2 * linux/arch/arm/mm/fault.c
4 * Copyright (C) 1995 Linus Torvalds
5 * Modifications for ARM processor (c) 1995-2004 Russell King
7 * This program is free software; you can redistribute it and/or modify
8 * it under the terms of the GNU General Public License version 2 as
9 * published by the Free Software Foundation.
11 #include <linux/module.h>
12 #include <linux/signal.h>
14 #include <linux/hardirq.h>
15 #include <linux/init.h>
16 #include <linux/kprobes.h>
17 #include <linux/uaccess.h>
18 #include <linux/page-flags.h>
19 #include <linux/sched.h>
20 #include <linux/highmem.h>
22 #include <asm/system.h>
23 #include <asm/pgtable.h>
24 #include <asm/tlbflush.h>
29 * Fault status register encodings
31 #define FSR_WRITE (1 << 11)
32 #define FSR_FS4 (1 << 10)
33 #define FSR_FS3_0 (15)
35 static inline int fsr_fs(unsigned int fsr
)
37 return (fsr
& FSR_FS3_0
) | (fsr
& FSR_FS4
) >> 6;
43 static inline int notify_page_fault(struct pt_regs
*regs
, unsigned int fsr
)
47 if (!user_mode(regs
)) {
48 /* kprobe_running() needs smp_processor_id() */
50 if (kprobe_running() && kprobe_fault_handler(regs
, fsr
))
58 static inline int notify_page_fault(struct pt_regs
*regs
, unsigned int fsr
)
65 * This is useful to dump out the page tables associated with
68 void show_pte(struct mm_struct
*mm
, unsigned long addr
)
75 printk(KERN_ALERT
"pgd = %p\n", mm
->pgd
);
76 pgd
= pgd_offset(mm
, addr
);
77 printk(KERN_ALERT
"[%08lx] *pgd=%08lx", addr
, pgd_val(*pgd
));
91 pmd
= pmd_offset(pgd
, addr
);
92 if (PTRS_PER_PMD
!= 1)
93 printk(", *pmd=%08lx", pmd_val(*pmd
));
103 /* We must not map this if we have highmem enabled */
104 if (PageHighMem(pfn_to_page(pmd_val(*pmd
) >> PAGE_SHIFT
)))
107 pte
= pte_offset_map(pmd
, addr
);
108 printk(", *pte=%08lx", pte_val(*pte
));
109 printk(", *ppte=%08lx", pte_val(pte
[-PTRS_PER_PTE
]));
115 #else /* CONFIG_MMU */
116 void show_pte(struct mm_struct
*mm
, unsigned long addr
)
118 #endif /* CONFIG_MMU */
121 * Oops. The kernel tried to access some page that wasn't present.
124 __do_kernel_fault(struct mm_struct
*mm
, unsigned long addr
, unsigned int fsr
,
125 struct pt_regs
*regs
)
128 * Are we prepared to handle this kernel fault?
130 if (fixup_exception(regs
))
134 * No handler, we'll have to terminate things with extreme prejudice.
138 "Unable to handle kernel %s at virtual address %08lx\n",
139 (addr
< PAGE_SIZE
) ? "NULL pointer dereference" :
140 "paging request", addr
);
143 die("Oops", regs
, fsr
);
149 * Something tried to access memory that isn't in our memory map..
150 * User mode accesses just cause a SIGSEGV
153 __do_user_fault(struct task_struct
*tsk
, unsigned long addr
,
154 unsigned int fsr
, unsigned int sig
, int code
,
155 struct pt_regs
*regs
)
159 #ifdef CONFIG_DEBUG_USER
160 if (user_debug
& UDBG_SEGV
) {
161 printk(KERN_DEBUG
"%s: unhandled page fault (%d) at 0x%08lx, code 0x%03x\n",
162 tsk
->comm
, sig
, addr
, fsr
);
163 show_pte(tsk
->mm
, addr
);
168 tsk
->thread
.address
= addr
;
169 tsk
->thread
.error_code
= fsr
;
170 tsk
->thread
.trap_no
= 14;
174 si
.si_addr
= (void __user
*)addr
;
175 force_sig_info(sig
, &si
, tsk
);
178 void do_bad_area(unsigned long addr
, unsigned int fsr
, struct pt_regs
*regs
)
180 struct task_struct
*tsk
= current
;
181 struct mm_struct
*mm
= tsk
->active_mm
;
184 * If we are in kernel mode at this point, we
185 * have no context to handle this fault with.
188 __do_user_fault(tsk
, addr
, fsr
, SIGSEGV
, SEGV_MAPERR
, regs
);
190 __do_kernel_fault(mm
, addr
, fsr
, regs
);
194 #define VM_FAULT_BADMAP 0x010000
195 #define VM_FAULT_BADACCESS 0x020000
198 * Check that the permissions on the VMA allow for the fault which occurred.
199 * If we encountered a write fault, we must have write permission, otherwise
200 * we allow any permission.
202 static inline bool access_error(unsigned int fsr
, struct vm_area_struct
*vma
)
204 unsigned int mask
= VM_READ
| VM_WRITE
| VM_EXEC
;
209 return vma
->vm_flags
& mask
? false : true;
213 __do_page_fault(struct mm_struct
*mm
, unsigned long addr
, unsigned int fsr
,
214 struct task_struct
*tsk
)
216 struct vm_area_struct
*vma
;
219 vma
= find_vma(mm
, addr
);
220 fault
= VM_FAULT_BADMAP
;
223 if (unlikely(vma
->vm_start
> addr
))
227 * Ok, we have a good vm_area for this
228 * memory access, so we can handle it.
231 if (access_error(fsr
, vma
)) {
232 fault
= VM_FAULT_BADACCESS
;
237 * If for any reason at all we couldn't handle the fault, make
238 * sure we exit gracefully rather than endlessly redo the fault.
240 fault
= handle_mm_fault(mm
, vma
, addr
& PAGE_MASK
, (fsr
& FSR_WRITE
) ? FAULT_FLAG_WRITE
: 0);
241 if (unlikely(fault
& VM_FAULT_ERROR
))
243 if (fault
& VM_FAULT_MAJOR
)
250 if (vma
->vm_flags
& VM_GROWSDOWN
&& !expand_stack(vma
, addr
))
257 do_page_fault(unsigned long addr
, unsigned int fsr
, struct pt_regs
*regs
)
259 struct task_struct
*tsk
;
260 struct mm_struct
*mm
;
261 int fault
, sig
, code
;
263 if (notify_page_fault(regs
, fsr
))
270 * If we're in an interrupt or have no user
271 * context, we must not take the fault..
273 if (in_atomic() || !mm
)
277 * As per x86, we may deadlock here. However, since the kernel only
278 * validly references user space from well defined areas of the code,
279 * we can bug out early if this is from code which shouldn't.
281 if (!down_read_trylock(&mm
->mmap_sem
)) {
282 if (!user_mode(regs
) && !search_exception_tables(regs
->ARM_pc
))
284 down_read(&mm
->mmap_sem
);
287 * The above down_read_trylock() might have succeeded in
288 * which case, we'll have missed the might_sleep() from
294 fault
= __do_page_fault(mm
, addr
, fsr
, tsk
);
295 up_read(&mm
->mmap_sem
);
298 * Handle the "normal" case first - VM_FAULT_MAJOR / VM_FAULT_MINOR
300 if (likely(!(fault
& (VM_FAULT_ERROR
| VM_FAULT_BADMAP
| VM_FAULT_BADACCESS
))))
303 if (fault
& VM_FAULT_OOM
) {
305 * We ran out of memory, call the OOM killer, and return to
306 * userspace (which will retry the fault, or kill us if we
309 pagefault_out_of_memory();
314 * If we are in kernel mode at this point, we
315 * have no context to handle this fault with.
317 if (!user_mode(regs
))
320 if (fault
& VM_FAULT_SIGBUS
) {
322 * We had some memory, but were unable to
323 * successfully fix up this page fault.
329 * Something tried to access memory that
330 * isn't in our memory map..
333 code
= fault
== VM_FAULT_BADACCESS
?
334 SEGV_ACCERR
: SEGV_MAPERR
;
337 __do_user_fault(tsk
, addr
, fsr
, sig
, code
, regs
);
341 __do_kernel_fault(mm
, addr
, fsr
, regs
);
344 #else /* CONFIG_MMU */
346 do_page_fault(unsigned long addr
, unsigned int fsr
, struct pt_regs
*regs
)
350 #endif /* CONFIG_MMU */
353 * First Level Translation Fault Handler
355 * We enter here because the first level page table doesn't contain
356 * a valid entry for the address.
358 * If the address is in kernel space (>= TASK_SIZE), then we are
359 * probably faulting in the vmalloc() area.
361 * If the init_task's first level page tables contains the relevant
362 * entry, we copy the it to this task. If not, we send the process
363 * a signal, fixup the exception, or oops the kernel.
365 * NOTE! We MUST NOT take any locks for this case. We may be in an
366 * interrupt or a critical region, and should only copy the information
367 * from the master page table, nothing more.
371 do_translation_fault(unsigned long addr
, unsigned int fsr
,
372 struct pt_regs
*regs
)
378 if (addr
< TASK_SIZE
)
379 return do_page_fault(addr
, fsr
, regs
);
381 index
= pgd_index(addr
);
384 * FIXME: CP15 C1 is write only on ARMv3 architectures.
386 pgd
= cpu_get_pgd() + index
;
387 pgd_k
= init_mm
.pgd
+ index
;
389 if (pgd_none(*pgd_k
))
392 if (!pgd_present(*pgd
))
393 set_pgd(pgd
, *pgd_k
);
395 pmd_k
= pmd_offset(pgd_k
, addr
);
396 pmd
= pmd_offset(pgd
, addr
);
398 if (pmd_none(*pmd_k
))
401 copy_pmd(pmd
, pmd_k
);
405 do_bad_area(addr
, fsr
, regs
);
408 #else /* CONFIG_MMU */
410 do_translation_fault(unsigned long addr
, unsigned int fsr
,
411 struct pt_regs
*regs
)
415 #endif /* CONFIG_MMU */
418 * Some section permission faults need to be handled gracefully.
419 * They can happen due to a __{get,put}_user during an oops.
422 do_sect_fault(unsigned long addr
, unsigned int fsr
, struct pt_regs
*regs
)
424 do_bad_area(addr
, fsr
, regs
);
429 * This abort handler always returns "fault".
432 do_bad(unsigned long addr
, unsigned int fsr
, struct pt_regs
*regs
)
437 static struct fsr_info
{
438 int (*fn
)(unsigned long addr
, unsigned int fsr
, struct pt_regs
*regs
);
444 * The following are the standard ARMv3 and ARMv4 aborts. ARMv5
445 * defines these to be "precise" aborts.
447 { do_bad
, SIGSEGV
, 0, "vector exception" },
448 { do_bad
, SIGILL
, BUS_ADRALN
, "alignment exception" },
449 { do_bad
, SIGKILL
, 0, "terminal exception" },
450 { do_bad
, SIGILL
, BUS_ADRALN
, "alignment exception" },
451 { do_bad
, SIGBUS
, 0, "external abort on linefetch" },
452 { do_translation_fault
, SIGSEGV
, SEGV_MAPERR
, "section translation fault" },
453 { do_bad
, SIGBUS
, 0, "external abort on linefetch" },
454 { do_page_fault
, SIGSEGV
, SEGV_MAPERR
, "page translation fault" },
455 { do_bad
, SIGBUS
, 0, "external abort on non-linefetch" },
456 { do_bad
, SIGSEGV
, SEGV_ACCERR
, "section domain fault" },
457 { do_bad
, SIGBUS
, 0, "external abort on non-linefetch" },
458 { do_bad
, SIGSEGV
, SEGV_ACCERR
, "page domain fault" },
459 { do_bad
, SIGBUS
, 0, "external abort on translation" },
460 { do_sect_fault
, SIGSEGV
, SEGV_ACCERR
, "section permission fault" },
461 { do_bad
, SIGBUS
, 0, "external abort on translation" },
462 { do_page_fault
, SIGSEGV
, SEGV_ACCERR
, "page permission fault" },
464 * The following are "imprecise" aborts, which are signalled by bit
465 * 10 of the FSR, and may not be recoverable. These are only
466 * supported if the CPU abort handler supports bit 10.
468 { do_bad
, SIGBUS
, 0, "unknown 16" },
469 { do_bad
, SIGBUS
, 0, "unknown 17" },
470 { do_bad
, SIGBUS
, 0, "unknown 18" },
471 { do_bad
, SIGBUS
, 0, "unknown 19" },
472 { do_bad
, SIGBUS
, 0, "lock abort" }, /* xscale */
473 { do_bad
, SIGBUS
, 0, "unknown 21" },
474 { do_bad
, SIGBUS
, BUS_OBJERR
, "imprecise external abort" }, /* xscale */
475 { do_bad
, SIGBUS
, 0, "unknown 23" },
476 { do_bad
, SIGBUS
, 0, "dcache parity error" }, /* xscale */
477 { do_bad
, SIGBUS
, 0, "unknown 25" },
478 { do_bad
, SIGBUS
, 0, "unknown 26" },
479 { do_bad
, SIGBUS
, 0, "unknown 27" },
480 { do_bad
, SIGBUS
, 0, "unknown 28" },
481 { do_bad
, SIGBUS
, 0, "unknown 29" },
482 { do_bad
, SIGBUS
, 0, "unknown 30" },
483 { do_bad
, SIGBUS
, 0, "unknown 31" }
487 hook_fault_code(int nr
, int (*fn
)(unsigned long, unsigned int, struct pt_regs
*),
488 int sig
, const char *name
)
490 if (nr
>= 0 && nr
< ARRAY_SIZE(fsr_info
)) {
491 fsr_info
[nr
].fn
= fn
;
492 fsr_info
[nr
].sig
= sig
;
493 fsr_info
[nr
].name
= name
;
498 * Dispatch a data abort to the relevant handler.
500 asmlinkage
void __exception
501 do_DataAbort(unsigned long addr
, unsigned int fsr
, struct pt_regs
*regs
)
503 const struct fsr_info
*inf
= fsr_info
+ fsr_fs(fsr
);
506 if (!inf
->fn(addr
, fsr
, regs
))
509 printk(KERN_ALERT
"Unhandled fault: %s (0x%03x) at 0x%08lx\n",
510 inf
->name
, fsr
, addr
);
512 info
.si_signo
= inf
->sig
;
514 info
.si_code
= inf
->code
;
515 info
.si_addr
= (void __user
*)addr
;
516 arm_notify_die("", regs
, &info
, fsr
, 0);
519 asmlinkage
void __exception
520 do_PrefetchAbort(unsigned long addr
, struct pt_regs
*regs
)
522 do_translation_fault(addr
, 0, regs
);