| 1 |
35 |
wfjm |
$Id: ECO-027-trap_mmu.txt 708 2015-08-03 06:41:43Z mueller $
|
| 2 |
|
|
|
| 3 |
|
|
Scope:
|
| 4 |
|
|
Introduced in release w11a_V0.71
|
| 5 |
|
|
Affects: all w11a systems
|
| 6 |
|
|
|
| 7 |
|
|
Symptom summary:
|
| 8 |
|
|
A mmu trap could be lost or vectored through 014 (bpt) rather 250 (mmu).
|
| 9 |
|
|
|
| 10 |
|
|
Background:
|
| 11 |
|
|
The PDP-11/70 and 11/45 MMU offers a 'mmu trap' feature, which can cause
|
| 12 |
|
|
a trap when a memory location is read or written. This can be enabled with
|
| 13 |
|
|
special ACF values in the page descriptor registers for each segment end
|
| 14 |
|
|
globally enabled with an enable bit in SSR0.
|
| 15 |
|
|
|
| 16 |
|
|
Since only 11/70 and 11/45 offer this (and J11 does not) this feature is
|
| 17 |
|
|
in general not used by operations systems.
|
| 18 |
|
|
|
| 19 |
|
|
Summary of issues:
|
| 20 |
|
|
When an instruction does more than one memory access and the mmu trap
|
| 21 |
|
|
condition occurs not on the last access
|
| 22 |
|
|
- an mmu trap could be missed
|
| 23 |
|
|
- an mmu trap might be vectored through 014 (the bpt vector)
|
| 24 |
|
|
The later happens for all read-modify-write accesses.
|
| 25 |
|
|
|
| 26 |
|
|
Analysis:
|
| 27 |
|
|
The VM_STAT.trap_mmu flag was copied into the R_STATUS.trap_mmu state bit
|
| 28 |
|
|
in do_memcheck, which is called for each memory wait. In case of a
|
| 29 |
|
|
read-modify-write the initial read will signal trap_mmu, while the
|
| 30 |
|
|
rmw completion will not (the mmu doesn't check on rmw completions).
|
| 31 |
|
|
This leads to
|
| 32 |
|
|
- lost mmu traps (e.g. when mmu trap comes on 1st of 2 access)
|
| 33 |
|
|
- mmu traps vectored through 014 (the bpt vector)
|
| 34 |
|
|
The later happens due to the logic of state s_opg_gen_rmw_w:
|
| 35 |
|
|
- do_memcheck can clear R_STATUS.trap_mmu
|
| 36 |
|
|
- do_fork_next still branches to s_trap_disp because R_STATUS.trap_mmu='1'
|
| 37 |
|
|
- s_trap_disp sees R_STATUS.trap_mmu='0' and miscalculates the vector
|
| 38 |
|
|
|
| 39 |
|
|
Fixes:
|
| 40 |
|
|
pdp11_sequencer was modified to ensure that R_STATUS.trap_mmu is only set
|
| 41 |
|
|
in do_memcheck. Same for trap_ysv (which had the same potential bug)
|
| 42 |
|
|
|
| 43 |
|
|
Provisos:
|
| 44 |
|
|
The issue was found by systematic testing of mmu fault and trap behavior.
|
| 45 |
|
|
Because known OS don't use mmu traps the issue should not have any impact
|
| 46 |
|
|
on practical usage with OS like rsx or 211bsd.
|
