Commit | Line | Data |
---|---|---|
1da177e4 LT |
1 | /* $Id: fault.c,v 1.59 2002/02/09 19:49:31 davem Exp $ |
2 | * arch/sparc64/mm/fault.c: Page fault handlers for the 64-bit Sparc. | |
3 | * | |
4 | * Copyright (C) 1996 David S. Miller (davem@caip.rutgers.edu) | |
5 | * Copyright (C) 1997, 1999 Jakub Jelinek (jj@ultra.linux.cz) | |
6 | */ | |
7 | ||
8 | #include <asm/head.h> | |
9 | ||
10 | #include <linux/string.h> | |
11 | #include <linux/types.h> | |
12 | #include <linux/sched.h> | |
13 | #include <linux/ptrace.h> | |
14 | #include <linux/mman.h> | |
15 | #include <linux/signal.h> | |
16 | #include <linux/mm.h> | |
17 | #include <linux/module.h> | |
18 | #include <linux/smp_lock.h> | |
19 | #include <linux/init.h> | |
20 | #include <linux/interrupt.h> | |
05e14cb3 | 21 | #include <linux/kprobes.h> |
1da177e4 LT |
22 | |
23 | #include <asm/page.h> | |
24 | #include <asm/pgtable.h> | |
25 | #include <asm/openprom.h> | |
26 | #include <asm/oplib.h> | |
27 | #include <asm/uaccess.h> | |
28 | #include <asm/asi.h> | |
29 | #include <asm/lsu.h> | |
30 | #include <asm/sections.h> | |
31 | #include <asm/kdebug.h> | |
32 | ||
33 | #define ELEMENTS(arr) (sizeof (arr)/sizeof (arr[0])) | |
34 | ||
35 | extern struct sparc_phys_banks sp_banks[SPARC_PHYS_BANKS]; | |
36 | ||
1da177e4 LT |
37 | /* |
38 | * To debug kernel to catch accesses to certain virtual/physical addresses. | |
39 | * Mode = 0 selects physical watchpoints, mode = 1 selects virtual watchpoints. | |
40 | * flags = VM_READ watches memread accesses, flags = VM_WRITE watches memwrite accesses. | |
41 | * Caller passes in a 64bit aligned addr, with mask set to the bytes that need to be | |
42 | * watched. This is only useful on a single cpu machine for now. After the watchpoint | |
43 | * is detected, the process causing it will be killed, thus preventing an infinite loop. | |
44 | */ | |
45 | void set_brkpt(unsigned long addr, unsigned char mask, int flags, int mode) | |
46 | { | |
47 | unsigned long lsubits; | |
48 | ||
49 | __asm__ __volatile__("ldxa [%%g0] %1, %0" | |
50 | : "=r" (lsubits) | |
51 | : "i" (ASI_LSU_CONTROL)); | |
52 | lsubits &= ~(LSU_CONTROL_PM | LSU_CONTROL_VM | | |
53 | LSU_CONTROL_PR | LSU_CONTROL_VR | | |
54 | LSU_CONTROL_PW | LSU_CONTROL_VW); | |
55 | ||
56 | __asm__ __volatile__("stxa %0, [%1] %2\n\t" | |
57 | "membar #Sync" | |
58 | : /* no outputs */ | |
59 | : "r" (addr), "r" (mode ? VIRT_WATCHPOINT : PHYS_WATCHPOINT), | |
60 | "i" (ASI_DMMU)); | |
61 | ||
62 | lsubits |= ((unsigned long)mask << (mode ? 25 : 33)); | |
63 | if (flags & VM_READ) | |
64 | lsubits |= (mode ? LSU_CONTROL_VR : LSU_CONTROL_PR); | |
65 | if (flags & VM_WRITE) | |
66 | lsubits |= (mode ? LSU_CONTROL_VW : LSU_CONTROL_PW); | |
67 | __asm__ __volatile__("stxa %0, [%%g0] %1\n\t" | |
68 | "membar #Sync" | |
69 | : /* no outputs */ | |
70 | : "r" (lsubits), "i" (ASI_LSU_CONTROL) | |
71 | : "memory"); | |
72 | } | |
73 | ||
74 | /* Nice, simple, prom library does all the sweating for us. ;) */ | |
75 | unsigned long __init prom_probe_memory (void) | |
76 | { | |
77 | register struct linux_mlist_p1275 *mlist; | |
78 | register unsigned long bytes, base_paddr, tally; | |
79 | register int i; | |
80 | ||
81 | i = 0; | |
82 | mlist = *prom_meminfo()->p1275_available; | |
83 | bytes = tally = mlist->num_bytes; | |
84 | base_paddr = mlist->start_adr; | |
85 | ||
86 | sp_banks[0].base_addr = base_paddr; | |
87 | sp_banks[0].num_bytes = bytes; | |
88 | ||
89 | while (mlist->theres_more != (void *) 0) { | |
90 | i++; | |
91 | mlist = mlist->theres_more; | |
92 | bytes = mlist->num_bytes; | |
93 | tally += bytes; | |
94 | if (i >= SPARC_PHYS_BANKS-1) { | |
95 | printk ("The machine has more banks than " | |
96 | "this kernel can support\n" | |
97 | "Increase the SPARC_PHYS_BANKS " | |
98 | "setting (currently %d)\n", | |
99 | SPARC_PHYS_BANKS); | |
100 | i = SPARC_PHYS_BANKS-1; | |
101 | break; | |
102 | } | |
103 | ||
104 | sp_banks[i].base_addr = mlist->start_adr; | |
105 | sp_banks[i].num_bytes = mlist->num_bytes; | |
106 | } | |
107 | ||
108 | i++; | |
109 | sp_banks[i].base_addr = 0xdeadbeefbeefdeadUL; | |
110 | sp_banks[i].num_bytes = 0; | |
111 | ||
112 | /* Now mask all bank sizes on a page boundary, it is all we can | |
113 | * use anyways. | |
114 | */ | |
115 | for (i = 0; sp_banks[i].num_bytes != 0; i++) | |
116 | sp_banks[i].num_bytes &= PAGE_MASK; | |
117 | ||
118 | return tally; | |
119 | } | |
120 | ||
05e14cb3 PP |
121 | static void __kprobes unhandled_fault(unsigned long address, |
122 | struct task_struct *tsk, | |
123 | struct pt_regs *regs) | |
1da177e4 LT |
124 | { |
125 | if ((unsigned long) address < PAGE_SIZE) { | |
126 | printk(KERN_ALERT "Unable to handle kernel NULL " | |
127 | "pointer dereference\n"); | |
128 | } else { | |
129 | printk(KERN_ALERT "Unable to handle kernel paging request " | |
130 | "at virtual address %016lx\n", (unsigned long)address); | |
131 | } | |
132 | printk(KERN_ALERT "tsk->{mm,active_mm}->context = %016lx\n", | |
133 | (tsk->mm ? | |
134 | CTX_HWBITS(tsk->mm->context) : | |
135 | CTX_HWBITS(tsk->active_mm->context))); | |
136 | printk(KERN_ALERT "tsk->{mm,active_mm}->pgd = %016lx\n", | |
137 | (tsk->mm ? (unsigned long) tsk->mm->pgd : | |
138 | (unsigned long) tsk->active_mm->pgd)); | |
139 | if (notify_die(DIE_GPF, "general protection fault", regs, | |
140 | 0, 0, SIGSEGV) == NOTIFY_STOP) | |
141 | return; | |
142 | die_if_kernel("Oops", regs); | |
143 | } | |
144 | ||
145 | static void bad_kernel_pc(struct pt_regs *regs) | |
146 | { | |
147 | unsigned long *ksp; | |
148 | ||
149 | printk(KERN_CRIT "OOPS: Bogus kernel PC [%016lx] in fault handler\n", | |
150 | regs->tpc); | |
151 | __asm__("mov %%sp, %0" : "=r" (ksp)); | |
152 | show_stack(current, ksp); | |
153 | unhandled_fault(regs->tpc, current, regs); | |
154 | } | |
155 | ||
156 | /* | |
157 | * We now make sure that mmap_sem is held in all paths that call | |
158 | * this. Additionally, to prevent kswapd from ripping ptes from | |
159 | * under us, raise interrupts around the time that we look at the | |
160 | * pte, kswapd will have to wait to get his smp ipi response from | |
161 | * us. This saves us having to get page_table_lock. | |
162 | */ | |
163 | static unsigned int get_user_insn(unsigned long tpc) | |
164 | { | |
165 | pgd_t *pgdp = pgd_offset(current->mm, tpc); | |
166 | pud_t *pudp; | |
167 | pmd_t *pmdp; | |
168 | pte_t *ptep, pte; | |
169 | unsigned long pa; | |
170 | u32 insn = 0; | |
171 | unsigned long pstate; | |
172 | ||
173 | if (pgd_none(*pgdp)) | |
174 | goto outret; | |
175 | pudp = pud_offset(pgdp, tpc); | |
176 | if (pud_none(*pudp)) | |
177 | goto outret; | |
178 | pmdp = pmd_offset(pudp, tpc); | |
179 | if (pmd_none(*pmdp)) | |
180 | goto outret; | |
181 | ||
182 | /* This disables preemption for us as well. */ | |
183 | __asm__ __volatile__("rdpr %%pstate, %0" : "=r" (pstate)); | |
184 | __asm__ __volatile__("wrpr %0, %1, %%pstate" | |
185 | : : "r" (pstate), "i" (PSTATE_IE)); | |
186 | ptep = pte_offset_map(pmdp, tpc); | |
187 | pte = *ptep; | |
188 | if (!pte_present(pte)) | |
189 | goto out; | |
190 | ||
191 | pa = (pte_val(pte) & _PAGE_PADDR); | |
192 | pa += (tpc & ~PAGE_MASK); | |
193 | ||
194 | /* Use phys bypass so we don't pollute dtlb/dcache. */ | |
195 | __asm__ __volatile__("lduwa [%1] %2, %0" | |
196 | : "=r" (insn) | |
197 | : "r" (pa), "i" (ASI_PHYS_USE_EC)); | |
198 | ||
199 | out: | |
200 | pte_unmap(ptep); | |
201 | __asm__ __volatile__("wrpr %0, 0x0, %%pstate" : : "r" (pstate)); | |
202 | outret: | |
203 | return insn; | |
204 | } | |
205 | ||
206 | extern unsigned long compute_effective_address(struct pt_regs *, unsigned int, unsigned int); | |
207 | ||
208 | static void do_fault_siginfo(int code, int sig, struct pt_regs *regs, | |
209 | unsigned int insn, int fault_code) | |
210 | { | |
211 | siginfo_t info; | |
212 | ||
213 | info.si_code = code; | |
214 | info.si_signo = sig; | |
215 | info.si_errno = 0; | |
216 | if (fault_code & FAULT_CODE_ITLB) | |
217 | info.si_addr = (void __user *) regs->tpc; | |
218 | else | |
219 | info.si_addr = (void __user *) | |
220 | compute_effective_address(regs, insn, 0); | |
221 | info.si_trapno = 0; | |
222 | force_sig_info(sig, &info, current); | |
223 | } | |
224 | ||
225 | extern int handle_ldf_stq(u32, struct pt_regs *); | |
226 | extern int handle_ld_nf(u32, struct pt_regs *); | |
227 | ||
228 | static unsigned int get_fault_insn(struct pt_regs *regs, unsigned int insn) | |
229 | { | |
230 | if (!insn) { | |
231 | if (!regs->tpc || (regs->tpc & 0x3)) | |
232 | return 0; | |
233 | if (regs->tstate & TSTATE_PRIV) { | |
234 | insn = *(unsigned int *) regs->tpc; | |
235 | } else { | |
236 | insn = get_user_insn(regs->tpc); | |
237 | } | |
238 | } | |
239 | return insn; | |
240 | } | |
241 | ||
242 | static void do_kernel_fault(struct pt_regs *regs, int si_code, int fault_code, | |
243 | unsigned int insn, unsigned long address) | |
244 | { | |
245 | unsigned long g2; | |
246 | unsigned char asi = ASI_P; | |
247 | ||
248 | if ((!insn) && (regs->tstate & TSTATE_PRIV)) | |
249 | goto cannot_handle; | |
250 | ||
251 | /* If user insn could be read (thus insn is zero), that | |
252 | * is fine. We will just gun down the process with a signal | |
253 | * in that case. | |
254 | */ | |
255 | ||
256 | if (!(fault_code & (FAULT_CODE_WRITE|FAULT_CODE_ITLB)) && | |
257 | (insn & 0xc0800000) == 0xc0800000) { | |
258 | if (insn & 0x2000) | |
259 | asi = (regs->tstate >> 24); | |
260 | else | |
261 | asi = (insn >> 5); | |
262 | if ((asi & 0xf2) == 0x82) { | |
263 | if (insn & 0x1000000) { | |
264 | handle_ldf_stq(insn, regs); | |
265 | } else { | |
266 | /* This was a non-faulting load. Just clear the | |
267 | * destination register(s) and continue with the next | |
268 | * instruction. -jj | |
269 | */ | |
270 | handle_ld_nf(insn, regs); | |
271 | } | |
272 | return; | |
273 | } | |
274 | } | |
275 | ||
276 | g2 = regs->u_regs[UREG_G2]; | |
277 | ||
278 | /* Is this in ex_table? */ | |
279 | if (regs->tstate & TSTATE_PRIV) { | |
280 | unsigned long fixup; | |
281 | ||
282 | if (asi == ASI_P && (insn & 0xc0800000) == 0xc0800000) { | |
283 | if (insn & 0x2000) | |
284 | asi = (regs->tstate >> 24); | |
285 | else | |
286 | asi = (insn >> 5); | |
287 | } | |
288 | ||
289 | /* Look in asi.h: All _S asis have LS bit set */ | |
290 | if ((asi & 0x1) && | |
291 | (fixup = search_extables_range(regs->tpc, &g2))) { | |
292 | regs->tpc = fixup; | |
293 | regs->tnpc = regs->tpc + 4; | |
294 | regs->u_regs[UREG_G2] = g2; | |
295 | return; | |
296 | } | |
297 | } else { | |
298 | /* The si_code was set to make clear whether | |
299 | * this was a SEGV_MAPERR or SEGV_ACCERR fault. | |
300 | */ | |
301 | do_fault_siginfo(si_code, SIGSEGV, regs, insn, fault_code); | |
302 | return; | |
303 | } | |
304 | ||
305 | cannot_handle: | |
306 | unhandled_fault (address, current, regs); | |
307 | } | |
308 | ||
05e14cb3 | 309 | asmlinkage void __kprobes do_sparc64_fault(struct pt_regs *regs) |
1da177e4 LT |
310 | { |
311 | struct mm_struct *mm = current->mm; | |
312 | struct vm_area_struct *vma; | |
313 | unsigned int insn = 0; | |
314 | int si_code, fault_code; | |
315 | unsigned long address; | |
316 | ||
317 | fault_code = get_thread_fault_code(); | |
318 | ||
319 | if (notify_die(DIE_PAGE_FAULT, "page_fault", regs, | |
320 | fault_code, 0, SIGSEGV) == NOTIFY_STOP) | |
321 | return; | |
322 | ||
323 | si_code = SEGV_MAPERR; | |
324 | address = current_thread_info()->fault_address; | |
325 | ||
326 | if ((fault_code & FAULT_CODE_ITLB) && | |
327 | (fault_code & FAULT_CODE_DTLB)) | |
328 | BUG(); | |
329 | ||
330 | if (regs->tstate & TSTATE_PRIV) { | |
331 | unsigned long tpc = regs->tpc; | |
332 | ||
333 | /* Sanity check the PC. */ | |
334 | if ((tpc >= KERNBASE && tpc < (unsigned long) _etext) || | |
335 | (tpc >= MODULES_VADDR && tpc < MODULES_END)) { | |
336 | /* Valid, no problems... */ | |
337 | } else { | |
338 | bad_kernel_pc(regs); | |
339 | return; | |
340 | } | |
341 | } | |
342 | ||
343 | /* | |
344 | * If we're in an interrupt or have no user | |
345 | * context, we must not take the fault.. | |
346 | */ | |
347 | if (in_atomic() || !mm) | |
348 | goto intr_or_no_mm; | |
349 | ||
350 | if (test_thread_flag(TIF_32BIT)) { | |
351 | if (!(regs->tstate & TSTATE_PRIV)) | |
352 | regs->tpc &= 0xffffffff; | |
353 | address &= 0xffffffff; | |
354 | } | |
355 | ||
356 | if (!down_read_trylock(&mm->mmap_sem)) { | |
357 | if ((regs->tstate & TSTATE_PRIV) && | |
358 | !search_exception_tables(regs->tpc)) { | |
359 | insn = get_fault_insn(regs, insn); | |
360 | goto handle_kernel_fault; | |
361 | } | |
362 | down_read(&mm->mmap_sem); | |
363 | } | |
364 | ||
365 | vma = find_vma(mm, address); | |
366 | if (!vma) | |
367 | goto bad_area; | |
368 | ||
369 | /* Pure DTLB misses do not tell us whether the fault causing | |
370 | * load/store/atomic was a write or not, it only says that there | |
371 | * was no match. So in such a case we (carefully) read the | |
372 | * instruction to try and figure this out. It's an optimization | |
373 | * so it's ok if we can't do this. | |
374 | * | |
375 | * Special hack, window spill/fill knows the exact fault type. | |
376 | */ | |
377 | if (((fault_code & | |
378 | (FAULT_CODE_DTLB | FAULT_CODE_WRITE | FAULT_CODE_WINFIXUP)) == FAULT_CODE_DTLB) && | |
379 | (vma->vm_flags & VM_WRITE) != 0) { | |
380 | insn = get_fault_insn(regs, 0); | |
381 | if (!insn) | |
382 | goto continue_fault; | |
383 | if ((insn & 0xc0200000) == 0xc0200000 && | |
384 | (insn & 0x1780000) != 0x1680000) { | |
385 | /* Don't bother updating thread struct value, | |
386 | * because update_mmu_cache only cares which tlb | |
387 | * the access came from. | |
388 | */ | |
389 | fault_code |= FAULT_CODE_WRITE; | |
390 | } | |
391 | } | |
392 | continue_fault: | |
393 | ||
394 | if (vma->vm_start <= address) | |
395 | goto good_area; | |
396 | if (!(vma->vm_flags & VM_GROWSDOWN)) | |
397 | goto bad_area; | |
398 | if (!(fault_code & FAULT_CODE_WRITE)) { | |
399 | /* Non-faulting loads shouldn't expand stack. */ | |
400 | insn = get_fault_insn(regs, insn); | |
401 | if ((insn & 0xc0800000) == 0xc0800000) { | |
402 | unsigned char asi; | |
403 | ||
404 | if (insn & 0x2000) | |
405 | asi = (regs->tstate >> 24); | |
406 | else | |
407 | asi = (insn >> 5); | |
408 | if ((asi & 0xf2) == 0x82) | |
409 | goto bad_area; | |
410 | } | |
411 | } | |
412 | if (expand_stack(vma, address)) | |
413 | goto bad_area; | |
414 | /* | |
415 | * Ok, we have a good vm_area for this memory access, so | |
416 | * we can handle it.. | |
417 | */ | |
418 | good_area: | |
419 | si_code = SEGV_ACCERR; | |
420 | ||
421 | /* If we took a ITLB miss on a non-executable page, catch | |
422 | * that here. | |
423 | */ | |
424 | if ((fault_code & FAULT_CODE_ITLB) && !(vma->vm_flags & VM_EXEC)) { | |
425 | BUG_ON(address != regs->tpc); | |
426 | BUG_ON(regs->tstate & TSTATE_PRIV); | |
427 | goto bad_area; | |
428 | } | |
429 | ||
430 | if (fault_code & FAULT_CODE_WRITE) { | |
431 | if (!(vma->vm_flags & VM_WRITE)) | |
432 | goto bad_area; | |
433 | ||
434 | /* Spitfire has an icache which does not snoop | |
435 | * processor stores. Later processors do... | |
436 | */ | |
437 | if (tlb_type == spitfire && | |
438 | (vma->vm_flags & VM_EXEC) != 0 && | |
439 | vma->vm_file != NULL) | |
440 | set_thread_fault_code(fault_code | | |
441 | FAULT_CODE_BLKCOMMIT); | |
442 | } else { | |
443 | /* Allow reads even for write-only mappings */ | |
444 | if (!(vma->vm_flags & (VM_READ | VM_EXEC))) | |
445 | goto bad_area; | |
446 | } | |
447 | ||
448 | switch (handle_mm_fault(mm, vma, address, (fault_code & FAULT_CODE_WRITE))) { | |
449 | case VM_FAULT_MINOR: | |
450 | current->min_flt++; | |
451 | break; | |
452 | case VM_FAULT_MAJOR: | |
453 | current->maj_flt++; | |
454 | break; | |
455 | case VM_FAULT_SIGBUS: | |
456 | goto do_sigbus; | |
457 | case VM_FAULT_OOM: | |
458 | goto out_of_memory; | |
459 | default: | |
460 | BUG(); | |
461 | } | |
462 | ||
463 | up_read(&mm->mmap_sem); | |
464 | goto fault_done; | |
465 | ||
466 | /* | |
467 | * Something tried to access memory that isn't in our memory map.. | |
468 | * Fix it, but check if it's kernel or user first.. | |
469 | */ | |
470 | bad_area: | |
471 | insn = get_fault_insn(regs, insn); | |
472 | up_read(&mm->mmap_sem); | |
473 | ||
474 | handle_kernel_fault: | |
475 | do_kernel_fault(regs, si_code, fault_code, insn, address); | |
476 | ||
477 | goto fault_done; | |
478 | ||
479 | /* | |
480 | * We ran out of memory, or some other thing happened to us that made | |
481 | * us unable to handle the page fault gracefully. | |
482 | */ | |
483 | out_of_memory: | |
484 | insn = get_fault_insn(regs, insn); | |
485 | up_read(&mm->mmap_sem); | |
486 | printk("VM: killing process %s\n", current->comm); | |
487 | if (!(regs->tstate & TSTATE_PRIV)) | |
488 | do_exit(SIGKILL); | |
489 | goto handle_kernel_fault; | |
490 | ||
491 | intr_or_no_mm: | |
492 | insn = get_fault_insn(regs, 0); | |
493 | goto handle_kernel_fault; | |
494 | ||
495 | do_sigbus: | |
496 | insn = get_fault_insn(regs, insn); | |
497 | up_read(&mm->mmap_sem); | |
498 | ||
499 | /* | |
500 | * Send a sigbus, regardless of whether we were in kernel | |
501 | * or user mode. | |
502 | */ | |
503 | do_fault_siginfo(BUS_ADRERR, SIGBUS, regs, insn, fault_code); | |
504 | ||
505 | /* Kernel mode? Handle exceptions or die */ | |
506 | if (regs->tstate & TSTATE_PRIV) | |
507 | goto handle_kernel_fault; | |
508 | ||
509 | fault_done: | |
510 | /* These values are no longer needed, clear them. */ | |
511 | set_thread_fault_code(0); | |
512 | current_thread_info()->fault_address = 0; | |
513 | } |