Now available: The Design and Implementation of the FreeBSD Operating System (Second Edition)
[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]
FreeBSD/Linux Kernel Cross Reference
sys/amd64/amd64/trap.c
Version:
- FREEBSD - FREEBSD-13-STABLE - FREEBSD-13-0 - FREEBSD-12-STABLE - FREEBSD-12-0 - FREEBSD-11-STABLE - FREEBSD-11-0 - FREEBSD-10-STABLE - FREEBSD-10-0 - FREEBSD-9-STABLE - FREEBSD-9-0 - FREEBSD-8-STABLE - FREEBSD-8-0 - FREEBSD-7-STABLE - FREEBSD-7-0 - FREEBSD-6-STABLE - FREEBSD-6-0 - FREEBSD-5-STABLE - FREEBSD-5-0 - FREEBSD-4-STABLE - FREEBSD-3-STABLE - FREEBSD22 - l41 - OPENBSD - linux-2.6 - MK84 - PLAN9 - xnu-8792
SearchContext: - none - 3 - 10
SearchContext: - none - 3 - 10
1 /*- 2 * Copyright (C) 1994, David Greenman 3 * Copyright (c) 1990, 1993 4 * The Regents of the University of California. All rights reserved. 5 * 6 * This code is derived from software contributed to Berkeley by 7 * the University of Utah, and William Jolitz. 8 * 9 * Redistribution and use in source and binary forms, with or without 10 * modification, are permitted provided that the following conditions 11 * are met: 12 * 1. Redistributions of source code must retain the above copyright 13 * notice, this list of conditions and the following disclaimer. 14 * 2. Redistributions in binary form must reproduce the above copyright 15 * notice, this list of conditions and the following disclaimer in the 16 * documentation and/or other materials provided with the distribution. 17 * 3. All advertising materials mentioning features or use of this software 18 * must display the following acknowledgement: 19 * This product includes software developed by the University of 20 * California, Berkeley and its contributors. 21 * 4. Neither the name of the University nor the names of its contributors 22 * may be used to endorse or promote products derived from this software 23 * without specific prior written permission. 24 * 25 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 26 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 27 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 28 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 29 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 30 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 31 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 32 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 33 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 34 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 35 * SUCH DAMAGE. 36 * 37 * from: @(#)trap.c 7.4 (Berkeley) 5/13/91 38 */ 39 40 #include <sys/cdefs.h> 41 __FBSDID("$FreeBSD: releng/8.3/sys/amd64/amd64/trap.c 236953 2012-06-12 12:10:10Z bz $"); 42 43 /* 44 * AMD64 Trap and System call handling 45 */ 46 47 #include "opt_clock.h" 48 #include "opt_cpu.h" 49 #include "opt_hwpmc_hooks.h" 50 #include "opt_isa.h" 51 #include "opt_kdb.h" 52 #include "opt_kdtrace.h" 53 #include "opt_ktrace.h" 54 55 #include <sys/param.h> 56 #include <sys/bus.h> 57 #include <sys/systm.h> 58 #include <sys/proc.h> 59 #include <sys/pioctl.h> 60 #include <sys/ptrace.h> 61 #include <sys/kdb.h> 62 #include <sys/kernel.h> 63 #include <sys/ktr.h> 64 #include <sys/lock.h> 65 #include <sys/mutex.h> 66 #include <sys/resourcevar.h> 67 #include <sys/signalvar.h> 68 #include <sys/syscall.h> 69 #include <sys/sysctl.h> 70 #include <sys/sysent.h> 71 #include <sys/uio.h> 72 #include <sys/vmmeter.h> 73 #ifdef KTRACE 74 #include <sys/ktrace.h> 75 #endif 76 #ifdef HWPMC_HOOKS 77 #include <sys/pmckern.h> 78 #endif 79 80 #include <vm/vm.h> 81 #include <vm/vm_param.h> 82 #include <vm/pmap.h> 83 #include <vm/vm_kern.h> 84 #include <vm/vm_map.h> 85 #include <vm/vm_page.h> 86 #include <vm/vm_extern.h> 87 88 #include <machine/cpu.h> 89 #include <machine/intr_machdep.h> 90 #include <machine/mca.h> 91 #include <machine/md_var.h> 92 #include <machine/pcb.h> 93 #ifdef SMP 94 #include <machine/smp.h> 95 #endif 96 #include <machine/tss.h> 97 98 #ifdef KDTRACE_HOOKS 99 #include <sys/dtrace_bsd.h> 100 101 /* 102 * This is a hook which is initialised by the dtrace module 103 * to handle traps which might occur during DTrace probe 104 * execution. 105 */ 106 dtrace_trap_func_t dtrace_trap_func; 107 108 dtrace_doubletrap_func_t dtrace_doubletrap_func; 109 110 /* 111 * This is a hook which is initialised by the systrace module 112 * when it is loaded. This keeps the DTrace syscall provider 113 * implementation opaque. 114 */ 115 systrace_probe_func_t systrace_probe_func; 116 117 /* 118 * These hooks are necessary for the pid, usdt and fasttrap providers. 119 */ 120 dtrace_fasttrap_probe_ptr_t dtrace_fasttrap_probe_ptr; 121 dtrace_pid_probe_ptr_t dtrace_pid_probe_ptr; 122 dtrace_return_probe_ptr_t dtrace_return_probe_ptr; 123 #endif 124 125 extern void trap(struct trapframe *frame); 126 extern void syscall(struct trapframe *frame); 127 void dblfault_handler(struct trapframe *frame); 128 129 static int trap_pfault(struct trapframe *, int); 130 static void trap_fatal(struct trapframe *, vm_offset_t); 131 132 #define MAX_TRAP_MSG 33 133 static char *trap_msg[] = { 134 "", /* 0 unused */ 135 "privileged instruction fault", /* 1 T_PRIVINFLT */ 136 "", /* 2 unused */ 137 "breakpoint instruction fault", /* 3 T_BPTFLT */ 138 "", /* 4 unused */ 139 "", /* 5 unused */ 140 "arithmetic trap", /* 6 T_ARITHTRAP */ 141 "", /* 7 unused */ 142 "", /* 8 unused */ 143 "general protection fault", /* 9 T_PROTFLT */ 144 "trace trap", /* 10 T_TRCTRAP */ 145 "", /* 11 unused */ 146 "page fault", /* 12 T_PAGEFLT */ 147 "", /* 13 unused */ 148 "alignment fault", /* 14 T_ALIGNFLT */ 149 "", /* 15 unused */ 150 "", /* 16 unused */ 151 "", /* 17 unused */ 152 "integer divide fault", /* 18 T_DIVIDE */ 153 "non-maskable interrupt trap", /* 19 T_NMI */ 154 "overflow trap", /* 20 T_OFLOW */ 155 "FPU bounds check fault", /* 21 T_BOUND */ 156 "FPU device not available", /* 22 T_DNA */ 157 "double fault", /* 23 T_DOUBLEFLT */ 158 "FPU operand fetch fault", /* 24 T_FPOPFLT */ 159 "invalid TSS fault", /* 25 T_TSSFLT */ 160 "segment not present fault", /* 26 T_SEGNPFLT */ 161 "stack fault", /* 27 T_STKFLT */ 162 "machine check trap", /* 28 T_MCHK */ 163 "SIMD floating-point exception", /* 29 T_XMMFLT */ 164 "reserved (unknown) fault", /* 30 T_RESERVED */ 165 "", /* 31 unused (reserved) */ 166 "DTrace pid return trap", /* 32 T_DTRACE_RET */ 167 "DTrace fasttrap probe trap", /* 33 T_DTRACE_PROBE */ 168 }; 169 170 #ifdef KDB 171 static int kdb_on_nmi = 1; 172 SYSCTL_INT(_machdep, OID_AUTO, kdb_on_nmi, CTLFLAG_RW, 173 &kdb_on_nmi, 0, "Go to KDB on NMI"); 174 TUNABLE_INT("machdep.kdb_on_nmi", &kdb_on_nmi); 175 #endif 176 static int panic_on_nmi = 1; 177 SYSCTL_INT(_machdep, OID_AUTO, panic_on_nmi, CTLFLAG_RW, 178 &panic_on_nmi, 0, "Panic on NMI"); 179 TUNABLE_INT("machdep.panic_on_nmi", &panic_on_nmi); 180 static int prot_fault_translation = 0; 181 SYSCTL_INT(_machdep, OID_AUTO, prot_fault_translation, CTLFLAG_RW, 182 &prot_fault_translation, 0, "Select signal to deliver on protection fault"); 183 184 /* 185 * Exception, fault, and trap interface to the FreeBSD kernel. 186 * This common code is called from assembly language IDT gate entry 187 * routines that prepare a suitable stack frame, and restore this 188 * frame after the exception has been processed. 189 */ 190 191 void 192 trap(struct trapframe *frame) 193 { 194 struct thread *td = curthread; 195 struct proc *p = td->td_proc; 196 int i = 0, ucode = 0, code; 197 u_int type; 198 register_t addr = 0; 199 ksiginfo_t ksi; 200 201 PCPU_INC(cnt.v_trap); 202 type = frame->tf_trapno; 203 204 #ifdef SMP 205 /* Handler for NMI IPIs used for stopping CPUs. */ 206 if (type == T_NMI) { 207 if (ipi_nmi_handler() == 0) 208 goto out; 209 } 210 #endif /* SMP */ 211 212 #ifdef KDB 213 if (kdb_active) { 214 kdb_reenter(); 215 goto out; 216 } 217 #endif 218 219 if (type == T_RESERVED) { 220 trap_fatal(frame, 0); 221 goto out; 222 } 223 224 #ifdef HWPMC_HOOKS 225 /* 226 * CPU PMCs interrupt using an NMI. If the PMC module is 227 * active, pass the 'rip' value to the PMC module's interrupt 228 * handler. A return value of '1' from the handler means that 229 * the NMI was handled by it and we can return immediately. 230 */ 231 if (type == T_NMI && pmc_intr && 232 (*pmc_intr)(PCPU_GET(cpuid), frame)) 233 goto out; 234 #endif 235 236 if (type == T_MCHK) { 237 if (!mca_intr()) 238 trap_fatal(frame, 0); 239 goto out; 240 } 241 242 #ifdef KDTRACE_HOOKS 243 /* 244 * A trap can occur while DTrace executes a probe. Before 245 * executing the probe, DTrace blocks re-scheduling and sets 246 * a flag in it's per-cpu flags to indicate that it doesn't 247 * want to fault. On returning from the probe, the no-fault 248 * flag is cleared and finally re-scheduling is enabled. 249 * 250 * If the DTrace kernel module has registered a trap handler, 251 * call it and if it returns non-zero, assume that it has 252 * handled the trap and modified the trap frame so that this 253 * function can return normally. 254 */ 255 if (type == T_DTRACE_PROBE || type == T_DTRACE_RET || 256 type == T_BPTFLT) { 257 struct reg regs; 258 259 fill_frame_regs(frame, ®s); 260 if (type == T_DTRACE_PROBE && 261 dtrace_fasttrap_probe_ptr != NULL && 262 dtrace_fasttrap_probe_ptr(®s) == 0) 263 goto out; 264 else if (type == T_BPTFLT && 265 dtrace_pid_probe_ptr != NULL && 266 dtrace_pid_probe_ptr(®s) == 0) 267 goto out; 268 else if (type == T_DTRACE_RET && 269 dtrace_return_probe_ptr != NULL && 270 dtrace_return_probe_ptr(®s) == 0) 271 goto out; 272 } 273 if (dtrace_trap_func != NULL && (*dtrace_trap_func)(frame, type)) 274 goto out; 275 #endif 276 277 if ((frame->tf_rflags & PSL_I) == 0) { 278 /* 279 * Buggy application or kernel code has disabled 280 * interrupts and then trapped. Enabling interrupts 281 * now is wrong, but it is better than running with 282 * interrupts disabled until they are accidentally 283 * enabled later. 284 */ 285 if (ISPL(frame->tf_cs) == SEL_UPL) 286 uprintf( 287 "pid %ld (%s): trap %d with interrupts disabled\n", 288 (long)curproc->p_pid, curthread->td_name, type); 289 else if (type != T_NMI && type != T_BPTFLT && 290 type != T_TRCTRAP) { 291 /* 292 * XXX not quite right, since this may be for a 293 * multiple fault in user mode. 294 */ 295 printf("kernel trap %d with interrupts disabled\n", 296 type); 297 298 /* 299 * We shouldn't enable interrupts while holding a 300 * spin lock. 301 */ 302 if (td->td_md.md_spinlock_count == 0) 303 enable_intr(); 304 } 305 } 306 307 code = frame->tf_err; 308 if (type == T_PAGEFLT) { 309 /* 310 * If we get a page fault while in a critical section, then 311 * it is most likely a fatal kernel page fault. The kernel 312 * is already going to panic trying to get a sleep lock to 313 * do the VM lookup, so just consider it a fatal trap so the 314 * kernel can print out a useful trap message and even get 315 * to the debugger. 316 * 317 * If we get a page fault while holding a non-sleepable 318 * lock, then it is most likely a fatal kernel page fault. 319 * If WITNESS is enabled, then it's going to whine about 320 * bogus LORs with various VM locks, so just skip to the 321 * fatal trap handling directly. 322 */ 323 if (td->td_critnest != 0 || 324 WITNESS_CHECK(WARN_SLEEPOK | WARN_GIANTOK, NULL, 325 "Kernel page fault") != 0) 326 trap_fatal(frame, frame->tf_addr); 327 } 328 329 if (ISPL(frame->tf_cs) == SEL_UPL) { 330 /* user trap */ 331 332 td->td_pticks = 0; 333 td->td_frame = frame; 334 addr = frame->tf_rip; 335 if (td->td_ucred != p->p_ucred) 336 cred_update_thread(td); 337 338 switch (type) { 339 case T_PRIVINFLT: /* privileged instruction fault */ 340 i = SIGILL; 341 ucode = ILL_PRVOPC; 342 break; 343 344 case T_BPTFLT: /* bpt instruction fault */ 345 case T_TRCTRAP: /* trace trap */ 346 enable_intr(); 347 frame->tf_rflags &= ~PSL_T; 348 i = SIGTRAP; 349 ucode = (type == T_TRCTRAP ? TRAP_TRACE : TRAP_BRKPT); 350 break; 351 352 case T_ARITHTRAP: /* arithmetic trap */ 353 ucode = fputrap(); 354 if (ucode == -1) 355 goto userout; 356 i = SIGFPE; 357 break; 358 359 case T_PROTFLT: /* general protection fault */ 360 i = SIGBUS; 361 ucode = BUS_OBJERR; 362 break; 363 case T_STKFLT: /* stack fault */ 364 case T_SEGNPFLT: /* segment not present fault */ 365 i = SIGBUS; 366 ucode = BUS_ADRERR; 367 break; 368 case T_TSSFLT: /* invalid TSS fault */ 369 i = SIGBUS; 370 ucode = BUS_OBJERR; 371 break; 372 case T_DOUBLEFLT: /* double fault */ 373 default: 374 i = SIGBUS; 375 ucode = BUS_OBJERR; 376 break; 377 378 case T_PAGEFLT: /* page fault */ 379 addr = frame->tf_addr; 380 i = trap_pfault(frame, TRUE); 381 if (i == -1) 382 goto userout; 383 if (i == 0) 384 goto user; 385 386 if (i == SIGSEGV) 387 ucode = SEGV_MAPERR; 388 else { 389 if (prot_fault_translation == 0) { 390 /* 391 * Autodetect. 392 * This check also covers the images 393 * without the ABI-tag ELF note. 394 */ 395 if (SV_CURPROC_ABI() == SV_ABI_FREEBSD 396 && p->p_osrel >= P_OSREL_SIGSEGV) { 397 i = SIGSEGV; 398 ucode = SEGV_ACCERR; 399 } else { 400 i = SIGBUS; 401 ucode = BUS_PAGE_FAULT; 402 } 403 } else if (prot_fault_translation == 1) { 404 /* 405 * Always compat mode. 406 */ 407 i = SIGBUS; 408 ucode = BUS_PAGE_FAULT; 409 } else { 410 /* 411 * Always SIGSEGV mode. 412 */ 413 i = SIGSEGV; 414 ucode = SEGV_ACCERR; 415 } 416 } 417 break; 418 419 case T_DIVIDE: /* integer divide fault */ 420 ucode = FPE_INTDIV; 421 i = SIGFPE; 422 break; 423 424 #ifdef DEV_ISA 425 case T_NMI: 426 /* machine/parity/power fail/"kitchen sink" faults */ 427 if (isa_nmi(code) == 0) { 428 #ifdef KDB 429 /* 430 * NMI can be hooked up to a pushbutton 431 * for debugging. 432 */ 433 if (kdb_on_nmi) { 434 printf ("NMI ... going to debugger\n"); 435 kdb_trap(type, 0, frame); 436 } 437 #endif /* KDB */ 438 goto userout; 439 } else if (panic_on_nmi) 440 panic("NMI indicates hardware failure"); 441 break; 442 #endif /* DEV_ISA */ 443 444 case T_OFLOW: /* integer overflow fault */ 445 ucode = FPE_INTOVF; 446 i = SIGFPE; 447 break; 448 449 case T_BOUND: /* bounds check fault */ 450 ucode = FPE_FLTSUB; 451 i = SIGFPE; 452 break; 453 454 case T_DNA: 455 /* transparent fault (due to context switch "late") */ 456 KASSERT(PCB_USER_FPU(td->td_pcb), 457 ("kernel FPU ctx has leaked")); 458 fpudna(); 459 goto userout; 460 461 case T_FPOPFLT: /* FPU operand fetch fault */ 462 ucode = ILL_COPROC; 463 i = SIGILL; 464 break; 465 466 case T_XMMFLT: /* SIMD floating-point exception */ 467 ucode = 0; /* XXX */ 468 i = SIGFPE; 469 break; 470 } 471 } else { 472 /* kernel trap */ 473 474 KASSERT(cold || td->td_ucred != NULL, 475 ("kernel trap doesn't have ucred")); 476 switch (type) { 477 case T_PAGEFLT: /* page fault */ 478 (void) trap_pfault(frame, FALSE); 479 goto out; 480 481 case T_DNA: 482 KASSERT(!PCB_USER_FPU(td->td_pcb), 483 ("Unregistered use of FPU in kernel")); 484 fpudna(); 485 goto out; 486 487 case T_ARITHTRAP: /* arithmetic trap */ 488 case T_XMMFLT: /* SIMD floating-point exception */ 489 case T_FPOPFLT: /* FPU operand fetch fault */ 490 /* 491 * XXXKIB for now disable any FPU traps in kernel 492 * handler registration seems to be overkill 493 */ 494 trap_fatal(frame, 0); 495 goto out; 496 497 case T_STKFLT: /* stack fault */ 498 break; 499 500 case T_PROTFLT: /* general protection fault */ 501 case T_SEGNPFLT: /* segment not present fault */ 502 if (td->td_intr_nesting_level != 0) 503 break; 504 505 /* 506 * Invalid segment selectors and out of bounds 507 * %rip's and %rsp's can be set up in user mode. 508 * This causes a fault in kernel mode when the 509 * kernel tries to return to user mode. We want 510 * to get this fault so that we can fix the 511 * problem here and not have to check all the 512 * selectors and pointers when the user changes 513 * them. 514 */ 515 if (frame->tf_rip == (long)doreti_iret) { 516 frame->tf_rip = (long)doreti_iret_fault; 517 goto out; 518 } 519 if (frame->tf_rip == (long)ld_ds) { 520 frame->tf_rip = (long)ds_load_fault; 521 goto out; 522 } 523 if (frame->tf_rip == (long)ld_es) { 524 frame->tf_rip = (long)es_load_fault; 525 goto out; 526 } 527 if (frame->tf_rip == (long)ld_fs) { 528 frame->tf_rip = (long)fs_load_fault; 529 goto out; 530 } 531 if (frame->tf_rip == (long)ld_gs) { 532 frame->tf_rip = (long)gs_load_fault; 533 goto out; 534 } 535 if (frame->tf_rip == (long)ld_gsbase) { 536 frame->tf_rip = (long)gsbase_load_fault; 537 goto out; 538 } 539 if (frame->tf_rip == (long)ld_fsbase) { 540 frame->tf_rip = (long)fsbase_load_fault; 541 goto out; 542 } 543 if (PCPU_GET(curpcb)->pcb_onfault != NULL) { 544 frame->tf_rip = 545 (long)PCPU_GET(curpcb)->pcb_onfault; 546 goto out; 547 } 548 break; 549 550 case T_TSSFLT: 551 /* 552 * PSL_NT can be set in user mode and isn't cleared 553 * automatically when the kernel is entered. This 554 * causes a TSS fault when the kernel attempts to 555 * `iret' because the TSS link is uninitialized. We 556 * want to get this fault so that we can fix the 557 * problem here and not every time the kernel is 558 * entered. 559 */ 560 if (frame->tf_rflags & PSL_NT) { 561 frame->tf_rflags &= ~PSL_NT; 562 goto out; 563 } 564 break; 565 566 case T_TRCTRAP: /* trace trap */ 567 /* 568 * Ignore debug register trace traps due to 569 * accesses in the user's address space, which 570 * can happen under several conditions such as 571 * if a user sets a watchpoint on a buffer and 572 * then passes that buffer to a system call. 573 * We still want to get TRCTRAPS for addresses 574 * in kernel space because that is useful when 575 * debugging the kernel. 576 */ 577 if (user_dbreg_trap()) { 578 /* 579 * Reset breakpoint bits because the 580 * processor doesn't 581 */ 582 /* XXX check upper bits here */ 583 load_dr6(rdr6() & 0xfffffff0); 584 goto out; 585 } 586 /* 587 * FALLTHROUGH (TRCTRAP kernel mode, kernel address) 588 */ 589 case T_BPTFLT: 590 /* 591 * If KDB is enabled, let it handle the debugger trap. 592 * Otherwise, debugger traps "can't happen". 593 */ 594 #ifdef KDB 595 if (kdb_trap(type, 0, frame)) 596 goto out; 597 #endif 598 break; 599 600 #ifdef DEV_ISA 601 case T_NMI: 602 /* machine/parity/power fail/"kitchen sink" faults */ 603 if (isa_nmi(code) == 0) { 604 #ifdef KDB 605 /* 606 * NMI can be hooked up to a pushbutton 607 * for debugging. 608 */ 609 if (kdb_on_nmi) { 610 printf ("NMI ... going to debugger\n"); 611 kdb_trap(type, 0, frame); 612 } 613 #endif /* KDB */ 614 goto out; 615 } else if (panic_on_nmi == 0) 616 goto out; 617 /* FALLTHROUGH */ 618 #endif /* DEV_ISA */ 619 } 620 621 trap_fatal(frame, 0); 622 goto out; 623 } 624 625 /* Translate fault for emulators (e.g. Linux) */ 626 if (*p->p_sysent->sv_transtrap) 627 i = (*p->p_sysent->sv_transtrap)(i, type); 628 629 ksiginfo_init_trap(&ksi); 630 ksi.ksi_signo = i; 631 ksi.ksi_code = ucode; 632 ksi.ksi_trapno = type; 633 ksi.ksi_addr = (void *)addr; 634 trapsignal(td, &ksi); 635 636 user: 637 userret(td, frame); 638 mtx_assert(&Giant, MA_NOTOWNED); 639 KASSERT(PCB_USER_FPU(td->td_pcb), 640 ("Return from trap with kernel FPU ctx leaked")); 641 userout: 642 out: 643 return; 644 } 645 646 static int 647 trap_pfault(frame, usermode) 648 struct trapframe *frame; 649 int usermode; 650 { 651 vm_offset_t va; 652 struct vmspace *vm = NULL; 653 vm_map_t map; 654 int rv = 0; 655 vm_prot_t ftype; 656 struct thread *td = curthread; 657 struct proc *p = td->td_proc; 658 vm_offset_t eva = frame->tf_addr; 659 660 va = trunc_page(eva); 661 if (va >= VM_MIN_KERNEL_ADDRESS) { 662 /* 663 * Don't allow user-mode faults in kernel address space. 664 */ 665 if (usermode) 666 goto nogo; 667 668 map = kernel_map; 669 } else { 670 /* 671 * This is a fault on non-kernel virtual memory. 672 * vm is initialized above to NULL. If curproc is NULL 673 * or curproc->p_vmspace is NULL the fault is fatal. 674 */ 675 if (p != NULL) 676 vm = p->p_vmspace; 677 678 if (vm == NULL) 679 goto nogo; 680 681 map = &vm->vm_map; 682 683 /* 684 * When accessing a usermode address, kernel must be 685 * ready to accept the page fault, and provide a 686 * handling routine. Since accessing the address 687 * without the handler is a bug, do not try to handle 688 * it normally, and panic immediately. 689 */ 690 if (!usermode && (td->td_intr_nesting_level != 0 || 691 PCPU_GET(curpcb)->pcb_onfault == NULL)) { 692 trap_fatal(frame, eva); 693 return (-1); 694 } 695 } 696 697 /* 698 * PGEX_I is defined only if the execute disable bit capability is 699 * supported and enabled. 700 */ 701 if (frame->tf_err & PGEX_W) 702 ftype = VM_PROT_WRITE; 703 else if ((frame->tf_err & PGEX_I) && pg_nx != 0) 704 ftype = VM_PROT_EXECUTE; 705 else 706 ftype = VM_PROT_READ; 707 708 if (map != kernel_map) { 709 /* 710 * Keep swapout from messing with us during this 711 * critical time. 712 */ 713 PROC_LOCK(p); 714 ++p->p_lock; 715 PROC_UNLOCK(p); 716 717 /* Fault in the user page: */ 718 rv = vm_fault(map, va, ftype, 719 (ftype & VM_PROT_WRITE) ? VM_FAULT_DIRTY 720 : VM_FAULT_NORMAL); 721 722 PROC_LOCK(p); 723 --p->p_lock; 724 PROC_UNLOCK(p); 725 } else { 726 /* 727 * Don't have to worry about process locking or stacks in the 728 * kernel. 729 */ 730 rv = vm_fault(map, va, ftype, VM_FAULT_NORMAL); 731 } 732 if (rv == KERN_SUCCESS) 733 return (0); 734 nogo: 735 if (!usermode) { 736 if (td->td_intr_nesting_level == 0 && 737 PCPU_GET(curpcb)->pcb_onfault != NULL) { 738 frame->tf_rip = (long)PCPU_GET(curpcb)->pcb_onfault; 739 return (0); 740 } 741 trap_fatal(frame, eva); 742 return (-1); 743 } 744 745 return((rv == KERN_PROTECTION_FAILURE) ? SIGBUS : SIGSEGV); 746 } 747 748 static void 749 trap_fatal(frame, eva) 750 struct trapframe *frame; 751 vm_offset_t eva; 752 { 753 int code, ss; 754 u_int type; 755 long esp; 756 struct soft_segment_descriptor softseg; 757 char *msg; 758 759 code = frame->tf_err; 760 type = frame->tf_trapno; 761 sdtossd(&gdt[NGDT * PCPU_GET(cpuid) + IDXSEL(frame->tf_cs & 0xffff)], 762 &softseg); 763 764 if (type <= MAX_TRAP_MSG) 765 msg = trap_msg[type]; 766 else 767 msg = "UNKNOWN"; 768 printf("\n\nFatal trap %d: %s while in %s mode\n", type, msg, 769 ISPL(frame->tf_cs) == SEL_UPL ? "user" : "kernel"); 770 #ifdef SMP 771 /* two separate prints in case of a trap on an unmapped page */ 772 printf("cpuid = %d; ", PCPU_GET(cpuid)); 773 printf("apic id = %02x\n", PCPU_GET(apic_id)); 774 #endif 775 if (type == T_PAGEFLT) { 776 printf("fault virtual address = 0x%lx\n", eva); 777 printf("fault code = %s %s %s, %s\n", 778 code & PGEX_U ? "user" : "supervisor", 779 code & PGEX_W ? "write" : "read", 780 code & PGEX_I ? "instruction" : "data", 781 code & PGEX_P ? "protection violation" : "page not present"); 782 } 783 printf("instruction pointer = 0x%lx:0x%lx\n", 784 frame->tf_cs & 0xffff, frame->tf_rip); 785 if (ISPL(frame->tf_cs) == SEL_UPL) { 786 ss = frame->tf_ss & 0xffff; 787 esp = frame->tf_rsp; 788 } else { 789 ss = GSEL(GDATA_SEL, SEL_KPL); 790 esp = (long)&frame->tf_rsp; 791 } 792 printf("stack pointer = 0x%x:0x%lx\n", ss, esp); 793 printf("frame pointer = 0x%x:0x%lx\n", ss, frame->tf_rbp); 794 printf("code segment = base 0x%lx, limit 0x%lx, type 0x%x\n", 795 softseg.ssd_base, softseg.ssd_limit, softseg.ssd_type); 796 printf(" = DPL %d, pres %d, long %d, def32 %d, gran %d\n", 797 softseg.ssd_dpl, softseg.ssd_p, softseg.ssd_long, softseg.ssd_def32, 798 softseg.ssd_gran); 799 printf("processor eflags = "); 800 if (frame->tf_rflags & PSL_T) 801 printf("trace trap, "); 802 if (frame->tf_rflags & PSL_I) 803 printf("interrupt enabled, "); 804 if (frame->tf_rflags & PSL_NT) 805 printf("nested task, "); 806 if (frame->tf_rflags & PSL_RF) 807 printf("resume, "); 808 printf("IOPL = %ld\n", (frame->tf_rflags & PSL_IOPL) >> 12); 809 printf("current process = "); 810 if (curproc) { 811 printf("%lu (%s)\n", 812 (u_long)curproc->p_pid, curthread->td_name ? 813 curthread->td_name : ""); 814 } else { 815 printf("Idle\n"); 816 } 817 818 #ifdef KDB 819 if (debugger_on_panic || kdb_active) 820 if (kdb_trap(type, 0, frame)) 821 return; 822 #endif 823 printf("trap number = %d\n", type); 824 if (type <= MAX_TRAP_MSG) 825 panic("%s", trap_msg[type]); 826 else 827 panic("unknown/reserved trap"); 828 } 829 830 /* 831 * Double fault handler. Called when a fault occurs while writing 832 * a frame for a trap/exception onto the stack. This usually occurs 833 * when the stack overflows (such is the case with infinite recursion, 834 * for example). 835 */ 836 void 837 dblfault_handler(struct trapframe *frame) 838 { 839 #ifdef KDTRACE_HOOKS 840 if (dtrace_doubletrap_func != NULL) 841 (*dtrace_doubletrap_func)(); 842 #endif 843 printf("\nFatal double fault\n"); 844 printf("rip = 0x%lx\n", frame->tf_rip); 845 printf("rsp = 0x%lx\n", frame->tf_rsp); 846 printf("rbp = 0x%lx\n", frame->tf_rbp); 847 #ifdef SMP 848 /* two separate prints in case of a trap on an unmapped page */ 849 printf("cpuid = %d; ", PCPU_GET(cpuid)); 850 printf("apic id = %02x\n", PCPU_GET(apic_id)); 851 #endif 852 panic("double fault"); 853 } 854 855 int 856 cpu_fetch_syscall_args(struct thread *td, struct syscall_args *sa) 857 { 858 struct proc *p; 859 struct trapframe *frame; 860 register_t *argp; 861 caddr_t params; 862 int reg, regcnt, error; 863 864 p = td->td_proc; 865 frame = td->td_frame; 866 reg = 0; 867 regcnt = 6; 868 869 params = (caddr_t)frame->tf_rsp + sizeof(register_t); 870 sa->code = frame->tf_rax; 871 872 if (sa->code == SYS_syscall || sa->code == SYS___syscall) { 873 sa->code = frame->tf_rdi; 874 reg++; 875 regcnt--; 876 } 877 if (p->p_sysent->sv_mask) 878 sa->code &= p->p_sysent->sv_mask; 879 880 if (sa->code >= p->p_sysent->sv_size) 881 sa->callp = &p->p_sysent->sv_table[0]; 882 else 883 sa->callp = &p->p_sysent->sv_table[sa->code]; 884 885 sa->narg = sa->callp->sy_narg; 886 KASSERT(sa->narg <= sizeof(sa->args) / sizeof(sa->args[0]), 887 ("Too many syscall arguments!")); 888 error = 0; 889 argp = &frame->tf_rdi; 890 argp += reg; 891 bcopy(argp, sa->args, sizeof(sa->args[0]) * regcnt); 892 if (sa->narg > regcnt) { 893 KASSERT(params != NULL, ("copyin args with no params!")); 894 error = copyin(params, &sa->args[regcnt], 895 (sa->narg - regcnt) * sizeof(sa->args[0])); 896 } 897 898 if (error == 0) { 899 td->td_retval[0] = 0; 900 td->td_retval[1] = frame->tf_rdx; 901 } 902 903 return (error); 904 } 905 906 #include "../../kern/subr_syscall.c" 907 908 /* 909 * syscall - system call request C handler 910 * 911 * A system call is essentially treated as a trap. 912 */ 913 void 914 amd64_syscall(struct thread *td, int traced) 915 { 916 struct syscall_args sa; 917 int error; 918 ksiginfo_t ksi; 919 920 #ifdef DIAGNOSTIC 921 if (ISPL(td->td_frame->tf_cs) != SEL_UPL) { 922 panic("syscall"); 923 /* NOT REACHED */ 924 } 925 #endif 926 error = syscallenter(td, &sa); 927 928 /* 929 * Traced syscall. 930 */ 931 if (__predict_false(traced)) { 932 td->td_frame->tf_rflags &= ~PSL_T; 933 ksiginfo_init_trap(&ksi); 934 ksi.ksi_signo = SIGTRAP; 935 ksi.ksi_code = TRAP_TRACE; 936 ksi.ksi_addr = (void *)td->td_frame->tf_rip; 937 trapsignal(td, &ksi); 938 } 939 940 KASSERT(PCB_USER_FPU(td->td_pcb), 941 ("System call %s returing with kernel FPU ctx leaked", 942 syscallname(td->td_proc, sa.code))); 943 KASSERT(td->td_pcb->pcb_save == &td->td_pcb->pcb_user_save, 944 ("System call %s returning with mangled pcb_save", 945 syscallname(td->td_proc, sa.code))); 946 947 syscallret(td, error, &sa); 948 949 /* 950 * If the user-supplied value of %rip is not a canonical 951 * address, then some CPUs will trigger a ring 0 #GP during 952 * the sysret instruction. However, the fault handler would 953 * execute with the user's %gs and %rsp in ring 0 which would 954 * not be safe. Instead, preemptively kill the thread with a 955 * SIGBUS. 956 */ 957 if (td->td_frame->tf_rip >= VM_MAXUSER_ADDRESS) { 958 ksiginfo_init_trap(&ksi); 959 ksi.ksi_signo = SIGBUS; 960 ksi.ksi_code = BUS_OBJERR; 961 ksi.ksi_trapno = T_PROTFLT; 962 ksi.ksi_addr = (void *)td->td_frame->tf_rip; 963 trapsignal(td, &ksi); 964 } 965 }
Cache object: 9de28fa56a3eeb1622cbdadb7bcf8a22
[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]