fault.c 11 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465
  1. /*
  2. * linux/arch/arm/mm/fault.c
  3. *
  4. * Copyright (C) 1995 Linus Torvalds
  5. * Modifications for ARM processor (c) 1995-2004 Russell King
  6. *
  7. * This program is free software; you can redistribute it and/or modify
  8. * it under the terms of the GNU General Public License version 2 as
  9. * published by the Free Software Foundation.
  10. */
  11. #include <linux/module.h>
  12. #include <linux/signal.h>
  13. #include <linux/ptrace.h>
  14. #include <linux/mm.h>
  15. #include <linux/init.h>
  16. #include <asm/system.h>
  17. #include <asm/pgtable.h>
  18. #include <asm/tlbflush.h>
  19. #include <asm/uaccess.h>
  20. #include "fault.h"
  21. /*
  22. * This is useful to dump out the page tables associated with
  23. * 'addr' in mm 'mm'.
  24. */
  25. void show_pte(struct mm_struct *mm, unsigned long addr)
  26. {
  27. pgd_t *pgd;
  28. if (!mm)
  29. mm = &init_mm;
  30. printk(KERN_ALERT "pgd = %p\n", mm->pgd);
  31. pgd = pgd_offset(mm, addr);
  32. printk(KERN_ALERT "[%08lx] *pgd=%08lx", addr, pgd_val(*pgd));
  33. do {
  34. pmd_t *pmd;
  35. pte_t *pte;
  36. if (pgd_none(*pgd))
  37. break;
  38. if (pgd_bad(*pgd)) {
  39. printk("(bad)");
  40. break;
  41. }
  42. pmd = pmd_offset(pgd, addr);
  43. #if PTRS_PER_PMD != 1
  44. printk(", *pmd=%08lx", pmd_val(*pmd));
  45. #endif
  46. if (pmd_none(*pmd))
  47. break;
  48. if (pmd_bad(*pmd)) {
  49. printk("(bad)");
  50. break;
  51. }
  52. #ifndef CONFIG_HIGHMEM
  53. /* We must not map this if we have highmem enabled */
  54. pte = pte_offset_map(pmd, addr);
  55. printk(", *pte=%08lx", pte_val(*pte));
  56. printk(", *ppte=%08lx", pte_val(pte[-PTRS_PER_PTE]));
  57. pte_unmap(pte);
  58. #endif
  59. } while(0);
  60. printk("\n");
  61. }
  62. /*
  63. * Oops. The kernel tried to access some page that wasn't present.
  64. */
  65. static void
  66. __do_kernel_fault(struct mm_struct *mm, unsigned long addr, unsigned int fsr,
  67. struct pt_regs *regs)
  68. {
  69. /*
  70. * Are we prepared to handle this kernel fault?
  71. */
  72. if (fixup_exception(regs))
  73. return;
  74. /*
  75. * No handler, we'll have to terminate things with extreme prejudice.
  76. */
  77. bust_spinlocks(1);
  78. printk(KERN_ALERT
  79. "Unable to handle kernel %s at virtual address %08lx\n",
  80. (addr < PAGE_SIZE) ? "NULL pointer dereference" :
  81. "paging request", addr);
  82. show_pte(mm, addr);
  83. die("Oops", regs, fsr);
  84. bust_spinlocks(0);
  85. do_exit(SIGKILL);
  86. }
  87. /*
  88. * Something tried to access memory that isn't in our memory map..
  89. * User mode accesses just cause a SIGSEGV
  90. */
  91. static void
  92. __do_user_fault(struct task_struct *tsk, unsigned long addr,
  93. unsigned int fsr, unsigned int sig, int code,
  94. struct pt_regs *regs)
  95. {
  96. struct siginfo si;
  97. #ifdef CONFIG_DEBUG_USER
  98. if (user_debug & UDBG_SEGV) {
  99. printk(KERN_DEBUG "%s: unhandled page fault (%d) at 0x%08lx, code 0x%03x\n",
  100. tsk->comm, sig, addr, fsr);
  101. show_pte(tsk->mm, addr);
  102. show_regs(regs);
  103. }
  104. #endif
  105. tsk->thread.address = addr;
  106. tsk->thread.error_code = fsr;
  107. tsk->thread.trap_no = 14;
  108. si.si_signo = sig;
  109. si.si_errno = 0;
  110. si.si_code = code;
  111. si.si_addr = (void __user *)addr;
  112. force_sig_info(sig, &si, tsk);
  113. }
  114. void do_bad_area(unsigned long addr, unsigned int fsr, struct pt_regs *regs)
  115. {
  116. struct task_struct *tsk = current;
  117. struct mm_struct *mm = tsk->active_mm;
  118. /*
  119. * If we are in kernel mode at this point, we
  120. * have no context to handle this fault with.
  121. */
  122. if (user_mode(regs))
  123. __do_user_fault(tsk, addr, fsr, SIGSEGV, SEGV_MAPERR, regs);
  124. else
  125. __do_kernel_fault(mm, addr, fsr, regs);
  126. }
  127. #define VM_FAULT_BADMAP (-20)
  128. #define VM_FAULT_BADACCESS (-21)
  129. static int
  130. __do_page_fault(struct mm_struct *mm, unsigned long addr, unsigned int fsr,
  131. struct task_struct *tsk)
  132. {
  133. struct vm_area_struct *vma;
  134. int fault, mask;
  135. vma = find_vma(mm, addr);
  136. fault = VM_FAULT_BADMAP;
  137. if (!vma)
  138. goto out;
  139. if (vma->vm_start > addr)
  140. goto check_stack;
  141. /*
  142. * Ok, we have a good vm_area for this
  143. * memory access, so we can handle it.
  144. */
  145. good_area:
  146. if (fsr & (1 << 11)) /* write? */
  147. mask = VM_WRITE;
  148. else
  149. mask = VM_READ|VM_EXEC|VM_WRITE;
  150. fault = VM_FAULT_BADACCESS;
  151. if (!(vma->vm_flags & mask))
  152. goto out;
  153. /*
  154. * If for any reason at all we couldn't handle
  155. * the fault, make sure we exit gracefully rather
  156. * than endlessly redo the fault.
  157. */
  158. survive:
  159. fault = handle_mm_fault(mm, vma, addr & PAGE_MASK, fsr & (1 << 11));
  160. /*
  161. * Handle the "normal" cases first - successful and sigbus
  162. */
  163. switch (fault) {
  164. case VM_FAULT_MAJOR:
  165. tsk->maj_flt++;
  166. return fault;
  167. case VM_FAULT_MINOR:
  168. tsk->min_flt++;
  169. case VM_FAULT_SIGBUS:
  170. return fault;
  171. }
  172. if (!is_init(tsk))
  173. goto out;
  174. /*
  175. * If we are out of memory for pid1, sleep for a while and retry
  176. */
  177. up_read(&mm->mmap_sem);
  178. yield();
  179. down_read(&mm->mmap_sem);
  180. goto survive;
  181. check_stack:
  182. if (vma->vm_flags & VM_GROWSDOWN && !expand_stack(vma, addr))
  183. goto good_area;
  184. out:
  185. return fault;
  186. }
  187. static int
  188. do_page_fault(unsigned long addr, unsigned int fsr, struct pt_regs *regs)
  189. {
  190. struct task_struct *tsk;
  191. struct mm_struct *mm;
  192. int fault, sig, code;
  193. tsk = current;
  194. mm = tsk->mm;
  195. /*
  196. * If we're in an interrupt or have no user
  197. * context, we must not take the fault..
  198. */
  199. if (in_atomic() || !mm)
  200. goto no_context;
  201. /*
  202. * As per x86, we may deadlock here. However, since the kernel only
  203. * validly references user space from well defined areas of the code,
  204. * we can bug out early if this is from code which shouldn't.
  205. */
  206. if (!down_read_trylock(&mm->mmap_sem)) {
  207. if (!user_mode(regs) && !search_exception_tables(regs->ARM_pc))
  208. goto no_context;
  209. down_read(&mm->mmap_sem);
  210. }
  211. fault = __do_page_fault(mm, addr, fsr, tsk);
  212. up_read(&mm->mmap_sem);
  213. /*
  214. * Handle the "normal" case first - VM_FAULT_MAJOR / VM_FAULT_MINOR
  215. */
  216. if (fault >= VM_FAULT_MINOR)
  217. return 0;
  218. /*
  219. * If we are in kernel mode at this point, we
  220. * have no context to handle this fault with.
  221. */
  222. if (!user_mode(regs))
  223. goto no_context;
  224. switch (fault) {
  225. case VM_FAULT_OOM:
  226. /*
  227. * We ran out of memory, or some other thing
  228. * happened to us that made us unable to handle
  229. * the page fault gracefully.
  230. */
  231. printk("VM: killing process %s\n", tsk->comm);
  232. do_exit(SIGKILL);
  233. return 0;
  234. case VM_FAULT_SIGBUS:
  235. /*
  236. * We had some memory, but were unable to
  237. * successfully fix up this page fault.
  238. */
  239. sig = SIGBUS;
  240. code = BUS_ADRERR;
  241. break;
  242. default:
  243. /*
  244. * Something tried to access memory that
  245. * isn't in our memory map..
  246. */
  247. sig = SIGSEGV;
  248. code = fault == VM_FAULT_BADACCESS ?
  249. SEGV_ACCERR : SEGV_MAPERR;
  250. break;
  251. }
  252. __do_user_fault(tsk, addr, fsr, sig, code, regs);
  253. return 0;
  254. no_context:
  255. __do_kernel_fault(mm, addr, fsr, regs);
  256. return 0;
  257. }
  258. /*
  259. * First Level Translation Fault Handler
  260. *
  261. * We enter here because the first level page table doesn't contain
  262. * a valid entry for the address.
  263. *
  264. * If the address is in kernel space (>= TASK_SIZE), then we are
  265. * probably faulting in the vmalloc() area.
  266. *
  267. * If the init_task's first level page tables contains the relevant
  268. * entry, we copy the it to this task. If not, we send the process
  269. * a signal, fixup the exception, or oops the kernel.
  270. *
  271. * NOTE! We MUST NOT take any locks for this case. We may be in an
  272. * interrupt or a critical region, and should only copy the information
  273. * from the master page table, nothing more.
  274. */
  275. static int
  276. do_translation_fault(unsigned long addr, unsigned int fsr,
  277. struct pt_regs *regs)
  278. {
  279. unsigned int index;
  280. pgd_t *pgd, *pgd_k;
  281. pmd_t *pmd, *pmd_k;
  282. if (addr < TASK_SIZE)
  283. return do_page_fault(addr, fsr, regs);
  284. index = pgd_index(addr);
  285. /*
  286. * FIXME: CP15 C1 is write only on ARMv3 architectures.
  287. */
  288. pgd = cpu_get_pgd() + index;
  289. pgd_k = init_mm.pgd + index;
  290. if (pgd_none(*pgd_k))
  291. goto bad_area;
  292. if (!pgd_present(*pgd))
  293. set_pgd(pgd, *pgd_k);
  294. pmd_k = pmd_offset(pgd_k, addr);
  295. pmd = pmd_offset(pgd, addr);
  296. if (pmd_none(*pmd_k))
  297. goto bad_area;
  298. copy_pmd(pmd, pmd_k);
  299. return 0;
  300. bad_area:
  301. do_bad_area(addr, fsr, regs);
  302. return 0;
  303. }
  304. /*
  305. * Some section permission faults need to be handled gracefully.
  306. * They can happen due to a __{get,put}_user during an oops.
  307. */
  308. static int
  309. do_sect_fault(unsigned long addr, unsigned int fsr, struct pt_regs *regs)
  310. {
  311. do_bad_area(addr, fsr, regs);
  312. return 0;
  313. }
  314. /*
  315. * This abort handler always returns "fault".
  316. */
  317. static int
  318. do_bad(unsigned long addr, unsigned int fsr, struct pt_regs *regs)
  319. {
  320. return 1;
  321. }
  322. static struct fsr_info {
  323. int (*fn)(unsigned long addr, unsigned int fsr, struct pt_regs *regs);
  324. int sig;
  325. int code;
  326. const char *name;
  327. } fsr_info[] = {
  328. /*
  329. * The following are the standard ARMv3 and ARMv4 aborts. ARMv5
  330. * defines these to be "precise" aborts.
  331. */
  332. { do_bad, SIGSEGV, 0, "vector exception" },
  333. { do_bad, SIGILL, BUS_ADRALN, "alignment exception" },
  334. { do_bad, SIGKILL, 0, "terminal exception" },
  335. { do_bad, SIGILL, BUS_ADRALN, "alignment exception" },
  336. { do_bad, SIGBUS, 0, "external abort on linefetch" },
  337. { do_translation_fault, SIGSEGV, SEGV_MAPERR, "section translation fault" },
  338. { do_bad, SIGBUS, 0, "external abort on linefetch" },
  339. { do_page_fault, SIGSEGV, SEGV_MAPERR, "page translation fault" },
  340. { do_bad, SIGBUS, 0, "external abort on non-linefetch" },
  341. { do_bad, SIGSEGV, SEGV_ACCERR, "section domain fault" },
  342. { do_bad, SIGBUS, 0, "external abort on non-linefetch" },
  343. { do_bad, SIGSEGV, SEGV_ACCERR, "page domain fault" },
  344. { do_bad, SIGBUS, 0, "external abort on translation" },
  345. { do_sect_fault, SIGSEGV, SEGV_ACCERR, "section permission fault" },
  346. { do_bad, SIGBUS, 0, "external abort on translation" },
  347. { do_page_fault, SIGSEGV, SEGV_ACCERR, "page permission fault" },
  348. /*
  349. * The following are "imprecise" aborts, which are signalled by bit
  350. * 10 of the FSR, and may not be recoverable. These are only
  351. * supported if the CPU abort handler supports bit 10.
  352. */
  353. { do_bad, SIGBUS, 0, "unknown 16" },
  354. { do_bad, SIGBUS, 0, "unknown 17" },
  355. { do_bad, SIGBUS, 0, "unknown 18" },
  356. { do_bad, SIGBUS, 0, "unknown 19" },
  357. { do_bad, SIGBUS, 0, "lock abort" }, /* xscale */
  358. { do_bad, SIGBUS, 0, "unknown 21" },
  359. { do_bad, SIGBUS, BUS_OBJERR, "imprecise external abort" }, /* xscale */
  360. { do_bad, SIGBUS, 0, "unknown 23" },
  361. { do_bad, SIGBUS, 0, "dcache parity error" }, /* xscale */
  362. { do_bad, SIGBUS, 0, "unknown 25" },
  363. { do_bad, SIGBUS, 0, "unknown 26" },
  364. { do_bad, SIGBUS, 0, "unknown 27" },
  365. { do_bad, SIGBUS, 0, "unknown 28" },
  366. { do_bad, SIGBUS, 0, "unknown 29" },
  367. { do_bad, SIGBUS, 0, "unknown 30" },
  368. { do_bad, SIGBUS, 0, "unknown 31" }
  369. };
  370. void __init
  371. hook_fault_code(int nr, int (*fn)(unsigned long, unsigned int, struct pt_regs *),
  372. int sig, const char *name)
  373. {
  374. if (nr >= 0 && nr < ARRAY_SIZE(fsr_info)) {
  375. fsr_info[nr].fn = fn;
  376. fsr_info[nr].sig = sig;
  377. fsr_info[nr].name = name;
  378. }
  379. }
  380. /*
  381. * Dispatch a data abort to the relevant handler.
  382. */
  383. asmlinkage void
  384. do_DataAbort(unsigned long addr, unsigned int fsr, struct pt_regs *regs)
  385. {
  386. const struct fsr_info *inf = fsr_info + (fsr & 15) + ((fsr & (1 << 10)) >> 6);
  387. struct siginfo info;
  388. if (!inf->fn(addr, fsr, regs))
  389. return;
  390. printk(KERN_ALERT "Unhandled fault: %s (0x%03x) at 0x%08lx\n",
  391. inf->name, fsr, addr);
  392. info.si_signo = inf->sig;
  393. info.si_errno = 0;
  394. info.si_code = inf->code;
  395. info.si_addr = (void __user *)addr;
  396. notify_die("", regs, &info, fsr, 0);
  397. }
  398. asmlinkage void
  399. do_PrefetchAbort(unsigned long addr, struct pt_regs *regs)
  400. {
  401. do_translation_fault(addr, 0, regs);
  402. }