blob: 51ab9e7e6c391b9497a08730a7b5e4c625c96304 [file] [log] [blame]
Paul Mackerras14cf11a2005-09-26 16:04:21 +10001/*
Paul Mackerras14cf11a2005-09-26 16:04:21 +10002 * PowerPC version
3 * Copyright (C) 1995-1996 Gary Thomas (gdt@linuxppc.org)
4 *
5 * Derived from "arch/i386/mm/fault.c"
6 * Copyright (C) 1991, 1992, 1993, 1994 Linus Torvalds
7 *
8 * Modified by Cort Dougan and Paul Mackerras.
9 *
10 * Modified for PPC64 by Dave Engebretsen (engebret@ibm.com)
11 *
12 * This program is free software; you can redistribute it and/or
13 * modify it under the terms of the GNU General Public License
14 * as published by the Free Software Foundation; either version
15 * 2 of the License, or (at your option) any later version.
16 */
17
Paul Mackerras14cf11a2005-09-26 16:04:21 +100018#include <linux/signal.h>
19#include <linux/sched.h>
20#include <linux/kernel.h>
21#include <linux/errno.h>
22#include <linux/string.h>
23#include <linux/types.h>
24#include <linux/ptrace.h>
25#include <linux/mman.h>
26#include <linux/mm.h>
27#include <linux/interrupt.h>
28#include <linux/highmem.h>
29#include <linux/module.h>
30#include <linux/kprobes.h>
Christoph Hellwig1eeb66a2007-05-08 00:27:03 -070031#include <linux/kdebug.h>
Ingo Molnarcdd6c482009-09-21 12:02:48 +020032#include <linux/perf_event.h>
Anton Blanchard28b54992010-08-24 13:15:28 +000033#include <linux/magic.h>
Christian Dietrich76462232011-06-04 05:36:54 +000034#include <linux/ratelimit.h>
Li Zhongba12eed2013-05-13 16:16:41 +000035#include <linux/context_tracking.h>
Paul Mackerras14cf11a2005-09-26 16:04:21 +100036
Brian King40900192008-10-22 05:53:45 +000037#include <asm/firmware.h>
Paul Mackerras14cf11a2005-09-26 16:04:21 +100038#include <asm/page.h>
39#include <asm/pgtable.h>
40#include <asm/mmu.h>
41#include <asm/mmu_context.h>
Paul Mackerras14cf11a2005-09-26 16:04:21 +100042#include <asm/uaccess.h>
43#include <asm/tlbflush.h>
Paul Mackerras14cf11a2005-09-26 16:04:21 +100044#include <asm/siginfo.h>
David Howellsae3a1972012-03-28 18:30:02 +010045#include <asm/debug.h>
Joakim Tjernlund5efab4a2009-11-20 00:21:02 +000046#include <mm/mmu_decl.h>
Christoph Hellwig9f90b992007-04-30 11:56:46 +010047
Jimi Xenidisc3dcf532011-09-29 10:55:14 +000048#include "icswx.h"
49
Anil S Keshavamurthy4f9e87c2006-06-26 00:25:27 -070050#ifdef CONFIG_KPROBES
Christoph Hellwig9f90b992007-04-30 11:56:46 +010051static inline int notify_page_fault(struct pt_regs *regs)
Anil S Keshavamurthy4f9e87c2006-06-26 00:25:27 -070052{
Christoph Hellwig9f90b992007-04-30 11:56:46 +010053 int ret = 0;
Anil S Keshavamurthy4f9e87c2006-06-26 00:25:27 -070054
Christoph Hellwig9f90b992007-04-30 11:56:46 +010055 /* kprobe_running() needs smp_processor_id() */
56 if (!user_mode(regs)) {
57 preempt_disable();
58 if (kprobe_running() && kprobe_fault_handler(regs, 11))
59 ret = 1;
60 preempt_enable();
61 }
Anil S Keshavamurthy4f9e87c2006-06-26 00:25:27 -070062
Christoph Hellwig9f90b992007-04-30 11:56:46 +010063 return ret;
Anil S Keshavamurthy4f9e87c2006-06-26 00:25:27 -070064}
65#else
Christoph Hellwig9f90b992007-04-30 11:56:46 +010066static inline int notify_page_fault(struct pt_regs *regs)
Anil S Keshavamurthy4f9e87c2006-06-26 00:25:27 -070067{
Christoph Hellwig9f90b992007-04-30 11:56:46 +010068 return 0;
Anil S Keshavamurthy4f9e87c2006-06-26 00:25:27 -070069}
70#endif
71
Paul Mackerras14cf11a2005-09-26 16:04:21 +100072/*
73 * Check whether the instruction at regs->nip is a store using
74 * an update addressing form which will update r1.
75 */
76static int store_updates_sp(struct pt_regs *regs)
77{
78 unsigned int inst;
79
80 if (get_user(inst, (unsigned int __user *)regs->nip))
81 return 0;
82 /* check for 1 in the rA field */
83 if (((inst >> 16) & 0x1f) != 1)
84 return 0;
85 /* check major opcode */
86 switch (inst >> 26) {
87 case 37: /* stwu */
88 case 39: /* stbu */
89 case 45: /* sthu */
90 case 53: /* stfsu */
91 case 55: /* stfdu */
92 return 1;
93 case 62: /* std or stdu */
94 return (inst & 3) == 1;
95 case 31:
96 /* check minor opcode */
97 switch ((inst >> 1) & 0x3ff) {
98 case 181: /* stdux */
99 case 183: /* stwux */
100 case 247: /* stbux */
101 case 439: /* sthux */
102 case 695: /* stfsux */
103 case 759: /* stfdux */
104 return 1;
105 }
106 }
107 return 0;
108}
Benjamin Herrenschmidt9be72572012-03-01 18:14:45 +1100109/*
110 * do_page_fault error handling helpers
111 */
112
113#define MM_FAULT_RETURN 0
114#define MM_FAULT_CONTINUE -1
115#define MM_FAULT_ERR(sig) (sig)
116
Benjamin Herrenschmidt9be72572012-03-01 18:14:45 +1100117static int do_sigbus(struct pt_regs *regs, unsigned long address)
118{
119 siginfo_t info;
120
121 up_read(&current->mm->mmap_sem);
122
123 if (user_mode(regs)) {
Ananth N Mavinakayanahalli41ab5262012-08-23 21:27:09 +0000124 current->thread.trap_nr = BUS_ADRERR;
Benjamin Herrenschmidt9be72572012-03-01 18:14:45 +1100125 info.si_signo = SIGBUS;
126 info.si_errno = 0;
127 info.si_code = BUS_ADRERR;
128 info.si_addr = (void __user *)address;
129 force_sig_info(SIGBUS, &info, current);
130 return MM_FAULT_RETURN;
131 }
132 return MM_FAULT_ERR(SIGBUS);
133}
134
135static int mm_fault_error(struct pt_regs *regs, unsigned long addr, int fault)
136{
137 /*
138 * Pagefault was interrupted by SIGKILL. We have no reason to
139 * continue the pagefault.
140 */
141 if (fatal_signal_pending(current)) {
142 /*
143 * If we have retry set, the mmap semaphore will have
144 * alrady been released in __lock_page_or_retry(). Else
145 * we release it now.
146 */
147 if (!(fault & VM_FAULT_RETRY))
148 up_read(&current->mm->mmap_sem);
149 /* Coming from kernel, we need to deal with uaccess fixups */
150 if (user_mode(regs))
151 return MM_FAULT_RETURN;
152 return MM_FAULT_ERR(SIGKILL);
153 }
154
155 /* No fault: be happy */
156 if (!(fault & VM_FAULT_ERROR))
157 return MM_FAULT_CONTINUE;
158
159 /* Out of memory */
David Rientjesc2d23f92012-12-12 13:52:10 -0800160 if (fault & VM_FAULT_OOM) {
161 up_read(&current->mm->mmap_sem);
162
163 /*
164 * We ran out of memory, or some other thing happened to us that
165 * made us unable to handle the page fault gracefully.
166 */
167 if (!user_mode(regs))
168 return MM_FAULT_ERR(SIGKILL);
169 pagefault_out_of_memory();
170 return MM_FAULT_RETURN;
171 }
Benjamin Herrenschmidt9be72572012-03-01 18:14:45 +1100172
173 /* Bus error. x86 handles HWPOISON here, we'll add this if/when
174 * we support the feature in HW
175 */
176 if (fault & VM_FAULT_SIGBUS)
177 return do_sigbus(regs, addr);
178
179 /* We don't understand the fault code, this is fatal */
180 BUG();
181 return MM_FAULT_CONTINUE;
182}
Paul Mackerras14cf11a2005-09-26 16:04:21 +1000183
Paul Mackerras14cf11a2005-09-26 16:04:21 +1000184/*
185 * For 600- and 800-family processors, the error_code parameter is DSISR
186 * for a data fault, SRR1 for an instruction fault. For 400-family processors
187 * the error_code parameter is ESR for a data fault, 0 for an instruction
188 * fault.
189 * For 64-bit processors, the error_code parameter is
190 * - DSISR for a non-SLB data access fault,
191 * - SRR1 & 0x08000000 for a non-SLB instruction access fault
192 * - 0 any SLB fault.
193 *
194 * The return value is 0 if the fault was handled, or the signal
195 * number if this is a kernel fault that can't be handled here.
196 */
197int __kprobes do_page_fault(struct pt_regs *regs, unsigned long address,
198 unsigned long error_code)
199{
Li Zhongba12eed2013-05-13 16:16:41 +0000200 enum ctx_state prev_state = exception_enter();
Paul Mackerras14cf11a2005-09-26 16:04:21 +1000201 struct vm_area_struct * vma;
202 struct mm_struct *mm = current->mm;
Benjamin Herrenschmidt9be72572012-03-01 18:14:45 +1100203 unsigned int flags = FAULT_FLAG_ALLOW_RETRY | FAULT_FLAG_KILLABLE;
Paul Mackerras14cf11a2005-09-26 16:04:21 +1000204 int code = SEGV_MAPERR;
Benjamin Herrenschmidt9be72572012-03-01 18:14:45 +1100205 int is_write = 0;
Paul Mackerras14cf11a2005-09-26 16:04:21 +1000206 int trap = TRAP(regs);
207 int is_exec = trap == 0x400;
Benjamin Herrenschmidt9be72572012-03-01 18:14:45 +1100208 int fault;
Aneesh Kumar K.V69e044d2013-09-10 18:44:42 +0530209 int rc = 0, store_update_sp = 0;
Paul Mackerras14cf11a2005-09-26 16:04:21 +1000210
211#if !(defined(CONFIG_4xx) || defined(CONFIG_BOOKE))
212 /*
213 * Fortunately the bit assignments in SRR1 for an instruction
214 * fault and DSISR for a data fault are mostly the same for the
215 * bits we are interested in. But there are some bits which
216 * indicate errors in DSISR but can validly be set in SRR1.
217 */
218 if (trap == 0x400)
219 error_code &= 0x48200000;
220 else
221 is_write = error_code & DSISR_ISSTORE;
222#else
223 is_write = error_code & ESR_DST;
224#endif /* CONFIG_4xx || CONFIG_BOOKE */
225
Jimi Xenidisc3dcf532011-09-29 10:55:14 +0000226#ifdef CONFIG_PPC_ICSWX
227 /*
228 * we need to do this early because this "data storage
229 * interrupt" does not update the DAR/DEAR so we don't want to
230 * look at it
231 */
232 if (error_code & ICSWX_DSI_UCT) {
Li Zhongba12eed2013-05-13 16:16:41 +0000233 rc = acop_handle_fault(regs, address, error_code);
Benjamin Herrenschmidt9be72572012-03-01 18:14:45 +1100234 if (rc)
Li Zhongba12eed2013-05-13 16:16:41 +0000235 goto bail;
Jimi Xenidisc3dcf532011-09-29 10:55:14 +0000236 }
Benjamin Herrenschmidt9be72572012-03-01 18:14:45 +1100237#endif /* CONFIG_PPC_ICSWX */
Jimi Xenidisc3dcf532011-09-29 10:55:14 +0000238
Christoph Hellwig9f90b992007-04-30 11:56:46 +0100239 if (notify_page_fault(regs))
Li Zhongba12eed2013-05-13 16:16:41 +0000240 goto bail;
Paul Mackerras14cf11a2005-09-26 16:04:21 +1000241
Michael Neulingc3b75bd2008-01-18 15:50:30 +1100242 if (unlikely(debugger_fault_handler(regs)))
Li Zhongba12eed2013-05-13 16:16:41 +0000243 goto bail;
Paul Mackerras14cf11a2005-09-26 16:04:21 +1000244
245 /* On a kernel SLB miss we can only check for a valid exception entry */
Li Zhongba12eed2013-05-13 16:16:41 +0000246 if (!user_mode(regs) && (address >= TASK_SIZE)) {
247 rc = SIGSEGV;
248 goto bail;
249 }
Paul Mackerras14cf11a2005-09-26 16:04:21 +1000250
K.Prasad9c7cc232010-03-29 23:59:25 +0000251#if !(defined(CONFIG_4xx) || defined(CONFIG_BOOKE) || \
252 defined(CONFIG_PPC_BOOK3S_64))
Paul Mackerras14cf11a2005-09-26 16:04:21 +1000253 if (error_code & DSISR_DABRMATCH) {
Michael Neuling9422de32012-12-20 14:06:44 +0000254 /* breakpoint match */
255 do_break(regs, address, error_code);
Li Zhongba12eed2013-05-13 16:16:41 +0000256 goto bail;
Paul Mackerras14cf11a2005-09-26 16:04:21 +1000257 }
K.Prasad9c7cc232010-03-29 23:59:25 +0000258#endif
Paul Mackerras14cf11a2005-09-26 16:04:21 +1000259
Benjamin Herrenschmidta5464982012-03-07 16:48:45 +1100260 /* We restore the interrupt state now */
261 if (!arch_irq_disabled_regs(regs))
262 local_irq_enable();
263
Paul Mackerras14cf11a2005-09-26 16:04:21 +1000264 if (in_atomic() || mm == NULL) {
Li Zhongba12eed2013-05-13 16:16:41 +0000265 if (!user_mode(regs)) {
266 rc = SIGSEGV;
267 goto bail;
268 }
Paul Mackerras14cf11a2005-09-26 16:04:21 +1000269 /* in_atomic() in user mode is really bad,
270 as is current->mm == NULL. */
joe@perches.comdf3c9012007-11-20 12:47:55 +1100271 printk(KERN_EMERG "Page fault in user mode with "
Paul Mackerras14cf11a2005-09-26 16:04:21 +1000272 "in_atomic() = %d mm = %p\n", in_atomic(), mm);
273 printk(KERN_EMERG "NIP = %lx MSR = %lx\n",
274 regs->nip, regs->msr);
275 die("Weird page fault", regs, SIGSEGV);
276 }
277
Peter Zijlstraa8b0ca12011-06-27 14:41:57 +0200278 perf_sw_event(PERF_COUNT_SW_PAGE_FAULTS, 1, regs, address);
Peter Zijlstra7dd1fcc2009-03-13 12:21:33 +0100279
Aneesh Kumar K.V69e044d2013-09-10 18:44:42 +0530280 /*
281 * We want to do this outside mmap_sem, because reading code around nip
282 * can result in fault, which will cause a deadlock when called with
283 * mmap_sem held
284 */
285 if (user_mode(regs))
286 store_update_sp = store_updates_sp(regs);
287
Johannes Weiner759496b2013-09-12 15:13:39 -0700288 if (user_mode(regs))
289 flags |= FAULT_FLAG_USER;
290
Paul Mackerras14cf11a2005-09-26 16:04:21 +1000291 /* When running in the kernel we expect faults to occur only to
292 * addresses in user space. All other faults represent errors in the
Anton Blanchardfc5266e2006-04-01 11:33:12 +1100293 * kernel and should generate an OOPS. Unfortunately, in the case of an
294 * erroneous fault occurring in a code path which already holds mmap_sem
Paul Mackerras14cf11a2005-09-26 16:04:21 +1000295 * we will deadlock attempting to validate the fault against the
296 * address space. Luckily the kernel only validly references user
297 * space from well defined areas of code, which are listed in the
298 * exceptions table.
299 *
300 * As the vast majority of faults will be valid we will only perform
Anton Blanchardfc5266e2006-04-01 11:33:12 +1100301 * the source reference check when there is a possibility of a deadlock.
Paul Mackerras14cf11a2005-09-26 16:04:21 +1000302 * Attempt to lock the address space, if we cannot we then validate the
303 * source. If this is invalid we can skip the address space check,
304 * thus avoiding the deadlock.
305 */
306 if (!down_read_trylock(&mm->mmap_sem)) {
307 if (!user_mode(regs) && !search_exception_tables(regs->nip))
308 goto bad_area_nosemaphore;
309
Benjamin Herrenschmidt9be72572012-03-01 18:14:45 +1100310retry:
Paul Mackerras14cf11a2005-09-26 16:04:21 +1000311 down_read(&mm->mmap_sem);
Benjamin Herrenschmidta5464982012-03-07 16:48:45 +1100312 } else {
313 /*
314 * The above down_read_trylock() might have succeeded in
315 * which case we'll have missed the might_sleep() from
316 * down_read():
317 */
318 might_sleep();
Paul Mackerras14cf11a2005-09-26 16:04:21 +1000319 }
320
321 vma = find_vma(mm, address);
322 if (!vma)
323 goto bad_area;
324 if (vma->vm_start <= address)
325 goto good_area;
326 if (!(vma->vm_flags & VM_GROWSDOWN))
327 goto bad_area;
328
329 /*
330 * N.B. The POWER/Open ABI allows programs to access up to
331 * 288 bytes below the stack pointer.
332 * The kernel signal delivery code writes up to about 1.5kB
333 * below the stack pointer (r1) before decrementing it.
334 * The exec code can write slightly over 640kB to the stack
335 * before setting the user r1. Thus we allow the stack to
336 * expand to 1MB without further checks.
337 */
338 if (address + 0x100000 < vma->vm_end) {
339 /* get user regs even if this fault is in kernel mode */
340 struct pt_regs *uregs = current->thread.regs;
341 if (uregs == NULL)
342 goto bad_area;
343
344 /*
345 * A user-mode access to an address a long way below
346 * the stack pointer is only valid if the instruction
347 * is one which would update the stack pointer to the
348 * address accessed if the instruction completed,
349 * i.e. either stwu rs,n(r1) or stwux rs,r1,rb
350 * (or the byte, halfword, float or double forms).
351 *
352 * If we don't check this then any write to the area
353 * between the last mapped region and the stack will
354 * expand the stack rather than segfaulting.
355 */
Aneesh Kumar K.V69e044d2013-09-10 18:44:42 +0530356 if (address + 2048 < uregs->gpr[1] && !store_update_sp)
Paul Mackerras14cf11a2005-09-26 16:04:21 +1000357 goto bad_area;
358 }
359 if (expand_stack(vma, address))
360 goto bad_area;
361
362good_area:
363 code = SEGV_ACCERR;
364#if defined(CONFIG_6xx)
365 if (error_code & 0x95700000)
366 /* an error such as lwarx to I/O controller space,
367 address matching DABR, eciwx, etc. */
368 goto bad_area;
369#endif /* CONFIG_6xx */
370#if defined(CONFIG_8xx)
Joakim Tjernlund5efab4a2009-11-20 00:21:02 +0000371 /* 8xx sometimes need to load a invalid/non-present TLBs.
372 * These must be invalidated separately as linux mm don't.
373 */
374 if (error_code & 0x40000000) /* no translation? */
375 _tlbil_va(address, 0, 0, 0);
376
Paul Mackerras14cf11a2005-09-26 16:04:21 +1000377 /* The MPC8xx seems to always set 0x80000000, which is
378 * "undefined". Of those that can be set, this is the only
379 * one which seems bad.
380 */
381 if (error_code & 0x10000000)
382 /* Guarded storage error. */
383 goto bad_area;
384#endif /* CONFIG_8xx */
385
386 if (is_exec) {
Benjamin Herrenschmidt8d30c142009-02-10 16:02:37 +0000387#ifdef CONFIG_PPC_STD_MMU
388 /* Protection fault on exec go straight to failure on
389 * Hash based MMUs as they either don't support per-page
390 * execute permission, or if they do, it's handled already
391 * at the hash level. This test would probably have to
392 * be removed if we change the way this works to make hash
393 * processors use the same I/D cache coherency mechanism
394 * as embedded.
395 */
Paul Mackerras14cf11a2005-09-26 16:04:21 +1000396 if (error_code & DSISR_PROTFAULT)
397 goto bad_area;
Benjamin Herrenschmidt8d30c142009-02-10 16:02:37 +0000398#endif /* CONFIG_PPC_STD_MMU */
399
Paul Mackerras08ae6cc2007-07-19 10:00:20 +1000400 /*
401 * Allow execution from readable areas if the MMU does not
402 * provide separate controls over reading and executing.
Benjamin Herrenschmidt8d30c142009-02-10 16:02:37 +0000403 *
404 * Note: That code used to not be enabled for 4xx/BookE.
405 * It is now as I/D cache coherency for these is done at
406 * set_pte_at() time and I see no reason why the test
407 * below wouldn't be valid on those processors. This -may-
408 * break programs compiled with a really old ABI though.
Paul Mackerras08ae6cc2007-07-19 10:00:20 +1000409 */
410 if (!(vma->vm_flags & VM_EXEC) &&
411 (cpu_has_feature(CPU_FTR_NOEXECUTE) ||
412 !(vma->vm_flags & (VM_READ | VM_WRITE))))
Paul Mackerras14cf11a2005-09-26 16:04:21 +1000413 goto bad_area;
Paul Mackerras14cf11a2005-09-26 16:04:21 +1000414 /* a write */
415 } else if (is_write) {
416 if (!(vma->vm_flags & VM_WRITE))
417 goto bad_area;
Johannes Weiner759496b2013-09-12 15:13:39 -0700418 flags |= FAULT_FLAG_WRITE;
Paul Mackerras14cf11a2005-09-26 16:04:21 +1000419 /* a read */
420 } else {
421 /* protection fault */
422 if (error_code & 0x08000000)
423 goto bad_area;
Jason Barondf67b3d2006-09-29 01:58:58 -0700424 if (!(vma->vm_flags & (VM_READ | VM_EXEC | VM_WRITE)))
Paul Mackerras14cf11a2005-09-26 16:04:21 +1000425 goto bad_area;
426 }
427
428 /*
429 * If for any reason at all we couldn't handle the fault,
430 * make sure we exit gracefully rather than endlessly redo
431 * the fault.
432 */
Benjamin Herrenschmidt9be72572012-03-01 18:14:45 +1100433 fault = handle_mm_fault(mm, vma, address, flags);
434 if (unlikely(fault & (VM_FAULT_RETRY|VM_FAULT_ERROR))) {
Li Zhongba12eed2013-05-13 16:16:41 +0000435 rc = mm_fault_error(regs, address, fault);
Benjamin Herrenschmidt9be72572012-03-01 18:14:45 +1100436 if (rc >= MM_FAULT_RETURN)
Li Zhongba12eed2013-05-13 16:16:41 +0000437 goto bail;
438 else
439 rc = 0;
Paul Mackerras14cf11a2005-09-26 16:04:21 +1000440 }
Benjamin Herrenschmidt9be72572012-03-01 18:14:45 +1100441
442 /*
443 * Major/minor page fault accounting is only done on the
444 * initial attempt. If we go through a retry, it is extremely
445 * likely that the page will be found in page cache at that point.
446 */
447 if (flags & FAULT_FLAG_ALLOW_RETRY) {
448 if (fault & VM_FAULT_MAJOR) {
449 current->maj_flt++;
450 perf_sw_event(PERF_COUNT_SW_PAGE_FAULTS_MAJ, 1,
451 regs, address);
Brian King40900192008-10-22 05:53:45 +0000452#ifdef CONFIG_PPC_SMLPAR
Benjamin Herrenschmidt9be72572012-03-01 18:14:45 +1100453 if (firmware_has_feature(FW_FEATURE_CMO)) {
Anton Blanchard7ffcf8e2013-08-07 02:01:46 +1000454 u32 page_ins;
455
Benjamin Herrenschmidt9be72572012-03-01 18:14:45 +1100456 preempt_disable();
Anton Blanchard7ffcf8e2013-08-07 02:01:46 +1000457 page_ins = be32_to_cpu(get_lppaca()->page_ins);
458 page_ins += 1 << PAGE_FACTOR;
459 get_lppaca()->page_ins = cpu_to_be32(page_ins);
Benjamin Herrenschmidt9be72572012-03-01 18:14:45 +1100460 preempt_enable();
461 }
462#endif /* CONFIG_PPC_SMLPAR */
463 } else {
464 current->min_flt++;
465 perf_sw_event(PERF_COUNT_SW_PAGE_FAULTS_MIN, 1,
466 regs, address);
Brian King40900192008-10-22 05:53:45 +0000467 }
Benjamin Herrenschmidt9be72572012-03-01 18:14:45 +1100468 if (fault & VM_FAULT_RETRY) {
469 /* Clear FAULT_FLAG_ALLOW_RETRY to avoid any risk
470 * of starvation. */
471 flags &= ~FAULT_FLAG_ALLOW_RETRY;
Shaohua Li45cac652012-10-08 16:32:19 -0700472 flags |= FAULT_FLAG_TRIED;
Benjamin Herrenschmidt9be72572012-03-01 18:14:45 +1100473 goto retry;
474 }
Peter Zijlstraac17dc82009-03-13 12:21:34 +0100475 }
Benjamin Herrenschmidt9be72572012-03-01 18:14:45 +1100476
Paul Mackerras14cf11a2005-09-26 16:04:21 +1000477 up_read(&mm->mmap_sem);
Li Zhongba12eed2013-05-13 16:16:41 +0000478 goto bail;
Paul Mackerras14cf11a2005-09-26 16:04:21 +1000479
480bad_area:
481 up_read(&mm->mmap_sem);
482
483bad_area_nosemaphore:
484 /* User mode accesses cause a SIGSEGV */
485 if (user_mode(regs)) {
486 _exception(SIGSEGV, regs, code, address);
Li Zhongba12eed2013-05-13 16:16:41 +0000487 goto bail;
Paul Mackerras14cf11a2005-09-26 16:04:21 +1000488 }
489
Christian Dietrich76462232011-06-04 05:36:54 +0000490 if (is_exec && (error_code & DSISR_PROTFAULT))
491 printk_ratelimited(KERN_CRIT "kernel tried to execute NX-protected"
492 " page (%lx) - exploit attempt? (uid: %d)\n",
Eric W. Biederman9e184e02012-08-07 03:59:47 -0700493 address, from_kuid(&init_user_ns, current_uid()));
Paul Mackerras14cf11a2005-09-26 16:04:21 +1000494
Li Zhongba12eed2013-05-13 16:16:41 +0000495 rc = SIGSEGV;
496
497bail:
498 exception_exit(prev_state);
499 return rc;
Paul Mackerras14cf11a2005-09-26 16:04:21 +1000500
Paul Mackerras14cf11a2005-09-26 16:04:21 +1000501}
502
503/*
504 * bad_page_fault is called when we have a bad access from the kernel.
505 * It is called from the DSI and ISI handlers in head.S and from some
506 * of the procedures in traps.c.
507 */
508void bad_page_fault(struct pt_regs *regs, unsigned long address, int sig)
509{
510 const struct exception_table_entry *entry;
Anton Blanchard28b54992010-08-24 13:15:28 +0000511 unsigned long *stackend;
Paul Mackerras14cf11a2005-09-26 16:04:21 +1000512
513 /* Are we prepared to handle this fault? */
514 if ((entry = search_exception_tables(regs->nip)) != NULL) {
515 regs->nip = entry->fixup;
516 return;
517 }
518
519 /* kernel has accessed a bad area */
Olof Johansson723925b2005-11-06 14:54:36 -0800520
Olof Johansson723925b2005-11-06 14:54:36 -0800521 switch (regs->trap) {
Michael Ellermana416dd82006-11-08 10:22:59 +1100522 case 0x300:
523 case 0x380:
524 printk(KERN_ALERT "Unable to handle kernel paging request for "
525 "data at address 0x%08lx\n", regs->dar);
526 break;
527 case 0x400:
528 case 0x480:
529 printk(KERN_ALERT "Unable to handle kernel paging request for "
530 "instruction fetch\n");
531 break;
532 default:
533 printk(KERN_ALERT "Unable to handle kernel paging request for "
534 "unknown fault\n");
535 break;
Olof Johansson723925b2005-11-06 14:54:36 -0800536 }
537 printk(KERN_ALERT "Faulting instruction address: 0x%08lx\n",
538 regs->nip);
539
Anton Blanchard28b54992010-08-24 13:15:28 +0000540 stackend = end_of_stack(current);
541 if (current != &init_task && *stackend != STACK_END_MAGIC)
542 printk(KERN_ALERT "Thread overran stack, or stack corrupted\n");
543
Paul Mackerras14cf11a2005-09-26 16:04:21 +1000544 die("Kernel access of bad area", regs, sig);
545}