fault.c revision 1.75 1 1.75 wiz /* $NetBSD: fault.c,v 1.75 2010/02/03 13:51:00 wiz Exp $ */
2 1.1 chris
3 1.1 chris /*
4 1.27 scw * Copyright 2003 Wasabi Systems, Inc.
5 1.27 scw * All rights reserved.
6 1.27 scw *
7 1.27 scw * Written by Steve C. Woodford for Wasabi Systems, Inc.
8 1.27 scw *
9 1.27 scw * Redistribution and use in source and binary forms, with or without
10 1.27 scw * modification, are permitted provided that the following conditions
11 1.27 scw * are met:
12 1.27 scw * 1. Redistributions of source code must retain the above copyright
13 1.27 scw * notice, this list of conditions and the following disclaimer.
14 1.27 scw * 2. Redistributions in binary form must reproduce the above copyright
15 1.27 scw * notice, this list of conditions and the following disclaimer in the
16 1.27 scw * documentation and/or other materials provided with the distribution.
17 1.27 scw * 3. All advertising materials mentioning features or use of this software
18 1.27 scw * must display the following acknowledgement:
19 1.27 scw * This product includes software developed for the NetBSD Project by
20 1.27 scw * Wasabi Systems, Inc.
21 1.27 scw * 4. The name of Wasabi Systems, Inc. may not be used to endorse
22 1.27 scw * or promote products derived from this software without specific prior
23 1.27 scw * written permission.
24 1.27 scw *
25 1.27 scw * THIS SOFTWARE IS PROVIDED BY WASABI SYSTEMS, INC. ``AS IS'' AND
26 1.27 scw * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
27 1.27 scw * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
28 1.27 scw * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL WASABI SYSTEMS, INC
29 1.27 scw * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
30 1.27 scw * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
31 1.27 scw * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
32 1.27 scw * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
33 1.27 scw * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
34 1.27 scw * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
35 1.27 scw * POSSIBILITY OF SUCH DAMAGE.
36 1.27 scw */
37 1.27 scw /*
38 1.1 chris * Copyright (c) 1994-1997 Mark Brinicombe.
39 1.1 chris * Copyright (c) 1994 Brini.
40 1.1 chris * All rights reserved.
41 1.1 chris *
42 1.1 chris * This code is derived from software written for Brini by Mark Brinicombe
43 1.1 chris *
44 1.1 chris * Redistribution and use in source and binary forms, with or without
45 1.1 chris * modification, are permitted provided that the following conditions
46 1.1 chris * are met:
47 1.1 chris * 1. Redistributions of source code must retain the above copyright
48 1.1 chris * notice, this list of conditions and the following disclaimer.
49 1.1 chris * 2. Redistributions in binary form must reproduce the above copyright
50 1.1 chris * notice, this list of conditions and the following disclaimer in the
51 1.1 chris * documentation and/or other materials provided with the distribution.
52 1.1 chris * 3. All advertising materials mentioning features or use of this software
53 1.1 chris * must display the following acknowledgement:
54 1.1 chris * This product includes software developed by Brini.
55 1.1 chris * 4. The name of the company nor the name of the author may be used to
56 1.1 chris * endorse or promote products derived from this software without specific
57 1.1 chris * prior written permission.
58 1.1 chris *
59 1.1 chris * THIS SOFTWARE IS PROVIDED BY BRINI ``AS IS'' AND ANY EXPRESS OR IMPLIED
60 1.1 chris * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
61 1.1 chris * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
62 1.1 chris * IN NO EVENT SHALL BRINI OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT,
63 1.1 chris * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
64 1.1 chris * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
65 1.1 chris * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
66 1.1 chris * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
67 1.1 chris * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
68 1.1 chris * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
69 1.1 chris * SUCH DAMAGE.
70 1.1 chris *
71 1.1 chris * RiscBSD kernel project
72 1.1 chris *
73 1.1 chris * fault.c
74 1.1 chris *
75 1.1 chris * Fault handlers
76 1.1 chris *
77 1.1 chris * Created : 28/11/94
78 1.1 chris */
79 1.1 chris
80 1.1 chris #include "opt_ddb.h"
81 1.28 briggs #include "opt_kgdb.h"
82 1.72 matt #include "opt_sa.h"
83 1.1 chris
84 1.1 chris #include <sys/types.h>
85 1.75 wiz __KERNEL_RCSID(0, "$NetBSD: fault.c,v 1.75 2010/02/03 13:51:00 wiz Exp $");
86 1.21 bjh21
87 1.1 chris #include <sys/param.h>
88 1.1 chris #include <sys/systm.h>
89 1.1 chris #include <sys/proc.h>
90 1.1 chris #include <sys/kernel.h>
91 1.60 yamt #include <sys/kauth.h>
92 1.71 cegger
93 1.71 cegger #include <sys/savar.h>
94 1.65 matt #include <sys/cpu.h>
95 1.1 chris
96 1.1 chris #include <uvm/uvm_extern.h>
97 1.50 rearnsha #include <uvm/uvm_stat.h>
98 1.50 rearnsha #ifdef UVMHIST
99 1.50 rearnsha #include <uvm/uvm.h>
100 1.50 rearnsha #endif
101 1.18 thorpej
102 1.18 thorpej #include <arm/cpuconf.h>
103 1.1 chris
104 1.1 chris #include <machine/frame.h>
105 1.5 thorpej #include <arm/arm32/katelib.h>
106 1.2 matt #include <machine/intr.h>
107 1.28 briggs #if defined(DDB) || defined(KGDB)
108 1.1 chris #include <machine/db_machdep.h>
109 1.28 briggs #ifdef KGDB
110 1.28 briggs #include <sys/kgdb.h>
111 1.28 briggs #endif
112 1.28 briggs #if !defined(DDB)
113 1.28 briggs #define kdb_trap kgdb_trap
114 1.28 briggs #endif
115 1.1 chris #endif
116 1.1 chris
117 1.1 chris #include <arch/arm/arm/disassem.h>
118 1.7 chris #include <arm/arm32/machdep.h>
119 1.7 chris
120 1.1 chris extern char fusubailout[];
121 1.1 chris
122 1.27 scw #ifdef DEBUG
123 1.27 scw int last_fault_code; /* For the benefit of pmap_fault_fixup() */
124 1.27 scw #endif
125 1.27 scw
126 1.39 scw #if defined(CPU_ARM3) || defined(CPU_ARM6) || \
127 1.39 scw defined(CPU_ARM7) || defined(CPU_ARM7TDMI)
128 1.39 scw /* These CPUs may need data/prefetch abort fixups */
129 1.39 scw #define CPU_ABORT_FIXUP_REQUIRED
130 1.39 scw #endif
131 1.7 chris
132 1.39 scw struct data_abort {
133 1.39 scw int (*func)(trapframe_t *, u_int, u_int, struct lwp *, ksiginfo_t *);
134 1.39 scw const char *desc;
135 1.39 scw };
136 1.1 chris
137 1.39 scw static int dab_fatal(trapframe_t *, u_int, u_int, struct lwp *, ksiginfo_t *);
138 1.39 scw static int dab_align(trapframe_t *, u_int, u_int, struct lwp *, ksiginfo_t *);
139 1.39 scw static int dab_buserr(trapframe_t *, u_int, u_int, struct lwp *, ksiginfo_t *);
140 1.39 scw
141 1.39 scw static const struct data_abort data_aborts[] = {
142 1.39 scw {dab_fatal, "Vector Exception"},
143 1.39 scw {dab_align, "Alignment Fault 1"},
144 1.39 scw {dab_fatal, "Terminal Exception"},
145 1.39 scw {dab_align, "Alignment Fault 3"},
146 1.39 scw {dab_buserr, "External Linefetch Abort (S)"},
147 1.39 scw {NULL, "Translation Fault (S)"},
148 1.39 scw {dab_buserr, "External Linefetch Abort (P)"},
149 1.39 scw {NULL, "Translation Fault (P)"},
150 1.39 scw {dab_buserr, "External Non-Linefetch Abort (S)"},
151 1.39 scw {NULL, "Domain Fault (S)"},
152 1.39 scw {dab_buserr, "External Non-Linefetch Abort (P)"},
153 1.39 scw {NULL, "Domain Fault (P)"},
154 1.39 scw {dab_buserr, "External Translation Abort (L1)"},
155 1.39 scw {NULL, "Permission Fault (S)"},
156 1.39 scw {dab_buserr, "External Translation Abort (L2)"},
157 1.39 scw {NULL, "Permission Fault (P)"}
158 1.39 scw };
159 1.1 chris
160 1.39 scw /* Determine if a fault came from user mode */
161 1.39 scw #define TRAP_USERMODE(tf) ((tf->tf_spsr & PSR_MODE) == PSR_USR32_MODE)
162 1.39 scw
163 1.39 scw /* Determine if 'x' is a permission fault */
164 1.39 scw #define IS_PERMISSION_FAULT(x) \
165 1.39 scw (((1 << ((x) & FAULT_TYPE_MASK)) & \
166 1.39 scw ((1 << FAULT_PERM_P) | (1 << FAULT_PERM_S))) != 0)
167 1.1 chris
168 1.39 scw #if 0
169 1.39 scw /* maybe one day we'll do emulations */
170 1.39 scw #define TRAPSIGNAL(l,k) (*(l)->l_proc->p_emul->e_trapsignal)((l), (k))
171 1.39 scw #else
172 1.39 scw #define TRAPSIGNAL(l,k) trapsignal((l), (k))
173 1.1 chris #endif
174 1.3 thorpej
175 1.56 perry static inline void
176 1.39 scw call_trapsignal(struct lwp *l, ksiginfo_t *ksi)
177 1.3 thorpej {
178 1.3 thorpej
179 1.39 scw TRAPSIGNAL(l, ksi);
180 1.39 scw }
181 1.3 thorpej
182 1.56 perry static inline int
183 1.39 scw data_abort_fixup(trapframe_t *tf, u_int fsr, u_int far, struct lwp *l)
184 1.39 scw {
185 1.39 scw #ifdef CPU_ABORT_FIXUP_REQUIRED
186 1.39 scw int error;
187 1.3 thorpej
188 1.48 wiz /* Call the CPU specific data abort fixup routine */
189 1.39 scw error = cpu_dataabt_fixup(tf);
190 1.39 scw if (__predict_true(error != ABORT_FIXUP_FAILED))
191 1.39 scw return (error);
192 1.3 thorpej
193 1.39 scw /*
194 1.39 scw * Oops, couldn't fix up the instruction
195 1.39 scw */
196 1.39 scw printf("data_abort_fixup: fixup for %s mode data abort failed.\n",
197 1.39 scw TRAP_USERMODE(tf) ? "user" : "kernel");
198 1.51 rearnsha #ifdef THUMB_CODE
199 1.51 rearnsha if (tf->tf_spsr & PSR_T_bit) {
200 1.51 rearnsha printf("pc = 0x%08x, opcode 0x%04x, 0x%04x, insn = ",
201 1.66 chris tf->tf_pc, *((u_int16 *)(tf->tf_pc & ~1)),
202 1.66 chris *((u_int16 *)((tf->tf_pc + 2) & ~1)));
203 1.51 rearnsha }
204 1.51 rearnsha else
205 1.51 rearnsha #endif
206 1.51 rearnsha {
207 1.51 rearnsha printf("pc = 0x%08x, opcode 0x%08x, insn = ", tf->tf_pc,
208 1.51 rearnsha *((u_int *)tf->tf_pc));
209 1.51 rearnsha }
210 1.39 scw disassemble(tf->tf_pc);
211 1.39 scw
212 1.39 scw /* Die now if this happened in kernel mode */
213 1.39 scw if (!TRAP_USERMODE(tf))
214 1.39 scw dab_fatal(tf, fsr, far, l, NULL);
215 1.3 thorpej
216 1.39 scw return (error);
217 1.39 scw #else
218 1.39 scw return (ABORT_FIXUP_OK);
219 1.39 scw #endif /* CPU_ABORT_FIXUP_REQUIRED */
220 1.3 thorpej }
221 1.3 thorpej
222 1.1 chris void
223 1.39 scw data_abort_handler(trapframe_t *tf)
224 1.1 chris {
225 1.39 scw struct vm_map *map;
226 1.39 scw struct pcb *pcb;
227 1.26 thorpej struct lwp *l;
228 1.39 scw u_int user, far, fsr;
229 1.39 scw vm_prot_t ftype;
230 1.1 chris void *onfault;
231 1.27 scw vaddr_t va;
232 1.39 scw int error;
233 1.34 matt ksiginfo_t ksi;
234 1.3 thorpej
235 1.50 rearnsha UVMHIST_FUNC("data_abort_handler");
236 1.50 rearnsha
237 1.39 scw /* Grab FAR/FSR before enabling interrupts */
238 1.39 scw far = cpu_faultaddress();
239 1.39 scw fsr = cpu_faultstatus();
240 1.1 chris
241 1.50 rearnsha UVMHIST_CALLED(maphist);
242 1.39 scw /* Update vmmeter statistics */
243 1.39 scw uvmexp.traps++;
244 1.1 chris
245 1.39 scw /* Re-enable interrupts if they were enabled previously */
246 1.72 matt KASSERT(!TRAP_USERMODE(tf) || (tf->tf_spsr & IF32_bits) == 0);
247 1.72 matt if (__predict_true((tf->tf_spsr & IF32_bits) != IF32_bits))
248 1.72 matt restore_interrupts(tf->tf_spsr & IF32_bits);
249 1.1 chris
250 1.67 matt /* Get the current lwp structure */
251 1.67 matt KASSERT(curlwp != NULL);
252 1.67 matt l = curlwp;
253 1.1 chris
254 1.50 rearnsha UVMHIST_LOG(maphist, " (pc=0x%x, l=0x%x, far=0x%x, fsr=0x%x)",
255 1.50 rearnsha tf->tf_pc, l, far, fsr);
256 1.50 rearnsha
257 1.39 scw /* Data abort came from user mode? */
258 1.61 ad if ((user = TRAP_USERMODE(tf)) != 0)
259 1.61 ad LWP_CACHE_CREDS(l, l->l_proc);
260 1.1 chris
261 1.39 scw /* Grab the current pcb */
262 1.74 mbalmer pcb = lwp_getpcb(l);
263 1.1 chris
264 1.39 scw /* Invoke the appropriate handler, if necessary */
265 1.39 scw if (__predict_false(data_aborts[fsr & FAULT_TYPE_MASK].func != NULL)) {
266 1.39 scw if ((data_aborts[fsr & FAULT_TYPE_MASK].func)(tf, fsr, far,
267 1.39 scw l, &ksi))
268 1.39 scw goto do_trapsignal;
269 1.39 scw goto out;
270 1.39 scw }
271 1.1 chris
272 1.1 chris /*
273 1.39 scw * At this point, we're dealing with one of the following data aborts:
274 1.39 scw *
275 1.39 scw * FAULT_TRANS_S - Translation -- Section
276 1.39 scw * FAULT_TRANS_P - Translation -- Page
277 1.39 scw * FAULT_DOMAIN_S - Domain -- Section
278 1.39 scw * FAULT_DOMAIN_P - Domain -- Page
279 1.39 scw * FAULT_PERM_S - Permission -- Section
280 1.39 scw * FAULT_PERM_P - Permission -- Page
281 1.39 scw *
282 1.39 scw * These are the main virtual memory-related faults signalled by
283 1.39 scw * the MMU.
284 1.1 chris */
285 1.1 chris
286 1.1 chris /* fusubailout is used by [fs]uswintr to avoid page faulting */
287 1.39 scw if (__predict_false(pcb->pcb_onfault == fusubailout)) {
288 1.39 scw tf->tf_r0 = EFAULT;
289 1.39 scw tf->tf_pc = (register_t)(intptr_t) pcb->pcb_onfault;
290 1.1 chris return;
291 1.1 chris }
292 1.1 chris
293 1.73 rmind if (user) {
294 1.73 rmind pcb->pcb_tf = tf;
295 1.73 rmind }
296 1.1 chris
297 1.40 scw /*
298 1.40 scw * Make sure the Program Counter is sane. We could fall foul of
299 1.40 scw * someone executing Thumb code, in which case the PC might not
300 1.40 scw * be word-aligned. This would cause a kernel alignment fault
301 1.40 scw * further down if we have to decode the current instruction.
302 1.40 scw */
303 1.51 rearnsha #ifdef THUMB_CODE
304 1.51 rearnsha /*
305 1.51 rearnsha * XXX: It would be nice to be able to support Thumb in the kernel
306 1.51 rearnsha * at some point.
307 1.51 rearnsha */
308 1.51 rearnsha if (__predict_false(!user && (tf->tf_pc & 3) != 0)) {
309 1.51 rearnsha printf("\ndata_abort_fault: Misaligned Kernel-mode "
310 1.51 rearnsha "Program Counter\n");
311 1.51 rearnsha dab_fatal(tf, fsr, far, l, NULL);
312 1.51 rearnsha }
313 1.51 rearnsha #else
314 1.40 scw if (__predict_false((tf->tf_pc & 3) != 0)) {
315 1.40 scw if (user) {
316 1.40 scw /*
317 1.40 scw * Give the user an illegal instruction signal.
318 1.40 scw */
319 1.40 scw /* Deliver a SIGILL to the process */
320 1.40 scw KSI_INIT_TRAP(&ksi);
321 1.40 scw ksi.ksi_signo = SIGILL;
322 1.40 scw ksi.ksi_code = ILL_ILLOPC;
323 1.40 scw ksi.ksi_addr = (u_int32_t *)(intptr_t) far;
324 1.40 scw ksi.ksi_trap = fsr;
325 1.40 scw goto do_trapsignal;
326 1.40 scw }
327 1.40 scw
328 1.40 scw /*
329 1.40 scw * The kernel never executes Thumb code.
330 1.40 scw */
331 1.40 scw printf("\ndata_abort_fault: Misaligned Kernel-mode "
332 1.40 scw "Program Counter\n");
333 1.40 scw dab_fatal(tf, fsr, far, l, NULL);
334 1.27 scw }
335 1.51 rearnsha #endif
336 1.27 scw
337 1.48 wiz /* See if the CPU state needs to be fixed up */
338 1.41 scw switch (data_abort_fixup(tf, fsr, far, l)) {
339 1.41 scw case ABORT_FIXUP_RETURN:
340 1.41 scw return;
341 1.41 scw case ABORT_FIXUP_FAILED:
342 1.41 scw /* Deliver a SIGILL to the process */
343 1.41 scw KSI_INIT_TRAP(&ksi);
344 1.41 scw ksi.ksi_signo = SIGILL;
345 1.41 scw ksi.ksi_code = ILL_ILLOPC;
346 1.41 scw ksi.ksi_addr = (u_int32_t *)(intptr_t) far;
347 1.41 scw ksi.ksi_trap = fsr;
348 1.41 scw goto do_trapsignal;
349 1.41 scw default:
350 1.41 scw break;
351 1.41 scw }
352 1.41 scw
353 1.39 scw va = trunc_page((vaddr_t)far);
354 1.1 chris
355 1.27 scw /*
356 1.27 scw * It is only a kernel address space fault iff:
357 1.27 scw * 1. user == 0 and
358 1.27 scw * 2. pcb_onfault not set or
359 1.41 scw * 3. pcb_onfault set and not LDRT/LDRBT/STRT/STRBT instruction.
360 1.27 scw */
361 1.39 scw if (user == 0 && (va >= VM_MIN_KERNEL_ADDRESS ||
362 1.41 scw (va < VM_MIN_ADDRESS && vector_page == ARM_VECTORS_LOW)) &&
363 1.41 scw __predict_true((pcb->pcb_onfault == NULL ||
364 1.41 scw (ReadWord(tf->tf_pc) & 0x05200000) != 0x04200000))) {
365 1.39 scw map = kernel_map;
366 1.39 scw
367 1.27 scw /* Was the fault due to the FPE/IPKDB ? */
368 1.39 scw if (__predict_false((tf->tf_spsr & PSR_MODE)==PSR_UND32_MODE)) {
369 1.35 thorpej KSI_INIT_TRAP(&ksi);
370 1.34 matt ksi.ksi_signo = SIGSEGV;
371 1.39 scw ksi.ksi_code = SEGV_ACCERR;
372 1.39 scw ksi.ksi_addr = (u_int32_t *)(intptr_t) far;
373 1.39 scw ksi.ksi_trap = fsr;
374 1.27 scw
375 1.27 scw /*
376 1.27 scw * Force exit via userret()
377 1.39 scw * This is necessary as the FPE is an extension to
378 1.39 scw * userland that actually runs in a priveledged mode
379 1.39 scw * but uses USR mode permissions for its accesses.
380 1.27 scw */
381 1.39 scw user = 1;
382 1.39 scw goto do_trapsignal;
383 1.27 scw }
384 1.70 wrstuden } else {
385 1.39 scw map = &l->l_proc->p_vmspace->vm_map;
386 1.72 matt #ifdef KERN_SA
387 1.70 wrstuden if ((l->l_flag & LW_SA) && (~l->l_pflag & LP_SA_NOBLOCK)) {
388 1.70 wrstuden l->l_savp->savp_faultaddr = (vaddr_t)far;
389 1.70 wrstuden l->l_pflag |= LP_SA_PAGEFAULT;
390 1.70 wrstuden }
391 1.72 matt #endif
392 1.70 wrstuden }
393 1.1 chris
394 1.27 scw /*
395 1.27 scw * We need to know whether the page should be mapped
396 1.27 scw * as R or R/W. The MMU does not give us the info as
397 1.27 scw * to whether the fault was caused by a read or a write.
398 1.39 scw *
399 1.39 scw * However, we know that a permission fault can only be
400 1.39 scw * the result of a write to a read-only location, so
401 1.39 scw * we can deal with those quickly.
402 1.39 scw *
403 1.39 scw * Otherwise we need to disassemble the instruction
404 1.39 scw * responsible to determine if it was a write.
405 1.27 scw */
406 1.39 scw if (IS_PERMISSION_FAULT(fsr))
407 1.27 scw ftype = VM_PROT_WRITE;
408 1.39 scw else {
409 1.51 rearnsha #ifdef THUMB_CODE
410 1.51 rearnsha /* Fast track the ARM case. */
411 1.51 rearnsha if (__predict_false(tf->tf_spsr & PSR_T_bit)) {
412 1.51 rearnsha u_int insn = fusword((void *)(tf->tf_pc & ~1));
413 1.51 rearnsha u_int insn_f8 = insn & 0xf800;
414 1.51 rearnsha u_int insn_fe = insn & 0xfe00;
415 1.51 rearnsha
416 1.51 rearnsha if (insn_f8 == 0x6000 || /* STR(1) */
417 1.51 rearnsha insn_f8 == 0x7000 || /* STRB(1) */
418 1.51 rearnsha insn_f8 == 0x8000 || /* STRH(1) */
419 1.51 rearnsha insn_f8 == 0x9000 || /* STR(3) */
420 1.51 rearnsha insn_f8 == 0xc000 || /* STM */
421 1.51 rearnsha insn_fe == 0x5000 || /* STR(2) */
422 1.51 rearnsha insn_fe == 0x5200 || /* STRH(2) */
423 1.51 rearnsha insn_fe == 0x5400) /* STRB(2) */
424 1.51 rearnsha ftype = VM_PROT_WRITE;
425 1.51 rearnsha else
426 1.51 rearnsha ftype = VM_PROT_READ;
427 1.51 rearnsha }
428 1.51 rearnsha else
429 1.51 rearnsha #endif
430 1.51 rearnsha {
431 1.51 rearnsha u_int insn = ReadWord(tf->tf_pc);
432 1.39 scw
433 1.51 rearnsha if (((insn & 0x0c100000) == 0x04000000) || /* STR[B] */
434 1.51 rearnsha ((insn & 0x0e1000b0) == 0x000000b0) || /* STR[HD]*/
435 1.51 rearnsha ((insn & 0x0a100000) == 0x08000000)) /* STM/CDT*/
436 1.51 rearnsha ftype = VM_PROT_WRITE;
437 1.51 rearnsha else if ((insn & 0x0fb00ff0) == 0x01000090)/* SWP */
438 1.51 rearnsha ftype = VM_PROT_READ | VM_PROT_WRITE;
439 1.51 rearnsha else
440 1.51 rearnsha ftype = VM_PROT_READ;
441 1.51 rearnsha }
442 1.39 scw }
443 1.39 scw
444 1.39 scw /*
445 1.39 scw * See if the fault is as a result of ref/mod emulation,
446 1.39 scw * or domain mismatch.
447 1.39 scw */
448 1.39 scw #ifdef DEBUG
449 1.39 scw last_fault_code = fsr;
450 1.1 chris #endif
451 1.42 briggs if (pmap_fault_fixup(map->pmap, va, ftype, user)) {
452 1.72 matt #ifdef KERN_SA
453 1.70 wrstuden if (map != kernel_map)
454 1.70 wrstuden l->l_pflag &= ~LP_SA_PAGEFAULT;
455 1.72 matt #endif
456 1.50 rearnsha UVMHIST_LOG(maphist, " <- ref/mod emul", 0, 0, 0, 0);
457 1.27 scw goto out;
458 1.42 briggs }
459 1.1 chris
460 1.67 matt if (__predict_false(curcpu()->ci_intr_depth > 0)) {
461 1.45 scw if (pcb->pcb_onfault) {
462 1.45 scw tf->tf_r0 = EINVAL;
463 1.45 scw tf->tf_pc = (register_t)(intptr_t) pcb->pcb_onfault;
464 1.45 scw return;
465 1.45 scw }
466 1.39 scw printf("\nNon-emulated page fault with intr_depth > 0\n");
467 1.39 scw dab_fatal(tf, fsr, far, l, NULL);
468 1.27 scw }
469 1.1 chris
470 1.27 scw onfault = pcb->pcb_onfault;
471 1.27 scw pcb->pcb_onfault = NULL;
472 1.57 he error = uvm_fault(map, va, ftype);
473 1.27 scw pcb->pcb_onfault = onfault;
474 1.39 scw
475 1.72 matt #ifdef KERN_SA
476 1.70 wrstuden if (map != kernel_map)
477 1.70 wrstuden l->l_pflag &= ~LP_SA_PAGEFAULT;
478 1.72 matt #endif
479 1.70 wrstuden
480 1.39 scw if (__predict_true(error == 0)) {
481 1.39 scw if (user)
482 1.39 scw uvm_grow(l->l_proc, va); /* Record any stack growth */
483 1.50 rearnsha UVMHIST_LOG(maphist, " <- uvm", 0, 0, 0, 0);
484 1.27 scw goto out;
485 1.27 scw }
486 1.39 scw
487 1.27 scw if (user == 0) {
488 1.27 scw if (pcb->pcb_onfault) {
489 1.39 scw tf->tf_r0 = error;
490 1.39 scw tf->tf_pc = (register_t)(intptr_t) pcb->pcb_onfault;
491 1.39 scw return;
492 1.1 chris }
493 1.39 scw
494 1.58 drochner printf("\nuvm_fault(%p, %lx, %x) -> %x\n", map, va, ftype,
495 1.39 scw error);
496 1.39 scw dab_fatal(tf, fsr, far, l, NULL);
497 1.27 scw }
498 1.1 chris
499 1.43 scw KSI_INIT_TRAP(&ksi);
500 1.43 scw
501 1.39 scw if (error == ENOMEM) {
502 1.39 scw printf("UVM: pid %d (%s), uid %d killed: "
503 1.39 scw "out of swap\n", l->l_proc->p_pid, l->l_proc->p_comm,
504 1.62 ad l->l_cred ? kauth_cred_geteuid(l->l_cred) : -1);
505 1.43 scw ksi.ksi_signo = SIGKILL;
506 1.43 scw } else
507 1.43 scw ksi.ksi_signo = SIGSEGV;
508 1.34 matt
509 1.39 scw ksi.ksi_code = (error == EACCES) ? SEGV_ACCERR : SEGV_MAPERR;
510 1.39 scw ksi.ksi_addr = (u_int32_t *)(intptr_t) far;
511 1.39 scw ksi.ksi_trap = fsr;
512 1.69 is UVMHIST_LOG(maphist, " <- error (%d)", error, 0, 0, 0);
513 1.39 scw
514 1.39 scw do_trapsignal:
515 1.39 scw call_trapsignal(l, &ksi);
516 1.39 scw out:
517 1.39 scw /* If returning to user mode, make sure to invoke userret() */
518 1.39 scw if (user)
519 1.39 scw userret(l);
520 1.39 scw }
521 1.39 scw
522 1.39 scw /*
523 1.39 scw * dab_fatal() handles the following data aborts:
524 1.39 scw *
525 1.39 scw * FAULT_WRTBUF_0 - Vector Exception
526 1.39 scw * FAULT_WRTBUF_1 - Terminal Exception
527 1.39 scw *
528 1.39 scw * We should never see these on a properly functioning system.
529 1.39 scw *
530 1.39 scw * This function is also called by the other handlers if they
531 1.39 scw * detect a fatal problem.
532 1.39 scw *
533 1.39 scw * Note: If 'l' is NULL, we assume we're dealing with a prefetch abort.
534 1.39 scw */
535 1.39 scw static int
536 1.39 scw dab_fatal(trapframe_t *tf, u_int fsr, u_int far, struct lwp *l, ksiginfo_t *ksi)
537 1.39 scw {
538 1.39 scw const char *mode;
539 1.39 scw
540 1.39 scw mode = TRAP_USERMODE(tf) ? "user" : "kernel";
541 1.39 scw
542 1.39 scw if (l != NULL) {
543 1.39 scw printf("Fatal %s mode data abort: '%s'\n", mode,
544 1.39 scw data_aborts[fsr & FAULT_TYPE_MASK].desc);
545 1.44 scw printf("trapframe: %p\nFSR=%08x, FAR=", tf, fsr);
546 1.39 scw if ((fsr & FAULT_IMPRECISE) == 0)
547 1.44 scw printf("%08x, ", far);
548 1.39 scw else
549 1.44 scw printf("Invalid, ");
550 1.44 scw printf("spsr=%08x\n", tf->tf_spsr);
551 1.39 scw } else {
552 1.44 scw printf("Fatal %s mode prefetch abort at 0x%08x\n",
553 1.44 scw mode, tf->tf_pc);
554 1.44 scw printf("trapframe: %p, spsr=%08x\n", tf, tf->tf_spsr);
555 1.44 scw }
556 1.44 scw
557 1.44 scw printf("r0 =%08x, r1 =%08x, r2 =%08x, r3 =%08x\n",
558 1.44 scw tf->tf_r0, tf->tf_r1, tf->tf_r2, tf->tf_r3);
559 1.44 scw printf("r4 =%08x, r5 =%08x, r6 =%08x, r7 =%08x\n",
560 1.44 scw tf->tf_r4, tf->tf_r5, tf->tf_r6, tf->tf_r7);
561 1.44 scw printf("r8 =%08x, r9 =%08x, r10=%08x, r11=%08x\n",
562 1.44 scw tf->tf_r8, tf->tf_r9, tf->tf_r10, tf->tf_r11);
563 1.44 scw printf("r12=%08x, ", tf->tf_r12);
564 1.44 scw
565 1.44 scw if (TRAP_USERMODE(tf))
566 1.44 scw printf("usp=%08x, ulr=%08x",
567 1.44 scw tf->tf_usr_sp, tf->tf_usr_lr);
568 1.44 scw else
569 1.44 scw printf("ssp=%08x, slr=%08x",
570 1.44 scw tf->tf_svc_sp, tf->tf_svc_lr);
571 1.44 scw printf(", pc =%08x\n\n", tf->tf_pc);
572 1.34 matt
573 1.39 scw #if defined(DDB) || defined(KGDB)
574 1.39 scw kdb_trap(T_FAULT, tf);
575 1.34 matt #endif
576 1.39 scw panic("Fatal abort");
577 1.39 scw /*NOTREACHED*/
578 1.39 scw }
579 1.39 scw
580 1.39 scw /*
581 1.39 scw * dab_align() handles the following data aborts:
582 1.39 scw *
583 1.39 scw * FAULT_ALIGN_0 - Alignment fault
584 1.39 scw * FAULT_ALIGN_0 - Alignment fault
585 1.39 scw *
586 1.39 scw * These faults are fatal if they happen in kernel mode. Otherwise, we
587 1.39 scw * deliver a bus error to the process.
588 1.39 scw */
589 1.39 scw static int
590 1.39 scw dab_align(trapframe_t *tf, u_int fsr, u_int far, struct lwp *l, ksiginfo_t *ksi)
591 1.39 scw {
592 1.73 rmind struct pcb *pcb = lwp_getpcb(l);
593 1.39 scw
594 1.39 scw /* Alignment faults are always fatal if they occur in kernel mode */
595 1.39 scw if (!TRAP_USERMODE(tf))
596 1.39 scw dab_fatal(tf, fsr, far, l, NULL);
597 1.39 scw
598 1.39 scw /* pcb_onfault *must* be NULL at this point */
599 1.73 rmind KDASSERT(pcb->pcb_onfault == NULL);
600 1.39 scw
601 1.48 wiz /* See if the CPU state needs to be fixed up */
602 1.39 scw (void) data_abort_fixup(tf, fsr, far, l);
603 1.39 scw
604 1.39 scw /* Deliver a bus error signal to the process */
605 1.39 scw KSI_INIT_TRAP(ksi);
606 1.39 scw ksi->ksi_signo = SIGBUS;
607 1.39 scw ksi->ksi_code = BUS_ADRALN;
608 1.39 scw ksi->ksi_addr = (u_int32_t *)(intptr_t)far;
609 1.39 scw ksi->ksi_trap = fsr;
610 1.39 scw
611 1.73 rmind pcb->pcb_tf = tf;
612 1.39 scw
613 1.39 scw return (1);
614 1.39 scw }
615 1.39 scw
616 1.39 scw /*
617 1.39 scw * dab_buserr() handles the following data aborts:
618 1.39 scw *
619 1.39 scw * FAULT_BUSERR_0 - External Abort on Linefetch -- Section
620 1.39 scw * FAULT_BUSERR_1 - External Abort on Linefetch -- Page
621 1.39 scw * FAULT_BUSERR_2 - External Abort on Non-linefetch -- Section
622 1.39 scw * FAULT_BUSERR_3 - External Abort on Non-linefetch -- Page
623 1.39 scw * FAULT_BUSTRNL1 - External abort on Translation -- Level 1
624 1.39 scw * FAULT_BUSTRNL2 - External abort on Translation -- Level 2
625 1.39 scw *
626 1.39 scw * If pcb_onfault is set, flag the fault and return to the handler.
627 1.39 scw * If the fault occurred in user mode, give the process a SIGBUS.
628 1.39 scw *
629 1.39 scw * Note: On XScale, FAULT_BUSERR_0, FAULT_BUSERR_1, and FAULT_BUSERR_2
630 1.39 scw * can be flagged as imprecise in the FSR. This causes a real headache
631 1.39 scw * since some of the machine state is lost. In this case, tf->tf_pc
632 1.39 scw * may not actually point to the offending instruction. In fact, if
633 1.39 scw * we've taken a double abort fault, it generally points somewhere near
634 1.39 scw * the top of "data_abort_entry" in exception.S.
635 1.39 scw *
636 1.39 scw * In all other cases, these data aborts are considered fatal.
637 1.39 scw */
638 1.39 scw static int
639 1.39 scw dab_buserr(trapframe_t *tf, u_int fsr, u_int far, struct lwp *l,
640 1.39 scw ksiginfo_t *ksi)
641 1.39 scw {
642 1.73 rmind struct pcb *pcb = lwp_getpcb(l);
643 1.39 scw
644 1.39 scw #ifdef __XSCALE__
645 1.39 scw if ((fsr & FAULT_IMPRECISE) != 0 &&
646 1.39 scw (tf->tf_spsr & PSR_MODE) == PSR_ABT32_MODE) {
647 1.39 scw /*
648 1.39 scw * Oops, an imprecise, double abort fault. We've lost the
649 1.39 scw * r14_abt/spsr_abt values corresponding to the original
650 1.39 scw * abort, and the spsr saved in the trapframe indicates
651 1.39 scw * ABT mode.
652 1.39 scw */
653 1.39 scw tf->tf_spsr &= ~PSR_MODE;
654 1.39 scw
655 1.39 scw /*
656 1.39 scw * We use a simple heuristic to determine if the double abort
657 1.39 scw * happened as a result of a kernel or user mode access.
658 1.39 scw * If the current trapframe is at the top of the kernel stack,
659 1.39 scw * the fault _must_ have come from user mode.
660 1.39 scw */
661 1.39 scw if (tf != ((trapframe_t *)pcb->pcb_un.un_32.pcb32_sp) - 1) {
662 1.39 scw /*
663 1.39 scw * Kernel mode. We're either about to die a
664 1.39 scw * spectacular death, or pcb_onfault will come
665 1.39 scw * to our rescue. Either way, the current value
666 1.39 scw * of tf->tf_pc is irrelevant.
667 1.39 scw */
668 1.39 scw tf->tf_spsr |= PSR_SVC32_MODE;
669 1.39 scw if (pcb->pcb_onfault == NULL)
670 1.39 scw printf("\nKernel mode double abort!\n");
671 1.39 scw } else {
672 1.39 scw /*
673 1.39 scw * User mode. We've lost the program counter at the
674 1.39 scw * time of the fault (not that it was accurate anyway;
675 1.39 scw * it's not called an imprecise fault for nothing).
676 1.39 scw * About all we can do is copy r14_usr to tf_pc and
677 1.39 scw * hope for the best. The process is about to get a
678 1.39 scw * SIGBUS, so it's probably history anyway.
679 1.39 scw */
680 1.39 scw tf->tf_spsr |= PSR_USR32_MODE;
681 1.39 scw tf->tf_pc = tf->tf_usr_lr;
682 1.51 rearnsha #ifdef THUMB_CODE
683 1.51 rearnsha tf->tf_spsr &= ~PSR_T_bit;
684 1.51 rearnsha if (tf->tf_usr_lr & 1)
685 1.51 rearnsha tf->tf_spsr |= PSR_T_bit;
686 1.51 rearnsha #endif
687 1.39 scw }
688 1.39 scw }
689 1.39 scw
690 1.39 scw /* FAR is invalid for imprecise exceptions */
691 1.39 scw if ((fsr & FAULT_IMPRECISE) != 0)
692 1.39 scw far = 0;
693 1.39 scw #endif /* __XSCALE__ */
694 1.39 scw
695 1.39 scw if (pcb->pcb_onfault) {
696 1.39 scw KDASSERT(TRAP_USERMODE(tf) == 0);
697 1.39 scw tf->tf_r0 = EFAULT;
698 1.39 scw tf->tf_pc = (register_t)(intptr_t) pcb->pcb_onfault;
699 1.39 scw return (0);
700 1.39 scw }
701 1.39 scw
702 1.48 wiz /* See if the CPU state needs to be fixed up */
703 1.39 scw (void) data_abort_fixup(tf, fsr, far, l);
704 1.39 scw
705 1.39 scw /*
706 1.39 scw * At this point, if the fault happened in kernel mode, we're toast
707 1.39 scw */
708 1.39 scw if (!TRAP_USERMODE(tf))
709 1.39 scw dab_fatal(tf, fsr, far, l, NULL);
710 1.39 scw
711 1.39 scw /* Deliver a bus error signal to the process */
712 1.39 scw KSI_INIT_TRAP(ksi);
713 1.39 scw ksi->ksi_signo = SIGBUS;
714 1.39 scw ksi->ksi_code = BUS_ADRERR;
715 1.39 scw ksi->ksi_addr = (u_int32_t *)(intptr_t)far;
716 1.39 scw ksi->ksi_trap = fsr;
717 1.39 scw
718 1.73 rmind pcb->pcb_tf = tf;
719 1.27 scw
720 1.39 scw return (1);
721 1.1 chris }
722 1.1 chris
723 1.56 perry static inline int
724 1.39 scw prefetch_abort_fixup(trapframe_t *tf)
725 1.39 scw {
726 1.39 scw #ifdef CPU_ABORT_FIXUP_REQUIRED
727 1.39 scw int error;
728 1.39 scw
729 1.48 wiz /* Call the CPU specific prefetch abort fixup routine */
730 1.39 scw error = cpu_prefetchabt_fixup(tf);
731 1.39 scw if (__predict_true(error != ABORT_FIXUP_FAILED))
732 1.39 scw return (error);
733 1.39 scw
734 1.39 scw /*
735 1.39 scw * Oops, couldn't fix up the instruction
736 1.39 scw */
737 1.39 scw printf(
738 1.39 scw "prefetch_abort_fixup: fixup for %s mode prefetch abort failed.\n",
739 1.39 scw TRAP_USERMODE(tf) ? "user" : "kernel");
740 1.51 rearnsha #ifdef THUMB_CODE
741 1.51 rearnsha if (tf->tf_spsr & PSR_T_bit) {
742 1.51 rearnsha printf("pc = 0x%08x, opcode 0x%04x, 0x%04x, insn = ",
743 1.75 wiz tf->tf_pc, *((u_int16 *)(tf->tf_pc & ~1)),
744 1.75 wiz *((u_int16 *)((tf->tf_pc + 2) & ~1)));
745 1.51 rearnsha }
746 1.51 rearnsha else
747 1.51 rearnsha #endif
748 1.51 rearnsha {
749 1.51 rearnsha printf("pc = 0x%08x, opcode 0x%08x, insn = ", tf->tf_pc,
750 1.51 rearnsha *((u_int *)tf->tf_pc));
751 1.51 rearnsha }
752 1.39 scw disassemble(tf->tf_pc);
753 1.39 scw
754 1.39 scw /* Die now if this happened in kernel mode */
755 1.39 scw if (!TRAP_USERMODE(tf))
756 1.39 scw dab_fatal(tf, 0, tf->tf_pc, NULL, NULL);
757 1.39 scw
758 1.39 scw return (error);
759 1.39 scw #else
760 1.39 scw return (ABORT_FIXUP_OK);
761 1.39 scw #endif /* CPU_ABORT_FIXUP_REQUIRED */
762 1.39 scw }
763 1.1 chris
764 1.1 chris /*
765 1.39 scw * void prefetch_abort_handler(trapframe_t *tf)
766 1.1 chris *
767 1.1 chris * Abort handler called when instruction execution occurs at
768 1.1 chris * a non existent or restricted (access permissions) memory page.
769 1.1 chris * If the address is invalid and we were in SVC mode then panic as
770 1.1 chris * the kernel should never prefetch abort.
771 1.1 chris * If the address is invalid and the page is mapped then the user process
772 1.1 chris * does no have read permission so send it a signal.
773 1.1 chris * Otherwise fault the page in and try again.
774 1.1 chris */
775 1.1 chris void
776 1.39 scw prefetch_abort_handler(trapframe_t *tf)
777 1.1 chris {
778 1.26 thorpej struct lwp *l;
779 1.73 rmind struct pcb *pcb;
780 1.14 thorpej struct vm_map *map;
781 1.14 thorpej vaddr_t fault_pc, va;
782 1.39 scw ksiginfo_t ksi;
783 1.61 ad int error, user;
784 1.39 scw
785 1.50 rearnsha UVMHIST_FUNC("prefetch_abort_handler"); UVMHIST_CALLED(maphist);
786 1.50 rearnsha
787 1.39 scw /* Update vmmeter statistics */
788 1.39 scw uvmexp.traps++;
789 1.1 chris
790 1.61 ad l = curlwp;
791 1.73 rmind pcb = lwp_getpcb(l);
792 1.61 ad
793 1.61 ad if ((user = TRAP_USERMODE(tf)) != 0)
794 1.61 ad LWP_CACHE_CREDS(l, l->l_proc);
795 1.61 ad
796 1.1 chris /*
797 1.1 chris * Enable IRQ's (disabled by the abort) This always comes
798 1.1 chris * from user mode so we know interrupts were not disabled.
799 1.1 chris * But we check anyway.
800 1.1 chris */
801 1.72 matt KASSERT(!TRAP_USERMODE(tf) || (tf->tf_spsr & IF32_bits) == 0);
802 1.72 matt if (__predict_true((tf->tf_spsr & I32_bit) != IF32_bits))
803 1.72 matt restore_interrupts(tf->tf_spsr & IF32_bits);
804 1.1 chris
805 1.48 wiz /* See if the CPU state needs to be fixed up */
806 1.39 scw switch (prefetch_abort_fixup(tf)) {
807 1.39 scw case ABORT_FIXUP_RETURN:
808 1.72 matt KASSERT(!TRAP_USERMODE(tf) || (tf->tf_spsr & IF32_bits) == 0);
809 1.1 chris return;
810 1.39 scw case ABORT_FIXUP_FAILED:
811 1.39 scw /* Deliver a SIGILL to the process */
812 1.39 scw KSI_INIT_TRAP(&ksi);
813 1.39 scw ksi.ksi_signo = SIGILL;
814 1.39 scw ksi.ksi_code = ILL_ILLOPC;
815 1.39 scw ksi.ksi_addr = (u_int32_t *)(intptr_t) tf->tf_pc;
816 1.73 rmind pcb->pcb_tf = tf;
817 1.39 scw goto do_trapsignal;
818 1.39 scw default:
819 1.39 scw break;
820 1.1 chris }
821 1.1 chris
822 1.39 scw /* Prefetch aborts cannot happen in kernel mode */
823 1.61 ad if (__predict_false(!user))
824 1.39 scw dab_fatal(tf, 0, tf->tf_pc, NULL, NULL);
825 1.1 chris
826 1.4 thorpej /* Get fault address */
827 1.39 scw fault_pc = tf->tf_pc;
828 1.73 rmind pcb->pcb_tf = tf;
829 1.50 rearnsha UVMHIST_LOG(maphist, " (pc=0x%x, l=0x%x, tf=0x%x)", fault_pc, l, tf,
830 1.50 rearnsha 0);
831 1.14 thorpej
832 1.1 chris /* Ok validate the address, can only execute in USER space */
833 1.39 scw if (__predict_false(fault_pc >= VM_MAXUSER_ADDRESS ||
834 1.39 scw (fault_pc < VM_MIN_ADDRESS && vector_page == ARM_VECTORS_LOW))) {
835 1.35 thorpej KSI_INIT_TRAP(&ksi);
836 1.34 matt ksi.ksi_signo = SIGSEGV;
837 1.34 matt ksi.ksi_code = SEGV_ACCERR;
838 1.39 scw ksi.ksi_addr = (u_int32_t *)(intptr_t) fault_pc;
839 1.34 matt ksi.ksi_trap = fault_pc;
840 1.39 scw goto do_trapsignal;
841 1.39 scw }
842 1.34 matt
843 1.39 scw map = &l->l_proc->p_vmspace->vm_map;
844 1.39 scw va = trunc_page(fault_pc);
845 1.1 chris
846 1.27 scw /*
847 1.27 scw * See if the pmap can handle this fault on its own...
848 1.27 scw */
849 1.39 scw #ifdef DEBUG
850 1.39 scw last_fault_code = -1;
851 1.39 scw #endif
852 1.50 rearnsha if (pmap_fault_fixup(map->pmap, va, VM_PROT_READ, 1)) {
853 1.50 rearnsha UVMHIST_LOG (maphist, " <- emulated", 0, 0, 0, 0);
854 1.39 scw goto out;
855 1.50 rearnsha }
856 1.27 scw
857 1.39 scw #ifdef DIAGNOSTIC
858 1.67 matt if (__predict_false(l->l_cpu->ci_intr_depth > 0)) {
859 1.39 scw printf("\nNon-emulated prefetch abort with intr_depth > 0\n");
860 1.39 scw dab_fatal(tf, 0, tf->tf_pc, NULL, NULL);
861 1.39 scw }
862 1.1 chris #endif
863 1.72 matt
864 1.72 matt #ifdef KERN_SA
865 1.72 matt if (map != kernel_map && (l->l_flag & LW_SA)) {
866 1.70 wrstuden l->l_savp->savp_faultaddr = fault_pc;
867 1.70 wrstuden l->l_pflag |= LP_SA_PAGEFAULT;
868 1.70 wrstuden }
869 1.72 matt #endif
870 1.70 wrstuden
871 1.57 he error = uvm_fault(map, va, VM_PROT_READ);
872 1.53 joff
873 1.72 matt #ifdef KERN_SA
874 1.70 wrstuden if (map != kernel_map)
875 1.70 wrstuden l->l_pflag &= ~LP_SA_PAGEFAULT;
876 1.72 matt #endif
877 1.70 wrstuden
878 1.50 rearnsha if (__predict_true(error == 0)) {
879 1.50 rearnsha UVMHIST_LOG (maphist, " <- uvm", 0, 0, 0, 0);
880 1.39 scw goto out;
881 1.50 rearnsha }
882 1.43 scw KSI_INIT_TRAP(&ksi);
883 1.43 scw
884 1.50 rearnsha UVMHIST_LOG (maphist, " <- fatal (%d)", error, 0, 0, 0);
885 1.39 scw if (error == ENOMEM) {
886 1.39 scw printf("UVM: pid %d (%s), uid %d killed: "
887 1.39 scw "out of swap\n", l->l_proc->p_pid, l->l_proc->p_comm,
888 1.62 ad l->l_cred ? kauth_cred_geteuid(l->l_cred) : -1);
889 1.43 scw ksi.ksi_signo = SIGKILL;
890 1.43 scw } else
891 1.43 scw ksi.ksi_signo = SIGSEGV;
892 1.1 chris
893 1.39 scw ksi.ksi_code = SEGV_MAPERR;
894 1.39 scw ksi.ksi_addr = (u_int32_t *)(intptr_t) fault_pc;
895 1.39 scw ksi.ksi_trap = fault_pc;
896 1.39 scw
897 1.39 scw do_trapsignal:
898 1.39 scw call_trapsignal(l, &ksi);
899 1.39 scw
900 1.39 scw out:
901 1.72 matt KASSERT(!TRAP_USERMODE(tf) || (tf->tf_spsr & IF32_bits) == 0);
902 1.39 scw userret(l);
903 1.39 scw }
904 1.39 scw
905 1.39 scw /*
906 1.39 scw * Tentatively read an 8, 16, or 32-bit value from 'addr'.
907 1.39 scw * If the read succeeds, the value is written to 'rptr' and zero is returned.
908 1.39 scw * Else, return EFAULT.
909 1.39 scw */
910 1.39 scw int
911 1.39 scw badaddr_read(void *addr, size_t size, void *rptr)
912 1.39 scw {
913 1.39 scw extern int badaddr_read_1(const uint8_t *, uint8_t *);
914 1.39 scw extern int badaddr_read_2(const uint16_t *, uint16_t *);
915 1.39 scw extern int badaddr_read_4(const uint32_t *, uint32_t *);
916 1.39 scw union {
917 1.39 scw uint8_t v1;
918 1.39 scw uint16_t v2;
919 1.39 scw uint32_t v4;
920 1.39 scw } u;
921 1.47 scw struct pcb *curpcb_save;
922 1.47 scw int rv, s;
923 1.39 scw
924 1.39 scw cpu_drain_writebuf();
925 1.39 scw
926 1.47 scw /*
927 1.47 scw * We might be called at interrupt time, so arrange to steal
928 1.47 scw * lwp0's PCB temporarily, if required, so that pcb_onfault
929 1.47 scw * handling works correctly.
930 1.47 scw */
931 1.47 scw s = splhigh();
932 1.47 scw if ((curpcb_save = curpcb) == NULL)
933 1.73 rmind curpcb = lwp_getpcb(&lwp0);
934 1.47 scw
935 1.39 scw /* Read from the test address. */
936 1.39 scw switch (size) {
937 1.39 scw case sizeof(uint8_t):
938 1.39 scw rv = badaddr_read_1(addr, &u.v1);
939 1.39 scw if (rv == 0 && rptr)
940 1.39 scw *(uint8_t *) rptr = u.v1;
941 1.39 scw break;
942 1.39 scw
943 1.39 scw case sizeof(uint16_t):
944 1.39 scw rv = badaddr_read_2(addr, &u.v2);
945 1.39 scw if (rv == 0 && rptr)
946 1.39 scw *(uint16_t *) rptr = u.v2;
947 1.39 scw break;
948 1.39 scw
949 1.39 scw case sizeof(uint32_t):
950 1.39 scw rv = badaddr_read_4(addr, &u.v4);
951 1.39 scw if (rv == 0 && rptr)
952 1.39 scw *(uint32_t *) rptr = u.v4;
953 1.39 scw break;
954 1.39 scw
955 1.39 scw default:
956 1.47 scw curpcb = curpcb_save;
957 1.39 scw panic("badaddr: invalid size (%lu)", (u_long) size);
958 1.34 matt }
959 1.39 scw
960 1.47 scw /* Restore curpcb */
961 1.47 scw curpcb = curpcb_save;
962 1.47 scw splx(s);
963 1.47 scw
964 1.39 scw /* Return EFAULT if the address was invalid, else zero */
965 1.39 scw return (rv);
966 1.1 chris }
967