1/*
2 *  linux/arch/arm/mm/fault.c
3 *
4 *  Copyright (C) 1995  Linus Torvalds
5 *  Modifications for ARM processor (c) 1995-2004 Russell King
6 *
7 * This program is free software; you can redistribute it and/or modify
8 * it under the terms of the GNU General Public License version 2 as
9 * published by the Free Software Foundation.
10 */
11#include <linux/module.h>
12#include <linux/signal.h>
13#include <linux/mm.h>
14#include <linux/init.h>
15
16#include <asm/system.h>
17#include <asm/pgtable.h>
18#include <asm/tlbflush.h>
19#include <asm/uaccess.h>
20
21#include "fault.h"
22
23/*
24 * This is useful to dump out the page tables associated with
25 * 'addr' in mm 'mm'.
26 */
27void show_pte(struct mm_struct *mm, unsigned long addr)
28{
29	pgd_t *pgd;
30
31	if (!mm)
32		mm = &init_mm;
33
34	printk(KERN_ALERT "pgd = %p\n", mm->pgd);
35	pgd = pgd_offset(mm, addr);
36	printk(KERN_ALERT "[%08lx] *pgd=%08lx", addr, pgd_val(*pgd));
37
38	do {
39		pmd_t *pmd;
40		pte_t *pte;
41
42		if (pgd_none(*pgd))
43			break;
44
45		if (pgd_bad(*pgd)) {
46			printk("(bad)");
47			break;
48		}
49
50		pmd = pmd_offset(pgd, addr);
51#if PTRS_PER_PMD != 1
52		printk(", *pmd=%08lx", pmd_val(*pmd));
53#endif
54
55		if (pmd_none(*pmd))
56			break;
57
58		if (pmd_bad(*pmd)) {
59			printk("(bad)");
60			break;
61		}
62
63#ifndef CONFIG_HIGHMEM
64		/* We must not map this if we have highmem enabled */
65		pte = pte_offset_map(pmd, addr);
66		printk(", *pte=%08lx", pte_val(*pte));
67		printk(", *ppte=%08lx", pte_val(pte[-PTRS_PER_PTE]));
68		pte_unmap(pte);
69#endif
70	} while(0);
71
72	printk("\n");
73}
74
75/*
76 * Oops.  The kernel tried to access some page that wasn't present.
77 */
78static void
79__do_kernel_fault(struct mm_struct *mm, unsigned long addr, unsigned int fsr,
80		  struct pt_regs *regs)
81{
82	/*
83	 * Are we prepared to handle this kernel fault?
84	 */
85	if (fixup_exception(regs))
86		return;
87
88	/*
89	 * No handler, we'll have to terminate things with extreme prejudice.
90	 */
91	bust_spinlocks(1);
92	printk(KERN_ALERT
93		"Unable to handle kernel %s at virtual address %08lx\n",
94		(addr < PAGE_SIZE) ? "NULL pointer dereference" :
95		"paging request", addr);
96
97	show_pte(mm, addr);
98	die("Oops", regs, fsr);
99	bust_spinlocks(0);
100	do_exit(SIGKILL);
101}
102
103/*
104 * Something tried to access memory that isn't in our memory map..
105 * User mode accesses just cause a SIGSEGV
106 */
107static void
108__do_user_fault(struct task_struct *tsk, unsigned long addr,
109		unsigned int fsr, unsigned int sig, int code,
110		struct pt_regs *regs)
111{
112	struct siginfo si;
113
114#ifdef CONFIG_DEBUG_USER
115	if (user_debug & UDBG_SEGV) {
116		printk(KERN_DEBUG "%s: unhandled page fault (%d) at 0x%08lx, code 0x%03x\n",
117		       tsk->comm, sig, addr, fsr);
118		show_pte(tsk->mm, addr);
119		show_regs(regs);
120	}
121#endif
122
123	tsk->thread.address = addr;
124	tsk->thread.error_code = fsr;
125	tsk->thread.trap_no = 14;
126	si.si_signo = sig;
127	si.si_errno = 0;
128	si.si_code = code;
129	si.si_addr = (void __user *)addr;
130	force_sig_info(sig, &si, tsk);
131}
132
133void do_bad_area(unsigned long addr, unsigned int fsr, struct pt_regs *regs)
134{
135	struct task_struct *tsk = current;
136	struct mm_struct *mm = tsk->active_mm;
137
138	/*
139	 * If we are in kernel mode at this point, we
140	 * have no context to handle this fault with.
141	 */
142	if (user_mode(regs))
143		__do_user_fault(tsk, addr, fsr, SIGSEGV, SEGV_MAPERR, regs);
144	else
145		__do_kernel_fault(mm, addr, fsr, regs);
146}
147
148#define VM_FAULT_BADMAP		(-20)
149#define VM_FAULT_BADACCESS	(-21)
150
151static int
152__do_page_fault(struct mm_struct *mm, unsigned long addr, unsigned int fsr,
153		struct task_struct *tsk)
154{
155	struct vm_area_struct *vma;
156	int fault, mask;
157
158	vma = find_vma(mm, addr);
159	fault = VM_FAULT_BADMAP;
160	if (!vma)
161		goto out;
162	if (vma->vm_start > addr)
163		goto check_stack;
164
165	/*
166	 * Ok, we have a good vm_area for this
167	 * memory access, so we can handle it.
168	 */
169good_area:
170	if (fsr & (1 << 11)) /* write? */
171		mask = VM_WRITE;
172	else
173		mask = VM_READ|VM_EXEC|VM_WRITE;
174
175	fault = VM_FAULT_BADACCESS;
176	if (!(vma->vm_flags & mask))
177		goto out;
178
179	/*
180	 * If for any reason at all we couldn't handle
181	 * the fault, make sure we exit gracefully rather
182	 * than endlessly redo the fault.
183	 */
184survive:
185	fault = handle_mm_fault(mm, vma, addr & PAGE_MASK, fsr & (1 << 11));
186
187	/*
188	 * Handle the "normal" cases first - successful and sigbus
189	 */
190	switch (fault) {
191	case VM_FAULT_MAJOR:
192		tsk->maj_flt++;
193		return fault;
194	case VM_FAULT_MINOR:
195		tsk->min_flt++;
196	case VM_FAULT_SIGBUS:
197		return fault;
198	}
199
200	if (!is_init(tsk))
201		goto out;
202
203	/*
204	 * If we are out of memory for pid1, sleep for a while and retry
205	 */
206	up_read(&mm->mmap_sem);
207	yield();
208	down_read(&mm->mmap_sem);
209	goto survive;
210
211check_stack:
212	if (vma->vm_flags & VM_GROWSDOWN && !expand_stack(vma, addr))
213		goto good_area;
214out:
215	return fault;
216}
217
218static int
219do_page_fault(unsigned long addr, unsigned int fsr, struct pt_regs *regs)
220{
221	struct task_struct *tsk;
222	struct mm_struct *mm;
223	int fault, sig, code;
224
225	tsk = current;
226	mm  = tsk->mm;
227
228	/*
229	 * If we're in an interrupt or have no user
230	 * context, we must not take the fault..
231	 */
232	if (in_atomic() || !mm)
233		goto no_context;
234
235	/*
236	 * As per x86, we may deadlock here.  However, since the kernel only
237	 * validly references user space from well defined areas of the code,
238	 * we can bug out early if this is from code which shouldn't.
239	 */
240	if (!down_read_trylock(&mm->mmap_sem)) {
241		if (!user_mode(regs) && !search_exception_tables(regs->ARM_pc))
242			goto no_context;
243		down_read(&mm->mmap_sem);
244	}
245
246	fault = __do_page_fault(mm, addr, fsr, tsk);
247	up_read(&mm->mmap_sem);
248
249	/*
250	 * Handle the "normal" case first - VM_FAULT_MAJOR / VM_FAULT_MINOR
251	 */
252	if (fault >= VM_FAULT_MINOR)
253		return 0;
254
255	/*
256	 * If we are in kernel mode at this point, we
257	 * have no context to handle this fault with.
258	 */
259	if (!user_mode(regs))
260		goto no_context;
261
262	switch (fault) {
263	case VM_FAULT_OOM:
264		/*
265		 * We ran out of memory, or some other thing
266		 * happened to us that made us unable to handle
267		 * the page fault gracefully.
268		 */
269		printk("VM: killing process %s\n", tsk->comm);
270		do_exit(SIGKILL);
271		return 0;
272
273	case VM_FAULT_SIGBUS:
274		/*
275		 * We had some memory, but were unable to
276		 * successfully fix up this page fault.
277		 */
278		sig = SIGBUS;
279		code = BUS_ADRERR;
280		break;
281
282	default:
283		/*
284		 * Something tried to access memory that
285		 * isn't in our memory map..
286		 */
287		sig = SIGSEGV;
288		code = fault == VM_FAULT_BADACCESS ?
289			SEGV_ACCERR : SEGV_MAPERR;
290		break;
291	}
292
293	__do_user_fault(tsk, addr, fsr, sig, code, regs);
294	return 0;
295
296no_context:
297	__do_kernel_fault(mm, addr, fsr, regs);
298	return 0;
299}
300
301/*
302 * First Level Translation Fault Handler
303 *
304 * We enter here because the first level page table doesn't contain
305 * a valid entry for the address.
306 *
307 * If the address is in kernel space (>= TASK_SIZE), then we are
308 * probably faulting in the vmalloc() area.
309 *
310 * If the init_task's first level page tables contains the relevant
311 * entry, we copy the it to this task.  If not, we send the process
312 * a signal, fixup the exception, or oops the kernel.
313 *
314 * NOTE! We MUST NOT take any locks for this case. We may be in an
315 * interrupt or a critical region, and should only copy the information
316 * from the master page table, nothing more.
317 */
318static int
319do_translation_fault(unsigned long addr, unsigned int fsr,
320		     struct pt_regs *regs)
321{
322	unsigned int index;
323	pgd_t *pgd, *pgd_k;
324	pmd_t *pmd, *pmd_k;
325
326	if (addr < TASK_SIZE)
327		return do_page_fault(addr, fsr, regs);
328
329	index = pgd_index(addr);
330
331	pgd = cpu_get_pgd() + index;
332	pgd_k = init_mm.pgd + index;
333
334	if (pgd_none(*pgd_k))
335		goto bad_area;
336
337	if (!pgd_present(*pgd))
338		set_pgd(pgd, *pgd_k);
339
340	pmd_k = pmd_offset(pgd_k, addr);
341	pmd   = pmd_offset(pgd, addr);
342
343	if (pmd_none(*pmd_k))
344		goto bad_area;
345
346	copy_pmd(pmd, pmd_k);
347	return 0;
348
349bad_area:
350	do_bad_area(addr, fsr, regs);
351	return 0;
352}
353
354/*
355 * Some section permission faults need to be handled gracefully.
356 * They can happen due to a __{get,put}_user during an oops.
357 */
358static int
359do_sect_fault(unsigned long addr, unsigned int fsr, struct pt_regs *regs)
360{
361	do_bad_area(addr, fsr, regs);
362	return 0;
363}
364
365/*
366 * This abort handler always returns "fault".
367 */
368static int
369do_bad(unsigned long addr, unsigned int fsr, struct pt_regs *regs)
370{
371	return 1;
372}
373
374static struct fsr_info {
375	int	(*fn)(unsigned long addr, unsigned int fsr, struct pt_regs *regs);
376	int	sig;
377	int	code;
378	const char *name;
379} fsr_info[] = {
380	/*
381	 * The following are the standard ARMv3 and ARMv4 aborts.  ARMv5
382	 * defines these to be "precise" aborts.
383	 */
384	{ do_bad,		SIGSEGV, 0,		"vector exception"		   },
385	{ do_bad,		SIGILL,	 BUS_ADRALN,	"alignment exception"		   },
386	{ do_bad,		SIGKILL, 0,		"terminal exception"		   },
387	{ do_bad,		SIGILL,	 BUS_ADRALN,	"alignment exception"		   },
388	{ do_bad,		SIGBUS,	 0,		"external abort on linefetch"	   },
389	{ do_translation_fault,	SIGSEGV, SEGV_MAPERR,	"section translation fault"	   },
390	{ do_bad,		SIGBUS,	 0,		"external abort on linefetch"	   },
391	{ do_page_fault,	SIGSEGV, SEGV_MAPERR,	"page translation fault"	   },
392	{ do_bad,		SIGBUS,	 0,		"external abort on non-linefetch"  },
393	{ do_bad,		SIGSEGV, SEGV_ACCERR,	"section domain fault"		   },
394	{ do_bad,		SIGBUS,	 0,		"external abort on non-linefetch"  },
395	{ do_bad,		SIGSEGV, SEGV_ACCERR,	"page domain fault"		   },
396	{ do_bad,		SIGBUS,	 0,		"external abort on translation"	   },
397	{ do_sect_fault,	SIGSEGV, SEGV_ACCERR,	"section permission fault"	   },
398	{ do_bad,		SIGBUS,	 0,		"external abort on translation"	   },
399	{ do_page_fault,	SIGSEGV, SEGV_ACCERR,	"page permission fault"		   },
400	/*
401	 * The following are "imprecise" aborts, which are signalled by bit
402	 * 10 of the FSR, and may not be recoverable.  These are only
403	 * supported if the CPU abort handler supports bit 10.
404	 */
405	{ do_bad,		SIGBUS,  0,		"unknown 16"			   },
406	{ do_bad,		SIGBUS,  0,		"unknown 17"			   },
407	{ do_bad,		SIGBUS,  0,		"unknown 18"			   },
408	{ do_bad,		SIGBUS,  0,		"unknown 19"			   },
409	{ do_bad,		SIGBUS,  0,		"lock abort"			   }, /* xscale */
410	{ do_bad,		SIGBUS,  0,		"unknown 21"			   },
411	{ do_bad,		SIGBUS,  BUS_OBJERR,	"imprecise external abort"	   }, /* xscale */
412	{ do_bad,		SIGBUS,  0,		"unknown 23"			   },
413	{ do_bad,		SIGBUS,  0,		"dcache parity error"		   }, /* xscale */
414	{ do_bad,		SIGBUS,  0,		"unknown 25"			   },
415	{ do_bad,		SIGBUS,  0,		"unknown 26"			   },
416	{ do_bad,		SIGBUS,  0,		"unknown 27"			   },
417	{ do_bad,		SIGBUS,  0,		"unknown 28"			   },
418	{ do_bad,		SIGBUS,  0,		"unknown 29"			   },
419	{ do_bad,		SIGBUS,  0,		"unknown 30"			   },
420	{ do_bad,		SIGBUS,  0,		"unknown 31"			   }
421};
422
423void __init
424hook_fault_code(int nr, int (*fn)(unsigned long, unsigned int, struct pt_regs *),
425		int sig, const char *name)
426{
427	if (nr >= 0 && nr < ARRAY_SIZE(fsr_info)) {
428		fsr_info[nr].fn   = fn;
429		fsr_info[nr].sig  = sig;
430		fsr_info[nr].name = name;
431	}
432}
433
434/*
435 * Dispatch a data abort to the relevant handler.
436 */
437asmlinkage void __exception
438do_DataAbort(unsigned long addr, unsigned int fsr, struct pt_regs *regs)
439{
440	const struct fsr_info *inf = fsr_info + (fsr & 15) + ((fsr & (1 << 10)) >> 6);
441	struct siginfo info;
442
443	if (!inf->fn(addr, fsr, regs))
444		return;
445
446	printk(KERN_ALERT "Unhandled fault: %s (0x%03x) at 0x%08lx\n",
447		inf->name, fsr, addr);
448
449	info.si_signo = inf->sig;
450	info.si_errno = 0;
451	info.si_code  = inf->code;
452	info.si_addr  = (void __user *)addr;
453	arm_notify_die("", regs, &info, fsr, 0);
454}
455
456asmlinkage void __exception
457do_PrefetchAbort(unsigned long addr, struct pt_regs *regs)
458{
459	do_translation_fault(addr, 0, regs);
460}
461