fault.c 12 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423
  1. /*
  2. * PowerPC version
  3. * Copyright (C) 1995-1996 Gary Thomas (gdt@linuxppc.org)
  4. *
  5. * Derived from "arch/i386/mm/fault.c"
  6. * Copyright (C) 1991, 1992, 1993, 1994 Linus Torvalds
  7. *
  8. * Modified by Cort Dougan and Paul Mackerras.
  9. *
  10. * Modified for PPC64 by Dave Engebretsen (engebret@ibm.com)
  11. *
  12. * This program is free software; you can redistribute it and/or
  13. * modify it under the terms of the GNU General Public License
  14. * as published by the Free Software Foundation; either version
  15. * 2 of the License, or (at your option) any later version.
  16. */
  17. #include <linux/signal.h>
  18. #include <linux/sched.h>
  19. #include <linux/kernel.h>
  20. #include <linux/errno.h>
  21. #include <linux/string.h>
  22. #include <linux/types.h>
  23. #include <linux/ptrace.h>
  24. #include <linux/mman.h>
  25. #include <linux/mm.h>
  26. #include <linux/interrupt.h>
  27. #include <linux/highmem.h>
  28. #include <linux/module.h>
  29. #include <linux/kprobes.h>
  30. #include <linux/kdebug.h>
  31. #include <linux/perf_event.h>
  32. #include <linux/magic.h>
  33. #include <asm/firmware.h>
  34. #include <asm/page.h>
  35. #include <asm/pgtable.h>
  36. #include <asm/mmu.h>
  37. #include <asm/mmu_context.h>
  38. #include <asm/system.h>
  39. #include <asm/uaccess.h>
  40. #include <asm/tlbflush.h>
  41. #include <asm/siginfo.h>
  42. #include <mm/mmu_decl.h>
  43. #ifdef CONFIG_KPROBES
  44. static inline int notify_page_fault(struct pt_regs *regs)
  45. {
  46. int ret = 0;
  47. /* kprobe_running() needs smp_processor_id() */
  48. if (!user_mode(regs)) {
  49. preempt_disable();
  50. if (kprobe_running() && kprobe_fault_handler(regs, 11))
  51. ret = 1;
  52. preempt_enable();
  53. }
  54. return ret;
  55. }
  56. #else
  57. static inline int notify_page_fault(struct pt_regs *regs)
  58. {
  59. return 0;
  60. }
  61. #endif
  62. /*
  63. * Check whether the instruction at regs->nip is a store using
  64. * an update addressing form which will update r1.
  65. */
  66. static int store_updates_sp(struct pt_regs *regs)
  67. {
  68. unsigned int inst;
  69. if (get_user(inst, (unsigned int __user *)regs->nip))
  70. return 0;
  71. /* check for 1 in the rA field */
  72. if (((inst >> 16) & 0x1f) != 1)
  73. return 0;
  74. /* check major opcode */
  75. switch (inst >> 26) {
  76. case 37: /* stwu */
  77. case 39: /* stbu */
  78. case 45: /* sthu */
  79. case 53: /* stfsu */
  80. case 55: /* stfdu */
  81. return 1;
  82. case 62: /* std or stdu */
  83. return (inst & 3) == 1;
  84. case 31:
  85. /* check minor opcode */
  86. switch ((inst >> 1) & 0x3ff) {
  87. case 181: /* stdux */
  88. case 183: /* stwux */
  89. case 247: /* stbux */
  90. case 439: /* sthux */
  91. case 695: /* stfsux */
  92. case 759: /* stfdux */
  93. return 1;
  94. }
  95. }
  96. return 0;
  97. }
  98. /*
  99. * For 600- and 800-family processors, the error_code parameter is DSISR
  100. * for a data fault, SRR1 for an instruction fault. For 400-family processors
  101. * the error_code parameter is ESR for a data fault, 0 for an instruction
  102. * fault.
  103. * For 64-bit processors, the error_code parameter is
  104. * - DSISR for a non-SLB data access fault,
  105. * - SRR1 & 0x08000000 for a non-SLB instruction access fault
  106. * - 0 any SLB fault.
  107. *
  108. * The return value is 0 if the fault was handled, or the signal
  109. * number if this is a kernel fault that can't be handled here.
  110. */
  111. int __kprobes do_page_fault(struct pt_regs *regs, unsigned long address,
  112. unsigned long error_code)
  113. {
  114. struct vm_area_struct * vma;
  115. struct mm_struct *mm = current->mm;
  116. siginfo_t info;
  117. int code = SEGV_MAPERR;
  118. int is_write = 0, ret;
  119. int trap = TRAP(regs);
  120. int is_exec = trap == 0x400;
  121. #if !(defined(CONFIG_4xx) || defined(CONFIG_BOOKE))
  122. /*
  123. * Fortunately the bit assignments in SRR1 for an instruction
  124. * fault and DSISR for a data fault are mostly the same for the
  125. * bits we are interested in. But there are some bits which
  126. * indicate errors in DSISR but can validly be set in SRR1.
  127. */
  128. if (trap == 0x400)
  129. error_code &= 0x48200000;
  130. else
  131. is_write = error_code & DSISR_ISSTORE;
  132. #else
  133. is_write = error_code & ESR_DST;
  134. #endif /* CONFIG_4xx || CONFIG_BOOKE */
  135. if (notify_page_fault(regs))
  136. return 0;
  137. if (unlikely(debugger_fault_handler(regs)))
  138. return 0;
  139. /* On a kernel SLB miss we can only check for a valid exception entry */
  140. if (!user_mode(regs) && (address >= TASK_SIZE))
  141. return SIGSEGV;
  142. #if !(defined(CONFIG_4xx) || defined(CONFIG_BOOKE) || \
  143. defined(CONFIG_PPC_BOOK3S_64))
  144. if (error_code & DSISR_DABRMATCH) {
  145. /* DABR match */
  146. do_dabr(regs, address, error_code);
  147. return 0;
  148. }
  149. #endif
  150. if (in_atomic() || mm == NULL) {
  151. if (!user_mode(regs))
  152. return SIGSEGV;
  153. /* in_atomic() in user mode is really bad,
  154. as is current->mm == NULL. */
  155. printk(KERN_EMERG "Page fault in user mode with "
  156. "in_atomic() = %d mm = %p\n", in_atomic(), mm);
  157. printk(KERN_EMERG "NIP = %lx MSR = %lx\n",
  158. regs->nip, regs->msr);
  159. die("Weird page fault", regs, SIGSEGV);
  160. }
  161. perf_sw_event(PERF_COUNT_SW_PAGE_FAULTS, 1, 0, regs, address);
  162. /* When running in the kernel we expect faults to occur only to
  163. * addresses in user space. All other faults represent errors in the
  164. * kernel and should generate an OOPS. Unfortunately, in the case of an
  165. * erroneous fault occurring in a code path which already holds mmap_sem
  166. * we will deadlock attempting to validate the fault against the
  167. * address space. Luckily the kernel only validly references user
  168. * space from well defined areas of code, which are listed in the
  169. * exceptions table.
  170. *
  171. * As the vast majority of faults will be valid we will only perform
  172. * the source reference check when there is a possibility of a deadlock.
  173. * Attempt to lock the address space, if we cannot we then validate the
  174. * source. If this is invalid we can skip the address space check,
  175. * thus avoiding the deadlock.
  176. */
  177. if (!down_read_trylock(&mm->mmap_sem)) {
  178. if (!user_mode(regs) && !search_exception_tables(regs->nip))
  179. goto bad_area_nosemaphore;
  180. down_read(&mm->mmap_sem);
  181. }
  182. vma = find_vma(mm, address);
  183. if (!vma)
  184. goto bad_area;
  185. if (vma->vm_start <= address)
  186. goto good_area;
  187. if (!(vma->vm_flags & VM_GROWSDOWN))
  188. goto bad_area;
  189. /*
  190. * N.B. The POWER/Open ABI allows programs to access up to
  191. * 288 bytes below the stack pointer.
  192. * The kernel signal delivery code writes up to about 1.5kB
  193. * below the stack pointer (r1) before decrementing it.
  194. * The exec code can write slightly over 640kB to the stack
  195. * before setting the user r1. Thus we allow the stack to
  196. * expand to 1MB without further checks.
  197. */
  198. if (address + 0x100000 < vma->vm_end) {
  199. /* get user regs even if this fault is in kernel mode */
  200. struct pt_regs *uregs = current->thread.regs;
  201. if (uregs == NULL)
  202. goto bad_area;
  203. /*
  204. * A user-mode access to an address a long way below
  205. * the stack pointer is only valid if the instruction
  206. * is one which would update the stack pointer to the
  207. * address accessed if the instruction completed,
  208. * i.e. either stwu rs,n(r1) or stwux rs,r1,rb
  209. * (or the byte, halfword, float or double forms).
  210. *
  211. * If we don't check this then any write to the area
  212. * between the last mapped region and the stack will
  213. * expand the stack rather than segfaulting.
  214. */
  215. if (address + 2048 < uregs->gpr[1]
  216. && (!user_mode(regs) || !store_updates_sp(regs)))
  217. goto bad_area;
  218. }
  219. if (expand_stack(vma, address))
  220. goto bad_area;
  221. good_area:
  222. code = SEGV_ACCERR;
  223. #if defined(CONFIG_6xx)
  224. if (error_code & 0x95700000)
  225. /* an error such as lwarx to I/O controller space,
  226. address matching DABR, eciwx, etc. */
  227. goto bad_area;
  228. #endif /* CONFIG_6xx */
  229. #if defined(CONFIG_8xx)
  230. /* 8xx sometimes need to load a invalid/non-present TLBs.
  231. * These must be invalidated separately as linux mm don't.
  232. */
  233. if (error_code & 0x40000000) /* no translation? */
  234. _tlbil_va(address, 0, 0, 0);
  235. /* The MPC8xx seems to always set 0x80000000, which is
  236. * "undefined". Of those that can be set, this is the only
  237. * one which seems bad.
  238. */
  239. if (error_code & 0x10000000)
  240. /* Guarded storage error. */
  241. goto bad_area;
  242. #endif /* CONFIG_8xx */
  243. if (is_exec) {
  244. #ifdef CONFIG_PPC_STD_MMU
  245. /* Protection fault on exec go straight to failure on
  246. * Hash based MMUs as they either don't support per-page
  247. * execute permission, or if they do, it's handled already
  248. * at the hash level. This test would probably have to
  249. * be removed if we change the way this works to make hash
  250. * processors use the same I/D cache coherency mechanism
  251. * as embedded.
  252. */
  253. if (error_code & DSISR_PROTFAULT)
  254. goto bad_area;
  255. #endif /* CONFIG_PPC_STD_MMU */
  256. /*
  257. * Allow execution from readable areas if the MMU does not
  258. * provide separate controls over reading and executing.
  259. *
  260. * Note: That code used to not be enabled for 4xx/BookE.
  261. * It is now as I/D cache coherency for these is done at
  262. * set_pte_at() time and I see no reason why the test
  263. * below wouldn't be valid on those processors. This -may-
  264. * break programs compiled with a really old ABI though.
  265. */
  266. if (!(vma->vm_flags & VM_EXEC) &&
  267. (cpu_has_feature(CPU_FTR_NOEXECUTE) ||
  268. !(vma->vm_flags & (VM_READ | VM_WRITE))))
  269. goto bad_area;
  270. /* a write */
  271. } else if (is_write) {
  272. if (!(vma->vm_flags & VM_WRITE))
  273. goto bad_area;
  274. /* a read */
  275. } else {
  276. /* protection fault */
  277. if (error_code & 0x08000000)
  278. goto bad_area;
  279. if (!(vma->vm_flags & (VM_READ | VM_EXEC | VM_WRITE)))
  280. goto bad_area;
  281. }
  282. /*
  283. * If for any reason at all we couldn't handle the fault,
  284. * make sure we exit gracefully rather than endlessly redo
  285. * the fault.
  286. */
  287. ret = handle_mm_fault(mm, vma, address, is_write ? FAULT_FLAG_WRITE : 0);
  288. if (unlikely(ret & VM_FAULT_ERROR)) {
  289. if (ret & VM_FAULT_OOM)
  290. goto out_of_memory;
  291. else if (ret & VM_FAULT_SIGBUS)
  292. goto do_sigbus;
  293. BUG();
  294. }
  295. if (ret & VM_FAULT_MAJOR) {
  296. current->maj_flt++;
  297. perf_sw_event(PERF_COUNT_SW_PAGE_FAULTS_MAJ, 1, 0,
  298. regs, address);
  299. #ifdef CONFIG_PPC_SMLPAR
  300. if (firmware_has_feature(FW_FEATURE_CMO)) {
  301. preempt_disable();
  302. get_lppaca()->page_ins += (1 << PAGE_FACTOR);
  303. preempt_enable();
  304. }
  305. #endif
  306. } else {
  307. current->min_flt++;
  308. perf_sw_event(PERF_COUNT_SW_PAGE_FAULTS_MIN, 1, 0,
  309. regs, address);
  310. }
  311. up_read(&mm->mmap_sem);
  312. return 0;
  313. bad_area:
  314. up_read(&mm->mmap_sem);
  315. bad_area_nosemaphore:
  316. /* User mode accesses cause a SIGSEGV */
  317. if (user_mode(regs)) {
  318. _exception(SIGSEGV, regs, code, address);
  319. return 0;
  320. }
  321. if (is_exec && (error_code & DSISR_PROTFAULT)
  322. && printk_ratelimit())
  323. printk(KERN_CRIT "kernel tried to execute NX-protected"
  324. " page (%lx) - exploit attempt? (uid: %d)\n",
  325. address, current_uid());
  326. return SIGSEGV;
  327. /*
  328. * We ran out of memory, or some other thing happened to us that made
  329. * us unable to handle the page fault gracefully.
  330. */
  331. out_of_memory:
  332. up_read(&mm->mmap_sem);
  333. if (!user_mode(regs))
  334. return SIGKILL;
  335. pagefault_out_of_memory();
  336. return 0;
  337. do_sigbus:
  338. up_read(&mm->mmap_sem);
  339. if (user_mode(regs)) {
  340. info.si_signo = SIGBUS;
  341. info.si_errno = 0;
  342. info.si_code = BUS_ADRERR;
  343. info.si_addr = (void __user *)address;
  344. force_sig_info(SIGBUS, &info, current);
  345. return 0;
  346. }
  347. return SIGBUS;
  348. }
  349. /*
  350. * bad_page_fault is called when we have a bad access from the kernel.
  351. * It is called from the DSI and ISI handlers in head.S and from some
  352. * of the procedures in traps.c.
  353. */
  354. void bad_page_fault(struct pt_regs *regs, unsigned long address, int sig)
  355. {
  356. const struct exception_table_entry *entry;
  357. unsigned long *stackend;
  358. /* Are we prepared to handle this fault? */
  359. if ((entry = search_exception_tables(regs->nip)) != NULL) {
  360. regs->nip = entry->fixup;
  361. return;
  362. }
  363. /* kernel has accessed a bad area */
  364. switch (regs->trap) {
  365. case 0x300:
  366. case 0x380:
  367. printk(KERN_ALERT "Unable to handle kernel paging request for "
  368. "data at address 0x%08lx\n", regs->dar);
  369. break;
  370. case 0x400:
  371. case 0x480:
  372. printk(KERN_ALERT "Unable to handle kernel paging request for "
  373. "instruction fetch\n");
  374. break;
  375. default:
  376. printk(KERN_ALERT "Unable to handle kernel paging request for "
  377. "unknown fault\n");
  378. break;
  379. }
  380. printk(KERN_ALERT "Faulting instruction address: 0x%08lx\n",
  381. regs->nip);
  382. stackend = end_of_stack(current);
  383. if (current != &init_task && *stackend != STACK_END_MAGIC)
  384. printk(KERN_ALERT "Thread overran stack, or stack corrupted\n");
  385. die("Kernel access of bad area", regs, sig);
  386. }