1 files changed, 121 insertions, 75 deletions

diff --git a/arch/sh/mm/fault_32.c b/arch/sh/mm/fault_32.c
index 71925946f1e1..781b413ff82d 100644
--- a/arch/sh/mm/fault_32.c
+++ b/arch/sh/mm/fault_32.c
@@ -2,7 +2,7 @@
  * Page fault handler for SH with an MMU.
  *
  *  Copyright (C) 1999  Niibe Yutaka
- *  Copyright (C) 2003 - 2008  Paul Mundt
+ *  Copyright (C) 2003 - 2009  Paul Mundt
  *
  *  Based on linux/arch/i386/mm/fault.c:
  *   Copyright (C) 1995  Linus Torvalds
@@ -25,18 +25,91 @@ static inline int notify_page_fault(struct pt_regs *regs, int trap)
 {
         int ret = 0;
 
-#ifdef CONFIG_KPROBES
-        if (!user_mode(regs)) {
+        if (kprobes_built_in() && !user_mode(regs)) {
                 preempt_disable();
                 if (kprobe_running() && kprobe_fault_handler(regs, trap))
                         ret = 1;
                 preempt_enable();
         }
-#endif
 
         return ret;
 }
 
+static inline pmd_t *vmalloc_sync_one(pgd_t *pgd, unsigned long address)
+{
+        unsigned index = pgd_index(address);
+        pgd_t *pgd_k;
+        pud_t *pud, *pud_k;
+        pmd_t *pmd, *pmd_k;
+
+        pgd += index;
+        pgd_k = init_mm.pgd + index;
+
+        if (!pgd_present(*pgd_k))
+                return NULL;
+
+        pud = pud_offset(pgd, address);
+        pud_k = pud_offset(pgd_k, address);
+        if (!pud_present(*pud_k))
+                return NULL;
+
+        pmd = pmd_offset(pud, address);
+        pmd_k = pmd_offset(pud_k, address);
+        if (!pmd_present(*pmd_k))
+                return NULL;
+
+        if (!pmd_present(*pmd))
+                set_pmd(pmd, *pmd_k);
+        else {
+                /*
+                 * The page tables are fully synchronised so there must
+                 * be another reason for the fault. Return NULL here to
+                 * signal that we have not taken care of the fault.
+                 */
+                BUG_ON(pmd_page(*pmd) != pmd_page(*pmd_k));
+                return NULL;
+        }
+
+        return pmd_k;
+}
+
+/*
+ * Handle a fault on the vmalloc or module mapping area
+ */
+static noinline int vmalloc_fault(unsigned long address)
+{
+        pgd_t *pgd_k;
+        pmd_t *pmd_k;
+        pte_t *pte_k;
+
+        /* Make sure we are in vmalloc/module/P3 area: */
+        if (!(address >= VMALLOC_START && address < P3_ADDR_MAX))
+                return -1;
+
+        /*
+         * Synchronize this task's top level page-table
+         * with the 'reference' page table.
+         *
+         * Do _not_ use "current" here. We might be inside
+         * an interrupt in the middle of a task switch..
+         */
+        pgd_k = get_TTB();
+        pmd_k = vmalloc_sync_one(pgd_k, address);
+        if (!pmd_k)
+                return -1;
+
+        pte_k = pte_offset_kernel(pmd_k, address);
+        if (!pte_present(*pte_k))
+                return -1;
+
+        return 0;
+}
+
+static int fault_in_kernel_space(unsigned long address)
+{
+        return address >= TASK_SIZE;
+}
+
 /*
  * This routine handles page faults.  It determines the address,
  * and the problem, and then passes it off to one of the appropriate
@@ -46,6 +119,7 @@ asmlinkage void __kprobes do_page_fault(struct pt_regs *regs,
                                         unsigned long writeaccess,
                                         unsigned long address)
 {
+        unsigned long vec;
         struct task_struct *tsk;
         struct mm_struct *mm;
         struct vm_area_struct * vma;
@@ -53,59 +127,30 @@ asmlinkage void __kprobes do_page_fault(struct pt_regs *regs,
         int fault;
         siginfo_t info;
 
-        /*
-         * We don't bother with any notifier callbacks here, as they are
-         * all handled through the __do_page_fault() fast-path.
-         */
-
         tsk = current;
+        mm = tsk->mm;
         si_code = SEGV_MAPERR;
+        vec = lookup_exception_vector();
 
-        if (unlikely(address >= TASK_SIZE)) {
-                /*
-                 * Synchronize this task's top level page-table
-                 * with the 'reference' page table.
-                 *
-                 * Do _not_ use "tsk" here. We might be inside
-                 * an interrupt in the middle of a task switch..
-                 */
-                int offset = pgd_index(address);
-                pgd_t *pgd, *pgd_k;
-                pud_t *pud, *pud_k;
-                pmd_t *pmd, *pmd_k;
-
-                pgd = get_TTB() + offset;
-                pgd_k = swapper_pg_dir + offset;
-
-                if (!pgd_present(*pgd)) {
-                        if (!pgd_present(*pgd_k))
-                                goto bad_area_nosemaphore;
-                        set_pgd(pgd, *pgd_k);
+        /*
+         * We fault-in kernel-space virtual memory on-demand. The
+         * 'reference' page table is init_mm.pgd.
+         *
+         * NOTE! We MUST NOT take any locks for this case. We may
+         * be in an interrupt or a critical region, and should
+         * only copy the information from the master page table,
+         * nothing more.
+         */
+        if (unlikely(fault_in_kernel_space(address))) {
+                if (vmalloc_fault(address) >= 0)
                         return;
-                }
-
-                pud = pud_offset(pgd, address);
-                pud_k = pud_offset(pgd_k, address);
-
-                if (!pud_present(*pud)) {
-                        if (!pud_present(*pud_k))
-                                goto bad_area_nosemaphore;
-                        set_pud(pud, *pud_k);
+                if (notify_page_fault(regs, vec))
                         return;
-                }
 
-                pmd = pmd_offset(pud, address);
-                pmd_k = pmd_offset(pud_k, address);
-                if (pmd_present(*pmd) || !pmd_present(*pmd_k))
-                        goto bad_area_nosemaphore;
-                set_pmd(pmd, *pmd_k);
-
-                return;
+                goto bad_area_nosemaphore;
         }
 
-        mm = tsk->mm;
-
-        if (unlikely(notify_page_fault(regs, lookup_exception_vector())))
+        if (unlikely(notify_page_fault(regs, vec)))
                 return;
 
         /* Only enable interrupts if they were on before the fault */
@@ -115,8 +160,8 @@ asmlinkage void __kprobes do_page_fault(struct pt_regs *regs,
         perf_swcounter_event(PERF_COUNT_SW_PAGE_FAULTS, 1, 0, regs, address);
 
         /*
-         * If we're in an interrupt or have no user
-         * context, we must not take the fault..
+         * If we're in an interrupt, have no user context or are running
+         * in an atomic region then we must not take the fault:
          */
         if (in_atomic() || !mm)
                 goto no_context;
@@ -132,10 +177,11 @@ asmlinkage void __kprobes do_page_fault(struct pt_regs *regs,
                 goto bad_area;
         if (expand_stack(vma, address))
                 goto bad_area;
-/*
- * Ok, we have a good vm_area for this memory access, so
- * we can handle it..
- */
+
+        /*
+         * Ok, we have a good vm_area for this memory access, so
+         * we can handle it..
+         */
 good_area:
         si_code = SEGV_ACCERR;
         if (writeaccess) {
@@ -173,10 +219,10 @@ survive:
         up_read(&mm->mmap_sem);
         return;
 
-/*
- * Something tried to access memory that isn't in our memory map..
- * Fix it, but check if it's kernel or user first..
- */
+        /*
+         * Something tried to access memory that isn't in our memory map..
+         * Fix it, but check if it's kernel or user first..
+         */
 bad_area:
         up_read(&mm->mmap_sem);
 
@@ -272,16 +318,15 @@ do_sigbus:
 /*
  * Called with interrupts disabled.
  */
-asmlinkage int __kprobes __do_page_fault(struct pt_regs *regs,
-                                         unsigned long writeaccess,
-                                         unsigned long address)
+asmlinkage int __kprobes
+handle_tlbmiss(struct pt_regs *regs, unsigned long writeaccess,
+               unsigned long address)
 {
         pgd_t *pgd;
         pud_t *pud;
         pmd_t *pmd;
         pte_t *pte;
         pte_t entry;
-        int ret = 1;
 
         /*
          * We don't take page faults for P1, P2, and parts of P4, these
@@ -292,40 +337,41 @@ asmlinkage int __kprobes __do_page_fault(struct pt_regs *regs,
                 pgd = pgd_offset_k(address);
         } else {
                 if (unlikely(address >= TASK_SIZE || !current->mm))
-                        goto out;
+                        return 1;
 
                 pgd = pgd_offset(current->mm, address);
         }
 
         pud = pud_offset(pgd, address);
         if (pud_none_or_clear_bad(pud))
-                goto out;
+                return 1;
         pmd = pmd_offset(pud, address);
         if (pmd_none_or_clear_bad(pmd))
-                goto out;
+                return 1;
         pte = pte_offset_kernel(pmd, address);
         entry = *pte;
         if (unlikely(pte_none(entry) || pte_not_present(entry)))
-                goto out;
+                return 1;
         if (unlikely(writeaccess && !pte_write(entry)))
-                goto out;
+                return 1;
 
         if (writeaccess)
                 entry = pte_mkdirty(entry);
         entry = pte_mkyoung(entry);
 
+        set_pte(pte, entry);
+
 #if defined(CONFIG_CPU_SH4) && !defined(CONFIG_SMP)
         /*
-         * ITLB is not affected by "ldtlb" instruction.
-         * So, we need to flush the entry by ourselves.
+         * SH-4 does not set MMUCR.RC to the corresponding TLB entry in
+         * the case of an initial page write exception, so we need to
+         * flush it in order to avoid potential TLB entry duplication.
          */
-        local_flush_tlb_one(get_asid(), address & PAGE_MASK);
+        if (writeaccess == 2)
+                local_flush_tlb_one(get_asid(), address & PAGE_MASK);
 #endif
 
-        set_pte(pte, entry);
         update_mmu_cache(NULL, address, entry);
 
-        ret = 0;
-out:
-        return ret;
+        return 0;
 }