trap.c revision 1.58
1/*	$NetBSD: trap.c,v 1.58 2009/04/11 09:49:23 skrll Exp $	*/
2
3/*-
4 * Copyright (c) 2001, 2002 The NetBSD Foundation, Inc.
5 * All rights reserved.
6 *
7 * This code is derived from software contributed to The NetBSD Foundation
8 * by Matthew Fredette.
9 *
10 * Redistribution and use in source and binary forms, with or without
11 * modification, are permitted provided that the following conditions
12 * are met:
13 * 1. Redistributions of source code must retain the above copyright
14 *    notice, this list of conditions and the following disclaimer.
15 * 2. Redistributions in binary form must reproduce the above copyright
16 *    notice, this list of conditions and the following disclaimer in the
17 *    documentation and/or other materials provided with the distribution.
18 *
19 * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
20 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
21 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
22 * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
23 * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
24 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
25 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
26 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
27 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
28 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
29 * POSSIBILITY OF SUCH DAMAGE.
30 */
31
32/*	$OpenBSD: trap.c,v 1.30 2001/09/19 20:50:56 mickey Exp $	*/
33
34/*
35 * Copyright (c) 1998-2000 Michael Shalayeff
36 * All rights reserved.
37 *
38 * Redistribution and use in source and binary forms, with or without
39 * modification, are permitted provided that the following conditions
40 * are met:
41 * 1. Redistributions of source code must retain the above copyright
42 *    notice, this list of conditions and the following disclaimer.
43 * 2. Redistributions in binary form must reproduce the above copyright
44 *    notice, this list of conditions and the following disclaimer in the
45 *    documentation and/or other materials provided with the distribution.
46 * 3. All advertising materials mentioning features or use of this software
47 *    must display the following acknowledgement:
48 *	This product includes software developed by Michael Shalayeff.
49 * 4. The name of the author may not be used to endorse or promote products
50 *    derived from this software without specific prior written permission.
51 *
52 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
53 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
54 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
55 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
56 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
57 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
58 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
59 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
60 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
61 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
62 */
63
64#include <sys/cdefs.h>
65__KERNEL_RCSID(0, "$NetBSD: trap.c,v 1.58 2009/04/11 09:49:23 skrll Exp $");
66
67/* #define INTRDEBUG */
68/* #define TRAPDEBUG */
69/* #define USERTRACE */
70
71#include "opt_kgdb.h"
72#include "opt_ptrace.h"
73#include "opt_sa.h"
74
75#include <sys/param.h>
76#include <sys/systm.h>
77#include <sys/kernel.h>
78#include <sys/syscall.h>
79#include <sys/syscallvar.h>
80#include <sys/sa.h>
81#include <sys/savar.h>
82#include <sys/mutex.h>
83#include <sys/ktrace.h>
84#include <sys/proc.h>
85#include <sys/signalvar.h>
86#include <sys/user.h>
87#include <sys/acct.h>
88#include <sys/signal.h>
89#include <sys/device.h>
90#include <sys/pool.h>
91#include <sys/userret.h>
92
93#include <net/netisr.h>
94
95#ifdef KGDB
96#include <sys/kgdb.h>
97#endif
98
99#include <uvm/uvm.h>
100
101#include <machine/iomod.h>
102#include <machine/cpufunc.h>
103#include <machine/reg.h>
104#include <machine/autoconf.h>
105
106#include <machine/db_machdep.h>
107
108#include <hppa/hppa/machdep.h>
109
110#include <ddb/db_output.h>
111#include <ddb/db_interface.h>
112
113#ifdef PTRACE
114void ss_clear_breakpoints(struct lwp *l);
115int ss_put_value(struct lwp *, vaddr_t, u_int);
116int ss_get_value(struct lwp *, vaddr_t, u_int *);
117#endif
118
119/* single-step breakpoint */
120#define SSBREAKPOINT   (HPPA_BREAK_KERNEL | (HPPA_BREAK_SS << 13))
121
122#if defined(DEBUG) || defined(DIAGNOSTIC)
123/*
124 * 0x6fc1000 is a stwm r1, d(sr0, sp), which is the last
125 * instruction in the function prologue that gcc -O0 uses.
126 * When we have this instruction we know the relationship
127 * between the stack pointer and the gcc -O0 frame pointer
128 * (in r3, loaded with the initial sp) for the body of a
129 * function.
130 *
131 * If the given instruction is a stwm r1, d(sr0, sp) where
132 * d > 0, we evaluate to d, else we evaluate to zero.
133 */
134#define STWM_R1_D_SR0_SP(inst) \
135	(((inst) & 0xffffc001) == 0x6fc10000 ? (((inst) & 0x00003ff) >> 1) : 0)
136#endif /* DEBUG || DIAGNOSTIC */
137
138const char *trap_type[] = {
139	"invalid",
140	"HPMC",
141	"power failure",
142	"recovery counter",
143	"external interrupt",
144	"LPMC",
145	"ITLB miss fault",
146	"instruction protection",
147	"Illegal instruction",
148	"break instruction",
149	"privileged operation",
150	"privileged register",
151	"overflow",
152	"conditional",
153	"assist exception",
154	"DTLB miss",
155	"ITLB non-access miss",
156	"DTLB non-access miss",
157	"data protection/rights/alignment",
158	"data break",
159	"TLB dirty",
160	"page reference",
161	"assist emulation",
162	"higher-priv transfer",
163	"lower-priv transfer",
164	"taken branch",
165	"data access rights",
166	"data protection",
167	"unaligned data ref",
168};
169int trap_types = sizeof(trap_type)/sizeof(trap_type[0]);
170
171uint8_t fpopmap[] = {
172	0x00, 0x00, 0x00, 0x06, 0x00, 0x00, 0x00, 0x00,
173	0x00, 0x0c, 0x00, 0x0e, 0x00, 0x00, 0x00, 0x00,
174	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
175	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
176	0x00, 0x00, 0x00, 0x26, 0x00, 0x00, 0x00, 0x00,
177	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
178	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
179	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
180};
181
182volatile int astpending;
183
184void pmap_hptdump(void);
185void syscall(struct trapframe *, int *);
186
187#if defined(DEBUG)
188struct trapframe *sanity_frame;
189struct lwp *sanity_lwp;
190int sanity_checked = 0;
191void frame_sanity_check(int, int, struct trapframe *, struct lwp *);
192#endif
193
194
195#ifdef USERTRACE
196/*
197 * USERTRACE is a crude facility that traces the PC of
198 * a single user process.  This tracing is normally
199 * activated by the dispatching of a certain syscall
200 * with certain arguments - see the activation code in
201 * syscall().
202 */
203static void user_backtrace(struct trapframe *, struct lwp *, int);
204static void user_backtrace_raw(u_int, u_int);
205
206u_int rctr_next_iioq;
207#endif
208
209static inline void
210userret(struct lwp *l, register_t pc, u_quad_t oticks)
211{
212	struct proc *p = l->l_proc;
213
214	if (curcpu()->ci_want_resched) {
215		preempt();
216	}
217
218	mi_userret(l);
219
220	/*
221	 * If profiling, charge recent system time to the trapped pc.
222	 */
223	if (p->p_stflag & PST_PROFIL) {
224		extern int psratio;
225
226		addupc_task(l, pc, (int)(p->p_sticks - oticks) * psratio);
227	}
228}
229
230/*
231 * This handles some messy kernel debugger details.
232 * It dispatches into either kgdb or DDB, and knows
233 * about some special things to do, like skipping over
234 * break instructions and how to really set up for
235 * a single-step.
236 */
237#if defined(KGDB) || defined(DDB)
238static int
239trap_kdebug(int type, int code, struct trapframe *frame)
240{
241	int handled;
242	u_int tf_iioq_head_old;
243	u_int tf_iioq_tail_old;
244
245	for(;;) {
246
247		/* This trap has not been handled. */
248		handled = 0;
249
250		/* Remember the instruction offset queue. */
251		tf_iioq_head_old = frame->tf_iioq_head;
252		tf_iioq_tail_old = frame->tf_iioq_tail;
253
254#ifdef	KGDB
255		/* Let KGDB handle it (if connected) */
256		if (!handled)
257			handled = kgdb_trap(type, frame);
258#endif
259#ifdef	DDB
260		/* Let DDB handle it. */
261		if (!handled)
262			handled = kdb_trap(type, code, frame);
263#endif
264
265		/* If this trap wasn't handled, return now. */
266		if (!handled)
267			return(0);
268
269		/*
270		 * If the instruction offset queue head changed,
271		 * but the offset queue tail didn't, assume that
272		 * the user wants to jump to the head offset, and
273		 * adjust the tail accordingly.  This should fix
274		 * the kgdb `jump' command, and can help DDB users
275		 * who `set' the offset head but forget the tail.
276		 */
277		if (frame->tf_iioq_head != tf_iioq_head_old &&
278		    frame->tf_iioq_tail == tf_iioq_tail_old)
279			frame->tf_iioq_tail = frame->tf_iioq_head + 4;
280
281		/*
282		 * This is some single-stepping support.
283		 * If we're trying to step through a nullified
284		 * instruction, just advance by hand and trap
285		 * again.  Otherwise, load the recovery counter
286		 * with zero.
287		 */
288		if (frame->tf_ipsw & PSW_R) {
289#ifdef TRAPDEBUG
290			printf("(single stepping at head 0x%x tail 0x%x)\n",
291			    frame->tf_iioq_head, frame->tf_iioq_tail);
292#endif
293			if (frame->tf_ipsw & PSW_N) {
294#ifdef TRAPDEBUG
295				printf("(single stepping past nullified)\n");
296#endif
297
298				/* Advance the program counter. */
299				frame->tf_iioq_head = frame->tf_iioq_tail;
300				frame->tf_iioq_tail = frame->tf_iioq_head + 4;
301
302				/* Clear flags. */
303				frame->tf_ipsw &= ~(PSW_N|PSW_X|PSW_Y|PSW_Z|PSW_B|PSW_T|PSW_H|PSW_L);
304
305				/* Simulate another trap. */
306				type = T_RECOVERY;
307				continue;
308			}
309			frame->tf_rctr = 0;
310		}
311
312		/* We handled this trap. */
313		return (1);
314	}
315	/* NOTREACHED */
316}
317#else	/* !KGDB && !DDB */
318#define trap_kdebug(t, c, f)	(0)
319#endif	/* !KGDB && !DDB */
320
321#if defined(DEBUG) || defined(USERTRACE)
322/*
323 * These functions give a crude usermode backtrace.  They
324 * really only work when code has been compiled without
325 * optimization, as they assume a certain function prologue
326 * sets up a frame pointer and stores the return pointer
327 * and arguments in it.
328 */
329static void
330user_backtrace_raw(u_int pc, u_int fp)
331{
332	int frame_number;
333	int arg_number;
334
335	for (frame_number = 0;
336	     frame_number < 100 && pc > HPPA_PC_PRIV_MASK && fp;
337	     frame_number++) {
338
339		printf("%3d: pc=%08x%s fp=0x%08x", frame_number,
340		    pc & ~HPPA_PC_PRIV_MASK, USERMODE(pc) ? "  " : "**", fp);
341		for(arg_number = 0; arg_number < 4; arg_number++)
342			printf(" arg%d=0x%08x", arg_number,
343			    (int) fuword(HPPA_FRAME_CARG(arg_number, fp)));
344		printf("\n");
345                pc = fuword(((register_t *) fp) - 5);	/* fetch rp */
346		if (pc == -1) {
347			printf("  fuword for pc failed\n");
348			break;
349		}
350                fp = fuword(((register_t *) fp) + 0);	/* fetch previous fp */
351		if (fp == -1) {
352			printf("  fuword for fp failed\n");
353			break;
354		}
355	}
356	printf("  backtrace stopped with pc %08x fp 0x%08x\n", pc, fp);
357}
358
359static void
360user_backtrace(struct trapframe *tf, struct lwp *l, int type)
361{
362	struct proc *p = l->l_proc;
363	u_int pc, fp, inst;
364
365	/*
366	 * Display any trap type that we have.
367	 */
368	if (type >= 0)
369		printf("pid %d (%s) trap #%d\n",
370		    p->p_pid, p->p_comm, type & ~T_USER);
371
372	/*
373	 * Assuming that the frame pointer in r3 is valid,
374	 * dump out a stack trace.
375	 */
376	fp = tf->tf_r3;
377	printf("pid %d (%s) backtrace, starting with fp 0x%08x\n",
378		p->p_pid, p->p_comm, fp);
379	user_backtrace_raw(tf->tf_iioq_head, fp);
380
381	/*
382	 * In case the frame pointer in r3 is not valid,
383	 * assuming the stack pointer is valid and the
384	 * faulting function is a non-leaf, if we can
385	 * find its prologue we can recover its frame
386	 * pointer.
387	 */
388	pc = tf->tf_iioq_head;
389	fp = tf->tf_sp - HPPA_FRAME_SIZE;
390	printf("pid %d (%s) backtrace, starting with sp 0x%08x pc 0x%08x\n",
391		p->p_pid, p->p_comm, tf->tf_sp, pc);
392	for (pc &= ~HPPA_PC_PRIV_MASK; pc > 0; pc -= sizeof(inst)) {
393		inst = fuword((register_t *) pc);
394		if (inst == -1) {
395			printf("  fuword for inst at pc %08x failed\n", pc);
396			break;
397		}
398		/* Check for the prologue instruction that sets sp. */
399		if (STWM_R1_D_SR0_SP(inst)) {
400			fp = tf->tf_sp - STWM_R1_D_SR0_SP(inst);
401			printf("  sp from fp at pc %08x: %08x\n", pc, inst);
402			break;
403		}
404	}
405	user_backtrace_raw(tf->tf_iioq_head, fp);
406}
407#endif /* DEBUG || USERTRACE */
408
409#ifdef DEBUG
410/*
411 * This sanity-checks a trapframe.  It is full of various
412 * assumptions about what a healthy CPU state should be,
413 * with some documented elsewhere, some not.
414 */
415void
416frame_sanity_check(int where, int type, struct trapframe *tf, struct lwp *l)
417{
418	extern int kernel_text;
419	extern int etext;
420	extern register_t kpsw;
421	extern vaddr_t hpt_base;
422	extern vsize_t hpt_mask;
423#define SANITY(e)					\
424do {							\
425	if (sanity_frame == NULL && !(e)) {		\
426		sanity_frame = tf;			\
427		sanity_lwp = l;				\
428		sanity_checked = __LINE__;		\
429	}						\
430} while (/* CONSTCOND */ 0)
431
432	SANITY((tf->tf_ipsw & kpsw) == kpsw);
433	SANITY(tf->tf_hptm == hpt_mask && tf->tf_vtop == hpt_base);
434	SANITY((kpsw & PSW_I) == 0 || tf->tf_eiem != 0);
435	if (tf->tf_iisq_head == HPPA_SID_KERNEL) {
436		vaddr_t minsp, maxsp;
437
438		/*
439		 * If the trap happened in the gateway
440		 * page, we take the easy way out and
441		 * assume that the trapframe is okay.
442		 */
443		if ((tf->tf_iioq_head & ~PAGE_MASK) == SYSCALLGATE)
444			goto out;
445
446		SANITY(!USERMODE(tf->tf_iioq_head));
447		SANITY(!USERMODE(tf->tf_iioq_tail));
448
449		/*
450		 * Don't check the instruction queues or stack on interrupts
451		 * as we could be be in the sti code (outside normal kernel
452		 * text) or switching LWPs (curlwp and sp are not in sync)
453		 */
454		if ((type & ~T_USER) == T_INTERRUPT)
455			goto out;
456
457		SANITY(tf->tf_iioq_head >= (u_int) &kernel_text);
458		SANITY(tf->tf_iioq_head < (u_int) &etext);
459		SANITY(tf->tf_iioq_tail >= (u_int) &kernel_text);
460		SANITY(tf->tf_iioq_tail < (u_int) &etext);
461
462#ifdef HPPA_REDZONE
463		maxsp = (u_int)(l->l_addr) + HPPA_REDZONE;
464#else
465		maxsp = (u_int)(l->l_addr) + USPACE;
466#endif
467		minsp = (u_int)(l->l_addr) + PAGE_SIZE;
468
469		SANITY(l != NULL || (tf->tf_sp >= minsp && tf->tf_sp < maxsp));
470	} else {
471		SANITY(USERMODE(tf->tf_iioq_head));
472		SANITY(USERMODE(tf->tf_iioq_tail));
473		SANITY(l != NULL && tf->tf_cr30 == kvtop((void *)l->l_addr));
474	}
475#undef SANITY
476out:
477	if (sanity_frame == tf) {
478		printf("insanity: where 0x%x type 0x%x tf %p lwp %p line %d "
479		       "sp 0x%x pc 0x%x\n",
480		       where, type, sanity_frame, sanity_lwp, sanity_checked,
481		       tf->tf_sp, tf->tf_iioq_head);
482		(void) trap_kdebug(T_IBREAK, 0, tf);
483		sanity_frame = NULL;
484		sanity_lwp = NULL;
485		sanity_checked = 0;
486	}
487}
488#endif /* DEBUG */
489
490void
491trap(int type, struct trapframe *frame)
492{
493	struct lwp *l;
494	struct proc *p;
495	struct pcb *pcbp;
496	vaddr_t va;
497	struct vm_map *map;
498	struct vmspace *vm;
499	vm_prot_t vftype;
500	pa_space_t space;
501	ksiginfo_t ksi;
502	u_int opcode, onfault;
503	int ret;
504	const char *tts;
505	int type_raw;
506#ifdef DIAGNOSTIC
507	extern int emergency_stack_start, emergency_stack_end;
508#endif
509
510	type_raw = type & ~T_USER;
511	opcode = frame->tf_iir;
512	if (type_raw == T_ITLBMISS || type_raw == T_ITLBMISSNA ||
513	    type_raw == T_IBREAK || type_raw == T_TAKENBR) {
514		va = frame->tf_iioq_head;
515		space = frame->tf_iisq_head;
516		vftype = VM_PROT_EXECUTE;
517	} else {
518		va = frame->tf_ior;
519		space = frame->tf_isr;
520		vftype = inst_store(opcode) ? VM_PROT_WRITE : VM_PROT_READ;
521	}
522
523	l = curlwp;
524	p = l ? l->l_proc : NULL;
525	if ((type & T_USER) != 0)
526		LWP_CACHE_CREDS(l, p);
527
528	tts = (type & ~T_USER) > trap_types ? "reserved" :
529		trap_type[type & ~T_USER];
530
531#ifdef DIAGNOSTIC
532	/*
533	 * If we are on the emergency stack, then we either got
534	 * a fault on the kernel stack, or we're just handling
535	 * a trap for the machine check handler (which also
536	 * runs on the emergency stack).
537	 *
538	 * We *very crudely* differentiate between the two cases
539	 * by checking the faulting instruction: if it is the
540	 * function prologue instruction that stores the old
541	 * frame pointer and updates the stack pointer, we assume
542	 * that we faulted on the kernel stack.
543	 *
544	 * In this case, not completing that instruction will
545	 * probably confuse backtraces in kgdb/ddb.  Completing
546	 * it would be difficult, because we already faulted on
547	 * that part of the stack, so instead we fix up the
548	 * frame as if the function called has just returned.
549	 * This has peculiar knowledge about what values are in
550	 * what registers during the "normal gcc -g" prologue.
551	 */
552	if (&type >= &emergency_stack_start &&
553	    &type < &emergency_stack_end &&
554	    type != T_IBREAK && STWM_R1_D_SR0_SP(opcode)) {
555		/* Restore the caller's frame pointer. */
556		frame->tf_r3 = frame->tf_r1;
557		/* Restore the caller's instruction offsets. */
558		frame->tf_iioq_head = frame->tf_rp;
559		frame->tf_iioq_tail = frame->tf_iioq_head + 4;
560		goto dead_end;
561	}
562#endif /* DIAGNOSTIC */
563
564#ifdef DEBUG
565	frame_sanity_check(0xdead01, type, frame, l);
566#endif /* DEBUG */
567
568	/* If this is a trap, not an interrupt, reenable interrupts. */
569	if (type_raw != T_INTERRUPT)
570		mtctl(frame->tf_eiem, CR_EIEM);
571
572	if (frame->tf_flags & TFF_LAST)
573		l->l_md.md_regs = frame;
574
575#ifdef TRAPDEBUG
576	if (type_raw != T_INTERRUPT && type_raw != T_IBREAK)
577		printf("trap: %d, %s for %x:%x at %x:%x, fp=%p, rp=%x\n",
578		    type, tts, space, (u_int)va, frame->tf_iisq_head,
579		    frame->tf_iioq_head, frame, frame->tf_rp);
580	else if (type_raw == T_IBREAK)
581		printf("trap: break instruction %x:%x at %x:%x, fp=%p\n",
582		    break5(opcode), break13(opcode),
583		    frame->tf_iisq_head, frame->tf_iioq_head, frame);
584
585	{
586		extern int etext;
587		if (frame < (struct trapframe *)&etext) {
588			printf("trap: bogus frame ptr %p\n", frame);
589			goto dead_end;
590		}
591	}
592#endif
593	switch (type) {
594	case T_NONEXIST:
595	case T_NONEXIST|T_USER:
596#if !defined(DDB) && !defined(KGDB)
597		/* we've got screwed up by the central scrutinizer */
598		panic ("trap: elvis has just left the building!");
599		break;
600#else
601		goto dead_end;
602#endif
603	case T_RECOVERY|T_USER:
604#ifdef USERTRACE
605		for(;;) {
606			if (frame->tf_iioq_head != rctr_next_iioq)
607				printf("-%08x\nr %08x",
608					rctr_next_iioq - 4,
609					frame->tf_iioq_head);
610			rctr_next_iioq = frame->tf_iioq_head + 4;
611			if (frame->tf_ipsw & PSW_N) {
612				/* Advance the program counter. */
613				frame->tf_iioq_head = frame->tf_iioq_tail;
614				frame->tf_iioq_tail = frame->tf_iioq_head + 4;
615				/* Clear flags. */
616				frame->tf_ipsw &= ~(PSW_N|PSW_X|PSW_Y|PSW_Z|PSW_B|PSW_T|PSW_H|PSW_L);
617				/* Simulate another trap. */
618				continue;
619			}
620			break;
621		}
622		frame->tf_rctr = 0;
623		break;
624#endif /* USERTRACE */
625	case T_RECOVERY:
626#if !defined(DDB) && !defined(KGDB)
627		/* XXX will implement later */
628		printf ("trap: handicapped");
629		break;
630#else
631		goto dead_end;
632#endif
633
634	case T_EMULATION | T_USER:
635#ifdef FPEMUL
636		hppa_fpu_emulate(frame, l, opcode);
637#else  /* !FPEMUL */
638		/*
639		 * We don't have FPU emulation, so signal the
640		 * process with a SIGFPE.
641		 */
642
643		KSI_INIT_TRAP(&ksi);
644		ksi.ksi_signo = SIGFPE;
645		ksi.ksi_code = SI_NOINFO;
646		ksi.ksi_trap = type;
647		ksi.ksi_addr = (void *)frame->tf_iioq_head;
648		trapsignal(l, &ksi);
649#endif /* !FPEMUL */
650		break;
651
652	case T_DATALIGN:
653		if (l->l_addr->u_pcb.pcb_onfault) {
654do_onfault:
655			pcbp = &l->l_addr->u_pcb;
656			frame->tf_iioq_tail = 4 +
657				(frame->tf_iioq_head =
658				 pcbp->pcb_onfault);
659			pcbp->pcb_onfault = 0;
660			break;
661		}
662		/*FALLTHROUGH*/
663
664#ifdef DIAGNOSTIC
665		/* these just can't happen ever */
666	case T_PRIV_OP:
667	case T_PRIV_REG:
668		/* these just can't make it to the trap() ever */
669	case T_HPMC:
670	case T_HPMC | T_USER:
671	case T_EMULATION:
672	case T_EXCEPTION:
673#endif
674	case T_IBREAK:
675	case T_DBREAK:
676	dead_end:
677		if (type & T_USER) {
678#ifdef DEBUG
679			user_backtrace(frame, l, type);
680#endif
681			KSI_INIT_TRAP(&ksi);
682			ksi.ksi_signo = SIGILL;
683			ksi.ksi_code = ILL_ILLTRP;
684			ksi.ksi_trap = type;
685			ksi.ksi_addr = (void *)frame->tf_iioq_head;
686			trapsignal(l, &ksi);
687			break;
688		}
689		if (trap_kdebug(type, va, frame))
690			return;
691		else if (type == T_DATALIGN)
692			panic ("trap: %s at 0x%x", tts, (u_int) va);
693		else
694			panic ("trap: no debugger for \"%s\" (%d)", tts, type);
695		break;
696
697	case T_IBREAK | T_USER:
698	case T_DBREAK | T_USER:
699		KSI_INIT_TRAP(&ksi);
700		ksi.ksi_signo = SIGTRAP;
701		ksi.ksi_code = TRAP_TRACE;
702		ksi.ksi_trap = type_raw;
703		ksi.ksi_addr = (void *)frame->tf_iioq_head;
704#ifdef PTRACE
705		ss_clear_breakpoints(l);
706		if (opcode == SSBREAKPOINT)
707			ksi.ksi_code = TRAP_BRKPT;
708#endif
709		/* pass to user debugger */
710		trapsignal(l, &ksi);
711
712		break;
713
714#ifdef PTRACE
715	case T_TAKENBR | T_USER:
716		ss_clear_breakpoints(l);
717
718		KSI_INIT_TRAP(&ksi);
719		ksi.ksi_signo = SIGTRAP;
720		ksi.ksi_code = TRAP_TRACE;
721		ksi.ksi_trap = type_raw;
722		ksi.ksi_addr = (void *)frame->tf_iioq_head;
723
724                /* pass to user debugger */
725		trapsignal(l, &ksi);
726		break;
727#endif
728
729	case T_EXCEPTION | T_USER: {	/* co-proc assist trap */
730		uint64_t *fpp;
731		uint32_t *pex, ex, inst;
732		int i;
733
734		hppa_fpu_flush(l);
735		fpp = l->l_addr->u_pcb.pcb_fpregs;
736		pex = (uint32_t *)&fpp[1];
737		for (i = 1; i < 8 && !*pex; i++, pex++)
738			;
739		KASSERT(i < 8);
740		ex = *pex;
741		*pex = 0;
742
743		/* reset the trap flag, as if there was none */
744		fpp[0] &= ~(((uint64_t)HPPA_FPU_T) << 32);
745
746		/* emulate the instruction */
747		inst = ((uint32_t)fpopmap[ex >> 26] << 26) | (ex & 0x03ffffff);
748		hppa_fpu_emulate(frame, l, inst);
749		}
750		break;
751
752	case T_OVERFLOW | T_USER:
753		KSI_INIT_TRAP(&ksi);
754		ksi.ksi_signo = SIGFPE;
755		ksi.ksi_code = SI_NOINFO;
756		ksi.ksi_trap = type;
757		ksi.ksi_addr = (void *)va;
758		trapsignal(l, &ksi);
759		break;
760
761	case T_CONDITION | T_USER:
762		KSI_INIT_TRAP(&ksi);
763		ksi.ksi_signo = SIGFPE;
764		ksi.ksi_code = FPE_INTDIV;
765		ksi.ksi_trap = type;
766		ksi.ksi_addr = (void *)va;
767		trapsignal(l, &ksi);
768		break;
769
770	case T_ILLEGAL | T_USER:
771#ifdef DEBUG
772		user_backtrace(frame, l, type);
773#endif
774		KSI_INIT_TRAP(&ksi);
775		ksi.ksi_signo = SIGILL;
776		ksi.ksi_code = ILL_ILLOPC;
777		ksi.ksi_trap = type;
778		ksi.ksi_addr = (void *)va;
779		trapsignal(l, &ksi);
780		break;
781
782	case T_PRIV_OP | T_USER:
783#ifdef DEBUG
784		user_backtrace(frame, l, type);
785#endif
786		KSI_INIT_TRAP(&ksi);
787		ksi.ksi_signo = SIGILL;
788		ksi.ksi_code = ILL_PRVOPC;
789		ksi.ksi_trap = type;
790		ksi.ksi_addr = (void *)va;
791		trapsignal(l, &ksi);
792		break;
793
794	case T_PRIV_REG | T_USER:
795#ifdef DEBUG
796		user_backtrace(frame, l, type);
797#endif
798		KSI_INIT_TRAP(&ksi);
799		ksi.ksi_signo = SIGILL;
800		ksi.ksi_code = ILL_PRVREG;
801		ksi.ksi_trap = type;
802		ksi.ksi_addr = (void *)va;
803		trapsignal(l, &ksi);
804		break;
805
806		/* these should never got here */
807	case T_HIGHERPL | T_USER:
808	case T_LOWERPL | T_USER:
809		KSI_INIT_TRAP(&ksi);
810		ksi.ksi_signo = SIGSEGV;
811		ksi.ksi_code = SEGV_ACCERR;
812		ksi.ksi_trap = type;
813		ksi.ksi_addr = (void *)va;
814		trapsignal(l, &ksi);
815		break;
816
817	case T_IPROT | T_USER:
818	case T_DPROT | T_USER:
819		KSI_INIT_TRAP(&ksi);
820		ksi.ksi_signo = SIGSEGV;
821		ksi.ksi_code = SEGV_ACCERR;
822		ksi.ksi_trap = type;
823		ksi.ksi_addr = (void *)va;
824		trapsignal(l, &ksi);
825		break;
826
827	case T_DATACC:   	case T_USER | T_DATACC:
828	case T_ITLBMISS:	case T_USER | T_ITLBMISS:
829	case T_DTLBMISS:	case T_USER | T_DTLBMISS:
830	case T_ITLBMISSNA:	case T_USER | T_ITLBMISSNA:
831	case T_DTLBMISSNA:	case T_USER | T_DTLBMISSNA:
832	case T_TLB_DIRTY:	case T_USER | T_TLB_DIRTY:
833		vm = p->p_vmspace;
834
835		if (!vm) {
836#ifdef TRAPDEBUG
837			printf("trap: no vm, p=%p\n", p);
838#endif
839			goto dead_end;
840		}
841
842		/*
843		 * it could be a kernel map for exec_map faults
844		 */
845		if (!(type & T_USER) && space == HPPA_SID_KERNEL)
846			map = kernel_map;
847		else {
848			map = &vm->vm_map;
849			if ((l->l_flag & LW_SA)
850			    && (~l->l_pflag & LP_SA_NOBLOCK)) {
851				l->l_savp->savp_faultaddr = va;
852				l->l_pflag |= LP_SA_PAGEFAULT;
853			}
854		}
855
856		va = trunc_page(va);
857
858		if (map->pmap->pmap_space != space) {
859#ifdef TRAPDEBUG
860			printf("trap: space mismatch %d != %d\n",
861			    space, map->pmap->pmap_space);
862#endif
863			/* actually dump the user, crap the kernel */
864			goto dead_end;
865		}
866
867		/* Never call uvm_fault in interrupt context. */
868		KASSERT(hppa_intr_depth == 0);
869
870		onfault = l->l_addr->u_pcb.pcb_onfault;
871		l->l_addr->u_pcb.pcb_onfault = 0;
872		ret = uvm_fault(map, va, vftype);
873		l->l_addr->u_pcb.pcb_onfault = onfault;
874
875#ifdef TRAPDEBUG
876		printf("uvm_fault(%p, %x, %d)=%d\n",
877		    map, (u_int)va, vftype, ret);
878#endif
879
880		if (map != kernel_map)
881			l->l_pflag &= ~LP_SA_PAGEFAULT;
882
883		/*
884		 * If this was a stack access we keep track of the maximum
885		 * accessed stack size.  Also, if uvm_fault gets a protection
886		 * failure it is due to accessing the stack region outside
887		 * the current limit and we need to reflect that as an access
888		 * error.
889		 */
890		if (map != kernel_map && va >= (vaddr_t)vm->vm_minsaddr) {
891			if (ret == 0)
892				uvm_grow(l->l_proc, va);
893			else if (ret == EACCES)
894				ret = EFAULT;
895		}
896
897		if (ret != 0) {
898			if (type & T_USER) {
899#ifdef DEBUG
900				user_backtrace(frame, l, type);
901#endif
902				KSI_INIT_TRAP(&ksi);
903				ksi.ksi_signo = SIGSEGV;
904				ksi.ksi_code = (ret == EACCES ?
905						SEGV_ACCERR : SEGV_MAPERR);
906				ksi.ksi_trap = type;
907				ksi.ksi_addr = (void *)va;
908				trapsignal(l, &ksi);
909			} else {
910				if (l->l_addr->u_pcb.pcb_onfault) {
911					goto do_onfault;
912				}
913				panic("trap: uvm_fault(%p, %lx, %d): %d",
914				    map, va, vftype, ret);
915			}
916		}
917		break;
918
919	case T_DATALIGN | T_USER:
920#ifdef DEBUG
921		user_backtrace(frame, l, type);
922#endif
923		KSI_INIT_TRAP(&ksi);
924		ksi.ksi_signo = SIGBUS;
925		ksi.ksi_code = BUS_ADRALN;
926		ksi.ksi_trap = type;
927		ksi.ksi_addr = (void *)va;
928		trapsignal(l, &ksi);
929		break;
930
931	case T_INTERRUPT:
932	case T_INTERRUPT|T_USER:
933		hppa_intr(frame);
934		mtctl(frame->tf_eiem, CR_EIEM);
935		break;
936
937	case T_LOWERPL:
938	case T_DPROT:
939	case T_IPROT:
940	case T_OVERFLOW:
941	case T_CONDITION:
942	case T_ILLEGAL:
943	case T_HIGHERPL:
944	case T_TAKENBR:
945	case T_POWERFAIL:
946	case T_LPMC:
947	case T_PAGEREF:
948	case T_DATAPID:  	case T_DATAPID  | T_USER:
949		if (0 /* T-chip */) {
950			break;
951		}
952		/* FALLTHROUGH to unimplemented */
953	default:
954		panic ("trap: unimplemented \'%s\' (%d)", tts, type);
955	}
956
957	if (type & T_USER)
958		userret(l, l->l_md.md_regs->tf_iioq_head, 0);
959
960#ifdef DEBUG
961	frame_sanity_check(0xdead02, type, frame, l);
962	if (frame->tf_flags & TFF_LAST && (curlwp->l_flag & LW_IDLE) == 0)
963		frame_sanity_check(0xdead03, type, curlwp->l_md.md_regs,
964				   curlwp);
965#endif /* DEBUG */
966}
967
968void
969child_return(void *arg)
970{
971	struct lwp *l = arg;
972
973	userret(l, l->l_md.md_regs->tf_iioq_head, 0);
974	ktrsysret(SYS_fork, 0, 0);
975#ifdef DEBUG
976	frame_sanity_check(0xdead04, 0, l->l_md.md_regs, l);
977#endif /* DEBUG */
978}
979
980#ifdef PTRACE
981
982#include <sys/ptrace.h>
983
984int
985ss_get_value(struct lwp *l, vaddr_t addr, u_int *value)
986{
987	struct uio uio;
988	struct iovec iov;
989
990	iov.iov_base = (void *)value;
991	iov.iov_len = sizeof(u_int);
992	uio.uio_iov = &iov;
993	uio.uio_iovcnt = 1;
994	uio.uio_offset = (off_t)addr;
995	uio.uio_resid = sizeof(u_int);
996	uio.uio_rw = UIO_READ;
997	UIO_SETUP_SYSSPACE(&uio);
998
999	return (process_domem(curlwp, l, &uio));
1000}
1001
1002int
1003ss_put_value(struct lwp *l, vaddr_t addr, u_int value)
1004{
1005	struct uio uio;
1006	struct iovec iov;
1007
1008	iov.iov_base = (void *)&value;
1009	iov.iov_len = sizeof(u_int);
1010	uio.uio_iov = &iov;
1011	uio.uio_iovcnt = 1;
1012	uio.uio_offset = (off_t)addr;
1013	uio.uio_resid = sizeof(u_int);
1014	uio.uio_rw = UIO_WRITE;
1015	UIO_SETUP_SYSSPACE(&uio);
1016
1017	return (process_domem(curlwp, l, &uio));
1018}
1019
1020void
1021ss_clear_breakpoints(struct lwp *l)
1022{
1023	/* Restore origional instructions. */
1024	if (l->l_md.md_bpva != 0) {
1025		ss_put_value(l, l->l_md.md_bpva, l->l_md.md_bpsave[0]);
1026		ss_put_value(l, l->l_md.md_bpva + 4, l->l_md.md_bpsave[1]);
1027		l->l_md.md_bpva = 0;
1028	}
1029}
1030
1031
1032int
1033process_sstep(struct lwp *l, int sstep)
1034{
1035	struct trapframe *tf = l->l_md.md_regs;
1036	int error;
1037
1038	ss_clear_breakpoints(l);
1039
1040	/* We're continuing... */
1041	/* Don't touch the syscall gateway page. */
1042	/* XXX head */
1043	if (sstep == 0 ||
1044	    (tf->tf_iioq_tail & ~PAGE_MASK) == SYSCALLGATE) {
1045		tf->tf_ipsw &= ~PSW_T;
1046		return 0;
1047	}
1048
1049	l->l_md.md_bpva = tf->tf_iioq_tail & ~HPPA_PC_PRIV_MASK;
1050
1051	/*
1052	 * Insert two breakpoint instructions; the first one might be
1053	 * nullified.  Of course we need to save two instruction
1054	 * first.
1055	 */
1056
1057	error = ss_get_value(l, l->l_md.md_bpva, &l->l_md.md_bpsave[0]);
1058	if (error)
1059		return (error);
1060	error = ss_get_value(l, l->l_md.md_bpva + 4, &l->l_md.md_bpsave[1]);
1061	if (error)
1062		return (error);
1063
1064	error = ss_put_value(l, l->l_md.md_bpva, SSBREAKPOINT);
1065	if (error)
1066		return error;
1067	error = ss_put_value(l, l->l_md.md_bpva + 4, SSBREAKPOINT);
1068	if (error)
1069		return error;
1070
1071	tf->tf_ipsw |= PSW_T;
1072
1073	return 0;
1074}
1075#endif
1076
1077
1078/*
1079 * call actual syscall routine
1080 * from the low-level syscall handler:
1081 * - all HPPA_FRAME_NARGS syscall's arguments supposed to be copied onto
1082 *   our stack, this wins compared to copyin just needed amount anyway
1083 * - register args are copied onto stack too
1084 */
1085void
1086syscall(struct trapframe *frame, int *args)
1087{
1088	struct lwp *l;
1089	struct proc *p;
1090	const struct sysent *callp;
1091	int nsys, code, error;
1092	int tmp;
1093	int rval[2];
1094
1095	uvmexp.syscalls++;
1096
1097#ifdef DEBUG
1098	frame_sanity_check(0xdead04, 0, frame, curlwp);
1099#endif /* DEBUG */
1100
1101	if (!USERMODE(frame->tf_iioq_head))
1102		panic("syscall");
1103
1104	l = curlwp;
1105	p = l->l_proc;
1106	l->l_md.md_regs = frame;
1107	nsys = p->p_emul->e_nsysent;
1108	callp = p->p_emul->e_sysent;
1109	code = frame->tf_t1;
1110	LWP_CACHE_CREDS(l, p);
1111
1112#ifdef KERN_SA
1113	if (__predict_false((l->l_savp)
1114            && (l->l_savp->savp_pflags & SAVP_FLAG_DELIVERING)))
1115		l->l_savp->savp_pflags &= ~SAVP_FLAG_DELIVERING;
1116#endif
1117
1118	/*
1119	 * Restarting a system call is touchy on the HPPA,
1120	 * because syscall arguments are passed in registers
1121	 * and the program counter of the syscall "point"
1122	 * isn't easily divined.
1123	 *
1124	 * We handle the first problem by assuming that we
1125	 * will have to restart this system call, so we
1126	 * stuff the first four words of the original arguments
1127	 * back into the frame as arg0...arg3, which is where
1128	 * we found them in the first place.  Any further
1129	 * arguments are (still) on the user's stack and the
1130	 * syscall code will fetch them from there (again).
1131	 *
1132	 * The program counter problem is addressed below.
1133	 */
1134	frame->tf_arg0 = args[0];
1135	frame->tf_arg1 = args[1];
1136	frame->tf_arg2 = args[2];
1137	frame->tf_arg3 = args[3];
1138
1139	/*
1140	 * Some special handling for the syscall(2) and
1141	 * __syscall(2) system calls.
1142	 */
1143	switch (code) {
1144	case SYS_syscall:
1145		code = *args;
1146		args += 1;
1147		break;
1148	case SYS___syscall:
1149		if (callp != sysent)
1150			break;
1151		/*
1152		 * NB: even though __syscall(2) takes a quad_t
1153		 * containing the system call number, because
1154		 * our argument copying word-swaps 64-bit arguments,
1155		 * the least significant word of that quad_t
1156		 * is the first word in the argument array.
1157		 */
1158		code = *args;
1159		args += 2;
1160	}
1161
1162	/*
1163	 * Stacks growing from lower addresses to higher
1164	 * addresses are not really such a good idea, because
1165	 * it makes it impossible to overlay a struct on top
1166	 * of C stack arguments (the arguments appear in
1167	 * reversed order).
1168	 *
1169	 * You can do the obvious thing (as locore.S does) and
1170	 * copy argument words one by one, laying them out in
1171	 * the "right" order in the destination buffer, but this
1172	 * ends up word-swapping multi-word arguments (like off_t).
1173	 *
1174	 * To compensate, we have some automatically-generated
1175	 * code that word-swaps these multi-word arguments.
1176	 * Right now the script that generates this code is
1177	 * in Perl, because I don't know awk.
1178	 *
1179	 * FIXME - this works only on native binaries and
1180	 * will probably screw up any and all emulation.
1181	 */
1182	switch (code) {
1183	case SYS_pread:
1184		/*
1185		 * 	syscallarg(int) fd;
1186		 * 	syscallarg(void *) buf;
1187		 * 	syscallarg(size_t) nbyte;
1188		 * 	syscallarg(int) pad;
1189		 * 	syscallarg(off_t) offset;
1190		 */
1191		tmp = args[4];
1192		args[4] = args[4 + 1];
1193		args[4 + 1] = tmp;
1194		break;
1195	case SYS_pwrite:
1196		/*
1197		 * 	syscallarg(int) fd;
1198		 * 	syscallarg(const void *) buf;
1199		 * 	syscallarg(size_t) nbyte;
1200		 * 	syscallarg(int) pad;
1201		 * 	syscallarg(off_t) offset;
1202		 */
1203		tmp = args[4];
1204		args[4] = args[4 + 1];
1205		args[4 + 1] = tmp;
1206		break;
1207	case SYS_mmap:
1208		/*
1209		 * 	syscallarg(void *) addr;
1210		 * 	syscallarg(size_t) len;
1211		 * 	syscallarg(int) prot;
1212		 * 	syscallarg(int) flags;
1213		 * 	syscallarg(int) fd;
1214		 * 	syscallarg(long) pad;
1215		 * 	syscallarg(off_t) pos;
1216		 */
1217		tmp = args[6];
1218		args[6] = args[6 + 1];
1219		args[6 + 1] = tmp;
1220		break;
1221	case SYS_lseek:
1222		/*
1223		 * 	syscallarg(int) fd;
1224		 * 	syscallarg(int) pad;
1225		 * 	syscallarg(off_t) offset;
1226		 */
1227		tmp = args[2];
1228		args[2] = args[2 + 1];
1229		args[2 + 1] = tmp;
1230		break;
1231	case SYS_truncate:
1232		/*
1233		 * 	syscallarg(const char *) path;
1234		 * 	syscallarg(int) pad;
1235		 * 	syscallarg(off_t) length;
1236		 */
1237		tmp = args[2];
1238		args[2] = args[2 + 1];
1239		args[2 + 1] = tmp;
1240		break;
1241	case SYS_ftruncate:
1242		/*
1243		 * 	syscallarg(int) fd;
1244		 * 	syscallarg(int) pad;
1245		 * 	syscallarg(off_t) length;
1246		 */
1247		tmp = args[2];
1248		args[2] = args[2 + 1];
1249		args[2 + 1] = tmp;
1250		break;
1251	case SYS_preadv:
1252		/*
1253		 * 	syscallarg(int) fd;
1254		 * 	syscallarg(const struct iovec *) iovp;
1255		 * 	syscallarg(int) iovcnt;
1256		 * 	syscallarg(int) pad;
1257		 * 	syscallarg(off_t) offset;
1258		 */
1259		tmp = args[4];
1260		args[4] = args[4 + 1];
1261		args[4 + 1] = tmp;
1262		break;
1263	case SYS_pwritev:
1264		/*
1265		 * 	syscallarg(int) fd;
1266		 * 	syscallarg(const struct iovec *) iovp;
1267		 * 	syscallarg(int) iovcnt;
1268		 * 	syscallarg(int) pad;
1269		 * 	syscallarg(off_t) offset;
1270		 */
1271		tmp = args[4];
1272		args[4] = args[4 + 1];
1273		args[4 + 1] = tmp;
1274		break;
1275	case SYS___posix_fadvise50:
1276		/*
1277		 *	syscallarg(int) fd;
1278		 *	syscallarg(int) pad;
1279		 *	syscallarg(off_t) offset;
1280		 *	syscallarg(off_t) len;
1281		 *	syscallarg(int) advice;
1282		 */
1283		tmp = args[2];
1284		args[2] = args[2 + 1];
1285		args[2 + 1] = tmp;
1286		tmp = args[4];
1287		args[4] = args[4 + 1];
1288		args[4 + 1] = tmp;
1289	case SYS___mknod50:
1290		/*
1291		 *	syscallarg(const char *) path;
1292		 *	syscallarg(mode_t) mode;
1293		 *	syscallarg(dev_t) dev;
1294		 */
1295		tmp = args[2];
1296		args[2] = args[2 + 1];
1297		args[2 + 1] = tmp;
1298	default:
1299		break;
1300	}
1301
1302#ifdef USERTRACE
1303	if (0) {
1304		user_backtrace(frame, l, -1);
1305		frame->tf_ipsw |= PSW_R;
1306		frame->tf_rctr = 0;
1307		printf("r %08x", frame->tf_iioq_head);
1308		rctr_next_iioq = frame->tf_iioq_head + 4;
1309	}
1310#endif
1311
1312	if (code < 0 || code >= nsys)
1313		callp += p->p_emul->e_nosys;	/* bad syscall # */
1314	else
1315		callp += code;
1316
1317	if ((error = trace_enter(code, args, callp->sy_narg)) != 0)
1318		goto out;
1319
1320	rval[0] = 0;
1321	rval[1] = 0;
1322	error = sy_call(callp, l, args, rval);
1323out:
1324	switch (error) {
1325	case 0:
1326		l = curlwp;			/* changes on exec() */
1327		frame = l->l_md.md_regs;
1328		frame->tf_ret0 = rval[0];
1329		frame->tf_ret1 = rval[1];
1330		frame->tf_t1 = 0;
1331		break;
1332	case ERESTART:
1333		/*
1334		 * Now we have to wind back the instruction
1335		 * offset queue to the point where the system
1336		 * call will be made again.  This is inherently
1337		 * tied to the SYSCALL macro.
1338		 *
1339		 * Currently, the part of the SYSCALL macro
1340		 * that we want to rerun reads as:
1341		 *
1342		 *	ldil	L%SYSCALLGATE, r1
1343		 *	ble	4(sr7, r1)
1344		 *	ldi	__CONCAT(SYS_,x), t1
1345		 *	comb,<>	%r0, %t1, __cerror
1346		 *
1347		 * And our offset queue head points to the
1348		 * comb instruction.  So we need to
1349		 * subtract twelve to reach the ldil.
1350		 */
1351		frame->tf_iioq_head -= 12;
1352		frame->tf_iioq_tail = frame->tf_iioq_head + 4;
1353		break;
1354	case EJUSTRETURN:
1355		p = curproc;
1356		break;
1357	default:
1358		if (p->p_emul->e_errno)
1359			error = p->p_emul->e_errno[error];
1360		frame->tf_t1 = error;
1361		break;
1362	}
1363
1364	trace_exit(code, rval, error);
1365
1366	userret(l, frame->tf_iioq_head, 0);
1367#ifdef DEBUG
1368	frame_sanity_check(0xdead05, 0, frame, l);
1369#endif /* DEBUG */
1370}
1371
1372/*
1373 * Start a new LWP
1374 */
1375void
1376startlwp(void *arg)
1377{
1378	int err;
1379	ucontext_t *uc = arg;
1380	struct lwp *l = curlwp;
1381
1382	err = cpu_setmcontext(l, &uc->uc_mcontext, uc->uc_flags);
1383#if DIAGNOSTIC
1384	if (err) {
1385		printf("Error %d from cpu_setmcontext.", err);
1386	}
1387#endif
1388	pool_put(&lwp_uc_pool, uc);
1389
1390	userret(l, l->l_md.md_regs->tf_iioq_head, 0);
1391}
1392
1393/*
1394 * XXX This is a terrible name.
1395 */
1396void
1397upcallret(struct lwp *l)
1398{
1399	userret(l, l->l_md.md_regs->tf_iioq_head, 0);
1400}
1401