-gate * H.1.6; UltraSPARC I/II User's Manual, sections 3.1.1.1, 9127c478bd9Sstevel@tonic-gate * and 13.6.4) by using the ASI ASI_BLK_COMMIT_S to copy the 9137c478bd9Sstevel@tonic-gate * instruction into the user's address space without 9147c478bd9Sstevel@tonic-gate * bypassing the I$. There's no AS_USER version of this ASI 9157c478bd9Sstevel@tonic-gate * (as exist for other ASIs) so we use the lofault 9167c478bd9Sstevel@tonic-gate * mechanism to catch faults. 9177c478bd9Sstevel@tonic-gate */ 9187c478bd9Sstevel@tonic-gate if (dtrace_blksuword32(rp->r_g7, &tp->ftt_instr, 1) == -1) { 9197c478bd9Sstevel@tonic-gate /* 9207c478bd9Sstevel@tonic-gate * If the copyout fails, then the process's state 9217c478bd9Sstevel@tonic-gate * is not consistent (the effects of the traced 9227c478bd9Sstevel@tonic-gate * instruction will never be seen). This process 9237c478bd9Sstevel@tonic-gate * cannot be allowed to continue execution. 9247c478bd9Sstevel@tonic-gate */ 9257c478bd9Sstevel@tonic-gate fasttrap_sigtrap(curproc, curthread, pc); 9267c478bd9Sstevel@tonic-gate return (0); 9277c478bd9Sstevel@tonic-gate } 9287c478bd9Sstevel@tonic-gate 9297c478bd9Sstevel@tonic-gate curthread->t_dtrace_pc = pc; 9307c478bd9Sstevel@tonic-gate curthread->t_dtrace_npc = npc; 9317c478bd9Sstevel@tonic-gate curthread->t_dtrace_on = 1; 9327c478bd9Sstevel@tonic-gate 9337c478bd9Sstevel@tonic-gate pc = curthread->t_dtrace_scrpc; 9347c478bd9Sstevel@tonic-gate 9357c478bd9Sstevel@tonic-gate if (tp->ftt_retids != NULL) { 9367c478bd9Sstevel@tonic-gate curthread->t_dtrace_step = 1; 9377c478bd9Sstevel@tonic-gate curthread->t_dtrace_ret = 1; 9387c478bd9Sstevel@tonic-gate npc = curthread->t_dtrace_astpc; 9397c478bd9Sstevel@tonic-gate } 9407c478bd9Sstevel@tonic-gate break; 9417c478bd9Sstevel@tonic-gate } 9427c478bd9Sstevel@tonic-gate 9437c478bd9Sstevel@tonic-gate default: 9447c478bd9Sstevel@tonic-gate panic("fasttrap: mishandled an instruction"); 9457c478bd9Sstevel@tonic-gate } 9467c478bd9Sstevel@tonic-gate 9477c478bd9Sstevel@tonic-gate /* 9487c478bd9Sstevel@tonic-gate * This bit me in the ass a couple of times, so lets toss this 9497c478bd9Sstevel@tonic-gate * in as a cursory sanity check. 9507c478bd9Sstevel@tonic-gate */ 9517c478bd9Sstevel@tonic-gate ASSERT(pc != rp->r_g7 + 4); 9527c478bd9Sstevel@tonic-gate ASSERT(pc != rp->r_g7 + 8); 9537c478bd9Sstevel@tonic-gate 954*ac448965Sahl done: 9557c478bd9Sstevel@tonic-gate /* 9567c478bd9Sstevel@tonic-gate * If there were no return probes when we first found the tracepoint, 9577c478bd9Sstevel@tonic-gate * we should feel no obligation to honor any return probes that were 9587c478bd9Sstevel@tonic-gate * subsequently enabled -- they'll just have to wait until the next 9597c478bd9Sstevel@tonic-gate * time around. 9607c478bd9Sstevel@tonic-gate */ 9617c478bd9Sstevel@tonic-gate if (tp->ftt_retids != NULL) { 9627c478bd9Sstevel@tonic-gate /* 9637c478bd9Sstevel@tonic-gate * We need to wait until the results of the instruction are 9647c478bd9Sstevel@tonic-gate * apparent before invoking any return probes. If this 9657c478bd9Sstevel@tonic-gate * instruction was emulated we can just call 9667c478bd9Sstevel@tonic-gate * fasttrap_return_common(); if it needs to be executed, we 9677c478bd9Sstevel@tonic-gate * need to wait until we return to the kernel. 9687c478bd9Sstevel@tonic-gate */ 9697c478bd9Sstevel@tonic-gate if (tp->ftt_type != FASTTRAP_T_COMMON) { 9707c478bd9Sstevel@tonic-gate fasttrap_return_common(rp, orig_pc, pid, fake_restore); 9717c478bd9Sstevel@tonic-gate } else { 9727c478bd9Sstevel@tonic-gate ASSERT(curthread->t_dtrace_ret != 0); 9737c478bd9Sstevel@tonic-gate ASSERT(curthread->t_dtrace_pc == orig_pc); 9747c478bd9Sstevel@tonic-gate ASSERT(curthread->t_dtrace_scrpc == rp->r_g7); 9757c478bd9Sstevel@tonic-gate ASSERT(npc == curthread->t_dtrace_astpc); 9767c478bd9Sstevel@tonic-gate } 9777c478bd9Sstevel@tonic-gate } 9787c478bd9Sstevel@tonic-gate 9797c478bd9Sstevel@tonic-gate ASSERT(pc != 0); 9807c478bd9Sstevel@tonic-gate rp->r_pc = pc; 9817c478bd9Sstevel@tonic-gate rp->r_npc = npc; 9827c478bd9Sstevel@tonic-gate 9837c478bd9Sstevel@tonic-gate return (0); 9847c478bd9Sstevel@tonic-gate } 9857c478bd9Sstevel@tonic-gate 9867c478bd9Sstevel@tonic-gate int 9877c478bd9Sstevel@tonic-gate fasttrap_return_probe(struct regs *rp) 9887c478bd9Sstevel@tonic-gate { 9897c478bd9Sstevel@tonic-gate proc_t *p = ttoproc(curthread); 9907c478bd9Sstevel@tonic-gate pid_t pid; 9917c478bd9Sstevel@tonic-gate uintptr_t pc = curthread->t_dtrace_pc; 9927c478bd9Sstevel@tonic-gate uintptr_t npc = curthread->t_dtrace_npc; 9937c478bd9Sstevel@tonic-gate 9947c478bd9Sstevel@tonic-gate curthread->t_dtrace_pc = 0; 9957c478bd9Sstevel@tonic-gate curthread->t_dtrace_npc = 0; 9967c478bd9Sstevel@tonic-gate curthread->t_dtrace_scrpc = 0; 9977c478bd9Sstevel@tonic-gate curthread->t_dtrace_astpc = 0; 9987c478bd9Sstevel@tonic-gate 9997c478bd9Sstevel@tonic-gate /* 10007c478bd9Sstevel@tonic-gate * Treat a child created by a call to vfork(2) as if it were its 10017c478bd9Sstevel@tonic-gate * parent. We know there's only one thread of control in such a 10027c478bd9Sstevel@tonic-gate * process: this one. 10037c478bd9Sstevel@tonic-gate */ 10047c478bd9Sstevel@tonic-gate while (p->p_flag & SVFORK) { 10057c478bd9Sstevel@tonic-gate p = p->p_parent; 10067c478bd9Sstevel@tonic-gate } 10077c478bd9Sstevel@tonic-gate 10087c478bd9Sstevel@tonic-gate /* 10097c478bd9Sstevel@tonic-gate * We set the %pc and %npc to their values when the traced 10107c478bd9Sstevel@tonic-gate * instruction was initially executed so that it appears to 10117c478bd9Sstevel@tonic-gate * dtrace_probe() that we're on the original instruction, and so that 10127c478bd9Sstevel@tonic-gate * the user can't easily detect our complex web of lies. 10137c478bd9Sstevel@tonic-gate * dtrace_return_probe() (our caller) will correctly set %pc and %npc 10147c478bd9Sstevel@tonic-gate * after we return. 10157c478bd9Sstevel@tonic-gate */ 10167c478bd9Sstevel@tonic-gate rp->r_pc = pc; 10177c478bd9Sstevel@tonic-gate rp->r_npc = npc; 10187c478bd9Sstevel@tonic-gate 10197c478bd9Sstevel@tonic-gate pid = p->p_pid; 10207c478bd9Sstevel@tonic-gate fasttrap_return_common(rp, pc, pid, 0); 10217c478bd9Sstevel@tonic-gate 10227c478bd9Sstevel@tonic-gate return (0); 10237c478bd9Sstevel@tonic-gate } 10247c478bd9Sstevel@tonic-gate 10257c478bd9Sstevel@tonic-gate int 10267c478bd9Sstevel@tonic-gate fasttrap_tracepoint_install(proc_t *p, fasttrap_tracepoint_t *tp) 10277c478bd9Sstevel@tonic-gate { 10287c478bd9Sstevel@tonic-gate fasttrap_instr_t instr = FASTTRAP_INSTR; 10297c478bd9Sstevel@tonic-gate 10307c478bd9Sstevel@tonic-gate if (uwrite(p, &instr, 4, tp->ftt_pc) != 0) 10317c478bd9Sstevel@tonic-gate return (-1); 10327c478bd9Sstevel@tonic-gate 10337c478bd9Sstevel@tonic-gate return (0); 10347c478bd9Sstevel@tonic-gate } 10357c478bd9Sstevel@tonic-gate 10367c478bd9Sstevel@tonic-gate int 10377c478bd9Sstevel@tonic-gate fasttrap_tracepoint_remove(proc_t *p, fasttrap_tracepoint_t *tp) 10387c478bd9Sstevel@tonic-gate { 10397c478bd9Sstevel@tonic-gate fasttrap_instr_t instr; 10407c478bd9Sstevel@tonic-gate 10417c478bd9Sstevel@tonic-gate /* 10427c478bd9Sstevel@tonic-gate * Distinguish between read or write failures and a changed 10437c478bd9Sstevel@tonic-gate * instruction. 10447c478bd9Sstevel@tonic-gate */ 10457c478bd9Sstevel@tonic-gate if (uread(p, &instr, 4, tp->ftt_pc) != 0) 10467c478bd9Sstevel@tonic-gate return (0); 10477c478bd9Sstevel@tonic-gate if (instr != FASTTRAP_INSTR && instr != BREAKPOINT_INSTR) 10487c478bd9Sstevel@tonic-gate return (0); 10497c478bd9Sstevel@tonic-gate if (uwrite(p, &tp->ftt_instr, 4, tp->ftt_pc) != 0) 10507c478bd9Sstevel@tonic-gate return (-1); 10517c478bd9Sstevel@tonic-gate 10527c478bd9Sstevel@tonic-gate return (0); 10537c478bd9Sstevel@tonic-gate } 10547c478bd9Sstevel@tonic-gate 10557c478bd9Sstevel@tonic-gate int 1056*ac448965Sahl fasttrap_tracepoint_init(proc_t *p, fasttrap_tracepoint_t *tp, uintptr_t pc, 1057*ac448965Sahl fasttrap_probe_type_t type) 10587c478bd9Sstevel@tonic-gate { 10597c478bd9Sstevel@tonic-gate uint32_t instr; 10607c478bd9Sstevel@tonic-gate int32_t disp; 10617c478bd9Sstevel@tonic-gate 10627c478bd9Sstevel@tonic-gate /* 10637c478bd9Sstevel@tonic-gate * Read the instruction at the given address out of the process's 10647c478bd9Sstevel@tonic-gate * address space. We don't have to worry about a debugger 10657c478bd9Sstevel@tonic-gate * changing this instruction before we overwrite it with our trap 10667c478bd9Sstevel@tonic-gate * instruction since P_PR_LOCK is set. 10677c478bd9Sstevel@tonic-gate */ 10687c478bd9Sstevel@tonic-gate if (uread(p, &instr, 4, pc) != 0) 10697c478bd9Sstevel@tonic-gate return (-1); 10707c478bd9Sstevel@tonic-gate 10717c478bd9Sstevel@tonic-gate /* 10727c478bd9Sstevel@tonic-gate * Decode the instruction to fill in the probe flags. We can have 10737c478bd9Sstevel@tonic-gate * the process execute most instructions on its own using a pc/npc 10747c478bd9Sstevel@tonic-gate * trick, but pc-relative control transfer present a problem since 10757c478bd9Sstevel@tonic-gate * we're relocating the instruction. We emulate these instructions 10767c478bd9Sstevel@tonic-gate * in the kernel. We assume a default type and over-write that as 10777c478bd9Sstevel@tonic-gate * needed. 10787c478bd9Sstevel@tonic-gate * 10797c478bd9Sstevel@tonic-gate * pc-relative instructions must be emulated for correctness; 10807c478bd9Sstevel@tonic-gate * other instructions (which represent a large set of commonly traced 10817c478bd9Sstevel@tonic-gate * instructions) are emulated or otherwise optimized for performance. 10827c478bd9Sstevel@tonic-gate */ 10837c478bd9Sstevel@tonic-gate tp->ftt_type = FASTTRAP_T_COMMON; 10847c478bd9Sstevel@tonic-gate if (OP(instr) == 1) { 10857c478bd9Sstevel@tonic-gate /* 10867c478bd9Sstevel@tonic-gate * Call instructions. 10877c478bd9Sstevel@tonic-gate */ 10887c478bd9Sstevel@tonic-gate tp->ftt_type = FASTTRAP_T_CALL; 10897c478bd9Sstevel@tonic-gate disp = DISP30(instr) << 2; 10907c478bd9Sstevel@tonic-gate tp->ftt_dest = pc + (intptr_t)disp; 10917c478bd9Sstevel@tonic-gate 10927c478bd9Sstevel@tonic-gate } else if (OP(instr) == 0) { 10937c478bd9Sstevel@tonic-gate /* 10947c478bd9Sstevel@tonic-gate * Branch instructions. 10957c478bd9Sstevel@tonic-gate * 10967c478bd9Sstevel@tonic-gate * Unconditional branches need careful attention when they're 10977c478bd9Sstevel@tonic-gate * annulled: annulled unconditional branches never execute 10987c478bd9Sstevel@tonic-gate * the instruction in the delay slot. 10997c478bd9Sstevel@tonic-gate */ 11007c478bd9Sstevel@tonic-gate switch (OP2(instr)) { 11017c478bd9Sstevel@tonic-gate case OP2_ILLTRAP: 11027c478bd9Sstevel@tonic-gate case 0x7: 11037c478bd9Sstevel@tonic-gate /* 11047c478bd9Sstevel@tonic-gate * The compiler may place an illtrap after a call to 11057c478bd9Sstevel@tonic-gate * a function that returns a structure. In the case of 11067c478bd9Sstevel@tonic-gate * a returned structure, the compiler places an illtrap 11077c478bd9Sstevel@tonic-gate * whose const22 field is the size of the returned 11087c478bd9Sstevel@tonic-gate * structure immediately following the delay slot of 11097c478bd9Sstevel@tonic-gate * the call. To stay out of the way, we refuse to 11107c478bd9Sstevel@tonic-gate * place tracepoints on top of illtrap instructions. 11117c478bd9Sstevel@tonic-gate * 11127c478bd9Sstevel@tonic-gate * This is one of the dumbest architectural decisions 11137c478bd9Sstevel@tonic-gate * I've ever had to work around. 11147c478bd9Sstevel@tonic-gate * 11157c478bd9Sstevel@tonic-gate * We also identify the only illegal op2 value (See 11167c478bd9Sstevel@tonic-gate * SPARC Architecture Manual Version 9, E.2 table 31). 11177c478bd9Sstevel@tonic-gate */ 11187c478bd9Sstevel@tonic-gate return (-1); 11197c478bd9Sstevel@tonic-gate 11207c478bd9Sstevel@tonic-gate case OP2_BPcc: 11217c478bd9Sstevel@tonic-gate if (COND(instr) == 8) { 11227c478bd9Sstevel@tonic-gate tp->ftt_type = FASTTRAP_T_ALWAYS; 11237c478bd9Sstevel@tonic-gate } else { 11247c478bd9Sstevel@tonic-gate /* 11257c478bd9Sstevel@tonic-gate * Check for an illegal instruction. 11267c478bd9Sstevel@tonic-gate */ 11277c478bd9Sstevel@tonic-gate if (CC(instr) & 1) 11287c478bd9Sstevel@tonic-gate return (-1); 11297c478bd9Sstevel@tonic-gate tp->ftt_type = FASTTRAP_T_CCR; 11307c478bd9Sstevel@tonic-gate tp->ftt_cc = CC(instr); 11317c478bd9Sstevel@tonic-gate tp->ftt_code = COND(instr); 11327c478bd9Sstevel@tonic-gate } 11337c478bd9Sstevel@tonic-gate 11347c478bd9Sstevel@tonic-gate if (A(instr) != 0) 11357c478bd9Sstevel@tonic-gate tp->ftt_flags |= FASTTRAP_F_ANNUL; 11367c478bd9Sstevel@tonic-gate 11377c478bd9Sstevel@tonic-gate disp = DISP19(instr); 11387c478bd9Sstevel@tonic-gate disp <<= 13; 11397c478bd9Sstevel@tonic-gate disp >>= 11; 11407c478bd9Sstevel@tonic-gate tp->ftt_dest = pc + (intptr_t)disp; 11417c478bd9Sstevel@tonic-gate break; 11427c478bd9Sstevel@tonic-gate 11437c478bd9Sstevel@tonic-gate case OP2_Bicc: 11447c478bd9Sstevel@tonic-gate if (COND(instr) == 8) { 11457c478bd9Sstevel@tonic-gate tp->ftt_type = FASTTRAP_T_ALWAYS; 11467c478bd9Sstevel@tonic-gate } else { 11477c478bd9Sstevel@tonic-gate tp->ftt_type = FASTTRAP_T_CCR; 11487c478bd9Sstevel@tonic-gate tp->ftt_cc = 0; 11497c478bd9Sstevel@tonic-gate tp->ftt_code = COND(instr); 11507c478bd9Sstevel@tonic-gate } 11517c478bd9Sstevel@tonic-gate 11527c478bd9Sstevel@tonic-gate if (A(instr) != 0) 11537c478bd9Sstevel@tonic-gate tp->ftt_flags |= FASTTRAP_F_ANNUL; 11547c478bd9Sstevel@tonic-gate 11557c478bd9Sstevel@tonic-gate disp = DISP22(instr); 11567c478bd9Sstevel@tonic-gate disp <<= 10; 11577c478bd9Sstevel@tonic-gate disp >>= 8; 11587c478bd9Sstevel@tonic-gate tp->ftt_dest = pc + (intptr_t)disp; 11597c478bd9Sstevel@tonic-gate break; 11607c478bd9Sstevel@tonic-gate 11617c478bd9Sstevel@tonic-gate case OP2_BPr: 11627c478bd9Sstevel@tonic-gate /* 11637c478bd9Sstevel@tonic-gate * Check for an illegal instruction. 11647c478bd9Sstevel@tonic-gate */ 11657c478bd9Sstevel@tonic-gate if ((RCOND(instr) & 3) == 0) 11667c478bd9Sstevel@tonic-gate return (-1); 11677c478bd9Sstevel@tonic-gate 11687c478bd9Sstevel@tonic-gate /* 11697c478bd9Sstevel@tonic-gate * It's a violation of the v8plus ABI to use a 11707c478bd9Sstevel@tonic-gate * register-predicated branch in a 32-bit app if 11717c478bd9Sstevel@tonic-gate * the register used is an %l or an %i (%gs and %os 11727c478bd9Sstevel@tonic-gate * are legit because they're not saved to the stack 11737c478bd9Sstevel@tonic-gate * in 32-bit words when we take a trap). 11747c478bd9Sstevel@tonic-gate */ 11757c478bd9Sstevel@tonic-gate if (p->p_model == DATAMODEL_ILP32 && RS1(instr) >= 16) 11767c478bd9Sstevel@tonic-gate return (-1); 11777c478bd9Sstevel@tonic-gate 11787c478bd9Sstevel@tonic-gate tp->ftt_type = FASTTRAP_T_REG; 11797c478bd9Sstevel@tonic-gate if (A(instr) != 0) 11807c478bd9Sstevel@tonic-gate tp->ftt_flags |= FASTTRAP_F_ANNUL; 11817c478bd9Sstevel@tonic-gate disp = DISP16(instr); 11827c478bd9Sstevel@tonic-gate disp <<= 16; 11837c478bd9Sstevel@tonic-gate disp >>= 14; 11847c478bd9Sstevel@tonic-gate tp->ftt_dest = pc + (intptr_t)disp; 11857c478bd9Sstevel@tonic-gate tp->ftt_code = RCOND(instr); 11867c478bd9Sstevel@tonic-gate break; 11877c478bd9Sstevel@tonic-gate 11887c478bd9Sstevel@tonic-gate case OP2_SETHI: 11897c478bd9Sstevel@tonic-gate tp->ftt_type = FASTTRAP_T_SETHI; 11907c478bd9Sstevel@tonic-gate break; 11917c478bd9Sstevel@tonic-gate 11927c478bd9Sstevel@tonic-gate case OP2_FBPfcc: 11937c478bd9Sstevel@tonic-gate if (COND(instr) == 8) { 11947c478bd9Sstevel@tonic-gate tp->ftt_type = FASTTRAP_T_ALWAYS; 11957c478bd9Sstevel@tonic-gate } else { 11967c478bd9Sstevel@tonic-gate tp->ftt_type = FASTTRAP_T_FCC; 11977c478bd9Sstevel@tonic-gate tp->ftt_cc = CC(instr); 11987c478bd9Sstevel@tonic-gate tp->ftt_code = COND(instr); 11997c478bd9Sstevel@tonic-gate } 12007c478bd9Sstevel@tonic-gate 12017c478bd9Sstevel@tonic-gate if (A(instr) != 0) 12027c478bd9Sstevel@tonic-gate tp->ftt_flags |= FASTTRAP_F_ANNUL; 12037c478bd9Sstevel@tonic-gate 12047c478bd9Sstevel@tonic-gate disp = DISP19(instr); 12057c478bd9Sstevel@tonic-gate disp <<= 13; 12067c478bd9Sstevel@tonic-gate disp >>= 11; 12077c478bd9Sstevel@tonic-gate tp->ftt_dest = pc + (intptr_t)disp; 12087c478bd9Sstevel@tonic-gate break; 12097c478bd9Sstevel@tonic-gate 12107c478bd9Sstevel@tonic-gate case OP2_FBfcc: 12117c478bd9Sstevel@tonic-gate if (COND(instr) == 8) { 12127c478bd9Sstevel@tonic-gate tp->ftt_type = FASTTRAP_T_ALWAYS; 12137c478bd9Sstevel@tonic-gate } else { 12147c478bd9Sstevel@tonic-gate tp->ftt_type = FASTTRAP_T_FCC; 12157c478bd9Sstevel@tonic-gate tp->ftt_cc = 0; 12167c478bd9Sstevel@tonic-gate tp->ftt_code = COND(instr); 12177c478bd9Sstevel@tonic-gate } 12187c478bd9Sstevel@tonic-gate 12197c478bd9Sstevel@tonic-gate if (A(instr) != 0) 12207c478bd9Sstevel@tonic-gate tp->ftt_flags |= FASTTRAP_F_ANNUL; 12217c478bd9Sstevel@tonic-gate 12227c478bd9Sstevel@tonic-gate disp = DISP22(instr); 12237c478bd9Sstevel@tonic-gate disp <<= 10; 12247c478bd9Sstevel@tonic-gate disp >>= 8; 12257c478bd9Sstevel@tonic-gate tp->ftt_dest = pc + (intptr_t)disp; 12267c478bd9Sstevel@tonic-gate break; 12277c478bd9Sstevel@tonic-gate } 12287c478bd9Sstevel@tonic-gate 12297c478bd9Sstevel@tonic-gate } else if (OP(instr) == 2) { 12307c478bd9Sstevel@tonic-gate switch (OP3(instr)) { 12317c478bd9Sstevel@tonic-gate case OP3_RETURN: 12327c478bd9Sstevel@tonic-gate tp->ftt_type = FASTTRAP_T_RETURN; 12337c478bd9Sstevel@tonic-gate break; 12347c478bd9Sstevel@tonic-gate 12357c478bd9Sstevel@tonic-gate case OP3_JMPL: 12367c478bd9Sstevel@tonic-gate tp->ftt_type = FASTTRAP_T_JMPL; 12377c478bd9Sstevel@tonic-gate break; 12387c478bd9Sstevel@tonic-gate 12397c478bd9Sstevel@tonic-gate case OP3_RD: 12407c478bd9Sstevel@tonic-gate if (RS1(instr) == 5) 12417c478bd9Sstevel@tonic-gate tp->ftt_type = FASTTRAP_T_RDPC; 12427c478bd9Sstevel@tonic-gate break; 12437c478bd9Sstevel@tonic-gate 12447c478bd9Sstevel@tonic-gate case OP3_SAVE: 12457c478bd9Sstevel@tonic-gate /* 12467c478bd9Sstevel@tonic-gate * We optimize for save instructions at function 12477c478bd9Sstevel@tonic-gate * entry; see the comment in fasttrap_pid_probe() 12487c478bd9Sstevel@tonic-gate * (near FASTTRAP_T_SAVE) for details. 12497c478bd9Sstevel@tonic-gate */ 12507c478bd9Sstevel@tonic-gate if (fasttrap_optimize_save != 0 && 1251*ac448965Sahl type == DTFTP_ENTRY && 12527c478bd9Sstevel@tonic-gate I(instr) == 1 && RD(instr) == R_SP) 12537c478bd9Sstevel@tonic-gate tp->ftt_type = FASTTRAP_T_SAVE; 12547c478bd9Sstevel@tonic-gate break; 12557c478bd9Sstevel@tonic-gate 12567c478bd9Sstevel@tonic-gate case OP3_RESTORE: 12577c478bd9Sstevel@tonic-gate /* 12587c478bd9Sstevel@tonic-gate * We optimize restore instructions at function 12597c478bd9Sstevel@tonic-gate * return; see the comment in fasttrap_pid_probe() 12607c478bd9Sstevel@tonic-gate * (near FASTTRAP_T_RESTORE) for details. 12617c478bd9Sstevel@tonic-gate * 12627c478bd9Sstevel@tonic-gate * rd must be an %o or %g register. 12637c478bd9Sstevel@tonic-gate */ 12647c478bd9Sstevel@tonic-gate if ((RD(instr) & 0x10) == 0) 12657c478bd9Sstevel@tonic-gate tp->ftt_type = FASTTRAP_T_RESTORE; 12667c478bd9Sstevel@tonic-gate break; 12677c478bd9Sstevel@tonic-gate 12687c478bd9Sstevel@tonic-gate case OP3_OR: 12697c478bd9Sstevel@tonic-gate /* 12707c478bd9Sstevel@tonic-gate * A large proportion of instructions in the delay 12717c478bd9Sstevel@tonic-gate * slot of retl instructions are or's so we emulate 12727c478bd9Sstevel@tonic-gate * these downstairs as an optimization. 12737c478bd9Sstevel@tonic-gate */ 12747c478bd9Sstevel@tonic-gate tp->ftt_type = FASTTRAP_T_OR; 12757c478bd9Sstevel@tonic-gate break; 12767c478bd9Sstevel@tonic-gate 12777c478bd9Sstevel@tonic-gate case OP3_TCC: 12787c478bd9Sstevel@tonic-gate /* 12797c478bd9Sstevel@tonic-gate * Breakpoint instructions are effectively position- 12807c478bd9Sstevel@tonic-gate * dependent since the debugger uses the %pc value 12817c478bd9Sstevel@tonic-gate * to lookup which breakpoint was executed. As a 12827c478bd9Sstevel@tonic-gate * result, we can't actually instrument breakpoints. 12837c478bd9Sstevel@tonic-gate */ 12847c478bd9Sstevel@tonic-gate if (SW_TRAP(instr) == ST_BREAKPOINT) 12857c478bd9Sstevel@tonic-gate return (-1); 12867c478bd9Sstevel@tonic-gate break; 12877c478bd9Sstevel@tonic-gate 12887c478bd9Sstevel@tonic-gate case 0x19: 12897c478bd9Sstevel@tonic-gate case 0x1d: 12907c478bd9Sstevel@tonic-gate case 0x29: 12917c478bd9Sstevel@tonic-gate case 0x33: 12927c478bd9Sstevel@tonic-gate case 0x3f: 12937c478bd9Sstevel@tonic-gate /* 12947c478bd9Sstevel@tonic-gate * Identify illegal instructions (See SPARC 12957c478bd9Sstevel@tonic-gate * Architecture Manual Version 9, E.2 table 32). 12967c478bd9Sstevel@tonic-gate */ 12977c478bd9Sstevel@tonic-gate return (-1); 12987c478bd9Sstevel@tonic-gate } 12997c478bd9Sstevel@tonic-gate } else if (OP(instr) == 3) { 13007c478bd9Sstevel@tonic-gate uint32_t op3 = OP3(instr); 13017c478bd9Sstevel@tonic-gate 13027c478bd9Sstevel@tonic-gate /* 13037c478bd9Sstevel@tonic-gate * Identify illegal instructions (See SPARC Architecture 13047c478bd9Sstevel@tonic-gate * Manual Version 9, E.2 table 33). 13057c478bd9Sstevel@tonic-gate */ 13067c478bd9Sstevel@tonic-gate if ((op3 & 0x28) == 0x28) { 13077c478bd9Sstevel@tonic-gate if (op3 != OP3_PREFETCH && op3 != OP3_CASA && 13087c478bd9Sstevel@tonic-gate op3 != OP3_PREFETCHA && op3 != OP3_CASXA) 13097c478bd9Sstevel@tonic-gate return (-1); 13107c478bd9Sstevel@tonic-gate } else { 13117c478bd9Sstevel@tonic-gate if ((op3 & 0x0f) == 0x0c || (op3 & 0x3b) == 0x31) 13127c478bd9Sstevel@tonic-gate return (-1); 13137c478bd9Sstevel@tonic-gate } 13147c478bd9Sstevel@tonic-gate } 13157c478bd9Sstevel@tonic-gate 13167c478bd9Sstevel@tonic-gate tp->ftt_instr = instr; 13177c478bd9Sstevel@tonic-gate 13187c478bd9Sstevel@tonic-gate /* 13197c478bd9Sstevel@tonic-gate * We don't know how this tracepoint is going to be used, but in case 13207c478bd9Sstevel@tonic-gate * it's used as part of a function return probe, we need to indicate 13217c478bd9Sstevel@tonic-gate * whether it's always a return site or only potentially a return 13227c478bd9Sstevel@tonic-gate * site. If it's part of a return probe, it's always going to be a 13237c478bd9Sstevel@tonic-gate * return from that function if it's a restore instruction or if 13247c478bd9Sstevel@tonic-gate * the previous instruction was a return. If we could reliably 13257c478bd9Sstevel@tonic-gate * distinguish jump tables from return sites, this wouldn't be 13267c478bd9Sstevel@tonic-gate * necessary. 13277c478bd9Sstevel@tonic-gate */ 13287c478bd9Sstevel@tonic-gate if (tp->ftt_type != FASTTRAP_T_RESTORE && 13297c478bd9Sstevel@tonic-gate (uread(p, &instr, 4, pc - sizeof (instr)) != 0 || 13307c478bd9Sstevel@tonic-gate !(OP(instr) == 2 && OP3(instr) == OP3_RETURN))) 13317c478bd9Sstevel@tonic-gate tp->ftt_flags |= FASTTRAP_F_RETMAYBE; 13327c478bd9Sstevel@tonic-gate 13337c478bd9Sstevel@tonic-gate return (0); 13347c478bd9Sstevel@tonic-gate } 13357c478bd9Sstevel@tonic-gate 13367c478bd9Sstevel@tonic-gate /*ARGSUSED*/ 13377c478bd9Sstevel@tonic-gate uint64_t 13387c478bd9Sstevel@tonic-gate fasttrap_getarg(void *arg, dtrace_id_t id, void *parg, int argno, int aframes) 13397c478bd9Sstevel@tonic-gate { 13407c478bd9Sstevel@tonic-gate return (fasttrap_anarg(ttolwp(curthread)->lwp_regs, argno)); 13417c478bd9Sstevel@tonic-gate } 13427c478bd9Sstevel@tonic-gate 13437c478bd9Sstevel@tonic-gate /*ARGSUSED*/ 13447c478bd9Sstevel@tonic-gate uint64_t 13457c478bd9Sstevel@tonic-gate fasttrap_usdt_getarg(void *arg, dtrace_id_t id, void *parg, int argno, 13467c478bd9Sstevel@tonic-gate int aframes) 13477c478bd9Sstevel@tonic-gate { 13487c478bd9Sstevel@tonic-gate return (fasttrap_anarg(ttolwp(curthread)->lwp_regs, argno)); 13497c478bd9Sstevel@tonic-gate } 13507c478bd9Sstevel@tonic-gate 13517c478bd9Sstevel@tonic-gate static uint64_t fasttrap_getreg_fast_cnt; 13527c478bd9Sstevel@tonic-gate static uint64_t fasttrap_getreg_mpcb_cnt; 13537c478bd9Sstevel@tonic-gate static uint64_t fasttrap_getreg_slow_cnt; 13547c478bd9Sstevel@tonic-gate 13557c478bd9Sstevel@tonic-gate static ulong_t 13567c478bd9Sstevel@tonic-gate fasttrap_getreg(struct regs *rp, uint_t reg) 13577c478bd9Sstevel@tonic-gate { 13587c478bd9Sstevel@tonic-gate ulong_t value; 13597c478bd9Sstevel@tonic-gate dtrace_icookie_t cookie; 13607c478bd9Sstevel@tonic-gate struct machpcb *mpcb; 13617c478bd9Sstevel@tonic-gate extern ulong_t dtrace_getreg_win(uint_t, uint_t); 13627c478bd9Sstevel@tonic-gate 13637c478bd9Sstevel@tonic-gate /* 13647c478bd9Sstevel@tonic-gate * We have the %os and %gs in our struct regs, but if we need to 13657c478bd9Sstevel@tonic-gate * snag a %l or %i we need to go scrounging around in the process's 13667c478bd9Sstevel@tonic-gate * address space. 13677c478bd9Sstevel@tonic-gate */ 13687c478bd9Sstevel@tonic-gate if (reg == 0) 13697c478bd9Sstevel@tonic-gate return (0); 13707c478bd9Sstevel@tonic-gate 13717c478bd9Sstevel@tonic-gate if (reg < 16) 13727c478bd9Sstevel@tonic-gate return ((&rp->r_g1)[reg - 1]); 13737c478bd9Sstevel@tonic-gate 13747c478bd9Sstevel@tonic-gate /* 13757c478bd9Sstevel@tonic-gate * Before we look at the user's stack, we'll check the register 13767c478bd9Sstevel@tonic-gate * windows to see if the information we want is in there. 13777c478bd9Sstevel@tonic-gate */ 13787c478bd9Sstevel@tonic-gate cookie = dtrace_interrupt_disable(); 13797c478bd9Sstevel@tonic-gate if (dtrace_getotherwin() > 0) { 13807c478bd9Sstevel@tonic-gate value = dtrace_getreg_win(reg, 1); 13817c478bd9Sstevel@tonic-gate dtrace_interrupt_enable(cookie); 13827c478bd9Sstevel@tonic-gate 13837c478bd9Sstevel@tonic-gate atomic_add_64(&fasttrap_getreg_fast_cnt, 1); 13847c478bd9Sstevel@tonic-gate 13857c478bd9Sstevel@tonic-gate return (value); 13867c478bd9Sstevel@tonic-gate } 13877c478bd9Sstevel@tonic-gate dtrace_interrupt_enable(cookie); 13887c478bd9Sstevel@tonic-gate 13897c478bd9Sstevel@tonic-gate /* 13907c478bd9Sstevel@tonic-gate * First check the machpcb structure to see if we've already read 13917c478bd9Sstevel@tonic-gate * in the register window we're looking for; if we haven't, (and 13927c478bd9Sstevel@tonic-gate * we probably haven't) try to copy in the value of the register. 13937c478bd9Sstevel@tonic-gate */ 13947c478bd9Sstevel@tonic-gate mpcb = (struct machpcb *)((caddr_t)rp - REGOFF); 13957c478bd9Sstevel@tonic-gate 13967c478bd9Sstevel@tonic-gate if (get_udatamodel() == DATAMODEL_NATIVE) { 13977c478bd9Sstevel@tonic-gate struct frame *fr = (struct frame *)(rp->r_sp + STACK_BIAS); 13987c478bd9Sstevel@tonic-gate 13997c478bd9Sstevel@tonic-gate if (mpcb->mpcb_wbcnt > 0) { 14007c478bd9Sstevel@tonic-gate struct rwindow *rwin = (void *)mpcb->mpcb_wbuf; 14017c478bd9Sstevel@tonic-gate int i = mpcb->mpcb_wbcnt; 14027c478bd9Sstevel@tonic-gate do { 14037c478bd9Sstevel@tonic-gate i--; 14047c478bd9Sstevel@tonic-gate if ((long)mpcb->mpcb_spbuf[i] != rp->r_sp) 14057c478bd9Sstevel@tonic-gate continue; 14067c478bd9Sstevel@tonic-gate 14077c478bd9Sstevel@tonic-gate atomic_add_64(&fasttrap_getreg_mpcb_cnt, 1); 14087c478bd9Sstevel@tonic-gate return (rwin[i].rw_local[reg - 16]); 14097c478bd9Sstevel@tonic-gate } while (i > 0); 14107c478bd9Sstevel@tonic-gate } 14117c478bd9Sstevel@tonic-gate 14127c478bd9Sstevel@tonic-gate if (fasttrap_fulword(&fr->fr_local[reg - 16], &value) != 0) 14137c478bd9Sstevel@tonic-gate goto err; 14147c478bd9Sstevel@tonic-gate } else { 141575521904Sraf struct frame32 *fr = 141675521904Sraf (struct frame32 *)(uintptr_t)(caddr32_t)rp->r_sp; 14177c478bd9Sstevel@tonic-gate uint32_t *v32 = (uint32_t *)&value; 14187c478bd9Sstevel@tonic-gate 14197c478bd9Sstevel@tonic-gate if (mpcb->mpcb_wbcnt > 0) { 14207c478bd9Sstevel@tonic-gate struct rwindow32 *rwin = (void *)mpcb->mpcb_wbuf; 14217c478bd9Sstevel@tonic-gate int i = mpcb->mpcb_wbcnt; 14227c478bd9Sstevel@tonic-gate do { 14237c478bd9Sstevel@tonic-gate i--; 14247c478bd9Sstevel@tonic-gate if ((long)mpcb->mpcb_spbuf[i] != rp->r_sp) 14257c478bd9Sstevel@tonic-gate continue; 14267c478bd9Sstevel@tonic-gate 14277c478bd9Sstevel@tonic-gate atomic_add_64(&fasttrap_getreg_mpcb_cnt, 1); 14287c478bd9Sstevel@tonic-gate return (rwin[i].rw_local[reg - 16]); 14297c478bd9Sstevel@tonic-gate } while (i > 0); 14307c478bd9Sstevel@tonic-gate } 14317c478bd9Sstevel@tonic-gate 14327c478bd9Sstevel@tonic-gate if (fasttrap_fuword32(&fr->fr_local[reg - 16], &v32[1]) != 0) 14337c478bd9Sstevel@tonic-gate goto err; 14347c478bd9Sstevel@tonic-gate 14357c478bd9Sstevel@tonic-gate v32[0] = 0; 14367c478bd9Sstevel@tonic-gate } 14377c478bd9Sstevel@tonic-gate 14387c478bd9Sstevel@tonic-gate atomic_add_64(&fasttrap_getreg_slow_cnt, 1); 14397c478bd9Sstevel@tonic-gate return (value); 14407c478bd9Sstevel@tonic-gate 14417c478bd9Sstevel@tonic-gate err: 14427c478bd9Sstevel@tonic-gate /* 14437c478bd9Sstevel@tonic-gate * If the copy in failed, the process will be in a irrecoverable 14447c478bd9Sstevel@tonic-gate * state, and we have no choice but to kill it. 14457c478bd9Sstevel@tonic-gate */ 14467c478bd9Sstevel@tonic-gate psignal(ttoproc(curthread), SIGILL); 14477c478bd9Sstevel@tonic-gate return (0); 14487c478bd9Sstevel@tonic-gate } 14497c478bd9Sstevel@tonic-gate 14507c478bd9Sstevel@tonic-gate static uint64_t fasttrap_putreg_fast_cnt; 14517c478bd9Sstevel@tonic-gate static uint64_t fasttrap_putreg_mpcb_cnt; 14527c478bd9Sstevel@tonic-gate static uint64_t fasttrap_putreg_slow_cnt; 14537c478bd9Sstevel@tonic-gate 14547c478bd9Sstevel@tonic-gate static void 14557c478bd9Sstevel@tonic-gate fasttrap_putreg(struct regs *rp, uint_t reg, ulong_t value) 14567c478bd9Sstevel@tonic-gate { 14577c478bd9Sstevel@tonic-gate dtrace_icookie_t cookie; 14587c478bd9Sstevel@tonic-gate struct machpcb *mpcb; 14597c478bd9Sstevel@tonic-gate extern void dtrace_putreg_win(uint_t, ulong_t); 14607c478bd9Sstevel@tonic-gate 14617c478bd9Sstevel@tonic-gate if (reg == 0) 14627c478bd9Sstevel@tonic-gate return; 14637c478bd9Sstevel@tonic-gate 14647c478bd9Sstevel@tonic-gate if (reg < 16) { 14657c478bd9Sstevel@tonic-gate (&rp->r_g1)[reg - 1] = value; 14667c478bd9Sstevel@tonic-gate return; 14677c478bd9Sstevel@tonic-gate } 14687c478bd9Sstevel@tonic-gate 14697c478bd9Sstevel@tonic-gate /* 14707c478bd9Sstevel@tonic-gate * If the user process is still using some register windows, we 14717c478bd9Sstevel@tonic-gate * can just place the value in the correct window. 14727c478bd9Sstevel@tonic-gate */ 14737c478bd9Sstevel@tonic-gate cookie = dtrace_interrupt_disable(); 14747c478bd9Sstevel@tonic-gate if (dtrace_getotherwin() > 0) { 14757c478bd9Sstevel@tonic-gate dtrace_putreg_win(reg, value); 14767c478bd9Sstevel@tonic-gate dtrace_interrupt_enable(cookie); 14777c478bd9Sstevel@tonic-gate atomic_add_64(&fasttrap_putreg_fast_cnt, 1); 14787c478bd9Sstevel@tonic-gate return; 14797c478bd9Sstevel@tonic-gate } 14807c478bd9Sstevel@tonic-gate dtrace_interrupt_enable(cookie); 14817c478bd9Sstevel@tonic-gate 14827c478bd9Sstevel@tonic-gate /* 14837c478bd9Sstevel@tonic-gate * First see if there's a copy of the register window in the 14847c478bd9Sstevel@tonic-gate * machpcb structure that we can modify; if there isn't try to 14857c478bd9Sstevel@tonic-gate * copy out the value. If that fails, we try to create a new 14867c478bd9Sstevel@tonic-gate * register window in the machpcb structure. While this isn't 14877c478bd9Sstevel@tonic-gate * _precisely_ the intended use of the machpcb structure, it 14887c478bd9Sstevel@tonic-gate * can't cause any problems since we know at this point in the 14897c478bd9Sstevel@tonic-gate * code that all of the user's data have been flushed out of the 14907c478bd9Sstevel@tonic-gate * register file (since %otherwin is 0). 14917c478bd9Sstevel@tonic-gate */ 14927c478bd9Sstevel@tonic-gate mpcb = (struct machpcb *)((caddr_t)rp - REGOFF); 14937c478bd9Sstevel@tonic-gate 14947c478bd9Sstevel@tonic-gate if (get_udatamodel() == DATAMODEL_NATIVE) { 14957c478bd9Sstevel@tonic-gate struct frame *fr = (struct frame *)(rp->r_sp + STACK_BIAS); 14967c478bd9Sstevel@tonic-gate struct rwindow *rwin = (struct rwindow *)mpcb->mpcb_wbuf; 14977c478bd9Sstevel@tonic-gate 14987c478bd9Sstevel@tonic-gate if (mpcb->mpcb_wbcnt > 0) { 14997c478bd9Sstevel@tonic-gate int i = mpcb->mpcb_wbcnt; 15007c478bd9Sstevel@tonic-gate do { 15017c478bd9Sstevel@tonic-gate i--; 15027c478bd9Sstevel@tonic-gate if ((long)mpcb->mpcb_spbuf[i] != rp->r_sp) 15037c478bd9Sstevel@tonic-gate continue; 15047c478bd9Sstevel@tonic-gate 15057c478bd9Sstevel@tonic-gate rwin[i].rw_local[reg - 16] = value; 15067c478bd9Sstevel@tonic-gate atomic_add_64(&fasttrap_putreg_mpcb_cnt, 1); 15077c478bd9Sstevel@tonic-gate return; 15087c478bd9Sstevel@tonic-gate } while (i > 0); 15097c478bd9Sstevel@tonic-gate } 15107c478bd9Sstevel@tonic-gate 15117c478bd9Sstevel@tonic-gate if (fasttrap_sulword(&fr->fr_local[reg - 16], value) != 0) { 15127c478bd9Sstevel@tonic-gate if (mpcb->mpcb_wbcnt >= MAXWIN || copyin(fr, 15137c478bd9Sstevel@tonic-gate &rwin[mpcb->mpcb_wbcnt], sizeof (*rwin)) != 0) 15147c478bd9Sstevel@tonic-gate goto err; 15157c478bd9Sstevel@tonic-gate 15167c478bd9Sstevel@tonic-gate rwin[mpcb->mpcb_wbcnt].rw_local[reg - 16] = value; 15177c478bd9Sstevel@tonic-gate mpcb->mpcb_spbuf[mpcb->mpcb_wbcnt] = (caddr_t)rp->r_sp; 15187c478bd9Sstevel@tonic-gate mpcb->mpcb_wbcnt++; 15197c478bd9Sstevel@tonic-gate atomic_add_64(&fasttrap_putreg_mpcb_cnt, 1); 15207c478bd9Sstevel@tonic-gate return; 15217c478bd9Sstevel@tonic-gate } 15227c478bd9Sstevel@tonic-gate } else { 152375521904Sraf struct frame32 *fr = 152475521904Sraf (struct frame32 *)(uintptr_t)(caddr32_t)rp->r_sp; 15257c478bd9Sstevel@tonic-gate struct rwindow32 *rwin = (struct rwindow32 *)mpcb->mpcb_wbuf; 15267c478bd9Sstevel@tonic-gate uint32_t v32 = (uint32_t)value; 15277c478bd9Sstevel@tonic-gate 15287c478bd9Sstevel@tonic-gate if (mpcb->mpcb_wbcnt > 0) { 15297c478bd9Sstevel@tonic-gate int i = mpcb->mpcb_wbcnt; 15307c478bd9Sstevel@tonic-gate do { 15317c478bd9Sstevel@tonic-gate i--; 15327c478bd9Sstevel@tonic-gate if ((long)mpcb->mpcb_spbuf[i] != rp->r_sp) 15337c478bd9Sstevel@tonic-gate continue; 15347c478bd9Sstevel@tonic-gate 15357c478bd9Sstevel@tonic-gate rwin[i].rw_local[reg - 16] = v32; 15367c478bd9Sstevel@tonic-gate atomic_add_64(&fasttrap_putreg_mpcb_cnt, 1); 15377c478bd9Sstevel@tonic-gate return; 15387c478bd9Sstevel@tonic-gate } while (i > 0); 15397c478bd9Sstevel@tonic-gate } 15407c478bd9Sstevel@tonic-gate 15417c478bd9Sstevel@tonic-gate if (fasttrap_suword32(&fr->fr_local[reg - 16], v32) != 0) { 15427c478bd9Sstevel@tonic-gate if (mpcb->mpcb_wbcnt >= MAXWIN || copyin(fr, 15437c478bd9Sstevel@tonic-gate &rwin[mpcb->mpcb_wbcnt], sizeof (*rwin)) != 0) 15447c478bd9Sstevel@tonic-gate goto err; 15457c478bd9Sstevel@tonic-gate 15467c478bd9Sstevel@tonic-gate rwin[mpcb->mpcb_wbcnt].rw_local[reg - 16] = v32; 15477c478bd9Sstevel@tonic-gate mpcb->mpcb_spbuf[mpcb->mpcb_wbcnt] = (caddr_t)rp->r_sp; 15487c478bd9Sstevel@tonic-gate mpcb->mpcb_wbcnt++; 15497c478bd9Sstevel@tonic-gate atomic_add_64(&fasttrap_putreg_mpcb_cnt, 1); 15507c478bd9Sstevel@tonic-gate return; 15517c478bd9Sstevel@tonic-gate } 15527c478bd9Sstevel@tonic-gate } 15537c478bd9Sstevel@tonic-gate 15547c478bd9Sstevel@tonic-gate atomic_add_64(&fasttrap_putreg_slow_cnt, 1); 15557c478bd9Sstevel@tonic-gate return; 15567c478bd9Sstevel@tonic-gate 15577c478bd9Sstevel@tonic-gate err: 15587c478bd9Sstevel@tonic-gate /* 15597c478bd9Sstevel@tonic-gate * If we couldn't record this register's value, the process is in an 15607c478bd9Sstevel@tonic-gate * irrecoverable state and we have no choice but to euthanize it. 15617c478bd9Sstevel@tonic-gate */ 15627c478bd9Sstevel@tonic-gate psignal(ttoproc(curthread), SIGILL); 15637c478bd9Sstevel@tonic-gate } 1564