Home | History | Annotate | Line # | Download | only in hppa
trap.c revision 1.58
      1 /*	$NetBSD: trap.c,v 1.58 2009/04/11 09:49:23 skrll Exp $	*/
      2 
      3 /*-
      4  * Copyright (c) 2001, 2002 The NetBSD Foundation, Inc.
      5  * All rights reserved.
      6  *
      7  * This code is derived from software contributed to The NetBSD Foundation
      8  * by Matthew Fredette.
      9  *
     10  * Redistribution and use in source and binary forms, with or without
     11  * modification, are permitted provided that the following conditions
     12  * are met:
     13  * 1. Redistributions of source code must retain the above copyright
     14  *    notice, this list of conditions and the following disclaimer.
     15  * 2. Redistributions in binary form must reproduce the above copyright
     16  *    notice, this list of conditions and the following disclaimer in the
     17  *    documentation and/or other materials provided with the distribution.
     18  *
     19  * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
     20  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
     21  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
     22  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
     23  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
     24  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
     25  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
     26  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
     27  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
     28  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
     29  * POSSIBILITY OF SUCH DAMAGE.
     30  */
     31 
     32 /*	$OpenBSD: trap.c,v 1.30 2001/09/19 20:50:56 mickey Exp $	*/
     33 
     34 /*
     35  * Copyright (c) 1998-2000 Michael Shalayeff
     36  * All rights reserved.
     37  *
     38  * Redistribution and use in source and binary forms, with or without
     39  * modification, are permitted provided that the following conditions
     40  * are met:
     41  * 1. Redistributions of source code must retain the above copyright
     42  *    notice, this list of conditions and the following disclaimer.
     43  * 2. Redistributions in binary form must reproduce the above copyright
     44  *    notice, this list of conditions and the following disclaimer in the
     45  *    documentation and/or other materials provided with the distribution.
     46  * 3. All advertising materials mentioning features or use of this software
     47  *    must display the following acknowledgement:
     48  *	This product includes software developed by Michael Shalayeff.
     49  * 4. The name of the author may not be used to endorse or promote products
     50  *    derived from this software without specific prior written permission.
     51  *
     52  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
     53  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
     54  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
     55  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
     56  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
     57  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
     58  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
     59  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
     60  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
     61  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
     62  */
     63 
     64 #include <sys/cdefs.h>
     65 __KERNEL_RCSID(0, "$NetBSD: trap.c,v 1.58 2009/04/11 09:49:23 skrll Exp $");
     66 
     67 /* #define INTRDEBUG */
     68 /* #define TRAPDEBUG */
     69 /* #define USERTRACE */
     70 
     71 #include "opt_kgdb.h"
     72 #include "opt_ptrace.h"
     73 #include "opt_sa.h"
     74 
     75 #include <sys/param.h>
     76 #include <sys/systm.h>
     77 #include <sys/kernel.h>
     78 #include <sys/syscall.h>
     79 #include <sys/syscallvar.h>
     80 #include <sys/sa.h>
     81 #include <sys/savar.h>
     82 #include <sys/mutex.h>
     83 #include <sys/ktrace.h>
     84 #include <sys/proc.h>
     85 #include <sys/signalvar.h>
     86 #include <sys/user.h>
     87 #include <sys/acct.h>
     88 #include <sys/signal.h>
     89 #include <sys/device.h>
     90 #include <sys/pool.h>
     91 #include <sys/userret.h>
     92 
     93 #include <net/netisr.h>
     94 
     95 #ifdef KGDB
     96 #include <sys/kgdb.h>
     97 #endif
     98 
     99 #include <uvm/uvm.h>
    100 
    101 #include <machine/iomod.h>
    102 #include <machine/cpufunc.h>
    103 #include <machine/reg.h>
    104 #include <machine/autoconf.h>
    105 
    106 #include <machine/db_machdep.h>
    107 
    108 #include <hppa/hppa/machdep.h>
    109 
    110 #include <ddb/db_output.h>
    111 #include <ddb/db_interface.h>
    112 
    113 #ifdef PTRACE
    114 void ss_clear_breakpoints(struct lwp *l);
    115 int ss_put_value(struct lwp *, vaddr_t, u_int);
    116 int ss_get_value(struct lwp *, vaddr_t, u_int *);
    117 #endif
    118 
    119 /* single-step breakpoint */
    120 #define SSBREAKPOINT   (HPPA_BREAK_KERNEL | (HPPA_BREAK_SS << 13))
    121 
    122 #if defined(DEBUG) || defined(DIAGNOSTIC)
    123 /*
    124  * 0x6fc1000 is a stwm r1, d(sr0, sp), which is the last
    125  * instruction in the function prologue that gcc -O0 uses.
    126  * When we have this instruction we know the relationship
    127  * between the stack pointer and the gcc -O0 frame pointer
    128  * (in r3, loaded with the initial sp) for the body of a
    129  * function.
    130  *
    131  * If the given instruction is a stwm r1, d(sr0, sp) where
    132  * d > 0, we evaluate to d, else we evaluate to zero.
    133  */
    134 #define STWM_R1_D_SR0_SP(inst) \
    135 	(((inst) & 0xffffc001) == 0x6fc10000 ? (((inst) & 0x00003ff) >> 1) : 0)
    136 #endif /* DEBUG || DIAGNOSTIC */
    137 
    138 const char *trap_type[] = {
    139 	"invalid",
    140 	"HPMC",
    141 	"power failure",
    142 	"recovery counter",
    143 	"external interrupt",
    144 	"LPMC",
    145 	"ITLB miss fault",
    146 	"instruction protection",
    147 	"Illegal instruction",
    148 	"break instruction",
    149 	"privileged operation",
    150 	"privileged register",
    151 	"overflow",
    152 	"conditional",
    153 	"assist exception",
    154 	"DTLB miss",
    155 	"ITLB non-access miss",
    156 	"DTLB non-access miss",
    157 	"data protection/rights/alignment",
    158 	"data break",
    159 	"TLB dirty",
    160 	"page reference",
    161 	"assist emulation",
    162 	"higher-priv transfer",
    163 	"lower-priv transfer",
    164 	"taken branch",
    165 	"data access rights",
    166 	"data protection",
    167 	"unaligned data ref",
    168 };
    169 int trap_types = sizeof(trap_type)/sizeof(trap_type[0]);
    170 
    171 uint8_t fpopmap[] = {
    172 	0x00, 0x00, 0x00, 0x06, 0x00, 0x00, 0x00, 0x00,
    173 	0x00, 0x0c, 0x00, 0x0e, 0x00, 0x00, 0x00, 0x00,
    174 	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
    175 	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
    176 	0x00, 0x00, 0x00, 0x26, 0x00, 0x00, 0x00, 0x00,
    177 	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
    178 	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
    179 	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
    180 };
    181 
    182 volatile int astpending;
    183 
    184 void pmap_hptdump(void);
    185 void syscall(struct trapframe *, int *);
    186 
    187 #if defined(DEBUG)
    188 struct trapframe *sanity_frame;
    189 struct lwp *sanity_lwp;
    190 int sanity_checked = 0;
    191 void frame_sanity_check(int, int, struct trapframe *, struct lwp *);
    192 #endif
    193 
    194 
    195 #ifdef USERTRACE
    196 /*
    197  * USERTRACE is a crude facility that traces the PC of
    198  * a single user process.  This tracing is normally
    199  * activated by the dispatching of a certain syscall
    200  * with certain arguments - see the activation code in
    201  * syscall().
    202  */
    203 static void user_backtrace(struct trapframe *, struct lwp *, int);
    204 static void user_backtrace_raw(u_int, u_int);
    205 
    206 u_int rctr_next_iioq;
    207 #endif
    208 
    209 static inline void
    210 userret(struct lwp *l, register_t pc, u_quad_t oticks)
    211 {
    212 	struct proc *p = l->l_proc;
    213 
    214 	if (curcpu()->ci_want_resched) {
    215 		preempt();
    216 	}
    217 
    218 	mi_userret(l);
    219 
    220 	/*
    221 	 * If profiling, charge recent system time to the trapped pc.
    222 	 */
    223 	if (p->p_stflag & PST_PROFIL) {
    224 		extern int psratio;
    225 
    226 		addupc_task(l, pc, (int)(p->p_sticks - oticks) * psratio);
    227 	}
    228 }
    229 
    230 /*
    231  * This handles some messy kernel debugger details.
    232  * It dispatches into either kgdb or DDB, and knows
    233  * about some special things to do, like skipping over
    234  * break instructions and how to really set up for
    235  * a single-step.
    236  */
    237 #if defined(KGDB) || defined(DDB)
    238 static int
    239 trap_kdebug(int type, int code, struct trapframe *frame)
    240 {
    241 	int handled;
    242 	u_int tf_iioq_head_old;
    243 	u_int tf_iioq_tail_old;
    244 
    245 	for(;;) {
    246 
    247 		/* This trap has not been handled. */
    248 		handled = 0;
    249 
    250 		/* Remember the instruction offset queue. */
    251 		tf_iioq_head_old = frame->tf_iioq_head;
    252 		tf_iioq_tail_old = frame->tf_iioq_tail;
    253 
    254 #ifdef	KGDB
    255 		/* Let KGDB handle it (if connected) */
    256 		if (!handled)
    257 			handled = kgdb_trap(type, frame);
    258 #endif
    259 #ifdef	DDB
    260 		/* Let DDB handle it. */
    261 		if (!handled)
    262 			handled = kdb_trap(type, code, frame);
    263 #endif
    264 
    265 		/* If this trap wasn't handled, return now. */
    266 		if (!handled)
    267 			return(0);
    268 
    269 		/*
    270 		 * If the instruction offset queue head changed,
    271 		 * but the offset queue tail didn't, assume that
    272 		 * the user wants to jump to the head offset, and
    273 		 * adjust the tail accordingly.  This should fix
    274 		 * the kgdb `jump' command, and can help DDB users
    275 		 * who `set' the offset head but forget the tail.
    276 		 */
    277 		if (frame->tf_iioq_head != tf_iioq_head_old &&
    278 		    frame->tf_iioq_tail == tf_iioq_tail_old)
    279 			frame->tf_iioq_tail = frame->tf_iioq_head + 4;
    280 
    281 		/*
    282 		 * This is some single-stepping support.
    283 		 * If we're trying to step through a nullified
    284 		 * instruction, just advance by hand and trap
    285 		 * again.  Otherwise, load the recovery counter
    286 		 * with zero.
    287 		 */
    288 		if (frame->tf_ipsw & PSW_R) {
    289 #ifdef TRAPDEBUG
    290 			printf("(single stepping at head 0x%x tail 0x%x)\n",
    291 			    frame->tf_iioq_head, frame->tf_iioq_tail);
    292 #endif
    293 			if (frame->tf_ipsw & PSW_N) {
    294 #ifdef TRAPDEBUG
    295 				printf("(single stepping past nullified)\n");
    296 #endif
    297 
    298 				/* Advance the program counter. */
    299 				frame->tf_iioq_head = frame->tf_iioq_tail;
    300 				frame->tf_iioq_tail = frame->tf_iioq_head + 4;
    301 
    302 				/* Clear flags. */
    303 				frame->tf_ipsw &= ~(PSW_N|PSW_X|PSW_Y|PSW_Z|PSW_B|PSW_T|PSW_H|PSW_L);
    304 
    305 				/* Simulate another trap. */
    306 				type = T_RECOVERY;
    307 				continue;
    308 			}
    309 			frame->tf_rctr = 0;
    310 		}
    311 
    312 		/* We handled this trap. */
    313 		return (1);
    314 	}
    315 	/* NOTREACHED */
    316 }
    317 #else	/* !KGDB && !DDB */
    318 #define trap_kdebug(t, c, f)	(0)
    319 #endif	/* !KGDB && !DDB */
    320 
    321 #if defined(DEBUG) || defined(USERTRACE)
    322 /*
    323  * These functions give a crude usermode backtrace.  They
    324  * really only work when code has been compiled without
    325  * optimization, as they assume a certain function prologue
    326  * sets up a frame pointer and stores the return pointer
    327  * and arguments in it.
    328  */
    329 static void
    330 user_backtrace_raw(u_int pc, u_int fp)
    331 {
    332 	int frame_number;
    333 	int arg_number;
    334 
    335 	for (frame_number = 0;
    336 	     frame_number < 100 && pc > HPPA_PC_PRIV_MASK && fp;
    337 	     frame_number++) {
    338 
    339 		printf("%3d: pc=%08x%s fp=0x%08x", frame_number,
    340 		    pc & ~HPPA_PC_PRIV_MASK, USERMODE(pc) ? "  " : "**", fp);
    341 		for(arg_number = 0; arg_number < 4; arg_number++)
    342 			printf(" arg%d=0x%08x", arg_number,
    343 			    (int) fuword(HPPA_FRAME_CARG(arg_number, fp)));
    344 		printf("\n");
    345                 pc = fuword(((register_t *) fp) - 5);	/* fetch rp */
    346 		if (pc == -1) {
    347 			printf("  fuword for pc failed\n");
    348 			break;
    349 		}
    350                 fp = fuword(((register_t *) fp) + 0);	/* fetch previous fp */
    351 		if (fp == -1) {
    352 			printf("  fuword for fp failed\n");
    353 			break;
    354 		}
    355 	}
    356 	printf("  backtrace stopped with pc %08x fp 0x%08x\n", pc, fp);
    357 }
    358 
    359 static void
    360 user_backtrace(struct trapframe *tf, struct lwp *l, int type)
    361 {
    362 	struct proc *p = l->l_proc;
    363 	u_int pc, fp, inst;
    364 
    365 	/*
    366 	 * Display any trap type that we have.
    367 	 */
    368 	if (type >= 0)
    369 		printf("pid %d (%s) trap #%d\n",
    370 		    p->p_pid, p->p_comm, type & ~T_USER);
    371 
    372 	/*
    373 	 * Assuming that the frame pointer in r3 is valid,
    374 	 * dump out a stack trace.
    375 	 */
    376 	fp = tf->tf_r3;
    377 	printf("pid %d (%s) backtrace, starting with fp 0x%08x\n",
    378 		p->p_pid, p->p_comm, fp);
    379 	user_backtrace_raw(tf->tf_iioq_head, fp);
    380 
    381 	/*
    382 	 * In case the frame pointer in r3 is not valid,
    383 	 * assuming the stack pointer is valid and the
    384 	 * faulting function is a non-leaf, if we can
    385 	 * find its prologue we can recover its frame
    386 	 * pointer.
    387 	 */
    388 	pc = tf->tf_iioq_head;
    389 	fp = tf->tf_sp - HPPA_FRAME_SIZE;
    390 	printf("pid %d (%s) backtrace, starting with sp 0x%08x pc 0x%08x\n",
    391 		p->p_pid, p->p_comm, tf->tf_sp, pc);
    392 	for (pc &= ~HPPA_PC_PRIV_MASK; pc > 0; pc -= sizeof(inst)) {
    393 		inst = fuword((register_t *) pc);
    394 		if (inst == -1) {
    395 			printf("  fuword for inst at pc %08x failed\n", pc);
    396 			break;
    397 		}
    398 		/* Check for the prologue instruction that sets sp. */
    399 		if (STWM_R1_D_SR0_SP(inst)) {
    400 			fp = tf->tf_sp - STWM_R1_D_SR0_SP(inst);
    401 			printf("  sp from fp at pc %08x: %08x\n", pc, inst);
    402 			break;
    403 		}
    404 	}
    405 	user_backtrace_raw(tf->tf_iioq_head, fp);
    406 }
    407 #endif /* DEBUG || USERTRACE */
    408 
    409 #ifdef DEBUG
    410 /*
    411  * This sanity-checks a trapframe.  It is full of various
    412  * assumptions about what a healthy CPU state should be,
    413  * with some documented elsewhere, some not.
    414  */
    415 void
    416 frame_sanity_check(int where, int type, struct trapframe *tf, struct lwp *l)
    417 {
    418 	extern int kernel_text;
    419 	extern int etext;
    420 	extern register_t kpsw;
    421 	extern vaddr_t hpt_base;
    422 	extern vsize_t hpt_mask;
    423 #define SANITY(e)					\
    424 do {							\
    425 	if (sanity_frame == NULL && !(e)) {		\
    426 		sanity_frame = tf;			\
    427 		sanity_lwp = l;				\
    428 		sanity_checked = __LINE__;		\
    429 	}						\
    430 } while (/* CONSTCOND */ 0)
    431 
    432 	SANITY((tf->tf_ipsw & kpsw) == kpsw);
    433 	SANITY(tf->tf_hptm == hpt_mask && tf->tf_vtop == hpt_base);
    434 	SANITY((kpsw & PSW_I) == 0 || tf->tf_eiem != 0);
    435 	if (tf->tf_iisq_head == HPPA_SID_KERNEL) {
    436 		vaddr_t minsp, maxsp;
    437 
    438 		/*
    439 		 * If the trap happened in the gateway
    440 		 * page, we take the easy way out and
    441 		 * assume that the trapframe is okay.
    442 		 */
    443 		if ((tf->tf_iioq_head & ~PAGE_MASK) == SYSCALLGATE)
    444 			goto out;
    445 
    446 		SANITY(!USERMODE(tf->tf_iioq_head));
    447 		SANITY(!USERMODE(tf->tf_iioq_tail));
    448 
    449 		/*
    450 		 * Don't check the instruction queues or stack on interrupts
    451 		 * as we could be be in the sti code (outside normal kernel
    452 		 * text) or switching LWPs (curlwp and sp are not in sync)
    453 		 */
    454 		if ((type & ~T_USER) == T_INTERRUPT)
    455 			goto out;
    456 
    457 		SANITY(tf->tf_iioq_head >= (u_int) &kernel_text);
    458 		SANITY(tf->tf_iioq_head < (u_int) &etext);
    459 		SANITY(tf->tf_iioq_tail >= (u_int) &kernel_text);
    460 		SANITY(tf->tf_iioq_tail < (u_int) &etext);
    461 
    462 #ifdef HPPA_REDZONE
    463 		maxsp = (u_int)(l->l_addr) + HPPA_REDZONE;
    464 #else
    465 		maxsp = (u_int)(l->l_addr) + USPACE;
    466 #endif
    467 		minsp = (u_int)(l->l_addr) + PAGE_SIZE;
    468 
    469 		SANITY(l != NULL || (tf->tf_sp >= minsp && tf->tf_sp < maxsp));
    470 	} else {
    471 		SANITY(USERMODE(tf->tf_iioq_head));
    472 		SANITY(USERMODE(tf->tf_iioq_tail));
    473 		SANITY(l != NULL && tf->tf_cr30 == kvtop((void *)l->l_addr));
    474 	}
    475 #undef SANITY
    476 out:
    477 	if (sanity_frame == tf) {
    478 		printf("insanity: where 0x%x type 0x%x tf %p lwp %p line %d "
    479 		       "sp 0x%x pc 0x%x\n",
    480 		       where, type, sanity_frame, sanity_lwp, sanity_checked,
    481 		       tf->tf_sp, tf->tf_iioq_head);
    482 		(void) trap_kdebug(T_IBREAK, 0, tf);
    483 		sanity_frame = NULL;
    484 		sanity_lwp = NULL;
    485 		sanity_checked = 0;
    486 	}
    487 }
    488 #endif /* DEBUG */
    489 
    490 void
    491 trap(int type, struct trapframe *frame)
    492 {
    493 	struct lwp *l;
    494 	struct proc *p;
    495 	struct pcb *pcbp;
    496 	vaddr_t va;
    497 	struct vm_map *map;
    498 	struct vmspace *vm;
    499 	vm_prot_t vftype;
    500 	pa_space_t space;
    501 	ksiginfo_t ksi;
    502 	u_int opcode, onfault;
    503 	int ret;
    504 	const char *tts;
    505 	int type_raw;
    506 #ifdef DIAGNOSTIC
    507 	extern int emergency_stack_start, emergency_stack_end;
    508 #endif
    509 
    510 	type_raw = type & ~T_USER;
    511 	opcode = frame->tf_iir;
    512 	if (type_raw == T_ITLBMISS || type_raw == T_ITLBMISSNA ||
    513 	    type_raw == T_IBREAK || type_raw == T_TAKENBR) {
    514 		va = frame->tf_iioq_head;
    515 		space = frame->tf_iisq_head;
    516 		vftype = VM_PROT_EXECUTE;
    517 	} else {
    518 		va = frame->tf_ior;
    519 		space = frame->tf_isr;
    520 		vftype = inst_store(opcode) ? VM_PROT_WRITE : VM_PROT_READ;
    521 	}
    522 
    523 	l = curlwp;
    524 	p = l ? l->l_proc : NULL;
    525 	if ((type & T_USER) != 0)
    526 		LWP_CACHE_CREDS(l, p);
    527 
    528 	tts = (type & ~T_USER) > trap_types ? "reserved" :
    529 		trap_type[type & ~T_USER];
    530 
    531 #ifdef DIAGNOSTIC
    532 	/*
    533 	 * If we are on the emergency stack, then we either got
    534 	 * a fault on the kernel stack, or we're just handling
    535 	 * a trap for the machine check handler (which also
    536 	 * runs on the emergency stack).
    537 	 *
    538 	 * We *very crudely* differentiate between the two cases
    539 	 * by checking the faulting instruction: if it is the
    540 	 * function prologue instruction that stores the old
    541 	 * frame pointer and updates the stack pointer, we assume
    542 	 * that we faulted on the kernel stack.
    543 	 *
    544 	 * In this case, not completing that instruction will
    545 	 * probably confuse backtraces in kgdb/ddb.  Completing
    546 	 * it would be difficult, because we already faulted on
    547 	 * that part of the stack, so instead we fix up the
    548 	 * frame as if the function called has just returned.
    549 	 * This has peculiar knowledge about what values are in
    550 	 * what registers during the "normal gcc -g" prologue.
    551 	 */
    552 	if (&type >= &emergency_stack_start &&
    553 	    &type < &emergency_stack_end &&
    554 	    type != T_IBREAK && STWM_R1_D_SR0_SP(opcode)) {
    555 		/* Restore the caller's frame pointer. */
    556 		frame->tf_r3 = frame->tf_r1;
    557 		/* Restore the caller's instruction offsets. */
    558 		frame->tf_iioq_head = frame->tf_rp;
    559 		frame->tf_iioq_tail = frame->tf_iioq_head + 4;
    560 		goto dead_end;
    561 	}
    562 #endif /* DIAGNOSTIC */
    563 
    564 #ifdef DEBUG
    565 	frame_sanity_check(0xdead01, type, frame, l);
    566 #endif /* DEBUG */
    567 
    568 	/* If this is a trap, not an interrupt, reenable interrupts. */
    569 	if (type_raw != T_INTERRUPT)
    570 		mtctl(frame->tf_eiem, CR_EIEM);
    571 
    572 	if (frame->tf_flags & TFF_LAST)
    573 		l->l_md.md_regs = frame;
    574 
    575 #ifdef TRAPDEBUG
    576 	if (type_raw != T_INTERRUPT && type_raw != T_IBREAK)
    577 		printf("trap: %d, %s for %x:%x at %x:%x, fp=%p, rp=%x\n",
    578 		    type, tts, space, (u_int)va, frame->tf_iisq_head,
    579 		    frame->tf_iioq_head, frame, frame->tf_rp);
    580 	else if (type_raw == T_IBREAK)
    581 		printf("trap: break instruction %x:%x at %x:%x, fp=%p\n",
    582 		    break5(opcode), break13(opcode),
    583 		    frame->tf_iisq_head, frame->tf_iioq_head, frame);
    584 
    585 	{
    586 		extern int etext;
    587 		if (frame < (struct trapframe *)&etext) {
    588 			printf("trap: bogus frame ptr %p\n", frame);
    589 			goto dead_end;
    590 		}
    591 	}
    592 #endif
    593 	switch (type) {
    594 	case T_NONEXIST:
    595 	case T_NONEXIST|T_USER:
    596 #if !defined(DDB) && !defined(KGDB)
    597 		/* we've got screwed up by the central scrutinizer */
    598 		panic ("trap: elvis has just left the building!");
    599 		break;
    600 #else
    601 		goto dead_end;
    602 #endif
    603 	case T_RECOVERY|T_USER:
    604 #ifdef USERTRACE
    605 		for(;;) {
    606 			if (frame->tf_iioq_head != rctr_next_iioq)
    607 				printf("-%08x\nr %08x",
    608 					rctr_next_iioq - 4,
    609 					frame->tf_iioq_head);
    610 			rctr_next_iioq = frame->tf_iioq_head + 4;
    611 			if (frame->tf_ipsw & PSW_N) {
    612 				/* Advance the program counter. */
    613 				frame->tf_iioq_head = frame->tf_iioq_tail;
    614 				frame->tf_iioq_tail = frame->tf_iioq_head + 4;
    615 				/* Clear flags. */
    616 				frame->tf_ipsw &= ~(PSW_N|PSW_X|PSW_Y|PSW_Z|PSW_B|PSW_T|PSW_H|PSW_L);
    617 				/* Simulate another trap. */
    618 				continue;
    619 			}
    620 			break;
    621 		}
    622 		frame->tf_rctr = 0;
    623 		break;
    624 #endif /* USERTRACE */
    625 	case T_RECOVERY:
    626 #if !defined(DDB) && !defined(KGDB)
    627 		/* XXX will implement later */
    628 		printf ("trap: handicapped");
    629 		break;
    630 #else
    631 		goto dead_end;
    632 #endif
    633 
    634 	case T_EMULATION | T_USER:
    635 #ifdef FPEMUL
    636 		hppa_fpu_emulate(frame, l, opcode);
    637 #else  /* !FPEMUL */
    638 		/*
    639 		 * We don't have FPU emulation, so signal the
    640 		 * process with a SIGFPE.
    641 		 */
    642 
    643 		KSI_INIT_TRAP(&ksi);
    644 		ksi.ksi_signo = SIGFPE;
    645 		ksi.ksi_code = SI_NOINFO;
    646 		ksi.ksi_trap = type;
    647 		ksi.ksi_addr = (void *)frame->tf_iioq_head;
    648 		trapsignal(l, &ksi);
    649 #endif /* !FPEMUL */
    650 		break;
    651 
    652 	case T_DATALIGN:
    653 		if (l->l_addr->u_pcb.pcb_onfault) {
    654 do_onfault:
    655 			pcbp = &l->l_addr->u_pcb;
    656 			frame->tf_iioq_tail = 4 +
    657 				(frame->tf_iioq_head =
    658 				 pcbp->pcb_onfault);
    659 			pcbp->pcb_onfault = 0;
    660 			break;
    661 		}
    662 		/*FALLTHROUGH*/
    663 
    664 #ifdef DIAGNOSTIC
    665 		/* these just can't happen ever */
    666 	case T_PRIV_OP:
    667 	case T_PRIV_REG:
    668 		/* these just can't make it to the trap() ever */
    669 	case T_HPMC:
    670 	case T_HPMC | T_USER:
    671 	case T_EMULATION:
    672 	case T_EXCEPTION:
    673 #endif
    674 	case T_IBREAK:
    675 	case T_DBREAK:
    676 	dead_end:
    677 		if (type & T_USER) {
    678 #ifdef DEBUG
    679 			user_backtrace(frame, l, type);
    680 #endif
    681 			KSI_INIT_TRAP(&ksi);
    682 			ksi.ksi_signo = SIGILL;
    683 			ksi.ksi_code = ILL_ILLTRP;
    684 			ksi.ksi_trap = type;
    685 			ksi.ksi_addr = (void *)frame->tf_iioq_head;
    686 			trapsignal(l, &ksi);
    687 			break;
    688 		}
    689 		if (trap_kdebug(type, va, frame))
    690 			return;
    691 		else if (type == T_DATALIGN)
    692 			panic ("trap: %s at 0x%x", tts, (u_int) va);
    693 		else
    694 			panic ("trap: no debugger for \"%s\" (%d)", tts, type);
    695 		break;
    696 
    697 	case T_IBREAK | T_USER:
    698 	case T_DBREAK | T_USER:
    699 		KSI_INIT_TRAP(&ksi);
    700 		ksi.ksi_signo = SIGTRAP;
    701 		ksi.ksi_code = TRAP_TRACE;
    702 		ksi.ksi_trap = type_raw;
    703 		ksi.ksi_addr = (void *)frame->tf_iioq_head;
    704 #ifdef PTRACE
    705 		ss_clear_breakpoints(l);
    706 		if (opcode == SSBREAKPOINT)
    707 			ksi.ksi_code = TRAP_BRKPT;
    708 #endif
    709 		/* pass to user debugger */
    710 		trapsignal(l, &ksi);
    711 
    712 		break;
    713 
    714 #ifdef PTRACE
    715 	case T_TAKENBR | T_USER:
    716 		ss_clear_breakpoints(l);
    717 
    718 		KSI_INIT_TRAP(&ksi);
    719 		ksi.ksi_signo = SIGTRAP;
    720 		ksi.ksi_code = TRAP_TRACE;
    721 		ksi.ksi_trap = type_raw;
    722 		ksi.ksi_addr = (void *)frame->tf_iioq_head;
    723 
    724                 /* pass to user debugger */
    725 		trapsignal(l, &ksi);
    726 		break;
    727 #endif
    728 
    729 	case T_EXCEPTION | T_USER: {	/* co-proc assist trap */
    730 		uint64_t *fpp;
    731 		uint32_t *pex, ex, inst;
    732 		int i;
    733 
    734 		hppa_fpu_flush(l);
    735 		fpp = l->l_addr->u_pcb.pcb_fpregs;
    736 		pex = (uint32_t *)&fpp[1];
    737 		for (i = 1; i < 8 && !*pex; i++, pex++)
    738 			;
    739 		KASSERT(i < 8);
    740 		ex = *pex;
    741 		*pex = 0;
    742 
    743 		/* reset the trap flag, as if there was none */
    744 		fpp[0] &= ~(((uint64_t)HPPA_FPU_T) << 32);
    745 
    746 		/* emulate the instruction */
    747 		inst = ((uint32_t)fpopmap[ex >> 26] << 26) | (ex & 0x03ffffff);
    748 		hppa_fpu_emulate(frame, l, inst);
    749 		}
    750 		break;
    751 
    752 	case T_OVERFLOW | T_USER:
    753 		KSI_INIT_TRAP(&ksi);
    754 		ksi.ksi_signo = SIGFPE;
    755 		ksi.ksi_code = SI_NOINFO;
    756 		ksi.ksi_trap = type;
    757 		ksi.ksi_addr = (void *)va;
    758 		trapsignal(l, &ksi);
    759 		break;
    760 
    761 	case T_CONDITION | T_USER:
    762 		KSI_INIT_TRAP(&ksi);
    763 		ksi.ksi_signo = SIGFPE;
    764 		ksi.ksi_code = FPE_INTDIV;
    765 		ksi.ksi_trap = type;
    766 		ksi.ksi_addr = (void *)va;
    767 		trapsignal(l, &ksi);
    768 		break;
    769 
    770 	case T_ILLEGAL | T_USER:
    771 #ifdef DEBUG
    772 		user_backtrace(frame, l, type);
    773 #endif
    774 		KSI_INIT_TRAP(&ksi);
    775 		ksi.ksi_signo = SIGILL;
    776 		ksi.ksi_code = ILL_ILLOPC;
    777 		ksi.ksi_trap = type;
    778 		ksi.ksi_addr = (void *)va;
    779 		trapsignal(l, &ksi);
    780 		break;
    781 
    782 	case T_PRIV_OP | T_USER:
    783 #ifdef DEBUG
    784 		user_backtrace(frame, l, type);
    785 #endif
    786 		KSI_INIT_TRAP(&ksi);
    787 		ksi.ksi_signo = SIGILL;
    788 		ksi.ksi_code = ILL_PRVOPC;
    789 		ksi.ksi_trap = type;
    790 		ksi.ksi_addr = (void *)va;
    791 		trapsignal(l, &ksi);
    792 		break;
    793 
    794 	case T_PRIV_REG | T_USER:
    795 #ifdef DEBUG
    796 		user_backtrace(frame, l, type);
    797 #endif
    798 		KSI_INIT_TRAP(&ksi);
    799 		ksi.ksi_signo = SIGILL;
    800 		ksi.ksi_code = ILL_PRVREG;
    801 		ksi.ksi_trap = type;
    802 		ksi.ksi_addr = (void *)va;
    803 		trapsignal(l, &ksi);
    804 		break;
    805 
    806 		/* these should never got here */
    807 	case T_HIGHERPL | T_USER:
    808 	case T_LOWERPL | T_USER:
    809 		KSI_INIT_TRAP(&ksi);
    810 		ksi.ksi_signo = SIGSEGV;
    811 		ksi.ksi_code = SEGV_ACCERR;
    812 		ksi.ksi_trap = type;
    813 		ksi.ksi_addr = (void *)va;
    814 		trapsignal(l, &ksi);
    815 		break;
    816 
    817 	case T_IPROT | T_USER:
    818 	case T_DPROT | T_USER:
    819 		KSI_INIT_TRAP(&ksi);
    820 		ksi.ksi_signo = SIGSEGV;
    821 		ksi.ksi_code = SEGV_ACCERR;
    822 		ksi.ksi_trap = type;
    823 		ksi.ksi_addr = (void *)va;
    824 		trapsignal(l, &ksi);
    825 		break;
    826 
    827 	case T_DATACC:   	case T_USER | T_DATACC:
    828 	case T_ITLBMISS:	case T_USER | T_ITLBMISS:
    829 	case T_DTLBMISS:	case T_USER | T_DTLBMISS:
    830 	case T_ITLBMISSNA:	case T_USER | T_ITLBMISSNA:
    831 	case T_DTLBMISSNA:	case T_USER | T_DTLBMISSNA:
    832 	case T_TLB_DIRTY:	case T_USER | T_TLB_DIRTY:
    833 		vm = p->p_vmspace;
    834 
    835 		if (!vm) {
    836 #ifdef TRAPDEBUG
    837 			printf("trap: no vm, p=%p\n", p);
    838 #endif
    839 			goto dead_end;
    840 		}
    841 
    842 		/*
    843 		 * it could be a kernel map for exec_map faults
    844 		 */
    845 		if (!(type & T_USER) && space == HPPA_SID_KERNEL)
    846 			map = kernel_map;
    847 		else {
    848 			map = &vm->vm_map;
    849 			if ((l->l_flag & LW_SA)
    850 			    && (~l->l_pflag & LP_SA_NOBLOCK)) {
    851 				l->l_savp->savp_faultaddr = va;
    852 				l->l_pflag |= LP_SA_PAGEFAULT;
    853 			}
    854 		}
    855 
    856 		va = trunc_page(va);
    857 
    858 		if (map->pmap->pmap_space != space) {
    859 #ifdef TRAPDEBUG
    860 			printf("trap: space mismatch %d != %d\n",
    861 			    space, map->pmap->pmap_space);
    862 #endif
    863 			/* actually dump the user, crap the kernel */
    864 			goto dead_end;
    865 		}
    866 
    867 		/* Never call uvm_fault in interrupt context. */
    868 		KASSERT(hppa_intr_depth == 0);
    869 
    870 		onfault = l->l_addr->u_pcb.pcb_onfault;
    871 		l->l_addr->u_pcb.pcb_onfault = 0;
    872 		ret = uvm_fault(map, va, vftype);
    873 		l->l_addr->u_pcb.pcb_onfault = onfault;
    874 
    875 #ifdef TRAPDEBUG
    876 		printf("uvm_fault(%p, %x, %d)=%d\n",
    877 		    map, (u_int)va, vftype, ret);
    878 #endif
    879 
    880 		if (map != kernel_map)
    881 			l->l_pflag &= ~LP_SA_PAGEFAULT;
    882 
    883 		/*
    884 		 * If this was a stack access we keep track of the maximum
    885 		 * accessed stack size.  Also, if uvm_fault gets a protection
    886 		 * failure it is due to accessing the stack region outside
    887 		 * the current limit and we need to reflect that as an access
    888 		 * error.
    889 		 */
    890 		if (map != kernel_map && va >= (vaddr_t)vm->vm_minsaddr) {
    891 			if (ret == 0)
    892 				uvm_grow(l->l_proc, va);
    893 			else if (ret == EACCES)
    894 				ret = EFAULT;
    895 		}
    896 
    897 		if (ret != 0) {
    898 			if (type & T_USER) {
    899 #ifdef DEBUG
    900 				user_backtrace(frame, l, type);
    901 #endif
    902 				KSI_INIT_TRAP(&ksi);
    903 				ksi.ksi_signo = SIGSEGV;
    904 				ksi.ksi_code = (ret == EACCES ?
    905 						SEGV_ACCERR : SEGV_MAPERR);
    906 				ksi.ksi_trap = type;
    907 				ksi.ksi_addr = (void *)va;
    908 				trapsignal(l, &ksi);
    909 			} else {
    910 				if (l->l_addr->u_pcb.pcb_onfault) {
    911 					goto do_onfault;
    912 				}
    913 				panic("trap: uvm_fault(%p, %lx, %d): %d",
    914 				    map, va, vftype, ret);
    915 			}
    916 		}
    917 		break;
    918 
    919 	case T_DATALIGN | T_USER:
    920 #ifdef DEBUG
    921 		user_backtrace(frame, l, type);
    922 #endif
    923 		KSI_INIT_TRAP(&ksi);
    924 		ksi.ksi_signo = SIGBUS;
    925 		ksi.ksi_code = BUS_ADRALN;
    926 		ksi.ksi_trap = type;
    927 		ksi.ksi_addr = (void *)va;
    928 		trapsignal(l, &ksi);
    929 		break;
    930 
    931 	case T_INTERRUPT:
    932 	case T_INTERRUPT|T_USER:
    933 		hppa_intr(frame);
    934 		mtctl(frame->tf_eiem, CR_EIEM);
    935 		break;
    936 
    937 	case T_LOWERPL:
    938 	case T_DPROT:
    939 	case T_IPROT:
    940 	case T_OVERFLOW:
    941 	case T_CONDITION:
    942 	case T_ILLEGAL:
    943 	case T_HIGHERPL:
    944 	case T_TAKENBR:
    945 	case T_POWERFAIL:
    946 	case T_LPMC:
    947 	case T_PAGEREF:
    948 	case T_DATAPID:  	case T_DATAPID  | T_USER:
    949 		if (0 /* T-chip */) {
    950 			break;
    951 		}
    952 		/* FALLTHROUGH to unimplemented */
    953 	default:
    954 		panic ("trap: unimplemented \'%s\' (%d)", tts, type);
    955 	}
    956 
    957 	if (type & T_USER)
    958 		userret(l, l->l_md.md_regs->tf_iioq_head, 0);
    959 
    960 #ifdef DEBUG
    961 	frame_sanity_check(0xdead02, type, frame, l);
    962 	if (frame->tf_flags & TFF_LAST && (curlwp->l_flag & LW_IDLE) == 0)
    963 		frame_sanity_check(0xdead03, type, curlwp->l_md.md_regs,
    964 				   curlwp);
    965 #endif /* DEBUG */
    966 }
    967 
    968 void
    969 child_return(void *arg)
    970 {
    971 	struct lwp *l = arg;
    972 
    973 	userret(l, l->l_md.md_regs->tf_iioq_head, 0);
    974 	ktrsysret(SYS_fork, 0, 0);
    975 #ifdef DEBUG
    976 	frame_sanity_check(0xdead04, 0, l->l_md.md_regs, l);
    977 #endif /* DEBUG */
    978 }
    979 
    980 #ifdef PTRACE
    981 
    982 #include <sys/ptrace.h>
    983 
    984 int
    985 ss_get_value(struct lwp *l, vaddr_t addr, u_int *value)
    986 {
    987 	struct uio uio;
    988 	struct iovec iov;
    989 
    990 	iov.iov_base = (void *)value;
    991 	iov.iov_len = sizeof(u_int);
    992 	uio.uio_iov = &iov;
    993 	uio.uio_iovcnt = 1;
    994 	uio.uio_offset = (off_t)addr;
    995 	uio.uio_resid = sizeof(u_int);
    996 	uio.uio_rw = UIO_READ;
    997 	UIO_SETUP_SYSSPACE(&uio);
    998 
    999 	return (process_domem(curlwp, l, &uio));
   1000 }
   1001 
   1002 int
   1003 ss_put_value(struct lwp *l, vaddr_t addr, u_int value)
   1004 {
   1005 	struct uio uio;
   1006 	struct iovec iov;
   1007 
   1008 	iov.iov_base = (void *)&value;
   1009 	iov.iov_len = sizeof(u_int);
   1010 	uio.uio_iov = &iov;
   1011 	uio.uio_iovcnt = 1;
   1012 	uio.uio_offset = (off_t)addr;
   1013 	uio.uio_resid = sizeof(u_int);
   1014 	uio.uio_rw = UIO_WRITE;
   1015 	UIO_SETUP_SYSSPACE(&uio);
   1016 
   1017 	return (process_domem(curlwp, l, &uio));
   1018 }
   1019 
   1020 void
   1021 ss_clear_breakpoints(struct lwp *l)
   1022 {
   1023 	/* Restore origional instructions. */
   1024 	if (l->l_md.md_bpva != 0) {
   1025 		ss_put_value(l, l->l_md.md_bpva, l->l_md.md_bpsave[0]);
   1026 		ss_put_value(l, l->l_md.md_bpva + 4, l->l_md.md_bpsave[1]);
   1027 		l->l_md.md_bpva = 0;
   1028 	}
   1029 }
   1030 
   1031 
   1032 int
   1033 process_sstep(struct lwp *l, int sstep)
   1034 {
   1035 	struct trapframe *tf = l->l_md.md_regs;
   1036 	int error;
   1037 
   1038 	ss_clear_breakpoints(l);
   1039 
   1040 	/* We're continuing... */
   1041 	/* Don't touch the syscall gateway page. */
   1042 	/* XXX head */
   1043 	if (sstep == 0 ||
   1044 	    (tf->tf_iioq_tail & ~PAGE_MASK) == SYSCALLGATE) {
   1045 		tf->tf_ipsw &= ~PSW_T;
   1046 		return 0;
   1047 	}
   1048 
   1049 	l->l_md.md_bpva = tf->tf_iioq_tail & ~HPPA_PC_PRIV_MASK;
   1050 
   1051 	/*
   1052 	 * Insert two breakpoint instructions; the first one might be
   1053 	 * nullified.  Of course we need to save two instruction
   1054 	 * first.
   1055 	 */
   1056 
   1057 	error = ss_get_value(l, l->l_md.md_bpva, &l->l_md.md_bpsave[0]);
   1058 	if (error)
   1059 		return (error);
   1060 	error = ss_get_value(l, l->l_md.md_bpva + 4, &l->l_md.md_bpsave[1]);
   1061 	if (error)
   1062 		return (error);
   1063 
   1064 	error = ss_put_value(l, l->l_md.md_bpva, SSBREAKPOINT);
   1065 	if (error)
   1066 		return error;
   1067 	error = ss_put_value(l, l->l_md.md_bpva + 4, SSBREAKPOINT);
   1068 	if (error)
   1069 		return error;
   1070 
   1071 	tf->tf_ipsw |= PSW_T;
   1072 
   1073 	return 0;
   1074 }
   1075 #endif
   1076 
   1077 
   1078 /*
   1079  * call actual syscall routine
   1080  * from the low-level syscall handler:
   1081  * - all HPPA_FRAME_NARGS syscall's arguments supposed to be copied onto
   1082  *   our stack, this wins compared to copyin just needed amount anyway
   1083  * - register args are copied onto stack too
   1084  */
   1085 void
   1086 syscall(struct trapframe *frame, int *args)
   1087 {
   1088 	struct lwp *l;
   1089 	struct proc *p;
   1090 	const struct sysent *callp;
   1091 	int nsys, code, error;
   1092 	int tmp;
   1093 	int rval[2];
   1094 
   1095 	uvmexp.syscalls++;
   1096 
   1097 #ifdef DEBUG
   1098 	frame_sanity_check(0xdead04, 0, frame, curlwp);
   1099 #endif /* DEBUG */
   1100 
   1101 	if (!USERMODE(frame->tf_iioq_head))
   1102 		panic("syscall");
   1103 
   1104 	l = curlwp;
   1105 	p = l->l_proc;
   1106 	l->l_md.md_regs = frame;
   1107 	nsys = p->p_emul->e_nsysent;
   1108 	callp = p->p_emul->e_sysent;
   1109 	code = frame->tf_t1;
   1110 	LWP_CACHE_CREDS(l, p);
   1111 
   1112 #ifdef KERN_SA
   1113 	if (__predict_false((l->l_savp)
   1114             && (l->l_savp->savp_pflags & SAVP_FLAG_DELIVERING)))
   1115 		l->l_savp->savp_pflags &= ~SAVP_FLAG_DELIVERING;
   1116 #endif
   1117 
   1118 	/*
   1119 	 * Restarting a system call is touchy on the HPPA,
   1120 	 * because syscall arguments are passed in registers
   1121 	 * and the program counter of the syscall "point"
   1122 	 * isn't easily divined.
   1123 	 *
   1124 	 * We handle the first problem by assuming that we
   1125 	 * will have to restart this system call, so we
   1126 	 * stuff the first four words of the original arguments
   1127 	 * back into the frame as arg0...arg3, which is where
   1128 	 * we found them in the first place.  Any further
   1129 	 * arguments are (still) on the user's stack and the
   1130 	 * syscall code will fetch them from there (again).
   1131 	 *
   1132 	 * The program counter problem is addressed below.
   1133 	 */
   1134 	frame->tf_arg0 = args[0];
   1135 	frame->tf_arg1 = args[1];
   1136 	frame->tf_arg2 = args[2];
   1137 	frame->tf_arg3 = args[3];
   1138 
   1139 	/*
   1140 	 * Some special handling for the syscall(2) and
   1141 	 * __syscall(2) system calls.
   1142 	 */
   1143 	switch (code) {
   1144 	case SYS_syscall:
   1145 		code = *args;
   1146 		args += 1;
   1147 		break;
   1148 	case SYS___syscall:
   1149 		if (callp != sysent)
   1150 			break;
   1151 		/*
   1152 		 * NB: even though __syscall(2) takes a quad_t
   1153 		 * containing the system call number, because
   1154 		 * our argument copying word-swaps 64-bit arguments,
   1155 		 * the least significant word of that quad_t
   1156 		 * is the first word in the argument array.
   1157 		 */
   1158 		code = *args;
   1159 		args += 2;
   1160 	}
   1161 
   1162 	/*
   1163 	 * Stacks growing from lower addresses to higher
   1164 	 * addresses are not really such a good idea, because
   1165 	 * it makes it impossible to overlay a struct on top
   1166 	 * of C stack arguments (the arguments appear in
   1167 	 * reversed order).
   1168 	 *
   1169 	 * You can do the obvious thing (as locore.S does) and
   1170 	 * copy argument words one by one, laying them out in
   1171 	 * the "right" order in the destination buffer, but this
   1172 	 * ends up word-swapping multi-word arguments (like off_t).
   1173 	 *
   1174 	 * To compensate, we have some automatically-generated
   1175 	 * code that word-swaps these multi-word arguments.
   1176 	 * Right now the script that generates this code is
   1177 	 * in Perl, because I don't know awk.
   1178 	 *
   1179 	 * FIXME - this works only on native binaries and
   1180 	 * will probably screw up any and all emulation.
   1181 	 */
   1182 	switch (code) {
   1183 	case SYS_pread:
   1184 		/*
   1185 		 * 	syscallarg(int) fd;
   1186 		 * 	syscallarg(void *) buf;
   1187 		 * 	syscallarg(size_t) nbyte;
   1188 		 * 	syscallarg(int) pad;
   1189 		 * 	syscallarg(off_t) offset;
   1190 		 */
   1191 		tmp = args[4];
   1192 		args[4] = args[4 + 1];
   1193 		args[4 + 1] = tmp;
   1194 		break;
   1195 	case SYS_pwrite:
   1196 		/*
   1197 		 * 	syscallarg(int) fd;
   1198 		 * 	syscallarg(const void *) buf;
   1199 		 * 	syscallarg(size_t) nbyte;
   1200 		 * 	syscallarg(int) pad;
   1201 		 * 	syscallarg(off_t) offset;
   1202 		 */
   1203 		tmp = args[4];
   1204 		args[4] = args[4 + 1];
   1205 		args[4 + 1] = tmp;
   1206 		break;
   1207 	case SYS_mmap:
   1208 		/*
   1209 		 * 	syscallarg(void *) addr;
   1210 		 * 	syscallarg(size_t) len;
   1211 		 * 	syscallarg(int) prot;
   1212 		 * 	syscallarg(int) flags;
   1213 		 * 	syscallarg(int) fd;
   1214 		 * 	syscallarg(long) pad;
   1215 		 * 	syscallarg(off_t) pos;
   1216 		 */
   1217 		tmp = args[6];
   1218 		args[6] = args[6 + 1];
   1219 		args[6 + 1] = tmp;
   1220 		break;
   1221 	case SYS_lseek:
   1222 		/*
   1223 		 * 	syscallarg(int) fd;
   1224 		 * 	syscallarg(int) pad;
   1225 		 * 	syscallarg(off_t) offset;
   1226 		 */
   1227 		tmp = args[2];
   1228 		args[2] = args[2 + 1];
   1229 		args[2 + 1] = tmp;
   1230 		break;
   1231 	case SYS_truncate:
   1232 		/*
   1233 		 * 	syscallarg(const char *) path;
   1234 		 * 	syscallarg(int) pad;
   1235 		 * 	syscallarg(off_t) length;
   1236 		 */
   1237 		tmp = args[2];
   1238 		args[2] = args[2 + 1];
   1239 		args[2 + 1] = tmp;
   1240 		break;
   1241 	case SYS_ftruncate:
   1242 		/*
   1243 		 * 	syscallarg(int) fd;
   1244 		 * 	syscallarg(int) pad;
   1245 		 * 	syscallarg(off_t) length;
   1246 		 */
   1247 		tmp = args[2];
   1248 		args[2] = args[2 + 1];
   1249 		args[2 + 1] = tmp;
   1250 		break;
   1251 	case SYS_preadv:
   1252 		/*
   1253 		 * 	syscallarg(int) fd;
   1254 		 * 	syscallarg(const struct iovec *) iovp;
   1255 		 * 	syscallarg(int) iovcnt;
   1256 		 * 	syscallarg(int) pad;
   1257 		 * 	syscallarg(off_t) offset;
   1258 		 */
   1259 		tmp = args[4];
   1260 		args[4] = args[4 + 1];
   1261 		args[4 + 1] = tmp;
   1262 		break;
   1263 	case SYS_pwritev:
   1264 		/*
   1265 		 * 	syscallarg(int) fd;
   1266 		 * 	syscallarg(const struct iovec *) iovp;
   1267 		 * 	syscallarg(int) iovcnt;
   1268 		 * 	syscallarg(int) pad;
   1269 		 * 	syscallarg(off_t) offset;
   1270 		 */
   1271 		tmp = args[4];
   1272 		args[4] = args[4 + 1];
   1273 		args[4 + 1] = tmp;
   1274 		break;
   1275 	case SYS___posix_fadvise50:
   1276 		/*
   1277 		 *	syscallarg(int) fd;
   1278 		 *	syscallarg(int) pad;
   1279 		 *	syscallarg(off_t) offset;
   1280 		 *	syscallarg(off_t) len;
   1281 		 *	syscallarg(int) advice;
   1282 		 */
   1283 		tmp = args[2];
   1284 		args[2] = args[2 + 1];
   1285 		args[2 + 1] = tmp;
   1286 		tmp = args[4];
   1287 		args[4] = args[4 + 1];
   1288 		args[4 + 1] = tmp;
   1289 	case SYS___mknod50:
   1290 		/*
   1291 		 *	syscallarg(const char *) path;
   1292 		 *	syscallarg(mode_t) mode;
   1293 		 *	syscallarg(dev_t) dev;
   1294 		 */
   1295 		tmp = args[2];
   1296 		args[2] = args[2 + 1];
   1297 		args[2 + 1] = tmp;
   1298 	default:
   1299 		break;
   1300 	}
   1301 
   1302 #ifdef USERTRACE
   1303 	if (0) {
   1304 		user_backtrace(frame, l, -1);
   1305 		frame->tf_ipsw |= PSW_R;
   1306 		frame->tf_rctr = 0;
   1307 		printf("r %08x", frame->tf_iioq_head);
   1308 		rctr_next_iioq = frame->tf_iioq_head + 4;
   1309 	}
   1310 #endif
   1311 
   1312 	if (code < 0 || code >= nsys)
   1313 		callp += p->p_emul->e_nosys;	/* bad syscall # */
   1314 	else
   1315 		callp += code;
   1316 
   1317 	if ((error = trace_enter(code, args, callp->sy_narg)) != 0)
   1318 		goto out;
   1319 
   1320 	rval[0] = 0;
   1321 	rval[1] = 0;
   1322 	error = sy_call(callp, l, args, rval);
   1323 out:
   1324 	switch (error) {
   1325 	case 0:
   1326 		l = curlwp;			/* changes on exec() */
   1327 		frame = l->l_md.md_regs;
   1328 		frame->tf_ret0 = rval[0];
   1329 		frame->tf_ret1 = rval[1];
   1330 		frame->tf_t1 = 0;
   1331 		break;
   1332 	case ERESTART:
   1333 		/*
   1334 		 * Now we have to wind back the instruction
   1335 		 * offset queue to the point where the system
   1336 		 * call will be made again.  This is inherently
   1337 		 * tied to the SYSCALL macro.
   1338 		 *
   1339 		 * Currently, the part of the SYSCALL macro
   1340 		 * that we want to rerun reads as:
   1341 		 *
   1342 		 *	ldil	L%SYSCALLGATE, r1
   1343 		 *	ble	4(sr7, r1)
   1344 		 *	ldi	__CONCAT(SYS_,x), t1
   1345 		 *	comb,<>	%r0, %t1, __cerror
   1346 		 *
   1347 		 * And our offset queue head points to the
   1348 		 * comb instruction.  So we need to
   1349 		 * subtract twelve to reach the ldil.
   1350 		 */
   1351 		frame->tf_iioq_head -= 12;
   1352 		frame->tf_iioq_tail = frame->tf_iioq_head + 4;
   1353 		break;
   1354 	case EJUSTRETURN:
   1355 		p = curproc;
   1356 		break;
   1357 	default:
   1358 		if (p->p_emul->e_errno)
   1359 			error = p->p_emul->e_errno[error];
   1360 		frame->tf_t1 = error;
   1361 		break;
   1362 	}
   1363 
   1364 	trace_exit(code, rval, error);
   1365 
   1366 	userret(l, frame->tf_iioq_head, 0);
   1367 #ifdef DEBUG
   1368 	frame_sanity_check(0xdead05, 0, frame, l);
   1369 #endif /* DEBUG */
   1370 }
   1371 
   1372 /*
   1373  * Start a new LWP
   1374  */
   1375 void
   1376 startlwp(void *arg)
   1377 {
   1378 	int err;
   1379 	ucontext_t *uc = arg;
   1380 	struct lwp *l = curlwp;
   1381 
   1382 	err = cpu_setmcontext(l, &uc->uc_mcontext, uc->uc_flags);
   1383 #if DIAGNOSTIC
   1384 	if (err) {
   1385 		printf("Error %d from cpu_setmcontext.", err);
   1386 	}
   1387 #endif
   1388 	pool_put(&lwp_uc_pool, uc);
   1389 
   1390 	userret(l, l->l_md.md_regs->tf_iioq_head, 0);
   1391 }
   1392 
   1393 /*
   1394  * XXX This is a terrible name.
   1395  */
   1396 void
   1397 upcallret(struct lwp *l)
   1398 {
   1399 	userret(l, l->l_md.md_regs->tf_iioq_head, 0);
   1400 }
   1401