1 /* $NetBSD: fault.c,v 1.26 2003/01/17 22:28:49 thorpej Exp $ */ 2 3 /* 4 * Copyright (c) 1994-1997 Mark Brinicombe. 5 * Copyright (c) 1994 Brini. 6 * All rights reserved. 7 * 8 * This code is derived from software written for Brini by Mark Brinicombe 9 * 10 * Redistribution and use in source and binary forms, with or without 11 * modification, are permitted provided that the following conditions 12 * are met: 13 * 1. Redistributions of source code must retain the above copyright 14 * notice, this list of conditions and the following disclaimer. 15 * 2. Redistributions in binary form must reproduce the above copyright 16 * notice, this list of conditions and the following disclaimer in the 17 * documentation and/or other materials provided with the distribution. 18 * 3. All advertising materials mentioning features or use of this software 19 * must display the following acknowledgement: 20 * This product includes software developed by Brini. 21 * 4. The name of the company nor the name of the author may be used to 22 * endorse or promote products derived from this software without specific 23 * prior written permission. 24 * 25 * THIS SOFTWARE IS PROVIDED BY BRINI ``AS IS'' AND ANY EXPRESS OR IMPLIED 26 * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF 27 * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 28 * IN NO EVENT SHALL BRINI OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, 29 * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES 30 * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR 31 * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 32 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 33 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 34 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 35 * SUCH DAMAGE. 36 * 37 * RiscBSD kernel project 38 * 39 * fault.c 40 * 41 * Fault handlers 42 * 43 * Created : 28/11/94 44 */ 45 46 #include "opt_ddb.h" 47 #include "opt_pmap_debug.h" 48 49 #include <sys/types.h> 50 __KERNEL_RCSID(0, "$NetBSD: fault.c,v 1.26 2003/01/17 22:28:49 thorpej Exp $"); 51 52 #include <sys/param.h> 53 #include <sys/systm.h> 54 #include <sys/proc.h> 55 #include <sys/user.h> 56 #include <sys/kernel.h> 57 58 #include <uvm/uvm_extern.h> 59 60 #include <arm/cpuconf.h> 61 62 #include <machine/frame.h> 63 #include <arm/arm32/katelib.h> 64 #include <machine/cpu.h> 65 #include <machine/intr.h> 66 #ifdef DDB 67 #include <machine/db_machdep.h> 68 #endif 69 70 #include <arch/arm/arm/disassem.h> 71 #include <arm/arm32/machdep.h> 72 73 extern char fusubailout[]; 74 75 static void report_abort __P((const char *, u_int, u_int, u_int)); 76 77 /* Abort code */ 78 79 /* Define text descriptions of the different aborts */ 80 81 static const char *aborts[16] = { 82 "Write buffer fault", 83 "Alignment fault", 84 "Write buffer fault", 85 "Alignment fault", 86 "Bus error (LF section)", 87 "Translation fault (section)", 88 "Bus error (page)", 89 "Translation fault (page)", 90 "Bus error (section)", 91 "Domain error (section)", 92 "Bus error (page)", 93 "Domain error (page)", 94 "Bus error trans (L1)", 95 "Permission error (section)", 96 "Bus error trans (L2)", 97 "Permission error (page)" 98 }; 99 100 static void 101 report_abort(prefix, fault_status, fault_address, fault_pc) 102 const char *prefix; 103 u_int fault_status; 104 u_int fault_address; 105 u_int fault_pc; 106 { 107 #ifndef DEBUG 108 if (prefix == NULL) { 109 #endif 110 if (prefix) 111 printf("%s ", prefix); 112 printf("Data abort: '%s' status=%03x address=%08x PC=%08x\n", 113 aborts[fault_status & FAULT_TYPE_MASK], 114 fault_status & 0xfff, fault_address, fault_pc); 115 #ifndef DEBUG 116 } 117 #endif 118 } 119 120 static __volatile int data_abort_expected; 121 static __volatile int data_abort_received; 122 123 int 124 badaddr_read(void *addr, size_t size, void *rptr) 125 { 126 u_long rcpt; 127 int rv; 128 129 /* Tell the Data Abort handler that we're expecting one. */ 130 data_abort_received = 0; 131 data_abort_expected = 1; 132 133 cpu_drain_writebuf(); 134 135 /* Read from the test address. */ 136 switch (size) { 137 case sizeof(uint8_t): 138 __asm __volatile("ldrb %0, [%1]" 139 : "=r" (rcpt) 140 : "r" (addr)); 141 break; 142 143 case sizeof(uint16_t): 144 __asm __volatile("ldrh %0, [%1]" 145 : "=r" (rcpt) 146 : "r" (addr)); 147 break; 148 149 case sizeof(uint32_t): 150 __asm __volatile("ldr %0, [%1]" 151 : "=r" (rcpt) 152 : "r" (addr)); 153 break; 154 155 default: 156 data_abort_expected = 0; 157 panic("badaddr: invalid size (%lu)", (u_long) size); 158 } 159 160 /* Disallow further Data Aborts. */ 161 data_abort_expected = 0; 162 163 rv = data_abort_received; 164 data_abort_received = 0; 165 166 /* Copy the data back if no fault occurred. */ 167 if (rptr != NULL && rv == 0) { 168 switch (size) { 169 case sizeof(uint8_t): 170 *(uint8_t *) rptr = rcpt; 171 break; 172 173 case sizeof(uint16_t): 174 *(uint16_t *) rptr = rcpt; 175 break; 176 177 case sizeof(uint32_t): 178 *(uint32_t *) rptr = rcpt; 179 break; 180 } 181 } 182 183 /* Return true if the address was invalid. */ 184 return (rv); 185 } 186 187 /* 188 * void data_abort_handler(trapframe_t *frame) 189 * 190 * Abort handler called when read/write occurs at an address of 191 * a non existent or restricted (access permissions) memory page. 192 * We first need to identify the type of page fault. 193 */ 194 195 #define TRAP_CODE ((fault_status & 0x0f) | (fault_address & 0xfffffff0)) 196 197 void 198 data_abort_handler(frame) 199 trapframe_t *frame; 200 { 201 struct lwp *l; 202 struct proc *p; 203 struct pcb *pcb; 204 u_int fault_address; 205 u_int fault_status; 206 u_int fault_pc; 207 u_int fault_instruction; 208 int fault_code; 209 int user; 210 int error; 211 void *onfault; 212 213 /* 214 * If we were expecting a Data Abort, signal that we got 215 * one, adjust the PC to skip the faulting insn, and 216 * return. 217 */ 218 if (data_abort_expected) { 219 data_abort_received = 1; 220 frame->tf_pc += INSN_SIZE; 221 return; 222 } 223 224 /* 225 * Must get fault address and status from the CPU before 226 * re-enabling interrupts. (Interrupt handlers may take 227 * R/M emulation faults.) 228 */ 229 fault_address = cpu_faultaddress(); 230 fault_status = cpu_faultstatus(); 231 fault_pc = frame->tf_pc; 232 233 /* 234 * Enable IRQ's (disabled by CPU on abort) if trapframe 235 * shows they were enabled. 236 */ 237 if (!(frame->tf_spsr & I32_bit)) 238 enable_interrupts(I32_bit); 239 240 #ifdef DEBUG 241 if ((GetCPSR() & PSR_MODE) != PSR_SVC32_MODE) 242 panic("data_abort_handler: not in SVC32 mode"); 243 #endif 244 245 /* Update vmmeter statistics */ 246 uvmexp.traps++; 247 248 /* Extract the fault code from the fault status */ 249 fault_code = fault_status & FAULT_TYPE_MASK; 250 251 /* Get the current lwp structure or lwp0 if there is none */ 252 l = curlwp == NULL ? &lwp0 : curlwp; 253 p = l->l_proc; 254 255 /* 256 * can't use curpcb, as it might be NULL; and we have p in 257 * a register anyway 258 */ 259 pcb = &l->l_addr->u_pcb; 260 261 /* fusubailout is used by [fs]uswintr to avoid page faulting */ 262 if (pcb->pcb_onfault 263 && ((fault_code != FAULT_TRANS_S && fault_code != FAULT_TRANS_P && 264 fault_code != FAULT_PERM_S && fault_code != FAULT_PERM_P) 265 || pcb->pcb_onfault == fusubailout)) { 266 267 frame->tf_r0 = EFAULT; 268 copyfault: 269 #ifdef DEBUG 270 printf("Using pcb_onfault=%p addr=%08x st=%08x l=%p\n", 271 pcb->pcb_onfault, fault_address, fault_status, l); 272 #endif 273 frame->tf_pc = (u_int)pcb->pcb_onfault; 274 if ((frame->tf_spsr & PSR_MODE) == PSR_USR32_MODE) 275 panic("Yikes pcb_onfault=%p during USR mode fault", 276 pcb->pcb_onfault); 277 return; 278 } 279 280 /* More debug stuff */ 281 282 fault_instruction = ReadWord(fault_pc); 283 284 #ifdef PMAP_DEBUG 285 if (pmap_debug_level >= 0) { 286 report_abort(NULL, fault_status, fault_address, fault_pc); 287 printf("Instruction @V%08x = %08x\n", 288 fault_pc, fault_instruction); 289 } 290 #endif 291 292 /* Call the cpu specific abort fixup routine */ 293 error = cpu_dataabt_fixup(frame); 294 if (error == ABORT_FIXUP_RETURN) 295 return; 296 if (error == ABORT_FIXUP_FAILED) { 297 printf("pc = 0x%08x, opcode 0x%08x, insn = ", fault_pc, *((u_int *)fault_pc)); 298 disassemble(fault_pc); 299 printf("data abort handler: fixup failed for this instruction\n"); 300 } 301 302 #ifdef PMAP_DEBUG 303 if (pmap_debug_level >= 0) 304 printf("fault in process %p\n", p); 305 #endif 306 307 #ifdef DEBUG 308 /* Is this needed ? */ 309 if (pcb != curpcb) { 310 printf("data_abort: Alert ! pcb(%p) != curpcb(%p)\n", 311 pcb, curpcb); 312 printf("data_abort: Alert ! proc(%p), curlwp(%p)\n", 313 p, curlwp); 314 } 315 #endif /* DEBUG */ 316 317 /* Were we in user mode when the abort occurred ? */ 318 if ((frame->tf_spsr & PSR_MODE) == PSR_USR32_MODE) { 319 /* 320 * Note that the fault was from USR mode. 321 */ 322 user = 1; 323 l->l_addr->u_pcb.pcb_tf = frame; 324 } else 325 user = 0; 326 327 /* check if this was a failed fixup */ 328 if (error == ABORT_FIXUP_FAILED) { 329 if (user) { 330 trapsignal(l, SIGSEGV, TRAP_CODE); 331 userret(l); 332 return; 333 }; 334 panic("Data abort fixup failed in kernel - we're dead"); 335 }; 336 337 /* Now act on the fault type */ 338 switch (fault_code) { 339 case FAULT_WRTBUF_0: /* Write Buffer Fault */ 340 case FAULT_WRTBUF_1: /* Write Buffer Fault */ 341 /* If this happens forget it no point in continuing */ 342 343 /* FALLTHROUGH */ 344 345 case FAULT_ALIGN_0: /* Alignment Fault */ 346 case FAULT_ALIGN_1: /* Alignment Fault */ 347 /* 348 * Really this should just kill the process. 349 * Alignment faults are turned off in the kernel 350 * in order to get better performance from shorts with 351 * GCC so an alignment fault means somebody has played 352 * with the control register in the CPU. Might as well 353 * panic as the kernel was not compiled for aligned accesses. 354 */ 355 356 /* FALLTHROUGH */ 357 358 case FAULT_BUSERR_0: /* Bus Error LF Section */ 359 case FAULT_BUSERR_1: /* Bus Error Page */ 360 case FAULT_BUSERR_2: /* Bus Error Section */ 361 case FAULT_BUSERR_3: /* Bus Error Page */ 362 /* What will accutally cause a bus error ? */ 363 /* Real bus errors are not a process problem but hardware */ 364 365 /* FALLTHROUGH */ 366 367 case FAULT_DOMAIN_S: /* Section Domain Error Fault */ 368 case FAULT_DOMAIN_P: /* Page Domain Error Fault*/ 369 /* 370 * Right well we dont use domains, everything is 371 * always a client and thus subject to access permissions. 372 * If we get a domain error then we have corrupts PTE's 373 * so we might as well die ! 374 * I suppose eventually this should just kill the process 375 * who owns the PTE's but if this happens it implies a 376 * kernel problem. 377 */ 378 379 /* FALLTHROUGH */ 380 381 case FAULT_BUSTRNL1: /* Bus Error Trans L1 Fault */ 382 case FAULT_BUSTRNL2: /* Bus Error Trans L2 Fault */ 383 /* 384 * These faults imply that the PTE is corrupt. 385 * Likely to be a kernel fault so we had better stop. 386 */ 387 388 /* FALLTHROUGH */ 389 390 default : 391 /* Are there any combinations I have missed ? */ 392 report_abort(NULL, fault_status, fault_address, fault_pc); 393 394 we_re_toast: 395 /* 396 * Were are dead, try and provide some debug 397 * information before dying. 398 */ 399 #ifdef DDB 400 printf("Unhandled trap (frame = %p)\n", frame); 401 report_abort(NULL, fault_status, fault_address, fault_pc); 402 kdb_trap(-1, frame); 403 return; 404 #else 405 panic("Unhandled trap (frame = %p)", frame); 406 #endif /* DDB */ 407 408 case FAULT_TRANS_P: /* Page Translation Fault */ 409 case FAULT_PERM_P: /* Page Permission Fault */ 410 case FAULT_TRANS_S: /* Section Translation Fault */ 411 case FAULT_PERM_S: /* Section Permission Fault */ 412 /* 413 * Page/section translation/permission fault -- need to fault in 414 * the page and possibly the page table page. 415 */ 416 { 417 register vaddr_t va; 418 register struct vmspace *vm = p->p_vmspace; 419 register struct vm_map *map; 420 int rv; 421 vm_prot_t ftype; 422 extern struct vm_map *kernel_map; 423 424 va = trunc_page((vaddr_t)fault_address); 425 426 #ifdef PMAP_DEBUG 427 if (pmap_debug_level >= 0) 428 printf("page fault: addr=V%08lx ", va); 429 #endif 430 431 /* 432 * It is only a kernel address space fault iff: 433 * 1. user == 0 and 434 * 2. pcb_onfault not set or 435 * 3. pcb_onfault set but supervisor space fault 436 * The last can occur during an exec() copyin where the 437 * argument space is lazy-allocated. 438 */ 439 if (!user && 440 (va >= VM_MIN_KERNEL_ADDRESS || va < VM_MIN_ADDRESS)) { 441 /* Was the fault due to the FPE/IPKDB ? */ 442 if ((frame->tf_spsr & PSR_MODE) == PSR_UND32_MODE) { 443 report_abort("UND32", fault_status, 444 fault_address, fault_pc); 445 trapsignal(l, SIGSEGV, TRAP_CODE); 446 447 /* 448 * Force exit via userret() 449 * This is necessary as the FPE is an extension 450 * to userland that actually runs in a 451 * priveledged mode but uses USR mode 452 * permissions for its accesses. 453 */ 454 userret(l); 455 return; 456 } 457 map = kernel_map; 458 } else 459 map = &vm->vm_map; 460 461 #ifdef PMAP_DEBUG 462 if (pmap_debug_level >= 0) 463 printf("vmmap=%p ", map); 464 #endif 465 466 if (map == NULL) 467 panic("No map for fault address va = 0x%08lx", va); 468 469 /* 470 * We need to know whether the page should be mapped 471 * as R or R/W. The MMU does not give us the info as 472 * to whether the fault was caused by a read or a write. 473 * This means we need to disassemble the instruction 474 * responsible and determine if it was a read or write 475 * instruction. 476 */ 477 /* STR instruction ? */ 478 if ((fault_instruction & 0x0c100000) == 0x04000000) 479 ftype = VM_PROT_WRITE; 480 /* STM or CDT instruction ? */ 481 else if ((fault_instruction & 0x0a100000) == 0x08000000) 482 ftype = VM_PROT_WRITE; 483 /* STRH, STRSH or STRSB instruction ? */ 484 else if ((fault_instruction & 0x0e100090) == 0x00000090) 485 ftype = VM_PROT_WRITE; 486 /* SWP instruction ? */ 487 else if ((fault_instruction & 0x0fb00ff0) == 0x01000090) 488 ftype = VM_PROT_READ | VM_PROT_WRITE; 489 else 490 ftype = VM_PROT_READ; 491 492 #ifdef PMAP_DEBUG 493 if (pmap_debug_level >= 0) 494 printf("fault protection = %d\n", ftype); 495 #endif 496 497 if ((ftype & VM_PROT_WRITE) ? 498 pmap_modified_emulation(map->pmap, va) : 499 pmap_handled_emulation(map->pmap, va)) 500 goto out; 501 502 if (current_intr_depth > 0) { 503 #ifdef DDB 504 printf("Non-emulated page fault with intr_depth > 0\n"); 505 report_abort(NULL, fault_status, fault_address, fault_pc); 506 kdb_trap(-1, frame); 507 return; 508 #else 509 panic("Fault with intr_depth > 0"); 510 #endif /* DDB */ 511 } 512 513 onfault = pcb->pcb_onfault; 514 pcb->pcb_onfault = NULL; 515 rv = uvm_fault(map, va, 0, ftype); 516 pcb->pcb_onfault = onfault; 517 if (rv == 0) { 518 if (user != 0) /* Record any stack growth... */ 519 uvm_grow(p, trunc_page(va)); 520 goto out; 521 } 522 if (user == 0) { 523 if (pcb->pcb_onfault) { 524 frame->tf_r0 = rv; 525 goto copyfault; 526 } 527 printf("[u]vm_fault(%p, %lx, %x, 0) -> %x\n", 528 map, va, ftype, rv); 529 goto we_re_toast; 530 } 531 532 report_abort("", fault_status, fault_address, fault_pc); 533 if (rv == ENOMEM) { 534 printf("UVM: pid %d (%s), uid %d killed: " 535 "out of swap\n", p->p_pid, p->p_comm, 536 p->p_cred && p->p_ucred ? 537 p->p_ucred->cr_uid : -1); 538 trapsignal(l, SIGKILL, TRAP_CODE); 539 } else 540 trapsignal(l, SIGSEGV, TRAP_CODE); 541 break; 542 } 543 } 544 545 out: 546 /* Call userret() if it was a USR mode fault */ 547 if (user) 548 userret(l); 549 } 550 551 552 /* 553 * void prefetch_abort_handler(trapframe_t *frame) 554 * 555 * Abort handler called when instruction execution occurs at 556 * a non existent or restricted (access permissions) memory page. 557 * If the address is invalid and we were in SVC mode then panic as 558 * the kernel should never prefetch abort. 559 * If the address is invalid and the page is mapped then the user process 560 * does no have read permission so send it a signal. 561 * Otherwise fault the page in and try again. 562 */ 563 564 extern int kernel_debug; 565 566 void 567 prefetch_abort_handler(frame) 568 trapframe_t *frame; 569 { 570 struct lwp *l; 571 struct proc *p; 572 struct vm_map *map; 573 vaddr_t fault_pc, va; 574 int error; 575 576 /* 577 * Enable IRQ's (disabled by the abort) This always comes 578 * from user mode so we know interrupts were not disabled. 579 * But we check anyway. 580 */ 581 if (!(frame->tf_spsr & I32_bit)) 582 enable_interrupts(I32_bit); 583 584 #ifdef DEBUG 585 if ((GetCPSR() & PSR_MODE) != PSR_SVC32_MODE) 586 panic("prefetch_abort_handler: not in SVC32 mode"); 587 #endif 588 589 /* Update vmmeter statistics */ 590 uvmexp.traps++; 591 592 /* Call the cpu specific abort fixup routine */ 593 error = cpu_prefetchabt_fixup(frame); 594 if (error == ABORT_FIXUP_RETURN) 595 return; 596 if (error == ABORT_FIXUP_FAILED) 597 panic("prefetch abort fixup failed"); 598 599 /* Get the current proc structure or proc0 if there is none */ 600 if ((l = curlwp) == NULL) { 601 l = &lwp0; 602 #ifdef DEBUG 603 printf("Prefetch abort with curlwp == 0\n"); 604 #endif 605 } 606 p = l->l_proc; 607 608 #ifdef PMAP_DEBUG 609 if (pmap_debug_level >= 0) 610 printf("prefetch fault in process %p %s\n", p, p->p_comm); 611 #endif 612 613 /* Get fault address */ 614 fault_pc = frame->tf_pc; 615 va = trunc_page(fault_pc); 616 617 /* Was the prefectch abort from USR32 mode ? */ 618 if ((frame->tf_spsr & PSR_MODE) == PSR_USR32_MODE) { 619 l->l_addr->u_pcb.pcb_tf = frame; 620 } else { 621 /* 622 * All the kernel code pages are loaded at boot time 623 * and do not get paged 624 */ 625 panic("Prefetch abort in non-USR mode (frame=%p PC=0x%08lx)", 626 frame, fault_pc); 627 } 628 629 map = &p->p_vmspace->vm_map; 630 631 #ifdef PMAP_DEBUG 632 if (pmap_debug_level >= 0) 633 printf("prefetch_abort: PC = %08lx\n", fault_pc); 634 #endif 635 /* Ok validate the address, can only execute in USER space */ 636 if (fault_pc < VM_MIN_ADDRESS || fault_pc >= VM_MAXUSER_ADDRESS) { 637 #ifdef DEBUG 638 printf("prefetch: pc (%08lx) not in user process space\n", 639 fault_pc); 640 #endif 641 trapsignal(l, SIGSEGV, fault_pc); 642 userret(l); 643 return; 644 } 645 646 #ifdef CPU_SA110 647 /* 648 * There are bugs in the rev K SA110. This is a check for one 649 * of them. 650 */ 651 if (curcpu()->ci_arm_cputype == CPU_ID_SA110 && 652 curcpu()->ci_arm_cpurev < 3) { 653 /* Always current pmap */ 654 pt_entry_t *pte = vtopte((vaddr_t) fault_pc); 655 struct pmap *pmap = p->p_vmspace->vm_map.pmap; 656 657 if (pmap_pde_v(pmap_pde(pmap, (vaddr_t) fault_pc)) && 658 pmap_pte_v(pte)) { 659 if (kernel_debug & 1) { 660 printf("prefetch_abort: page is already " 661 "mapped - pte=%p *pte=%08x\n", pte, *pte); 662 printf("prefetch_abort: pc=%08lx proc=%p " 663 "process=%s\n", fault_pc, p, p->p_comm); 664 printf("prefetch_abort: far=%08x fs=%x\n", 665 cpu_faultaddress(), cpu_faultstatus()); 666 printf("prefetch_abort: trapframe=%08x\n", 667 (u_int)frame); 668 } 669 #ifdef DDB 670 if (kernel_debug & 2) 671 Debugger(); 672 #endif 673 } 674 } 675 #endif /* CPU_SA110 */ 676 677 if (pmap_handled_emulation(map->pmap, va)) 678 goto out; 679 680 if (current_intr_depth > 0) { 681 #ifdef DDB 682 printf("Non-emulated prefetch abort with intr_depth > 0\n"); 683 kdb_trap(-1, frame); 684 return; 685 #else 686 panic("Prefetch Abort with intr_depth > 0"); 687 #endif 688 } 689 690 error = uvm_fault(map, va, 0, VM_PROT_READ); 691 if (error == 0) 692 goto out; 693 694 if (error == ENOMEM) { 695 printf("UVM: pid %d (%s), uid %d killed: " 696 "out of swap\n", p->p_pid, p->p_comm, 697 p->p_cred && p->p_ucred ? 698 p->p_ucred->cr_uid : -1); 699 trapsignal(l, SIGKILL, fault_pc); 700 } else 701 trapsignal(l, SIGSEGV, fault_pc); 702 out: 703 userret(l); 704 } 705