]>
Commit | Line | Data |
---|---|---|
b00dc837 | 1 | /* |
1da177e4 LT |
2 | * arch/sparc64/mm/fault.c: Page fault handlers for the 64-bit Sparc. |
3 | * | |
4fe3ebec | 4 | * Copyright (C) 1996, 2008 David S. Miller (davem@davemloft.net) |
1da177e4 LT |
5 | * Copyright (C) 1997, 1999 Jakub Jelinek (jj@ultra.linux.cz) |
6 | */ | |
7 | ||
8 | #include <asm/head.h> | |
9 | ||
10 | #include <linux/string.h> | |
11 | #include <linux/types.h> | |
12 | #include <linux/sched.h> | |
13 | #include <linux/ptrace.h> | |
14 | #include <linux/mman.h> | |
15 | #include <linux/signal.h> | |
16 | #include <linux/mm.h> | |
17 | #include <linux/module.h> | |
1da177e4 | 18 | #include <linux/init.h> |
a084b667 | 19 | #include <linux/perf_event.h> |
1da177e4 | 20 | #include <linux/interrupt.h> |
05e14cb3 | 21 | #include <linux/kprobes.h> |
1eeb66a1 | 22 | #include <linux/kdebug.h> |
eeabac73 | 23 | #include <linux/percpu.h> |
1da177e4 LT |
24 | |
25 | #include <asm/page.h> | |
26 | #include <asm/pgtable.h> | |
27 | #include <asm/openprom.h> | |
28 | #include <asm/oplib.h> | |
29 | #include <asm/uaccess.h> | |
30 | #include <asm/asi.h> | |
31 | #include <asm/lsu.h> | |
32 | #include <asm/sections.h> | |
7a1ac526 | 33 | #include <asm/mmu_context.h> |
1da177e4 | 34 | |
4ed5d5e4 | 35 | static inline __kprobes int notify_page_fault(struct pt_regs *regs) |
d98f8f05 | 36 | { |
127cda1e DM |
37 | int ret = 0; |
38 | ||
39 | /* kprobe_running() needs smp_processor_id() */ | |
135d0821 | 40 | if (kprobes_built_in() && !user_mode(regs)) { |
127cda1e DM |
41 | preempt_disable(); |
42 | if (kprobe_running() && kprobe_fault_handler(regs, 0)) | |
43 | ret = 1; | |
44 | preempt_enable(); | |
45 | } | |
46 | return ret; | |
d98f8f05 | 47 | } |
d98f8f05 | 48 | |
05e14cb3 PP |
49 | static void __kprobes unhandled_fault(unsigned long address, |
50 | struct task_struct *tsk, | |
51 | struct pt_regs *regs) | |
1da177e4 LT |
52 | { |
53 | if ((unsigned long) address < PAGE_SIZE) { | |
54 | printk(KERN_ALERT "Unable to handle kernel NULL " | |
55 | "pointer dereference\n"); | |
56 | } else { | |
57 | printk(KERN_ALERT "Unable to handle kernel paging request " | |
58 | "at virtual address %016lx\n", (unsigned long)address); | |
59 | } | |
60 | printk(KERN_ALERT "tsk->{mm,active_mm}->context = %016lx\n", | |
61 | (tsk->mm ? | |
62 | CTX_HWBITS(tsk->mm->context) : | |
63 | CTX_HWBITS(tsk->active_mm->context))); | |
64 | printk(KERN_ALERT "tsk->{mm,active_mm}->pgd = %016lx\n", | |
65 | (tsk->mm ? (unsigned long) tsk->mm->pgd : | |
66 | (unsigned long) tsk->active_mm->pgd)); | |
1da177e4 LT |
67 | die_if_kernel("Oops", regs); |
68 | } | |
69 | ||
4ed5d5e4 | 70 | static void __kprobes bad_kernel_pc(struct pt_regs *regs, unsigned long vaddr) |
1da177e4 | 71 | { |
1da177e4 LT |
72 | printk(KERN_CRIT "OOPS: Bogus kernel PC [%016lx] in fault handler\n", |
73 | regs->tpc); | |
eb398d10 | 74 | printk(KERN_CRIT "OOPS: RPC [%016lx]\n", regs->u_regs[15]); |
4fe3ebec | 75 | printk("OOPS: RPC <%pS>\n", (void *) regs->u_regs[15]); |
bf941d6c | 76 | printk(KERN_CRIT "OOPS: Fault was to vaddr[%lx]\n", vaddr); |
c1f193a7 | 77 | dump_stack(); |
1da177e4 LT |
78 | unhandled_fault(regs->tpc, current, regs); |
79 | } | |
80 | ||
81 | /* | |
82 | * We now make sure that mmap_sem is held in all paths that call | |
83 | * this. Additionally, to prevent kswapd from ripping ptes from | |
84 | * under us, raise interrupts around the time that we look at the | |
85 | * pte, kswapd will have to wait to get his smp ipi response from | |
da160546 | 86 | * us. vmtruncate likewise. This saves us having to get pte lock. |
1da177e4 LT |
87 | */ |
88 | static unsigned int get_user_insn(unsigned long tpc) | |
89 | { | |
90 | pgd_t *pgdp = pgd_offset(current->mm, tpc); | |
91 | pud_t *pudp; | |
92 | pmd_t *pmdp; | |
93 | pte_t *ptep, pte; | |
94 | unsigned long pa; | |
95 | u32 insn = 0; | |
96 | unsigned long pstate; | |
97 | ||
98 | if (pgd_none(*pgdp)) | |
99 | goto outret; | |
100 | pudp = pud_offset(pgdp, tpc); | |
101 | if (pud_none(*pudp)) | |
102 | goto outret; | |
103 | pmdp = pmd_offset(pudp, tpc); | |
104 | if (pmd_none(*pmdp)) | |
105 | goto outret; | |
106 | ||
107 | /* This disables preemption for us as well. */ | |
108 | __asm__ __volatile__("rdpr %%pstate, %0" : "=r" (pstate)); | |
109 | __asm__ __volatile__("wrpr %0, %1, %%pstate" | |
110 | : : "r" (pstate), "i" (PSTATE_IE)); | |
111 | ptep = pte_offset_map(pmdp, tpc); | |
112 | pte = *ptep; | |
113 | if (!pte_present(pte)) | |
114 | goto out; | |
115 | ||
c4bce90e | 116 | pa = (pte_pfn(pte) << PAGE_SHIFT); |
1da177e4 LT |
117 | pa += (tpc & ~PAGE_MASK); |
118 | ||
119 | /* Use phys bypass so we don't pollute dtlb/dcache. */ | |
120 | __asm__ __volatile__("lduwa [%1] %2, %0" | |
121 | : "=r" (insn) | |
122 | : "r" (pa), "i" (ASI_PHYS_USE_EC)); | |
123 | ||
124 | out: | |
125 | pte_unmap(ptep); | |
126 | __asm__ __volatile__("wrpr %0, 0x0, %%pstate" : : "r" (pstate)); | |
127 | outret: | |
128 | return insn; | |
129 | } | |
130 | ||
131 | extern unsigned long compute_effective_address(struct pt_regs *, unsigned int, unsigned int); | |
132 | ||
133 | static void do_fault_siginfo(int code, int sig, struct pt_regs *regs, | |
134 | unsigned int insn, int fault_code) | |
135 | { | |
136 | siginfo_t info; | |
137 | ||
138 | info.si_code = code; | |
139 | info.si_signo = sig; | |
140 | info.si_errno = 0; | |
141 | if (fault_code & FAULT_CODE_ITLB) | |
142 | info.si_addr = (void __user *) regs->tpc; | |
143 | else | |
144 | info.si_addr = (void __user *) | |
145 | compute_effective_address(regs, insn, 0); | |
146 | info.si_trapno = 0; | |
147 | force_sig_info(sig, &info, current); | |
148 | } | |
149 | ||
150 | extern int handle_ldf_stq(u32, struct pt_regs *); | |
151 | extern int handle_ld_nf(u32, struct pt_regs *); | |
152 | ||
153 | static unsigned int get_fault_insn(struct pt_regs *regs, unsigned int insn) | |
154 | { | |
155 | if (!insn) { | |
156 | if (!regs->tpc || (regs->tpc & 0x3)) | |
157 | return 0; | |
158 | if (regs->tstate & TSTATE_PRIV) { | |
159 | insn = *(unsigned int *) regs->tpc; | |
160 | } else { | |
161 | insn = get_user_insn(regs->tpc); | |
162 | } | |
163 | } | |
164 | return insn; | |
165 | } | |
166 | ||
4ed5d5e4 DM |
167 | static void __kprobes do_kernel_fault(struct pt_regs *regs, int si_code, |
168 | int fault_code, unsigned int insn, | |
169 | unsigned long address) | |
1da177e4 | 170 | { |
1da177e4 LT |
171 | unsigned char asi = ASI_P; |
172 | ||
173 | if ((!insn) && (regs->tstate & TSTATE_PRIV)) | |
174 | goto cannot_handle; | |
175 | ||
176 | /* If user insn could be read (thus insn is zero), that | |
177 | * is fine. We will just gun down the process with a signal | |
178 | * in that case. | |
179 | */ | |
180 | ||
181 | if (!(fault_code & (FAULT_CODE_WRITE|FAULT_CODE_ITLB)) && | |
182 | (insn & 0xc0800000) == 0xc0800000) { | |
183 | if (insn & 0x2000) | |
184 | asi = (regs->tstate >> 24); | |
185 | else | |
186 | asi = (insn >> 5); | |
187 | if ((asi & 0xf2) == 0x82) { | |
188 | if (insn & 0x1000000) { | |
189 | handle_ldf_stq(insn, regs); | |
190 | } else { | |
191 | /* This was a non-faulting load. Just clear the | |
192 | * destination register(s) and continue with the next | |
193 | * instruction. -jj | |
194 | */ | |
195 | handle_ld_nf(insn, regs); | |
196 | } | |
197 | return; | |
198 | } | |
199 | } | |
200 | ||
1da177e4 LT |
201 | /* Is this in ex_table? */ |
202 | if (regs->tstate & TSTATE_PRIV) { | |
8cf14af0 | 203 | const struct exception_table_entry *entry; |
1da177e4 | 204 | |
622eaec6 DM |
205 | entry = search_exception_tables(regs->tpc); |
206 | if (entry) { | |
8cf14af0 | 207 | regs->tpc = entry->fixup; |
1da177e4 | 208 | regs->tnpc = regs->tpc + 4; |
1da177e4 LT |
209 | return; |
210 | } | |
211 | } else { | |
212 | /* The si_code was set to make clear whether | |
213 | * this was a SEGV_MAPERR or SEGV_ACCERR fault. | |
214 | */ | |
215 | do_fault_siginfo(si_code, SIGSEGV, regs, insn, fault_code); | |
216 | return; | |
217 | } | |
218 | ||
219 | cannot_handle: | |
220 | unhandled_fault (address, current, regs); | |
221 | } | |
222 | ||
4ed5d5e4 | 223 | static void noinline __kprobes bogus_32bit_fault_tpc(struct pt_regs *regs) |
9b026058 DM |
224 | { |
225 | static int times; | |
226 | ||
227 | if (times++ < 10) | |
228 | printk(KERN_ERR "FAULT[%s:%d]: 32-bit process reports " | |
229 | "64-bit TPC [%lx]\n", | |
230 | current->comm, current->pid, | |
231 | regs->tpc); | |
232 | show_regs(regs); | |
233 | } | |
234 | ||
4ed5d5e4 DM |
235 | static void noinline __kprobes bogus_32bit_fault_address(struct pt_regs *regs, |
236 | unsigned long addr) | |
9b026058 DM |
237 | { |
238 | static int times; | |
239 | ||
240 | if (times++ < 10) | |
241 | printk(KERN_ERR "FAULT[%s:%d]: 32-bit process " | |
242 | "reports 64-bit fault address [%lx]\n", | |
243 | current->comm, current->pid, addr); | |
244 | show_regs(regs); | |
245 | } | |
246 | ||
05e14cb3 | 247 | asmlinkage void __kprobes do_sparc64_fault(struct pt_regs *regs) |
1da177e4 LT |
248 | { |
249 | struct mm_struct *mm = current->mm; | |
250 | struct vm_area_struct *vma; | |
251 | unsigned int insn = 0; | |
83c54070 | 252 | int si_code, fault_code, fault; |
7a1ac526 | 253 | unsigned long address, mm_rss; |
1da177e4 LT |
254 | |
255 | fault_code = get_thread_fault_code(); | |
256 | ||
127cda1e | 257 | if (notify_page_fault(regs)) |
1da177e4 LT |
258 | return; |
259 | ||
260 | si_code = SEGV_MAPERR; | |
261 | address = current_thread_info()->fault_address; | |
262 | ||
263 | if ((fault_code & FAULT_CODE_ITLB) && | |
264 | (fault_code & FAULT_CODE_DTLB)) | |
265 | BUG(); | |
266 | ||
eeabac73 | 267 | if (test_thread_flag(TIF_32BIT)) { |
9b026058 DM |
268 | if (!(regs->tstate & TSTATE_PRIV)) { |
269 | if (unlikely((regs->tpc >> 32) != 0)) { | |
270 | bogus_32bit_fault_tpc(regs); | |
271 | goto intr_or_no_mm; | |
272 | } | |
273 | } | |
274 | if (unlikely((address >> 32) != 0)) { | |
275 | bogus_32bit_fault_address(regs, address); | |
276 | goto intr_or_no_mm; | |
277 | } | |
eeabac73 DM |
278 | } |
279 | ||
1da177e4 | 280 | if (regs->tstate & TSTATE_PRIV) { |
9b026058 | 281 | unsigned long tpc = regs->tpc; |
1da177e4 LT |
282 | |
283 | /* Sanity check the PC. */ | |
be71716e | 284 | if ((tpc >= KERNBASE && tpc < (unsigned long) __init_end) || |
1da177e4 LT |
285 | (tpc >= MODULES_VADDR && tpc < MODULES_END)) { |
286 | /* Valid, no problems... */ | |
287 | } else { | |
bf941d6c | 288 | bad_kernel_pc(regs, address); |
1da177e4 LT |
289 | return; |
290 | } | |
291 | } | |
292 | ||
293 | /* | |
294 | * If we're in an interrupt or have no user | |
295 | * context, we must not take the fault.. | |
296 | */ | |
297 | if (in_atomic() || !mm) | |
298 | goto intr_or_no_mm; | |
299 | ||
a084b667 DM |
300 | perf_sw_event(PERF_COUNT_SW_PAGE_FAULTS, 1, 0, regs, address); |
301 | ||
1da177e4 LT |
302 | if (!down_read_trylock(&mm->mmap_sem)) { |
303 | if ((regs->tstate & TSTATE_PRIV) && | |
304 | !search_exception_tables(regs->tpc)) { | |
305 | insn = get_fault_insn(regs, insn); | |
306 | goto handle_kernel_fault; | |
307 | } | |
308 | down_read(&mm->mmap_sem); | |
309 | } | |
310 | ||
311 | vma = find_vma(mm, address); | |
312 | if (!vma) | |
313 | goto bad_area; | |
314 | ||
315 | /* Pure DTLB misses do not tell us whether the fault causing | |
316 | * load/store/atomic was a write or not, it only says that there | |
317 | * was no match. So in such a case we (carefully) read the | |
318 | * instruction to try and figure this out. It's an optimization | |
319 | * so it's ok if we can't do this. | |
320 | * | |
321 | * Special hack, window spill/fill knows the exact fault type. | |
322 | */ | |
323 | if (((fault_code & | |
324 | (FAULT_CODE_DTLB | FAULT_CODE_WRITE | FAULT_CODE_WINFIXUP)) == FAULT_CODE_DTLB) && | |
325 | (vma->vm_flags & VM_WRITE) != 0) { | |
326 | insn = get_fault_insn(regs, 0); | |
327 | if (!insn) | |
328 | goto continue_fault; | |
73c50a27 DM |
329 | /* All loads, stores and atomics have bits 30 and 31 both set |
330 | * in the instruction. Bit 21 is set in all stores, but we | |
331 | * have to avoid prefetches which also have bit 21 set. | |
332 | */ | |
1da177e4 | 333 | if ((insn & 0xc0200000) == 0xc0200000 && |
73c50a27 | 334 | (insn & 0x01780000) != 0x01680000) { |
1da177e4 LT |
335 | /* Don't bother updating thread struct value, |
336 | * because update_mmu_cache only cares which tlb | |
337 | * the access came from. | |
338 | */ | |
339 | fault_code |= FAULT_CODE_WRITE; | |
340 | } | |
341 | } | |
342 | continue_fault: | |
343 | ||
344 | if (vma->vm_start <= address) | |
345 | goto good_area; | |
346 | if (!(vma->vm_flags & VM_GROWSDOWN)) | |
347 | goto bad_area; | |
348 | if (!(fault_code & FAULT_CODE_WRITE)) { | |
349 | /* Non-faulting loads shouldn't expand stack. */ | |
350 | insn = get_fault_insn(regs, insn); | |
351 | if ((insn & 0xc0800000) == 0xc0800000) { | |
352 | unsigned char asi; | |
353 | ||
354 | if (insn & 0x2000) | |
355 | asi = (regs->tstate >> 24); | |
356 | else | |
357 | asi = (insn >> 5); | |
358 | if ((asi & 0xf2) == 0x82) | |
359 | goto bad_area; | |
360 | } | |
361 | } | |
362 | if (expand_stack(vma, address)) | |
363 | goto bad_area; | |
364 | /* | |
365 | * Ok, we have a good vm_area for this memory access, so | |
366 | * we can handle it.. | |
367 | */ | |
368 | good_area: | |
369 | si_code = SEGV_ACCERR; | |
370 | ||
371 | /* If we took a ITLB miss on a non-executable page, catch | |
372 | * that here. | |
373 | */ | |
374 | if ((fault_code & FAULT_CODE_ITLB) && !(vma->vm_flags & VM_EXEC)) { | |
375 | BUG_ON(address != regs->tpc); | |
376 | BUG_ON(regs->tstate & TSTATE_PRIV); | |
377 | goto bad_area; | |
378 | } | |
379 | ||
380 | if (fault_code & FAULT_CODE_WRITE) { | |
381 | if (!(vma->vm_flags & VM_WRITE)) | |
382 | goto bad_area; | |
383 | ||
384 | /* Spitfire has an icache which does not snoop | |
385 | * processor stores. Later processors do... | |
386 | */ | |
387 | if (tlb_type == spitfire && | |
388 | (vma->vm_flags & VM_EXEC) != 0 && | |
389 | vma->vm_file != NULL) | |
390 | set_thread_fault_code(fault_code | | |
391 | FAULT_CODE_BLKCOMMIT); | |
392 | } else { | |
393 | /* Allow reads even for write-only mappings */ | |
394 | if (!(vma->vm_flags & (VM_READ | VM_EXEC))) | |
395 | goto bad_area; | |
396 | } | |
397 | ||
d06063cc | 398 | fault = handle_mm_fault(mm, vma, address, (fault_code & FAULT_CODE_WRITE) ? FAULT_FLAG_WRITE : 0); |
83c54070 NP |
399 | if (unlikely(fault & VM_FAULT_ERROR)) { |
400 | if (fault & VM_FAULT_OOM) | |
401 | goto out_of_memory; | |
402 | else if (fault & VM_FAULT_SIGBUS) | |
403 | goto do_sigbus; | |
1da177e4 LT |
404 | BUG(); |
405 | } | |
a084b667 | 406 | if (fault & VM_FAULT_MAJOR) { |
83c54070 | 407 | current->maj_flt++; |
a084b667 DM |
408 | perf_sw_event(PERF_COUNT_SW_PAGE_FAULTS_MAJ, 1, 0, |
409 | regs, address); | |
410 | } else { | |
83c54070 | 411 | current->min_flt++; |
a084b667 DM |
412 | perf_sw_event(PERF_COUNT_SW_PAGE_FAULTS_MIN, 1, 0, |
413 | regs, address); | |
414 | } | |
1da177e4 | 415 | up_read(&mm->mmap_sem); |
7a1ac526 DM |
416 | |
417 | mm_rss = get_mm_rss(mm); | |
dcc1e8dd DM |
418 | #ifdef CONFIG_HUGETLB_PAGE |
419 | mm_rss -= (mm->context.huge_pte_count * (HPAGE_SIZE / PAGE_SIZE)); | |
420 | #endif | |
7bebd83d | 421 | if (unlikely(mm_rss > |
dcc1e8dd DM |
422 | mm->context.tsb_block[MM_TSB_BASE].tsb_rss_limit)) |
423 | tsb_grow(mm, MM_TSB_BASE, mm_rss); | |
424 | #ifdef CONFIG_HUGETLB_PAGE | |
425 | mm_rss = mm->context.huge_pte_count; | |
7bebd83d | 426 | if (unlikely(mm_rss > |
dcc1e8dd DM |
427 | mm->context.tsb_block[MM_TSB_HUGE].tsb_rss_limit)) |
428 | tsb_grow(mm, MM_TSB_HUGE, mm_rss); | |
429 | #endif | |
efdc1e20 | 430 | return; |
1da177e4 LT |
431 | |
432 | /* | |
433 | * Something tried to access memory that isn't in our memory map.. | |
434 | * Fix it, but check if it's kernel or user first.. | |
435 | */ | |
436 | bad_area: | |
437 | insn = get_fault_insn(regs, insn); | |
438 | up_read(&mm->mmap_sem); | |
439 | ||
440 | handle_kernel_fault: | |
441 | do_kernel_fault(regs, si_code, fault_code, insn, address); | |
efdc1e20 | 442 | return; |
1da177e4 LT |
443 | |
444 | /* | |
445 | * We ran out of memory, or some other thing happened to us that made | |
446 | * us unable to handle the page fault gracefully. | |
447 | */ | |
448 | out_of_memory: | |
449 | insn = get_fault_insn(regs, insn); | |
450 | up_read(&mm->mmap_sem); | |
a923c28f DM |
451 | if (!(regs->tstate & TSTATE_PRIV)) { |
452 | pagefault_out_of_memory(); | |
453 | return; | |
454 | } | |
1da177e4 LT |
455 | goto handle_kernel_fault; |
456 | ||
457 | intr_or_no_mm: | |
458 | insn = get_fault_insn(regs, 0); | |
459 | goto handle_kernel_fault; | |
460 | ||
461 | do_sigbus: | |
462 | insn = get_fault_insn(regs, insn); | |
463 | up_read(&mm->mmap_sem); | |
464 | ||
465 | /* | |
466 | * Send a sigbus, regardless of whether we were in kernel | |
467 | * or user mode. | |
468 | */ | |
469 | do_fault_siginfo(BUS_ADRERR, SIGBUS, regs, insn, fault_code); | |
470 | ||
471 | /* Kernel mode? Handle exceptions or die */ | |
472 | if (regs->tstate & TSTATE_PRIV) | |
473 | goto handle_kernel_fault; | |
1da177e4 | 474 | } |