2 * linux/arch/arm/mm/fault.c
4 * Copyright (C) 1995 Linus Torvalds
5 * Modifications for ARM processor (c) 1995-2004 Russell King
6 * Modifications for nommu or non-paged, Hyok S. Choi, 2003
8 * This program is free software; you can redistribute it and/or modify
9 * it under the terms of the GNU General Public License version 2 as
10 * published by the Free Software Foundation.
12 #include <linux/module.h>
13 #include <linux/signal.h>
14 #include <linux/ptrace.h>
16 #include <linux/init.h>
18 #include <asm/system.h>
19 #include <asm/pgtable.h>
20 #include <asm/tlbflush.h>
21 #include <asm/uaccess.h>
26 int (*fn
)(unsigned long addr
, unsigned int fsr
, struct pt_regs
*regs
);
31 static struct fsr_info fsr_info
[];
35 * This is useful to dump out the page tables associated with
38 void show_pte(struct mm_struct
*mm
, unsigned long addr
)
45 printk(KERN_ALERT
"pgd = %p\n", mm
->pgd
);
46 pgd
= pgd_offset(mm
, addr
);
47 printk(KERN_ALERT
"[%08lx] *pgd=%08lx", addr
, pgd_val(*pgd
));
61 pmd
= pmd_offset(pgd
, addr
);
63 printk(", *pmd=%08lx", pmd_val(*pmd
));
74 #ifndef CONFIG_HIGHMEM
75 /* We must not map this if we have highmem enabled */
76 pte
= pte_offset_map(pmd
, addr
);
77 printk(", *pte=%08lx", pte_val(*pte
));
78 printk(", *ppte=%08lx", pte_val(pte
[-PTRS_PER_PTE
]));
87 * Oops. The kernel tried to access some page that wasn't present.
90 __do_kernel_fault(struct mm_struct
*mm
, unsigned long addr
, unsigned int fsr
,
94 * Are we prepared to handle this kernel fault?
96 if (fixup_exception(regs
))
100 * No handler, we'll have to terminate things with extreme prejudice.
104 "Unable to handle kernel %s at virtual address %08lx\n",
105 (addr
< PAGE_SIZE
) ? "NULL pointer dereference" :
106 "paging request", addr
);
109 die("Oops", regs
, fsr
);
115 * Something tried to access memory that isn't in our memory map..
116 * User mode accesses just cause a SIGSEGV
119 __do_user_fault(struct task_struct
*tsk
, unsigned long addr
,
120 unsigned int fsr
, unsigned int sig
, int code
,
121 struct pt_regs
*regs
)
125 #ifdef CONFIG_DEBUG_USER
126 if (user_debug
& UDBG_SEGV
) {
127 printk(KERN_DEBUG
"%s: unhandled page fault (%d) at 0x%08lx, code 0x%03x\n",
128 tsk
->comm
, sig
, addr
, fsr
);
129 show_pte(tsk
->mm
, addr
);
134 tsk
->thread
.address
= addr
;
135 tsk
->thread
.error_code
= fsr
;
136 tsk
->thread
.trap_no
= 14;
140 si
.si_addr
= (void __user
*)addr
;
141 force_sig_info(sig
, &si
, tsk
);
144 void do_bad_area(unsigned long addr
, unsigned int fsr
, struct pt_regs
*regs
)
146 struct task_struct
*tsk
= current
;
147 struct mm_struct
*mm
= tsk
->active_mm
;
150 * If we are in kernel mode at this point, we
151 * have no context to handle this fault with.
154 __do_user_fault(tsk
, addr
, fsr
, SIGSEGV
, SEGV_MAPERR
, regs
);
156 __do_kernel_fault(mm
, addr
, fsr
, regs
);
159 #define VM_FAULT_BADMAP (-20)
160 #define VM_FAULT_BADACCESS (-21)
163 __do_page_fault(struct mm_struct
*mm
, unsigned long addr
, unsigned int fsr
,
164 struct task_struct
*tsk
)
166 struct vm_area_struct
*vma
;
169 vma
= find_vma(mm
, addr
);
170 fault
= VM_FAULT_BADMAP
;
173 if (vma
->vm_start
> addr
)
177 * Ok, we have a good vm_area for this
178 * memory access, so we can handle it.
181 if (fsr
& (1 << 11)) /* write? */
184 mask
= VM_READ
|VM_EXEC
|VM_WRITE
;
186 fault
= VM_FAULT_BADACCESS
;
187 if (!(vma
->vm_flags
& mask
))
191 * If for any reason at all we couldn't handle
192 * the fault, make sure we exit gracefully rather
193 * than endlessly redo the fault.
196 fault
= handle_mm_fault(mm
, vma
, addr
& PAGE_MASK
, fsr
& (1 << 11));
199 * Handle the "normal" cases first - successful and sigbus
207 case VM_FAULT_SIGBUS
:
215 * If we are out of memory for pid1, sleep for a while and retry
217 up_read(&mm
->mmap_sem
);
219 down_read(&mm
->mmap_sem
);
223 if (vma
->vm_flags
& VM_GROWSDOWN
&& !expand_stack(vma
, addr
))
230 do_page_fault(unsigned long addr
, unsigned int fsr
, struct pt_regs
*regs
)
232 struct task_struct
*tsk
;
233 struct mm_struct
*mm
;
234 int fault
, sig
, code
;
240 * If we're in an interrupt or have no user
241 * context, we must not take the fault..
243 if (in_interrupt() || !mm
)
247 * As per x86, we may deadlock here. However, since the kernel only
248 * validly references user space from well defined areas of the code,
249 * we can bug out early if this is from code which shouldn't.
251 if (!down_read_trylock(&mm
->mmap_sem
)) {
252 if (!user_mode(regs
) && !search_exception_tables(regs
->ARM_pc
))
254 down_read(&mm
->mmap_sem
);
257 fault
= __do_page_fault(mm
, addr
, fsr
, tsk
);
258 up_read(&mm
->mmap_sem
);
261 * Handle the "normal" case first - VM_FAULT_MAJOR / VM_FAULT_MINOR
263 if (fault
>= VM_FAULT_MINOR
)
267 * If we are in kernel mode at this point, we
268 * have no context to handle this fault with.
270 if (!user_mode(regs
))
276 * We ran out of memory, or some other thing
277 * happened to us that made us unable to handle
278 * the page fault gracefully.
280 printk("VM: killing process %s\n", tsk
->comm
);
284 case VM_FAULT_SIGBUS
:
286 * We had some memory, but were unable to
287 * successfully fix up this page fault.
295 * Something tried to access memory that
296 * isn't in our memory map..
299 code
= fault
== VM_FAULT_BADACCESS
?
300 SEGV_ACCERR
: SEGV_MAPERR
;
304 __do_user_fault(tsk
, addr
, fsr
, sig
, code
, regs
);
308 __do_kernel_fault(mm
, addr
, fsr
, regs
);
313 * First Level Translation Fault Handler
315 * We enter here because the first level page table doesn't contain
316 * a valid entry for the address.
318 * If the address is in kernel space (>= TASK_SIZE), then we are
319 * probably faulting in the vmalloc() area.
321 * If the init_task's first level page tables contains the relevant
322 * entry, we copy the it to this task. If not, we send the process
323 * a signal, fixup the exception, or oops the kernel.
325 * NOTE! We MUST NOT take any locks for this case. We may be in an
326 * interrupt or a critical region, and should only copy the information
327 * from the master page table, nothing more.
330 do_translation_fault(unsigned long addr
, unsigned int fsr
,
331 struct pt_regs
*regs
)
337 if (addr
< TASK_SIZE
)
338 return do_page_fault(addr
, fsr
, regs
);
340 index
= pgd_index(addr
);
343 * FIXME: CP15 C1 is write only on ARMv3 architectures.
345 pgd
= cpu_get_pgd() + index
;
346 pgd_k
= init_mm
.pgd
+ index
;
348 if (pgd_none(*pgd_k
))
351 if (!pgd_present(*pgd
))
352 set_pgd(pgd
, *pgd_k
);
354 pmd_k
= pmd_offset(pgd_k
, addr
);
355 pmd
= pmd_offset(pgd
, addr
);
357 if (pmd_none(*pmd_k
))
360 copy_pmd(pmd
, pmd_k
);
364 do_bad_area(addr
, fsr
, regs
);
369 * Some section permission faults need to be handled gracefully.
370 * They can happen due to a __{get,put}_user during an oops.
373 do_sect_fault(unsigned long addr
, unsigned int fsr
, struct pt_regs
*regs
)
375 do_bad_area(addr
, fsr
, regs
);
380 * Dispatch a data abort to the relevant handler.
383 do_DataAbort(unsigned long addr
, unsigned int fsr
, struct pt_regs
*regs
)
385 const struct fsr_info
*inf
= fsr_info
+ (fsr
& 15) + ((fsr
& (1 << 10)) >> 6);
388 if (!inf
->fn(addr
, fsr
, regs
))
391 printk(KERN_ALERT
"Unhandled fault: %s (0x%03x) at 0x%08lx\n",
392 inf
->name
, fsr
, addr
);
394 info
.si_signo
= inf
->sig
;
396 info
.si_code
= inf
->code
;
397 info
.si_addr
= (void __user
*)addr
;
398 notify_die("", regs
, &info
, fsr
, 0);
402 do_PrefetchAbort(unsigned long addr
, struct pt_regs
*regs
)
404 do_translation_fault(addr
, 0, regs
);
407 #else /* !CONFIG_MMU */
410 * In nommu mode, all the handler always returns "fault".
413 do_page_fault(unsigned long addr
, unsigned int fsr
, struct pt_regs
*regs
)
419 do_translation_fault(unsigned long addr
, unsigned int fsr
, struct pt_regs
*regs
)
425 do_sect_fault(unsigned long addr
, unsigned int fsr
, struct pt_regs
*regs
)
431 * Dispatch a data abort to the relevant handler.
434 do_DataAbort(unsigned long addr
, unsigned int fsr
, struct pt_regs
*regs
)
436 const struct fsr_info
*inf
= fsr_info
+ (fsr
& 15) + ((fsr
& (1 << 10)) >> 6);
438 if (!inf
->fn(addr
, fsr
, regs
))
442 printk(KERN_ALERT
"Unhandled fault: %s (0x%03x) at 0x%08lx\n",
443 inf
->name
, fsr
, addr
);
444 die("Oops", regs
, fsr
);
450 do_PrefetchAbort(unsigned long addr
, struct pt_regs
*regs
)
454 "Unable to handle %s at virtual address %08lx\n",
455 (addr
< PAGE_SIZE
) ? "NULL pointer dereference" :
457 die("Oops", regs
, -1);
462 void do_bad_area(unsigned long addr
, unsigned int fsr
, struct pt_regs
*regs
)
465 * Are we prepared to handle this kernel fault?
467 if (fixup_exception(regs
))
471 * No handler, we'll have to terminate things with extreme prejudice.
475 "Unable to handle kernel %s at virtual address %08lx\n",
476 (addr
< PAGE_SIZE
) ? "NULL pointer dereference" :
477 "paging request", addr
);
479 die("Oops", regs
, fsr
);
483 #endif /* !CONFIG_MMU */
486 * This abort handler always returns "fault".
489 do_bad(unsigned long addr
, unsigned int fsr
, struct pt_regs
*regs
)
494 static struct fsr_info fsr_info
[] = {
496 * The following are the standard ARMv3 and ARMv4 aborts. ARMv5
497 * defines these to be "precise" aborts.
499 { do_bad
, SIGSEGV
, 0, "vector exception" },
500 { do_bad
, SIGILL
, BUS_ADRALN
, "alignment exception" },
501 { do_bad
, SIGKILL
, 0, "terminal exception" },
502 { do_bad
, SIGILL
, BUS_ADRALN
, "alignment exception" },
503 { do_bad
, SIGBUS
, 0, "external abort on linefetch" },
504 { do_translation_fault
, SIGSEGV
, SEGV_MAPERR
, "section translation fault" },
505 { do_bad
, SIGBUS
, 0, "external abort on linefetch" },
506 { do_page_fault
, SIGSEGV
, SEGV_MAPERR
, "page translation fault" },
507 { do_bad
, SIGBUS
, 0, "external abort on non-linefetch" },
508 { do_bad
, SIGSEGV
, SEGV_ACCERR
, "section domain fault" },
509 { do_bad
, SIGBUS
, 0, "external abort on non-linefetch" },
510 { do_bad
, SIGSEGV
, SEGV_ACCERR
, "page domain fault" },
511 { do_bad
, SIGBUS
, 0, "external abort on translation" },
512 { do_sect_fault
, SIGSEGV
, SEGV_ACCERR
, "section permission fault" },
513 { do_bad
, SIGBUS
, 0, "external abort on translation" },
514 { do_page_fault
, SIGSEGV
, SEGV_ACCERR
, "page permission fault" },
516 * The following are "imprecise" aborts, which are signalled by bit
517 * 10 of the FSR, and may not be recoverable. These are only
518 * supported if the CPU abort handler supports bit 10.
520 { do_bad
, SIGBUS
, 0, "unknown 16" },
521 { do_bad
, SIGBUS
, 0, "unknown 17" },
522 { do_bad
, SIGBUS
, 0, "unknown 18" },
523 { do_bad
, SIGBUS
, 0, "unknown 19" },
524 { do_bad
, SIGBUS
, 0, "lock abort" }, /* xscale */
525 { do_bad
, SIGBUS
, 0, "unknown 21" },
526 { do_bad
, SIGBUS
, BUS_OBJERR
, "imprecise external abort" }, /* xscale */
527 { do_bad
, SIGBUS
, 0, "unknown 23" },
528 { do_bad
, SIGBUS
, 0, "dcache parity error" }, /* xscale */
529 { do_bad
, SIGBUS
, 0, "unknown 25" },
530 { do_bad
, SIGBUS
, 0, "unknown 26" },
531 { do_bad
, SIGBUS
, 0, "unknown 27" },
532 { do_bad
, SIGBUS
, 0, "unknown 28" },
533 { do_bad
, SIGBUS
, 0, "unknown 29" },
534 { do_bad
, SIGBUS
, 0, "unknown 30" },
535 { do_bad
, SIGBUS
, 0, "unknown 31" }
539 hook_fault_code(int nr
, int (*fn
)(unsigned long, unsigned int, struct pt_regs
*),
540 int sig
, const char *name
)
542 if (nr
>= 0 && nr
< ARRAY_SIZE(fsr_info
)) {
543 fsr_info
[nr
].fn
= fn
;
544 fsr_info
[nr
].sig
= sig
;
545 fsr_info
[nr
].name
= name
;