/*
- * Copyright (c) 2000-2012 Apple Inc. All rights reserved.
+ * Copyright (c) 2000-2016 Apple Inc. All rights reserved.
*
* @APPLE_OSREFERENCE_LICENSE_HEADER_START@
*
#include <kern/telemetry.h>
#endif
#include <sys/kdebug.h>
+#include <prng/random.h>
#include <string.h>
* Forward declarations
*/
static void user_page_fault_continue(kern_return_t kret);
-static void panic_trap(x86_saved_state64_t *saved_state);
+static void panic_trap(x86_saved_state64_t *saved_state, uint32_t pl, kern_return_t fault_result);
static void set_recovery_ip(x86_saved_state64_t *saved_state, vm_offset_t ip);
volatile perfCallback perfTrapHook = NULL; /* Pointer to CHUD trap hook routine */
#endif
extern boolean_t pmap_smep_enabled;
+extern boolean_t pmap_smap_enabled;
+__attribute__((noreturn))
void
thread_syscall_return(
kern_return_t ret)
kprintf(" r10 0x%llx\n", saved_state->r10);
kprintf(" r8 0x%llx\n", saved_state->r8);
kprintf(" r9 0x%llx\n", saved_state->r9);
- kprintf(" v_arg6 0x%llx\n", saved_state->v_arg6);
- kprintf(" v_arg7 0x%llx\n", saved_state->v_arg7);
- kprintf(" v_arg8 0x%llx\n", saved_state->v_arg8);
kprintf(" cr2 0x%llx\n", saved_state->cr2);
kprintf("real cr2 0x%lx\n", get_cr2());
SCHED_STATS_INTERRUPT(current_processor());
#if CONFIG_TELEMETRY
- if (telemetry_needs_record
- && (current_task() != kernel_task)
-#if CONFIG_SCHED_IDLE_IN_PLACE
- && ((current_thread()->state & TH_IDLE) == 0) /* idle-in-place should be treated like the idle thread */
-#endif
- ) {
+ if (telemetry_needs_record) {
telemetry_mark_curthread(user_mode);
}
#endif
* Handle local APIC interrupts
* else call platform expert for devices.
*/
- if (!lapic_interrupt(interrupt_num, state))
+ if (!lapic_interrupt(interrupt_num, state)) {
PE_incoming_interrupt(interrupt_num);
+ }
if (__improbable(get_preemption_level() != ipl)) {
panic("Preemption level altered by interrupt vector 0x%x: initial 0x%x, final: 0x%x\n", interrupt_num, ipl, get_preemption_level());
}
}
+ if (cnum == master_cpu)
+ ml_entropy_collect();
+
KERNEL_DEBUG_CONSTANT_IST(KDEBUG_TRACE,
MACHDBG_CODE(DBG_MACH_EXCP_INTR, 0) | DBG_FUNC_END,
interrupt_num, 0, 0, 0, 0);
+ assert(ml_get_interrupts_enabled() == FALSE);
}
static inline void
int type;
vm_map_t map = 0; /* protected by T_PAGE_FAULT */
kern_return_t result = KERN_FAILURE;
+ kern_return_t fault_result = KERN_SUCCESS;
thread_t thread;
ast_t *myast;
boolean_t intr;
#if NCOPY_WINDOWS > 0
int fault_in_copy_window = -1;
#endif
- int is_user = 0;
-
+ int is_user;
+ int trap_pl = get_preemption_level();
+
thread = current_thread();
if (__improbable(is_saved_state32(state)))
myast = ast_pending();
+ is_user = (vaddr < VM_MAX_USER_PAGE_ADDRESS);
+
perfASTCallback astfn = perfASTHook;
if (__improbable(astfn != NULL)) {
if (*myast & AST_CHUD_ALL)
} else
*myast &= ~AST_CHUD_ALL;
- /*
- * Is there a hook?
- */
- perfCallback fn = perfTrapHook;
- if (__improbable(fn != NULL)) {
- if (fn(type, NULL, 0, 0) == KERN_SUCCESS) {
- /*
- * If it succeeds, we are done...
- */
- return;
- }
- }
#if CONFIG_DTRACE
+ /*
+ * Is there a DTrace hook?
+ */
if (__improbable(tempDTraceTrapHook != NULL)) {
if (tempDTraceTrapHook(type, state, lo_spp, 0) == KERN_SUCCESS) {
/*
0, 0, 0, VM_KERNEL_UNSLIDE(kern_ip), 0);
return;
}
-
+
+ user_addr_t kd_vaddr = is_user ? vaddr : VM_KERNEL_UNSLIDE(vaddr);
+ KERNEL_DEBUG_CONSTANT_IST(KDEBUG_TRACE,
+ (MACHDBG_CODE(DBG_MACH_EXCP_KTRAP_x86, type)) | DBG_FUNC_NONE,
+ (unsigned)(kd_vaddr >> 32), (unsigned)kd_vaddr, is_user,
+ VM_KERNEL_UNSLIDE(kern_ip), 0);
+
+
if (T_PAGE_FAULT == type) {
/*
* assume we're faulting in the kernel map
map = thread->map;
fault_in_copy_window = window_index;
}
- is_user = -1;
}
#else
if (__probable(vaddr < VM_MAX_USER_PAGE_ADDRESS)) {
/* fault occurred in userspace */
map = thread->map;
- is_user = -1;
/* Intercept a potential Supervisor Mode Execute
* Protection fault. These criteria identify
* (The VM could just redrive a SMEP fault, hence
* the intercept).
*/
- if (__improbable((code == (T_PF_PROT | T_PF_EXECUTE)) && (pmap_smep_enabled) && (saved_state->isf.rip == vaddr))) {
+ if (__improbable((code == (T_PF_PROT | T_PF_EXECUTE)) &&
+ (pmap_smep_enabled) && (saved_state->isf.rip == vaddr))) {
+ goto debugger_entry;
+ }
+
+ /*
+ * Additionally check for SMAP faults...
+ * which are characterized by page-present and
+ * the AC bit unset (i.e. not from copyin/out path).
+ */
+ if (__improbable(code & T_PF_PROT &&
+ pmap_smap_enabled &&
+ (saved_state->isf.rflags & EFL_AC) == 0)) {
goto debugger_entry;
}
set_cr3_raw(map->pmap->pm_cr3);
return;
}
+ if (__improbable(vaddr < PAGE_SIZE) &&
+ ((thread->machine.specFlags & CopyIOActive) == 0)) {
+ goto debugger_entry;
+ }
}
#endif
}
}
- user_addr_t kd_vaddr = is_user ? vaddr : VM_KERNEL_UNSLIDE(vaddr);
- KERNEL_DEBUG_CONSTANT_IST(KDEBUG_TRACE,
- (MACHDBG_CODE(DBG_MACH_EXCP_KTRAP_x86, type)) | DBG_FUNC_NONE,
- (unsigned)(kd_vaddr >> 32), (unsigned)kd_vaddr, is_user,
- VM_KERNEL_UNSLIDE(kern_ip), 0);
-
(void) ml_set_interrupts_enabled(intr);
if (code & T_PF_WRITE)
prot |= VM_PROT_WRITE;
-#if PAE
if (code & T_PF_EXECUTE)
prot |= VM_PROT_EXECUTE;
-#endif
- result = vm_fault(map,
- vm_map_trunc_page(vaddr,
- PAGE_MASK),
+ fault_result = result = vm_fault(map,
+ vaddr,
prot,
FALSE,
THREAD_UNINT, NULL, 0);
*/
sync_iss_to_iks(state);
#if MACH_KDP
- if (current_debugger != KDB_CUR_DB) {
- if (kdp_i386_trap(type, saved_state, result, (vm_offset_t)vaddr))
- return;
- }
+ if (kdp_i386_trap(type, saved_state, result, (vm_offset_t)vaddr))
+ return;
#endif
}
pal_cli();
- panic_trap(saved_state);
+ panic_trap(saved_state, trap_pl, fault_result);
/*
* NO RETURN
*/
saved_state->isf.rip = ip;
}
-
-
-
static void
-panic_trap(x86_saved_state64_t *regs)
+panic_trap(x86_saved_state64_t *regs, uint32_t pl, kern_return_t fault_result)
{
const char *trapname = "Unknown";
pal_cr_t cr0, cr2, cr3, cr4;
boolean_t potential_smep_fault = FALSE, potential_kernel_NX_fault = FALSE;
+ boolean_t potential_smap_fault = FALSE;
pal_get_control_registers( &cr0, &cr2, &cr3, &cr4 );
assert(ml_get_interrupts_enabled() == FALSE);
} else if (regs->isf.rip >= VM_MIN_KERNEL_AND_KEXT_ADDRESS) {
potential_kernel_NX_fault = TRUE;
}
+ } else if (pmap_smap_enabled &&
+ regs->isf.trapno == T_PAGE_FAULT &&
+ regs->isf.err & T_PF_PROT &&
+ regs->cr2 < VM_MAX_USER_PAGE_ADDRESS &&
+ regs->isf.rip >= VM_MIN_KERNEL_AND_KEXT_ADDRESS) {
+ potential_smap_fault = TRUE;
}
#undef panic
"R8: 0x%016llx, R9: 0x%016llx, R10: 0x%016llx, R11: 0x%016llx\n"
"R12: 0x%016llx, R13: 0x%016llx, R14: 0x%016llx, R15: 0x%016llx\n"
"RFL: 0x%016llx, RIP: 0x%016llx, CS: 0x%016llx, SS: 0x%016llx\n"
- "Fault CR2: 0x%016llx, Error code: 0x%016llx, Fault CPU: 0x%x%s%s%s\n",
+ "Fault CR2: 0x%016llx, Error code: 0x%016llx, Fault CPU: 0x%x%s%s%s%s, PL: %d, VF: %d\n",
regs->isf.rip, regs->isf.trapno, trapname,
cr0, cr2, cr3, cr4,
regs->rax, regs->rbx, regs->rcx, regs->rdx,
regs->isf.ss & 0xFFFF,regs->cr2, regs->isf.err, regs->isf.cpu,
virtualized ? " VMM" : "",
potential_kernel_NX_fault ? " Kernel NX fault" : "",
- potential_smep_fault ? " SMEP/User NX fault" : "");
+ potential_smep_fault ? " SMEP/User NX fault" : "",
+ potential_smap_fault ? " SMAP fault" : "",
+ pl,
+ fault_result);
/*
* This next statement is not executed,
* but it's needed to stop the compiler using tail call optimization
return; /* If it succeeds, we are done... */
}
+#if CONFIG_DTRACE
/*
* DTrace does not consume all user traps, only INT_3's for now.
* Avoid needlessly calling tempDTraceTrapHook here, and let the
* INT_3 case handle them.
*/
+#endif
+
DEBUG_KPRINT_SYSCALL_MASK(1,
"user_trap: type=0x%x(%s) err=0x%x cr2=%p rip=%p\n",
type, trap_type[type], err, (void *)(long) vaddr, (void *)(long) rip);
if (err & T_PF_WRITE)
prot |= VM_PROT_WRITE;
-#if PAE
if (__improbable(err & T_PF_EXECUTE))
prot |= VM_PROT_EXECUTE;
-#endif
kret = vm_fault(thread->map,
- vm_map_trunc_page(vaddr,
- PAGE_MASK),
+ vaddr,
prot, FALSE,
THREAD_ABORTSAFE, NULL, 0);
}
-/* Synchronize a thread's i386_kernel_state (if any) with the given
- * i386_saved_state_t obtained from the trap/IPI handler; called in
+/* Synchronize a thread's x86_kernel_state (if any) with the given
+ * x86_saved_state_t obtained from the trap/IPI handler; called in
* kernel_trap() prior to entering the debugger, and when receiving
- * an "MP_KDP" IPI.
+ * an "MP_KDP" IPI. Called with null saved_state if an incoming IPI
+ * was detected from the kernel while spinning with interrupts masked.
*/
void
boolean_t record_active_regs = FALSE;
/* The PAL may have a special way to sync registers */
- if( saved_state->flavor == THREAD_STATE_NONE )
+ if (saved_state && saved_state->flavor == THREAD_STATE_NONE)
pal_get_kern_regs( saved_state );
if ((kstack = current_thread()->kernel_stack) != 0) {
iks = STACK_IKS(kstack);
/* Did we take the trap/interrupt in kernel mode? */
- if (regs == USER_REGS64(current_thread()))
+ if (saved_state == NULL || /* NULL => polling in kernel */
+ regs == USER_REGS64(current_thread()))
record_active_regs = TRUE;
else {
iks->k_rbx = regs->rbx;
__asm__ volatile("leaq 1f(%%rip), %%rax; mov %%rax, %0\n1:" : "=m" (iks->k_rip)::"rax");
}
}
+
+#if DEBUG
+extern void thread_exception_return_internal(void) __dead2;
+
+void thread_exception_return(void) {
+ thread_t thread = current_thread();
+ ml_set_interrupts_enabled(FALSE);
+ if (thread_is_64bit(thread) != task_has_64BitAddr(thread->task)) {
+ panic("Task/thread bitness mismatch %p %p, task: %d, thread: %d", thread, thread->task, thread_is_64bit(thread), task_has_64BitAddr(thread->task));
+ }
+
+ if (thread_is_64bit(thread)) {
+ if ((gdt_desc_p(USER64_CS)->access & ACC_PL_U) == 0) {
+ panic("64-GDT mismatch %p, descriptor: %p", thread, gdt_desc_p(USER64_CS));
+ }
+ } else {
+ if ((gdt_desc_p(USER_CS)->access & ACC_PL_U) == 0) {
+ panic("32-GDT mismatch %p, descriptor: %p", thread, gdt_desc_p(USER_CS));
+
+ }
+ }
+ thread_exception_return_internal();
+}
+#endif
projects / apple / xnu.git / blobdiff