1 /* 2 * arch/s390/mm/fault.c 3 * 4 * S390 version 5 * Copyright (C) 1999 IBM Deutschland Entwicklung GmbH, IBM Corporation 6 * Author(s): Hartmut Penner (hp@de.ibm.com) 7 * Ulrich Weigand (uweigand@de.ibm.com) 8 * 9 * Derived from "arch/i386/mm/fault.c" 10 * Copyright (C) 1995 Linus Torvalds 11 */ 12 13 #include <linux/signal.h> 14 #include <linux/sched.h> 15 #include <linux/kernel.h> 16 #include <linux/errno.h> 17 #include <linux/string.h> 18 #include <linux/types.h> 19 #include <linux/ptrace.h> 20 #include <linux/mman.h> 21 #include <linux/mm.h> 22 #include <linux/smp.h> 23 #include <linux/kdebug.h> 24 #include <linux/smp_lock.h> 25 #include <linux/init.h> 26 #include <linux/console.h> 27 #include <linux/module.h> 28 #include <linux/hardirq.h> 29 #include <linux/kprobes.h> 30 #include <linux/uaccess.h> 31 #include <linux/hugetlb.h> 32 #include <asm/system.h> 33 #include <asm/pgtable.h> 34 #include <asm/s390_ext.h> 35 #include <asm/mmu_context.h> 36 #include "../kernel/entry.h" 37 38 #ifndef CONFIG_64BIT 39 #define __FAIL_ADDR_MASK 0x7ffff000 40 #define __FIXUP_MASK 0x7fffffff 41 #define __SUBCODE_MASK 0x0200 42 #define __PF_RES_FIELD 0ULL 43 #else /* CONFIG_64BIT */ 44 #define __FAIL_ADDR_MASK -4096L 45 #define __FIXUP_MASK ~0L 46 #define __SUBCODE_MASK 0x0600 47 #define __PF_RES_FIELD 0x8000000000000000ULL 48 #endif /* CONFIG_64BIT */ 49 50 #ifdef CONFIG_SYSCTL 51 extern int sysctl_userprocess_debug; 52 #endif 53 54 #ifdef CONFIG_KPROBES 55 static inline int notify_page_fault(struct pt_regs *regs, long err) 56 { 57 int ret = 0; 58 59 /* kprobe_running() needs smp_processor_id() */ 60 if (!user_mode(regs)) { 61 preempt_disable(); 62 if (kprobe_running() && kprobe_fault_handler(regs, 14)) 63 ret = 1; 64 preempt_enable(); 65 } 66 67 return ret; 68 } 69 #else 70 static inline int notify_page_fault(struct pt_regs *regs, long err) 71 { 72 return 0; 73 } 74 #endif 75 76 77 /* 78 * Unlock any spinlocks which will prevent us from getting the 79 * message out. 80 */ 81 void bust_spinlocks(int yes) 82 { 83 if (yes) { 84 oops_in_progress = 1; 85 } else { 86 int loglevel_save = console_loglevel; 87 console_unblank(); 88 oops_in_progress = 0; 89 /* 90 * OK, the message is on the console. Now we call printk() 91 * without oops_in_progress set so that printk will give klogd 92 * a poke. Hold onto your hats... 93 */ 94 console_loglevel = 15; 95 printk(" "); 96 console_loglevel = loglevel_save; 97 } 98 } 99 100 /* 101 * Returns the address space associated with the fault. 102 * Returns 0 for kernel space, 1 for user space and 103 * 2 for code execution in user space with noexec=on. 104 */ 105 static inline int check_space(struct task_struct *tsk) 106 { 107 /* 108 * The lowest two bits of S390_lowcore.trans_exc_code 109 * indicate which paging table was used. 110 */ 111 int desc = S390_lowcore.trans_exc_code & 3; 112 113 if (desc == 3) /* Home Segment Table Descriptor */ 114 return switch_amode == 0; 115 if (desc == 2) /* Secondary Segment Table Descriptor */ 116 return tsk->thread.mm_segment.ar4; 117 #ifdef CONFIG_S390_SWITCH_AMODE 118 if (unlikely(desc == 1)) { /* STD determined via access register */ 119 /* %a0 always indicates primary space. */ 120 if (S390_lowcore.exc_access_id != 0) { 121 save_access_regs(tsk->thread.acrs); 122 /* 123 * An alet of 0 indicates primary space. 124 * An alet of 1 indicates secondary space. 125 * Any other alet values generate an 126 * alen-translation exception. 127 */ 128 if (tsk->thread.acrs[S390_lowcore.exc_access_id]) 129 return tsk->thread.mm_segment.ar4; 130 } 131 } 132 #endif 133 /* Primary Segment Table Descriptor */ 134 return switch_amode << s390_noexec; 135 } 136 137 /* 138 * Send SIGSEGV to task. This is an external routine 139 * to keep the stack usage of do_page_fault small. 140 */ 141 static void do_sigsegv(struct pt_regs *regs, unsigned long error_code, 142 int si_code, unsigned long address) 143 { 144 struct siginfo si; 145 146 #if defined(CONFIG_SYSCTL) || defined(CONFIG_PROCESS_DEBUG) 147 #if defined(CONFIG_SYSCTL) 148 if (sysctl_userprocess_debug) 149 #endif 150 { 151 printk("User process fault: interruption code 0x%lX\n", 152 error_code); 153 printk("failing address: %lX\n", address); 154 show_regs(regs); 155 } 156 #endif 157 si.si_signo = SIGSEGV; 158 si.si_code = si_code; 159 si.si_addr = (void __user *) address; 160 force_sig_info(SIGSEGV, &si, current); 161 } 162 163 static void do_no_context(struct pt_regs *regs, unsigned long error_code, 164 unsigned long address) 165 { 166 const struct exception_table_entry *fixup; 167 168 /* Are we prepared to handle this kernel fault? */ 169 fixup = search_exception_tables(regs->psw.addr & __FIXUP_MASK); 170 if (fixup) { 171 regs->psw.addr = fixup->fixup | PSW_ADDR_AMODE; 172 return; 173 } 174 175 /* 176 * Oops. The kernel tried to access some bad page. We'll have to 177 * terminate things with extreme prejudice. 178 */ 179 if (check_space(current) == 0) 180 printk(KERN_ALERT "Unable to handle kernel pointer dereference" 181 " at virtual kernel address %p\n", (void *)address); 182 else 183 printk(KERN_ALERT "Unable to handle kernel paging request" 184 " at virtual user address %p\n", (void *)address); 185 186 die("Oops", regs, error_code); 187 do_exit(SIGKILL); 188 } 189 190 static void do_low_address(struct pt_regs *regs, unsigned long error_code) 191 { 192 /* Low-address protection hit in kernel mode means 193 NULL pointer write access in kernel mode. */ 194 if (regs->psw.mask & PSW_MASK_PSTATE) { 195 /* Low-address protection hit in user mode 'cannot happen'. */ 196 die ("Low-address protection", regs, error_code); 197 do_exit(SIGKILL); 198 } 199 200 do_no_context(regs, error_code, 0); 201 } 202 203 static void do_sigbus(struct pt_regs *regs, unsigned long error_code, 204 unsigned long address) 205 { 206 struct task_struct *tsk = current; 207 struct mm_struct *mm = tsk->mm; 208 209 up_read(&mm->mmap_sem); 210 /* 211 * Send a sigbus, regardless of whether we were in kernel 212 * or user mode. 213 */ 214 tsk->thread.prot_addr = address; 215 tsk->thread.trap_no = error_code; 216 force_sig(SIGBUS, tsk); 217 218 /* Kernel mode? Handle exceptions or die */ 219 if (!(regs->psw.mask & PSW_MASK_PSTATE)) 220 do_no_context(regs, error_code, address); 221 } 222 223 #ifdef CONFIG_S390_EXEC_PROTECT 224 static int signal_return(struct mm_struct *mm, struct pt_regs *regs, 225 unsigned long address, unsigned long error_code) 226 { 227 u16 instruction; 228 int rc; 229 #ifdef CONFIG_COMPAT 230 int compat; 231 #endif 232 233 pagefault_disable(); 234 rc = __get_user(instruction, (u16 __user *) regs->psw.addr); 235 pagefault_enable(); 236 if (rc) 237 return -EFAULT; 238 239 up_read(&mm->mmap_sem); 240 clear_tsk_thread_flag(current, TIF_SINGLE_STEP); 241 #ifdef CONFIG_COMPAT 242 compat = test_tsk_thread_flag(current, TIF_31BIT); 243 if (compat && instruction == 0x0a77) 244 sys32_sigreturn(); 245 else if (compat && instruction == 0x0aad) 246 sys32_rt_sigreturn(); 247 else 248 #endif 249 if (instruction == 0x0a77) 250 sys_sigreturn(); 251 else if (instruction == 0x0aad) 252 sys_rt_sigreturn(); 253 else { 254 current->thread.prot_addr = address; 255 current->thread.trap_no = error_code; 256 do_sigsegv(regs, error_code, SEGV_MAPERR, address); 257 } 258 return 0; 259 } 260 #endif /* CONFIG_S390_EXEC_PROTECT */ 261 262 /* 263 * This routine handles page faults. It determines the address, 264 * and the problem, and then passes it off to one of the appropriate 265 * routines. 266 * 267 * error_code: 268 * 04 Protection -> Write-Protection (suprression) 269 * 10 Segment translation -> Not present (nullification) 270 * 11 Page translation -> Not present (nullification) 271 * 3b Region third trans. -> Not present (nullification) 272 */ 273 static inline void 274 do_exception(struct pt_regs *regs, unsigned long error_code, int write) 275 { 276 struct task_struct *tsk; 277 struct mm_struct *mm; 278 struct vm_area_struct *vma; 279 unsigned long address; 280 int space; 281 int si_code; 282 int fault; 283 284 if (notify_page_fault(regs, error_code)) 285 return; 286 287 tsk = current; 288 mm = tsk->mm; 289 290 /* get the failing address and the affected space */ 291 address = S390_lowcore.trans_exc_code & __FAIL_ADDR_MASK; 292 space = check_space(tsk); 293 294 /* 295 * Verify that the fault happened in user space, that 296 * we are not in an interrupt and that there is a 297 * user context. 298 */ 299 if (unlikely(space == 0 || in_atomic() || !mm)) 300 goto no_context; 301 302 /* 303 * When we get here, the fault happened in the current 304 * task's user address space, so we can switch on the 305 * interrupts again and then search the VMAs 306 */ 307 local_irq_enable(); 308 309 down_read(&mm->mmap_sem); 310 311 si_code = SEGV_MAPERR; 312 vma = find_vma(mm, address); 313 if (!vma) 314 goto bad_area; 315 316 #ifdef CONFIG_S390_EXEC_PROTECT 317 if (unlikely((space == 2) && !(vma->vm_flags & VM_EXEC))) 318 if (!signal_return(mm, regs, address, error_code)) 319 /* 320 * signal_return() has done an up_read(&mm->mmap_sem) 321 * if it returns 0. 322 */ 323 return; 324 #endif 325 326 if (vma->vm_start <= address) 327 goto good_area; 328 if (!(vma->vm_flags & VM_GROWSDOWN)) 329 goto bad_area; 330 if (expand_stack(vma, address)) 331 goto bad_area; 332 /* 333 * Ok, we have a good vm_area for this memory access, so 334 * we can handle it.. 335 */ 336 good_area: 337 si_code = SEGV_ACCERR; 338 if (!write) { 339 /* page not present, check vm flags */ 340 if (!(vma->vm_flags & (VM_READ | VM_EXEC | VM_WRITE))) 341 goto bad_area; 342 } else { 343 if (!(vma->vm_flags & VM_WRITE)) 344 goto bad_area; 345 } 346 347 if (is_vm_hugetlb_page(vma)) 348 address &= HPAGE_MASK; 349 /* 350 * If for any reason at all we couldn't handle the fault, 351 * make sure we exit gracefully rather than endlessly redo 352 * the fault. 353 */ 354 fault = handle_mm_fault(mm, vma, address, write); 355 if (unlikely(fault & VM_FAULT_ERROR)) { 356 if (fault & VM_FAULT_OOM) { 357 up_read(&mm->mmap_sem); 358 pagefault_out_of_memory(); 359 return; 360 } else if (fault & VM_FAULT_SIGBUS) { 361 do_sigbus(regs, error_code, address); 362 return; 363 } 364 BUG(); 365 } 366 if (fault & VM_FAULT_MAJOR) 367 tsk->maj_flt++; 368 else 369 tsk->min_flt++; 370 371 up_read(&mm->mmap_sem); 372 /* 373 * The instruction that caused the program check will 374 * be repeated. Don't signal single step via SIGTRAP. 375 */ 376 clear_tsk_thread_flag(tsk, TIF_SINGLE_STEP); 377 return; 378 379 /* 380 * Something tried to access memory that isn't in our memory map.. 381 * Fix it, but check if it's kernel or user first.. 382 */ 383 bad_area: 384 up_read(&mm->mmap_sem); 385 386 /* User mode accesses just cause a SIGSEGV */ 387 if (regs->psw.mask & PSW_MASK_PSTATE) { 388 tsk->thread.prot_addr = address; 389 tsk->thread.trap_no = error_code; 390 do_sigsegv(regs, error_code, si_code, address); 391 return; 392 } 393 394 no_context: 395 do_no_context(regs, error_code, address); 396 } 397 398 void __kprobes do_protection_exception(struct pt_regs *regs, 399 long error_code) 400 { 401 /* Protection exception is supressing, decrement psw address. */ 402 regs->psw.addr -= (error_code >> 16); 403 /* 404 * Check for low-address protection. This needs to be treated 405 * as a special case because the translation exception code 406 * field is not guaranteed to contain valid data in this case. 407 */ 408 if (unlikely(!(S390_lowcore.trans_exc_code & 4))) { 409 do_low_address(regs, error_code); 410 return; 411 } 412 do_exception(regs, 4, 1); 413 } 414 415 void __kprobes do_dat_exception(struct pt_regs *regs, long error_code) 416 { 417 do_exception(regs, error_code & 0xff, 0); 418 } 419 420 #ifdef CONFIG_64BIT 421 void __kprobes do_asce_exception(struct pt_regs *regs, unsigned long error_code) 422 { 423 struct mm_struct *mm; 424 struct vm_area_struct *vma; 425 unsigned long address; 426 int space; 427 428 mm = current->mm; 429 address = S390_lowcore.trans_exc_code & __FAIL_ADDR_MASK; 430 space = check_space(current); 431 432 if (unlikely(space == 0 || in_atomic() || !mm)) 433 goto no_context; 434 435 local_irq_enable(); 436 437 down_read(&mm->mmap_sem); 438 vma = find_vma(mm, address); 439 up_read(&mm->mmap_sem); 440 441 if (vma) { 442 update_mm(mm, current); 443 return; 444 } 445 446 /* User mode accesses just cause a SIGSEGV */ 447 if (regs->psw.mask & PSW_MASK_PSTATE) { 448 current->thread.prot_addr = address; 449 current->thread.trap_no = error_code; 450 do_sigsegv(regs, error_code, SEGV_MAPERR, address); 451 return; 452 } 453 454 no_context: 455 do_no_context(regs, error_code, address); 456 } 457 #endif 458 459 #ifdef CONFIG_PFAULT 460 /* 461 * 'pfault' pseudo page faults routines. 462 */ 463 static ext_int_info_t ext_int_pfault; 464 static int pfault_disable = 0; 465 466 static int __init nopfault(char *str) 467 { 468 pfault_disable = 1; 469 return 1; 470 } 471 472 __setup("nopfault", nopfault); 473 474 typedef struct { 475 __u16 refdiagc; 476 __u16 reffcode; 477 __u16 refdwlen; 478 __u16 refversn; 479 __u64 refgaddr; 480 __u64 refselmk; 481 __u64 refcmpmk; 482 __u64 reserved; 483 } __attribute__ ((packed, aligned(8))) pfault_refbk_t; 484 485 int pfault_init(void) 486 { 487 pfault_refbk_t refbk = 488 { 0x258, 0, 5, 2, __LC_CURRENT, 1ULL << 48, 1ULL << 48, 489 __PF_RES_FIELD }; 490 int rc; 491 492 if (!MACHINE_IS_VM || pfault_disable) 493 return -1; 494 asm volatile( 495 " diag %1,%0,0x258\n" 496 "0: j 2f\n" 497 "1: la %0,8\n" 498 "2:\n" 499 EX_TABLE(0b,1b) 500 : "=d" (rc) : "a" (&refbk), "m" (refbk) : "cc"); 501 __ctl_set_bit(0, 9); 502 return rc; 503 } 504 505 void pfault_fini(void) 506 { 507 pfault_refbk_t refbk = 508 { 0x258, 1, 5, 2, 0ULL, 0ULL, 0ULL, 0ULL }; 509 510 if (!MACHINE_IS_VM || pfault_disable) 511 return; 512 __ctl_clear_bit(0,9); 513 asm volatile( 514 " diag %0,0,0x258\n" 515 "0:\n" 516 EX_TABLE(0b,0b) 517 : : "a" (&refbk), "m" (refbk) : "cc"); 518 } 519 520 static void pfault_interrupt(__u16 error_code) 521 { 522 struct task_struct *tsk; 523 __u16 subcode; 524 525 /* 526 * Get the external interruption subcode & pfault 527 * initial/completion signal bit. VM stores this 528 * in the 'cpu address' field associated with the 529 * external interrupt. 530 */ 531 subcode = S390_lowcore.cpu_addr; 532 if ((subcode & 0xff00) != __SUBCODE_MASK) 533 return; 534 535 /* 536 * Get the token (= address of the task structure of the affected task). 537 */ 538 tsk = *(struct task_struct **) __LC_PFAULT_INTPARM; 539 540 if (subcode & 0x0080) { 541 /* signal bit is set -> a page has been swapped in by VM */ 542 if (xchg(&tsk->thread.pfault_wait, -1) != 0) { 543 /* Initial interrupt was faster than the completion 544 * interrupt. pfault_wait is valid. Set pfault_wait 545 * back to zero and wake up the process. This can 546 * safely be done because the task is still sleeping 547 * and can't produce new pfaults. */ 548 tsk->thread.pfault_wait = 0; 549 wake_up_process(tsk); 550 put_task_struct(tsk); 551 } 552 } else { 553 /* signal bit not set -> a real page is missing. */ 554 get_task_struct(tsk); 555 set_task_state(tsk, TASK_UNINTERRUPTIBLE); 556 if (xchg(&tsk->thread.pfault_wait, 1) != 0) { 557 /* Completion interrupt was faster than the initial 558 * interrupt (swapped in a -1 for pfault_wait). Set 559 * pfault_wait back to zero and exit. This can be 560 * done safely because tsk is running in kernel 561 * mode and can't produce new pfaults. */ 562 tsk->thread.pfault_wait = 0; 563 set_task_state(tsk, TASK_RUNNING); 564 put_task_struct(tsk); 565 } else 566 set_tsk_need_resched(tsk); 567 } 568 } 569 570 void __init pfault_irq_init(void) 571 { 572 if (!MACHINE_IS_VM) 573 return; 574 575 /* 576 * Try to get pfault pseudo page faults going. 577 */ 578 if (register_early_external_interrupt(0x2603, pfault_interrupt, 579 &ext_int_pfault) != 0) 580 panic("Couldn't request external interrupt 0x2603"); 581 582 if (pfault_init() == 0) 583 return; 584 585 /* Tough luck, no pfault. */ 586 pfault_disable = 1; 587 unregister_early_external_interrupt(0x2603, pfault_interrupt, 588 &ext_int_pfault); 589 } 590 #endif 591