fault.c revision 1.72 1 /* $NetBSD: fault.c,v 1.72 2008/11/19 06:32:58 matt Exp $ */
2
3 /*
4 * Copyright 2003 Wasabi Systems, Inc.
5 * All rights reserved.
6 *
7 * Written by Steve C. Woodford for Wasabi Systems, Inc.
8 *
9 * Redistribution and use in source and binary forms, with or without
10 * modification, are permitted provided that the following conditions
11 * are met:
12 * 1. Redistributions of source code must retain the above copyright
13 * notice, this list of conditions and the following disclaimer.
14 * 2. Redistributions in binary form must reproduce the above copyright
15 * notice, this list of conditions and the following disclaimer in the
16 * documentation and/or other materials provided with the distribution.
17 * 3. All advertising materials mentioning features or use of this software
18 * must display the following acknowledgement:
19 * This product includes software developed for the NetBSD Project by
20 * Wasabi Systems, Inc.
21 * 4. The name of Wasabi Systems, Inc. may not be used to endorse
22 * or promote products derived from this software without specific prior
23 * written permission.
24 *
25 * THIS SOFTWARE IS PROVIDED BY WASABI SYSTEMS, INC. ``AS IS'' AND
26 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
27 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
28 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL WASABI SYSTEMS, INC
29 * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
30 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
31 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
32 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
33 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
34 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
35 * POSSIBILITY OF SUCH DAMAGE.
36 */
37 /*
38 * Copyright (c) 1994-1997 Mark Brinicombe.
39 * Copyright (c) 1994 Brini.
40 * All rights reserved.
41 *
42 * This code is derived from software written for Brini by Mark Brinicombe
43 *
44 * Redistribution and use in source and binary forms, with or without
45 * modification, are permitted provided that the following conditions
46 * are met:
47 * 1. Redistributions of source code must retain the above copyright
48 * notice, this list of conditions and the following disclaimer.
49 * 2. Redistributions in binary form must reproduce the above copyright
50 * notice, this list of conditions and the following disclaimer in the
51 * documentation and/or other materials provided with the distribution.
52 * 3. All advertising materials mentioning features or use of this software
53 * must display the following acknowledgement:
54 * This product includes software developed by Brini.
55 * 4. The name of the company nor the name of the author may be used to
56 * endorse or promote products derived from this software without specific
57 * prior written permission.
58 *
59 * THIS SOFTWARE IS PROVIDED BY BRINI ``AS IS'' AND ANY EXPRESS OR IMPLIED
60 * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
61 * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
62 * IN NO EVENT SHALL BRINI OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT,
63 * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
64 * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
65 * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
66 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
67 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
68 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
69 * SUCH DAMAGE.
70 *
71 * RiscBSD kernel project
72 *
73 * fault.c
74 *
75 * Fault handlers
76 *
77 * Created : 28/11/94
78 */
79
80 #include "opt_ddb.h"
81 #include "opt_kgdb.h"
82 #include "opt_sa.h"
83
84 #include <sys/types.h>
85 __KERNEL_RCSID(0, "$NetBSD: fault.c,v 1.72 2008/11/19 06:32:58 matt Exp $");
86
87 #include <sys/param.h>
88 #include <sys/systm.h>
89 #include <sys/proc.h>
90 #include <sys/user.h>
91 #include <sys/kernel.h>
92 #include <sys/kauth.h>
93
94 #include <sys/savar.h>
95 #include <sys/cpu.h>
96
97 #include <uvm/uvm_extern.h>
98 #include <uvm/uvm_stat.h>
99 #ifdef UVMHIST
100 #include <uvm/uvm.h>
101 #endif
102
103 #include <arm/cpuconf.h>
104
105 #include <machine/frame.h>
106 #include <arm/arm32/katelib.h>
107 #include <machine/intr.h>
108 #if defined(DDB) || defined(KGDB)
109 #include <machine/db_machdep.h>
110 #ifdef KGDB
111 #include <sys/kgdb.h>
112 #endif
113 #if !defined(DDB)
114 #define kdb_trap kgdb_trap
115 #endif
116 #endif
117
118 #include <arch/arm/arm/disassem.h>
119 #include <arm/arm32/machdep.h>
120
121 extern char fusubailout[];
122
123 #ifdef DEBUG
124 int last_fault_code; /* For the benefit of pmap_fault_fixup() */
125 #endif
126
127 #if defined(CPU_ARM3) || defined(CPU_ARM6) || \
128 defined(CPU_ARM7) || defined(CPU_ARM7TDMI)
129 /* These CPUs may need data/prefetch abort fixups */
130 #define CPU_ABORT_FIXUP_REQUIRED
131 #endif
132
133 struct data_abort {
134 int (*func)(trapframe_t *, u_int, u_int, struct lwp *, ksiginfo_t *);
135 const char *desc;
136 };
137
138 static int dab_fatal(trapframe_t *, u_int, u_int, struct lwp *, ksiginfo_t *);
139 static int dab_align(trapframe_t *, u_int, u_int, struct lwp *, ksiginfo_t *);
140 static int dab_buserr(trapframe_t *, u_int, u_int, struct lwp *, ksiginfo_t *);
141
142 static const struct data_abort data_aborts[] = {
143 {dab_fatal, "Vector Exception"},
144 {dab_align, "Alignment Fault 1"},
145 {dab_fatal, "Terminal Exception"},
146 {dab_align, "Alignment Fault 3"},
147 {dab_buserr, "External Linefetch Abort (S)"},
148 {NULL, "Translation Fault (S)"},
149 {dab_buserr, "External Linefetch Abort (P)"},
150 {NULL, "Translation Fault (P)"},
151 {dab_buserr, "External Non-Linefetch Abort (S)"},
152 {NULL, "Domain Fault (S)"},
153 {dab_buserr, "External Non-Linefetch Abort (P)"},
154 {NULL, "Domain Fault (P)"},
155 {dab_buserr, "External Translation Abort (L1)"},
156 {NULL, "Permission Fault (S)"},
157 {dab_buserr, "External Translation Abort (L2)"},
158 {NULL, "Permission Fault (P)"}
159 };
160
161 /* Determine if a fault came from user mode */
162 #define TRAP_USERMODE(tf) ((tf->tf_spsr & PSR_MODE) == PSR_USR32_MODE)
163
164 /* Determine if 'x' is a permission fault */
165 #define IS_PERMISSION_FAULT(x) \
166 (((1 << ((x) & FAULT_TYPE_MASK)) & \
167 ((1 << FAULT_PERM_P) | (1 << FAULT_PERM_S))) != 0)
168
169 #if 0
170 /* maybe one day we'll do emulations */
171 #define TRAPSIGNAL(l,k) (*(l)->l_proc->p_emul->e_trapsignal)((l), (k))
172 #else
173 #define TRAPSIGNAL(l,k) trapsignal((l), (k))
174 #endif
175
176 static inline void
177 call_trapsignal(struct lwp *l, ksiginfo_t *ksi)
178 {
179
180 TRAPSIGNAL(l, ksi);
181 }
182
183 static inline int
184 data_abort_fixup(trapframe_t *tf, u_int fsr, u_int far, struct lwp *l)
185 {
186 #ifdef CPU_ABORT_FIXUP_REQUIRED
187 int error;
188
189 /* Call the CPU specific data abort fixup routine */
190 error = cpu_dataabt_fixup(tf);
191 if (__predict_true(error != ABORT_FIXUP_FAILED))
192 return (error);
193
194 /*
195 * Oops, couldn't fix up the instruction
196 */
197 printf("data_abort_fixup: fixup for %s mode data abort failed.\n",
198 TRAP_USERMODE(tf) ? "user" : "kernel");
199 #ifdef THUMB_CODE
200 if (tf->tf_spsr & PSR_T_bit) {
201 printf("pc = 0x%08x, opcode 0x%04x, 0x%04x, insn = ",
202 tf->tf_pc, *((u_int16 *)(tf->tf_pc & ~1)),
203 *((u_int16 *)((tf->tf_pc + 2) & ~1)));
204 }
205 else
206 #endif
207 {
208 printf("pc = 0x%08x, opcode 0x%08x, insn = ", tf->tf_pc,
209 *((u_int *)tf->tf_pc));
210 }
211 disassemble(tf->tf_pc);
212
213 /* Die now if this happened in kernel mode */
214 if (!TRAP_USERMODE(tf))
215 dab_fatal(tf, fsr, far, l, NULL);
216
217 return (error);
218 #else
219 return (ABORT_FIXUP_OK);
220 #endif /* CPU_ABORT_FIXUP_REQUIRED */
221 }
222
223 void
224 data_abort_handler(trapframe_t *tf)
225 {
226 struct vm_map *map;
227 struct pcb *pcb;
228 struct lwp *l;
229 u_int user, far, fsr;
230 vm_prot_t ftype;
231 void *onfault;
232 vaddr_t va;
233 int error;
234 ksiginfo_t ksi;
235
236 UVMHIST_FUNC("data_abort_handler");
237
238 /* Grab FAR/FSR before enabling interrupts */
239 far = cpu_faultaddress();
240 fsr = cpu_faultstatus();
241
242 UVMHIST_CALLED(maphist);
243 /* Update vmmeter statistics */
244 uvmexp.traps++;
245
246 /* Re-enable interrupts if they were enabled previously */
247 KASSERT(!TRAP_USERMODE(tf) || (tf->tf_spsr & IF32_bits) == 0);
248 if (__predict_true((tf->tf_spsr & IF32_bits) != IF32_bits))
249 restore_interrupts(tf->tf_spsr & IF32_bits);
250
251 /* Get the current lwp structure */
252 KASSERT(curlwp != NULL);
253 l = curlwp;
254
255 UVMHIST_LOG(maphist, " (pc=0x%x, l=0x%x, far=0x%x, fsr=0x%x)",
256 tf->tf_pc, l, far, fsr);
257
258 /* Data abort came from user mode? */
259 if ((user = TRAP_USERMODE(tf)) != 0)
260 LWP_CACHE_CREDS(l, l->l_proc);
261
262 /* Grab the current pcb */
263 pcb = &l->l_addr->u_pcb;
264
265 /* Invoke the appropriate handler, if necessary */
266 if (__predict_false(data_aborts[fsr & FAULT_TYPE_MASK].func != NULL)) {
267 if ((data_aborts[fsr & FAULT_TYPE_MASK].func)(tf, fsr, far,
268 l, &ksi))
269 goto do_trapsignal;
270 goto out;
271 }
272
273 /*
274 * At this point, we're dealing with one of the following data aborts:
275 *
276 * FAULT_TRANS_S - Translation -- Section
277 * FAULT_TRANS_P - Translation -- Page
278 * FAULT_DOMAIN_S - Domain -- Section
279 * FAULT_DOMAIN_P - Domain -- Page
280 * FAULT_PERM_S - Permission -- Section
281 * FAULT_PERM_P - Permission -- Page
282 *
283 * These are the main virtual memory-related faults signalled by
284 * the MMU.
285 */
286
287 /* fusubailout is used by [fs]uswintr to avoid page faulting */
288 if (__predict_false(pcb->pcb_onfault == fusubailout)) {
289 tf->tf_r0 = EFAULT;
290 tf->tf_pc = (register_t)(intptr_t) pcb->pcb_onfault;
291 return;
292 }
293
294 if (user)
295 l->l_addr->u_pcb.pcb_tf = tf;
296
297 /*
298 * Make sure the Program Counter is sane. We could fall foul of
299 * someone executing Thumb code, in which case the PC might not
300 * be word-aligned. This would cause a kernel alignment fault
301 * further down if we have to decode the current instruction.
302 */
303 #ifdef THUMB_CODE
304 /*
305 * XXX: It would be nice to be able to support Thumb in the kernel
306 * at some point.
307 */
308 if (__predict_false(!user && (tf->tf_pc & 3) != 0)) {
309 printf("\ndata_abort_fault: Misaligned Kernel-mode "
310 "Program Counter\n");
311 dab_fatal(tf, fsr, far, l, NULL);
312 }
313 #else
314 if (__predict_false((tf->tf_pc & 3) != 0)) {
315 if (user) {
316 /*
317 * Give the user an illegal instruction signal.
318 */
319 /* Deliver a SIGILL to the process */
320 KSI_INIT_TRAP(&ksi);
321 ksi.ksi_signo = SIGILL;
322 ksi.ksi_code = ILL_ILLOPC;
323 ksi.ksi_addr = (u_int32_t *)(intptr_t) far;
324 ksi.ksi_trap = fsr;
325 goto do_trapsignal;
326 }
327
328 /*
329 * The kernel never executes Thumb code.
330 */
331 printf("\ndata_abort_fault: Misaligned Kernel-mode "
332 "Program Counter\n");
333 dab_fatal(tf, fsr, far, l, NULL);
334 }
335 #endif
336
337 /* See if the CPU state needs to be fixed up */
338 switch (data_abort_fixup(tf, fsr, far, l)) {
339 case ABORT_FIXUP_RETURN:
340 return;
341 case ABORT_FIXUP_FAILED:
342 /* Deliver a SIGILL to the process */
343 KSI_INIT_TRAP(&ksi);
344 ksi.ksi_signo = SIGILL;
345 ksi.ksi_code = ILL_ILLOPC;
346 ksi.ksi_addr = (u_int32_t *)(intptr_t) far;
347 ksi.ksi_trap = fsr;
348 goto do_trapsignal;
349 default:
350 break;
351 }
352
353 va = trunc_page((vaddr_t)far);
354
355 /*
356 * It is only a kernel address space fault iff:
357 * 1. user == 0 and
358 * 2. pcb_onfault not set or
359 * 3. pcb_onfault set and not LDRT/LDRBT/STRT/STRBT instruction.
360 */
361 if (user == 0 && (va >= VM_MIN_KERNEL_ADDRESS ||
362 (va < VM_MIN_ADDRESS && vector_page == ARM_VECTORS_LOW)) &&
363 __predict_true((pcb->pcb_onfault == NULL ||
364 (ReadWord(tf->tf_pc) & 0x05200000) != 0x04200000))) {
365 map = kernel_map;
366
367 /* Was the fault due to the FPE/IPKDB ? */
368 if (__predict_false((tf->tf_spsr & PSR_MODE)==PSR_UND32_MODE)) {
369 KSI_INIT_TRAP(&ksi);
370 ksi.ksi_signo = SIGSEGV;
371 ksi.ksi_code = SEGV_ACCERR;
372 ksi.ksi_addr = (u_int32_t *)(intptr_t) far;
373 ksi.ksi_trap = fsr;
374
375 /*
376 * Force exit via userret()
377 * This is necessary as the FPE is an extension to
378 * userland that actually runs in a priveledged mode
379 * but uses USR mode permissions for its accesses.
380 */
381 user = 1;
382 goto do_trapsignal;
383 }
384 } else {
385 map = &l->l_proc->p_vmspace->vm_map;
386 #ifdef KERN_SA
387 if ((l->l_flag & LW_SA) && (~l->l_pflag & LP_SA_NOBLOCK)) {
388 l->l_savp->savp_faultaddr = (vaddr_t)far;
389 l->l_pflag |= LP_SA_PAGEFAULT;
390 }
391 #endif
392 }
393
394 /*
395 * We need to know whether the page should be mapped
396 * as R or R/W. The MMU does not give us the info as
397 * to whether the fault was caused by a read or a write.
398 *
399 * However, we know that a permission fault can only be
400 * the result of a write to a read-only location, so
401 * we can deal with those quickly.
402 *
403 * Otherwise we need to disassemble the instruction
404 * responsible to determine if it was a write.
405 */
406 if (IS_PERMISSION_FAULT(fsr))
407 ftype = VM_PROT_WRITE;
408 else {
409 #ifdef THUMB_CODE
410 /* Fast track the ARM case. */
411 if (__predict_false(tf->tf_spsr & PSR_T_bit)) {
412 u_int insn = fusword((void *)(tf->tf_pc & ~1));
413 u_int insn_f8 = insn & 0xf800;
414 u_int insn_fe = insn & 0xfe00;
415
416 if (insn_f8 == 0x6000 || /* STR(1) */
417 insn_f8 == 0x7000 || /* STRB(1) */
418 insn_f8 == 0x8000 || /* STRH(1) */
419 insn_f8 == 0x9000 || /* STR(3) */
420 insn_f8 == 0xc000 || /* STM */
421 insn_fe == 0x5000 || /* STR(2) */
422 insn_fe == 0x5200 || /* STRH(2) */
423 insn_fe == 0x5400) /* STRB(2) */
424 ftype = VM_PROT_WRITE;
425 else
426 ftype = VM_PROT_READ;
427 }
428 else
429 #endif
430 {
431 u_int insn = ReadWord(tf->tf_pc);
432
433 if (((insn & 0x0c100000) == 0x04000000) || /* STR[B] */
434 ((insn & 0x0e1000b0) == 0x000000b0) || /* STR[HD]*/
435 ((insn & 0x0a100000) == 0x08000000)) /* STM/CDT*/
436 ftype = VM_PROT_WRITE;
437 else if ((insn & 0x0fb00ff0) == 0x01000090)/* SWP */
438 ftype = VM_PROT_READ | VM_PROT_WRITE;
439 else
440 ftype = VM_PROT_READ;
441 }
442 }
443
444 /*
445 * See if the fault is as a result of ref/mod emulation,
446 * or domain mismatch.
447 */
448 #ifdef DEBUG
449 last_fault_code = fsr;
450 #endif
451 if (pmap_fault_fixup(map->pmap, va, ftype, user)) {
452 #ifdef KERN_SA
453 if (map != kernel_map)
454 l->l_pflag &= ~LP_SA_PAGEFAULT;
455 #endif
456 UVMHIST_LOG(maphist, " <- ref/mod emul", 0, 0, 0, 0);
457 goto out;
458 }
459
460 if (__predict_false(curcpu()->ci_intr_depth > 0)) {
461 if (pcb->pcb_onfault) {
462 tf->tf_r0 = EINVAL;
463 tf->tf_pc = (register_t)(intptr_t) pcb->pcb_onfault;
464 return;
465 }
466 printf("\nNon-emulated page fault with intr_depth > 0\n");
467 dab_fatal(tf, fsr, far, l, NULL);
468 }
469
470 onfault = pcb->pcb_onfault;
471 pcb->pcb_onfault = NULL;
472 error = uvm_fault(map, va, ftype);
473 pcb->pcb_onfault = onfault;
474
475 #ifdef KERN_SA
476 if (map != kernel_map)
477 l->l_pflag &= ~LP_SA_PAGEFAULT;
478 #endif
479
480 if (__predict_true(error == 0)) {
481 if (user)
482 uvm_grow(l->l_proc, va); /* Record any stack growth */
483 UVMHIST_LOG(maphist, " <- uvm", 0, 0, 0, 0);
484 goto out;
485 }
486
487 if (user == 0) {
488 if (pcb->pcb_onfault) {
489 tf->tf_r0 = error;
490 tf->tf_pc = (register_t)(intptr_t) pcb->pcb_onfault;
491 return;
492 }
493
494 printf("\nuvm_fault(%p, %lx, %x) -> %x\n", map, va, ftype,
495 error);
496 dab_fatal(tf, fsr, far, l, NULL);
497 }
498
499 KSI_INIT_TRAP(&ksi);
500
501 if (error == ENOMEM) {
502 printf("UVM: pid %d (%s), uid %d killed: "
503 "out of swap\n", l->l_proc->p_pid, l->l_proc->p_comm,
504 l->l_cred ? kauth_cred_geteuid(l->l_cred) : -1);
505 ksi.ksi_signo = SIGKILL;
506 } else
507 ksi.ksi_signo = SIGSEGV;
508
509 ksi.ksi_code = (error == EACCES) ? SEGV_ACCERR : SEGV_MAPERR;
510 ksi.ksi_addr = (u_int32_t *)(intptr_t) far;
511 ksi.ksi_trap = fsr;
512 UVMHIST_LOG(maphist, " <- error (%d)", error, 0, 0, 0);
513
514 do_trapsignal:
515 call_trapsignal(l, &ksi);
516 out:
517 /* If returning to user mode, make sure to invoke userret() */
518 if (user)
519 userret(l);
520 }
521
522 /*
523 * dab_fatal() handles the following data aborts:
524 *
525 * FAULT_WRTBUF_0 - Vector Exception
526 * FAULT_WRTBUF_1 - Terminal Exception
527 *
528 * We should never see these on a properly functioning system.
529 *
530 * This function is also called by the other handlers if they
531 * detect a fatal problem.
532 *
533 * Note: If 'l' is NULL, we assume we're dealing with a prefetch abort.
534 */
535 static int
536 dab_fatal(trapframe_t *tf, u_int fsr, u_int far, struct lwp *l, ksiginfo_t *ksi)
537 {
538 const char *mode;
539
540 mode = TRAP_USERMODE(tf) ? "user" : "kernel";
541
542 if (l != NULL) {
543 printf("Fatal %s mode data abort: '%s'\n", mode,
544 data_aborts[fsr & FAULT_TYPE_MASK].desc);
545 printf("trapframe: %p\nFSR=%08x, FAR=", tf, fsr);
546 if ((fsr & FAULT_IMPRECISE) == 0)
547 printf("%08x, ", far);
548 else
549 printf("Invalid, ");
550 printf("spsr=%08x\n", tf->tf_spsr);
551 } else {
552 printf("Fatal %s mode prefetch abort at 0x%08x\n",
553 mode, tf->tf_pc);
554 printf("trapframe: %p, spsr=%08x\n", tf, tf->tf_spsr);
555 }
556
557 printf("r0 =%08x, r1 =%08x, r2 =%08x, r3 =%08x\n",
558 tf->tf_r0, tf->tf_r1, tf->tf_r2, tf->tf_r3);
559 printf("r4 =%08x, r5 =%08x, r6 =%08x, r7 =%08x\n",
560 tf->tf_r4, tf->tf_r5, tf->tf_r6, tf->tf_r7);
561 printf("r8 =%08x, r9 =%08x, r10=%08x, r11=%08x\n",
562 tf->tf_r8, tf->tf_r9, tf->tf_r10, tf->tf_r11);
563 printf("r12=%08x, ", tf->tf_r12);
564
565 if (TRAP_USERMODE(tf))
566 printf("usp=%08x, ulr=%08x",
567 tf->tf_usr_sp, tf->tf_usr_lr);
568 else
569 printf("ssp=%08x, slr=%08x",
570 tf->tf_svc_sp, tf->tf_svc_lr);
571 printf(", pc =%08x\n\n", tf->tf_pc);
572
573 #if defined(DDB) || defined(KGDB)
574 kdb_trap(T_FAULT, tf);
575 #endif
576 panic("Fatal abort");
577 /*NOTREACHED*/
578 }
579
580 /*
581 * dab_align() handles the following data aborts:
582 *
583 * FAULT_ALIGN_0 - Alignment fault
584 * FAULT_ALIGN_0 - Alignment fault
585 *
586 * These faults are fatal if they happen in kernel mode. Otherwise, we
587 * deliver a bus error to the process.
588 */
589 static int
590 dab_align(trapframe_t *tf, u_int fsr, u_int far, struct lwp *l, ksiginfo_t *ksi)
591 {
592
593 /* Alignment faults are always fatal if they occur in kernel mode */
594 if (!TRAP_USERMODE(tf))
595 dab_fatal(tf, fsr, far, l, NULL);
596
597 /* pcb_onfault *must* be NULL at this point */
598 KDASSERT(l->l_addr->u_pcb.pcb_onfault == NULL);
599
600 /* See if the CPU state needs to be fixed up */
601 (void) data_abort_fixup(tf, fsr, far, l);
602
603 /* Deliver a bus error signal to the process */
604 KSI_INIT_TRAP(ksi);
605 ksi->ksi_signo = SIGBUS;
606 ksi->ksi_code = BUS_ADRALN;
607 ksi->ksi_addr = (u_int32_t *)(intptr_t)far;
608 ksi->ksi_trap = fsr;
609
610 l->l_addr->u_pcb.pcb_tf = tf;
611
612 return (1);
613 }
614
615 /*
616 * dab_buserr() handles the following data aborts:
617 *
618 * FAULT_BUSERR_0 - External Abort on Linefetch -- Section
619 * FAULT_BUSERR_1 - External Abort on Linefetch -- Page
620 * FAULT_BUSERR_2 - External Abort on Non-linefetch -- Section
621 * FAULT_BUSERR_3 - External Abort on Non-linefetch -- Page
622 * FAULT_BUSTRNL1 - External abort on Translation -- Level 1
623 * FAULT_BUSTRNL2 - External abort on Translation -- Level 2
624 *
625 * If pcb_onfault is set, flag the fault and return to the handler.
626 * If the fault occurred in user mode, give the process a SIGBUS.
627 *
628 * Note: On XScale, FAULT_BUSERR_0, FAULT_BUSERR_1, and FAULT_BUSERR_2
629 * can be flagged as imprecise in the FSR. This causes a real headache
630 * since some of the machine state is lost. In this case, tf->tf_pc
631 * may not actually point to the offending instruction. In fact, if
632 * we've taken a double abort fault, it generally points somewhere near
633 * the top of "data_abort_entry" in exception.S.
634 *
635 * In all other cases, these data aborts are considered fatal.
636 */
637 static int
638 dab_buserr(trapframe_t *tf, u_int fsr, u_int far, struct lwp *l,
639 ksiginfo_t *ksi)
640 {
641 struct pcb *pcb = &l->l_addr->u_pcb;
642
643 #ifdef __XSCALE__
644 if ((fsr & FAULT_IMPRECISE) != 0 &&
645 (tf->tf_spsr & PSR_MODE) == PSR_ABT32_MODE) {
646 /*
647 * Oops, an imprecise, double abort fault. We've lost the
648 * r14_abt/spsr_abt values corresponding to the original
649 * abort, and the spsr saved in the trapframe indicates
650 * ABT mode.
651 */
652 tf->tf_spsr &= ~PSR_MODE;
653
654 /*
655 * We use a simple heuristic to determine if the double abort
656 * happened as a result of a kernel or user mode access.
657 * If the current trapframe is at the top of the kernel stack,
658 * the fault _must_ have come from user mode.
659 */
660 if (tf != ((trapframe_t *)pcb->pcb_un.un_32.pcb32_sp) - 1) {
661 /*
662 * Kernel mode. We're either about to die a
663 * spectacular death, or pcb_onfault will come
664 * to our rescue. Either way, the current value
665 * of tf->tf_pc is irrelevant.
666 */
667 tf->tf_spsr |= PSR_SVC32_MODE;
668 if (pcb->pcb_onfault == NULL)
669 printf("\nKernel mode double abort!\n");
670 } else {
671 /*
672 * User mode. We've lost the program counter at the
673 * time of the fault (not that it was accurate anyway;
674 * it's not called an imprecise fault for nothing).
675 * About all we can do is copy r14_usr to tf_pc and
676 * hope for the best. The process is about to get a
677 * SIGBUS, so it's probably history anyway.
678 */
679 tf->tf_spsr |= PSR_USR32_MODE;
680 tf->tf_pc = tf->tf_usr_lr;
681 #ifdef THUMB_CODE
682 tf->tf_spsr &= ~PSR_T_bit;
683 if (tf->tf_usr_lr & 1)
684 tf->tf_spsr |= PSR_T_bit;
685 #endif
686 }
687 }
688
689 /* FAR is invalid for imprecise exceptions */
690 if ((fsr & FAULT_IMPRECISE) != 0)
691 far = 0;
692 #endif /* __XSCALE__ */
693
694 if (pcb->pcb_onfault) {
695 KDASSERT(TRAP_USERMODE(tf) == 0);
696 tf->tf_r0 = EFAULT;
697 tf->tf_pc = (register_t)(intptr_t) pcb->pcb_onfault;
698 return (0);
699 }
700
701 /* See if the CPU state needs to be fixed up */
702 (void) data_abort_fixup(tf, fsr, far, l);
703
704 /*
705 * At this point, if the fault happened in kernel mode, we're toast
706 */
707 if (!TRAP_USERMODE(tf))
708 dab_fatal(tf, fsr, far, l, NULL);
709
710 /* Deliver a bus error signal to the process */
711 KSI_INIT_TRAP(ksi);
712 ksi->ksi_signo = SIGBUS;
713 ksi->ksi_code = BUS_ADRERR;
714 ksi->ksi_addr = (u_int32_t *)(intptr_t)far;
715 ksi->ksi_trap = fsr;
716
717 l->l_addr->u_pcb.pcb_tf = tf;
718
719 return (1);
720 }
721
722 static inline int
723 prefetch_abort_fixup(trapframe_t *tf)
724 {
725 #ifdef CPU_ABORT_FIXUP_REQUIRED
726 int error;
727
728 /* Call the CPU specific prefetch abort fixup routine */
729 error = cpu_prefetchabt_fixup(tf);
730 if (__predict_true(error != ABORT_FIXUP_FAILED))
731 return (error);
732
733 /*
734 * Oops, couldn't fix up the instruction
735 */
736 printf(
737 "prefetch_abort_fixup: fixup for %s mode prefetch abort failed.\n",
738 TRAP_USERMODE(tf) ? "user" : "kernel");
739 #ifdef THUMB_CODE
740 if (tf->tf_spsr & PSR_T_bit) {
741 printf("pc = 0x%08x, opcode 0x%04x, 0x%04x, insn = ",
742 tf->tf_pc, *((u_int16 *)(tf->tf_pc & ~1),
743 *((u_int16 *)((tf->tf_pc + 2) & ~1));
744 }
745 else
746 #endif
747 {
748 printf("pc = 0x%08x, opcode 0x%08x, insn = ", tf->tf_pc,
749 *((u_int *)tf->tf_pc));
750 }
751 disassemble(tf->tf_pc);
752
753 /* Die now if this happened in kernel mode */
754 if (!TRAP_USERMODE(tf))
755 dab_fatal(tf, 0, tf->tf_pc, NULL, NULL);
756
757 return (error);
758 #else
759 return (ABORT_FIXUP_OK);
760 #endif /* CPU_ABORT_FIXUP_REQUIRED */
761 }
762
763 /*
764 * void prefetch_abort_handler(trapframe_t *tf)
765 *
766 * Abort handler called when instruction execution occurs at
767 * a non existent or restricted (access permissions) memory page.
768 * If the address is invalid and we were in SVC mode then panic as
769 * the kernel should never prefetch abort.
770 * If the address is invalid and the page is mapped then the user process
771 * does no have read permission so send it a signal.
772 * Otherwise fault the page in and try again.
773 */
774 void
775 prefetch_abort_handler(trapframe_t *tf)
776 {
777 struct lwp *l;
778 struct vm_map *map;
779 vaddr_t fault_pc, va;
780 ksiginfo_t ksi;
781 int error, user;
782
783 UVMHIST_FUNC("prefetch_abort_handler"); UVMHIST_CALLED(maphist);
784
785 /* Update vmmeter statistics */
786 uvmexp.traps++;
787
788 l = curlwp;
789
790 if ((user = TRAP_USERMODE(tf)) != 0)
791 LWP_CACHE_CREDS(l, l->l_proc);
792
793 /*
794 * Enable IRQ's (disabled by the abort) This always comes
795 * from user mode so we know interrupts were not disabled.
796 * But we check anyway.
797 */
798 KASSERT(!TRAP_USERMODE(tf) || (tf->tf_spsr & IF32_bits) == 0);
799 if (__predict_true((tf->tf_spsr & I32_bit) != IF32_bits))
800 restore_interrupts(tf->tf_spsr & IF32_bits);
801
802 /* See if the CPU state needs to be fixed up */
803 switch (prefetch_abort_fixup(tf)) {
804 case ABORT_FIXUP_RETURN:
805 KASSERT(!TRAP_USERMODE(tf) || (tf->tf_spsr & IF32_bits) == 0);
806 return;
807 case ABORT_FIXUP_FAILED:
808 /* Deliver a SIGILL to the process */
809 KSI_INIT_TRAP(&ksi);
810 ksi.ksi_signo = SIGILL;
811 ksi.ksi_code = ILL_ILLOPC;
812 ksi.ksi_addr = (u_int32_t *)(intptr_t) tf->tf_pc;
813 l->l_addr->u_pcb.pcb_tf = tf;
814 goto do_trapsignal;
815 default:
816 break;
817 }
818
819 /* Prefetch aborts cannot happen in kernel mode */
820 if (__predict_false(!user))
821 dab_fatal(tf, 0, tf->tf_pc, NULL, NULL);
822
823 /* Get fault address */
824 fault_pc = tf->tf_pc;
825 l = curlwp;
826 l->l_addr->u_pcb.pcb_tf = tf;
827 UVMHIST_LOG(maphist, " (pc=0x%x, l=0x%x, tf=0x%x)", fault_pc, l, tf,
828 0);
829
830 /* Ok validate the address, can only execute in USER space */
831 if (__predict_false(fault_pc >= VM_MAXUSER_ADDRESS ||
832 (fault_pc < VM_MIN_ADDRESS && vector_page == ARM_VECTORS_LOW))) {
833 KSI_INIT_TRAP(&ksi);
834 ksi.ksi_signo = SIGSEGV;
835 ksi.ksi_code = SEGV_ACCERR;
836 ksi.ksi_addr = (u_int32_t *)(intptr_t) fault_pc;
837 ksi.ksi_trap = fault_pc;
838 goto do_trapsignal;
839 }
840
841 map = &l->l_proc->p_vmspace->vm_map;
842 va = trunc_page(fault_pc);
843
844 /*
845 * See if the pmap can handle this fault on its own...
846 */
847 #ifdef DEBUG
848 last_fault_code = -1;
849 #endif
850 if (pmap_fault_fixup(map->pmap, va, VM_PROT_READ, 1)) {
851 UVMHIST_LOG (maphist, " <- emulated", 0, 0, 0, 0);
852 goto out;
853 }
854
855 #ifdef DIAGNOSTIC
856 if (__predict_false(l->l_cpu->ci_intr_depth > 0)) {
857 printf("\nNon-emulated prefetch abort with intr_depth > 0\n");
858 dab_fatal(tf, 0, tf->tf_pc, NULL, NULL);
859 }
860 #endif
861
862 #ifdef KERN_SA
863 if (map != kernel_map && (l->l_flag & LW_SA)) {
864 l->l_savp->savp_faultaddr = fault_pc;
865 l->l_pflag |= LP_SA_PAGEFAULT;
866 }
867 #endif
868
869 error = uvm_fault(map, va, VM_PROT_READ);
870
871 #ifdef KERN_SA
872 if (map != kernel_map)
873 l->l_pflag &= ~LP_SA_PAGEFAULT;
874 #endif
875
876 if (__predict_true(error == 0)) {
877 UVMHIST_LOG (maphist, " <- uvm", 0, 0, 0, 0);
878 goto out;
879 }
880 KSI_INIT_TRAP(&ksi);
881
882 UVMHIST_LOG (maphist, " <- fatal (%d)", error, 0, 0, 0);
883 if (error == ENOMEM) {
884 printf("UVM: pid %d (%s), uid %d killed: "
885 "out of swap\n", l->l_proc->p_pid, l->l_proc->p_comm,
886 l->l_cred ? kauth_cred_geteuid(l->l_cred) : -1);
887 ksi.ksi_signo = SIGKILL;
888 } else
889 ksi.ksi_signo = SIGSEGV;
890
891 ksi.ksi_code = SEGV_MAPERR;
892 ksi.ksi_addr = (u_int32_t *)(intptr_t) fault_pc;
893 ksi.ksi_trap = fault_pc;
894
895 do_trapsignal:
896 call_trapsignal(l, &ksi);
897
898 out:
899 KASSERT(!TRAP_USERMODE(tf) || (tf->tf_spsr & IF32_bits) == 0);
900 userret(l);
901 }
902
903 /*
904 * Tentatively read an 8, 16, or 32-bit value from 'addr'.
905 * If the read succeeds, the value is written to 'rptr' and zero is returned.
906 * Else, return EFAULT.
907 */
908 int
909 badaddr_read(void *addr, size_t size, void *rptr)
910 {
911 extern int badaddr_read_1(const uint8_t *, uint8_t *);
912 extern int badaddr_read_2(const uint16_t *, uint16_t *);
913 extern int badaddr_read_4(const uint32_t *, uint32_t *);
914 union {
915 uint8_t v1;
916 uint16_t v2;
917 uint32_t v4;
918 } u;
919 struct pcb *curpcb_save;
920 int rv, s;
921
922 cpu_drain_writebuf();
923
924 /*
925 * We might be called at interrupt time, so arrange to steal
926 * lwp0's PCB temporarily, if required, so that pcb_onfault
927 * handling works correctly.
928 */
929 s = splhigh();
930 if ((curpcb_save = curpcb) == NULL)
931 curpcb = &lwp0.l_addr->u_pcb;
932
933 /* Read from the test address. */
934 switch (size) {
935 case sizeof(uint8_t):
936 rv = badaddr_read_1(addr, &u.v1);
937 if (rv == 0 && rptr)
938 *(uint8_t *) rptr = u.v1;
939 break;
940
941 case sizeof(uint16_t):
942 rv = badaddr_read_2(addr, &u.v2);
943 if (rv == 0 && rptr)
944 *(uint16_t *) rptr = u.v2;
945 break;
946
947 case sizeof(uint32_t):
948 rv = badaddr_read_4(addr, &u.v4);
949 if (rv == 0 && rptr)
950 *(uint32_t *) rptr = u.v4;
951 break;
952
953 default:
954 curpcb = curpcb_save;
955 panic("badaddr: invalid size (%lu)", (u_long) size);
956 }
957
958 /* Restore curpcb */
959 curpcb = curpcb_save;
960 splx(s);
961
962 /* Return EFAULT if the address was invalid, else zero */
963 return (rv);
964 }
965