1 files changed, 82 insertions, 11 deletions

diff --git a/arch/x86/mm/fault_64.c b/arch/x86/mm/fault_64.c
index edca689c62d5..0902719388bc 100644
--- a/arch/x86/mm/fault_64.c
+++ b/arch/x86/mm/fault_64.c
@@ -51,7 +51,11 @@ static inline int notify_page_fault(struct pt_regs *regs)
         int ret = 0;
 
         /* kprobe_running() needs smp_processor_id() */
+#ifdef CONFIG_X86_32
+        if (!user_mode_vm(regs)) {
+#else
         if (!user_mode(regs)) {
+#endif
                 preempt_disable();
                 if (kprobe_running() && kprobe_fault_handler(regs, 14))
                         ret = 1;
@@ -433,6 +437,10 @@ static noinline void pgtable_bad(unsigned long address, struct pt_regs *regs,
 #endif
 
 /*
+ * X86_32
+ * Handle a fault on the vmalloc or module mapping area
+ *
+ * X86_64
  * Handle a fault on the vmalloc area
  *
  * This assumes no large pages in there.
@@ -512,16 +520,20 @@ int show_unhandled_signals = 1;
  * and the problem, and then passes it off to one of the appropriate
  * routines.
  */
-asmlinkage void __kprobes do_page_fault(struct pt_regs *regs,
-                                        unsigned long error_code)
+#ifdef CONFIG_X86_64
+asmlinkage
+#endif
+void __kprobes do_page_fault(struct pt_regs *regs, unsigned long error_code)
 {
         struct task_struct *tsk;
         struct mm_struct *mm;
         struct vm_area_struct *vma;
         unsigned long address;
-        int write, fault;
+        int write, si_code;
+        int fault;
+#ifdef CONFIG_X86_64
         unsigned long flags;
-        int si_code;
+#endif
 
         /*
          * We can fault from pretty much anywhere, with unknown IRQ state.
@@ -553,6 +565,30 @@ asmlinkage void __kprobes do_page_fault(struct pt_regs *regs,
          * (error_code & 4) == 0, and that the fault was not a
          * protection error (error_code & 9) == 0.
          */
+#ifdef CONFIG_X86_32
+        if (unlikely(address >= TASK_SIZE)) {
+                if (!(error_code & (PF_RSVD|PF_USER|PF_PROT)) &&
+                    vmalloc_fault(address) >= 0)
+                        return;
+                /*
+                 * Don't take the mm semaphore here. If we fixup a prefetch
+                 * fault we could otherwise deadlock.
+                 */
+                goto bad_area_nosemaphore;
+        }
+
+        /* It's safe to allow irq's after cr2 has been saved and the vmalloc
+           fault has been handled. */
+        if (regs->flags & (X86_EFLAGS_IF|VM_MASK))
+                local_irq_enable();
+
+        /*
+         * If we're in an interrupt, have no user context or are running in an
+         * atomic region then we must not take the fault.
+         */
+        if (in_atomic() || !mm)
+                goto bad_area_nosemaphore;
+#else /* CONFIG_X86_64 */
         if (unlikely(address >= TASK_SIZE64)) {
                 /*
                  * Don't check for the module range here: its PML4
@@ -570,7 +606,6 @@ asmlinkage void __kprobes do_page_fault(struct pt_regs *regs,
                  */
                 goto bad_area_nosemaphore;
         }
-
         if (likely(regs->flags & X86_EFLAGS_IF))
                 local_irq_enable();
 
@@ -590,8 +625,8 @@ asmlinkage void __kprobes do_page_fault(struct pt_regs *regs,
          */
         if (user_mode_vm(regs))
                 error_code |= PF_USER;
-
- again:
+again:
+#endif
         /* When running in the kernel we expect faults to occur only to
          * addresses in user space.  All other faults represent errors in the
          * kernel and should generate an OOPS.  Unfortunately, in the case of an
@@ -617,7 +652,11 @@ asmlinkage void __kprobes do_page_fault(struct pt_regs *regs,
         vma = find_vma(mm, address);
         if (!vma)
                 goto bad_area;
+#ifdef CONFIG_X86_32
+        if (vma->vm_start <= address)
+#else
         if (likely(vma->vm_start <= address))
+#endif
                 goto good_area;
         if (!(vma->vm_flags & VM_GROWSDOWN))
                 goto bad_area;
@@ -655,6 +694,9 @@ good_area:
                         goto bad_area;
         }
 
+#ifdef CONFIG_X86_32
+survive:
+#endif
         /*
          * If for any reason at all we couldn't handle the fault,
          * make sure we exit gracefully rather than endlessly redo
@@ -730,7 +772,6 @@ bad_area_nosemaphore:
                 /* Kernel addresses are always protection faults */
                 tsk->thread.error_code = error_code | (address >= TASK_SIZE);
                 tsk->thread.trap_no = 14;
-
                 force_sig_info_fault(SIGSEGV, si_code, address, tsk);
                 return;
         }
@@ -744,9 +785,14 @@ no_context:
                 return;
 
         /*
+         * X86_32
+         * Valid to do another page fault here, because if this fault
+         * had been triggered by is_prefetch fixup_exception would have
+         * handled it.
+         *
+         * X86_64
          * Hall of shame of CPU/BIOS bugs.
          */
-
         if (is_prefetch(regs, address, error_code))
                 return;
 
@@ -757,7 +803,18 @@ no_context:
  * Oops. The kernel tried to access some bad page. We'll have to
  * terminate things with extreme prejudice.
  */
+#ifdef CONFIG_X86_32
+        bust_spinlocks(1);
+
+        show_fault_oops(regs, error_code, address);
 
+        tsk->thread.cr2 = address;
+        tsk->thread.trap_no = 14;
+        tsk->thread.error_code = error_code;
+        die("Oops", regs, error_code);
+        bust_spinlocks(0);
+        do_exit(SIGKILL);
+#else /* CONFIG_X86_64 */
         flags = oops_begin();
 
         show_fault_oops(regs, error_code, address);
@@ -770,6 +827,7 @@ no_context:
         /* Executive summary in case the body of the oops scrolled away */
         printk(KERN_EMERG "CR2: %016lx\n", address);
         oops_end(flags, regs, SIGKILL);
+#endif
 
 /*
  * We ran out of memory, or some other thing happened to us that made
@@ -777,10 +835,18 @@ no_context:
  */
 out_of_memory:
         up_read(&mm->mmap_sem);
+#ifdef CONFIG_X86_32
+        if (is_global_init(tsk)) {
+                yield();
+                down_read(&mm->mmap_sem);
+                goto survive;
+        }
+#else
         if (is_global_init(current)) {
                 yield();
                 goto again;
         }
+#endif
         printk("VM: killing process %s\n", tsk->comm);
         if (error_code & PF_USER)
                 do_group_exit(SIGKILL);
@@ -792,16 +858,21 @@ do_sigbus:
         /* Kernel mode? Handle exceptions or die */
         if (!(error_code & PF_USER))
                 goto no_context;
-
+#ifdef CONFIG_X86_32
+        /* User space => ok to do another page fault */
+        if (is_prefetch(regs, address, error_code))
+                return;
+#endif
         tsk->thread.cr2 = address;
         tsk->thread.error_code = error_code;
         tsk->thread.trap_no = 14;
         force_sig_info_fault(SIGBUS, BUS_ADRERR, address, tsk);
-        return;
 }
 
+#ifdef CONFIG_X86_64
 DEFINE_SPINLOCK(pgd_lock);
 LIST_HEAD(pgd_list);
+#endif
 
 void vmalloc_sync_all(void)
 {