1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20#include <linux/extable.h>
21#include <linux/signal.h>
22#include <linux/sched.h>
23#include <linux/kernel.h>
24#include <linux/errno.h>
25#include <linux/string.h>
26#include <linux/types.h>
27#include <linux/ptrace.h>
28#include <linux/mman.h>
29#include <linux/mm.h>
30#include <linux/interrupt.h>
31
32#include <asm/page.h>
33#include <asm/mmu.h>
34#include <linux/mmu_context.h>
35#include <linux/uaccess.h>
36#include <asm/exceptions.h>
37
38static unsigned long pte_misses;
39static unsigned long pte_errors;
40
41
42
43
44
45static int store_updates_sp(struct pt_regs *regs)
46{
47 unsigned int inst;
48
49 if (get_user(inst, (unsigned int __user *)regs->pc))
50 return 0;
51
52 if (((inst >> 21) & 0x1f) != 1)
53 return 0;
54
55 if ((inst & 0xd0000000) == 0xd0000000)
56 return 1;
57 return 0;
58}
59
60
61
62
63
64
65
66void bad_page_fault(struct pt_regs *regs, unsigned long address, int sig)
67{
68 const struct exception_table_entry *fixup;
69
70
71 fixup = search_exception_tables(regs->pc);
72 if (fixup) {
73 regs->pc = fixup->fixup;
74 return;
75 }
76
77
78 die("kernel access of bad area", regs, sig);
79}
80
81
82
83
84
85void do_page_fault(struct pt_regs *regs, unsigned long address,
86 unsigned long error_code)
87{
88 struct vm_area_struct *vma;
89 struct mm_struct *mm = current->mm;
90 int code = SEGV_MAPERR;
91 int is_write = error_code & ESR_S;
92 vm_fault_t fault;
93 unsigned int flags = FAULT_FLAG_DEFAULT;
94
95 regs->ear = address;
96 regs->esr = error_code;
97
98
99 if (unlikely(kernel_mode(regs) && (address >= TASK_SIZE))) {
100 pr_warn("kernel task_size exceed");
101 _exception(SIGSEGV, regs, code, address);
102 }
103
104
105 if ((error_code & 0x13) == 0x13 || (error_code & 0x11) == 0x11)
106 is_write = 0;
107
108 if (unlikely(faulthandler_disabled() || !mm)) {
109 if (kernel_mode(regs))
110 goto bad_area_nosemaphore;
111
112
113
114 pr_emerg("Page fault in user mode with faulthandler_disabled(), mm = %p\n",
115 mm);
116 pr_emerg("r15 = %lx MSR = %lx\n",
117 regs->r15, regs->msr);
118 die("Weird page fault", regs, SIGSEGV);
119 }
120
121 if (user_mode(regs))
122 flags |= FAULT_FLAG_USER;
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139 if (unlikely(!mmap_read_trylock(mm))) {
140 if (kernel_mode(regs) && !search_exception_tables(regs->pc))
141 goto bad_area_nosemaphore;
142
143retry:
144 mmap_read_lock(mm);
145 }
146
147 vma = find_vma(mm, address);
148 if (unlikely(!vma))
149 goto bad_area;
150
151 if (vma->vm_start <= address)
152 goto good_area;
153
154 if (unlikely(!(vma->vm_flags & VM_GROWSDOWN)))
155 goto bad_area;
156
157 if (unlikely(!is_write))
158 goto bad_area;
159
160
161
162
163
164
165
166
167
168
169 if (unlikely(address + 0x100000 < vma->vm_end)) {
170
171
172 struct pt_regs *uregs = current->thread.regs;
173 if (uregs == NULL)
174 goto bad_area;
175
176
177
178
179
180
181
182
183
184
185
186
187
188 if (address + 2048 < uregs->r1
189 && (kernel_mode(regs) || !store_updates_sp(regs)))
190 goto bad_area;
191 }
192 if (expand_stack(vma, address))
193 goto bad_area;
194
195good_area:
196 code = SEGV_ACCERR;
197
198
199 if (unlikely(is_write)) {
200 if (unlikely(!(vma->vm_flags & VM_WRITE)))
201 goto bad_area;
202 flags |= FAULT_FLAG_WRITE;
203
204 } else {
205
206 if (unlikely(error_code & 0x08000000))
207 goto bad_area;
208 if (unlikely(!(vma->vm_flags & (VM_READ | VM_EXEC))))
209 goto bad_area;
210 }
211
212
213
214
215
216
217 fault = handle_mm_fault(vma, address, flags);
218
219 if (fault_signal_pending(fault, regs))
220 return;
221
222 if (unlikely(fault & VM_FAULT_ERROR)) {
223 if (fault & VM_FAULT_OOM)
224 goto out_of_memory;
225 else if (fault & VM_FAULT_SIGSEGV)
226 goto bad_area;
227 else if (fault & VM_FAULT_SIGBUS)
228 goto do_sigbus;
229 BUG();
230 }
231
232 if (flags & FAULT_FLAG_ALLOW_RETRY) {
233 if (unlikely(fault & VM_FAULT_MAJOR))
234 current->maj_flt++;
235 else
236 current->min_flt++;
237 if (fault & VM_FAULT_RETRY) {
238 flags |= FAULT_FLAG_TRIED;
239
240
241
242
243
244
245
246 goto retry;
247 }
248 }
249
250 mmap_read_unlock(mm);
251
252
253
254
255
256
257 pte_misses++;
258 return;
259
260bad_area:
261 mmap_read_unlock(mm);
262
263bad_area_nosemaphore:
264 pte_errors++;
265
266
267 if (user_mode(regs)) {
268 _exception(SIGSEGV, regs, code, address);
269 return;
270 }
271
272 bad_page_fault(regs, address, SIGSEGV);
273 return;
274
275
276
277
278
279out_of_memory:
280 mmap_read_unlock(mm);
281 if (!user_mode(regs))
282 bad_page_fault(regs, address, SIGKILL);
283 else
284 pagefault_out_of_memory();
285 return;
286
287do_sigbus:
288 mmap_read_unlock(mm);
289 if (user_mode(regs)) {
290 force_sig_fault(SIGBUS, BUS_ADRERR, (void __user *)address);
291 return;
292 }
293 bad_page_fault(regs, address, SIGBUS);
294}
295