Now available: The Design and Implementation of the FreeBSD Operating System (Second Edition)
[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]
FreeBSD/Linux Kernel Cross Reference
sys/i386/i386/trap.c
Version:
- FREEBSD - FREEBSD-13-STABLE - FREEBSD-13-0 - FREEBSD-12-STABLE - FREEBSD-12-0 - FREEBSD-11-STABLE - FREEBSD-11-0 - FREEBSD-10-STABLE - FREEBSD-10-0 - FREEBSD-9-STABLE - FREEBSD-9-0 - FREEBSD-8-STABLE - FREEBSD-8-0 - FREEBSD-7-STABLE - FREEBSD-7-0 - FREEBSD-6-STABLE - FREEBSD-6-0 - FREEBSD-5-STABLE - FREEBSD-5-0 - FREEBSD-4-STABLE - FREEBSD-3-STABLE - FREEBSD22 - l41 - OPENBSD - linux-2.6 - MK84 - PLAN9 - xnu-8792
SearchContext: - none - 3 - 10
SearchContext: - none - 3 - 10
1 /*- 2 * Copyright (C) 1994, David Greenman 3 * Copyright (c) 1990, 1993 4 * The Regents of the University of California. All rights reserved. 5 * 6 * This code is derived from software contributed to Berkeley by 7 * the University of Utah, and William Jolitz. 8 * 9 * Redistribution and use in source and binary forms, with or without 10 * modification, are permitted provided that the following conditions 11 * are met: 12 * 1. Redistributions of source code must retain the above copyright 13 * notice, this list of conditions and the following disclaimer. 14 * 2. Redistributions in binary form must reproduce the above copyright 15 * notice, this list of conditions and the following disclaimer in the 16 * documentation and/or other materials provided with the distribution. 17 * 3. All advertising materials mentioning features or use of this software 18 * must display the following acknowledgement: 19 * This product includes software developed by the University of 20 * California, Berkeley and its contributors. 21 * 4. Neither the name of the University nor the names of its contributors 22 * may be used to endorse or promote products derived from this software 23 * without specific prior written permission. 24 * 25 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 26 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 27 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 28 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 29 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 30 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 31 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 32 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 33 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 34 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 35 * SUCH DAMAGE. 36 * 37 * from: @(#)trap.c 7.4 (Berkeley) 5/13/91 38 */ 39 40 #include <sys/cdefs.h> 41 __FBSDID("$FreeBSD: releng/5.4/sys/i386/i386/trap.c 145750 2005-05-01 05:38:14Z dwhite $"); 42 43 /* 44 * 386 Trap and System call handling 45 */ 46 47 #include "opt_clock.h" 48 #include "opt_cpu.h" 49 #include "opt_isa.h" 50 #include "opt_ktrace.h" 51 #include "opt_npx.h" 52 #include "opt_trap.h" 53 54 #include <sys/param.h> 55 #include <sys/bus.h> 56 #include <sys/systm.h> 57 #include <sys/proc.h> 58 #include <sys/pioctl.h> 59 #include <sys/ptrace.h> 60 #include <sys/kdb.h> 61 #include <sys/kernel.h> 62 #include <sys/ktr.h> 63 #include <sys/lock.h> 64 #include <sys/mutex.h> 65 #include <sys/resourcevar.h> 66 #include <sys/signalvar.h> 67 #include <sys/syscall.h> 68 #include <sys/sysctl.h> 69 #include <sys/sysent.h> 70 #include <sys/uio.h> 71 #include <sys/vmmeter.h> 72 #ifdef KTRACE 73 #include <sys/ktrace.h> 74 #endif 75 76 #include <vm/vm.h> 77 #include <vm/vm_param.h> 78 #include <vm/pmap.h> 79 #include <vm/vm_kern.h> 80 #include <vm/vm_map.h> 81 #include <vm/vm_page.h> 82 #include <vm/vm_extern.h> 83 84 #include <machine/cpu.h> 85 #include <machine/intr_machdep.h> 86 #include <machine/md_var.h> 87 #include <machine/pcb.h> 88 #ifdef SMP 89 #include <machine/smp.h> 90 #endif 91 #include <machine/tss.h> 92 #include <machine/vm86.h> 93 94 #ifdef POWERFAIL_NMI 95 #include <sys/syslog.h> 96 #include <machine/clock.h> 97 #endif 98 99 extern void trap(struct trapframe frame); 100 #ifdef I386_CPU 101 extern int trapwrite(unsigned addr); 102 #endif 103 extern void syscall(struct trapframe frame); 104 105 static int trap_pfault(struct trapframe *, int, vm_offset_t); 106 static void trap_fatal(struct trapframe *, vm_offset_t); 107 void dblfault_handler(void); 108 109 extern inthand_t IDTVEC(lcall_syscall); 110 111 #define MAX_TRAP_MSG 28 112 static char *trap_msg[] = { 113 "", /* 0 unused */ 114 "privileged instruction fault", /* 1 T_PRIVINFLT */ 115 "", /* 2 unused */ 116 "breakpoint instruction fault", /* 3 T_BPTFLT */ 117 "", /* 4 unused */ 118 "", /* 5 unused */ 119 "arithmetic trap", /* 6 T_ARITHTRAP */ 120 "", /* 7 unused */ 121 "", /* 8 unused */ 122 "general protection fault", /* 9 T_PROTFLT */ 123 "trace trap", /* 10 T_TRCTRAP */ 124 "", /* 11 unused */ 125 "page fault", /* 12 T_PAGEFLT */ 126 "", /* 13 unused */ 127 "alignment fault", /* 14 T_ALIGNFLT */ 128 "", /* 15 unused */ 129 "", /* 16 unused */ 130 "", /* 17 unused */ 131 "integer divide fault", /* 18 T_DIVIDE */ 132 "non-maskable interrupt trap", /* 19 T_NMI */ 133 "overflow trap", /* 20 T_OFLOW */ 134 "FPU bounds check fault", /* 21 T_BOUND */ 135 "FPU device not available", /* 22 T_DNA */ 136 "double fault", /* 23 T_DOUBLEFLT */ 137 "FPU operand fetch fault", /* 24 T_FPOPFLT */ 138 "invalid TSS fault", /* 25 T_TSSFLT */ 139 "segment not present fault", /* 26 T_SEGNPFLT */ 140 "stack fault", /* 27 T_STKFLT */ 141 "machine check trap", /* 28 T_MCHK */ 142 }; 143 144 #if defined(I586_CPU) && !defined(NO_F00F_HACK) 145 extern int has_f00f_bug; 146 #endif 147 148 #ifdef KDB 149 static int kdb_on_nmi = 1; 150 SYSCTL_INT(_machdep, OID_AUTO, kdb_on_nmi, CTLFLAG_RW, 151 &kdb_on_nmi, 0, "Go to KDB on NMI"); 152 #endif 153 static int panic_on_nmi = 1; 154 SYSCTL_INT(_machdep, OID_AUTO, panic_on_nmi, CTLFLAG_RW, 155 &panic_on_nmi, 0, "Panic on NMI"); 156 157 #ifdef WITNESS 158 extern char *syscallnames[]; 159 #endif 160 161 #ifdef DEVICE_POLLING 162 extern u_int32_t poll_in_trap; 163 extern int ether_poll(int count); 164 #endif /* DEVICE_POLLING */ 165 166 /* 167 * Exception, fault, and trap interface to the FreeBSD kernel. 168 * This common code is called from assembly language IDT gate entry 169 * routines that prepare a suitable stack frame, and restore this 170 * frame after the exception has been processed. 171 */ 172 173 void 174 trap(frame) 175 struct trapframe frame; 176 { 177 struct thread *td = curthread; 178 struct proc *p = td->td_proc; 179 u_int sticks = 0; 180 int i = 0, ucode = 0, type, code; 181 vm_offset_t eva; 182 #ifdef POWERFAIL_NMI 183 static int lastalert = 0; 184 #endif 185 186 atomic_add_int(&cnt.v_trap, 1); 187 type = frame.tf_trapno; 188 189 #ifdef KDB_STOP_NMI 190 /* Handler for NMI IPIs used for debugging */ 191 if (type == T_NMI) { 192 if (ipi_nmi_handler() == 0) 193 goto out; 194 } 195 #endif /* KDB_STOP_NMI */ 196 197 #ifdef KDB 198 if (kdb_active) { 199 kdb_reenter(); 200 goto out; 201 } 202 #endif 203 204 if ((frame.tf_eflags & PSL_I) == 0) { 205 /* 206 * Buggy application or kernel code has disabled 207 * interrupts and then trapped. Enabling interrupts 208 * now is wrong, but it is better than running with 209 * interrupts disabled until they are accidentally 210 * enabled later. 211 */ 212 if (ISPL(frame.tf_cs) == SEL_UPL || (frame.tf_eflags & PSL_VM)) 213 printf( 214 "pid %ld (%s): trap %d with interrupts disabled\n", 215 (long)curproc->p_pid, curproc->p_comm, type); 216 else if (type != T_BPTFLT && type != T_TRCTRAP && 217 frame.tf_eip != (int)cpu_switch_load_gs) { 218 /* 219 * XXX not quite right, since this may be for a 220 * multiple fault in user mode. 221 */ 222 printf("kernel trap %d with interrupts disabled\n", 223 type); 224 /* 225 * Page faults need interrupts diasabled until later, 226 * and we shouldn't enable interrupts while in a 227 * critical section. 228 */ 229 if (type != T_PAGEFLT && td->td_critnest == 0) 230 enable_intr(); 231 } 232 } 233 234 eva = 0; 235 code = frame.tf_err; 236 if (type == T_PAGEFLT) { 237 /* 238 * For some Cyrix CPUs, %cr2 is clobbered by 239 * interrupts. This problem is worked around by using 240 * an interrupt gate for the pagefault handler. We 241 * are finally ready to read %cr2 and then must 242 * reenable interrupts. 243 * 244 * If we get a page fault while in a critical section, then 245 * it is most likely a fatal kernel page fault. The kernel 246 * is already going to panic trying to get a sleep lock to 247 * do the VM lookup, so just consider it a fatal trap so the 248 * kernel can print out a useful trap message and even get 249 * to the debugger. 250 */ 251 eva = rcr2(); 252 if (td->td_critnest == 0) 253 enable_intr(); 254 else 255 trap_fatal(&frame, eva); 256 } 257 258 #ifdef DEVICE_POLLING 259 if (poll_in_trap) 260 ether_poll(poll_in_trap); 261 #endif /* DEVICE_POLLING */ 262 263 if ((ISPL(frame.tf_cs) == SEL_UPL) || 264 ((frame.tf_eflags & PSL_VM) && 265 !(PCPU_GET(curpcb)->pcb_flags & PCB_VM86CALL))) { 266 /* user trap */ 267 268 sticks = td->td_sticks; 269 td->td_frame = &frame; 270 if (td->td_ucred != p->p_ucred) 271 cred_update_thread(td); 272 273 switch (type) { 274 case T_PRIVINFLT: /* privileged instruction fault */ 275 ucode = type; 276 i = SIGILL; 277 break; 278 279 case T_BPTFLT: /* bpt instruction fault */ 280 case T_TRCTRAP: /* trace trap */ 281 enable_intr(); 282 frame.tf_eflags &= ~PSL_T; 283 i = SIGTRAP; 284 break; 285 286 case T_ARITHTRAP: /* arithmetic trap */ 287 #ifdef DEV_NPX 288 ucode = npxtrap(); 289 if (ucode == -1) 290 goto userout; 291 #else 292 ucode = code; 293 #endif 294 i = SIGFPE; 295 break; 296 297 /* 298 * The following two traps can happen in 299 * vm86 mode, and, if so, we want to handle 300 * them specially. 301 */ 302 case T_PROTFLT: /* general protection fault */ 303 case T_STKFLT: /* stack fault */ 304 if (frame.tf_eflags & PSL_VM) { 305 i = vm86_emulate((struct vm86frame *)&frame); 306 if (i == 0) 307 goto user; 308 break; 309 } 310 /* FALLTHROUGH */ 311 312 case T_SEGNPFLT: /* segment not present fault */ 313 case T_TSSFLT: /* invalid TSS fault */ 314 case T_DOUBLEFLT: /* double fault */ 315 default: 316 ucode = code + BUS_SEGM_FAULT ; 317 i = SIGBUS; 318 break; 319 320 case T_PAGEFLT: /* page fault */ 321 if (td->td_pflags & TDP_SA) 322 thread_user_enter(td); 323 324 i = trap_pfault(&frame, TRUE, eva); 325 #if defined(I586_CPU) && !defined(NO_F00F_HACK) 326 if (i == -2) { 327 /* 328 * The f00f hack workaround has triggered, so 329 * treat the fault as an illegal instruction 330 * (T_PRIVINFLT) instead of a page fault. 331 */ 332 type = frame.tf_trapno = T_PRIVINFLT; 333 334 /* Proceed as in that case. */ 335 ucode = type; 336 i = SIGILL; 337 break; 338 } 339 #endif 340 if (i == -1) 341 goto userout; 342 if (i == 0) 343 goto user; 344 345 ucode = T_PAGEFLT; 346 break; 347 348 case T_DIVIDE: /* integer divide fault */ 349 ucode = FPE_INTDIV; 350 i = SIGFPE; 351 break; 352 353 #ifdef DEV_ISA 354 case T_NMI: 355 #ifdef POWERFAIL_NMI 356 #ifndef TIMER_FREQ 357 # define TIMER_FREQ 1193182 358 #endif 359 mtx_lock(&Giant); 360 if (time_second - lastalert > 10) { 361 log(LOG_WARNING, "NMI: power fail\n"); 362 sysbeep(TIMER_FREQ/880, hz); 363 lastalert = time_second; 364 } 365 mtx_unlock(&Giant); 366 goto userout; 367 #else /* !POWERFAIL_NMI */ 368 /* machine/parity/power fail/"kitchen sink" faults */ 369 /* XXX Giant */ 370 if (isa_nmi(code) == 0) { 371 #ifdef KDB 372 /* 373 * NMI can be hooked up to a pushbutton 374 * for debugging. 375 */ 376 if (kdb_on_nmi) { 377 printf ("NMI ... going to debugger\n"); 378 kdb_trap(type, 0, &frame); 379 } 380 #endif /* KDB */ 381 goto userout; 382 } else if (panic_on_nmi) 383 panic("NMI indicates hardware failure"); 384 break; 385 #endif /* POWERFAIL_NMI */ 386 #endif /* DEV_ISA */ 387 388 case T_OFLOW: /* integer overflow fault */ 389 ucode = FPE_INTOVF; 390 i = SIGFPE; 391 break; 392 393 case T_BOUND: /* bounds check fault */ 394 ucode = FPE_FLTSUB; 395 i = SIGFPE; 396 break; 397 398 case T_DNA: 399 #ifdef DEV_NPX 400 /* transparent fault (due to context switch "late") */ 401 if (npxdna()) 402 goto userout; 403 #endif 404 i = SIGFPE; 405 ucode = FPE_FPU_NP_TRAP; 406 break; 407 408 case T_FPOPFLT: /* FPU operand fetch fault */ 409 ucode = T_FPOPFLT; 410 i = SIGILL; 411 break; 412 413 case T_XMMFLT: /* SIMD floating-point exception */ 414 ucode = 0; /* XXX */ 415 i = SIGFPE; 416 break; 417 } 418 } else { 419 /* kernel trap */ 420 421 KASSERT(cold || td->td_ucred != NULL, 422 ("kernel trap doesn't have ucred")); 423 switch (type) { 424 case T_PAGEFLT: /* page fault */ 425 (void) trap_pfault(&frame, FALSE, eva); 426 goto out; 427 428 case T_DNA: 429 #ifdef DEV_NPX 430 /* 431 * The kernel is apparently using npx for copying. 432 * XXX this should be fatal unless the kernel has 433 * registered such use. 434 */ 435 if (npxdna()) 436 goto out; 437 #endif 438 break; 439 440 /* 441 * The following two traps can happen in 442 * vm86 mode, and, if so, we want to handle 443 * them specially. 444 */ 445 case T_PROTFLT: /* general protection fault */ 446 case T_STKFLT: /* stack fault */ 447 if (frame.tf_eflags & PSL_VM) { 448 i = vm86_emulate((struct vm86frame *)&frame); 449 if (i != 0) 450 /* 451 * returns to original process 452 */ 453 vm86_trap((struct vm86frame *)&frame); 454 goto out; 455 } 456 if (type == T_STKFLT) 457 break; 458 459 /* FALL THROUGH */ 460 461 case T_SEGNPFLT: /* segment not present fault */ 462 if (PCPU_GET(curpcb)->pcb_flags & PCB_VM86CALL) 463 break; 464 465 /* 466 * Invalid %fs's and %gs's can be created using 467 * procfs or PT_SETREGS or by invalidating the 468 * underlying LDT entry. This causes a fault 469 * in kernel mode when the kernel attempts to 470 * switch contexts. Lose the bad context 471 * (XXX) so that we can continue, and generate 472 * a signal. 473 */ 474 if (frame.tf_eip == (int)cpu_switch_load_gs) { 475 PCPU_GET(curpcb)->pcb_gs = 0; 476 #if 0 477 PROC_LOCK(p); 478 psignal(p, SIGBUS); 479 PROC_UNLOCK(p); 480 #endif 481 goto out; 482 } 483 484 if (td->td_intr_nesting_level != 0) 485 break; 486 487 /* 488 * Invalid segment selectors and out of bounds 489 * %eip's and %esp's can be set up in user mode. 490 * This causes a fault in kernel mode when the 491 * kernel tries to return to user mode. We want 492 * to get this fault so that we can fix the 493 * problem here and not have to check all the 494 * selectors and pointers when the user changes 495 * them. 496 */ 497 if (frame.tf_eip == (int)doreti_iret) { 498 frame.tf_eip = (int)doreti_iret_fault; 499 goto out; 500 } 501 if (frame.tf_eip == (int)doreti_popl_ds) { 502 frame.tf_eip = (int)doreti_popl_ds_fault; 503 goto out; 504 } 505 if (frame.tf_eip == (int)doreti_popl_es) { 506 frame.tf_eip = (int)doreti_popl_es_fault; 507 goto out; 508 } 509 if (frame.tf_eip == (int)doreti_popl_fs) { 510 frame.tf_eip = (int)doreti_popl_fs_fault; 511 goto out; 512 } 513 if (PCPU_GET(curpcb)->pcb_onfault != NULL) { 514 frame.tf_eip = 515 (int)PCPU_GET(curpcb)->pcb_onfault; 516 goto out; 517 } 518 break; 519 520 case T_TSSFLT: 521 /* 522 * PSL_NT can be set in user mode and isn't cleared 523 * automatically when the kernel is entered. This 524 * causes a TSS fault when the kernel attempts to 525 * `iret' because the TSS link is uninitialized. We 526 * want to get this fault so that we can fix the 527 * problem here and not every time the kernel is 528 * entered. 529 */ 530 if (frame.tf_eflags & PSL_NT) { 531 frame.tf_eflags &= ~PSL_NT; 532 goto out; 533 } 534 break; 535 536 case T_TRCTRAP: /* trace trap */ 537 if (frame.tf_eip == (int)IDTVEC(lcall_syscall)) { 538 /* 539 * We've just entered system mode via the 540 * syscall lcall. Continue single stepping 541 * silently until the syscall handler has 542 * saved the flags. 543 */ 544 goto out; 545 } 546 if (frame.tf_eip == (int)IDTVEC(lcall_syscall) + 1) { 547 /* 548 * The syscall handler has now saved the 549 * flags. Stop single stepping it. 550 */ 551 frame.tf_eflags &= ~PSL_T; 552 goto out; 553 } 554 /* 555 * Ignore debug register trace traps due to 556 * accesses in the user's address space, which 557 * can happen under several conditions such as 558 * if a user sets a watchpoint on a buffer and 559 * then passes that buffer to a system call. 560 * We still want to get TRCTRAPS for addresses 561 * in kernel space because that is useful when 562 * debugging the kernel. 563 */ 564 /* XXX Giant */ 565 if (user_dbreg_trap() && 566 !(PCPU_GET(curpcb)->pcb_flags & PCB_VM86CALL)) { 567 /* 568 * Reset breakpoint bits because the 569 * processor doesn't 570 */ 571 load_dr6(rdr6() & 0xfffffff0); 572 goto out; 573 } 574 /* 575 * FALLTHROUGH (TRCTRAP kernel mode, kernel address) 576 */ 577 case T_BPTFLT: 578 /* 579 * If KDB is enabled, let it handle the debugger trap. 580 * Otherwise, debugger traps "can't happen". 581 */ 582 #ifdef KDB 583 /* XXX Giant */ 584 if (kdb_trap(type, 0, &frame)) 585 goto out; 586 #endif 587 break; 588 589 #ifdef DEV_ISA 590 case T_NMI: 591 #ifdef POWERFAIL_NMI 592 mtx_lock(&Giant); 593 if (time_second - lastalert > 10) { 594 log(LOG_WARNING, "NMI: power fail\n"); 595 sysbeep(TIMER_FREQ/880, hz); 596 lastalert = time_second; 597 } 598 mtx_unlock(&Giant); 599 goto out; 600 #else /* !POWERFAIL_NMI */ 601 /* XXX Giant */ 602 /* machine/parity/power fail/"kitchen sink" faults */ 603 if (isa_nmi(code) == 0) { 604 #ifdef KDB 605 /* 606 * NMI can be hooked up to a pushbutton 607 * for debugging. 608 */ 609 if (kdb_on_nmi) { 610 printf ("NMI ... going to debugger\n"); 611 kdb_trap(type, 0, &frame); 612 } 613 #endif /* KDB */ 614 goto out; 615 } else if (panic_on_nmi == 0) 616 goto out; 617 /* FALLTHROUGH */ 618 #endif /* POWERFAIL_NMI */ 619 #endif /* DEV_ISA */ 620 } 621 622 trap_fatal(&frame, eva); 623 goto out; 624 } 625 626 /* Translate fault for emulators (e.g. Linux) */ 627 if (*p->p_sysent->sv_transtrap) 628 i = (*p->p_sysent->sv_transtrap)(i, type); 629 630 trapsignal(td, i, ucode); 631 632 #ifdef DEBUG 633 if (type <= MAX_TRAP_MSG) { 634 uprintf("fatal process exception: %s", 635 trap_msg[type]); 636 if ((type == T_PAGEFLT) || (type == T_PROTFLT)) 637 uprintf(", fault VA = 0x%lx", (u_long)eva); 638 uprintf("\n"); 639 } 640 #endif 641 642 user: 643 userret(td, &frame, sticks); 644 mtx_assert(&Giant, MA_NOTOWNED); 645 userout: 646 out: 647 return; 648 } 649 650 static int 651 trap_pfault(frame, usermode, eva) 652 struct trapframe *frame; 653 int usermode; 654 vm_offset_t eva; 655 { 656 vm_offset_t va; 657 struct vmspace *vm = NULL; 658 vm_map_t map = 0; 659 int rv = 0; 660 vm_prot_t ftype; 661 struct thread *td = curthread; 662 struct proc *p = td->td_proc; 663 664 va = trunc_page(eva); 665 if (va >= KERNBASE) { 666 /* 667 * Don't allow user-mode faults in kernel address space. 668 * An exception: if the faulting address is the invalid 669 * instruction entry in the IDT, then the Intel Pentium 670 * F00F bug workaround was triggered, and we need to 671 * treat it is as an illegal instruction, and not a page 672 * fault. 673 */ 674 #if defined(I586_CPU) && !defined(NO_F00F_HACK) 675 if ((eva == (unsigned int)&idt[6]) && has_f00f_bug) 676 return -2; 677 #endif 678 if (usermode) 679 goto nogo; 680 681 map = kernel_map; 682 } else { 683 /* 684 * This is a fault on non-kernel virtual memory. 685 * vm is initialized above to NULL. If curproc is NULL 686 * or curproc->p_vmspace is NULL the fault is fatal. 687 */ 688 if (p != NULL) 689 vm = p->p_vmspace; 690 691 if (vm == NULL) 692 goto nogo; 693 694 map = &vm->vm_map; 695 } 696 697 if (frame->tf_err & PGEX_W) 698 ftype = VM_PROT_WRITE; 699 else 700 ftype = VM_PROT_READ; 701 702 if (map != kernel_map) { 703 /* 704 * Keep swapout from messing with us during this 705 * critical time. 706 */ 707 PROC_LOCK(p); 708 ++p->p_lock; 709 PROC_UNLOCK(p); 710 711 /* Fault in the user page: */ 712 rv = vm_fault(map, va, ftype, 713 (ftype & VM_PROT_WRITE) ? VM_FAULT_DIRTY 714 : VM_FAULT_NORMAL); 715 716 PROC_LOCK(p); 717 --p->p_lock; 718 PROC_UNLOCK(p); 719 } else { 720 /* 721 * Don't have to worry about process locking or stacks in the 722 * kernel. 723 */ 724 rv = vm_fault(map, va, ftype, VM_FAULT_NORMAL); 725 } 726 if (rv == KERN_SUCCESS) 727 return (0); 728 nogo: 729 if (!usermode) { 730 if (td->td_intr_nesting_level == 0 && 731 PCPU_GET(curpcb)->pcb_onfault != NULL) { 732 frame->tf_eip = (int)PCPU_GET(curpcb)->pcb_onfault; 733 return (0); 734 } 735 trap_fatal(frame, eva); 736 return (-1); 737 } 738 739 /* kludge to pass faulting virtual address to sendsig */ 740 frame->tf_err = eva; 741 742 return((rv == KERN_PROTECTION_FAILURE) ? SIGBUS : SIGSEGV); 743 } 744 745 static void 746 trap_fatal(frame, eva) 747 struct trapframe *frame; 748 vm_offset_t eva; 749 { 750 int code, type, ss, esp; 751 struct soft_segment_descriptor softseg; 752 753 code = frame->tf_err; 754 type = frame->tf_trapno; 755 sdtossd(&gdt[IDXSEL(frame->tf_cs & 0xffff)].sd, &softseg); 756 757 if (type <= MAX_TRAP_MSG) 758 printf("\n\nFatal trap %d: %s while in %s mode\n", 759 type, trap_msg[type], 760 frame->tf_eflags & PSL_VM ? "vm86" : 761 ISPL(frame->tf_cs) == SEL_UPL ? "user" : "kernel"); 762 #ifdef SMP 763 /* two separate prints in case of a trap on an unmapped page */ 764 printf("cpuid = %d; ", PCPU_GET(cpuid)); 765 printf("apic id = %02x\n", PCPU_GET(apic_id)); 766 #endif 767 if (type == T_PAGEFLT) { 768 printf("fault virtual address = 0x%x\n", eva); 769 printf("fault code = %s %s, %s\n", 770 code & PGEX_U ? "user" : "supervisor", 771 code & PGEX_W ? "write" : "read", 772 code & PGEX_P ? "protection violation" : "page not present"); 773 } 774 printf("instruction pointer = 0x%x:0x%x\n", 775 frame->tf_cs & 0xffff, frame->tf_eip); 776 if ((ISPL(frame->tf_cs) == SEL_UPL) || (frame->tf_eflags & PSL_VM)) { 777 ss = frame->tf_ss & 0xffff; 778 esp = frame->tf_esp; 779 } else { 780 ss = GSEL(GDATA_SEL, SEL_KPL); 781 esp = (int)&frame->tf_esp; 782 } 783 printf("stack pointer = 0x%x:0x%x\n", ss, esp); 784 printf("frame pointer = 0x%x:0x%x\n", ss, frame->tf_ebp); 785 printf("code segment = base 0x%x, limit 0x%x, type 0x%x\n", 786 softseg.ssd_base, softseg.ssd_limit, softseg.ssd_type); 787 printf(" = DPL %d, pres %d, def32 %d, gran %d\n", 788 softseg.ssd_dpl, softseg.ssd_p, softseg.ssd_def32, 789 softseg.ssd_gran); 790 printf("processor eflags = "); 791 if (frame->tf_eflags & PSL_T) 792 printf("trace trap, "); 793 if (frame->tf_eflags & PSL_I) 794 printf("interrupt enabled, "); 795 if (frame->tf_eflags & PSL_NT) 796 printf("nested task, "); 797 if (frame->tf_eflags & PSL_RF) 798 printf("resume, "); 799 if (frame->tf_eflags & PSL_VM) 800 printf("vm86, "); 801 printf("IOPL = %d\n", (frame->tf_eflags & PSL_IOPL) >> 12); 802 printf("current process = "); 803 if (curproc) { 804 printf("%lu (%s)\n", 805 (u_long)curproc->p_pid, curproc->p_comm ? 806 curproc->p_comm : ""); 807 } else { 808 printf("Idle\n"); 809 } 810 811 #ifdef KDB 812 if (kdb_trap(type, 0, frame)) 813 return; 814 #endif 815 printf("trap number = %d\n", type); 816 if (type <= MAX_TRAP_MSG) 817 panic("%s", trap_msg[type]); 818 else 819 panic("unknown/reserved trap"); 820 } 821 822 /* 823 * Double fault handler. Called when a fault occurs while writing 824 * a frame for a trap/exception onto the stack. This usually occurs 825 * when the stack overflows (such is the case with infinite recursion, 826 * for example). 827 * 828 * XXX Note that the current PTD gets replaced by IdlePTD when the 829 * task switch occurs. This means that the stack that was active at 830 * the time of the double fault is not available at <kstack> unless 831 * the machine was idle when the double fault occurred. The downside 832 * of this is that "trace <ebp>" in ddb won't work. 833 */ 834 void 835 dblfault_handler() 836 { 837 printf("\nFatal double fault:\n"); 838 printf("eip = 0x%x\n", PCPU_GET(common_tss.tss_eip)); 839 printf("esp = 0x%x\n", PCPU_GET(common_tss.tss_esp)); 840 printf("ebp = 0x%x\n", PCPU_GET(common_tss.tss_ebp)); 841 #ifdef SMP 842 /* two separate prints in case of a trap on an unmapped page */ 843 printf("cpuid = %d; ", PCPU_GET(cpuid)); 844 printf("apic id = %02x\n", PCPU_GET(apic_id)); 845 #endif 846 panic("double fault"); 847 } 848 849 #ifdef I386_CPU 850 /* 851 * Compensate for 386 brain damage (missing URKR). 852 * This is a little simpler than the pagefault handler in trap() because 853 * it the page tables have already been faulted in and high addresses 854 * are thrown out early for other reasons. 855 */ 856 int trapwrite(addr) 857 unsigned addr; 858 { 859 struct thread *td; 860 struct proc *p; 861 vm_offset_t va; 862 struct vmspace *vm; 863 int rv; 864 865 va = trunc_page((vm_offset_t)addr); 866 /* 867 * XXX - MAX is END. Changed > to >= for temp. fix. 868 */ 869 if (va >= VM_MAXUSER_ADDRESS) 870 return (1); 871 872 td = curthread; 873 p = td->td_proc; 874 vm = p->p_vmspace; 875 876 PROC_LOCK(p); 877 ++p->p_lock; 878 PROC_UNLOCK(p); 879 880 /* 881 * fault the data page 882 */ 883 rv = vm_fault(&vm->vm_map, va, VM_PROT_WRITE, VM_FAULT_DIRTY); 884 885 PROC_LOCK(p); 886 --p->p_lock; 887 PROC_UNLOCK(p); 888 889 if (rv != KERN_SUCCESS) 890 return 1; 891 892 return (0); 893 } 894 #endif 895 896 /* 897 * syscall - system call request C handler 898 * 899 * A system call is essentially treated as a trap. 900 */ 901 void 902 syscall(frame) 903 struct trapframe frame; 904 { 905 caddr_t params; 906 struct sysent *callp; 907 struct thread *td = curthread; 908 struct proc *p = td->td_proc; 909 register_t orig_tf_eflags; 910 u_int sticks; 911 int error; 912 int narg; 913 int args[8]; 914 u_int code; 915 916 /* 917 * note: PCPU_LAZY_INC() can only be used if we can afford 918 * occassional inaccuracy in the count. 919 */ 920 PCPU_LAZY_INC(cnt.v_syscall); 921 922 #ifdef DIAGNOSTIC 923 if (ISPL(frame.tf_cs) != SEL_UPL) { 924 mtx_lock(&Giant); /* try to stabilize the system XXX */ 925 panic("syscall"); 926 /* NOT REACHED */ 927 mtx_unlock(&Giant); 928 } 929 #endif 930 931 sticks = td->td_sticks; 932 td->td_frame = &frame; 933 if (td->td_ucred != p->p_ucred) 934 cred_update_thread(td); 935 if (p->p_flag & P_SA) 936 thread_user_enter(td); 937 params = (caddr_t)frame.tf_esp + sizeof(int); 938 code = frame.tf_eax; 939 orig_tf_eflags = frame.tf_eflags; 940 941 if (p->p_sysent->sv_prepsyscall) { 942 /* 943 * The prep code is MP aware. 944 */ 945 (*p->p_sysent->sv_prepsyscall)(&frame, args, &code, ¶ms); 946 } else { 947 /* 948 * Need to check if this is a 32 bit or 64 bit syscall. 949 * fuword is MP aware. 950 */ 951 if (code == SYS_syscall) { 952 /* 953 * Code is first argument, followed by actual args. 954 */ 955 code = fuword(params); 956 params += sizeof(int); 957 } else if (code == SYS___syscall) { 958 /* 959 * Like syscall, but code is a quad, so as to maintain 960 * quad alignment for the rest of the arguments. 961 */ 962 code = fuword(params); 963 params += sizeof(quad_t); 964 } 965 } 966 967 if (p->p_sysent->sv_mask) 968 code &= p->p_sysent->sv_mask; 969 970 if (code >= p->p_sysent->sv_size) 971 callp = &p->p_sysent->sv_table[0]; 972 else 973 callp = &p->p_sysent->sv_table[code]; 974 975 narg = callp->sy_narg & SYF_ARGMASK; 976 977 /* 978 * copyin and the ktrsyscall()/ktrsysret() code is MP-aware 979 */ 980 if (params != NULL && narg != 0) 981 error = copyin(params, (caddr_t)args, 982 (u_int)(narg * sizeof(int))); 983 else 984 error = 0; 985 986 #ifdef KTRACE 987 if (KTRPOINT(td, KTR_SYSCALL)) 988 ktrsyscall(code, narg, args); 989 #endif 990 991 CTR4(KTR_SYSC, "syscall enter thread %p pid %d proc %s code %d", td, 992 td->td_proc->p_pid, td->td_proc->p_comm, code); 993 994 /* 995 * Try to run the syscall without Giant if the syscall 996 * is MP safe. 997 */ 998 if ((callp->sy_narg & SYF_MPSAFE) == 0) 999 mtx_lock(&Giant); 1000 1001 if (error == 0) { 1002 td->td_retval[0] = 0; 1003 td->td_retval[1] = frame.tf_edx; 1004 1005 STOPEVENT(p, S_SCE, narg); 1006 1007 PTRACESTOP_SC(p, td, S_PT_SCE); 1008 1009 error = (*callp->sy_call)(td, args); 1010 } 1011 1012 switch (error) { 1013 case 0: 1014 frame.tf_eax = td->td_retval[0]; 1015 frame.tf_edx = td->td_retval[1]; 1016 frame.tf_eflags &= ~PSL_C; 1017 break; 1018 1019 case ERESTART: 1020 /* 1021 * Reconstruct pc, assuming lcall $X,y is 7 bytes, 1022 * int 0x80 is 2 bytes. We saved this in tf_err. 1023 */ 1024 frame.tf_eip -= frame.tf_err; 1025 break; 1026 1027 case EJUSTRETURN: 1028 break; 1029 1030 default: 1031 if (p->p_sysent->sv_errsize) { 1032 if (error >= p->p_sysent->sv_errsize) 1033 error = -1; /* XXX */ 1034 else 1035 error = p->p_sysent->sv_errtbl[error]; 1036 } 1037 frame.tf_eax = error; 1038 frame.tf_eflags |= PSL_C; 1039 break; 1040 } 1041 1042 /* 1043 * Release Giant if we previously set it. 1044 */ 1045 if ((callp->sy_narg & SYF_MPSAFE) == 0) 1046 mtx_unlock(&Giant); 1047 1048 /* 1049 * Traced syscall. 1050 */ 1051 if ((orig_tf_eflags & PSL_T) && !(orig_tf_eflags & PSL_VM)) { 1052 frame.tf_eflags &= ~PSL_T; 1053 trapsignal(td, SIGTRAP, 0); 1054 } 1055 1056 /* 1057 * Handle reschedule and other end-of-syscall issues 1058 */ 1059 userret(td, &frame, sticks); 1060 1061 CTR4(KTR_SYSC, "syscall exit thread %p pid %d proc %s code %d", td, 1062 td->td_proc->p_pid, td->td_proc->p_comm, code); 1063 1064 #ifdef KTRACE 1065 if (KTRPOINT(td, KTR_SYSRET)) 1066 ktrsysret(code, error, td->td_retval[0]); 1067 #endif 1068 1069 /* 1070 * This works because errno is findable through the 1071 * register set. If we ever support an emulation where this 1072 * is not the case, this code will need to be revisited. 1073 */ 1074 STOPEVENT(p, S_SCX, code); 1075 1076 PTRACESTOP_SC(p, td, S_PT_SCX); 1077 1078 WITNESS_WARN(WARN_PANIC, NULL, "System call %s returning", 1079 (code >= 0 && code < SYS_MAXSYSCALL) ? syscallnames[code] : "???"); 1080 mtx_assert(&sched_lock, MA_NOTOWNED); 1081 mtx_assert(&Giant, MA_NOTOWNED); 1082 } 1083
Cache object: 51fe9ecf099080fe79a7d37402905e60
[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]