The Design and Implementation of the FreeBSD Operating System, Second Edition
Now available: The Design and Implementation of the FreeBSD Operating System (Second Edition)


[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]

FreeBSD/Linux Kernel Cross Reference
sys/i386/i386/trap.c

Version: -  FREEBSD  -  FREEBSD-12-STABLE  -  FREEBSD-12-0  -  FREEBSD-11-STABLE  -  FREEBSD-11-2  -  FREEBSD-11-1  -  FREEBSD-11-0  -  FREEBSD-10-STABLE  -  FREEBSD-10-4  -  FREEBSD-10-3  -  FREEBSD-10-2  -  FREEBSD-10-1  -  FREEBSD-10-0  -  FREEBSD-9-STABLE  -  FREEBSD-9-3  -  FREEBSD-9-2  -  FREEBSD-9-1  -  FREEBSD-9-0  -  FREEBSD-8-STABLE  -  FREEBSD-8-4  -  FREEBSD-8-3  -  FREEBSD-8-2  -  FREEBSD-8-1  -  FREEBSD-8-0  -  FREEBSD-7-STABLE  -  FREEBSD-7-4  -  FREEBSD-7-3  -  FREEBSD-7-2  -  FREEBSD-7-1  -  FREEBSD-7-0  -  FREEBSD-6-STABLE  -  FREEBSD-6-4  -  FREEBSD-6-3  -  FREEBSD-6-2  -  FREEBSD-6-1  -  FREEBSD-6-0  -  FREEBSD-5-STABLE  -  FREEBSD-5-5  -  FREEBSD-5-4  -  FREEBSD-5-3  -  FREEBSD-5-2  -  FREEBSD-5-1  -  FREEBSD-5-0  -  FREEBSD-4-STABLE  -  FREEBSD-3-STABLE  -  FREEBSD22  -  linux-2.6  -  linux-2.4.22  -  MK83  -  MK84  -  PLAN9  -  DFBSD  -  NETBSD  -  NETBSD5  -  NETBSD4  -  NETBSD3  -  NETBSD20  -  OPENBSD  -  xnu-517  -  xnu-792  -  xnu-792.6.70  -  xnu-1228  -  xnu-1456.1.26  -  xnu-1699.24.8  -  xnu-2050.18.24  -  OPENSOLARIS  -  minix-3-1-1 
SearchContext: -  none  -  3  -  10 

    1 /*-
    2  * Copyright (C) 1994, David Greenman
    3  * Copyright (c) 1990, 1993
    4  *      The Regents of the University of California.  All rights reserved.
    5  *
    6  * This code is derived from software contributed to Berkeley by
    7  * the University of Utah, and William Jolitz.
    8  *
    9  * Redistribution and use in source and binary forms, with or without
   10  * modification, are permitted provided that the following conditions
   11  * are met:
   12  * 1. Redistributions of source code must retain the above copyright
   13  *    notice, this list of conditions and the following disclaimer.
   14  * 2. Redistributions in binary form must reproduce the above copyright
   15  *    notice, this list of conditions and the following disclaimer in the
   16  *    documentation and/or other materials provided with the distribution.
   17  * 3. All advertising materials mentioning features or use of this software
   18  *    must display the following acknowledgement:
   19  *      This product includes software developed by the University of
   20  *      California, Berkeley and its contributors.
   21  * 4. Neither the name of the University nor the names of its contributors
   22  *    may be used to endorse or promote products derived from this software
   23  *    without specific prior written permission.
   24  *
   25  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
   26  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
   27  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
   28  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
   29  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
   30  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
   31  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
   32  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
   33  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
   34  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
   35  * SUCH DAMAGE.
   36  *
   37  *      from: @(#)trap.c        7.4 (Berkeley) 5/13/91
   38  */
   39 
   40 #include <sys/cdefs.h>
   41 __FBSDID("$FreeBSD: src/sys/i386/i386/trap.c,v 1.267.2.4 2005/11/28 20:03:15 jhb Exp $");
   42 
   43 /*
   44  * 386 Trap and System call handling
   45  */
   46 
   47 #include "opt_clock.h"
   48 #include "opt_cpu.h"
   49 #include "opt_isa.h"
   50 #include "opt_ktrace.h"
   51 #include "opt_npx.h"
   52 #include "opt_trap.h"
   53 
   54 #include <sys/param.h>
   55 #include <sys/bus.h>
   56 #include <sys/systm.h>
   57 #include <sys/proc.h>
   58 #include <sys/pioctl.h>
   59 #include <sys/ptrace.h>
   60 #include <sys/kdb.h>
   61 #include <sys/kernel.h>
   62 #include <sys/ktr.h>
   63 #include <sys/lock.h>
   64 #include <sys/mutex.h>
   65 #include <sys/resourcevar.h>
   66 #include <sys/signalvar.h>
   67 #include <sys/syscall.h>
   68 #include <sys/sysctl.h>
   69 #include <sys/sysent.h>
   70 #include <sys/uio.h>
   71 #include <sys/vmmeter.h>
   72 #ifdef KTRACE
   73 #include <sys/ktrace.h>
   74 #endif
   75 
   76 #include <vm/vm.h>
   77 #include <vm/vm_param.h>
   78 #include <vm/pmap.h>
   79 #include <vm/vm_kern.h>
   80 #include <vm/vm_map.h>
   81 #include <vm/vm_page.h>
   82 #include <vm/vm_extern.h>
   83 
   84 #include <machine/cpu.h>
   85 #include <machine/intr_machdep.h>
   86 #include <machine/md_var.h>
   87 #include <machine/pcb.h>
   88 #ifdef SMP
   89 #include <machine/smp.h>
   90 #endif
   91 #include <machine/tss.h>
   92 #include <machine/vm86.h>
   93 
   94 #ifdef POWERFAIL_NMI
   95 #include <sys/syslog.h>
   96 #include <machine/clock.h>
   97 #endif
   98 
   99 extern void trap(struct trapframe frame);
  100 #ifdef I386_CPU
  101 extern int trapwrite(unsigned addr);
  102 #endif
  103 extern void syscall(struct trapframe frame);
  104 
  105 static int trap_pfault(struct trapframe *, int, vm_offset_t);
  106 static void trap_fatal(struct trapframe *, vm_offset_t);
  107 void dblfault_handler(void);
  108 
  109 extern inthand_t IDTVEC(lcall_syscall);
  110 
  111 #define MAX_TRAP_MSG            30
  112 static char *trap_msg[] = {
  113         "",                                     /*  0 unused */
  114         "privileged instruction fault",         /*  1 T_PRIVINFLT */
  115         "",                                     /*  2 unused */
  116         "breakpoint instruction fault",         /*  3 T_BPTFLT */
  117         "",                                     /*  4 unused */
  118         "",                                     /*  5 unused */
  119         "arithmetic trap",                      /*  6 T_ARITHTRAP */
  120         "",                                     /*  7 unused */
  121         "",                                     /*  8 unused */
  122         "general protection fault",             /*  9 T_PROTFLT */
  123         "trace trap",                           /* 10 T_TRCTRAP */
  124         "",                                     /* 11 unused */
  125         "page fault",                           /* 12 T_PAGEFLT */
  126         "",                                     /* 13 unused */
  127         "alignment fault",                      /* 14 T_ALIGNFLT */
  128         "",                                     /* 15 unused */
  129         "",                                     /* 16 unused */
  130         "",                                     /* 17 unused */
  131         "integer divide fault",                 /* 18 T_DIVIDE */
  132         "non-maskable interrupt trap",          /* 19 T_NMI */
  133         "overflow trap",                        /* 20 T_OFLOW */
  134         "FPU bounds check fault",               /* 21 T_BOUND */
  135         "FPU device not available",             /* 22 T_DNA */
  136         "double fault",                         /* 23 T_DOUBLEFLT */
  137         "FPU operand fetch fault",              /* 24 T_FPOPFLT */
  138         "invalid TSS fault",                    /* 25 T_TSSFLT */
  139         "segment not present fault",            /* 26 T_SEGNPFLT */
  140         "stack fault",                          /* 27 T_STKFLT */
  141         "machine check trap",                   /* 28 T_MCHK */
  142         "SIMD floating-point exception",        /* 29 T_XMMFLT */
  143         "reserved (unknown) fault",             /* 30 T_RESERVED */
  144 };
  145 
  146 #if defined(I586_CPU) && !defined(NO_F00F_HACK)
  147 extern int has_f00f_bug;
  148 #endif
  149 
  150 #ifdef KDB
  151 static int kdb_on_nmi = 1;
  152 SYSCTL_INT(_machdep, OID_AUTO, kdb_on_nmi, CTLFLAG_RW,
  153         &kdb_on_nmi, 0, "Go to KDB on NMI");
  154 #endif
  155 static int panic_on_nmi = 1;
  156 SYSCTL_INT(_machdep, OID_AUTO, panic_on_nmi, CTLFLAG_RW,
  157         &panic_on_nmi, 0, "Panic on NMI");
  158 
  159 #ifdef WITNESS
  160 extern char *syscallnames[];
  161 #endif
  162 
  163 #ifdef DEVICE_POLLING
  164 extern u_int32_t poll_in_trap;
  165 extern int ether_poll(int count);
  166 #endif /* DEVICE_POLLING */
  167 
  168 /*
  169  * Exception, fault, and trap interface to the FreeBSD kernel.
  170  * This common code is called from assembly language IDT gate entry
  171  * routines that prepare a suitable stack frame, and restore this
  172  * frame after the exception has been processed.
  173  */
  174 
  175 void
  176 trap(frame)
  177         struct trapframe frame;
  178 {
  179         struct thread *td = curthread;
  180         struct proc *p = td->td_proc;
  181         u_int sticks = 0;
  182         int i = 0, ucode = 0, type, code;
  183         vm_offset_t eva;
  184 #ifdef POWERFAIL_NMI
  185         static int lastalert = 0;
  186 #endif
  187 
  188         atomic_add_int(&cnt.v_trap, 1);
  189         type = frame.tf_trapno;
  190 
  191 #ifdef KDB_STOP_NMI
  192         /* Handler for NMI IPIs used for debugging */
  193         if (type == T_NMI) {
  194                  if (ipi_nmi_handler() == 0)
  195                            goto out;
  196         }
  197 #endif /* KDB_STOP_NMI */
  198 
  199 #ifdef KDB
  200         if (kdb_active) {
  201                 kdb_reenter();
  202                 goto out;
  203         }
  204 #endif
  205 
  206         if ((frame.tf_eflags & PSL_I) == 0) {
  207                 /*
  208                  * Buggy application or kernel code has disabled
  209                  * interrupts and then trapped.  Enabling interrupts
  210                  * now is wrong, but it is better than running with
  211                  * interrupts disabled until they are accidentally
  212                  * enabled later.
  213                  */
  214                 if (ISPL(frame.tf_cs) == SEL_UPL || (frame.tf_eflags & PSL_VM))
  215                         printf(
  216                             "pid %ld (%s): trap %d with interrupts disabled\n",
  217                             (long)curproc->p_pid, curproc->p_comm, type);
  218                 else if (type != T_BPTFLT && type != T_TRCTRAP &&
  219                          frame.tf_eip != (int)cpu_switch_load_gs) {
  220                         /*
  221                          * XXX not quite right, since this may be for a
  222                          * multiple fault in user mode.
  223                          */
  224                         printf("kernel trap %d with interrupts disabled\n",
  225                             type);
  226                         /*
  227                          * Page faults need interrupts diasabled until later,
  228                          * and we shouldn't enable interrupts while in a
  229                          * critical section.
  230                          */
  231                         if (type != T_PAGEFLT && td->td_critnest == 0)
  232                                 enable_intr();
  233                 }
  234         }
  235 
  236         eva = 0;
  237         code = frame.tf_err;
  238         if (type == T_PAGEFLT) {
  239                 /*
  240                  * For some Cyrix CPUs, %cr2 is clobbered by
  241                  * interrupts.  This problem is worked around by using
  242                  * an interrupt gate for the pagefault handler.  We
  243                  * are finally ready to read %cr2 and then must
  244                  * reenable interrupts.
  245                  *
  246                  * If we get a page fault while in a critical section, then
  247                  * it is most likely a fatal kernel page fault.  The kernel
  248                  * is already going to panic trying to get a sleep lock to
  249                  * do the VM lookup, so just consider it a fatal trap so the
  250                  * kernel can print out a useful trap message and even get
  251                  * to the debugger.
  252                  */
  253                 eva = rcr2();
  254                 if (td->td_critnest == 0)
  255                         enable_intr();
  256                 else
  257                         trap_fatal(&frame, eva);
  258         }
  259 
  260 #ifdef  DEVICE_POLLING
  261         if (poll_in_trap)
  262                 ether_poll(poll_in_trap);
  263 #endif  /* DEVICE_POLLING */
  264 
  265         if ((ISPL(frame.tf_cs) == SEL_UPL) ||
  266             ((frame.tf_eflags & PSL_VM) && 
  267                 !(PCPU_GET(curpcb)->pcb_flags & PCB_VM86CALL))) {
  268                 /* user trap */
  269 
  270                 sticks = td->td_sticks;
  271                 td->td_frame = &frame;
  272                 if (td->td_ucred != p->p_ucred) 
  273                         cred_update_thread(td);
  274 
  275                 switch (type) {
  276                 case T_PRIVINFLT:       /* privileged instruction fault */
  277                         ucode = type;
  278                         i = SIGILL;
  279                         break;
  280 
  281                 case T_BPTFLT:          /* bpt instruction fault */
  282                 case T_TRCTRAP:         /* trace trap */
  283                         enable_intr();
  284                         frame.tf_eflags &= ~PSL_T;
  285                         i = SIGTRAP;
  286                         break;
  287 
  288                 case T_ARITHTRAP:       /* arithmetic trap */
  289 #ifdef DEV_NPX
  290                         ucode = npxtrap();
  291                         if (ucode == -1)
  292                                 goto userout;
  293 #else
  294                         ucode = code;
  295 #endif
  296                         i = SIGFPE;
  297                         break;
  298 
  299                         /*
  300                          * The following two traps can happen in
  301                          * vm86 mode, and, if so, we want to handle
  302                          * them specially.
  303                          */
  304                 case T_PROTFLT:         /* general protection fault */
  305                 case T_STKFLT:          /* stack fault */
  306                         if (frame.tf_eflags & PSL_VM) {
  307                                 i = vm86_emulate((struct vm86frame *)&frame);
  308                                 if (i == 0)
  309                                         goto user;
  310                                 break;
  311                         }
  312                         /* FALLTHROUGH */
  313 
  314                 case T_SEGNPFLT:        /* segment not present fault */
  315                 case T_TSSFLT:          /* invalid TSS fault */
  316                 case T_DOUBLEFLT:       /* double fault */
  317                 default:
  318                         ucode = code + BUS_SEGM_FAULT ;
  319                         i = SIGBUS;
  320                         break;
  321 
  322                 case T_PAGEFLT:         /* page fault */
  323                         if (td->td_pflags & TDP_SA)
  324                                 thread_user_enter(td);
  325 
  326                         i = trap_pfault(&frame, TRUE, eva);
  327 #if defined(I586_CPU) && !defined(NO_F00F_HACK)
  328                         if (i == -2) {
  329                                 /*
  330                                  * The f00f hack workaround has triggered, so
  331                                  * treat the fault as an illegal instruction 
  332                                  * (T_PRIVINFLT) instead of a page fault.
  333                                  */
  334                                 type = frame.tf_trapno = T_PRIVINFLT;
  335 
  336                                 /* Proceed as in that case. */
  337                                 ucode = type;
  338                                 i = SIGILL;
  339                                 break;
  340                         }
  341 #endif
  342                         if (i == -1)
  343                                 goto userout;
  344                         if (i == 0)
  345                                 goto user;
  346 
  347                         ucode = T_PAGEFLT;
  348                         break;
  349 
  350                 case T_DIVIDE:          /* integer divide fault */
  351                         ucode = FPE_INTDIV;
  352                         i = SIGFPE;
  353                         break;
  354 
  355 #ifdef DEV_ISA
  356                 case T_NMI:
  357 #ifdef POWERFAIL_NMI
  358 #ifndef TIMER_FREQ
  359 #  define TIMER_FREQ 1193182
  360 #endif
  361                         mtx_lock(&Giant);
  362                         if (time_second - lastalert > 10) {
  363                                 log(LOG_WARNING, "NMI: power fail\n");
  364                                 sysbeep(TIMER_FREQ/880, hz);
  365                                 lastalert = time_second;
  366                         }
  367                         mtx_unlock(&Giant);
  368                         goto userout;
  369 #else /* !POWERFAIL_NMI */
  370                         /* machine/parity/power fail/"kitchen sink" faults */
  371                         /* XXX Giant */
  372                         if (isa_nmi(code) == 0) {
  373 #ifdef KDB
  374                                 /*
  375                                  * NMI can be hooked up to a pushbutton
  376                                  * for debugging.
  377                                  */
  378                                 if (kdb_on_nmi) {
  379                                         printf ("NMI ... going to debugger\n");
  380                                         kdb_trap(type, 0, &frame);
  381                                 }
  382 #endif /* KDB */
  383                                 goto userout;
  384                         } else if (panic_on_nmi)
  385                                 panic("NMI indicates hardware failure");
  386                         break;
  387 #endif /* POWERFAIL_NMI */
  388 #endif /* DEV_ISA */
  389 
  390                 case T_OFLOW:           /* integer overflow fault */
  391                         ucode = FPE_INTOVF;
  392                         i = SIGFPE;
  393                         break;
  394 
  395                 case T_BOUND:           /* bounds check fault */
  396                         ucode = FPE_FLTSUB;
  397                         i = SIGFPE;
  398                         break;
  399 
  400                 case T_DNA:
  401 #ifdef DEV_NPX
  402                         /* transparent fault (due to context switch "late") */
  403                         if (npxdna())
  404                                 goto userout;
  405 #endif
  406                         i = SIGFPE;
  407                         ucode = FPE_FPU_NP_TRAP;
  408                         break;
  409 
  410                 case T_FPOPFLT:         /* FPU operand fetch fault */
  411                         ucode = T_FPOPFLT;
  412                         i = SIGILL;
  413                         break;
  414 
  415                 case T_XMMFLT:          /* SIMD floating-point exception */
  416                         ucode = 0; /* XXX */
  417                         i = SIGFPE;
  418                         break;
  419                 }
  420         } else {
  421                 /* kernel trap */
  422 
  423                 KASSERT(cold || td->td_ucred != NULL,
  424                     ("kernel trap doesn't have ucred"));
  425                 switch (type) {
  426                 case T_PAGEFLT:                 /* page fault */
  427                         (void) trap_pfault(&frame, FALSE, eva);
  428                         goto out;
  429 
  430                 case T_DNA:
  431 #ifdef DEV_NPX
  432                         /*
  433                          * The kernel is apparently using npx for copying.
  434                          * XXX this should be fatal unless the kernel has
  435                          * registered such use.
  436                          */
  437                         if (npxdna())
  438                                 goto out;
  439 #endif
  440                         break;
  441 
  442                         /*
  443                          * The following two traps can happen in
  444                          * vm86 mode, and, if so, we want to handle
  445                          * them specially.
  446                          */
  447                 case T_PROTFLT:         /* general protection fault */
  448                 case T_STKFLT:          /* stack fault */
  449                         if (frame.tf_eflags & PSL_VM) {
  450                                 i = vm86_emulate((struct vm86frame *)&frame);
  451                                 if (i != 0)
  452                                         /*
  453                                          * returns to original process
  454                                          */
  455                                         vm86_trap((struct vm86frame *)&frame);
  456                                 goto out;
  457                         }
  458                         if (type == T_STKFLT)
  459                                 break;
  460 
  461                         /* FALL THROUGH */
  462 
  463                 case T_SEGNPFLT:        /* segment not present fault */
  464                         if (PCPU_GET(curpcb)->pcb_flags & PCB_VM86CALL)
  465                                 break;
  466 
  467                         /*
  468                          * Invalid %fs's and %gs's can be created using
  469                          * procfs or PT_SETREGS or by invalidating the
  470                          * underlying LDT entry.  This causes a fault
  471                          * in kernel mode when the kernel attempts to
  472                          * switch contexts.  Lose the bad context
  473                          * (XXX) so that we can continue, and generate
  474                          * a signal.
  475                          */
  476                         if (frame.tf_eip == (int)cpu_switch_load_gs) {
  477                                 PCPU_GET(curpcb)->pcb_gs = 0;
  478 #if 0                           
  479                                 PROC_LOCK(p);
  480                                 psignal(p, SIGBUS);
  481                                 PROC_UNLOCK(p);
  482 #endif                          
  483                                 goto out;
  484                         }
  485 
  486                         if (td->td_intr_nesting_level != 0)
  487                                 break;
  488 
  489                         /*
  490                          * Invalid segment selectors and out of bounds
  491                          * %eip's and %esp's can be set up in user mode.
  492                          * This causes a fault in kernel mode when the
  493                          * kernel tries to return to user mode.  We want
  494                          * to get this fault so that we can fix the
  495                          * problem here and not have to check all the
  496                          * selectors and pointers when the user changes
  497                          * them.
  498                          */
  499                         if (frame.tf_eip == (int)doreti_iret) {
  500                                 frame.tf_eip = (int)doreti_iret_fault;
  501                                 goto out;
  502                         }
  503                         if (frame.tf_eip == (int)doreti_popl_ds) {
  504                                 frame.tf_eip = (int)doreti_popl_ds_fault;
  505                                 goto out;
  506                         }
  507                         if (frame.tf_eip == (int)doreti_popl_es) {
  508                                 frame.tf_eip = (int)doreti_popl_es_fault;
  509                                 goto out;
  510                         }
  511                         if (frame.tf_eip == (int)doreti_popl_fs) {
  512                                 frame.tf_eip = (int)doreti_popl_fs_fault;
  513                                 goto out;
  514                         }
  515                         if (PCPU_GET(curpcb)->pcb_onfault != NULL) {
  516                                 frame.tf_eip =
  517                                     (int)PCPU_GET(curpcb)->pcb_onfault;
  518                                 goto out;
  519                         }
  520                         break;
  521 
  522                 case T_TSSFLT:
  523                         /*
  524                          * PSL_NT can be set in user mode and isn't cleared
  525                          * automatically when the kernel is entered.  This
  526                          * causes a TSS fault when the kernel attempts to
  527                          * `iret' because the TSS link is uninitialized.  We
  528                          * want to get this fault so that we can fix the
  529                          * problem here and not every time the kernel is
  530                          * entered.
  531                          */
  532                         if (frame.tf_eflags & PSL_NT) {
  533                                 frame.tf_eflags &= ~PSL_NT;
  534                                 goto out;
  535                         }
  536                         break;
  537 
  538                 case T_TRCTRAP:  /* trace trap */
  539                         if (frame.tf_eip == (int)IDTVEC(lcall_syscall)) {
  540                                 /*
  541                                  * We've just entered system mode via the
  542                                  * syscall lcall.  Continue single stepping
  543                                  * silently until the syscall handler has
  544                                  * saved the flags.
  545                                  */
  546                                 goto out;
  547                         }
  548                         if (frame.tf_eip == (int)IDTVEC(lcall_syscall) + 1) {
  549                                 /*
  550                                  * The syscall handler has now saved the
  551                                  * flags.  Stop single stepping it.
  552                                  */
  553                                 frame.tf_eflags &= ~PSL_T;
  554                                 goto out;
  555                         }
  556                         /*
  557                          * Ignore debug register trace traps due to
  558                          * accesses in the user's address space, which
  559                          * can happen under several conditions such as
  560                          * if a user sets a watchpoint on a buffer and
  561                          * then passes that buffer to a system call.
  562                          * We still want to get TRCTRAPS for addresses
  563                          * in kernel space because that is useful when
  564                          * debugging the kernel.
  565                          */
  566                         /* XXX Giant */
  567                         if (user_dbreg_trap() && 
  568                            !(PCPU_GET(curpcb)->pcb_flags & PCB_VM86CALL)) {
  569                                 /*
  570                                  * Reset breakpoint bits because the
  571                                  * processor doesn't
  572                                  */
  573                                 load_dr6(rdr6() & 0xfffffff0);
  574                                 goto out;
  575                         }
  576                         /*
  577                          * FALLTHROUGH (TRCTRAP kernel mode, kernel address)
  578                          */
  579                 case T_BPTFLT:
  580                         /*
  581                          * If KDB is enabled, let it handle the debugger trap.
  582                          * Otherwise, debugger traps "can't happen".
  583                          */
  584 #ifdef KDB
  585                         /* XXX Giant */
  586                         if (kdb_trap(type, 0, &frame))
  587                                 goto out;
  588 #endif
  589                         break;
  590 
  591 #ifdef DEV_ISA
  592                 case T_NMI:
  593 #ifdef POWERFAIL_NMI
  594                         mtx_lock(&Giant);
  595                         if (time_second - lastalert > 10) {
  596                                 log(LOG_WARNING, "NMI: power fail\n");
  597                                 sysbeep(TIMER_FREQ/880, hz);
  598                                 lastalert = time_second;
  599                         }
  600                         mtx_unlock(&Giant);
  601                         goto out;
  602 #else /* !POWERFAIL_NMI */
  603                         /* XXX Giant */
  604                         /* machine/parity/power fail/"kitchen sink" faults */
  605                         if (isa_nmi(code) == 0) {
  606 #ifdef KDB
  607                                 /*
  608                                  * NMI can be hooked up to a pushbutton
  609                                  * for debugging.
  610                                  */
  611                                 if (kdb_on_nmi) {
  612                                         printf ("NMI ... going to debugger\n");
  613                                         kdb_trap(type, 0, &frame);
  614                                 }
  615 #endif /* KDB */
  616                                 goto out;
  617                         } else if (panic_on_nmi == 0)
  618                                 goto out;
  619                         /* FALLTHROUGH */
  620 #endif /* POWERFAIL_NMI */
  621 #endif /* DEV_ISA */
  622                 }
  623 
  624                 trap_fatal(&frame, eva);
  625                 goto out;
  626         }
  627 
  628         /* Translate fault for emulators (e.g. Linux) */
  629         if (*p->p_sysent->sv_transtrap)
  630                 i = (*p->p_sysent->sv_transtrap)(i, type);
  631 
  632         trapsignal(td, i, ucode);
  633 
  634 #ifdef DEBUG
  635         if (type <= MAX_TRAP_MSG) {
  636                 uprintf("fatal process exception: %s",
  637                         trap_msg[type]);
  638                 if ((type == T_PAGEFLT) || (type == T_PROTFLT))
  639                         uprintf(", fault VA = 0x%lx", (u_long)eva);
  640                 uprintf("\n");
  641         }
  642 #endif
  643 
  644 user:
  645         userret(td, &frame, sticks);
  646         mtx_assert(&Giant, MA_NOTOWNED);
  647 userout:
  648 out:
  649         return;
  650 }
  651 
  652 static int
  653 trap_pfault(frame, usermode, eva)
  654         struct trapframe *frame;
  655         int usermode;
  656         vm_offset_t eva;
  657 {
  658         vm_offset_t va;
  659         struct vmspace *vm = NULL;
  660         vm_map_t map = 0;
  661         int rv = 0;
  662         vm_prot_t ftype;
  663         struct thread *td = curthread;
  664         struct proc *p = td->td_proc;
  665 
  666         va = trunc_page(eva);
  667         if (va >= KERNBASE) {
  668                 /*
  669                  * Don't allow user-mode faults in kernel address space.
  670                  * An exception:  if the faulting address is the invalid
  671                  * instruction entry in the IDT, then the Intel Pentium
  672                  * F00F bug workaround was triggered, and we need to
  673                  * treat it is as an illegal instruction, and not a page
  674                  * fault.
  675                  */
  676 #if defined(I586_CPU) && !defined(NO_F00F_HACK)
  677                 if ((eva == (unsigned int)&idt[6]) && has_f00f_bug)
  678                         return -2;
  679 #endif
  680                 if (usermode)
  681                         goto nogo;
  682 
  683                 map = kernel_map;
  684         } else {
  685                 /*
  686                  * This is a fault on non-kernel virtual memory.
  687                  * vm is initialized above to NULL. If curproc is NULL
  688                  * or curproc->p_vmspace is NULL the fault is fatal.
  689                  */
  690                 if (p != NULL)
  691                         vm = p->p_vmspace;
  692 
  693                 if (vm == NULL)
  694                         goto nogo;
  695 
  696                 map = &vm->vm_map;
  697         }
  698 
  699         if (frame->tf_err & PGEX_W)
  700                 ftype = VM_PROT_WRITE;
  701         else
  702                 ftype = VM_PROT_READ;
  703 
  704         if (map != kernel_map) {
  705                 /*
  706                  * Keep swapout from messing with us during this
  707                  *      critical time.
  708                  */
  709                 PROC_LOCK(p);
  710                 ++p->p_lock;
  711                 PROC_UNLOCK(p);
  712 
  713                 /* Fault in the user page: */
  714                 rv = vm_fault(map, va, ftype,
  715                               (ftype & VM_PROT_WRITE) ? VM_FAULT_DIRTY
  716                                                       : VM_FAULT_NORMAL);
  717 
  718                 PROC_LOCK(p);
  719                 --p->p_lock;
  720                 PROC_UNLOCK(p);
  721         } else {
  722                 /*
  723                  * Don't have to worry about process locking or stacks in the
  724                  * kernel.
  725                  */
  726                 rv = vm_fault(map, va, ftype, VM_FAULT_NORMAL);
  727         }
  728         if (rv == KERN_SUCCESS)
  729                 return (0);
  730 nogo:
  731         if (!usermode) {
  732                 if (td->td_intr_nesting_level == 0 &&
  733                     PCPU_GET(curpcb)->pcb_onfault != NULL) {
  734                         frame->tf_eip = (int)PCPU_GET(curpcb)->pcb_onfault;
  735                         return (0);
  736                 }
  737                 trap_fatal(frame, eva);
  738                 return (-1);
  739         }
  740 
  741         /* kludge to pass faulting virtual address to sendsig */
  742         frame->tf_err = eva;
  743 
  744         return((rv == KERN_PROTECTION_FAILURE) ? SIGBUS : SIGSEGV);
  745 }
  746 
  747 static void
  748 trap_fatal(frame, eva)
  749         struct trapframe *frame;
  750         vm_offset_t eva;
  751 {
  752         int code, type, ss, esp;
  753         struct soft_segment_descriptor softseg;
  754         char *msg;
  755 
  756         code = frame->tf_err;
  757         type = frame->tf_trapno;
  758         sdtossd(&gdt[IDXSEL(frame->tf_cs & 0xffff)].sd, &softseg);
  759 
  760         if (type <= MAX_TRAP_MSG)
  761                 msg = trap_msg[type];
  762         else
  763                 msg = "UNKNOWN";
  764         printf("\n\nFatal trap %d: %s while in %s mode\n", type, msg,
  765             frame->tf_eflags & PSL_VM ? "vm86" :
  766             ISPL(frame->tf_cs) == SEL_UPL ? "user" : "kernel");
  767 #ifdef SMP
  768         /* two separate prints in case of a trap on an unmapped page */
  769         printf("cpuid = %d; ", PCPU_GET(cpuid));
  770         printf("apic id = %02x\n", PCPU_GET(apic_id));
  771 #endif
  772         if (type == T_PAGEFLT) {
  773                 printf("fault virtual address   = 0x%x\n", eva);
  774                 printf("fault code              = %s %s, %s\n",
  775                         code & PGEX_U ? "user" : "supervisor",
  776                         code & PGEX_W ? "write" : "read",
  777                         code & PGEX_P ? "protection violation" : "page not present");
  778         }
  779         printf("instruction pointer     = 0x%x:0x%x\n",
  780                frame->tf_cs & 0xffff, frame->tf_eip);
  781         if ((ISPL(frame->tf_cs) == SEL_UPL) || (frame->tf_eflags & PSL_VM)) {
  782                 ss = frame->tf_ss & 0xffff;
  783                 esp = frame->tf_esp;
  784         } else {
  785                 ss = GSEL(GDATA_SEL, SEL_KPL);
  786                 esp = (int)&frame->tf_esp;
  787         }
  788         printf("stack pointer           = 0x%x:0x%x\n", ss, esp);
  789         printf("frame pointer           = 0x%x:0x%x\n", ss, frame->tf_ebp);
  790         printf("code segment            = base 0x%x, limit 0x%x, type 0x%x\n",
  791                softseg.ssd_base, softseg.ssd_limit, softseg.ssd_type);
  792         printf("                        = DPL %d, pres %d, def32 %d, gran %d\n",
  793                softseg.ssd_dpl, softseg.ssd_p, softseg.ssd_def32,
  794                softseg.ssd_gran);
  795         printf("processor eflags        = ");
  796         if (frame->tf_eflags & PSL_T)
  797                 printf("trace trap, ");
  798         if (frame->tf_eflags & PSL_I)
  799                 printf("interrupt enabled, ");
  800         if (frame->tf_eflags & PSL_NT)
  801                 printf("nested task, ");
  802         if (frame->tf_eflags & PSL_RF)
  803                 printf("resume, ");
  804         if (frame->tf_eflags & PSL_VM)
  805                 printf("vm86, ");
  806         printf("IOPL = %d\n", (frame->tf_eflags & PSL_IOPL) >> 12);
  807         printf("current process         = ");
  808         if (curproc) {
  809                 printf("%lu (%s)\n",
  810                     (u_long)curproc->p_pid, curproc->p_comm ?
  811                     curproc->p_comm : "");
  812         } else {
  813                 printf("Idle\n");
  814         }
  815 
  816 #ifdef KDB
  817         if (kdb_trap(type, 0, frame))
  818                 return;
  819 #endif
  820         printf("trap number             = %d\n", type);
  821         if (type <= MAX_TRAP_MSG)
  822                 panic("%s", trap_msg[type]);
  823         else
  824                 panic("unknown/reserved trap");
  825 }
  826 
  827 /*
  828  * Double fault handler. Called when a fault occurs while writing
  829  * a frame for a trap/exception onto the stack. This usually occurs
  830  * when the stack overflows (such is the case with infinite recursion,
  831  * for example).
  832  *
  833  * XXX Note that the current PTD gets replaced by IdlePTD when the
  834  * task switch occurs. This means that the stack that was active at
  835  * the time of the double fault is not available at <kstack> unless
  836  * the machine was idle when the double fault occurred. The downside
  837  * of this is that "trace <ebp>" in ddb won't work.
  838  */
  839 void
  840 dblfault_handler()
  841 {
  842         printf("\nFatal double fault:\n");
  843         printf("eip = 0x%x\n", PCPU_GET(common_tss.tss_eip));
  844         printf("esp = 0x%x\n", PCPU_GET(common_tss.tss_esp));
  845         printf("ebp = 0x%x\n", PCPU_GET(common_tss.tss_ebp));
  846 #ifdef SMP
  847         /* two separate prints in case of a trap on an unmapped page */
  848         printf("cpuid = %d; ", PCPU_GET(cpuid));
  849         printf("apic id = %02x\n", PCPU_GET(apic_id));
  850 #endif
  851         panic("double fault");
  852 }
  853 
  854 #ifdef I386_CPU
  855 /*
  856  * Compensate for 386 brain damage (missing URKR).
  857  * This is a little simpler than the pagefault handler in trap() because
  858  * it the page tables have already been faulted in and high addresses
  859  * are thrown out early for other reasons.
  860  */
  861 int trapwrite(addr)
  862         unsigned addr;
  863 {
  864         struct thread *td;
  865         struct proc *p;
  866         vm_offset_t va;
  867         struct vmspace *vm;
  868         int rv;
  869 
  870         va = trunc_page((vm_offset_t)addr);
  871         /*
  872          * XXX - MAX is END.  Changed > to >= for temp. fix.
  873          */
  874         if (va >= VM_MAXUSER_ADDRESS)
  875                 return (1);
  876 
  877         td = curthread;
  878         p = td->td_proc;
  879         vm = p->p_vmspace;
  880 
  881         PROC_LOCK(p);
  882         ++p->p_lock;
  883         PROC_UNLOCK(p);
  884 
  885         /*
  886          * fault the data page
  887          */
  888         rv = vm_fault(&vm->vm_map, va, VM_PROT_WRITE, VM_FAULT_DIRTY);
  889 
  890         PROC_LOCK(p);
  891         --p->p_lock;
  892         PROC_UNLOCK(p);
  893 
  894         if (rv != KERN_SUCCESS)
  895                 return 1;
  896 
  897         return (0);
  898 }
  899 #endif
  900 
  901 /*
  902  *      syscall -       system call request C handler
  903  *
  904  *      A system call is essentially treated as a trap.
  905  */
  906 void
  907 syscall(frame)
  908         struct trapframe frame;
  909 {
  910         caddr_t params;
  911         struct sysent *callp;
  912         struct thread *td = curthread;
  913         struct proc *p = td->td_proc;
  914         register_t orig_tf_eflags;
  915         u_int sticks;
  916         int error;
  917         int narg;
  918         int args[8];
  919         u_int code;
  920 
  921         /*
  922          * note: PCPU_LAZY_INC() can only be used if we can afford
  923          * occassional inaccuracy in the count.
  924          */
  925         PCPU_LAZY_INC(cnt.v_syscall);
  926 
  927 #ifdef DIAGNOSTIC
  928         if (ISPL(frame.tf_cs) != SEL_UPL) {
  929                 mtx_lock(&Giant);       /* try to stabilize the system XXX */
  930                 panic("syscall");
  931                 /* NOT REACHED */
  932                 mtx_unlock(&Giant);
  933         }
  934 #endif
  935 
  936         sticks = td->td_sticks;
  937         td->td_frame = &frame;
  938         if (td->td_ucred != p->p_ucred) 
  939                 cred_update_thread(td);
  940         if (p->p_flag & P_SA)
  941                 thread_user_enter(td);
  942         params = (caddr_t)frame.tf_esp + sizeof(int);
  943         code = frame.tf_eax;
  944         orig_tf_eflags = frame.tf_eflags;
  945 
  946         if (p->p_sysent->sv_prepsyscall) {
  947                 /*
  948                  * The prep code is MP aware.
  949                  */
  950                 (*p->p_sysent->sv_prepsyscall)(&frame, args, &code, &params);
  951         } else {
  952                 /*
  953                  * Need to check if this is a 32 bit or 64 bit syscall.
  954                  * fuword is MP aware.
  955                  */
  956                 if (code == SYS_syscall) {
  957                         /*
  958                          * Code is first argument, followed by actual args.
  959                          */
  960                         code = fuword(params);
  961                         params += sizeof(int);
  962                 } else if (code == SYS___syscall) {
  963                         /*
  964                          * Like syscall, but code is a quad, so as to maintain
  965                          * quad alignment for the rest of the arguments.
  966                          */
  967                         code = fuword(params);
  968                         params += sizeof(quad_t);
  969                 }
  970         }
  971 
  972         if (p->p_sysent->sv_mask)
  973                 code &= p->p_sysent->sv_mask;
  974 
  975         if (code >= p->p_sysent->sv_size)
  976                 callp = &p->p_sysent->sv_table[0];
  977         else
  978                 callp = &p->p_sysent->sv_table[code];
  979 
  980         narg = callp->sy_narg & SYF_ARGMASK;
  981 
  982         /*
  983          * copyin and the ktrsyscall()/ktrsysret() code is MP-aware
  984          */
  985         if (params != NULL && narg != 0)
  986                 error = copyin(params, (caddr_t)args,
  987                     (u_int)(narg * sizeof(int)));
  988         else
  989                 error = 0;
  990                 
  991 #ifdef KTRACE
  992         if (KTRPOINT(td, KTR_SYSCALL))
  993                 ktrsyscall(code, narg, args);
  994 #endif
  995 
  996         CTR4(KTR_SYSC, "syscall enter thread %p pid %d proc %s code %d", td,
  997             td->td_proc->p_pid, td->td_proc->p_comm, code);
  998 
  999         /*
 1000          * Try to run the syscall without Giant if the syscall
 1001          * is MP safe.
 1002          */
 1003         if ((callp->sy_narg & SYF_MPSAFE) == 0)
 1004                 mtx_lock(&Giant);
 1005 
 1006         if (error == 0) {
 1007                 td->td_retval[0] = 0;
 1008                 td->td_retval[1] = frame.tf_edx;
 1009 
 1010                 STOPEVENT(p, S_SCE, narg);
 1011 
 1012                 PTRACESTOP_SC(p, td, S_PT_SCE);
 1013 
 1014                 error = (*callp->sy_call)(td, args);
 1015         }
 1016 
 1017         switch (error) {
 1018         case 0:
 1019                 frame.tf_eax = td->td_retval[0];
 1020                 frame.tf_edx = td->td_retval[1];
 1021                 frame.tf_eflags &= ~PSL_C;
 1022                 break;
 1023 
 1024         case ERESTART:
 1025                 /*
 1026                  * Reconstruct pc, assuming lcall $X,y is 7 bytes,
 1027                  * int 0x80 is 2 bytes. We saved this in tf_err.
 1028                  */
 1029                 frame.tf_eip -= frame.tf_err;
 1030                 break;
 1031 
 1032         case EJUSTRETURN:
 1033                 break;
 1034 
 1035         default:
 1036                 if (p->p_sysent->sv_errsize) {
 1037                         if (error >= p->p_sysent->sv_errsize)
 1038                                 error = -1;     /* XXX */
 1039                         else
 1040                                 error = p->p_sysent->sv_errtbl[error];
 1041                 }
 1042                 frame.tf_eax = error;
 1043                 frame.tf_eflags |= PSL_C;
 1044                 break;
 1045         }
 1046 
 1047         /*
 1048          * Release Giant if we previously set it.
 1049          */
 1050         if ((callp->sy_narg & SYF_MPSAFE) == 0)
 1051                 mtx_unlock(&Giant);
 1052 
 1053         /*
 1054          * Traced syscall.
 1055          */
 1056         if ((orig_tf_eflags & PSL_T) && !(orig_tf_eflags & PSL_VM)) {
 1057                 frame.tf_eflags &= ~PSL_T;
 1058                 trapsignal(td, SIGTRAP, 0);
 1059         }
 1060 
 1061         /*
 1062          * Handle reschedule and other end-of-syscall issues
 1063          */
 1064         userret(td, &frame, sticks);
 1065 
 1066         CTR4(KTR_SYSC, "syscall exit thread %p pid %d proc %s code %d", td,
 1067             td->td_proc->p_pid, td->td_proc->p_comm, code);
 1068 
 1069 #ifdef KTRACE
 1070         if (KTRPOINT(td, KTR_SYSRET))
 1071                 ktrsysret(code, error, td->td_retval[0]);
 1072 #endif
 1073 
 1074         /*
 1075          * This works because errno is findable through the
 1076          * register set.  If we ever support an emulation where this
 1077          * is not the case, this code will need to be revisited.
 1078          */
 1079         STOPEVENT(p, S_SCX, code);
 1080 
 1081         PTRACESTOP_SC(p, td, S_PT_SCX);
 1082 
 1083         WITNESS_WARN(WARN_PANIC, NULL, "System call %s returning",
 1084             (code >= 0 && code < SYS_MAXSYSCALL) ? syscallnames[code] : "???");
 1085         mtx_assert(&sched_lock, MA_NOTOWNED);
 1086         mtx_assert(&Giant, MA_NOTOWNED);
 1087 }
 1088 

Cache object: 678bdab19301677cc432a2e20ed966bc


[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]


This page is part of the FreeBSD/Linux Linux Kernel Cross-Reference, and was automatically generated using a modified version of the LXR engine.