Home | History | Annotate | Line # | Download | only in arm32
fault.c revision 1.35
      1  1.35  thorpej /*	$NetBSD: fault.c,v 1.35 2003/10/08 00:28:41 thorpej Exp $	*/
      2   1.1    chris 
      3   1.1    chris /*
      4  1.27      scw  * Copyright 2003 Wasabi Systems, Inc.
      5  1.27      scw  * All rights reserved.
      6  1.27      scw  *
      7  1.27      scw  * Written by Steve C. Woodford for Wasabi Systems, Inc.
      8  1.27      scw  *
      9  1.27      scw  * Redistribution and use in source and binary forms, with or without
     10  1.27      scw  * modification, are permitted provided that the following conditions
     11  1.27      scw  * are met:
     12  1.27      scw  * 1. Redistributions of source code must retain the above copyright
     13  1.27      scw  *    notice, this list of conditions and the following disclaimer.
     14  1.27      scw  * 2. Redistributions in binary form must reproduce the above copyright
     15  1.27      scw  *    notice, this list of conditions and the following disclaimer in the
     16  1.27      scw  *    documentation and/or other materials provided with the distribution.
     17  1.27      scw  * 3. All advertising materials mentioning features or use of this software
     18  1.27      scw  *    must display the following acknowledgement:
     19  1.27      scw  *      This product includes software developed for the NetBSD Project by
     20  1.27      scw  *      Wasabi Systems, Inc.
     21  1.27      scw  * 4. The name of Wasabi Systems, Inc. may not be used to endorse
     22  1.27      scw  *    or promote products derived from this software without specific prior
     23  1.27      scw  *    written permission.
     24  1.27      scw  *
     25  1.27      scw  * THIS SOFTWARE IS PROVIDED BY WASABI SYSTEMS, INC. ``AS IS'' AND
     26  1.27      scw  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
     27  1.27      scw  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
     28  1.27      scw  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL WASABI SYSTEMS, INC
     29  1.27      scw  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
     30  1.27      scw  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
     31  1.27      scw  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
     32  1.27      scw  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
     33  1.27      scw  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
     34  1.27      scw  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
     35  1.27      scw  * POSSIBILITY OF SUCH DAMAGE.
     36  1.27      scw  */
     37  1.27      scw /*
     38   1.1    chris  * Copyright (c) 1994-1997 Mark Brinicombe.
     39   1.1    chris  * Copyright (c) 1994 Brini.
     40   1.1    chris  * All rights reserved.
     41   1.1    chris  *
     42   1.1    chris  * This code is derived from software written for Brini by Mark Brinicombe
     43   1.1    chris  *
     44   1.1    chris  * Redistribution and use in source and binary forms, with or without
     45   1.1    chris  * modification, are permitted provided that the following conditions
     46   1.1    chris  * are met:
     47   1.1    chris  * 1. Redistributions of source code must retain the above copyright
     48   1.1    chris  *    notice, this list of conditions and the following disclaimer.
     49   1.1    chris  * 2. Redistributions in binary form must reproduce the above copyright
     50   1.1    chris  *    notice, this list of conditions and the following disclaimer in the
     51   1.1    chris  *    documentation and/or other materials provided with the distribution.
     52   1.1    chris  * 3. All advertising materials mentioning features or use of this software
     53   1.1    chris  *    must display the following acknowledgement:
     54   1.1    chris  *	This product includes software developed by Brini.
     55   1.1    chris  * 4. The name of the company nor the name of the author may be used to
     56   1.1    chris  *    endorse or promote products derived from this software without specific
     57   1.1    chris  *    prior written permission.
     58   1.1    chris  *
     59   1.1    chris  * THIS SOFTWARE IS PROVIDED BY BRINI ``AS IS'' AND ANY EXPRESS OR IMPLIED
     60   1.1    chris  * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
     61   1.1    chris  * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
     62   1.1    chris  * IN NO EVENT SHALL BRINI OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT,
     63   1.1    chris  * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
     64   1.1    chris  * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
     65   1.1    chris  * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
     66   1.1    chris  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
     67   1.1    chris  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
     68   1.1    chris  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
     69   1.1    chris  * SUCH DAMAGE.
     70   1.1    chris  *
     71   1.1    chris  * RiscBSD kernel project
     72   1.1    chris  *
     73   1.1    chris  * fault.c
     74   1.1    chris  *
     75   1.1    chris  * Fault handlers
     76   1.1    chris  *
     77   1.1    chris  * Created      : 28/11/94
     78   1.1    chris  */
     79   1.1    chris 
     80   1.1    chris #include "opt_ddb.h"
     81  1.28   briggs #include "opt_kgdb.h"
     82   1.1    chris #include "opt_pmap_debug.h"
     83   1.1    chris 
     84   1.1    chris #include <sys/types.h>
     85  1.35  thorpej __KERNEL_RCSID(0, "$NetBSD: fault.c,v 1.35 2003/10/08 00:28:41 thorpej Exp $");
     86  1.21    bjh21 
     87   1.1    chris #include <sys/param.h>
     88   1.1    chris #include <sys/systm.h>
     89   1.1    chris #include <sys/proc.h>
     90  1.33      agc #include <sys/savar.h>
     91   1.1    chris #include <sys/user.h>
     92   1.1    chris #include <sys/kernel.h>
     93   1.1    chris 
     94   1.1    chris #include <uvm/uvm_extern.h>
     95  1.18  thorpej 
     96  1.18  thorpej #include <arm/cpuconf.h>
     97   1.1    chris 
     98   1.1    chris #include <machine/frame.h>
     99   1.5  thorpej #include <arm/arm32/katelib.h>
    100   1.1    chris #include <machine/cpu.h>
    101   1.2     matt #include <machine/intr.h>
    102  1.28   briggs #if defined(DDB) || defined(KGDB)
    103   1.1    chris #include <machine/db_machdep.h>
    104  1.28   briggs #ifdef KGDB
    105  1.28   briggs #include <sys/kgdb.h>
    106  1.28   briggs #endif
    107  1.28   briggs #if !defined(DDB)
    108  1.28   briggs #define kdb_trap	kgdb_trap
    109  1.28   briggs #endif
    110   1.1    chris #endif
    111   1.1    chris 
    112   1.1    chris #include <arch/arm/arm/disassem.h>
    113   1.7    chris #include <arm/arm32/machdep.h>
    114   1.7    chris 
    115   1.1    chris extern char fusubailout[];
    116   1.1    chris 
    117  1.27      scw #ifdef DEBUG
    118  1.27      scw int last_fault_code;	/* For the benefit of pmap_fault_fixup() */
    119  1.27      scw #endif
    120  1.27      scw 
    121   1.7    chris static void report_abort __P((const char *, u_int, u_int, u_int));
    122   1.7    chris 
    123   1.1    chris /* Abort code */
    124   1.1    chris 
    125   1.1    chris /* Define text descriptions of the different aborts */
    126   1.1    chris 
    127   1.1    chris static const char *aborts[16] = {
    128   1.1    chris 	"Write buffer fault",
    129   1.1    chris 	"Alignment fault",
    130   1.1    chris 	"Write buffer fault",
    131   1.1    chris 	"Alignment fault",
    132   1.1    chris 	"Bus error (LF section)",
    133   1.1    chris 	"Translation fault (section)",
    134   1.1    chris 	"Bus error (page)",
    135   1.1    chris 	"Translation fault (page)",
    136   1.1    chris 	"Bus error (section)",
    137   1.1    chris 	"Domain error (section)",
    138   1.1    chris 	"Bus error (page)",
    139   1.1    chris 	"Domain error (page)",
    140   1.1    chris 	"Bus error trans (L1)",
    141   1.1    chris 	"Permission error (section)",
    142   1.1    chris 	"Bus error trans (L2)",
    143   1.1    chris 	"Permission error (page)"
    144   1.1    chris };
    145   1.1    chris 
    146   1.7    chris static void
    147   1.1    chris report_abort(prefix, fault_status, fault_address, fault_pc)
    148   1.1    chris 	const char *prefix;
    149   1.1    chris 	u_int fault_status;
    150   1.1    chris 	u_int fault_address;
    151   1.1    chris 	u_int fault_pc;
    152   1.1    chris {
    153   1.1    chris #ifndef DEBUG
    154   1.1    chris 	if (prefix == NULL) {
    155   1.1    chris #endif
    156   1.1    chris 		if (prefix)
    157   1.1    chris 			printf("%s ", prefix);
    158   1.1    chris 		printf("Data abort: '%s' status=%03x address=%08x PC=%08x\n",
    159   1.1    chris 		    aborts[fault_status & FAULT_TYPE_MASK],
    160   1.1    chris 		    fault_status & 0xfff, fault_address, fault_pc);
    161   1.1    chris #ifndef DEBUG
    162   1.1    chris 	}
    163   1.1    chris #endif
    164   1.1    chris }
    165   1.1    chris 
    166   1.3  thorpej static __volatile int data_abort_expected;
    167   1.3  thorpej static __volatile int data_abort_received;
    168   1.3  thorpej 
    169   1.3  thorpej int
    170   1.3  thorpej badaddr_read(void *addr, size_t size, void *rptr)
    171   1.3  thorpej {
    172   1.3  thorpej 	u_long rcpt;
    173   1.3  thorpej 	int rv;
    174   1.3  thorpej 
    175   1.3  thorpej 	/* Tell the Data Abort handler that we're expecting one. */
    176   1.3  thorpej 	data_abort_received = 0;
    177   1.3  thorpej 	data_abort_expected = 1;
    178   1.3  thorpej 
    179   1.3  thorpej 	cpu_drain_writebuf();
    180   1.3  thorpej 
    181   1.3  thorpej 	/* Read from the test address. */
    182   1.3  thorpej 	switch (size) {
    183   1.3  thorpej 	case sizeof(uint8_t):
    184   1.3  thorpej 		__asm __volatile("ldrb %0, [%1]"
    185   1.3  thorpej 			: "=r" (rcpt)
    186   1.3  thorpej 			: "r" (addr));
    187   1.3  thorpej 		break;
    188   1.3  thorpej 
    189   1.3  thorpej 	case sizeof(uint16_t):
    190   1.3  thorpej 		__asm __volatile("ldrh %0, [%1]"
    191   1.3  thorpej 			: "=r" (rcpt)
    192   1.3  thorpej 			: "r" (addr));
    193   1.3  thorpej 		break;
    194   1.3  thorpej 
    195   1.3  thorpej 	case sizeof(uint32_t):
    196   1.3  thorpej 		__asm __volatile("ldr %0, [%1]"
    197   1.3  thorpej 			: "=r" (rcpt)
    198   1.3  thorpej 			: "r" (addr));
    199   1.3  thorpej 		break;
    200   1.3  thorpej 
    201   1.3  thorpej 	default:
    202   1.3  thorpej 		data_abort_expected = 0;
    203  1.24   provos 		panic("badaddr: invalid size (%lu)", (u_long) size);
    204   1.3  thorpej 	}
    205   1.3  thorpej 
    206   1.3  thorpej 	/* Disallow further Data Aborts. */
    207   1.3  thorpej 	data_abort_expected = 0;
    208   1.3  thorpej 
    209   1.3  thorpej 	rv = data_abort_received;
    210   1.3  thorpej 	data_abort_received = 0;
    211   1.3  thorpej 
    212   1.3  thorpej 	/* Copy the data back if no fault occurred. */
    213   1.3  thorpej 	if (rptr != NULL && rv == 0) {
    214   1.3  thorpej 		switch (size) {
    215   1.3  thorpej 		case sizeof(uint8_t):
    216   1.3  thorpej 			*(uint8_t *) rptr = rcpt;
    217   1.3  thorpej 			break;
    218   1.3  thorpej 
    219   1.3  thorpej 		case sizeof(uint16_t):
    220   1.3  thorpej 			*(uint16_t *) rptr = rcpt;
    221   1.3  thorpej 			break;
    222   1.3  thorpej 
    223   1.3  thorpej 		case sizeof(uint32_t):
    224   1.3  thorpej 			*(uint32_t *) rptr = rcpt;
    225   1.3  thorpej 			break;
    226   1.3  thorpej 		}
    227   1.3  thorpej 	}
    228   1.3  thorpej 
    229   1.3  thorpej 	/* Return true if the address was invalid. */
    230   1.3  thorpej 	return (rv);
    231   1.3  thorpej }
    232   1.3  thorpej 
    233   1.1    chris /*
    234   1.1    chris  * void data_abort_handler(trapframe_t *frame)
    235   1.1    chris  *
    236   1.1    chris  * Abort handler called when read/write occurs at an address of
    237   1.1    chris  * a non existent or restricted (access permissions) memory page.
    238   1.1    chris  * We first need to identify the type of page fault.
    239   1.1    chris  */
    240   1.1    chris 
    241   1.1    chris #define TRAP_CODE ((fault_status & 0x0f) | (fault_address & 0xfffffff0))
    242   1.1    chris 
    243  1.27      scw /* Determine if we can recover from a fault */
    244  1.27      scw #define	IS_FATAL_FAULT(x)					\
    245  1.27      scw 	(((1 << (x)) &						\
    246  1.27      scw 	  ((1 << FAULT_WRTBUF_0) | (1 << FAULT_WRTBUF_1) |	\
    247  1.27      scw 	   (1 << FAULT_BUSERR_0) | (1 << FAULT_BUSERR_1) |	\
    248  1.27      scw 	   (1 << FAULT_BUSERR_2) | (1 << FAULT_BUSERR_3) |	\
    249  1.27      scw 	   (1 << FAULT_BUSTRNL1) | (1 << FAULT_BUSTRNL2) |	\
    250  1.27      scw 	   (1 << FAULT_ALIGN_0)  | (1 << FAULT_ALIGN_1))) != 0)
    251  1.27      scw 
    252   1.1    chris void
    253   1.1    chris data_abort_handler(frame)
    254   1.1    chris 	trapframe_t *frame;
    255   1.1    chris {
    256  1.26  thorpej 	struct lwp *l;
    257   1.1    chris 	struct proc *p;
    258   1.1    chris 	struct pcb *pcb;
    259   1.1    chris 	u_int fault_address;
    260   1.1    chris 	u_int fault_status;
    261   1.1    chris 	u_int fault_pc;
    262   1.1    chris 	u_int fault_instruction;
    263  1.27      scw 	int fault_code, fatal_fault;
    264   1.1    chris 	int user;
    265   1.1    chris 	int error;
    266  1.27      scw 	int rv;
    267   1.1    chris 	void *onfault;
    268  1.27      scw 	vaddr_t va;
    269  1.27      scw 	struct vmspace *vm;
    270  1.27      scw 	struct vm_map *map;
    271  1.27      scw 	vm_prot_t ftype;
    272  1.27      scw 	extern struct vm_map *kernel_map;
    273  1.34     matt 	ksiginfo_t ksi;
    274   1.3  thorpej 
    275   1.3  thorpej 	/*
    276   1.3  thorpej 	 * If we were expecting a Data Abort, signal that we got
    277   1.3  thorpej 	 * one, adjust the PC to skip the faulting insn, and
    278   1.3  thorpej 	 * return.
    279   1.3  thorpej 	 */
    280   1.3  thorpej 	if (data_abort_expected) {
    281   1.3  thorpej 		data_abort_received = 1;
    282   1.3  thorpej 		frame->tf_pc += INSN_SIZE;
    283   1.3  thorpej 		return;
    284   1.3  thorpej 	}
    285   1.1    chris 
    286   1.1    chris 	/*
    287   1.1    chris 	 * Must get fault address and status from the CPU before
    288   1.1    chris 	 * re-enabling interrupts.  (Interrupt handlers may take
    289   1.1    chris 	 * R/M emulation faults.)
    290   1.1    chris 	 */
    291   1.1    chris 	fault_address = cpu_faultaddress();
    292   1.1    chris 	fault_status = cpu_faultstatus();
    293   1.1    chris 	fault_pc = frame->tf_pc;
    294   1.1    chris 
    295   1.1    chris 	/*
    296   1.1    chris 	 * Enable IRQ's (disabled by CPU on abort) if trapframe
    297   1.1    chris 	 * shows they were enabled.
    298   1.1    chris 	 */
    299   1.1    chris 	if (!(frame->tf_spsr & I32_bit))
    300   1.1    chris 		enable_interrupts(I32_bit);
    301   1.1    chris 
    302   1.1    chris #ifdef DEBUG
    303   1.1    chris 	if ((GetCPSR() & PSR_MODE) != PSR_SVC32_MODE)
    304   1.1    chris 		panic("data_abort_handler: not in SVC32 mode");
    305   1.1    chris #endif
    306   1.1    chris 
    307   1.1    chris 	/* Update vmmeter statistics */
    308   1.1    chris 	uvmexp.traps++;
    309   1.1    chris 
    310   1.1    chris 	/* Extract the fault code from the fault status */
    311   1.1    chris 	fault_code = fault_status & FAULT_TYPE_MASK;
    312  1.27      scw 	fatal_fault = IS_FATAL_FAULT(fault_code);
    313   1.1    chris 
    314  1.26  thorpej 	/* Get the current lwp structure or lwp0 if there is none */
    315  1.26  thorpej 	l = curlwp == NULL ? &lwp0 : curlwp;
    316  1.26  thorpej 	p = l->l_proc;
    317   1.1    chris 
    318   1.1    chris 	/*
    319   1.1    chris 	 * can't use curpcb, as it might be NULL; and we have p in
    320   1.1    chris 	 * a register anyway
    321   1.1    chris 	 */
    322  1.26  thorpej 	pcb = &l->l_addr->u_pcb;
    323   1.1    chris 
    324   1.1    chris 	/* fusubailout is used by [fs]uswintr to avoid page faulting */
    325  1.27      scw 	if (pcb->pcb_onfault &&
    326  1.27      scw 	    (fatal_fault || pcb->pcb_onfault == fusubailout)) {
    327   1.1    chris 
    328  1.20    bjh21 		frame->tf_r0 = EFAULT;
    329   1.1    chris copyfault:
    330   1.1    chris #ifdef DEBUG
    331  1.26  thorpej 		printf("Using pcb_onfault=%p addr=%08x st=%08x l=%p\n",
    332  1.26  thorpej 		    pcb->pcb_onfault, fault_address, fault_status, l);
    333   1.1    chris #endif
    334   1.1    chris 		frame->tf_pc = (u_int)pcb->pcb_onfault;
    335   1.1    chris 		if ((frame->tf_spsr & PSR_MODE) == PSR_USR32_MODE)
    336  1.24   provos 			panic("Yikes pcb_onfault=%p during USR mode fault",
    337   1.1    chris 			    pcb->pcb_onfault);
    338   1.1    chris 		return;
    339   1.1    chris 	}
    340   1.1    chris 
    341   1.1    chris 	/* More debug stuff */
    342   1.1    chris 
    343   1.1    chris 	fault_instruction = ReadWord(fault_pc);
    344   1.1    chris 
    345   1.1    chris #ifdef PMAP_DEBUG
    346   1.1    chris 	if (pmap_debug_level >= 0) {
    347   1.1    chris 		report_abort(NULL, fault_status, fault_address, fault_pc);
    348   1.1    chris 		printf("Instruction @V%08x = %08x\n",
    349   1.1    chris 		    fault_pc, fault_instruction);
    350   1.1    chris 	}
    351   1.1    chris #endif
    352   1.1    chris 
    353   1.1    chris 	/* Call the cpu specific abort fixup routine */
    354   1.1    chris 	error = cpu_dataabt_fixup(frame);
    355   1.1    chris 	if (error == ABORT_FIXUP_RETURN)
    356   1.1    chris 		return;
    357   1.1    chris 	if (error == ABORT_FIXUP_FAILED) {
    358  1.11  reinoud 		printf("pc = 0x%08x, opcode 0x%08x, insn = ", fault_pc, *((u_int *)fault_pc));
    359   1.1    chris 		disassemble(fault_pc);
    360  1.11  reinoud 		printf("data abort handler: fixup failed for this instruction\n");
    361   1.1    chris 	}
    362   1.1    chris 
    363   1.1    chris #ifdef PMAP_DEBUG
    364   1.1    chris 	if (pmap_debug_level >= 0)
    365   1.1    chris 		printf("fault in process %p\n", p);
    366   1.1    chris #endif
    367   1.1    chris 
    368   1.1    chris #ifdef DEBUG
    369  1.27      scw 	/* Is this needed ? (XXXSCW: yes. can happen during boot ...) */
    370  1.27      scw 	if (!cold && pcb != curpcb) {
    371   1.1    chris 		printf("data_abort: Alert ! pcb(%p) != curpcb(%p)\n",
    372   1.1    chris 		    pcb, curpcb);
    373  1.26  thorpej 		printf("data_abort: Alert ! proc(%p), curlwp(%p)\n",
    374  1.26  thorpej 		    p, curlwp);
    375   1.1    chris 	}
    376   1.1    chris #endif	/* DEBUG */
    377   1.1    chris 
    378   1.1    chris 	/* Were we in user mode when the abort occurred ? */
    379   1.1    chris 	if ((frame->tf_spsr & PSR_MODE) == PSR_USR32_MODE) {
    380   1.1    chris 		/*
    381   1.1    chris 		 * Note that the fault was from USR mode.
    382   1.1    chris 		 */
    383   1.1    chris 		user = 1;
    384  1.26  thorpej 		l->l_addr->u_pcb.pcb_tf = frame;
    385   1.1    chris 	} else
    386   1.1    chris 		user = 0;
    387  1.11  reinoud 
    388  1.11  reinoud 	/* check if this was a failed fixup */
    389  1.11  reinoud 	if (error == ABORT_FIXUP_FAILED) {
    390  1.11  reinoud 		if (user) {
    391  1.35  thorpej 			KSI_INIT_TRAP(&ksi);
    392  1.34     matt 			ksi.ksi_signo = SIGSEGV;
    393  1.34     matt 			ksi.ksi_code = 0;
    394  1.34     matt 			ksi.ksi_addr = (u_int32_t *)fault_address;
    395  1.34     matt 			ksi.ksi_trap = TRAP_CODE;
    396  1.34     matt 			ksi.ksi_errno = error;
    397  1.34     matt 			goto trapsignal;
    398  1.11  reinoud 		};
    399  1.24   provos 		panic("Data abort fixup failed in kernel - we're dead");
    400  1.11  reinoud 	};
    401   1.1    chris 
    402   1.1    chris 	/* Now act on the fault type */
    403  1.27      scw 	if (fatal_fault) {
    404   1.1    chris 		/*
    405  1.27      scw 		 * None of these faults should happen on a perfectly
    406  1.27      scw 		 * functioning system. They indicate either some gross
    407  1.27      scw 		 * problem with the kernel, or a hardware problem.
    408  1.27      scw 		 * In either case, stop.
    409   1.1    chris 		 */
    410   1.1    chris 		report_abort(NULL, fault_status, fault_address, fault_pc);
    411   1.1    chris 
    412  1.27      scw we_re_toast:
    413   1.1    chris 		/*
    414  1.34     matt 		 * We're are dead, try and provide some debug
    415   1.1    chris 		 * information before dying.
    416   1.1    chris 		 */
    417  1.28   briggs #if defined(DDB) || defined(KGDB)
    418   1.1    chris 		printf("Unhandled trap (frame = %p)\n", frame);
    419   1.1    chris 		report_abort(NULL, fault_status, fault_address, fault_pc);
    420  1.31  thorpej 		kdb_trap(T_FAULT, frame);
    421   1.1    chris 		return;
    422   1.1    chris #else
    423   1.1    chris 		panic("Unhandled trap (frame = %p)", frame);
    424  1.28   briggs #endif	/* DDB || KGDB */
    425  1.27      scw 	}
    426  1.27      scw 
    427   1.1    chris 	/*
    428  1.27      scw 	 * At this point, we're dealing with one of the following faults:
    429  1.27      scw 	 *
    430  1.27      scw 	 *  FAULT_TRANS_P	Page Translation Fault
    431  1.27      scw 	 *  FAULT_PERM_P	Page Permission Fault
    432  1.27      scw 	 *  FAULT_TRANS_S	Section Translation Fault
    433  1.27      scw 	 *  FAULT_PERM_S	Section Permission Fault
    434  1.27      scw 	 *  FAULT_DOMAIN_P	Page Domain Error Fault
    435  1.27      scw 	 *  FAULT_DOMAIN_S	Section Domain Error Fault
    436  1.27      scw 	 *
    437   1.1    chris 	 * Page/section translation/permission fault -- need to fault in
    438  1.27      scw 	 * the page.
    439  1.27      scw 	 *
    440  1.27      scw 	 * Page/section domain fault -- need to see if the L1 entry can
    441  1.27      scw 	 * be fixed up.
    442   1.1    chris 	 */
    443  1.27      scw 	vm = p->p_vmspace;
    444  1.27      scw 	va = trunc_page((vaddr_t)fault_address);
    445   1.1    chris 
    446   1.1    chris #ifdef PMAP_DEBUG
    447  1.27      scw 	if (pmap_debug_level >= 0)
    448  1.27      scw 		printf("page fault: addr=V%08lx ", va);
    449   1.1    chris #endif
    450   1.1    chris 
    451  1.27      scw 	/*
    452  1.27      scw 	 * It is only a kernel address space fault iff:
    453  1.27      scw 	 *	1. user == 0  and
    454  1.27      scw 	 *	2. pcb_onfault not set or
    455  1.27      scw 	 *	3. pcb_onfault set but supervisor space fault
    456  1.27      scw 	 * The last can occur during an exec() copyin where the
    457  1.27      scw 	 * argument space is lazy-allocated.
    458  1.27      scw 	 */
    459  1.27      scw 	if (!user &&
    460  1.27      scw 	    (va >= VM_MIN_KERNEL_ADDRESS || va < VM_MIN_ADDRESS)) {
    461  1.27      scw 		/* Was the fault due to the FPE/IPKDB ? */
    462  1.27      scw 		if ((frame->tf_spsr & PSR_MODE) == PSR_UND32_MODE) {
    463  1.27      scw 			report_abort("UND32", fault_status,
    464  1.27      scw 			    fault_address, fault_pc);
    465  1.35  thorpej 			KSI_INIT_TRAP(&ksi);
    466  1.34     matt 			ksi.ksi_signo = SIGSEGV;
    467  1.34     matt 			ksi.ksi_code = fault_status;
    468  1.34     matt 			ksi.ksi_addr = (u_int32_t *)fault_address;
    469  1.34     matt 			ksi.ksi_trap = TRAP_CODE;
    470  1.34     matt 			KERNEL_PROC_LOCK(p);
    471  1.34     matt 			trapsignal(l, &ksi);
    472  1.34     matt 			KERNEL_PROC_UNLOCK(p);
    473  1.27      scw 
    474  1.27      scw 			/*
    475  1.27      scw 			 * Force exit via userret()
    476  1.27      scw 			 * This is necessary as the FPE is an extension
    477  1.27      scw 			 * to userland that actually runs in a
    478  1.27      scw 			 * priveledged mode but uses USR mode
    479  1.27      scw 			 * permissions for its accesses.
    480  1.27      scw 			 */
    481  1.27      scw 			userret(l);
    482  1.27      scw 			return;
    483  1.27      scw 		}
    484  1.27      scw 		map = kernel_map;
    485  1.32       cl 	} else {
    486  1.27      scw 		map = &vm->vm_map;
    487  1.32       cl 		if (l->l_flag & L_SA) {
    488  1.32       cl 			KDASSERT(p != NULL && p->p_sa != NULL);
    489  1.32       cl 			p->p_sa->sa_vp_faultaddr = (vaddr_t)fault_address;
    490  1.32       cl 			l->l_flag |= L_SA_PAGEFAULT;
    491  1.32       cl 		}
    492  1.32       cl 	}
    493   1.1    chris 
    494   1.1    chris #ifdef PMAP_DEBUG
    495  1.27      scw 	if (pmap_debug_level >= 0)
    496  1.27      scw 		printf("vmmap=%p ", map);
    497   1.1    chris #endif
    498   1.1    chris 
    499  1.27      scw 	if (map == NULL)
    500  1.27      scw 		printf("No map for fault address va = 0x%08lx", va);
    501   1.1    chris 
    502  1.27      scw 	/*
    503  1.27      scw 	 * We need to know whether the page should be mapped
    504  1.27      scw 	 * as R or R/W. The MMU does not give us the info as
    505  1.27      scw 	 * to whether the fault was caused by a read or a write.
    506  1.27      scw 	 * This means we need to disassemble the instruction
    507  1.27      scw 	 * responsible and determine if it was a read or write
    508  1.27      scw 	 * instruction.
    509  1.27      scw 	 */
    510  1.27      scw 	/* STR instruction ? */
    511  1.27      scw 	if ((fault_instruction & 0x0c100000) == 0x04000000)
    512  1.27      scw 		ftype = VM_PROT_WRITE;
    513  1.27      scw 	/* STM or CDT instruction ? */
    514  1.27      scw 	else if ((fault_instruction & 0x0a100000) == 0x08000000)
    515  1.27      scw 		ftype = VM_PROT_WRITE;
    516  1.27      scw 	/* STRH, STRSH or STRSB instruction ? */
    517  1.27      scw 	else if ((fault_instruction & 0x0e100090) == 0x00000090)
    518  1.27      scw 		ftype = VM_PROT_WRITE;
    519  1.27      scw 	/* SWP instruction ? */
    520  1.27      scw 	else if ((fault_instruction & 0x0fb00ff0) == 0x01000090)
    521  1.27      scw 		ftype = VM_PROT_READ | VM_PROT_WRITE;
    522  1.27      scw 	else
    523  1.27      scw 		ftype = VM_PROT_READ;
    524   1.1    chris 
    525   1.1    chris #ifdef PMAP_DEBUG
    526  1.27      scw 	if (pmap_debug_level >= 0)
    527  1.27      scw 		printf("fault protection = %d\n", ftype);
    528   1.1    chris #endif
    529   1.1    chris 
    530  1.29      scw 	if (pmap_fault_fixup(map->pmap, va, ftype, user))
    531  1.27      scw 		goto out;
    532   1.1    chris 
    533  1.27      scw 	if (current_intr_depth > 0) {
    534  1.28   briggs #if defined(DDB) || defined(KGDB)
    535  1.27      scw 		printf("Non-emulated page fault with intr_depth > 0\n");
    536  1.27      scw 		report_abort(NULL, fault_status, fault_address, fault_pc);
    537  1.31  thorpej 		kdb_trap(T_FAULT, frame);
    538  1.27      scw 		return;
    539   1.1    chris #else
    540  1.27      scw 		panic("Fault with intr_depth > 0");
    541   1.1    chris #endif	/* DDB */
    542  1.27      scw 	}
    543   1.1    chris 
    544  1.27      scw 	onfault = pcb->pcb_onfault;
    545  1.27      scw 	pcb->pcb_onfault = NULL;
    546  1.27      scw 	rv = uvm_fault(map, va, 0, ftype);
    547  1.27      scw 	pcb->pcb_onfault = onfault;
    548  1.32       cl 	if (map != kernel_map)
    549  1.32       cl 		l->l_flag &= ~L_SA_PAGEFAULT;
    550  1.27      scw 	if (rv == 0) {
    551  1.27      scw 		if (user != 0) /* Record any stack growth... */
    552  1.27      scw 			uvm_grow(p, trunc_page(va));
    553  1.27      scw 		goto out;
    554  1.27      scw 	}
    555  1.27      scw 	if (user == 0) {
    556  1.27      scw 		if (pcb->pcb_onfault) {
    557  1.27      scw 			frame->tf_r0 = rv;
    558  1.27      scw 			goto copyfault;
    559   1.1    chris 		}
    560  1.27      scw 		printf("[u]vm_fault(%p, %lx, %x, 0) -> %x\n", map, va, ftype,
    561  1.27      scw 		    rv);
    562  1.27      scw 		goto we_re_toast;
    563  1.27      scw 	}
    564   1.1    chris 
    565  1.27      scw 	report_abort("", fault_status, fault_address, fault_pc);
    566  1.34     matt 
    567  1.35  thorpej 	KSI_INIT_TRAP(&ksi);
    568  1.34     matt 	ksi.ksi_signo = SIGSEGV;
    569  1.34     matt 	ksi.ksi_code = 0;
    570  1.34     matt 	ksi.ksi_addr = (u_int32_t *)fault_address;
    571  1.34     matt 	ksi.ksi_trap = TRAP_CODE;
    572  1.34     matt 	ksi.ksi_errno = rv;
    573  1.34     matt 
    574  1.27      scw 	if (rv == ENOMEM) {
    575  1.27      scw 		printf("UVM: pid %d (%s), uid %d killed: "
    576  1.27      scw 		    "out of swap\n", p->p_pid, p->p_comm,
    577  1.27      scw 		    (p->p_cred && p->p_ucred) ?  p->p_ucred->cr_uid : -1);
    578  1.34     matt 	}
    579  1.34     matt 
    580  1.34     matt trapsignal:
    581  1.34     matt 	KERNEL_PROC_LOCK(p);
    582  1.34     matt #if 0
    583  1.34     matt 	/* maybe one day we'll do emulations */
    584  1.34     matt 	(*p->p_emul->e_trapsignal)(l, &ksi);
    585  1.34     matt #else
    586  1.34     matt 	trapsignal(l, &ksi);
    587  1.34     matt #endif
    588  1.34     matt 	KERNEL_PROC_UNLOCK(p);
    589  1.27      scw 
    590  1.27      scw out:
    591   1.1    chris 	/* Call userret() if it was a USR mode fault */
    592   1.1    chris 	if (user)
    593  1.26  thorpej 		userret(l);
    594   1.1    chris }
    595   1.1    chris 
    596   1.1    chris 
    597   1.1    chris /*
    598   1.1    chris  * void prefetch_abort_handler(trapframe_t *frame)
    599   1.1    chris  *
    600   1.1    chris  * Abort handler called when instruction execution occurs at
    601   1.1    chris  * a non existent or restricted (access permissions) memory page.
    602   1.1    chris  * If the address is invalid and we were in SVC mode then panic as
    603   1.1    chris  * the kernel should never prefetch abort.
    604   1.1    chris  * If the address is invalid and the page is mapped then the user process
    605   1.1    chris  * does no have read permission so send it a signal.
    606   1.1    chris  * Otherwise fault the page in and try again.
    607   1.1    chris  */
    608   1.1    chris 
    609   1.1    chris void
    610   1.1    chris prefetch_abort_handler(frame)
    611   1.1    chris 	trapframe_t *frame;
    612   1.1    chris {
    613  1.26  thorpej 	struct lwp *l;
    614  1.14  thorpej 	struct proc *p;
    615  1.14  thorpej 	struct vm_map *map;
    616  1.14  thorpej 	vaddr_t fault_pc, va;
    617   1.1    chris 	int error;
    618  1.34     matt 	ksiginfo_t ksi;
    619   1.1    chris 
    620   1.1    chris 	/*
    621   1.1    chris 	 * Enable IRQ's (disabled by the abort) This always comes
    622   1.1    chris 	 * from user mode so we know interrupts were not disabled.
    623   1.1    chris 	 * But we check anyway.
    624   1.1    chris 	 */
    625   1.1    chris 	if (!(frame->tf_spsr & I32_bit))
    626   1.1    chris 		enable_interrupts(I32_bit);
    627   1.1    chris 
    628   1.1    chris #ifdef DEBUG
    629   1.1    chris 	if ((GetCPSR() & PSR_MODE) != PSR_SVC32_MODE)
    630   1.1    chris 		panic("prefetch_abort_handler: not in SVC32 mode");
    631   1.1    chris #endif
    632   1.1    chris 
    633   1.1    chris 	/* Update vmmeter statistics */
    634   1.1    chris 	uvmexp.traps++;
    635   1.1    chris 
    636   1.1    chris 	/* Call the cpu specific abort fixup routine */
    637   1.1    chris 	error = cpu_prefetchabt_fixup(frame);
    638   1.1    chris 	if (error == ABORT_FIXUP_RETURN)
    639   1.1    chris 		return;
    640   1.1    chris 	if (error == ABORT_FIXUP_FAILED)
    641  1.24   provos 		panic("prefetch abort fixup failed");
    642   1.1    chris 
    643   1.1    chris 	/* Get the current proc structure or proc0 if there is none */
    644  1.26  thorpej 	if ((l = curlwp) == NULL) {
    645  1.26  thorpej 		l = &lwp0;
    646   1.1    chris #ifdef DEBUG
    647  1.26  thorpej 		printf("Prefetch abort with curlwp == 0\n");
    648   1.1    chris #endif
    649   1.1    chris 	}
    650  1.26  thorpej 	p = l->l_proc;
    651   1.1    chris 
    652   1.1    chris #ifdef PMAP_DEBUG
    653   1.1    chris 	if (pmap_debug_level >= 0)
    654   1.1    chris 		printf("prefetch fault in process %p %s\n", p, p->p_comm);
    655   1.1    chris #endif
    656   1.1    chris 
    657   1.4  thorpej 	/* Get fault address */
    658   1.4  thorpej 	fault_pc = frame->tf_pc;
    659  1.14  thorpej 	va = trunc_page(fault_pc);
    660   1.4  thorpej 
    661   1.1    chris 	/* Was the prefectch abort from USR32 mode ? */
    662   1.1    chris 	if ((frame->tf_spsr & PSR_MODE) == PSR_USR32_MODE) {
    663  1.26  thorpej 		l->l_addr->u_pcb.pcb_tf = frame;
    664   1.1    chris 	} else {
    665   1.1    chris 		/*
    666   1.1    chris 		 * All the kernel code pages are loaded at boot time
    667   1.1    chris 		 * and do not get paged
    668   1.1    chris 		 */
    669  1.24   provos 	        panic("Prefetch abort in non-USR mode (frame=%p PC=0x%08lx)",
    670   1.4  thorpej 	            frame, fault_pc);
    671   1.1    chris 	}
    672   1.1    chris 
    673  1.14  thorpej 	map = &p->p_vmspace->vm_map;
    674  1.14  thorpej 
    675   1.1    chris #ifdef PMAP_DEBUG
    676   1.1    chris 	if (pmap_debug_level >= 0)
    677  1.16  thorpej 		printf("prefetch_abort: PC = %08lx\n", fault_pc);
    678   1.1    chris #endif
    679   1.1    chris 	/* Ok validate the address, can only execute in USER space */
    680   1.1    chris 	if (fault_pc < VM_MIN_ADDRESS || fault_pc >= VM_MAXUSER_ADDRESS) {
    681   1.1    chris #ifdef DEBUG
    682  1.19   ichiro 		printf("prefetch: pc (%08lx) not in user process space\n",
    683   1.1    chris 		    fault_pc);
    684   1.1    chris #endif
    685  1.35  thorpej 		KSI_INIT_TRAP(&ksi);
    686  1.34     matt 		ksi.ksi_signo = SIGSEGV;
    687  1.34     matt 		ksi.ksi_code = SEGV_ACCERR;
    688  1.34     matt 		ksi.ksi_addr = (u_int32_t *)fault_pc;
    689  1.34     matt 		ksi.ksi_trap = fault_pc;
    690  1.34     matt 
    691  1.34     matt 		goto prefetch_trapsignal;
    692   1.1    chris 	}
    693   1.1    chris 
    694  1.27      scw 	/*
    695  1.27      scw 	 * See if the pmap can handle this fault on its own...
    696  1.27      scw 	 */
    697  1.29      scw 	if (pmap_fault_fixup(map->pmap, va, VM_PROT_READ, 1))
    698  1.34     matt 		goto prefetch_out;
    699  1.27      scw 
    700  1.14  thorpej 	if (current_intr_depth > 0) {
    701  1.14  thorpej #ifdef DDB
    702  1.14  thorpej 		printf("Non-emulated prefetch abort with intr_depth > 0\n");
    703  1.31  thorpej 		kdb_trap(T_FAULT, frame);
    704  1.14  thorpej 		return;
    705  1.14  thorpej #else
    706  1.14  thorpej 		panic("Prefetch Abort with intr_depth > 0");
    707   1.1    chris #endif
    708   1.1    chris 	}
    709   1.1    chris 
    710  1.14  thorpej 	error = uvm_fault(map, va, 0, VM_PROT_READ);
    711  1.14  thorpej 	if (error == 0)
    712  1.34     matt 		goto prefetch_out;
    713  1.34     matt 
    714  1.35  thorpej 	KSI_INIT_TRAP(&ksi);
    715  1.34     matt 	ksi.ksi_signo = SIGSEGV;
    716  1.34     matt 	ksi.ksi_code = 0;
    717  1.34     matt 	ksi.ksi_errno = error;
    718  1.34     matt 	ksi.ksi_addr = (u_int32_t *)fault_pc;
    719  1.34     matt 	ksi.ksi_trap = fault_pc;
    720  1.34     matt 
    721  1.14  thorpej 	if (error == ENOMEM) {
    722  1.14  thorpej 		printf("UVM: pid %d (%s), uid %d killed: "
    723  1.14  thorpej 		    "out of swap\n", p->p_pid, p->p_comm,
    724  1.27      scw 		    (p->p_cred && p->p_ucred) ?  p->p_ucred->cr_uid : -1);
    725  1.34     matt 	}
    726  1.34     matt prefetch_trapsignal:
    727  1.34     matt 	KERNEL_PROC_LOCK(p);
    728  1.34     matt #if 0
    729  1.34     matt 	/* maybe one day we'll do emulations */
    730  1.34     matt 	(*p->p_emul->e_trapsignal)(l, &ksi);
    731  1.34     matt #else
    732  1.34     matt 	trapsignal(l, &ksi);
    733  1.34     matt #endif
    734  1.34     matt 	KERNEL_PROC_UNLOCK(p);
    735  1.34     matt prefetch_out:
    736  1.26  thorpej 	userret(l);
    737   1.1    chris }
    738