1 /* 2 * CDDL HEADER START 3 * 4 * The contents of this file are subject to the terms of the 5 * Common Development and Distribution License (the "License"). 6 * You may not use this file except in compliance with the License. 7 * 8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 9 * or http://www.opensolaris.org/os/licensing. 10 * See the License for the specific language governing permissions 11 * and limitations under the License. 12 * 13 * When distributing Covered Code, include this CDDL HEADER in each 14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 15 * If applicable, add the following below this CDDL HEADER, with the 16 * fields enclosed by brackets "[]" replaced with your own identifying 17 * information: Portions Copyright [yyyy] [name of copyright owner] 18 * 19 * CDDL HEADER END 20 */ 21 22 /* 23 * Copyright 2007 Sun Microsystems, Inc. All rights reserved. 24 * Use is subject to license terms. 25 */ 26 27 /* Copyright (c) 1990, 1991 UNIX System Laboratories, Inc. */ 28 /* Copyright (c) 1984, 1986, 1987, 1988, 1989, 1990 AT&T */ 29 /* All Rights Reserved */ 30 /* */ 31 /* Copyright (c) 1987, 1988 Microsoft Corporation */ 32 /* All Rights Reserved */ 33 /* */ 34 35 #pragma ident "%Z%%M% %I% %E% SMI" 36 37 #include <sys/types.h> 38 #include <sys/sysmacros.h> 39 #include <sys/param.h> 40 #include <sys/signal.h> 41 #include <sys/systm.h> 42 #include <sys/user.h> 43 #include <sys/proc.h> 44 #include <sys/disp.h> 45 #include <sys/class.h> 46 #include <sys/core.h> 47 #include <sys/syscall.h> 48 #include <sys/cpuvar.h> 49 #include <sys/vm.h> 50 #include <sys/sysinfo.h> 51 #include <sys/fault.h> 52 #include <sys/stack.h> 53 #include <sys/psw.h> 54 #include <sys/regset.h> 55 #include <sys/fp.h> 56 #include <sys/trap.h> 57 #include <sys/kmem.h> 58 #include <sys/vtrace.h> 59 #include <sys/cmn_err.h> 60 #include <sys/prsystm.h> 61 #include <sys/mutex_impl.h> 62 #include <sys/machsystm.h> 63 #include <sys/archsystm.h> 64 #include <sys/sdt.h> 65 #include <sys/avintr.h> 66 #include <sys/kobj.h> 67 68 #include <vm/hat.h> 69 70 #include <vm/seg_kmem.h> 71 #include <vm/as.h> 72 #include <vm/seg.h> 73 #include <vm/hat_pte.h> 74 #include <vm/hat_i86.h> 75 76 #include <sys/procfs.h> 77 78 #include <sys/reboot.h> 79 #include <sys/debug.h> 80 #include <sys/debugreg.h> 81 #include <sys/modctl.h> 82 #include <sys/aio_impl.h> 83 #include <sys/tnf.h> 84 #include <sys/tnf_probe.h> 85 #include <sys/cred.h> 86 #include <sys/mman.h> 87 #include <sys/x86_archext.h> 88 #include <sys/copyops.h> 89 #include <c2/audit.h> 90 #include <sys/ftrace.h> 91 #include <sys/panic.h> 92 #include <sys/traptrace.h> 93 #include <sys/ontrap.h> 94 #include <sys/cpc_impl.h> 95 #include <sys/bootconf.h> 96 #include <sys/bootinfo.h> 97 #include <sys/promif.h> 98 #include <sys/mach_mmu.h> 99 100 #define USER 0x10000 /* user-mode flag added to trap type */ 101 102 static const char *trap_type_mnemonic[] = { 103 "de", "db", "2", "bp", 104 "of", "br", "ud", "nm", 105 "df", "9", "ts", "np", 106 "ss", "gp", "pf", "15", 107 "mf", "ac", "mc", "xf" 108 }; 109 110 static const char *trap_type[] = { 111 "Divide error", /* trap id 0 */ 112 "Debug", /* trap id 1 */ 113 "NMI interrupt", /* trap id 2 */ 114 "Breakpoint", /* trap id 3 */ 115 "Overflow", /* trap id 4 */ 116 "BOUND range exceeded", /* trap id 5 */ 117 "Invalid opcode", /* trap id 6 */ 118 "Device not available", /* trap id 7 */ 119 "Double fault", /* trap id 8 */ 120 "Coprocessor segment overrun", /* trap id 9 */ 121 "Invalid TSS", /* trap id 10 */ 122 "Segment not present", /* trap id 11 */ 123 "Stack segment fault", /* trap id 12 */ 124 "General protection", /* trap id 13 */ 125 "Page fault", /* trap id 14 */ 126 "Reserved", /* trap id 15 */ 127 "x87 floating point error", /* trap id 16 */ 128 "Alignment check", /* trap id 17 */ 129 "Machine check", /* trap id 18 */ 130 "SIMD floating point exception", /* trap id 19 */ 131 }; 132 133 #define TRAP_TYPES (sizeof (trap_type) / sizeof (trap_type[0])) 134 135 #define SLOW_SCALL_SIZE 2 136 #define FAST_SCALL_SIZE 2 137 138 int tudebug = 0; 139 int tudebugbpt = 0; 140 int tudebugfpe = 0; 141 int tudebugsse = 0; 142 143 #if defined(TRAPDEBUG) || defined(lint) 144 int tdebug = 0; 145 int lodebug = 0; 146 int faultdebug = 0; 147 #else 148 #define tdebug 0 149 #define lodebug 0 150 #define faultdebug 0 151 #endif /* defined(TRAPDEBUG) || defined(lint) */ 152 153 #if defined(TRAPTRACE) 154 static void dump_ttrace(void); 155 #endif /* TRAPTRACE */ 156 static void dumpregs(struct regs *); 157 static void showregs(uint_t, struct regs *, caddr_t); 158 static void dump_tss(void); 159 static int kern_gpfault(struct regs *); 160 161 struct trap_info { 162 struct regs *trap_regs; 163 uint_t trap_type; 164 caddr_t trap_addr; 165 }; 166 167 /*ARGSUSED*/ 168 static int 169 die(uint_t type, struct regs *rp, caddr_t addr, processorid_t cpuid) 170 { 171 struct trap_info ti; 172 const char *trap_name, *trap_mnemonic; 173 174 if (type < TRAP_TYPES) { 175 trap_name = trap_type[type]; 176 trap_mnemonic = trap_type_mnemonic[type]; 177 } else { 178 trap_name = "trap"; 179 trap_mnemonic = "-"; 180 } 181 182 #ifdef TRAPTRACE 183 TRAPTRACE_FREEZE; 184 #endif 185 186 ti.trap_regs = rp; 187 ti.trap_type = type & ~USER; 188 ti.trap_addr = addr; 189 190 curthread->t_panic_trap = &ti; 191 192 if (type == T_PGFLT && addr < (caddr_t)KERNELBASE) { 193 panic("BAD TRAP: type=%x (#%s %s) rp=%p addr=%p " 194 "occurred in module \"%s\" due to %s", 195 type, trap_mnemonic, trap_name, (void *)rp, (void *)addr, 196 mod_containing_pc((caddr_t)rp->r_pc), 197 addr < (caddr_t)PAGESIZE ? 198 "a NULL pointer dereference" : 199 "an illegal access to a user address"); 200 } else 201 panic("BAD TRAP: type=%x (#%s %s) rp=%p addr=%p", 202 type, trap_mnemonic, trap_name, (void *)rp, (void *)addr); 203 return (0); 204 } 205 206 /* 207 * Rewrite the instruction at pc to be an int $T_SYSCALLINT instruction. 208 * 209 * int <vector> is two bytes: 0xCD <vector> 210 */ 211 212 static int 213 rewrite_syscall(caddr_t pc) 214 { 215 uchar_t instr[SLOW_SCALL_SIZE] = { 0xCD, T_SYSCALLINT }; 216 217 if (uwrite(curthread->t_procp, instr, SLOW_SCALL_SIZE, 218 (uintptr_t)pc) != 0) 219 return (1); 220 221 return (0); 222 } 223 224 /* 225 * Test to see if the instruction at pc is sysenter or syscall. The second 226 * argument should be the x86 feature flag corresponding to the expected 227 * instruction. 228 * 229 * sysenter is two bytes: 0x0F 0x34 230 * syscall is two bytes: 0x0F 0x05 231 * int $T_SYSCALLINT is two bytes: 0xCD 0x91 232 */ 233 234 static int 235 instr_is_other_syscall(caddr_t pc, int which) 236 { 237 uchar_t instr[FAST_SCALL_SIZE]; 238 239 ASSERT(which == X86_SEP || which == X86_ASYSC || which == 0xCD); 240 241 if (copyin_nowatch(pc, (caddr_t)instr, FAST_SCALL_SIZE) != 0) 242 return (0); 243 244 switch (which) { 245 case X86_SEP: 246 if (instr[0] == 0x0F && instr[1] == 0x34) 247 return (1); 248 break; 249 case X86_ASYSC: 250 if (instr[0] == 0x0F && instr[1] == 0x05) 251 return (1); 252 break; 253 case 0xCD: 254 if (instr[0] == 0xCD && instr[1] == T_SYSCALLINT) 255 return (1); 256 break; 257 } 258 259 return (0); 260 } 261 262 static const char * 263 syscall_insn_string(int syscall_insn) 264 { 265 switch (syscall_insn) { 266 case X86_SEP: 267 return ("sysenter"); 268 case X86_ASYSC: 269 return ("syscall"); 270 case 0xCD: 271 return ("int"); 272 default: 273 return ("Unknown"); 274 } 275 } 276 277 static int 278 ldt_rewrite_syscall(struct regs *rp, proc_t *p, int syscall_insn) 279 { 280 caddr_t linearpc; 281 int return_code = 0; 282 283 mutex_enter(&p->p_ldtlock); /* Must be held across linear_pc() */ 284 285 if (linear_pc(rp, p, &linearpc) == 0) { 286 287 /* 288 * If another thread beat us here, it already changed 289 * this site to the slower (int) syscall instruction. 290 */ 291 if (instr_is_other_syscall(linearpc, 0xCD)) { 292 return_code = 1; 293 } else if (instr_is_other_syscall(linearpc, syscall_insn)) { 294 295 if (rewrite_syscall(linearpc) == 0) { 296 return_code = 1; 297 } 298 #ifdef DEBUG 299 else 300 cmn_err(CE_WARN, "failed to rewrite %s " 301 "instruction in process %d", 302 syscall_insn_string(syscall_insn), 303 p->p_pid); 304 #endif /* DEBUG */ 305 } 306 } 307 308 mutex_exit(&p->p_ldtlock); /* Must be held across linear_pc() */ 309 310 return (return_code); 311 } 312 313 /* 314 * Test to see if the instruction at pc is a system call instruction. 315 * 316 * The bytes of an lcall instruction used for the syscall trap. 317 * static uchar_t lcall[7] = { 0x9a, 0, 0, 0, 0, 0x7, 0 }; 318 * static uchar_t lcallalt[7] = { 0x9a, 0, 0, 0, 0, 0x27, 0 }; 319 */ 320 321 #define LCALLSIZE 7 322 323 static int 324 instr_is_lcall_syscall(caddr_t pc) 325 { 326 uchar_t instr[LCALLSIZE]; 327 328 if (copyin_nowatch(pc, (caddr_t)instr, LCALLSIZE) == 0 && 329 instr[0] == 0x9a && 330 instr[1] == 0 && 331 instr[2] == 0 && 332 instr[3] == 0 && 333 instr[4] == 0 && 334 (instr[5] == 0x7 || instr[5] == 0x27) && 335 instr[6] == 0) 336 return (1); 337 338 return (0); 339 } 340 341 #ifdef __amd64 342 343 /* 344 * In the first revisions of amd64 CPUs produced by AMD, the LAHF and 345 * SAHF instructions were not implemented in 64-bit mode. Later revisions 346 * did implement these instructions. An extension to the cpuid instruction 347 * was added to check for the capability of executing these instructions 348 * in 64-bit mode. 349 * 350 * Intel originally did not implement these instructions in EM64T either, 351 * but added them in later revisions. 352 * 353 * So, there are different chip revisions by both vendors out there that 354 * may or may not implement these instructions. The easy solution is to 355 * just always emulate these instructions on demand. 356 * 357 * SAHF == store %ah in the lower 8 bits of %rflags (opcode 0x9e) 358 * LAHF == load the lower 8 bits of %rflags into %ah (opcode 0x9f) 359 */ 360 361 #define LSAHFSIZE 1 362 363 static int 364 instr_is_lsahf(caddr_t pc, uchar_t *instr) 365 { 366 if (copyin_nowatch(pc, (caddr_t)instr, LSAHFSIZE) == 0 && 367 (*instr == 0x9e || *instr == 0x9f)) 368 return (1); 369 return (0); 370 } 371 372 /* 373 * Emulate the LAHF and SAHF instructions. The reference manuals define 374 * these instructions to always load/store bit 1 as a 1, and bits 3 and 5 375 * as a 0. The other, defined, bits are copied (the PS_ICC bits and PS_P). 376 * 377 * Note that %ah is bits 8-15 of %rax. 378 */ 379 static void 380 emulate_lsahf(struct regs *rp, uchar_t instr) 381 { 382 if (instr == 0x9e) { 383 /* sahf. Copy bits from %ah to flags. */ 384 rp->r_ps = (rp->r_ps & ~0xff) | 385 ((rp->r_rax >> 8) & PSL_LSAHFMASK) | PS_MB1; 386 } else { 387 /* lahf. Copy bits from flags to %ah. */ 388 rp->r_rax = (rp->r_rax & ~0xff00) | 389 (((rp->r_ps & PSL_LSAHFMASK) | PS_MB1) << 8); 390 } 391 rp->r_pc += LSAHFSIZE; 392 } 393 #endif /* __amd64 */ 394 395 #ifdef OPTERON_ERRATUM_91 396 397 /* 398 * Test to see if the instruction at pc is a prefetch instruction. 399 * 400 * The first byte of prefetch instructions is always 0x0F. 401 * The second byte is 0x18 for regular prefetch or 0x0D for AMD 3dnow prefetch. 402 * The third byte is between 0 and 3 inclusive. 403 */ 404 405 #define PREFETCHSIZE 3 406 407 static int 408 cmp_to_prefetch(uchar_t *p) 409 { 410 if (*p == 0x0F && (*(p+1) == 0x18 || *(p+1) == 0x0D) && *(p+2) <= 3) 411 return (1); 412 return (0); 413 } 414 415 static int 416 instr_is_prefetch(caddr_t pc) 417 { 418 uchar_t instr[PREFETCHSIZE]; 419 int error; 420 421 error = copyin_nowatch(pc, (caddr_t)instr, PREFETCHSIZE); 422 423 if (error == 0 && cmp_to_prefetch(instr)) 424 return (1); 425 return (0); 426 } 427 428 #endif /* OPTERON_ERRATUM_91 */ 429 430 /* 431 * Called from the trap handler when a processor trap occurs. 432 * 433 * Note: All user-level traps that might call stop() must exit 434 * trap() by 'goto out' or by falling through. 435 * Note Also: trap() is usually called with interrupts enabled, (PS_IE == 1) 436 * however, there are paths that arrive here with PS_IE == 0 so special care 437 * must be taken in those cases. 438 */ 439 void 440 trap(struct regs *rp, caddr_t addr, processorid_t cpuid) 441 { 442 kthread_t *ct = curthread; 443 enum seg_rw rw; 444 unsigned type; 445 proc_t *p = ttoproc(ct); 446 klwp_t *lwp = ttolwp(ct); 447 uintptr_t lofault; 448 faultcode_t pagefault(), res, errcode; 449 enum fault_type fault_type; 450 k_siginfo_t siginfo; 451 uint_t fault = 0; 452 int mstate; 453 int sicode = 0; 454 int watchcode; 455 int watchpage; 456 caddr_t vaddr; 457 int singlestep_twiddle; 458 size_t sz; 459 int ta; 460 #ifdef __amd64 461 uchar_t instr; 462 #endif 463 464 ASSERT_STACK_ALIGNED(); 465 466 type = rp->r_trapno; 467 CPU_STATS_ADDQ(CPU, sys, trap, 1); 468 ASSERT(ct->t_schedflag & TS_DONT_SWAP); 469 470 if (type == T_PGFLT) { 471 472 errcode = rp->r_err; 473 if (errcode & PF_ERR_WRITE) 474 rw = S_WRITE; 475 else if ((caddr_t)rp->r_pc == addr || 476 (mmu.pt_nx != 0 && (errcode & PF_ERR_EXEC))) 477 rw = S_EXEC; 478 else 479 rw = S_READ; 480 481 #if defined(__i386) 482 /* 483 * Pentium Pro work-around 484 */ 485 if ((errcode & PF_ERR_PROT) && pentiumpro_bug4046376) { 486 uint_t attr; 487 uint_t priv_violation; 488 uint_t access_violation; 489 490 if (hat_getattr(addr < (caddr_t)kernelbase ? 491 curproc->p_as->a_hat : kas.a_hat, addr, &attr) 492 == -1) { 493 errcode &= ~PF_ERR_PROT; 494 } else { 495 priv_violation = (errcode & PF_ERR_USER) && 496 !(attr & PROT_USER); 497 access_violation = (errcode & PF_ERR_WRITE) && 498 !(attr & PROT_WRITE); 499 if (!priv_violation && !access_violation) 500 goto cleanup; 501 } 502 } 503 #endif /* __i386 */ 504 505 } else if (type == T_SGLSTP && lwp != NULL) 506 lwp->lwp_pcb.pcb_drstat = (uintptr_t)addr; 507 508 if (tdebug) 509 showregs(type, rp, addr); 510 511 if (USERMODE(rp->r_cs)) { 512 /* 513 * Set up the current cred to use during this trap. u_cred 514 * no longer exists. t_cred is used instead. 515 * The current process credential applies to the thread for 516 * the entire trap. If trapping from the kernel, this 517 * should already be set up. 518 */ 519 if (ct->t_cred != p->p_cred) { 520 cred_t *oldcred = ct->t_cred; 521 /* 522 * DTrace accesses t_cred in probe context. t_cred 523 * must always be either NULL, or point to a valid, 524 * allocated cred structure. 525 */ 526 ct->t_cred = crgetcred(); 527 crfree(oldcred); 528 } 529 ASSERT(lwp != NULL); 530 type |= USER; 531 ASSERT(lwptoregs(lwp) == rp); 532 lwp->lwp_state = LWP_SYS; 533 534 switch (type) { 535 case T_PGFLT + USER: 536 if ((caddr_t)rp->r_pc == addr) 537 mstate = LMS_TFAULT; 538 else 539 mstate = LMS_DFAULT; 540 break; 541 default: 542 mstate = LMS_TRAP; 543 break; 544 } 545 /* Kernel probe */ 546 TNF_PROBE_1(thread_state, "thread", /* CSTYLED */, 547 tnf_microstate, state, mstate); 548 mstate = new_mstate(ct, mstate); 549 550 bzero(&siginfo, sizeof (siginfo)); 551 } 552 553 switch (type) { 554 case T_PGFLT + USER: 555 case T_SGLSTP: 556 case T_SGLSTP + USER: 557 case T_BPTFLT + USER: 558 break; 559 560 default: 561 FTRACE_2("trap(): type=0x%lx, regs=0x%lx", 562 (ulong_t)type, (ulong_t)rp); 563 break; 564 } 565 566 switch (type) { 567 default: 568 if (type & USER) { 569 if (tudebug) 570 showregs(type, rp, (caddr_t)0); 571 printf("trap: Unknown trap type %d in user mode\n", 572 type & ~USER); 573 siginfo.si_signo = SIGILL; 574 siginfo.si_code = ILL_ILLTRP; 575 siginfo.si_addr = (caddr_t)rp->r_pc; 576 siginfo.si_trapno = type & ~USER; 577 fault = FLTILL; 578 break; 579 } else { 580 (void) die(type, rp, addr, cpuid); 581 /*NOTREACHED*/ 582 } 583 584 case T_PGFLT: /* system page fault */ 585 /* 586 * If we're under on_trap() protection (see <sys/ontrap.h>), 587 * set ot_trap and longjmp back to the on_trap() call site. 588 */ 589 if ((ct->t_ontrap != NULL) && 590 (ct->t_ontrap->ot_prot & OT_DATA_ACCESS)) { 591 ct->t_ontrap->ot_trap |= OT_DATA_ACCESS; 592 longjmp(&curthread->t_ontrap->ot_jmpbuf); 593 } 594 595 /* 596 * See if we can handle as pagefault. Save lofault 597 * across this. Here we assume that an address 598 * less than KERNELBASE is a user fault. 599 * We can do this as copy.s routines verify that the 600 * starting address is less than KERNELBASE before 601 * starting and because we know that we always have 602 * KERNELBASE mapped as invalid to serve as a "barrier". 603 */ 604 lofault = ct->t_lofault; 605 ct->t_lofault = 0; 606 607 mstate = new_mstate(ct, LMS_KFAULT); 608 609 if (addr < (caddr_t)kernelbase) { 610 res = pagefault(addr, 611 (errcode & PF_ERR_PROT)? F_PROT: F_INVAL, rw, 0); 612 if (res == FC_NOMAP && 613 addr < p->p_usrstack && 614 grow(addr)) 615 res = 0; 616 } else { 617 res = pagefault(addr, 618 (errcode & PF_ERR_PROT)? F_PROT: F_INVAL, rw, 1); 619 } 620 (void) new_mstate(ct, mstate); 621 622 /* 623 * Restore lofault. If we resolved the fault, exit. 624 * If we didn't and lofault wasn't set, die. 625 */ 626 ct->t_lofault = lofault; 627 if (res == 0) 628 goto cleanup; 629 630 #if defined(OPTERON_ERRATUM_93) && defined(_LP64) 631 if (lofault == 0 && opteron_erratum_93) { 632 /* 633 * Workaround for Opteron Erratum 93. On return from 634 * a System Managment Interrupt at a HLT instruction 635 * the %rip might be truncated to a 32 bit value. 636 * BIOS is supposed to fix this, but some don't. 637 * If this occurs we simply restore the high order bits. 638 * The HLT instruction is 1 byte of 0xf4. 639 */ 640 uintptr_t rip = rp->r_pc; 641 642 if ((rip & 0xfffffffful) == rip) { 643 rip |= 0xfffffffful << 32; 644 if (hat_getpfnum(kas.a_hat, (caddr_t)rip) != 645 PFN_INVALID && 646 (*(uchar_t *)rip == 0xf4 || 647 *(uchar_t *)(rip - 1) == 0xf4)) { 648 rp->r_pc = rip; 649 goto cleanup; 650 } 651 } 652 } 653 #endif /* OPTERON_ERRATUM_93 && _LP64 */ 654 655 #ifdef OPTERON_ERRATUM_91 656 if (lofault == 0 && opteron_erratum_91) { 657 /* 658 * Workaround for Opteron Erratum 91. Prefetches may 659 * generate a page fault (they're not supposed to do 660 * that!). If this occurs we simply return back to the 661 * instruction. 662 */ 663 caddr_t pc = (caddr_t)rp->r_pc; 664 665 /* 666 * If the faulting PC is not mapped, this is a 667 * legitimate kernel page fault that must result in a 668 * panic. If the faulting PC is mapped, it could contain 669 * a prefetch instruction. Check for that here. 670 */ 671 if (hat_getpfnum(kas.a_hat, pc) != PFN_INVALID) { 672 if (cmp_to_prefetch((uchar_t *)pc)) { 673 #ifdef DEBUG 674 cmn_err(CE_WARN, "Opteron erratum 91 " 675 "occurred: kernel prefetch" 676 " at %p generated a page fault!", 677 (void *)rp->r_pc); 678 #endif /* DEBUG */ 679 goto cleanup; 680 } 681 } 682 (void) die(type, rp, addr, cpuid); 683 } 684 #endif /* OPTERON_ERRATUM_91 */ 685 686 if (lofault == 0) 687 (void) die(type, rp, addr, cpuid); 688 689 /* 690 * Cannot resolve fault. Return to lofault. 691 */ 692 if (lodebug) { 693 showregs(type, rp, addr); 694 traceregs(rp); 695 } 696 if (FC_CODE(res) == FC_OBJERR) 697 res = FC_ERRNO(res); 698 else 699 res = EFAULT; 700 rp->r_r0 = res; 701 rp->r_pc = ct->t_lofault; 702 goto cleanup; 703 704 case T_PGFLT + USER: /* user page fault */ 705 if (faultdebug) { 706 char *fault_str; 707 708 switch (rw) { 709 case S_READ: 710 fault_str = "read"; 711 break; 712 case S_WRITE: 713 fault_str = "write"; 714 break; 715 case S_EXEC: 716 fault_str = "exec"; 717 break; 718 default: 719 fault_str = ""; 720 break; 721 } 722 printf("user %s fault: addr=0x%lx errcode=0x%x\n", 723 fault_str, (uintptr_t)addr, errcode); 724 } 725 726 #if defined(OPTERON_ERRATUM_100) && defined(_LP64) 727 /* 728 * Workaround for AMD erratum 100 729 * 730 * A 32-bit process may receive a page fault on a non 731 * 32-bit address by mistake. The range of the faulting 732 * address will be 733 * 734 * 0xffffffff80000000 .. 0xffffffffffffffff or 735 * 0x0000000100000000 .. 0x000000017fffffff 736 * 737 * The fault is always due to an instruction fetch, however 738 * the value of r_pc should be correct (in 32 bit range), 739 * so we ignore the page fault on the bogus address. 740 */ 741 if (p->p_model == DATAMODEL_ILP32 && 742 (0xffffffff80000000 <= (uintptr_t)addr || 743 (0x100000000 <= (uintptr_t)addr && 744 (uintptr_t)addr <= 0x17fffffff))) { 745 if (!opteron_erratum_100) 746 panic("unexpected erratum #100"); 747 if (rp->r_pc <= 0xffffffff) 748 goto out; 749 } 750 #endif /* OPTERON_ERRATUM_100 && _LP64 */ 751 752 ASSERT(!(curthread->t_flag & T_WATCHPT)); 753 watchpage = (pr_watch_active(p) && pr_is_watchpage(addr, rw)); 754 #ifdef __i386 755 /* 756 * In 32-bit mode, the lcall (system call) instruction fetches 757 * one word from the stack, at the stack pointer, because of the 758 * way the call gate is constructed. This is a bogus 759 * read and should not be counted as a read watchpoint. 760 * We work around the problem here by testing to see if 761 * this situation applies and, if so, simply jumping to 762 * the code in locore.s that fields the system call trap. 763 * The registers on the stack are already set up properly 764 * due to the match between the call gate sequence and the 765 * trap gate sequence. We just have to adjust the pc. 766 */ 767 if (watchpage && addr == (caddr_t)rp->r_sp && 768 rw == S_READ && instr_is_lcall_syscall((caddr_t)rp->r_pc)) { 769 extern void watch_syscall(void); 770 771 rp->r_pc += LCALLSIZE; 772 watch_syscall(); /* never returns */ 773 /* NOTREACHED */ 774 } 775 #endif /* __i386 */ 776 vaddr = addr; 777 if (!watchpage || (sz = instr_size(rp, &vaddr, rw)) <= 0) 778 fault_type = (errcode & PF_ERR_PROT)? F_PROT: F_INVAL; 779 else if ((watchcode = pr_is_watchpoint(&vaddr, &ta, 780 sz, NULL, rw)) != 0) { 781 if (ta) { 782 do_watch_step(vaddr, sz, rw, 783 watchcode, rp->r_pc); 784 fault_type = F_INVAL; 785 } else { 786 bzero(&siginfo, sizeof (siginfo)); 787 siginfo.si_signo = SIGTRAP; 788 siginfo.si_code = watchcode; 789 siginfo.si_addr = vaddr; 790 siginfo.si_trapafter = 0; 791 siginfo.si_pc = (caddr_t)rp->r_pc; 792 fault = FLTWATCH; 793 break; 794 } 795 } else { 796 /* XXX pr_watch_emul() never succeeds (for now) */ 797 if (rw != S_EXEC && pr_watch_emul(rp, vaddr, rw)) 798 goto out; 799 do_watch_step(vaddr, sz, rw, 0, 0); 800 fault_type = F_INVAL; 801 } 802 803 res = pagefault(addr, fault_type, rw, 0); 804 805 /* 806 * If pagefault() succeeded, ok. 807 * Otherwise attempt to grow the stack. 808 */ 809 if (res == 0 || 810 (res == FC_NOMAP && 811 addr < p->p_usrstack && 812 grow(addr))) { 813 lwp->lwp_lastfault = FLTPAGE; 814 lwp->lwp_lastfaddr = addr; 815 if (prismember(&p->p_fltmask, FLTPAGE)) { 816 bzero(&siginfo, sizeof (siginfo)); 817 siginfo.si_addr = addr; 818 (void) stop_on_fault(FLTPAGE, &siginfo); 819 } 820 goto out; 821 } else if (res == FC_PROT && addr < p->p_usrstack && 822 (mmu.pt_nx != 0 && (errcode & PF_ERR_EXEC))) { 823 report_stack_exec(p, addr); 824 } 825 826 #ifdef OPTERON_ERRATUM_91 827 /* 828 * Workaround for Opteron Erratum 91. Prefetches may generate a 829 * page fault (they're not supposed to do that!). If this 830 * occurs we simply return back to the instruction. 831 * 832 * We rely on copyin to properly fault in the page with r_pc. 833 */ 834 if (opteron_erratum_91 && 835 addr != (caddr_t)rp->r_pc && 836 instr_is_prefetch((caddr_t)rp->r_pc)) { 837 #ifdef DEBUG 838 cmn_err(CE_WARN, "Opteron erratum 91 occurred: " 839 "prefetch at %p in pid %d generated a trap!", 840 (void *)rp->r_pc, p->p_pid); 841 #endif /* DEBUG */ 842 goto out; 843 } 844 #endif /* OPTERON_ERRATUM_91 */ 845 846 if (tudebug) 847 showregs(type, rp, addr); 848 /* 849 * In the case where both pagefault and grow fail, 850 * set the code to the value provided by pagefault. 851 * We map all errors returned from pagefault() to SIGSEGV. 852 */ 853 bzero(&siginfo, sizeof (siginfo)); 854 siginfo.si_addr = addr; 855 switch (FC_CODE(res)) { 856 case FC_HWERR: 857 case FC_NOSUPPORT: 858 siginfo.si_signo = SIGBUS; 859 siginfo.si_code = BUS_ADRERR; 860 fault = FLTACCESS; 861 break; 862 case FC_ALIGN: 863 siginfo.si_signo = SIGBUS; 864 siginfo.si_code = BUS_ADRALN; 865 fault = FLTACCESS; 866 break; 867 case FC_OBJERR: 868 if ((siginfo.si_errno = FC_ERRNO(res)) != EINTR) { 869 siginfo.si_signo = SIGBUS; 870 siginfo.si_code = BUS_OBJERR; 871 fault = FLTACCESS; 872 } 873 break; 874 default: /* FC_NOMAP or FC_PROT */ 875 siginfo.si_signo = SIGSEGV; 876 siginfo.si_code = 877 (res == FC_NOMAP)? SEGV_MAPERR : SEGV_ACCERR; 878 fault = FLTBOUNDS; 879 break; 880 } 881 break; 882 883 case T_ILLINST + USER: /* invalid opcode fault */ 884 /* 885 * If the syscall instruction is disabled due to LDT usage, a 886 * user program that attempts to execute it will trigger a #ud 887 * trap. Check for that case here. If this occurs on a CPU which 888 * doesn't even support syscall, the result of all of this will 889 * be to emulate that particular instruction. 890 */ 891 if (p->p_ldt != NULL && 892 ldt_rewrite_syscall(rp, p, X86_ASYSC)) 893 goto out; 894 895 #ifdef __amd64 896 /* 897 * Emulate the LAHF and SAHF instructions if needed. 898 * See the instr_is_lsahf function for details. 899 */ 900 if (p->p_model == DATAMODEL_LP64 && 901 instr_is_lsahf((caddr_t)rp->r_pc, &instr)) { 902 emulate_lsahf(rp, instr); 903 goto out; 904 } 905 #endif 906 907 /*FALLTHROUGH*/ 908 909 if (tudebug) 910 showregs(type, rp, (caddr_t)0); 911 siginfo.si_signo = SIGILL; 912 siginfo.si_code = ILL_ILLOPC; 913 siginfo.si_addr = (caddr_t)rp->r_pc; 914 fault = FLTILL; 915 break; 916 917 case T_ZERODIV + USER: /* integer divide by zero */ 918 if (tudebug && tudebugfpe) 919 showregs(type, rp, (caddr_t)0); 920 siginfo.si_signo = SIGFPE; 921 siginfo.si_code = FPE_INTDIV; 922 siginfo.si_addr = (caddr_t)rp->r_pc; 923 fault = FLTIZDIV; 924 break; 925 926 case T_OVFLW + USER: /* integer overflow */ 927 if (tudebug && tudebugfpe) 928 showregs(type, rp, (caddr_t)0); 929 siginfo.si_signo = SIGFPE; 930 siginfo.si_code = FPE_INTOVF; 931 siginfo.si_addr = (caddr_t)rp->r_pc; 932 fault = FLTIOVF; 933 break; 934 935 case T_NOEXTFLT + USER: /* math coprocessor not available */ 936 if (tudebug && tudebugfpe) 937 showregs(type, rp, addr); 938 if (fpnoextflt(rp)) { 939 siginfo.si_signo = SIGFPE; 940 siginfo.si_code = ILL_ILLOPC; 941 siginfo.si_addr = (caddr_t)rp->r_pc; 942 fault = FLTFPE; 943 } 944 break; 945 946 case T_EXTOVRFLT: /* extension overrun fault */ 947 /* check if we took a kernel trap on behalf of user */ 948 { 949 extern void ndptrap_frstor(void); 950 if (rp->r_pc != (uintptr_t)ndptrap_frstor) 951 (void) die(type, rp, addr, cpuid); 952 type |= USER; 953 } 954 /*FALLTHROUGH*/ 955 case T_EXTOVRFLT + USER: /* extension overrun fault */ 956 if (tudebug && tudebugfpe) 957 showregs(type, rp, addr); 958 if (fpextovrflt(rp)) { 959 siginfo.si_signo = SIGSEGV; 960 siginfo.si_code = SEGV_MAPERR; 961 siginfo.si_addr = (caddr_t)rp->r_pc; 962 fault = FLTBOUNDS; 963 } 964 break; 965 966 case T_EXTERRFLT: /* x87 floating point exception pending */ 967 /* check if we took a kernel trap on behalf of user */ 968 { 969 extern void ndptrap_frstor(void); 970 if (rp->r_pc != (uintptr_t)ndptrap_frstor) 971 (void) die(type, rp, addr, cpuid); 972 type |= USER; 973 } 974 /*FALLTHROUGH*/ 975 976 case T_EXTERRFLT + USER: /* x87 floating point exception pending */ 977 if (tudebug && tudebugfpe) 978 showregs(type, rp, addr); 979 if (sicode = fpexterrflt(rp)) { 980 siginfo.si_signo = SIGFPE; 981 siginfo.si_code = sicode; 982 siginfo.si_addr = (caddr_t)rp->r_pc; 983 fault = FLTFPE; 984 } 985 break; 986 987 case T_SIMDFPE + USER: /* SSE and SSE2 exceptions */ 988 if (tudebug && tudebugsse) 989 showregs(type, rp, addr); 990 if ((x86_feature & (X86_SSE|X86_SSE2)) == 0) { 991 /* 992 * There are rumours that some user instructions 993 * on older CPUs can cause this trap to occur; in 994 * which case send a SIGILL instead of a SIGFPE. 995 */ 996 siginfo.si_signo = SIGILL; 997 siginfo.si_code = ILL_ILLTRP; 998 siginfo.si_addr = (caddr_t)rp->r_pc; 999 siginfo.si_trapno = type & ~USER; 1000 fault = FLTILL; 1001 } else if ((sicode = fpsimderrflt(rp)) != 0) { 1002 siginfo.si_signo = SIGFPE; 1003 siginfo.si_code = sicode; 1004 siginfo.si_addr = (caddr_t)rp->r_pc; 1005 fault = FLTFPE; 1006 } 1007 break; 1008 1009 case T_BPTFLT: /* breakpoint trap */ 1010 /* 1011 * Kernel breakpoint traps should only happen when kmdb is 1012 * active, and even then, it'll have interposed on the IDT, so 1013 * control won't get here. If it does, we've hit a breakpoint 1014 * without the debugger, which is very strange, and very 1015 * fatal. 1016 */ 1017 if (tudebug && tudebugbpt) 1018 showregs(type, rp, (caddr_t)0); 1019 1020 (void) die(type, rp, addr, cpuid); 1021 break; 1022 1023 case T_SGLSTP: /* single step/hw breakpoint exception */ 1024 1025 /* Now evaluate how we got here */ 1026 if (lwp != NULL && (lwp->lwp_pcb.pcb_drstat & DR_SINGLESTEP)) { 1027 /* 1028 * i386 single-steps even through lcalls which 1029 * change the privilege level. So we take a trap at 1030 * the first instruction in privileged mode. 1031 * 1032 * Set a flag to indicate that upon completion of 1033 * the system call, deal with the single-step trap. 1034 * 1035 * The same thing happens for sysenter, too. 1036 */ 1037 singlestep_twiddle = 0; 1038 if (rp->r_pc == (uintptr_t)sys_sysenter || 1039 rp->r_pc == (uintptr_t)brand_sys_sysenter) { 1040 singlestep_twiddle = 1; 1041 #if defined(__amd64) 1042 /* 1043 * Since we are already on the kernel's 1044 * %gs, on 64-bit systems the sysenter case 1045 * needs to adjust the pc to avoid 1046 * executing the swapgs instruction at the 1047 * top of the handler. 1048 */ 1049 if (rp->r_pc == (uintptr_t)sys_sysenter) 1050 rp->r_pc = (uintptr_t) 1051 _sys_sysenter_post_swapgs; 1052 else 1053 rp->r_pc = (uintptr_t) 1054 _brand_sys_sysenter_post_swapgs; 1055 #endif 1056 } 1057 #if defined(__i386) 1058 else if (rp->r_pc == (uintptr_t)sys_call || 1059 rp->r_pc == (uintptr_t)brand_sys_call) { 1060 singlestep_twiddle = 1; 1061 } 1062 #endif 1063 else { 1064 /* not on sysenter/syscall; uregs available */ 1065 if (tudebug && tudebugbpt) 1066 showregs(type, rp, (caddr_t)0); 1067 } 1068 if (singlestep_twiddle) { 1069 rp->r_ps &= ~PS_T; /* turn off trace */ 1070 lwp->lwp_pcb.pcb_flags |= DEBUG_PENDING; 1071 ct->t_post_sys = 1; 1072 aston(curthread); 1073 goto cleanup; 1074 } 1075 } 1076 /* XXX - needs review on debugger interface? */ 1077 if (boothowto & RB_DEBUG) 1078 debug_enter((char *)NULL); 1079 else 1080 (void) die(type, rp, addr, cpuid); 1081 break; 1082 1083 case T_NMIFLT: /* NMI interrupt */ 1084 printf("Unexpected NMI in system mode\n"); 1085 goto cleanup; 1086 1087 case T_NMIFLT + USER: /* NMI interrupt */ 1088 printf("Unexpected NMI in user mode\n"); 1089 break; 1090 1091 case T_GPFLT: /* general protection violation */ 1092 #if defined(__amd64) 1093 /* 1094 * On amd64, we can get a #gp from referencing addresses 1095 * in the virtual address hole e.g. from a copyin 1096 * or in update_sregs while updating user semgent registers. 1097 */ 1098 1099 /* 1100 * If we're under on_trap() protection (see <sys/ontrap.h>), 1101 * set ot_trap and longjmp back to the on_trap() call site. 1102 */ 1103 if (ct->t_ontrap != NULL) { 1104 if (ct->t_ontrap->ot_prot & OT_DATA_ACCESS) 1105 ct->t_ontrap->ot_trap |= OT_DATA_ACCESS; 1106 1107 if (ct->t_ontrap->ot_prot & OT_SEGMENT_ACCESS) 1108 ct->t_ontrap->ot_trap |= OT_SEGMENT_ACCESS; 1109 longjmp(&curthread->t_ontrap->ot_jmpbuf); 1110 } 1111 1112 /* 1113 * If we're under lofault protection (copyin etc.), 1114 * longjmp back to lofault with an EFAULT. 1115 */ 1116 if (ct->t_lofault) { 1117 /* 1118 * Fault is not resolvable, so just return to lofault 1119 */ 1120 if (lodebug) { 1121 showregs(type, rp, addr); 1122 traceregs(rp); 1123 } 1124 rp->r_r0 = EFAULT; 1125 rp->r_pc = ct->t_lofault; 1126 goto cleanup; 1127 } 1128 /*FALLTHROUGH*/ 1129 #endif 1130 case T_SEGFLT: /* segment not present fault */ 1131 #if defined(__amd64) 1132 /* 1133 * One example of this is #NP in update_sregs while 1134 * attempting to update a user segment register 1135 * that points to a descriptor that is marked not 1136 * present. 1137 */ 1138 if (ct->t_ontrap != NULL && 1139 ct->t_ontrap->ot_prot & OT_SEGMENT_ACCESS) { 1140 ct->t_ontrap->ot_trap |= OT_SEGMENT_ACCESS; 1141 longjmp(&curthread->t_ontrap->ot_jmpbuf); 1142 } 1143 #endif /* __amd64 */ 1144 /*FALLTHROUGH*/ 1145 case T_STKFLT: /* stack fault */ 1146 case T_TSSFLT: /* invalid TSS fault */ 1147 if (tudebug) 1148 showregs(type, rp, (caddr_t)0); 1149 if (kern_gpfault(rp)) 1150 (void) die(type, rp, addr, cpuid); 1151 goto cleanup; 1152 /*FALLTHROUGH*/ 1153 1154 /* 1155 * ONLY 32-bit PROCESSES can USE a PRIVATE LDT! 64-bit apps 1156 * should have no need for them, so we put a stop to it here. 1157 * 1158 * So: not-present fault is ONLY valid for 32-bit processes with 1159 * a private LDT trying to do a system call. Emulate it. 1160 * 1161 * #gp fault is ONLY valid for 32-bit processes also, which DO NOT 1162 * have a private LDT, and are trying to do a system call. Emulate it. 1163 */ 1164 1165 case T_SEGFLT + USER: /* segment not present fault */ 1166 case T_GPFLT + USER: /* general protection violation */ 1167 #ifdef _SYSCALL32_IMPL 1168 if (p->p_model != DATAMODEL_NATIVE) { 1169 #endif /* _SYSCALL32_IMPL */ 1170 if (instr_is_lcall_syscall((caddr_t)rp->r_pc)) { 1171 if (type == T_SEGFLT + USER) 1172 ASSERT(p->p_ldt != NULL); 1173 1174 if ((p->p_ldt == NULL && type == T_GPFLT + USER) || 1175 type == T_SEGFLT + USER) { 1176 1177 /* 1178 * The user attempted a system call via the obsolete 1179 * call gate mechanism. Because the process doesn't have 1180 * an LDT (i.e. the ldtr contains 0), a #gp results. 1181 * Emulate the syscall here, just as we do above for a 1182 * #np trap. 1183 */ 1184 1185 /* 1186 * Since this is a not-present trap, rp->r_pc points to 1187 * the trapping lcall instruction. We need to bump it 1188 * to the next insn so the app can continue on. 1189 */ 1190 rp->r_pc += LCALLSIZE; 1191 lwp->lwp_regs = rp; 1192 1193 /* 1194 * Normally the microstate of the LWP is forced back to 1195 * LMS_USER by the syscall handlers. Emulate that 1196 * behavior here. 1197 */ 1198 mstate = LMS_USER; 1199 1200 dosyscall(); 1201 goto out; 1202 } 1203 } 1204 #ifdef _SYSCALL32_IMPL 1205 } 1206 #endif /* _SYSCALL32_IMPL */ 1207 /* 1208 * If the current process is using a private LDT and the 1209 * trapping instruction is sysenter, the sysenter instruction 1210 * has been disabled on the CPU because it destroys segment 1211 * registers. If this is the case, rewrite the instruction to 1212 * be a safe system call and retry it. If this occurs on a CPU 1213 * which doesn't even support sysenter, the result of all of 1214 * this will be to emulate that particular instruction. 1215 */ 1216 if (p->p_ldt != NULL && 1217 ldt_rewrite_syscall(rp, p, X86_SEP)) 1218 goto out; 1219 1220 /*FALLTHROUGH*/ 1221 1222 case T_BOUNDFLT + USER: /* bound fault */ 1223 case T_STKFLT + USER: /* stack fault */ 1224 case T_TSSFLT + USER: /* invalid TSS fault */ 1225 if (tudebug) 1226 showregs(type, rp, (caddr_t)0); 1227 siginfo.si_signo = SIGSEGV; 1228 siginfo.si_code = SEGV_MAPERR; 1229 siginfo.si_addr = (caddr_t)rp->r_pc; 1230 fault = FLTBOUNDS; 1231 break; 1232 1233 case T_ALIGNMENT + USER: /* user alignment error (486) */ 1234 if (tudebug) 1235 showregs(type, rp, (caddr_t)0); 1236 bzero(&siginfo, sizeof (siginfo)); 1237 siginfo.si_signo = SIGBUS; 1238 siginfo.si_code = BUS_ADRALN; 1239 siginfo.si_addr = (caddr_t)rp->r_pc; 1240 fault = FLTACCESS; 1241 break; 1242 1243 case T_SGLSTP + USER: /* single step/hw breakpoint exception */ 1244 if (tudebug && tudebugbpt) 1245 showregs(type, rp, (caddr_t)0); 1246 1247 /* Was it single-stepping? */ 1248 if (lwp->lwp_pcb.pcb_drstat & DR_SINGLESTEP) { 1249 pcb_t *pcb = &lwp->lwp_pcb; 1250 1251 rp->r_ps &= ~PS_T; 1252 /* 1253 * If both NORMAL_STEP and WATCH_STEP are in effect, 1254 * give precedence to WATCH_STEP. If neither is set, 1255 * user must have set the PS_T bit in %efl; treat this 1256 * as NORMAL_STEP. 1257 */ 1258 if ((fault = undo_watch_step(&siginfo)) == 0 && 1259 ((pcb->pcb_flags & NORMAL_STEP) || 1260 !(pcb->pcb_flags & WATCH_STEP))) { 1261 siginfo.si_signo = SIGTRAP; 1262 siginfo.si_code = TRAP_TRACE; 1263 siginfo.si_addr = (caddr_t)rp->r_pc; 1264 fault = FLTTRACE; 1265 } 1266 pcb->pcb_flags &= ~(NORMAL_STEP|WATCH_STEP); 1267 } else { 1268 cmn_err(CE_WARN, 1269 "Unexpected INT 1 in user mode, dr6=%lx", 1270 lwp->lwp_pcb.pcb_drstat); 1271 } 1272 break; 1273 1274 case T_BPTFLT + USER: /* breakpoint trap */ 1275 if (tudebug && tudebugbpt) 1276 showregs(type, rp, (caddr_t)0); 1277 /* 1278 * int 3 (the breakpoint instruction) leaves the pc referring 1279 * to the address one byte after the breakpointed address. 1280 * If the P_PR_BPTADJ flag has been set via /proc, We adjust 1281 * it back so it refers to the breakpointed address. 1282 */ 1283 if (p->p_proc_flag & P_PR_BPTADJ) 1284 rp->r_pc--; 1285 siginfo.si_signo = SIGTRAP; 1286 siginfo.si_code = TRAP_BRKPT; 1287 siginfo.si_addr = (caddr_t)rp->r_pc; 1288 fault = FLTBPT; 1289 break; 1290 1291 case T_AST: 1292 /* 1293 * This occurs only after the cs register has been made to 1294 * look like a kernel selector, either through debugging or 1295 * possibly by functions like setcontext(). The thread is 1296 * about to cause a general protection fault at common_iret() 1297 * in locore. We let that happen immediately instead of 1298 * doing the T_AST processing. 1299 */ 1300 goto cleanup; 1301 1302 case T_AST + USER: /* profiling or resched pseudo trap */ 1303 if (lwp->lwp_pcb.pcb_flags & CPC_OVERFLOW) { 1304 lwp->lwp_pcb.pcb_flags &= ~CPC_OVERFLOW; 1305 if (kcpc_overflow_ast()) { 1306 /* 1307 * Signal performance counter overflow 1308 */ 1309 if (tudebug) 1310 showregs(type, rp, (caddr_t)0); 1311 bzero(&siginfo, sizeof (siginfo)); 1312 siginfo.si_signo = SIGEMT; 1313 siginfo.si_code = EMT_CPCOVF; 1314 siginfo.si_addr = (caddr_t)rp->r_pc; 1315 fault = FLTCPCOVF; 1316 } 1317 } 1318 break; 1319 } 1320 1321 /* 1322 * We can't get here from a system trap 1323 */ 1324 ASSERT(type & USER); 1325 1326 if (fault) { 1327 /* We took a fault so abort single step. */ 1328 lwp->lwp_pcb.pcb_flags &= ~(NORMAL_STEP|WATCH_STEP); 1329 /* 1330 * Remember the fault and fault adddress 1331 * for real-time (SIGPROF) profiling. 1332 */ 1333 lwp->lwp_lastfault = fault; 1334 lwp->lwp_lastfaddr = siginfo.si_addr; 1335 1336 DTRACE_PROC2(fault, int, fault, ksiginfo_t *, &siginfo); 1337 1338 /* 1339 * If a debugger has declared this fault to be an 1340 * event of interest, stop the lwp. Otherwise just 1341 * deliver the associated signal. 1342 */ 1343 if (siginfo.si_signo != SIGKILL && 1344 prismember(&p->p_fltmask, fault) && 1345 stop_on_fault(fault, &siginfo) == 0) 1346 siginfo.si_signo = 0; 1347 } 1348 1349 if (siginfo.si_signo) 1350 trapsig(&siginfo, (fault == FLTCPCOVF)? 0 : 1); 1351 1352 if (lwp->lwp_oweupc) 1353 profil_tick(rp->r_pc); 1354 1355 if (ct->t_astflag | ct->t_sig_check) { 1356 /* 1357 * Turn off the AST flag before checking all the conditions that 1358 * may have caused an AST. This flag is on whenever a signal or 1359 * unusual condition should be handled after the next trap or 1360 * syscall. 1361 */ 1362 astoff(ct); 1363 /* 1364 * If a single-step trap occurred on a syscall (see above) 1365 * recognize it now. Do this before checking for signals 1366 * because deferred_singlestep_trap() may generate a SIGTRAP to 1367 * the LWP or may otherwise mark the LWP to call issig(FORREAL). 1368 */ 1369 if (lwp->lwp_pcb.pcb_flags & DEBUG_PENDING) 1370 deferred_singlestep_trap((caddr_t)rp->r_pc); 1371 1372 ct->t_sig_check = 0; 1373 1374 mutex_enter(&p->p_lock); 1375 if (curthread->t_proc_flag & TP_CHANGEBIND) { 1376 timer_lwpbind(); 1377 curthread->t_proc_flag &= ~TP_CHANGEBIND; 1378 } 1379 mutex_exit(&p->p_lock); 1380 1381 /* 1382 * for kaio requests that are on the per-process poll queue, 1383 * aiop->aio_pollq, they're AIO_POLL bit is set, the kernel 1384 * should copyout their result_t to user memory. by copying 1385 * out the result_t, the user can poll on memory waiting 1386 * for the kaio request to complete. 1387 */ 1388 if (p->p_aio) 1389 aio_cleanup(0); 1390 /* 1391 * If this LWP was asked to hold, call holdlwp(), which will 1392 * stop. holdlwps() sets this up and calls pokelwps() which 1393 * sets the AST flag. 1394 * 1395 * Also check TP_EXITLWP, since this is used by fresh new LWPs 1396 * through lwp_rtt(). That flag is set if the lwp_create(2) 1397 * syscall failed after creating the LWP. 1398 */ 1399 if (ISHOLD(p)) 1400 holdlwp(); 1401 1402 /* 1403 * All code that sets signals and makes ISSIG evaluate true must 1404 * set t_astflag afterwards. 1405 */ 1406 if (ISSIG_PENDING(ct, lwp, p)) { 1407 if (issig(FORREAL)) 1408 psig(); 1409 ct->t_sig_check = 1; 1410 } 1411 1412 if (ct->t_rprof != NULL) { 1413 realsigprof(0, 0); 1414 ct->t_sig_check = 1; 1415 } 1416 1417 /* 1418 * /proc can't enable/disable the trace bit itself 1419 * because that could race with the call gate used by 1420 * system calls via "lcall". If that happened, an 1421 * invalid EFLAGS would result. prstep()/prnostep() 1422 * therefore schedule an AST for the purpose. 1423 */ 1424 if (lwp->lwp_pcb.pcb_flags & REQUEST_STEP) { 1425 lwp->lwp_pcb.pcb_flags &= ~REQUEST_STEP; 1426 rp->r_ps |= PS_T; 1427 } 1428 if (lwp->lwp_pcb.pcb_flags & REQUEST_NOSTEP) { 1429 lwp->lwp_pcb.pcb_flags &= ~REQUEST_NOSTEP; 1430 rp->r_ps &= ~PS_T; 1431 } 1432 } 1433 1434 out: /* We can't get here from a system trap */ 1435 ASSERT(type & USER); 1436 1437 if (ISHOLD(p)) 1438 holdlwp(); 1439 1440 /* 1441 * Set state to LWP_USER here so preempt won't give us a kernel 1442 * priority if it occurs after this point. Call CL_TRAPRET() to 1443 * restore the user-level priority. 1444 * 1445 * It is important that no locks (other than spinlocks) be entered 1446 * after this point before returning to user mode (unless lwp_state 1447 * is set back to LWP_SYS). 1448 */ 1449 lwp->lwp_state = LWP_USER; 1450 1451 if (ct->t_trapret) { 1452 ct->t_trapret = 0; 1453 thread_lock(ct); 1454 CL_TRAPRET(ct); 1455 thread_unlock(ct); 1456 } 1457 if (CPU->cpu_runrun || curthread->t_schedflag & TS_ANYWAITQ) 1458 preempt(); 1459 (void) new_mstate(ct, mstate); 1460 1461 /* Kernel probe */ 1462 TNF_PROBE_1(thread_state, "thread", /* CSTYLED */, 1463 tnf_microstate, state, LMS_USER); 1464 1465 return; 1466 1467 cleanup: /* system traps end up here */ 1468 ASSERT(!(type & USER)); 1469 } 1470 1471 /* 1472 * Patch non-zero to disable preemption of threads in the kernel. 1473 */ 1474 int IGNORE_KERNEL_PREEMPTION = 0; /* XXX - delete this someday */ 1475 1476 struct kpreempt_cnts { /* kernel preemption statistics */ 1477 int kpc_idle; /* executing idle thread */ 1478 int kpc_intr; /* executing interrupt thread */ 1479 int kpc_clock; /* executing clock thread */ 1480 int kpc_blocked; /* thread has blocked preemption (t_preempt) */ 1481 int kpc_notonproc; /* thread is surrendering processor */ 1482 int kpc_inswtch; /* thread has ratified scheduling decision */ 1483 int kpc_prilevel; /* processor interrupt level is too high */ 1484 int kpc_apreempt; /* asynchronous preemption */ 1485 int kpc_spreempt; /* synchronous preemption */ 1486 } kpreempt_cnts; 1487 1488 /* 1489 * kernel preemption: forced rescheduling, preempt the running kernel thread. 1490 * the argument is old PIL for an interrupt, 1491 * or the distingished value KPREEMPT_SYNC. 1492 */ 1493 void 1494 kpreempt(int asyncspl) 1495 { 1496 kthread_t *ct = curthread; 1497 1498 if (IGNORE_KERNEL_PREEMPTION) { 1499 aston(CPU->cpu_dispthread); 1500 return; 1501 } 1502 1503 /* 1504 * Check that conditions are right for kernel preemption 1505 */ 1506 do { 1507 if (ct->t_preempt) { 1508 /* 1509 * either a privileged thread (idle, panic, interrupt) 1510 * or will check when t_preempt is lowered 1511 */ 1512 if (ct->t_pri < 0) 1513 kpreempt_cnts.kpc_idle++; 1514 else if (ct->t_flag & T_INTR_THREAD) { 1515 kpreempt_cnts.kpc_intr++; 1516 if (ct->t_pil == CLOCK_LEVEL) 1517 kpreempt_cnts.kpc_clock++; 1518 } else 1519 kpreempt_cnts.kpc_blocked++; 1520 aston(CPU->cpu_dispthread); 1521 return; 1522 } 1523 if (ct->t_state != TS_ONPROC || 1524 ct->t_disp_queue != CPU->cpu_disp) { 1525 /* this thread will be calling swtch() shortly */ 1526 kpreempt_cnts.kpc_notonproc++; 1527 if (CPU->cpu_thread != CPU->cpu_dispthread) { 1528 /* already in swtch(), force another */ 1529 kpreempt_cnts.kpc_inswtch++; 1530 siron(); 1531 } 1532 return; 1533 } 1534 if (getpil() >= DISP_LEVEL) { 1535 /* 1536 * We can't preempt this thread if it is at 1537 * a PIL >= DISP_LEVEL since it may be holding 1538 * a spin lock (like sched_lock). 1539 */ 1540 siron(); /* check back later */ 1541 kpreempt_cnts.kpc_prilevel++; 1542 return; 1543 } 1544 if (!interrupts_enabled()) { 1545 /* 1546 * Can't preempt while running with ints disabled 1547 */ 1548 kpreempt_cnts.kpc_prilevel++; 1549 return; 1550 } 1551 if (asyncspl != KPREEMPT_SYNC) 1552 kpreempt_cnts.kpc_apreempt++; 1553 else 1554 kpreempt_cnts.kpc_spreempt++; 1555 1556 ct->t_preempt++; 1557 preempt(); 1558 ct->t_preempt--; 1559 } while (CPU->cpu_kprunrun); 1560 } 1561 1562 /* 1563 * Print out debugging info. 1564 */ 1565 static void 1566 showregs(uint_t type, struct regs *rp, caddr_t addr) 1567 { 1568 int s; 1569 1570 s = spl7(); 1571 type &= ~USER; 1572 if (PTOU(curproc)->u_comm[0]) 1573 printf("%s: ", PTOU(curproc)->u_comm); 1574 if (type < TRAP_TYPES) 1575 printf("#%s %s\n", trap_type_mnemonic[type], trap_type[type]); 1576 else 1577 switch (type) { 1578 case T_SYSCALL: 1579 printf("Syscall Trap:\n"); 1580 break; 1581 case T_AST: 1582 printf("AST\n"); 1583 break; 1584 default: 1585 printf("Bad Trap = %d\n", type); 1586 break; 1587 } 1588 if (type == T_PGFLT) { 1589 printf("Bad %s fault at addr=0x%lx\n", 1590 USERMODE(rp->r_cs) ? "user": "kernel", (uintptr_t)addr); 1591 } else if (addr) { 1592 printf("addr=0x%lx\n", (uintptr_t)addr); 1593 } 1594 1595 printf("pid=%d, pc=0x%lx, sp=0x%lx, eflags=0x%lx\n", 1596 (ttoproc(curthread) && ttoproc(curthread)->p_pidp) ? 1597 ttoproc(curthread)->p_pid : 0, rp->r_pc, rp->r_sp, rp->r_ps); 1598 1599 #if defined(__lint) 1600 /* 1601 * this clause can be deleted when lint bug 4870403 is fixed 1602 * (lint thinks that bit 32 is illegal in a %b format string) 1603 */ 1604 printf("cr0: %x cr4: %b\n", 1605 (uint_t)getcr0(), (uint_t)getcr4(), FMT_CR4); 1606 #else 1607 printf("cr0: %b cr4: %b\n", 1608 (uint_t)getcr0(), FMT_CR0, (uint_t)getcr4(), FMT_CR4); 1609 #endif /* __lint */ 1610 1611 #if defined(__amd64) 1612 printf("cr2: %lx cr3: %lx cr8: %lx\n", getcr2(), getcr3(), getcr8()); 1613 #elif defined(__i386) 1614 printf("cr2: %lx cr3: %lx\n", getcr2(), getcr3()); 1615 #endif 1616 1617 dumpregs(rp); 1618 splx(s); 1619 } 1620 1621 static void 1622 dumpregs(struct regs *rp) 1623 { 1624 #if defined(__amd64) 1625 const char fmt[] = "\t%3s: %16lx %3s: %16lx %3s: %16lx\n"; 1626 1627 printf(fmt, "rdi", rp->r_rdi, "rsi", rp->r_rsi, "rdx", rp->r_rdx); 1628 printf(fmt, "rcx", rp->r_rcx, " r8", rp->r_r8, " r9", rp->r_r9); 1629 printf(fmt, "rax", rp->r_rax, "rbx", rp->r_rbx, "rbp", rp->r_rbp); 1630 printf(fmt, "r10", rp->r_r10, "r11", rp->r_r11, "r12", rp->r_r12); 1631 printf(fmt, "r13", rp->r_r13, "r14", rp->r_r14, "r15", rp->r_r15); 1632 1633 printf(fmt, "fsb", rdmsr(MSR_AMD_FSBASE), "gsb", rdmsr(MSR_AMD_GSBASE), 1634 " ds", rp->r_ds); 1635 printf(fmt, " es", rp->r_es, " fs", rp->r_fs, " gs", rp->r_gs); 1636 1637 printf(fmt, "trp", rp->r_trapno, "err", rp->r_err, "rip", rp->r_rip); 1638 printf(fmt, " cs", rp->r_cs, "rfl", rp->r_rfl, "rsp", rp->r_rsp); 1639 1640 printf("\t%3s: %16lx\n", " ss", rp->r_ss); 1641 1642 #elif defined(__i386) 1643 const char fmt[] = "\t%3s: %8lx %3s: %8lx %3s: %8lx %3s: %8lx\n"; 1644 1645 printf(fmt, " gs", rp->r_gs, " fs", rp->r_fs, 1646 " es", rp->r_es, " ds", rp->r_ds); 1647 printf(fmt, "edi", rp->r_edi, "esi", rp->r_esi, 1648 "ebp", rp->r_ebp, "esp", rp->r_esp); 1649 printf(fmt, "ebx", rp->r_ebx, "edx", rp->r_edx, 1650 "ecx", rp->r_ecx, "eax", rp->r_eax); 1651 printf(fmt, "trp", rp->r_trapno, "err", rp->r_err, 1652 "eip", rp->r_eip, " cs", rp->r_cs); 1653 printf("\t%3s: %8lx %3s: %8lx %3s: %8lx\n", 1654 "efl", rp->r_efl, "usp", rp->r_uesp, " ss", rp->r_ss); 1655 1656 #endif /* __i386 */ 1657 } 1658 1659 /* 1660 * Handle #gp faults in kernel mode. 1661 * 1662 * One legitimate way this can happen is if we attempt to update segment 1663 * registers to naughty values on the way out of the kernel. 1664 * 1665 * This can happen in a couple of ways: someone - either accidentally or 1666 * on purpose - creates (setcontext(2), lwp_create(2)) or modifies 1667 * (signal(2)) a ucontext that contains silly segment register values. 1668 * Or someone - either accidentally or on purpose - modifies the prgregset_t 1669 * of a subject process via /proc to contain silly segment register values. 1670 * 1671 * (The unfortunate part is that we can end up discovering the bad segment 1672 * register value in the middle of an 'iret' after we've popped most of the 1673 * stack. So it becomes quite difficult to associate an accurate ucontext 1674 * with the lwp, because the act of taking the #gp trap overwrites most of 1675 * what we were going to send the lwp.) 1676 * 1677 * OTOH if it turns out that's -not- the problem, and we're -not- an lwp 1678 * trying to return to user mode and we get a #gp fault, then we need 1679 * to die() -- which will happen if we return non-zero from this routine. 1680 */ 1681 static int 1682 kern_gpfault(struct regs *rp) 1683 { 1684 kthread_t *t = curthread; 1685 proc_t *p = ttoproc(t); 1686 klwp_t *lwp = ttolwp(t); 1687 struct regs tmpregs, *trp = NULL; 1688 caddr_t pc = (caddr_t)rp->r_pc; 1689 int v; 1690 1691 extern void _sys_rtt(), sr_sup(); 1692 1693 #if defined(__amd64) 1694 static const uint8_t iretq_insn[2] = { 0x48, 0xcf }; 1695 1696 #elif defined(__i386) 1697 static const uint8_t iret_insn[1] = { 0xcf }; 1698 1699 /* 1700 * Note carefully the appallingly awful dependency between 1701 * the instruction sequence used in __SEGREGS_POP and these 1702 * instructions encoded here. 1703 * 1704 * XX64 Add some commentary to locore.s/privregs.h to document this. 1705 */ 1706 static const uint8_t movw_0_esp_gs[4] = { 0x8e, 0x6c, 0x24, 0x0 }; 1707 static const uint8_t movw_4_esp_fs[4] = { 0x8e, 0x64, 0x24, 0x4 }; 1708 static const uint8_t movw_8_esp_es[4] = { 0x8e, 0x44, 0x24, 0x8 }; 1709 static const uint8_t movw_c_esp_ds[4] = { 0x8e, 0x5c, 0x24, 0xc }; 1710 #endif 1711 /* 1712 * if we're not an lwp, or the pc range is outside _sys_rtt, then 1713 * we should immediately be die()ing horribly 1714 */ 1715 if (lwp == NULL || 1716 (uintptr_t)pc < (uintptr_t)_sys_rtt || 1717 (uintptr_t)pc > (uintptr_t)sr_sup) 1718 return (1); 1719 1720 /* 1721 * So at least we're in the right part of the kernel. 1722 * 1723 * Disassemble the instruction at the faulting pc. 1724 * Once we know what it is, we carefully reconstruct the stack 1725 * based on the order in which the stack is deconstructed in 1726 * _sys_rtt. Ew. 1727 */ 1728 1729 #if defined(__amd64) 1730 1731 if (bcmp(pc, iretq_insn, sizeof (iretq_insn)) == 0) { 1732 /* 1733 * We took the #gp while trying to perform the iretq. 1734 * This means that either %cs or %ss are bad. 1735 * All we know for sure is that most of the general 1736 * registers have been restored, including the 1737 * segment registers, and all we have left on the 1738 * topmost part of the lwp's stack are the 1739 * registers that the iretq was unable to consume. 1740 * 1741 * All the rest of the state was crushed by the #gp 1742 * which pushed -its- registers atop our old save area 1743 * (because we had to decrement the stack pointer, sigh) so 1744 * all that we can try and do is to reconstruct the 1745 * crushed frame from the #gp trap frame itself. 1746 */ 1747 trp = &tmpregs; 1748 trp->r_ss = lwptoregs(lwp)->r_ss; 1749 trp->r_sp = lwptoregs(lwp)->r_sp; 1750 trp->r_ps = lwptoregs(lwp)->r_ps; 1751 trp->r_cs = lwptoregs(lwp)->r_cs; 1752 trp->r_pc = lwptoregs(lwp)->r_pc; 1753 bcopy(rp, trp, offsetof(struct regs, r_pc)); 1754 1755 /* 1756 * Validate simple math 1757 */ 1758 ASSERT(trp->r_pc == lwptoregs(lwp)->r_pc); 1759 ASSERT(trp->r_err == rp->r_err); 1760 1761 } 1762 1763 #elif defined(__i386) 1764 1765 if (bcmp(pc, iret_insn, sizeof (iret_insn)) == 0) { 1766 /* 1767 * We took the #gp while trying to perform the iret. 1768 * This means that either %cs or %ss are bad. 1769 * All we know for sure is that most of the general 1770 * registers have been restored, including the 1771 * segment registers, and all we have left on the 1772 * topmost part of the lwp's stack are the registers that 1773 * the iret was unable to consume. 1774 * 1775 * All the rest of the state was crushed by the #gp 1776 * which pushed -its- registers atop our old save area 1777 * (because we had to decrement the stack pointer, sigh) so 1778 * all that we can try and do is to reconstruct the 1779 * crushed frame from the #gp trap frame itself. 1780 */ 1781 trp = &tmpregs; 1782 trp->r_ss = lwptoregs(lwp)->r_ss; 1783 trp->r_sp = lwptoregs(lwp)->r_sp; 1784 trp->r_ps = lwptoregs(lwp)->r_ps; 1785 trp->r_cs = lwptoregs(lwp)->r_cs; 1786 trp->r_pc = lwptoregs(lwp)->r_pc; 1787 bcopy(rp, trp, offsetof(struct regs, r_pc)); 1788 1789 ASSERT(trp->r_pc == lwptoregs(lwp)->r_pc); 1790 ASSERT(trp->r_err == rp->r_err); 1791 1792 } else { 1793 /* 1794 * Segment registers are reloaded in _sys_rtt 1795 * via the following sequence: 1796 * 1797 * movw 0(%esp), %gs 1798 * movw 4(%esp), %fs 1799 * movw 8(%esp), %es 1800 * movw 12(%esp), %ds 1801 * addl $16, %esp 1802 * 1803 * Thus if any of them fault, we know the user 1804 * registers are left unharmed on the stack. 1805 */ 1806 if (bcmp(pc, movw_0_esp_gs, sizeof (movw_0_esp_gs)) == 0 || 1807 bcmp(pc, movw_4_esp_fs, sizeof (movw_4_esp_fs)) == 0 || 1808 bcmp(pc, movw_8_esp_es, sizeof (movw_8_esp_es)) == 0 || 1809 bcmp(pc, movw_c_esp_ds, sizeof (movw_c_esp_ds)) == 0) 1810 trp = lwptoregs(lwp); 1811 } 1812 #endif /* __amd64 */ 1813 1814 if (trp == NULL) 1815 return (1); 1816 1817 /* 1818 * If we get to here, we're reasonably confident that we've 1819 * correctly decoded what happened on the way out of the kernel. 1820 * Rewrite the lwp's registers so that we can create a core dump 1821 * the (at least vaguely) represents the mcontext we were 1822 * being asked to restore when things went so terribly wrong. 1823 */ 1824 1825 /* 1826 * Make sure that we have a meaningful %trapno and %err. 1827 */ 1828 trp->r_trapno = rp->r_trapno; 1829 trp->r_err = rp->r_err; 1830 1831 if ((caddr_t)trp != (caddr_t)lwptoregs(lwp)) 1832 bcopy(trp, lwptoregs(lwp), sizeof (*trp)); 1833 1834 mutex_enter(&p->p_lock); 1835 lwp->lwp_cursig = SIGSEGV; 1836 mutex_exit(&p->p_lock); 1837 1838 /* 1839 * Terminate all LWPs but don't discard them. If another lwp beat us to 1840 * the punch by calling exit(), evaporate now. 1841 */ 1842 proc_is_exiting(p); 1843 if (exitlwps(1) != 0) { 1844 mutex_enter(&p->p_lock); 1845 lwp_exit(); 1846 } 1847 1848 #ifdef C2_AUDIT 1849 if (audit_active) /* audit core dump */ 1850 audit_core_start(SIGSEGV); 1851 #endif 1852 v = core(SIGSEGV, B_FALSE); 1853 #ifdef C2_AUDIT 1854 if (audit_active) /* audit core dump */ 1855 audit_core_finish(v ? CLD_KILLED : CLD_DUMPED); 1856 #endif 1857 exit(v ? CLD_KILLED : CLD_DUMPED, SIGSEGV); 1858 return (0); 1859 } 1860 1861 /* 1862 * dump_tss() - Display the TSS structure 1863 */ 1864 1865 #if defined(__amd64) 1866 1867 static void 1868 dump_tss(void) 1869 { 1870 const char tss_fmt[] = "tss.%s:\t0x%p\n"; /* Format string */ 1871 struct tss *tss = CPU->cpu_tss; 1872 1873 printf(tss_fmt, "tss_rsp0", (void *)tss->tss_rsp0); 1874 printf(tss_fmt, "tss_rsp1", (void *)tss->tss_rsp1); 1875 printf(tss_fmt, "tss_rsp2", (void *)tss->tss_rsp2); 1876 1877 printf(tss_fmt, "tss_ist1", (void *)tss->tss_ist1); 1878 printf(tss_fmt, "tss_ist2", (void *)tss->tss_ist2); 1879 printf(tss_fmt, "tss_ist3", (void *)tss->tss_ist3); 1880 printf(tss_fmt, "tss_ist4", (void *)tss->tss_ist4); 1881 printf(tss_fmt, "tss_ist5", (void *)tss->tss_ist5); 1882 printf(tss_fmt, "tss_ist6", (void *)tss->tss_ist6); 1883 printf(tss_fmt, "tss_ist7", (void *)tss->tss_ist7); 1884 } 1885 1886 #elif defined(__i386) 1887 1888 static void 1889 dump_tss(void) 1890 { 1891 const char tss_fmt[] = "tss.%s:\t0x%p\n"; /* Format string */ 1892 struct tss *tss = CPU->cpu_tss; 1893 1894 printf(tss_fmt, "tss_link", (void *)(uintptr_t)tss->tss_link); 1895 printf(tss_fmt, "tss_esp0", (void *)(uintptr_t)tss->tss_esp0); 1896 printf(tss_fmt, "tss_ss0", (void *)(uintptr_t)tss->tss_ss0); 1897 printf(tss_fmt, "tss_esp1", (void *)(uintptr_t)tss->tss_esp1); 1898 printf(tss_fmt, "tss_ss1", (void *)(uintptr_t)tss->tss_ss1); 1899 printf(tss_fmt, "tss_esp2", (void *)(uintptr_t)tss->tss_esp2); 1900 printf(tss_fmt, "tss_ss2", (void *)(uintptr_t)tss->tss_ss2); 1901 printf(tss_fmt, "tss_cr3", (void *)(uintptr_t)tss->tss_cr3); 1902 printf(tss_fmt, "tss_eip", (void *)(uintptr_t)tss->tss_eip); 1903 printf(tss_fmt, "tss_eflags", (void *)(uintptr_t)tss->tss_eflags); 1904 printf(tss_fmt, "tss_eax", (void *)(uintptr_t)tss->tss_eax); 1905 printf(tss_fmt, "tss_ebx", (void *)(uintptr_t)tss->tss_ebx); 1906 printf(tss_fmt, "tss_ecx", (void *)(uintptr_t)tss->tss_ecx); 1907 printf(tss_fmt, "tss_edx", (void *)(uintptr_t)tss->tss_edx); 1908 printf(tss_fmt, "tss_esp", (void *)(uintptr_t)tss->tss_esp); 1909 } 1910 1911 #endif /* __amd64 */ 1912 1913 #if defined(TRAPTRACE) 1914 1915 int ttrace_nrec = 0; /* number of records to dump out */ 1916 int ttrace_dump_nregs = 5; /* dump out this many records with regs too */ 1917 1918 /* 1919 * Dump out the last ttrace_nrec traptrace records on each CPU 1920 */ 1921 static void 1922 dump_ttrace(void) 1923 { 1924 trap_trace_ctl_t *ttc; 1925 trap_trace_rec_t *rec; 1926 uintptr_t current; 1927 int i, j, k; 1928 int n = NCPU; 1929 #if defined(__amd64) 1930 const char banner[] = 1931 "\ncpu address timestamp " 1932 "type vc handler pc\n"; 1933 const char fmt1[] = "%3d %016lx %12llx "; 1934 #elif defined(__i386) 1935 const char banner[] = 1936 "\ncpu address timestamp type vc handler pc\n"; 1937 const char fmt1[] = "%3d %08lx %12llx "; 1938 #endif 1939 const char fmt2[] = "%4s %3x "; 1940 const char fmt3[] = "%8s "; 1941 1942 if (ttrace_nrec == 0) 1943 return; 1944 1945 printf(banner); 1946 1947 for (i = 0; i < n; i++) { 1948 ttc = &trap_trace_ctl[i]; 1949 if (ttc->ttc_first == NULL) 1950 continue; 1951 1952 current = ttc->ttc_next - sizeof (trap_trace_rec_t); 1953 for (j = 0; j < ttrace_nrec; j++) { 1954 struct sysent *sys; 1955 struct autovec *vec; 1956 extern struct av_head autovect[]; 1957 int type; 1958 ulong_t off; 1959 char *sym, *stype; 1960 1961 if (current < ttc->ttc_first) 1962 current = 1963 ttc->ttc_limit - sizeof (trap_trace_rec_t); 1964 1965 if (current == NULL) 1966 continue; 1967 1968 rec = (trap_trace_rec_t *)current; 1969 1970 if (rec->ttr_stamp == 0) 1971 break; 1972 1973 printf(fmt1, i, (uintptr_t)rec, rec->ttr_stamp); 1974 1975 switch (rec->ttr_marker) { 1976 case TT_SYSCALL: 1977 case TT_SYSENTER: 1978 case TT_SYSC: 1979 case TT_SYSC64: 1980 #if defined(__amd64) 1981 sys = &sysent32[rec->ttr_sysnum]; 1982 switch (rec->ttr_marker) { 1983 case TT_SYSC64: 1984 sys = &sysent[rec->ttr_sysnum]; 1985 /*FALLTHROUGH*/ 1986 #elif defined(__i386) 1987 sys = &sysent[rec->ttr_sysnum]; 1988 switch (rec->ttr_marker) { 1989 case TT_SYSC64: 1990 #endif 1991 case TT_SYSC: 1992 stype = "sysc"; /* syscall */ 1993 break; 1994 case TT_SYSCALL: 1995 stype = "lcal"; /* lcall */ 1996 break; 1997 case TT_SYSENTER: 1998 stype = "syse"; /* sysenter */ 1999 break; 2000 default: 2001 break; 2002 } 2003 printf(fmt2, "sysc", rec->ttr_sysnum); 2004 if (sys != NULL) { 2005 sym = kobj_getsymname( 2006 (uintptr_t)sys->sy_callc, 2007 &off); 2008 if (sym != NULL) 2009 printf(fmt3, sym); 2010 else 2011 printf("%p ", sys->sy_callc); 2012 } else { 2013 printf(fmt3, "unknown"); 2014 } 2015 break; 2016 2017 case TT_INTERRUPT: 2018 printf(fmt2, "intr", rec->ttr_vector); 2019 vec = (&autovect[rec->ttr_vector])->avh_link; 2020 if (vec != NULL) { 2021 sym = kobj_getsymname( 2022 (uintptr_t)vec->av_vector, &off); 2023 if (sym != NULL) 2024 printf(fmt3, sym); 2025 else 2026 printf("%p ", vec->av_vector); 2027 } else { 2028 printf(fmt3, "unknown "); 2029 } 2030 break; 2031 2032 case TT_TRAP: 2033 case TT_EVENT: 2034 type = rec->ttr_regs.r_trapno; 2035 printf(fmt2, "trap", type); 2036 if (type < TRAP_TYPES) 2037 printf(" #%s ", 2038 trap_type_mnemonic[type]); 2039 else 2040 switch (type) { 2041 case T_AST: 2042 printf(fmt3, "ast"); 2043 break; 2044 default: 2045 printf(fmt3, ""); 2046 break; 2047 } 2048 break; 2049 2050 case TT_XCALL: 2051 printf(fmt2, "xcal", 2052 rec->ttr_info.xc_entry.xce_marker); 2053 printf(fmt3, ""); 2054 break; 2055 2056 default: 2057 break; 2058 } 2059 2060 sym = kobj_getsymname(rec->ttr_regs.r_pc, &off); 2061 if (sym != NULL) 2062 printf("%s+%lx\n", sym, off); 2063 else 2064 printf("%lx\n", rec->ttr_regs.r_pc); 2065 2066 if (ttrace_dump_nregs-- > 0) { 2067 int s; 2068 2069 if (rec->ttr_marker == TT_INTERRUPT) 2070 printf( 2071 "\t\tipl %x spl %x pri %x\n", 2072 rec->ttr_ipl, 2073 rec->ttr_spl, 2074 rec->ttr_pri); 2075 2076 dumpregs(&rec->ttr_regs); 2077 2078 printf("\t%3s: %p\n\n", " ct", 2079 (void *)rec->ttr_curthread); 2080 2081 /* 2082 * print out the pc stack that we recorded 2083 * at trap time (if any) 2084 */ 2085 for (s = 0; s < rec->ttr_sdepth; s++) { 2086 uintptr_t fullpc; 2087 2088 if (s >= TTR_STACK_DEPTH) { 2089 printf("ttr_sdepth corrupt\n"); 2090 break; 2091 } 2092 2093 fullpc = (uintptr_t)rec->ttr_stack[s]; 2094 2095 sym = kobj_getsymname(fullpc, &off); 2096 if (sym != NULL) 2097 printf("-> %s+0x%lx()\n", 2098 sym, off); 2099 else 2100 printf("-> 0x%lx()\n", fullpc); 2101 } 2102 printf("\n"); 2103 } 2104 current -= sizeof (trap_trace_rec_t); 2105 } 2106 } 2107 } 2108 2109 /* 2110 * Help with constructing traptrace records in C 2111 */ 2112 trap_trace_rec_t * 2113 trap_trace_get_traceptr(uint8_t marker, ulong_t pc, ulong_t sp) 2114 { 2115 trap_trace_rec_t *ttr; 2116 2117 if (trap_trace_freeze) 2118 ttr = &trap_trace_postmort; 2119 else { 2120 trap_trace_ctl_t *ttc = &trap_trace_ctl[CPU->cpu_id]; 2121 2122 ttr = (void *)ttc->ttc_next; 2123 2124 if (ttc->ttc_next >= ttc->ttc_limit) 2125 ttc->ttc_next = ttc->ttc_first; 2126 else 2127 ttc->ttc_next += sizeof (trap_trace_rec_t); 2128 } 2129 2130 ttr->ttr_regs.r_sp = sp; 2131 ttr->ttr_regs.r_pc = pc; 2132 ttr->ttr_cr2 = getcr2(); 2133 ttr->ttr_curthread = (uintptr_t)curthread; 2134 ttr->ttr_stamp = tsc_read(); 2135 ttr->ttr_marker = marker; 2136 return (ttr); 2137 } 2138 2139 #endif /* TRAPTRACE */ 2140 2141 void 2142 panic_showtrap(struct trap_info *tip) 2143 { 2144 showregs(tip->trap_type, tip->trap_regs, tip->trap_addr); 2145 2146 #if defined(TRAPTRACE) 2147 dump_ttrace(); 2148 #endif /* TRAPTRACE */ 2149 2150 if (tip->trap_type == T_DBLFLT) 2151 dump_tss(); 2152 } 2153 2154 void 2155 panic_savetrap(panic_data_t *pdp, struct trap_info *tip) 2156 { 2157 panic_saveregs(pdp, tip->trap_regs); 2158 } 2159