FreeBSD/Linux Kernel Cross Reference
sys/i386/i386/trap.c
1 /*-
2 * Copyright (C) 1994, David Greenman
3 * Copyright (c) 1990, 1993
4 * The Regents of the University of California. All rights reserved.
5 *
6 * This code is derived from software contributed to Berkeley by
7 * the University of Utah, and William Jolitz.
8 *
9 * Redistribution and use in source and binary forms, with or without
10 * modification, are permitted provided that the following conditions
11 * are met:
12 * 1. Redistributions of source code must retain the above copyright
13 * notice, this list of conditions and the following disclaimer.
14 * 2. Redistributions in binary form must reproduce the above copyright
15 * notice, this list of conditions and the following disclaimer in the
16 * documentation and/or other materials provided with the distribution.
17 * 3. All advertising materials mentioning features or use of this software
18 * must display the following acknowledgement:
19 * This product includes software developed by the University of
20 * California, Berkeley and its contributors.
21 * 4. Neither the name of the University nor the names of its contributors
22 * may be used to endorse or promote products derived from this software
23 * without specific prior written permission.
24 *
25 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
26 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
27 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
28 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
29 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
30 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
31 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
32 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
33 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
34 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
35 * SUCH DAMAGE.
36 *
37 * from: @(#)trap.c 7.4 (Berkeley) 5/13/91
38 */
39
40 #include <sys/cdefs.h>
41 __FBSDID("$FreeBSD$");
42
43 /*
44 * 386 Trap and System call handling
45 */
46
47 #include "opt_clock.h"
48 #include "opt_cpu.h"
49 #include "opt_hwpmc_hooks.h"
50 #include "opt_isa.h"
51 #include "opt_kdb.h"
52 #include "opt_ktrace.h"
53 #include "opt_npx.h"
54 #include "opt_trap.h"
55
56 #include <sys/param.h>
57 #include <sys/bus.h>
58 #include <sys/systm.h>
59 #include <sys/proc.h>
60 #include <sys/pioctl.h>
61 #include <sys/ptrace.h>
62 #include <sys/kdb.h>
63 #include <sys/kernel.h>
64 #include <sys/ktr.h>
65 #include <sys/lock.h>
66 #include <sys/mutex.h>
67 #include <sys/resourcevar.h>
68 #include <sys/signalvar.h>
69 #include <sys/syscall.h>
70 #include <sys/sysctl.h>
71 #include <sys/sysent.h>
72 #include <sys/uio.h>
73 #include <sys/vmmeter.h>
74 #ifdef KTRACE
75 #include <sys/ktrace.h>
76 #endif
77 #ifdef HWPMC_HOOKS
78 #include <sys/pmckern.h>
79 #endif
80 #include <security/audit/audit.h>
81
82 #include <vm/vm.h>
83 #include <vm/vm_param.h>
84 #include <vm/pmap.h>
85 #include <vm/vm_kern.h>
86 #include <vm/vm_map.h>
87 #include <vm/vm_page.h>
88 #include <vm/vm_extern.h>
89
90 #include <machine/cpu.h>
91 #include <machine/intr_machdep.h>
92 #include <machine/md_var.h>
93 #include <machine/pcb.h>
94 #ifdef SMP
95 #include <machine/smp.h>
96 #endif
97 #include <machine/tss.h>
98 #include <machine/vm86.h>
99
100 #ifdef POWERFAIL_NMI
101 #include <sys/syslog.h>
102 #include <machine/clock.h>
103 #endif
104
105 extern void trap(struct trapframe *frame);
106 extern void syscall(struct trapframe *frame);
107
108 static int trap_pfault(struct trapframe *, int, vm_offset_t);
109 static void trap_fatal(struct trapframe *, vm_offset_t);
110 void dblfault_handler(void);
111
112 extern inthand_t IDTVEC(lcall_syscall);
113
114 #define MAX_TRAP_MSG 30
115 static char *trap_msg[] = {
116 "", /* 0 unused */
117 "privileged instruction fault", /* 1 T_PRIVINFLT */
118 "", /* 2 unused */
119 "breakpoint instruction fault", /* 3 T_BPTFLT */
120 "", /* 4 unused */
121 "", /* 5 unused */
122 "arithmetic trap", /* 6 T_ARITHTRAP */
123 "", /* 7 unused */
124 "", /* 8 unused */
125 "general protection fault", /* 9 T_PROTFLT */
126 "trace trap", /* 10 T_TRCTRAP */
127 "", /* 11 unused */
128 "page fault", /* 12 T_PAGEFLT */
129 "", /* 13 unused */
130 "alignment fault", /* 14 T_ALIGNFLT */
131 "", /* 15 unused */
132 "", /* 16 unused */
133 "", /* 17 unused */
134 "integer divide fault", /* 18 T_DIVIDE */
135 "non-maskable interrupt trap", /* 19 T_NMI */
136 "overflow trap", /* 20 T_OFLOW */
137 "FPU bounds check fault", /* 21 T_BOUND */
138 "FPU device not available", /* 22 T_DNA */
139 "double fault", /* 23 T_DOUBLEFLT */
140 "FPU operand fetch fault", /* 24 T_FPOPFLT */
141 "invalid TSS fault", /* 25 T_TSSFLT */
142 "segment not present fault", /* 26 T_SEGNPFLT */
143 "stack fault", /* 27 T_STKFLT */
144 "machine check trap", /* 28 T_MCHK */
145 "SIMD floating-point exception", /* 29 T_XMMFLT */
146 "reserved (unknown) fault", /* 30 T_RESERVED */
147 };
148
149 #if defined(I586_CPU) && !defined(NO_F00F_HACK)
150 extern int has_f00f_bug;
151 #endif
152
153 #ifdef KDB
154 static int kdb_on_nmi = 1;
155 SYSCTL_INT(_machdep, OID_AUTO, kdb_on_nmi, CTLFLAG_RW,
156 &kdb_on_nmi, 0, "Go to KDB on NMI");
157 #endif
158 static int panic_on_nmi = 1;
159 SYSCTL_INT(_machdep, OID_AUTO, panic_on_nmi, CTLFLAG_RW,
160 &panic_on_nmi, 0, "Panic on NMI");
161 static int prot_fault_translation = 0;
162 SYSCTL_INT(_machdep, OID_AUTO, prot_fault_translation, CTLFLAG_RW,
163 &prot_fault_translation, 0, "Select signal to deliver on protection fault");
164
165 extern char *syscallnames[];
166
167 /*
168 * Exception, fault, and trap interface to the FreeBSD kernel.
169 * This common code is called from assembly language IDT gate entry
170 * routines that prepare a suitable stack frame, and restore this
171 * frame after the exception has been processed.
172 */
173
174 void
175 trap(struct trapframe *frame)
176 {
177 struct thread *td = curthread;
178 struct proc *p = td->td_proc;
179 int i = 0, ucode = 0, code;
180 u_int type;
181 register_t addr = 0;
182 vm_offset_t eva;
183 ksiginfo_t ksi;
184 #ifdef POWERFAIL_NMI
185 static int lastalert = 0;
186 #endif
187
188 PCPU_INC(cnt.v_trap);
189 type = frame->tf_trapno;
190
191 #ifdef SMP
192 #ifdef STOP_NMI
193 /* Handler for NMI IPIs used for stopping CPUs. */
194 if (type == T_NMI) {
195 if (ipi_nmi_handler() == 0)
196 goto out;
197 }
198 #endif /* STOP_NMI */
199 #endif /* SMP */
200
201 #ifdef KDB
202 if (kdb_active) {
203 kdb_reenter();
204 goto out;
205 }
206 #endif
207
208 #ifdef HWPMC_HOOKS
209 /*
210 * CPU PMCs interrupt using an NMI so we check for that first.
211 * If the HWPMC module is active, 'pmc_hook' will point to
212 * the function to be called. A return value of '1' from the
213 * hook means that the NMI was handled by it and that we can
214 * return immediately.
215 */
216 if (type == T_NMI && pmc_intr &&
217 (*pmc_intr)(PCPU_GET(cpuid), (uintptr_t) frame->tf_eip,
218 TRAPF_USERMODE(frame)))
219 goto out;
220 #endif
221
222 if ((frame->tf_eflags & PSL_I) == 0) {
223 /*
224 * Buggy application or kernel code has disabled
225 * interrupts and then trapped. Enabling interrupts
226 * now is wrong, but it is better than running with
227 * interrupts disabled until they are accidentally
228 * enabled later.
229 */
230 if (ISPL(frame->tf_cs) == SEL_UPL || (frame->tf_eflags & PSL_VM))
231 printf(
232 "pid %ld (%s): trap %d with interrupts disabled\n",
233 (long)curproc->p_pid, curproc->p_comm, type);
234 else if (type != T_BPTFLT && type != T_TRCTRAP &&
235 frame->tf_eip != (int)cpu_switch_load_gs) {
236 /*
237 * XXX not quite right, since this may be for a
238 * multiple fault in user mode.
239 */
240 printf("kernel trap %d with interrupts disabled\n",
241 type);
242 /*
243 * Page faults need interrupts disabled until later,
244 * and we shouldn't enable interrupts while holding
245 * a spin lock or if servicing an NMI.
246 */
247 if (type != T_NMI && type != T_PAGEFLT &&
248 td->td_md.md_spinlock_count == 0)
249 enable_intr();
250 }
251 }
252
253 eva = 0;
254 code = frame->tf_err;
255 if (type == T_PAGEFLT) {
256 /*
257 * For some Cyrix CPUs, %cr2 is clobbered by
258 * interrupts. This problem is worked around by using
259 * an interrupt gate for the pagefault handler. We
260 * are finally ready to read %cr2 and then must
261 * reenable interrupts.
262 *
263 * If we get a page fault while in a critical section, then
264 * it is most likely a fatal kernel page fault. The kernel
265 * is already going to panic trying to get a sleep lock to
266 * do the VM lookup, so just consider it a fatal trap so the
267 * kernel can print out a useful trap message and even get
268 * to the debugger.
269 *
270 * If we get a page fault while holding a non-sleepable
271 * lock, then it is most likely a fatal kernel page fault.
272 * If WITNESS is enabled, then it's going to whine about
273 * bogus LORs with various VM locks, so just skip to the
274 * fatal trap handling directly.
275 */
276 eva = rcr2();
277 if (td->td_critnest != 0 ||
278 WITNESS_CHECK(WARN_SLEEPOK | WARN_GIANTOK, NULL,
279 "Kernel page fault") != 0)
280 trap_fatal(frame, eva);
281 else
282 enable_intr();
283 }
284
285 if ((ISPL(frame->tf_cs) == SEL_UPL) ||
286 ((frame->tf_eflags & PSL_VM) &&
287 !(PCPU_GET(curpcb)->pcb_flags & PCB_VM86CALL))) {
288 /* user trap */
289
290 td->td_pticks = 0;
291 td->td_frame = frame;
292 addr = frame->tf_eip;
293 if (td->td_ucred != p->p_ucred)
294 cred_update_thread(td);
295
296 switch (type) {
297 case T_PRIVINFLT: /* privileged instruction fault */
298 i = SIGILL;
299 ucode = ILL_PRVOPC;
300 break;
301
302 case T_BPTFLT: /* bpt instruction fault */
303 case T_TRCTRAP: /* trace trap */
304 enable_intr();
305 frame->tf_eflags &= ~PSL_T;
306 i = SIGTRAP;
307 ucode = (type == T_TRCTRAP ? TRAP_TRACE : TRAP_BRKPT);
308 break;
309
310 case T_ARITHTRAP: /* arithmetic trap */
311 #ifdef DEV_NPX
312 ucode = npxtrap();
313 if (ucode == -1)
314 goto userout;
315 #else
316 ucode = 0;
317 #endif
318 i = SIGFPE;
319 break;
320
321 /*
322 * The following two traps can happen in
323 * vm86 mode, and, if so, we want to handle
324 * them specially.
325 */
326 case T_PROTFLT: /* general protection fault */
327 case T_STKFLT: /* stack fault */
328 if (frame->tf_eflags & PSL_VM) {
329 i = vm86_emulate((struct vm86frame *)frame);
330 if (i == 0)
331 goto user;
332 break;
333 }
334 i = SIGBUS;
335 ucode = (type == T_PROTFLT) ? BUS_OBJERR : BUS_ADRERR;
336 break;
337 case T_SEGNPFLT: /* segment not present fault */
338 i = SIGBUS;
339 ucode = BUS_ADRERR;
340 break;
341 case T_TSSFLT: /* invalid TSS fault */
342 i = SIGBUS;
343 ucode = BUS_OBJERR;
344 break;
345 case T_DOUBLEFLT: /* double fault */
346 default:
347 i = SIGBUS;
348 ucode = BUS_OBJERR;
349 break;
350
351 case T_PAGEFLT: /* page fault */
352 #ifdef KSE
353 if (td->td_pflags & TDP_SA)
354 thread_user_enter(td);
355 #endif
356
357 i = trap_pfault(frame, TRUE, eva);
358 #if defined(I586_CPU) && !defined(NO_F00F_HACK)
359 if (i == -2) {
360 /*
361 * The f00f hack workaround has triggered, so
362 * treat the fault as an illegal instruction
363 * (T_PRIVINFLT) instead of a page fault.
364 */
365 type = frame->tf_trapno = T_PRIVINFLT;
366
367 /* Proceed as in that case. */
368 ucode = ILL_PRVOPC;
369 i = SIGILL;
370 break;
371 }
372 #endif
373 if (i == -1)
374 goto userout;
375 if (i == 0)
376 goto user;
377
378 if (i == SIGSEGV)
379 ucode = SEGV_MAPERR;
380 else {
381 if (prot_fault_translation == 0) {
382 /*
383 * Autodetect.
384 * This check also covers the images
385 * without the ABI-tag ELF note.
386 */
387 if (p->p_osrel >= 700004) {
388 i = SIGSEGV;
389 ucode = SEGV_ACCERR;
390 } else {
391 i = SIGBUS;
392 ucode = BUS_PAGE_FAULT;
393 }
394 } else if (prot_fault_translation == 1) {
395 /*
396 * Always compat mode.
397 */
398 i = SIGBUS;
399 ucode = BUS_PAGE_FAULT;
400 } else {
401 /*
402 * Always SIGSEGV mode.
403 */
404 i = SIGSEGV;
405 ucode = SEGV_ACCERR;
406 }
407 }
408 addr = eva;
409 break;
410
411 case T_DIVIDE: /* integer divide fault */
412 ucode = FPE_INTDIV;
413 i = SIGFPE;
414 break;
415
416 #ifdef DEV_ISA
417 case T_NMI:
418 #ifdef POWERFAIL_NMI
419 #ifndef TIMER_FREQ
420 # define TIMER_FREQ 1193182
421 #endif
422 mtx_lock(&Giant);
423 if (time_second - lastalert > 10) {
424 log(LOG_WARNING, "NMI: power fail\n");
425 sysbeep(TIMER_FREQ/880, hz);
426 lastalert = time_second;
427 }
428 mtx_unlock(&Giant);
429 goto userout;
430 #else /* !POWERFAIL_NMI */
431 /* machine/parity/power fail/"kitchen sink" faults */
432 /* XXX Giant */
433 if (isa_nmi(code) == 0) {
434 #ifdef KDB
435 /*
436 * NMI can be hooked up to a pushbutton
437 * for debugging.
438 */
439 if (kdb_on_nmi) {
440 printf ("NMI ... going to debugger\n");
441 kdb_trap(type, 0, frame);
442 }
443 #endif /* KDB */
444 goto userout;
445 } else if (panic_on_nmi)
446 panic("NMI indicates hardware failure");
447 break;
448 #endif /* POWERFAIL_NMI */
449 #endif /* DEV_ISA */
450
451 case T_OFLOW: /* integer overflow fault */
452 ucode = FPE_INTOVF;
453 i = SIGFPE;
454 break;
455
456 case T_BOUND: /* bounds check fault */
457 ucode = FPE_FLTSUB;
458 i = SIGFPE;
459 break;
460
461 case T_DNA:
462 #ifdef DEV_NPX
463 /* transparent fault (due to context switch "late") */
464 if (npxdna())
465 goto userout;
466 #endif
467 printf("pid %d killed due to lack of floating point\n",
468 p->p_pid);
469 i = SIGKILL;
470 ucode = 0;
471 break;
472
473 case T_FPOPFLT: /* FPU operand fetch fault */
474 ucode = ILL_COPROC;
475 i = SIGILL;
476 break;
477
478 case T_XMMFLT: /* SIMD floating-point exception */
479 ucode = 0; /* XXX */
480 i = SIGFPE;
481 break;
482 }
483 } else {
484 /* kernel trap */
485
486 KASSERT(cold || td->td_ucred != NULL,
487 ("kernel trap doesn't have ucred"));
488 switch (type) {
489 case T_PAGEFLT: /* page fault */
490 (void) trap_pfault(frame, FALSE, eva);
491 goto out;
492
493 case T_DNA:
494 #ifdef DEV_NPX
495 /*
496 * The kernel is apparently using npx for copying.
497 * XXX this should be fatal unless the kernel has
498 * registered such use.
499 */
500 if (npxdna())
501 goto out;
502 #endif
503 break;
504
505 /*
506 * The following two traps can happen in
507 * vm86 mode, and, if so, we want to handle
508 * them specially.
509 */
510 case T_PROTFLT: /* general protection fault */
511 case T_STKFLT: /* stack fault */
512 if (frame->tf_eflags & PSL_VM) {
513 i = vm86_emulate((struct vm86frame *)frame);
514 if (i != 0)
515 /*
516 * returns to original process
517 */
518 vm86_trap((struct vm86frame *)frame);
519 goto out;
520 }
521 if (type == T_STKFLT)
522 break;
523
524 /* FALL THROUGH */
525
526 case T_SEGNPFLT: /* segment not present fault */
527 if (PCPU_GET(curpcb)->pcb_flags & PCB_VM86CALL)
528 break;
529
530 /*
531 * Invalid %fs's and %gs's can be created using
532 * procfs or PT_SETREGS or by invalidating the
533 * underlying LDT entry. This causes a fault
534 * in kernel mode when the kernel attempts to
535 * switch contexts. Lose the bad context
536 * (XXX) so that we can continue, and generate
537 * a signal.
538 */
539 if (frame->tf_eip == (int)cpu_switch_load_gs) {
540 PCPU_GET(curpcb)->pcb_gs = 0;
541 #if 0
542 PROC_LOCK(p);
543 psignal(p, SIGBUS);
544 PROC_UNLOCK(p);
545 #endif
546 goto out;
547 }
548
549 if (td->td_intr_nesting_level != 0)
550 break;
551
552 /*
553 * Invalid segment selectors and out of bounds
554 * %eip's and %esp's can be set up in user mode.
555 * This causes a fault in kernel mode when the
556 * kernel tries to return to user mode. We want
557 * to get this fault so that we can fix the
558 * problem here and not have to check all the
559 * selectors and pointers when the user changes
560 * them.
561 */
562 if (frame->tf_eip == (int)doreti_iret) {
563 frame->tf_eip = (int)doreti_iret_fault;
564 goto out;
565 }
566 if (frame->tf_eip == (int)doreti_popl_ds) {
567 frame->tf_eip = (int)doreti_popl_ds_fault;
568 goto out;
569 }
570 if (frame->tf_eip == (int)doreti_popl_es) {
571 frame->tf_eip = (int)doreti_popl_es_fault;
572 goto out;
573 }
574 if (frame->tf_eip == (int)doreti_popl_fs) {
575 frame->tf_eip = (int)doreti_popl_fs_fault;
576 goto out;
577 }
578 if (PCPU_GET(curpcb)->pcb_onfault != NULL) {
579 frame->tf_eip =
580 (int)PCPU_GET(curpcb)->pcb_onfault;
581 goto out;
582 }
583 break;
584
585 case T_TSSFLT:
586 /*
587 * PSL_NT can be set in user mode and isn't cleared
588 * automatically when the kernel is entered. This
589 * causes a TSS fault when the kernel attempts to
590 * `iret' because the TSS link is uninitialized. We
591 * want to get this fault so that we can fix the
592 * problem here and not every time the kernel is
593 * entered.
594 */
595 if (frame->tf_eflags & PSL_NT) {
596 frame->tf_eflags &= ~PSL_NT;
597 goto out;
598 }
599 break;
600
601 case T_TRCTRAP: /* trace trap */
602 if (frame->tf_eip == (int)IDTVEC(lcall_syscall)) {
603 /*
604 * We've just entered system mode via the
605 * syscall lcall. Continue single stepping
606 * silently until the syscall handler has
607 * saved the flags.
608 */
609 goto out;
610 }
611 if (frame->tf_eip == (int)IDTVEC(lcall_syscall) + 1) {
612 /*
613 * The syscall handler has now saved the
614 * flags. Stop single stepping it.
615 */
616 frame->tf_eflags &= ~PSL_T;
617 goto out;
618 }
619 /*
620 * Ignore debug register trace traps due to
621 * accesses in the user's address space, which
622 * can happen under several conditions such as
623 * if a user sets a watchpoint on a buffer and
624 * then passes that buffer to a system call.
625 * We still want to get TRCTRAPS for addresses
626 * in kernel space because that is useful when
627 * debugging the kernel.
628 */
629 /* XXX Giant */
630 if (user_dbreg_trap() &&
631 !(PCPU_GET(curpcb)->pcb_flags & PCB_VM86CALL)) {
632 /*
633 * Reset breakpoint bits because the
634 * processor doesn't
635 */
636 load_dr6(rdr6() & 0xfffffff0);
637 goto out;
638 }
639 /*
640 * FALLTHROUGH (TRCTRAP kernel mode, kernel address)
641 */
642 case T_BPTFLT:
643 /*
644 * If KDB is enabled, let it handle the debugger trap.
645 * Otherwise, debugger traps "can't happen".
646 */
647 #ifdef KDB
648 if (kdb_trap(type, 0, frame))
649 goto out;
650 #endif
651 break;
652
653 #ifdef DEV_ISA
654 case T_NMI:
655 #ifdef POWERFAIL_NMI
656 mtx_lock(&Giant);
657 if (time_second - lastalert > 10) {
658 log(LOG_WARNING, "NMI: power fail\n");
659 sysbeep(TIMER_FREQ/880, hz);
660 lastalert = time_second;
661 }
662 mtx_unlock(&Giant);
663 goto out;
664 #else /* !POWERFAIL_NMI */
665 /* XXX Giant */
666 /* machine/parity/power fail/"kitchen sink" faults */
667 if (isa_nmi(code) == 0) {
668 #ifdef KDB
669 /*
670 * NMI can be hooked up to a pushbutton
671 * for debugging.
672 */
673 if (kdb_on_nmi) {
674 printf ("NMI ... going to debugger\n");
675 kdb_trap(type, 0, frame);
676 }
677 #endif /* KDB */
678 goto out;
679 } else if (panic_on_nmi == 0)
680 goto out;
681 /* FALLTHROUGH */
682 #endif /* POWERFAIL_NMI */
683 #endif /* DEV_ISA */
684 }
685
686 trap_fatal(frame, eva);
687 goto out;
688 }
689
690 /* Translate fault for emulators (e.g. Linux) */
691 if (*p->p_sysent->sv_transtrap)
692 i = (*p->p_sysent->sv_transtrap)(i, type);
693
694 ksiginfo_init_trap(&ksi);
695 ksi.ksi_signo = i;
696 ksi.ksi_code = ucode;
697 ksi.ksi_addr = (void *)addr;
698 ksi.ksi_trapno = type;
699 trapsignal(td, &ksi);
700
701 #ifdef DEBUG
702 if (type <= MAX_TRAP_MSG) {
703 uprintf("fatal process exception: %s",
704 trap_msg[type]);
705 if ((type == T_PAGEFLT) || (type == T_PROTFLT))
706 uprintf(", fault VA = 0x%lx", (u_long)eva);
707 uprintf("\n");
708 }
709 #endif
710
711 user:
712 userret(td, frame);
713 mtx_assert(&Giant, MA_NOTOWNED);
714 userout:
715 out:
716 return;
717 }
718
719 static int
720 trap_pfault(frame, usermode, eva)
721 struct trapframe *frame;
722 int usermode;
723 vm_offset_t eva;
724 {
725 vm_offset_t va;
726 struct vmspace *vm = NULL;
727 vm_map_t map;
728 int rv = 0;
729 vm_prot_t ftype;
730 struct thread *td = curthread;
731 struct proc *p = td->td_proc;
732
733 va = trunc_page(eva);
734 if (va >= KERNBASE) {
735 /*
736 * Don't allow user-mode faults in kernel address space.
737 * An exception: if the faulting address is the invalid
738 * instruction entry in the IDT, then the Intel Pentium
739 * F00F bug workaround was triggered, and we need to
740 * treat it is as an illegal instruction, and not a page
741 * fault.
742 */
743 #if defined(I586_CPU) && !defined(NO_F00F_HACK)
744 if ((eva == (unsigned int)&idt[6]) && has_f00f_bug)
745 return -2;
746 #endif
747 if (usermode)
748 goto nogo;
749
750 map = kernel_map;
751 } else {
752 /*
753 * This is a fault on non-kernel virtual memory.
754 * vm is initialized above to NULL. If curproc is NULL
755 * or curproc->p_vmspace is NULL the fault is fatal.
756 */
757 if (p != NULL)
758 vm = p->p_vmspace;
759
760 if (vm == NULL)
761 goto nogo;
762
763 map = &vm->vm_map;
764 }
765
766 /*
767 * PGEX_I is defined only if the execute disable bit capability is
768 * supported and enabled.
769 */
770 if (frame->tf_err & PGEX_W)
771 ftype = VM_PROT_WRITE;
772 #ifdef PAE
773 else if ((frame->tf_err & PGEX_I) && pg_nx != 0)
774 ftype = VM_PROT_EXECUTE;
775 #endif
776 else
777 ftype = VM_PROT_READ;
778
779 if (map != kernel_map) {
780 /*
781 * Keep swapout from messing with us during this
782 * critical time.
783 */
784 PROC_LOCK(p);
785 ++p->p_lock;
786 PROC_UNLOCK(p);
787
788 /* Fault in the user page: */
789 rv = vm_fault(map, va, ftype,
790 (ftype & VM_PROT_WRITE) ? VM_FAULT_DIRTY
791 : VM_FAULT_NORMAL);
792
793 PROC_LOCK(p);
794 --p->p_lock;
795 PROC_UNLOCK(p);
796 } else {
797 /*
798 * Don't have to worry about process locking or stacks in the
799 * kernel.
800 */
801 rv = vm_fault(map, va, ftype, VM_FAULT_NORMAL);
802 }
803 if (rv == KERN_SUCCESS)
804 return (0);
805 nogo:
806 if (!usermode) {
807 if (td->td_intr_nesting_level == 0 &&
808 PCPU_GET(curpcb)->pcb_onfault != NULL) {
809 frame->tf_eip = (int)PCPU_GET(curpcb)->pcb_onfault;
810 return (0);
811 }
812 trap_fatal(frame, eva);
813 return (-1);
814 }
815
816 return((rv == KERN_PROTECTION_FAILURE) ? SIGBUS : SIGSEGV);
817 }
818
819 static void
820 trap_fatal(frame, eva)
821 struct trapframe *frame;
822 vm_offset_t eva;
823 {
824 int code, ss, esp;
825 u_int type;
826 struct soft_segment_descriptor softseg;
827 char *msg;
828
829 code = frame->tf_err;
830 type = frame->tf_trapno;
831 sdtossd(&gdt[IDXSEL(frame->tf_cs & 0xffff)].sd, &softseg);
832
833 if (type <= MAX_TRAP_MSG)
834 msg = trap_msg[type];
835 else
836 msg = "UNKNOWN";
837 printf("\n\nFatal trap %d: %s while in %s mode\n", type, msg,
838 frame->tf_eflags & PSL_VM ? "vm86" :
839 ISPL(frame->tf_cs) == SEL_UPL ? "user" : "kernel");
840 #ifdef SMP
841 /* two separate prints in case of a trap on an unmapped page */
842 printf("cpuid = %d; ", PCPU_GET(cpuid));
843 printf("apic id = %02x\n", PCPU_GET(apic_id));
844 #endif
845 if (type == T_PAGEFLT) {
846 printf("fault virtual address = 0x%x\n", eva);
847 printf("fault code = %s %s, %s\n",
848 code & PGEX_U ? "user" : "supervisor",
849 code & PGEX_W ? "write" : "read",
850 code & PGEX_P ? "protection violation" : "page not present");
851 }
852 printf("instruction pointer = 0x%x:0x%x\n",
853 frame->tf_cs & 0xffff, frame->tf_eip);
854 if ((ISPL(frame->tf_cs) == SEL_UPL) || (frame->tf_eflags & PSL_VM)) {
855 ss = frame->tf_ss & 0xffff;
856 esp = frame->tf_esp;
857 } else {
858 ss = GSEL(GDATA_SEL, SEL_KPL);
859 esp = (int)&frame->tf_esp;
860 }
861 printf("stack pointer = 0x%x:0x%x\n", ss, esp);
862 printf("frame pointer = 0x%x:0x%x\n", ss, frame->tf_ebp);
863 printf("code segment = base 0x%x, limit 0x%x, type 0x%x\n",
864 softseg.ssd_base, softseg.ssd_limit, softseg.ssd_type);
865 printf(" = DPL %d, pres %d, def32 %d, gran %d\n",
866 softseg.ssd_dpl, softseg.ssd_p, softseg.ssd_def32,
867 softseg.ssd_gran);
868 printf("processor eflags = ");
869 if (frame->tf_eflags & PSL_T)
870 printf("trace trap, ");
871 if (frame->tf_eflags & PSL_I)
872 printf("interrupt enabled, ");
873 if (frame->tf_eflags & PSL_NT)
874 printf("nested task, ");
875 if (frame->tf_eflags & PSL_RF)
876 printf("resume, ");
877 if (frame->tf_eflags & PSL_VM)
878 printf("vm86, ");
879 printf("IOPL = %d\n", (frame->tf_eflags & PSL_IOPL) >> 12);
880 printf("current process = ");
881 if (curproc) {
882 printf("%lu (%s)\n", (u_long)curproc->p_pid, curproc->p_comm);
883 } else {
884 printf("Idle\n");
885 }
886
887 #ifdef KDB
888 if (debugger_on_panic || kdb_active) {
889 frame->tf_err = eva; /* smuggle fault address to ddb */
890 if (kdb_trap(type, 0, frame)) {
891 frame->tf_err = code; /* restore error code */
892 return;
893 }
894 frame->tf_err = code; /* restore error code */
895 }
896 #endif
897 printf("trap number = %d\n", type);
898 if (type <= MAX_TRAP_MSG)
899 panic("%s", trap_msg[type]);
900 else
901 panic("unknown/reserved trap");
902 }
903
904 /*
905 * Double fault handler. Called when a fault occurs while writing
906 * a frame for a trap/exception onto the stack. This usually occurs
907 * when the stack overflows (such is the case with infinite recursion,
908 * for example).
909 *
910 * XXX Note that the current PTD gets replaced by IdlePTD when the
911 * task switch occurs. This means that the stack that was active at
912 * the time of the double fault is not available at <kstack> unless
913 * the machine was idle when the double fault occurred. The downside
914 * of this is that "trace <ebp>" in ddb won't work.
915 */
916 void
917 dblfault_handler()
918 {
919 printf("\nFatal double fault:\n");
920 printf("eip = 0x%x\n", PCPU_GET(common_tss.tss_eip));
921 printf("esp = 0x%x\n", PCPU_GET(common_tss.tss_esp));
922 printf("ebp = 0x%x\n", PCPU_GET(common_tss.tss_ebp));
923 #ifdef SMP
924 /* two separate prints in case of a trap on an unmapped page */
925 printf("cpuid = %d; ", PCPU_GET(cpuid));
926 printf("apic id = %02x\n", PCPU_GET(apic_id));
927 #endif
928 panic("double fault");
929 }
930
931 /*
932 * syscall - system call request C handler
933 *
934 * A system call is essentially treated as a trap.
935 */
936 void
937 syscall(struct trapframe *frame)
938 {
939 caddr_t params;
940 struct sysent *callp;
941 struct thread *td = curthread;
942 struct proc *p = td->td_proc;
943 register_t orig_tf_eflags;
944 int error;
945 int narg;
946 int args[8];
947 u_int code;
948 ksiginfo_t ksi;
949
950 PCPU_INC(cnt.v_syscall);
951
952 #ifdef DIAGNOSTIC
953 if (ISPL(frame->tf_cs) != SEL_UPL) {
954 panic("syscall");
955 /* NOT REACHED */
956 }
957 #endif
958
959 td->td_pticks = 0;
960 td->td_frame = frame;
961 if (td->td_ucred != p->p_ucred)
962 cred_update_thread(td);
963 #ifdef KSE
964 if (p->p_flag & P_SA)
965 thread_user_enter(td);
966 #endif
967 params = (caddr_t)frame->tf_esp + sizeof(int);
968 code = frame->tf_eax;
969 orig_tf_eflags = frame->tf_eflags;
970
971 if (p->p_sysent->sv_prepsyscall) {
972 /*
973 * The prep code is MP aware.
974 */
975 (*p->p_sysent->sv_prepsyscall)(frame, args, &code, ¶ms);
976 } else {
977 /*
978 * Need to check if this is a 32 bit or 64 bit syscall.
979 * fuword is MP aware.
980 */
981 if (code == SYS_syscall) {
982 /*
983 * Code is first argument, followed by actual args.
984 */
985 code = fuword(params);
986 params += sizeof(int);
987 } else if (code == SYS___syscall) {
988 /*
989 * Like syscall, but code is a quad, so as to maintain
990 * quad alignment for the rest of the arguments.
991 */
992 code = fuword(params);
993 params += sizeof(quad_t);
994 }
995 }
996
997 if (p->p_sysent->sv_mask)
998 code &= p->p_sysent->sv_mask;
999
1000 if (code >= p->p_sysent->sv_size)
1001 callp = &p->p_sysent->sv_table[0];
1002 else
1003 callp = &p->p_sysent->sv_table[code];
1004
1005 narg = callp->sy_narg;
1006
1007 /*
1008 * copyin and the ktrsyscall()/ktrsysret() code is MP-aware
1009 */
1010 if (params != NULL && narg != 0)
1011 error = copyin(params, (caddr_t)args,
1012 (u_int)(narg * sizeof(int)));
1013 else
1014 error = 0;
1015
1016 #ifdef KTRACE
1017 if (KTRPOINT(td, KTR_SYSCALL))
1018 ktrsyscall(code, narg, args);
1019 #endif
1020
1021 CTR4(KTR_SYSC, "syscall enter thread %p pid %d proc %s code %d", td,
1022 td->td_proc->p_pid, td->td_proc->p_comm, code);
1023
1024 td->td_syscalls++;
1025
1026 if (error == 0) {
1027 td->td_retval[0] = 0;
1028 td->td_retval[1] = frame->tf_edx;
1029
1030 STOPEVENT(p, S_SCE, narg);
1031
1032 PTRACESTOP_SC(p, td, S_PT_SCE);
1033
1034 AUDIT_SYSCALL_ENTER(code, td);
1035 error = (*callp->sy_call)(td, args);
1036 AUDIT_SYSCALL_EXIT(error, td);
1037 }
1038
1039 switch (error) {
1040 case 0:
1041 frame->tf_eax = td->td_retval[0];
1042 frame->tf_edx = td->td_retval[1];
1043 frame->tf_eflags &= ~PSL_C;
1044 break;
1045
1046 case ERESTART:
1047 /*
1048 * Reconstruct pc, assuming lcall $X,y is 7 bytes,
1049 * int 0x80 is 2 bytes. We saved this in tf_err.
1050 */
1051 frame->tf_eip -= frame->tf_err;
1052 break;
1053
1054 case EJUSTRETURN:
1055 break;
1056
1057 default:
1058 if (p->p_sysent->sv_errsize) {
1059 if (error >= p->p_sysent->sv_errsize)
1060 error = -1; /* XXX */
1061 else
1062 error = p->p_sysent->sv_errtbl[error];
1063 }
1064 frame->tf_eax = error;
1065 frame->tf_eflags |= PSL_C;
1066 break;
1067 }
1068
1069 /*
1070 * Traced syscall.
1071 */
1072 if ((orig_tf_eflags & PSL_T) && !(orig_tf_eflags & PSL_VM)) {
1073 frame->tf_eflags &= ~PSL_T;
1074 ksiginfo_init_trap(&ksi);
1075 ksi.ksi_signo = SIGTRAP;
1076 ksi.ksi_code = TRAP_TRACE;
1077 ksi.ksi_addr = (void *)frame->tf_eip;
1078 trapsignal(td, &ksi);
1079 }
1080
1081 /*
1082 * Check for misbehavior.
1083 */
1084 WITNESS_WARN(WARN_PANIC, NULL, "System call %s returning",
1085 (code >= 0 && code < SYS_MAXSYSCALL) ? syscallnames[code] : "???");
1086 KASSERT(td->td_critnest == 0,
1087 ("System call %s returning in a critical section",
1088 (code >= 0 && code < SYS_MAXSYSCALL) ? syscallnames[code] : "???"));
1089 KASSERT(td->td_locks == 0,
1090 ("System call %s returning with %d locks held",
1091 (code >= 0 && code < SYS_MAXSYSCALL) ? syscallnames[code] : "???",
1092 td->td_locks));
1093
1094 /*
1095 * Handle reschedule and other end-of-syscall issues
1096 */
1097 userret(td, frame);
1098
1099 CTR4(KTR_SYSC, "syscall exit thread %p pid %d proc %s code %d", td,
1100 td->td_proc->p_pid, td->td_proc->p_comm, code);
1101
1102 #ifdef KTRACE
1103 if (KTRPOINT(td, KTR_SYSRET))
1104 ktrsysret(code, error, td->td_retval[0]);
1105 #endif
1106
1107 /*
1108 * This works because errno is findable through the
1109 * register set. If we ever support an emulation where this
1110 * is not the case, this code will need to be revisited.
1111 */
1112 STOPEVENT(p, S_SCX, code);
1113
1114 PTRACESTOP_SC(p, td, S_PT_SCX);
1115 }
1116
Cache object: d31c6ddee296f701983282f5b57cfaee
|