The Design and Implementation of the FreeBSD Operating System, Second Edition
Now available: The Design and Implementation of the FreeBSD Operating System (Second Edition)


[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]

FreeBSD/Linux Kernel Cross Reference
sys/i386/i386/trap.c

Version: -  FREEBSD  -  FREEBSD-12-STABLE  -  FREEBSD-12-0  -  FREEBSD-11-STABLE  -  FREEBSD-11-2  -  FREEBSD-11-1  -  FREEBSD-11-0  -  FREEBSD-10-STABLE  -  FREEBSD-10-4  -  FREEBSD-10-3  -  FREEBSD-10-2  -  FREEBSD-10-1  -  FREEBSD-10-0  -  FREEBSD-9-STABLE  -  FREEBSD-9-3  -  FREEBSD-9-2  -  FREEBSD-9-1  -  FREEBSD-9-0  -  FREEBSD-8-STABLE  -  FREEBSD-8-4  -  FREEBSD-8-3  -  FREEBSD-8-2  -  FREEBSD-8-1  -  FREEBSD-8-0  -  FREEBSD-7-STABLE  -  FREEBSD-7-4  -  FREEBSD-7-3  -  FREEBSD-7-2  -  FREEBSD-7-1  -  FREEBSD-7-0  -  FREEBSD-6-STABLE  -  FREEBSD-6-4  -  FREEBSD-6-3  -  FREEBSD-6-2  -  FREEBSD-6-1  -  FREEBSD-6-0  -  FREEBSD-5-STABLE  -  FREEBSD-5-5  -  FREEBSD-5-4  -  FREEBSD-5-3  -  FREEBSD-5-2  -  FREEBSD-5-1  -  FREEBSD-5-0  -  FREEBSD-4-STABLE  -  FREEBSD-3-STABLE  -  FREEBSD22  -  linux-2.6  -  linux-2.4.22  -  MK83  -  MK84  -  PLAN9  -  DFBSD  -  NETBSD  -  NETBSD5  -  NETBSD4  -  NETBSD3  -  NETBSD20  -  OPENBSD  -  xnu-517  -  xnu-792  -  xnu-792.6.70  -  xnu-1228  -  xnu-1456.1.26  -  xnu-1699.24.8  -  xnu-2050.18.24  -  OPENSOLARIS  -  minix-3-1-1 
SearchContext: -  none  -  3  -  10 

    1 /*-
    2  * Copyright (C) 1994, David Greenman
    3  * Copyright (c) 1990, 1993
    4  *      The Regents of the University of California.  All rights reserved.
    5  *
    6  * This code is derived from software contributed to Berkeley by
    7  * the University of Utah, and William Jolitz.
    8  *
    9  * Redistribution and use in source and binary forms, with or without
   10  * modification, are permitted provided that the following conditions
   11  * are met:
   12  * 1. Redistributions of source code must retain the above copyright
   13  *    notice, this list of conditions and the following disclaimer.
   14  * 2. Redistributions in binary form must reproduce the above copyright
   15  *    notice, this list of conditions and the following disclaimer in the
   16  *    documentation and/or other materials provided with the distribution.
   17  * 3. All advertising materials mentioning features or use of this software
   18  *    must display the following acknowledgement:
   19  *      This product includes software developed by the University of
   20  *      California, Berkeley and its contributors.
   21  * 4. Neither the name of the University nor the names of its contributors
   22  *    may be used to endorse or promote products derived from this software
   23  *    without specific prior written permission.
   24  *
   25  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
   26  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
   27  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
   28  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
   29  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
   30  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
   31  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
   32  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
   33  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
   34  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
   35  * SUCH DAMAGE.
   36  *
   37  *      from: @(#)trap.c        7.4 (Berkeley) 5/13/91
   38  */
   39 
   40 #include <sys/cdefs.h>
   41 __FBSDID("$FreeBSD: releng/11.2/sys/i386/i386/trap.c 333369 2018-05-08 17:03:33Z emaste $");
   42 
   43 /*
   44  * 386 Trap and System call handling
   45  */
   46 
   47 #include "opt_clock.h"
   48 #include "opt_cpu.h"
   49 #include "opt_hwpmc_hooks.h"
   50 #include "opt_isa.h"
   51 #include "opt_kdb.h"
   52 #include "opt_stack.h"
   53 #include "opt_trap.h"
   54 
   55 #include <sys/param.h>
   56 #include <sys/bus.h>
   57 #include <sys/systm.h>
   58 #include <sys/proc.h>
   59 #include <sys/pioctl.h>
   60 #include <sys/ptrace.h>
   61 #include <sys/kdb.h>
   62 #include <sys/kernel.h>
   63 #include <sys/ktr.h>
   64 #include <sys/lock.h>
   65 #include <sys/mutex.h>
   66 #include <sys/resourcevar.h>
   67 #include <sys/signalvar.h>
   68 #include <sys/syscall.h>
   69 #include <sys/sysctl.h>
   70 #include <sys/sysent.h>
   71 #include <sys/uio.h>
   72 #include <sys/vmmeter.h>
   73 #ifdef HWPMC_HOOKS
   74 #include <sys/pmckern.h>
   75 PMC_SOFT_DEFINE( , , page_fault, all);
   76 PMC_SOFT_DEFINE( , , page_fault, read);
   77 PMC_SOFT_DEFINE( , , page_fault, write);
   78 #endif
   79 #include <security/audit/audit.h>
   80 
   81 #include <vm/vm.h>
   82 #include <vm/vm_param.h>
   83 #include <vm/pmap.h>
   84 #include <vm/vm_kern.h>
   85 #include <vm/vm_map.h>
   86 #include <vm/vm_page.h>
   87 #include <vm/vm_extern.h>
   88 
   89 #include <machine/cpu.h>
   90 #include <machine/intr_machdep.h>
   91 #include <x86/mca.h>
   92 #include <machine/md_var.h>
   93 #include <machine/pcb.h>
   94 #ifdef SMP
   95 #include <machine/smp.h>
   96 #endif
   97 #include <machine/stack.h>
   98 #include <machine/tss.h>
   99 #include <machine/vm86.h>
  100 
  101 #ifdef POWERFAIL_NMI
  102 #include <sys/syslog.h>
  103 #include <machine/clock.h>
  104 #endif
  105 
  106 #ifdef KDTRACE_HOOKS
  107 #include <sys/dtrace_bsd.h>
  108 #endif
  109 
  110 void trap(struct trapframe *frame);
  111 void syscall(struct trapframe *frame);
  112 
  113 static int trap_pfault(struct trapframe *, int, vm_offset_t);
  114 static void trap_fatal(struct trapframe *, vm_offset_t);
  115 void dblfault_handler(void);
  116 
  117 extern inthand_t IDTVEC(lcall_syscall);
  118 
  119 extern inthand_t IDTVEC(bpt), IDTVEC(dbg), IDTVEC(int0x80_syscall);
  120 
  121 #define MAX_TRAP_MSG            32
  122 static char *trap_msg[] = {
  123         "",                                     /*  0 unused */
  124         "privileged instruction fault",         /*  1 T_PRIVINFLT */
  125         "",                                     /*  2 unused */
  126         "breakpoint instruction fault",         /*  3 T_BPTFLT */
  127         "",                                     /*  4 unused */
  128         "",                                     /*  5 unused */
  129         "arithmetic trap",                      /*  6 T_ARITHTRAP */
  130         "",                                     /*  7 unused */
  131         "",                                     /*  8 unused */
  132         "general protection fault",             /*  9 T_PROTFLT */
  133         "trace trap",                           /* 10 T_TRCTRAP */
  134         "",                                     /* 11 unused */
  135         "page fault",                           /* 12 T_PAGEFLT */
  136         "",                                     /* 13 unused */
  137         "alignment fault",                      /* 14 T_ALIGNFLT */
  138         "",                                     /* 15 unused */
  139         "",                                     /* 16 unused */
  140         "",                                     /* 17 unused */
  141         "integer divide fault",                 /* 18 T_DIVIDE */
  142         "non-maskable interrupt trap",          /* 19 T_NMI */
  143         "overflow trap",                        /* 20 T_OFLOW */
  144         "FPU bounds check fault",               /* 21 T_BOUND */
  145         "FPU device not available",             /* 22 T_DNA */
  146         "double fault",                         /* 23 T_DOUBLEFLT */
  147         "FPU operand fetch fault",              /* 24 T_FPOPFLT */
  148         "invalid TSS fault",                    /* 25 T_TSSFLT */
  149         "segment not present fault",            /* 26 T_SEGNPFLT */
  150         "stack fault",                          /* 27 T_STKFLT */
  151         "machine check trap",                   /* 28 T_MCHK */
  152         "SIMD floating-point exception",        /* 29 T_XMMFLT */
  153         "reserved (unknown) fault",             /* 30 T_RESERVED */
  154         "",                                     /* 31 unused (reserved) */
  155         "DTrace pid return trap",               /* 32 T_DTRACE_RET */
  156 };
  157 
  158 #if defined(I586_CPU) && !defined(NO_F00F_HACK)
  159 int has_f00f_bug = 0;           /* Initialized so that it can be patched. */
  160 #endif
  161 
  162 static int prot_fault_translation = 0;
  163 SYSCTL_INT(_machdep, OID_AUTO, prot_fault_translation, CTLFLAG_RW,
  164         &prot_fault_translation, 0, "Select signal to deliver on protection fault");
  165 static int uprintf_signal;
  166 SYSCTL_INT(_machdep, OID_AUTO, uprintf_signal, CTLFLAG_RW,
  167     &uprintf_signal, 0,
  168     "Print debugging information on trap signal to ctty");
  169 
  170 /*
  171  * Exception, fault, and trap interface to the FreeBSD kernel.
  172  * This common code is called from assembly language IDT gate entry
  173  * routines that prepare a suitable stack frame, and restore this
  174  * frame after the exception has been processed.
  175  */
  176 
  177 void
  178 trap(struct trapframe *frame)
  179 {
  180         ksiginfo_t ksi;
  181         struct thread *td;
  182         struct proc *p;
  183 #ifdef KDB
  184         register_t dr6;
  185 #endif
  186         int signo, ucode;
  187         u_int type;
  188         register_t addr;
  189         vm_offset_t eva;
  190 #ifdef POWERFAIL_NMI
  191         static int lastalert = 0;
  192 #endif
  193 
  194         td = curthread;
  195         p = td->td_proc;
  196         signo = 0;
  197         ucode = 0;
  198         addr = 0;
  199 
  200         PCPU_INC(cnt.v_trap);
  201         type = frame->tf_trapno;
  202 
  203 #ifdef SMP
  204         /* Handler for NMI IPIs used for stopping CPUs. */
  205         if (type == T_NMI && ipi_nmi_handler() == 0)
  206                 return;
  207 #endif /* SMP */
  208 
  209 #ifdef KDB
  210         if (kdb_active) {
  211                 kdb_reenter();
  212                 return;
  213         }
  214 #endif
  215 
  216         if (type == T_RESERVED) {
  217                 trap_fatal(frame, 0);
  218                 return;
  219         }
  220 
  221         if (type == T_NMI) {
  222 #ifdef HWPMC_HOOKS
  223                 /*
  224                  * CPU PMCs interrupt using an NMI so we check for that first.
  225                  * If the HWPMC module is active, 'pmc_hook' will point to
  226                  * the function to be called.  A non-zero return value from the
  227                  * hook means that the NMI was consumed by it and that we can
  228                  * return immediately.
  229                  */
  230                 if (pmc_intr != NULL &&
  231                     (*pmc_intr)(PCPU_GET(cpuid), frame) != 0)
  232                         return;
  233 #endif
  234 
  235 #ifdef STACK
  236                 if (stack_nmi_handler(frame) != 0)
  237                         return;
  238 #endif
  239         }
  240 
  241         if (type == T_MCHK) {
  242                 mca_intr();
  243                 return;
  244         }
  245 
  246 #ifdef KDTRACE_HOOKS
  247         /*
  248          * A trap can occur while DTrace executes a probe. Before
  249          * executing the probe, DTrace blocks re-scheduling and sets
  250          * a flag in its per-cpu flags to indicate that it doesn't
  251          * want to fault. On returning from the probe, the no-fault
  252          * flag is cleared and finally re-scheduling is enabled.
  253          */
  254         if ((type == T_PROTFLT || type == T_PAGEFLT) &&
  255             dtrace_trap_func != NULL && (*dtrace_trap_func)(frame, type))
  256                 return;
  257 #endif
  258 
  259         if ((frame->tf_eflags & PSL_I) == 0) {
  260                 /*
  261                  * Buggy application or kernel code has disabled
  262                  * interrupts and then trapped.  Enabling interrupts
  263                  * now is wrong, but it is better than running with
  264                  * interrupts disabled until they are accidentally
  265                  * enabled later.
  266                  */
  267                 if (TRAPF_USERMODE(frame) &&
  268                     (curpcb->pcb_flags & PCB_VM86CALL) == 0)
  269                         uprintf(
  270                             "pid %ld (%s): trap %d with interrupts disabled\n",
  271                             (long)curproc->p_pid, curthread->td_name, type);
  272                 else if (type != T_NMI && type != T_BPTFLT &&
  273                     type != T_TRCTRAP &&
  274                     frame->tf_eip != (int)cpu_switch_load_gs) {
  275                         /*
  276                          * XXX not quite right, since this may be for a
  277                          * multiple fault in user mode.
  278                          */
  279                         printf("kernel trap %d with interrupts disabled\n",
  280                             type);
  281                         /*
  282                          * Page faults need interrupts disabled until later,
  283                          * and we shouldn't enable interrupts while holding
  284                          * a spin lock.
  285                          */
  286                         if (type != T_PAGEFLT &&
  287                             td->td_md.md_spinlock_count == 0)
  288                                 enable_intr();
  289                 }
  290         }
  291         eva = 0;
  292         if (type == T_PAGEFLT) {
  293                 /*
  294                  * For some Cyrix CPUs, %cr2 is clobbered by
  295                  * interrupts.  This problem is worked around by using
  296                  * an interrupt gate for the pagefault handler.  We
  297                  * are finally ready to read %cr2 and conditionally
  298                  * reenable interrupts.  If we hold a spin lock, then
  299                  * we must not reenable interrupts.  This might be a
  300                  * spurious page fault.
  301                  */
  302                 eva = rcr2();
  303                 if (td->td_md.md_spinlock_count == 0)
  304                         enable_intr();
  305         }
  306 
  307         if (TRAPF_USERMODE(frame) && (curpcb->pcb_flags & PCB_VM86CALL) == 0) {
  308                 /* user trap */
  309 
  310                 td->td_pticks = 0;
  311                 td->td_frame = frame;
  312                 addr = frame->tf_eip;
  313                 if (td->td_cowgen != p->p_cowgen)
  314                         thread_cow_update(td);
  315 
  316                 switch (type) {
  317                 case T_PRIVINFLT:       /* privileged instruction fault */
  318                         signo = SIGILL;
  319                         ucode = ILL_PRVOPC;
  320                         break;
  321 
  322                 case T_BPTFLT:          /* bpt instruction fault */
  323                 case T_TRCTRAP:         /* trace trap */
  324                         enable_intr();
  325 #ifdef KDTRACE_HOOKS
  326                         if (type == T_BPTFLT) {
  327                                 if (dtrace_pid_probe_ptr != NULL &&
  328                                     dtrace_pid_probe_ptr(frame) == 0)
  329                                         return;
  330                         }
  331 #endif
  332 user_trctrap_out:
  333                         frame->tf_eflags &= ~PSL_T;
  334                         signo = SIGTRAP;
  335                         ucode = (type == T_TRCTRAP ? TRAP_TRACE : TRAP_BRKPT);
  336                         break;
  337 
  338                 case T_ARITHTRAP:       /* arithmetic trap */
  339                         ucode = npxtrap_x87();
  340                         if (ucode == -1)
  341                                 return;
  342                         signo = SIGFPE;
  343                         break;
  344 
  345                 /*
  346                  * The following two traps can happen in vm86 mode,
  347                  * and, if so, we want to handle them specially.
  348                  */
  349                 case T_PROTFLT:         /* general protection fault */
  350                 case T_STKFLT:          /* stack fault */
  351                         if (frame->tf_eflags & PSL_VM) {
  352                                 signo = vm86_emulate((struct vm86frame *)frame);
  353                                 if (signo == SIGTRAP) {
  354                                         type = T_TRCTRAP;
  355                                         load_dr6(rdr6() | 0x4000);
  356                                         goto user_trctrap_out;
  357                                 }
  358                                 if (signo == 0)
  359                                         goto user;
  360                                 break;
  361                         }
  362                         signo = SIGBUS;
  363                         ucode = (type == T_PROTFLT) ? BUS_OBJERR : BUS_ADRERR;
  364                         break;
  365                 case T_SEGNPFLT:        /* segment not present fault */
  366                         signo = SIGBUS;
  367                         ucode = BUS_ADRERR;
  368                         break;
  369                 case T_TSSFLT:          /* invalid TSS fault */
  370                         signo = SIGBUS;
  371                         ucode = BUS_OBJERR;
  372                         break;
  373                 case T_ALIGNFLT:
  374                         signo = SIGBUS;
  375                         ucode = BUS_ADRALN;
  376                         break;
  377                 case T_DOUBLEFLT:       /* double fault */
  378                 default:
  379                         signo = SIGBUS;
  380                         ucode = BUS_OBJERR;
  381                         break;
  382 
  383                 case T_PAGEFLT:         /* page fault */
  384                         signo = trap_pfault(frame, TRUE, eva);
  385 #if defined(I586_CPU) && !defined(NO_F00F_HACK)
  386                         if (signo == -2) {
  387                                 /*
  388                                  * The f00f hack workaround has triggered, so
  389                                  * treat the fault as an illegal instruction 
  390                                  * (T_PRIVINFLT) instead of a page fault.
  391                                  */
  392                                 type = frame->tf_trapno = T_PRIVINFLT;
  393 
  394                                 /* Proceed as in that case. */
  395                                 ucode = ILL_PRVOPC;
  396                                 signo = SIGILL;
  397                                 break;
  398                         }
  399 #endif
  400                         if (signo == -1)
  401                                 return;
  402                         if (signo == 0)
  403                                 goto user;
  404 
  405                         if (signo == SIGSEGV)
  406                                 ucode = SEGV_MAPERR;
  407                         else if (prot_fault_translation == 0) {
  408                                 /*
  409                                  * Autodetect.  This check also covers
  410                                  * the images without the ABI-tag ELF
  411                                  * note.
  412                                  */
  413                                 if (SV_CURPROC_ABI() == SV_ABI_FREEBSD &&
  414                                     p->p_osrel >= P_OSREL_SIGSEGV) {
  415                                         signo = SIGSEGV;
  416                                         ucode = SEGV_ACCERR;
  417                                 } else {
  418                                         signo = SIGBUS;
  419                                         ucode = BUS_PAGE_FAULT;
  420                                 }
  421                         } else if (prot_fault_translation == 1) {
  422                                 /*
  423                                  * Always compat mode.
  424                                  */
  425                                 signo = SIGBUS;
  426                                 ucode = BUS_PAGE_FAULT;
  427                         } else {
  428                                 /*
  429                                  * Always SIGSEGV mode.
  430                                  */
  431                                 signo = SIGSEGV;
  432                                 ucode = SEGV_ACCERR;
  433                         }
  434                         addr = eva;
  435                         break;
  436 
  437                 case T_DIVIDE:          /* integer divide fault */
  438                         ucode = FPE_INTDIV;
  439                         signo = SIGFPE;
  440                         break;
  441 
  442 #ifdef DEV_ISA
  443                 case T_NMI:
  444 #ifdef POWERFAIL_NMI
  445 #ifndef TIMER_FREQ
  446 #  define TIMER_FREQ 1193182
  447 #endif
  448                         if (time_second - lastalert > 10) {
  449                                 log(LOG_WARNING, "NMI: power fail\n");
  450                                 sysbeep(880, hz);
  451                                 lastalert = time_second;
  452                         }
  453                         return;
  454 #else /* !POWERFAIL_NMI */
  455                         nmi_handle_intr(type, frame);
  456                         return;
  457 #endif /* POWERFAIL_NMI */
  458 #endif /* DEV_ISA */
  459 
  460                 case T_OFLOW:           /* integer overflow fault */
  461                         ucode = FPE_INTOVF;
  462                         signo = SIGFPE;
  463                         break;
  464 
  465                 case T_BOUND:           /* bounds check fault */
  466                         ucode = FPE_FLTSUB;
  467                         signo = SIGFPE;
  468                         break;
  469 
  470                 case T_DNA:
  471                         KASSERT(PCB_USER_FPU(td->td_pcb),
  472                             ("kernel FPU ctx has leaked"));
  473                         /* transparent fault (due to context switch "late") */
  474                         if (npxdna())
  475                                 return;
  476                         uprintf("pid %d killed due to lack of floating point\n",
  477                                 p->p_pid);
  478                         signo = SIGKILL;
  479                         ucode = 0;
  480                         break;
  481 
  482                 case T_FPOPFLT:         /* FPU operand fetch fault */
  483                         ucode = ILL_COPROC;
  484                         signo = SIGILL;
  485                         break;
  486 
  487                 case T_XMMFLT:          /* SIMD floating-point exception */
  488                         ucode = npxtrap_sse();
  489                         if (ucode == -1)
  490                                 return;
  491                         signo = SIGFPE;
  492                         break;
  493 #ifdef KDTRACE_HOOKS
  494                 case T_DTRACE_RET:
  495                         enable_intr();
  496                         if (dtrace_return_probe_ptr != NULL)
  497                                 dtrace_return_probe_ptr(frame);
  498                         return;
  499 #endif
  500                 }
  501         } else {
  502                 /* kernel trap */
  503 
  504                 KASSERT(cold || td->td_ucred != NULL,
  505                     ("kernel trap doesn't have ucred"));
  506                 switch (type) {
  507                 case T_PAGEFLT:                 /* page fault */
  508                         (void) trap_pfault(frame, FALSE, eva);
  509                         return;
  510 
  511                 case T_DNA:
  512                         if (PCB_USER_FPU(td->td_pcb))
  513                                 panic("Unregistered use of FPU in kernel");
  514                         if (npxdna())
  515                                 return;
  516                         break;
  517 
  518                 case T_ARITHTRAP:       /* arithmetic trap */
  519                 case T_XMMFLT:          /* SIMD floating-point exception */
  520                 case T_FPOPFLT:         /* FPU operand fetch fault */
  521                         /*
  522                          * XXXKIB for now disable any FPU traps in kernel
  523                          * handler registration seems to be overkill
  524                          */
  525                         trap_fatal(frame, 0);
  526                         return;
  527 
  528                         /*
  529                          * The following two traps can happen in
  530                          * vm86 mode, and, if so, we want to handle
  531                          * them specially.
  532                          */
  533                 case T_PROTFLT:         /* general protection fault */
  534                 case T_STKFLT:          /* stack fault */
  535                         if (frame->tf_eflags & PSL_VM) {
  536                                 signo = vm86_emulate((struct vm86frame *)frame);
  537                                 if (signo == SIGTRAP) {
  538                                         type = T_TRCTRAP;
  539                                         load_dr6(rdr6() | 0x4000);
  540                                         goto kernel_trctrap;
  541                                 }
  542                                 if (signo != 0)
  543                                         /*
  544                                          * returns to original process
  545                                          */
  546                                         vm86_trap((struct vm86frame *)frame);
  547                                 return;
  548                         }
  549                         /* FALL THROUGH */
  550                 case T_SEGNPFLT:        /* segment not present fault */
  551                         if (curpcb->pcb_flags & PCB_VM86CALL)
  552                                 break;
  553 
  554                         /*
  555                          * Invalid %fs's and %gs's can be created using
  556                          * procfs or PT_SETREGS or by invalidating the
  557                          * underlying LDT entry.  This causes a fault
  558                          * in kernel mode when the kernel attempts to
  559                          * switch contexts.  Lose the bad context
  560                          * (XXX) so that we can continue, and generate
  561                          * a signal.
  562                          */
  563                         if (frame->tf_eip == (int)cpu_switch_load_gs) {
  564                                 curpcb->pcb_gs = 0;
  565 #if 0                           
  566                                 PROC_LOCK(p);
  567                                 kern_psignal(p, SIGBUS);
  568                                 PROC_UNLOCK(p);
  569 #endif                          
  570                                 return;
  571                         }
  572 
  573                         if (td->td_intr_nesting_level != 0)
  574                                 break;
  575 
  576                         /*
  577                          * Invalid segment selectors and out of bounds
  578                          * %eip's and %esp's can be set up in user mode.
  579                          * This causes a fault in kernel mode when the
  580                          * kernel tries to return to user mode.  We want
  581                          * to get this fault so that we can fix the
  582                          * problem here and not have to check all the
  583                          * selectors and pointers when the user changes
  584                          * them.
  585                          */
  586                         if (frame->tf_eip == (int)doreti_iret) {
  587                                 frame->tf_eip = (int)doreti_iret_fault;
  588                                 return;
  589                         }
  590                         if (type == T_STKFLT)
  591                                 break;
  592 
  593                         if (frame->tf_eip == (int)doreti_popl_ds) {
  594                                 frame->tf_eip = (int)doreti_popl_ds_fault;
  595                                 return;
  596                         }
  597                         if (frame->tf_eip == (int)doreti_popl_es) {
  598                                 frame->tf_eip = (int)doreti_popl_es_fault;
  599                                 return;
  600                         }
  601                         if (frame->tf_eip == (int)doreti_popl_fs) {
  602                                 frame->tf_eip = (int)doreti_popl_fs_fault;
  603                                 return;
  604                         }
  605                         if (curpcb->pcb_onfault != NULL) {
  606                                 frame->tf_eip = (int)curpcb->pcb_onfault;
  607                                 return;
  608                         }
  609                         break;
  610 
  611                 case T_TSSFLT:
  612                         /*
  613                          * PSL_NT can be set in user mode and isn't cleared
  614                          * automatically when the kernel is entered.  This
  615                          * causes a TSS fault when the kernel attempts to
  616                          * `iret' because the TSS link is uninitialized.  We
  617                          * want to get this fault so that we can fix the
  618                          * problem here and not every time the kernel is
  619                          * entered.
  620                          */
  621                         if (frame->tf_eflags & PSL_NT) {
  622                                 frame->tf_eflags &= ~PSL_NT;
  623                                 return;
  624                         }
  625                         break;
  626 
  627                 case T_TRCTRAP:  /* trace trap */
  628 kernel_trctrap:
  629                         if (frame->tf_eip == (int)IDTVEC(lcall_syscall)) {
  630                                 /*
  631                                  * We've just entered system mode via the
  632                                  * syscall lcall.  Continue single stepping
  633                                  * silently until the syscall handler has
  634                                  * saved the flags.
  635                                  */
  636                                 return;
  637                         }
  638                         if (frame->tf_eip == (int)IDTVEC(lcall_syscall) + 1) {
  639                                 /*
  640                                  * The syscall handler has now saved the
  641                                  * flags.  Stop single stepping it.
  642                                  */
  643                                 frame->tf_eflags &= ~PSL_T;
  644                                 return;
  645                         }
  646                         /*
  647                          * Ignore debug register trace traps due to
  648                          * accesses in the user's address space, which
  649                          * can happen under several conditions such as
  650                          * if a user sets a watchpoint on a buffer and
  651                          * then passes that buffer to a system call.
  652                          * We still want to get TRCTRAPS for addresses
  653                          * in kernel space because that is useful when
  654                          * debugging the kernel.
  655                          */
  656                         if (user_dbreg_trap() && 
  657                            !(curpcb->pcb_flags & PCB_VM86CALL)) {
  658                                 /*
  659                                  * Reset breakpoint bits because the
  660                                  * processor doesn't
  661                                  */
  662                                 load_dr6(rdr6() & ~0xf);
  663                                 return;
  664                         }
  665 
  666                         /*
  667                          * Malicious user code can configure a debug
  668                          * register watchpoint to trap on data access
  669                          * to the top of stack and then execute 'pop
  670                          * %ss; int 3'.  Due to exception deferral for
  671                          * 'pop %ss', the CPU will not interrupt 'int
  672                          * 3' to raise the DB# exception for the debug
  673                          * register but will postpone the DB# until
  674                          * execution of the first instruction of the
  675                          * BP# handler (in kernel mode).  Normally the
  676                          * previous check would ignore DB# exceptions
  677                          * for watchpoints on user addresses raised in
  678                          * kernel mode.  However, some CPU errata
  679                          * include cases where DB# exceptions do not
  680                          * properly set bits in %dr6, e.g. Haswell
  681                          * HSD23 and Skylake-X SKZ24.
  682                          *
  683                          * A deferred DB# can also be raised on the
  684                          * first instructions of system call entry
  685                          * points or single-step traps via similar use
  686                          * of 'pop %ss' or 'mov xxx, %ss'.
  687                          */
  688                         if (frame->tf_eip ==
  689                             (uintptr_t)IDTVEC(int0x80_syscall) ||
  690                             frame->tf_eip == (uintptr_t)IDTVEC(bpt) ||
  691                             frame->tf_eip == (uintptr_t)IDTVEC(dbg))
  692                                 return;
  693                         /*
  694                          * FALLTHROUGH (TRCTRAP kernel mode, kernel address)
  695                          */
  696                 case T_BPTFLT:
  697                         /*
  698                          * If KDB is enabled, let it handle the debugger trap.
  699                          * Otherwise, debugger traps "can't happen".
  700                          */
  701 #ifdef KDB
  702                         /* XXX %dr6 is not quite reentrant. */
  703                         dr6 = rdr6();
  704                         load_dr6(dr6 & ~0x4000);
  705                         if (kdb_trap(type, dr6, frame))
  706                                 return;
  707 #endif
  708                         break;
  709 
  710 #ifdef DEV_ISA
  711                 case T_NMI:
  712 #ifdef POWERFAIL_NMI
  713                         if (time_second - lastalert > 10) {
  714                                 log(LOG_WARNING, "NMI: power fail\n");
  715                                 sysbeep(880, hz);
  716                                 lastalert = time_second;
  717                         }
  718                         return;
  719 #else /* !POWERFAIL_NMI */
  720                         nmi_handle_intr(type, frame);
  721                         return;
  722 #endif /* POWERFAIL_NMI */
  723 #endif /* DEV_ISA */
  724                 }
  725 
  726                 trap_fatal(frame, eva);
  727                 return;
  728         }
  729 
  730         /* Translate fault for emulators (e.g. Linux) */
  731         if (*p->p_sysent->sv_transtrap != NULL)
  732                 signo = (*p->p_sysent->sv_transtrap)(signo, type);
  733 
  734         ksiginfo_init_trap(&ksi);
  735         ksi.ksi_signo = signo;
  736         ksi.ksi_code = ucode;
  737         ksi.ksi_addr = (void *)addr;
  738         ksi.ksi_trapno = type;
  739         if (uprintf_signal) {
  740                 uprintf("pid %d comm %s: signal %d err %x code %d type %d "
  741                     "addr 0x%x esp 0x%08x eip 0x%08x "
  742                     "<%02x %02x %02x %02x %02x %02x %02x %02x>\n",
  743                     p->p_pid, p->p_comm, signo, frame->tf_err, ucode, type,
  744                     addr, frame->tf_esp, frame->tf_eip,
  745                     fubyte((void *)(frame->tf_eip + 0)),
  746                     fubyte((void *)(frame->tf_eip + 1)),
  747                     fubyte((void *)(frame->tf_eip + 2)),
  748                     fubyte((void *)(frame->tf_eip + 3)),
  749                     fubyte((void *)(frame->tf_eip + 4)),
  750                     fubyte((void *)(frame->tf_eip + 5)),
  751                     fubyte((void *)(frame->tf_eip + 6)),
  752                     fubyte((void *)(frame->tf_eip + 7)));
  753         }
  754         KASSERT((read_eflags() & PSL_I) != 0, ("interrupts disabled"));
  755         trapsignal(td, &ksi);
  756 
  757 user:
  758         userret(td, frame);
  759         KASSERT(PCB_USER_FPU(td->td_pcb),
  760             ("Return from trap with kernel FPU ctx leaked"));
  761 }
  762 
  763 static int
  764 trap_pfault(struct trapframe *frame, int usermode, vm_offset_t eva)
  765 {
  766         struct thread *td;
  767         struct proc *p;
  768         vm_offset_t va;
  769         vm_map_t map;
  770         int rv;
  771         vm_prot_t ftype;
  772 
  773         td = curthread;
  774         p = td->td_proc;
  775 
  776         if (__predict_false((td->td_pflags & TDP_NOFAULTING) != 0)) {
  777                 /*
  778                  * Due to both processor errata and lazy TLB invalidation when
  779                  * access restrictions are removed from virtual pages, memory
  780                  * accesses that are allowed by the physical mapping layer may
  781                  * nonetheless cause one spurious page fault per virtual page. 
  782                  * When the thread is executing a "no faulting" section that
  783                  * is bracketed by vm_fault_{disable,enable}_pagefaults(),
  784                  * every page fault is treated as a spurious page fault,
  785                  * unless it accesses the same virtual address as the most
  786                  * recent page fault within the same "no faulting" section.
  787                  */
  788                 if (td->td_md.md_spurflt_addr != eva ||
  789                     (td->td_pflags & TDP_RESETSPUR) != 0) {
  790                         /*
  791                          * Do nothing to the TLB.  A stale TLB entry is
  792                          * flushed automatically by a page fault.
  793                          */
  794                         td->td_md.md_spurflt_addr = eva;
  795                         td->td_pflags &= ~TDP_RESETSPUR;
  796                         return (0);
  797                 }
  798         } else {
  799                 /*
  800                  * If we get a page fault while in a critical section, then
  801                  * it is most likely a fatal kernel page fault.  The kernel
  802                  * is already going to panic trying to get a sleep lock to
  803                  * do the VM lookup, so just consider it a fatal trap so the
  804                  * kernel can print out a useful trap message and even get
  805                  * to the debugger.
  806                  *
  807                  * If we get a page fault while holding a non-sleepable
  808                  * lock, then it is most likely a fatal kernel page fault.
  809                  * If WITNESS is enabled, then it's going to whine about
  810                  * bogus LORs with various VM locks, so just skip to the
  811                  * fatal trap handling directly.
  812                  */
  813                 if (td->td_critnest != 0 ||
  814                     WITNESS_CHECK(WARN_SLEEPOK | WARN_GIANTOK, NULL,
  815                     "Kernel page fault") != 0) {
  816                         trap_fatal(frame, eva);
  817                         return (-1);
  818                 }
  819         }
  820         va = trunc_page(eva);
  821         if (va >= KERNBASE) {
  822                 /*
  823                  * Don't allow user-mode faults in kernel address space.
  824                  * An exception:  if the faulting address is the invalid
  825                  * instruction entry in the IDT, then the Intel Pentium
  826                  * F00F bug workaround was triggered, and we need to
  827                  * treat it is as an illegal instruction, and not a page
  828                  * fault.
  829                  */
  830 #if defined(I586_CPU) && !defined(NO_F00F_HACK)
  831                 if ((eva == (unsigned int)&idt[6]) && has_f00f_bug)
  832                         return (-2);
  833 #endif
  834                 if (usermode)
  835                         return (SIGSEGV);
  836 
  837                 map = kernel_map;
  838         } else {
  839                 map = &p->p_vmspace->vm_map;
  840 
  841                 /*
  842                  * When accessing a user-space address, kernel must be
  843                  * ready to accept the page fault, and provide a
  844                  * handling routine.  Since accessing the address
  845                  * without the handler is a bug, do not try to handle
  846                  * it normally, and panic immediately.
  847                  */
  848                 if (!usermode && (td->td_intr_nesting_level != 0 ||
  849                     curpcb->pcb_onfault == NULL)) {
  850                         trap_fatal(frame, eva);
  851                         return (-1);
  852                 }
  853         }
  854 
  855         /*
  856          * If the trap was caused by errant bits in the PTE then panic.
  857          */
  858         if (frame->tf_err & PGEX_RSV) {
  859                 trap_fatal(frame, eva);
  860                 return (-1);
  861         }
  862 
  863         /*
  864          * PGEX_I is defined only if the execute disable bit capability is
  865          * supported and enabled.
  866          */
  867         if (frame->tf_err & PGEX_W)
  868                 ftype = VM_PROT_WRITE;
  869 #if defined(PAE) || defined(PAE_TABLES)
  870         else if ((frame->tf_err & PGEX_I) && pg_nx != 0)
  871                 ftype = VM_PROT_EXECUTE;
  872 #endif
  873         else
  874                 ftype = VM_PROT_READ;
  875 
  876         /* Fault in the page. */
  877         rv = vm_fault(map, va, ftype, VM_FAULT_NORMAL);
  878         if (rv == KERN_SUCCESS) {
  879 #ifdef HWPMC_HOOKS
  880                 if (ftype == VM_PROT_READ || ftype == VM_PROT_WRITE) {
  881                         PMC_SOFT_CALL_TF( , , page_fault, all, frame);
  882                         if (ftype == VM_PROT_READ)
  883                                 PMC_SOFT_CALL_TF( , , page_fault, read,
  884                                     frame);
  885                         else
  886                                 PMC_SOFT_CALL_TF( , , page_fault, write,
  887                                     frame);
  888                 }
  889 #endif
  890                 return (0);
  891         }
  892         if (!usermode) {
  893                 if (td->td_intr_nesting_level == 0 &&
  894                     curpcb->pcb_onfault != NULL) {
  895                         frame->tf_eip = (int)curpcb->pcb_onfault;
  896                         return (0);
  897                 }
  898                 trap_fatal(frame, eva);
  899                 return (-1);
  900         }
  901         return ((rv == KERN_PROTECTION_FAILURE) ? SIGBUS : SIGSEGV);
  902 }
  903 
  904 static void
  905 trap_fatal(frame, eva)
  906         struct trapframe *frame;
  907         vm_offset_t eva;
  908 {
  909         int code, ss, esp;
  910         u_int type;
  911         struct soft_segment_descriptor softseg;
  912         char *msg;
  913 #ifdef KDB
  914         bool handled;
  915 #endif
  916 
  917         code = frame->tf_err;
  918         type = frame->tf_trapno;
  919         sdtossd(&gdt[IDXSEL(frame->tf_cs & 0xffff)].sd, &softseg);
  920 
  921         if (type <= MAX_TRAP_MSG)
  922                 msg = trap_msg[type];
  923         else
  924                 msg = "UNKNOWN";
  925         printf("\n\nFatal trap %d: %s while in %s mode\n", type, msg,
  926             frame->tf_eflags & PSL_VM ? "vm86" :
  927             ISPL(frame->tf_cs) == SEL_UPL ? "user" : "kernel");
  928 #ifdef SMP
  929         /* two separate prints in case of a trap on an unmapped page */
  930         printf("cpuid = %d; ", PCPU_GET(cpuid));
  931         printf("apic id = %02x\n", PCPU_GET(apic_id));
  932 #endif
  933         if (type == T_PAGEFLT) {
  934                 printf("fault virtual address   = 0x%x\n", eva);
  935                 printf("fault code              = %s %s%s, %s\n",
  936                         code & PGEX_U ? "user" : "supervisor",
  937                         code & PGEX_W ? "write" : "read",
  938 #if defined(PAE) || defined(PAE_TABLES)
  939                         pg_nx != 0 ?
  940                         (code & PGEX_I ? " instruction" : " data") :
  941 #endif
  942                         "",
  943                         code & PGEX_RSV ? "reserved bits in PTE" :
  944                         code & PGEX_P ? "protection violation" : "page not present");
  945         } else {
  946                 printf("error code              = %#x\n", code);
  947         }
  948         printf("instruction pointer     = 0x%x:0x%x\n",
  949                frame->tf_cs & 0xffff, frame->tf_eip);
  950         if (TF_HAS_STACKREGS(frame)) {
  951                 ss = frame->tf_ss & 0xffff;
  952                 esp = frame->tf_esp;
  953         } else {
  954                 ss = GSEL(GDATA_SEL, SEL_KPL);
  955                 esp = (int)&frame->tf_esp;
  956         }
  957         printf("stack pointer           = 0x%x:0x%x\n", ss, esp);
  958         printf("frame pointer           = 0x%x:0x%x\n", ss, frame->tf_ebp);
  959         printf("code segment            = base 0x%x, limit 0x%x, type 0x%x\n",
  960                softseg.ssd_base, softseg.ssd_limit, softseg.ssd_type);
  961         printf("                        = DPL %d, pres %d, def32 %d, gran %d\n",
  962                softseg.ssd_dpl, softseg.ssd_p, softseg.ssd_def32,
  963                softseg.ssd_gran);
  964         printf("processor eflags        = ");
  965         if (frame->tf_eflags & PSL_T)
  966                 printf("trace trap, ");
  967         if (frame->tf_eflags & PSL_I)
  968                 printf("interrupt enabled, ");
  969         if (frame->tf_eflags & PSL_NT)
  970                 printf("nested task, ");
  971         if (frame->tf_eflags & PSL_RF)
  972                 printf("resume, ");
  973         if (frame->tf_eflags & PSL_VM)
  974                 printf("vm86, ");
  975         printf("IOPL = %d\n", (frame->tf_eflags & PSL_IOPL) >> 12);
  976         printf("current process         = %d (%s)\n",
  977             curproc->p_pid, curthread->td_name);
  978 
  979 #ifdef KDB
  980         if (debugger_on_panic) {
  981                 kdb_why = KDB_WHY_TRAP;
  982                 frame->tf_err = eva;    /* smuggle fault address to ddb */
  983                 handled = kdb_trap(type, 0, frame);
  984                 frame->tf_err = code;   /* restore error code */
  985                 kdb_why = KDB_WHY_UNSET;
  986                 if (handled)
  987                         return;
  988         }
  989 #endif
  990         printf("trap number             = %d\n", type);
  991         if (type <= MAX_TRAP_MSG)
  992                 panic("%s", trap_msg[type]);
  993         else
  994                 panic("unknown/reserved trap");
  995 }
  996 
  997 /*
  998  * Double fault handler. Called when a fault occurs while writing
  999  * a frame for a trap/exception onto the stack. This usually occurs
 1000  * when the stack overflows (such is the case with infinite recursion,
 1001  * for example).
 1002  *
 1003  * XXX Note that the current PTD gets replaced by IdlePTD when the
 1004  * task switch occurs. This means that the stack that was active at
 1005  * the time of the double fault is not available at <kstack> unless
 1006  * the machine was idle when the double fault occurred. The downside
 1007  * of this is that "trace <ebp>" in ddb won't work.
 1008  */
 1009 void
 1010 dblfault_handler()
 1011 {
 1012 #ifdef KDTRACE_HOOKS
 1013         if (dtrace_doubletrap_func != NULL)
 1014                 (*dtrace_doubletrap_func)();
 1015 #endif
 1016         printf("\nFatal double fault:\n");
 1017         printf("eip = 0x%x\n", PCPU_GET(common_tss.tss_eip));
 1018         printf("esp = 0x%x\n", PCPU_GET(common_tss.tss_esp));
 1019         printf("ebp = 0x%x\n", PCPU_GET(common_tss.tss_ebp));
 1020 #ifdef SMP
 1021         /* two separate prints in case of a trap on an unmapped page */
 1022         printf("cpuid = %d; ", PCPU_GET(cpuid));
 1023         printf("apic id = %02x\n", PCPU_GET(apic_id));
 1024 #endif
 1025         panic("double fault");
 1026 }
 1027 
 1028 int
 1029 cpu_fetch_syscall_args(struct thread *td)
 1030 {
 1031         struct proc *p;
 1032         struct trapframe *frame;
 1033         struct syscall_args *sa;
 1034         caddr_t params;
 1035         long tmp;
 1036         int error;
 1037 
 1038         p = td->td_proc;
 1039         frame = td->td_frame;
 1040         sa = &td->td_sa;
 1041 
 1042         params = (caddr_t)frame->tf_esp + sizeof(int);
 1043         sa->code = frame->tf_eax;
 1044 
 1045         /*
 1046          * Need to check if this is a 32 bit or 64 bit syscall.
 1047          */
 1048         if (sa->code == SYS_syscall) {
 1049                 /*
 1050                  * Code is first argument, followed by actual args.
 1051                  */
 1052                 error = fueword(params, &tmp);
 1053                 if (error == -1)
 1054                         return (EFAULT);
 1055                 sa->code = tmp;
 1056                 params += sizeof(int);
 1057         } else if (sa->code == SYS___syscall) {
 1058                 /*
 1059                  * Like syscall, but code is a quad, so as to maintain
 1060                  * quad alignment for the rest of the arguments.
 1061                  */
 1062                 error = fueword(params, &tmp);
 1063                 if (error == -1)
 1064                         return (EFAULT);
 1065                 sa->code = tmp;
 1066                 params += sizeof(quad_t);
 1067         }
 1068 
 1069         if (p->p_sysent->sv_mask)
 1070                 sa->code &= p->p_sysent->sv_mask;
 1071         if (sa->code >= p->p_sysent->sv_size)
 1072                 sa->callp = &p->p_sysent->sv_table[0];
 1073         else
 1074                 sa->callp = &p->p_sysent->sv_table[sa->code];
 1075         sa->narg = sa->callp->sy_narg;
 1076 
 1077         if (params != NULL && sa->narg != 0)
 1078                 error = copyin(params, (caddr_t)sa->args,
 1079                     (u_int)(sa->narg * sizeof(int)));
 1080         else
 1081                 error = 0;
 1082 
 1083         if (error == 0) {
 1084                 td->td_retval[0] = 0;
 1085                 td->td_retval[1] = frame->tf_edx;
 1086         }
 1087                 
 1088         return (error);
 1089 }
 1090 
 1091 #include "../../kern/subr_syscall.c"
 1092 
 1093 /*
 1094  * syscall - system call request C handler.  A system call is
 1095  * essentially treated as a trap by reusing the frame layout.
 1096  */
 1097 void
 1098 syscall(struct trapframe *frame)
 1099 {
 1100         struct thread *td;
 1101         register_t orig_tf_eflags;
 1102         int error;
 1103         ksiginfo_t ksi;
 1104 
 1105 #ifdef DIAGNOSTIC
 1106         if (!(TRAPF_USERMODE(frame) &&
 1107             (curpcb->pcb_flags & PCB_VM86CALL) == 0)) {
 1108                 panic("syscall");
 1109                 /* NOT REACHED */
 1110         }
 1111 #endif
 1112         orig_tf_eflags = frame->tf_eflags;
 1113 
 1114         td = curthread;
 1115         td->td_frame = frame;
 1116 
 1117         error = syscallenter(td);
 1118 
 1119         /*
 1120          * Traced syscall.
 1121          */
 1122         if ((orig_tf_eflags & PSL_T) && !(orig_tf_eflags & PSL_VM)) {
 1123                 frame->tf_eflags &= ~PSL_T;
 1124                 ksiginfo_init_trap(&ksi);
 1125                 ksi.ksi_signo = SIGTRAP;
 1126                 ksi.ksi_code = TRAP_TRACE;
 1127                 ksi.ksi_addr = (void *)frame->tf_eip;
 1128                 trapsignal(td, &ksi);
 1129         }
 1130 
 1131         KASSERT(PCB_USER_FPU(td->td_pcb),
 1132             ("System call %s returning with kernel FPU ctx leaked",
 1133              syscallname(td->td_proc, td->td_sa.code)));
 1134         KASSERT(td->td_pcb->pcb_save == get_pcb_user_save_td(td),
 1135             ("System call %s returning with mangled pcb_save",
 1136              syscallname(td->td_proc, td->td_sa.code)));
 1137 
 1138         syscallret(td, error);
 1139 }

Cache object: f25acd404612e12e33e46915dee5b907


[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]


This page is part of the FreeBSD/Linux Linux Kernel Cross-Reference, and was automatically generated using a modified version of the LXR engine.