Now available: The Design and Implementation of the FreeBSD Operating System (Second Edition)
[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]
FreeBSD/Linux Kernel Cross Reference
sys/i386/i386/trap.c
Version:
- FREEBSD - FREEBSD-13-STABLE - FREEBSD-13-0 - FREEBSD-12-STABLE - FREEBSD-12-0 - FREEBSD-11-STABLE - FREEBSD-11-0 - FREEBSD-10-STABLE - FREEBSD-10-0 - FREEBSD-9-STABLE - FREEBSD-9-0 - FREEBSD-8-STABLE - FREEBSD-8-0 - FREEBSD-7-STABLE - FREEBSD-7-0 - FREEBSD-6-STABLE - FREEBSD-6-0 - FREEBSD-5-STABLE - FREEBSD-5-0 - FREEBSD-4-STABLE - FREEBSD-3-STABLE - FREEBSD22 - l41 - OPENBSD - linux-2.6 - MK84 - PLAN9 - xnu-8792
SearchContext: - none - 3 - 10
SearchContext: - none - 3 - 10
1 /*- 2 * Copyright (C) 1994, David Greenman 3 * Copyright (c) 1990, 1993 4 * The Regents of the University of California. All rights reserved. 5 * 6 * This code is derived from software contributed to Berkeley by 7 * the University of Utah, and William Jolitz. 8 * 9 * Redistribution and use in source and binary forms, with or without 10 * modification, are permitted provided that the following conditions 11 * are met: 12 * 1. Redistributions of source code must retain the above copyright 13 * notice, this list of conditions and the following disclaimer. 14 * 2. Redistributions in binary form must reproduce the above copyright 15 * notice, this list of conditions and the following disclaimer in the 16 * documentation and/or other materials provided with the distribution. 17 * 3. All advertising materials mentioning features or use of this software 18 * must display the following acknowledgement: 19 * This product includes software developed by the University of 20 * California, Berkeley and its contributors. 21 * 4. Neither the name of the University nor the names of its contributors 22 * may be used to endorse or promote products derived from this software 23 * without specific prior written permission. 24 * 25 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 26 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 27 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 28 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 29 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 30 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 31 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 32 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 33 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 34 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 35 * SUCH DAMAGE. 36 * 37 * from: @(#)trap.c 7.4 (Berkeley) 5/13/91 38 */ 39 40 #include <sys/cdefs.h> 41 __FBSDID("$FreeBSD$"); 42 43 /* 44 * 386 Trap and System call handling 45 */ 46 47 #include "opt_clock.h" 48 #include "opt_cpu.h" 49 #include "opt_isa.h" 50 #include "opt_ktrace.h" 51 #include "opt_npx.h" 52 #include "opt_trap.h" 53 54 #include <sys/param.h> 55 #include <sys/bus.h> 56 #include <sys/systm.h> 57 #include <sys/proc.h> 58 #include <sys/pioctl.h> 59 #include <sys/ptrace.h> 60 #include <sys/kdb.h> 61 #include <sys/kernel.h> 62 #include <sys/ktr.h> 63 #include <sys/lock.h> 64 #include <sys/mutex.h> 65 #include <sys/resourcevar.h> 66 #include <sys/signalvar.h> 67 #include <sys/syscall.h> 68 #include <sys/sysctl.h> 69 #include <sys/sysent.h> 70 #include <sys/uio.h> 71 #include <sys/vmmeter.h> 72 #ifdef KTRACE 73 #include <sys/ktrace.h> 74 #endif 75 76 #include <vm/vm.h> 77 #include <vm/vm_param.h> 78 #include <vm/pmap.h> 79 #include <vm/vm_kern.h> 80 #include <vm/vm_map.h> 81 #include <vm/vm_page.h> 82 #include <vm/vm_extern.h> 83 84 #include <machine/cpu.h> 85 #include <machine/intr_machdep.h> 86 #include <machine/md_var.h> 87 #include <machine/pcb.h> 88 #ifdef SMP 89 #include <machine/smp.h> 90 #endif 91 #include <machine/tss.h> 92 #include <machine/vm86.h> 93 94 #ifdef POWERFAIL_NMI 95 #include <sys/syslog.h> 96 #include <machine/clock.h> 97 #endif 98 99 extern void trap(struct trapframe frame); 100 #ifdef I386_CPU 101 extern int trapwrite(unsigned addr); 102 #endif 103 extern void syscall(struct trapframe frame); 104 105 static int trap_pfault(struct trapframe *, int, vm_offset_t); 106 static void trap_fatal(struct trapframe *, vm_offset_t); 107 void dblfault_handler(void); 108 109 extern inthand_t IDTVEC(lcall_syscall); 110 111 #define MAX_TRAP_MSG 30 112 static char *trap_msg[] = { 113 "", /* 0 unused */ 114 "privileged instruction fault", /* 1 T_PRIVINFLT */ 115 "", /* 2 unused */ 116 "breakpoint instruction fault", /* 3 T_BPTFLT */ 117 "", /* 4 unused */ 118 "", /* 5 unused */ 119 "arithmetic trap", /* 6 T_ARITHTRAP */ 120 "", /* 7 unused */ 121 "", /* 8 unused */ 122 "general protection fault", /* 9 T_PROTFLT */ 123 "trace trap", /* 10 T_TRCTRAP */ 124 "", /* 11 unused */ 125 "page fault", /* 12 T_PAGEFLT */ 126 "", /* 13 unused */ 127 "alignment fault", /* 14 T_ALIGNFLT */ 128 "", /* 15 unused */ 129 "", /* 16 unused */ 130 "", /* 17 unused */ 131 "integer divide fault", /* 18 T_DIVIDE */ 132 "non-maskable interrupt trap", /* 19 T_NMI */ 133 "overflow trap", /* 20 T_OFLOW */ 134 "FPU bounds check fault", /* 21 T_BOUND */ 135 "FPU device not available", /* 22 T_DNA */ 136 "double fault", /* 23 T_DOUBLEFLT */ 137 "FPU operand fetch fault", /* 24 T_FPOPFLT */ 138 "invalid TSS fault", /* 25 T_TSSFLT */ 139 "segment not present fault", /* 26 T_SEGNPFLT */ 140 "stack fault", /* 27 T_STKFLT */ 141 "machine check trap", /* 28 T_MCHK */ 142 "SIMD floating-point exception", /* 29 T_XMMFLT */ 143 "reserved (unknown) fault", /* 30 T_RESERVED */ 144 }; 145 146 #if defined(I586_CPU) && !defined(NO_F00F_HACK) 147 extern int has_f00f_bug; 148 #endif 149 150 #ifdef KDB 151 static int kdb_on_nmi = 1; 152 SYSCTL_INT(_machdep, OID_AUTO, kdb_on_nmi, CTLFLAG_RW, 153 &kdb_on_nmi, 0, "Go to KDB on NMI"); 154 #endif 155 static int panic_on_nmi = 1; 156 SYSCTL_INT(_machdep, OID_AUTO, panic_on_nmi, CTLFLAG_RW, 157 &panic_on_nmi, 0, "Panic on NMI"); 158 159 #ifdef WITNESS 160 extern char *syscallnames[]; 161 #endif 162 163 #ifdef DEVICE_POLLING 164 extern u_int32_t poll_in_trap; 165 extern int ether_poll(int count); 166 #endif /* DEVICE_POLLING */ 167 168 /* 169 * Exception, fault, and trap interface to the FreeBSD kernel. 170 * This common code is called from assembly language IDT gate entry 171 * routines that prepare a suitable stack frame, and restore this 172 * frame after the exception has been processed. 173 */ 174 175 void 176 trap(frame) 177 struct trapframe frame; 178 { 179 struct thread *td = curthread; 180 struct proc *p = td->td_proc; 181 u_int sticks = 0; 182 int i = 0, ucode = 0, type, code; 183 vm_offset_t eva; 184 #ifdef POWERFAIL_NMI 185 static int lastalert = 0; 186 #endif 187 188 atomic_add_int(&cnt.v_trap, 1); 189 type = frame.tf_trapno; 190 191 #ifdef KDB_STOP_NMI 192 /* Handler for NMI IPIs used for debugging */ 193 if (type == T_NMI) { 194 if (ipi_nmi_handler() == 0) 195 goto out; 196 } 197 #endif /* KDB_STOP_NMI */ 198 199 #ifdef KDB 200 if (kdb_active) { 201 kdb_reenter(); 202 goto out; 203 } 204 #endif 205 206 if ((frame.tf_eflags & PSL_I) == 0) { 207 /* 208 * Buggy application or kernel code has disabled 209 * interrupts and then trapped. Enabling interrupts 210 * now is wrong, but it is better than running with 211 * interrupts disabled until they are accidentally 212 * enabled later. 213 */ 214 if (ISPL(frame.tf_cs) == SEL_UPL || (frame.tf_eflags & PSL_VM)) 215 printf( 216 "pid %ld (%s): trap %d with interrupts disabled\n", 217 (long)curproc->p_pid, curproc->p_comm, type); 218 else if (type != T_BPTFLT && type != T_TRCTRAP && 219 frame.tf_eip != (int)cpu_switch_load_gs) { 220 /* 221 * XXX not quite right, since this may be for a 222 * multiple fault in user mode. 223 */ 224 printf("kernel trap %d with interrupts disabled\n", 225 type); 226 /* 227 * Page faults need interrupts diasabled until later, 228 * and we shouldn't enable interrupts while in a 229 * critical section. 230 */ 231 if (type != T_PAGEFLT && td->td_critnest == 0) 232 enable_intr(); 233 } 234 } 235 236 eva = 0; 237 code = frame.tf_err; 238 if (type == T_PAGEFLT) { 239 /* 240 * For some Cyrix CPUs, %cr2 is clobbered by 241 * interrupts. This problem is worked around by using 242 * an interrupt gate for the pagefault handler. We 243 * are finally ready to read %cr2 and then must 244 * reenable interrupts. 245 * 246 * If we get a page fault while in a critical section, then 247 * it is most likely a fatal kernel page fault. The kernel 248 * is already going to panic trying to get a sleep lock to 249 * do the VM lookup, so just consider it a fatal trap so the 250 * kernel can print out a useful trap message and even get 251 * to the debugger. 252 */ 253 eva = rcr2(); 254 if (td->td_critnest == 0) 255 enable_intr(); 256 else 257 trap_fatal(&frame, eva); 258 } 259 260 #ifdef DEVICE_POLLING 261 if (poll_in_trap) 262 ether_poll(poll_in_trap); 263 #endif /* DEVICE_POLLING */ 264 265 if ((ISPL(frame.tf_cs) == SEL_UPL) || 266 ((frame.tf_eflags & PSL_VM) && 267 !(PCPU_GET(curpcb)->pcb_flags & PCB_VM86CALL))) { 268 /* user trap */ 269 270 sticks = td->td_sticks; 271 td->td_frame = &frame; 272 if (td->td_ucred != p->p_ucred) 273 cred_update_thread(td); 274 275 switch (type) { 276 case T_PRIVINFLT: /* privileged instruction fault */ 277 ucode = type; 278 i = SIGILL; 279 break; 280 281 case T_BPTFLT: /* bpt instruction fault */ 282 case T_TRCTRAP: /* trace trap */ 283 enable_intr(); 284 frame.tf_eflags &= ~PSL_T; 285 i = SIGTRAP; 286 break; 287 288 case T_ARITHTRAP: /* arithmetic trap */ 289 #ifdef DEV_NPX 290 ucode = npxtrap(); 291 if (ucode == -1) 292 goto userout; 293 #else 294 ucode = code; 295 #endif 296 i = SIGFPE; 297 break; 298 299 /* 300 * The following two traps can happen in 301 * vm86 mode, and, if so, we want to handle 302 * them specially. 303 */ 304 case T_PROTFLT: /* general protection fault */ 305 case T_STKFLT: /* stack fault */ 306 if (frame.tf_eflags & PSL_VM) { 307 i = vm86_emulate((struct vm86frame *)&frame); 308 if (i == 0) 309 goto user; 310 break; 311 } 312 /* FALLTHROUGH */ 313 314 case T_SEGNPFLT: /* segment not present fault */ 315 case T_TSSFLT: /* invalid TSS fault */ 316 case T_DOUBLEFLT: /* double fault */ 317 default: 318 ucode = code + BUS_SEGM_FAULT ; 319 i = SIGBUS; 320 break; 321 322 case T_PAGEFLT: /* page fault */ 323 if (td->td_pflags & TDP_SA) 324 thread_user_enter(td); 325 326 i = trap_pfault(&frame, TRUE, eva); 327 #if defined(I586_CPU) && !defined(NO_F00F_HACK) 328 if (i == -2) { 329 /* 330 * The f00f hack workaround has triggered, so 331 * treat the fault as an illegal instruction 332 * (T_PRIVINFLT) instead of a page fault. 333 */ 334 type = frame.tf_trapno = T_PRIVINFLT; 335 336 /* Proceed as in that case. */ 337 ucode = type; 338 i = SIGILL; 339 break; 340 } 341 #endif 342 if (i == -1) 343 goto userout; 344 if (i == 0) 345 goto user; 346 347 ucode = T_PAGEFLT; 348 break; 349 350 case T_DIVIDE: /* integer divide fault */ 351 ucode = FPE_INTDIV; 352 i = SIGFPE; 353 break; 354 355 #ifdef DEV_ISA 356 case T_NMI: 357 #ifdef POWERFAIL_NMI 358 #ifndef TIMER_FREQ 359 # define TIMER_FREQ 1193182 360 #endif 361 mtx_lock(&Giant); 362 if (time_second - lastalert > 10) { 363 log(LOG_WARNING, "NMI: power fail\n"); 364 sysbeep(TIMER_FREQ/880, hz); 365 lastalert = time_second; 366 } 367 mtx_unlock(&Giant); 368 goto userout; 369 #else /* !POWERFAIL_NMI */ 370 /* machine/parity/power fail/"kitchen sink" faults */ 371 /* XXX Giant */ 372 if (isa_nmi(code) == 0) { 373 #ifdef KDB 374 /* 375 * NMI can be hooked up to a pushbutton 376 * for debugging. 377 */ 378 if (kdb_on_nmi) { 379 printf ("NMI ... going to debugger\n"); 380 kdb_trap(type, 0, &frame); 381 } 382 #endif /* KDB */ 383 goto userout; 384 } else if (panic_on_nmi) 385 panic("NMI indicates hardware failure"); 386 break; 387 #endif /* POWERFAIL_NMI */ 388 #endif /* DEV_ISA */ 389 390 case T_OFLOW: /* integer overflow fault */ 391 ucode = FPE_INTOVF; 392 i = SIGFPE; 393 break; 394 395 case T_BOUND: /* bounds check fault */ 396 ucode = FPE_FLTSUB; 397 i = SIGFPE; 398 break; 399 400 case T_DNA: 401 #ifdef DEV_NPX 402 /* transparent fault (due to context switch "late") */ 403 if (npxdna()) 404 goto userout; 405 #endif 406 i = SIGFPE; 407 ucode = FPE_FPU_NP_TRAP; 408 break; 409 410 case T_FPOPFLT: /* FPU operand fetch fault */ 411 ucode = T_FPOPFLT; 412 i = SIGILL; 413 break; 414 415 case T_XMMFLT: /* SIMD floating-point exception */ 416 ucode = 0; /* XXX */ 417 i = SIGFPE; 418 break; 419 } 420 } else { 421 /* kernel trap */ 422 423 KASSERT(cold || td->td_ucred != NULL, 424 ("kernel trap doesn't have ucred")); 425 switch (type) { 426 case T_PAGEFLT: /* page fault */ 427 (void) trap_pfault(&frame, FALSE, eva); 428 goto out; 429 430 case T_DNA: 431 #ifdef DEV_NPX 432 /* 433 * The kernel is apparently using npx for copying. 434 * XXX this should be fatal unless the kernel has 435 * registered such use. 436 */ 437 if (npxdna()) 438 goto out; 439 #endif 440 break; 441 442 /* 443 * The following two traps can happen in 444 * vm86 mode, and, if so, we want to handle 445 * them specially. 446 */ 447 case T_PROTFLT: /* general protection fault */ 448 case T_STKFLT: /* stack fault */ 449 if (frame.tf_eflags & PSL_VM) { 450 i = vm86_emulate((struct vm86frame *)&frame); 451 if (i != 0) 452 /* 453 * returns to original process 454 */ 455 vm86_trap((struct vm86frame *)&frame); 456 goto out; 457 } 458 if (type == T_STKFLT) 459 break; 460 461 /* FALL THROUGH */ 462 463 case T_SEGNPFLT: /* segment not present fault */ 464 if (PCPU_GET(curpcb)->pcb_flags & PCB_VM86CALL) 465 break; 466 467 /* 468 * Invalid %fs's and %gs's can be created using 469 * procfs or PT_SETREGS or by invalidating the 470 * underlying LDT entry. This causes a fault 471 * in kernel mode when the kernel attempts to 472 * switch contexts. Lose the bad context 473 * (XXX) so that we can continue, and generate 474 * a signal. 475 */ 476 if (frame.tf_eip == (int)cpu_switch_load_gs) { 477 PCPU_GET(curpcb)->pcb_gs = 0; 478 #if 0 479 PROC_LOCK(p); 480 psignal(p, SIGBUS); 481 PROC_UNLOCK(p); 482 #endif 483 goto out; 484 } 485 486 if (td->td_intr_nesting_level != 0) 487 break; 488 489 /* 490 * Invalid segment selectors and out of bounds 491 * %eip's and %esp's can be set up in user mode. 492 * This causes a fault in kernel mode when the 493 * kernel tries to return to user mode. We want 494 * to get this fault so that we can fix the 495 * problem here and not have to check all the 496 * selectors and pointers when the user changes 497 * them. 498 */ 499 if (frame.tf_eip == (int)doreti_iret) { 500 frame.tf_eip = (int)doreti_iret_fault; 501 goto out; 502 } 503 if (frame.tf_eip == (int)doreti_popl_ds) { 504 frame.tf_eip = (int)doreti_popl_ds_fault; 505 goto out; 506 } 507 if (frame.tf_eip == (int)doreti_popl_es) { 508 frame.tf_eip = (int)doreti_popl_es_fault; 509 goto out; 510 } 511 if (frame.tf_eip == (int)doreti_popl_fs) { 512 frame.tf_eip = (int)doreti_popl_fs_fault; 513 goto out; 514 } 515 if (PCPU_GET(curpcb)->pcb_onfault != NULL) { 516 frame.tf_eip = 517 (int)PCPU_GET(curpcb)->pcb_onfault; 518 goto out; 519 } 520 break; 521 522 case T_TSSFLT: 523 /* 524 * PSL_NT can be set in user mode and isn't cleared 525 * automatically when the kernel is entered. This 526 * causes a TSS fault when the kernel attempts to 527 * `iret' because the TSS link is uninitialized. We 528 * want to get this fault so that we can fix the 529 * problem here and not every time the kernel is 530 * entered. 531 */ 532 if (frame.tf_eflags & PSL_NT) { 533 frame.tf_eflags &= ~PSL_NT; 534 goto out; 535 } 536 break; 537 538 case T_TRCTRAP: /* trace trap */ 539 if (frame.tf_eip == (int)IDTVEC(lcall_syscall)) { 540 /* 541 * We've just entered system mode via the 542 * syscall lcall. Continue single stepping 543 * silently until the syscall handler has 544 * saved the flags. 545 */ 546 goto out; 547 } 548 if (frame.tf_eip == (int)IDTVEC(lcall_syscall) + 1) { 549 /* 550 * The syscall handler has now saved the 551 * flags. Stop single stepping it. 552 */ 553 frame.tf_eflags &= ~PSL_T; 554 goto out; 555 } 556 /* 557 * Ignore debug register trace traps due to 558 * accesses in the user's address space, which 559 * can happen under several conditions such as 560 * if a user sets a watchpoint on a buffer and 561 * then passes that buffer to a system call. 562 * We still want to get TRCTRAPS for addresses 563 * in kernel space because that is useful when 564 * debugging the kernel. 565 */ 566 /* XXX Giant */ 567 if (user_dbreg_trap() && 568 !(PCPU_GET(curpcb)->pcb_flags & PCB_VM86CALL)) { 569 /* 570 * Reset breakpoint bits because the 571 * processor doesn't 572 */ 573 load_dr6(rdr6() & 0xfffffff0); 574 goto out; 575 } 576 /* 577 * FALLTHROUGH (TRCTRAP kernel mode, kernel address) 578 */ 579 case T_BPTFLT: 580 /* 581 * If KDB is enabled, let it handle the debugger trap. 582 * Otherwise, debugger traps "can't happen". 583 */ 584 #ifdef KDB 585 /* XXX Giant */ 586 if (kdb_trap(type, 0, &frame)) 587 goto out; 588 #endif 589 break; 590 591 #ifdef DEV_ISA 592 case T_NMI: 593 #ifdef POWERFAIL_NMI 594 mtx_lock(&Giant); 595 if (time_second - lastalert > 10) { 596 log(LOG_WARNING, "NMI: power fail\n"); 597 sysbeep(TIMER_FREQ/880, hz); 598 lastalert = time_second; 599 } 600 mtx_unlock(&Giant); 601 goto out; 602 #else /* !POWERFAIL_NMI */ 603 /* XXX Giant */ 604 /* machine/parity/power fail/"kitchen sink" faults */ 605 if (isa_nmi(code) == 0) { 606 #ifdef KDB 607 /* 608 * NMI can be hooked up to a pushbutton 609 * for debugging. 610 */ 611 if (kdb_on_nmi) { 612 printf ("NMI ... going to debugger\n"); 613 kdb_trap(type, 0, &frame); 614 } 615 #endif /* KDB */ 616 goto out; 617 } else if (panic_on_nmi == 0) 618 goto out; 619 /* FALLTHROUGH */ 620 #endif /* POWERFAIL_NMI */ 621 #endif /* DEV_ISA */ 622 } 623 624 trap_fatal(&frame, eva); 625 goto out; 626 } 627 628 /* Translate fault for emulators (e.g. Linux) */ 629 if (*p->p_sysent->sv_transtrap) 630 i = (*p->p_sysent->sv_transtrap)(i, type); 631 632 trapsignal(td, i, ucode); 633 634 #ifdef DEBUG 635 if (type <= MAX_TRAP_MSG) { 636 uprintf("fatal process exception: %s", 637 trap_msg[type]); 638 if ((type == T_PAGEFLT) || (type == T_PROTFLT)) 639 uprintf(", fault VA = 0x%lx", (u_long)eva); 640 uprintf("\n"); 641 } 642 #endif 643 644 user: 645 userret(td, &frame, sticks); 646 mtx_assert(&Giant, MA_NOTOWNED); 647 userout: 648 out: 649 return; 650 } 651 652 static int 653 trap_pfault(frame, usermode, eva) 654 struct trapframe *frame; 655 int usermode; 656 vm_offset_t eva; 657 { 658 vm_offset_t va; 659 struct vmspace *vm = NULL; 660 vm_map_t map = 0; 661 int rv = 0; 662 vm_prot_t ftype; 663 struct thread *td = curthread; 664 struct proc *p = td->td_proc; 665 666 va = trunc_page(eva); 667 if (va >= KERNBASE) { 668 /* 669 * Don't allow user-mode faults in kernel address space. 670 * An exception: if the faulting address is the invalid 671 * instruction entry in the IDT, then the Intel Pentium 672 * F00F bug workaround was triggered, and we need to 673 * treat it is as an illegal instruction, and not a page 674 * fault. 675 */ 676 #if defined(I586_CPU) && !defined(NO_F00F_HACK) 677 if ((eva == (unsigned int)&idt[6]) && has_f00f_bug) 678 return -2; 679 #endif 680 if (usermode) 681 goto nogo; 682 683 map = kernel_map; 684 } else { 685 /* 686 * This is a fault on non-kernel virtual memory. 687 * vm is initialized above to NULL. If curproc is NULL 688 * or curproc->p_vmspace is NULL the fault is fatal. 689 */ 690 if (p != NULL) 691 vm = p->p_vmspace; 692 693 if (vm == NULL) 694 goto nogo; 695 696 map = &vm->vm_map; 697 } 698 699 if (frame->tf_err & PGEX_W) 700 ftype = VM_PROT_WRITE; 701 else 702 ftype = VM_PROT_READ; 703 704 if (map != kernel_map) { 705 /* 706 * Keep swapout from messing with us during this 707 * critical time. 708 */ 709 PROC_LOCK(p); 710 ++p->p_lock; 711 PROC_UNLOCK(p); 712 713 /* Fault in the user page: */ 714 rv = vm_fault(map, va, ftype, 715 (ftype & VM_PROT_WRITE) ? VM_FAULT_DIRTY 716 : VM_FAULT_NORMAL); 717 718 PROC_LOCK(p); 719 --p->p_lock; 720 PROC_UNLOCK(p); 721 } else { 722 /* 723 * Don't have to worry about process locking or stacks in the 724 * kernel. 725 */ 726 rv = vm_fault(map, va, ftype, VM_FAULT_NORMAL); 727 } 728 if (rv == KERN_SUCCESS) 729 return (0); 730 nogo: 731 if (!usermode) { 732 if (td->td_intr_nesting_level == 0 && 733 PCPU_GET(curpcb)->pcb_onfault != NULL) { 734 frame->tf_eip = (int)PCPU_GET(curpcb)->pcb_onfault; 735 return (0); 736 } 737 trap_fatal(frame, eva); 738 return (-1); 739 } 740 741 /* kludge to pass faulting virtual address to sendsig */ 742 frame->tf_err = eva; 743 744 return((rv == KERN_PROTECTION_FAILURE) ? SIGBUS : SIGSEGV); 745 } 746 747 static void 748 trap_fatal(frame, eva) 749 struct trapframe *frame; 750 vm_offset_t eva; 751 { 752 int code, type, ss, esp; 753 struct soft_segment_descriptor softseg; 754 char *msg; 755 756 code = frame->tf_err; 757 type = frame->tf_trapno; 758 sdtossd(&gdt[IDXSEL(frame->tf_cs & 0xffff)].sd, &softseg); 759 760 if (type <= MAX_TRAP_MSG) 761 msg = trap_msg[type]; 762 else 763 msg = "UNKNOWN"; 764 printf("\n\nFatal trap %d: %s while in %s mode\n", type, msg, 765 frame->tf_eflags & PSL_VM ? "vm86" : 766 ISPL(frame->tf_cs) == SEL_UPL ? "user" : "kernel"); 767 #ifdef SMP 768 /* two separate prints in case of a trap on an unmapped page */ 769 printf("cpuid = %d; ", PCPU_GET(cpuid)); 770 printf("apic id = %02x\n", PCPU_GET(apic_id)); 771 #endif 772 if (type == T_PAGEFLT) { 773 printf("fault virtual address = 0x%x\n", eva); 774 printf("fault code = %s %s, %s\n", 775 code & PGEX_U ? "user" : "supervisor", 776 code & PGEX_W ? "write" : "read", 777 code & PGEX_P ? "protection violation" : "page not present"); 778 } 779 printf("instruction pointer = 0x%x:0x%x\n", 780 frame->tf_cs & 0xffff, frame->tf_eip); 781 if ((ISPL(frame->tf_cs) == SEL_UPL) || (frame->tf_eflags & PSL_VM)) { 782 ss = frame->tf_ss & 0xffff; 783 esp = frame->tf_esp; 784 } else { 785 ss = GSEL(GDATA_SEL, SEL_KPL); 786 esp = (int)&frame->tf_esp; 787 } 788 printf("stack pointer = 0x%x:0x%x\n", ss, esp); 789 printf("frame pointer = 0x%x:0x%x\n", ss, frame->tf_ebp); 790 printf("code segment = base 0x%x, limit 0x%x, type 0x%x\n", 791 softseg.ssd_base, softseg.ssd_limit, softseg.ssd_type); 792 printf(" = DPL %d, pres %d, def32 %d, gran %d\n", 793 softseg.ssd_dpl, softseg.ssd_p, softseg.ssd_def32, 794 softseg.ssd_gran); 795 printf("processor eflags = "); 796 if (frame->tf_eflags & PSL_T) 797 printf("trace trap, "); 798 if (frame->tf_eflags & PSL_I) 799 printf("interrupt enabled, "); 800 if (frame->tf_eflags & PSL_NT) 801 printf("nested task, "); 802 if (frame->tf_eflags & PSL_RF) 803 printf("resume, "); 804 if (frame->tf_eflags & PSL_VM) 805 printf("vm86, "); 806 printf("IOPL = %d\n", (frame->tf_eflags & PSL_IOPL) >> 12); 807 printf("current process = "); 808 if (curproc) { 809 printf("%lu (%s)\n", 810 (u_long)curproc->p_pid, curproc->p_comm ? 811 curproc->p_comm : ""); 812 } else { 813 printf("Idle\n"); 814 } 815 816 #ifdef KDB 817 if (kdb_trap(type, 0, frame)) 818 return; 819 #endif 820 printf("trap number = %d\n", type); 821 if (type <= MAX_TRAP_MSG) 822 panic("%s", trap_msg[type]); 823 else 824 panic("unknown/reserved trap"); 825 } 826 827 /* 828 * Double fault handler. Called when a fault occurs while writing 829 * a frame for a trap/exception onto the stack. This usually occurs 830 * when the stack overflows (such is the case with infinite recursion, 831 * for example). 832 * 833 * XXX Note that the current PTD gets replaced by IdlePTD when the 834 * task switch occurs. This means that the stack that was active at 835 * the time of the double fault is not available at <kstack> unless 836 * the machine was idle when the double fault occurred. The downside 837 * of this is that "trace <ebp>" in ddb won't work. 838 */ 839 void 840 dblfault_handler() 841 { 842 printf("\nFatal double fault:\n"); 843 printf("eip = 0x%x\n", PCPU_GET(common_tss.tss_eip)); 844 printf("esp = 0x%x\n", PCPU_GET(common_tss.tss_esp)); 845 printf("ebp = 0x%x\n", PCPU_GET(common_tss.tss_ebp)); 846 #ifdef SMP 847 /* two separate prints in case of a trap on an unmapped page */ 848 printf("cpuid = %d; ", PCPU_GET(cpuid)); 849 printf("apic id = %02x\n", PCPU_GET(apic_id)); 850 #endif 851 panic("double fault"); 852 } 853 854 #ifdef I386_CPU 855 /* 856 * Compensate for 386 brain damage (missing URKR). 857 * This is a little simpler than the pagefault handler in trap() because 858 * it the page tables have already been faulted in and high addresses 859 * are thrown out early for other reasons. 860 */ 861 int trapwrite(addr) 862 unsigned addr; 863 { 864 struct thread *td; 865 struct proc *p; 866 vm_offset_t va; 867 struct vmspace *vm; 868 int rv; 869 870 va = trunc_page((vm_offset_t)addr); 871 /* 872 * XXX - MAX is END. Changed > to >= for temp. fix. 873 */ 874 if (va >= VM_MAXUSER_ADDRESS) 875 return (1); 876 877 td = curthread; 878 p = td->td_proc; 879 vm = p->p_vmspace; 880 881 PROC_LOCK(p); 882 ++p->p_lock; 883 PROC_UNLOCK(p); 884 885 /* 886 * fault the data page 887 */ 888 rv = vm_fault(&vm->vm_map, va, VM_PROT_WRITE, VM_FAULT_DIRTY); 889 890 PROC_LOCK(p); 891 --p->p_lock; 892 PROC_UNLOCK(p); 893 894 if (rv != KERN_SUCCESS) 895 return 1; 896 897 return (0); 898 } 899 #endif 900 901 /* 902 * syscall - system call request C handler 903 * 904 * A system call is essentially treated as a trap. 905 */ 906 void 907 syscall(frame) 908 struct trapframe frame; 909 { 910 caddr_t params; 911 struct sysent *callp; 912 struct thread *td = curthread; 913 struct proc *p = td->td_proc; 914 register_t orig_tf_eflags; 915 u_int sticks; 916 int error; 917 int narg; 918 int args[8]; 919 u_int code; 920 921 /* 922 * note: PCPU_LAZY_INC() can only be used if we can afford 923 * occassional inaccuracy in the count. 924 */ 925 PCPU_LAZY_INC(cnt.v_syscall); 926 927 #ifdef DIAGNOSTIC 928 if (ISPL(frame.tf_cs) != SEL_UPL) { 929 mtx_lock(&Giant); /* try to stabilize the system XXX */ 930 panic("syscall"); 931 /* NOT REACHED */ 932 mtx_unlock(&Giant); 933 } 934 #endif 935 936 sticks = td->td_sticks; 937 td->td_frame = &frame; 938 if (td->td_ucred != p->p_ucred) 939 cred_update_thread(td); 940 if (p->p_flag & P_SA) 941 thread_user_enter(td); 942 params = (caddr_t)frame.tf_esp + sizeof(int); 943 code = frame.tf_eax; 944 orig_tf_eflags = frame.tf_eflags; 945 946 if (p->p_sysent->sv_prepsyscall) { 947 /* 948 * The prep code is MP aware. 949 */ 950 (*p->p_sysent->sv_prepsyscall)(&frame, args, &code, ¶ms); 951 } else { 952 /* 953 * Need to check if this is a 32 bit or 64 bit syscall. 954 * fuword is MP aware. 955 */ 956 if (code == SYS_syscall) { 957 /* 958 * Code is first argument, followed by actual args. 959 */ 960 code = fuword(params); 961 params += sizeof(int); 962 } else if (code == SYS___syscall) { 963 /* 964 * Like syscall, but code is a quad, so as to maintain 965 * quad alignment for the rest of the arguments. 966 */ 967 code = fuword(params); 968 params += sizeof(quad_t); 969 } 970 } 971 972 if (p->p_sysent->sv_mask) 973 code &= p->p_sysent->sv_mask; 974 975 if (code >= p->p_sysent->sv_size) 976 callp = &p->p_sysent->sv_table[0]; 977 else 978 callp = &p->p_sysent->sv_table[code]; 979 980 narg = callp->sy_narg & SYF_ARGMASK; 981 982 /* 983 * copyin and the ktrsyscall()/ktrsysret() code is MP-aware 984 */ 985 if (params != NULL && narg != 0) 986 error = copyin(params, (caddr_t)args, 987 (u_int)(narg * sizeof(int))); 988 else 989 error = 0; 990 991 #ifdef KTRACE 992 if (KTRPOINT(td, KTR_SYSCALL)) 993 ktrsyscall(code, narg, args); 994 #endif 995 996 CTR4(KTR_SYSC, "syscall enter thread %p pid %d proc %s code %d", td, 997 td->td_proc->p_pid, td->td_proc->p_comm, code); 998 999 /* 1000 * Try to run the syscall without Giant if the syscall 1001 * is MP safe. 1002 */ 1003 if ((callp->sy_narg & SYF_MPSAFE) == 0) 1004 mtx_lock(&Giant); 1005 1006 if (error == 0) { 1007 td->td_retval[0] = 0; 1008 td->td_retval[1] = frame.tf_edx; 1009 1010 STOPEVENT(p, S_SCE, narg); 1011 1012 PTRACESTOP_SC(p, td, S_PT_SCE); 1013 1014 error = (*callp->sy_call)(td, args); 1015 } 1016 1017 switch (error) { 1018 case 0: 1019 frame.tf_eax = td->td_retval[0]; 1020 frame.tf_edx = td->td_retval[1]; 1021 frame.tf_eflags &= ~PSL_C; 1022 break; 1023 1024 case ERESTART: 1025 /* 1026 * Reconstruct pc, assuming lcall $X,y is 7 bytes, 1027 * int 0x80 is 2 bytes. We saved this in tf_err. 1028 */ 1029 frame.tf_eip -= frame.tf_err; 1030 break; 1031 1032 case EJUSTRETURN: 1033 break; 1034 1035 default: 1036 if (p->p_sysent->sv_errsize) { 1037 if (error >= p->p_sysent->sv_errsize) 1038 error = -1; /* XXX */ 1039 else 1040 error = p->p_sysent->sv_errtbl[error]; 1041 } 1042 frame.tf_eax = error; 1043 frame.tf_eflags |= PSL_C; 1044 break; 1045 } 1046 1047 /* 1048 * Release Giant if we previously set it. 1049 */ 1050 if ((callp->sy_narg & SYF_MPSAFE) == 0) 1051 mtx_unlock(&Giant); 1052 1053 /* 1054 * Traced syscall. 1055 */ 1056 if ((orig_tf_eflags & PSL_T) && !(orig_tf_eflags & PSL_VM)) { 1057 frame.tf_eflags &= ~PSL_T; 1058 trapsignal(td, SIGTRAP, 0); 1059 } 1060 1061 /* 1062 * Handle reschedule and other end-of-syscall issues 1063 */ 1064 userret(td, &frame, sticks); 1065 1066 CTR4(KTR_SYSC, "syscall exit thread %p pid %d proc %s code %d", td, 1067 td->td_proc->p_pid, td->td_proc->p_comm, code); 1068 1069 #ifdef KTRACE 1070 if (KTRPOINT(td, KTR_SYSRET)) 1071 ktrsysret(code, error, td->td_retval[0]); 1072 #endif 1073 1074 /* 1075 * This works because errno is findable through the 1076 * register set. If we ever support an emulation where this 1077 * is not the case, this code will need to be revisited. 1078 */ 1079 STOPEVENT(p, S_SCX, code); 1080 1081 PTRACESTOP_SC(p, td, S_PT_SCX); 1082 1083 WITNESS_WARN(WARN_PANIC, NULL, "System call %s returning", 1084 (code >= 0 && code < SYS_MAXSYSCALL) ? syscallnames[code] : "???"); 1085 mtx_assert(&sched_lock, MA_NOTOWNED); 1086 mtx_assert(&Giant, MA_NOTOWNED); 1087 } 1088
Cache object: c10f1ee5c4bbb024b9f8121dfe15b5a1
[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]