Now available: The Design and Implementation of the FreeBSD Operating System (Second Edition)
[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]
FreeBSD/Linux Kernel Cross Reference
sys/i386/i386/trap.c
Version:
- FREEBSD - FREEBSD-13-STABLE - FREEBSD-13-0 - FREEBSD-12-STABLE - FREEBSD-12-0 - FREEBSD-11-STABLE - FREEBSD-11-0 - FREEBSD-10-STABLE - FREEBSD-10-0 - FREEBSD-9-STABLE - FREEBSD-9-0 - FREEBSD-8-STABLE - FREEBSD-8-0 - FREEBSD-7-STABLE - FREEBSD-7-0 - FREEBSD-6-STABLE - FREEBSD-6-0 - FREEBSD-5-STABLE - FREEBSD-5-0 - FREEBSD-4-STABLE - FREEBSD-3-STABLE - FREEBSD22 - l41 - OPENBSD - linux-2.6 - MK84 - PLAN9 - xnu-8792
SearchContext: - none - 3 - 10
SearchContext: - none - 3 - 10
1 /*- 2 * Copyright (C) 1994, David Greenman 3 * Copyright (c) 1990, 1993 4 * The Regents of the University of California. All rights reserved. 5 * 6 * This code is derived from software contributed to Berkeley by 7 * the University of Utah, and William Jolitz. 8 * 9 * Redistribution and use in source and binary forms, with or without 10 * modification, are permitted provided that the following conditions 11 * are met: 12 * 1. Redistributions of source code must retain the above copyright 13 * notice, this list of conditions and the following disclaimer. 14 * 2. Redistributions in binary form must reproduce the above copyright 15 * notice, this list of conditions and the following disclaimer in the 16 * documentation and/or other materials provided with the distribution. 17 * 3. All advertising materials mentioning features or use of this software 18 * must display the following acknowledgement: 19 * This product includes software developed by the University of 20 * California, Berkeley and its contributors. 21 * 4. Neither the name of the University nor the names of its contributors 22 * may be used to endorse or promote products derived from this software 23 * without specific prior written permission. 24 * 25 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 26 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 27 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 28 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 29 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 30 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 31 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 32 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 33 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 34 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 35 * SUCH DAMAGE. 36 * 37 * from: @(#)trap.c 7.4 (Berkeley) 5/13/91 38 */ 39 40 #include <sys/cdefs.h> 41 __FBSDID("$FreeBSD: releng/6.2/sys/i386/i386/trap.c 161901 2006-09-02 17:12:46Z rwatson $"); 42 43 /* 44 * 386 Trap and System call handling 45 */ 46 47 #include "opt_clock.h" 48 #include "opt_cpu.h" 49 #include "opt_hwpmc_hooks.h" 50 #include "opt_isa.h" 51 #include "opt_kdb.h" 52 #include "opt_ktrace.h" 53 #include "opt_npx.h" 54 #include "opt_trap.h" 55 56 #include <sys/param.h> 57 #include <sys/bus.h> 58 #include <sys/systm.h> 59 #include <sys/proc.h> 60 #include <sys/pioctl.h> 61 #include <sys/ptrace.h> 62 #include <sys/kdb.h> 63 #include <sys/kernel.h> 64 #include <sys/ktr.h> 65 #include <sys/lock.h> 66 #include <sys/mutex.h> 67 #include <sys/resourcevar.h> 68 #include <sys/signalvar.h> 69 #include <sys/syscall.h> 70 #include <sys/sysctl.h> 71 #include <sys/sysent.h> 72 #include <sys/uio.h> 73 #include <sys/vmmeter.h> 74 #ifdef KTRACE 75 #include <sys/ktrace.h> 76 #endif 77 #ifdef HWPMC_HOOKS 78 #include <sys/pmckern.h> 79 #endif 80 #include <security/audit/audit.h> 81 82 #include <vm/vm.h> 83 #include <vm/vm_param.h> 84 #include <vm/pmap.h> 85 #include <vm/vm_kern.h> 86 #include <vm/vm_map.h> 87 #include <vm/vm_page.h> 88 #include <vm/vm_extern.h> 89 90 #include <machine/cpu.h> 91 #include <machine/intr_machdep.h> 92 #include <machine/md_var.h> 93 #include <machine/pcb.h> 94 #ifdef SMP 95 #include <machine/smp.h> 96 #endif 97 #include <machine/tss.h> 98 #include <machine/vm86.h> 99 100 #ifdef POWERFAIL_NMI 101 #include <sys/syslog.h> 102 #include <machine/clock.h> 103 #endif 104 105 extern void trap(struct trapframe frame); 106 extern void syscall(struct trapframe frame); 107 108 static int trap_pfault(struct trapframe *, int, vm_offset_t); 109 static void trap_fatal(struct trapframe *, vm_offset_t); 110 void dblfault_handler(void); 111 112 extern inthand_t IDTVEC(lcall_syscall); 113 114 #define MAX_TRAP_MSG 30 115 static char *trap_msg[] = { 116 "", /* 0 unused */ 117 "privileged instruction fault", /* 1 T_PRIVINFLT */ 118 "", /* 2 unused */ 119 "breakpoint instruction fault", /* 3 T_BPTFLT */ 120 "", /* 4 unused */ 121 "", /* 5 unused */ 122 "arithmetic trap", /* 6 T_ARITHTRAP */ 123 "", /* 7 unused */ 124 "", /* 8 unused */ 125 "general protection fault", /* 9 T_PROTFLT */ 126 "trace trap", /* 10 T_TRCTRAP */ 127 "", /* 11 unused */ 128 "page fault", /* 12 T_PAGEFLT */ 129 "", /* 13 unused */ 130 "alignment fault", /* 14 T_ALIGNFLT */ 131 "", /* 15 unused */ 132 "", /* 16 unused */ 133 "", /* 17 unused */ 134 "integer divide fault", /* 18 T_DIVIDE */ 135 "non-maskable interrupt trap", /* 19 T_NMI */ 136 "overflow trap", /* 20 T_OFLOW */ 137 "FPU bounds check fault", /* 21 T_BOUND */ 138 "FPU device not available", /* 22 T_DNA */ 139 "double fault", /* 23 T_DOUBLEFLT */ 140 "FPU operand fetch fault", /* 24 T_FPOPFLT */ 141 "invalid TSS fault", /* 25 T_TSSFLT */ 142 "segment not present fault", /* 26 T_SEGNPFLT */ 143 "stack fault", /* 27 T_STKFLT */ 144 "machine check trap", /* 28 T_MCHK */ 145 "SIMD floating-point exception", /* 29 T_XMMFLT */ 146 "reserved (unknown) fault", /* 30 T_RESERVED */ 147 }; 148 149 #if defined(I586_CPU) && !defined(NO_F00F_HACK) 150 extern int has_f00f_bug; 151 #endif 152 153 #ifdef KDB 154 static int kdb_on_nmi = 1; 155 SYSCTL_INT(_machdep, OID_AUTO, kdb_on_nmi, CTLFLAG_RW, 156 &kdb_on_nmi, 0, "Go to KDB on NMI"); 157 #endif 158 static int panic_on_nmi = 1; 159 SYSCTL_INT(_machdep, OID_AUTO, panic_on_nmi, CTLFLAG_RW, 160 &panic_on_nmi, 0, "Panic on NMI"); 161 162 #ifdef WITNESS 163 extern char *syscallnames[]; 164 #endif 165 166 /* 167 * Exception, fault, and trap interface to the FreeBSD kernel. 168 * This common code is called from assembly language IDT gate entry 169 * routines that prepare a suitable stack frame, and restore this 170 * frame after the exception has been processed. 171 */ 172 173 void 174 trap(frame) 175 struct trapframe frame; 176 { 177 struct thread *td = curthread; 178 struct proc *p = td->td_proc; 179 u_int sticks = 0; 180 int i = 0, ucode = 0, type, code; 181 vm_offset_t eva; 182 #ifdef POWERFAIL_NMI 183 static int lastalert = 0; 184 #endif 185 186 PCPU_LAZY_INC(cnt.v_trap); 187 type = frame.tf_trapno; 188 189 #ifdef KDB_STOP_NMI 190 /* Handler for NMI IPIs used for debugging */ 191 if (type == T_NMI) { 192 if (ipi_nmi_handler() == 0) 193 goto out; 194 } 195 #endif /* KDB_STOP_NMI */ 196 197 #ifdef KDB 198 if (kdb_active) { 199 kdb_reenter(); 200 goto out; 201 } 202 #endif 203 204 #ifdef HWPMC_HOOKS 205 /* 206 * CPU PMCs interrupt using an NMI so we check for that first. 207 * If the HWPMC module is active, 'pmc_hook' will point to 208 * the function to be called. A return value of '1' from the 209 * hook means that the NMI was handled by it and that we can 210 * return immediately. 211 */ 212 if (type == T_NMI && pmc_intr && 213 (*pmc_intr)(PCPU_GET(cpuid), (uintptr_t) frame.tf_eip, 214 TRAPF_USERMODE(&frame))) 215 goto out; 216 #endif 217 218 if ((frame.tf_eflags & PSL_I) == 0) { 219 /* 220 * Buggy application or kernel code has disabled 221 * interrupts and then trapped. Enabling interrupts 222 * now is wrong, but it is better than running with 223 * interrupts disabled until they are accidentally 224 * enabled later. 225 */ 226 if (ISPL(frame.tf_cs) == SEL_UPL || (frame.tf_eflags & PSL_VM)) 227 printf( 228 "pid %ld (%s): trap %d with interrupts disabled\n", 229 (long)curproc->p_pid, curproc->p_comm, type); 230 else if (type != T_BPTFLT && type != T_TRCTRAP && 231 frame.tf_eip != (int)cpu_switch_load_gs) { 232 /* 233 * XXX not quite right, since this may be for a 234 * multiple fault in user mode. 235 */ 236 printf("kernel trap %d with interrupts disabled\n", 237 type); 238 /* 239 * Page faults need interrupts disabled until later, 240 * and we shouldn't enable interrupts while in a 241 * critical section or if servicing an NMI. 242 */ 243 if (type != T_NMI && type != T_PAGEFLT && 244 td->td_critnest == 0) 245 enable_intr(); 246 } 247 } 248 249 eva = 0; 250 code = frame.tf_err; 251 if (type == T_PAGEFLT) { 252 /* 253 * For some Cyrix CPUs, %cr2 is clobbered by 254 * interrupts. This problem is worked around by using 255 * an interrupt gate for the pagefault handler. We 256 * are finally ready to read %cr2 and then must 257 * reenable interrupts. 258 * 259 * If we get a page fault while in a critical section, then 260 * it is most likely a fatal kernel page fault. The kernel 261 * is already going to panic trying to get a sleep lock to 262 * do the VM lookup, so just consider it a fatal trap so the 263 * kernel can print out a useful trap message and even get 264 * to the debugger. 265 */ 266 eva = rcr2(); 267 if (td->td_critnest == 0) 268 enable_intr(); 269 else 270 trap_fatal(&frame, eva); 271 } 272 273 if ((ISPL(frame.tf_cs) == SEL_UPL) || 274 ((frame.tf_eflags & PSL_VM) && 275 !(PCPU_GET(curpcb)->pcb_flags & PCB_VM86CALL))) { 276 /* user trap */ 277 278 sticks = td->td_sticks; 279 td->td_frame = &frame; 280 if (td->td_ucred != p->p_ucred) 281 cred_update_thread(td); 282 283 switch (type) { 284 case T_PRIVINFLT: /* privileged instruction fault */ 285 ucode = type; 286 i = SIGILL; 287 break; 288 289 case T_BPTFLT: /* bpt instruction fault */ 290 case T_TRCTRAP: /* trace trap */ 291 enable_intr(); 292 frame.tf_eflags &= ~PSL_T; 293 i = SIGTRAP; 294 break; 295 296 case T_ARITHTRAP: /* arithmetic trap */ 297 #ifdef DEV_NPX 298 ucode = npxtrap(); 299 if (ucode == -1) 300 goto userout; 301 #else 302 ucode = code; 303 #endif 304 i = SIGFPE; 305 break; 306 307 /* 308 * The following two traps can happen in 309 * vm86 mode, and, if so, we want to handle 310 * them specially. 311 */ 312 case T_PROTFLT: /* general protection fault */ 313 case T_STKFLT: /* stack fault */ 314 if (frame.tf_eflags & PSL_VM) { 315 i = vm86_emulate((struct vm86frame *)&frame); 316 if (i == 0) 317 goto user; 318 break; 319 } 320 /* FALLTHROUGH */ 321 322 case T_SEGNPFLT: /* segment not present fault */ 323 case T_TSSFLT: /* invalid TSS fault */ 324 case T_DOUBLEFLT: /* double fault */ 325 default: 326 ucode = code + BUS_SEGM_FAULT ; 327 i = SIGBUS; 328 break; 329 330 case T_PAGEFLT: /* page fault */ 331 if (td->td_pflags & TDP_SA) 332 thread_user_enter(td); 333 334 i = trap_pfault(&frame, TRUE, eva); 335 #if defined(I586_CPU) && !defined(NO_F00F_HACK) 336 if (i == -2) { 337 /* 338 * The f00f hack workaround has triggered, so 339 * treat the fault as an illegal instruction 340 * (T_PRIVINFLT) instead of a page fault. 341 */ 342 type = frame.tf_trapno = T_PRIVINFLT; 343 344 /* Proceed as in that case. */ 345 ucode = type; 346 i = SIGILL; 347 break; 348 } 349 #endif 350 if (i == -1) 351 goto userout; 352 if (i == 0) 353 goto user; 354 355 ucode = T_PAGEFLT; 356 break; 357 358 case T_DIVIDE: /* integer divide fault */ 359 ucode = FPE_INTDIV; 360 i = SIGFPE; 361 break; 362 363 #ifdef DEV_ISA 364 case T_NMI: 365 #ifdef POWERFAIL_NMI 366 #ifndef TIMER_FREQ 367 # define TIMER_FREQ 1193182 368 #endif 369 mtx_lock(&Giant); 370 if (time_second - lastalert > 10) { 371 log(LOG_WARNING, "NMI: power fail\n"); 372 sysbeep(TIMER_FREQ/880, hz); 373 lastalert = time_second; 374 } 375 mtx_unlock(&Giant); 376 goto userout; 377 #else /* !POWERFAIL_NMI */ 378 /* machine/parity/power fail/"kitchen sink" faults */ 379 /* XXX Giant */ 380 if (isa_nmi(code) == 0) { 381 #ifdef KDB 382 /* 383 * NMI can be hooked up to a pushbutton 384 * for debugging. 385 */ 386 if (kdb_on_nmi) { 387 printf ("NMI ... going to debugger\n"); 388 kdb_trap(type, 0, &frame); 389 } 390 #endif /* KDB */ 391 goto userout; 392 } else if (panic_on_nmi) 393 panic("NMI indicates hardware failure"); 394 break; 395 #endif /* POWERFAIL_NMI */ 396 #endif /* DEV_ISA */ 397 398 case T_OFLOW: /* integer overflow fault */ 399 ucode = FPE_INTOVF; 400 i = SIGFPE; 401 break; 402 403 case T_BOUND: /* bounds check fault */ 404 ucode = FPE_FLTSUB; 405 i = SIGFPE; 406 break; 407 408 case T_DNA: 409 #ifdef DEV_NPX 410 /* transparent fault (due to context switch "late") */ 411 if (npxdna()) 412 goto userout; 413 #endif 414 i = SIGFPE; 415 ucode = FPE_FPU_NP_TRAP; 416 break; 417 418 case T_FPOPFLT: /* FPU operand fetch fault */ 419 ucode = T_FPOPFLT; 420 i = SIGILL; 421 break; 422 423 case T_XMMFLT: /* SIMD floating-point exception */ 424 ucode = 0; /* XXX */ 425 i = SIGFPE; 426 break; 427 } 428 } else { 429 /* kernel trap */ 430 431 KASSERT(cold || td->td_ucred != NULL, 432 ("kernel trap doesn't have ucred")); 433 switch (type) { 434 case T_PAGEFLT: /* page fault */ 435 (void) trap_pfault(&frame, FALSE, eva); 436 goto out; 437 438 case T_DNA: 439 #ifdef DEV_NPX 440 /* 441 * The kernel is apparently using npx for copying. 442 * XXX this should be fatal unless the kernel has 443 * registered such use. 444 */ 445 if (npxdna()) 446 goto out; 447 #endif 448 break; 449 450 /* 451 * The following two traps can happen in 452 * vm86 mode, and, if so, we want to handle 453 * them specially. 454 */ 455 case T_PROTFLT: /* general protection fault */ 456 case T_STKFLT: /* stack fault */ 457 if (frame.tf_eflags & PSL_VM) { 458 i = vm86_emulate((struct vm86frame *)&frame); 459 if (i != 0) 460 /* 461 * returns to original process 462 */ 463 vm86_trap((struct vm86frame *)&frame); 464 goto out; 465 } 466 if (type == T_STKFLT) 467 break; 468 469 /* FALL THROUGH */ 470 471 case T_SEGNPFLT: /* segment not present fault */ 472 if (PCPU_GET(curpcb)->pcb_flags & PCB_VM86CALL) 473 break; 474 475 /* 476 * Invalid %fs's and %gs's can be created using 477 * procfs or PT_SETREGS or by invalidating the 478 * underlying LDT entry. This causes a fault 479 * in kernel mode when the kernel attempts to 480 * switch contexts. Lose the bad context 481 * (XXX) so that we can continue, and generate 482 * a signal. 483 */ 484 if (frame.tf_eip == (int)cpu_switch_load_gs) { 485 PCPU_GET(curpcb)->pcb_gs = 0; 486 #if 0 487 PROC_LOCK(p); 488 psignal(p, SIGBUS); 489 PROC_UNLOCK(p); 490 #endif 491 goto out; 492 } 493 494 if (td->td_intr_nesting_level != 0) 495 break; 496 497 /* 498 * Invalid segment selectors and out of bounds 499 * %eip's and %esp's can be set up in user mode. 500 * This causes a fault in kernel mode when the 501 * kernel tries to return to user mode. We want 502 * to get this fault so that we can fix the 503 * problem here and not have to check all the 504 * selectors and pointers when the user changes 505 * them. 506 */ 507 if (frame.tf_eip == (int)doreti_iret) { 508 frame.tf_eip = (int)doreti_iret_fault; 509 goto out; 510 } 511 if (frame.tf_eip == (int)doreti_popl_ds) { 512 frame.tf_eip = (int)doreti_popl_ds_fault; 513 goto out; 514 } 515 if (frame.tf_eip == (int)doreti_popl_es) { 516 frame.tf_eip = (int)doreti_popl_es_fault; 517 goto out; 518 } 519 if (frame.tf_eip == (int)doreti_popl_fs) { 520 frame.tf_eip = (int)doreti_popl_fs_fault; 521 goto out; 522 } 523 if (PCPU_GET(curpcb)->pcb_onfault != NULL) { 524 frame.tf_eip = 525 (int)PCPU_GET(curpcb)->pcb_onfault; 526 goto out; 527 } 528 break; 529 530 case T_TSSFLT: 531 /* 532 * PSL_NT can be set in user mode and isn't cleared 533 * automatically when the kernel is entered. This 534 * causes a TSS fault when the kernel attempts to 535 * `iret' because the TSS link is uninitialized. We 536 * want to get this fault so that we can fix the 537 * problem here and not every time the kernel is 538 * entered. 539 */ 540 if (frame.tf_eflags & PSL_NT) { 541 frame.tf_eflags &= ~PSL_NT; 542 goto out; 543 } 544 break; 545 546 case T_TRCTRAP: /* trace trap */ 547 if (frame.tf_eip == (int)IDTVEC(lcall_syscall)) { 548 /* 549 * We've just entered system mode via the 550 * syscall lcall. Continue single stepping 551 * silently until the syscall handler has 552 * saved the flags. 553 */ 554 goto out; 555 } 556 if (frame.tf_eip == (int)IDTVEC(lcall_syscall) + 1) { 557 /* 558 * The syscall handler has now saved the 559 * flags. Stop single stepping it. 560 */ 561 frame.tf_eflags &= ~PSL_T; 562 goto out; 563 } 564 /* 565 * Ignore debug register trace traps due to 566 * accesses in the user's address space, which 567 * can happen under several conditions such as 568 * if a user sets a watchpoint on a buffer and 569 * then passes that buffer to a system call. 570 * We still want to get TRCTRAPS for addresses 571 * in kernel space because that is useful when 572 * debugging the kernel. 573 */ 574 /* XXX Giant */ 575 if (user_dbreg_trap() && 576 !(PCPU_GET(curpcb)->pcb_flags & PCB_VM86CALL)) { 577 /* 578 * Reset breakpoint bits because the 579 * processor doesn't 580 */ 581 load_dr6(rdr6() & 0xfffffff0); 582 goto out; 583 } 584 /* 585 * FALLTHROUGH (TRCTRAP kernel mode, kernel address) 586 */ 587 case T_BPTFLT: 588 /* 589 * If KDB is enabled, let it handle the debugger trap. 590 * Otherwise, debugger traps "can't happen". 591 */ 592 #ifdef KDB 593 /* XXX Giant */ 594 if (kdb_trap(type, 0, &frame)) 595 goto out; 596 #endif 597 break; 598 599 #ifdef DEV_ISA 600 case T_NMI: 601 #ifdef POWERFAIL_NMI 602 mtx_lock(&Giant); 603 if (time_second - lastalert > 10) { 604 log(LOG_WARNING, "NMI: power fail\n"); 605 sysbeep(TIMER_FREQ/880, hz); 606 lastalert = time_second; 607 } 608 mtx_unlock(&Giant); 609 goto out; 610 #else /* !POWERFAIL_NMI */ 611 /* XXX Giant */ 612 /* machine/parity/power fail/"kitchen sink" faults */ 613 if (isa_nmi(code) == 0) { 614 #ifdef KDB 615 /* 616 * NMI can be hooked up to a pushbutton 617 * for debugging. 618 */ 619 if (kdb_on_nmi) { 620 printf ("NMI ... going to debugger\n"); 621 kdb_trap(type, 0, &frame); 622 } 623 #endif /* KDB */ 624 goto out; 625 } else if (panic_on_nmi == 0) 626 goto out; 627 /* FALLTHROUGH */ 628 #endif /* POWERFAIL_NMI */ 629 #endif /* DEV_ISA */ 630 } 631 632 trap_fatal(&frame, eva); 633 goto out; 634 } 635 636 /* Translate fault for emulators (e.g. Linux) */ 637 if (*p->p_sysent->sv_transtrap) 638 i = (*p->p_sysent->sv_transtrap)(i, type); 639 640 trapsignal(td, i, ucode); 641 642 #ifdef DEBUG 643 if (type <= MAX_TRAP_MSG) { 644 uprintf("fatal process exception: %s", 645 trap_msg[type]); 646 if ((type == T_PAGEFLT) || (type == T_PROTFLT)) 647 uprintf(", fault VA = 0x%lx", (u_long)eva); 648 uprintf("\n"); 649 } 650 #endif 651 652 user: 653 userret(td, &frame, sticks); 654 mtx_assert(&Giant, MA_NOTOWNED); 655 userout: 656 out: 657 return; 658 } 659 660 static int 661 trap_pfault(frame, usermode, eva) 662 struct trapframe *frame; 663 int usermode; 664 vm_offset_t eva; 665 { 666 vm_offset_t va; 667 struct vmspace *vm = NULL; 668 vm_map_t map = 0; 669 int rv = 0; 670 vm_prot_t ftype; 671 struct thread *td = curthread; 672 struct proc *p = td->td_proc; 673 674 va = trunc_page(eva); 675 if (va >= KERNBASE) { 676 /* 677 * Don't allow user-mode faults in kernel address space. 678 * An exception: if the faulting address is the invalid 679 * instruction entry in the IDT, then the Intel Pentium 680 * F00F bug workaround was triggered, and we need to 681 * treat it is as an illegal instruction, and not a page 682 * fault. 683 */ 684 #if defined(I586_CPU) && !defined(NO_F00F_HACK) 685 if ((eva == (unsigned int)&idt[6]) && has_f00f_bug) 686 return -2; 687 #endif 688 if (usermode) 689 goto nogo; 690 691 map = kernel_map; 692 } else { 693 /* 694 * This is a fault on non-kernel virtual memory. 695 * vm is initialized above to NULL. If curproc is NULL 696 * or curproc->p_vmspace is NULL the fault is fatal. 697 */ 698 if (p != NULL) 699 vm = p->p_vmspace; 700 701 if (vm == NULL) 702 goto nogo; 703 704 map = &vm->vm_map; 705 } 706 707 if (frame->tf_err & PGEX_W) 708 ftype = VM_PROT_WRITE; 709 else 710 ftype = VM_PROT_READ; 711 712 if (map != kernel_map) { 713 /* 714 * Keep swapout from messing with us during this 715 * critical time. 716 */ 717 PROC_LOCK(p); 718 ++p->p_lock; 719 PROC_UNLOCK(p); 720 721 /* Fault in the user page: */ 722 rv = vm_fault(map, va, ftype, 723 (ftype & VM_PROT_WRITE) ? VM_FAULT_DIRTY 724 : VM_FAULT_NORMAL); 725 726 PROC_LOCK(p); 727 --p->p_lock; 728 PROC_UNLOCK(p); 729 } else { 730 /* 731 * Don't have to worry about process locking or stacks in the 732 * kernel. 733 */ 734 rv = vm_fault(map, va, ftype, VM_FAULT_NORMAL); 735 } 736 if (rv == KERN_SUCCESS) 737 return (0); 738 nogo: 739 if (!usermode) { 740 if (td->td_intr_nesting_level == 0 && 741 PCPU_GET(curpcb)->pcb_onfault != NULL) { 742 frame->tf_eip = (int)PCPU_GET(curpcb)->pcb_onfault; 743 return (0); 744 } 745 trap_fatal(frame, eva); 746 return (-1); 747 } 748 749 /* kludge to pass faulting virtual address to sendsig */ 750 frame->tf_err = eva; 751 752 return((rv == KERN_PROTECTION_FAILURE) ? SIGBUS : SIGSEGV); 753 } 754 755 static void 756 trap_fatal(frame, eva) 757 struct trapframe *frame; 758 vm_offset_t eva; 759 { 760 int code, type, ss, esp; 761 struct soft_segment_descriptor softseg; 762 char *msg; 763 764 code = frame->tf_err; 765 type = frame->tf_trapno; 766 sdtossd(&gdt[IDXSEL(frame->tf_cs & 0xffff)].sd, &softseg); 767 768 if (type <= MAX_TRAP_MSG) 769 msg = trap_msg[type]; 770 else 771 msg = "UNKNOWN"; 772 printf("\n\nFatal trap %d: %s while in %s mode\n", type, msg, 773 frame->tf_eflags & PSL_VM ? "vm86" : 774 ISPL(frame->tf_cs) == SEL_UPL ? "user" : "kernel"); 775 #ifdef SMP 776 /* two separate prints in case of a trap on an unmapped page */ 777 printf("cpuid = %d; ", PCPU_GET(cpuid)); 778 printf("apic id = %02x\n", PCPU_GET(apic_id)); 779 #endif 780 if (type == T_PAGEFLT) { 781 printf("fault virtual address = 0x%x\n", eva); 782 printf("fault code = %s %s, %s\n", 783 code & PGEX_U ? "user" : "supervisor", 784 code & PGEX_W ? "write" : "read", 785 code & PGEX_P ? "protection violation" : "page not present"); 786 } 787 printf("instruction pointer = 0x%x:0x%x\n", 788 frame->tf_cs & 0xffff, frame->tf_eip); 789 if ((ISPL(frame->tf_cs) == SEL_UPL) || (frame->tf_eflags & PSL_VM)) { 790 ss = frame->tf_ss & 0xffff; 791 esp = frame->tf_esp; 792 } else { 793 ss = GSEL(GDATA_SEL, SEL_KPL); 794 esp = (int)&frame->tf_esp; 795 } 796 printf("stack pointer = 0x%x:0x%x\n", ss, esp); 797 printf("frame pointer = 0x%x:0x%x\n", ss, frame->tf_ebp); 798 printf("code segment = base 0x%x, limit 0x%x, type 0x%x\n", 799 softseg.ssd_base, softseg.ssd_limit, softseg.ssd_type); 800 printf(" = DPL %d, pres %d, def32 %d, gran %d\n", 801 softseg.ssd_dpl, softseg.ssd_p, softseg.ssd_def32, 802 softseg.ssd_gran); 803 printf("processor eflags = "); 804 if (frame->tf_eflags & PSL_T) 805 printf("trace trap, "); 806 if (frame->tf_eflags & PSL_I) 807 printf("interrupt enabled, "); 808 if (frame->tf_eflags & PSL_NT) 809 printf("nested task, "); 810 if (frame->tf_eflags & PSL_RF) 811 printf("resume, "); 812 if (frame->tf_eflags & PSL_VM) 813 printf("vm86, "); 814 printf("IOPL = %d\n", (frame->tf_eflags & PSL_IOPL) >> 12); 815 printf("current process = "); 816 if (curproc) { 817 printf("%lu (%s)\n", 818 (u_long)curproc->p_pid, curproc->p_comm ? 819 curproc->p_comm : ""); 820 } else { 821 printf("Idle\n"); 822 } 823 824 #ifdef KDB 825 if (debugger_on_panic || kdb_active) { 826 register_t eflags; 827 eflags = intr_disable(); 828 if (kdb_trap(type, 0, frame)) { 829 intr_restore(eflags); 830 return; 831 } 832 intr_restore(eflags); 833 } 834 #endif 835 printf("trap number = %d\n", type); 836 if (type <= MAX_TRAP_MSG) 837 panic("%s", trap_msg[type]); 838 else 839 panic("unknown/reserved trap"); 840 } 841 842 /* 843 * Double fault handler. Called when a fault occurs while writing 844 * a frame for a trap/exception onto the stack. This usually occurs 845 * when the stack overflows (such is the case with infinite recursion, 846 * for example). 847 * 848 * XXX Note that the current PTD gets replaced by IdlePTD when the 849 * task switch occurs. This means that the stack that was active at 850 * the time of the double fault is not available at <kstack> unless 851 * the machine was idle when the double fault occurred. The downside 852 * of this is that "trace <ebp>" in ddb won't work. 853 */ 854 void 855 dblfault_handler() 856 { 857 printf("\nFatal double fault:\n"); 858 printf("eip = 0x%x\n", PCPU_GET(common_tss.tss_eip)); 859 printf("esp = 0x%x\n", PCPU_GET(common_tss.tss_esp)); 860 printf("ebp = 0x%x\n", PCPU_GET(common_tss.tss_ebp)); 861 #ifdef SMP 862 /* two separate prints in case of a trap on an unmapped page */ 863 printf("cpuid = %d; ", PCPU_GET(cpuid)); 864 printf("apic id = %02x\n", PCPU_GET(apic_id)); 865 #endif 866 panic("double fault"); 867 } 868 869 /* 870 * syscall - system call request C handler 871 * 872 * A system call is essentially treated as a trap. 873 */ 874 void 875 syscall(frame) 876 struct trapframe frame; 877 { 878 caddr_t params; 879 struct sysent *callp; 880 struct thread *td = curthread; 881 struct proc *p = td->td_proc; 882 register_t orig_tf_eflags; 883 u_int sticks; 884 int error; 885 int narg; 886 int args[8]; 887 u_int code; 888 889 /* 890 * note: PCPU_LAZY_INC() can only be used if we can afford 891 * occassional inaccuracy in the count. 892 */ 893 PCPU_LAZY_INC(cnt.v_syscall); 894 895 #ifdef DIAGNOSTIC 896 if (ISPL(frame.tf_cs) != SEL_UPL) { 897 mtx_lock(&Giant); /* try to stabilize the system XXX */ 898 panic("syscall"); 899 /* NOT REACHED */ 900 mtx_unlock(&Giant); 901 } 902 #endif 903 904 sticks = td->td_sticks; 905 td->td_frame = &frame; 906 if (td->td_ucred != p->p_ucred) 907 cred_update_thread(td); 908 if (p->p_flag & P_SA) 909 thread_user_enter(td); 910 params = (caddr_t)frame.tf_esp + sizeof(int); 911 code = frame.tf_eax; 912 orig_tf_eflags = frame.tf_eflags; 913 914 if (p->p_sysent->sv_prepsyscall) { 915 /* 916 * The prep code is MP aware. 917 */ 918 (*p->p_sysent->sv_prepsyscall)(&frame, args, &code, ¶ms); 919 } else { 920 /* 921 * Need to check if this is a 32 bit or 64 bit syscall. 922 * fuword is MP aware. 923 */ 924 if (code == SYS_syscall) { 925 /* 926 * Code is first argument, followed by actual args. 927 */ 928 code = fuword(params); 929 params += sizeof(int); 930 } else if (code == SYS___syscall) { 931 /* 932 * Like syscall, but code is a quad, so as to maintain 933 * quad alignment for the rest of the arguments. 934 */ 935 code = fuword(params); 936 params += sizeof(quad_t); 937 } 938 } 939 940 if (p->p_sysent->sv_mask) 941 code &= p->p_sysent->sv_mask; 942 943 if (code >= p->p_sysent->sv_size) 944 callp = &p->p_sysent->sv_table[0]; 945 else 946 callp = &p->p_sysent->sv_table[code]; 947 948 narg = callp->sy_narg & SYF_ARGMASK; 949 950 /* 951 * copyin and the ktrsyscall()/ktrsysret() code is MP-aware 952 */ 953 if (params != NULL && narg != 0) 954 error = copyin(params, (caddr_t)args, 955 (u_int)(narg * sizeof(int))); 956 else 957 error = 0; 958 959 #ifdef KTRACE 960 if (KTRPOINT(td, KTR_SYSCALL)) 961 ktrsyscall(code, narg, args); 962 #endif 963 964 CTR4(KTR_SYSC, "syscall enter thread %p pid %d proc %s code %d", td, 965 td->td_proc->p_pid, td->td_proc->p_comm, code); 966 967 /* 968 * Try to run the syscall without Giant if the syscall 969 * is MP safe. 970 */ 971 if ((callp->sy_narg & SYF_MPSAFE) == 0) 972 mtx_lock(&Giant); 973 974 if (error == 0) { 975 td->td_retval[0] = 0; 976 td->td_retval[1] = frame.tf_edx; 977 978 STOPEVENT(p, S_SCE, narg); 979 980 PTRACESTOP_SC(p, td, S_PT_SCE); 981 982 AUDIT_SYSCALL_ENTER(code, td); 983 error = (*callp->sy_call)(td, args); 984 AUDIT_SYSCALL_EXIT(error, td); 985 } 986 987 switch (error) { 988 case 0: 989 frame.tf_eax = td->td_retval[0]; 990 frame.tf_edx = td->td_retval[1]; 991 frame.tf_eflags &= ~PSL_C; 992 break; 993 994 case ERESTART: 995 /* 996 * Reconstruct pc, assuming lcall $X,y is 7 bytes, 997 * int 0x80 is 2 bytes. We saved this in tf_err. 998 */ 999 frame.tf_eip -= frame.tf_err; 1000 break; 1001 1002 case EJUSTRETURN: 1003 break; 1004 1005 default: 1006 if (p->p_sysent->sv_errsize) { 1007 if (error >= p->p_sysent->sv_errsize) 1008 error = -1; /* XXX */ 1009 else 1010 error = p->p_sysent->sv_errtbl[error]; 1011 } 1012 frame.tf_eax = error; 1013 frame.tf_eflags |= PSL_C; 1014 break; 1015 } 1016 1017 /* 1018 * Release Giant if we previously set it. 1019 */ 1020 if ((callp->sy_narg & SYF_MPSAFE) == 0) 1021 mtx_unlock(&Giant); 1022 1023 /* 1024 * Traced syscall. 1025 */ 1026 if ((orig_tf_eflags & PSL_T) && !(orig_tf_eflags & PSL_VM)) { 1027 frame.tf_eflags &= ~PSL_T; 1028 trapsignal(td, SIGTRAP, 0); 1029 } 1030 1031 /* 1032 * Handle reschedule and other end-of-syscall issues 1033 */ 1034 userret(td, &frame, sticks); 1035 1036 CTR4(KTR_SYSC, "syscall exit thread %p pid %d proc %s code %d", td, 1037 td->td_proc->p_pid, td->td_proc->p_comm, code); 1038 1039 #ifdef KTRACE 1040 if (KTRPOINT(td, KTR_SYSRET)) 1041 ktrsysret(code, error, td->td_retval[0]); 1042 #endif 1043 1044 /* 1045 * This works because errno is findable through the 1046 * register set. If we ever support an emulation where this 1047 * is not the case, this code will need to be revisited. 1048 */ 1049 STOPEVENT(p, S_SCX, code); 1050 1051 PTRACESTOP_SC(p, td, S_PT_SCX); 1052 1053 WITNESS_WARN(WARN_PANIC, NULL, "System call %s returning", 1054 (code >= 0 && code < SYS_MAXSYSCALL) ? syscallnames[code] : "???"); 1055 mtx_assert(&sched_lock, MA_NOTOWNED); 1056 mtx_assert(&Giant, MA_NOTOWNED); 1057 } 1058
Cache object: 6b35003d47515e2142c29231dc602605
[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]