if (error_code & DSISR_DABRMATCH) { if (notify_die(DIE_DABR_MATCH, "dabr_match", regs, error_code, 11, SIGSEGV) == NOTIFY_STOP) return 0; if (debugger_dabr_match(regs)) return 0; 
if (error_code & DSISR_DABRMATCH) { do_dabr(regs, error_code); return 0; 
int __kprobes do_page_fault(struct pt_regs *regs, unsigned long address,			    unsigned long error_code){	struct vm_area_struct * vma;	struct mm_struct *mm = current->mm;	siginfo_t info;	unsigned long code = SEGV_MAPERR;	unsigned long is_write = error_code & DSISR_ISSTORE;	unsigned long trap = TRAP(regs); 	unsigned long is_exec = trap == 0x400;	BUG_ON((trap == 0x380) || (trap == 0x480));	if (notify_die(DIE_PAGE_FAULT, "page_fault", regs, error_code,				11, SIGSEGV) == NOTIFY_STOP)		return 0;	if (trap == 0x300) {		if (debugger_fault_handler(regs))			return 0;	}	/* On a kernel SLB miss we can only check for a valid exception entry */	if (!user_mode(regs) && (address >= TASK_SIZE))		return SIGSEGV;	if (error_code & DSISR_DABRMATCH) {		if (notify_die(DIE_DABR_MATCH, "dabr_match", regs, error_code,					11, SIGSEGV) == NOTIFY_STOP)			return 0;		if (debugger_dabr_match(regs))			return 0;	}	if (in_atomic() || mm == NULL) {		if (!user_mode(regs))			return SIGSEGV;		/* in_atomic() in user mode is really bad,		   as is current->mm == NULL. */		printk(KERN_EMERG "Page fault in user mode with"		       "in_atomic() = %d mm = %p\n", in_atomic(), mm);		printk(KERN_EMERG "NIP = %lx  MSR = %lx\n",		       regs->nip, regs->msr);		die("Weird page fault", regs, SIGSEGV);	}	/* When running in the kernel we expect faults to occur only to	 * addresses in user space.  All other faults represent errors in the	 * kernel and should generate an OOPS.  Unfortunatly, in the case of an	 * erroneous fault occuring in a code path which already holds mmap_sem	 * we will deadlock attempting to validate the fault against the	 * address space.  Luckily the kernel only validly references user	 * space from well defined areas of code, which are listed in the	 * exceptions table.	 *	 * As the vast majority of faults will be valid we will only perform	 * the source reference check when there is a possibilty of a deadlock.	 * Attempt to lock the address space, if we cannot we then validate the	 * source.  If this is invalid we can skip the address space check,	 * thus avoiding the deadlock.	 */	if (!down_read_trylock(&mm->mmap_sem)) {		if (!user_mode(regs) && !search_exception_tables(regs->nip))			goto bad_area_nosemaphore;		down_read(&mm->mmap_sem);	}	vma = find_vma(mm, address);	if (!vma)		goto bad_area;	if (vma->vm_start <= address) {		goto good_area;	}	if (!(vma->vm_flags & VM_GROWSDOWN))		goto bad_area;	/*	 * N.B. The POWER/Open ABI allows programs to access up to	 * 288 bytes below the stack pointer.	 * The kernel signal delivery code writes up to about 1.5kB	 * below the stack pointer (r1) before decrementing it.	 * The exec code can write slightly over 640kB to the stack	 * before setting the user r1.  Thus we allow the stack to	 * expand to 1MB without further checks.	 */	if (address + 0x100000 < vma->vm_end) {		/* get user regs even if this fault is in kernel mode */		struct pt_regs *uregs = current->thread.regs;		if (uregs == NULL)			goto bad_area;		/*		 * A user-mode access to an address a long way below		 * the stack pointer is only valid if the instruction		 * is one which would update the stack pointer to the		 * address accessed if the instruction completed,		 * i.e. either stwu rs,n(r1) or stwux rs,r1,rb		 * (or the byte, halfword, float or double forms).		 *		 * If we don't check this then any write to the area		 * between the last mapped region and the stack will		 * expand the stack rather than segfaulting.		 */		if (address + 2048 < uregs->gpr[1]		    && (!user_mode(regs) || !store_updates_sp(regs)))			goto bad_area;	}	if (expand_stack(vma, address))		goto bad_area;good_area:	code = SEGV_ACCERR;	if (is_exec) {		/* protection fault */		if (error_code & DSISR_PROTFAULT)			goto bad_area;		if (!(vma->vm_flags & VM_EXEC))			goto bad_area;	/* a write */	} else if (is_write) {		if (!(vma->vm_flags & VM_WRITE))			goto bad_area;	/* a read */	} else {		if (!(vma->vm_flags & VM_READ))			goto bad_area;	} survive:	/*	 * If for any reason at all we couldn't handle the fault,	 * make sure we exit gracefully rather than endlessly redo	 * the fault.	 */	switch (handle_mm_fault(mm, vma, address, is_write)) {	case VM_FAULT_MINOR:		current->min_flt++;		break;	case VM_FAULT_MAJOR:		current->maj_flt++;		break;	case VM_FAULT_SIGBUS:		goto do_sigbus;	case VM_FAULT_OOM:		goto out_of_memory;	default:		BUG();	}	up_read(&mm->mmap_sem);	return 0;bad_area:	up_read(&mm->mmap_sem);bad_area_nosemaphore:	/* User mode accesses cause a SIGSEGV */	if (user_mode(regs)) {		info.si_signo = SIGSEGV;		info.si_errno = 0;		info.si_code = code;		info.si_addr = (void __user *) address;		force_sig_info(SIGSEGV, &info, current);		return 0;	}	if (trap == 0x400 && (error_code & DSISR_PROTFAULT)	    && printk_ratelimit())		printk(KERN_CRIT "kernel tried to execute NX-protected"		       " page (%lx) - exploit attempt? (uid: %d)\n",		       address, current->uid);	return SIGSEGV;/* * We ran out of memory, or some other thing happened to us that made * us unable to handle the page fault gracefully. */out_of_memory:	up_read(&mm->mmap_sem);	if (current->pid == 1) {		yield();		down_read(&mm->mmap_sem);		goto survive;	}	printk("VM: killing process %s\n", current->comm);	if (user_mode(regs))		do_exit(SIGKILL);	return SIGKILL;do_sigbus:	up_read(&mm->mmap_sem);	if (user_mode(regs)) {		info.si_signo = SIGBUS;		info.si_errno = 0;		info.si_code = BUS_ADRERR;		info.si_addr = (void __user *)address;		force_sig_info(SIGBUS, &info, current);		return 0;	}	return SIGBUS;}
10457	/local/tlutelli/issta_data/temp/c/2005_temp/2005/10457/fd9648dff6f9797ecc509bcd181706a274dc074d/fault.c/buggy/arch/ppc64/mm/fault.c