fault.c 7.7 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296
  1. /*
  2. * arch/microblaze/mm/fault.c
  3. *
  4. * Copyright (C) 2007 Xilinx, Inc. All rights reserved.
  5. *
  6. * Derived from "arch/ppc/mm/fault.c"
  7. * Copyright (C) 1995-1996 Gary Thomas ([email protected])
  8. *
  9. * Derived from "arch/i386/mm/fault.c"
  10. * Copyright (C) 1991, 1992, 1993, 1994 Linus Torvalds
  11. *
  12. * Modified by Cort Dougan and Paul Mackerras.
  13. *
  14. * This file is subject to the terms and conditions of the GNU General
  15. * Public License. See the file COPYING in the main directory of this
  16. * archive for more details.
  17. *
  18. */
  19. #include <linux/extable.h>
  20. #include <linux/signal.h>
  21. #include <linux/sched.h>
  22. #include <linux/kernel.h>
  23. #include <linux/errno.h>
  24. #include <linux/string.h>
  25. #include <linux/types.h>
  26. #include <linux/ptrace.h>
  27. #include <linux/mman.h>
  28. #include <linux/mm.h>
  29. #include <linux/interrupt.h>
  30. #include <linux/perf_event.h>
  31. #include <asm/page.h>
  32. #include <asm/mmu.h>
  33. #include <linux/mmu_context.h>
  34. #include <linux/uaccess.h>
  35. #include <asm/exceptions.h>
  36. static unsigned long pte_misses; /* updated by do_page_fault() */
  37. static unsigned long pte_errors; /* updated by do_page_fault() */
  38. /*
  39. * Check whether the instruction at regs->pc is a store using
  40. * an update addressing form which will update r1.
  41. */
  42. static int store_updates_sp(struct pt_regs *regs)
  43. {
  44. unsigned int inst;
  45. if (get_user(inst, (unsigned int __user *)regs->pc))
  46. return 0;
  47. /* check for 1 in the rD field */
  48. if (((inst >> 21) & 0x1f) != 1)
  49. return 0;
  50. /* check for store opcodes */
  51. if ((inst & 0xd0000000) == 0xd0000000)
  52. return 1;
  53. return 0;
  54. }
  55. /*
  56. * bad_page_fault is called when we have a bad access from the kernel.
  57. * It is called from do_page_fault above and from some of the procedures
  58. * in traps.c.
  59. */
  60. void bad_page_fault(struct pt_regs *regs, unsigned long address, int sig)
  61. {
  62. const struct exception_table_entry *fixup;
  63. /* MS: no context */
  64. /* Are we prepared to handle this fault? */
  65. fixup = search_exception_tables(regs->pc);
  66. if (fixup) {
  67. regs->pc = fixup->fixup;
  68. return;
  69. }
  70. /* kernel has accessed a bad area */
  71. die("kernel access of bad area", regs, sig);
  72. }
  73. /*
  74. * The error_code parameter is ESR for a data fault,
  75. * 0 for an instruction fault.
  76. */
  77. void do_page_fault(struct pt_regs *regs, unsigned long address,
  78. unsigned long error_code)
  79. {
  80. struct vm_area_struct *vma;
  81. struct mm_struct *mm = current->mm;
  82. int code = SEGV_MAPERR;
  83. int is_write = error_code & ESR_S;
  84. vm_fault_t fault;
  85. unsigned int flags = FAULT_FLAG_DEFAULT;
  86. regs->ear = address;
  87. regs->esr = error_code;
  88. /* On a kernel SLB miss we can only check for a valid exception entry */
  89. if (unlikely(kernel_mode(regs) && (address >= TASK_SIZE))) {
  90. pr_warn("kernel task_size exceed");
  91. _exception(SIGSEGV, regs, code, address);
  92. }
  93. /* for instr TLB miss and instr storage exception ESR_S is undefined */
  94. if ((error_code & 0x13) == 0x13 || (error_code & 0x11) == 0x11)
  95. is_write = 0;
  96. if (unlikely(faulthandler_disabled() || !mm)) {
  97. if (kernel_mode(regs))
  98. goto bad_area_nosemaphore;
  99. /* faulthandler_disabled() in user mode is really bad,
  100. as is current->mm == NULL. */
  101. pr_emerg("Page fault in user mode with faulthandler_disabled(), mm = %p\n",
  102. mm);
  103. pr_emerg("r15 = %lx MSR = %lx\n",
  104. regs->r15, regs->msr);
  105. die("Weird page fault", regs, SIGSEGV);
  106. }
  107. if (user_mode(regs))
  108. flags |= FAULT_FLAG_USER;
  109. perf_sw_event(PERF_COUNT_SW_PAGE_FAULTS, 1, regs, address);
  110. /* When running in the kernel we expect faults to occur only to
  111. * addresses in user space. All other faults represent errors in the
  112. * kernel and should generate an OOPS. Unfortunately, in the case of an
  113. * erroneous fault occurring in a code path which already holds mmap_lock
  114. * we will deadlock attempting to validate the fault against the
  115. * address space. Luckily the kernel only validly references user
  116. * space from well defined areas of code, which are listed in the
  117. * exceptions table.
  118. *
  119. * As the vast majority of faults will be valid we will only perform
  120. * the source reference check when there is a possibility of a deadlock.
  121. * Attempt to lock the address space, if we cannot we then validate the
  122. * source. If this is invalid we can skip the address space check,
  123. * thus avoiding the deadlock.
  124. */
  125. if (unlikely(!mmap_read_trylock(mm))) {
  126. if (kernel_mode(regs) && !search_exception_tables(regs->pc))
  127. goto bad_area_nosemaphore;
  128. retry:
  129. mmap_read_lock(mm);
  130. }
  131. vma = find_vma(mm, address);
  132. if (unlikely(!vma))
  133. goto bad_area;
  134. if (vma->vm_start <= address)
  135. goto good_area;
  136. if (unlikely(!(vma->vm_flags & VM_GROWSDOWN)))
  137. goto bad_area;
  138. if (unlikely(!is_write))
  139. goto bad_area;
  140. /*
  141. * N.B. The ABI allows programs to access up to
  142. * a few hundred bytes below the stack pointer (TBD).
  143. * The kernel signal delivery code writes up to about 1.5kB
  144. * below the stack pointer (r1) before decrementing it.
  145. * The exec code can write slightly over 640kB to the stack
  146. * before setting the user r1. Thus we allow the stack to
  147. * expand to 1MB without further checks.
  148. */
  149. if (unlikely(address + 0x100000 < vma->vm_end)) {
  150. /* get user regs even if this fault is in kernel mode */
  151. struct pt_regs *uregs = current->thread.regs;
  152. if (uregs == NULL)
  153. goto bad_area;
  154. /*
  155. * A user-mode access to an address a long way below
  156. * the stack pointer is only valid if the instruction
  157. * is one which would update the stack pointer to the
  158. * address accessed if the instruction completed,
  159. * i.e. either stwu rs,n(r1) or stwux rs,r1,rb
  160. * (or the byte, halfword, float or double forms).
  161. *
  162. * If we don't check this then any write to the area
  163. * between the last mapped region and the stack will
  164. * expand the stack rather than segfaulting.
  165. */
  166. if (address + 2048 < uregs->r1
  167. && (kernel_mode(regs) || !store_updates_sp(regs)))
  168. goto bad_area;
  169. }
  170. vma = expand_stack(mm, address);
  171. if (!vma)
  172. goto bad_area_nosemaphore;
  173. good_area:
  174. code = SEGV_ACCERR;
  175. /* a write */
  176. if (unlikely(is_write)) {
  177. if (unlikely(!(vma->vm_flags & VM_WRITE)))
  178. goto bad_area;
  179. flags |= FAULT_FLAG_WRITE;
  180. /* a read */
  181. } else {
  182. /* protection fault */
  183. if (unlikely(error_code & 0x08000000))
  184. goto bad_area;
  185. if (unlikely(!(vma->vm_flags & (VM_READ | VM_EXEC))))
  186. goto bad_area;
  187. }
  188. /*
  189. * If for any reason at all we couldn't handle the fault,
  190. * make sure we exit gracefully rather than endlessly redo
  191. * the fault.
  192. */
  193. fault = handle_mm_fault(vma, address, flags, regs);
  194. if (fault_signal_pending(fault, regs))
  195. return;
  196. /* The fault is fully completed (including releasing mmap lock) */
  197. if (fault & VM_FAULT_COMPLETED)
  198. return;
  199. if (unlikely(fault & VM_FAULT_ERROR)) {
  200. if (fault & VM_FAULT_OOM)
  201. goto out_of_memory;
  202. else if (fault & VM_FAULT_SIGSEGV)
  203. goto bad_area;
  204. else if (fault & VM_FAULT_SIGBUS)
  205. goto do_sigbus;
  206. BUG();
  207. }
  208. if (fault & VM_FAULT_RETRY) {
  209. flags |= FAULT_FLAG_TRIED;
  210. /*
  211. * No need to mmap_read_unlock(mm) as we would
  212. * have already released it in __lock_page_or_retry
  213. * in mm/filemap.c.
  214. */
  215. goto retry;
  216. }
  217. mmap_read_unlock(mm);
  218. /*
  219. * keep track of tlb+htab misses that are good addrs but
  220. * just need pte's created via handle_mm_fault()
  221. * -- Cort
  222. */
  223. pte_misses++;
  224. return;
  225. bad_area:
  226. mmap_read_unlock(mm);
  227. bad_area_nosemaphore:
  228. pte_errors++;
  229. /* User mode accesses cause a SIGSEGV */
  230. if (user_mode(regs)) {
  231. _exception(SIGSEGV, regs, code, address);
  232. return;
  233. }
  234. bad_page_fault(regs, address, SIGSEGV);
  235. return;
  236. /*
  237. * We ran out of memory, or some other thing happened to us that made
  238. * us unable to handle the page fault gracefully.
  239. */
  240. out_of_memory:
  241. mmap_read_unlock(mm);
  242. if (!user_mode(regs))
  243. bad_page_fault(regs, address, SIGKILL);
  244. else
  245. pagefault_out_of_memory();
  246. return;
  247. do_sigbus:
  248. mmap_read_unlock(mm);
  249. if (user_mode(regs)) {
  250. force_sig_fault(SIGBUS, BUS_ADRERR, (void __user *)address);
  251. return;
  252. }
  253. bad_page_fault(regs, address, SIGBUS);
  254. }