Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next
[deliverable/linux.git] / arch / arm / mm / fault.c
1 /*
2 * linux/arch/arm/mm/fault.c
3 *
4 * Copyright (C) 1995 Linus Torvalds
5 * Modifications for ARM processor (c) 1995-2004 Russell King
6 *
7 * This program is free software; you can redistribute it and/or modify
8 * it under the terms of the GNU General Public License version 2 as
9 * published by the Free Software Foundation.
10 */
11 #include <linux/module.h>
12 #include <linux/signal.h>
13 #include <linux/mm.h>
14 #include <linux/hardirq.h>
15 #include <linux/init.h>
16 #include <linux/kprobes.h>
17 #include <linux/uaccess.h>
18 #include <linux/page-flags.h>
19 #include <linux/sched.h>
20 #include <linux/highmem.h>
21 #include <linux/perf_event.h>
22
23 #include <asm/exception.h>
24 #include <asm/system.h>
25 #include <asm/pgtable.h>
26 #include <asm/tlbflush.h>
27
28 #include "fault.h"
29
30 /*
31 * Fault status register encodings. We steal bit 31 for our own purposes.
32 */
33 #define FSR_LNX_PF (1 << 31)
34 #define FSR_WRITE (1 << 11)
35 #define FSR_FS4 (1 << 10)
36 #define FSR_FS3_0 (15)
37
38 static inline int fsr_fs(unsigned int fsr)
39 {
40 return (fsr & FSR_FS3_0) | (fsr & FSR_FS4) >> 6;
41 }
42
43 #ifdef CONFIG_MMU
44
45 #ifdef CONFIG_KPROBES
46 static inline int notify_page_fault(struct pt_regs *regs, unsigned int fsr)
47 {
48 int ret = 0;
49
50 if (!user_mode(regs)) {
51 /* kprobe_running() needs smp_processor_id() */
52 preempt_disable();
53 if (kprobe_running() && kprobe_fault_handler(regs, fsr))
54 ret = 1;
55 preempt_enable();
56 }
57
58 return ret;
59 }
60 #else
61 static inline int notify_page_fault(struct pt_regs *regs, unsigned int fsr)
62 {
63 return 0;
64 }
65 #endif
66
67 /*
68 * This is useful to dump out the page tables associated with
69 * 'addr' in mm 'mm'.
70 */
71 void show_pte(struct mm_struct *mm, unsigned long addr)
72 {
73 pgd_t *pgd;
74
75 if (!mm)
76 mm = &init_mm;
77
78 printk(KERN_ALERT "pgd = %p\n", mm->pgd);
79 pgd = pgd_offset(mm, addr);
80 printk(KERN_ALERT "[%08lx] *pgd=%08llx",
81 addr, (long long)pgd_val(*pgd));
82
83 do {
84 pud_t *pud;
85 pmd_t *pmd;
86 pte_t *pte;
87
88 if (pgd_none(*pgd))
89 break;
90
91 if (pgd_bad(*pgd)) {
92 printk("(bad)");
93 break;
94 }
95
96 pud = pud_offset(pgd, addr);
97 if (PTRS_PER_PUD != 1)
98 printk(", *pud=%08llx", (long long)pud_val(*pud));
99
100 if (pud_none(*pud))
101 break;
102
103 if (pud_bad(*pud)) {
104 printk("(bad)");
105 break;
106 }
107
108 pmd = pmd_offset(pud, addr);
109 if (PTRS_PER_PMD != 1)
110 printk(", *pmd=%08llx", (long long)pmd_val(*pmd));
111
112 if (pmd_none(*pmd))
113 break;
114
115 if (pmd_bad(*pmd)) {
116 printk("(bad)");
117 break;
118 }
119
120 /* We must not map this if we have highmem enabled */
121 if (PageHighMem(pfn_to_page(pmd_val(*pmd) >> PAGE_SHIFT)))
122 break;
123
124 pte = pte_offset_map(pmd, addr);
125 printk(", *pte=%08llx", (long long)pte_val(*pte));
126 printk(", *ppte=%08llx",
127 (long long)pte_val(pte[PTE_HWTABLE_PTRS]));
128 pte_unmap(pte);
129 } while(0);
130
131 printk("\n");
132 }
133 #else /* CONFIG_MMU */
134 void show_pte(struct mm_struct *mm, unsigned long addr)
135 { }
136 #endif /* CONFIG_MMU */
137
138 /*
139 * Oops. The kernel tried to access some page that wasn't present.
140 */
141 static void
142 __do_kernel_fault(struct mm_struct *mm, unsigned long addr, unsigned int fsr,
143 struct pt_regs *regs)
144 {
145 /*
146 * Are we prepared to handle this kernel fault?
147 */
148 if (fixup_exception(regs))
149 return;
150
151 /*
152 * No handler, we'll have to terminate things with extreme prejudice.
153 */
154 bust_spinlocks(1);
155 printk(KERN_ALERT
156 "Unable to handle kernel %s at virtual address %08lx\n",
157 (addr < PAGE_SIZE) ? "NULL pointer dereference" :
158 "paging request", addr);
159
160 show_pte(mm, addr);
161 die("Oops", regs, fsr);
162 bust_spinlocks(0);
163 do_exit(SIGKILL);
164 }
165
166 /*
167 * Something tried to access memory that isn't in our memory map..
168 * User mode accesses just cause a SIGSEGV
169 */
170 static void
171 __do_user_fault(struct task_struct *tsk, unsigned long addr,
172 unsigned int fsr, unsigned int sig, int code,
173 struct pt_regs *regs)
174 {
175 struct siginfo si;
176
177 #ifdef CONFIG_DEBUG_USER
178 if (user_debug & UDBG_SEGV) {
179 printk(KERN_DEBUG "%s: unhandled page fault (%d) at 0x%08lx, code 0x%03x\n",
180 tsk->comm, sig, addr, fsr);
181 show_pte(tsk->mm, addr);
182 show_regs(regs);
183 }
184 #endif
185
186 tsk->thread.address = addr;
187 tsk->thread.error_code = fsr;
188 tsk->thread.trap_no = 14;
189 si.si_signo = sig;
190 si.si_errno = 0;
191 si.si_code = code;
192 si.si_addr = (void __user *)addr;
193 force_sig_info(sig, &si, tsk);
194 }
195
196 void do_bad_area(unsigned long addr, unsigned int fsr, struct pt_regs *regs)
197 {
198 struct task_struct *tsk = current;
199 struct mm_struct *mm = tsk->active_mm;
200
201 /*
202 * If we are in kernel mode at this point, we
203 * have no context to handle this fault with.
204 */
205 if (user_mode(regs))
206 __do_user_fault(tsk, addr, fsr, SIGSEGV, SEGV_MAPERR, regs);
207 else
208 __do_kernel_fault(mm, addr, fsr, regs);
209 }
210
211 #ifdef CONFIG_MMU
212 #define VM_FAULT_BADMAP 0x010000
213 #define VM_FAULT_BADACCESS 0x020000
214
215 /*
216 * Check that the permissions on the VMA allow for the fault which occurred.
217 * If we encountered a write fault, we must have write permission, otherwise
218 * we allow any permission.
219 */
220 static inline bool access_error(unsigned int fsr, struct vm_area_struct *vma)
221 {
222 unsigned int mask = VM_READ | VM_WRITE | VM_EXEC;
223
224 if (fsr & FSR_WRITE)
225 mask = VM_WRITE;
226 if (fsr & FSR_LNX_PF)
227 mask = VM_EXEC;
228
229 return vma->vm_flags & mask ? false : true;
230 }
231
232 static int __kprobes
233 __do_page_fault(struct mm_struct *mm, unsigned long addr, unsigned int fsr,
234 struct task_struct *tsk)
235 {
236 struct vm_area_struct *vma;
237 int fault;
238
239 vma = find_vma(mm, addr);
240 fault = VM_FAULT_BADMAP;
241 if (unlikely(!vma))
242 goto out;
243 if (unlikely(vma->vm_start > addr))
244 goto check_stack;
245
246 /*
247 * Ok, we have a good vm_area for this
248 * memory access, so we can handle it.
249 */
250 good_area:
251 if (access_error(fsr, vma)) {
252 fault = VM_FAULT_BADACCESS;
253 goto out;
254 }
255
256 /*
257 * If for any reason at all we couldn't handle the fault, make
258 * sure we exit gracefully rather than endlessly redo the fault.
259 */
260 fault = handle_mm_fault(mm, vma, addr & PAGE_MASK, (fsr & FSR_WRITE) ? FAULT_FLAG_WRITE : 0);
261 if (unlikely(fault & VM_FAULT_ERROR))
262 return fault;
263 if (fault & VM_FAULT_MAJOR)
264 tsk->maj_flt++;
265 else
266 tsk->min_flt++;
267 return fault;
268
269 check_stack:
270 if (vma->vm_flags & VM_GROWSDOWN && !expand_stack(vma, addr))
271 goto good_area;
272 out:
273 return fault;
274 }
275
276 static int __kprobes
277 do_page_fault(unsigned long addr, unsigned int fsr, struct pt_regs *regs)
278 {
279 struct task_struct *tsk;
280 struct mm_struct *mm;
281 int fault, sig, code;
282
283 if (notify_page_fault(regs, fsr))
284 return 0;
285
286 tsk = current;
287 mm = tsk->mm;
288
289 /* Enable interrupts if they were enabled in the parent context. */
290 if (interrupts_enabled(regs))
291 local_irq_enable();
292
293 /*
294 * If we're in an interrupt or have no user
295 * context, we must not take the fault..
296 */
297 if (in_atomic() || !mm)
298 goto no_context;
299
300 /*
301 * As per x86, we may deadlock here. However, since the kernel only
302 * validly references user space from well defined areas of the code,
303 * we can bug out early if this is from code which shouldn't.
304 */
305 if (!down_read_trylock(&mm->mmap_sem)) {
306 if (!user_mode(regs) && !search_exception_tables(regs->ARM_pc))
307 goto no_context;
308 down_read(&mm->mmap_sem);
309 } else {
310 /*
311 * The above down_read_trylock() might have succeeded in
312 * which case, we'll have missed the might_sleep() from
313 * down_read()
314 */
315 might_sleep();
316 #ifdef CONFIG_DEBUG_VM
317 if (!user_mode(regs) &&
318 !search_exception_tables(regs->ARM_pc))
319 goto no_context;
320 #endif
321 }
322
323 fault = __do_page_fault(mm, addr, fsr, tsk);
324 up_read(&mm->mmap_sem);
325
326 perf_sw_event(PERF_COUNT_SW_PAGE_FAULTS, 1, regs, addr);
327 if (fault & VM_FAULT_MAJOR)
328 perf_sw_event(PERF_COUNT_SW_PAGE_FAULTS_MAJ, 1, regs, addr);
329 else if (fault & VM_FAULT_MINOR)
330 perf_sw_event(PERF_COUNT_SW_PAGE_FAULTS_MIN, 1, regs, addr);
331
332 /*
333 * Handle the "normal" case first - VM_FAULT_MAJOR / VM_FAULT_MINOR
334 */
335 if (likely(!(fault & (VM_FAULT_ERROR | VM_FAULT_BADMAP | VM_FAULT_BADACCESS))))
336 return 0;
337
338 if (fault & VM_FAULT_OOM) {
339 /*
340 * We ran out of memory, call the OOM killer, and return to
341 * userspace (which will retry the fault, or kill us if we
342 * got oom-killed)
343 */
344 pagefault_out_of_memory();
345 return 0;
346 }
347
348 /*
349 * If we are in kernel mode at this point, we
350 * have no context to handle this fault with.
351 */
352 if (!user_mode(regs))
353 goto no_context;
354
355 if (fault & VM_FAULT_SIGBUS) {
356 /*
357 * We had some memory, but were unable to
358 * successfully fix up this page fault.
359 */
360 sig = SIGBUS;
361 code = BUS_ADRERR;
362 } else {
363 /*
364 * Something tried to access memory that
365 * isn't in our memory map..
366 */
367 sig = SIGSEGV;
368 code = fault == VM_FAULT_BADACCESS ?
369 SEGV_ACCERR : SEGV_MAPERR;
370 }
371
372 __do_user_fault(tsk, addr, fsr, sig, code, regs);
373 return 0;
374
375 no_context:
376 __do_kernel_fault(mm, addr, fsr, regs);
377 return 0;
378 }
379 #else /* CONFIG_MMU */
380 static int
381 do_page_fault(unsigned long addr, unsigned int fsr, struct pt_regs *regs)
382 {
383 return 0;
384 }
385 #endif /* CONFIG_MMU */
386
387 /*
388 * First Level Translation Fault Handler
389 *
390 * We enter here because the first level page table doesn't contain
391 * a valid entry for the address.
392 *
393 * If the address is in kernel space (>= TASK_SIZE), then we are
394 * probably faulting in the vmalloc() area.
395 *
396 * If the init_task's first level page tables contains the relevant
397 * entry, we copy the it to this task. If not, we send the process
398 * a signal, fixup the exception, or oops the kernel.
399 *
400 * NOTE! We MUST NOT take any locks for this case. We may be in an
401 * interrupt or a critical region, and should only copy the information
402 * from the master page table, nothing more.
403 */
404 #ifdef CONFIG_MMU
405 static int __kprobes
406 do_translation_fault(unsigned long addr, unsigned int fsr,
407 struct pt_regs *regs)
408 {
409 unsigned int index;
410 pgd_t *pgd, *pgd_k;
411 pud_t *pud, *pud_k;
412 pmd_t *pmd, *pmd_k;
413
414 if (addr < TASK_SIZE)
415 return do_page_fault(addr, fsr, regs);
416
417 if (user_mode(regs))
418 goto bad_area;
419
420 index = pgd_index(addr);
421
422 /*
423 * FIXME: CP15 C1 is write only on ARMv3 architectures.
424 */
425 pgd = cpu_get_pgd() + index;
426 pgd_k = init_mm.pgd + index;
427
428 if (pgd_none(*pgd_k))
429 goto bad_area;
430 if (!pgd_present(*pgd))
431 set_pgd(pgd, *pgd_k);
432
433 pud = pud_offset(pgd, addr);
434 pud_k = pud_offset(pgd_k, addr);
435
436 if (pud_none(*pud_k))
437 goto bad_area;
438 if (!pud_present(*pud))
439 set_pud(pud, *pud_k);
440
441 pmd = pmd_offset(pud, addr);
442 pmd_k = pmd_offset(pud_k, addr);
443
444 /*
445 * On ARM one Linux PGD entry contains two hardware entries (see page
446 * tables layout in pgtable.h). We normally guarantee that we always
447 * fill both L1 entries. But create_mapping() doesn't follow the rule.
448 * It can create inidividual L1 entries, so here we have to call
449 * pmd_none() check for the entry really corresponded to address, not
450 * for the first of pair.
451 */
452 index = (addr >> SECTION_SHIFT) & 1;
453 if (pmd_none(pmd_k[index]))
454 goto bad_area;
455
456 copy_pmd(pmd, pmd_k);
457 return 0;
458
459 bad_area:
460 do_bad_area(addr, fsr, regs);
461 return 0;
462 }
463 #else /* CONFIG_MMU */
464 static int
465 do_translation_fault(unsigned long addr, unsigned int fsr,
466 struct pt_regs *regs)
467 {
468 return 0;
469 }
470 #endif /* CONFIG_MMU */
471
472 /*
473 * Some section permission faults need to be handled gracefully.
474 * They can happen due to a __{get,put}_user during an oops.
475 */
476 static int
477 do_sect_fault(unsigned long addr, unsigned int fsr, struct pt_regs *regs)
478 {
479 do_bad_area(addr, fsr, regs);
480 return 0;
481 }
482
483 /*
484 * This abort handler always returns "fault".
485 */
486 static int
487 do_bad(unsigned long addr, unsigned int fsr, struct pt_regs *regs)
488 {
489 return 1;
490 }
491
492 static struct fsr_info {
493 int (*fn)(unsigned long addr, unsigned int fsr, struct pt_regs *regs);
494 int sig;
495 int code;
496 const char *name;
497 } fsr_info[] = {
498 /*
499 * The following are the standard ARMv3 and ARMv4 aborts. ARMv5
500 * defines these to be "precise" aborts.
501 */
502 { do_bad, SIGSEGV, 0, "vector exception" },
503 { do_bad, SIGBUS, BUS_ADRALN, "alignment exception" },
504 { do_bad, SIGKILL, 0, "terminal exception" },
505 { do_bad, SIGBUS, BUS_ADRALN, "alignment exception" },
506 { do_bad, SIGBUS, 0, "external abort on linefetch" },
507 { do_translation_fault, SIGSEGV, SEGV_MAPERR, "section translation fault" },
508 { do_bad, SIGBUS, 0, "external abort on linefetch" },
509 { do_page_fault, SIGSEGV, SEGV_MAPERR, "page translation fault" },
510 { do_bad, SIGBUS, 0, "external abort on non-linefetch" },
511 { do_bad, SIGSEGV, SEGV_ACCERR, "section domain fault" },
512 { do_bad, SIGBUS, 0, "external abort on non-linefetch" },
513 { do_bad, SIGSEGV, SEGV_ACCERR, "page domain fault" },
514 { do_bad, SIGBUS, 0, "external abort on translation" },
515 { do_sect_fault, SIGSEGV, SEGV_ACCERR, "section permission fault" },
516 { do_bad, SIGBUS, 0, "external abort on translation" },
517 { do_page_fault, SIGSEGV, SEGV_ACCERR, "page permission fault" },
518 /*
519 * The following are "imprecise" aborts, which are signalled by bit
520 * 10 of the FSR, and may not be recoverable. These are only
521 * supported if the CPU abort handler supports bit 10.
522 */
523 { do_bad, SIGBUS, 0, "unknown 16" },
524 { do_bad, SIGBUS, 0, "unknown 17" },
525 { do_bad, SIGBUS, 0, "unknown 18" },
526 { do_bad, SIGBUS, 0, "unknown 19" },
527 { do_bad, SIGBUS, 0, "lock abort" }, /* xscale */
528 { do_bad, SIGBUS, 0, "unknown 21" },
529 { do_bad, SIGBUS, BUS_OBJERR, "imprecise external abort" }, /* xscale */
530 { do_bad, SIGBUS, 0, "unknown 23" },
531 { do_bad, SIGBUS, 0, "dcache parity error" }, /* xscale */
532 { do_bad, SIGBUS, 0, "unknown 25" },
533 { do_bad, SIGBUS, 0, "unknown 26" },
534 { do_bad, SIGBUS, 0, "unknown 27" },
535 { do_bad, SIGBUS, 0, "unknown 28" },
536 { do_bad, SIGBUS, 0, "unknown 29" },
537 { do_bad, SIGBUS, 0, "unknown 30" },
538 { do_bad, SIGBUS, 0, "unknown 31" }
539 };
540
541 void __init
542 hook_fault_code(int nr, int (*fn)(unsigned long, unsigned int, struct pt_regs *),
543 int sig, int code, const char *name)
544 {
545 if (nr < 0 || nr >= ARRAY_SIZE(fsr_info))
546 BUG();
547
548 fsr_info[nr].fn = fn;
549 fsr_info[nr].sig = sig;
550 fsr_info[nr].code = code;
551 fsr_info[nr].name = name;
552 }
553
554 /*
555 * Dispatch a data abort to the relevant handler.
556 */
557 asmlinkage void __exception
558 do_DataAbort(unsigned long addr, unsigned int fsr, struct pt_regs *regs)
559 {
560 const struct fsr_info *inf = fsr_info + fsr_fs(fsr);
561 struct siginfo info;
562
563 if (!inf->fn(addr, fsr & ~FSR_LNX_PF, regs))
564 return;
565
566 printk(KERN_ALERT "Unhandled fault: %s (0x%03x) at 0x%08lx\n",
567 inf->name, fsr, addr);
568
569 info.si_signo = inf->sig;
570 info.si_errno = 0;
571 info.si_code = inf->code;
572 info.si_addr = (void __user *)addr;
573 arm_notify_die("", regs, &info, fsr, 0);
574 }
575
576
577 static struct fsr_info ifsr_info[] = {
578 { do_bad, SIGBUS, 0, "unknown 0" },
579 { do_bad, SIGBUS, 0, "unknown 1" },
580 { do_bad, SIGBUS, 0, "debug event" },
581 { do_bad, SIGSEGV, SEGV_ACCERR, "section access flag fault" },
582 { do_bad, SIGBUS, 0, "unknown 4" },
583 { do_translation_fault, SIGSEGV, SEGV_MAPERR, "section translation fault" },
584 { do_bad, SIGSEGV, SEGV_ACCERR, "page access flag fault" },
585 { do_page_fault, SIGSEGV, SEGV_MAPERR, "page translation fault" },
586 { do_bad, SIGBUS, 0, "external abort on non-linefetch" },
587 { do_bad, SIGSEGV, SEGV_ACCERR, "section domain fault" },
588 { do_bad, SIGBUS, 0, "unknown 10" },
589 { do_bad, SIGSEGV, SEGV_ACCERR, "page domain fault" },
590 { do_bad, SIGBUS, 0, "external abort on translation" },
591 { do_sect_fault, SIGSEGV, SEGV_ACCERR, "section permission fault" },
592 { do_bad, SIGBUS, 0, "external abort on translation" },
593 { do_page_fault, SIGSEGV, SEGV_ACCERR, "page permission fault" },
594 { do_bad, SIGBUS, 0, "unknown 16" },
595 { do_bad, SIGBUS, 0, "unknown 17" },
596 { do_bad, SIGBUS, 0, "unknown 18" },
597 { do_bad, SIGBUS, 0, "unknown 19" },
598 { do_bad, SIGBUS, 0, "unknown 20" },
599 { do_bad, SIGBUS, 0, "unknown 21" },
600 { do_bad, SIGBUS, 0, "unknown 22" },
601 { do_bad, SIGBUS, 0, "unknown 23" },
602 { do_bad, SIGBUS, 0, "unknown 24" },
603 { do_bad, SIGBUS, 0, "unknown 25" },
604 { do_bad, SIGBUS, 0, "unknown 26" },
605 { do_bad, SIGBUS, 0, "unknown 27" },
606 { do_bad, SIGBUS, 0, "unknown 28" },
607 { do_bad, SIGBUS, 0, "unknown 29" },
608 { do_bad, SIGBUS, 0, "unknown 30" },
609 { do_bad, SIGBUS, 0, "unknown 31" },
610 };
611
612 void __init
613 hook_ifault_code(int nr, int (*fn)(unsigned long, unsigned int, struct pt_regs *),
614 int sig, int code, const char *name)
615 {
616 if (nr < 0 || nr >= ARRAY_SIZE(ifsr_info))
617 BUG();
618
619 ifsr_info[nr].fn = fn;
620 ifsr_info[nr].sig = sig;
621 ifsr_info[nr].code = code;
622 ifsr_info[nr].name = name;
623 }
624
625 asmlinkage void __exception
626 do_PrefetchAbort(unsigned long addr, unsigned int ifsr, struct pt_regs *regs)
627 {
628 const struct fsr_info *inf = ifsr_info + fsr_fs(ifsr);
629 struct siginfo info;
630
631 if (!inf->fn(addr, ifsr | FSR_LNX_PF, regs))
632 return;
633
634 printk(KERN_ALERT "Unhandled prefetch abort: %s (0x%03x) at 0x%08lx\n",
635 inf->name, ifsr, addr);
636
637 info.si_signo = inf->sig;
638 info.si_errno = 0;
639 info.si_code = inf->code;
640 info.si_addr = (void __user *)addr;
641 arm_notify_die("", regs, &info, ifsr, 0);
642 }
643
644 static int __init exceptions_init(void)
645 {
646 if (cpu_architecture() >= CPU_ARCH_ARMv6) {
647 hook_fault_code(4, do_translation_fault, SIGSEGV, SEGV_MAPERR,
648 "I-cache maintenance fault");
649 }
650
651 if (cpu_architecture() >= CPU_ARCH_ARMv7) {
652 /*
653 * TODO: Access flag faults introduced in ARMv6K.
654 * Runtime check for 'K' extension is needed
655 */
656 hook_fault_code(3, do_bad, SIGSEGV, SEGV_MAPERR,
657 "section access flag fault");
658 hook_fault_code(6, do_bad, SIGSEGV, SEGV_MAPERR,
659 "section access flag fault");
660 }
661
662 return 0;
663 }
664
665 arch_initcall(exceptions_init);
This page took 0.044696 seconds and 5 git commands to generate.