1 /* $NetBSD: fault.c,v 1.6 2001/11/23 17:23:41 thorpej Exp $ */ 2 3 /* 4 * Copyright (c) 1994-1997 Mark Brinicombe. 5 * Copyright (c) 1994 Brini. 6 * All rights reserved. 7 * 8 * This code is derived from software written for Brini by Mark Brinicombe 9 * 10 * Redistribution and use in source and binary forms, with or without 11 * modification, are permitted provided that the following conditions 12 * are met: 13 * 1. Redistributions of source code must retain the above copyright 14 * notice, this list of conditions and the following disclaimer. 15 * 2. Redistributions in binary form must reproduce the above copyright 16 * notice, this list of conditions and the following disclaimer in the 17 * documentation and/or other materials provided with the distribution. 18 * 3. All advertising materials mentioning features or use of this software 19 * must display the following acknowledgement: 20 * This product includes software developed by Brini. 21 * 4. The name of the company nor the name of the author may be used to 22 * endorse or promote products derived from this software without specific 23 * prior written permission. 24 * 25 * THIS SOFTWARE IS PROVIDED BY BRINI ``AS IS'' AND ANY EXPRESS OR IMPLIED 26 * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF 27 * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 28 * IN NO EVENT SHALL BRINI OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, 29 * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES 30 * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR 31 * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 32 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 33 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 34 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 35 * SUCH DAMAGE. 36 * 37 * RiscBSD kernel project 38 * 39 * fault.c 40 * 41 * Fault handlers 42 * 43 * Created : 28/11/94 44 */ 45 46 #include "opt_ddb.h" 47 #include "opt_pmap_debug.h" 48 49 #include <sys/types.h> 50 #include <sys/param.h> 51 #include <sys/systm.h> 52 #include <sys/proc.h> 53 #include <sys/user.h> 54 #include <sys/kernel.h> 55 56 #include <uvm/uvm_extern.h> 57 58 #include <machine/frame.h> 59 #include <arm/arm32/katelib.h> 60 #include <machine/cpu.h> 61 #include <machine/intr.h> 62 #ifdef DDB 63 #include <machine/db_machdep.h> 64 #endif 65 66 #include <arch/arm/arm/disassem.h> 67 68 int cowfault __P((vaddr_t)); 69 int fetchuserword __P((u_int address, u_int *location)); 70 extern char fusubailout[]; 71 72 /* Abort code */ 73 74 /* Define text descriptions of the different aborts */ 75 76 static const char *aborts[16] = { 77 "Write buffer fault", 78 "Alignment fault", 79 "Write buffer fault", 80 "Alignment fault", 81 "Bus error (LF section)", 82 "Translation fault (section)", 83 "Bus error (page)", 84 "Translation fault (page)", 85 "Bus error (section)", 86 "Domain error (section)", 87 "Bus error (page)", 88 "Domain error (page)", 89 "Bus error trans (L1)", 90 "Permission error (section)", 91 "Bus error trans (L2)", 92 "Permission error (page)" 93 }; 94 95 void 96 report_abort(prefix, fault_status, fault_address, fault_pc) 97 const char *prefix; 98 u_int fault_status; 99 u_int fault_address; 100 u_int fault_pc; 101 { 102 #ifndef DEBUG 103 if (prefix == NULL) { 104 #endif 105 if (prefix) 106 printf("%s ", prefix); 107 printf("Data abort: '%s' status=%03x address=%08x PC=%08x\n", 108 aborts[fault_status & FAULT_TYPE_MASK], 109 fault_status & 0xfff, fault_address, fault_pc); 110 #ifndef DEBUG 111 } 112 #endif 113 } 114 115 static __volatile int data_abort_expected; 116 static __volatile int data_abort_received; 117 118 int 119 badaddr_read(void *addr, size_t size, void *rptr) 120 { 121 u_long rcpt; 122 int rv; 123 124 /* Tell the Data Abort handler that we're expecting one. */ 125 data_abort_received = 0; 126 data_abort_expected = 1; 127 128 cpu_drain_writebuf(); 129 130 /* Read from the test address. */ 131 switch (size) { 132 case sizeof(uint8_t): 133 __asm __volatile("ldrb %0, [%1]" 134 : "=r" (rcpt) 135 : "r" (addr)); 136 break; 137 138 case sizeof(uint16_t): 139 __asm __volatile("ldrh %0, [%1]" 140 : "=r" (rcpt) 141 : "r" (addr)); 142 break; 143 144 case sizeof(uint32_t): 145 __asm __volatile("ldr %0, [%1]" 146 : "=r" (rcpt) 147 : "r" (addr)); 148 break; 149 150 default: 151 data_abort_expected = 0; 152 panic("badaddr: invalid size (%lu)\n", (u_long) size); 153 } 154 155 /* Disallow further Data Aborts. */ 156 data_abort_expected = 0; 157 158 rv = data_abort_received; 159 data_abort_received = 0; 160 161 /* Copy the data back if no fault occurred. */ 162 if (rptr != NULL && rv == 0) { 163 switch (size) { 164 case sizeof(uint8_t): 165 *(uint8_t *) rptr = rcpt; 166 break; 167 168 case sizeof(uint16_t): 169 *(uint16_t *) rptr = rcpt; 170 break; 171 172 case sizeof(uint32_t): 173 *(uint32_t *) rptr = rcpt; 174 break; 175 } 176 } 177 178 /* Return true if the address was invalid. */ 179 return (rv); 180 } 181 182 /* 183 * void data_abort_handler(trapframe_t *frame) 184 * 185 * Abort handler called when read/write occurs at an address of 186 * a non existent or restricted (access permissions) memory page. 187 * We first need to identify the type of page fault. 188 */ 189 190 #define TRAP_CODE ((fault_status & 0x0f) | (fault_address & 0xfffffff0)) 191 192 void 193 data_abort_handler(frame) 194 trapframe_t *frame; 195 { 196 struct proc *p; 197 struct pcb *pcb; 198 u_int fault_address; 199 u_int fault_status; 200 u_int fault_pc; 201 u_int fault_instruction; 202 int fault_code; 203 int user; 204 int error; 205 void *onfault; 206 207 /* 208 * If we were expecting a Data Abort, signal that we got 209 * one, adjust the PC to skip the faulting insn, and 210 * return. 211 */ 212 if (data_abort_expected) { 213 data_abort_received = 1; 214 frame->tf_pc += INSN_SIZE; 215 return; 216 } 217 218 /* 219 * Must get fault address and status from the CPU before 220 * re-enabling interrupts. (Interrupt handlers may take 221 * R/M emulation faults.) 222 */ 223 fault_address = cpu_faultaddress(); 224 fault_status = cpu_faultstatus(); 225 fault_pc = frame->tf_pc; 226 227 /* 228 * Enable IRQ's (disabled by CPU on abort) if trapframe 229 * shows they were enabled. 230 */ 231 if (!(frame->tf_spsr & I32_bit)) 232 enable_interrupts(I32_bit); 233 234 #ifdef DEBUG 235 if ((GetCPSR() & PSR_MODE) != PSR_SVC32_MODE) 236 panic("data_abort_handler: not in SVC32 mode"); 237 #endif 238 239 /* Update vmmeter statistics */ 240 uvmexp.traps++; 241 242 /* Extract the fault code from the fault status */ 243 fault_code = fault_status & FAULT_TYPE_MASK; 244 245 /* Get the current proc structure or proc0 if there is none */ 246 if ((p = curproc) == NULL) 247 p = &proc0; 248 249 /* 250 * can't use curpcb, as it might be NULL; and we have p in 251 * a register anyway 252 */ 253 pcb = &p->p_addr->u_pcb; 254 255 /* fusubailout is used by [fs]uswintr to avoid page faulting */ 256 if (pcb->pcb_onfault 257 && ((fault_code != FAULT_TRANS_S && fault_code != FAULT_TRANS_P && 258 fault_code != FAULT_PERM_S && fault_code != FAULT_PERM_P) 259 || pcb->pcb_onfault == fusubailout)) { 260 261 copyfault: 262 #ifdef DEBUG 263 printf("Using pcb_onfault=%p addr=%08x st=%08x p=%p\n", 264 pcb->pcb_onfault, fault_address, fault_status, p); 265 #endif 266 frame->tf_pc = (u_int)pcb->pcb_onfault; 267 if ((frame->tf_spsr & PSR_MODE) == PSR_USR32_MODE) 268 panic("Yikes pcb_onfault=%p during USR mode fault\n", 269 pcb->pcb_onfault); 270 return; 271 } 272 273 /* More debug stuff */ 274 275 fault_instruction = ReadWord(fault_pc); 276 277 #ifdef PMAP_DEBUG 278 if (pmap_debug_level >= 0) { 279 report_abort(NULL, fault_status, fault_address, fault_pc); 280 printf("Instruction @V%08x = %08x\n", 281 fault_pc, fault_instruction); 282 } 283 #endif 284 285 /* Call the cpu specific abort fixup routine */ 286 error = cpu_dataabt_fixup(frame); 287 if (error == ABORT_FIXUP_RETURN) 288 return; 289 if (error == ABORT_FIXUP_FAILED) { 290 printf("pc = 0x%08x, insn = ", fault_pc); 291 disassemble(fault_pc); 292 panic("data abort fixup failed\n"); 293 } 294 295 #ifdef PMAP_DEBUG 296 if (pmap_debug_level >= 0) 297 printf("fault in process %p\n", p); 298 #endif 299 300 #ifdef DEBUG 301 /* Is this needed ? */ 302 if (pcb != curpcb) { 303 printf("data_abort: Alert ! pcb(%p) != curpcb(%p)\n", 304 pcb, curpcb); 305 printf("data_abort: Alert ! proc(%p), curproc(%p)\n", 306 p, curproc); 307 } 308 #endif /* DEBUG */ 309 310 /* Were we in user mode when the abort occurred ? */ 311 if ((frame->tf_spsr & PSR_MODE) == PSR_USR32_MODE) { 312 /* 313 * Note that the fault was from USR mode. 314 */ 315 user = 1; 316 p->p_addr->u_pcb.pcb_tf = frame; 317 } else 318 user = 0; 319 320 /* Now act on the fault type */ 321 switch (fault_code) { 322 case FAULT_WRTBUF_0: /* Write Buffer Fault */ 323 case FAULT_WRTBUF_1: /* Write Buffer Fault */ 324 /* If this happens forget it no point in continuing */ 325 326 /* FALLTHROUGH */ 327 328 case FAULT_ALIGN_0: /* Alignment Fault */ 329 case FAULT_ALIGN_1: /* Alignment Fault */ 330 /* 331 * Really this should just kill the process. 332 * Alignment faults are turned off in the kernel 333 * in order to get better performance from shorts with 334 * GCC so an alignment fault means somebody has played 335 * with the control register in the CPU. Might as well 336 * panic as the kernel was not compiled for aligned accesses. 337 */ 338 339 /* FALLTHROUGH */ 340 341 case FAULT_BUSERR_0: /* Bus Error LF Section */ 342 case FAULT_BUSERR_1: /* Bus Error Page */ 343 case FAULT_BUSERR_2: /* Bus Error Section */ 344 case FAULT_BUSERR_3: /* Bus Error Page */ 345 /* What will accutally cause a bus error ? */ 346 /* Real bus errors are not a process problem but hardware */ 347 348 /* FALLTHROUGH */ 349 350 case FAULT_DOMAIN_S: /* Section Domain Error Fault */ 351 case FAULT_DOMAIN_P: /* Page Domain Error Fault*/ 352 /* 353 * Right well we dont use domains, everything is 354 * always a client and thus subject to access permissions. 355 * If we get a domain error then we have corrupts PTE's 356 * so we might as well die ! 357 * I suppose eventually this should just kill the process 358 * who owns the PTE's but if this happens it implies a 359 * kernel problem. 360 */ 361 362 /* FALLTHROUGH */ 363 364 case FAULT_BUSTRNL1: /* Bus Error Trans L1 Fault */ 365 case FAULT_BUSTRNL2: /* Bus Error Trans L2 Fault */ 366 /* 367 * These faults imply that the PTE is corrupt. 368 * Likely to be a kernel fault so we had better stop. 369 */ 370 371 /* FALLTHROUGH */ 372 373 default : 374 /* Are there any combinations I have missed ? */ 375 report_abort(NULL, fault_status, fault_address, fault_pc); 376 377 we_re_toast: 378 /* 379 * Were are dead, try and provide some debug 380 * information before dying. 381 */ 382 #ifdef DDB 383 printf("Unhandled trap (frame = %p)\n", frame); 384 report_abort(NULL, fault_status, fault_address, fault_pc); 385 kdb_trap(-1, frame); 386 return; 387 #else 388 panic("Unhandled trap (frame = %p)", frame); 389 #endif /* DDB */ 390 391 case FAULT_TRANS_P: /* Page Translation Fault */ 392 case FAULT_PERM_P: /* Page Permission Fault */ 393 case FAULT_TRANS_S: /* Section Translation Fault */ 394 case FAULT_PERM_S: /* Section Permission Fault */ 395 /* 396 * Page/section translation/permission fault -- need to fault in 397 * the page and possibly the page table page. 398 */ 399 { 400 register vaddr_t va; 401 register struct vmspace *vm = p->p_vmspace; 402 register struct vm_map *map; 403 int rv; 404 vm_prot_t ftype; 405 extern struct vm_map *kernel_map; 406 407 va = trunc_page((vaddr_t)fault_address); 408 409 #ifdef PMAP_DEBUG 410 if (pmap_debug_level >= 0) 411 printf("page fault: addr=V%08lx ", va); 412 #endif 413 414 /* 415 * It is only a kernel address space fault iff: 416 * 1. user == 0 and 417 * 2. pcb_onfault not set or 418 * 3. pcb_onfault set but supervisor space fault 419 * The last can occur during an exec() copyin where the 420 * argument space is lazy-allocated. 421 */ 422 if (!user && 423 (va >= VM_MIN_KERNEL_ADDRESS || va < VM_MIN_ADDRESS)) { 424 /* Was the fault due to the FPE/IPKDB ? */ 425 if ((frame->tf_spsr & PSR_MODE) == PSR_UND32_MODE) { 426 report_abort("UND32", fault_status, 427 fault_address, fault_pc); 428 trapsignal(p, SIGSEGV, TRAP_CODE); 429 430 /* 431 * Force exit via userret() 432 * This is necessary as the FPE is an extension 433 * to userland that actually runs in a 434 * priveledged mode but uses USR mode 435 * permissions for its accesses. 436 */ 437 userret(p); 438 return; 439 } 440 map = kernel_map; 441 } else 442 map = &vm->vm_map; 443 444 #ifdef PMAP_DEBUG 445 if (pmap_debug_level >= 0) 446 printf("vmmap=%p ", map); 447 #endif 448 449 if (map == NULL) 450 panic("No map for fault address\n"); 451 452 /* 453 * We need to know whether the page should be mapped 454 * as R or R/W. The MMU does not give us the info as 455 * to whether the fault was caused by a read or a write. 456 * This means we need to disassemble the instruction 457 * responsible and determine if it was a read or write 458 * instruction. 459 */ 460 /* STR instruction ? */ 461 if ((fault_instruction & 0x0c100000) == 0x04000000) 462 ftype = VM_PROT_READ | VM_PROT_WRITE; 463 /* STM or CDT instruction ? */ 464 else if ((fault_instruction & 0x0a100000) == 0x08000000) 465 ftype = VM_PROT_READ | VM_PROT_WRITE; 466 /* STRH, STRSH or STRSB instruction ? */ 467 else if ((fault_instruction & 0x0e100090) == 0x00000090) 468 ftype = VM_PROT_READ | VM_PROT_WRITE; 469 /* SWP instruction ? */ 470 else if ((fault_instruction & 0x0fb00ff0) == 0x01000090) 471 ftype = VM_PROT_READ | VM_PROT_WRITE; 472 else 473 ftype = VM_PROT_READ; 474 475 #ifdef PMAP_DEBUG 476 if (pmap_debug_level >= 0) 477 printf("fault protection = %d\n", ftype); 478 #endif 479 480 if ((ftype & VM_PROT_WRITE) ? 481 pmap_modified_emulation(map->pmap, va) : 482 pmap_handled_emulation(map->pmap, va)) 483 goto out; 484 485 if (current_intr_depth > 0) { 486 #ifdef DDB 487 printf("Non-emulated page fault with intr_depth > 0\n"); 488 report_abort(NULL, fault_status, fault_address, fault_pc); 489 kdb_trap(-1, frame); 490 return; 491 #else 492 panic("Fault with intr_depth > 0"); 493 #endif /* DDB */ 494 } 495 496 onfault = pcb->pcb_onfault; 497 pcb->pcb_onfault = NULL; 498 rv = uvm_fault(map, va, 0, ftype); 499 pcb->pcb_onfault = onfault; 500 if (rv == 0) 501 goto out; 502 503 if (user == 0) { 504 if (pcb->pcb_onfault) 505 goto copyfault; 506 printf("[u]vm_fault(%p, %lx, %x, 0) -> %x\n", 507 map, va, ftype, rv); 508 goto we_re_toast; 509 } 510 511 report_abort("", fault_status, fault_address, fault_pc); 512 if (rv == ENOMEM) { 513 printf("UVM: pid %d (%s), uid %d killed: " 514 "out of swap\n", p->p_pid, p->p_comm, 515 p->p_cred && p->p_ucred ? 516 p->p_ucred->cr_uid : -1); 517 trapsignal(p, SIGKILL, TRAP_CODE); 518 } else 519 trapsignal(p, SIGSEGV, TRAP_CODE); 520 break; 521 } 522 } 523 524 out: 525 /* Call userret() if it was a USR mode fault */ 526 if (user) 527 userret(p); 528 } 529 530 531 /* 532 * void prefetch_abort_handler(trapframe_t *frame) 533 * 534 * Abort handler called when instruction execution occurs at 535 * a non existent or restricted (access permissions) memory page. 536 * If the address is invalid and we were in SVC mode then panic as 537 * the kernel should never prefetch abort. 538 * If the address is invalid and the page is mapped then the user process 539 * does no have read permission so send it a signal. 540 * Otherwise fault the page in and try again. 541 */ 542 543 extern int kernel_debug; 544 545 void 546 prefetch_abort_handler(frame) 547 trapframe_t *frame; 548 { 549 register u_int fault_pc; 550 register struct proc *p; 551 register struct pcb *pcb; 552 u_int fault_instruction; 553 pt_entry_t *pte; 554 int error; 555 556 /* 557 * Enable IRQ's (disabled by the abort) This always comes 558 * from user mode so we know interrupts were not disabled. 559 * But we check anyway. 560 */ 561 if (!(frame->tf_spsr & I32_bit)) 562 enable_interrupts(I32_bit); 563 564 #ifdef DEBUG 565 if ((GetCPSR() & PSR_MODE) != PSR_SVC32_MODE) 566 panic("prefetch_abort_handler: not in SVC32 mode"); 567 #endif 568 569 /* Update vmmeter statistics */ 570 uvmexp.traps++; 571 572 /* Call the cpu specific abort fixup routine */ 573 error = cpu_prefetchabt_fixup(frame); 574 if (error == ABORT_FIXUP_RETURN) 575 return; 576 if (error == ABORT_FIXUP_FAILED) 577 panic("prefetch abort fixup failed\n"); 578 579 /* Get the current proc structure or proc0 if there is none */ 580 if ((p = curproc) == 0) { 581 p = &proc0; 582 #ifdef DEBUG 583 printf("Prefetch abort with curproc == 0\n"); 584 #endif 585 } 586 587 #ifdef PMAP_DEBUG 588 if (pmap_debug_level >= 0) 589 printf("prefetch fault in process %p %s\n", p, p->p_comm); 590 #endif 591 /* 592 * can't use curpcb, as it might be NULL; and we have p in a 593 * register anyway 594 */ 595 pcb = &p->p_addr->u_pcb; 596 if (pcb == 0) 597 panic("prefetch_abort_handler: no pcb ... we're toast !\n"); 598 599 #ifdef DEBUG 600 if (pcb != curpcb) { 601 printf("data_abort: Alert ! pcb(%p) != curpcb(%p)\n", 602 pcb, curpcb); 603 printf("data_abort: Alert ! proc(%p), curproc(%p)\n", 604 p, curproc); 605 } 606 #endif /* DEBUG */ 607 608 /* Get fault address */ 609 fault_pc = frame->tf_pc; 610 611 /* Was the prefectch abort from USR32 mode ? */ 612 if ((frame->tf_spsr & PSR_MODE) == PSR_USR32_MODE) { 613 p->p_addr->u_pcb.pcb_tf = frame; 614 } else { 615 /* 616 * All the kernel code pages are loaded at boot time 617 * and do not get paged 618 */ 619 panic("Prefetch abort in non-USR mode (frame=%p PC=0x%08x)\n", 620 frame, fault_pc); 621 } 622 623 #ifdef PMAP_DEBUG 624 if (pmap_debug_level >= 0) 625 printf("prefetch_abort: PC = %08x\n", fault_pc); 626 #endif 627 /* Ok validate the address, can only execute in USER space */ 628 if (fault_pc < VM_MIN_ADDRESS || fault_pc >= VM_MAXUSER_ADDRESS) { 629 #ifdef DEBUG 630 printf("prefetch: pc (%08x) not in user process space\n", 631 fault_pc); 632 #endif 633 trapsignal(p, SIGSEGV, fault_pc); 634 userret(p); 635 return; 636 } 637 638 /* Is the page already mapped ? */ 639 /* This is debugging for rev K SA110 silicon */ 640 pte = pmap_pte(p->p_vmspace->vm_map.pmap, (vaddr_t)fault_pc); 641 if (pte && *pte != 0) { 642 if (kernel_debug & 1) { 643 printf("prefetch_abort: page is already mapped - pte=%p *pte=%08x\n", 644 pte, *pte); 645 printf("prefetch_abort: pc=%08x proc=%p process=%s\n", fault_pc, p, p->p_comm); 646 printf("prefetch_abort: far=%08x fs=%x\n", cpu_faultaddress(), cpu_faultstatus()); 647 printf("prefetch_abort: trapframe=%08x\n", (u_int)frame); 648 } 649 #ifdef DDB 650 if (kernel_debug & 2) 651 Debugger(); 652 #endif 653 } 654 655 /* Ok read the fault address. This will fault the page in for us */ 656 if (fetchuserword(fault_pc, &fault_instruction) != 0) { 657 #ifdef DEBUG 658 printf("prefetch: faultin failed for address %08x\n", 659 fault_pc); 660 #endif 661 trapsignal(p, SIGSEGV, fault_pc); 662 } else { 663 664 #ifdef DIAGNOSTIC 665 /* More debug stuff */ 666 667 #ifdef PMAP_DEBUG 668 if (pmap_debug_level >= 0) { 669 printf("Instruction @V%08x = %08x\n", fault_pc, 670 fault_instruction); 671 disassemble(fault_pc); 672 printf("return addr=%08x", frame->tf_pc); 673 pte = pmap_pte(p->p_vmspace->vm_map.pmap, 674 (vaddr_t)fault_pc); 675 if (pte) 676 printf(" pte=%p *pte=%08x\n", pte, *pte); 677 else 678 printf("\n"); 679 680 } 681 #endif /* PMAP_DEBUG */ 682 #endif /* DIAGNOSTIC */ 683 } 684 685 userret(p); 686 } 687 688 int 689 cowfault(va) 690 vaddr_t va; 691 { 692 struct vmspace *vm; 693 int error; 694 695 if (va >= VM_MAXUSER_ADDRESS) 696 return (EFAULT); 697 698 /* uvm_fault can't be called from within an interrupt */ 699 KASSERT(current_intr_depth == 0); 700 701 vm = curproc->p_vmspace; 702 error = uvm_fault(&vm->vm_map, va, 0, VM_PROT_READ | VM_PROT_WRITE); 703 return error; 704 } 705 706 /* End of fault.c */ 707