1 /*
2 * CDDL HEADER START
3 *
4 * The contents of this file are subject to the terms of the
5 * Common Development and Distribution License (the "License").
6 * You may not use this file except in compliance with the License.
7 *
8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9 * or http://www.opensolaris.org/os/licensing.
10 * See the License for the specific language governing permissions
11 * and limitations under the License.
12 *
13 * When distributing Covered Code, include this CDDL HEADER in each
14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15 * If applicable, add the following below this CDDL HEADER, with the
16 * fields enclosed by brackets "[]" replaced with your own identifying
17 * information: Portions Copyright [yyyy] [name of copyright owner]
18 *
19 * CDDL HEADER END
20 */
21 /*
22 * Copyright (c) 2012 Gary Mills
23 * Copyright 2016 PALO, Richard.
24 *
25 * Copyright (c) 2010, Oracle and/or its affiliates. All rights reserved.
26 *
27 * Copyright 2018 Joyent, Inc.
28 */
29
30 #include <sys/types.h>
31 #include <sys/clock.h>
32 #include <sys/psm.h>
33 #include <sys/archsystm.h>
34 #include <sys/machsystm.h>
35 #include <sys/compress.h>
36 #include <sys/modctl.h>
37 #include <sys/trap.h>
38 #include <sys/panic.h>
39 #include <sys/regset.h>
40 #include <sys/frame.h>
41 #include <sys/kobj.h>
42 #include <sys/apic.h>
43 #include <sys/apic_timer.h>
44 #include <sys/dumphdr.h>
45 #include <sys/mem.h>
46 #include <sys/x86_archext.h>
47 #include <sys/xpv_panic.h>
48 #include <sys/boot_console.h>
49 #include <sys/bootsvcs.h>
50 #include <sys/consdev.h>
51 #include <vm/hat_pte.h>
52 #include <vm/hat_i86.h>
53
54 /* XXX: need to add a PAE version too, if we ever support both PAE and non */
55 #define XPV_FILENAME "/boot/amd64/xen-syms"
56 #define XPV_MODNAME "xpv"
57
58 int xpv_panicking = 0;
59
60 struct module *xpv_module;
61 struct modctl *xpv_modctl;
62
63 #define ALIGN(x, a) ((a) == 0 ? (uintptr_t)(x) : \
64 (((uintptr_t)(x) + (uintptr_t)(a) - 1l) & ~((uintptr_t)(a) - 1l)))
65
66 /* Pointer to the xpv_panic_info structure handed to us by Xen. */
67 static struct panic_info *xpv_panic_info = NULL;
68
69 /* Timer support */
70 #define NSEC_SHIFT 5
71 #define T_XPV_TIMER 0xd1
72 #define XPV_TIMER_INTERVAL 1000 /* 1000 microseconds */
73 static uint32_t *xpv_apicadr = NULL;
74 static uint_t nsec_scale;
75
76 /* IDT support */
77 #pragma align 16(xpv_panic_idt)
78 static gate_desc_t xpv_panic_idt[NIDT]; /* interrupt descriptor table */
79
80 /* Xen pagetables mapped into our HAT's ptable windows */
81 static pfn_t ptable_pfn[MAX_NUM_LEVEL];
82
83 /* Number of MMU_PAGESIZE pages we're adding to the Solaris dump */
84 static int xpv_dump_pages;
85
86 /*
87 * There are up to two large swathes of RAM that we don't want to include
88 * in the dump: those that comprise the Xen version of segkpm. On 32-bit
89 * systems there is no such region of memory. On 64-bit systems, there
90 * should be just a single contiguous region that corresponds to all of
91 * physical memory. The tricky bit is that Xen's heap sometimes lives in
92 * the middle of their segkpm, and is mapped using only kpm-like addresses.
93 * In that case, we need to skip the swathes before and after Xen's heap.
94 */
95 uintptr_t kpm1_low = 0;
96 uintptr_t kpm1_high = 0;
97 uintptr_t kpm2_low = 0;
98 uintptr_t kpm2_high = 0;
99
100 /*
101 * Some commonly used values that we don't want to recompute over and over.
102 */
103 static int xpv_panic_nptes[MAX_NUM_LEVEL];
104 static ulong_t xpv_panic_cr3;
105 static uintptr_t xpv_end;
106
107 static void xpv_panic_console_print(const char *fmt, ...);
108 static void (*xpv_panic_printf)(const char *, ...) = xpv_panic_console_print;
109
110 #define CONSOLE_BUF_SIZE 256
111 static char console_buffer[CONSOLE_BUF_SIZE];
112 static boolean_t use_polledio;
113
114 /*
115 * Pointers to machine check panic info (if any).
116 */
117 xpv_mca_panic_data_t *xpv_mca_panic_data = NULL;
118
119 static void
xpv_panic_putc(int m)120 xpv_panic_putc(int m)
121 {
122 struct cons_polledio *c = cons_polledio;
123
124 /* This really shouldn't happen */
125 if (boot_console_type(NULL) == CONS_HYPERVISOR)
126 return;
127
128 if (use_polledio == B_TRUE)
129 c->cons_polledio_putchar(c->cons_polledio_argument, m);
130 else
131 bcons_putchar(m);
132 }
133
134 static void
xpv_panic_puts(char * msg)135 xpv_panic_puts(char *msg)
136 {
137 char *m;
138
139 dump_timeleft = dump_timeout;
140 for (m = msg; *m; m++)
141 xpv_panic_putc((int)*m);
142 }
143
144 static void
xpv_panic_console_print(const char * fmt,...)145 xpv_panic_console_print(const char *fmt, ...)
146 {
147 va_list ap;
148
149 va_start(ap, fmt);
150 (void) vsnprintf(console_buffer, sizeof (console_buffer), fmt, ap);
151 va_end(ap);
152
153 xpv_panic_puts(console_buffer);
154 }
155
156 static void
xpv_panic_map(int level,pfn_t pfn)157 xpv_panic_map(int level, pfn_t pfn)
158 {
159 x86pte_t pte, *pteptr;
160
161 /*
162 * The provided pfn represents a level 'level' page table. Map it
163 * into the 'level' slot in the list of page table windows.
164 */
165 pteptr = (x86pte_t *)PWIN_PTE_VA(level);
166 pte = pfn_to_pa(pfn) | PT_VALID;
167
168 XPV_ALLOW_PAGETABLE_UPDATES();
169 if (mmu.pae_hat)
170 *pteptr = pte;
171 else
172 *(x86pte32_t *)pteptr = pte;
173 XPV_DISALLOW_PAGETABLE_UPDATES();
174
175 mmu_flush_tlb_page((uintptr_t)PWIN_VA(level));
176 }
177
178 /*
179 * Walk the page tables to find the pfn mapped by the given va.
180 */
181 static pfn_t
xpv_va_walk(uintptr_t * vaddr)182 xpv_va_walk(uintptr_t *vaddr)
183 {
184 int l, idx;
185 pfn_t pfn;
186 x86pte_t pte;
187 x86pte_t *ptep;
188 uintptr_t va = *vaddr;
189 uintptr_t scan_va;
190 caddr_t ptable_window;
191 static pfn_t toplevel_pfn;
192 static uintptr_t lastva;
193
194 pte = 0;
195 /*
196 * If we do anything other than a simple scan through memory, don't
197 * trust the mapped page tables.
198 */
199 if (va != lastva + MMU_PAGESIZE)
200 for (l = mmu.max_level; l >= 0; l--)
201 ptable_pfn[l] = PFN_INVALID;
202
203 toplevel_pfn = mmu_btop(xpv_panic_cr3);
204
205 while (va < xpv_end && va >= *vaddr) {
206 /* Find the lowest table with any entry for va */
207 pfn = toplevel_pfn;
208 for (l = mmu.max_level; l >= 0; l--) {
209 if (ptable_pfn[l] != pfn) {
210 xpv_panic_map(l, pfn);
211 ptable_pfn[l] = pfn;
212 }
213
214 /*
215 * Search this pagetable for any mapping to an
216 * address >= va.
217 */
218 ptable_window = PWIN_VA(l);
219 if (l == mmu.max_level && mmu.pae_hat)
220 ptable_window +=
221 (xpv_panic_cr3 & MMU_PAGEOFFSET);
222
223 idx = (va >> LEVEL_SHIFT(l)) & (xpv_panic_nptes[l] - 1);
224 scan_va = va;
225 while (idx < xpv_panic_nptes[l] && scan_va < xpv_end &&
226 scan_va >= *vaddr) {
227 ptep = (x86pte_t *)(ptable_window +
228 (idx << mmu.pte_size_shift));
229 pte = GET_PTE(ptep);
230 if (pte & PTE_VALID)
231 break;
232 idx++;
233 scan_va += mmu.level_size[l];
234 }
235
236 /*
237 * If there are no valid mappings in this table, we
238 * can skip to the end of the VA range it covers.
239 */
240 if (idx == xpv_panic_nptes[l]) {
241 va = NEXT_ENTRY_VA(va, l + 1);
242 break;
243 }
244
245 va = scan_va;
246 /*
247 * See if we've hit the end of the range.
248 */
249 if (va >= xpv_end || va < *vaddr)
250 break;
251
252 /*
253 * If this mapping is for a pagetable, we drop down
254 * to the next level in the hierarchy and look for
255 * a mapping in it.
256 */
257 pfn = PTE2MFN(pte, l);
258 if (!PTE_ISPAGE(pte, l))
259 continue;
260
261 /*
262 * The APIC page is magic. Nothing to see here;
263 * move along.
264 */
265 if (((uintptr_t)xpv_apicadr & MMU_PAGEMASK) ==
266 (va & MMU_PAGEMASK)) {
267 va += MMU_PAGESIZE;
268 break;
269 }
270
271 /*
272 * See if the address is within one of the two
273 * kpm-like regions we want to skip.
274 */
275 if (va >= kpm1_low && va < kpm1_high) {
276 va = kpm1_high;
277 break;
278 }
279 if (va >= kpm2_low && va < kpm2_high) {
280 va = kpm2_high;
281 break;
282 }
283
284 /*
285 * The Xen panic code only handles small pages. If
286 * this mapping is for a large page, we need to
287 * identify the consituent page that covers the
288 * specific VA we were looking for.
289 */
290 if (l > 0) {
291 if (l > 1)
292 panic("Xen panic can't cope with "
293 "giant pages.");
294 idx = (va >> LEVEL_SHIFT(0)) &
295 (xpv_panic_nptes[0] - 1);
296 pfn += idx;
297 }
298
299 *vaddr = va;
300 lastva = va;
301 return (pfn | PFN_IS_FOREIGN_MFN);
302 }
303 }
304 return (PFN_INVALID);
305 }
306
307 /*
308 * Walk through the Xen VA space, finding pages that are mapped in.
309 *
310 * These pages all have MFNs rather than PFNs, meaning they may be outside
311 * the physical address space the kernel knows about, or they may collide
312 * with PFNs the kernel is using.
313 *
314 * The obvious trick of just adding the PFN_IS_FOREIGN_MFN bit to the MFNs
315 * to avoid collisions doesn't work. The pages need to be written to disk
316 * in PFN-order or savecore gets confused. We can't allocate memory to
317 * contruct a sorted pfn->VA reverse mapping, so we have to write the pages
318 * to disk in VA order.
319 *
320 * To square this circle, we simply make up PFNs for each of Xen's pages.
321 * We assign each mapped page a fake PFN in ascending order. These fake
322 * PFNs each have the FOREIGN bit set, ensuring that they fall outside the
323 * range of Solaris PFNs written by the kernel.
324 */
325 int
dump_xpv_addr()326 dump_xpv_addr()
327 {
328 uintptr_t va;
329 mem_vtop_t mem_vtop;
330
331 xpv_dump_pages = 0;
332 va = xen_virt_start;
333
334 while (xpv_va_walk(&va) != PFN_INVALID) {
335 mem_vtop.m_as = &kas;
336 mem_vtop.m_va = (void *)va;
337 mem_vtop.m_pfn = (pfn_t)xpv_dump_pages | PFN_IS_FOREIGN_MFN;
338
339 dumpvp_write(&mem_vtop, sizeof (mem_vtop_t));
340 xpv_dump_pages++;
341
342 va += MMU_PAGESIZE;
343 }
344
345 /*
346 * Add the shared_info page. This page actually ends up in the
347 * dump twice: once for the Xen va and once for the Solaris va.
348 * This isn't ideal, but we don't know the address Xen is using for
349 * the page, so we can't share it.
350 */
351 mem_vtop.m_as = &kas;
352 mem_vtop.m_va = HYPERVISOR_shared_info;
353 mem_vtop.m_pfn = (pfn_t)xpv_dump_pages | PFN_IS_FOREIGN_MFN;
354 dumpvp_write(&mem_vtop, sizeof (mem_vtop_t));
355 xpv_dump_pages++;
356
357 return (xpv_dump_pages);
358 }
359
360 void
dump_xpv_pfn()361 dump_xpv_pfn()
362 {
363 pfn_t pfn;
364 int cnt;
365
366 for (cnt = 0; cnt < xpv_dump_pages; cnt++) {
367 pfn = (pfn_t)cnt | PFN_IS_FOREIGN_MFN;
368 dumpvp_write(&pfn, sizeof (pfn));
369 }
370 }
371
372 int
dump_xpv_data(void * dump_cbuf)373 dump_xpv_data(void *dump_cbuf)
374 {
375 uintptr_t va;
376 uint32_t csize;
377 int cnt = 0;
378
379 /*
380 * XXX: we should probably run this data through a UE check. The
381 * catch is that the UE code relies on on_trap() and getpfnum()
382 * working.
383 */
384 va = xen_virt_start;
385
386 while (xpv_va_walk(&va) != PFN_INVALID) {
387 csize = (uint32_t)compress((void *)va, dump_cbuf, PAGESIZE);
388 dumpvp_write(&csize, sizeof (uint32_t));
389 dumpvp_write(dump_cbuf, csize);
390 if (dump_ioerr) {
391 dumphdr->dump_flags &= ~DF_COMPLETE;
392 return (cnt);
393 }
394 cnt++;
395 va += MMU_PAGESIZE;
396 }
397
398 /*
399 * Finally, dump the shared_info page
400 */
401 csize = (uint32_t)compress((void *)HYPERVISOR_shared_info, dump_cbuf,
402 PAGESIZE);
403 dumpvp_write(&csize, sizeof (uint32_t));
404 dumpvp_write(dump_cbuf, csize);
405 if (dump_ioerr)
406 dumphdr->dump_flags &= ~DF_COMPLETE;
407 cnt++;
408
409 return (cnt);
410 }
411
412 static void *
showstack(void * fpreg,int xpv_only)413 showstack(void *fpreg, int xpv_only)
414 {
415 struct frame *fpp;
416 ulong_t off;
417 char *sym;
418 uintptr_t pc, fp, lastfp;
419 uintptr_t minaddr = min(KERNELBASE, xen_virt_start);
420
421 fp = (uintptr_t)fpreg;
422 if (fp < minaddr) {
423 xpv_panic_printf("Bad frame ptr: 0x%p\n", fpreg);
424 return (fpreg);
425 }
426
427 do {
428 fpp = (struct frame *)fp;
429 pc = fpp->fr_savpc;
430
431 if ((xpv_only != 0) &&
432 (fp > xpv_end || fp < xen_virt_start))
433 break;
434 if ((sym = kobj_getsymname(pc, &off)) != NULL)
435 xpv_panic_printf("%08lx %s:%s+%lx\n", fp,
436 mod_containing_pc((caddr_t)pc), sym, off);
437 else if ((pc >= xen_virt_start) && (pc <= xpv_end))
438 xpv_panic_printf("%08lx 0x%lx (in Xen)\n", fp, pc);
439 else
440 xpv_panic_printf("%08lx %lx\n", fp, pc);
441
442 lastfp = fp;
443 fp = fpp->fr_savfp;
444
445 /*
446 * Xen marks an exception frame by inverting the frame
447 * pointer.
448 */
449 if (fp < lastfp) {
450 if ((~fp > minaddr) && ((~fp) ^ lastfp) < 0xfff)
451 fp = ~fp;
452 }
453 } while (fp > lastfp);
454 return ((void *)fp);
455 }
456
457 void *
xpv_traceback(void * fpreg)458 xpv_traceback(void *fpreg)
459 {
460 return (showstack(fpreg, 1));
461 }
462
463 static void
xpv_panic_hypercall(ulong_t call)464 xpv_panic_hypercall(ulong_t call)
465 {
466 panic("Illegally issued hypercall %d during panic!\n", (int)call);
467 }
468
469 void
xpv_die(struct regs * rp)470 xpv_die(struct regs *rp)
471 {
472 struct panic_trap_info ti;
473 struct cregs creg;
474
475 ti.trap_regs = rp;
476 ti.trap_type = rp->r_trapno;
477
478 curthread->t_panic_trap = &ti;
479 if (ti.trap_type == T_PGFLT) {
480 getcregs(&creg);
481 ti.trap_addr = (caddr_t)creg.cr_cr2;
482 panic("Fatal pagefault at 0x%lx. fault addr=0x%p rp=0x%p",
483 rp->r_pc, (void *)ti.trap_addr, (void *)rp);
484 } else {
485 ti.trap_addr = (caddr_t)rp->r_pc;
486 panic("Fatal trap %ld at 0x%lx. rp=0x%p", rp->r_trapno,
487 rp->r_pc, (void *)rp);
488 }
489 }
490
491 /*
492 * Build IDT to handle a Xen panic
493 */
494 static void
switch_to_xpv_panic_idt()495 switch_to_xpv_panic_idt()
496 {
497 int i;
498 desctbr_t idtr;
499 gate_desc_t *idt = xpv_panic_idt;
500 selector_t cs = get_cs_register();
501
502 for (i = 0; i < 32; i++)
503 set_gatesegd(&idt[i], &xpv_invaltrap, cs, SDT_SYSIGT, TRP_XPL,
504 0);
505
506 set_gatesegd(&idt[T_ZERODIV], &xpv_div0trap, cs, SDT_SYSIGT, TRP_XPL,
507 0);
508 set_gatesegd(&idt[T_SGLSTP], &xpv_dbgtrap, cs, SDT_SYSIGT, TRP_XPL, 0);
509 set_gatesegd(&idt[T_NMIFLT], &xpv_nmiint, cs, SDT_SYSIGT, TRP_XPL, 0);
510 set_gatesegd(&idt[T_BOUNDFLT], &xpv_boundstrap, cs, SDT_SYSIGT,
511 TRP_XPL, 0);
512 set_gatesegd(&idt[T_ILLINST], &xpv_invoptrap, cs, SDT_SYSIGT, TRP_XPL,
513 0);
514 set_gatesegd(&idt[T_NOEXTFLT], &xpv_ndptrap, cs, SDT_SYSIGT, TRP_XPL,
515 0);
516 set_gatesegd(&idt[T_TSSFLT], &xpv_invtsstrap, cs, SDT_SYSIGT, TRP_XPL,
517 0);
518 set_gatesegd(&idt[T_SEGFLT], &xpv_segnptrap, cs, SDT_SYSIGT, TRP_XPL,
519 0);
520 set_gatesegd(&idt[T_STKFLT], &xpv_stktrap, cs, SDT_SYSIGT, TRP_XPL, 0);
521 set_gatesegd(&idt[T_GPFLT], &xpv_gptrap, cs, SDT_SYSIGT, TRP_XPL, 0);
522 set_gatesegd(&idt[T_PGFLT], &xpv_pftrap, cs, SDT_SYSIGT, TRP_XPL, 0);
523 set_gatesegd(&idt[T_EXTERRFLT], &xpv_ndperr, cs, SDT_SYSIGT, TRP_XPL,
524 0);
525 set_gatesegd(&idt[T_ALIGNMENT], &xpv_achktrap, cs, SDT_SYSIGT, TRP_XPL,
526 0);
527 set_gatesegd(&idt[T_MCE], &xpv_mcetrap, cs, SDT_SYSIGT, TRP_XPL, 0);
528 set_gatesegd(&idt[T_SIMDFPE], &xpv_xmtrap, cs, SDT_SYSIGT, TRP_XPL, 0);
529
530 /*
531 * We have no double fault handler. Any single fault represents a
532 * catastrophic failure for us, so there is no attempt to handle
533 * them cleanly: we just print a message and reboot. If we
534 * encounter a second fault while doing that, there is nothing
535 * else we can do.
536 */
537
538 /*
539 * Be prepared to absorb any stray device interrupts received
540 * while writing the core to disk.
541 */
542 for (i = 33; i < NIDT; i++)
543 set_gatesegd(&idt[i], &xpv_surprise_intr, cs, SDT_SYSIGT,
544 TRP_XPL, 0);
545
546 /* The one interrupt we expect to get is from the APIC timer. */
547 set_gatesegd(&idt[T_XPV_TIMER], &xpv_timer_trap, cs, SDT_SYSIGT,
548 TRP_XPL, 0);
549
550 idtr.dtr_base = (uintptr_t)xpv_panic_idt;
551 idtr.dtr_limit = sizeof (xpv_panic_idt) - 1;
552 wr_idtr(&idtr);
553
554 /* Catch any hypercalls. */
555 wrmsr(MSR_AMD_LSTAR, (uintptr_t)xpv_panic_hypercall);
556 wrmsr(MSR_AMD_CSTAR, (uintptr_t)xpv_panic_hypercall);
557 }
558
559 static void
xpv_apic_clkinit()560 xpv_apic_clkinit()
561 {
562 uint_t apic_ticks = 0;
563
564 /*
565 * Measure how many APIC ticks there are within a fixed time
566 * period. We're going to be fairly coarse here. This timer is
567 * just being used to detect a stalled panic, so as long as we have
568 * the right order of magnitude, everything should be fine.
569 */
570 xpv_apicadr[APIC_SPUR_INT_REG] = AV_UNIT_ENABLE | APIC_SPUR_INTR;
571 xpv_apicadr[APIC_LOCAL_TIMER] = AV_MASK;
572 xpv_apicadr[APIC_INT_VECT0] = AV_MASK; /* local intr reg 0 */
573
574 xpv_apicadr[APIC_DIVIDE_REG] = 0;
575 xpv_apicadr[APIC_INIT_COUNT] = APIC_MAXVAL;
576 drv_usecwait(XPV_TIMER_INTERVAL);
577 apic_ticks = APIC_MAXVAL - xpv_apicadr[APIC_CURR_COUNT];
578
579 /*
580 * apic_ticks now represents roughly how many apic ticks comprise
581 * one timeout interval. Program the timer to send us an interrupt
582 * every time that interval expires.
583 */
584 xpv_apicadr[APIC_LOCAL_TIMER] = T_XPV_TIMER | AV_PERIODIC;
585 xpv_apicadr[APIC_INIT_COUNT] = apic_ticks;
586 xpv_apicadr[APIC_EOI_REG] = 0;
587 }
588
589 void
xpv_timer_tick(void)590 xpv_timer_tick(void)
591 {
592 static int ticks = 0;
593
594 if (ticks++ >= MICROSEC / XPV_TIMER_INTERVAL) {
595 ticks = 0;
596 if (dump_timeleft && (--dump_timeleft == 0))
597 panic("Xen panic timeout\n");
598 }
599 xpv_apicadr[APIC_EOI_REG] = 0;
600 }
601
602 void
xpv_interrupt(void)603 xpv_interrupt(void)
604 {
605 #ifdef DEBUG
606 static int cnt = 0;
607
608 if (cnt++ < 10)
609 xpv_panic_printf("Unexpected interrupt received.\n");
610 if ((cnt < 1000) && ((cnt % 100) == 0))
611 xpv_panic_printf("%d unexpected interrupts received.\n", cnt);
612 #endif
613
614 xpv_apicadr[APIC_EOI_REG] = 0;
615 }
616
617 /*
618 * Managing time in panic context is trivial. We only have a single CPU,
619 * we never get rescheduled, we never get suspended. We just need to
620 * convert clock ticks into nanoseconds.
621 */
622 static hrtime_t
xpv_panic_gethrtime(void)623 xpv_panic_gethrtime(void)
624 {
625 hrtime_t tsc, hrt;
626 unsigned int *l = (unsigned int *)&(tsc);
627
628 tsc = __rdtsc_insn();
629 hrt = (mul32(l[1], nsec_scale) << NSEC_SHIFT) +
630 (mul32(l[0], nsec_scale) >> (32 - NSEC_SHIFT));
631
632 return (hrt);
633 }
634
635 static void
xpv_panic_time_init()636 xpv_panic_time_init()
637 {
638 nsec_scale =
639 CPU->cpu_m.mcpu_vcpu_info->time.tsc_to_system_mul >> NSEC_SHIFT;
640
641 gethrtimef = xpv_panic_gethrtime;
642 }
643
644 static void
xpv_panicsys(struct regs * rp,char * fmt,...)645 xpv_panicsys(struct regs *rp, char *fmt, ...)
646 {
647 extern void panicsys(const char *, va_list, struct regs *, int);
648 va_list alist;
649
650 va_start(alist, fmt);
651 panicsys(fmt, alist, rp, 1);
652 va_end(alist);
653 }
654
655 void
xpv_do_panic(void * arg)656 xpv_do_panic(void *arg)
657 {
658 struct panic_info *pip = (struct panic_info *)arg;
659 int l;
660 struct cregs creg;
661 extern uintptr_t postbootkernelbase;
662
663 if (xpv_panicking++ > 0)
664 panic("multiple calls to xpv_do_panic()");
665
666 /*
667 * Indicate to the underlying panic framework that a panic has been
668 * initiated. This is ordinarily done as part of vpanic(). Since
669 * we already have all the register state saved by the hypervisor,
670 * we skip that and jump straight into the panic processing code.
671 *
672 * XXX If another thread grabs and wins the panic_quiesce trigger
673 * then we'll have two threads in panicsys believing they are in
674 * charge of the panic attempt!
675 */
676 (void) panic_trigger(&panic_quiesce);
677
678 /*
679 * bzero() and bcopy() get unhappy when asked to operate on
680 * addresses outside of the kernel. At this point Xen is really a
681 * part of the kernel, so we update the routines' notion of where
682 * the kernel starts.
683 */
684 postbootkernelbase = xen_virt_start;
685
686 #if defined(HYPERVISOR_VIRT_END)
687 xpv_end = HYPERVISOR_VIRT_END;
688 #else
689 xpv_end = (uintptr_t)UINTPTR_MAX - sizeof (uintptr_t);
690 #endif
691
692 /*
693 * If we were redirecting console output to the hypervisor, we have
694 * to stop.
695 */
696 use_polledio = B_FALSE;
697 if (boot_console_type(NULL) == CONS_HYPERVISOR) {
698 bcons_device_change(CONS_HYPERVISOR);
699 } else if (cons_polledio != NULL &&
700 cons_polledio->cons_polledio_putchar != NULL) {
701 if (cons_polledio->cons_polledio_enter != NULL)
702 cons_polledio->cons_polledio_enter(
703 cons_polledio->cons_polledio_argument);
704 use_polledio = 1;
705 }
706
707 /* Make sure we handle all console output from here on. */
708 sysp->bsvc_putchar = xpv_panic_putc;
709
710 /*
711 * If we find an unsupported panic_info structure, there's not much
712 * we can do other than complain, plow on, and hope for the best.
713 */
714 if (pip->pi_version != PANIC_INFO_VERSION)
715 xpv_panic_printf("Warning: Xen is using an unsupported "
716 "version of the panic_info structure.\n");
717
718 xpv_panic_info = pip;
719
720 kpm1_low = (uintptr_t)xpv_panic_info->pi_ram_start;
721 if (xpv_panic_info->pi_xen_start == NULL) {
722 kpm1_high = (uintptr_t)xpv_panic_info->pi_ram_end;
723 } else {
724 kpm1_high = (uintptr_t)xpv_panic_info->pi_xen_start;
725 kpm2_low = (uintptr_t)xpv_panic_info->pi_xen_end;
726 kpm2_high = (uintptr_t)xpv_panic_info->pi_ram_end;
727 }
728
729 /*
730 * Make sure we are running on the Solaris %gs. The Xen panic code
731 * should already have set up the GDT properly.
732 */
733 xpv_panic_resetgs();
734 wrmsr(MSR_AMD_GSBASE, (uint64_t)&cpus[0]);
735
736 xpv_panic_time_init();
737
738 /*
739 * Switch to our own IDT, avoiding any accidental returns to Xen
740 * world.
741 */
742 switch_to_xpv_panic_idt();
743
744 /*
745 * Initialize the APIC timer, which is used to detect a hung dump
746 * attempt.
747 */
748 xpv_apicadr = pip->pi_apic;
749 xpv_apic_clkinit();
750
751 /*
752 * Set up a few values that we'll need repeatedly.
753 */
754 getcregs(&creg);
755 xpv_panic_cr3 = creg.cr_cr3;
756 for (l = mmu.max_level; l >= 0; l--)
757 xpv_panic_nptes[l] = mmu.ptes_per_table;
758
759 /* Add the fake Xen module to the module list */
760 if (xpv_module != NULL) {
761 extern int last_module_id;
762
763 xpv_modctl->mod_id = last_module_id++;
764 xpv_modctl->mod_next = &modules;
765 xpv_modctl->mod_prev = modules.mod_prev;
766 modules.mod_prev->mod_next = xpv_modctl;
767 modules.mod_prev = xpv_modctl;
768 }
769
770 if (pip->pi_mca.mpd_magic == MCA_PANICDATA_MAGIC)
771 xpv_mca_panic_data = &pip->pi_mca;
772
773 xpv_panic_printf = printf;
774 xpv_panicsys((struct regs *)pip->pi_regs, pip->pi_panicstr);
775 xpv_panic_printf("Failed to reboot following panic.\n");
776 for (;;)
777 ;
778 }
779
780 /*
781 * Set up the necessary data structures to pretend that the Xen hypervisor
782 * is a loadable module, allowing mdb to find the Xen symbols in a crash
783 * dump. Since these symbols all map to VA space Solaris doesn't normally
784 * have access to, we don't link these structures into the kernel's lists
785 * until/unless we hit a Xen panic.
786 *
787 * The observant reader will note a striking amount of overlap between this
788 * code and that found in krtld. While it would be handy if we could just
789 * ask krtld to do this work for us, it's not that simple. Among the
790 * complications: we're not actually loading the text here (grub did it at
791 * boot), the .text section is writable, there are no relocations to do,
792 * none of the module text/data is in readable memory, etc. Training krtld
793 * to deal with this weird module is as complicated, and more risky, than
794 * reimplementing the necessary subset of it here.
795 */
796 static void
init_xen_module()797 init_xen_module()
798 {
799 struct _buf *file = NULL;
800 struct module *mp;
801 struct modctl *mcp;
802 int i, shn;
803 Shdr *shp, *ctf_shp;
804 char *names = NULL;
805 size_t n, namesize, text_align, data_align;
806 const char machine = EM_AMD64;
807
808 /* Allocate and init the module structure */
809 mp = kmem_zalloc(sizeof (*mp), KM_SLEEP);
810 mp->filename = kobj_zalloc(strlen(XPV_FILENAME) + 1, KM_SLEEP);
811 (void) strcpy(mp->filename, XPV_FILENAME);
812
813 /* Allocate and init the modctl structure */
814 mcp = kmem_zalloc(sizeof (*mcp), KM_SLEEP);
815 mcp->mod_modname = kobj_zalloc(strlen(XPV_MODNAME) + 1, KM_SLEEP);
816 (void) strcpy(mcp->mod_modname, XPV_MODNAME);
817 mcp->mod_filename = kobj_zalloc(strlen(XPV_FILENAME) + 1, KM_SLEEP);
818 (void) strcpy(mcp->mod_filename, XPV_FILENAME);
819 mcp->mod_inprogress_thread = (kthread_id_t)-1;
820 mcp->mod_ref = 1;
821 mcp->mod_loaded = 1;
822 mcp->mod_loadcnt = 1;
823 mcp->mod_mp = mp;
824
825 /*
826 * Try to open a Xen image that hasn't had its symbol and CTF
827 * information stripped off.
828 */
829 file = kobj_open_file(XPV_FILENAME);
830 if (file == (struct _buf *)-1) {
831 file = NULL;
832 goto err;
833 }
834
835 /*
836 * Read the header and ensure that this is an ELF file for the
837 * proper ISA. If it's not, somebody has done something very
838 * stupid. Why bother? See Mencken.
839 */
840 if (kobj_read_file(file, (char *)&mp->hdr, sizeof (mp->hdr), 0) < 0)
841 goto err;
842 for (i = 0; i < SELFMAG; i++)
843 if (mp->hdr.e_ident[i] != ELFMAG[i])
844 goto err;
845 if ((mp->hdr.e_ident[EI_DATA] != ELFDATA2LSB) ||
846 (mp->hdr.e_machine != machine))
847 goto err;
848
849 /* Read in the section headers */
850 n = mp->hdr.e_shentsize * mp->hdr.e_shnum;
851 mp->shdrs = kmem_zalloc(n, KM_SLEEP);
852 if (kobj_read_file(file, mp->shdrs, n, mp->hdr.e_shoff) < 0)
853 goto err;
854
855 /* Read the section names */
856 shp = (Shdr *)(mp->shdrs + mp->hdr.e_shstrndx * mp->hdr.e_shentsize);
857 namesize = shp->sh_size;
858 names = kmem_zalloc(shp->sh_size, KM_SLEEP);
859 if (kobj_read_file(file, names, shp->sh_size, shp->sh_offset) < 0)
860 goto err;
861
862 /*
863 * Fill in the text and data size fields.
864 */
865 ctf_shp = NULL;
866 text_align = data_align = 0;
867 for (shn = 1; shn < mp->hdr.e_shnum; shn++) {
868 shp = (Shdr *)(mp->shdrs + shn * mp->hdr.e_shentsize);
869
870 /* Sanity check the offset of the section name */
871 if (shp->sh_name >= namesize)
872 continue;
873
874 /* If we find the symtab section, remember it for later. */
875 if (shp->sh_type == SHT_SYMTAB) {
876 mp->symtbl_section = shn;
877 mp->symhdr = shp;
878 continue;
879 }
880
881 /* If we find the CTF section, remember it for later. */
882 if ((shp->sh_size != 0) &&
883 (strcmp(names + shp->sh_name, ".SUNW_ctf") == 0)) {
884 ctf_shp = shp;
885 continue;
886 }
887
888 if (!(shp->sh_flags & SHF_ALLOC))
889 continue;
890
891 /*
892 * Xen marks its text section as writable, so we need to
893 * look for the name - not just the flag.
894 */
895 if ((strcmp(&names[shp->sh_name], ".text") != 0) &&
896 (shp->sh_flags & SHF_WRITE) != 0) {
897 if (shp->sh_addralign > data_align)
898 data_align = shp->sh_addralign;
899 mp->data_size = ALIGN(mp->data_size, data_align);
900 mp->data_size += ALIGN(shp->sh_size, 8);
901 if (mp->data == NULL || mp->data > (char *)shp->sh_addr)
902 mp->data = (char *)shp->sh_addr;
903 } else {
904 if (shp->sh_addralign > text_align)
905 text_align = shp->sh_addralign;
906 mp->text_size = ALIGN(mp->text_size, text_align);
907 mp->text_size += ALIGN(shp->sh_size, 8);
908 if (mp->text == NULL || mp->text > (char *)shp->sh_addr)
909 mp->text = (char *)shp->sh_addr;
910 }
911 }
912 kmem_free(names, namesize);
913 names = NULL;
914 shp = NULL;
915 mcp->mod_text = mp->text;
916 mcp->mod_text_size = mp->text_size;
917
918 /*
919 * If we have symbol table and string table sections, read them in
920 * now. If we don't, we just plow on. We'll still get a valid
921 * core dump, but finding anything useful will be just a bit
922 * harder.
923 *
924 * Note: we don't bother with a hash table. We'll never do a
925 * symbol lookup unless we crash, and then mdb creates its own. We
926 * also don't try to perform any relocations. Xen should be loaded
927 * exactly where the ELF file indicates, and the symbol information
928 * in the file should be complete and correct already. Static
929 * linking ain't all bad.
930 */
931 if ((mp->symhdr != NULL) && (mp->symhdr->sh_link < mp->hdr.e_shnum)) {
932 mp->strhdr = (Shdr *)
933 (mp->shdrs + mp->symhdr->sh_link * mp->hdr.e_shentsize);
934 mp->nsyms = mp->symhdr->sh_size / mp->symhdr->sh_entsize;
935
936 /* Allocate space for the symbol table and strings. */
937 mp->symsize = mp->symhdr->sh_size +
938 mp->nsyms * sizeof (symid_t) + mp->strhdr->sh_size;
939 mp->symspace = kmem_zalloc(mp->symsize, KM_SLEEP);
940 mp->symtbl = mp->symspace;
941 mp->strings = (char *)(mp->symtbl + mp->symhdr->sh_size);
942
943 if ((kobj_read_file(file, mp->symtbl,
944 mp->symhdr->sh_size, mp->symhdr->sh_offset) < 0) ||
945 (kobj_read_file(file, mp->strings,
946 mp->strhdr->sh_size, mp->strhdr->sh_offset) < 0))
947 goto err;
948 }
949
950 /*
951 * Read in the CTF section
952 */
953 if ((ctf_shp != NULL) && ((moddebug & MODDEBUG_NOCTF) == 0)) {
954 mp->ctfdata = kmem_zalloc(ctf_shp->sh_size, KM_SLEEP);
955 mp->ctfsize = ctf_shp->sh_size;
956 if (kobj_read_file(file, mp->ctfdata, mp->ctfsize,
957 ctf_shp->sh_offset) < 0)
958 goto err;
959 }
960
961 kobj_close_file(file);
962
963 xpv_module = mp;
964 xpv_modctl = mcp;
965 return;
966
967 err:
968 cmn_err(CE_WARN, "Failed to initialize xpv module.");
969 if (file != NULL)
970 kobj_close_file(file);
971
972 kmem_free(mp->filename, strlen(XPV_FILENAME) + 1);
973 if (mp->shdrs != NULL)
974 kmem_free(mp->shdrs, mp->hdr.e_shentsize * mp->hdr.e_shnum);
975 if (mp->symspace != NULL)
976 kmem_free(mp->symspace, mp->symsize);
977 if (mp->ctfdata != NULL)
978 kmem_free(mp->ctfdata, mp->ctfsize);
979 kmem_free(mp, sizeof (*mp));
980 kmem_free(mcp->mod_filename, strlen(XPV_FILENAME) + 1);
981 kmem_free(mcp->mod_modname, strlen(XPV_MODNAME) + 1);
982 kmem_free(mcp, sizeof (*mcp));
983 if (names != NULL)
984 kmem_free(names, namesize);
985 }
986
987 void
xpv_panic_init()988 xpv_panic_init()
989 {
990 xen_platform_op_t op;
991 int i;
992
993 ASSERT(DOMAIN_IS_INITDOMAIN(xen_info));
994
995 for (i = 0; i < mmu.num_level; i++)
996 ptable_pfn[i] = PFN_INVALID;
997
998 /* Let Xen know where to jump if/when it panics. */
999 op.cmd = XENPF_panic_init;
1000 op.interface_version = XENPF_INTERFACE_VERSION;
1001 op.u.panic_init.panic_addr = (unsigned long)xpv_panic_hdlr;
1002
1003 (void) HYPERVISOR_platform_op(&op);
1004
1005 init_xen_module();
1006 }
1007