trap.c revision 1.81
1/* $NetBSD: trap.c,v 1.81 2010/03/22 23:26:06 skrll Exp $ */ 2 3/*- 4 * Copyright (c) 2001, 2002 The NetBSD Foundation, Inc. 5 * All rights reserved. 6 * 7 * This code is derived from software contributed to The NetBSD Foundation 8 * by Matthew Fredette. 9 * 10 * Redistribution and use in source and binary forms, with or without 11 * modification, are permitted provided that the following conditions 12 * are met: 13 * 1. Redistributions of source code must retain the above copyright 14 * notice, this list of conditions and the following disclaimer. 15 * 2. Redistributions in binary form must reproduce the above copyright 16 * notice, this list of conditions and the following disclaimer in the 17 * documentation and/or other materials provided with the distribution. 18 * 19 * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS 20 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED 21 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 22 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS 23 * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 24 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 25 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 26 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 27 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 28 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 29 * POSSIBILITY OF SUCH DAMAGE. 30 */ 31 32/* $OpenBSD: trap.c,v 1.30 2001/09/19 20:50:56 mickey Exp $ */ 33 34/* 35 * Copyright (c) 1998-2004 Michael Shalayeff 36 * All rights reserved. 37 * 38 * Redistribution and use in source and binary forms, with or without 39 * modification, are permitted provided that the following conditions 40 * are met: 41 * 1. Redistributions of source code must retain the above copyright 42 * notice, this list of conditions and the following disclaimer. 43 * 2. Redistributions in binary form must reproduce the above copyright 44 * notice, this list of conditions and the following disclaimer in the 45 * documentation and/or other materials provided with the distribution. 46 * 47 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 48 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 49 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 50 * IN NO EVENT SHALL THE AUTHOR OR HIS RELATIVES BE LIABLE FOR ANY DIRECT, 51 * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES 52 * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR 53 * SERVICES; LOSS OF MIND, USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 54 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, 55 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING 56 * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF 57 * THE POSSIBILITY OF SUCH DAMAGE. 58 */ 59 60#include <sys/cdefs.h> 61__KERNEL_RCSID(0, "$NetBSD: trap.c,v 1.81 2010/03/22 23:26:06 skrll Exp $"); 62 63/* #define INTRDEBUG */ 64/* #define TRAPDEBUG */ 65/* #define USERTRACE */ 66 67#include "opt_kgdb.h" 68#include "opt_ptrace.h" 69#include "opt_sa.h" 70 71#include <sys/param.h> 72#include <sys/systm.h> 73#include <sys/kernel.h> 74#include <sys/syscall.h> 75#include <sys/syscallvar.h> 76#include <sys/sa.h> 77#include <sys/savar.h> 78#include <sys/mutex.h> 79#include <sys/ktrace.h> 80#include <sys/proc.h> 81#include <sys/signalvar.h> 82#include <sys/acct.h> 83#include <sys/signal.h> 84#include <sys/device.h> 85#include <sys/pool.h> 86#include <sys/userret.h> 87 88#include <net/netisr.h> 89 90#ifdef KGDB 91#include <sys/kgdb.h> 92#endif 93 94#include <uvm/uvm.h> 95 96#include <machine/iomod.h> 97#include <machine/cpufunc.h> 98#include <machine/reg.h> 99#include <machine/autoconf.h> 100 101#include <machine/db_machdep.h> 102 103#include <hppa/hppa/machdep.h> 104 105#include <ddb/db_output.h> 106#include <ddb/db_interface.h> 107 108#ifdef PTRACE 109void ss_clear_breakpoints(struct lwp *l); 110int ss_put_value(struct lwp *, vaddr_t, u_int); 111int ss_get_value(struct lwp *, vaddr_t, u_int *); 112#endif 113 114/* single-step breakpoint */ 115#define SSBREAKPOINT (HPPA_BREAK_KERNEL | (HPPA_BREAK_SS << 13)) 116 117#if defined(DEBUG) || defined(DIAGNOSTIC) 118/* 119 * 0x6fc1000 is a stwm r1, d(sr0, sp), which is the last 120 * instruction in the function prologue that gcc -O0 uses. 121 * When we have this instruction we know the relationship 122 * between the stack pointer and the gcc -O0 frame pointer 123 * (in r3, loaded with the initial sp) for the body of a 124 * function. 125 * 126 * If the given instruction is a stwm r1, d(sr0, sp) where 127 * d > 0, we evaluate to d, else we evaluate to zero. 128 */ 129#define STWM_R1_D_SR0_SP(inst) \ 130 (((inst) & 0xffffc001) == 0x6fc10000 ? (((inst) & 0x00003ff) >> 1) : 0) 131#endif /* DEBUG || DIAGNOSTIC */ 132 133const char *trap_type[] = { 134 "invalid", 135 "HPMC", 136 "power failure", 137 "recovery counter", 138 "external interrupt", 139 "LPMC", 140 "ITLB miss fault", 141 "instruction protection", 142 "Illegal instruction", 143 "break instruction", 144 "privileged operation", 145 "privileged register", 146 "overflow", 147 "conditional", 148 "assist exception", 149 "DTLB miss", 150 "ITLB non-access miss", 151 "DTLB non-access miss", 152 "data protection/rights/alignment", 153 "data break", 154 "TLB dirty", 155 "page reference", 156 "assist emulation", 157 "higher-priv transfer", 158 "lower-priv transfer", 159 "taken branch", 160 "data access rights", 161 "data protection", 162 "unaligned data ref", 163}; 164int trap_types = __arraycount(trap_type); 165 166uint8_t fpopmap[] = { 167 0x00, 0x00, 0x00, 0x06, 0x00, 0x00, 0x00, 0x00, 168 0x00, 0x0c, 0x00, 0x0e, 0x00, 0x00, 0x00, 0x00, 169 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 170 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 171 0x00, 0x00, 0x00, 0x26, 0x00, 0x00, 0x00, 0x00, 172 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 173 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 174 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 175}; 176 177volatile int astpending; 178 179void pmap_hptdump(void); 180void syscall(struct trapframe *, int *); 181 182#if defined(DEBUG) 183struct trapframe *sanity_frame; 184struct lwp *sanity_lwp; 185const char *sanity_string; 186void frame_sanity_check(const char *, int, int, struct trapframe *, 187 struct lwp *); 188#endif 189 190 191#ifdef USERTRACE 192/* 193 * USERTRACE is a crude facility that traces the PC of 194 * a single user process. This tracing is normally 195 * activated by the dispatching of a certain syscall 196 * with certain arguments - see the activation code in 197 * syscall(). 198 */ 199static void user_backtrace(struct trapframe *, struct lwp *, int); 200static void user_backtrace_raw(u_int, u_int); 201 202u_int rctr_next_iioq; 203#endif 204 205static inline void 206userret(struct lwp *l, register_t pc, u_quad_t oticks) 207{ 208 struct proc *p = l->l_proc; 209 210 if (astpending) { 211 astpending = 0; 212 if (curcpu()->ci_want_resched) { 213 preempt(); 214 } 215 } 216 217 mi_userret(l); 218 219 /* 220 * If profiling, charge recent system time to the trapped pc. 221 */ 222 if (p->p_stflag & PST_PROFIL) { 223 extern int psratio; 224 225 addupc_task(l, pc, (int)(p->p_sticks - oticks) * psratio); 226 } 227} 228 229/* 230 * This handles some messy kernel debugger details. 231 * It dispatches into either kgdb or DDB, and knows 232 * about some special things to do, like skipping over 233 * break instructions and how to really set up for 234 * a single-step. 235 */ 236#if defined(KGDB) || defined(DDB) 237static int 238trap_kdebug(int type, int code, struct trapframe *frame) 239{ 240 int handled; 241 u_int tf_iioq_head_old; 242 u_int tf_iioq_tail_old; 243 244 for(;;) { 245 246 /* This trap has not been handled. */ 247 handled = 0; 248 249 /* Remember the instruction offset queue. */ 250 tf_iioq_head_old = frame->tf_iioq_head; 251 tf_iioq_tail_old = frame->tf_iioq_tail; 252 253#ifdef KGDB 254 /* Let KGDB handle it (if connected) */ 255 if (!handled) 256 handled = kgdb_trap(type, frame); 257#endif 258#ifdef DDB 259 /* Let DDB handle it. */ 260 if (!handled) 261 handled = kdb_trap(type, code, frame); 262#endif 263 264 /* If this trap wasn't handled, return now. */ 265 if (!handled) 266 return(0); 267 268 /* 269 * If the instruction offset queue head changed, but the offset 270 * queue tail didn't, assume that the user wants to jump to the 271 * head offset, and adjust the tail accordingly. This should 272 * fix the kgdb `jump' command, and can help DDB users who `set' 273 * the offset head but forget the tail. 274 */ 275 if (frame->tf_iioq_head != tf_iioq_head_old && 276 frame->tf_iioq_tail == tf_iioq_tail_old) 277 frame->tf_iioq_tail = frame->tf_iioq_head + 4; 278 279 /* 280 * This is some single-stepping support. If we're trying to 281 * step through a nullified instruction, just advance by hand 282 * and trap again. Otherwise, load the recovery counter with 283 * zero. 284 */ 285 if (frame->tf_ipsw & PSW_R) { 286#ifdef TRAPDEBUG 287 printf("(single stepping at head 0x%x tail 0x%x)\n", 288 frame->tf_iioq_head, frame->tf_iioq_tail); 289#endif 290 if (frame->tf_ipsw & PSW_N) { 291#ifdef TRAPDEBUG 292 printf("(single stepping past nullified)\n"); 293#endif 294 295 /* Advance the program counter. */ 296 frame->tf_iioq_head = frame->tf_iioq_tail; 297 frame->tf_iioq_tail = frame->tf_iioq_head + 4; 298 299 /* Clear flags. */ 300 frame->tf_ipsw &= ~(PSW_N|PSW_X|PSW_Y|PSW_Z|PSW_B|PSW_T|PSW_H|PSW_L); 301 302 /* Simulate another trap. */ 303 type = T_RECOVERY; 304 continue; 305 } 306 frame->tf_rctr = 0; 307 } 308 309 /* We handled this trap. */ 310 return (1); 311 } 312 /* NOTREACHED */ 313} 314#else /* !KGDB && !DDB */ 315#define trap_kdebug(t, c, f) (0) 316#endif /* !KGDB && !DDB */ 317 318#if defined(DEBUG) || defined(USERTRACE) 319/* 320 * These functions give a crude usermode backtrace. They really only work when 321 * code has been compiled without optimization, as they assume a certain func- 322 * tion prologue sets up a frame pointer and stores the return pointer and arg- 323 * uments in it. 324 */ 325static void 326user_backtrace_raw(u_int pc, u_int fp) 327{ 328 int frame_number; 329 int arg_number; 330 331 for (frame_number = 0; 332 frame_number < 100 && pc > HPPA_PC_PRIV_MASK && fp; 333 frame_number++) { 334 335 printf("%3d: pc=%08x%s fp=0x%08x", frame_number, 336 pc & ~HPPA_PC_PRIV_MASK, USERMODE(pc) ? " " : "**", fp); 337 for(arg_number = 0; arg_number < 4; arg_number++) 338 printf(" arg%d=0x%08x", arg_number, 339 (int) fuword(HPPA_FRAME_CARG(arg_number, fp))); 340 printf("\n"); 341 pc = fuword(((register_t *) fp) - 5); /* fetch rp */ 342 if (pc == -1) { 343 printf(" fuword for pc failed\n"); 344 break; 345 } 346 fp = fuword(((register_t *) fp) + 0); /* fetch previous fp */ 347 if (fp == -1) { 348 printf(" fuword for fp failed\n"); 349 break; 350 } 351 } 352 printf(" backtrace stopped with pc %08x fp 0x%08x\n", pc, fp); 353} 354 355static void 356user_backtrace(struct trapframe *tf, struct lwp *l, int type) 357{ 358 struct proc *p = l->l_proc; 359 u_int pc, fp, inst; 360 361 /* 362 * Display any trap type that we have. 363 */ 364 if (type >= 0) 365 printf("pid %d (%s) trap #%d\n", 366 p->p_pid, p->p_comm, type & ~T_USER); 367 368 /* 369 * Assuming that the frame pointer in r3 is valid, 370 * dump out a stack trace. 371 */ 372 fp = tf->tf_r3; 373 printf("pid %d (%s) backtrace, starting with fp 0x%08x\n", 374 p->p_pid, p->p_comm, fp); 375 user_backtrace_raw(tf->tf_iioq_head, fp); 376 377 /* 378 * In case the frame pointer in r3 is not valid, 379 * assuming the stack pointer is valid and the 380 * faulting function is a non-leaf, if we can 381 * find its prologue we can recover its frame 382 * pointer. 383 */ 384 pc = tf->tf_iioq_head; 385 fp = tf->tf_sp - HPPA_FRAME_SIZE; 386 printf("pid %d (%s) backtrace, starting with sp 0x%08x pc 0x%08x\n", 387 p->p_pid, p->p_comm, tf->tf_sp, pc); 388 for (pc &= ~HPPA_PC_PRIV_MASK; pc > 0; pc -= sizeof(inst)) { 389 inst = fuword((register_t *) pc); 390 if (inst == -1) { 391 printf(" fuword for inst at pc %08x failed\n", pc); 392 break; 393 } 394 /* Check for the prologue instruction that sets sp. */ 395 if (STWM_R1_D_SR0_SP(inst)) { 396 fp = tf->tf_sp - STWM_R1_D_SR0_SP(inst); 397 printf(" sp from fp at pc %08x: %08x\n", pc, inst); 398 break; 399 } 400 } 401 user_backtrace_raw(tf->tf_iioq_head, fp); 402} 403#endif /* DEBUG || USERTRACE */ 404 405#ifdef DEBUG 406/* 407 * This sanity-checks a trapframe. It is full of various 408 * assumptions about what a healthy CPU state should be, 409 * with some documented elsewhere, some not. 410 */ 411void 412frame_sanity_check(const char *func, int line, int type, struct trapframe *tf, 413 struct lwp *l) 414{ 415 extern int kernel_text; 416 extern int etext; 417 extern register_t kpsw; 418 419#define SANITY(e) \ 420do { \ 421 if (sanity_frame == NULL && !(e)) { \ 422 sanity_frame = tf; \ 423 sanity_lwp = l; \ 424 sanity_string = #e; \ 425 } \ 426} while (/* CONSTCOND */ 0) 427 428 KASSERT(l != NULL); 429 SANITY((tf->tf_ipsw & kpsw) == kpsw); 430 SANITY((kpsw & PSW_I) == 0 || tf->tf_eiem != 0); 431 if (tf->tf_iisq_head == HPPA_SID_KERNEL) { 432 vaddr_t minsp, maxsp, uv; 433 434 uv = uvm_lwp_getuarea(l); 435 436 /* 437 * If the trap happened in the gateway 438 * page, we take the easy way out and 439 * assume that the trapframe is okay. 440 */ 441 if ((tf->tf_iioq_head & ~PAGE_MASK) == SYSCALLGATE) 442 goto out; 443 444 SANITY(!USERMODE(tf->tf_iioq_head)); 445 SANITY(!USERMODE(tf->tf_iioq_tail)); 446 447 /* 448 * Don't check the instruction queues or stack on interrupts 449 * as we could be be in the sti code (outside normal kernel 450 * text) or switching LWPs (curlwp and sp are not in sync) 451 */ 452 if ((type & ~T_USER) == T_INTERRUPT) 453 goto out; 454 455 SANITY(tf->tf_iioq_head >= (u_int) &kernel_text); 456 SANITY(tf->tf_iioq_head < (u_int) &etext); 457 SANITY(tf->tf_iioq_tail >= (u_int) &kernel_text); 458 SANITY(tf->tf_iioq_tail < (u_int) &etext); 459 460 maxsp = uv + USPACE + PAGE_SIZE; 461 minsp = uv + PAGE_SIZE; 462 463 SANITY(tf->tf_sp >= minsp && tf->tf_sp < maxsp); 464 } else { 465 struct pcb *pcb = lwp_getpcb(l); 466 467 SANITY(USERMODE(tf->tf_iioq_head)); 468 SANITY(USERMODE(tf->tf_iioq_tail)); 469 SANITY(tf->tf_cr30 == (u_int)pcb->pcb_fpregs); 470 } 471#undef SANITY 472out: 473 if (sanity_frame == tf) { 474 printf("insanity: '%s' in func %s at line %d type 0x%x tf %p " 475 "lwp %p sp 0x%x pc 0x%x\n", sanity_string, func, line, type, 476 sanity_frame, sanity_lwp, tf->tf_sp, tf->tf_iioq_head); 477 (void) trap_kdebug(T_IBREAK, 0, tf); 478 sanity_frame = NULL; 479 sanity_lwp = NULL; 480 } 481} 482#endif /* DEBUG */ 483 484void 485trap(int type, struct trapframe *frame) 486{ 487 struct lwp *l; 488 struct proc *p; 489 struct pcb *pcb; 490 vaddr_t va; 491 struct vm_map *map; 492 struct vmspace *vm; 493 vm_prot_t vftype; 494 pa_space_t space; 495 ksiginfo_t ksi; 496 u_int opcode, onfault; 497 int ret; 498 const char *tts = "reserved"; 499 int trapnum; 500#ifdef DIAGNOSTIC 501 extern int emergency_stack_start, emergency_stack_end; 502 int oldcpl = cpl; 503#endif 504 505 trapnum = type & ~T_USER; 506 opcode = frame->tf_iir; 507 if (trapnum == T_ITLBMISS || trapnum == T_ITLBMISSNA || 508 trapnum == T_IBREAK || trapnum == T_TAKENBR) { 509 va = frame->tf_iioq_head; 510 space = frame->tf_iisq_head; 511 vftype = VM_PROT_EXECUTE; 512 } else { 513 va = frame->tf_ior; 514 space = frame->tf_isr; 515 vftype = inst_store(opcode) ? VM_PROT_WRITE : VM_PROT_READ; 516 } 517 518 KASSERT(curlwp != NULL); 519 l = curlwp; 520 p = l->l_proc; 521 if ((type & T_USER) != 0) 522 LWP_CACHE_CREDS(l, p); 523 524#ifdef DIAGNOSTIC 525 /* 526 * If we are on the emergency stack, then we either got 527 * a fault on the kernel stack, or we're just handling 528 * a trap for the machine check handler (which also 529 * runs on the emergency stack). 530 * 531 * We *very crudely* differentiate between the two cases 532 * by checking the faulting instruction: if it is the 533 * function prologue instruction that stores the old 534 * frame pointer and updates the stack pointer, we assume 535 * that we faulted on the kernel stack. 536 * 537 * In this case, not completing that instruction will 538 * probably confuse backtraces in kgdb/ddb. Completing 539 * it would be difficult, because we already faulted on 540 * that part of the stack, so instead we fix up the 541 * frame as if the function called has just returned. 542 * This has peculiar knowledge about what values are in 543 * what registers during the "normal gcc -g" prologue. 544 */ 545 if (&type >= &emergency_stack_start && 546 &type < &emergency_stack_end && 547 type != T_IBREAK && STWM_R1_D_SR0_SP(opcode)) { 548 /* Restore the caller's frame pointer. */ 549 frame->tf_r3 = frame->tf_r1; 550 /* Restore the caller's instruction offsets. */ 551 frame->tf_iioq_head = frame->tf_rp; 552 frame->tf_iioq_tail = frame->tf_iioq_head + 4; 553 goto dead_end; 554 } 555#endif /* DIAGNOSTIC */ 556 557#ifdef DEBUG 558 frame_sanity_check(__func__, __LINE__, type, frame, l); 559#endif /* DEBUG */ 560 561 if (frame->tf_flags & TFF_LAST) 562 l->l_md.md_regs = frame; 563 564 if (trapnum <= trap_types) 565 tts = trap_type[trapnum]; 566 567#ifdef TRAPDEBUG 568 if (trapnum != T_INTERRUPT && trapnum != T_IBREAK) 569 printf("trap: %d, %s for %x:%lx at %x:%x, fp=%p, rp=%x\n", 570 type, tts, space, va, frame->tf_iisq_head, 571 frame->tf_iioq_head, frame, frame->tf_rp); 572 else if (trapnum == T_IBREAK) 573 printf("trap: break instruction %x:%x at %x:%x, fp=%p\n", 574 break5(opcode), break13(opcode), 575 frame->tf_iisq_head, frame->tf_iioq_head, frame); 576 577 { 578 extern int etext; 579 if (frame < (struct trapframe *)&etext) { 580 printf("trap: bogus frame ptr %p\n", frame); 581 goto dead_end; 582 } 583 } 584#endif 585 586 pcb = lwp_getpcb(l); 587 588 /* If this is a trap, not an interrupt, reenable interrupts. */ 589 if (trapnum != T_INTERRUPT) { 590 uvmexp.traps++; 591 mtctl(frame->tf_eiem, CR_EIEM); 592 } 593 594 switch (type) { 595 case T_NONEXIST: 596 case T_NONEXIST|T_USER: 597#if !defined(DDB) && !defined(KGDB) 598 /* we've got screwed up by the central scrutinizer */ 599 panic ("trap: elvis has just left the building!"); 600 break; 601#else 602 goto dead_end; 603#endif 604 case T_RECOVERY|T_USER: 605#ifdef USERTRACE 606 for(;;) { 607 if (frame->tf_iioq_head != rctr_next_iioq) 608 printf("-%08x\nr %08x", 609 rctr_next_iioq - 4, 610 frame->tf_iioq_head); 611 rctr_next_iioq = frame->tf_iioq_head + 4; 612 if (frame->tf_ipsw & PSW_N) { 613 /* Advance the program counter. */ 614 frame->tf_iioq_head = frame->tf_iioq_tail; 615 frame->tf_iioq_tail = frame->tf_iioq_head + 4; 616 /* Clear flags. */ 617 frame->tf_ipsw &= ~(PSW_N|PSW_X|PSW_Y|PSW_Z|PSW_B|PSW_T|PSW_H|PSW_L); 618 /* Simulate another trap. */ 619 continue; 620 } 621 break; 622 } 623 frame->tf_rctr = 0; 624 break; 625#endif /* USERTRACE */ 626 case T_RECOVERY: 627#if !defined(DDB) && !defined(KGDB) 628 /* XXX will implement later */ 629 printf ("trap: handicapped"); 630 break; 631#else 632 goto dead_end; 633#endif 634 635 case T_EMULATION | T_USER: 636#ifdef FPEMUL 637 hppa_fpu_emulate(frame, l, opcode); 638#else /* !FPEMUL */ 639 /* 640 * We don't have FPU emulation, so signal the 641 * process with a SIGFPE. 642 */ 643 644 KSI_INIT_TRAP(&ksi); 645 ksi.ksi_signo = SIGFPE; 646 ksi.ksi_code = SI_NOINFO; 647 ksi.ksi_trap = type; 648 ksi.ksi_addr = (void *)frame->tf_iioq_head; 649 trapsignal(l, &ksi); 650#endif /* !FPEMUL */ 651 break; 652 653 case T_DATALIGN: 654 onfault = pcb->pcb_onfault; 655 if (onfault) { 656 ret = EFAULT; 657do_onfault: 658 frame->tf_iioq_head = onfault; 659 frame->tf_iioq_tail = frame->tf_iioq_head + 4; 660 frame->tf_ret0 = ret; 661 break; 662 } 663 /*FALLTHROUGH*/ 664 665#ifdef DIAGNOSTIC 666 /* these just can't happen ever */ 667 case T_PRIV_OP: 668 case T_PRIV_REG: 669 /* these just can't make it to the trap() ever */ 670 case T_HPMC: 671 case T_HPMC | T_USER: 672 case T_EMULATION: 673 case T_EXCEPTION: 674#endif 675 case T_IBREAK: 676 case T_DBREAK: 677 dead_end: 678 if (type & T_USER) { 679#ifdef DEBUG 680 user_backtrace(frame, l, type); 681#endif 682 KSI_INIT_TRAP(&ksi); 683 ksi.ksi_signo = SIGILL; 684 ksi.ksi_code = ILL_ILLTRP; 685 ksi.ksi_trap = type; 686 ksi.ksi_addr = (void *)frame->tf_iioq_head; 687 trapsignal(l, &ksi); 688 break; 689 } 690 if (trap_kdebug(type, va, frame)) 691 return; 692 else if (type == T_DATALIGN) 693 panic ("trap: %s at 0x%x", tts, (u_int) va); 694 else 695 panic ("trap: no debugger for \"%s\" (%d)", tts, type); 696 break; 697 698 case T_IBREAK | T_USER: 699 case T_DBREAK | T_USER: 700 KSI_INIT_TRAP(&ksi); 701 ksi.ksi_signo = SIGTRAP; 702 ksi.ksi_code = TRAP_TRACE; 703 ksi.ksi_trap = trapnum; 704 ksi.ksi_addr = (void *)frame->tf_iioq_head; 705#ifdef PTRACE 706 ss_clear_breakpoints(l); 707 if (opcode == SSBREAKPOINT) 708 ksi.ksi_code = TRAP_BRKPT; 709#endif 710 /* pass to user debugger */ 711 trapsignal(l, &ksi); 712 713 break; 714 715#ifdef PTRACE 716 case T_TAKENBR | T_USER: 717 ss_clear_breakpoints(l); 718 719 KSI_INIT_TRAP(&ksi); 720 ksi.ksi_signo = SIGTRAP; 721 ksi.ksi_code = TRAP_TRACE; 722 ksi.ksi_trap = trapnum; 723 ksi.ksi_addr = (void *)frame->tf_iioq_head; 724 725 /* pass to user debugger */ 726 trapsignal(l, &ksi); 727 break; 728#endif 729 730 case T_EXCEPTION | T_USER: { /* co-proc assist trap */ 731 uint64_t *fpp; 732 uint32_t *pex, ex, inst; 733 int i; 734 735 hppa_fpu_flush(l); 736 fpp = (uint64_t *)pcb->pcb_fpregs; 737 738 /* skip the status register */ 739 pex = (uint32_t *)&fpp[0]; 740 pex++; 741 742 /* loop through the exception registers */ 743 for (i = 1; i < 8 && !*pex; i++, pex++) 744 ; 745 KASSERT(i < 8); 746 ex = *pex; 747 *pex = 0; 748 749 /* reset the trap flag, as if there was none */ 750 fpp[0] &= ~(((uint64_t)HPPA_FPU_T) << 32); 751 752 /* emulate the instruction */ 753 inst = ((uint32_t)fpopmap[ex >> 26] << 26) | (ex & 0x03ffffff); 754 hppa_fpu_emulate(frame, l, inst); 755 } 756 break; 757 758 case T_OVERFLOW | T_USER: 759 KSI_INIT_TRAP(&ksi); 760 ksi.ksi_signo = SIGFPE; 761 ksi.ksi_code = SI_NOINFO; 762 ksi.ksi_trap = type; 763 ksi.ksi_addr = (void *)va; 764 trapsignal(l, &ksi); 765 break; 766 767 case T_CONDITION | T_USER: 768 KSI_INIT_TRAP(&ksi); 769 ksi.ksi_signo = SIGFPE; 770 ksi.ksi_code = FPE_INTDIV; 771 ksi.ksi_trap = type; 772 ksi.ksi_addr = (void *)va; 773 trapsignal(l, &ksi); 774 break; 775 776 case T_ILLEGAL | T_USER: 777#ifdef DEBUG 778 user_backtrace(frame, l, type); 779#endif 780 KSI_INIT_TRAP(&ksi); 781 ksi.ksi_signo = SIGILL; 782 ksi.ksi_code = ILL_ILLOPC; 783 ksi.ksi_trap = type; 784 ksi.ksi_addr = (void *)va; 785 trapsignal(l, &ksi); 786 break; 787 788 case T_PRIV_OP | T_USER: 789#ifdef DEBUG 790 user_backtrace(frame, l, type); 791#endif 792 KSI_INIT_TRAP(&ksi); 793 ksi.ksi_signo = SIGILL; 794 ksi.ksi_code = ILL_PRVOPC; 795 ksi.ksi_trap = type; 796 ksi.ksi_addr = (void *)va; 797 trapsignal(l, &ksi); 798 break; 799 800 case T_PRIV_REG | T_USER: 801#ifdef DEBUG 802 user_backtrace(frame, l, type); 803#endif 804 KSI_INIT_TRAP(&ksi); 805 ksi.ksi_signo = SIGILL; 806 ksi.ksi_code = ILL_PRVREG; 807 ksi.ksi_trap = type; 808 ksi.ksi_addr = (void *)va; 809 trapsignal(l, &ksi); 810 break; 811 812 /* these should never got here */ 813 case T_HIGHERPL | T_USER: 814 case T_LOWERPL | T_USER: 815 KSI_INIT_TRAP(&ksi); 816 ksi.ksi_signo = SIGSEGV; 817 ksi.ksi_code = SEGV_ACCERR; 818 ksi.ksi_trap = type; 819 ksi.ksi_addr = (void *)va; 820 trapsignal(l, &ksi); 821 break; 822 823 case T_IPROT | T_USER: 824 case T_DPROT | T_USER: 825 KSI_INIT_TRAP(&ksi); 826 ksi.ksi_signo = SIGSEGV; 827 ksi.ksi_code = SEGV_ACCERR; 828 ksi.ksi_trap = type; 829 ksi.ksi_addr = (void *)va; 830 trapsignal(l, &ksi); 831 break; 832 833 case T_DATACC: case T_USER | T_DATACC: 834 case T_ITLBMISS: case T_USER | T_ITLBMISS: 835 case T_DTLBMISS: case T_USER | T_DTLBMISS: 836 case T_ITLBMISSNA: case T_USER | T_ITLBMISSNA: 837 case T_DTLBMISSNA: case T_USER | T_DTLBMISSNA: 838 case T_TLB_DIRTY: case T_USER | T_TLB_DIRTY: 839 vm = p->p_vmspace; 840 841 if (!vm) { 842#ifdef TRAPDEBUG 843 printf("trap: no vm, p=%p\n", p); 844#endif 845 goto dead_end; 846 } 847 848 /* 849 * it could be a kernel map for exec_map faults 850 */ 851 if (!(type & T_USER) && space == HPPA_SID_KERNEL) 852 map = kernel_map; 853 else { 854 map = &vm->vm_map; 855 if ((l->l_flag & LW_SA) 856 && (~l->l_pflag & LP_SA_NOBLOCK)) { 857 l->l_savp->savp_faultaddr = va; 858 l->l_pflag |= LP_SA_PAGEFAULT; 859 } 860 } 861 862 va = trunc_page(va); 863 864 if (map->pmap->pm_space != space) { 865#ifdef TRAPDEBUG 866 printf("trap: space mismatch %d != %d\n", 867 space, map->pmap->pm_space); 868#endif 869 /* actually dump the user, crap the kernel */ 870 goto dead_end; 871 } 872 873 /* Never call uvm_fault in interrupt context. */ 874 KASSERT(hppa_intr_depth == 0); 875 876 onfault = pcb->pcb_onfault; 877 pcb->pcb_onfault = 0; 878 ret = uvm_fault(map, va, vftype); 879 pcb->pcb_onfault = onfault; 880 881#ifdef TRAPDEBUG 882 printf("uvm_fault(%p, %x, %d)=%d\n", 883 map, (u_int)va, vftype, ret); 884#endif 885 886 if (map != kernel_map) 887 l->l_pflag &= ~LP_SA_PAGEFAULT; 888 889 /* 890 * If this was a stack access we keep track of the maximum 891 * accessed stack size. Also, if uvm_fault gets a protection 892 * failure it is due to accessing the stack region outside 893 * the current limit and we need to reflect that as an access 894 * error. 895 */ 896 if (map != kernel_map && va >= (vaddr_t)vm->vm_minsaddr) { 897 if (ret == 0) 898 uvm_grow(l->l_proc, va); 899 else if (ret == EACCES) 900 ret = EFAULT; 901 } 902 903 if (ret != 0) { 904 if (type & T_USER) { 905#ifdef DEBUG 906 user_backtrace(frame, l, type); 907#endif 908 KSI_INIT_TRAP(&ksi); 909 ksi.ksi_signo = SIGSEGV; 910 ksi.ksi_code = (ret == EACCES ? 911 SEGV_ACCERR : SEGV_MAPERR); 912 ksi.ksi_trap = type; 913 ksi.ksi_addr = (void *)va; 914 trapsignal(l, &ksi); 915 } else { 916 if (onfault) { 917 goto do_onfault; 918 } 919 panic("trap: uvm_fault(%p, %lx, %d): %d", 920 map, va, vftype, ret); 921 } 922 } 923 break; 924 925 case T_DATALIGN | T_USER: 926#ifdef DEBUG 927 user_backtrace(frame, l, type); 928#endif 929 KSI_INIT_TRAP(&ksi); 930 ksi.ksi_signo = SIGBUS; 931 ksi.ksi_code = BUS_ADRALN; 932 ksi.ksi_trap = type; 933 ksi.ksi_addr = (void *)va; 934 trapsignal(l, &ksi); 935 break; 936 937 case T_INTERRUPT: 938 case T_INTERRUPT|T_USER: 939 hppa_intr(frame); 940 mtctl(frame->tf_eiem, CR_EIEM); 941 break; 942 943 case T_LOWERPL: 944 case T_DPROT: 945 case T_IPROT: 946 case T_OVERFLOW: 947 case T_CONDITION: 948 case T_ILLEGAL: 949 case T_HIGHERPL: 950 case T_TAKENBR: 951 case T_POWERFAIL: 952 case T_LPMC: 953 case T_PAGEREF: 954 case T_DATAPID: case T_DATAPID | T_USER: 955 if (0 /* T-chip */) { 956 break; 957 } 958 /* FALLTHROUGH to unimplemented */ 959 default: 960 panic ("trap: unimplemented \'%s\' (%d)", tts, type); 961 } 962 963#ifdef DIAGNOSTIC 964 if (cpl != oldcpl) 965 printf("WARNING: SPL (%d) NOT LOWERED ON TRAP (%d) EXIT\n", 966 cpl, trapnum); 967#endif 968 969 if (type & T_USER) 970 userret(l, l->l_md.md_regs->tf_iioq_head, 0); 971 972#ifdef DEBUG 973 frame_sanity_check(__func__, __LINE__, type, frame, l); 974 if (frame->tf_flags & TFF_LAST && (curlwp->l_flag & LW_IDLE) == 0) 975 frame_sanity_check(__func__, __LINE__, type, curlwp->l_md.md_regs, 976 curlwp); 977#endif /* DEBUG */ 978} 979 980void 981child_return(void *arg) 982{ 983 struct lwp *l = arg; 984 985 /* 986 * Return values in the frame set by cpu_lwp_fork(). 987 */ 988 989 userret(l, l->l_md.md_regs->tf_iioq_head, 0); 990 ktrsysret(SYS_fork, 0, 0); 991#ifdef DEBUG 992 frame_sanity_check(__func__, __LINE__, 0, l->l_md.md_regs, l); 993#endif /* DEBUG */ 994} 995 996#ifdef PTRACE 997 998#include <sys/ptrace.h> 999 1000int 1001ss_get_value(struct lwp *l, vaddr_t addr, u_int *value) 1002{ 1003 struct uio uio; 1004 struct iovec iov; 1005 1006 iov.iov_base = (void *)value; 1007 iov.iov_len = sizeof(u_int); 1008 uio.uio_iov = &iov; 1009 uio.uio_iovcnt = 1; 1010 uio.uio_offset = (off_t)addr; 1011 uio.uio_resid = sizeof(u_int); 1012 uio.uio_rw = UIO_READ; 1013 UIO_SETUP_SYSSPACE(&uio); 1014 1015 return (process_domem(curlwp, l, &uio)); 1016} 1017 1018int 1019ss_put_value(struct lwp *l, vaddr_t addr, u_int value) 1020{ 1021 struct uio uio; 1022 struct iovec iov; 1023 1024 iov.iov_base = (void *)&value; 1025 iov.iov_len = sizeof(u_int); 1026 uio.uio_iov = &iov; 1027 uio.uio_iovcnt = 1; 1028 uio.uio_offset = (off_t)addr; 1029 uio.uio_resid = sizeof(u_int); 1030 uio.uio_rw = UIO_WRITE; 1031 UIO_SETUP_SYSSPACE(&uio); 1032 1033 return (process_domem(curlwp, l, &uio)); 1034} 1035 1036void 1037ss_clear_breakpoints(struct lwp *l) 1038{ 1039 /* Restore origional instructions. */ 1040 if (l->l_md.md_bpva != 0) { 1041 ss_put_value(l, l->l_md.md_bpva, l->l_md.md_bpsave[0]); 1042 ss_put_value(l, l->l_md.md_bpva + 4, l->l_md.md_bpsave[1]); 1043 l->l_md.md_bpva = 0; 1044 } 1045} 1046 1047 1048int 1049process_sstep(struct lwp *l, int sstep) 1050{ 1051 struct trapframe *tf = l->l_md.md_regs; 1052 int error; 1053 1054 ss_clear_breakpoints(l); 1055 1056 /* We're continuing... */ 1057 /* Don't touch the syscall gateway page. */ 1058 /* XXX head */ 1059 if (sstep == 0 || 1060 (tf->tf_iioq_tail & ~PAGE_MASK) == SYSCALLGATE) { 1061 tf->tf_ipsw &= ~PSW_T; 1062 return 0; 1063 } 1064 1065 l->l_md.md_bpva = tf->tf_iioq_tail & ~HPPA_PC_PRIV_MASK; 1066 1067 /* 1068 * Insert two breakpoint instructions; the first one might be 1069 * nullified. Of course we need to save two instruction 1070 * first. 1071 */ 1072 1073 error = ss_get_value(l, l->l_md.md_bpva, &l->l_md.md_bpsave[0]); 1074 if (error) 1075 return (error); 1076 error = ss_get_value(l, l->l_md.md_bpva + 4, &l->l_md.md_bpsave[1]); 1077 if (error) 1078 return (error); 1079 1080 error = ss_put_value(l, l->l_md.md_bpva, SSBREAKPOINT); 1081 if (error) 1082 return error; 1083 error = ss_put_value(l, l->l_md.md_bpva + 4, SSBREAKPOINT); 1084 if (error) 1085 return error; 1086 1087 tf->tf_ipsw |= PSW_T; 1088 1089 return 0; 1090} 1091#endif 1092 1093 1094/* 1095 * call actual syscall routine 1096 * from the low-level syscall handler: 1097 * - all HPPA_FRAME_NARGS syscall's arguments supposed to be copied onto 1098 * our stack, this wins compared to copyin just needed amount anyway 1099 * - register args are copied onto stack too 1100 */ 1101void 1102syscall(struct trapframe *frame, int *args) 1103{ 1104 struct lwp *l; 1105 struct proc *p; 1106 const struct sysent *callp; 1107 size_t nargs64; 1108 int nsys, code, error; 1109 int tmp; 1110 int rval[2]; 1111#ifdef DIAGNOSTIC 1112 int oldcpl = cpl; 1113#endif 1114 1115 uvmexp.syscalls++; 1116 1117#ifdef DEBUG 1118 frame_sanity_check(__func__, __LINE__, 0, frame, curlwp); 1119#endif /* DEBUG */ 1120 1121 if (!USERMODE(frame->tf_iioq_head)) 1122 panic("syscall"); 1123 1124 KASSERT(curlwp != NULL); 1125 l = curlwp; 1126 p = l->l_proc; 1127 l->l_md.md_regs = frame; 1128 nsys = p->p_emul->e_nsysent; 1129 callp = p->p_emul->e_sysent; 1130 code = frame->tf_t1; 1131 LWP_CACHE_CREDS(l, p); 1132 1133#ifdef KERN_SA 1134 if (__predict_false((l->l_savp) 1135 && (l->l_savp->savp_pflags & SAVP_FLAG_DELIVERING))) 1136 l->l_savp->savp_pflags &= ~SAVP_FLAG_DELIVERING; 1137#endif 1138 1139 /* 1140 * Restarting a system call is touchy on the HPPA, because syscall 1141 * arguments are passed in registers and the program counter of the 1142 * syscall "point" isn't easily divined. 1143 * 1144 * We handle the first problem by assuming that we will have to restart 1145 * this system call, so we stuff the first four words of the original 1146 * arguments back into the frame as arg0...arg3, which is where we 1147 * found them in the first place. Any further arguments are (still) on 1148 * the user's stack and the syscall code will fetch them from there 1149 * (again). 1150 * 1151 * The program counter problem is addressed below. 1152 */ 1153 frame->tf_arg0 = args[0]; 1154 frame->tf_arg1 = args[1]; 1155 frame->tf_arg2 = args[2]; 1156 frame->tf_arg3 = args[3]; 1157 1158 /* 1159 * Some special handling for the syscall(2) and 1160 * __syscall(2) system calls. 1161 */ 1162 switch (code) { 1163 case SYS_syscall: 1164 code = *args; 1165 args += 1; 1166 break; 1167 case SYS___syscall: 1168 if (callp != sysent) 1169 break; 1170 /* 1171 * NB: even though __syscall(2) takes a quad_t containing the 1172 * system call number, because our argument copying word-swaps 1173 * 64-bit arguments, the least significant word of that quad_t 1174 * is the first word in the argument array. 1175 */ 1176 code = *args; 1177 args += 2; 1178 } 1179 1180 /* 1181 * Stacks growing from lower addresses to higher addresses are not 1182 * really such a good idea, because it makes it impossible to overlay a 1183 * struct on top of C stack arguments (the arguments appear in 1184 * reversed order). 1185 * 1186 * You can do the obvious thing (as locore.S does) and copy argument 1187 * words one by one, laying them out in the "right" order in the dest- 1188 * ination buffer, but this ends up word-swapping multi-word arguments 1189 * (like off_t). 1190 * 1191 * FIXME - this works only on native binaries and 1192 * will probably screw up any and all emulation. 1193 * 1194 */ 1195 1196 if (code < 0 || code >= nsys) 1197 callp += p->p_emul->e_nosys; /* bad syscall # */ 1198 else 1199 callp += code; 1200 1201 nargs64 = SYCALL_NARGS64(callp); 1202 if (nargs64 != 0) { 1203 size_t nargs = callp->sy_narg; 1204 1205 for (size_t i = 0; i < nargs + nargs64;) { 1206 if (SYCALL_ARG_64_P(callp, i)) { 1207 tmp = args[i]; 1208 args[i] = args[i + 1]; 1209 args[i + 1] = tmp; 1210 i += 2; 1211 } else 1212 i++; 1213 } 1214 } 1215 1216#ifdef USERTRACE 1217 if (0) { 1218 user_backtrace(frame, l, -1); 1219 frame->tf_ipsw |= PSW_R; 1220 frame->tf_rctr = 0; 1221 printf("r %08x", frame->tf_iioq_head); 1222 rctr_next_iioq = frame->tf_iioq_head + 4; 1223 } 1224#endif 1225 1226 error = 0; 1227 if (__predict_false(p->p_trace_enabled)) { 1228 error = trace_enter(code, args, callp->sy_narg); 1229 if (error) 1230 goto out; 1231 } 1232 1233 rval[0] = 0; 1234 rval[1] = 0; 1235 error = sy_call(callp, l, args, rval); 1236out: 1237 switch (error) { 1238 case 0: 1239 l = curlwp; /* changes on exec() */ 1240 frame = l->l_md.md_regs; 1241 frame->tf_ret0 = rval[0]; 1242 frame->tf_ret1 = rval[1]; 1243 frame->tf_t1 = 0; 1244 break; 1245 case ERESTART: 1246 /* 1247 * Now we have to wind back the instruction offset queue to the 1248 * point where the system call will be made again. This is 1249 * inherently tied to the SYSCALL macro. 1250 * 1251 * Currently, the part of the SYSCALL macro that we want to re- 1252 * run reads as: 1253 * 1254 * ldil L%SYSCALLGATE, r1 1255 * ble 4(sr7, r1) 1256 * ldi __CONCAT(SYS_,x), t1 1257 * comb,<> %r0, %t1, __cerror 1258 * 1259 * And our offset queue head points to the comb instruction. 1260 * So we need to subtract twelve to reach the ldil. 1261 */ 1262 frame->tf_iioq_head -= 12; 1263 frame->tf_iioq_tail = frame->tf_iioq_head + 4; 1264 break; 1265 case EJUSTRETURN: 1266 p = curproc; 1267 break; 1268 default: 1269 if (p->p_emul->e_errno) 1270 error = p->p_emul->e_errno[error]; 1271 frame->tf_t1 = error; 1272 break; 1273 } 1274 1275 if (__predict_false(p->p_trace_enabled)) 1276 trace_exit(code, rval, error); 1277 1278 userret(l, frame->tf_iioq_head, 0); 1279 1280#ifdef DIAGNOSTIC 1281 if (cpl != oldcpl) { 1282 printf("WARNING: SPL (0x%x) NOT LOWERED ON " 1283 "syscall(0x%x, 0x%x, 0x%x, 0x%x...) EXIT, PID %d\n", 1284 cpl, code, args[0], args[1], args[2], p->p_pid); 1285 cpl = oldcpl; 1286 } 1287#endif 1288 1289#ifdef DEBUG 1290 frame_sanity_check(__func__, __LINE__, 0, frame, l); 1291#endif /* DEBUG */ 1292} 1293 1294/* 1295 * Start a new LWP 1296 */ 1297void 1298startlwp(void *arg) 1299{ 1300 int err; 1301 ucontext_t *uc = arg; 1302 struct lwp *l = curlwp; 1303 1304 err = cpu_setmcontext(l, &uc->uc_mcontext, uc->uc_flags); 1305#if DIAGNOSTIC 1306 if (err) { 1307 printf("Error %d from cpu_setmcontext.", err); 1308 } 1309#endif 1310 pool_put(&lwp_uc_pool, uc); 1311 1312 userret(l, l->l_md.md_regs->tf_iioq_head, 0); 1313} 1314 1315/* 1316 * XXX This is a terrible name. 1317 */ 1318void 1319upcallret(struct lwp *l) 1320{ 1321 userret(l, l->l_md.md_regs->tf_iioq_head, 0); 1322} 1323