xref: /freebsd/sys/powerpc/powerpc/trap.c (revision d6b92ffa)
1 /*-
2  * Copyright (C) 1995, 1996 Wolfgang Solfrank.
3  * Copyright (C) 1995, 1996 TooLs GmbH.
4  * All rights reserved.
5  *
6  * Redistribution and use in source and binary forms, with or without
7  * modification, are permitted provided that the following conditions
8  * are met:
9  * 1. Redistributions of source code must retain the above copyright
10  *    notice, this list of conditions and the following disclaimer.
11  * 2. Redistributions in binary form must reproduce the above copyright
12  *    notice, this list of conditions and the following disclaimer in the
13  *    documentation and/or other materials provided with the distribution.
14  * 3. All advertising materials mentioning features or use of this software
15  *    must display the following acknowledgement:
16  *	This product includes software developed by TooLs GmbH.
17  * 4. The name of TooLs GmbH may not be used to endorse or promote products
18  *    derived from this software without specific prior written permission.
19  *
20  * THIS SOFTWARE IS PROVIDED BY TOOLS GMBH ``AS IS'' AND ANY EXPRESS OR
21  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
22  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
23  * IN NO EVENT SHALL TOOLS GMBH BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
24  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
25  * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS;
26  * OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
27  * WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
28  * OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF
29  * ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
30  *
31  * $NetBSD: trap.c,v 1.58 2002/03/04 04:07:35 dbj Exp $
32  */
33 
34 #include <sys/cdefs.h>
35 __FBSDID("$FreeBSD$");
36 
37 #include <sys/param.h>
38 #include <sys/kdb.h>
39 #include <sys/proc.h>
40 #include <sys/ktr.h>
41 #include <sys/lock.h>
42 #include <sys/mutex.h>
43 #include <sys/pioctl.h>
44 #include <sys/ptrace.h>
45 #include <sys/reboot.h>
46 #include <sys/syscall.h>
47 #include <sys/sysent.h>
48 #include <sys/systm.h>
49 #include <sys/kernel.h>
50 #include <sys/uio.h>
51 #include <sys/signalvar.h>
52 #include <sys/vmmeter.h>
53 
54 #include <security/audit/audit.h>
55 
56 #include <vm/vm.h>
57 #include <vm/pmap.h>
58 #include <vm/vm_extern.h>
59 #include <vm/vm_param.h>
60 #include <vm/vm_kern.h>
61 #include <vm/vm_map.h>
62 #include <vm/vm_page.h>
63 
64 #include <machine/_inttypes.h>
65 #include <machine/altivec.h>
66 #include <machine/cpu.h>
67 #include <machine/db_machdep.h>
68 #include <machine/fpu.h>
69 #include <machine/frame.h>
70 #include <machine/pcb.h>
71 #include <machine/psl.h>
72 #include <machine/trap.h>
73 #include <machine/spr.h>
74 #include <machine/sr.h>
75 
76 /* Below matches setjmp.S */
77 #define	FAULTBUF_LR	21
78 #define	FAULTBUF_R1	1
79 #define	FAULTBUF_R2	2
80 #define	FAULTBUF_CR	22
81 #define	FAULTBUF_R14	3
82 
83 #define	MOREARGS(sp)	((caddr_t)((uintptr_t)(sp) + \
84     sizeof(struct callframe) - 3*sizeof(register_t))) /* more args go here */
85 
86 static void	trap_fatal(struct trapframe *frame);
87 static void	printtrap(u_int vector, struct trapframe *frame, int isfatal,
88 		    int user);
89 static int	trap_pfault(struct trapframe *frame, int user);
90 static int	fix_unaligned(struct thread *td, struct trapframe *frame);
91 static int	handle_onfault(struct trapframe *frame);
92 static void	syscall(struct trapframe *frame);
93 
94 #if defined(__powerpc64__) && defined(AIM)
95        void	handle_kernel_slb_spill(int, register_t, register_t);
96 static int	handle_user_slb_spill(pmap_t pm, vm_offset_t addr);
97 extern int	n_slbs;
98 #endif
99 
100 #ifdef KDB
101 int db_trap_glue(struct trapframe *);		/* Called from trap_subr.S */
102 #endif
103 
104 struct powerpc_exception {
105 	u_int	vector;
106 	char	*name;
107 };
108 
109 #ifdef KDTRACE_HOOKS
110 #include <sys/dtrace_bsd.h>
111 
112 int (*dtrace_invop_jump_addr)(struct trapframe *);
113 #endif
114 
115 static struct powerpc_exception powerpc_exceptions[] = {
116 	{ EXC_CRIT,	"critical input" },
117 	{ EXC_RST,	"system reset" },
118 	{ EXC_MCHK,	"machine check" },
119 	{ EXC_DSI,	"data storage interrupt" },
120 	{ EXC_DSE,	"data segment exception" },
121 	{ EXC_ISI,	"instruction storage interrupt" },
122 	{ EXC_ISE,	"instruction segment exception" },
123 	{ EXC_EXI,	"external interrupt" },
124 	{ EXC_ALI,	"alignment" },
125 	{ EXC_PGM,	"program" },
126 	{ EXC_FPU,	"floating-point unavailable" },
127 	{ EXC_APU,	"auxiliary proc unavailable" },
128 	{ EXC_DECR,	"decrementer" },
129 	{ EXC_FIT,	"fixed-interval timer" },
130 	{ EXC_WDOG,	"watchdog timer" },
131 	{ EXC_SC,	"system call" },
132 	{ EXC_TRC,	"trace" },
133 	{ EXC_FPA,	"floating-point assist" },
134 	{ EXC_DEBUG,	"debug" },
135 	{ EXC_PERF,	"performance monitoring" },
136 	{ EXC_VEC,	"altivec unavailable" },
137 	{ EXC_VSX,	"vsx unavailable" },
138 	{ EXC_ITMISS,	"instruction tlb miss" },
139 	{ EXC_DLMISS,	"data load tlb miss" },
140 	{ EXC_DSMISS,	"data store tlb miss" },
141 	{ EXC_BPT,	"instruction breakpoint" },
142 	{ EXC_SMI,	"system management" },
143 	{ EXC_VECAST_G4,	"altivec assist" },
144 	{ EXC_THRM,	"thermal management" },
145 	{ EXC_RUNMODETRC,	"run mode/trace" },
146 	{ EXC_LAST,	NULL }
147 };
148 
149 static const char *
150 trapname(u_int vector)
151 {
152 	struct	powerpc_exception *pe;
153 
154 	for (pe = powerpc_exceptions; pe->vector != EXC_LAST; pe++) {
155 		if (pe->vector == vector)
156 			return (pe->name);
157 	}
158 
159 	return ("unknown");
160 }
161 
162 void
163 trap(struct trapframe *frame)
164 {
165 	struct thread	*td;
166 	struct proc	*p;
167 #ifdef KDTRACE_HOOKS
168 	uint32_t inst;
169 #endif
170 	int		sig, type, user;
171 	u_int		ucode;
172 	ksiginfo_t	ksi;
173 
174 	VM_CNT_INC(v_trap);
175 
176 	td = curthread;
177 	p = td->td_proc;
178 
179 	type = ucode = frame->exc;
180 	sig = 0;
181 	user = frame->srr1 & PSL_PR;
182 
183 	CTR3(KTR_TRAP, "trap: %s type=%s (%s)", td->td_name,
184 	    trapname(type), user ? "user" : "kernel");
185 
186 #ifdef KDTRACE_HOOKS
187 	/*
188 	 * A trap can occur while DTrace executes a probe. Before
189 	 * executing the probe, DTrace blocks re-scheduling and sets
190 	 * a flag in its per-cpu flags to indicate that it doesn't
191 	 * want to fault. On returning from the probe, the no-fault
192 	 * flag is cleared and finally re-scheduling is enabled.
193 	 *
194 	 * If the DTrace kernel module has registered a trap handler,
195 	 * call it and if it returns non-zero, assume that it has
196 	 * handled the trap and modified the trap frame so that this
197 	 * function can return normally.
198 	 */
199 	if (dtrace_trap_func != NULL && (*dtrace_trap_func)(frame, type) != 0)
200 		return;
201 #endif
202 
203 	if (user) {
204 		td->td_pticks = 0;
205 		td->td_frame = frame;
206 		if (td->td_cowgen != p->p_cowgen)
207 			thread_cow_update(td);
208 
209 		/* User Mode Traps */
210 		switch (type) {
211 		case EXC_RUNMODETRC:
212 		case EXC_TRC:
213 			frame->srr1 &= ~PSL_SE;
214 			sig = SIGTRAP;
215 			ucode = TRAP_TRACE;
216 			break;
217 
218 #if defined(__powerpc64__) && defined(AIM)
219 		case EXC_ISE:
220 		case EXC_DSE:
221 			if (handle_user_slb_spill(&p->p_vmspace->vm_pmap,
222 			    (type == EXC_ISE) ? frame->srr0 : frame->dar) != 0){
223 				sig = SIGSEGV;
224 				ucode = SEGV_MAPERR;
225 			}
226 			break;
227 #endif
228 		case EXC_DSI:
229 		case EXC_ISI:
230 			sig = trap_pfault(frame, 1);
231 			if (sig == SIGSEGV)
232 				ucode = SEGV_MAPERR;
233 			break;
234 
235 		case EXC_SC:
236 			syscall(frame);
237 			break;
238 
239 		case EXC_FPU:
240 			KASSERT((td->td_pcb->pcb_flags & PCB_FPU) != PCB_FPU,
241 			    ("FPU already enabled for thread"));
242 			enable_fpu(td);
243 			break;
244 
245 		case EXC_VEC:
246 			KASSERT((td->td_pcb->pcb_flags & PCB_VEC) != PCB_VEC,
247 			    ("Altivec already enabled for thread"));
248 			enable_vec(td);
249 			break;
250 
251 		case EXC_VSX:
252 			KASSERT((td->td_pcb->pcb_flags & PCB_VSX) != PCB_VSX,
253 			    ("VSX already enabled for thread"));
254 			if (!(td->td_pcb->pcb_flags & PCB_VEC))
255 				enable_vec(td);
256 			if (!(td->td_pcb->pcb_flags & PCB_FPU))
257 				save_fpu(td);
258 			td->td_pcb->pcb_flags |= PCB_VSX;
259 			enable_fpu(td);
260 			break;
261 
262 		case EXC_VECAST_E:
263 		case EXC_VECAST_G4:
264 		case EXC_VECAST_G5:
265 			/*
266 			 * We get a VPU assist exception for IEEE mode
267 			 * vector operations on denormalized floats.
268 			 * Emulating this is a giant pain, so for now,
269 			 * just switch off IEEE mode and treat them as
270 			 * zero.
271 			 */
272 
273 			save_vec(td);
274 			td->td_pcb->pcb_vec.vscr |= ALTIVEC_VSCR_NJ;
275 			enable_vec(td);
276 			break;
277 
278 		case EXC_ALI:
279 			if (fix_unaligned(td, frame) != 0) {
280 				sig = SIGBUS;
281 				ucode = BUS_ADRALN;
282 			}
283 			else
284 				frame->srr0 += 4;
285 			break;
286 
287 		case EXC_DEBUG:	/* Single stepping */
288 			mtspr(SPR_DBSR, mfspr(SPR_DBSR));
289 			frame->srr1 &= ~PSL_DE;
290 			frame->cpu.booke.dbcr0 &= ~(DBCR0_IDM | DBCR0_IC);
291 			sig = SIGTRAP;
292 			ucode = TRAP_TRACE;
293 			break;
294 
295 		case EXC_PGM:
296 			/* Identify the trap reason */
297 #ifdef AIM
298 			if (frame->srr1 & EXC_PGM_TRAP) {
299 #else
300 			if (frame->cpu.booke.esr & ESR_PTR) {
301 #endif
302 #ifdef KDTRACE_HOOKS
303 				inst = fuword32((const void *)frame->srr0);
304 				if (inst == 0x0FFFDDDD &&
305 				    dtrace_pid_probe_ptr != NULL) {
306 					struct reg regs;
307 					fill_regs(td, &regs);
308 					(*dtrace_pid_probe_ptr)(&regs);
309 					break;
310 				}
311 #endif
312  				sig = SIGTRAP;
313 				ucode = TRAP_BRKPT;
314 			} else {
315 				sig = ppc_instr_emulate(frame, td->td_pcb);
316 				if (sig == SIGILL) {
317 					if (frame->srr1 & EXC_PGM_PRIV)
318 						ucode = ILL_PRVOPC;
319 					else if (frame->srr1 & EXC_PGM_ILLEGAL)
320 						ucode = ILL_ILLOPC;
321 				} else if (sig == SIGFPE)
322 					ucode = FPE_FLTINV;	/* Punt for now, invalid operation. */
323 			}
324 			break;
325 
326 		case EXC_MCHK:
327 			/*
328 			 * Note that this may not be recoverable for the user
329 			 * process, depending on the type of machine check,
330 			 * but it at least prevents the kernel from dying.
331 			 */
332 			sig = SIGBUS;
333 			ucode = BUS_OBJERR;
334 			break;
335 
336 		default:
337 			trap_fatal(frame);
338 		}
339 	} else {
340 		/* Kernel Mode Traps */
341 
342 		KASSERT(cold || td->td_ucred != NULL,
343 		    ("kernel trap doesn't have ucred"));
344 		switch (type) {
345 		case EXC_PGM:
346 #ifdef KDTRACE_HOOKS
347 #ifdef AIM
348 			if (frame->srr1 & EXC_PGM_TRAP) {
349 #else
350 			if (frame->cpu.booke.esr & ESR_PTR) {
351 #endif
352 				if (*(uint32_t *)frame->srr0 == EXC_DTRACE) {
353 					if (dtrace_invop_jump_addr != NULL) {
354 						dtrace_invop_jump_addr(frame);
355 						return;
356 					}
357 				}
358 			}
359 #endif
360 #ifdef KDB
361 			if (db_trap_glue(frame))
362 				return;
363 #endif
364 			break;
365 #if defined(__powerpc64__) && defined(AIM)
366 		case EXC_DSE:
367 			if ((frame->dar & SEGMENT_MASK) == USER_ADDR) {
368 				__asm __volatile ("slbmte %0, %1" ::
369 					"r"(td->td_pcb->pcb_cpu.aim.usr_vsid),
370 					"r"(USER_SLB_SLBE));
371 				return;
372 			}
373 			break;
374 #endif
375 		case EXC_DSI:
376 			if (trap_pfault(frame, 0) == 0)
377  				return;
378 			break;
379 		case EXC_MCHK:
380 			if (handle_onfault(frame))
381  				return;
382 			break;
383 		default:
384 			break;
385 		}
386 		trap_fatal(frame);
387 	}
388 
389 	if (sig != 0) {
390 		if (p->p_sysent->sv_transtrap != NULL)
391 			sig = (p->p_sysent->sv_transtrap)(sig, type);
392 		ksiginfo_init_trap(&ksi);
393 		ksi.ksi_signo = sig;
394 		ksi.ksi_code = (int) ucode; /* XXX, not POSIX */
395 		/* ksi.ksi_addr = ? */
396 		ksi.ksi_trapno = type;
397 		trapsignal(td, &ksi);
398 	}
399 
400 	userret(td, frame);
401 }
402 
403 static void
404 trap_fatal(struct trapframe *frame)
405 {
406 
407 	printtrap(frame->exc, frame, 1, (frame->srr1 & PSL_PR));
408 #ifdef KDB
409 	if ((debugger_on_panic || kdb_active) &&
410 	    kdb_trap(frame->exc, 0, frame))
411 		return;
412 #endif
413 	panic("%s trap", trapname(frame->exc));
414 }
415 
416 static void
417 printtrap(u_int vector, struct trapframe *frame, int isfatal, int user)
418 {
419 	uint16_t ver;
420 #ifdef BOOKE
421 	vm_paddr_t pa;
422 #endif
423 
424 	printf("\n");
425 	printf("%s %s trap:\n", isfatal ? "fatal" : "handled",
426 	    user ? "user" : "kernel");
427 	printf("\n");
428 	printf("   exception       = 0x%x (%s)\n", vector, trapname(vector));
429 	switch (vector) {
430 	case EXC_DSE:
431 	case EXC_DSI:
432 	case EXC_DTMISS:
433 		printf("   virtual address = 0x%" PRIxPTR "\n", frame->dar);
434 #ifdef AIM
435 		printf("   dsisr           = 0x%lx\n",
436 		    (u_long)frame->cpu.aim.dsisr);
437 #endif
438 		break;
439 	case EXC_ISE:
440 	case EXC_ISI:
441 	case EXC_ITMISS:
442 		printf("   virtual address = 0x%" PRIxPTR "\n", frame->srr0);
443 		break;
444 	case EXC_MCHK:
445 		ver = mfpvr() >> 16;
446 #if defined(AIM)
447 		if (MPC745X_P(ver))
448 			printf("    msssr0         = 0x%lx\n",
449 			    (u_long)mfspr(SPR_MSSSR0));
450 #elif defined(BOOKE)
451 		pa = mfspr(SPR_MCARU);
452 		pa = (pa << 32) | (u_register_t)mfspr(SPR_MCAR);
453 		printf("   mcsr            = 0x%lx\n", (u_long)mfspr(SPR_MCSR));
454 		printf("   mcar            = 0x%jx\n", (uintmax_t)pa);
455 #endif
456 		break;
457 	}
458 #ifdef BOOKE
459 	printf("   esr             = 0x%" PRIxPTR "\n",
460 	    frame->cpu.booke.esr);
461 #endif
462 	printf("   srr0            = 0x%" PRIxPTR "\n", frame->srr0);
463 	printf("   srr1            = 0x%lx\n", (u_long)frame->srr1);
464 	printf("   lr              = 0x%" PRIxPTR "\n", frame->lr);
465 	printf("   curthread       = %p\n", curthread);
466 	if (curthread != NULL)
467 		printf("          pid = %d, comm = %s\n",
468 		    curthread->td_proc->p_pid, curthread->td_name);
469 	printf("\n");
470 }
471 
472 /*
473  * Handles a fatal fault when we have onfault state to recover.  Returns
474  * non-zero if there was onfault recovery state available.
475  */
476 static int
477 handle_onfault(struct trapframe *frame)
478 {
479 	struct		thread *td;
480 	jmp_buf		*fb;
481 
482 	td = curthread;
483 	fb = td->td_pcb->pcb_onfault;
484 	if (fb != NULL) {
485 		frame->srr0 = (*fb)->_jb[FAULTBUF_LR];
486 		frame->fixreg[1] = (*fb)->_jb[FAULTBUF_R1];
487 		frame->fixreg[2] = (*fb)->_jb[FAULTBUF_R2];
488 		frame->fixreg[3] = 1;
489 		frame->cr = (*fb)->_jb[FAULTBUF_CR];
490 		bcopy(&(*fb)->_jb[FAULTBUF_R14], &frame->fixreg[14],
491 		    18 * sizeof(register_t));
492 		td->td_pcb->pcb_onfault = NULL; /* Returns twice, not thrice */
493 		return (1);
494 	}
495 	return (0);
496 }
497 
498 int
499 cpu_fetch_syscall_args(struct thread *td)
500 {
501 	struct proc *p;
502 	struct trapframe *frame;
503 	struct syscall_args *sa;
504 	caddr_t	params;
505 	size_t argsz;
506 	int error, n, i;
507 
508 	p = td->td_proc;
509 	frame = td->td_frame;
510 	sa = &td->td_sa;
511 
512 	sa->code = frame->fixreg[0];
513 	params = (caddr_t)(frame->fixreg + FIRSTARG);
514 	n = NARGREG;
515 
516 	if (sa->code == SYS_syscall) {
517 		/*
518 		 * code is first argument,
519 		 * followed by actual args.
520 		 */
521 		sa->code = *(register_t *) params;
522 		params += sizeof(register_t);
523 		n -= 1;
524 	} else if (sa->code == SYS___syscall) {
525 		/*
526 		 * Like syscall, but code is a quad,
527 		 * so as to maintain quad alignment
528 		 * for the rest of the args.
529 		 */
530 		if (SV_PROC_FLAG(p, SV_ILP32)) {
531 			params += sizeof(register_t);
532 			sa->code = *(register_t *) params;
533 			params += sizeof(register_t);
534 			n -= 2;
535 		} else {
536 			sa->code = *(register_t *) params;
537 			params += sizeof(register_t);
538 			n -= 1;
539 		}
540 	}
541 
542  	if (p->p_sysent->sv_mask)
543 		sa->code &= p->p_sysent->sv_mask;
544 	if (sa->code >= p->p_sysent->sv_size)
545 		sa->callp = &p->p_sysent->sv_table[0];
546 	else
547 		sa->callp = &p->p_sysent->sv_table[sa->code];
548 
549 	sa->narg = sa->callp->sy_narg;
550 
551 	if (SV_PROC_FLAG(p, SV_ILP32)) {
552 		argsz = sizeof(uint32_t);
553 
554 		for (i = 0; i < n; i++)
555 			sa->args[i] = ((u_register_t *)(params))[i] &
556 			    0xffffffff;
557 	} else {
558 		argsz = sizeof(uint64_t);
559 
560 		for (i = 0; i < n; i++)
561 			sa->args[i] = ((u_register_t *)(params))[i];
562 	}
563 
564 	if (sa->narg > n)
565 		error = copyin(MOREARGS(frame->fixreg[1]), sa->args + n,
566 			       (sa->narg - n) * argsz);
567 	else
568 		error = 0;
569 
570 #ifdef __powerpc64__
571 	if (SV_PROC_FLAG(p, SV_ILP32) && sa->narg > n) {
572 		/* Expand the size of arguments copied from the stack */
573 
574 		for (i = sa->narg; i >= n; i--)
575 			sa->args[i] = ((uint32_t *)(&sa->args[n]))[i-n];
576 	}
577 #endif
578 
579 	if (error == 0) {
580 		td->td_retval[0] = 0;
581 		td->td_retval[1] = frame->fixreg[FIRSTARG + 1];
582 	}
583 	return (error);
584 }
585 
586 #include "../../kern/subr_syscall.c"
587 
588 void
589 syscall(struct trapframe *frame)
590 {
591 	struct thread *td;
592 	int error;
593 
594 	td = curthread;
595 	td->td_frame = frame;
596 
597 #if defined(__powerpc64__) && defined(AIM)
598 	/*
599 	 * Speculatively restore last user SLB segment, which we know is
600 	 * invalid already, since we are likely to do copyin()/copyout().
601 	 */
602 	__asm __volatile ("slbmte %0, %1; isync" ::
603             "r"(td->td_pcb->pcb_cpu.aim.usr_vsid), "r"(USER_SLB_SLBE));
604 #endif
605 
606 	error = syscallenter(td);
607 	syscallret(td, error);
608 }
609 
610 #if defined(__powerpc64__) && defined(AIM)
611 /* Handle kernel SLB faults -- runs in real mode, all seat belts off */
612 void
613 handle_kernel_slb_spill(int type, register_t dar, register_t srr0)
614 {
615 	struct slb *slbcache;
616 	uint64_t slbe, slbv;
617 	uint64_t esid, addr;
618 	int i;
619 
620 	addr = (type == EXC_ISE) ? srr0 : dar;
621 	slbcache = PCPU_GET(slb);
622 	esid = (uintptr_t)addr >> ADDR_SR_SHFT;
623 	slbe = (esid << SLBE_ESID_SHIFT) | SLBE_VALID;
624 
625 	/* See if the hardware flushed this somehow (can happen in LPARs) */
626 	for (i = 0; i < n_slbs; i++)
627 		if (slbcache[i].slbe == (slbe | (uint64_t)i))
628 			return;
629 
630 	/* Not in the map, needs to actually be added */
631 	slbv = kernel_va_to_slbv(addr);
632 	if (slbcache[USER_SLB_SLOT].slbe == 0) {
633 		for (i = 0; i < n_slbs; i++) {
634 			if (i == USER_SLB_SLOT)
635 				continue;
636 			if (!(slbcache[i].slbe & SLBE_VALID))
637 				goto fillkernslb;
638 		}
639 
640 		if (i == n_slbs)
641 			slbcache[USER_SLB_SLOT].slbe = 1;
642 	}
643 
644 	/* Sacrifice a random SLB entry that is not the user entry */
645 	i = mftb() % n_slbs;
646 	if (i == USER_SLB_SLOT)
647 		i = (i+1) % n_slbs;
648 
649 fillkernslb:
650 	/* Write new entry */
651 	slbcache[i].slbv = slbv;
652 	slbcache[i].slbe = slbe | (uint64_t)i;
653 
654 	/* Trap handler will restore from cache on exit */
655 }
656 
657 static int
658 handle_user_slb_spill(pmap_t pm, vm_offset_t addr)
659 {
660 	struct slb *user_entry;
661 	uint64_t esid;
662 	int i;
663 
664 	esid = (uintptr_t)addr >> ADDR_SR_SHFT;
665 
666 	PMAP_LOCK(pm);
667 	user_entry = user_va_to_slb_entry(pm, addr);
668 
669 	if (user_entry == NULL) {
670 		/* allocate_vsid auto-spills it */
671 		(void)allocate_user_vsid(pm, esid, 0);
672 	} else {
673 		/*
674 		 * Check that another CPU has not already mapped this.
675 		 * XXX: Per-thread SLB caches would be better.
676 		 */
677 		for (i = 0; i < pm->pm_slb_len; i++)
678 			if (pm->pm_slb[i] == user_entry)
679 				break;
680 
681 		if (i == pm->pm_slb_len)
682 			slb_insert_user(pm, user_entry);
683 	}
684 	PMAP_UNLOCK(pm);
685 
686 	return (0);
687 }
688 #endif
689 
690 static int
691 trap_pfault(struct trapframe *frame, int user)
692 {
693 	vm_offset_t	eva, va;
694 	struct		thread *td;
695 	struct		proc *p;
696 	vm_map_t	map;
697 	vm_prot_t	ftype;
698 	int		rv;
699 #ifdef AIM
700 	register_t	user_sr;
701 #endif
702 
703 	td = curthread;
704 	p = td->td_proc;
705 	if (frame->exc == EXC_ISI) {
706 		eva = frame->srr0;
707 		ftype = VM_PROT_EXECUTE;
708 		if (frame->srr1 & SRR1_ISI_PFAULT)
709 			ftype |= VM_PROT_READ;
710 	} else {
711 		eva = frame->dar;
712 #ifdef BOOKE
713 		if (frame->cpu.booke.esr & ESR_ST)
714 #else
715 		if (frame->cpu.aim.dsisr & DSISR_STORE)
716 #endif
717 			ftype = VM_PROT_WRITE;
718 		else
719 			ftype = VM_PROT_READ;
720 	}
721 
722 	if (user) {
723 		KASSERT(p->p_vmspace != NULL, ("trap_pfault: vmspace  NULL"));
724 		map = &p->p_vmspace->vm_map;
725 	} else {
726 #ifdef BOOKE
727 		if (eva < VM_MAXUSER_ADDRESS) {
728 #else
729 		if ((eva >> ADDR_SR_SHFT) == (USER_ADDR >> ADDR_SR_SHFT)) {
730 #endif
731 			map = &p->p_vmspace->vm_map;
732 
733 #ifdef AIM
734 			user_sr = td->td_pcb->pcb_cpu.aim.usr_segm;
735 			eva &= ADDR_PIDX | ADDR_POFF;
736 			eva |= user_sr << ADDR_SR_SHFT;
737 #endif
738 		} else {
739 			map = kernel_map;
740 		}
741 	}
742 	va = trunc_page(eva);
743 
744 	/* Fault in the page. */
745 	rv = vm_fault(map, va, ftype, VM_FAULT_NORMAL);
746 	/*
747 	 * XXXDTRACE: add dtrace_doubletrap_func here?
748 	 */
749 
750 	if (rv == KERN_SUCCESS)
751 		return (0);
752 
753 	if (!user && handle_onfault(frame))
754 		return (0);
755 
756 	return (SIGSEGV);
757 }
758 
759 /*
760  * For now, this only deals with the particular unaligned access case
761  * that gcc tends to generate.  Eventually it should handle all of the
762  * possibilities that can happen on a 32-bit PowerPC in big-endian mode.
763  */
764 
765 static int
766 fix_unaligned(struct thread *td, struct trapframe *frame)
767 {
768 	struct thread	*fputhread;
769 #ifdef	__SPE__
770 	uint32_t	inst;
771 #endif
772 	int		indicator, reg;
773 	double		*fpr;
774 
775 #ifdef __SPE__
776 	indicator = (frame->cpu.booke.esr & (ESR_ST|ESR_SPE));
777 	if (indicator & ESR_SPE) {
778 		if (copyin((void *)frame->srr0, &inst, sizeof(inst)) != 0)
779 			return (-1);
780 		reg = EXC_ALI_SPE_REG(inst);
781 		fpr = (double *)td->td_pcb->pcb_vec.vr[reg];
782 		fputhread = PCPU_GET(vecthread);
783 
784 		/* Juggle the SPE to ensure that we've initialized
785 		 * the registers, and that their current state is in
786 		 * the PCB.
787 		 */
788 		if (fputhread != td) {
789 			if (fputhread)
790 				save_vec(fputhread);
791 			enable_vec(td);
792 		}
793 		save_vec(td);
794 
795 		if (!(indicator & ESR_ST)) {
796 			if (copyin((void *)frame->dar, fpr,
797 			    sizeof(double)) != 0)
798 				return (-1);
799 			frame->fixreg[reg] = td->td_pcb->pcb_vec.vr[reg][1];
800 			enable_vec(td);
801 		} else {
802 			td->td_pcb->pcb_vec.vr[reg][1] = frame->fixreg[reg];
803 			if (copyout(fpr, (void *)frame->dar,
804 			    sizeof(double)) != 0)
805 				return (-1);
806 		}
807 		return (0);
808 	}
809 #else
810 	indicator = EXC_ALI_OPCODE_INDICATOR(frame->cpu.aim.dsisr);
811 
812 	switch (indicator) {
813 	case EXC_ALI_LFD:
814 	case EXC_ALI_STFD:
815 		reg = EXC_ALI_RST(frame->cpu.aim.dsisr);
816 		fpr = &td->td_pcb->pcb_fpu.fpr[reg].fpr;
817 		fputhread = PCPU_GET(fputhread);
818 
819 		/* Juggle the FPU to ensure that we've initialized
820 		 * the FPRs, and that their current state is in
821 		 * the PCB.
822 		 */
823 		if (fputhread != td) {
824 			if (fputhread)
825 				save_fpu(fputhread);
826 			enable_fpu(td);
827 		}
828 		save_fpu(td);
829 
830 		if (indicator == EXC_ALI_LFD) {
831 			if (copyin((void *)frame->dar, fpr,
832 			    sizeof(double)) != 0)
833 				return (-1);
834 			enable_fpu(td);
835 		} else {
836 			if (copyout(fpr, (void *)frame->dar,
837 			    sizeof(double)) != 0)
838 				return (-1);
839 		}
840 		return (0);
841 		break;
842 	}
843 #endif
844 
845 	return (-1);
846 }
847 
848 #ifdef KDB
849 int
850 db_trap_glue(struct trapframe *frame)
851 {
852 
853 	if (!(frame->srr1 & PSL_PR)
854 	    && (frame->exc == EXC_TRC || frame->exc == EXC_RUNMODETRC
855 #ifdef AIM
856 		|| (frame->exc == EXC_PGM
857 		    && (frame->srr1 & EXC_PGM_TRAP))
858 #else
859 		|| (frame->exc == EXC_DEBUG)
860 		|| (frame->cpu.booke.esr & ESR_PTR)
861 #endif
862 		|| frame->exc == EXC_BPT
863 		|| frame->exc == EXC_DSI)) {
864 		int type = frame->exc;
865 
866 		/* Ignore DTrace traps. */
867 		if (*(uint32_t *)frame->srr0 == EXC_DTRACE)
868 			return (0);
869 #ifdef AIM
870 		if (type == EXC_PGM && (frame->srr1 & EXC_PGM_TRAP)) {
871 #else
872 		if (type == EXC_DEBUG ||
873 		    (frame->cpu.booke.esr & ESR_PTR)) {
874 #endif
875 			type = T_BREAKPOINT;
876 		}
877 		return (kdb_trap(type, 0, frame));
878 	}
879 
880 	return (0);
881 }
882 #endif
883