2 * linux/arch/arm/mm/fault.c
4 * Copyright (C) 1995 Linus Torvalds
5 * Modifications for ARM processor (c) 1995-2004 Russell King
7 * This program is free software; you can redistribute it and/or modify
8 * it under the terms of the GNU General Public License version 2 as
9 * published by the Free Software Foundation.
11 #include <linux/module.h>
12 #include <linux/signal.h>
14 #include <linux/hardirq.h>
15 #include <linux/init.h>
16 #include <linux/kprobes.h>
17 #include <linux/uaccess.h>
18 #include <linux/page-flags.h>
19 #include <linux/sched.h>
20 #include <linux/highmem.h>
21 #include <linux/perf_event.h>
22 #include <linux/hugetlb.h>
24 #include <asm/exception.h>
25 #include <asm/system.h>
26 #include <asm/pgtable.h>
27 #include <asm/tlbflush.h>
32 * Fault status register encodings. We steal bit 31 for our own purposes.
34 #define FSR_LNX_PF (1 << 31)
35 #define FSR_WRITE (1 << 11)
36 #define FSR_FS4 (1 << 10)
37 #define FSR_FS3_0 (15)
39 static inline int fsr_fs(unsigned int fsr)
41 return (fsr & FSR_FS3_0) | (fsr & FSR_FS4) >> 6;
47 static inline int notify_page_fault(struct pt_regs *regs, unsigned int fsr)
51 if (!user_mode(regs)) {
52 /* kprobe_running() needs smp_processor_id() */
54 if (kprobe_running() && kprobe_fault_handler(regs, fsr))
62 static inline int notify_page_fault(struct pt_regs *regs, unsigned int fsr)
69 * This is useful to dump out the page tables associated with
72 void show_pte(struct mm_struct *mm, unsigned long addr)
79 printk(KERN_ALERT "pgd = %p\n", mm->pgd);
80 pgd = pgd_offset(mm, addr);
81 printk(KERN_ALERT "[%08lx] *pgd=%08llx",
82 addr, (long long)pgd_val(*pgd));
97 pud = pud_offset(pgd, addr);
98 if (PTRS_PER_PUD != 1)
99 printk(", *pud=%08llx", (long long)pud_val(*pud));
109 pmd = pmd_offset(pud, addr);
110 if (PTRS_PER_PMD != 1)
111 printk(", *pmd=%08llx", (long long)pmd_val(*pmd));
121 /* We must not map this if we have highmem enabled */
122 if (PageHighMem(pfn_to_page(pmd_val(*pmd) >> PAGE_SHIFT)))
125 pte = pte_offset_map(pmd, addr);
126 printk(", *pte=%08llx", (long long)pte_val(*pte));
127 printk(", *ppte=%08llx",
128 (long long)pte_val(pte[PTE_HWTABLE_PTRS]));
134 #else /* CONFIG_MMU */
135 void show_pte(struct mm_struct *mm, unsigned long addr)
137 #endif /* CONFIG_MMU */
140 * Oops. The kernel tried to access some page that wasn't present.
143 __do_kernel_fault(struct mm_struct *mm, unsigned long addr, unsigned int fsr,
144 struct pt_regs *regs)
147 * Are we prepared to handle this kernel fault?
149 if (fixup_exception(regs))
153 * No handler, we'll have to terminate things with extreme prejudice.
157 "Unable to handle kernel %s at virtual address %08lx\n",
158 (addr < PAGE_SIZE) ? "NULL pointer dereference" :
159 "paging request", addr);
162 die("Oops", regs, fsr);
168 * Something tried to access memory that isn't in our memory map..
169 * User mode accesses just cause a SIGSEGV
172 __do_user_fault(struct task_struct *tsk, unsigned long addr,
173 unsigned int fsr, unsigned int sig, int code,
174 struct pt_regs *regs)
178 #ifdef CONFIG_DEBUG_USER
179 if (user_debug & UDBG_SEGV) {
180 printk(KERN_DEBUG "%s: unhandled page fault (%d) at 0x%08lx, code 0x%03x\n",
181 tsk->comm, sig, addr, fsr);
182 show_pte(tsk->mm, addr);
187 tsk->thread.address = addr;
188 tsk->thread.error_code = fsr;
189 tsk->thread.trap_no = 14;
193 si.si_addr = (void __user *)addr;
194 force_sig_info(sig, &si, tsk);
197 void do_bad_area(unsigned long addr, unsigned int fsr, struct pt_regs *regs)
199 struct task_struct *tsk = current;
200 struct mm_struct *mm = tsk->active_mm;
203 * If we are in kernel mode at this point, we
204 * have no context to handle this fault with.
207 __do_user_fault(tsk, addr, fsr, SIGSEGV, SEGV_MAPERR, regs);
209 __do_kernel_fault(mm, addr, fsr, regs);
213 #define VM_FAULT_BADMAP 0x010000
214 #define VM_FAULT_BADACCESS 0x020000
217 * Check that the permissions on the VMA allow for the fault which occurred.
218 * If we encountered a write fault, we must have write permission, otherwise
219 * we allow any permission.
221 static inline bool access_error(unsigned int fsr, struct vm_area_struct *vma)
223 unsigned int mask = VM_READ | VM_WRITE | VM_EXEC;
227 if (fsr & FSR_LNX_PF)
230 return vma->vm_flags & mask ? false : true;
234 __do_page_fault(struct mm_struct *mm, unsigned long addr, unsigned int fsr,
235 struct task_struct *tsk)
237 struct vm_area_struct *vma;
240 vma = find_vma(mm, addr);
241 fault = VM_FAULT_BADMAP;
244 if (unlikely(vma->vm_start > addr))
248 * Ok, we have a good vm_area for this
249 * memory access, so we can handle it.
252 if (access_error(fsr, vma)) {
253 fault = VM_FAULT_BADACCESS;
258 * If for any reason at all we couldn't handle the fault, make
259 * sure we exit gracefully rather than endlessly redo the fault.
261 fault = handle_mm_fault(mm, vma, addr & PAGE_MASK, (fsr & FSR_WRITE) ? FAULT_FLAG_WRITE : 0);
262 if (unlikely(fault & VM_FAULT_ERROR))
264 if (fault & VM_FAULT_MAJOR)
271 /* Don't allow expansion below FIRST_USER_ADDRESS */
272 if (vma->vm_flags & VM_GROWSDOWN &&
273 addr >= FIRST_USER_ADDRESS && !expand_stack(vma, addr))
280 do_page_fault(unsigned long addr, unsigned int fsr, struct pt_regs *regs)
282 struct task_struct *tsk;
283 struct mm_struct *mm;
284 int fault, sig, code;
286 if (notify_page_fault(regs, fsr))
292 /* Enable interrupts if they were enabled in the parent context. */
293 if (interrupts_enabled(regs))
297 * If we're in an interrupt or have no user
298 * context, we must not take the fault..
300 if (in_atomic() || !mm)
304 * As per x86, we may deadlock here. However, since the kernel only
305 * validly references user space from well defined areas of the code,
306 * we can bug out early if this is from code which shouldn't.
308 if (!down_read_trylock(&mm->mmap_sem)) {
309 if (!user_mode(regs) && !search_exception_tables(regs->ARM_pc))
311 down_read(&mm->mmap_sem);
314 * The above down_read_trylock() might have succeeded in
315 * which case, we'll have missed the might_sleep() from
319 #ifdef CONFIG_DEBUG_VM
320 if (!user_mode(regs) &&
321 !search_exception_tables(regs->ARM_pc))
326 fault = __do_page_fault(mm, addr, fsr, tsk);
327 up_read(&mm->mmap_sem);
329 perf_sw_event(PERF_COUNT_SW_PAGE_FAULTS, 1, regs, addr);
330 if (fault & VM_FAULT_MAJOR)
331 perf_sw_event(PERF_COUNT_SW_PAGE_FAULTS_MAJ, 1, regs, addr);
332 else if (fault & VM_FAULT_MINOR)
333 perf_sw_event(PERF_COUNT_SW_PAGE_FAULTS_MIN, 1, regs, addr);
336 * Handle the "normal" case first - VM_FAULT_MAJOR / VM_FAULT_MINOR
338 if (likely(!(fault & (VM_FAULT_ERROR | VM_FAULT_BADMAP | VM_FAULT_BADACCESS))))
341 if (fault & VM_FAULT_OOM) {
343 * We ran out of memory, call the OOM killer, and return to
344 * userspace (which will retry the fault, or kill us if we
347 pagefault_out_of_memory();
352 * If we are in kernel mode at this point, we
353 * have no context to handle this fault with.
355 if (!user_mode(regs))
358 if (fault & VM_FAULT_SIGBUS) {
360 * We had some memory, but were unable to
361 * successfully fix up this page fault.
367 * Something tried to access memory that
368 * isn't in our memory map..
371 code = fault == VM_FAULT_BADACCESS ?
372 SEGV_ACCERR : SEGV_MAPERR;
375 __do_user_fault(tsk, addr, fsr, sig, code, regs);
379 __do_kernel_fault(mm, addr, fsr, regs);
382 #else /* CONFIG_MMU */
384 do_page_fault(unsigned long addr, unsigned int fsr, struct pt_regs *regs)
388 #endif /* CONFIG_MMU */
391 * First Level Translation Fault Handler
393 * We enter here because the first level page table doesn't contain
394 * a valid entry for the address.
396 * If the address is in kernel space (>= TASK_SIZE), then we are
397 * probably faulting in the vmalloc() area.
399 * If the init_task's first level page tables contains the relevant
400 * entry, we copy the it to this task. If not, we send the process
401 * a signal, fixup the exception, or oops the kernel.
403 * NOTE! We MUST NOT take any locks for this case. We may be in an
404 * interrupt or a critical region, and should only copy the information
405 * from the master page table, nothing more.
409 do_translation_fault(unsigned long addr, unsigned int fsr,
410 struct pt_regs *regs)
417 if (addr < TASK_SIZE)
418 return do_page_fault(addr, fsr, regs);
423 index = pgd_index(addr);
426 * FIXME: CP15 C1 is write only on ARMv3 architectures.
428 pgd = cpu_get_pgd() + index;
429 pgd_k = init_mm.pgd + index;
431 if (pgd_none(*pgd_k))
433 if (!pgd_present(*pgd))
434 set_pgd(pgd, *pgd_k);
436 pud = pud_offset(pgd, addr);
437 pud_k = pud_offset(pgd_k, addr);
439 if (pud_none(*pud_k))
441 if (!pud_present(*pud))
442 set_pud(pud, *pud_k);
444 pmd = pmd_offset(pud, addr);
445 pmd_k = pmd_offset(pud_k, addr);
448 * On ARM one Linux PGD entry contains two hardware entries (see page
449 * tables layout in pgtable.h). We normally guarantee that we always
450 * fill both L1 entries. But create_mapping() doesn't follow the rule.
451 * It can create inidividual L1 entries, so here we have to call
452 * pmd_none() check for the entry really corresponded to address, not
453 * for the first of pair.
455 index = (addr >> SECTION_SHIFT) & 1;
456 if (pmd_none(pmd_k[index]))
459 copy_pmd(pmd, pmd_k);
463 do_bad_area(addr, fsr, regs);
466 #else /* CONFIG_MMU */
468 do_translation_fault(unsigned long addr, unsigned int fsr,
469 struct pt_regs *regs)
473 #endif /* CONFIG_MMU */
475 #ifndef CONFIG_ARM_HUGETLB_SUPPORT
477 * Some section permission faults need to be handled gracefully.
478 * They can happen due to a __{get,put}_user during an oops.
481 do_sect_fault(unsigned long addr, unsigned int fsr, struct pt_regs *regs)
483 do_bad_area(addr, fsr, regs);
489 /* Since normal 4K page based vma will never fault into section traps,
490 * This will enable us to use do_page_fault for section permission fault.
493 do_sect_fault(unsigned long addr, unsigned int fsr, struct pt_regs *regs)
495 do_page_fault(addr, fsr, regs);
501 * This abort handler always returns "fault".
504 do_bad(unsigned long addr, unsigned int fsr, struct pt_regs *regs)
509 static struct fsr_info {
510 int (*fn)(unsigned long addr, unsigned int fsr, struct pt_regs *regs);
516 * The following are the standard ARMv3 and ARMv4 aborts. ARMv5
517 * defines these to be "precise" aborts.
519 { do_bad, SIGSEGV, 0, "vector exception" },
520 { do_bad, SIGBUS, BUS_ADRALN, "alignment exception" },
521 { do_bad, SIGKILL, 0, "terminal exception" },
522 { do_bad, SIGBUS, BUS_ADRALN, "alignment exception" },
523 { do_bad, SIGBUS, 0, "external abort on linefetch" },
524 { do_translation_fault, SIGSEGV, SEGV_MAPERR, "section translation fault" },
525 { do_bad, SIGBUS, 0, "external abort on linefetch" },
526 { do_page_fault, SIGSEGV, SEGV_MAPERR, "page translation fault" },
527 { do_bad, SIGBUS, 0, "external abort on non-linefetch" },
528 { do_bad, SIGSEGV, SEGV_ACCERR, "section domain fault" },
529 { do_bad, SIGBUS, 0, "external abort on non-linefetch" },
530 { do_bad, SIGSEGV, SEGV_ACCERR, "page domain fault" },
531 { do_bad, SIGBUS, 0, "external abort on translation" },
532 { do_sect_fault, SIGSEGV, SEGV_ACCERR, "section permission fault" },
533 { do_bad, SIGBUS, 0, "external abort on translation" },
534 { do_page_fault, SIGSEGV, SEGV_ACCERR, "page permission fault" },
536 * The following are "imprecise" aborts, which are signalled by bit
537 * 10 of the FSR, and may not be recoverable. These are only
538 * supported if the CPU abort handler supports bit 10.
540 { do_bad, SIGBUS, 0, "unknown 16" },
541 { do_bad, SIGBUS, 0, "unknown 17" },
542 { do_bad, SIGBUS, 0, "unknown 18" },
543 { do_bad, SIGBUS, 0, "unknown 19" },
544 { do_bad, SIGBUS, 0, "lock abort" }, /* xscale */
545 { do_bad, SIGBUS, 0, "unknown 21" },
546 { do_bad, SIGBUS, BUS_OBJERR, "imprecise external abort" }, /* xscale */
547 { do_bad, SIGBUS, 0, "unknown 23" },
548 { do_bad, SIGBUS, 0, "dcache parity error" }, /* xscale */
549 { do_bad, SIGBUS, 0, "unknown 25" },
550 { do_bad, SIGBUS, 0, "unknown 26" },
551 { do_bad, SIGBUS, 0, "unknown 27" },
552 { do_bad, SIGBUS, 0, "unknown 28" },
553 { do_bad, SIGBUS, 0, "unknown 29" },
554 { do_bad, SIGBUS, 0, "unknown 30" },
555 { do_bad, SIGBUS, 0, "unknown 31" }
559 hook_fault_code(int nr, int (*fn)(unsigned long, unsigned int, struct pt_regs *),
560 int sig, int code, const char *name)
562 if (nr < 0 || nr >= ARRAY_SIZE(fsr_info))
565 fsr_info[nr].fn = fn;
566 fsr_info[nr].sig = sig;
567 fsr_info[nr].code = code;
568 fsr_info[nr].name = name;
572 * Dispatch a data abort to the relevant handler.
574 asmlinkage void __exception
575 do_DataAbort(unsigned long addr, unsigned int fsr, struct pt_regs *regs)
577 const struct fsr_info *inf = fsr_info + fsr_fs(fsr);
580 if (!inf->fn(addr, fsr & ~FSR_LNX_PF, regs))
583 printk(KERN_ALERT "Unhandled fault: %s (0x%03x) at 0x%08lx\n",
584 inf->name, fsr, addr);
586 info.si_signo = inf->sig;
588 info.si_code = inf->code;
589 info.si_addr = (void __user *)addr;
590 arm_notify_die("", regs, &info, fsr, 0);
594 static struct fsr_info ifsr_info[] = {
595 { do_bad, SIGBUS, 0, "unknown 0" },
596 { do_bad, SIGBUS, 0, "unknown 1" },
597 { do_bad, SIGBUS, 0, "debug event" },
598 { do_bad, SIGSEGV, SEGV_ACCERR, "section access flag fault" },
599 { do_bad, SIGBUS, 0, "unknown 4" },
600 { do_translation_fault, SIGSEGV, SEGV_MAPERR, "section translation fault" },
601 { do_bad, SIGSEGV, SEGV_ACCERR, "page access flag fault" },
602 { do_page_fault, SIGSEGV, SEGV_MAPERR, "page translation fault" },
603 { do_bad, SIGBUS, 0, "external abort on non-linefetch" },
604 { do_bad, SIGSEGV, SEGV_ACCERR, "section domain fault" },
605 { do_bad, SIGBUS, 0, "unknown 10" },
606 { do_bad, SIGSEGV, SEGV_ACCERR, "page domain fault" },
607 { do_bad, SIGBUS, 0, "external abort on translation" },
608 { do_sect_fault, SIGSEGV, SEGV_ACCERR, "section permission fault" },
609 { do_bad, SIGBUS, 0, "external abort on translation" },
610 { do_page_fault, SIGSEGV, SEGV_ACCERR, "page permission fault" },
611 { do_bad, SIGBUS, 0, "unknown 16" },
612 { do_bad, SIGBUS, 0, "unknown 17" },
613 { do_bad, SIGBUS, 0, "unknown 18" },
614 { do_bad, SIGBUS, 0, "unknown 19" },
615 { do_bad, SIGBUS, 0, "unknown 20" },
616 { do_bad, SIGBUS, 0, "unknown 21" },
617 { do_bad, SIGBUS, 0, "unknown 22" },
618 { do_bad, SIGBUS, 0, "unknown 23" },
619 { do_bad, SIGBUS, 0, "unknown 24" },
620 { do_bad, SIGBUS, 0, "unknown 25" },
621 { do_bad, SIGBUS, 0, "unknown 26" },
622 { do_bad, SIGBUS, 0, "unknown 27" },
623 { do_bad, SIGBUS, 0, "unknown 28" },
624 { do_bad, SIGBUS, 0, "unknown 29" },
625 { do_bad, SIGBUS, 0, "unknown 30" },
626 { do_bad, SIGBUS, 0, "unknown 31" },
630 hook_ifault_code(int nr, int (*fn)(unsigned long, unsigned int, struct pt_regs *),
631 int sig, int code, const char *name)
633 if (nr < 0 || nr >= ARRAY_SIZE(ifsr_info))
636 ifsr_info[nr].fn = fn;
637 ifsr_info[nr].sig = sig;
638 ifsr_info[nr].code = code;
639 ifsr_info[nr].name = name;
642 asmlinkage void __exception
643 do_PrefetchAbort(unsigned long addr, unsigned int ifsr, struct pt_regs *regs)
645 const struct fsr_info *inf = ifsr_info + fsr_fs(ifsr);
648 if (!inf->fn(addr, ifsr | FSR_LNX_PF, regs))
651 printk(KERN_ALERT "Unhandled prefetch abort: %s (0x%03x) at 0x%08lx\n",
652 inf->name, ifsr, addr);
654 info.si_signo = inf->sig;
656 info.si_code = inf->code;
657 info.si_addr = (void __user *)addr;
658 arm_notify_die("", regs, &info, ifsr, 0);
661 static int __init exceptions_init(void)
663 if (cpu_architecture() >= CPU_ARCH_ARMv6) {
664 hook_fault_code(4, do_translation_fault, SIGSEGV, SEGV_MAPERR,
665 "I-cache maintenance fault");
668 if (cpu_architecture() >= CPU_ARCH_ARMv7) {
670 * TODO: Access flag faults introduced in ARMv6K.
671 * Runtime check for 'K' extension is needed
673 hook_fault_code(3, do_bad, SIGSEGV, SEGV_MAPERR,
674 "section access flag fault");
675 hook_fault_code(6, do_bad, SIGSEGV, SEGV_MAPERR,
676 "section access flag fault");
682 arch_initcall(exceptions_init);