Now available: The Design and Implementation of the FreeBSD Operating System (Second Edition)
[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]
FreeBSD/Linux Kernel Cross Reference
sys/i386/i386/trap.c
Version:
- FREEBSD - FREEBSD-13-STABLE - FREEBSD-13-0 - FREEBSD-12-STABLE - FREEBSD-12-0 - FREEBSD-11-STABLE - FREEBSD-11-0 - FREEBSD-10-STABLE - FREEBSD-10-0 - FREEBSD-9-STABLE - FREEBSD-9-0 - FREEBSD-8-STABLE - FREEBSD-8-0 - FREEBSD-7-STABLE - FREEBSD-7-0 - FREEBSD-6-STABLE - FREEBSD-6-0 - FREEBSD-5-STABLE - FREEBSD-5-0 - FREEBSD-4-STABLE - FREEBSD-3-STABLE - FREEBSD22 - l41 - OPENBSD - linux-2.6 - MK84 - PLAN9 - xnu-8792
SearchContext: - none - 3 - 10
SearchContext: - none - 3 - 10
1 /*- 2 * Copyright (C) 1994, David Greenman 3 * Copyright (c) 1990, 1993 4 * The Regents of the University of California. All rights reserved. 5 * 6 * This code is derived from software contributed to Berkeley by 7 * the University of Utah, and William Jolitz. 8 * 9 * Redistribution and use in source and binary forms, with or without 10 * modification, are permitted provided that the following conditions 11 * are met: 12 * 1. Redistributions of source code must retain the above copyright 13 * notice, this list of conditions and the following disclaimer. 14 * 2. Redistributions in binary form must reproduce the above copyright 15 * notice, this list of conditions and the following disclaimer in the 16 * documentation and/or other materials provided with the distribution. 17 * 3. All advertising materials mentioning features or use of this software 18 * must display the following acknowledgement: 19 * This product includes software developed by the University of 20 * California, Berkeley and its contributors. 21 * 4. Neither the name of the University nor the names of its contributors 22 * may be used to endorse or promote products derived from this software 23 * without specific prior written permission. 24 * 25 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 26 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 27 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 28 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 29 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 30 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 31 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 32 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 33 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 34 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 35 * SUCH DAMAGE. 36 * 37 * from: @(#)trap.c 7.4 (Berkeley) 5/13/91 38 */ 39 40 #include <sys/cdefs.h> 41 __FBSDID("$FreeBSD: releng/8.1/sys/i386/i386/trap.c 206890 2010-04-20 08:19:43Z kib $"); 42 43 /* 44 * 386 Trap and System call handling 45 */ 46 47 #include "opt_clock.h" 48 #include "opt_cpu.h" 49 #include "opt_hwpmc_hooks.h" 50 #include "opt_isa.h" 51 #include "opt_kdb.h" 52 #include "opt_kdtrace.h" 53 #include "opt_ktrace.h" 54 #include "opt_npx.h" 55 #include "opt_trap.h" 56 57 #include <sys/param.h> 58 #include <sys/bus.h> 59 #include <sys/systm.h> 60 #include <sys/proc.h> 61 #include <sys/pioctl.h> 62 #include <sys/ptrace.h> 63 #include <sys/kdb.h> 64 #include <sys/kernel.h> 65 #include <sys/ktr.h> 66 #include <sys/lock.h> 67 #include <sys/mutex.h> 68 #include <sys/resourcevar.h> 69 #include <sys/signalvar.h> 70 #include <sys/syscall.h> 71 #include <sys/sysctl.h> 72 #include <sys/sysent.h> 73 #include <sys/uio.h> 74 #include <sys/vmmeter.h> 75 #ifdef KTRACE 76 #include <sys/ktrace.h> 77 #endif 78 #ifdef HWPMC_HOOKS 79 #include <sys/pmckern.h> 80 #endif 81 #include <security/audit/audit.h> 82 83 #include <vm/vm.h> 84 #include <vm/vm_param.h> 85 #include <vm/pmap.h> 86 #include <vm/vm_kern.h> 87 #include <vm/vm_map.h> 88 #include <vm/vm_page.h> 89 #include <vm/vm_extern.h> 90 91 #include <machine/cpu.h> 92 #include <machine/intr_machdep.h> 93 #include <machine/mca.h> 94 #include <machine/md_var.h> 95 #include <machine/pcb.h> 96 #ifdef SMP 97 #include <machine/smp.h> 98 #endif 99 #include <machine/tss.h> 100 #include <machine/vm86.h> 101 102 #ifdef POWERFAIL_NMI 103 #include <sys/syslog.h> 104 #include <machine/clock.h> 105 #endif 106 107 #ifdef KDTRACE_HOOKS 108 #include <sys/dtrace_bsd.h> 109 110 /* 111 * This is a hook which is initialised by the dtrace module 112 * to handle traps which might occur during DTrace probe 113 * execution. 114 */ 115 dtrace_trap_func_t dtrace_trap_func; 116 117 dtrace_doubletrap_func_t dtrace_doubletrap_func; 118 119 /* 120 * This is a hook which is initialised by the systrace module 121 * when it is loaded. This keeps the DTrace syscall provider 122 * implementation opaque. 123 */ 124 systrace_probe_func_t systrace_probe_func; 125 #endif 126 127 extern void trap(struct trapframe *frame); 128 extern void syscall(struct trapframe *frame); 129 130 static int trap_pfault(struct trapframe *, int, vm_offset_t); 131 static void trap_fatal(struct trapframe *, vm_offset_t); 132 void dblfault_handler(void); 133 134 extern inthand_t IDTVEC(lcall_syscall); 135 136 #define MAX_TRAP_MSG 30 137 static char *trap_msg[] = { 138 "", /* 0 unused */ 139 "privileged instruction fault", /* 1 T_PRIVINFLT */ 140 "", /* 2 unused */ 141 "breakpoint instruction fault", /* 3 T_BPTFLT */ 142 "", /* 4 unused */ 143 "", /* 5 unused */ 144 "arithmetic trap", /* 6 T_ARITHTRAP */ 145 "", /* 7 unused */ 146 "", /* 8 unused */ 147 "general protection fault", /* 9 T_PROTFLT */ 148 "trace trap", /* 10 T_TRCTRAP */ 149 "", /* 11 unused */ 150 "page fault", /* 12 T_PAGEFLT */ 151 "", /* 13 unused */ 152 "alignment fault", /* 14 T_ALIGNFLT */ 153 "", /* 15 unused */ 154 "", /* 16 unused */ 155 "", /* 17 unused */ 156 "integer divide fault", /* 18 T_DIVIDE */ 157 "non-maskable interrupt trap", /* 19 T_NMI */ 158 "overflow trap", /* 20 T_OFLOW */ 159 "FPU bounds check fault", /* 21 T_BOUND */ 160 "FPU device not available", /* 22 T_DNA */ 161 "double fault", /* 23 T_DOUBLEFLT */ 162 "FPU operand fetch fault", /* 24 T_FPOPFLT */ 163 "invalid TSS fault", /* 25 T_TSSFLT */ 164 "segment not present fault", /* 26 T_SEGNPFLT */ 165 "stack fault", /* 27 T_STKFLT */ 166 "machine check trap", /* 28 T_MCHK */ 167 "SIMD floating-point exception", /* 29 T_XMMFLT */ 168 "reserved (unknown) fault", /* 30 T_RESERVED */ 169 }; 170 171 #if defined(I586_CPU) && !defined(NO_F00F_HACK) 172 extern int has_f00f_bug; 173 #endif 174 175 #ifdef KDB 176 static int kdb_on_nmi = 1; 177 SYSCTL_INT(_machdep, OID_AUTO, kdb_on_nmi, CTLFLAG_RW, 178 &kdb_on_nmi, 0, "Go to KDB on NMI"); 179 #endif 180 static int panic_on_nmi = 1; 181 SYSCTL_INT(_machdep, OID_AUTO, panic_on_nmi, CTLFLAG_RW, 182 &panic_on_nmi, 0, "Panic on NMI"); 183 static int prot_fault_translation = 0; 184 SYSCTL_INT(_machdep, OID_AUTO, prot_fault_translation, CTLFLAG_RW, 185 &prot_fault_translation, 0, "Select signal to deliver on protection fault"); 186 187 extern char *syscallnames[]; 188 189 /* 190 * Exception, fault, and trap interface to the FreeBSD kernel. 191 * This common code is called from assembly language IDT gate entry 192 * routines that prepare a suitable stack frame, and restore this 193 * frame after the exception has been processed. 194 */ 195 196 void 197 trap(struct trapframe *frame) 198 { 199 struct thread *td = curthread; 200 struct proc *p = td->td_proc; 201 int i = 0, ucode = 0, code; 202 u_int type; 203 register_t addr = 0; 204 vm_offset_t eva; 205 ksiginfo_t ksi; 206 #ifdef POWERFAIL_NMI 207 static int lastalert = 0; 208 #endif 209 210 PCPU_INC(cnt.v_trap); 211 type = frame->tf_trapno; 212 213 #ifdef SMP 214 /* Handler for NMI IPIs used for stopping CPUs. */ 215 if (type == T_NMI) { 216 if (ipi_nmi_handler() == 0) 217 goto out; 218 } 219 #endif /* SMP */ 220 221 #ifdef KDB 222 if (kdb_active) { 223 kdb_reenter(); 224 goto out; 225 } 226 #endif 227 228 if (type == T_RESERVED) { 229 trap_fatal(frame, 0); 230 goto out; 231 } 232 233 #ifdef HWPMC_HOOKS 234 /* 235 * CPU PMCs interrupt using an NMI so we check for that first. 236 * If the HWPMC module is active, 'pmc_hook' will point to 237 * the function to be called. A return value of '1' from the 238 * hook means that the NMI was handled by it and that we can 239 * return immediately. 240 */ 241 if (type == T_NMI && pmc_intr && 242 (*pmc_intr)(PCPU_GET(cpuid), frame)) 243 goto out; 244 #endif 245 246 if (type == T_MCHK) { 247 if (!mca_intr()) 248 trap_fatal(frame, 0); 249 goto out; 250 } 251 252 #ifdef KDTRACE_HOOKS 253 /* 254 * A trap can occur while DTrace executes a probe. Before 255 * executing the probe, DTrace blocks re-scheduling and sets 256 * a flag in it's per-cpu flags to indicate that it doesn't 257 * want to fault. On returning from the the probe, the no-fault 258 * flag is cleared and finally re-scheduling is enabled. 259 * 260 * If the DTrace kernel module has registered a trap handler, 261 * call it and if it returns non-zero, assume that it has 262 * handled the trap and modified the trap frame so that this 263 * function can return normally. 264 */ 265 if ((type == T_PROTFLT || type == T_PAGEFLT) && 266 dtrace_trap_func != NULL) 267 if ((*dtrace_trap_func)(frame, type)) 268 goto out; 269 #endif 270 271 if ((frame->tf_eflags & PSL_I) == 0) { 272 /* 273 * Buggy application or kernel code has disabled 274 * interrupts and then trapped. Enabling interrupts 275 * now is wrong, but it is better than running with 276 * interrupts disabled until they are accidentally 277 * enabled later. 278 */ 279 if (ISPL(frame->tf_cs) == SEL_UPL || (frame->tf_eflags & PSL_VM)) 280 uprintf( 281 "pid %ld (%s): trap %d with interrupts disabled\n", 282 (long)curproc->p_pid, curthread->td_name, type); 283 else if (type != T_BPTFLT && type != T_TRCTRAP && 284 frame->tf_eip != (int)cpu_switch_load_gs) { 285 /* 286 * XXX not quite right, since this may be for a 287 * multiple fault in user mode. 288 */ 289 printf("kernel trap %d with interrupts disabled\n", 290 type); 291 /* 292 * Page faults need interrupts disabled until later, 293 * and we shouldn't enable interrupts while holding 294 * a spin lock or if servicing an NMI. 295 */ 296 if (type != T_NMI && type != T_PAGEFLT && 297 td->td_md.md_spinlock_count == 0) 298 enable_intr(); 299 } 300 } 301 eva = 0; 302 code = frame->tf_err; 303 if (type == T_PAGEFLT) { 304 /* 305 * For some Cyrix CPUs, %cr2 is clobbered by 306 * interrupts. This problem is worked around by using 307 * an interrupt gate for the pagefault handler. We 308 * are finally ready to read %cr2 and then must 309 * reenable interrupts. 310 * 311 * If we get a page fault while in a critical section, then 312 * it is most likely a fatal kernel page fault. The kernel 313 * is already going to panic trying to get a sleep lock to 314 * do the VM lookup, so just consider it a fatal trap so the 315 * kernel can print out a useful trap message and even get 316 * to the debugger. 317 * 318 * If we get a page fault while holding a non-sleepable 319 * lock, then it is most likely a fatal kernel page fault. 320 * If WITNESS is enabled, then it's going to whine about 321 * bogus LORs with various VM locks, so just skip to the 322 * fatal trap handling directly. 323 */ 324 eva = rcr2(); 325 if (td->td_critnest != 0 || 326 WITNESS_CHECK(WARN_SLEEPOK | WARN_GIANTOK, NULL, 327 "Kernel page fault") != 0) 328 trap_fatal(frame, eva); 329 else 330 enable_intr(); 331 } 332 333 if ((ISPL(frame->tf_cs) == SEL_UPL) || 334 ((frame->tf_eflags & PSL_VM) && 335 !(PCPU_GET(curpcb)->pcb_flags & PCB_VM86CALL))) { 336 /* user trap */ 337 338 td->td_pticks = 0; 339 td->td_frame = frame; 340 addr = frame->tf_eip; 341 if (td->td_ucred != p->p_ucred) 342 cred_update_thread(td); 343 344 switch (type) { 345 case T_PRIVINFLT: /* privileged instruction fault */ 346 i = SIGILL; 347 ucode = ILL_PRVOPC; 348 break; 349 350 case T_BPTFLT: /* bpt instruction fault */ 351 case T_TRCTRAP: /* trace trap */ 352 enable_intr(); 353 frame->tf_eflags &= ~PSL_T; 354 i = SIGTRAP; 355 ucode = (type == T_TRCTRAP ? TRAP_TRACE : TRAP_BRKPT); 356 break; 357 358 case T_ARITHTRAP: /* arithmetic trap */ 359 #ifdef DEV_NPX 360 ucode = npxtrap(); 361 if (ucode == -1) 362 goto userout; 363 #else 364 ucode = 0; 365 #endif 366 i = SIGFPE; 367 break; 368 369 /* 370 * The following two traps can happen in 371 * vm86 mode, and, if so, we want to handle 372 * them specially. 373 */ 374 case T_PROTFLT: /* general protection fault */ 375 case T_STKFLT: /* stack fault */ 376 if (frame->tf_eflags & PSL_VM) { 377 i = vm86_emulate((struct vm86frame *)frame); 378 if (i == 0) 379 goto user; 380 break; 381 } 382 i = SIGBUS; 383 ucode = (type == T_PROTFLT) ? BUS_OBJERR : BUS_ADRERR; 384 break; 385 case T_SEGNPFLT: /* segment not present fault */ 386 i = SIGBUS; 387 ucode = BUS_ADRERR; 388 break; 389 case T_TSSFLT: /* invalid TSS fault */ 390 i = SIGBUS; 391 ucode = BUS_OBJERR; 392 break; 393 case T_DOUBLEFLT: /* double fault */ 394 default: 395 i = SIGBUS; 396 ucode = BUS_OBJERR; 397 break; 398 399 case T_PAGEFLT: /* page fault */ 400 401 i = trap_pfault(frame, TRUE, eva); 402 #if defined(I586_CPU) && !defined(NO_F00F_HACK) 403 if (i == -2) { 404 /* 405 * The f00f hack workaround has triggered, so 406 * treat the fault as an illegal instruction 407 * (T_PRIVINFLT) instead of a page fault. 408 */ 409 type = frame->tf_trapno = T_PRIVINFLT; 410 411 /* Proceed as in that case. */ 412 ucode = ILL_PRVOPC; 413 i = SIGILL; 414 break; 415 } 416 #endif 417 if (i == -1) 418 goto userout; 419 if (i == 0) 420 goto user; 421 422 if (i == SIGSEGV) 423 ucode = SEGV_MAPERR; 424 else { 425 if (prot_fault_translation == 0) { 426 /* 427 * Autodetect. 428 * This check also covers the images 429 * without the ABI-tag ELF note. 430 */ 431 if (SV_CURPROC_ABI() == 432 SV_ABI_FREEBSD && 433 p->p_osrel >= 700004) { 434 i = SIGSEGV; 435 ucode = SEGV_ACCERR; 436 } else { 437 i = SIGBUS; 438 ucode = BUS_PAGE_FAULT; 439 } 440 } else if (prot_fault_translation == 1) { 441 /* 442 * Always compat mode. 443 */ 444 i = SIGBUS; 445 ucode = BUS_PAGE_FAULT; 446 } else { 447 /* 448 * Always SIGSEGV mode. 449 */ 450 i = SIGSEGV; 451 ucode = SEGV_ACCERR; 452 } 453 } 454 addr = eva; 455 break; 456 457 case T_DIVIDE: /* integer divide fault */ 458 ucode = FPE_INTDIV; 459 i = SIGFPE; 460 break; 461 462 #ifdef DEV_ISA 463 case T_NMI: 464 #ifdef POWERFAIL_NMI 465 #ifndef TIMER_FREQ 466 # define TIMER_FREQ 1193182 467 #endif 468 if (time_second - lastalert > 10) { 469 log(LOG_WARNING, "NMI: power fail\n"); 470 sysbeep(880, hz); 471 lastalert = time_second; 472 } 473 goto userout; 474 #else /* !POWERFAIL_NMI */ 475 /* machine/parity/power fail/"kitchen sink" faults */ 476 if (isa_nmi(code) == 0) { 477 #ifdef KDB 478 /* 479 * NMI can be hooked up to a pushbutton 480 * for debugging. 481 */ 482 if (kdb_on_nmi) { 483 printf ("NMI ... going to debugger\n"); 484 kdb_trap(type, 0, frame); 485 } 486 #endif /* KDB */ 487 goto userout; 488 } else if (panic_on_nmi) 489 panic("NMI indicates hardware failure"); 490 break; 491 #endif /* POWERFAIL_NMI */ 492 #endif /* DEV_ISA */ 493 494 case T_OFLOW: /* integer overflow fault */ 495 ucode = FPE_INTOVF; 496 i = SIGFPE; 497 break; 498 499 case T_BOUND: /* bounds check fault */ 500 ucode = FPE_FLTSUB; 501 i = SIGFPE; 502 break; 503 504 case T_DNA: 505 #ifdef DEV_NPX 506 /* transparent fault (due to context switch "late") */ 507 if (npxdna()) 508 goto userout; 509 #endif 510 uprintf("pid %d killed due to lack of floating point\n", 511 p->p_pid); 512 i = SIGKILL; 513 ucode = 0; 514 break; 515 516 case T_FPOPFLT: /* FPU operand fetch fault */ 517 ucode = ILL_COPROC; 518 i = SIGILL; 519 break; 520 521 case T_XMMFLT: /* SIMD floating-point exception */ 522 ucode = 0; /* XXX */ 523 i = SIGFPE; 524 break; 525 } 526 } else { 527 /* kernel trap */ 528 529 KASSERT(cold || td->td_ucred != NULL, 530 ("kernel trap doesn't have ucred")); 531 switch (type) { 532 case T_PAGEFLT: /* page fault */ 533 (void) trap_pfault(frame, FALSE, eva); 534 goto out; 535 536 case T_DNA: 537 #ifdef DEV_NPX 538 /* 539 * The kernel is apparently using npx for copying. 540 * XXX this should be fatal unless the kernel has 541 * registered such use. 542 */ 543 if (npxdna()) 544 goto out; 545 #endif 546 break; 547 548 /* 549 * The following two traps can happen in 550 * vm86 mode, and, if so, we want to handle 551 * them specially. 552 */ 553 case T_PROTFLT: /* general protection fault */ 554 case T_STKFLT: /* stack fault */ 555 if (frame->tf_eflags & PSL_VM) { 556 i = vm86_emulate((struct vm86frame *)frame); 557 if (i != 0) 558 /* 559 * returns to original process 560 */ 561 vm86_trap((struct vm86frame *)frame); 562 goto out; 563 } 564 if (type == T_STKFLT) 565 break; 566 567 /* FALL THROUGH */ 568 569 case T_SEGNPFLT: /* segment not present fault */ 570 if (PCPU_GET(curpcb)->pcb_flags & PCB_VM86CALL) 571 break; 572 573 /* 574 * Invalid %fs's and %gs's can be created using 575 * procfs or PT_SETREGS or by invalidating the 576 * underlying LDT entry. This causes a fault 577 * in kernel mode when the kernel attempts to 578 * switch contexts. Lose the bad context 579 * (XXX) so that we can continue, and generate 580 * a signal. 581 */ 582 if (frame->tf_eip == (int)cpu_switch_load_gs) { 583 PCPU_GET(curpcb)->pcb_gs = 0; 584 #if 0 585 PROC_LOCK(p); 586 psignal(p, SIGBUS); 587 PROC_UNLOCK(p); 588 #endif 589 goto out; 590 } 591 592 if (td->td_intr_nesting_level != 0) 593 break; 594 595 /* 596 * Invalid segment selectors and out of bounds 597 * %eip's and %esp's can be set up in user mode. 598 * This causes a fault in kernel mode when the 599 * kernel tries to return to user mode. We want 600 * to get this fault so that we can fix the 601 * problem here and not have to check all the 602 * selectors and pointers when the user changes 603 * them. 604 */ 605 if (frame->tf_eip == (int)doreti_iret) { 606 frame->tf_eip = (int)doreti_iret_fault; 607 goto out; 608 } 609 if (frame->tf_eip == (int)doreti_popl_ds) { 610 frame->tf_eip = (int)doreti_popl_ds_fault; 611 goto out; 612 } 613 if (frame->tf_eip == (int)doreti_popl_es) { 614 frame->tf_eip = (int)doreti_popl_es_fault; 615 goto out; 616 } 617 if (frame->tf_eip == (int)doreti_popl_fs) { 618 frame->tf_eip = (int)doreti_popl_fs_fault; 619 goto out; 620 } 621 if (PCPU_GET(curpcb)->pcb_onfault != NULL) { 622 frame->tf_eip = 623 (int)PCPU_GET(curpcb)->pcb_onfault; 624 goto out; 625 } 626 break; 627 628 case T_TSSFLT: 629 /* 630 * PSL_NT can be set in user mode and isn't cleared 631 * automatically when the kernel is entered. This 632 * causes a TSS fault when the kernel attempts to 633 * `iret' because the TSS link is uninitialized. We 634 * want to get this fault so that we can fix the 635 * problem here and not every time the kernel is 636 * entered. 637 */ 638 if (frame->tf_eflags & PSL_NT) { 639 frame->tf_eflags &= ~PSL_NT; 640 goto out; 641 } 642 break; 643 644 case T_TRCTRAP: /* trace trap */ 645 if (frame->tf_eip == (int)IDTVEC(lcall_syscall)) { 646 /* 647 * We've just entered system mode via the 648 * syscall lcall. Continue single stepping 649 * silently until the syscall handler has 650 * saved the flags. 651 */ 652 goto out; 653 } 654 if (frame->tf_eip == (int)IDTVEC(lcall_syscall) + 1) { 655 /* 656 * The syscall handler has now saved the 657 * flags. Stop single stepping it. 658 */ 659 frame->tf_eflags &= ~PSL_T; 660 goto out; 661 } 662 /* 663 * Ignore debug register trace traps due to 664 * accesses in the user's address space, which 665 * can happen under several conditions such as 666 * if a user sets a watchpoint on a buffer and 667 * then passes that buffer to a system call. 668 * We still want to get TRCTRAPS for addresses 669 * in kernel space because that is useful when 670 * debugging the kernel. 671 */ 672 if (user_dbreg_trap() && 673 !(PCPU_GET(curpcb)->pcb_flags & PCB_VM86CALL)) { 674 /* 675 * Reset breakpoint bits because the 676 * processor doesn't 677 */ 678 load_dr6(rdr6() & 0xfffffff0); 679 goto out; 680 } 681 /* 682 * FALLTHROUGH (TRCTRAP kernel mode, kernel address) 683 */ 684 case T_BPTFLT: 685 /* 686 * If KDB is enabled, let it handle the debugger trap. 687 * Otherwise, debugger traps "can't happen". 688 */ 689 #ifdef KDB 690 if (kdb_trap(type, 0, frame)) 691 goto out; 692 #endif 693 break; 694 695 #ifdef DEV_ISA 696 case T_NMI: 697 #ifdef POWERFAIL_NMI 698 if (time_second - lastalert > 10) { 699 log(LOG_WARNING, "NMI: power fail\n"); 700 sysbeep(880, hz); 701 lastalert = time_second; 702 } 703 goto out; 704 #else /* !POWERFAIL_NMI */ 705 /* machine/parity/power fail/"kitchen sink" faults */ 706 if (isa_nmi(code) == 0) { 707 #ifdef KDB 708 /* 709 * NMI can be hooked up to a pushbutton 710 * for debugging. 711 */ 712 if (kdb_on_nmi) { 713 printf ("NMI ... going to debugger\n"); 714 kdb_trap(type, 0, frame); 715 } 716 #endif /* KDB */ 717 goto out; 718 } else if (panic_on_nmi == 0) 719 goto out; 720 /* FALLTHROUGH */ 721 #endif /* POWERFAIL_NMI */ 722 #endif /* DEV_ISA */ 723 } 724 725 trap_fatal(frame, eva); 726 goto out; 727 } 728 729 /* Translate fault for emulators (e.g. Linux) */ 730 if (*p->p_sysent->sv_transtrap) 731 i = (*p->p_sysent->sv_transtrap)(i, type); 732 733 ksiginfo_init_trap(&ksi); 734 ksi.ksi_signo = i; 735 ksi.ksi_code = ucode; 736 ksi.ksi_addr = (void *)addr; 737 ksi.ksi_trapno = type; 738 trapsignal(td, &ksi); 739 740 #ifdef DEBUG 741 if (type <= MAX_TRAP_MSG) { 742 uprintf("fatal process exception: %s", 743 trap_msg[type]); 744 if ((type == T_PAGEFLT) || (type == T_PROTFLT)) 745 uprintf(", fault VA = 0x%lx", (u_long)eva); 746 uprintf("\n"); 747 } 748 #endif 749 750 user: 751 userret(td, frame); 752 mtx_assert(&Giant, MA_NOTOWNED); 753 userout: 754 out: 755 return; 756 } 757 758 static int 759 trap_pfault(frame, usermode, eva) 760 struct trapframe *frame; 761 int usermode; 762 vm_offset_t eva; 763 { 764 vm_offset_t va; 765 struct vmspace *vm = NULL; 766 vm_map_t map; 767 int rv = 0; 768 vm_prot_t ftype; 769 struct thread *td = curthread; 770 struct proc *p = td->td_proc; 771 772 va = trunc_page(eva); 773 if (va >= KERNBASE) { 774 /* 775 * Don't allow user-mode faults in kernel address space. 776 * An exception: if the faulting address is the invalid 777 * instruction entry in the IDT, then the Intel Pentium 778 * F00F bug workaround was triggered, and we need to 779 * treat it is as an illegal instruction, and not a page 780 * fault. 781 */ 782 #if defined(I586_CPU) && !defined(NO_F00F_HACK) 783 if ((eva == (unsigned int)&idt[6]) && has_f00f_bug) 784 return -2; 785 #endif 786 if (usermode) 787 goto nogo; 788 789 map = kernel_map; 790 } else { 791 /* 792 * This is a fault on non-kernel virtual memory. 793 * vm is initialized above to NULL. If curproc is NULL 794 * or curproc->p_vmspace is NULL the fault is fatal. 795 */ 796 if (p != NULL) 797 vm = p->p_vmspace; 798 799 if (vm == NULL) 800 goto nogo; 801 802 map = &vm->vm_map; 803 } 804 805 /* 806 * PGEX_I is defined only if the execute disable bit capability is 807 * supported and enabled. 808 */ 809 if (frame->tf_err & PGEX_W) 810 ftype = VM_PROT_WRITE; 811 #ifdef PAE 812 else if ((frame->tf_err & PGEX_I) && pg_nx != 0) 813 ftype = VM_PROT_EXECUTE; 814 #endif 815 else 816 ftype = VM_PROT_READ; 817 818 if (map != kernel_map) { 819 /* 820 * Keep swapout from messing with us during this 821 * critical time. 822 */ 823 PROC_LOCK(p); 824 ++p->p_lock; 825 PROC_UNLOCK(p); 826 827 /* Fault in the user page: */ 828 rv = vm_fault(map, va, ftype, 829 (ftype & VM_PROT_WRITE) ? VM_FAULT_DIRTY 830 : VM_FAULT_NORMAL); 831 832 PROC_LOCK(p); 833 --p->p_lock; 834 PROC_UNLOCK(p); 835 } else { 836 /* 837 * Don't have to worry about process locking or stacks in the 838 * kernel. 839 */ 840 rv = vm_fault(map, va, ftype, VM_FAULT_NORMAL); 841 } 842 if (rv == KERN_SUCCESS) 843 return (0); 844 nogo: 845 if (!usermode) { 846 if (td->td_intr_nesting_level == 0 && 847 PCPU_GET(curpcb)->pcb_onfault != NULL) { 848 frame->tf_eip = (int)PCPU_GET(curpcb)->pcb_onfault; 849 return (0); 850 } 851 trap_fatal(frame, eva); 852 return (-1); 853 } 854 855 return((rv == KERN_PROTECTION_FAILURE) ? SIGBUS : SIGSEGV); 856 } 857 858 static void 859 trap_fatal(frame, eva) 860 struct trapframe *frame; 861 vm_offset_t eva; 862 { 863 int code, ss, esp; 864 u_int type; 865 struct soft_segment_descriptor softseg; 866 char *msg; 867 868 code = frame->tf_err; 869 type = frame->tf_trapno; 870 sdtossd(&gdt[IDXSEL(frame->tf_cs & 0xffff)].sd, &softseg); 871 872 if (type <= MAX_TRAP_MSG) 873 msg = trap_msg[type]; 874 else 875 msg = "UNKNOWN"; 876 printf("\n\nFatal trap %d: %s while in %s mode\n", type, msg, 877 frame->tf_eflags & PSL_VM ? "vm86" : 878 ISPL(frame->tf_cs) == SEL_UPL ? "user" : "kernel"); 879 #ifdef SMP 880 /* two separate prints in case of a trap on an unmapped page */ 881 printf("cpuid = %d; ", PCPU_GET(cpuid)); 882 printf("apic id = %02x\n", PCPU_GET(apic_id)); 883 #endif 884 if (type == T_PAGEFLT) { 885 printf("fault virtual address = 0x%x\n", eva); 886 printf("fault code = %s %s, %s\n", 887 code & PGEX_U ? "user" : "supervisor", 888 code & PGEX_W ? "write" : "read", 889 code & PGEX_P ? "protection violation" : "page not present"); 890 } 891 printf("instruction pointer = 0x%x:0x%x\n", 892 frame->tf_cs & 0xffff, frame->tf_eip); 893 if ((ISPL(frame->tf_cs) == SEL_UPL) || (frame->tf_eflags & PSL_VM)) { 894 ss = frame->tf_ss & 0xffff; 895 esp = frame->tf_esp; 896 } else { 897 ss = GSEL(GDATA_SEL, SEL_KPL); 898 esp = (int)&frame->tf_esp; 899 } 900 printf("stack pointer = 0x%x:0x%x\n", ss, esp); 901 printf("frame pointer = 0x%x:0x%x\n", ss, frame->tf_ebp); 902 printf("code segment = base 0x%x, limit 0x%x, type 0x%x\n", 903 softseg.ssd_base, softseg.ssd_limit, softseg.ssd_type); 904 printf(" = DPL %d, pres %d, def32 %d, gran %d\n", 905 softseg.ssd_dpl, softseg.ssd_p, softseg.ssd_def32, 906 softseg.ssd_gran); 907 printf("processor eflags = "); 908 if (frame->tf_eflags & PSL_T) 909 printf("trace trap, "); 910 if (frame->tf_eflags & PSL_I) 911 printf("interrupt enabled, "); 912 if (frame->tf_eflags & PSL_NT) 913 printf("nested task, "); 914 if (frame->tf_eflags & PSL_RF) 915 printf("resume, "); 916 if (frame->tf_eflags & PSL_VM) 917 printf("vm86, "); 918 printf("IOPL = %d\n", (frame->tf_eflags & PSL_IOPL) >> 12); 919 printf("current process = "); 920 if (curproc) { 921 printf("%lu (%s)\n", (u_long)curproc->p_pid, curthread->td_name); 922 } else { 923 printf("Idle\n"); 924 } 925 926 #ifdef KDB 927 if (debugger_on_panic || kdb_active) { 928 frame->tf_err = eva; /* smuggle fault address to ddb */ 929 if (kdb_trap(type, 0, frame)) { 930 frame->tf_err = code; /* restore error code */ 931 return; 932 } 933 frame->tf_err = code; /* restore error code */ 934 } 935 #endif 936 printf("trap number = %d\n", type); 937 if (type <= MAX_TRAP_MSG) 938 panic("%s", trap_msg[type]); 939 else 940 panic("unknown/reserved trap"); 941 } 942 943 /* 944 * Double fault handler. Called when a fault occurs while writing 945 * a frame for a trap/exception onto the stack. This usually occurs 946 * when the stack overflows (such is the case with infinite recursion, 947 * for example). 948 * 949 * XXX Note that the current PTD gets replaced by IdlePTD when the 950 * task switch occurs. This means that the stack that was active at 951 * the time of the double fault is not available at <kstack> unless 952 * the machine was idle when the double fault occurred. The downside 953 * of this is that "trace <ebp>" in ddb won't work. 954 */ 955 void 956 dblfault_handler() 957 { 958 #ifdef KDTRACE_HOOKS 959 if (dtrace_doubletrap_func != NULL) 960 (*dtrace_doubletrap_func)(); 961 #endif 962 printf("\nFatal double fault:\n"); 963 printf("eip = 0x%x\n", PCPU_GET(common_tss.tss_eip)); 964 printf("esp = 0x%x\n", PCPU_GET(common_tss.tss_esp)); 965 printf("ebp = 0x%x\n", PCPU_GET(common_tss.tss_ebp)); 966 #ifdef SMP 967 /* two separate prints in case of a trap on an unmapped page */ 968 printf("cpuid = %d; ", PCPU_GET(cpuid)); 969 printf("apic id = %02x\n", PCPU_GET(apic_id)); 970 #endif 971 panic("double fault"); 972 } 973 974 struct syscall_args { 975 u_int code; 976 struct sysent *callp; 977 int args[8]; 978 register_t *argp; 979 int narg; 980 }; 981 982 static int 983 fetch_syscall_args(struct thread *td, struct syscall_args *sa) 984 { 985 struct proc *p; 986 struct trapframe *frame; 987 caddr_t params; 988 int error; 989 990 p = td->td_proc; 991 frame = td->td_frame; 992 993 params = (caddr_t)frame->tf_esp + sizeof(int); 994 sa->code = frame->tf_eax; 995 996 if (p->p_sysent->sv_prepsyscall) { 997 (*p->p_sysent->sv_prepsyscall)(frame, sa->args, &sa->code, 998 ¶ms); 999 } else { 1000 /* 1001 * Need to check if this is a 32 bit or 64 bit syscall. 1002 */ 1003 if (sa->code == SYS_syscall) { 1004 /* 1005 * Code is first argument, followed by actual args. 1006 */ 1007 sa->code = fuword(params); 1008 params += sizeof(int); 1009 } else if (sa->code == SYS___syscall) { 1010 /* 1011 * Like syscall, but code is a quad, so as to maintain 1012 * quad alignment for the rest of the arguments. 1013 */ 1014 sa->code = fuword(params); 1015 params += sizeof(quad_t); 1016 } 1017 } 1018 1019 if (p->p_sysent->sv_mask) 1020 sa->code &= p->p_sysent->sv_mask; 1021 if (sa->code >= p->p_sysent->sv_size) 1022 sa->callp = &p->p_sysent->sv_table[0]; 1023 else 1024 sa->callp = &p->p_sysent->sv_table[sa->code]; 1025 sa->narg = sa->callp->sy_narg; 1026 1027 if (params != NULL && sa->narg != 0) 1028 error = copyin(params, (caddr_t)sa->args, 1029 (u_int)(sa->narg * sizeof(int))); 1030 else 1031 error = 0; 1032 1033 #ifdef KTRACE 1034 if (KTRPOINT(td, KTR_SYSCALL)) 1035 ktrsyscall(sa->code, sa->narg, sa->args); 1036 #endif 1037 return (error); 1038 } 1039 1040 /* 1041 * syscall - system call request C handler 1042 * 1043 * A system call is essentially treated as a trap. 1044 */ 1045 void 1046 syscall(struct trapframe *frame) 1047 { 1048 struct thread *td; 1049 struct proc *p; 1050 struct syscall_args sa; 1051 register_t orig_tf_eflags; 1052 int error; 1053 ksiginfo_t ksi; 1054 1055 PCPU_INC(cnt.v_syscall); 1056 td = curthread; 1057 p = td->td_proc; 1058 td->td_syscalls++; 1059 1060 #ifdef DIAGNOSTIC 1061 if (ISPL(frame->tf_cs) != SEL_UPL) { 1062 panic("syscall"); 1063 /* NOT REACHED */ 1064 } 1065 #endif 1066 1067 td->td_pticks = 0; 1068 td->td_frame = frame; 1069 if (td->td_ucred != p->p_ucred) 1070 cred_update_thread(td); 1071 orig_tf_eflags = frame->tf_eflags; 1072 if (p->p_flag & P_TRACED) { 1073 PROC_LOCK(p); 1074 td->td_dbgflags &= ~TDB_USERWR; 1075 PROC_UNLOCK(p); 1076 } 1077 error = fetch_syscall_args(td, &sa); 1078 1079 CTR4(KTR_SYSC, "syscall enter thread %p pid %d proc %s code %d", td, 1080 td->td_proc->p_pid, td->td_name, sa.code); 1081 1082 if (error == 0) { 1083 td->td_retval[0] = 0; 1084 td->td_retval[1] = frame->tf_edx; 1085 1086 STOPEVENT(p, S_SCE, sa.narg); 1087 PTRACESTOP_SC(p, td, S_PT_SCE); 1088 if (td->td_dbgflags & TDB_USERWR) { 1089 /* 1090 * Reread syscall number and arguments if 1091 * debugger modified registers or memory. 1092 */ 1093 error = fetch_syscall_args(td, &sa); 1094 if (error != 0) 1095 goto retval; 1096 td->td_retval[1] = frame->tf_edx; 1097 } 1098 1099 #ifdef KDTRACE_HOOKS 1100 /* 1101 * If the systrace module has registered it's probe 1102 * callback and if there is a probe active for the 1103 * syscall 'entry', process the probe. 1104 */ 1105 if (systrace_probe_func != NULL && sa.callp->sy_entry != 0) 1106 (*systrace_probe_func)(sa.callp->sy_entry, sa.code, 1107 sa.callp, sa.args); 1108 #endif 1109 1110 AUDIT_SYSCALL_ENTER(sa.code, td); 1111 error = (*sa.callp->sy_call)(td, sa.args); 1112 AUDIT_SYSCALL_EXIT(error, td); 1113 1114 /* Save the latest error return value. */ 1115 td->td_errno = error; 1116 1117 #ifdef KDTRACE_HOOKS 1118 /* 1119 * If the systrace module has registered it's probe 1120 * callback and if there is a probe active for the 1121 * syscall 'return', process the probe. 1122 */ 1123 if (systrace_probe_func != NULL && sa.callp->sy_return != 0) 1124 (*systrace_probe_func)(sa.callp->sy_return, sa.code, 1125 sa.callp, sa.args); 1126 #endif 1127 } 1128 retval: 1129 cpu_set_syscall_retval(td, error); 1130 1131 /* 1132 * Traced syscall. 1133 */ 1134 if ((orig_tf_eflags & PSL_T) && !(orig_tf_eflags & PSL_VM)) { 1135 frame->tf_eflags &= ~PSL_T; 1136 ksiginfo_init_trap(&ksi); 1137 ksi.ksi_signo = SIGTRAP; 1138 ksi.ksi_code = TRAP_TRACE; 1139 ksi.ksi_addr = (void *)frame->tf_eip; 1140 trapsignal(td, &ksi); 1141 } 1142 1143 /* 1144 * Check for misbehavior. 1145 */ 1146 WITNESS_WARN(WARN_PANIC, NULL, "System call %s returning", 1147 (sa.code >= 0 && sa.code < SYS_MAXSYSCALL) ? 1148 syscallnames[sa.code] : "???"); 1149 KASSERT(td->td_critnest == 0, 1150 ("System call %s returning in a critical section", 1151 (sa.code >= 0 && sa.code < SYS_MAXSYSCALL) ? 1152 syscallnames[sa.code] : "???")); 1153 KASSERT(td->td_locks == 0, 1154 ("System call %s returning with %d locks held", 1155 (sa.code >= 0 && sa.code < SYS_MAXSYSCALL) ? 1156 syscallnames[sa.code] : "???", td->td_locks)); 1157 1158 /* 1159 * Handle reschedule and other end-of-syscall issues 1160 */ 1161 userret(td, frame); 1162 1163 CTR4(KTR_SYSC, "syscall exit thread %p pid %d proc %s code %d", td, 1164 td->td_proc->p_pid, td->td_name, sa.code); 1165 1166 #ifdef KTRACE 1167 if (KTRPOINT(td, KTR_SYSRET)) 1168 ktrsysret(sa.code, error, td->td_retval[0]); 1169 #endif 1170 1171 /* 1172 * This works because errno is findable through the 1173 * register set. If we ever support an emulation where this 1174 * is not the case, this code will need to be revisited. 1175 */ 1176 STOPEVENT(p, S_SCX, sa.code); 1177 1178 PTRACESTOP_SC(p, td, S_PT_SCX); 1179 } 1180
Cache object: 9b6068441e88463828be431a0ec4793a
[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]