1 /* $NetBSD: undefined.c,v 1.62 2018/05/28 21:05:00 chs Exp $ */ 2 3 /* 4 * Copyright (c) 2001 Ben Harris. 5 * Copyright (c) 1995 Mark Brinicombe. 6 * Copyright (c) 1995 Brini. 7 * All rights reserved. 8 * 9 * This code is derived from software written for Brini by Mark Brinicombe 10 * 11 * Redistribution and use in source and binary forms, with or without 12 * modification, are permitted provided that the following conditions 13 * are met: 14 * 1. Redistributions of source code must retain the above copyright 15 * notice, this list of conditions and the following disclaimer. 16 * 2. Redistributions in binary form must reproduce the above copyright 17 * notice, this list of conditions and the following disclaimer in the 18 * documentation and/or other materials provided with the distribution. 19 * 3. All advertising materials mentioning features or use of this software 20 * must display the following acknowledgement: 21 * This product includes software developed by Brini. 22 * 4. The name of the company nor the name of the author may be used to 23 * endorse or promote products derived from this software without specific 24 * prior written permission. 25 * 26 * THIS SOFTWARE IS PROVIDED BY BRINI ``AS IS'' AND ANY EXPRESS OR IMPLIED 27 * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF 28 * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 29 * IN NO EVENT SHALL BRINI OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, 30 * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES 31 * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR 32 * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 33 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 34 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 35 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 36 * SUCH DAMAGE. 37 * 38 * RiscBSD kernel project 39 * 40 * undefined.c 41 * 42 * Fault handler 43 * 44 * Created : 06/01/95 45 */ 46 47 #define FAST_FPE 48 49 #include "opt_ddb.h" 50 #include "opt_dtrace.h" 51 #include "opt_kgdb.h" 52 53 #include <sys/param.h> 54 #ifdef KGDB 55 #include <sys/kgdb.h> 56 #endif 57 58 __KERNEL_RCSID(0, "$NetBSD: undefined.c,v 1.62 2018/05/28 21:05:00 chs Exp $"); 59 60 #include <sys/kmem.h> 61 #include <sys/queue.h> 62 #include <sys/signal.h> 63 #include <sys/systm.h> 64 #include <sys/proc.h> 65 #include <sys/syslog.h> 66 #include <sys/vmmeter.h> 67 #include <sys/cpu.h> 68 #ifdef FAST_FPE 69 #include <sys/acct.h> 70 #endif 71 #include <sys/userret.h> 72 73 #include <uvm/uvm_extern.h> 74 75 #include <arm/locore.h> 76 #include <arm/undefined.h> 77 78 #include <machine/pcb.h> 79 #include <machine/trap.h> 80 81 #include <arch/arm/arm/disassem.h> 82 83 #ifdef DDB 84 #include <ddb/db_output.h> 85 #include <machine/db_machdep.h> 86 #endif 87 88 static int gdb_trapper(u_int, u_int, struct trapframe *, int); 89 90 LIST_HEAD(, undefined_handler) undefined_handlers[NUM_UNKNOWN_HANDLERS]; 91 92 93 void * 94 install_coproc_handler(int coproc, undef_handler_t handler) 95 { 96 struct undefined_handler *uh; 97 98 KASSERT(coproc >= 0 && coproc < NUM_UNKNOWN_HANDLERS); 99 KASSERT(handler != NULL); /* Used to be legal. */ 100 101 uh = kmem_alloc(sizeof(*uh), KM_NOSLEEP); 102 KASSERT(uh != NULL); 103 uh->uh_handler = handler; 104 install_coproc_handler_static(coproc, uh); 105 return uh; 106 } 107 108 void 109 install_coproc_handler_static(int coproc, struct undefined_handler *uh) 110 { 111 112 LIST_INSERT_HEAD(&undefined_handlers[coproc], uh, uh_link); 113 } 114 115 void 116 remove_coproc_handler(void *cookie) 117 { 118 struct undefined_handler *uh = cookie; 119 120 LIST_REMOVE(uh, uh_link); 121 kmem_free(uh, sizeof(*uh)); 122 } 123 124 static int 125 cp15_trapper(u_int addr, u_int insn, struct trapframe *tf, int code) 126 { 127 struct lwp * const l = curlwp; 128 129 #if defined(THUMB_CODE) && !defined(CPU_ARMV7) 130 if (tf->tf_spsr & PSR_T_bit) 131 return 1; 132 #endif 133 if (code != FAULT_USER) 134 return 1; 135 136 /* 137 * Don't overwrite sp, pc, etc. 138 */ 139 const u_int regno = (insn >> 12) & 15; 140 if (regno > 12) 141 return 1; 142 143 /* 144 * Get a pointer to the register used in the instruction to be emulated. 145 */ 146 register_t * const regp = &tf->tf_r0 + regno; 147 148 /* 149 * Handle MRC p15, 0, <Rd>, c13, c0, 3 (Read User read-only thread id) 150 */ 151 if ((insn & 0xffff0fff) == 0xee1d0f70) { 152 *regp = (uintptr_t)l->l_private; 153 tf->tf_pc += INSN_SIZE; 154 curcpu()->ci_und_cp15_ev.ev_count++; 155 return 0; 156 } 157 158 /* 159 * Handle {MRC,MCR} p15, 0, <Rd>, c13, c0, 2 (User read/write thread id) 160 */ 161 if ((insn & 0xffef0fff) == 0xee0d0f50) { 162 struct pcb * const pcb = lwp_getpcb(l); 163 if (insn & 0x00100000) 164 *regp = pcb->pcb_user_pid_rw; 165 else 166 pcb->pcb_user_pid_rw = *regp; 167 tf->tf_pc += INSN_SIZE; 168 curcpu()->ci_und_cp15_ev.ev_count++; 169 return 0; 170 } 171 172 return 1; 173 } 174 175 static int 176 gdb_trapper(u_int addr, u_int insn, struct trapframe *tf, int code) 177 { 178 struct lwp * const l = curlwp; 179 180 #ifdef THUMB_CODE 181 if (tf->tf_spsr & PSR_T_bit) { 182 if (insn == GDB_THUMB_BREAKPOINT) 183 goto bkpt; 184 } 185 else 186 #endif 187 { 188 if (insn == GDB_BREAKPOINT || insn == GDB5_BREAKPOINT) { 189 #ifdef THUMB_CODE 190 bkpt: 191 #endif 192 if (code == FAULT_USER) { 193 ksiginfo_t ksi; 194 195 KSI_INIT_TRAP(&ksi); 196 ksi.ksi_signo = SIGTRAP; 197 ksi.ksi_code = TRAP_BRKPT; 198 ksi.ksi_addr = (uint32_t *)addr; 199 ksi.ksi_trap = 0; 200 trapsignal(l, &ksi); 201 return 0; 202 } 203 #ifdef KGDB 204 return !kgdb_trap(T_BREAKPOINT, tf); 205 #endif 206 } 207 } 208 return 1; 209 } 210 211 static struct undefined_handler cp15_uh; 212 static struct undefined_handler gdb_uh; 213 #ifdef THUMB_CODE 214 static struct undefined_handler gdb_uh_thumb; 215 #endif 216 217 #ifdef KDTRACE_HOOKS 218 #include <sys/dtrace_bsd.h> 219 220 /* Not used for now, but needed for dtrace/fbt modules */ 221 dtrace_doubletrap_func_t dtrace_doubletrap_func = NULL; 222 dtrace_trap_func_t dtrace_trap_func = NULL; 223 224 int (* dtrace_invop_jump_addr)(struct trapframe *); 225 226 static int 227 dtrace_trapper(u_int addr, struct trapframe *frame) 228 { 229 u_int insn = read_insn(addr, false); 230 231 if (dtrace_invop_jump_addr == NULL) 232 return 1; 233 234 if (!DTRACE_IS_BREAKPOINT(insn)) 235 return 1; 236 237 /* cond value is encoded in the low nibble */ 238 if (!arm_cond_ok_p(__SHIFTIN(insn, INSN_COND_MASK), frame->tf_spsr)) { 239 frame->tf_pc += INSN_SIZE; 240 return 0; 241 } 242 243 dtrace_invop_jump_addr(frame); 244 return 0; 245 } 246 #endif 247 248 void 249 undefined_init(void) 250 { 251 int loop; 252 253 /* Not actually necessary -- the initialiser is just NULL */ 254 for (loop = 0; loop < NUM_UNKNOWN_HANDLERS; ++loop) 255 LIST_INIT(&undefined_handlers[loop]); 256 257 /* Install handler for CP15 emulation */ 258 cp15_uh.uh_handler = cp15_trapper; 259 install_coproc_handler_static(SYSTEM_COPROC, &cp15_uh); 260 261 /* Install handler for GDB breakpoints */ 262 gdb_uh.uh_handler = gdb_trapper; 263 install_coproc_handler_static(CORE_UNKNOWN_HANDLER, &gdb_uh); 264 #ifdef THUMB_CODE 265 gdb_uh_thumb.uh_handler = gdb_trapper; 266 install_coproc_handler_static(THUMB_UNKNOWN_HANDLER, &gdb_uh_thumb); 267 #endif 268 } 269 270 void 271 undefinedinstruction(trapframe_t *tf) 272 { 273 struct lwp *l; 274 vaddr_t fault_pc; 275 int fault_instruction; 276 int fault_code; 277 int coprocessor; 278 int user; 279 struct undefined_handler *uh; 280 #ifdef VERBOSE_ARM32 281 int s; 282 #endif 283 284 curcpu()->ci_und_ev.ev_count++; 285 286 #ifdef KDTRACE_HOOKS 287 if ((tf->tf_spsr & PSR_MODE) != PSR_USR32_MODE) { 288 tf->tf_pc -= INSN_SIZE; 289 if (dtrace_trapper(tf->tf_pc, tf) == 0) 290 return; 291 tf->tf_pc += INSN_SIZE; /* Reset for the rest code */ 292 } 293 #endif 294 295 /* Enable interrupts if they were enabled before the exception. */ 296 restore_interrupts(tf->tf_spsr & IF32_bits); 297 298 #ifdef THUMB_CODE 299 if (tf->tf_spsr & PSR_T_bit) 300 tf->tf_pc -= THUMB_INSN_SIZE; 301 else 302 #endif 303 { 304 tf->tf_pc -= INSN_SIZE; 305 } 306 307 fault_pc = tf->tf_pc; 308 309 /* Get the current lwp/proc structure or lwp0/proc0 if there is none. */ 310 l = curlwp; 311 312 if ((tf->tf_spsr & PSR_MODE) == PSR_USR32_MODE) { 313 user = 1; 314 LWP_CACHE_CREDS(l, l->l_proc); 315 } else 316 user = 0; 317 318 319 #ifdef THUMB_CODE 320 if (tf->tf_spsr & PSR_T_bit) { 321 fault_instruction = read_thumb_insn(fault_pc, user); 322 if (fault_instruction >= 0xe000) { 323 fault_instruction = (fault_instruction << 16) 324 | read_thumb_insn(fault_pc + 2, user); 325 } 326 } 327 else 328 #endif 329 { 330 /* 331 * Make sure the program counter is correctly aligned so we 332 * don't take an alignment fault trying to read the opcode. 333 */ 334 if (__predict_false((fault_pc & 3) != 0)) { 335 ksiginfo_t ksi; 336 /* Give the user an illegal instruction signal. */ 337 KSI_INIT_TRAP(&ksi); 338 ksi.ksi_signo = SIGILL; 339 ksi.ksi_code = ILL_ILLOPC; 340 ksi.ksi_addr = (uint32_t *)(intptr_t) fault_pc; 341 trapsignal(l, &ksi); 342 userret(l); 343 return; 344 } 345 /* 346 * Should use fuword() here .. but in the interests of 347 * squeezing every bit of speed we will just use 348 * ReadWord(). We know the instruction can be read 349 * as was just executed so this will never fail unless 350 * the kernel is screwed up in which case it does 351 * not really matter does it ? 352 */ 353 fault_instruction = read_insn(fault_pc, user); 354 } 355 356 /* Update vmmeter statistics */ 357 curcpu()->ci_data.cpu_ntrap++; 358 359 #ifdef THUMB_CODE 360 if ((tf->tf_spsr & PSR_T_bit) && !CPU_IS_ARMV7_P()) { 361 coprocessor = THUMB_UNKNOWN_HANDLER; 362 } 363 else 364 #endif 365 { 366 /* Check for coprocessor instruction */ 367 368 /* 369 * According to the datasheets you only need to look at 370 * bit 27 of the instruction to tell the difference 371 * between and undefined instruction and a coprocessor 372 * instruction following an undefined instruction trap. 373 * 374 * ARMv5 adds undefined instructions in the NV space, 375 * even when bit 27 is set. 376 */ 377 378 if ((fault_instruction & (1 << 27)) != 0 379 && (fault_instruction & 0xf0000000) != 0xf0000000) { 380 coprocessor = (fault_instruction >> 8) & 0x0f; 381 #ifdef THUMB_CODE 382 } else if ((tf->tf_spsr & PSR_T_bit) && !CPU_IS_ARMV7_P()) { 383 coprocessor = THUMB_UNKNOWN_HANDLER; 384 #endif 385 } else { 386 coprocessor = CORE_UNKNOWN_HANDLER; 387 } 388 } 389 390 if (user) { 391 /* 392 * Modify the fault_code to reflect the USR/SVC state at 393 * time of fault. 394 */ 395 fault_code = FAULT_USER; 396 KASSERTMSG(tf == lwp_trapframe(l), "tf %p vs %p", tf, 397 lwp_trapframe(l)); 398 } else 399 fault_code = 0; 400 401 /* OK this is were we do something about the instruction. */ 402 LIST_FOREACH(uh, &undefined_handlers[coprocessor], uh_link) 403 if (uh->uh_handler(fault_pc, fault_instruction, tf, 404 fault_code) == 0) 405 break; 406 407 if (uh == NULL) { 408 /* Fault has not been handled */ 409 ksiginfo_t ksi; 410 411 #ifdef VERBOSE_ARM32 412 s = spltty(); 413 414 if ((fault_instruction & 0x0f000010) == 0x0e000000) { 415 printf("CDP\n"); 416 disassemble(fault_pc); 417 } else if ((fault_instruction & 0x0e000000) == 0x0c000000) { 418 printf("LDC/STC\n"); 419 disassemble(fault_pc); 420 } else if ((fault_instruction & 0x0f000010) == 0x0e000010) { 421 printf("MRC/MCR\n"); 422 disassemble(fault_pc); 423 } else if ((fault_instruction & ~INSN_COND_MASK) 424 != (KERNEL_BREAKPOINT & ~INSN_COND_MASK)) { 425 printf("Undefined instruction\n"); 426 disassemble(fault_pc); 427 } 428 429 splx(s); 430 #endif 431 432 if ((fault_code & FAULT_USER) == 0) { 433 #ifdef DDB 434 db_printf("Undefined instruction %#x in kernel at %#lx (LR %#x SP %#x)\n", 435 fault_instruction, fault_pc, tf->tf_svc_lr, tf->tf_svc_sp); 436 kdb_trap(T_FAULT, tf); 437 #else 438 panic("undefined instruction %#x in kernel at %#lx", fault_instruction, fault_pc); 439 #endif 440 } 441 KSI_INIT_TRAP(&ksi); 442 ksi.ksi_signo = SIGILL; 443 ksi.ksi_code = ILL_ILLOPC; 444 ksi.ksi_addr = (uint32_t *)fault_pc; 445 ksi.ksi_trap = fault_instruction; 446 trapsignal(l, &ksi); 447 } 448 449 if ((fault_code & FAULT_USER) == 0) 450 return; 451 452 userret(l); 453 } 454