xref: /netbsd-src/sys/arch/arm/arm32/fault.c (revision 001c68bd94f75ce9270b69227c4199fbf34ee396)
1 /*	$NetBSD: fault.c,v 1.31 2003/07/09 20:14:15 thorpej Exp $	*/
2 
3 /*
4  * Copyright 2003 Wasabi Systems, Inc.
5  * All rights reserved.
6  *
7  * Written by Steve C. Woodford for Wasabi Systems, Inc.
8  *
9  * Redistribution and use in source and binary forms, with or without
10  * modification, are permitted provided that the following conditions
11  * are met:
12  * 1. Redistributions of source code must retain the above copyright
13  *    notice, this list of conditions and the following disclaimer.
14  * 2. Redistributions in binary form must reproduce the above copyright
15  *    notice, this list of conditions and the following disclaimer in the
16  *    documentation and/or other materials provided with the distribution.
17  * 3. All advertising materials mentioning features or use of this software
18  *    must display the following acknowledgement:
19  *      This product includes software developed for the NetBSD Project by
20  *      Wasabi Systems, Inc.
21  * 4. The name of Wasabi Systems, Inc. may not be used to endorse
22  *    or promote products derived from this software without specific prior
23  *    written permission.
24  *
25  * THIS SOFTWARE IS PROVIDED BY WASABI SYSTEMS, INC. ``AS IS'' AND
26  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
27  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
28  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL WASABI SYSTEMS, INC
29  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
30  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
31  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
32  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
33  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
34  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
35  * POSSIBILITY OF SUCH DAMAGE.
36  */
37 /*
38  * Copyright (c) 1994-1997 Mark Brinicombe.
39  * Copyright (c) 1994 Brini.
40  * All rights reserved.
41  *
42  * This code is derived from software written for Brini by Mark Brinicombe
43  *
44  * Redistribution and use in source and binary forms, with or without
45  * modification, are permitted provided that the following conditions
46  * are met:
47  * 1. Redistributions of source code must retain the above copyright
48  *    notice, this list of conditions and the following disclaimer.
49  * 2. Redistributions in binary form must reproduce the above copyright
50  *    notice, this list of conditions and the following disclaimer in the
51  *    documentation and/or other materials provided with the distribution.
52  * 3. All advertising materials mentioning features or use of this software
53  *    must display the following acknowledgement:
54  *	This product includes software developed by Brini.
55  * 4. The name of the company nor the name of the author may be used to
56  *    endorse or promote products derived from this software without specific
57  *    prior written permission.
58  *
59  * THIS SOFTWARE IS PROVIDED BY BRINI ``AS IS'' AND ANY EXPRESS OR IMPLIED
60  * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
61  * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
62  * IN NO EVENT SHALL BRINI OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT,
63  * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
64  * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
65  * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
66  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
67  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
68  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
69  * SUCH DAMAGE.
70  *
71  * RiscBSD kernel project
72  *
73  * fault.c
74  *
75  * Fault handlers
76  *
77  * Created      : 28/11/94
78  */
79 
80 #include "opt_ddb.h"
81 #include "opt_kgdb.h"
82 #include "opt_pmap_debug.h"
83 
84 #include <sys/types.h>
85 __KERNEL_RCSID(0, "$NetBSD: fault.c,v 1.31 2003/07/09 20:14:15 thorpej Exp $");
86 
87 #include <sys/param.h>
88 #include <sys/systm.h>
89 #include <sys/proc.h>
90 #include <sys/user.h>
91 #include <sys/kernel.h>
92 
93 #include <uvm/uvm_extern.h>
94 
95 #include <arm/cpuconf.h>
96 
97 #include <machine/frame.h>
98 #include <arm/arm32/katelib.h>
99 #include <machine/cpu.h>
100 #include <machine/intr.h>
101 #if defined(DDB) || defined(KGDB)
102 #include <machine/db_machdep.h>
103 #ifdef KGDB
104 #include <sys/kgdb.h>
105 #endif
106 #if !defined(DDB)
107 #define kdb_trap	kgdb_trap
108 #endif
109 #endif
110 
111 #include <arch/arm/arm/disassem.h>
112 #include <arm/arm32/machdep.h>
113 
114 extern char fusubailout[];
115 
116 #ifdef DEBUG
117 int last_fault_code;	/* For the benefit of pmap_fault_fixup() */
118 #endif
119 
120 static void report_abort __P((const char *, u_int, u_int, u_int));
121 
122 /* Abort code */
123 
124 /* Define text descriptions of the different aborts */
125 
126 static const char *aborts[16] = {
127 	"Write buffer fault",
128 	"Alignment fault",
129 	"Write buffer fault",
130 	"Alignment fault",
131 	"Bus error (LF section)",
132 	"Translation fault (section)",
133 	"Bus error (page)",
134 	"Translation fault (page)",
135 	"Bus error (section)",
136 	"Domain error (section)",
137 	"Bus error (page)",
138 	"Domain error (page)",
139 	"Bus error trans (L1)",
140 	"Permission error (section)",
141 	"Bus error trans (L2)",
142 	"Permission error (page)"
143 };
144 
145 static void
146 report_abort(prefix, fault_status, fault_address, fault_pc)
147 	const char *prefix;
148 	u_int fault_status;
149 	u_int fault_address;
150 	u_int fault_pc;
151 {
152 #ifndef DEBUG
153 	if (prefix == NULL) {
154 #endif
155 		if (prefix)
156 			printf("%s ", prefix);
157 		printf("Data abort: '%s' status=%03x address=%08x PC=%08x\n",
158 		    aborts[fault_status & FAULT_TYPE_MASK],
159 		    fault_status & 0xfff, fault_address, fault_pc);
160 #ifndef DEBUG
161 	}
162 #endif
163 }
164 
165 static __volatile int data_abort_expected;
166 static __volatile int data_abort_received;
167 
168 int
169 badaddr_read(void *addr, size_t size, void *rptr)
170 {
171 	u_long rcpt;
172 	int rv;
173 
174 	/* Tell the Data Abort handler that we're expecting one. */
175 	data_abort_received = 0;
176 	data_abort_expected = 1;
177 
178 	cpu_drain_writebuf();
179 
180 	/* Read from the test address. */
181 	switch (size) {
182 	case sizeof(uint8_t):
183 		__asm __volatile("ldrb %0, [%1]"
184 			: "=r" (rcpt)
185 			: "r" (addr));
186 		break;
187 
188 	case sizeof(uint16_t):
189 		__asm __volatile("ldrh %0, [%1]"
190 			: "=r" (rcpt)
191 			: "r" (addr));
192 		break;
193 
194 	case sizeof(uint32_t):
195 		__asm __volatile("ldr %0, [%1]"
196 			: "=r" (rcpt)
197 			: "r" (addr));
198 		break;
199 
200 	default:
201 		data_abort_expected = 0;
202 		panic("badaddr: invalid size (%lu)", (u_long) size);
203 	}
204 
205 	/* Disallow further Data Aborts. */
206 	data_abort_expected = 0;
207 
208 	rv = data_abort_received;
209 	data_abort_received = 0;
210 
211 	/* Copy the data back if no fault occurred. */
212 	if (rptr != NULL && rv == 0) {
213 		switch (size) {
214 		case sizeof(uint8_t):
215 			*(uint8_t *) rptr = rcpt;
216 			break;
217 
218 		case sizeof(uint16_t):
219 			*(uint16_t *) rptr = rcpt;
220 			break;
221 
222 		case sizeof(uint32_t):
223 			*(uint32_t *) rptr = rcpt;
224 			break;
225 		}
226 	}
227 
228 	/* Return true if the address was invalid. */
229 	return (rv);
230 }
231 
232 /*
233  * void data_abort_handler(trapframe_t *frame)
234  *
235  * Abort handler called when read/write occurs at an address of
236  * a non existent or restricted (access permissions) memory page.
237  * We first need to identify the type of page fault.
238  */
239 
240 #define TRAP_CODE ((fault_status & 0x0f) | (fault_address & 0xfffffff0))
241 
242 /* Determine if we can recover from a fault */
243 #define	IS_FATAL_FAULT(x)					\
244 	(((1 << (x)) &						\
245 	  ((1 << FAULT_WRTBUF_0) | (1 << FAULT_WRTBUF_1) |	\
246 	   (1 << FAULT_BUSERR_0) | (1 << FAULT_BUSERR_1) |	\
247 	   (1 << FAULT_BUSERR_2) | (1 << FAULT_BUSERR_3) |	\
248 	   (1 << FAULT_BUSTRNL1) | (1 << FAULT_BUSTRNL2) |	\
249 	   (1 << FAULT_ALIGN_0)  | (1 << FAULT_ALIGN_1))) != 0)
250 
251 void
252 data_abort_handler(frame)
253 	trapframe_t *frame;
254 {
255 	struct lwp *l;
256 	struct proc *p;
257 	struct pcb *pcb;
258 	u_int fault_address;
259 	u_int fault_status;
260 	u_int fault_pc;
261 	u_int fault_instruction;
262 	int fault_code, fatal_fault;
263 	int user;
264 	int error;
265 	int rv;
266 	void *onfault;
267 	vaddr_t va;
268 	struct vmspace *vm;
269 	struct vm_map *map;
270 	vm_prot_t ftype;
271 	extern struct vm_map *kernel_map;
272 
273 	/*
274 	 * If we were expecting a Data Abort, signal that we got
275 	 * one, adjust the PC to skip the faulting insn, and
276 	 * return.
277 	 */
278 	if (data_abort_expected) {
279 		data_abort_received = 1;
280 		frame->tf_pc += INSN_SIZE;
281 		return;
282 	}
283 
284 	/*
285 	 * Must get fault address and status from the CPU before
286 	 * re-enabling interrupts.  (Interrupt handlers may take
287 	 * R/M emulation faults.)
288 	 */
289 	fault_address = cpu_faultaddress();
290 	fault_status = cpu_faultstatus();
291 	fault_pc = frame->tf_pc;
292 
293 	/*
294 	 * Enable IRQ's (disabled by CPU on abort) if trapframe
295 	 * shows they were enabled.
296 	 */
297 	if (!(frame->tf_spsr & I32_bit))
298 		enable_interrupts(I32_bit);
299 
300 #ifdef DEBUG
301 	if ((GetCPSR() & PSR_MODE) != PSR_SVC32_MODE)
302 		panic("data_abort_handler: not in SVC32 mode");
303 #endif
304 
305 	/* Update vmmeter statistics */
306 	uvmexp.traps++;
307 
308 	/* Extract the fault code from the fault status */
309 	fault_code = fault_status & FAULT_TYPE_MASK;
310 	fatal_fault = IS_FATAL_FAULT(fault_code);
311 
312 	/* Get the current lwp structure or lwp0 if there is none */
313 	l = curlwp == NULL ? &lwp0 : curlwp;
314 	p = l->l_proc;
315 
316 	/*
317 	 * can't use curpcb, as it might be NULL; and we have p in
318 	 * a register anyway
319 	 */
320 	pcb = &l->l_addr->u_pcb;
321 
322 	/* fusubailout is used by [fs]uswintr to avoid page faulting */
323 	if (pcb->pcb_onfault &&
324 	    (fatal_fault || pcb->pcb_onfault == fusubailout)) {
325 
326 		frame->tf_r0 = EFAULT;
327 copyfault:
328 #ifdef DEBUG
329 		printf("Using pcb_onfault=%p addr=%08x st=%08x l=%p\n",
330 		    pcb->pcb_onfault, fault_address, fault_status, l);
331 #endif
332 		frame->tf_pc = (u_int)pcb->pcb_onfault;
333 		if ((frame->tf_spsr & PSR_MODE) == PSR_USR32_MODE)
334 			panic("Yikes pcb_onfault=%p during USR mode fault",
335 			    pcb->pcb_onfault);
336 		return;
337 	}
338 
339 	/* More debug stuff */
340 
341 	fault_instruction = ReadWord(fault_pc);
342 
343 #ifdef PMAP_DEBUG
344 	if (pmap_debug_level >= 0) {
345 		report_abort(NULL, fault_status, fault_address, fault_pc);
346 		printf("Instruction @V%08x = %08x\n",
347 		    fault_pc, fault_instruction);
348 	}
349 #endif
350 
351 	/* Call the cpu specific abort fixup routine */
352 	error = cpu_dataabt_fixup(frame);
353 	if (error == ABORT_FIXUP_RETURN)
354 		return;
355 	if (error == ABORT_FIXUP_FAILED) {
356 		printf("pc = 0x%08x, opcode 0x%08x, insn = ", fault_pc, *((u_int *)fault_pc));
357 		disassemble(fault_pc);
358 		printf("data abort handler: fixup failed for this instruction\n");
359 	}
360 
361 #ifdef PMAP_DEBUG
362 	if (pmap_debug_level >= 0)
363 		printf("fault in process %p\n", p);
364 #endif
365 
366 #ifdef DEBUG
367 	/* Is this needed ? (XXXSCW: yes. can happen during boot ...) */
368 	if (!cold && pcb != curpcb) {
369 		printf("data_abort: Alert ! pcb(%p) != curpcb(%p)\n",
370 		    pcb, curpcb);
371 		printf("data_abort: Alert ! proc(%p), curlwp(%p)\n",
372 		    p, curlwp);
373 	}
374 #endif	/* DEBUG */
375 
376 	/* Were we in user mode when the abort occurred ? */
377 	if ((frame->tf_spsr & PSR_MODE) == PSR_USR32_MODE) {
378 		/*
379 		 * Note that the fault was from USR mode.
380 		 */
381 		user = 1;
382 		l->l_addr->u_pcb.pcb_tf = frame;
383 	} else
384 		user = 0;
385 
386 	/* check if this was a failed fixup */
387 	if (error == ABORT_FIXUP_FAILED) {
388 		if (user) {
389 			trapsignal(l, SIGSEGV, TRAP_CODE);
390 			userret(l);
391 			return;
392 		};
393 		panic("Data abort fixup failed in kernel - we're dead");
394 	};
395 
396 	/* Now act on the fault type */
397 	if (fatal_fault) {
398 		/*
399 		 * None of these faults should happen on a perfectly
400 		 * functioning system. They indicate either some gross
401 		 * problem with the kernel, or a hardware problem.
402 		 * In either case, stop.
403 		 */
404 		report_abort(NULL, fault_status, fault_address, fault_pc);
405 
406 we_re_toast:
407 		/*
408 		 * Were are dead, try and provide some debug
409 		 * information before dying.
410 		 */
411 #if defined(DDB) || defined(KGDB)
412 		printf("Unhandled trap (frame = %p)\n", frame);
413 		report_abort(NULL, fault_status, fault_address, fault_pc);
414 		kdb_trap(T_FAULT, frame);
415 		return;
416 #else
417 		panic("Unhandled trap (frame = %p)", frame);
418 #endif	/* DDB || KGDB */
419 	}
420 
421 	/*
422 	 * At this point, we're dealing with one of the following faults:
423 	 *
424 	 *  FAULT_TRANS_P	Page Translation Fault
425 	 *  FAULT_PERM_P	Page Permission Fault
426 	 *  FAULT_TRANS_S	Section Translation Fault
427 	 *  FAULT_PERM_S	Section Permission Fault
428 	 *  FAULT_DOMAIN_P	Page Domain Error Fault
429 	 *  FAULT_DOMAIN_S	Section Domain Error Fault
430 	 *
431 	 * Page/section translation/permission fault -- need to fault in
432 	 * the page.
433 	 *
434 	 * Page/section domain fault -- need to see if the L1 entry can
435 	 * be fixed up.
436 	 */
437 	vm = p->p_vmspace;
438 	va = trunc_page((vaddr_t)fault_address);
439 
440 #ifdef PMAP_DEBUG
441 	if (pmap_debug_level >= 0)
442 		printf("page fault: addr=V%08lx ", va);
443 #endif
444 
445 	/*
446 	 * It is only a kernel address space fault iff:
447 	 *	1. user == 0  and
448 	 *	2. pcb_onfault not set or
449 	 *	3. pcb_onfault set but supervisor space fault
450 	 * The last can occur during an exec() copyin where the
451 	 * argument space is lazy-allocated.
452 	 */
453 	if (!user &&
454 	    (va >= VM_MIN_KERNEL_ADDRESS || va < VM_MIN_ADDRESS)) {
455 		/* Was the fault due to the FPE/IPKDB ? */
456 		if ((frame->tf_spsr & PSR_MODE) == PSR_UND32_MODE) {
457 			report_abort("UND32", fault_status,
458 			    fault_address, fault_pc);
459 			trapsignal(l, SIGSEGV, TRAP_CODE);
460 
461 			/*
462 			 * Force exit via userret()
463 			 * This is necessary as the FPE is an extension
464 			 * to userland that actually runs in a
465 			 * priveledged mode but uses USR mode
466 			 * permissions for its accesses.
467 			 */
468 			userret(l);
469 			return;
470 		}
471 		map = kernel_map;
472 	} else
473 		map = &vm->vm_map;
474 
475 #ifdef PMAP_DEBUG
476 	if (pmap_debug_level >= 0)
477 		printf("vmmap=%p ", map);
478 #endif
479 
480 	if (map == NULL)
481 		printf("No map for fault address va = 0x%08lx", va);
482 
483 	/*
484 	 * We need to know whether the page should be mapped
485 	 * as R or R/W. The MMU does not give us the info as
486 	 * to whether the fault was caused by a read or a write.
487 	 * This means we need to disassemble the instruction
488 	 * responsible and determine if it was a read or write
489 	 * instruction.
490 	 */
491 	/* STR instruction ? */
492 	if ((fault_instruction & 0x0c100000) == 0x04000000)
493 		ftype = VM_PROT_WRITE;
494 	/* STM or CDT instruction ? */
495 	else if ((fault_instruction & 0x0a100000) == 0x08000000)
496 		ftype = VM_PROT_WRITE;
497 	/* STRH, STRSH or STRSB instruction ? */
498 	else if ((fault_instruction & 0x0e100090) == 0x00000090)
499 		ftype = VM_PROT_WRITE;
500 	/* SWP instruction ? */
501 	else if ((fault_instruction & 0x0fb00ff0) == 0x01000090)
502 		ftype = VM_PROT_READ | VM_PROT_WRITE;
503 	else
504 		ftype = VM_PROT_READ;
505 
506 #ifdef PMAP_DEBUG
507 	if (pmap_debug_level >= 0)
508 		printf("fault protection = %d\n", ftype);
509 #endif
510 
511 	if (pmap_fault_fixup(map->pmap, va, ftype, user))
512 		goto out;
513 
514 	if (current_intr_depth > 0) {
515 #if defined(DDB) || defined(KGDB)
516 		printf("Non-emulated page fault with intr_depth > 0\n");
517 		report_abort(NULL, fault_status, fault_address, fault_pc);
518 		kdb_trap(T_FAULT, frame);
519 		return;
520 #else
521 		panic("Fault with intr_depth > 0");
522 #endif	/* DDB */
523 	}
524 
525 	onfault = pcb->pcb_onfault;
526 	pcb->pcb_onfault = NULL;
527 	rv = uvm_fault(map, va, 0, ftype);
528 	pcb->pcb_onfault = onfault;
529 	if (rv == 0) {
530 		if (user != 0) /* Record any stack growth... */
531 			uvm_grow(p, trunc_page(va));
532 		goto out;
533 	}
534 	if (user == 0) {
535 		if (pcb->pcb_onfault) {
536 			frame->tf_r0 = rv;
537 			goto copyfault;
538 		}
539 		printf("[u]vm_fault(%p, %lx, %x, 0) -> %x\n", map, va, ftype,
540 		    rv);
541 		goto we_re_toast;
542 	}
543 
544 	report_abort("", fault_status, fault_address, fault_pc);
545 	if (rv == ENOMEM) {
546 		printf("UVM: pid %d (%s), uid %d killed: "
547 		    "out of swap\n", p->p_pid, p->p_comm,
548 		    (p->p_cred && p->p_ucred) ?  p->p_ucred->cr_uid : -1);
549 			trapsignal(l, SIGKILL, TRAP_CODE);
550 	} else
551 		trapsignal(l, SIGSEGV, TRAP_CODE);
552 
553 out:
554 	/* Call userret() if it was a USR mode fault */
555 	if (user)
556 		userret(l);
557 }
558 
559 
560 /*
561  * void prefetch_abort_handler(trapframe_t *frame)
562  *
563  * Abort handler called when instruction execution occurs at
564  * a non existent or restricted (access permissions) memory page.
565  * If the address is invalid and we were in SVC mode then panic as
566  * the kernel should never prefetch abort.
567  * If the address is invalid and the page is mapped then the user process
568  * does no have read permission so send it a signal.
569  * Otherwise fault the page in and try again.
570  */
571 
572 void
573 prefetch_abort_handler(frame)
574 	trapframe_t *frame;
575 {
576 	struct lwp *l;
577 	struct proc *p;
578 	struct vm_map *map;
579 	vaddr_t fault_pc, va;
580 	int error;
581 
582 	/*
583 	 * Enable IRQ's (disabled by the abort) This always comes
584 	 * from user mode so we know interrupts were not disabled.
585 	 * But we check anyway.
586 	 */
587 	if (!(frame->tf_spsr & I32_bit))
588 		enable_interrupts(I32_bit);
589 
590 #ifdef DEBUG
591 	if ((GetCPSR() & PSR_MODE) != PSR_SVC32_MODE)
592 		panic("prefetch_abort_handler: not in SVC32 mode");
593 #endif
594 
595 	/* Update vmmeter statistics */
596 	uvmexp.traps++;
597 
598 	/* Call the cpu specific abort fixup routine */
599 	error = cpu_prefetchabt_fixup(frame);
600 	if (error == ABORT_FIXUP_RETURN)
601 		return;
602 	if (error == ABORT_FIXUP_FAILED)
603 		panic("prefetch abort fixup failed");
604 
605 	/* Get the current proc structure or proc0 if there is none */
606 	if ((l = curlwp) == NULL) {
607 		l = &lwp0;
608 #ifdef DEBUG
609 		printf("Prefetch abort with curlwp == 0\n");
610 #endif
611 	}
612 	p = l->l_proc;
613 
614 #ifdef PMAP_DEBUG
615 	if (pmap_debug_level >= 0)
616 		printf("prefetch fault in process %p %s\n", p, p->p_comm);
617 #endif
618 
619 	/* Get fault address */
620 	fault_pc = frame->tf_pc;
621 	va = trunc_page(fault_pc);
622 
623 	/* Was the prefectch abort from USR32 mode ? */
624 	if ((frame->tf_spsr & PSR_MODE) == PSR_USR32_MODE) {
625 		l->l_addr->u_pcb.pcb_tf = frame;
626 	} else {
627 		/*
628 		 * All the kernel code pages are loaded at boot time
629 		 * and do not get paged
630 		 */
631 	        panic("Prefetch abort in non-USR mode (frame=%p PC=0x%08lx)",
632 	            frame, fault_pc);
633 	}
634 
635 	map = &p->p_vmspace->vm_map;
636 
637 #ifdef PMAP_DEBUG
638 	if (pmap_debug_level >= 0)
639 		printf("prefetch_abort: PC = %08lx\n", fault_pc);
640 #endif
641 	/* Ok validate the address, can only execute in USER space */
642 	if (fault_pc < VM_MIN_ADDRESS || fault_pc >= VM_MAXUSER_ADDRESS) {
643 #ifdef DEBUG
644 		printf("prefetch: pc (%08lx) not in user process space\n",
645 		    fault_pc);
646 #endif
647 		trapsignal(l, SIGSEGV, fault_pc);
648 		userret(l);
649 		return;
650 	}
651 
652 	/*
653 	 * See if the pmap can handle this fault on its own...
654 	 */
655 	if (pmap_fault_fixup(map->pmap, va, VM_PROT_READ, 1))
656 		goto out;
657 
658 	if (current_intr_depth > 0) {
659 #ifdef DDB
660 		printf("Non-emulated prefetch abort with intr_depth > 0\n");
661 		kdb_trap(T_FAULT, frame);
662 		return;
663 #else
664 		panic("Prefetch Abort with intr_depth > 0");
665 #endif
666 	}
667 
668 	error = uvm_fault(map, va, 0, VM_PROT_READ);
669 	if (error == 0)
670 		goto out;
671 
672 	if (error == ENOMEM) {
673 		printf("UVM: pid %d (%s), uid %d killed: "
674 		    "out of swap\n", p->p_pid, p->p_comm,
675 		    (p->p_cred && p->p_ucred) ?  p->p_ucred->cr_uid : -1);
676 		trapsignal(l, SIGKILL, fault_pc);
677 	} else
678 		trapsignal(l, SIGSEGV, fault_pc);
679 out:
680 	userret(l);
681 }
682