Page error, page shortage or access violation?
You are reading an exception error code that the CPU pushes onto the stack before calling the page error handler. This error code contains 5 bits that you are interested in these 4:
- P = 0: The error was caused by a non-persistent page.
P = 1: The error was caused by a page level security violation.
- W / R = 0: The access causing the error was read.
W / R = 1: The access causing the error was written.
- U / S = 0: An error-causing access that occurred when the processor was running in supervisor mode.
U / S = 1: The access that is causing the error occurred while the processor was executing in user mode.
- I / D = 0: The error was not caused by retrieving the command.
I / D = 1: error caused by command retrieval.
If you get P = 0, the page is missing.
If you get P = 1, there are not enough privileges to access the page. The U / S tells you if it's in the kernel or the app. The I / D tells you if it is due to reading instructions or reading (reading / writing data). W / R tells you that this is a read or write that cannot be performed.
This is described in the section
Interrupt 14—Page-Fault Exception (#PF)
Intel® 64 and IA-32 Architectures Software Developer’s Manual, Volume 3: System Programming Guide
source to share
Alex's answer is perfectly correct, however you also need to combine this information with some information (for example by looking at the memory manager data). For example, some operating systems do not allocate memory-backing pages until they are first referenced, so if you get a read or write to a page that is not there, you might find that the reason it is missing , is because you haven't highlighted it yet and you have to highlight it and continue with the exception. Likewise, writing to a read-only page can occur as part of the copy-to-write mechanism (a number of systems do this, especially on posix style systems when doing fork ()), so you find writing to a read-only page, check the memory manager tables and see ,that the page should be copied, copy the page, update the page tables and continue.
I found that usually the only flag from the list Alex notices that this is interesting is the one that says if it was read or write. Also, you still need to check everything else from the MM tables.
source to share