2 * Copyright (c) 2007 Apple Inc. All rights reserved.
7 * The contents of this file are subject to the terms of the
8 * Common Development and Distribution License, Version 1.0 only
9 * (the "License"). You may not use this file except in compliance
12 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
13 * or http://www.opensolaris.org/os/licensing.
14 * See the License for the specific language governing permissions
15 * and limitations under the License.
17 * When distributing Covered Code, include this CDDL HEADER in each
18 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
19 * If applicable, add the following below this CDDL HEADER, with the
20 * fields enclosed by brackets "[]" replaced with your own identifying
21 * information: Portions Copyright [yyyy] [name of copyright owner]
26 * Copyright 2005 Sun Microsystems, Inc. All rights reserved.
27 * Use is subject to license terms.
31 * #pragma ident "@(#)fasttrap_isa.c 1.19 05/09/14 SMI"
36 #define _KERNEL /* Solaris vs. Darwin */
40 #include <sys/fasttrap_isa.h>
41 #include <sys/fasttrap_impl.h>
42 #include <sys/dtrace.h>
43 #include <sys/dtrace_impl.h>
44 #include <kern/task.h>
46 #include <vm/vm_map.h>
47 #include <mach/mach_vm.h>
48 #include <arm/proc_reg.h>
49 #include <arm/caches_internal.h>
51 #include <sys/dtrace_ptss.h>
52 #include <kern/debug.h>
54 #include <pexpert/pexpert.h>
56 extern dtrace_id_t dtrace_probeid_error
;
58 /* Solaris proc_t is the struct. Darwin's proc_t is a pointer to it. */
59 #define proc_t struct proc /* Steer clear of the Darwin typedef for proc_t */
61 extern int dtrace_decode_arm(uint32_t instr
);
62 extern int dtrace_decode_thumb(uint32_t instr
);
65 * Lossless User-Land Tracing on ARM
66 * ---------------------------------
68 * The details here will be fleshed out as more of this is implemented. The
69 * basic design will be the same way as tracing works in x86.
71 * Some ARM specific issues:
73 * We need to patch differently for ARM instructions and Thumb instructions.
74 * When we hit a probe, we check to see if the mode we're currently in is the
75 * same as the mode we're patching for. If not, we remove the tracepoint and
76 * abort. This ARM/Thumb information is pulled in from the arch specific
77 * information in the fasttrap probe.
79 * On ARM, any instruction that uses registers can also use the pc as a
80 * register. This presents problems during emulation because we have copied
81 * the instruction and thus the pc can be different. Currently we've emulated
82 * any instructions that use the pc if they can be used in a return probe.
83 * Eventually we will want to support all instructions that use the pc, but
84 * to do so requires disassembling the instruction and reconstituting it by
85 * substituting a different register.
89 #define THUMB_INSTR(x) (*(uint16_t*) &(x))
91 #define SIGNEXTEND(x,v) ((((int) (x)) << (32-(v))) >> (32-(v)))
92 #define ALIGNADDR(x,v) (((x) >> (v)) << (v))
93 #define GETITSTATE(x) ((((x) >> 8) & 0xFC) | (((x) >> 25) & 0x3))
94 #define ISLASTINIT(x) (((x) & 0xF) == 8)
96 #define SET16(x,w) *((uint16_t*) (x)) = (w)
97 #define SET32(x,w) *((uint32_t*) (x)) = (w)
99 #define IS_ARM_NOP(x) ((x) == 0xE1A00000)
100 /* Marker for is-enabled probes */
101 #define IS_ARM_IS_ENABLED(x) ((x) == 0xE0200000)
103 #define IS_THUMB_NOP(x) ((x) == 0x46C0)
104 /* Marker for is-enabled probes */
105 #define IS_THUMB_IS_ENABLED(x) ((x) == 0x4040)
107 #define ARM_LDM_UF (1 << 23)
108 #define ARM_LDM_PF (1 << 24)
109 #define ARM_LDM_WF (1 << 21)
111 #define ARM_LDR_UF (1 << 23)
112 #define ARM_LDR_BF (1 << 22)
114 extern int dtrace_arm_condition_true(int cond
, int cpsr
);
117 fasttrap_tracepoint_init(proc_t
*p
, fasttrap_tracepoint_t
*tp
,
118 user_addr_t pc
, fasttrap_probe_type_t type
)
124 * Read the instruction at the given address out of the process's
125 * address space. We don't have to worry about a debugger
126 * changing this instruction before we overwrite it with our trap
127 * instruction since P_PR_LOCK is set. Since instructions can span
128 * pages, we potentially read the instruction in two parts. If the
129 * second part fails, we just zero out that part of the instruction.
132 * APPLE NOTE: Of course, we do not have a P_PR_LOCK, so this is racey...
135 if (uread(p
, &instr
, 4, pc
) != 0)
138 /* We want &instr to always point to the saved instruction, so just copy the
139 * whole thing When cast to a pointer to a uint16_t, that will give us a
140 * pointer to the first two bytes, which is the thumb instruction.
142 tp
->ftt_instr
= instr
;
144 if (tp
->ftt_fntype
!= FASTTRAP_FN_DONE_INIT
) {
145 switch(tp
->ftt_fntype
) {
146 case FASTTRAP_FN_UNKNOWN
:
147 /* Can't instrument without any information. We can add some heuristics later if necessary. */
150 case FASTTRAP_FN_USDT
:
151 if (IS_ARM_NOP(instr
) || IS_ARM_IS_ENABLED(instr
)) {
153 } else if (IS_THUMB_NOP(THUMB_INSTR(instr
)) || IS_THUMB_IS_ENABLED(THUMB_INSTR(instr
))) {
156 /* Shouldn't reach here - this means we don't recognize
157 * the instruction at one of the USDT probe locations
161 tp
->ftt_fntype
= FASTTRAP_FN_DONE_INIT
;
164 case FASTTRAP_FN_ARM
:
166 tp
->ftt_fntype
= FASTTRAP_FN_DONE_INIT
;
169 case FASTTRAP_FN_THUMB
:
171 tp
->ftt_fntype
= FASTTRAP_FN_DONE_INIT
;
180 tp
->ftt_type
= dtrace_decode_thumb(instr
);
182 tp
->ftt_type
= dtrace_decode_arm(instr
);
185 if (tp
->ftt_type
== FASTTRAP_T_INV
) {
186 /* This is an instruction we either don't recognize or can't instrument */
187 printf("dtrace: fasttrap: Unrecognized instruction: %08x at %08x\n",
188 (tp
->ftt_thumb
&& dtrace_instr_size(tp
->ftt_instr
,tp
->ftt_thumb
) == 2) ? tp
->ftt_instr1
: instr
, pc
);
196 fasttrap_tracepoint_install(proc_t
*p
, fasttrap_tracepoint_t
*tp
)
198 /* The thumb patch is a 2 byte instruction regardless of the size of the original instruction */
200 int size
= tp
->ftt_thumb
? 2 : 4;
203 *((uint16_t*) &instr
) = FASTTRAP_THUMB_INSTR
;
205 instr
= FASTTRAP_ARM_INSTR
;
208 if (uwrite(p
, &instr
, size
, tp
->ftt_pc
) != 0)
211 tp
->ftt_installed
= 1;
217 fasttrap_tracepoint_remove(proc_t
*p
, fasttrap_tracepoint_t
*tp
)
219 /* The thumb patch is a 2 byte instruction regardless of the size of the original instruction */
221 int size
= tp
->ftt_thumb
? 2 : 4;
224 * Distinguish between read or write failures and a changed
227 if (uread(p
, &instr
, size
, tp
->ftt_pc
) != 0)
230 if (*((uint16_t*) &instr
) != FASTTRAP_THUMB_INSTR
)
233 if (instr
!= FASTTRAP_ARM_INSTR
)
236 if (uwrite(p
, &tp
->ftt_instr
, size
, tp
->ftt_pc
) != 0)
240 tp
->ftt_installed
= 0;
246 fasttrap_return_common(proc_t
*p
, arm_saved_state_t
*regs
, user_addr_t pc
, user_addr_t new_pc
)
248 pid_t pid
= p
->p_pid
;
249 fasttrap_tracepoint_t
*tp
;
250 fasttrap_bucket_t
*bucket
;
255 pid_mtx
= &cpu_core
[CPU
->cpu_id
].cpuc_pid_lock
;
256 lck_mtx_lock(pid_mtx
);
257 bucket
= &fasttrap_tpoints
.fth_table
[FASTTRAP_TPOINTS_INDEX(pid
, pc
)];
259 for (tp
= bucket
->ftb_data
; tp
!= NULL
; tp
= tp
->ftt_next
) {
260 if (pid
== tp
->ftt_pid
&& pc
== tp
->ftt_pc
&&
261 tp
->ftt_proc
->ftpc_acount
!= 0)
266 * Don't sweat it if we can't find the tracepoint again; unlike
267 * when we're in fasttrap_pid_probe(), finding the tracepoint here
268 * is not essential to the correct execution of the process.
271 lck_mtx_unlock(pid_mtx
);
275 for (id
= tp
->ftt_retids
; id
!= NULL
; id
= id
->fti_next
) {
276 fasttrap_probe_t
*probe
= id
->fti_probe
;
278 * If there's a branch that could act as a return site, we
279 * need to trace it, and check here if the program counter is
280 * external to the function.
282 if (tp
->ftt_type
!= FASTTRAP_T_LDM_PC
&&
283 tp
->ftt_type
!= FASTTRAP_T_POP_PC
&&
284 new_pc
- probe
->ftp_faddr
< probe
->ftp_fsize
)
287 if (probe
->ftp_prov
->ftp_provider_type
== DTFTP_PROVIDER_ONESHOT
) {
288 uint8_t already_triggered
= atomic_or_8(&probe
->ftp_triggered
, 1);
289 if (already_triggered
) {
294 * If we have at least one probe associated that
295 * is not a oneshot probe, don't remove the
301 #ifndef CONFIG_EMBEDDED
302 if (ISSET(current_proc()->p_lflag
, P_LNOATTACH
)) {
303 dtrace_probe(dtrace_probeid_error
, 0 /* state */, id
->fti_probe
->ftp_id
,
304 1 /* ndx */, -1 /* offset */, DTRACEFLT_UPRIV
);
309 dtrace_probe(id
->fti_probe
->ftp_id
,
310 pc
- id
->fti_probe
->ftp_faddr
,
311 regs
->r
[0], 0, 0, 0);
315 fasttrap_tracepoint_retire(p
, tp
);
318 lck_mtx_unlock(pid_mtx
);
322 fasttrap_sigsegv(proc_t
*p
, uthread_t t
, user_addr_t addr
, arm_saved_state_t
*regs
)
324 /* TODO: This function isn't implemented yet. In debug mode, panic the system to
325 * find out why we're hitting this point. In other modes, kill the process.
328 #pragma unused(p,t,addr,arm_saved_state)
329 panic("fasttrap: sigsegv not yet implemented");
331 #pragma unused(p,t,addr)
332 /* Kill the process */
339 /* Set fault address and mark signal */
341 t
->uu_siglist
|= sigmask(SIGSEGV
);
344 * XXX These two line may be redundant; if not, then we need
345 * XXX to potentially set the data address in the machine
346 * XXX specific thread state structure to indicate the address.
348 t
->uu_exception
= KERN_INVALID_ADDRESS
; /* SIGSEGV */
349 t
->uu_subcode
= 0; /* XXX pad */
354 signal_setast(t
->uu_context
.vc_thread
);
359 fasttrap_usdt_args(fasttrap_probe_t
*probe
, arm_saved_state_t
*regs
, int argc
,
362 int i
, x
, cap
= MIN(argc
, probe
->ftp_nargs
);
364 for (i
= 0; i
< cap
; i
++) {
365 x
= probe
->ftp_argmap
[i
];
368 argv
[i
] = regs
->r
[x
];
370 fasttrap_fuword32_noerr(regs
->sp
+ (x
- 4) * sizeof(uint32_t), &argv
[i
]);
374 for (; i
< argc
; i
++) {
379 static void set_thumb_flag(arm_saved_state_t
*regs
, user_addr_t pc
)
382 regs
->cpsr
|= PSR_TF
;
384 regs
->cpsr
&= ~PSR_TF
;
389 fasttrap_pid_probe(arm_saved_state_t
*regs
)
391 proc_t
*p
= current_proc();
392 user_addr_t new_pc
= 0;
393 fasttrap_bucket_t
*bucket
;
395 fasttrap_tracepoint_t
*tp
, tp_local
;
397 dtrace_icookie_t cookie
;
398 uint_t is_enabled
= 0;
400 int was_simulated
= 1, retire_tp
= 1;
402 user_addr_t pc
= regs
->pc
;
404 uthread_t uthread
= (uthread_t
) get_bsdthread_info(current_thread());
407 * It's possible that a user (in a veritable orgy of bad planning)
408 * could redirect this thread's flow of control before it reached the
409 * return probe fasttrap. In this case we need to kill the process
410 * since it's in a unrecoverable state.
412 if (uthread
->t_dtrace_step
) {
413 ASSERT(uthread
->t_dtrace_on
);
414 fasttrap_sigtrap(p
, uthread
, pc
);
419 * Clear all user tracing flags.
421 uthread
->t_dtrace_ft
= 0;
422 uthread
->t_dtrace_pc
= 0;
423 uthread
->t_dtrace_npc
= 0;
424 uthread
->t_dtrace_scrpc
= 0;
425 uthread
->t_dtrace_astpc
= 0;
428 * Treat a child created by a call to vfork(2) as if it were its
429 * parent. We know that there's only one thread of control in such a
432 if (p
->p_lflag
& P_LINVFORK
) {
434 while (p
->p_lflag
& P_LINVFORK
)
440 pid_mtx
= &cpu_core
[CPU
->cpu_id
].cpuc_pid_lock
;
441 lck_mtx_lock(pid_mtx
);
442 bucket
= &fasttrap_tpoints
.fth_table
[FASTTRAP_TPOINTS_INDEX(pid
,pc
)];
445 * Lookup the tracepoint that the process just hit.
447 for (tp
= bucket
->ftb_data
; tp
!= NULL
; tp
= tp
->ftt_next
) {
448 if (pid
== tp
->ftt_pid
&& pc
== tp
->ftt_pc
&&
449 tp
->ftt_proc
->ftpc_acount
!= 0)
454 * If we couldn't find a matching tracepoint, either a tracepoint has
455 * been inserted without using the pid<pid> ioctl interface (see
456 * fasttrap_ioctl), or somehow we have mislaid this tracepoint.
459 lck_mtx_unlock(pid_mtx
);
463 /* Default to always execute */
464 int condition_code
= 0xE;
466 uint32_t itstate
= GETITSTATE(regs
->cpsr
);
468 /* In IT block, make sure it's the last statement in the block */
469 if (ISLASTINIT(itstate
)) {
470 condition_code
= itstate
>> 4;
472 printf("dtrace: fasttrap: Tried to trace instruction %08x at %08x but not at end of IT block\n",
473 (tp
->ftt_thumb
&& dtrace_instr_size(tp
->ftt_instr
,tp
->ftt_thumb
) == 2) ? tp
->ftt_instr1
: tp
->ftt_instr
, pc
);
475 fasttrap_tracepoint_remove(p
, tp
);
476 lck_mtx_unlock(pid_mtx
);
481 condition_code
= ARM_CONDCODE(tp
->ftt_instr
);
484 if (!tp
->ftt_thumb
!= !(regs
->cpsr
& PSR_TF
)) {
485 /* The ARM/Thumb mode does not match what we expected for this probe.
486 * Remove this probe and bail.
488 fasttrap_tracepoint_remove(p
, tp
);
489 lck_mtx_unlock(pid_mtx
);
493 if (tp
->ftt_ids
!= NULL
) {
497 uint32_t *stack
= (uint32_t *)regs
->sp
;
499 /* First four parameters are passed in registers */
500 fasttrap_fuword32_noerr((user_addr_t
)(uint32_t)stack
, &s4
);
502 for (id
= tp
->ftt_ids
; id
!= NULL
; id
= id
->fti_next
) {
503 fasttrap_probe_t
*probe
= id
->fti_probe
;
505 #ifndef CONFIG_EMBEDDED
506 if (ISSET(current_proc()->p_lflag
, P_LNOATTACH
)) {
507 dtrace_probe(dtrace_probeid_error
, 0 /* state */, probe
->ftp_id
,
508 1 /* ndx */, -1 /* offset */, DTRACEFLT_UPRIV
);
513 if (probe
->ftp_prov
->ftp_provider_type
== DTFTP_PROVIDER_ONESHOT
) {
514 uint8_t already_triggered
= atomic_or_8(&probe
->ftp_triggered
, 1);
515 if (already_triggered
) {
520 * If we have at least probe associated that
521 * is not a oneshot probe, don't remove the
527 if (id
->fti_ptype
== DTFTP_ENTRY
) {
529 * We note that this was an entry
530 * probe to help ustack() find the
533 cookie
= dtrace_interrupt_disable();
534 DTRACE_CPUFLAG_SET(CPU_DTRACE_ENTRY
);
535 dtrace_probe(probe
->ftp_id
, regs
->r
[0], regs
->r
[1], regs
->r
[2], regs
->r
[3], s4
);
536 DTRACE_CPUFLAG_CLEAR(CPU_DTRACE_ENTRY
);
537 dtrace_interrupt_enable(cookie
);
538 } else if (id
->fti_ptype
== DTFTP_IS_ENABLED
) {
540 * Note that in this case, we don't
541 * call dtrace_probe() since it's only
542 * an artificial probe meant to change
543 * the flow of control so that it
544 * encounters the true probe.
547 } else if (probe
->ftp_argmap
== NULL
) {
548 dtrace_probe(probe
->ftp_id
, regs
->r
[0], regs
->r
[1], regs
->r
[2], regs
->r
[3], s4
);
552 fasttrap_usdt_args(probe
, regs
, 5, t
);
553 dtrace_probe(probe
->ftp_id
, t
[0], t
[1], t
[2], t
[3], t
[4]);
558 fasttrap_tracepoint_retire(p
, tp
);
562 * We're about to do a bunch of work so we cache a local copy of
563 * the tracepoint to emulate the instruction, and then find the
564 * tracepoint again later if we need to light up any return probes.
567 lck_mtx_unlock(pid_mtx
);
571 * If there's an is-enabled probe connected to this tracepoint it
572 * means that there was a 'eor r0,r0,r0'
573 * instruction that was placed there by DTrace when the binary was
574 * linked. As this probe is, in fact, enabled, we need to stuff 1
575 * into R0. Accordingly, we can bypass all the instruction
576 * emulation logic since we know the inevitable result. It's possible
577 * that a user could construct a scenario where the 'is-enabled'
578 * probe was on some other instruction, but that would be a rather
579 * exotic way to shoot oneself in the foot.
584 new_pc
= regs
->pc
+ (tp
->ftt_thumb
? 2 : 4);
588 /* For USDT probes, bypass all the emulation logic for the nop instruction */
589 if ((tp
->ftt_thumb
&& IS_THUMB_NOP(THUMB_INSTR(tp
->ftt_instr
))) ||
590 (!tp
->ftt_thumb
&& IS_ARM_NOP(tp
->ftt_instr
))) {
591 new_pc
= regs
->pc
+ (tp
->ftt_thumb
? 2 : 4);
595 instr_size
= dtrace_instr_size(tp
->ftt_instr
,tp
->ftt_thumb
);
597 switch (tp
->ftt_type
) {
598 case FASTTRAP_T_MOV_PC_REG
:
599 case FASTTRAP_T_CPY_PC
:
601 if (!dtrace_arm_condition_true(condition_code
, regs
->cpsr
)) {
602 new_pc
= pc
+ instr_size
;
608 rm
= THUMB16_HRM(tp
->ftt_instr1
);
610 rm
= tp
->ftt_instr
& 0xF;
612 new_pc
= regs
->r
[rm
];
614 /* This instruction does not change the Thumb state */
619 case FASTTRAP_T_STM_LR
:
620 case FASTTRAP_T_PUSH_LR
:
623 * This is a very common case, so we want to emulate this instruction if
624 * possible. However, on a push, it is possible that we might reach the end
625 * of a page and have to allocate a new page. Most of the time this will not
626 * happen, and we know that the push instruction can store at most 16 words,
627 * so check to see if we are far from the boundary, and if so, emulate. This
628 * can be made more aggressive by checking the actual number of words being
629 * pushed, but we won't do that for now.
631 * Some of the same issues that apply to POP_PC probably apply here also.
638 if (!dtrace_arm_condition_true(condition_code
, regs
->cpsr
)) {
639 new_pc
= pc
+ instr_size
;
643 base
= (uintptr_t*) regs
->sp
;
644 if (((((uintptr_t) base
)-16*4) >> PAGE_SHIFT
) != (((uintptr_t) base
) >> PAGE_SHIFT
)) {
645 /* Crosses the page boundary, go to emulation */
650 if (instr_size
== 4) {
651 /* We know we have to push lr, never push sp or pc */
652 reglist
= tp
->ftt_instr2
& 0x1FFF;
654 reglist
= tp
->ftt_instr1
& 0xFF;
657 /* We know we have to push lr, never push sp or pc */
658 reglist
= tp
->ftt_instr
& 0x1FFF;
661 /* Push the link register */
663 ret
= fasttrap_suword32((uint32_t) base
, regs
->lr
);
665 fasttrap_sigsegv(p
, uthread
, (user_addr_t
) base
, regs
);
670 /* Start pushing from $r12 */
671 int regmask
= 1 << 12;
675 if (reglist
& regmask
) {
677 ret
= fasttrap_suword32((uint32_t) base
, regs
->r
[regnum
]);
679 fasttrap_sigsegv(p
, uthread
, (user_addr_t
) base
, regs
);
688 regs
->sp
= (uintptr_t) base
;
690 new_pc
= pc
+ instr_size
;
696 case FASTTRAP_T_LDM_PC
:
697 case FASTTRAP_T_POP_PC
:
699 /* TODO Two issues that will eventually need to be resolved:
701 * 1. Understand what the hardware does if we have to segfault (data abort) in
702 * the middle of a load multiple. We currently don't have a working segfault
703 * handler anyway, and with no swapfile we should never segfault on this load.
704 * If we do, we'll just kill the process by setting the pc to 0.
706 * 2. The emulation is no longer atomic. We currently only emulate pop for
707 * function epilogues, and so we should never have a race here because one
708 * thread should never be trying to manipulate another thread's stack frames.
709 * That is almost certainly a bug in the program.
711 * This will need to be fixed if we ever:
712 * a. Ship dtrace externally, as this could be a potential attack vector
713 * b. Support instruction level tracing, as we might then pop/ldm non epilogues.
717 /* Assume ldmia! sp/pop ... pc */
719 int regnum
= 0, reglist
;
723 if (!dtrace_arm_condition_true(condition_code
, regs
->cpsr
)) {
724 new_pc
= pc
+ instr_size
;
729 if (instr_size
== 4) {
730 /* We know we have to load the pc, don't do it twice */
731 reglist
= tp
->ftt_instr2
& 0x7FFF;
733 reglist
= tp
->ftt_instr1
& 0xFF;
736 /* We know we have to load the pc, don't do it twice */
737 reglist
= tp
->ftt_instr
& 0x7FFF;
740 base
= (uintptr_t*) regs
->sp
;
743 ret
= fasttrap_fuword32((uint32_t) base
, ®s
->r
[regnum
]);
745 fasttrap_sigsegv(p
, uthread
, (user_addr_t
) base
, regs
);
755 ret
= fasttrap_fuword32((uint32_t) base
, &new_pc
);
757 fasttrap_sigsegv(p
, uthread
, (user_addr_t
) base
, regs
);
763 regs
->sp
= (uintptr_t) base
;
765 set_thumb_flag(regs
, new_pc
);
770 case FASTTRAP_T_CB_N_Z
:
772 /* Thumb mode instruction, and not permitted in IT block, so skip the condition code check */
773 int rn
= tp
->ftt_instr1
& 0x7;
774 int offset
= (((tp
->ftt_instr1
& 0x00F8) >> 2) | ((tp
->ftt_instr1
& 0x0200) >> 3)) + 4;
775 int nonzero
= tp
->ftt_instr1
& 0x0800;
776 if (!nonzero
!= !(regs
->r
[rn
] == 0)) {
777 new_pc
= pc
+ offset
;
779 new_pc
= pc
+ instr_size
;
784 case FASTTRAP_T_B_COND
:
786 /* Use the condition code in the instruction and ignore the ITSTATE */
790 if (instr_size
== 4) {
791 code
= (tp
->ftt_instr1
>> 6) & 0xF;
792 if (code
== 14 || code
== 15) {
793 panic("fasttrap: Emulation of invalid branch");
795 int S
= (tp
->ftt_instr1
>> 10) & 1,
796 J1
= (tp
->ftt_instr2
>> 13) & 1,
797 J2
= (tp
->ftt_instr2
>> 11) & 1;
798 offset
= 4 + SIGNEXTEND(
799 (S
<< 20) | (J2
<< 19) | (J1
<< 18) |
800 ((tp
->ftt_instr1
& 0x003F) << 12) |
801 ((tp
->ftt_instr2
& 0x07FF) << 1),
804 code
= (tp
->ftt_instr1
>> 8) & 0xF;
805 if (code
== 14 || code
== 15) {
806 panic("fasttrap: Emulation of invalid branch");
808 offset
= 4 + (SIGNEXTEND(tp
->ftt_instr1
& 0xFF, 8) << 1);
811 code
= ARM_CONDCODE(tp
->ftt_instr
);
813 panic("fasttrap: Emulation of invalid branch");
815 offset
= 8 + (SIGNEXTEND(tp
->ftt_instr
& 0x00FFFFFF, 24) << 2);
818 if (dtrace_arm_condition_true(code
, regs
->cpsr
)) {
819 new_pc
= pc
+ offset
;
821 new_pc
= pc
+ instr_size
;
827 case FASTTRAP_T_B_UNCOND
:
831 /* Unconditional branches can only be taken from Thumb mode */
832 /* (This is different from an ARM branch with condition code "always") */
833 ASSERT(tp
->ftt_thumb
== 1);
835 if (!dtrace_arm_condition_true(condition_code
, regs
->cpsr
)) {
836 new_pc
= pc
+ instr_size
;
840 if (instr_size
== 4) {
841 int S
= (tp
->ftt_instr1
>> 10) & 1,
842 J1
= (tp
->ftt_instr2
>> 13) & 1,
843 J2
= (tp
->ftt_instr2
>> 11) & 1;
844 int I1
= (J1
!= S
) ? 0 : 1, I2
= (J2
!= S
) ? 0 : 1;
845 offset
= 4 + SIGNEXTEND(
846 (S
<< 24) | (I1
<< 23) | (I2
<< 22) |
847 ((tp
->ftt_instr1
& 0x03FF) << 12) |
848 ((tp
->ftt_instr2
& 0x07FF) << 1),
851 uint32_t instr1
= tp
->ftt_instr1
;
852 offset
= 4 + (SIGNEXTEND(instr1
& 0x7FF, 11) << 1);
855 new_pc
= pc
+ offset
;
860 case FASTTRAP_T_BX_REG
:
864 if (!dtrace_arm_condition_true(condition_code
, regs
->cpsr
)) {
865 new_pc
= pc
+ instr_size
;
870 reg
= THUMB16_HRM(tp
->ftt_instr1
);
872 reg
= ARM_RM(tp
->ftt_instr
);
874 new_pc
= regs
->r
[reg
];
875 set_thumb_flag(regs
, new_pc
);
880 case FASTTRAP_T_LDR_PC_IMMED
:
881 case FASTTRAP_T_VLDR_PC_IMMED
:
882 /* Handle these instructions by replacing the PC in the instruction with another
883 * register. They are common, so we'd like to support them, and this way we do so
884 * without any risk of having to simulate a segfault.
890 case FASTTRAP_T_COMMON
:
895 fasttrap_instr_t emul_instr
;
896 emul_instr
.instr32
= tp
->ftt_instr
;
900 * Unfortunately sometimes when we emulate the instruction and have to replace the
901 * PC, there is no longer a thumb mode equivalent. We end up having to run the
902 * modified instruction in ARM mode. We use this variable to keep track of which
903 * mode we should emulate in. We still use the original variable to determine
904 * what mode to return to.
906 uint8_t emul_thumb
= tp
->ftt_thumb
;
908 uint32_t save_val
= 0;
911 * Dealing with condition codes and emulation:
912 * We can't just uniformly do a condition code check here because not all instructions
913 * have condition codes. We currently do not support an instruction by instruction trace,
914 * so we can assume that either: 1. We are executing a Thumb instruction, in which case
915 * we either are not in an IT block and should execute always, or we are last in an IT
916 * block. Either way, the traced instruction will run correctly, and we won't have any
917 * problems when we return to the original code, because we will no longer be in the IT
918 * block. 2. We are executing an ARM instruction, in which case we are ok as long as
919 * we don't attempt to change the condition code.
921 if (tp
->ftt_type
== FASTTRAP_T_LDR_PC_IMMED
) {
922 /* We know we always have a free register (the one we plan to write the
923 * result value to!). So we'll replace the pc with that one.
927 /* Check to see if thumb or thumb2 */
928 if (instr_size
== 2) {
930 * Sadness. We need to emulate this instruction in ARM mode
931 * because it has an 8 bit immediate offset. Instead of having
932 * to deal with condition codes in the ARM instruction, we'll
933 * just check the condition and abort if the condition is false.
935 if (!dtrace_arm_condition_true(condition_code
, regs
->cpsr
)) {
936 new_pc
= pc
+ instr_size
;
940 new_reg
= (tp
->ftt_instr1
>> 8) & 0x7;
941 regs
->r
[new_reg
] = ALIGNADDR(regs
->pc
+ 4, 2);
943 emul_instr
.instr32
= 0xE5900000 | (new_reg
<< 16) | (new_reg
<< 12) | ((tp
->ftt_instr1
& 0xFF) << 2);
945 /* Thumb2. Just replace the register. */
946 new_reg
= (tp
->ftt_instr2
>> 12) & 0xF;
947 regs
->r
[new_reg
] = ALIGNADDR(regs
->pc
+ 4, 2);
948 emul_instr
.instr16
.instr1
&= ~0x000F;
949 emul_instr
.instr16
.instr1
|= new_reg
;
952 /* ARM. Just replace the register. */
953 new_reg
= (tp
->ftt_instr
>> 12) & 0xF;
954 regs
->r
[new_reg
] = ALIGNADDR(regs
->pc
+ 8,2);
955 emul_instr
.instr32
&= ~0x000F0000;
956 emul_instr
.instr32
|= new_reg
<< 16;
958 } else if (tp
->ftt_type
== FASTTRAP_T_VLDR_PC_IMMED
) {
959 /* This instruction only uses one register, and if we're here, we know
960 * it must be the pc. So we'll just replace it with R0.
963 save_val
= regs
->r
[0];
964 regs
->r
[save_reg
] = ALIGNADDR(regs
->pc
+ (tp
->ftt_thumb
? 4 : 8), 2);
966 emul_instr
.instr16
.instr1
&= ~0x000F;
968 emul_instr
.instr32
&= ~0x000F0000;
972 emul_instr_size
= dtrace_instr_size(emul_instr
.instr32
, emul_thumb
);
976 * tp->ftt_thumb = thumb mode of original instruction
977 * emul_thumb = thumb mode for emulation
978 * emul_instr = instruction we are using to emulate original instruction
979 * emul_instr_size = size of emulating instruction
982 addr
= uthread
->t_dtrace_scratch
->addr
;
985 fasttrap_sigtrap(p
, uthread
, pc
); // Should be killing target proc
990 uthread
->t_dtrace_scrpc
= addr
;
993 * No way to do an unconditional branch in Thumb mode, shove the address
994 * onto the user stack and go to the next location with a pop. This can
995 * segfault if this push happens to cross a stack page, but that's ok, since
996 * we are running in userland, and the kernel knows how to handle userland
997 * stack expansions correctly.
999 * Layout of scratch space for Thumb mode:
1000 * Emulated instruction
1001 * ldr save_reg, [pc, #16] (if necessary, restore any register we clobbered)
1006 * Location we should return to in original program
1007 * Saved value of clobbered register (if necessary)
1010 bcopy(&emul_instr
, &scratch
[i
], emul_instr_size
); i
+= emul_instr_size
;
1012 if (save_reg
!= -1) {
1013 uint16_t restore_inst
= 0x4803;
1014 restore_inst
|= (save_reg
& 0x7) << 8;
1015 SET16(scratch
+i
, restore_inst
); i
+= 2; // ldr reg, [pc , #16]
1018 SET16(scratch
+i
, 0xB403); i
+= 2; // push { r0, r1 }
1019 SET16(scratch
+i
, 0x4801); i
+= 2; // ldr r0, [pc, #4]
1020 SET16(scratch
+i
, 0x9001); i
+= 2; // str r0, [sp, #4]
1021 SET16(scratch
+i
, 0xBD01); i
+= 2; // pop { r0, pc }
1024 SET16(scratch
+i
, 0); i
+= 2; // padding - saved 32 bit words must be aligned
1026 SET32(scratch
+i
, pc
+ instr_size
+ (tp
->ftt_thumb
? 1 : 0)); i
+= 4; // Return address
1027 if (save_reg
!= -1) {
1028 SET32(scratch
+i
, save_val
); i
+= 4; // saved value of clobbered register
1031 uthread
->t_dtrace_astpc
= addr
+ i
;
1032 bcopy(&emul_instr
, &scratch
[i
], emul_instr_size
); i
+= emul_instr_size
;
1033 SET16(scratch
+i
, FASTTRAP_THUMB_RET_INSTR
); i
+= 2;
1036 * Layout of scratch space for ARM mode:
1037 * Emulated instruction
1038 * ldr save_reg, [pc, #12] (if necessary, restore any register we clobbered)
1040 * Location we should return to in original program
1041 * Saved value of clobbered register (if necessary)
1044 bcopy(&emul_instr
, &scratch
[i
], emul_instr_size
); i
+= emul_instr_size
;
1046 if (save_reg
!= -1) {
1047 uint32_t restore_inst
= 0xE59F0004;
1048 restore_inst
|= save_reg
<< 12;
1049 SET32(scratch
+i
, restore_inst
); i
+= 4; // ldr reg, [pc, #12]
1051 SET32(scratch
+i
, 0xE51FF004); i
+= 4; // ldr pc, [pc, #4]
1053 SET32(scratch
+i
, pc
+ instr_size
+ (tp
->ftt_thumb
? 1 : 0)); i
+= 4; // Return address
1054 if (save_reg
!= -1) {
1055 SET32(scratch
+i
, save_val
); i
+= 4; // Saved value of clobbered register
1058 uthread
->t_dtrace_astpc
= addr
+ i
;
1059 bcopy(&emul_instr
, &scratch
[i
], emul_instr_size
); i
+= emul_instr_size
;
1060 SET32(scratch
+i
, FASTTRAP_ARM_RET_INSTR
); i
+= 4;
1063 if (uwrite(p
, scratch
, i
, uthread
->t_dtrace_scratch
->write_addr
) != KERN_SUCCESS
) {
1064 fasttrap_sigtrap(p
, uthread
, pc
);
1069 if (tp
->ftt_retids
!= NULL
) {
1070 uthread
->t_dtrace_step
= 1;
1071 uthread
->t_dtrace_ret
= 1;
1072 new_pc
= uthread
->t_dtrace_astpc
+ (emul_thumb
? 1 : 0);
1074 new_pc
= uthread
->t_dtrace_scrpc
+ (emul_thumb
? 1 : 0);
1077 uthread
->t_dtrace_pc
= pc
;
1078 uthread
->t_dtrace_npc
= pc
+ instr_size
;
1079 uthread
->t_dtrace_on
= 1;
1081 set_thumb_flag(regs
, new_pc
);
1086 panic("fasttrap: mishandled an instruction");
1093 * We're setting this earlier than Solaris does, to get a "correct"
1094 * ustack() output. In the Sun code, a() -> b() -> c() -> d() is
1095 * reported at: d, b, a. The new way gives c, b, a, which is closer
1096 * to correct, as the return instruction has already exectued.
1101 * If there were no return probes when we first found the tracepoint,
1102 * we should feel no obligation to honor any return probes that were
1103 * subsequently enabled -- they'll just have to wait until the next
1106 if (tp
->ftt_retids
!= NULL
) {
1108 * We need to wait until the results of the instruction are
1109 * apparent before invoking any return probes. If this
1110 * instruction was emulated we can just call
1111 * fasttrap_return_common(); if it needs to be executed, we
1112 * need to wait until the user thread returns to the kernel.
1115 * It used to be that only common instructions were simulated.
1116 * For performance reasons, we now simulate some instructions
1117 * when safe and go back to userland otherwise. The was_simulated
1118 * flag means we don't need to go back to userland.
1120 if (was_simulated
) {
1121 fasttrap_return_common(p
, regs
, pc
, new_pc
);
1123 ASSERT(uthread
->t_dtrace_ret
!= 0);
1124 ASSERT(uthread
->t_dtrace_pc
== pc
);
1125 ASSERT(uthread
->t_dtrace_scrpc
!= 0);
1126 ASSERT(new_pc
== uthread
->t_dtrace_astpc
);
1134 fasttrap_return_probe(arm_saved_state_t
*regs
)
1136 proc_t
*p
= current_proc();
1137 uthread_t uthread
= (uthread_t
)get_bsdthread_info(current_thread());
1138 user_addr_t pc
= uthread
->t_dtrace_pc
;
1139 user_addr_t npc
= uthread
->t_dtrace_npc
;
1141 uthread
->t_dtrace_pc
= 0;
1142 uthread
->t_dtrace_npc
= 0;
1143 uthread
->t_dtrace_scrpc
= 0;
1144 uthread
->t_dtrace_astpc
= 0;
1147 * Treat a child created by a call to vfork(2) as if it were its
1148 * parent. We know that there's only one thread of control in such a
1149 * process: this one.
1151 if (p
->p_lflag
& P_LINVFORK
) {
1153 while (p
->p_lflag
& P_LINVFORK
)
1159 * We set rp->r_pc to the address of the traced instruction so
1160 * that it appears to dtrace_probe() that we're on the original
1161 * instruction, and so that the user can't easily detect our
1162 * complex web of lies. dtrace_return_probe() (our caller)
1163 * will correctly set %pc after we return.
1167 fasttrap_return_common(p
, regs
, pc
, npc
);
1173 fasttrap_pid_getarg(void *arg
, dtrace_id_t id
, void *parg
, int argno
,
1176 #pragma unused(arg, id, parg, aframes)
1177 arm_saved_state_t
* regs
= find_user_regs(current_thread());
1179 /* First four arguments are in registers */
1181 return regs
->r
[argno
];
1183 /* Look on the stack for the rest */
1185 uint32_t* sp
= (uint32_t*) regs
->sp
;
1186 DTRACE_CPUFLAG_SET(CPU_DTRACE_NOFAULT
);
1187 value
= dtrace_fuword32((user_addr_t
) (sp
+argno
-4));
1188 DTRACE_CPUFLAG_CLEAR(CPU_DTRACE_NOFAULT
| CPU_DTRACE_BADADDR
);
1194 fasttrap_usdt_getarg(void *arg
, dtrace_id_t id
, void *parg
, int argno
, int aframes
)
1196 #pragma unused(arg, id, parg, argno, aframes)
1198 return (fasttrap_anarg(ttolwp(curthread
)->lwp_regs
, 0, argno
));