1 /* $NetBSD: fault.c,v 1.4 2001/11/09 19:04:23 thorpej Exp $ */ 2 3 /* 4 * Copyright (c) 1994-1997 Mark Brinicombe. 5 * Copyright (c) 1994 Brini. 6 * All rights reserved. 7 * 8 * This code is derived from software written for Brini by Mark Brinicombe 9 * 10 * Redistribution and use in source and binary forms, with or without 11 * modification, are permitted provided that the following conditions 12 * are met: 13 * 1. Redistributions of source code must retain the above copyright 14 * notice, this list of conditions and the following disclaimer. 15 * 2. Redistributions in binary form must reproduce the above copyright 16 * notice, this list of conditions and the following disclaimer in the 17 * documentation and/or other materials provided with the distribution. 18 * 3. All advertising materials mentioning features or use of this software 19 * must display the following acknowledgement: 20 * This product includes software developed by Brini. 21 * 4. The name of the company nor the name of the author may be used to 22 * endorse or promote products derived from this software without specific 23 * prior written permission. 24 * 25 * THIS SOFTWARE IS PROVIDED BY BRINI ``AS IS'' AND ANY EXPRESS OR IMPLIED 26 * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF 27 * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 28 * IN NO EVENT SHALL BRINI OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, 29 * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES 30 * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR 31 * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 32 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 33 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 34 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 35 * SUCH DAMAGE. 36 * 37 * RiscBSD kernel project 38 * 39 * fault.c 40 * 41 * Fault handlers 42 * 43 * Created : 28/11/94 44 */ 45 46 #include "opt_ddb.h" 47 #include "opt_pmap_debug.h" 48 49 #include <sys/types.h> 50 #include <sys/param.h> 51 #include <sys/systm.h> 52 #include <sys/proc.h> 53 #include <sys/user.h> 54 #include <sys/kernel.h> 55 56 #include <uvm/uvm_extern.h> 57 58 #include <machine/frame.h> 59 #include <machine/katelib.h> 60 #include <machine/cpu.h> 61 #include <machine/pte.h> 62 #include <machine/intr.h> 63 #ifdef DDB 64 #include <machine/db_machdep.h> 65 #endif 66 67 #include <arch/arm/arm/disassem.h> 68 69 int cowfault __P((vaddr_t)); 70 int fetchuserword __P((u_int address, u_int *location)); 71 extern char fusubailout[]; 72 73 /* Abort code */ 74 75 /* Define text descriptions of the different aborts */ 76 77 static const char *aborts[16] = { 78 "Write buffer fault", 79 "Alignment fault", 80 "Write buffer fault", 81 "Alignment fault", 82 "Bus error (LF section)", 83 "Translation fault (section)", 84 "Bus error (page)", 85 "Translation fault (page)", 86 "Bus error (section)", 87 "Domain error (section)", 88 "Bus error (page)", 89 "Domain error (page)", 90 "Bus error trans (L1)", 91 "Permission error (section)", 92 "Bus error trans (L2)", 93 "Permission error (page)" 94 }; 95 96 void 97 report_abort(prefix, fault_status, fault_address, fault_pc) 98 const char *prefix; 99 u_int fault_status; 100 u_int fault_address; 101 u_int fault_pc; 102 { 103 #ifndef DEBUG 104 if (prefix == NULL) { 105 #endif 106 if (prefix) 107 printf("%s ", prefix); 108 printf("Data abort: '%s' status=%03x address=%08x PC=%08x\n", 109 aborts[fault_status & FAULT_TYPE_MASK], 110 fault_status & 0xfff, fault_address, fault_pc); 111 #ifndef DEBUG 112 } 113 #endif 114 } 115 116 static __volatile int data_abort_expected; 117 static __volatile int data_abort_received; 118 119 int 120 badaddr_read(void *addr, size_t size, void *rptr) 121 { 122 u_long rcpt; 123 int rv; 124 125 /* Tell the Data Abort handler that we're expecting one. */ 126 data_abort_received = 0; 127 data_abort_expected = 1; 128 129 cpu_drain_writebuf(); 130 131 /* Read from the test address. */ 132 switch (size) { 133 case sizeof(uint8_t): 134 __asm __volatile("ldrb %0, [%1]" 135 : "=r" (rcpt) 136 : "r" (addr)); 137 break; 138 139 case sizeof(uint16_t): 140 __asm __volatile("ldrh %0, [%1]" 141 : "=r" (rcpt) 142 : "r" (addr)); 143 break; 144 145 case sizeof(uint32_t): 146 __asm __volatile("ldr %0, [%1]" 147 : "=r" (rcpt) 148 : "r" (addr)); 149 break; 150 151 default: 152 data_abort_expected = 0; 153 panic("badaddr: invalid size (%lu)\n", (u_long) size); 154 } 155 156 /* Disallow further Data Aborts. */ 157 data_abort_expected = 0; 158 159 rv = data_abort_received; 160 data_abort_received = 0; 161 162 /* Copy the data back if no fault occurred. */ 163 if (rptr != NULL && rv == 0) { 164 switch (size) { 165 case sizeof(uint8_t): 166 *(uint8_t *) rptr = rcpt; 167 break; 168 169 case sizeof(uint16_t): 170 *(uint16_t *) rptr = rcpt; 171 break; 172 173 case sizeof(uint32_t): 174 *(uint32_t *) rptr = rcpt; 175 break; 176 } 177 } 178 179 /* Return true if the address was invalid. */ 180 return (rv); 181 } 182 183 /* 184 * void data_abort_handler(trapframe_t *frame) 185 * 186 * Abort handler called when read/write occurs at an address of 187 * a non existent or restricted (access permissions) memory page. 188 * We first need to identify the type of page fault. 189 */ 190 191 #define TRAP_CODE ((fault_status & 0x0f) | (fault_address & 0xfffffff0)) 192 193 void 194 data_abort_handler(frame) 195 trapframe_t *frame; 196 { 197 struct proc *p; 198 struct pcb *pcb; 199 u_int fault_address; 200 u_int fault_status; 201 u_int fault_pc; 202 u_int fault_instruction; 203 int fault_code; 204 int user; 205 int error; 206 void *onfault; 207 208 /* 209 * If we were expecting a Data Abort, signal that we got 210 * one, adjust the PC to skip the faulting insn, and 211 * return. 212 */ 213 if (data_abort_expected) { 214 data_abort_received = 1; 215 frame->tf_pc += INSN_SIZE; 216 return; 217 } 218 219 /* 220 * Must get fault address and status from the CPU before 221 * re-enabling interrupts. (Interrupt handlers may take 222 * R/M emulation faults.) 223 */ 224 fault_address = cpu_faultaddress(); 225 fault_status = cpu_faultstatus(); 226 fault_pc = frame->tf_pc; 227 228 /* 229 * Enable IRQ's (disabled by CPU on abort) if trapframe 230 * shows they were enabled. 231 */ 232 if (!(frame->tf_spsr & I32_bit)) 233 enable_interrupts(I32_bit); 234 235 #ifdef DEBUG 236 if ((GetCPSR() & PSR_MODE) != PSR_SVC32_MODE) 237 panic("data_abort_handler: not in SVC32 mode"); 238 #endif 239 240 /* Update vmmeter statistics */ 241 uvmexp.traps++; 242 243 /* Extract the fault code from the fault status */ 244 fault_code = fault_status & FAULT_TYPE_MASK; 245 246 /* Get the current proc structure or proc0 if there is none */ 247 if ((p = curproc) == NULL) 248 p = &proc0; 249 250 /* 251 * can't use curpcb, as it might be NULL; and we have p in 252 * a register anyway 253 */ 254 pcb = &p->p_addr->u_pcb; 255 256 /* fusubailout is used by [fs]uswintr to avoid page faulting */ 257 if (pcb->pcb_onfault 258 && ((fault_code != FAULT_TRANS_S && fault_code != FAULT_TRANS_P && 259 fault_code != FAULT_PERM_S && fault_code != FAULT_PERM_P) 260 || pcb->pcb_onfault == fusubailout)) { 261 262 copyfault: 263 #ifdef DEBUG 264 printf("Using pcb_onfault=%p addr=%08x st=%08x p=%p\n", 265 pcb->pcb_onfault, fault_address, fault_status, p); 266 #endif 267 frame->tf_pc = (u_int)pcb->pcb_onfault; 268 if ((frame->tf_spsr & PSR_MODE) == PSR_USR32_MODE) 269 panic("Yikes pcb_onfault=%p during USR mode fault\n", 270 pcb->pcb_onfault); 271 return; 272 } 273 274 /* More debug stuff */ 275 276 fault_instruction = ReadWord(fault_pc); 277 278 #ifdef PMAP_DEBUG 279 if (pmap_debug_level >= 0) { 280 report_abort(NULL, fault_status, fault_address, fault_pc); 281 printf("Instruction @V%08x = %08x\n", 282 fault_pc, fault_instruction); 283 } 284 #endif 285 286 /* Call the cpu specific abort fixup routine */ 287 error = cpu_dataabt_fixup(frame); 288 if (error == ABORT_FIXUP_RETURN) 289 return; 290 if (error == ABORT_FIXUP_FAILED) { 291 printf("pc = 0x%08x, insn = ", fault_pc); 292 disassemble(fault_pc); 293 panic("data abort fixup failed\n"); 294 } 295 296 #ifdef PMAP_DEBUG 297 if (pmap_debug_level >= 0) 298 printf("fault in process %p\n", p); 299 #endif 300 301 #ifdef DEBUG 302 /* Is this needed ? */ 303 if (pcb != curpcb) { 304 printf("data_abort: Alert ! pcb(%p) != curpcb(%p)\n", 305 pcb, curpcb); 306 printf("data_abort: Alert ! proc(%p), curproc(%p)\n", 307 p, curproc); 308 } 309 #endif /* DEBUG */ 310 311 /* Were we in user mode when the abort occurred ? */ 312 if ((frame->tf_spsr & PSR_MODE) == PSR_USR32_MODE) { 313 /* 314 * Note that the fault was from USR mode. 315 */ 316 user = 1; 317 p->p_addr->u_pcb.pcb_tf = frame; 318 } else 319 user = 0; 320 321 /* Now act on the fault type */ 322 switch (fault_code) { 323 case FAULT_WRTBUF_0: /* Write Buffer Fault */ 324 case FAULT_WRTBUF_1: /* Write Buffer Fault */ 325 /* If this happens forget it no point in continuing */ 326 327 /* FALLTHROUGH */ 328 329 case FAULT_ALIGN_0: /* Alignment Fault */ 330 case FAULT_ALIGN_1: /* Alignment Fault */ 331 /* 332 * Really this should just kill the process. 333 * Alignment faults are turned off in the kernel 334 * in order to get better performance from shorts with 335 * GCC so an alignment fault means somebody has played 336 * with the control register in the CPU. Might as well 337 * panic as the kernel was not compiled for aligned accesses. 338 */ 339 340 /* FALLTHROUGH */ 341 342 case FAULT_BUSERR_0: /* Bus Error LF Section */ 343 case FAULT_BUSERR_1: /* Bus Error Page */ 344 case FAULT_BUSERR_2: /* Bus Error Section */ 345 case FAULT_BUSERR_3: /* Bus Error Page */ 346 /* What will accutally cause a bus error ? */ 347 /* Real bus errors are not a process problem but hardware */ 348 349 /* FALLTHROUGH */ 350 351 case FAULT_DOMAIN_S: /* Section Domain Error Fault */ 352 case FAULT_DOMAIN_P: /* Page Domain Error Fault*/ 353 /* 354 * Right well we dont use domains, everything is 355 * always a client and thus subject to access permissions. 356 * If we get a domain error then we have corrupts PTE's 357 * so we might as well die ! 358 * I suppose eventually this should just kill the process 359 * who owns the PTE's but if this happens it implies a 360 * kernel problem. 361 */ 362 363 /* FALLTHROUGH */ 364 365 case FAULT_BUSTRNL1: /* Bus Error Trans L1 Fault */ 366 case FAULT_BUSTRNL2: /* Bus Error Trans L2 Fault */ 367 /* 368 * These faults imply that the PTE is corrupt. 369 * Likely to be a kernel fault so we had better stop. 370 */ 371 372 /* FALLTHROUGH */ 373 374 default : 375 /* Are there any combinations I have missed ? */ 376 report_abort(NULL, fault_status, fault_address, fault_pc); 377 378 we_re_toast: 379 /* 380 * Were are dead, try and provide some debug 381 * information before dying. 382 */ 383 #ifdef DDB 384 printf("Unhandled trap (frame = %p)\n", frame); 385 report_abort(NULL, fault_status, fault_address, fault_pc); 386 kdb_trap(-1, frame); 387 return; 388 #else 389 panic("Unhandled trap (frame = %p)", frame); 390 #endif /* DDB */ 391 392 case FAULT_TRANS_P: /* Page Translation Fault */ 393 case FAULT_PERM_P: /* Page Permission Fault */ 394 case FAULT_TRANS_S: /* Section Translation Fault */ 395 case FAULT_PERM_S: /* Section Permission Fault */ 396 /* 397 * Page/section translation/permission fault -- need to fault in 398 * the page and possibly the page table page. 399 */ 400 { 401 register vaddr_t va; 402 register struct vmspace *vm = p->p_vmspace; 403 register struct vm_map *map; 404 int rv; 405 vm_prot_t ftype; 406 extern struct vm_map *kernel_map; 407 408 va = trunc_page((vaddr_t)fault_address); 409 410 #ifdef PMAP_DEBUG 411 if (pmap_debug_level >= 0) 412 printf("page fault: addr=V%08lx ", va); 413 #endif 414 415 /* 416 * It is only a kernel address space fault iff: 417 * 1. user == 0 and 418 * 2. pcb_onfault not set or 419 * 3. pcb_onfault set but supervisor space fault 420 * The last can occur during an exec() copyin where the 421 * argument space is lazy-allocated. 422 */ 423 if (!user && 424 (va >= VM_MIN_KERNEL_ADDRESS || va < VM_MIN_ADDRESS)) { 425 /* Was the fault due to the FPE/IPKDB ? */ 426 if ((frame->tf_spsr & PSR_MODE) == PSR_UND32_MODE) { 427 report_abort("UND32", fault_status, 428 fault_address, fault_pc); 429 trapsignal(p, SIGSEGV, TRAP_CODE); 430 431 /* 432 * Force exit via userret() 433 * This is necessary as the FPE is an extension 434 * to userland that actually runs in a 435 * priveledged mode but uses USR mode 436 * permissions for its accesses. 437 */ 438 userret(p); 439 return; 440 } 441 map = kernel_map; 442 } else 443 map = &vm->vm_map; 444 445 #ifdef PMAP_DEBUG 446 if (pmap_debug_level >= 0) 447 printf("vmmap=%p ", map); 448 #endif 449 450 if (map == NULL) 451 panic("No map for fault address\n"); 452 453 /* 454 * We need to know whether the page should be mapped 455 * as R or R/W. The MMU does not give us the info as 456 * to whether the fault was caused by a read or a write. 457 * This means we need to disassemble the instruction 458 * responsible and determine if it was a read or write 459 * instruction. 460 */ 461 /* STR instruction ? */ 462 if ((fault_instruction & 0x0c100000) == 0x04000000) 463 ftype = VM_PROT_READ | VM_PROT_WRITE; 464 /* STM or CDT instruction ? */ 465 else if ((fault_instruction & 0x0a100000) == 0x08000000) 466 ftype = VM_PROT_READ | VM_PROT_WRITE; 467 /* STRH, STRSH or STRSB instruction ? */ 468 else if ((fault_instruction & 0x0e100090) == 0x00000090) 469 ftype = VM_PROT_READ | VM_PROT_WRITE; 470 /* SWP instruction ? */ 471 else if ((fault_instruction & 0x0fb00ff0) == 0x01000090) 472 ftype = VM_PROT_READ | VM_PROT_WRITE; 473 else 474 ftype = VM_PROT_READ; 475 476 #ifdef PMAP_DEBUG 477 if (pmap_debug_level >= 0) 478 printf("fault protection = %d\n", ftype); 479 #endif 480 481 if ((ftype & VM_PROT_WRITE) ? 482 pmap_modified_emulation(map->pmap, va) : 483 pmap_handled_emulation(map->pmap, va)) 484 goto out; 485 486 if (current_intr_depth > 0) { 487 #ifdef DDB 488 printf("Non-emulated page fault with intr_depth > 0\n"); 489 report_abort(NULL, fault_status, fault_address, fault_pc); 490 kdb_trap(-1, frame); 491 return; 492 #else 493 panic("Fault with intr_depth > 0"); 494 #endif /* DDB */ 495 } 496 497 onfault = pcb->pcb_onfault; 498 pcb->pcb_onfault = NULL; 499 rv = uvm_fault(map, va, 0, ftype); 500 pcb->pcb_onfault = onfault; 501 if (rv == 0) 502 goto out; 503 504 if (user == 0) { 505 if (pcb->pcb_onfault) 506 goto copyfault; 507 printf("[u]vm_fault(%p, %lx, %x, 0) -> %x\n", 508 map, va, ftype, rv); 509 goto we_re_toast; 510 } 511 512 report_abort("", fault_status, fault_address, fault_pc); 513 if (rv == ENOMEM) { 514 printf("UVM: pid %d (%s), uid %d killed: " 515 "out of swap\n", p->p_pid, p->p_comm, 516 p->p_cred && p->p_ucred ? 517 p->p_ucred->cr_uid : -1); 518 trapsignal(p, SIGKILL, TRAP_CODE); 519 } else 520 trapsignal(p, SIGSEGV, TRAP_CODE); 521 break; 522 } 523 } 524 525 out: 526 /* Call userret() if it was a USR mode fault */ 527 if (user) 528 userret(p); 529 } 530 531 532 /* 533 * void prefetch_abort_handler(trapframe_t *frame) 534 * 535 * Abort handler called when instruction execution occurs at 536 * a non existent or restricted (access permissions) memory page. 537 * If the address is invalid and we were in SVC mode then panic as 538 * the kernel should never prefetch abort. 539 * If the address is invalid and the page is mapped then the user process 540 * does no have read permission so send it a signal. 541 * Otherwise fault the page in and try again. 542 */ 543 544 extern int kernel_debug; 545 546 void 547 prefetch_abort_handler(frame) 548 trapframe_t *frame; 549 { 550 register u_int fault_pc; 551 register struct proc *p; 552 register struct pcb *pcb; 553 u_int fault_instruction; 554 pt_entry_t *pte; 555 int error; 556 557 /* 558 * Enable IRQ's (disabled by the abort) This always comes 559 * from user mode so we know interrupts were not disabled. 560 * But we check anyway. 561 */ 562 if (!(frame->tf_spsr & I32_bit)) 563 enable_interrupts(I32_bit); 564 565 #ifdef DEBUG 566 if ((GetCPSR() & PSR_MODE) != PSR_SVC32_MODE) 567 panic("prefetch_abort_handler: not in SVC32 mode"); 568 #endif 569 570 /* Update vmmeter statistics */ 571 uvmexp.traps++; 572 573 /* Call the cpu specific abort fixup routine */ 574 error = cpu_prefetchabt_fixup(frame); 575 if (error == ABORT_FIXUP_RETURN) 576 return; 577 if (error == ABORT_FIXUP_FAILED) 578 panic("prefetch abort fixup failed\n"); 579 580 /* Get the current proc structure or proc0 if there is none */ 581 if ((p = curproc) == 0) { 582 p = &proc0; 583 #ifdef DEBUG 584 printf("Prefetch abort with curproc == 0\n"); 585 #endif 586 } 587 588 #ifdef PMAP_DEBUG 589 if (pmap_debug_level >= 0) 590 printf("prefetch fault in process %p %s\n", p, p->p_comm); 591 #endif 592 /* 593 * can't use curpcb, as it might be NULL; and we have p in a 594 * register anyway 595 */ 596 pcb = &p->p_addr->u_pcb; 597 if (pcb == 0) 598 panic("prefetch_abort_handler: no pcb ... we're toast !\n"); 599 600 #ifdef DEBUG 601 if (pcb != curpcb) { 602 printf("data_abort: Alert ! pcb(%p) != curpcb(%p)\n", 603 pcb, curpcb); 604 printf("data_abort: Alert ! proc(%p), curproc(%p)\n", 605 p, curproc); 606 } 607 #endif /* DEBUG */ 608 609 /* Get fault address */ 610 fault_pc = frame->tf_pc; 611 612 /* Was the prefectch abort from USR32 mode ? */ 613 if ((frame->tf_spsr & PSR_MODE) == PSR_USR32_MODE) { 614 p->p_addr->u_pcb.pcb_tf = frame; 615 } else { 616 /* 617 * All the kernel code pages are loaded at boot time 618 * and do not get paged 619 */ 620 panic("Prefetch abort in non-USR mode (frame=%p PC=0x%08x)\n", 621 frame, fault_pc); 622 } 623 624 #ifdef PMAP_DEBUG 625 if (pmap_debug_level >= 0) 626 printf("prefetch_abort: PC = %08x\n", fault_pc); 627 #endif 628 /* Ok validate the address, can only execute in USER space */ 629 if (fault_pc < VM_MIN_ADDRESS || fault_pc >= VM_MAXUSER_ADDRESS) { 630 #ifdef DEBUG 631 printf("prefetch: pc (%08x) not in user process space\n", 632 fault_pc); 633 #endif 634 trapsignal(p, SIGSEGV, fault_pc); 635 userret(p); 636 return; 637 } 638 639 /* Is the page already mapped ? */ 640 /* This is debugging for rev K SA110 silicon */ 641 pte = pmap_pte(p->p_vmspace->vm_map.pmap, (vaddr_t)fault_pc); 642 if (pte && *pte != 0) { 643 if (kernel_debug & 1) { 644 printf("prefetch_abort: page is already mapped - pte=%p *pte=%08x\n", 645 pte, *pte); 646 printf("prefetch_abort: pc=%08x proc=%p process=%s\n", fault_pc, p, p->p_comm); 647 printf("prefetch_abort: far=%08x fs=%x\n", cpu_faultaddress(), cpu_faultstatus()); 648 printf("prefetch_abort: trapframe=%08x\n", (u_int)frame); 649 } 650 #ifdef DDB 651 if (kernel_debug & 2) 652 Debugger(); 653 #endif 654 } 655 656 /* Ok read the fault address. This will fault the page in for us */ 657 if (fetchuserword(fault_pc, &fault_instruction) != 0) { 658 #ifdef DEBUG 659 printf("prefetch: faultin failed for address %08x\n", 660 fault_pc); 661 #endif 662 trapsignal(p, SIGSEGV, fault_pc); 663 } else { 664 665 #ifdef DIAGNOSTIC 666 /* More debug stuff */ 667 668 #ifdef PMAP_DEBUG 669 if (pmap_debug_level >= 0) { 670 printf("Instruction @V%08x = %08x\n", fault_pc, 671 fault_instruction); 672 disassemble(fault_pc); 673 printf("return addr=%08x", frame->tf_pc); 674 pte = pmap_pte(p->p_vmspace->vm_map.pmap, 675 (vaddr_t)fault_pc); 676 if (pte) 677 printf(" pte=%p *pte=%08x\n", pte, *pte); 678 else 679 printf("\n"); 680 681 } 682 #endif /* PMAP_DEBUG */ 683 #endif /* DIAGNOSTIC */ 684 } 685 686 userret(p); 687 } 688 689 int 690 cowfault(va) 691 vaddr_t va; 692 { 693 struct vmspace *vm; 694 int error; 695 696 if (va >= VM_MAXUSER_ADDRESS) 697 return (EFAULT); 698 699 /* uvm_fault can't be called from within an interrupt */ 700 KASSERT(current_intr_depth == 0); 701 702 vm = curproc->p_vmspace; 703 error = uvm_fault(&vm->vm_map, va, 0, VM_PROT_READ | VM_PROT_WRITE); 704 return error; 705 } 706 707 /* End of fault.c */ 708