Now available: The Design and Implementation of the FreeBSD Operating System (Second Edition)
[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]
FreeBSD/Linux Kernel Cross Reference
sys/i386/i386/trap.c
Version:
- FREEBSD - FREEBSD-13-STABLE - FREEBSD-13-0 - FREEBSD-12-STABLE - FREEBSD-12-0 - FREEBSD-11-STABLE - FREEBSD-11-0 - FREEBSD-10-STABLE - FREEBSD-10-0 - FREEBSD-9-STABLE - FREEBSD-9-0 - FREEBSD-8-STABLE - FREEBSD-8-0 - FREEBSD-7-STABLE - FREEBSD-7-0 - FREEBSD-6-STABLE - FREEBSD-6-0 - FREEBSD-5-STABLE - FREEBSD-5-0 - FREEBSD-4-STABLE - FREEBSD-3-STABLE - FREEBSD22 - l41 - OPENBSD - linux-2.6 - MK84 - PLAN9 - xnu-8792
SearchContext: - none - 3 - 10
SearchContext: - none - 3 - 10
1 /*- 2 * Copyright (C) 1994, David Greenman 3 * Copyright (c) 1990, 1993 4 * The Regents of the University of California. All rights reserved. 5 * 6 * This code is derived from software contributed to Berkeley by 7 * the University of Utah, and William Jolitz. 8 * 9 * Redistribution and use in source and binary forms, with or without 10 * modification, are permitted provided that the following conditions 11 * are met: 12 * 1. Redistributions of source code must retain the above copyright 13 * notice, this list of conditions and the following disclaimer. 14 * 2. Redistributions in binary form must reproduce the above copyright 15 * notice, this list of conditions and the following disclaimer in the 16 * documentation and/or other materials provided with the distribution. 17 * 3. All advertising materials mentioning features or use of this software 18 * must display the following acknowledgement: 19 * This product includes software developed by the University of 20 * California, Berkeley and its contributors. 21 * 4. Neither the name of the University nor the names of its contributors 22 * may be used to endorse or promote products derived from this software 23 * without specific prior written permission. 24 * 25 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 26 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 27 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 28 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 29 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 30 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 31 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 32 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 33 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 34 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 35 * SUCH DAMAGE. 36 * 37 * from: @(#)trap.c 7.4 (Berkeley) 5/13/91 38 */ 39 40 #include <sys/cdefs.h> 41 __FBSDID("$FreeBSD: releng/8.0/sys/i386/i386/trap.c 196601 2009-08-27 17:34:13Z bz $"); 42 43 /* 44 * 386 Trap and System call handling 45 */ 46 47 #include "opt_clock.h" 48 #include "opt_cpu.h" 49 #include "opt_hwpmc_hooks.h" 50 #include "opt_isa.h" 51 #include "opt_kdb.h" 52 #include "opt_kdtrace.h" 53 #include "opt_ktrace.h" 54 #include "opt_npx.h" 55 #include "opt_trap.h" 56 57 #include <sys/param.h> 58 #include <sys/bus.h> 59 #include <sys/systm.h> 60 #include <sys/proc.h> 61 #include <sys/pioctl.h> 62 #include <sys/ptrace.h> 63 #include <sys/kdb.h> 64 #include <sys/kernel.h> 65 #include <sys/ktr.h> 66 #include <sys/lock.h> 67 #include <sys/mutex.h> 68 #include <sys/resourcevar.h> 69 #include <sys/signalvar.h> 70 #include <sys/syscall.h> 71 #include <sys/sysctl.h> 72 #include <sys/sysent.h> 73 #include <sys/uio.h> 74 #include <sys/vmmeter.h> 75 #ifdef KTRACE 76 #include <sys/ktrace.h> 77 #endif 78 #ifdef HWPMC_HOOKS 79 #include <sys/pmckern.h> 80 #endif 81 #include <security/audit/audit.h> 82 83 #include <vm/vm.h> 84 #include <vm/vm_param.h> 85 #include <vm/pmap.h> 86 #include <vm/vm_kern.h> 87 #include <vm/vm_map.h> 88 #include <vm/vm_page.h> 89 #include <vm/vm_extern.h> 90 91 #include <machine/cpu.h> 92 #include <machine/intr_machdep.h> 93 #include <machine/mca.h> 94 #include <machine/md_var.h> 95 #include <machine/pcb.h> 96 #ifdef SMP 97 #include <machine/smp.h> 98 #endif 99 #include <machine/tss.h> 100 #include <machine/vm86.h> 101 102 #ifdef POWERFAIL_NMI 103 #include <sys/syslog.h> 104 #include <machine/clock.h> 105 #endif 106 107 #ifdef KDTRACE_HOOKS 108 #include <sys/dtrace_bsd.h> 109 110 /* 111 * This is a hook which is initialised by the dtrace module 112 * to handle traps which might occur during DTrace probe 113 * execution. 114 */ 115 dtrace_trap_func_t dtrace_trap_func; 116 117 dtrace_doubletrap_func_t dtrace_doubletrap_func; 118 119 /* 120 * This is a hook which is initialised by the systrace module 121 * when it is loaded. This keeps the DTrace syscall provider 122 * implementation opaque. 123 */ 124 systrace_probe_func_t systrace_probe_func; 125 #endif 126 127 extern void trap(struct trapframe *frame); 128 extern void syscall(struct trapframe *frame); 129 130 static int trap_pfault(struct trapframe *, int, vm_offset_t); 131 static void trap_fatal(struct trapframe *, vm_offset_t); 132 void dblfault_handler(void); 133 134 extern inthand_t IDTVEC(lcall_syscall); 135 136 #define MAX_TRAP_MSG 30 137 static char *trap_msg[] = { 138 "", /* 0 unused */ 139 "privileged instruction fault", /* 1 T_PRIVINFLT */ 140 "", /* 2 unused */ 141 "breakpoint instruction fault", /* 3 T_BPTFLT */ 142 "", /* 4 unused */ 143 "", /* 5 unused */ 144 "arithmetic trap", /* 6 T_ARITHTRAP */ 145 "", /* 7 unused */ 146 "", /* 8 unused */ 147 "general protection fault", /* 9 T_PROTFLT */ 148 "trace trap", /* 10 T_TRCTRAP */ 149 "", /* 11 unused */ 150 "page fault", /* 12 T_PAGEFLT */ 151 "", /* 13 unused */ 152 "alignment fault", /* 14 T_ALIGNFLT */ 153 "", /* 15 unused */ 154 "", /* 16 unused */ 155 "", /* 17 unused */ 156 "integer divide fault", /* 18 T_DIVIDE */ 157 "non-maskable interrupt trap", /* 19 T_NMI */ 158 "overflow trap", /* 20 T_OFLOW */ 159 "FPU bounds check fault", /* 21 T_BOUND */ 160 "FPU device not available", /* 22 T_DNA */ 161 "double fault", /* 23 T_DOUBLEFLT */ 162 "FPU operand fetch fault", /* 24 T_FPOPFLT */ 163 "invalid TSS fault", /* 25 T_TSSFLT */ 164 "segment not present fault", /* 26 T_SEGNPFLT */ 165 "stack fault", /* 27 T_STKFLT */ 166 "machine check trap", /* 28 T_MCHK */ 167 "SIMD floating-point exception", /* 29 T_XMMFLT */ 168 "reserved (unknown) fault", /* 30 T_RESERVED */ 169 }; 170 171 #if defined(I586_CPU) && !defined(NO_F00F_HACK) 172 extern int has_f00f_bug; 173 #endif 174 175 #ifdef KDB 176 static int kdb_on_nmi = 1; 177 SYSCTL_INT(_machdep, OID_AUTO, kdb_on_nmi, CTLFLAG_RW, 178 &kdb_on_nmi, 0, "Go to KDB on NMI"); 179 #endif 180 static int panic_on_nmi = 1; 181 SYSCTL_INT(_machdep, OID_AUTO, panic_on_nmi, CTLFLAG_RW, 182 &panic_on_nmi, 0, "Panic on NMI"); 183 static int prot_fault_translation = 0; 184 SYSCTL_INT(_machdep, OID_AUTO, prot_fault_translation, CTLFLAG_RW, 185 &prot_fault_translation, 0, "Select signal to deliver on protection fault"); 186 187 extern char *syscallnames[]; 188 189 /* 190 * Exception, fault, and trap interface to the FreeBSD kernel. 191 * This common code is called from assembly language IDT gate entry 192 * routines that prepare a suitable stack frame, and restore this 193 * frame after the exception has been processed. 194 */ 195 196 void 197 trap(struct trapframe *frame) 198 { 199 struct thread *td = curthread; 200 struct proc *p = td->td_proc; 201 int i = 0, ucode = 0, code; 202 u_int type; 203 register_t addr = 0; 204 vm_offset_t eva; 205 ksiginfo_t ksi; 206 #ifdef POWERFAIL_NMI 207 static int lastalert = 0; 208 #endif 209 210 PCPU_INC(cnt.v_trap); 211 type = frame->tf_trapno; 212 213 #ifdef SMP 214 /* Handler for NMI IPIs used for stopping CPUs. */ 215 if (type == T_NMI) { 216 if (ipi_nmi_handler() == 0) 217 goto out; 218 } 219 #endif /* SMP */ 220 221 #ifdef KDB 222 if (kdb_active) { 223 kdb_reenter(); 224 goto out; 225 } 226 #endif 227 228 #ifdef HWPMC_HOOKS 229 /* 230 * CPU PMCs interrupt using an NMI so we check for that first. 231 * If the HWPMC module is active, 'pmc_hook' will point to 232 * the function to be called. A return value of '1' from the 233 * hook means that the NMI was handled by it and that we can 234 * return immediately. 235 */ 236 if (type == T_NMI && pmc_intr && 237 (*pmc_intr)(PCPU_GET(cpuid), frame)) 238 goto out; 239 #endif 240 241 if (type == T_MCHK) { 242 if (!mca_intr()) 243 trap_fatal(frame, 0); 244 goto out; 245 } 246 247 #ifdef KDTRACE_HOOKS 248 /* 249 * A trap can occur while DTrace executes a probe. Before 250 * executing the probe, DTrace blocks re-scheduling and sets 251 * a flag in it's per-cpu flags to indicate that it doesn't 252 * want to fault. On returning from the the probe, the no-fault 253 * flag is cleared and finally re-scheduling is enabled. 254 * 255 * If the DTrace kernel module has registered a trap handler, 256 * call it and if it returns non-zero, assume that it has 257 * handled the trap and modified the trap frame so that this 258 * function can return normally. 259 */ 260 if ((type == T_PROTFLT || type == T_PAGEFLT) && 261 dtrace_trap_func != NULL) 262 if ((*dtrace_trap_func)(frame, type)) 263 goto out; 264 #endif 265 266 if ((frame->tf_eflags & PSL_I) == 0) { 267 /* 268 * Buggy application or kernel code has disabled 269 * interrupts and then trapped. Enabling interrupts 270 * now is wrong, but it is better than running with 271 * interrupts disabled until they are accidentally 272 * enabled later. 273 */ 274 if (ISPL(frame->tf_cs) == SEL_UPL || (frame->tf_eflags & PSL_VM)) 275 printf( 276 "pid %ld (%s): trap %d with interrupts disabled\n", 277 (long)curproc->p_pid, curthread->td_name, type); 278 else if (type != T_BPTFLT && type != T_TRCTRAP && 279 frame->tf_eip != (int)cpu_switch_load_gs) { 280 /* 281 * XXX not quite right, since this may be for a 282 * multiple fault in user mode. 283 */ 284 printf("kernel trap %d with interrupts disabled\n", 285 type); 286 /* 287 * Page faults need interrupts disabled until later, 288 * and we shouldn't enable interrupts while holding 289 * a spin lock or if servicing an NMI. 290 */ 291 if (type != T_NMI && type != T_PAGEFLT && 292 td->td_md.md_spinlock_count == 0) 293 enable_intr(); 294 } 295 } 296 eva = 0; 297 code = frame->tf_err; 298 if (type == T_PAGEFLT) { 299 /* 300 * For some Cyrix CPUs, %cr2 is clobbered by 301 * interrupts. This problem is worked around by using 302 * an interrupt gate for the pagefault handler. We 303 * are finally ready to read %cr2 and then must 304 * reenable interrupts. 305 * 306 * If we get a page fault while in a critical section, then 307 * it is most likely a fatal kernel page fault. The kernel 308 * is already going to panic trying to get a sleep lock to 309 * do the VM lookup, so just consider it a fatal trap so the 310 * kernel can print out a useful trap message and even get 311 * to the debugger. 312 * 313 * If we get a page fault while holding a non-sleepable 314 * lock, then it is most likely a fatal kernel page fault. 315 * If WITNESS is enabled, then it's going to whine about 316 * bogus LORs with various VM locks, so just skip to the 317 * fatal trap handling directly. 318 */ 319 eva = rcr2(); 320 if (td->td_critnest != 0 || 321 WITNESS_CHECK(WARN_SLEEPOK | WARN_GIANTOK, NULL, 322 "Kernel page fault") != 0) 323 trap_fatal(frame, eva); 324 else 325 enable_intr(); 326 } 327 328 if ((ISPL(frame->tf_cs) == SEL_UPL) || 329 ((frame->tf_eflags & PSL_VM) && 330 !(PCPU_GET(curpcb)->pcb_flags & PCB_VM86CALL))) { 331 /* user trap */ 332 333 td->td_pticks = 0; 334 td->td_frame = frame; 335 addr = frame->tf_eip; 336 if (td->td_ucred != p->p_ucred) 337 cred_update_thread(td); 338 339 switch (type) { 340 case T_PRIVINFLT: /* privileged instruction fault */ 341 i = SIGILL; 342 ucode = ILL_PRVOPC; 343 break; 344 345 case T_BPTFLT: /* bpt instruction fault */ 346 case T_TRCTRAP: /* trace trap */ 347 enable_intr(); 348 frame->tf_eflags &= ~PSL_T; 349 i = SIGTRAP; 350 ucode = (type == T_TRCTRAP ? TRAP_TRACE : TRAP_BRKPT); 351 break; 352 353 case T_ARITHTRAP: /* arithmetic trap */ 354 #ifdef DEV_NPX 355 ucode = npxtrap(); 356 if (ucode == -1) 357 goto userout; 358 #else 359 ucode = 0; 360 #endif 361 i = SIGFPE; 362 break; 363 364 /* 365 * The following two traps can happen in 366 * vm86 mode, and, if so, we want to handle 367 * them specially. 368 */ 369 case T_PROTFLT: /* general protection fault */ 370 case T_STKFLT: /* stack fault */ 371 if (frame->tf_eflags & PSL_VM) { 372 i = vm86_emulate((struct vm86frame *)frame); 373 if (i == 0) 374 goto user; 375 break; 376 } 377 i = SIGBUS; 378 ucode = (type == T_PROTFLT) ? BUS_OBJERR : BUS_ADRERR; 379 break; 380 case T_SEGNPFLT: /* segment not present fault */ 381 i = SIGBUS; 382 ucode = BUS_ADRERR; 383 break; 384 case T_TSSFLT: /* invalid TSS fault */ 385 i = SIGBUS; 386 ucode = BUS_OBJERR; 387 break; 388 case T_DOUBLEFLT: /* double fault */ 389 default: 390 i = SIGBUS; 391 ucode = BUS_OBJERR; 392 break; 393 394 case T_PAGEFLT: /* page fault */ 395 396 i = trap_pfault(frame, TRUE, eva); 397 #if defined(I586_CPU) && !defined(NO_F00F_HACK) 398 if (i == -2) { 399 /* 400 * The f00f hack workaround has triggered, so 401 * treat the fault as an illegal instruction 402 * (T_PRIVINFLT) instead of a page fault. 403 */ 404 type = frame->tf_trapno = T_PRIVINFLT; 405 406 /* Proceed as in that case. */ 407 ucode = ILL_PRVOPC; 408 i = SIGILL; 409 break; 410 } 411 #endif 412 if (i == -1) 413 goto userout; 414 if (i == 0) 415 goto user; 416 417 if (i == SIGSEGV) 418 ucode = SEGV_MAPERR; 419 else { 420 if (prot_fault_translation == 0) { 421 /* 422 * Autodetect. 423 * This check also covers the images 424 * without the ABI-tag ELF note. 425 */ 426 if (SV_CURPROC_ABI() == 427 SV_ABI_FREEBSD && 428 p->p_osrel >= 700004) { 429 i = SIGSEGV; 430 ucode = SEGV_ACCERR; 431 } else { 432 i = SIGBUS; 433 ucode = BUS_PAGE_FAULT; 434 } 435 } else if (prot_fault_translation == 1) { 436 /* 437 * Always compat mode. 438 */ 439 i = SIGBUS; 440 ucode = BUS_PAGE_FAULT; 441 } else { 442 /* 443 * Always SIGSEGV mode. 444 */ 445 i = SIGSEGV; 446 ucode = SEGV_ACCERR; 447 } 448 } 449 addr = eva; 450 break; 451 452 case T_DIVIDE: /* integer divide fault */ 453 ucode = FPE_INTDIV; 454 i = SIGFPE; 455 break; 456 457 #ifdef DEV_ISA 458 case T_NMI: 459 #ifdef POWERFAIL_NMI 460 #ifndef TIMER_FREQ 461 # define TIMER_FREQ 1193182 462 #endif 463 if (time_second - lastalert > 10) { 464 log(LOG_WARNING, "NMI: power fail\n"); 465 sysbeep(880, hz); 466 lastalert = time_second; 467 } 468 goto userout; 469 #else /* !POWERFAIL_NMI */ 470 /* machine/parity/power fail/"kitchen sink" faults */ 471 if (isa_nmi(code) == 0) { 472 #ifdef KDB 473 /* 474 * NMI can be hooked up to a pushbutton 475 * for debugging. 476 */ 477 if (kdb_on_nmi) { 478 printf ("NMI ... going to debugger\n"); 479 kdb_trap(type, 0, frame); 480 } 481 #endif /* KDB */ 482 goto userout; 483 } else if (panic_on_nmi) 484 panic("NMI indicates hardware failure"); 485 break; 486 #endif /* POWERFAIL_NMI */ 487 #endif /* DEV_ISA */ 488 489 case T_OFLOW: /* integer overflow fault */ 490 ucode = FPE_INTOVF; 491 i = SIGFPE; 492 break; 493 494 case T_BOUND: /* bounds check fault */ 495 ucode = FPE_FLTSUB; 496 i = SIGFPE; 497 break; 498 499 case T_DNA: 500 #ifdef DEV_NPX 501 /* transparent fault (due to context switch "late") */ 502 if (npxdna()) 503 goto userout; 504 #endif 505 printf("pid %d killed due to lack of floating point\n", 506 p->p_pid); 507 i = SIGKILL; 508 ucode = 0; 509 break; 510 511 case T_FPOPFLT: /* FPU operand fetch fault */ 512 ucode = ILL_COPROC; 513 i = SIGILL; 514 break; 515 516 case T_XMMFLT: /* SIMD floating-point exception */ 517 ucode = 0; /* XXX */ 518 i = SIGFPE; 519 break; 520 } 521 } else { 522 /* kernel trap */ 523 524 KASSERT(cold || td->td_ucred != NULL, 525 ("kernel trap doesn't have ucred")); 526 switch (type) { 527 case T_PAGEFLT: /* page fault */ 528 (void) trap_pfault(frame, FALSE, eva); 529 goto out; 530 531 case T_DNA: 532 #ifdef DEV_NPX 533 /* 534 * The kernel is apparently using npx for copying. 535 * XXX this should be fatal unless the kernel has 536 * registered such use. 537 */ 538 if (npxdna()) 539 goto out; 540 #endif 541 break; 542 543 /* 544 * The following two traps can happen in 545 * vm86 mode, and, if so, we want to handle 546 * them specially. 547 */ 548 case T_PROTFLT: /* general protection fault */ 549 case T_STKFLT: /* stack fault */ 550 if (frame->tf_eflags & PSL_VM) { 551 i = vm86_emulate((struct vm86frame *)frame); 552 if (i != 0) 553 /* 554 * returns to original process 555 */ 556 vm86_trap((struct vm86frame *)frame); 557 goto out; 558 } 559 if (type == T_STKFLT) 560 break; 561 562 /* FALL THROUGH */ 563 564 case T_SEGNPFLT: /* segment not present fault */ 565 if (PCPU_GET(curpcb)->pcb_flags & PCB_VM86CALL) 566 break; 567 568 /* 569 * Invalid %fs's and %gs's can be created using 570 * procfs or PT_SETREGS or by invalidating the 571 * underlying LDT entry. This causes a fault 572 * in kernel mode when the kernel attempts to 573 * switch contexts. Lose the bad context 574 * (XXX) so that we can continue, and generate 575 * a signal. 576 */ 577 if (frame->tf_eip == (int)cpu_switch_load_gs) { 578 PCPU_GET(curpcb)->pcb_gs = 0; 579 #if 0 580 PROC_LOCK(p); 581 psignal(p, SIGBUS); 582 PROC_UNLOCK(p); 583 #endif 584 goto out; 585 } 586 587 if (td->td_intr_nesting_level != 0) 588 break; 589 590 /* 591 * Invalid segment selectors and out of bounds 592 * %eip's and %esp's can be set up in user mode. 593 * This causes a fault in kernel mode when the 594 * kernel tries to return to user mode. We want 595 * to get this fault so that we can fix the 596 * problem here and not have to check all the 597 * selectors and pointers when the user changes 598 * them. 599 */ 600 if (frame->tf_eip == (int)doreti_iret) { 601 frame->tf_eip = (int)doreti_iret_fault; 602 goto out; 603 } 604 if (frame->tf_eip == (int)doreti_popl_ds) { 605 frame->tf_eip = (int)doreti_popl_ds_fault; 606 goto out; 607 } 608 if (frame->tf_eip == (int)doreti_popl_es) { 609 frame->tf_eip = (int)doreti_popl_es_fault; 610 goto out; 611 } 612 if (frame->tf_eip == (int)doreti_popl_fs) { 613 frame->tf_eip = (int)doreti_popl_fs_fault; 614 goto out; 615 } 616 if (PCPU_GET(curpcb)->pcb_onfault != NULL) { 617 frame->tf_eip = 618 (int)PCPU_GET(curpcb)->pcb_onfault; 619 goto out; 620 } 621 break; 622 623 case T_TSSFLT: 624 /* 625 * PSL_NT can be set in user mode and isn't cleared 626 * automatically when the kernel is entered. This 627 * causes a TSS fault when the kernel attempts to 628 * `iret' because the TSS link is uninitialized. We 629 * want to get this fault so that we can fix the 630 * problem here and not every time the kernel is 631 * entered. 632 */ 633 if (frame->tf_eflags & PSL_NT) { 634 frame->tf_eflags &= ~PSL_NT; 635 goto out; 636 } 637 break; 638 639 case T_TRCTRAP: /* trace trap */ 640 if (frame->tf_eip == (int)IDTVEC(lcall_syscall)) { 641 /* 642 * We've just entered system mode via the 643 * syscall lcall. Continue single stepping 644 * silently until the syscall handler has 645 * saved the flags. 646 */ 647 goto out; 648 } 649 if (frame->tf_eip == (int)IDTVEC(lcall_syscall) + 1) { 650 /* 651 * The syscall handler has now saved the 652 * flags. Stop single stepping it. 653 */ 654 frame->tf_eflags &= ~PSL_T; 655 goto out; 656 } 657 /* 658 * Ignore debug register trace traps due to 659 * accesses in the user's address space, which 660 * can happen under several conditions such as 661 * if a user sets a watchpoint on a buffer and 662 * then passes that buffer to a system call. 663 * We still want to get TRCTRAPS for addresses 664 * in kernel space because that is useful when 665 * debugging the kernel. 666 */ 667 if (user_dbreg_trap() && 668 !(PCPU_GET(curpcb)->pcb_flags & PCB_VM86CALL)) { 669 /* 670 * Reset breakpoint bits because the 671 * processor doesn't 672 */ 673 load_dr6(rdr6() & 0xfffffff0); 674 goto out; 675 } 676 /* 677 * FALLTHROUGH (TRCTRAP kernel mode, kernel address) 678 */ 679 case T_BPTFLT: 680 /* 681 * If KDB is enabled, let it handle the debugger trap. 682 * Otherwise, debugger traps "can't happen". 683 */ 684 #ifdef KDB 685 if (kdb_trap(type, 0, frame)) 686 goto out; 687 #endif 688 break; 689 690 #ifdef DEV_ISA 691 case T_NMI: 692 #ifdef POWERFAIL_NMI 693 if (time_second - lastalert > 10) { 694 log(LOG_WARNING, "NMI: power fail\n"); 695 sysbeep(880, hz); 696 lastalert = time_second; 697 } 698 goto out; 699 #else /* !POWERFAIL_NMI */ 700 /* machine/parity/power fail/"kitchen sink" faults */ 701 if (isa_nmi(code) == 0) { 702 #ifdef KDB 703 /* 704 * NMI can be hooked up to a pushbutton 705 * for debugging. 706 */ 707 if (kdb_on_nmi) { 708 printf ("NMI ... going to debugger\n"); 709 kdb_trap(type, 0, frame); 710 } 711 #endif /* KDB */ 712 goto out; 713 } else if (panic_on_nmi == 0) 714 goto out; 715 /* FALLTHROUGH */ 716 #endif /* POWERFAIL_NMI */ 717 #endif /* DEV_ISA */ 718 } 719 720 trap_fatal(frame, eva); 721 goto out; 722 } 723 724 /* Translate fault for emulators (e.g. Linux) */ 725 if (*p->p_sysent->sv_transtrap) 726 i = (*p->p_sysent->sv_transtrap)(i, type); 727 728 ksiginfo_init_trap(&ksi); 729 ksi.ksi_signo = i; 730 ksi.ksi_code = ucode; 731 ksi.ksi_addr = (void *)addr; 732 ksi.ksi_trapno = type; 733 trapsignal(td, &ksi); 734 735 #ifdef DEBUG 736 if (type <= MAX_TRAP_MSG) { 737 uprintf("fatal process exception: %s", 738 trap_msg[type]); 739 if ((type == T_PAGEFLT) || (type == T_PROTFLT)) 740 uprintf(", fault VA = 0x%lx", (u_long)eva); 741 uprintf("\n"); 742 } 743 #endif 744 745 user: 746 userret(td, frame); 747 mtx_assert(&Giant, MA_NOTOWNED); 748 userout: 749 out: 750 return; 751 } 752 753 static int 754 trap_pfault(frame, usermode, eva) 755 struct trapframe *frame; 756 int usermode; 757 vm_offset_t eva; 758 { 759 vm_offset_t va; 760 struct vmspace *vm = NULL; 761 vm_map_t map; 762 int rv = 0; 763 vm_prot_t ftype; 764 struct thread *td = curthread; 765 struct proc *p = td->td_proc; 766 767 va = trunc_page(eva); 768 if (va >= KERNBASE) { 769 /* 770 * Don't allow user-mode faults in kernel address space. 771 * An exception: if the faulting address is the invalid 772 * instruction entry in the IDT, then the Intel Pentium 773 * F00F bug workaround was triggered, and we need to 774 * treat it is as an illegal instruction, and not a page 775 * fault. 776 */ 777 #if defined(I586_CPU) && !defined(NO_F00F_HACK) 778 if ((eva == (unsigned int)&idt[6]) && has_f00f_bug) 779 return -2; 780 #endif 781 if (usermode) 782 goto nogo; 783 784 map = kernel_map; 785 } else { 786 /* 787 * This is a fault on non-kernel virtual memory. 788 * vm is initialized above to NULL. If curproc is NULL 789 * or curproc->p_vmspace is NULL the fault is fatal. 790 */ 791 if (p != NULL) 792 vm = p->p_vmspace; 793 794 if (vm == NULL) 795 goto nogo; 796 797 map = &vm->vm_map; 798 } 799 800 /* 801 * PGEX_I is defined only if the execute disable bit capability is 802 * supported and enabled. 803 */ 804 if (frame->tf_err & PGEX_W) 805 ftype = VM_PROT_WRITE; 806 #ifdef PAE 807 else if ((frame->tf_err & PGEX_I) && pg_nx != 0) 808 ftype = VM_PROT_EXECUTE; 809 #endif 810 else 811 ftype = VM_PROT_READ; 812 813 if (map != kernel_map) { 814 /* 815 * Keep swapout from messing with us during this 816 * critical time. 817 */ 818 PROC_LOCK(p); 819 ++p->p_lock; 820 PROC_UNLOCK(p); 821 822 /* Fault in the user page: */ 823 rv = vm_fault(map, va, ftype, 824 (ftype & VM_PROT_WRITE) ? VM_FAULT_DIRTY 825 : VM_FAULT_NORMAL); 826 827 PROC_LOCK(p); 828 --p->p_lock; 829 PROC_UNLOCK(p); 830 } else { 831 /* 832 * Don't have to worry about process locking or stacks in the 833 * kernel. 834 */ 835 rv = vm_fault(map, va, ftype, VM_FAULT_NORMAL); 836 } 837 if (rv == KERN_SUCCESS) 838 return (0); 839 nogo: 840 if (!usermode) { 841 if (td->td_intr_nesting_level == 0 && 842 PCPU_GET(curpcb)->pcb_onfault != NULL) { 843 frame->tf_eip = (int)PCPU_GET(curpcb)->pcb_onfault; 844 return (0); 845 } 846 trap_fatal(frame, eva); 847 return (-1); 848 } 849 850 return((rv == KERN_PROTECTION_FAILURE) ? SIGBUS : SIGSEGV); 851 } 852 853 static void 854 trap_fatal(frame, eva) 855 struct trapframe *frame; 856 vm_offset_t eva; 857 { 858 int code, ss, esp; 859 u_int type; 860 struct soft_segment_descriptor softseg; 861 char *msg; 862 863 code = frame->tf_err; 864 type = frame->tf_trapno; 865 sdtossd(&gdt[IDXSEL(frame->tf_cs & 0xffff)].sd, &softseg); 866 867 if (type <= MAX_TRAP_MSG) 868 msg = trap_msg[type]; 869 else 870 msg = "UNKNOWN"; 871 printf("\n\nFatal trap %d: %s while in %s mode\n", type, msg, 872 frame->tf_eflags & PSL_VM ? "vm86" : 873 ISPL(frame->tf_cs) == SEL_UPL ? "user" : "kernel"); 874 #ifdef SMP 875 /* two separate prints in case of a trap on an unmapped page */ 876 printf("cpuid = %d; ", PCPU_GET(cpuid)); 877 printf("apic id = %02x\n", PCPU_GET(apic_id)); 878 #endif 879 if (type == T_PAGEFLT) { 880 printf("fault virtual address = 0x%x\n", eva); 881 printf("fault code = %s %s, %s\n", 882 code & PGEX_U ? "user" : "supervisor", 883 code & PGEX_W ? "write" : "read", 884 code & PGEX_P ? "protection violation" : "page not present"); 885 } 886 printf("instruction pointer = 0x%x:0x%x\n", 887 frame->tf_cs & 0xffff, frame->tf_eip); 888 if ((ISPL(frame->tf_cs) == SEL_UPL) || (frame->tf_eflags & PSL_VM)) { 889 ss = frame->tf_ss & 0xffff; 890 esp = frame->tf_esp; 891 } else { 892 ss = GSEL(GDATA_SEL, SEL_KPL); 893 esp = (int)&frame->tf_esp; 894 } 895 printf("stack pointer = 0x%x:0x%x\n", ss, esp); 896 printf("frame pointer = 0x%x:0x%x\n", ss, frame->tf_ebp); 897 printf("code segment = base 0x%x, limit 0x%x, type 0x%x\n", 898 softseg.ssd_base, softseg.ssd_limit, softseg.ssd_type); 899 printf(" = DPL %d, pres %d, def32 %d, gran %d\n", 900 softseg.ssd_dpl, softseg.ssd_p, softseg.ssd_def32, 901 softseg.ssd_gran); 902 printf("processor eflags = "); 903 if (frame->tf_eflags & PSL_T) 904 printf("trace trap, "); 905 if (frame->tf_eflags & PSL_I) 906 printf("interrupt enabled, "); 907 if (frame->tf_eflags & PSL_NT) 908 printf("nested task, "); 909 if (frame->tf_eflags & PSL_RF) 910 printf("resume, "); 911 if (frame->tf_eflags & PSL_VM) 912 printf("vm86, "); 913 printf("IOPL = %d\n", (frame->tf_eflags & PSL_IOPL) >> 12); 914 printf("current process = "); 915 if (curproc) { 916 printf("%lu (%s)\n", (u_long)curproc->p_pid, curthread->td_name); 917 } else { 918 printf("Idle\n"); 919 } 920 921 #ifdef KDB 922 if (debugger_on_panic || kdb_active) { 923 frame->tf_err = eva; /* smuggle fault address to ddb */ 924 if (kdb_trap(type, 0, frame)) { 925 frame->tf_err = code; /* restore error code */ 926 return; 927 } 928 frame->tf_err = code; /* restore error code */ 929 } 930 #endif 931 printf("trap number = %d\n", type); 932 if (type <= MAX_TRAP_MSG) 933 panic("%s", trap_msg[type]); 934 else 935 panic("unknown/reserved trap"); 936 } 937 938 /* 939 * Double fault handler. Called when a fault occurs while writing 940 * a frame for a trap/exception onto the stack. This usually occurs 941 * when the stack overflows (such is the case with infinite recursion, 942 * for example). 943 * 944 * XXX Note that the current PTD gets replaced by IdlePTD when the 945 * task switch occurs. This means that the stack that was active at 946 * the time of the double fault is not available at <kstack> unless 947 * the machine was idle when the double fault occurred. The downside 948 * of this is that "trace <ebp>" in ddb won't work. 949 */ 950 void 951 dblfault_handler() 952 { 953 #ifdef KDTRACE_HOOKS 954 if (dtrace_doubletrap_func != NULL) 955 (*dtrace_doubletrap_func)(); 956 #endif 957 printf("\nFatal double fault:\n"); 958 printf("eip = 0x%x\n", PCPU_GET(common_tss.tss_eip)); 959 printf("esp = 0x%x\n", PCPU_GET(common_tss.tss_esp)); 960 printf("ebp = 0x%x\n", PCPU_GET(common_tss.tss_ebp)); 961 #ifdef SMP 962 /* two separate prints in case of a trap on an unmapped page */ 963 printf("cpuid = %d; ", PCPU_GET(cpuid)); 964 printf("apic id = %02x\n", PCPU_GET(apic_id)); 965 #endif 966 panic("double fault"); 967 } 968 969 /* 970 * syscall - system call request C handler 971 * 972 * A system call is essentially treated as a trap. 973 */ 974 void 975 syscall(struct trapframe *frame) 976 { 977 caddr_t params; 978 struct sysent *callp; 979 struct thread *td = curthread; 980 struct proc *p = td->td_proc; 981 register_t orig_tf_eflags; 982 int error; 983 int narg; 984 int args[8]; 985 u_int code; 986 ksiginfo_t ksi; 987 988 PCPU_INC(cnt.v_syscall); 989 990 #ifdef DIAGNOSTIC 991 if (ISPL(frame->tf_cs) != SEL_UPL) { 992 panic("syscall"); 993 /* NOT REACHED */ 994 } 995 #endif 996 997 td->td_pticks = 0; 998 td->td_frame = frame; 999 if (td->td_ucred != p->p_ucred) 1000 cred_update_thread(td); 1001 params = (caddr_t)frame->tf_esp + sizeof(int); 1002 code = frame->tf_eax; 1003 orig_tf_eflags = frame->tf_eflags; 1004 1005 if (p->p_sysent->sv_prepsyscall) { 1006 (*p->p_sysent->sv_prepsyscall)(frame, args, &code, ¶ms); 1007 } else { 1008 /* 1009 * Need to check if this is a 32 bit or 64 bit syscall. 1010 */ 1011 if (code == SYS_syscall) { 1012 /* 1013 * Code is first argument, followed by actual args. 1014 */ 1015 code = fuword(params); 1016 params += sizeof(int); 1017 } else if (code == SYS___syscall) { 1018 /* 1019 * Like syscall, but code is a quad, so as to maintain 1020 * quad alignment for the rest of the arguments. 1021 */ 1022 code = fuword(params); 1023 params += sizeof(quad_t); 1024 } 1025 } 1026 1027 if (p->p_sysent->sv_mask) 1028 code &= p->p_sysent->sv_mask; 1029 1030 if (code >= p->p_sysent->sv_size) 1031 callp = &p->p_sysent->sv_table[0]; 1032 else 1033 callp = &p->p_sysent->sv_table[code]; 1034 1035 narg = callp->sy_narg; 1036 1037 if (params != NULL && narg != 0) 1038 error = copyin(params, (caddr_t)args, 1039 (u_int)(narg * sizeof(int))); 1040 else 1041 error = 0; 1042 1043 #ifdef KTRACE 1044 if (KTRPOINT(td, KTR_SYSCALL)) 1045 ktrsyscall(code, narg, args); 1046 #endif 1047 1048 CTR4(KTR_SYSC, "syscall enter thread %p pid %d proc %s code %d", td, 1049 td->td_proc->p_pid, td->td_name, code); 1050 1051 td->td_syscalls++; 1052 1053 if (error == 0) { 1054 td->td_retval[0] = 0; 1055 td->td_retval[1] = frame->tf_edx; 1056 1057 STOPEVENT(p, S_SCE, narg); 1058 1059 PTRACESTOP_SC(p, td, S_PT_SCE); 1060 1061 #ifdef KDTRACE_HOOKS 1062 /* 1063 * If the systrace module has registered it's probe 1064 * callback and if there is a probe active for the 1065 * syscall 'entry', process the probe. 1066 */ 1067 if (systrace_probe_func != NULL && callp->sy_entry != 0) 1068 (*systrace_probe_func)(callp->sy_entry, code, callp, 1069 args); 1070 #endif 1071 1072 AUDIT_SYSCALL_ENTER(code, td); 1073 error = (*callp->sy_call)(td, args); 1074 AUDIT_SYSCALL_EXIT(error, td); 1075 1076 /* Save the latest error return value. */ 1077 td->td_errno = error; 1078 1079 #ifdef KDTRACE_HOOKS 1080 /* 1081 * If the systrace module has registered it's probe 1082 * callback and if there is a probe active for the 1083 * syscall 'return', process the probe. 1084 */ 1085 if (systrace_probe_func != NULL && callp->sy_return != 0) 1086 (*systrace_probe_func)(callp->sy_return, code, callp, 1087 args); 1088 #endif 1089 } 1090 1091 switch (error) { 1092 case 0: 1093 frame->tf_eax = td->td_retval[0]; 1094 frame->tf_edx = td->td_retval[1]; 1095 frame->tf_eflags &= ~PSL_C; 1096 break; 1097 1098 case ERESTART: 1099 /* 1100 * Reconstruct pc, assuming lcall $X,y is 7 bytes, 1101 * int 0x80 is 2 bytes. We saved this in tf_err. 1102 */ 1103 frame->tf_eip -= frame->tf_err; 1104 break; 1105 1106 case EJUSTRETURN: 1107 break; 1108 1109 default: 1110 if (p->p_sysent->sv_errsize) { 1111 if (error >= p->p_sysent->sv_errsize) 1112 error = -1; /* XXX */ 1113 else 1114 error = p->p_sysent->sv_errtbl[error]; 1115 } 1116 frame->tf_eax = error; 1117 frame->tf_eflags |= PSL_C; 1118 break; 1119 } 1120 1121 /* 1122 * Traced syscall. 1123 */ 1124 if ((orig_tf_eflags & PSL_T) && !(orig_tf_eflags & PSL_VM)) { 1125 frame->tf_eflags &= ~PSL_T; 1126 ksiginfo_init_trap(&ksi); 1127 ksi.ksi_signo = SIGTRAP; 1128 ksi.ksi_code = TRAP_TRACE; 1129 ksi.ksi_addr = (void *)frame->tf_eip; 1130 trapsignal(td, &ksi); 1131 } 1132 1133 /* 1134 * Check for misbehavior. 1135 */ 1136 WITNESS_WARN(WARN_PANIC, NULL, "System call %s returning", 1137 (code >= 0 && code < SYS_MAXSYSCALL) ? syscallnames[code] : "???"); 1138 KASSERT(td->td_critnest == 0, 1139 ("System call %s returning in a critical section", 1140 (code >= 0 && code < SYS_MAXSYSCALL) ? syscallnames[code] : "???")); 1141 KASSERT(td->td_locks == 0, 1142 ("System call %s returning with %d locks held", 1143 (code >= 0 && code < SYS_MAXSYSCALL) ? syscallnames[code] : "???", 1144 td->td_locks)); 1145 1146 /* 1147 * Handle reschedule and other end-of-syscall issues 1148 */ 1149 userret(td, frame); 1150 1151 CTR4(KTR_SYSC, "syscall exit thread %p pid %d proc %s code %d", td, 1152 td->td_proc->p_pid, td->td_name, code); 1153 1154 #ifdef KTRACE 1155 if (KTRPOINT(td, KTR_SYSRET)) 1156 ktrsysret(code, error, td->td_retval[0]); 1157 #endif 1158 1159 /* 1160 * This works because errno is findable through the 1161 * register set. If we ever support an emulation where this 1162 * is not the case, this code will need to be revisited. 1163 */ 1164 STOPEVENT(p, S_SCX, code); 1165 1166 PTRACESTOP_SC(p, td, S_PT_SCX); 1167 } 1168
Cache object: f3c65df1efad92130f48efa575ea82b5
[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]