Now available: The Design and Implementation of the FreeBSD Operating System (Second Edition)
[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]
FreeBSD/Linux Kernel Cross Reference
sys/amd64/amd64/trap.c
Version:
- FREEBSD - FREEBSD-13-STABLE - FREEBSD-13-0 - FREEBSD-12-STABLE - FREEBSD-12-0 - FREEBSD-11-STABLE - FREEBSD-11-0 - FREEBSD-10-STABLE - FREEBSD-10-0 - FREEBSD-9-STABLE - FREEBSD-9-0 - FREEBSD-8-STABLE - FREEBSD-8-0 - FREEBSD-7-STABLE - FREEBSD-7-0 - FREEBSD-6-STABLE - FREEBSD-6-0 - FREEBSD-5-STABLE - FREEBSD-5-0 - FREEBSD-4-STABLE - FREEBSD-3-STABLE - FREEBSD22 - l41 - OPENBSD - linux-2.6 - MK84 - PLAN9 - xnu-8792
SearchContext: - none - 3 - 10
SearchContext: - none - 3 - 10
1 /*- 2 * Copyright (C) 1994, David Greenman 3 * Copyright (c) 1990, 1993 4 * The Regents of the University of California. All rights reserved. 5 * 6 * This code is derived from software contributed to Berkeley by 7 * the University of Utah, and William Jolitz. 8 * 9 * Redistribution and use in source and binary forms, with or without 10 * modification, are permitted provided that the following conditions 11 * are met: 12 * 1. Redistributions of source code must retain the above copyright 13 * notice, this list of conditions and the following disclaimer. 14 * 2. Redistributions in binary form must reproduce the above copyright 15 * notice, this list of conditions and the following disclaimer in the 16 * documentation and/or other materials provided with the distribution. 17 * 3. All advertising materials mentioning features or use of this software 18 * must display the following acknowledgement: 19 * This product includes software developed by the University of 20 * California, Berkeley and its contributors. 21 * 4. Neither the name of the University nor the names of its contributors 22 * may be used to endorse or promote products derived from this software 23 * without specific prior written permission. 24 * 25 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 26 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 27 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 28 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 29 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 30 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 31 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 32 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 33 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 34 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 35 * SUCH DAMAGE. 36 * 37 * from: @(#)trap.c 7.4 (Berkeley) 5/13/91 38 */ 39 40 #include <sys/cdefs.h> 41 __FBSDID("$FreeBSD: releng/8.0/sys/amd64/amd64/trap.c 196601 2009-08-27 17:34:13Z bz $"); 42 43 /* 44 * AMD64 Trap and System call handling 45 */ 46 47 #include "opt_clock.h" 48 #include "opt_cpu.h" 49 #include "opt_hwpmc_hooks.h" 50 #include "opt_isa.h" 51 #include "opt_kdb.h" 52 #include "opt_kdtrace.h" 53 #include "opt_ktrace.h" 54 55 #include <sys/param.h> 56 #include <sys/bus.h> 57 #include <sys/systm.h> 58 #include <sys/proc.h> 59 #include <sys/pioctl.h> 60 #include <sys/ptrace.h> 61 #include <sys/kdb.h> 62 #include <sys/kernel.h> 63 #include <sys/ktr.h> 64 #include <sys/lock.h> 65 #include <sys/mutex.h> 66 #include <sys/resourcevar.h> 67 #include <sys/signalvar.h> 68 #include <sys/syscall.h> 69 #include <sys/sysctl.h> 70 #include <sys/sysent.h> 71 #include <sys/uio.h> 72 #include <sys/vmmeter.h> 73 #ifdef KTRACE 74 #include <sys/ktrace.h> 75 #endif 76 #ifdef HWPMC_HOOKS 77 #include <sys/pmckern.h> 78 #endif 79 #include <security/audit/audit.h> 80 81 #include <vm/vm.h> 82 #include <vm/vm_param.h> 83 #include <vm/pmap.h> 84 #include <vm/vm_kern.h> 85 #include <vm/vm_map.h> 86 #include <vm/vm_page.h> 87 #include <vm/vm_extern.h> 88 89 #include <machine/cpu.h> 90 #include <machine/intr_machdep.h> 91 #include <machine/mca.h> 92 #include <machine/md_var.h> 93 #include <machine/pcb.h> 94 #ifdef SMP 95 #include <machine/smp.h> 96 #endif 97 #include <machine/tss.h> 98 99 #ifdef KDTRACE_HOOKS 100 #include <sys/dtrace_bsd.h> 101 102 /* 103 * This is a hook which is initialised by the dtrace module 104 * to handle traps which might occur during DTrace probe 105 * execution. 106 */ 107 dtrace_trap_func_t dtrace_trap_func; 108 109 dtrace_doubletrap_func_t dtrace_doubletrap_func; 110 111 /* 112 * This is a hook which is initialised by the systrace module 113 * when it is loaded. This keeps the DTrace syscall provider 114 * implementation opaque. 115 */ 116 systrace_probe_func_t systrace_probe_func; 117 #endif 118 119 extern void trap(struct trapframe *frame); 120 extern void syscall(struct trapframe *frame); 121 void dblfault_handler(struct trapframe *frame); 122 123 static int trap_pfault(struct trapframe *, int); 124 static void trap_fatal(struct trapframe *, vm_offset_t); 125 126 #define MAX_TRAP_MSG 30 127 static char *trap_msg[] = { 128 "", /* 0 unused */ 129 "privileged instruction fault", /* 1 T_PRIVINFLT */ 130 "", /* 2 unused */ 131 "breakpoint instruction fault", /* 3 T_BPTFLT */ 132 "", /* 4 unused */ 133 "", /* 5 unused */ 134 "arithmetic trap", /* 6 T_ARITHTRAP */ 135 "", /* 7 unused */ 136 "", /* 8 unused */ 137 "general protection fault", /* 9 T_PROTFLT */ 138 "trace trap", /* 10 T_TRCTRAP */ 139 "", /* 11 unused */ 140 "page fault", /* 12 T_PAGEFLT */ 141 "", /* 13 unused */ 142 "alignment fault", /* 14 T_ALIGNFLT */ 143 "", /* 15 unused */ 144 "", /* 16 unused */ 145 "", /* 17 unused */ 146 "integer divide fault", /* 18 T_DIVIDE */ 147 "non-maskable interrupt trap", /* 19 T_NMI */ 148 "overflow trap", /* 20 T_OFLOW */ 149 "FPU bounds check fault", /* 21 T_BOUND */ 150 "FPU device not available", /* 22 T_DNA */ 151 "double fault", /* 23 T_DOUBLEFLT */ 152 "FPU operand fetch fault", /* 24 T_FPOPFLT */ 153 "invalid TSS fault", /* 25 T_TSSFLT */ 154 "segment not present fault", /* 26 T_SEGNPFLT */ 155 "stack fault", /* 27 T_STKFLT */ 156 "machine check trap", /* 28 T_MCHK */ 157 "SIMD floating-point exception", /* 29 T_XMMFLT */ 158 "reserved (unknown) fault", /* 30 T_RESERVED */ 159 }; 160 161 #ifdef KDB 162 static int kdb_on_nmi = 1; 163 SYSCTL_INT(_machdep, OID_AUTO, kdb_on_nmi, CTLFLAG_RW, 164 &kdb_on_nmi, 0, "Go to KDB on NMI"); 165 #endif 166 static int panic_on_nmi = 1; 167 SYSCTL_INT(_machdep, OID_AUTO, panic_on_nmi, CTLFLAG_RW, 168 &panic_on_nmi, 0, "Panic on NMI"); 169 static int prot_fault_translation = 0; 170 SYSCTL_INT(_machdep, OID_AUTO, prot_fault_translation, CTLFLAG_RW, 171 &prot_fault_translation, 0, "Select signal to deliver on protection fault"); 172 173 extern char *syscallnames[]; 174 175 /* #define DEBUG 1 */ 176 #ifdef DEBUG 177 static void 178 report_seg_fault(const char *segn, struct trapframe *frame) 179 { 180 struct proc_ldt *pldt; 181 struct trapframe *pf; 182 183 pldt = curproc->p_md.md_ldt; 184 printf("%d: %s load fault %lx %p %d\n", 185 curproc->p_pid, segn, frame->tf_err, 186 pldt != NULL ? pldt->ldt_base : NULL, 187 pldt != NULL ? pldt->ldt_refcnt : 0); 188 kdb_backtrace(); 189 pf = (struct trapframe *)frame->tf_rsp; 190 printf("rdi %lx\n", pf->tf_rdi); 191 printf("rsi %lx\n", pf->tf_rsi); 192 printf("rdx %lx\n", pf->tf_rdx); 193 printf("rcx %lx\n", pf->tf_rcx); 194 printf("r8 %lx\n", pf->tf_r8); 195 printf("r9 %lx\n", pf->tf_r9); 196 printf("rax %lx\n", pf->tf_rax); 197 printf("rbx %lx\n", pf->tf_rbx); 198 printf("rbp %lx\n", pf->tf_rbp); 199 printf("r10 %lx\n", pf->tf_r10); 200 printf("r11 %lx\n", pf->tf_r11); 201 printf("r12 %lx\n", pf->tf_r12); 202 printf("r13 %lx\n", pf->tf_r13); 203 printf("r14 %lx\n", pf->tf_r14); 204 printf("r15 %lx\n", pf->tf_r15); 205 printf("fs %x\n", pf->tf_fs); 206 printf("gs %x\n", pf->tf_gs); 207 printf("es %x\n", pf->tf_es); 208 printf("ds %x\n", pf->tf_ds); 209 printf("tno %x\n", pf->tf_trapno); 210 printf("adr %lx\n", pf->tf_addr); 211 printf("flg %x\n", pf->tf_flags); 212 printf("err %lx\n", pf->tf_err); 213 printf("rip %lx\n", pf->tf_rip); 214 printf("cs %lx\n", pf->tf_cs); 215 printf("rfl %lx\n", pf->tf_rflags); 216 printf("rsp %lx\n", pf->tf_rsp); 217 printf("ss %lx\n", pf->tf_ss); 218 } 219 #endif 220 221 /* 222 * Exception, fault, and trap interface to the FreeBSD kernel. 223 * This common code is called from assembly language IDT gate entry 224 * routines that prepare a suitable stack frame, and restore this 225 * frame after the exception has been processed. 226 */ 227 228 void 229 trap(struct trapframe *frame) 230 { 231 struct thread *td = curthread; 232 struct proc *p = td->td_proc; 233 int i = 0, ucode = 0, code; 234 u_int type; 235 register_t addr = 0; 236 ksiginfo_t ksi; 237 238 PCPU_INC(cnt.v_trap); 239 type = frame->tf_trapno; 240 241 #ifdef SMP 242 /* Handler for NMI IPIs used for stopping CPUs. */ 243 if (type == T_NMI) { 244 if (ipi_nmi_handler() == 0) 245 goto out; 246 } 247 #endif /* SMP */ 248 249 #ifdef KDB 250 if (kdb_active) { 251 kdb_reenter(); 252 goto out; 253 } 254 #endif 255 256 #ifdef HWPMC_HOOKS 257 /* 258 * CPU PMCs interrupt using an NMI. If the PMC module is 259 * active, pass the 'rip' value to the PMC module's interrupt 260 * handler. A return value of '1' from the handler means that 261 * the NMI was handled by it and we can return immediately. 262 */ 263 if (type == T_NMI && pmc_intr && 264 (*pmc_intr)(PCPU_GET(cpuid), frame)) 265 goto out; 266 #endif 267 268 if (type == T_MCHK) { 269 if (!mca_intr()) 270 trap_fatal(frame, 0); 271 goto out; 272 } 273 274 #ifdef KDTRACE_HOOKS 275 /* 276 * A trap can occur while DTrace executes a probe. Before 277 * executing the probe, DTrace blocks re-scheduling and sets 278 * a flag in it's per-cpu flags to indicate that it doesn't 279 * want to fault. On returning from the the probe, the no-fault 280 * flag is cleared and finally re-scheduling is enabled. 281 * 282 * If the DTrace kernel module has registered a trap handler, 283 * call it and if it returns non-zero, assume that it has 284 * handled the trap and modified the trap frame so that this 285 * function can return normally. 286 */ 287 if (dtrace_trap_func != NULL) 288 if ((*dtrace_trap_func)(frame, type)) 289 goto out; 290 #endif 291 292 if ((frame->tf_rflags & PSL_I) == 0) { 293 /* 294 * Buggy application or kernel code has disabled 295 * interrupts and then trapped. Enabling interrupts 296 * now is wrong, but it is better than running with 297 * interrupts disabled until they are accidentally 298 * enabled later. 299 */ 300 if (ISPL(frame->tf_cs) == SEL_UPL) 301 printf( 302 "pid %ld (%s): trap %d with interrupts disabled\n", 303 (long)curproc->p_pid, curthread->td_name, type); 304 else if (type != T_NMI && type != T_BPTFLT && 305 type != T_TRCTRAP) { 306 /* 307 * XXX not quite right, since this may be for a 308 * multiple fault in user mode. 309 */ 310 printf("kernel trap %d with interrupts disabled\n", 311 type); 312 #ifdef DEBUG 313 report_seg_fault("hlt", frame); 314 #endif 315 /* 316 * We shouldn't enable interrupts while holding a 317 * spin lock or servicing an NMI. 318 */ 319 if (type != T_NMI && td->td_md.md_spinlock_count == 0) 320 enable_intr(); 321 } 322 } 323 324 code = frame->tf_err; 325 if (type == T_PAGEFLT) { 326 /* 327 * If we get a page fault while in a critical section, then 328 * it is most likely a fatal kernel page fault. The kernel 329 * is already going to panic trying to get a sleep lock to 330 * do the VM lookup, so just consider it a fatal trap so the 331 * kernel can print out a useful trap message and even get 332 * to the debugger. 333 * 334 * If we get a page fault while holding a non-sleepable 335 * lock, then it is most likely a fatal kernel page fault. 336 * If WITNESS is enabled, then it's going to whine about 337 * bogus LORs with various VM locks, so just skip to the 338 * fatal trap handling directly. 339 */ 340 if (td->td_critnest != 0 || 341 WITNESS_CHECK(WARN_SLEEPOK | WARN_GIANTOK, NULL, 342 "Kernel page fault") != 0) 343 trap_fatal(frame, frame->tf_addr); 344 } 345 346 if (ISPL(frame->tf_cs) == SEL_UPL) { 347 /* user trap */ 348 349 td->td_pticks = 0; 350 td->td_frame = frame; 351 addr = frame->tf_rip; 352 if (td->td_ucred != p->p_ucred) 353 cred_update_thread(td); 354 355 switch (type) { 356 case T_PRIVINFLT: /* privileged instruction fault */ 357 i = SIGILL; 358 ucode = ILL_PRVOPC; 359 break; 360 361 case T_BPTFLT: /* bpt instruction fault */ 362 case T_TRCTRAP: /* trace trap */ 363 enable_intr(); 364 frame->tf_rflags &= ~PSL_T; 365 i = SIGTRAP; 366 ucode = (type == T_TRCTRAP ? TRAP_TRACE : TRAP_BRKPT); 367 break; 368 369 case T_ARITHTRAP: /* arithmetic trap */ 370 ucode = fputrap(); 371 if (ucode == -1) 372 goto userout; 373 i = SIGFPE; 374 break; 375 376 case T_PROTFLT: /* general protection fault */ 377 i = SIGBUS; 378 ucode = BUS_OBJERR; 379 break; 380 case T_STKFLT: /* stack fault */ 381 case T_SEGNPFLT: /* segment not present fault */ 382 i = SIGBUS; 383 ucode = BUS_ADRERR; 384 break; 385 case T_TSSFLT: /* invalid TSS fault */ 386 i = SIGBUS; 387 ucode = BUS_OBJERR; 388 break; 389 case T_DOUBLEFLT: /* double fault */ 390 default: 391 i = SIGBUS; 392 ucode = BUS_OBJERR; 393 break; 394 395 case T_PAGEFLT: /* page fault */ 396 addr = frame->tf_addr; 397 i = trap_pfault(frame, TRUE); 398 if (i == -1) 399 goto userout; 400 if (i == 0) 401 goto user; 402 403 if (i == SIGSEGV) 404 ucode = SEGV_MAPERR; 405 else { 406 if (prot_fault_translation == 0) { 407 /* 408 * Autodetect. 409 * This check also covers the images 410 * without the ABI-tag ELF note. 411 */ 412 if (SV_CURPROC_ABI() == 413 SV_ABI_FREEBSD && 414 p->p_osrel >= 700004) { 415 i = SIGSEGV; 416 ucode = SEGV_ACCERR; 417 } else { 418 i = SIGBUS; 419 ucode = BUS_PAGE_FAULT; 420 } 421 } else if (prot_fault_translation == 1) { 422 /* 423 * Always compat mode. 424 */ 425 i = SIGBUS; 426 ucode = BUS_PAGE_FAULT; 427 } else { 428 /* 429 * Always SIGSEGV mode. 430 */ 431 i = SIGSEGV; 432 ucode = SEGV_ACCERR; 433 } 434 } 435 break; 436 437 case T_DIVIDE: /* integer divide fault */ 438 ucode = FPE_INTDIV; 439 i = SIGFPE; 440 break; 441 442 #ifdef DEV_ISA 443 case T_NMI: 444 /* machine/parity/power fail/"kitchen sink" faults */ 445 if (isa_nmi(code) == 0) { 446 #ifdef KDB 447 /* 448 * NMI can be hooked up to a pushbutton 449 * for debugging. 450 */ 451 if (kdb_on_nmi) { 452 printf ("NMI ... going to debugger\n"); 453 kdb_trap(type, 0, frame); 454 } 455 #endif /* KDB */ 456 goto userout; 457 } else if (panic_on_nmi) 458 panic("NMI indicates hardware failure"); 459 break; 460 #endif /* DEV_ISA */ 461 462 case T_OFLOW: /* integer overflow fault */ 463 ucode = FPE_INTOVF; 464 i = SIGFPE; 465 break; 466 467 case T_BOUND: /* bounds check fault */ 468 ucode = FPE_FLTSUB; 469 i = SIGFPE; 470 break; 471 472 case T_DNA: 473 /* transparent fault (due to context switch "late") */ 474 fpudna(); 475 goto userout; 476 477 case T_FPOPFLT: /* FPU operand fetch fault */ 478 ucode = ILL_COPROC; 479 i = SIGILL; 480 break; 481 482 case T_XMMFLT: /* SIMD floating-point exception */ 483 ucode = 0; /* XXX */ 484 i = SIGFPE; 485 break; 486 } 487 } else { 488 /* kernel trap */ 489 490 KASSERT(cold || td->td_ucred != NULL, 491 ("kernel trap doesn't have ucred")); 492 switch (type) { 493 case T_PAGEFLT: /* page fault */ 494 (void) trap_pfault(frame, FALSE); 495 goto out; 496 497 case T_DNA: 498 /* 499 * The kernel is apparently using fpu for copying. 500 * XXX this should be fatal unless the kernel has 501 * registered such use. 502 */ 503 fpudna(); 504 printf("fpudna in kernel mode!\n"); 505 goto out; 506 507 case T_STKFLT: /* stack fault */ 508 break; 509 510 case T_PROTFLT: /* general protection fault */ 511 case T_SEGNPFLT: /* segment not present fault */ 512 if (td->td_intr_nesting_level != 0) 513 break; 514 515 /* 516 * Invalid segment selectors and out of bounds 517 * %rip's and %rsp's can be set up in user mode. 518 * This causes a fault in kernel mode when the 519 * kernel tries to return to user mode. We want 520 * to get this fault so that we can fix the 521 * problem here and not have to check all the 522 * selectors and pointers when the user changes 523 * them. 524 */ 525 if (frame->tf_rip == (long)doreti_iret) { 526 frame->tf_rip = (long)doreti_iret_fault; 527 goto out; 528 } 529 if (frame->tf_rip == (long)ld_ds) { 530 #ifdef DEBUG 531 report_seg_fault("ds", frame); 532 #endif 533 frame->tf_rip = (long)ds_load_fault; 534 frame->tf_ds = _udatasel; 535 goto out; 536 } 537 if (frame->tf_rip == (long)ld_es) { 538 #ifdef DEBUG 539 report_seg_fault("es", frame); 540 #endif 541 frame->tf_rip = (long)es_load_fault; 542 frame->tf_es = _udatasel; 543 goto out; 544 } 545 if (frame->tf_rip == (long)ld_fs) { 546 #ifdef DEBUG 547 report_seg_fault("fs", frame); 548 #endif 549 frame->tf_rip = (long)fs_load_fault; 550 frame->tf_fs = _ufssel; 551 goto out; 552 } 553 if (frame->tf_rip == (long)ld_gs) { 554 #ifdef DEBUG 555 report_seg_fault("gs", frame); 556 #endif 557 frame->tf_rip = (long)gs_load_fault; 558 frame->tf_gs = _ugssel; 559 goto out; 560 } 561 if (PCPU_GET(curpcb)->pcb_onfault != NULL) { 562 frame->tf_rip = 563 (long)PCPU_GET(curpcb)->pcb_onfault; 564 goto out; 565 } 566 break; 567 568 case T_TSSFLT: 569 /* 570 * PSL_NT can be set in user mode and isn't cleared 571 * automatically when the kernel is entered. This 572 * causes a TSS fault when the kernel attempts to 573 * `iret' because the TSS link is uninitialized. We 574 * want to get this fault so that we can fix the 575 * problem here and not every time the kernel is 576 * entered. 577 */ 578 if (frame->tf_rflags & PSL_NT) { 579 frame->tf_rflags &= ~PSL_NT; 580 goto out; 581 } 582 break; 583 584 case T_TRCTRAP: /* trace trap */ 585 /* 586 * Ignore debug register trace traps due to 587 * accesses in the user's address space, which 588 * can happen under several conditions such as 589 * if a user sets a watchpoint on a buffer and 590 * then passes that buffer to a system call. 591 * We still want to get TRCTRAPS for addresses 592 * in kernel space because that is useful when 593 * debugging the kernel. 594 */ 595 if (user_dbreg_trap()) { 596 /* 597 * Reset breakpoint bits because the 598 * processor doesn't 599 */ 600 /* XXX check upper bits here */ 601 load_dr6(rdr6() & 0xfffffff0); 602 goto out; 603 } 604 /* 605 * FALLTHROUGH (TRCTRAP kernel mode, kernel address) 606 */ 607 case T_BPTFLT: 608 /* 609 * If KDB is enabled, let it handle the debugger trap. 610 * Otherwise, debugger traps "can't happen". 611 */ 612 #ifdef KDB 613 if (kdb_trap(type, 0, frame)) 614 goto out; 615 #endif 616 break; 617 618 #ifdef DEV_ISA 619 case T_NMI: 620 /* machine/parity/power fail/"kitchen sink" faults */ 621 if (isa_nmi(code) == 0) { 622 #ifdef KDB 623 /* 624 * NMI can be hooked up to a pushbutton 625 * for debugging. 626 */ 627 if (kdb_on_nmi) { 628 printf ("NMI ... going to debugger\n"); 629 kdb_trap(type, 0, frame); 630 } 631 #endif /* KDB */ 632 goto out; 633 } else if (panic_on_nmi == 0) 634 goto out; 635 /* FALLTHROUGH */ 636 #endif /* DEV_ISA */ 637 } 638 639 trap_fatal(frame, 0); 640 goto out; 641 } 642 643 /* Translate fault for emulators (e.g. Linux) */ 644 if (*p->p_sysent->sv_transtrap) 645 i = (*p->p_sysent->sv_transtrap)(i, type); 646 647 ksiginfo_init_trap(&ksi); 648 ksi.ksi_signo = i; 649 ksi.ksi_code = ucode; 650 ksi.ksi_trapno = type; 651 ksi.ksi_addr = (void *)addr; 652 trapsignal(td, &ksi); 653 654 #ifdef DEBUG 655 { 656 register_t rg,rgk, rf; 657 658 if (type <= MAX_TRAP_MSG) { 659 uprintf("fatal process exception: %s", 660 trap_msg[type]); 661 if ((type == T_PAGEFLT) || (type == T_PROTFLT)) 662 uprintf(", fault VA = 0x%lx", frame->tf_addr); 663 uprintf("\n"); 664 } 665 rf = rdmsr(0xc0000100); 666 rg = rdmsr(0xc0000101); 667 rgk = rdmsr(0xc0000102); 668 uprintf("pid %d TRAP %d rip %lx err %lx addr %lx cs %lx ss %lx ds %x " 669 "es %x fs %x fsbase %lx %lx gs %x gsbase %lx %lx %lx\n", 670 curproc->p_pid, type, frame->tf_rip, frame->tf_err, 671 frame->tf_addr, 672 frame->tf_cs, frame->tf_ss, frame->tf_ds, frame->tf_es, 673 frame->tf_fs, td->td_pcb->pcb_fsbase, rf, 674 frame->tf_gs, td->td_pcb->pcb_gsbase, rg, rgk); 675 } 676 #endif 677 678 user: 679 userret(td, frame); 680 mtx_assert(&Giant, MA_NOTOWNED); 681 userout: 682 out: 683 return; 684 } 685 686 static int 687 trap_pfault(frame, usermode) 688 struct trapframe *frame; 689 int usermode; 690 { 691 vm_offset_t va; 692 struct vmspace *vm = NULL; 693 vm_map_t map; 694 int rv = 0; 695 vm_prot_t ftype; 696 struct thread *td = curthread; 697 struct proc *p = td->td_proc; 698 vm_offset_t eva = frame->tf_addr; 699 700 va = trunc_page(eva); 701 if (va >= VM_MIN_KERNEL_ADDRESS) { 702 /* 703 * Don't allow user-mode faults in kernel address space. 704 */ 705 if (usermode) 706 goto nogo; 707 708 map = kernel_map; 709 } else { 710 /* 711 * This is a fault on non-kernel virtual memory. 712 * vm is initialized above to NULL. If curproc is NULL 713 * or curproc->p_vmspace is NULL the fault is fatal. 714 */ 715 if (p != NULL) 716 vm = p->p_vmspace; 717 718 if (vm == NULL) 719 goto nogo; 720 721 map = &vm->vm_map; 722 } 723 724 /* 725 * PGEX_I is defined only if the execute disable bit capability is 726 * supported and enabled. 727 */ 728 if (frame->tf_err & PGEX_W) 729 ftype = VM_PROT_WRITE; 730 else if ((frame->tf_err & PGEX_I) && pg_nx != 0) 731 ftype = VM_PROT_EXECUTE; 732 else 733 ftype = VM_PROT_READ; 734 735 if (map != kernel_map) { 736 /* 737 * Keep swapout from messing with us during this 738 * critical time. 739 */ 740 PROC_LOCK(p); 741 ++p->p_lock; 742 PROC_UNLOCK(p); 743 744 /* Fault in the user page: */ 745 rv = vm_fault(map, va, ftype, 746 (ftype & VM_PROT_WRITE) ? VM_FAULT_DIRTY 747 : VM_FAULT_NORMAL); 748 749 PROC_LOCK(p); 750 --p->p_lock; 751 PROC_UNLOCK(p); 752 } else { 753 /* 754 * Don't have to worry about process locking or stacks in the 755 * kernel. 756 */ 757 rv = vm_fault(map, va, ftype, VM_FAULT_NORMAL); 758 } 759 if (rv == KERN_SUCCESS) 760 return (0); 761 nogo: 762 if (!usermode) { 763 if (td->td_intr_nesting_level == 0 && 764 PCPU_GET(curpcb)->pcb_onfault != NULL) { 765 frame->tf_rip = (long)PCPU_GET(curpcb)->pcb_onfault; 766 return (0); 767 } 768 trap_fatal(frame, eva); 769 return (-1); 770 } 771 772 return((rv == KERN_PROTECTION_FAILURE) ? SIGBUS : SIGSEGV); 773 } 774 775 static void 776 trap_fatal(frame, eva) 777 struct trapframe *frame; 778 vm_offset_t eva; 779 { 780 int code, ss; 781 u_int type; 782 long esp; 783 struct soft_segment_descriptor softseg; 784 char *msg; 785 786 code = frame->tf_err; 787 type = frame->tf_trapno; 788 sdtossd(&gdt[NGDT * PCPU_GET(cpuid) + IDXSEL(frame->tf_cs & 0xffff)], 789 &softseg); 790 791 if (type <= MAX_TRAP_MSG) 792 msg = trap_msg[type]; 793 else 794 msg = "UNKNOWN"; 795 printf("\n\nFatal trap %d: %s while in %s mode\n", type, msg, 796 ISPL(frame->tf_cs) == SEL_UPL ? "user" : "kernel"); 797 #ifdef SMP 798 /* two separate prints in case of a trap on an unmapped page */ 799 printf("cpuid = %d; ", PCPU_GET(cpuid)); 800 printf("apic id = %02x\n", PCPU_GET(apic_id)); 801 #endif 802 if (type == T_PAGEFLT) { 803 printf("fault virtual address = 0x%lx\n", eva); 804 printf("fault code = %s %s %s, %s\n", 805 code & PGEX_U ? "user" : "supervisor", 806 code & PGEX_W ? "write" : "read", 807 code & PGEX_I ? "instruction" : "data", 808 code & PGEX_P ? "protection violation" : "page not present"); 809 } 810 printf("instruction pointer = 0x%lx:0x%lx\n", 811 frame->tf_cs & 0xffff, frame->tf_rip); 812 if (ISPL(frame->tf_cs) == SEL_UPL) { 813 ss = frame->tf_ss & 0xffff; 814 esp = frame->tf_rsp; 815 } else { 816 ss = GSEL(GDATA_SEL, SEL_KPL); 817 esp = (long)&frame->tf_rsp; 818 } 819 printf("stack pointer = 0x%x:0x%lx\n", ss, esp); 820 printf("frame pointer = 0x%x:0x%lx\n", ss, frame->tf_rbp); 821 printf("code segment = base 0x%lx, limit 0x%lx, type 0x%x\n", 822 softseg.ssd_base, softseg.ssd_limit, softseg.ssd_type); 823 printf(" = DPL %d, pres %d, long %d, def32 %d, gran %d\n", 824 softseg.ssd_dpl, softseg.ssd_p, softseg.ssd_long, softseg.ssd_def32, 825 softseg.ssd_gran); 826 printf("processor eflags = "); 827 if (frame->tf_rflags & PSL_T) 828 printf("trace trap, "); 829 if (frame->tf_rflags & PSL_I) 830 printf("interrupt enabled, "); 831 if (frame->tf_rflags & PSL_NT) 832 printf("nested task, "); 833 if (frame->tf_rflags & PSL_RF) 834 printf("resume, "); 835 printf("IOPL = %ld\n", (frame->tf_rflags & PSL_IOPL) >> 12); 836 printf("current process = "); 837 if (curproc) { 838 printf("%lu (%s)\n", 839 (u_long)curproc->p_pid, curthread->td_name ? 840 curthread->td_name : ""); 841 } else { 842 printf("Idle\n"); 843 } 844 845 #ifdef KDB 846 if (debugger_on_panic || kdb_active) 847 if (kdb_trap(type, 0, frame)) 848 return; 849 #endif 850 printf("trap number = %d\n", type); 851 if (type <= MAX_TRAP_MSG) 852 panic("%s", trap_msg[type]); 853 else 854 panic("unknown/reserved trap"); 855 } 856 857 /* 858 * Double fault handler. Called when a fault occurs while writing 859 * a frame for a trap/exception onto the stack. This usually occurs 860 * when the stack overflows (such is the case with infinite recursion, 861 * for example). 862 */ 863 void 864 dblfault_handler(struct trapframe *frame) 865 { 866 #ifdef KDTRACE_HOOKS 867 if (dtrace_doubletrap_func != NULL) 868 (*dtrace_doubletrap_func)(); 869 #endif 870 printf("\nFatal double fault\n"); 871 printf("rip = 0x%lx\n", frame->tf_rip); 872 printf("rsp = 0x%lx\n", frame->tf_rsp); 873 printf("rbp = 0x%lx\n", frame->tf_rbp); 874 #ifdef SMP 875 /* two separate prints in case of a trap on an unmapped page */ 876 printf("cpuid = %d; ", PCPU_GET(cpuid)); 877 printf("apic id = %02x\n", PCPU_GET(apic_id)); 878 #endif 879 panic("double fault"); 880 } 881 882 /* 883 * syscall - system call request C handler 884 * 885 * A system call is essentially treated as a trap. 886 */ 887 void 888 syscall(struct trapframe *frame) 889 { 890 caddr_t params; 891 struct sysent *callp; 892 struct thread *td = curthread; 893 struct proc *p = td->td_proc; 894 register_t orig_tf_rflags; 895 int error; 896 int narg; 897 register_t args[8]; 898 register_t *argp; 899 u_int code; 900 int reg, regcnt; 901 ksiginfo_t ksi; 902 903 PCPU_INC(cnt.v_syscall); 904 905 #ifdef DIAGNOSTIC 906 if (ISPL(frame->tf_cs) != SEL_UPL) { 907 panic("syscall"); 908 /* NOT REACHED */ 909 } 910 #endif 911 912 reg = 0; 913 regcnt = 6; 914 td->td_pticks = 0; 915 td->td_frame = frame; 916 if (td->td_ucred != p->p_ucred) 917 cred_update_thread(td); 918 params = (caddr_t)frame->tf_rsp + sizeof(register_t); 919 code = frame->tf_rax; 920 orig_tf_rflags = frame->tf_rflags; 921 922 if (p->p_sysent->sv_prepsyscall) { 923 (*p->p_sysent->sv_prepsyscall)(frame, (int *)args, &code, ¶ms); 924 } else { 925 if (code == SYS_syscall || code == SYS___syscall) { 926 code = frame->tf_rdi; 927 reg++; 928 regcnt--; 929 } 930 } 931 932 if (p->p_sysent->sv_mask) 933 code &= p->p_sysent->sv_mask; 934 935 if (code >= p->p_sysent->sv_size) 936 callp = &p->p_sysent->sv_table[0]; 937 else 938 callp = &p->p_sysent->sv_table[code]; 939 940 narg = callp->sy_narg; 941 KASSERT(narg <= sizeof(args) / sizeof(args[0]), 942 ("Too many syscall arguments!")); 943 error = 0; 944 argp = &frame->tf_rdi; 945 argp += reg; 946 bcopy(argp, args, sizeof(args[0]) * regcnt); 947 if (narg > regcnt) { 948 KASSERT(params != NULL, ("copyin args with no params!")); 949 error = copyin(params, &args[regcnt], 950 (narg - regcnt) * sizeof(args[0])); 951 } 952 argp = &args[0]; 953 954 #ifdef KTRACE 955 if (KTRPOINT(td, KTR_SYSCALL)) 956 ktrsyscall(code, narg, argp); 957 #endif 958 959 CTR4(KTR_SYSC, "syscall enter thread %p pid %d proc %s code %d", td, 960 td->td_proc->p_pid, td->td_name, code); 961 962 td->td_syscalls++; 963 964 if (error == 0) { 965 td->td_retval[0] = 0; 966 td->td_retval[1] = frame->tf_rdx; 967 968 STOPEVENT(p, S_SCE, narg); 969 970 PTRACESTOP_SC(p, td, S_PT_SCE); 971 972 #ifdef KDTRACE_HOOKS 973 /* 974 * If the systrace module has registered it's probe 975 * callback and if there is a probe active for the 976 * syscall 'entry', process the probe. 977 */ 978 if (systrace_probe_func != NULL && callp->sy_entry != 0) 979 (*systrace_probe_func)(callp->sy_entry, code, callp, 980 args); 981 #endif 982 983 AUDIT_SYSCALL_ENTER(code, td); 984 error = (*callp->sy_call)(td, argp); 985 AUDIT_SYSCALL_EXIT(error, td); 986 987 /* Save the latest error return value. */ 988 td->td_errno = error; 989 990 #ifdef KDTRACE_HOOKS 991 /* 992 * If the systrace module has registered it's probe 993 * callback and if there is a probe active for the 994 * syscall 'return', process the probe. 995 */ 996 if (systrace_probe_func != NULL && callp->sy_return != 0) 997 (*systrace_probe_func)(callp->sy_return, code, callp, 998 args); 999 #endif 1000 } 1001 1002 switch (error) { 1003 case 0: 1004 frame->tf_rax = td->td_retval[0]; 1005 frame->tf_rdx = td->td_retval[1]; 1006 frame->tf_rflags &= ~PSL_C; 1007 break; 1008 1009 case ERESTART: 1010 /* 1011 * Reconstruct pc, we know that 'syscall' is 2 bytes. 1012 * We have to do a full context restore so that %r10 1013 * (which was holding the value of %rcx) is restored for 1014 * the next iteration. 1015 */ 1016 frame->tf_rip -= frame->tf_err; 1017 frame->tf_r10 = frame->tf_rcx; 1018 td->td_pcb->pcb_flags |= PCB_FULLCTX; 1019 break; 1020 1021 case EJUSTRETURN: 1022 break; 1023 1024 default: 1025 if (p->p_sysent->sv_errsize) { 1026 if (error >= p->p_sysent->sv_errsize) 1027 error = -1; /* XXX */ 1028 else 1029 error = p->p_sysent->sv_errtbl[error]; 1030 } 1031 frame->tf_rax = error; 1032 frame->tf_rflags |= PSL_C; 1033 break; 1034 } 1035 1036 /* 1037 * Traced syscall. 1038 */ 1039 if (orig_tf_rflags & PSL_T) { 1040 frame->tf_rflags &= ~PSL_T; 1041 ksiginfo_init_trap(&ksi); 1042 ksi.ksi_signo = SIGTRAP; 1043 ksi.ksi_code = TRAP_TRACE; 1044 ksi.ksi_addr = (void *)frame->tf_rip; 1045 trapsignal(td, &ksi); 1046 } 1047 1048 /* 1049 * Check for misbehavior. 1050 */ 1051 WITNESS_WARN(WARN_PANIC, NULL, "System call %s returning", 1052 (code >= 0 && code < SYS_MAXSYSCALL) ? syscallnames[code] : "???"); 1053 KASSERT(td->td_critnest == 0, 1054 ("System call %s returning in a critical section", 1055 (code >= 0 && code < SYS_MAXSYSCALL) ? syscallnames[code] : "???")); 1056 KASSERT(td->td_locks == 0, 1057 ("System call %s returning with %d locks held", 1058 (code >= 0 && code < SYS_MAXSYSCALL) ? syscallnames[code] : "???", 1059 td->td_locks)); 1060 1061 /* 1062 * Handle reschedule and other end-of-syscall issues 1063 */ 1064 userret(td, frame); 1065 1066 CTR4(KTR_SYSC, "syscall exit thread %p pid %d proc %s code %d", td, 1067 td->td_proc->p_pid, td->td_name, code); 1068 1069 #ifdef KTRACE 1070 if (KTRPOINT(td, KTR_SYSRET)) 1071 ktrsysret(code, error, td->td_retval[0]); 1072 #endif 1073 1074 /* 1075 * This works because errno is findable through the 1076 * register set. If we ever support an emulation where this 1077 * is not the case, this code will need to be revisited. 1078 */ 1079 STOPEVENT(p, S_SCX, code); 1080 1081 PTRACESTOP_SC(p, td, S_PT_SCX); 1082 }
Cache object: 41fd098c8df0c272e15c554aba59a96a
[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]