2 * This file is subject to the terms and conditions of the GNU General Public
3 * License. See the file "COPYING" in the main directory of this archive
6 * Copyright (C) 1995 - 2000 by Ralf Baechle
8 #include <linux/context_tracking.h>
9 #include <linux/signal.h>
10 #include <linux/sched.h>
11 #include <linux/interrupt.h>
12 #include <linux/kernel.h>
13 #include <linux/errno.h>
14 #include <linux/string.h>
15 #include <linux/types.h>
16 #include <linux/ptrace.h>
17 #include <linux/ratelimit.h>
18 #include <linux/mman.h>
20 #include <linux/smp.h>
21 #include <linux/kprobes.h>
22 #include <linux/perf_event.h>
23 #include <linux/uaccess.h>
25 #include <asm/branch.h>
26 #include <asm/mmu_context.h>
27 #include <asm/ptrace.h>
28 #include <asm/highmem.h> /* For VMALLOC_END */
29 #include <linux/kdebug.h>
31 int show_unhandled_signals
= 1;
34 * This routine handles page faults. It determines the address,
35 * and the problem, and then passes it off to one of the appropriate
38 static void __kprobes
__do_page_fault(struct pt_regs
*regs
, unsigned long write
,
39 unsigned long address
)
41 struct vm_area_struct
* vma
= NULL
;
42 struct task_struct
*tsk
= current
;
43 struct mm_struct
*mm
= tsk
->mm
;
44 const int field
= sizeof(unsigned long) * 2;
47 unsigned int flags
= FAULT_FLAG_ALLOW_RETRY
| FAULT_FLAG_KILLABLE
;
49 static DEFINE_RATELIMIT_STATE(ratelimit_state
, 5 * HZ
, 10);
52 printk("Cpu%d[%s:%d:%0*lx:%ld:%0*lx]\n", raw_smp_processor_id(),
53 current
->comm
, current
->pid
, field
, address
, write
,
54 field
, regs
->cp0_epc
);
59 * This is to notify the fault handler of the kprobes.
61 if (notify_die(DIE_PAGE_FAULT
, "page fault", regs
, -1,
62 current
->thread
.trap_nr
, SIGSEGV
) == NOTIFY_STOP
)
66 info
.si_code
= SEGV_MAPERR
;
69 * We fault-in kernel-space virtual memory on-demand. The
70 * 'reference' page table is init_mm.pgd.
72 * NOTE! We MUST NOT take any locks for this case. We may
73 * be in an interrupt or a critical region, and should
74 * only copy the information from the master page table,
78 # define VMALLOC_FAULT_TARGET no_context
80 # define VMALLOC_FAULT_TARGET vmalloc_fault
83 if (unlikely(address
>= VMALLOC_START
&& address
<= VMALLOC_END
))
84 goto VMALLOC_FAULT_TARGET
;
86 if (unlikely(address
>= MODULE_START
&& address
< MODULE_END
))
87 goto VMALLOC_FAULT_TARGET
;
91 * If we're in an interrupt or have no user
92 * context, we must not take the fault..
94 if (faulthandler_disabled() || !mm
)
95 goto bad_area_nosemaphore
;
98 flags
|= FAULT_FLAG_USER
;
100 down_read(&mm
->mmap_sem
);
101 vma
= find_vma(mm
, address
);
104 if (vma
->vm_start
<= address
)
106 if (!(vma
->vm_flags
& VM_GROWSDOWN
))
108 if (expand_stack(vma
, address
))
111 * Ok, we have a good vm_area for this memory access, so
115 info
.si_code
= SEGV_ACCERR
;
118 if (!(vma
->vm_flags
& VM_WRITE
))
120 flags
|= FAULT_FLAG_WRITE
;
123 if (address
== regs
->cp0_epc
&& !(vma
->vm_flags
& VM_EXEC
)) {
125 pr_notice("Cpu%d[%s:%d:%0*lx:%ld:%0*lx] XI violation\n",
126 raw_smp_processor_id(),
127 current
->comm
, current
->pid
,
128 field
, address
, write
,
129 field
, regs
->cp0_epc
);
133 if (!(vma
->vm_flags
& VM_READ
) &&
134 exception_epc(regs
) != address
) {
136 pr_notice("Cpu%d[%s:%d:%0*lx:%ld:%0*lx] RI violation\n",
137 raw_smp_processor_id(),
138 current
->comm
, current
->pid
,
139 field
, address
, write
,
140 field
, regs
->cp0_epc
);
145 if (!(vma
->vm_flags
& (VM_READ
| VM_WRITE
| VM_EXEC
)))
151 * If for any reason at all we couldn't handle the fault,
152 * make sure we exit gracefully rather than endlessly redo
155 fault
= handle_mm_fault(vma
, address
, flags
);
157 if ((fault
& VM_FAULT_RETRY
) && fatal_signal_pending(current
))
160 perf_sw_event(PERF_COUNT_SW_PAGE_FAULTS
, 1, regs
, address
);
161 if (unlikely(fault
& VM_FAULT_ERROR
)) {
162 if (fault
& VM_FAULT_OOM
)
164 else if (fault
& VM_FAULT_SIGSEGV
)
166 else if (fault
& VM_FAULT_SIGBUS
)
170 if (flags
& FAULT_FLAG_ALLOW_RETRY
) {
171 if (fault
& VM_FAULT_MAJOR
) {
172 perf_sw_event(PERF_COUNT_SW_PAGE_FAULTS_MAJ
, 1,
176 perf_sw_event(PERF_COUNT_SW_PAGE_FAULTS_MIN
, 1,
180 if (fault
& VM_FAULT_RETRY
) {
181 flags
&= ~FAULT_FLAG_ALLOW_RETRY
;
182 flags
|= FAULT_FLAG_TRIED
;
185 * No need to up_read(&mm->mmap_sem) as we would
186 * have already released it in __lock_page_or_retry
194 up_read(&mm
->mmap_sem
);
198 * Something tried to access memory that isn't in our memory map..
199 * Fix it, but check if it's kernel or user first..
202 up_read(&mm
->mmap_sem
);
204 bad_area_nosemaphore
:
205 /* User mode accesses just cause a SIGSEGV */
206 if (user_mode(regs
)) {
207 tsk
->thread
.cp0_badvaddr
= address
;
208 tsk
->thread
.error_code
= write
;
209 if (show_unhandled_signals
&&
210 unhandled_signal(tsk
, SIGSEGV
) &&
211 __ratelimit(&ratelimit_state
)) {
212 pr_info("\ndo_page_fault(): sending SIGSEGV to %s for invalid %s %0*lx",
214 write
? "write access to" : "read access from",
216 pr_info("epc = %0*lx in", field
,
217 (unsigned long) regs
->cp0_epc
);
218 print_vma_addr(" ", regs
->cp0_epc
);
219 pr_info("ra = %0*lx in", field
,
220 (unsigned long) regs
->regs
[31]);
221 print_vma_addr(" ", regs
->regs
[31]);
224 current
->thread
.trap_nr
= (regs
->cp0_cause
>> 2) & 0x1f;
225 info
.si_signo
= SIGSEGV
;
227 /* info.si_code has been set above */
228 info
.si_addr
= (void __user
*) address
;
229 force_sig_info(SIGSEGV
, &info
, tsk
);
234 /* Are we prepared to handle this kernel fault? */
235 if (fixup_exception(regs
)) {
236 current
->thread
.cp0_baduaddr
= address
;
241 * Oops. The kernel tried to access some bad page. We'll have to
242 * terminate things with extreme prejudice.
246 printk(KERN_ALERT
"CPU %d Unable to handle kernel paging request at "
247 "virtual address %0*lx, epc == %0*lx, ra == %0*lx\n",
248 raw_smp_processor_id(), field
, address
, field
, regs
->cp0_epc
,
249 field
, regs
->regs
[31]);
254 * We ran out of memory, call the OOM killer, and return the userspace
255 * (which will retry the fault, or kill us if we got oom-killed).
257 up_read(&mm
->mmap_sem
);
258 if (!user_mode(regs
))
260 pagefault_out_of_memory();
264 up_read(&mm
->mmap_sem
);
266 /* Kernel mode? Handle exceptions or die */
267 if (!user_mode(regs
))
271 * Send a sigbus, regardless of whether we were in kernel
275 printk("do_page_fault() #3: sending SIGBUS to %s for "
276 "invalid %s\n%0*lx (epc == %0*lx, ra == %0*lx)\n",
278 write
? "write access to" : "read access from",
280 field
, (unsigned long) regs
->cp0_epc
,
281 field
, (unsigned long) regs
->regs
[31]);
283 current
->thread
.trap_nr
= (regs
->cp0_cause
>> 2) & 0x1f;
284 tsk
->thread
.cp0_badvaddr
= address
;
285 info
.si_signo
= SIGBUS
;
287 info
.si_code
= BUS_ADRERR
;
288 info
.si_addr
= (void __user
*) address
;
289 force_sig_info(SIGBUS
, &info
, tsk
);
296 * Synchronize this task's top level page-table
297 * with the 'reference' page table.
299 * Do _not_ use "tsk" here. We might be inside
300 * an interrupt in the middle of a task switch..
302 int offset
= __pgd_offset(address
);
308 pgd
= (pgd_t
*) pgd_current
[raw_smp_processor_id()] + offset
;
309 pgd_k
= init_mm
.pgd
+ offset
;
311 if (!pgd_present(*pgd_k
))
313 set_pgd(pgd
, *pgd_k
);
315 pud
= pud_offset(pgd
, address
);
316 pud_k
= pud_offset(pgd_k
, address
);
317 if (!pud_present(*pud_k
))
320 pmd
= pmd_offset(pud
, address
);
321 pmd_k
= pmd_offset(pud_k
, address
);
322 if (!pmd_present(*pmd_k
))
324 set_pmd(pmd
, *pmd_k
);
326 pte_k
= pte_offset_kernel(pmd_k
, address
);
327 if (!pte_present(*pte_k
))
334 asmlinkage
void __kprobes
do_page_fault(struct pt_regs
*regs
,
335 unsigned long write
, unsigned long address
)
337 enum ctx_state prev_state
;
339 prev_state
= exception_enter();
340 __do_page_fault(regs
, write
, address
);
341 exception_exit(prev_state
);