1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18#include <linux/signal.h>
19#include <linux/sched.h>
20#include <linux/kernel.h>
21#include <linux/errno.h>
22#include <linux/string.h>
23#include <linux/types.h>
24#include <linux/ptrace.h>
25#include <linux/mman.h>
26#include <linux/mm.h>
27#include <linux/interrupt.h>
28#include <linux/highmem.h>
29#include <linux/module.h>
30#include <linux/kprobes.h>
31#include <linux/kdebug.h>
32#include <linux/perf_event.h>
33
34#include <asm/firmware.h>
35#include <asm/page.h>
36#include <asm/pgtable.h>
37#include <asm/mmu.h>
38#include <asm/mmu_context.h>
39#include <asm/system.h>
40#include <asm/uaccess.h>
41#include <asm/tlbflush.h>
42#include <asm/siginfo.h>
43
44
45#ifdef CONFIG_KPROBES
46static inline int notify_page_fault(struct pt_regs *regs)
47{
48 int ret = 0;
49
50
51 if (!user_mode(regs)) {
52 preempt_disable();
53 if (kprobe_running() && kprobe_fault_handler(regs, 11))
54 ret = 1;
55 preempt_enable();
56 }
57
58 return ret;
59}
60#else
61static inline int notify_page_fault(struct pt_regs *regs)
62{
63 return 0;
64}
65#endif
66
67
68
69
70
71static int store_updates_sp(struct pt_regs *regs)
72{
73 unsigned int inst;
74
75 if (get_user(inst, (unsigned int __user *)regs->nip))
76 return 0;
77
78 if (((inst >> 16) & 0x1f) != 1)
79 return 0;
80
81 switch (inst >> 26) {
82 case 37:
83 case 39:
84 case 45:
85 case 53:
86 case 55:
87 return 1;
88 case 62:
89 return (inst & 3) == 1;
90 case 31:
91
92 switch ((inst >> 1) & 0x3ff) {
93 case 181:
94 case 183:
95 case 247:
96 case 439:
97 case 695:
98 case 759:
99 return 1;
100 }
101 }
102 return 0;
103}
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118int __kprobes do_page_fault(struct pt_regs *regs, unsigned long address,
119 unsigned long error_code)
120{
121 struct vm_area_struct * vma;
122 struct mm_struct *mm = current->mm;
123 siginfo_t info;
124 int code = SEGV_MAPERR;
125 int is_write = 0, ret;
126 int trap = TRAP(regs);
127 int is_exec = trap == 0x400;
128
129#if !(defined(CONFIG_4xx) || defined(CONFIG_BOOKE))
130
131
132
133
134
135
136 if (trap == 0x400)
137 error_code &= 0x48200000;
138 else
139 is_write = error_code & DSISR_ISSTORE;
140#else
141 is_write = error_code & ESR_DST;
142#endif
143
144 if (notify_page_fault(regs))
145 return 0;
146
147 if (unlikely(debugger_fault_handler(regs)))
148 return 0;
149
150
151 if (!user_mode(regs) && (address >= TASK_SIZE))
152 return SIGSEGV;
153
154#if !(defined(CONFIG_4xx) || defined(CONFIG_BOOKE))
155 if (error_code & DSISR_DABRMATCH) {
156
157 do_dabr(regs, address, error_code);
158 return 0;
159 }
160#endif
161
162 if (in_atomic() || mm == NULL) {
163 if (!user_mode(regs))
164 return SIGSEGV;
165
166
167 printk(KERN_EMERG "Page fault in user mode with "
168 "in_atomic() = %d mm = %p\n", in_atomic(), mm);
169 printk(KERN_EMERG "NIP = %lx MSR = %lx\n",
170 regs->nip, regs->msr);
171 die("Weird page fault", regs, SIGSEGV);
172 }
173
174 perf_sw_event(PERF_COUNT_SW_PAGE_FAULTS, 1, 0, regs, address);
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191 if (!down_read_trylock(&mm->mmap_sem)) {
192 if (!user_mode(regs) && !search_exception_tables(regs->nip))
193 goto bad_area_nosemaphore;
194
195 down_read(&mm->mmap_sem);
196 }
197
198 vma = find_vma(mm, address);
199 if (!vma)
200 goto bad_area;
201 if (vma->vm_start <= address)
202 goto good_area;
203 if (!(vma->vm_flags & VM_GROWSDOWN))
204 goto bad_area;
205
206
207
208
209
210
211
212
213
214
215 if (address + 0x100000 < vma->vm_end) {
216
217 struct pt_regs *uregs = current->thread.regs;
218 if (uregs == NULL)
219 goto bad_area;
220
221
222
223
224
225
226
227
228
229
230
231
232
233 if (address + 2048 < uregs->gpr[1]
234 && (!user_mode(regs) || !store_updates_sp(regs)))
235 goto bad_area;
236 }
237 if (expand_stack(vma, address))
238 goto bad_area;
239
240good_area:
241 code = SEGV_ACCERR;
242#if defined(CONFIG_6xx)
243 if (error_code & 0x95700000)
244
245
246 goto bad_area;
247#endif
248#if defined(CONFIG_8xx)
249
250
251
252
253 if (error_code & 0x10000000)
254
255 goto bad_area;
256#endif
257
258 if (is_exec) {
259#ifdef CONFIG_PPC_STD_MMU
260
261
262
263
264
265
266
267
268 if (error_code & DSISR_PROTFAULT)
269 goto bad_area;
270#endif
271
272
273
274
275
276
277
278
279
280
281
282 if (!(vma->vm_flags & VM_EXEC) &&
283 (cpu_has_feature(CPU_FTR_NOEXECUTE) ||
284 !(vma->vm_flags & (VM_READ | VM_WRITE))))
285 goto bad_area;
286
287 } else if (is_write) {
288 if (!(vma->vm_flags & VM_WRITE))
289 goto bad_area;
290
291 } else {
292
293 if (error_code & 0x08000000)
294 goto bad_area;
295 if (!(vma->vm_flags & (VM_READ | VM_EXEC | VM_WRITE)))
296 goto bad_area;
297 }
298
299
300
301
302
303
304 survive:
305 ret = handle_mm_fault(mm, vma, address, is_write ? FAULT_FLAG_WRITE : 0);
306 if (unlikely(ret & VM_FAULT_ERROR)) {
307 if (ret & VM_FAULT_OOM)
308 goto out_of_memory;
309 else if (ret & VM_FAULT_SIGBUS)
310 goto do_sigbus;
311 BUG();
312 }
313 if (ret & VM_FAULT_MAJOR) {
314 current->maj_flt++;
315 perf_sw_event(PERF_COUNT_SW_PAGE_FAULTS_MAJ, 1, 0,
316 regs, address);
317#ifdef CONFIG_PPC_SMLPAR
318 if (firmware_has_feature(FW_FEATURE_CMO)) {
319 preempt_disable();
320 get_lppaca()->page_ins += (1 << PAGE_FACTOR);
321 preempt_enable();
322 }
323#endif
324 } else {
325 current->min_flt++;
326 perf_sw_event(PERF_COUNT_SW_PAGE_FAULTS_MIN, 1, 0,
327 regs, address);
328 }
329 up_read(&mm->mmap_sem);
330 return 0;
331
332bad_area:
333 up_read(&mm->mmap_sem);
334
335bad_area_nosemaphore:
336
337 if (user_mode(regs)) {
338 _exception(SIGSEGV, regs, code, address);
339 return 0;
340 }
341
342 if (is_exec && (error_code & DSISR_PROTFAULT)
343 && printk_ratelimit())
344 printk(KERN_CRIT "kernel tried to execute NX-protected"
345 " page (%lx) - exploit attempt? (uid: %d)\n",
346 address, current_uid());
347
348 return SIGSEGV;
349
350
351
352
353
354out_of_memory:
355 up_read(&mm->mmap_sem);
356 if (is_global_init(current)) {
357 yield();
358 down_read(&mm->mmap_sem);
359 goto survive;
360 }
361 printk("VM: killing process %s\n", current->comm);
362 if (user_mode(regs))
363 do_group_exit(SIGKILL);
364 return SIGKILL;
365
366do_sigbus:
367 up_read(&mm->mmap_sem);
368 if (user_mode(regs)) {
369 info.si_signo = SIGBUS;
370 info.si_errno = 0;
371 info.si_code = BUS_ADRERR;
372 info.si_addr = (void __user *)address;
373 force_sig_info(SIGBUS, &info, current);
374 return 0;
375 }
376 return SIGBUS;
377}
378
379
380
381
382
383
384void bad_page_fault(struct pt_regs *regs, unsigned long address, int sig)
385{
386 const struct exception_table_entry *entry;
387
388
389 if ((entry = search_exception_tables(regs->nip)) != NULL) {
390 regs->nip = entry->fixup;
391 return;
392 }
393
394
395
396 switch (regs->trap) {
397 case 0x300:
398 case 0x380:
399 printk(KERN_ALERT "Unable to handle kernel paging request for "
400 "data at address 0x%08lx\n", regs->dar);
401 break;
402 case 0x400:
403 case 0x480:
404 printk(KERN_ALERT "Unable to handle kernel paging request for "
405 "instruction fetch\n");
406 break;
407 default:
408 printk(KERN_ALERT "Unable to handle kernel paging request for "
409 "unknown fault\n");
410 break;
411 }
412 printk(KERN_ALERT "Faulting instruction address: 0x%08lx\n",
413 regs->nip);
414
415 die("Kernel access of bad area", regs, sig);
416}
417