Home | History | Annotate | Line # | Download | only in arm32
fault.c revision 1.72
      1 /*	$NetBSD: fault.c,v 1.72 2008/11/19 06:32:58 matt Exp $	*/
      2 
      3 /*
      4  * Copyright 2003 Wasabi Systems, Inc.
      5  * All rights reserved.
      6  *
      7  * Written by Steve C. Woodford for Wasabi Systems, Inc.
      8  *
      9  * Redistribution and use in source and binary forms, with or without
     10  * modification, are permitted provided that the following conditions
     11  * are met:
     12  * 1. Redistributions of source code must retain the above copyright
     13  *    notice, this list of conditions and the following disclaimer.
     14  * 2. Redistributions in binary form must reproduce the above copyright
     15  *    notice, this list of conditions and the following disclaimer in the
     16  *    documentation and/or other materials provided with the distribution.
     17  * 3. All advertising materials mentioning features or use of this software
     18  *    must display the following acknowledgement:
     19  *      This product includes software developed for the NetBSD Project by
     20  *      Wasabi Systems, Inc.
     21  * 4. The name of Wasabi Systems, Inc. may not be used to endorse
     22  *    or promote products derived from this software without specific prior
     23  *    written permission.
     24  *
     25  * THIS SOFTWARE IS PROVIDED BY WASABI SYSTEMS, INC. ``AS IS'' AND
     26  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
     27  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
     28  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL WASABI SYSTEMS, INC
     29  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
     30  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
     31  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
     32  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
     33  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
     34  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
     35  * POSSIBILITY OF SUCH DAMAGE.
     36  */
     37 /*
     38  * Copyright (c) 1994-1997 Mark Brinicombe.
     39  * Copyright (c) 1994 Brini.
     40  * All rights reserved.
     41  *
     42  * This code is derived from software written for Brini by Mark Brinicombe
     43  *
     44  * Redistribution and use in source and binary forms, with or without
     45  * modification, are permitted provided that the following conditions
     46  * are met:
     47  * 1. Redistributions of source code must retain the above copyright
     48  *    notice, this list of conditions and the following disclaimer.
     49  * 2. Redistributions in binary form must reproduce the above copyright
     50  *    notice, this list of conditions and the following disclaimer in the
     51  *    documentation and/or other materials provided with the distribution.
     52  * 3. All advertising materials mentioning features or use of this software
     53  *    must display the following acknowledgement:
     54  *	This product includes software developed by Brini.
     55  * 4. The name of the company nor the name of the author may be used to
     56  *    endorse or promote products derived from this software without specific
     57  *    prior written permission.
     58  *
     59  * THIS SOFTWARE IS PROVIDED BY BRINI ``AS IS'' AND ANY EXPRESS OR IMPLIED
     60  * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
     61  * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
     62  * IN NO EVENT SHALL BRINI OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT,
     63  * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
     64  * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
     65  * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
     66  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
     67  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
     68  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
     69  * SUCH DAMAGE.
     70  *
     71  * RiscBSD kernel project
     72  *
     73  * fault.c
     74  *
     75  * Fault handlers
     76  *
     77  * Created      : 28/11/94
     78  */
     79 
     80 #include "opt_ddb.h"
     81 #include "opt_kgdb.h"
     82 #include "opt_sa.h"
     83 
     84 #include <sys/types.h>
     85 __KERNEL_RCSID(0, "$NetBSD: fault.c,v 1.72 2008/11/19 06:32:58 matt Exp $");
     86 
     87 #include <sys/param.h>
     88 #include <sys/systm.h>
     89 #include <sys/proc.h>
     90 #include <sys/user.h>
     91 #include <sys/kernel.h>
     92 #include <sys/kauth.h>
     93 
     94 #include <sys/savar.h>
     95 #include <sys/cpu.h>
     96 
     97 #include <uvm/uvm_extern.h>
     98 #include <uvm/uvm_stat.h>
     99 #ifdef UVMHIST
    100 #include <uvm/uvm.h>
    101 #endif
    102 
    103 #include <arm/cpuconf.h>
    104 
    105 #include <machine/frame.h>
    106 #include <arm/arm32/katelib.h>
    107 #include <machine/intr.h>
    108 #if defined(DDB) || defined(KGDB)
    109 #include <machine/db_machdep.h>
    110 #ifdef KGDB
    111 #include <sys/kgdb.h>
    112 #endif
    113 #if !defined(DDB)
    114 #define kdb_trap	kgdb_trap
    115 #endif
    116 #endif
    117 
    118 #include <arch/arm/arm/disassem.h>
    119 #include <arm/arm32/machdep.h>
    120 
    121 extern char fusubailout[];
    122 
    123 #ifdef DEBUG
    124 int last_fault_code;	/* For the benefit of pmap_fault_fixup() */
    125 #endif
    126 
    127 #if defined(CPU_ARM3) || defined(CPU_ARM6) || \
    128     defined(CPU_ARM7) || defined(CPU_ARM7TDMI)
    129 /* These CPUs may need data/prefetch abort fixups */
    130 #define	CPU_ABORT_FIXUP_REQUIRED
    131 #endif
    132 
    133 struct data_abort {
    134 	int (*func)(trapframe_t *, u_int, u_int, struct lwp *, ksiginfo_t *);
    135 	const char *desc;
    136 };
    137 
    138 static int dab_fatal(trapframe_t *, u_int, u_int, struct lwp *, ksiginfo_t *);
    139 static int dab_align(trapframe_t *, u_int, u_int, struct lwp *, ksiginfo_t *);
    140 static int dab_buserr(trapframe_t *, u_int, u_int, struct lwp *, ksiginfo_t *);
    141 
    142 static const struct data_abort data_aborts[] = {
    143 	{dab_fatal,	"Vector Exception"},
    144 	{dab_align,	"Alignment Fault 1"},
    145 	{dab_fatal,	"Terminal Exception"},
    146 	{dab_align,	"Alignment Fault 3"},
    147 	{dab_buserr,	"External Linefetch Abort (S)"},
    148 	{NULL,		"Translation Fault (S)"},
    149 	{dab_buserr,	"External Linefetch Abort (P)"},
    150 	{NULL,		"Translation Fault (P)"},
    151 	{dab_buserr,	"External Non-Linefetch Abort (S)"},
    152 	{NULL,		"Domain Fault (S)"},
    153 	{dab_buserr,	"External Non-Linefetch Abort (P)"},
    154 	{NULL,		"Domain Fault (P)"},
    155 	{dab_buserr,	"External Translation Abort (L1)"},
    156 	{NULL,		"Permission Fault (S)"},
    157 	{dab_buserr,	"External Translation Abort (L2)"},
    158 	{NULL,		"Permission Fault (P)"}
    159 };
    160 
    161 /* Determine if a fault came from user mode */
    162 #define	TRAP_USERMODE(tf)	((tf->tf_spsr & PSR_MODE) == PSR_USR32_MODE)
    163 
    164 /* Determine if 'x' is a permission fault */
    165 #define	IS_PERMISSION_FAULT(x)					\
    166 	(((1 << ((x) & FAULT_TYPE_MASK)) &			\
    167 	  ((1 << FAULT_PERM_P) | (1 << FAULT_PERM_S))) != 0)
    168 
    169 #if 0
    170 /* maybe one day we'll do emulations */
    171 #define	TRAPSIGNAL(l,k)	(*(l)->l_proc->p_emul->e_trapsignal)((l), (k))
    172 #else
    173 #define	TRAPSIGNAL(l,k)	trapsignal((l), (k))
    174 #endif
    175 
    176 static inline void
    177 call_trapsignal(struct lwp *l, ksiginfo_t *ksi)
    178 {
    179 
    180 	TRAPSIGNAL(l, ksi);
    181 }
    182 
    183 static inline int
    184 data_abort_fixup(trapframe_t *tf, u_int fsr, u_int far, struct lwp *l)
    185 {
    186 #ifdef CPU_ABORT_FIXUP_REQUIRED
    187 	int error;
    188 
    189 	/* Call the CPU specific data abort fixup routine */
    190 	error = cpu_dataabt_fixup(tf);
    191 	if (__predict_true(error != ABORT_FIXUP_FAILED))
    192 		return (error);
    193 
    194 	/*
    195 	 * Oops, couldn't fix up the instruction
    196 	 */
    197 	printf("data_abort_fixup: fixup for %s mode data abort failed.\n",
    198 	    TRAP_USERMODE(tf) ? "user" : "kernel");
    199 #ifdef THUMB_CODE
    200 	if (tf->tf_spsr & PSR_T_bit) {
    201 		printf("pc = 0x%08x, opcode 0x%04x, 0x%04x, insn = ",
    202 		    tf->tf_pc, *((u_int16 *)(tf->tf_pc & ~1)),
    203 		    *((u_int16 *)((tf->tf_pc + 2) & ~1)));
    204 	}
    205 	else
    206 #endif
    207 	{
    208 		printf("pc = 0x%08x, opcode 0x%08x, insn = ", tf->tf_pc,
    209 		    *((u_int *)tf->tf_pc));
    210 	}
    211 	disassemble(tf->tf_pc);
    212 
    213 	/* Die now if this happened in kernel mode */
    214 	if (!TRAP_USERMODE(tf))
    215 		dab_fatal(tf, fsr, far, l, NULL);
    216 
    217 	return (error);
    218 #else
    219 	return (ABORT_FIXUP_OK);
    220 #endif /* CPU_ABORT_FIXUP_REQUIRED */
    221 }
    222 
    223 void
    224 data_abort_handler(trapframe_t *tf)
    225 {
    226 	struct vm_map *map;
    227 	struct pcb *pcb;
    228 	struct lwp *l;
    229 	u_int user, far, fsr;
    230 	vm_prot_t ftype;
    231 	void *onfault;
    232 	vaddr_t va;
    233 	int error;
    234 	ksiginfo_t ksi;
    235 
    236 	UVMHIST_FUNC("data_abort_handler");
    237 
    238 	/* Grab FAR/FSR before enabling interrupts */
    239 	far = cpu_faultaddress();
    240 	fsr = cpu_faultstatus();
    241 
    242 	UVMHIST_CALLED(maphist);
    243 	/* Update vmmeter statistics */
    244 	uvmexp.traps++;
    245 
    246 	/* Re-enable interrupts if they were enabled previously */
    247 	KASSERT(!TRAP_USERMODE(tf) || (tf->tf_spsr & IF32_bits) == 0);
    248 	if (__predict_true((tf->tf_spsr & IF32_bits) != IF32_bits))
    249 		restore_interrupts(tf->tf_spsr & IF32_bits);
    250 
    251 	/* Get the current lwp structure */
    252 	KASSERT(curlwp != NULL);
    253 	l = curlwp;
    254 
    255 	UVMHIST_LOG(maphist, " (pc=0x%x, l=0x%x, far=0x%x, fsr=0x%x)",
    256 	    tf->tf_pc, l, far, fsr);
    257 
    258 	/* Data abort came from user mode? */
    259 	if ((user = TRAP_USERMODE(tf)) != 0)
    260 		LWP_CACHE_CREDS(l, l->l_proc);
    261 
    262 	/* Grab the current pcb */
    263 	pcb = &l->l_addr->u_pcb;
    264 
    265 	/* Invoke the appropriate handler, if necessary */
    266 	if (__predict_false(data_aborts[fsr & FAULT_TYPE_MASK].func != NULL)) {
    267 		if ((data_aborts[fsr & FAULT_TYPE_MASK].func)(tf, fsr, far,
    268 		    l, &ksi))
    269 			goto do_trapsignal;
    270 		goto out;
    271 	}
    272 
    273 	/*
    274 	 * At this point, we're dealing with one of the following data aborts:
    275 	 *
    276 	 *  FAULT_TRANS_S  - Translation -- Section
    277 	 *  FAULT_TRANS_P  - Translation -- Page
    278 	 *  FAULT_DOMAIN_S - Domain -- Section
    279 	 *  FAULT_DOMAIN_P - Domain -- Page
    280 	 *  FAULT_PERM_S   - Permission -- Section
    281 	 *  FAULT_PERM_P   - Permission -- Page
    282 	 *
    283 	 * These are the main virtual memory-related faults signalled by
    284 	 * the MMU.
    285 	 */
    286 
    287 	/* fusubailout is used by [fs]uswintr to avoid page faulting */
    288 	if (__predict_false(pcb->pcb_onfault == fusubailout)) {
    289 		tf->tf_r0 = EFAULT;
    290 		tf->tf_pc = (register_t)(intptr_t) pcb->pcb_onfault;
    291 		return;
    292 	}
    293 
    294 	if (user)
    295 		l->l_addr->u_pcb.pcb_tf = tf;
    296 
    297 	/*
    298 	 * Make sure the Program Counter is sane. We could fall foul of
    299 	 * someone executing Thumb code, in which case the PC might not
    300 	 * be word-aligned. This would cause a kernel alignment fault
    301 	 * further down if we have to decode the current instruction.
    302 	 */
    303 #ifdef THUMB_CODE
    304 	/*
    305 	 * XXX: It would be nice to be able to support Thumb in the kernel
    306 	 * at some point.
    307 	 */
    308 	if (__predict_false(!user && (tf->tf_pc & 3) != 0)) {
    309 		printf("\ndata_abort_fault: Misaligned Kernel-mode "
    310 		    "Program Counter\n");
    311 		dab_fatal(tf, fsr, far, l, NULL);
    312 	}
    313 #else
    314 	if (__predict_false((tf->tf_pc & 3) != 0)) {
    315 		if (user) {
    316 			/*
    317 			 * Give the user an illegal instruction signal.
    318 			 */
    319 			/* Deliver a SIGILL to the process */
    320 			KSI_INIT_TRAP(&ksi);
    321 			ksi.ksi_signo = SIGILL;
    322 			ksi.ksi_code = ILL_ILLOPC;
    323 			ksi.ksi_addr = (u_int32_t *)(intptr_t) far;
    324 			ksi.ksi_trap = fsr;
    325 			goto do_trapsignal;
    326 		}
    327 
    328 		/*
    329 		 * The kernel never executes Thumb code.
    330 		 */
    331 		printf("\ndata_abort_fault: Misaligned Kernel-mode "
    332 		    "Program Counter\n");
    333 		dab_fatal(tf, fsr, far, l, NULL);
    334 	}
    335 #endif
    336 
    337 	/* See if the CPU state needs to be fixed up */
    338 	switch (data_abort_fixup(tf, fsr, far, l)) {
    339 	case ABORT_FIXUP_RETURN:
    340 		return;
    341 	case ABORT_FIXUP_FAILED:
    342 		/* Deliver a SIGILL to the process */
    343 		KSI_INIT_TRAP(&ksi);
    344 		ksi.ksi_signo = SIGILL;
    345 		ksi.ksi_code = ILL_ILLOPC;
    346 		ksi.ksi_addr = (u_int32_t *)(intptr_t) far;
    347 		ksi.ksi_trap = fsr;
    348 		goto do_trapsignal;
    349 	default:
    350 		break;
    351 	}
    352 
    353 	va = trunc_page((vaddr_t)far);
    354 
    355 	/*
    356 	 * It is only a kernel address space fault iff:
    357 	 *	1. user == 0  and
    358 	 *	2. pcb_onfault not set or
    359 	 *	3. pcb_onfault set and not LDRT/LDRBT/STRT/STRBT instruction.
    360 	 */
    361 	if (user == 0 && (va >= VM_MIN_KERNEL_ADDRESS ||
    362 	    (va < VM_MIN_ADDRESS && vector_page == ARM_VECTORS_LOW)) &&
    363 	    __predict_true((pcb->pcb_onfault == NULL ||
    364 	     (ReadWord(tf->tf_pc) & 0x05200000) != 0x04200000))) {
    365 		map = kernel_map;
    366 
    367 		/* Was the fault due to the FPE/IPKDB ? */
    368 		if (__predict_false((tf->tf_spsr & PSR_MODE)==PSR_UND32_MODE)) {
    369 			KSI_INIT_TRAP(&ksi);
    370 			ksi.ksi_signo = SIGSEGV;
    371 			ksi.ksi_code = SEGV_ACCERR;
    372 			ksi.ksi_addr = (u_int32_t *)(intptr_t) far;
    373 			ksi.ksi_trap = fsr;
    374 
    375 			/*
    376 			 * Force exit via userret()
    377 			 * This is necessary as the FPE is an extension to
    378 			 * userland that actually runs in a priveledged mode
    379 			 * but uses USR mode permissions for its accesses.
    380 			 */
    381 			user = 1;
    382 			goto do_trapsignal;
    383 		}
    384 	} else {
    385 		map = &l->l_proc->p_vmspace->vm_map;
    386 #ifdef KERN_SA
    387 		if ((l->l_flag & LW_SA) && (~l->l_pflag & LP_SA_NOBLOCK)) {
    388 			l->l_savp->savp_faultaddr = (vaddr_t)far;
    389 			l->l_pflag |= LP_SA_PAGEFAULT;
    390 		}
    391 #endif
    392 	}
    393 
    394 	/*
    395 	 * We need to know whether the page should be mapped
    396 	 * as R or R/W. The MMU does not give us the info as
    397 	 * to whether the fault was caused by a read or a write.
    398 	 *
    399 	 * However, we know that a permission fault can only be
    400 	 * the result of a write to a read-only location, so
    401 	 * we can deal with those quickly.
    402 	 *
    403 	 * Otherwise we need to disassemble the instruction
    404 	 * responsible to determine if it was a write.
    405 	 */
    406 	if (IS_PERMISSION_FAULT(fsr))
    407 		ftype = VM_PROT_WRITE;
    408 	else {
    409 #ifdef THUMB_CODE
    410 		/* Fast track the ARM case.  */
    411 		if (__predict_false(tf->tf_spsr & PSR_T_bit)) {
    412 			u_int insn = fusword((void *)(tf->tf_pc & ~1));
    413 			u_int insn_f8 = insn & 0xf800;
    414 			u_int insn_fe = insn & 0xfe00;
    415 
    416 			if (insn_f8 == 0x6000 || /* STR(1) */
    417 			    insn_f8 == 0x7000 || /* STRB(1) */
    418 			    insn_f8 == 0x8000 || /* STRH(1) */
    419 			    insn_f8 == 0x9000 || /* STR(3) */
    420 			    insn_f8 == 0xc000 || /* STM */
    421 			    insn_fe == 0x5000 || /* STR(2) */
    422 			    insn_fe == 0x5200 || /* STRH(2) */
    423 			    insn_fe == 0x5400)   /* STRB(2) */
    424 				ftype = VM_PROT_WRITE;
    425 			else
    426 				ftype = VM_PROT_READ;
    427 		}
    428 		else
    429 #endif
    430 		{
    431 			u_int insn = ReadWord(tf->tf_pc);
    432 
    433 			if (((insn & 0x0c100000) == 0x04000000) || /* STR[B] */
    434 			    ((insn & 0x0e1000b0) == 0x000000b0) || /* STR[HD]*/
    435 			    ((insn & 0x0a100000) == 0x08000000))   /* STM/CDT*/
    436 				ftype = VM_PROT_WRITE;
    437 			else if ((insn & 0x0fb00ff0) == 0x01000090)/* SWP */
    438 				ftype = VM_PROT_READ | VM_PROT_WRITE;
    439 			else
    440 				ftype = VM_PROT_READ;
    441 		}
    442 	}
    443 
    444 	/*
    445 	 * See if the fault is as a result of ref/mod emulation,
    446 	 * or domain mismatch.
    447 	 */
    448 #ifdef DEBUG
    449 	last_fault_code = fsr;
    450 #endif
    451 	if (pmap_fault_fixup(map->pmap, va, ftype, user)) {
    452 #ifdef KERN_SA
    453 		if (map != kernel_map)
    454 			l->l_pflag &= ~LP_SA_PAGEFAULT;
    455 #endif
    456 		UVMHIST_LOG(maphist, " <- ref/mod emul", 0, 0, 0, 0);
    457 		goto out;
    458 	}
    459 
    460 	if (__predict_false(curcpu()->ci_intr_depth > 0)) {
    461 		if (pcb->pcb_onfault) {
    462 			tf->tf_r0 = EINVAL;
    463 			tf->tf_pc = (register_t)(intptr_t) pcb->pcb_onfault;
    464 			return;
    465 		}
    466 		printf("\nNon-emulated page fault with intr_depth > 0\n");
    467 		dab_fatal(tf, fsr, far, l, NULL);
    468 	}
    469 
    470 	onfault = pcb->pcb_onfault;
    471 	pcb->pcb_onfault = NULL;
    472 	error = uvm_fault(map, va, ftype);
    473 	pcb->pcb_onfault = onfault;
    474 
    475 #ifdef KERN_SA
    476 	if (map != kernel_map)
    477 		l->l_pflag &= ~LP_SA_PAGEFAULT;
    478 #endif
    479 
    480 	if (__predict_true(error == 0)) {
    481 		if (user)
    482 			uvm_grow(l->l_proc, va); /* Record any stack growth */
    483 		UVMHIST_LOG(maphist, " <- uvm", 0, 0, 0, 0);
    484 		goto out;
    485 	}
    486 
    487 	if (user == 0) {
    488 		if (pcb->pcb_onfault) {
    489 			tf->tf_r0 = error;
    490 			tf->tf_pc = (register_t)(intptr_t) pcb->pcb_onfault;
    491 			return;
    492 		}
    493 
    494 		printf("\nuvm_fault(%p, %lx, %x) -> %x\n", map, va, ftype,
    495 		    error);
    496 		dab_fatal(tf, fsr, far, l, NULL);
    497 	}
    498 
    499 	KSI_INIT_TRAP(&ksi);
    500 
    501 	if (error == ENOMEM) {
    502 		printf("UVM: pid %d (%s), uid %d killed: "
    503 		    "out of swap\n", l->l_proc->p_pid, l->l_proc->p_comm,
    504 		    l->l_cred ? kauth_cred_geteuid(l->l_cred) : -1);
    505 		ksi.ksi_signo = SIGKILL;
    506 	} else
    507 		ksi.ksi_signo = SIGSEGV;
    508 
    509 	ksi.ksi_code = (error == EACCES) ? SEGV_ACCERR : SEGV_MAPERR;
    510 	ksi.ksi_addr = (u_int32_t *)(intptr_t) far;
    511 	ksi.ksi_trap = fsr;
    512 	UVMHIST_LOG(maphist, " <- error (%d)", error, 0, 0, 0);
    513 
    514 do_trapsignal:
    515 	call_trapsignal(l, &ksi);
    516 out:
    517 	/* If returning to user mode, make sure to invoke userret() */
    518 	if (user)
    519 		userret(l);
    520 }
    521 
    522 /*
    523  * dab_fatal() handles the following data aborts:
    524  *
    525  *  FAULT_WRTBUF_0 - Vector Exception
    526  *  FAULT_WRTBUF_1 - Terminal Exception
    527  *
    528  * We should never see these on a properly functioning system.
    529  *
    530  * This function is also called by the other handlers if they
    531  * detect a fatal problem.
    532  *
    533  * Note: If 'l' is NULL, we assume we're dealing with a prefetch abort.
    534  */
    535 static int
    536 dab_fatal(trapframe_t *tf, u_int fsr, u_int far, struct lwp *l, ksiginfo_t *ksi)
    537 {
    538 	const char *mode;
    539 
    540 	mode = TRAP_USERMODE(tf) ? "user" : "kernel";
    541 
    542 	if (l != NULL) {
    543 		printf("Fatal %s mode data abort: '%s'\n", mode,
    544 		    data_aborts[fsr & FAULT_TYPE_MASK].desc);
    545 		printf("trapframe: %p\nFSR=%08x, FAR=", tf, fsr);
    546 		if ((fsr & FAULT_IMPRECISE) == 0)
    547 			printf("%08x, ", far);
    548 		else
    549 			printf("Invalid,  ");
    550 		printf("spsr=%08x\n", tf->tf_spsr);
    551 	} else {
    552 		printf("Fatal %s mode prefetch abort at 0x%08x\n",
    553 		    mode, tf->tf_pc);
    554 		printf("trapframe: %p, spsr=%08x\n", tf, tf->tf_spsr);
    555 	}
    556 
    557 	printf("r0 =%08x, r1 =%08x, r2 =%08x, r3 =%08x\n",
    558 	    tf->tf_r0, tf->tf_r1, tf->tf_r2, tf->tf_r3);
    559 	printf("r4 =%08x, r5 =%08x, r6 =%08x, r7 =%08x\n",
    560 	    tf->tf_r4, tf->tf_r5, tf->tf_r6, tf->tf_r7);
    561 	printf("r8 =%08x, r9 =%08x, r10=%08x, r11=%08x\n",
    562 	    tf->tf_r8, tf->tf_r9, tf->tf_r10, tf->tf_r11);
    563 	printf("r12=%08x, ", tf->tf_r12);
    564 
    565 	if (TRAP_USERMODE(tf))
    566 		printf("usp=%08x, ulr=%08x",
    567 		    tf->tf_usr_sp, tf->tf_usr_lr);
    568 	else
    569 		printf("ssp=%08x, slr=%08x",
    570 		    tf->tf_svc_sp, tf->tf_svc_lr);
    571 	printf(", pc =%08x\n\n", tf->tf_pc);
    572 
    573 #if defined(DDB) || defined(KGDB)
    574 	kdb_trap(T_FAULT, tf);
    575 #endif
    576 	panic("Fatal abort");
    577 	/*NOTREACHED*/
    578 }
    579 
    580 /*
    581  * dab_align() handles the following data aborts:
    582  *
    583  *  FAULT_ALIGN_0 - Alignment fault
    584  *  FAULT_ALIGN_0 - Alignment fault
    585  *
    586  * These faults are fatal if they happen in kernel mode. Otherwise, we
    587  * deliver a bus error to the process.
    588  */
    589 static int
    590 dab_align(trapframe_t *tf, u_int fsr, u_int far, struct lwp *l, ksiginfo_t *ksi)
    591 {
    592 
    593 	/* Alignment faults are always fatal if they occur in kernel mode */
    594 	if (!TRAP_USERMODE(tf))
    595 		dab_fatal(tf, fsr, far, l, NULL);
    596 
    597 	/* pcb_onfault *must* be NULL at this point */
    598 	KDASSERT(l->l_addr->u_pcb.pcb_onfault == NULL);
    599 
    600 	/* See if the CPU state needs to be fixed up */
    601 	(void) data_abort_fixup(tf, fsr, far, l);
    602 
    603 	/* Deliver a bus error signal to the process */
    604 	KSI_INIT_TRAP(ksi);
    605 	ksi->ksi_signo = SIGBUS;
    606 	ksi->ksi_code = BUS_ADRALN;
    607 	ksi->ksi_addr = (u_int32_t *)(intptr_t)far;
    608 	ksi->ksi_trap = fsr;
    609 
    610 	l->l_addr->u_pcb.pcb_tf = tf;
    611 
    612 	return (1);
    613 }
    614 
    615 /*
    616  * dab_buserr() handles the following data aborts:
    617  *
    618  *  FAULT_BUSERR_0 - External Abort on Linefetch -- Section
    619  *  FAULT_BUSERR_1 - External Abort on Linefetch -- Page
    620  *  FAULT_BUSERR_2 - External Abort on Non-linefetch -- Section
    621  *  FAULT_BUSERR_3 - External Abort on Non-linefetch -- Page
    622  *  FAULT_BUSTRNL1 - External abort on Translation -- Level 1
    623  *  FAULT_BUSTRNL2 - External abort on Translation -- Level 2
    624  *
    625  * If pcb_onfault is set, flag the fault and return to the handler.
    626  * If the fault occurred in user mode, give the process a SIGBUS.
    627  *
    628  * Note: On XScale, FAULT_BUSERR_0, FAULT_BUSERR_1, and FAULT_BUSERR_2
    629  * can be flagged as imprecise in the FSR. This causes a real headache
    630  * since some of the machine state is lost. In this case, tf->tf_pc
    631  * may not actually point to the offending instruction. In fact, if
    632  * we've taken a double abort fault, it generally points somewhere near
    633  * the top of "data_abort_entry" in exception.S.
    634  *
    635  * In all other cases, these data aborts are considered fatal.
    636  */
    637 static int
    638 dab_buserr(trapframe_t *tf, u_int fsr, u_int far, struct lwp *l,
    639     ksiginfo_t *ksi)
    640 {
    641 	struct pcb *pcb = &l->l_addr->u_pcb;
    642 
    643 #ifdef __XSCALE__
    644 	if ((fsr & FAULT_IMPRECISE) != 0 &&
    645 	    (tf->tf_spsr & PSR_MODE) == PSR_ABT32_MODE) {
    646 		/*
    647 		 * Oops, an imprecise, double abort fault. We've lost the
    648 		 * r14_abt/spsr_abt values corresponding to the original
    649 		 * abort, and the spsr saved in the trapframe indicates
    650 		 * ABT mode.
    651 		 */
    652 		tf->tf_spsr &= ~PSR_MODE;
    653 
    654 		/*
    655 		 * We use a simple heuristic to determine if the double abort
    656 		 * happened as a result of a kernel or user mode access.
    657 		 * If the current trapframe is at the top of the kernel stack,
    658 		 * the fault _must_ have come from user mode.
    659 		 */
    660 		if (tf != ((trapframe_t *)pcb->pcb_un.un_32.pcb32_sp) - 1) {
    661 			/*
    662 			 * Kernel mode. We're either about to die a
    663 			 * spectacular death, or pcb_onfault will come
    664 			 * to our rescue. Either way, the current value
    665 			 * of tf->tf_pc is irrelevant.
    666 			 */
    667 			tf->tf_spsr |= PSR_SVC32_MODE;
    668 			if (pcb->pcb_onfault == NULL)
    669 				printf("\nKernel mode double abort!\n");
    670 		} else {
    671 			/*
    672 			 * User mode. We've lost the program counter at the
    673 			 * time of the fault (not that it was accurate anyway;
    674 			 * it's not called an imprecise fault for nothing).
    675 			 * About all we can do is copy r14_usr to tf_pc and
    676 			 * hope for the best. The process is about to get a
    677 			 * SIGBUS, so it's probably history anyway.
    678 			 */
    679 			tf->tf_spsr |= PSR_USR32_MODE;
    680 			tf->tf_pc = tf->tf_usr_lr;
    681 #ifdef THUMB_CODE
    682 			tf->tf_spsr &= ~PSR_T_bit;
    683 			if (tf->tf_usr_lr & 1)
    684 				tf->tf_spsr |= PSR_T_bit;
    685 #endif
    686 		}
    687 	}
    688 
    689 	/* FAR is invalid for imprecise exceptions */
    690 	if ((fsr & FAULT_IMPRECISE) != 0)
    691 		far = 0;
    692 #endif /* __XSCALE__ */
    693 
    694 	if (pcb->pcb_onfault) {
    695 		KDASSERT(TRAP_USERMODE(tf) == 0);
    696 		tf->tf_r0 = EFAULT;
    697 		tf->tf_pc = (register_t)(intptr_t) pcb->pcb_onfault;
    698 		return (0);
    699 	}
    700 
    701 	/* See if the CPU state needs to be fixed up */
    702 	(void) data_abort_fixup(tf, fsr, far, l);
    703 
    704 	/*
    705 	 * At this point, if the fault happened in kernel mode, we're toast
    706 	 */
    707 	if (!TRAP_USERMODE(tf))
    708 		dab_fatal(tf, fsr, far, l, NULL);
    709 
    710 	/* Deliver a bus error signal to the process */
    711 	KSI_INIT_TRAP(ksi);
    712 	ksi->ksi_signo = SIGBUS;
    713 	ksi->ksi_code = BUS_ADRERR;
    714 	ksi->ksi_addr = (u_int32_t *)(intptr_t)far;
    715 	ksi->ksi_trap = fsr;
    716 
    717 	l->l_addr->u_pcb.pcb_tf = tf;
    718 
    719 	return (1);
    720 }
    721 
    722 static inline int
    723 prefetch_abort_fixup(trapframe_t *tf)
    724 {
    725 #ifdef CPU_ABORT_FIXUP_REQUIRED
    726 	int error;
    727 
    728 	/* Call the CPU specific prefetch abort fixup routine */
    729 	error = cpu_prefetchabt_fixup(tf);
    730 	if (__predict_true(error != ABORT_FIXUP_FAILED))
    731 		return (error);
    732 
    733 	/*
    734 	 * Oops, couldn't fix up the instruction
    735 	 */
    736 	printf(
    737 	    "prefetch_abort_fixup: fixup for %s mode prefetch abort failed.\n",
    738 	    TRAP_USERMODE(tf) ? "user" : "kernel");
    739 #ifdef THUMB_CODE
    740 	if (tf->tf_spsr & PSR_T_bit) {
    741 		printf("pc = 0x%08x, opcode 0x%04x, 0x%04x, insn = ",
    742 		    tf->tf_pc, *((u_int16 *)(tf->tf_pc & ~1),
    743 		    *((u_int16 *)((tf->tf_pc + 2) & ~1));
    744 	}
    745 	else
    746 #endif
    747 	{
    748 		printf("pc = 0x%08x, opcode 0x%08x, insn = ", tf->tf_pc,
    749 		    *((u_int *)tf->tf_pc));
    750 	}
    751 	disassemble(tf->tf_pc);
    752 
    753 	/* Die now if this happened in kernel mode */
    754 	if (!TRAP_USERMODE(tf))
    755 		dab_fatal(tf, 0, tf->tf_pc, NULL, NULL);
    756 
    757 	return (error);
    758 #else
    759 	return (ABORT_FIXUP_OK);
    760 #endif /* CPU_ABORT_FIXUP_REQUIRED */
    761 }
    762 
    763 /*
    764  * void prefetch_abort_handler(trapframe_t *tf)
    765  *
    766  * Abort handler called when instruction execution occurs at
    767  * a non existent or restricted (access permissions) memory page.
    768  * If the address is invalid and we were in SVC mode then panic as
    769  * the kernel should never prefetch abort.
    770  * If the address is invalid and the page is mapped then the user process
    771  * does no have read permission so send it a signal.
    772  * Otherwise fault the page in and try again.
    773  */
    774 void
    775 prefetch_abort_handler(trapframe_t *tf)
    776 {
    777 	struct lwp *l;
    778 	struct vm_map *map;
    779 	vaddr_t fault_pc, va;
    780 	ksiginfo_t ksi;
    781 	int error, user;
    782 
    783 	UVMHIST_FUNC("prefetch_abort_handler"); UVMHIST_CALLED(maphist);
    784 
    785 	/* Update vmmeter statistics */
    786 	uvmexp.traps++;
    787 
    788 	l = curlwp;
    789 
    790 	if ((user = TRAP_USERMODE(tf)) != 0)
    791 		LWP_CACHE_CREDS(l, l->l_proc);
    792 
    793 	/*
    794 	 * Enable IRQ's (disabled by the abort) This always comes
    795 	 * from user mode so we know interrupts were not disabled.
    796 	 * But we check anyway.
    797 	 */
    798 	KASSERT(!TRAP_USERMODE(tf) || (tf->tf_spsr & IF32_bits) == 0);
    799 	if (__predict_true((tf->tf_spsr & I32_bit) != IF32_bits))
    800 		restore_interrupts(tf->tf_spsr & IF32_bits);
    801 
    802 	/* See if the CPU state needs to be fixed up */
    803 	switch (prefetch_abort_fixup(tf)) {
    804 	case ABORT_FIXUP_RETURN:
    805 		KASSERT(!TRAP_USERMODE(tf) || (tf->tf_spsr & IF32_bits) == 0);
    806 		return;
    807 	case ABORT_FIXUP_FAILED:
    808 		/* Deliver a SIGILL to the process */
    809 		KSI_INIT_TRAP(&ksi);
    810 		ksi.ksi_signo = SIGILL;
    811 		ksi.ksi_code = ILL_ILLOPC;
    812 		ksi.ksi_addr = (u_int32_t *)(intptr_t) tf->tf_pc;
    813 		l->l_addr->u_pcb.pcb_tf = tf;
    814 		goto do_trapsignal;
    815 	default:
    816 		break;
    817 	}
    818 
    819 	/* Prefetch aborts cannot happen in kernel mode */
    820 	if (__predict_false(!user))
    821 		dab_fatal(tf, 0, tf->tf_pc, NULL, NULL);
    822 
    823 	/* Get fault address */
    824 	fault_pc = tf->tf_pc;
    825 	l = curlwp;
    826 	l->l_addr->u_pcb.pcb_tf = tf;
    827 	UVMHIST_LOG(maphist, " (pc=0x%x, l=0x%x, tf=0x%x)", fault_pc, l, tf,
    828 	    0);
    829 
    830 	/* Ok validate the address, can only execute in USER space */
    831 	if (__predict_false(fault_pc >= VM_MAXUSER_ADDRESS ||
    832 	    (fault_pc < VM_MIN_ADDRESS && vector_page == ARM_VECTORS_LOW))) {
    833 		KSI_INIT_TRAP(&ksi);
    834 		ksi.ksi_signo = SIGSEGV;
    835 		ksi.ksi_code = SEGV_ACCERR;
    836 		ksi.ksi_addr = (u_int32_t *)(intptr_t) fault_pc;
    837 		ksi.ksi_trap = fault_pc;
    838 		goto do_trapsignal;
    839 	}
    840 
    841 	map = &l->l_proc->p_vmspace->vm_map;
    842 	va = trunc_page(fault_pc);
    843 
    844 	/*
    845 	 * See if the pmap can handle this fault on its own...
    846 	 */
    847 #ifdef DEBUG
    848 	last_fault_code = -1;
    849 #endif
    850 	if (pmap_fault_fixup(map->pmap, va, VM_PROT_READ, 1)) {
    851 		UVMHIST_LOG (maphist, " <- emulated", 0, 0, 0, 0);
    852 		goto out;
    853 	}
    854 
    855 #ifdef DIAGNOSTIC
    856 	if (__predict_false(l->l_cpu->ci_intr_depth > 0)) {
    857 		printf("\nNon-emulated prefetch abort with intr_depth > 0\n");
    858 		dab_fatal(tf, 0, tf->tf_pc, NULL, NULL);
    859 	}
    860 #endif
    861 
    862 #ifdef KERN_SA
    863 	if (map != kernel_map && (l->l_flag & LW_SA)) {
    864 		l->l_savp->savp_faultaddr = fault_pc;
    865 		l->l_pflag |= LP_SA_PAGEFAULT;
    866 	}
    867 #endif
    868 
    869 	error = uvm_fault(map, va, VM_PROT_READ);
    870 
    871 #ifdef KERN_SA
    872 	if (map != kernel_map)
    873 		l->l_pflag &= ~LP_SA_PAGEFAULT;
    874 #endif
    875 
    876 	if (__predict_true(error == 0)) {
    877 		UVMHIST_LOG (maphist, " <- uvm", 0, 0, 0, 0);
    878 		goto out;
    879 	}
    880 	KSI_INIT_TRAP(&ksi);
    881 
    882 	UVMHIST_LOG (maphist, " <- fatal (%d)", error, 0, 0, 0);
    883 	if (error == ENOMEM) {
    884 		printf("UVM: pid %d (%s), uid %d killed: "
    885 		    "out of swap\n", l->l_proc->p_pid, l->l_proc->p_comm,
    886 		    l->l_cred ? kauth_cred_geteuid(l->l_cred) : -1);
    887 		ksi.ksi_signo = SIGKILL;
    888 	} else
    889 		ksi.ksi_signo = SIGSEGV;
    890 
    891 	ksi.ksi_code = SEGV_MAPERR;
    892 	ksi.ksi_addr = (u_int32_t *)(intptr_t) fault_pc;
    893 	ksi.ksi_trap = fault_pc;
    894 
    895 do_trapsignal:
    896 	call_trapsignal(l, &ksi);
    897 
    898 out:
    899 	KASSERT(!TRAP_USERMODE(tf) || (tf->tf_spsr & IF32_bits) == 0);
    900 	userret(l);
    901 }
    902 
    903 /*
    904  * Tentatively read an 8, 16, or 32-bit value from 'addr'.
    905  * If the read succeeds, the value is written to 'rptr' and zero is returned.
    906  * Else, return EFAULT.
    907  */
    908 int
    909 badaddr_read(void *addr, size_t size, void *rptr)
    910 {
    911 	extern int badaddr_read_1(const uint8_t *, uint8_t *);
    912 	extern int badaddr_read_2(const uint16_t *, uint16_t *);
    913 	extern int badaddr_read_4(const uint32_t *, uint32_t *);
    914 	union {
    915 		uint8_t v1;
    916 		uint16_t v2;
    917 		uint32_t v4;
    918 	} u;
    919 	struct pcb *curpcb_save;
    920 	int rv, s;
    921 
    922 	cpu_drain_writebuf();
    923 
    924 	/*
    925 	 * We might be called at interrupt time, so arrange to steal
    926 	 * lwp0's PCB temporarily, if required, so that pcb_onfault
    927 	 * handling works correctly.
    928 	 */
    929 	s = splhigh();
    930 	if ((curpcb_save = curpcb) == NULL)
    931 		curpcb = &lwp0.l_addr->u_pcb;
    932 
    933 	/* Read from the test address. */
    934 	switch (size) {
    935 	case sizeof(uint8_t):
    936 		rv = badaddr_read_1(addr, &u.v1);
    937 		if (rv == 0 && rptr)
    938 			*(uint8_t *) rptr = u.v1;
    939 		break;
    940 
    941 	case sizeof(uint16_t):
    942 		rv = badaddr_read_2(addr, &u.v2);
    943 		if (rv == 0 && rptr)
    944 			*(uint16_t *) rptr = u.v2;
    945 		break;
    946 
    947 	case sizeof(uint32_t):
    948 		rv = badaddr_read_4(addr, &u.v4);
    949 		if (rv == 0 && rptr)
    950 			*(uint32_t *) rptr = u.v4;
    951 		break;
    952 
    953 	default:
    954 		curpcb = curpcb_save;
    955 		panic("badaddr: invalid size (%lu)", (u_long) size);
    956 	}
    957 
    958 	/* Restore curpcb */
    959 	curpcb = curpcb_save;
    960 	splx(s);
    961 
    962 	/* Return EFAULT if the address was invalid, else zero */
    963 	return (rv);
    964 }
    965