1 /* 2 * CDDL HEADER START 3 * 4 * The contents of this file are subject to the terms of the 5 * Common Development and Distribution License, Version 1.0 only 6 * (the "License"). You may not use this file except in compliance 7 * with the License. 8 * 9 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 10 * or http://www.opensolaris.org/os/licensing. 11 * See the License for the specific language governing permissions 12 * and limitations under the License. 13 * 14 * When distributing Covered Code, include this CDDL HEADER in each 15 * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 16 * If applicable, add the following below this CDDL HEADER, with the 17 * fields enclosed by brackets "[]" replaced with your own identifying 18 * information: Portions Copyright [yyyy] [name of copyright owner] 19 * 20 * CDDL HEADER END 21 */ 22 23 /* 24 * Copyright 2006 Sun Microsystems, Inc. All rights reserved. 25 * Use is subject to license terms. 26 */ 27 28 /* Copyright (c) 1990, 1991 UNIX System Laboratories, Inc. */ 29 /* Copyright (c) 1984, 1986, 1987, 1988, 1989, 1990 AT&T */ 30 /* All Rights Reserved */ 31 /* */ 32 /* Copyright (c) 1987, 1988 Microsoft Corporation */ 33 /* All Rights Reserved */ 34 /* */ 35 36 #pragma ident "%Z%%M% %I% %E% SMI" 37 38 #include <sys/types.h> 39 #include <sys/sysmacros.h> 40 #include <sys/param.h> 41 #include <sys/signal.h> 42 #include <sys/systm.h> 43 #include <sys/user.h> 44 #include <sys/proc.h> 45 #include <sys/disp.h> 46 #include <sys/class.h> 47 #include <sys/core.h> 48 #include <sys/syscall.h> 49 #include <sys/cpuvar.h> 50 #include <sys/vm.h> 51 #include <sys/sysinfo.h> 52 #include <sys/fault.h> 53 #include <sys/stack.h> 54 #include <sys/mmu.h> 55 #include <sys/psw.h> 56 #include <sys/regset.h> 57 #include <sys/fp.h> 58 #include <sys/trap.h> 59 #include <sys/kmem.h> 60 #include <sys/vtrace.h> 61 #include <sys/cmn_err.h> 62 #include <sys/prsystm.h> 63 #include <sys/mutex_impl.h> 64 #include <sys/machsystm.h> 65 #include <sys/archsystm.h> 66 #include <sys/sdt.h> 67 #include <sys/avintr.h> 68 #include <sys/kobj.h> 69 70 #include <vm/hat.h> 71 72 #include <vm/seg_kmem.h> 73 #include <vm/as.h> 74 #include <vm/seg.h> 75 #include <vm/hat_pte.h> 76 77 #include <sys/procfs.h> 78 79 #include <sys/reboot.h> 80 #include <sys/debug.h> 81 #include <sys/debugreg.h> 82 #include <sys/modctl.h> 83 #include <sys/aio_impl.h> 84 #include <sys/tnf.h> 85 #include <sys/tnf_probe.h> 86 #include <sys/cred.h> 87 #include <sys/mman.h> 88 #include <sys/x86_archext.h> 89 #include <sys/copyops.h> 90 #include <c2/audit.h> 91 #include <sys/ftrace.h> 92 #include <sys/panic.h> 93 #include <sys/traptrace.h> 94 #include <sys/ontrap.h> 95 #include <sys/cpc_impl.h> 96 97 #define USER 0x10000 /* user-mode flag added to trap type */ 98 99 static const char *trap_type_mnemonic[] = { 100 "de", "db", "2", "bp", 101 "of", "br", "ud", "nm", 102 "df", "9", "ts", "np", 103 "ss", "gp", "pf", "15", 104 "mf", "ac", "mc", "xf" 105 }; 106 107 static const char *trap_type[] = { 108 "Divide error", /* trap id 0 */ 109 "Debug", /* trap id 1 */ 110 "NMI interrupt", /* trap id 2 */ 111 "Breakpoint", /* trap id 3 */ 112 "Overflow", /* trap id 4 */ 113 "BOUND range exceeded", /* trap id 5 */ 114 "Invalid opcode", /* trap id 6 */ 115 "Device not available", /* trap id 7 */ 116 "Double fault", /* trap id 8 */ 117 "Coprocessor segment overrun", /* trap id 9 */ 118 "Invalid TSS", /* trap id 10 */ 119 "Segment not present", /* trap id 11 */ 120 "Stack segment fault", /* trap id 12 */ 121 "General protection", /* trap id 13 */ 122 "Page fault", /* trap id 14 */ 123 "Reserved", /* trap id 15 */ 124 "x87 floating point error", /* trap id 16 */ 125 "Alignment check", /* trap id 17 */ 126 "Machine check", /* trap id 18 */ 127 "SIMD floating point exception", /* trap id 19 */ 128 }; 129 130 #define TRAP_TYPES (sizeof (trap_type) / sizeof (trap_type[0])) 131 132 int tudebug = 0; 133 int tudebugbpt = 0; 134 int tudebugfpe = 0; 135 int tudebugsse = 0; 136 137 #if defined(TRAPDEBUG) || defined(lint) 138 int tdebug = 0; 139 int lodebug = 0; 140 int faultdebug = 0; 141 #else 142 #define tdebug 0 143 #define lodebug 0 144 #define faultdebug 0 145 #endif /* defined(TRAPDEBUG) || defined(lint) */ 146 147 #if defined(TRAPTRACE) 148 static void dump_ttrace(void); 149 #endif /* TRAPTRACE */ 150 static void dumpregs(struct regs *); 151 static void showregs(uint_t, struct regs *, caddr_t); 152 static void dump_tss(void); 153 static int kern_gpfault(struct regs *); 154 155 struct trap_info { 156 struct regs *trap_regs; 157 uint_t trap_type; 158 caddr_t trap_addr; 159 }; 160 161 /*ARGSUSED*/ 162 static int 163 die(uint_t type, struct regs *rp, caddr_t addr, processorid_t cpuid) 164 { 165 struct trap_info ti; 166 const char *trap_name, *trap_mnemonic; 167 168 if (type < TRAP_TYPES) { 169 trap_name = trap_type[type]; 170 trap_mnemonic = trap_type_mnemonic[type]; 171 } else { 172 trap_name = "trap"; 173 trap_mnemonic = "-"; 174 } 175 176 #ifdef TRAPTRACE 177 TRAPTRACE_FREEZE; 178 #endif 179 180 ti.trap_regs = rp; 181 ti.trap_type = type & ~USER; 182 ti.trap_addr = addr; 183 184 curthread->t_panic_trap = &ti; 185 186 if (type == T_PGFLT && addr < (caddr_t)KERNELBASE) { 187 panic("BAD TRAP: type=%x (#%s %s) rp=%p addr=%p " 188 "occurred in module \"%s\" due to %s", 189 type, trap_mnemonic, trap_name, (void *)rp, (void *)addr, 190 mod_containing_pc((caddr_t)rp->r_pc), 191 addr < (caddr_t)PAGESIZE ? 192 "a NULL pointer dereference" : 193 "an illegal access to a user address"); 194 } else 195 panic("BAD TRAP: type=%x (#%s %s) rp=%p addr=%p", 196 type, trap_mnemonic, trap_name, (void *)rp, (void *)addr); 197 return (0); 198 } 199 200 /* 201 * Rewrite the instruction at pc to be an int $T_SYSCALLINT instruction. 202 * 203 * int <vector> is two bytes: 0xCD <vector> 204 */ 205 206 #define SLOW_SCALL_SIZE 2 207 208 static int 209 rewrite_syscall(caddr_t pc) 210 { 211 uchar_t instr[SLOW_SCALL_SIZE] = { 0xCD, T_SYSCALLINT }; 212 213 if (uwrite(curthread->t_procp, instr, SLOW_SCALL_SIZE, 214 (uintptr_t)pc) != 0) 215 return (1); 216 217 return (0); 218 } 219 220 /* 221 * Test to see if the instruction at pc is sysenter or syscall. The second 222 * argument should be the x86 feature flag corresponding to the expected 223 * instruction. 224 * 225 * sysenter is two bytes: 0x0F 0x34 226 * syscall is two bytes: 0x0F 0x05 227 */ 228 229 #define FAST_SCALL_SIZE 2 230 231 static int 232 instr_is_fast_syscall(caddr_t pc, int which) 233 { 234 uchar_t instr[FAST_SCALL_SIZE]; 235 236 ASSERT(which == X86_SEP || which == X86_ASYSC); 237 238 if (copyin_nowatch(pc, (caddr_t)instr, FAST_SCALL_SIZE) != 0 || 239 instr[0] != 0x0F) 240 return (0); 241 242 if ((which == X86_SEP && instr[1] == 0x34) || 243 (which == X86_ASYSC && instr[1] == 0x05)) 244 return (1); 245 246 return (0); 247 } 248 249 /* 250 * Test to see if the instruction at pc is a system call instruction. 251 * 252 * The bytes of an lcall instruction used for the syscall trap. 253 * static uchar_t lcall[7] = { 0x9a, 0, 0, 0, 0, 0x7, 0 }; 254 * static uchar_t lcallalt[7] = { 0x9a, 0, 0, 0, 0, 0x27, 0 }; 255 */ 256 257 #define LCALLSIZE 7 258 259 static int 260 instr_is_syscall(caddr_t pc) 261 { 262 uchar_t instr[LCALLSIZE]; 263 264 if (copyin_nowatch(pc, (caddr_t)instr, LCALLSIZE) == 0 && 265 instr[0] == 0x9a && 266 instr[1] == 0 && 267 instr[2] == 0 && 268 instr[3] == 0 && 269 instr[4] == 0 && 270 (instr[5] == 0x7 || instr[5] == 0x27) && 271 instr[6] == 0) 272 return (1); 273 274 return (0); 275 } 276 277 #ifdef __amd64 278 279 /* 280 * In the first revisions of AMD64 CPUs produced by AMD, the LAHF and 281 * SAHF instructions were not implemented in 64bit mode. Later revisions 282 * did implement these instructions. An extension to the cpuid instruction 283 * was added to check for the capability of executing these instructions 284 * in 64bit mode. 285 * 286 * Intel originally did not implement these instructions in EM64T either, 287 * but added them in later revisions. 288 * 289 * So, there are different chip revisions by both vendors out there that 290 * may or may not implement these instructions. The easy solution is to 291 * just always emulate these instructions on demand. 292 * 293 * SAHF == store %ah in the lower 8 bits of %rflags (opcode 0x9e) 294 * LAHF == load the lower 8 bits of %rflags into %ah (opcode 0x9f) 295 */ 296 297 #define LSAHFSIZE 1 298 299 static int 300 instr_is_lsahf(caddr_t pc, uchar_t *instr) 301 { 302 if (copyin_nowatch(pc, (caddr_t)instr, LSAHFSIZE) == 0 && 303 (*instr == 0x9e || *instr == 0x9f)) 304 return (1); 305 return (0); 306 } 307 308 /* 309 * Emulate the LAHF and SAHF instructions. The reference manuals define 310 * these instructions to always load/store bit 1 as a 1, and bits 3 and 5 311 * as a 0. The other, defined, bits are copied (the PS_ICC bits and PS_P). 312 * 313 * Note that %ah is bits 8-15 of %rax. 314 */ 315 static void 316 emulate_lsahf(struct regs *rp, uchar_t instr) 317 { 318 if (instr == 0x9e) { 319 /* sahf. Copy bits from %ah to flags. */ 320 rp->r_ps = (rp->r_ps & ~0xff) | 321 ((rp->r_rax >> 8) & PSL_LSAHFMASK) | PS_MB1; 322 } else { 323 /* lahf. Copy bits from flags to %ah. */ 324 rp->r_rax = (rp->r_rax & ~0xff00) | 325 (((rp->r_ps & PSL_LSAHFMASK) | PS_MB1) << 8); 326 } 327 rp->r_pc += LSAHFSIZE; 328 } 329 #endif /* __amd64 */ 330 331 #ifdef OPTERON_ERRATUM_91 332 333 /* 334 * Test to see if the instruction at pc is a prefetch instruction. 335 * 336 * The first byte of prefetch instructions is always 0x0F. 337 * The second byte is 0x18 for regular prefetch or 0x0D for AMD 3dnow prefetch. 338 * The third byte is between 0 and 3 inclusive. 339 */ 340 341 #define PREFETCHSIZE 3 342 343 static int 344 cmp_to_prefetch(uchar_t *p) 345 { 346 if (*p == 0x0F && (*(p+1) == 0x18 || *(p+1) == 0x0D) && *(p+2) <= 3) 347 return (1); 348 return (0); 349 } 350 351 static int 352 instr_is_prefetch(caddr_t pc) 353 { 354 uchar_t instr[PREFETCHSIZE]; 355 int error; 356 357 error = copyin_nowatch(pc, (caddr_t)instr, PREFETCHSIZE); 358 359 if (error == 0 && cmp_to_prefetch(instr)) 360 return (1); 361 return (0); 362 } 363 364 #endif /* OPTERON_ERRATUM_91 */ 365 366 /* 367 * Called from the trap handler when a processor trap occurs. 368 * 369 * Note: All user-level traps that might call stop() must exit 370 * trap() by 'goto out' or by falling through. 371 */ 372 void 373 trap(struct regs *rp, caddr_t addr, processorid_t cpuid) 374 { 375 kthread_t *cur_thread = curthread; 376 enum seg_rw rw; 377 unsigned type; 378 extern int stop_on_fault(uint_t, k_siginfo_t *); 379 proc_t *p = ttoproc(cur_thread); 380 klwp_t *lwp = ttolwp(cur_thread); 381 uintptr_t lofault; 382 faultcode_t pagefault(), res, errcode; 383 enum fault_type fault_type; 384 k_siginfo_t siginfo; 385 uint_t fault = 0; 386 int mstate; 387 int sicode = 0; 388 int watchcode; 389 int watchpage; 390 caddr_t vaddr; 391 size_t sz; 392 int ta; 393 #ifdef __amd64 394 uchar_t instr; 395 #endif 396 397 ASSERT_STACK_ALIGNED(); 398 399 type = rp->r_trapno; 400 CPU_STATS_ADDQ(CPU, sys, trap, 1); 401 402 ASSERT(cur_thread->t_schedflag & TS_DONT_SWAP); 403 404 if (type == T_PGFLT) { 405 406 errcode = rp->r_err; 407 if (errcode & PF_ERR_WRITE) 408 rw = S_WRITE; 409 else if ((caddr_t)rp->r_pc == addr || 410 (mmu.pt_nx != 0 && (errcode & PF_ERR_EXEC))) 411 rw = S_EXEC; 412 else 413 rw = S_READ; 414 415 #if defined(__i386) 416 /* 417 * Pentium Pro work-around 418 */ 419 if ((errcode & PF_ERR_PROT) && pentiumpro_bug4046376) { 420 uint_t attr; 421 uint_t priv_violation; 422 uint_t access_violation; 423 424 if (hat_getattr(addr < (caddr_t)kernelbase ? 425 curproc->p_as->a_hat : kas.a_hat, addr, &attr) 426 == -1) { 427 errcode &= ~PF_ERR_PROT; 428 } else { 429 priv_violation = (errcode & PF_ERR_USER) && 430 !(attr & PROT_USER); 431 access_violation = (errcode & PF_ERR_WRITE) && 432 !(attr & PROT_WRITE); 433 if (!priv_violation && !access_violation) 434 goto cleanup; 435 } 436 } 437 #endif /* __i386 */ 438 439 } 440 441 if (tdebug) 442 showregs(type, rp, addr); 443 444 if (USERMODE(rp->r_cs)) { 445 /* 446 * Set up the current cred to use during this trap. u_cred 447 * no longer exists. t_cred is used instead. 448 * The current process credential applies to the thread for 449 * the entire trap. If trapping from the kernel, this 450 * should already be set up. 451 */ 452 if (cur_thread->t_cred != p->p_cred) { 453 cred_t *oldcred = cur_thread->t_cred; 454 /* 455 * DTrace accesses t_cred in probe context. t_cred 456 * must always be either NULL, or point to a valid, 457 * allocated cred structure. 458 */ 459 cur_thread->t_cred = crgetcred(); 460 crfree(oldcred); 461 } 462 ASSERT(lwp != NULL); 463 type |= USER; 464 ASSERT(lwptoregs(lwp) == rp); 465 lwp->lwp_state = LWP_SYS; 466 467 switch (type) { 468 case T_PGFLT + USER: 469 if ((caddr_t)rp->r_pc == addr) 470 mstate = LMS_TFAULT; 471 else 472 mstate = LMS_DFAULT; 473 break; 474 default: 475 mstate = LMS_TRAP; 476 break; 477 } 478 /* Kernel probe */ 479 TNF_PROBE_1(thread_state, "thread", /* CSTYLED */, 480 tnf_microstate, state, mstate); 481 mstate = new_mstate(cur_thread, mstate); 482 483 bzero(&siginfo, sizeof (siginfo)); 484 } 485 486 switch (type) { 487 case T_PGFLT + USER: 488 case T_SGLSTP: 489 case T_SGLSTP + USER: 490 case T_BPTFLT + USER: 491 break; 492 493 default: 494 FTRACE_2("trap(): type=0x%lx, regs=0x%lx", 495 (ulong_t)type, (ulong_t)rp); 496 break; 497 } 498 499 switch (type) { 500 501 case T_MCE: /* Machine check exception */ 502 case T_MCE + USER: 503 if (x86_feature & X86_MCA) { 504 if (mca_exception(rp)) 505 (void) die(type, rp, addr, cpuid); 506 type &= ~USER; 507 goto cleanup; 508 } 509 default: 510 if (type & USER) { 511 if (tudebug) 512 showregs(type, rp, (caddr_t)0); 513 printf("trap: Unknown trap type %d in user mode\n", 514 type & ~USER); 515 siginfo.si_signo = SIGILL; 516 siginfo.si_code = ILL_ILLTRP; 517 siginfo.si_addr = (caddr_t)rp->r_pc; 518 siginfo.si_trapno = type & ~USER; 519 fault = FLTILL; 520 break; 521 } else { 522 (void) die(type, rp, addr, cpuid); 523 /*NOTREACHED*/ 524 } 525 526 case T_PGFLT: /* system page fault */ 527 /* 528 * If we're under on_trap() protection (see <sys/ontrap.h>), 529 * set ot_trap and longjmp back to the on_trap() call site. 530 */ 531 if ((cur_thread->t_ontrap != NULL) && 532 (cur_thread->t_ontrap->ot_prot & OT_DATA_ACCESS)) { 533 curthread->t_ontrap->ot_trap |= OT_DATA_ACCESS; 534 longjmp(&curthread->t_ontrap->ot_jmpbuf); 535 } 536 537 /* 538 * See if we can handle as pagefault. Save lofault 539 * across this. Here we assume that an address 540 * less than KERNELBASE is a user fault. 541 * We can do this as copy.s routines verify that the 542 * starting address is less than KERNELBASE before 543 * starting and because we know that we always have 544 * KERNELBASE mapped as invalid to serve as a "barrier". 545 */ 546 lofault = cur_thread->t_lofault; 547 cur_thread->t_lofault = 0; 548 549 mstate = new_mstate(cur_thread, LMS_KFAULT); 550 551 if (addr < (caddr_t)kernelbase) { 552 res = pagefault(addr, 553 (errcode & PF_ERR_PROT)? F_PROT: F_INVAL, rw, 0); 554 if (res == FC_NOMAP && 555 addr < p->p_usrstack && 556 grow(addr)) 557 res = 0; 558 } else { 559 res = pagefault(addr, 560 (errcode & PF_ERR_PROT)? F_PROT: F_INVAL, rw, 1); 561 } 562 (void) new_mstate(cur_thread, mstate); 563 564 /* 565 * Restore lofault. If we resolved the fault, exit. 566 * If we didn't and lofault wasn't set, die. 567 */ 568 cur_thread->t_lofault = lofault; 569 if (res == 0) 570 goto cleanup; 571 572 #if defined(OPTERON_ERRATUM_93) && defined(_LP64) 573 if (lofault == 0 && opteron_erratum_93) { 574 /* 575 * Workaround for Opteron Erratum 93. On return from 576 * a System Managment Interrupt at a HLT instruction 577 * the %rip might be truncated to a 32 bit value. 578 * BIOS is supposed to fix this, but some don't. 579 * If this occurs we simply restore the high order bits. 580 * The HLT instruction is 1 byte of 0xf4. 581 */ 582 uintptr_t rip = rp->r_pc; 583 584 if ((rip & 0xfffffffful) == rip) { 585 rip |= 0xfffffffful << 32; 586 if (hat_getpfnum(kas.a_hat, (caddr_t)rip) != 587 PFN_INVALID && 588 (*(uchar_t *)rip == 0xf4 || 589 *(uchar_t *)(rip - 1) == 0xf4)) { 590 rp->r_pc = rip; 591 goto cleanup; 592 } 593 } 594 } 595 #endif /* OPTERON_ERRATUM_93 && _LP64 */ 596 597 #ifdef OPTERON_ERRATUM_91 598 if (lofault == 0 && opteron_erratum_91) { 599 /* 600 * Workaround for Opteron Erratum 91. Prefetches may 601 * generate a page fault (they're not supposed to do 602 * that!). If this occurs we simply return back to the 603 * instruction. 604 */ 605 caddr_t pc = (caddr_t)rp->r_pc; 606 607 /* 608 * If the faulting PC is not mapped, this is a 609 * legitimate kernel page fault that must result in a 610 * panic. If the faulting PC is mapped, it could contain 611 * a prefetch instruction. Check for that here. 612 */ 613 if (hat_getpfnum(kas.a_hat, pc) != PFN_INVALID) { 614 if (cmp_to_prefetch((uchar_t *)pc)) { 615 #ifdef DEBUG 616 cmn_err(CE_WARN, "Opteron erratum 91 " 617 "occurred: kernel prefetch" 618 " at %p generated a page fault!", 619 (void *)rp->r_pc); 620 #endif /* DEBUG */ 621 goto cleanup; 622 } 623 } 624 (void) die(type, rp, addr, cpuid); 625 } 626 #endif /* OPTERON_ERRATUM_91 */ 627 628 if (lofault == 0) 629 (void) die(type, rp, addr, cpuid); 630 631 /* 632 * Cannot resolve fault. Return to lofault. 633 */ 634 if (lodebug) { 635 showregs(type, rp, addr); 636 traceregs(rp); 637 } 638 if (FC_CODE(res) == FC_OBJERR) 639 res = FC_ERRNO(res); 640 else 641 res = EFAULT; 642 rp->r_r0 = res; 643 rp->r_pc = cur_thread->t_lofault; 644 goto cleanup; 645 646 case T_PGFLT + USER: /* user page fault */ 647 if (faultdebug) { 648 char *fault_str; 649 650 switch (rw) { 651 case S_READ: 652 fault_str = "read"; 653 break; 654 case S_WRITE: 655 fault_str = "write"; 656 break; 657 case S_EXEC: 658 fault_str = "exec"; 659 break; 660 default: 661 fault_str = ""; 662 break; 663 } 664 printf("user %s fault: addr=0x%lx errcode=0x%x\n", 665 fault_str, (uintptr_t)addr, errcode); 666 } 667 668 #if defined(OPTERON_ERRATUM_100) && defined(_LP64) 669 /* 670 * Workaround for AMD erratum 100 671 * 672 * A 32-bit process may receive a page fault on a non 673 * 32-bit address by mistake. The range of the faulting 674 * address will be 675 * 676 * 0xffffffff80000000 .. 0xffffffffffffffff or 677 * 0x0000000100000000 .. 0x000000017fffffff 678 * 679 * The fault is always due to an instruction fetch, however 680 * the value of r_pc should be correct (in 32 bit range), 681 * so we ignore the page fault on the bogus address. 682 */ 683 if (p->p_model == DATAMODEL_ILP32 && 684 (0xffffffff80000000 <= (uintptr_t)addr || 685 (0x100000000 <= (uintptr_t)addr && 686 (uintptr_t)addr <= 0x17fffffff))) { 687 if (!opteron_erratum_100) 688 panic("unexpected erratum #100"); 689 if (rp->r_pc <= 0xffffffff) 690 goto out; 691 } 692 #endif /* OPTERON_ERRATUM_100 && _LP64 */ 693 694 ASSERT(!(curthread->t_flag & T_WATCHPT)); 695 watchpage = (pr_watch_active(p) && pr_is_watchpage(addr, rw)); 696 #ifdef __i386 697 /* 698 * In 32-bit mode, the lcall (system call) instruction fetches 699 * one word from the stack, at the stack pointer, because of the 700 * way the call gate is constructed. This is a bogus 701 * read and should not be counted as a read watchpoint. 702 * We work around the problem here by testing to see if 703 * this situation applies and, if so, simply jumping to 704 * the code in locore.s that fields the system call trap. 705 * The registers on the stack are already set up properly 706 * due to the match between the call gate sequence and the 707 * trap gate sequence. We just have to adjust the pc. 708 */ 709 if (watchpage && addr == (caddr_t)rp->r_sp && 710 rw == S_READ && instr_is_syscall((caddr_t)rp->r_pc)) { 711 extern void watch_syscall(void); 712 713 rp->r_pc += LCALLSIZE; 714 watch_syscall(); /* never returns */ 715 /* NOTREACHED */ 716 } 717 #endif /* __i386 */ 718 vaddr = addr; 719 if (!watchpage || (sz = instr_size(rp, &vaddr, rw)) <= 0) 720 fault_type = (errcode & PF_ERR_PROT)? F_PROT: F_INVAL; 721 else if ((watchcode = pr_is_watchpoint(&vaddr, &ta, 722 sz, NULL, rw)) != 0) { 723 if (ta) { 724 do_watch_step(vaddr, sz, rw, 725 watchcode, rp->r_pc); 726 fault_type = F_INVAL; 727 } else { 728 bzero(&siginfo, sizeof (siginfo)); 729 siginfo.si_signo = SIGTRAP; 730 siginfo.si_code = watchcode; 731 siginfo.si_addr = vaddr; 732 siginfo.si_trapafter = 0; 733 siginfo.si_pc = (caddr_t)rp->r_pc; 734 fault = FLTWATCH; 735 break; 736 } 737 } else { 738 /* XXX pr_watch_emul() never succeeds (for now) */ 739 if (rw != S_EXEC && pr_watch_emul(rp, vaddr, rw)) 740 goto out; 741 do_watch_step(vaddr, sz, rw, 0, 0); 742 fault_type = F_INVAL; 743 } 744 745 res = pagefault(addr, fault_type, rw, 0); 746 747 /* 748 * If pagefault() succeeded, ok. 749 * Otherwise attempt to grow the stack. 750 */ 751 if (res == 0 || 752 (res == FC_NOMAP && 753 addr < p->p_usrstack && 754 grow(addr))) { 755 lwp->lwp_lastfault = FLTPAGE; 756 lwp->lwp_lastfaddr = addr; 757 if (prismember(&p->p_fltmask, FLTPAGE)) { 758 bzero(&siginfo, sizeof (siginfo)); 759 siginfo.si_addr = addr; 760 (void) stop_on_fault(FLTPAGE, &siginfo); 761 } 762 goto out; 763 } else if (res == FC_PROT && addr < p->p_usrstack && 764 (mmu.pt_nx != 0 && (errcode & PF_ERR_EXEC))) { 765 report_stack_exec(p, addr); 766 } 767 768 #ifdef OPTERON_ERRATUM_91 769 /* 770 * Workaround for Opteron Erratum 91. Prefetches may generate a 771 * page fault (they're not supposed to do that!). If this 772 * occurs we simply return back to the instruction. 773 * 774 * We rely on copyin to properly fault in the page with r_pc. 775 */ 776 if (opteron_erratum_91 && 777 addr != (caddr_t)rp->r_pc && 778 instr_is_prefetch((caddr_t)rp->r_pc)) { 779 #ifdef DEBUG 780 cmn_err(CE_WARN, "Opteron erratum 91 occurred: " 781 "prefetch at %p in pid %d generated a trap!", 782 (void *)rp->r_pc, p->p_pid); 783 #endif /* DEBUG */ 784 goto out; 785 } 786 #endif /* OPTERON_ERRATUM_91 */ 787 788 if (tudebug) 789 showregs(type, rp, addr); 790 /* 791 * In the case where both pagefault and grow fail, 792 * set the code to the value provided by pagefault. 793 * We map all errors returned from pagefault() to SIGSEGV. 794 */ 795 bzero(&siginfo, sizeof (siginfo)); 796 siginfo.si_addr = addr; 797 switch (FC_CODE(res)) { 798 case FC_HWERR: 799 case FC_NOSUPPORT: 800 siginfo.si_signo = SIGBUS; 801 siginfo.si_code = BUS_ADRERR; 802 fault = FLTACCESS; 803 break; 804 case FC_ALIGN: 805 siginfo.si_signo = SIGBUS; 806 siginfo.si_code = BUS_ADRALN; 807 fault = FLTACCESS; 808 break; 809 case FC_OBJERR: 810 if ((siginfo.si_errno = FC_ERRNO(res)) != EINTR) { 811 siginfo.si_signo = SIGBUS; 812 siginfo.si_code = BUS_OBJERR; 813 fault = FLTACCESS; 814 } 815 break; 816 default: /* FC_NOMAP or FC_PROT */ 817 siginfo.si_signo = SIGSEGV; 818 siginfo.si_code = 819 (res == FC_NOMAP)? SEGV_MAPERR : SEGV_ACCERR; 820 fault = FLTBOUNDS; 821 break; 822 } 823 break; 824 825 case T_ILLINST + USER: /* invalid opcode fault */ 826 /* 827 * If the syscall instruction is disabled due to LDT usage, a 828 * user program that attempts to execute it will trigger a #ud 829 * trap. Check for that case here. If this occurs on a CPU which 830 * doesn't even support syscall, the result of all of this will 831 * be to emulate that particular instruction. 832 */ 833 if (p->p_ldt != NULL && 834 instr_is_fast_syscall((caddr_t)rp->r_pc, X86_ASYSC)) { 835 if (rewrite_syscall((caddr_t)rp->r_pc) == 0) 836 goto out; 837 #ifdef DEBUG 838 else 839 cmn_err(CE_WARN, "failed to rewrite syscall " 840 "instruction in process %d", 841 curthread->t_procp->p_pid); 842 #endif /* DEBUG */ 843 } 844 845 #ifdef __amd64 846 /* 847 * Emulate the LAHF and SAHF instructions if needed. 848 * See the instr_is_lsahf function for details. 849 */ 850 if (p->p_model == DATAMODEL_LP64 && 851 instr_is_lsahf((caddr_t)rp->r_pc, &instr)) { 852 emulate_lsahf(rp, instr); 853 goto out; 854 } 855 #endif 856 857 /*FALLTHROUGH*/ 858 859 if (tudebug) 860 showregs(type, rp, (caddr_t)0); 861 siginfo.si_signo = SIGILL; 862 siginfo.si_code = ILL_ILLOPC; 863 siginfo.si_addr = (caddr_t)rp->r_pc; 864 fault = FLTILL; 865 break; 866 867 case T_ZERODIV + USER: /* integer divide by zero */ 868 if (tudebug && tudebugfpe) 869 showregs(type, rp, (caddr_t)0); 870 siginfo.si_signo = SIGFPE; 871 siginfo.si_code = FPE_INTDIV; 872 siginfo.si_addr = (caddr_t)rp->r_pc; 873 fault = FLTIZDIV; 874 break; 875 876 case T_OVFLW + USER: /* integer overflow */ 877 if (tudebug && tudebugfpe) 878 showregs(type, rp, (caddr_t)0); 879 siginfo.si_signo = SIGFPE; 880 siginfo.si_code = FPE_INTOVF; 881 siginfo.si_addr = (caddr_t)rp->r_pc; 882 fault = FLTIOVF; 883 break; 884 885 case T_NOEXTFLT + USER: /* math coprocessor not available */ 886 if (tudebug && tudebugfpe) 887 showregs(type, rp, addr); 888 if (fpnoextflt(rp)) { 889 siginfo.si_signo = SIGFPE; 890 siginfo.si_code = ILL_ILLOPC; 891 siginfo.si_addr = (caddr_t)rp->r_pc; 892 fault = FLTFPE; 893 } 894 break; 895 896 case T_EXTOVRFLT: /* extension overrun fault */ 897 /* check if we took a kernel trap on behalf of user */ 898 { 899 extern void ndptrap_frstor(void); 900 if (rp->r_pc != (uintptr_t)ndptrap_frstor) 901 (void) die(type, rp, addr, cpuid); 902 type |= USER; 903 } 904 /*FALLTHROUGH*/ 905 case T_EXTOVRFLT + USER: /* extension overrun fault */ 906 if (tudebug && tudebugfpe) 907 showregs(type, rp, addr); 908 if (fpextovrflt(rp)) { 909 siginfo.si_signo = SIGSEGV; 910 siginfo.si_code = SEGV_MAPERR; 911 siginfo.si_addr = (caddr_t)rp->r_pc; 912 fault = FLTBOUNDS; 913 } 914 break; 915 916 case T_EXTERRFLT: /* x87 floating point exception pending */ 917 /* check if we took a kernel trap on behalf of user */ 918 { 919 extern void ndptrap_frstor(void); 920 if (rp->r_pc != (uintptr_t)ndptrap_frstor) 921 (void) die(type, rp, addr, cpuid); 922 type |= USER; 923 } 924 /*FALLTHROUGH*/ 925 926 case T_EXTERRFLT + USER: /* x87 floating point exception pending */ 927 if (tudebug && tudebugfpe) 928 showregs(type, rp, addr); 929 if (sicode = fpexterrflt(rp)) { 930 siginfo.si_signo = SIGFPE; 931 siginfo.si_code = sicode; 932 siginfo.si_addr = (caddr_t)rp->r_pc; 933 fault = FLTFPE; 934 } 935 break; 936 937 case T_SIMDFPE + USER: /* SSE and SSE2 exceptions */ 938 if (tudebug && tudebugsse) 939 showregs(type, rp, addr); 940 if ((x86_feature & (X86_SSE|X86_SSE2)) == 0) { 941 /* 942 * There are rumours that some user instructions 943 * on older CPUs can cause this trap to occur; in 944 * which case send a SIGILL instead of a SIGFPE. 945 */ 946 siginfo.si_signo = SIGILL; 947 siginfo.si_code = ILL_ILLTRP; 948 siginfo.si_addr = (caddr_t)rp->r_pc; 949 siginfo.si_trapno = type & ~USER; 950 fault = FLTILL; 951 } else if ((sicode = fpsimderrflt(rp)) != 0) { 952 siginfo.si_signo = SIGFPE; 953 siginfo.si_code = sicode; 954 siginfo.si_addr = (caddr_t)rp->r_pc; 955 fault = FLTFPE; 956 } 957 break; 958 959 case T_BPTFLT: /* breakpoint trap */ 960 /* 961 * Kernel breakpoint traps should only happen when kmdb is 962 * active, and even then, it'll have interposed on the IDT, so 963 * control won't get here. If it does, we've hit a breakpoint 964 * without the debugger, which is very strange, and very 965 * fatal. 966 */ 967 if (tudebug && tudebugbpt) 968 showregs(type, rp, (caddr_t)0); 969 970 (void) die(type, rp, addr, cpuid); 971 break; 972 973 case T_SGLSTP: /* single step/hw breakpoint exception */ 974 if (tudebug && tudebugbpt) 975 showregs(type, rp, (caddr_t)0); 976 977 /* Now evaluate how we got here */ 978 if (lwp != NULL && (lwp->lwp_pcb.pcb_drstat & DR_SINGLESTEP)) { 979 /* 980 * i386 single-steps even through lcalls which 981 * change the privilege level. So we take a trap at 982 * the first instruction in privileged mode. 983 * 984 * Set a flag to indicate that upon completion of 985 * the system call, deal with the single-step trap. 986 * 987 * The same thing happens for sysenter, too. 988 */ 989 #if defined(__amd64) 990 if (rp->r_pc == (uintptr_t)sys_sysenter) { 991 /* 992 * Adjust the pc so that we don't execute the 993 * swapgs instruction at the head of the 994 * handler and completely confuse things. 995 */ 996 rp->r_pc = (uintptr_t) 997 _sys_sysenter_post_swapgs; 998 #elif defined(__i386) 999 if (rp->r_pc == (uintptr_t)sys_call || 1000 rp->r_pc == (uintptr_t)sys_sysenter) { 1001 #endif 1002 rp->r_ps &= ~PS_T; /* turn off trace */ 1003 lwp->lwp_pcb.pcb_flags |= DEBUG_PENDING; 1004 cur_thread->t_post_sys = 1; 1005 goto cleanup; 1006 } 1007 } 1008 /* XXX - needs review on debugger interface? */ 1009 if (boothowto & RB_DEBUG) 1010 debug_enter((char *)NULL); 1011 else 1012 (void) die(type, rp, addr, cpuid); 1013 break; 1014 1015 case T_NMIFLT: /* NMI interrupt */ 1016 printf("Unexpected NMI in system mode\n"); 1017 goto cleanup; 1018 1019 case T_NMIFLT + USER: /* NMI interrupt */ 1020 printf("Unexpected NMI in user mode\n"); 1021 break; 1022 1023 case T_GPFLT: /* general protection violation */ 1024 #if defined(__amd64) 1025 /* 1026 * On amd64, we can get a #gp from referencing addresses 1027 * in the virtual address hole e.g. from a copyin. 1028 */ 1029 1030 /* 1031 * If we're under on_trap() protection (see <sys/ontrap.h>), 1032 * set ot_trap and longjmp back to the on_trap() call site. 1033 */ 1034 if ((cur_thread->t_ontrap != NULL) && 1035 (cur_thread->t_ontrap->ot_prot & OT_DATA_ACCESS)) { 1036 curthread->t_ontrap->ot_trap |= OT_DATA_ACCESS; 1037 longjmp(&curthread->t_ontrap->ot_jmpbuf); 1038 } 1039 1040 /* 1041 * If we're under lofault protection (copyin etc.), 1042 * longjmp back to lofault with an EFAULT. 1043 */ 1044 if (cur_thread->t_lofault) { 1045 /* 1046 * Fault is not resolvable, so just return to lofault 1047 */ 1048 if (lodebug) { 1049 showregs(type, rp, addr); 1050 traceregs(rp); 1051 } 1052 rp->r_r0 = EFAULT; 1053 rp->r_pc = cur_thread->t_lofault; 1054 goto cleanup; 1055 } 1056 /*FALLTHROUGH*/ 1057 #endif 1058 case T_STKFLT: /* stack fault */ 1059 case T_TSSFLT: /* invalid TSS fault */ 1060 case T_SEGFLT: /* segment not present fault */ 1061 if (tudebug) 1062 showregs(type, rp, (caddr_t)0); 1063 if (kern_gpfault(rp)) 1064 (void) die(type, rp, addr, cpuid); 1065 goto cleanup; 1066 /*FALLTHROUGH*/ 1067 1068 /* 1069 * ONLY 32-bit PROCESSES can USE a PRIVATE LDT! 64-bit apps should have 1070 * no legacy need for them, so we put a stop to it here. 1071 * 1072 * So: not-present fault is ONLY valid for 32-bit processes with a private LDT 1073 * trying to do a system call. Emulate it. 1074 * 1075 * #gp fault is ONLY valid for 32-bit processes also, which DO NOT have private 1076 * LDT, and are trying to do a system call. Emulate it. 1077 */ 1078 case T_SEGFLT + USER: /* segment not present fault */ 1079 case T_GPFLT + USER: /* general protection violation */ 1080 #ifdef _SYSCALL32_IMPL 1081 if (p->p_model != DATAMODEL_NATIVE) { 1082 #endif /* _SYSCALL32_IMPL */ 1083 if (instr_is_syscall((caddr_t)rp->r_pc)) { 1084 if (type == T_SEGFLT + USER) 1085 ASSERT(p->p_ldt != NULL); 1086 1087 if ((p->p_ldt == NULL && type == T_GPFLT + USER) || 1088 type == T_SEGFLT + USER) { 1089 1090 /* 1091 * The user attempted a system call via the obsolete 1092 * call gate mechanism. Because the process doesn't have 1093 * an LDT (i.e. the ldtr contains 0), a #gp results. 1094 * Emulate the syscall here, just as we do above for a 1095 * #np trap. 1096 */ 1097 1098 /* 1099 * Since this is a not-present trap, rp->r_pc points to 1100 * the trapping lcall instruction. We need to bump it 1101 * to the next insn so the app can continue on. 1102 */ 1103 rp->r_pc += LCALLSIZE; 1104 lwp->lwp_regs = rp; 1105 1106 /* 1107 * Normally the microstate of the LWP is forced back to 1108 * LMS_USER by the syscall handlers. Emulate that 1109 * behavior here. 1110 */ 1111 mstate = LMS_USER; 1112 1113 dosyscall(); 1114 goto out; 1115 } 1116 } 1117 #ifdef _SYSCALL32_IMPL 1118 } 1119 #endif /* _SYSCALL32_IMPL */ 1120 /* 1121 * If the current process is using a private LDT and the 1122 * trapping instruction is sysenter, the sysenter instruction 1123 * has been disabled on the CPU because it destroys segment 1124 * registers. If this is the case, rewrite the instruction to 1125 * be a safe system call and retry it. If this occurs on a CPU 1126 * which doesn't even support sysenter, the result of all of 1127 * this will be to emulate that particular instruction. 1128 */ 1129 if (p->p_ldt != NULL && 1130 instr_is_fast_syscall((caddr_t)rp->r_pc, X86_SEP)) { 1131 if (rewrite_syscall((caddr_t)rp->r_pc) == 0) 1132 goto out; 1133 #ifdef DEBUG 1134 else 1135 cmn_err(CE_WARN, "failed to rewrite sysenter " 1136 "instruction in process %d", 1137 curthread->t_procp->p_pid); 1138 #endif /* DEBUG */ 1139 } 1140 /*FALLTHROUGH*/ 1141 1142 case T_BOUNDFLT + USER: /* bound fault */ 1143 case T_STKFLT + USER: /* stack fault */ 1144 case T_TSSFLT + USER: /* invalid TSS fault */ 1145 if (tudebug) 1146 showregs(type, rp, (caddr_t)0); 1147 siginfo.si_signo = SIGSEGV; 1148 siginfo.si_code = SEGV_MAPERR; 1149 siginfo.si_addr = (caddr_t)rp->r_pc; 1150 fault = FLTBOUNDS; 1151 break; 1152 1153 case T_ALIGNMENT + USER: /* user alignment error (486) */ 1154 if (tudebug) 1155 showregs(type, rp, (caddr_t)0); 1156 bzero(&siginfo, sizeof (siginfo)); 1157 siginfo.si_signo = SIGBUS; 1158 siginfo.si_code = BUS_ADRALN; 1159 siginfo.si_addr = (caddr_t)rp->r_pc; 1160 fault = FLTACCESS; 1161 break; 1162 1163 case T_SGLSTP + USER: /* single step/hw breakpoint exception */ 1164 if (tudebug && tudebugbpt) 1165 showregs(type, rp, (caddr_t)0); 1166 1167 /* Was it single-stepping? */ 1168 if (lwp->lwp_pcb.pcb_drstat & DR_SINGLESTEP) { 1169 pcb_t *pcb = &lwp->lwp_pcb; 1170 1171 rp->r_ps &= ~PS_T; 1172 /* 1173 * If both NORMAL_STEP and WATCH_STEP are in effect, 1174 * give precedence to NORMAL_STEP. If neither is set, 1175 * user must have set the PS_T bit in %efl; treat this 1176 * as NORMAL_STEP. 1177 */ 1178 if ((pcb->pcb_flags & NORMAL_STEP) || 1179 !(pcb->pcb_flags & WATCH_STEP)) { 1180 siginfo.si_signo = SIGTRAP; 1181 siginfo.si_code = TRAP_TRACE; 1182 siginfo.si_addr = (caddr_t)rp->r_pc; 1183 fault = FLTTRACE; 1184 if (pcb->pcb_flags & WATCH_STEP) 1185 (void) undo_watch_step(NULL); 1186 } else { 1187 fault = undo_watch_step(&siginfo); 1188 } 1189 pcb->pcb_flags &= ~(NORMAL_STEP|WATCH_STEP); 1190 } else { 1191 cmn_err(CE_WARN, 1192 "Unexpected INT 1 in user mode, dr6=%lx", 1193 lwp->lwp_pcb.pcb_drstat); 1194 } 1195 break; 1196 1197 case T_BPTFLT + USER: /* breakpoint trap */ 1198 if (tudebug && tudebugbpt) 1199 showregs(type, rp, (caddr_t)0); 1200 /* 1201 * int 3 (the breakpoint instruction) leaves the pc referring 1202 * to the address one byte after the breakpointed address. 1203 * If the P_PR_BPTADJ flag has been set via /proc, We adjust 1204 * it back so it refers to the breakpointed address. 1205 */ 1206 if (p->p_proc_flag & P_PR_BPTADJ) 1207 rp->r_pc--; 1208 siginfo.si_signo = SIGTRAP; 1209 siginfo.si_code = TRAP_BRKPT; 1210 siginfo.si_addr = (caddr_t)rp->r_pc; 1211 fault = FLTBPT; 1212 break; 1213 1214 case T_AST: 1215 /* 1216 * This occurs only after the cs register has been made to 1217 * look like a kernel selector, either through debugging or 1218 * possibly by functions like setcontext(). The thread is 1219 * about to cause a general protection fault at common_iret() 1220 * in locore. We let that happen immediately instead of 1221 * doing the T_AST processing. 1222 */ 1223 goto cleanup; 1224 1225 case T_AST + USER: /* profiling or resched pseudo trap */ 1226 if (lwp->lwp_pcb.pcb_flags & CPC_OVERFLOW) { 1227 lwp->lwp_pcb.pcb_flags &= ~CPC_OVERFLOW; 1228 if (kcpc_overflow_ast()) { 1229 /* 1230 * Signal performance counter overflow 1231 */ 1232 if (tudebug) 1233 showregs(type, rp, (caddr_t)0); 1234 bzero(&siginfo, sizeof (siginfo)); 1235 siginfo.si_signo = SIGEMT; 1236 siginfo.si_code = EMT_CPCOVF; 1237 siginfo.si_addr = (caddr_t)rp->r_pc; 1238 fault = FLTCPCOVF; 1239 } 1240 } 1241 break; 1242 } 1243 1244 /* 1245 * We can't get here from a system trap 1246 */ 1247 ASSERT(type & USER); 1248 1249 if (fault) { 1250 /* 1251 * Remember the fault and fault adddress 1252 * for real-time (SIGPROF) profiling. 1253 */ 1254 lwp->lwp_lastfault = fault; 1255 lwp->lwp_lastfaddr = siginfo.si_addr; 1256 1257 DTRACE_PROC2(fault, int, fault, ksiginfo_t *, &siginfo); 1258 1259 /* 1260 * If a debugger has declared this fault to be an 1261 * event of interest, stop the lwp. Otherwise just 1262 * deliver the associated signal. 1263 */ 1264 if (siginfo.si_signo != SIGKILL && 1265 prismember(&p->p_fltmask, fault) && 1266 stop_on_fault(fault, &siginfo) == 0) 1267 siginfo.si_signo = 0; 1268 } 1269 1270 if (siginfo.si_signo) 1271 trapsig(&siginfo, (fault == FLTCPCOVF)? 0 : 1); 1272 1273 if (lwp->lwp_oweupc) 1274 profil_tick(rp->r_pc); 1275 1276 if (cur_thread->t_astflag | cur_thread->t_sig_check) { 1277 /* 1278 * Turn off the AST flag before checking all the conditions that 1279 * may have caused an AST. This flag is on whenever a signal or 1280 * unusual condition should be handled after the next trap or 1281 * syscall. 1282 */ 1283 astoff(cur_thread); 1284 cur_thread->t_sig_check = 0; 1285 1286 mutex_enter(&p->p_lock); 1287 if (curthread->t_proc_flag & TP_CHANGEBIND) { 1288 timer_lwpbind(); 1289 curthread->t_proc_flag &= ~TP_CHANGEBIND; 1290 } 1291 mutex_exit(&p->p_lock); 1292 1293 /* 1294 * for kaio requests that are on the per-process poll queue, 1295 * aiop->aio_pollq, they're AIO_POLL bit is set, the kernel 1296 * should copyout their result_t to user memory. by copying 1297 * out the result_t, the user can poll on memory waiting 1298 * for the kaio request to complete. 1299 */ 1300 if (p->p_aio) 1301 aio_cleanup(0); 1302 /* 1303 * If this LWP was asked to hold, call holdlwp(), which will 1304 * stop. holdlwps() sets this up and calls pokelwps() which 1305 * sets the AST flag. 1306 * 1307 * Also check TP_EXITLWP, since this is used by fresh new LWPs 1308 * through lwp_rtt(). That flag is set if the lwp_create(2) 1309 * syscall failed after creating the LWP. 1310 */ 1311 if (ISHOLD(p)) 1312 holdlwp(); 1313 1314 /* 1315 * All code that sets signals and makes ISSIG evaluate true must 1316 * set t_astflag afterwards. 1317 */ 1318 if (ISSIG_PENDING(cur_thread, lwp, p)) { 1319 if (issig(FORREAL)) 1320 psig(); 1321 cur_thread->t_sig_check = 1; 1322 } 1323 1324 if (cur_thread->t_rprof != NULL) { 1325 realsigprof(0, 0); 1326 cur_thread->t_sig_check = 1; 1327 } 1328 } 1329 1330 out: /* We can't get here from a system trap */ 1331 ASSERT(type & USER); 1332 1333 if (ISHOLD(p)) 1334 holdlwp(); 1335 1336 /* 1337 * Set state to LWP_USER here so preempt won't give us a kernel 1338 * priority if it occurs after this point. Call CL_TRAPRET() to 1339 * restore the user-level priority. 1340 * 1341 * It is important that no locks (other than spinlocks) be entered 1342 * after this point before returning to user mode (unless lwp_state 1343 * is set back to LWP_SYS). 1344 */ 1345 lwp->lwp_state = LWP_USER; 1346 1347 if (cur_thread->t_trapret) { 1348 cur_thread->t_trapret = 0; 1349 thread_lock(cur_thread); 1350 CL_TRAPRET(cur_thread); 1351 thread_unlock(cur_thread); 1352 } 1353 if (CPU->cpu_runrun) 1354 preempt(); 1355 (void) new_mstate(cur_thread, mstate); 1356 1357 /* Kernel probe */ 1358 TNF_PROBE_1(thread_state, "thread", /* CSTYLED */, 1359 tnf_microstate, state, LMS_USER); 1360 1361 return; 1362 1363 cleanup: /* system traps end up here */ 1364 ASSERT(!(type & USER)); 1365 } 1366 1367 /* 1368 * Patch non-zero to disable preemption of threads in the kernel. 1369 */ 1370 int IGNORE_KERNEL_PREEMPTION = 0; /* XXX - delete this someday */ 1371 1372 struct kpreempt_cnts { /* kernel preemption statistics */ 1373 int kpc_idle; /* executing idle thread */ 1374 int kpc_intr; /* executing interrupt thread */ 1375 int kpc_clock; /* executing clock thread */ 1376 int kpc_blocked; /* thread has blocked preemption (t_preempt) */ 1377 int kpc_notonproc; /* thread is surrendering processor */ 1378 int kpc_inswtch; /* thread has ratified scheduling decision */ 1379 int kpc_prilevel; /* processor interrupt level is too high */ 1380 int kpc_apreempt; /* asynchronous preemption */ 1381 int kpc_spreempt; /* synchronous preemption */ 1382 } kpreempt_cnts; 1383 1384 /* 1385 * kernel preemption: forced rescheduling, preempt the running kernel thread. 1386 * the argument is old PIL for an interrupt, 1387 * or the distingished value KPREEMPT_SYNC. 1388 */ 1389 void 1390 kpreempt(int asyncspl) 1391 { 1392 kthread_t *cur_thread = curthread; 1393 1394 if (IGNORE_KERNEL_PREEMPTION) { 1395 aston(CPU->cpu_dispthread); 1396 return; 1397 } 1398 1399 /* 1400 * Check that conditions are right for kernel preemption 1401 */ 1402 do { 1403 if (cur_thread->t_preempt) { 1404 /* 1405 * either a privileged thread (idle, panic, interrupt) 1406 * or will check when t_preempt is lowered 1407 */ 1408 if (cur_thread->t_pri < 0) 1409 kpreempt_cnts.kpc_idle++; 1410 else if (cur_thread->t_flag & T_INTR_THREAD) { 1411 kpreempt_cnts.kpc_intr++; 1412 if (cur_thread->t_pil == CLOCK_LEVEL) 1413 kpreempt_cnts.kpc_clock++; 1414 } else 1415 kpreempt_cnts.kpc_blocked++; 1416 aston(CPU->cpu_dispthread); 1417 return; 1418 } 1419 if (cur_thread->t_state != TS_ONPROC || 1420 cur_thread->t_disp_queue != CPU->cpu_disp) { 1421 /* this thread will be calling swtch() shortly */ 1422 kpreempt_cnts.kpc_notonproc++; 1423 if (CPU->cpu_thread != CPU->cpu_dispthread) { 1424 /* already in swtch(), force another */ 1425 kpreempt_cnts.kpc_inswtch++; 1426 siron(); 1427 } 1428 return; 1429 } 1430 if (getpil() >= DISP_LEVEL) { 1431 /* 1432 * We can't preempt this thread if it is at 1433 * a PIL >= DISP_LEVEL since it may be holding 1434 * a spin lock (like sched_lock). 1435 */ 1436 siron(); /* check back later */ 1437 kpreempt_cnts.kpc_prilevel++; 1438 return; 1439 } 1440 1441 if (asyncspl != KPREEMPT_SYNC) 1442 kpreempt_cnts.kpc_apreempt++; 1443 else 1444 kpreempt_cnts.kpc_spreempt++; 1445 1446 cur_thread->t_preempt++; 1447 preempt(); 1448 cur_thread->t_preempt--; 1449 } while (CPU->cpu_kprunrun); 1450 } 1451 1452 /* 1453 * Print out debugging info. 1454 */ 1455 static void 1456 showregs(uint_t type, struct regs *rp, caddr_t addr) 1457 { 1458 int s; 1459 1460 s = spl7(); 1461 type &= ~USER; 1462 if (u.u_comm[0]) 1463 printf("%s: ", u.u_comm); 1464 if (type < TRAP_TYPES) 1465 printf("#%s %s\n", trap_type_mnemonic[type], trap_type[type]); 1466 else 1467 switch (type) { 1468 case T_SYSCALL: 1469 printf("Syscall Trap:\n"); 1470 break; 1471 case T_AST: 1472 printf("AST\n"); 1473 break; 1474 default: 1475 printf("Bad Trap = %d\n", type); 1476 break; 1477 } 1478 if (type == T_PGFLT) { 1479 printf("Bad %s fault at addr=0x%lx\n", 1480 USERMODE(rp->r_cs) ? "user": "kernel", (uintptr_t)addr); 1481 } else if (addr) { 1482 printf("addr=0x%lx\n", (uintptr_t)addr); 1483 } 1484 1485 printf("pid=%d, pc=0x%lx, sp=0x%lx, eflags=0x%lx\n", 1486 (ttoproc(curthread) && ttoproc(curthread)->p_pidp) ? 1487 ttoproc(curthread)->p_pid : 0, rp->r_pc, rp->r_sp, rp->r_ps); 1488 1489 #if defined(__lint) 1490 /* 1491 * this clause can be deleted when lint bug 4870403 is fixed 1492 * (lint thinks that bit 32 is illegal in a %b format string) 1493 */ 1494 printf("cr0: %x cr4: %b\n", 1495 (uint_t)getcr0(), (uint_t)getcr4(), FMT_CR4); 1496 #else 1497 printf("cr0: %b cr4: %b\n", 1498 (uint_t)getcr0(), FMT_CR0, (uint_t)getcr4(), FMT_CR4); 1499 #endif 1500 1501 #if defined(__amd64) 1502 printf("cr2: %lx cr3: %lx cr8: %lx\n", getcr2(), getcr3(), getcr8()); 1503 #elif defined(__i386) 1504 printf("cr2: %lx cr3: %lx\n", getcr2(), getcr3()); 1505 #endif 1506 1507 dumpregs(rp); 1508 splx(s); 1509 } 1510 1511 static void 1512 dumpregs(struct regs *rp) 1513 { 1514 #if defined(__amd64) 1515 const char fmt[] = "\t%3s: %16lx %3s: %16lx %3s: %16lx\n"; 1516 1517 printf(fmt, "rdi", rp->r_rdi, "rsi", rp->r_rsi, "rdx", rp->r_rdx); 1518 printf(fmt, "rcx", rp->r_rcx, " r8", rp->r_r8, " r9", rp->r_r9); 1519 printf(fmt, "rax", rp->r_rax, "rbx", rp->r_rbx, "rbp", rp->r_rbp); 1520 printf(fmt, "r10", rp->r_r10, "r11", rp->r_r11, "r12", rp->r_r12); 1521 printf(fmt, "r13", rp->r_r13, "r14", rp->r_r14, "r15", rp->r_r15); 1522 1523 printf(fmt, "fsb", rp->r_fsbase, "gsb", rp->r_gsbase, " ds", rp->r_ds); 1524 printf(fmt, " es", rp->r_es, " fs", rp->r_fs, " gs", rp->r_gs); 1525 1526 printf(fmt, "trp", rp->r_trapno, "err", rp->r_err, "rip", rp->r_rip); 1527 printf(fmt, " cs", rp->r_cs, "rfl", rp->r_rfl, "rsp", rp->r_rsp); 1528 1529 printf("\t%3s: %16lx\n", " ss", rp->r_ss); 1530 1531 #elif defined(__i386) 1532 const char fmt[] = "\t%3s: %8lx %3s: %8lx %3s: %8lx %3s: %8lx\n"; 1533 1534 printf(fmt, " gs", rp->r_gs, " fs", rp->r_fs, 1535 " es", rp->r_es, " ds", rp->r_ds); 1536 printf(fmt, "edi", rp->r_edi, "esi", rp->r_esi, 1537 "ebp", rp->r_ebp, "esp", rp->r_esp); 1538 printf(fmt, "ebx", rp->r_ebx, "edx", rp->r_edx, 1539 "ecx", rp->r_ecx, "eax", rp->r_eax); 1540 printf(fmt, "trp", rp->r_trapno, "err", rp->r_err, 1541 "eip", rp->r_eip, " cs", rp->r_cs); 1542 printf("\t%3s: %8lx %3s: %8lx %3s: %8lx\n", 1543 "efl", rp->r_efl, "usp", rp->r_uesp, " ss", rp->r_ss); 1544 1545 #endif /* __i386 */ 1546 } 1547 1548 /* 1549 * Handle #gp faults in kernel mode. 1550 * 1551 * One legitimate way this can happen is if we attempt to update segment 1552 * registers to naughty values on the way out of the kernel. 1553 * 1554 * This can happen in a couple of ways: someone - either accidentally or 1555 * on purpose - creates (setcontext(2), lwp_create(2)) or modifies 1556 * (signal(2)) a ucontext that contains silly segment register values. 1557 * Or someone - either accidentally or on purpose - modifies the prgregset_t 1558 * of a subject process via /proc to contain silly segment register values. 1559 * 1560 * (The unfortunate part is that we can end up discovering the bad segment 1561 * register value in the middle of an 'iret' after we've popped most of the 1562 * stack. So it becomes quite difficult to associate an accurate ucontext 1563 * with the lwp, because the act of taking the #gp trap overwrites most of 1564 * what we were going to send the lwp.) 1565 * 1566 * OTOH if it turns out that's -not- the problem, and we're -not- an lwp 1567 * trying to return to user mode and we get a #gp fault, then we need 1568 * to die() -- which will happen if we return non-zero from this routine. 1569 */ 1570 static int 1571 kern_gpfault(struct regs *rp) 1572 { 1573 kthread_t *t = curthread; 1574 proc_t *p = ttoproc(t); 1575 klwp_t *lwp = ttolwp(t); 1576 struct regs tmpregs, *trp = NULL; 1577 caddr_t pc = (caddr_t)rp->r_pc; 1578 int v; 1579 1580 extern void _sys_rtt(), sr_sup(); 1581 1582 #if defined(__amd64) 1583 extern void _update_sregs(), _update_sregs_done(); 1584 static const uint8_t iretq_insn[2] = { 0x48, 0xcf }; 1585 1586 #elif defined(__i386) 1587 static const uint8_t iret_insn[1] = { 0xcf }; 1588 1589 /* 1590 * Note carefully the appallingly awful dependency between 1591 * the instruction sequence used in __SEGREGS_POP and these 1592 * instructions encoded here. 1593 * 1594 * XX64 Add some commentary to locore.s/privregs.h to document this. 1595 */ 1596 static const uint8_t movw_0_esp_gs[4] = { 0x8e, 0x6c, 0x24, 0x0 }; 1597 static const uint8_t movw_4_esp_fs[4] = { 0x8e, 0x64, 0x24, 0x4 }; 1598 static const uint8_t movw_8_esp_es[4] = { 0x8e, 0x44, 0x24, 0x8 }; 1599 static const uint8_t movw_c_esp_ds[4] = { 0x8e, 0x5c, 0x24, 0xc }; 1600 #endif 1601 /* 1602 * if we're not an lwp, or the pc range is outside _sys_rtt, then 1603 * we should immediately be die()ing horribly 1604 */ 1605 if (lwp == NULL || 1606 (uintptr_t)pc < (uintptr_t)_sys_rtt || 1607 (uintptr_t)pc > (uintptr_t)sr_sup) 1608 return (1); 1609 1610 /* 1611 * So at least we're in the right part of the kernel. 1612 * 1613 * Disassemble the instruction at the faulting pc. 1614 * Once we know what it is, we carefully reconstruct the stack 1615 * based on the order in which the stack is deconstructed in 1616 * _sys_rtt. Ew. 1617 */ 1618 1619 #if defined(__amd64) 1620 1621 if (bcmp(pc, iretq_insn, sizeof (iretq_insn)) == 0) { 1622 /* 1623 * We took the #gp while trying to perform the iretq. 1624 * This means that either %cs or %ss are bad. 1625 * All we know for sure is that most of the general 1626 * registers have been restored, including the 1627 * segment registers, and all we have left on the 1628 * topmost part of the lwp's stack are the 1629 * registers that the iretq was unable to consume. 1630 * 1631 * All the rest of the state was crushed by the #gp 1632 * which pushed -its- registers atop our old save area 1633 * (because we had to decrement the stack pointer, sigh) so 1634 * all that we can try and do is to reconstruct the 1635 * crushed frame from the #gp trap frame itself. 1636 */ 1637 trp = &tmpregs; 1638 trp->r_ss = lwptoregs(lwp)->r_ss; 1639 trp->r_sp = lwptoregs(lwp)->r_sp; 1640 trp->r_ps = lwptoregs(lwp)->r_ps; 1641 trp->r_cs = lwptoregs(lwp)->r_cs; 1642 trp->r_pc = lwptoregs(lwp)->r_pc; 1643 bcopy(rp, trp, offsetof(struct regs, r_pc)); 1644 1645 /* 1646 * Validate simple math 1647 */ 1648 ASSERT(trp->r_pc == lwptoregs(lwp)->r_pc); 1649 ASSERT(trp->r_err == rp->r_err); 1650 1651 } else if ((lwp->lwp_pcb.pcb_flags & RUPDATE_PENDING) != 0 && 1652 pc >= (caddr_t)_update_sregs && 1653 pc < (caddr_t)_update_sregs_done) { 1654 /* 1655 * This is the common case -- we're trying to load 1656 * a bad segment register value in the only section 1657 * of kernel code that ever loads segment registers. 1658 * 1659 * We don't need to do anything at this point because 1660 * the pcb contains all the pending segment register 1661 * state, and the regs are still intact because we 1662 * didn't adjust the stack pointer yet. Given the fidelity 1663 * of all this, we could conceivably send a signal 1664 * to the lwp, rather than core-ing. 1665 */ 1666 trp = lwptoregs(lwp); 1667 ASSERT((caddr_t)trp == (caddr_t)rp->r_sp); 1668 } 1669 1670 #elif defined(__i386) 1671 1672 if (bcmp(pc, iret_insn, sizeof (iret_insn)) == 0) { 1673 /* 1674 * We took the #gp while trying to perform the iret. 1675 * This means that either %cs or %ss are bad. 1676 * All we know for sure is that most of the general 1677 * registers have been restored, including the 1678 * segment registers, and all we have left on the 1679 * topmost part of the lwp's stack are the registers that 1680 * the iret was unable to consume. 1681 * 1682 * All the rest of the state was crushed by the #gp 1683 * which pushed -its- registers atop our old save area 1684 * (because we had to decrement the stack pointer, sigh) so 1685 * all that we can try and do is to reconstruct the 1686 * crushed frame from the #gp trap frame itself. 1687 */ 1688 trp = &tmpregs; 1689 trp->r_ss = lwptoregs(lwp)->r_ss; 1690 trp->r_sp = lwptoregs(lwp)->r_sp; 1691 trp->r_ps = lwptoregs(lwp)->r_ps; 1692 trp->r_cs = lwptoregs(lwp)->r_cs; 1693 trp->r_pc = lwptoregs(lwp)->r_pc; 1694 bcopy(rp, trp, offsetof(struct regs, r_pc)); 1695 1696 ASSERT(trp->r_pc == lwptoregs(lwp)->r_pc); 1697 ASSERT(trp->r_err == rp->r_err); 1698 1699 } else { 1700 /* 1701 * Segment registers are reloaded in _sys_rtt 1702 * via the following sequence: 1703 * 1704 * movw 0(%esp), %gs 1705 * movw 4(%esp), %fs 1706 * movw 8(%esp), %es 1707 * movw 12(%esp), %ds 1708 * addl $16, %esp 1709 * 1710 * Thus if any of them fault, we know the user 1711 * registers are left unharmed on the stack. 1712 */ 1713 if (bcmp(pc, movw_0_esp_gs, sizeof (movw_0_esp_gs)) == 0 || 1714 bcmp(pc, movw_4_esp_fs, sizeof (movw_4_esp_fs)) == 0 || 1715 bcmp(pc, movw_8_esp_es, sizeof (movw_8_esp_es)) == 0 || 1716 bcmp(pc, movw_c_esp_ds, sizeof (movw_c_esp_ds)) == 0) 1717 trp = lwptoregs(lwp); 1718 } 1719 #endif /* __amd64 */ 1720 1721 if (trp == NULL) 1722 return (1); 1723 1724 /* 1725 * If we get to here, we're reasonably confident that we've 1726 * correctly decoded what happened on the way out of the kernel. 1727 * Rewrite the lwp's registers so that we can create a core dump 1728 * the (at least vaguely) represents the mcontext we were 1729 * being asked to restore when things went so terribly wrong. 1730 */ 1731 1732 /* 1733 * Make sure that we have a meaningful %trapno and %err. 1734 */ 1735 trp->r_trapno = rp->r_trapno; 1736 trp->r_err = rp->r_err; 1737 1738 if ((caddr_t)trp != (caddr_t)lwptoregs(lwp)) 1739 bcopy(trp, lwptoregs(lwp), sizeof (*trp)); 1740 1741 mutex_enter(&p->p_lock); 1742 lwp->lwp_cursig = SIGSEGV; 1743 mutex_exit(&p->p_lock); 1744 1745 /* 1746 * Terminate all LWPs but don't discard them. If another lwp beat us to 1747 * the punch by calling exit(), evaporate now. 1748 */ 1749 proc_is_exiting(p); 1750 if (exitlwps(1) != 0) { 1751 mutex_enter(&p->p_lock); 1752 lwp_exit(); 1753 } 1754 1755 #ifdef C2_AUDIT 1756 if (audit_active) /* audit core dump */ 1757 audit_core_start(SIGSEGV); 1758 #endif 1759 v = core(SIGSEGV, B_FALSE); 1760 #ifdef C2_AUDIT 1761 if (audit_active) /* audit core dump */ 1762 audit_core_finish(v ? CLD_KILLED : CLD_DUMPED); 1763 #endif 1764 exit(v ? CLD_KILLED : CLD_DUMPED, SIGSEGV); 1765 return (0); 1766 } 1767 1768 /* 1769 * dump_tss() - Display the TSS structure 1770 */ 1771 1772 #if defined(__amd64) 1773 1774 static void 1775 dump_tss(void) 1776 { 1777 const char tss_fmt[] = "tss.%s:\t0x%p\n"; /* Format string */ 1778 struct tss *tss = CPU->cpu_tss; 1779 1780 printf(tss_fmt, "tss_rsp0", (void *)tss->tss_rsp0); 1781 printf(tss_fmt, "tss_rsp1", (void *)tss->tss_rsp1); 1782 printf(tss_fmt, "tss_rsp2", (void *)tss->tss_rsp2); 1783 1784 printf(tss_fmt, "tss_ist1", (void *)tss->tss_ist1); 1785 printf(tss_fmt, "tss_ist2", (void *)tss->tss_ist2); 1786 printf(tss_fmt, "tss_ist3", (void *)tss->tss_ist3); 1787 printf(tss_fmt, "tss_ist4", (void *)tss->tss_ist4); 1788 printf(tss_fmt, "tss_ist5", (void *)tss->tss_ist5); 1789 printf(tss_fmt, "tss_ist6", (void *)tss->tss_ist6); 1790 printf(tss_fmt, "tss_ist7", (void *)tss->tss_ist7); 1791 } 1792 1793 #elif defined(__i386) 1794 1795 static void 1796 dump_tss(void) 1797 { 1798 const char tss_fmt[] = "tss.%s:\t0x%p\n"; /* Format string */ 1799 struct tss *tss = CPU->cpu_tss; 1800 1801 printf(tss_fmt, "tss_link", (void *)(uintptr_t)tss->tss_link); 1802 printf(tss_fmt, "tss_esp0", (void *)(uintptr_t)tss->tss_esp0); 1803 printf(tss_fmt, "tss_ss0", (void *)(uintptr_t)tss->tss_ss0); 1804 printf(tss_fmt, "tss_esp1", (void *)(uintptr_t)tss->tss_esp1); 1805 printf(tss_fmt, "tss_ss1", (void *)(uintptr_t)tss->tss_ss1); 1806 printf(tss_fmt, "tss_esp2", (void *)(uintptr_t)tss->tss_esp2); 1807 printf(tss_fmt, "tss_ss2", (void *)(uintptr_t)tss->tss_ss2); 1808 printf(tss_fmt, "tss_cr3", (void *)(uintptr_t)tss->tss_cr3); 1809 printf(tss_fmt, "tss_eip", (void *)(uintptr_t)tss->tss_eip); 1810 printf(tss_fmt, "tss_eflags", (void *)(uintptr_t)tss->tss_eflags); 1811 printf(tss_fmt, "tss_eax", (void *)(uintptr_t)tss->tss_eax); 1812 printf(tss_fmt, "tss_ebx", (void *)(uintptr_t)tss->tss_ebx); 1813 printf(tss_fmt, "tss_ecx", (void *)(uintptr_t)tss->tss_ecx); 1814 printf(tss_fmt, "tss_edx", (void *)(uintptr_t)tss->tss_edx); 1815 printf(tss_fmt, "tss_esp", (void *)(uintptr_t)tss->tss_esp); 1816 } 1817 1818 #endif /* __amd64 */ 1819 1820 #if defined(TRAPTRACE) 1821 1822 int ttrace_nrec = 0; /* number of records to dump out */ 1823 int ttrace_dump_nregs = 5; /* dump out this many records with regs too */ 1824 1825 /* 1826 * Dump out the last ttrace_nrec traptrace records on each CPU 1827 */ 1828 static void 1829 dump_ttrace(void) 1830 { 1831 trap_trace_ctl_t *ttc; 1832 trap_trace_rec_t *rec; 1833 uintptr_t current; 1834 int i, j, k; 1835 int n = NCPU; 1836 #if defined(__amd64) 1837 const char banner[] = 1838 "\ncpu address timestamp " 1839 "type vc handler pc\n"; 1840 const char fmt1[] = "%3d %016lx %12llx "; 1841 #elif defined(__i386) 1842 const char banner[] = 1843 "\ncpu address timestamp type vc handler pc\n"; 1844 const char fmt1[] = "%3d %08lx %12llx "; 1845 #endif 1846 const char fmt2[] = "%4s %3x "; 1847 const char fmt3[] = "%8s "; 1848 1849 if (ttrace_nrec == 0) 1850 return; 1851 1852 printf(banner); 1853 1854 for (i = 0; i < n; i++) { 1855 ttc = &trap_trace_ctl[i]; 1856 if (ttc->ttc_first == NULL) 1857 continue; 1858 1859 current = ttc->ttc_next - sizeof (trap_trace_rec_t); 1860 for (j = 0; j < ttrace_nrec; j++) { 1861 struct sysent *sys; 1862 struct autovec *vec; 1863 extern struct av_head autovect[]; 1864 int type; 1865 ulong_t off; 1866 char *sym, *stype; 1867 1868 if (current < ttc->ttc_first) 1869 current = 1870 ttc->ttc_limit - sizeof (trap_trace_rec_t); 1871 1872 if (current == NULL) 1873 continue; 1874 1875 rec = (trap_trace_rec_t *)current; 1876 1877 if (rec->ttr_stamp == 0) 1878 break; 1879 1880 printf(fmt1, i, (uintptr_t)rec, rec->ttr_stamp); 1881 1882 switch (rec->ttr_marker) { 1883 case TT_SYSCALL: 1884 case TT_SYSENTER: 1885 case TT_SYSC: 1886 case TT_SYSC64: 1887 #if defined(__amd64) 1888 sys = &sysent32[rec->ttr_sysnum]; 1889 switch (rec->ttr_marker) { 1890 case TT_SYSC64: 1891 sys = &sysent[rec->ttr_sysnum]; 1892 /*FALLTHROUGH*/ 1893 #elif defined(__i386) 1894 sys = &sysent[rec->ttr_sysnum]; 1895 switch (rec->ttr_marker) { 1896 case TT_SYSC64: 1897 #endif 1898 case TT_SYSC: 1899 stype = "sysc"; /* syscall */ 1900 break; 1901 case TT_SYSCALL: 1902 stype = "lcal"; /* lcall */ 1903 break; 1904 case TT_SYSENTER: 1905 stype = "syse"; /* sysenter */ 1906 break; 1907 default: 1908 break; 1909 } 1910 printf(fmt2, "sysc", rec->ttr_sysnum); 1911 if (sys != NULL) { 1912 sym = kobj_getsymname( 1913 (uintptr_t)sys->sy_callc, 1914 &off); 1915 if (sym != NULL) 1916 printf("%s ", sym); 1917 else 1918 printf("%p ", sys->sy_callc); 1919 } else { 1920 printf("unknown "); 1921 } 1922 break; 1923 1924 case TT_INTERRUPT: 1925 printf(fmt2, "intr", rec->ttr_vector); 1926 vec = (&autovect[rec->ttr_vector])->avh_link; 1927 if (vec != NULL) { 1928 sym = kobj_getsymname( 1929 (uintptr_t)vec->av_vector, &off); 1930 if (sym != NULL) 1931 printf("%s ", sym); 1932 else 1933 printf("%p ", vec->av_vector); 1934 } else { 1935 printf("unknown "); 1936 } 1937 break; 1938 1939 case TT_TRAP: 1940 type = rec->ttr_regs.r_trapno; 1941 printf(fmt2, "trap", type); 1942 printf("#%s ", type < TRAP_TYPES ? 1943 trap_type_mnemonic[type] : "trap"); 1944 break; 1945 1946 default: 1947 break; 1948 } 1949 1950 sym = kobj_getsymname(rec->ttr_regs.r_pc, &off); 1951 if (sym != NULL) 1952 printf("%s+%lx\n", sym, off); 1953 else 1954 printf("%lx\n", rec->ttr_regs.r_pc); 1955 1956 if (ttrace_dump_nregs-- > 0) { 1957 int s; 1958 1959 if (rec->ttr_marker == TT_INTERRUPT) 1960 printf( 1961 "\t\tipl %x spl %x pri %x\n", 1962 rec->ttr_ipl, 1963 rec->ttr_spl, 1964 rec->ttr_pri); 1965 1966 dumpregs(&rec->ttr_regs); 1967 1968 printf("\t%3s: %p\n\n", " ct", 1969 (void *)rec->ttr_curthread); 1970 1971 /* 1972 * print out the pc stack that we recorded 1973 * at trap time (if any) 1974 */ 1975 for (s = 0; s < rec->ttr_sdepth; s++) { 1976 uintptr_t fullpc; 1977 1978 if (s >= TTR_STACK_DEPTH) { 1979 printf("ttr_sdepth corrupt\n"); 1980 break; 1981 } 1982 1983 fullpc = (uintptr_t)rec->ttr_stack[s]; 1984 1985 sym = kobj_getsymname(fullpc, &off); 1986 if (sym != NULL) 1987 printf("-> %s+0x%lx()\n", 1988 sym, off); 1989 else 1990 printf("-> 0x%lx()\n", fullpc); 1991 } 1992 printf("\n"); 1993 } 1994 current -= sizeof (trap_trace_rec_t); 1995 } 1996 } 1997 } 1998 1999 #endif /* TRAPTRACE */ 2000 2001 void 2002 panic_showtrap(struct trap_info *tip) 2003 { 2004 showregs(tip->trap_type, tip->trap_regs, tip->trap_addr); 2005 2006 #if defined(TRAPTRACE) 2007 dump_ttrace(); 2008 #endif /* TRAPTRACE */ 2009 2010 if (tip->trap_type == T_DBLFLT) 2011 dump_tss(); 2012 } 2013 2014 void 2015 panic_savetrap(panic_data_t *pdp, struct trap_info *tip) 2016 { 2017 panic_saveregs(pdp, tip->trap_regs); 2018 } 2019