1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18#include <linux/signal.h>
19#include <linux/sched.h>
20#include <linux/kernel.h>
21#include <linux/errno.h>
22#include <linux/string.h>
23#include <linux/types.h>
24#include <linux/ptrace.h>
25#include <linux/mman.h>
26#include <linux/mm.h>
27#include <linux/interrupt.h>
28#include <linux/highmem.h>
29#include <linux/module.h>
30#include <linux/kprobes.h>
31#include <linux/kdebug.h>
32#include <linux/perf_event.h>
33#include <linux/magic.h>
34
35#include <asm/firmware.h>
36#include <asm/page.h>
37#include <asm/pgtable.h>
38#include <asm/mmu.h>
39#include <asm/mmu_context.h>
40#include <asm/system.h>
41#include <asm/uaccess.h>
42#include <asm/tlbflush.h>
43#include <asm/siginfo.h>
44#include <mm/mmu_decl.h>
45
46#ifdef CONFIG_KPROBES
47static inline int notify_page_fault(struct pt_regs *regs)
48{
49 int ret = 0;
50
51
52 if (!user_mode(regs)) {
53 preempt_disable();
54 if (kprobe_running() && kprobe_fault_handler(regs, 11))
55 ret = 1;
56 preempt_enable();
57 }
58
59 return ret;
60}
61#else
62static inline int notify_page_fault(struct pt_regs *regs)
63{
64 return 0;
65}
66#endif
67
68
69
70
71
72static int store_updates_sp(struct pt_regs *regs)
73{
74 unsigned int inst;
75
76 if (get_user(inst, (unsigned int __user *)regs->nip))
77 return 0;
78
79 if (((inst >> 16) & 0x1f) != 1)
80 return 0;
81
82 switch (inst >> 26) {
83 case 37:
84 case 39:
85 case 45:
86 case 53:
87 case 55:
88 return 1;
89 case 62:
90 return (inst & 3) == 1;
91 case 31:
92
93 switch ((inst >> 1) & 0x3ff) {
94 case 181:
95 case 183:
96 case 247:
97 case 439:
98 case 695:
99 case 759:
100 return 1;
101 }
102 }
103 return 0;
104}
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119int __kprobes do_page_fault(struct pt_regs *regs, unsigned long address,
120 unsigned long error_code)
121{
122 struct vm_area_struct * vma;
123 struct mm_struct *mm = current->mm;
124 siginfo_t info;
125 int code = SEGV_MAPERR;
126 int is_write = 0, ret;
127 int trap = TRAP(regs);
128 int is_exec = trap == 0x400;
129
130#if !(defined(CONFIG_4xx) || defined(CONFIG_BOOKE))
131
132
133
134
135
136
137 if (trap == 0x400)
138 error_code &= 0x48200000;
139 else
140 is_write = error_code & DSISR_ISSTORE;
141#else
142 is_write = error_code & ESR_DST;
143#endif
144
145 if (notify_page_fault(regs))
146 return 0;
147
148 if (unlikely(debugger_fault_handler(regs)))
149 return 0;
150
151
152 if (!user_mode(regs) && (address >= TASK_SIZE))
153 return SIGSEGV;
154
155#if !(defined(CONFIG_4xx) || defined(CONFIG_BOOKE) || \
156 defined(CONFIG_PPC_BOOK3S_64))
157 if (error_code & DSISR_DABRMATCH) {
158
159 do_dabr(regs, address, error_code);
160 return 0;
161 }
162#endif
163
164 if (in_atomic() || mm == NULL) {
165 if (!user_mode(regs))
166 return SIGSEGV;
167
168
169 printk(KERN_EMERG "Page fault in user mode with "
170 "in_atomic() = %d mm = %p\n", in_atomic(), mm);
171 printk(KERN_EMERG "NIP = %lx MSR = %lx\n",
172 regs->nip, regs->msr);
173 die("Weird page fault", regs, SIGSEGV);
174 }
175
176 perf_sw_event(PERF_COUNT_SW_PAGE_FAULTS, 1, 0, regs, address);
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193 if (!down_read_trylock(&mm->mmap_sem)) {
194 if (!user_mode(regs) && !search_exception_tables(regs->nip))
195 goto bad_area_nosemaphore;
196
197 down_read(&mm->mmap_sem);
198 }
199
200 vma = find_vma(mm, address);
201 if (!vma)
202 goto bad_area;
203 if (vma->vm_start <= address)
204 goto good_area;
205 if (!(vma->vm_flags & VM_GROWSDOWN))
206 goto bad_area;
207
208
209
210
211
212
213
214
215
216
217 if (address + 0x100000 < vma->vm_end) {
218
219 struct pt_regs *uregs = current->thread.regs;
220 if (uregs == NULL)
221 goto bad_area;
222
223
224
225
226
227
228
229
230
231
232
233
234
235 if (address + 2048 < uregs->gpr[1]
236 && (!user_mode(regs) || !store_updates_sp(regs)))
237 goto bad_area;
238 }
239 if (expand_stack(vma, address))
240 goto bad_area;
241
242good_area:
243 code = SEGV_ACCERR;
244#if defined(CONFIG_6xx)
245 if (error_code & 0x95700000)
246
247
248 goto bad_area;
249#endif
250#if defined(CONFIG_8xx)
251
252
253
254 if (error_code & 0x40000000)
255 _tlbil_va(address, 0, 0, 0);
256
257
258
259
260
261 if (error_code & 0x10000000)
262
263 goto bad_area;
264#endif
265
266 if (is_exec) {
267#ifdef CONFIG_PPC_STD_MMU
268
269
270
271
272
273
274
275
276 if (error_code & DSISR_PROTFAULT)
277 goto bad_area;
278#endif
279
280
281
282
283
284
285
286
287
288
289
290 if (!(vma->vm_flags & VM_EXEC) &&
291 (cpu_has_feature(CPU_FTR_NOEXECUTE) ||
292 !(vma->vm_flags & (VM_READ | VM_WRITE))))
293 goto bad_area;
294
295 } else if (is_write) {
296 if (!(vma->vm_flags & VM_WRITE))
297 goto bad_area;
298
299 } else {
300
301 if (error_code & 0x08000000)
302 goto bad_area;
303 if (!(vma->vm_flags & (VM_READ | VM_EXEC | VM_WRITE)))
304 goto bad_area;
305 }
306
307
308
309
310
311
312 ret = handle_mm_fault(mm, vma, address, is_write ? FAULT_FLAG_WRITE : 0);
313 if (unlikely(ret & VM_FAULT_ERROR)) {
314 if (ret & VM_FAULT_OOM)
315 goto out_of_memory;
316 else if (ret & VM_FAULT_SIGBUS)
317 goto do_sigbus;
318 BUG();
319 }
320 if (ret & VM_FAULT_MAJOR) {
321 current->maj_flt++;
322 perf_sw_event(PERF_COUNT_SW_PAGE_FAULTS_MAJ, 1, 0,
323 regs, address);
324#ifdef CONFIG_PPC_SMLPAR
325 if (firmware_has_feature(FW_FEATURE_CMO)) {
326 preempt_disable();
327 get_lppaca()->page_ins += (1 << PAGE_FACTOR);
328 preempt_enable();
329 }
330#endif
331 } else {
332 current->min_flt++;
333 perf_sw_event(PERF_COUNT_SW_PAGE_FAULTS_MIN, 1, 0,
334 regs, address);
335 }
336 up_read(&mm->mmap_sem);
337 return 0;
338
339bad_area:
340 up_read(&mm->mmap_sem);
341
342bad_area_nosemaphore:
343
344 if (user_mode(regs)) {
345 _exception(SIGSEGV, regs, code, address);
346 return 0;
347 }
348
349 if (is_exec && (error_code & DSISR_PROTFAULT)
350 && printk_ratelimit())
351 printk(KERN_CRIT "kernel tried to execute NX-protected"
352 " page (%lx) - exploit attempt? (uid: %d)\n",
353 address, current_uid());
354
355 return SIGSEGV;
356
357
358
359
360
361out_of_memory:
362 up_read(&mm->mmap_sem);
363 if (!user_mode(regs))
364 return SIGKILL;
365 pagefault_out_of_memory();
366 return 0;
367
368do_sigbus:
369 up_read(&mm->mmap_sem);
370 if (user_mode(regs)) {
371 info.si_signo = SIGBUS;
372 info.si_errno = 0;
373 info.si_code = BUS_ADRERR;
374 info.si_addr = (void __user *)address;
375 force_sig_info(SIGBUS, &info, current);
376 return 0;
377 }
378 return SIGBUS;
379}
380
381
382
383
384
385
386void bad_page_fault(struct pt_regs *regs, unsigned long address, int sig)
387{
388 const struct exception_table_entry *entry;
389 unsigned long *stackend;
390
391
392 if ((entry = search_exception_tables(regs->nip)) != NULL) {
393 regs->nip = entry->fixup;
394 return;
395 }
396
397
398
399 switch (regs->trap) {
400 case 0x300:
401 case 0x380:
402 printk(KERN_ALERT "Unable to handle kernel paging request for "
403 "data at address 0x%08lx\n", regs->dar);
404 break;
405 case 0x400:
406 case 0x480:
407 printk(KERN_ALERT "Unable to handle kernel paging request for "
408 "instruction fetch\n");
409 break;
410 default:
411 printk(KERN_ALERT "Unable to handle kernel paging request for "
412 "unknown fault\n");
413 break;
414 }
415 printk(KERN_ALERT "Faulting instruction address: 0x%08lx\n",
416 regs->nip);
417
418 stackend = end_of_stack(current);
419 if (current != &init_task && *stackend != STACK_END_MAGIC)
420 printk(KERN_ALERT "Thread overran stack, or stack corrupted\n");
421
422 die("Kernel access of bad area", regs, sig);
423}
424