Skip to content
  • Kumar Gala's avatar
    powerpc/mm: Fix module instruction tlb fault handling on Book-E 64 · 82ae5eaf
    Kumar Gala authored
    
    
    We were seeing oops like the following when we did an rmmod on a module:
    
    Unable to handle kernel paging request for instruction fetch
    Faulting instruction address: 0x8000000000008010
    Oops: Kernel access of bad area, sig: 11 [#1]
    SMP NR_CPUS=2 P5020 DS
    last sysfs file: /sys/devices/qman-portals.2/qman-pool.9/uevent
    Modules linked in: qman_tester(-)
    NIP: 8000000000008010 LR: c000000000074858 CTR: 8000000000008010
    REGS: c00000002e29bab0 TRAP: 0400   Not tainted
    (2.6.34.6-00744-g2d21f14)
    MSR: 0000000080029000 <EE,ME,CE>  CR: 24000448  XER: 00000000
    TASK = c00000007a8be600[4987] 'rmmod' THREAD: c00000002e298000 CPU: 1
    GPR00: 8000000000008010 c00000002e29bd30 8000000000012798 c00000000035fb28
    GPR04: 0000000000000002 0000000000000002 0000000024022428 c000000000009108
    GPR08: fffffffffffffffe 800000000000a618 c0000000003c13c8 0000000000000000
    GPR12: 0000000022000444 c00000000fffed00 0000000000000000 0000000000000000
    GPR16: 00000000100c0000 0000000000000000 00000000100dabc8 0000000010099688
    GPR20: 0000000000000000 00000000100cfc28 0000000000000000 0000000010011a44
    GPR24: 00000000100017b2 0000000000000000 0000000000000000 0000000000000880
    GPR28: c00000000035fb28 800000000000a7b8 c000000000376d80 c0000000003cce50
    NIP [8000000000008010] .test_exit+0x0/0x10 [qman_tester]
    LR [c000000000074858] .SyS_delete_module+0x1f8/0x2f0
    Call Trace:
    [c00000002e29bd30] [c0000000000748b4] .SyS_delete_module+0x254/0x2f0 (unreliable)
    [c00000002e29be30] [c000000000000580] syscall_exit+0x0/0x2c
    Instruction dump:
    XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX
    38600000 4e800020 60000000 60000000 <4e800020> 60000000 60000000 60000000
    ---[ end trace 4f57124939a84dc8 ]---
    
    This appears to be due to checking the wrong permission bits in the
    instruction_tlb_miss handling if the address that faulted was in vmalloc
    space.  We need to look at the supervisor execute (_PAGE_BAP_SX) bit and
    not the user bit (_PAGE_BAP_UX/_PAGE_EXEC).
    
    Also removed a branch level since it did not appear to be used.
    
    Reported-by: default avatarJeffrey Ladouceur <Jeffrey.Ladouceur@freescale.com>
    Signed-off-by: default avatarKumar Gala <galak@kernel.crashing.org>
    Signed-off-by: default avatarBenjamin Herrenschmidt <benh@kernel.crashing.org>
    82ae5eaf