Commit | Line | Data |
---|---|---|
0d1fb0a4 | 1 | // SPDX-License-Identifier: GPL-2.0 |
ea2ba7dc | 2 | /* |
4c9e1385 | 3 | * Copyright (C) 2000 - 2007 Jeff Dike (jdike@{addtoit,linux.intel}.com) |
1da177e4 LT |
4 | */ |
5 | ||
4c9e1385 | 6 | #include <linux/mm.h> |
3f07c014 | 7 | #include <linux/sched/signal.h> |
4c9e1385 | 8 | #include <linux/hardirq.h> |
73395a00 | 9 | #include <linux/module.h> |
fbc9f16a | 10 | #include <linux/uaccess.h> |
b17b0153 | 11 | #include <linux/sched/debug.h> |
4c9e1385 JD |
12 | #include <asm/current.h> |
13 | #include <asm/pgtable.h> | |
14 | #include <asm/tlbflush.h> | |
37185b33 AV |
15 | #include <arch.h> |
16 | #include <as-layout.h> | |
17 | #include <kern_util.h> | |
18 | #include <os.h> | |
19 | #include <skas.h> | |
1da177e4 | 20 | |
4c9e1385 | 21 | /* |
59fdf91d | 22 | * Note this is constrained to return 0, -EFAULT, -EACCES, -ENOMEM by |
4c9e1385 JD |
23 | * segv(). |
24 | */ | |
1d3468a6 | 25 | int handle_page_fault(unsigned long address, unsigned long ip, |
1da177e4 LT |
26 | int is_write, int is_user, int *code_out) |
27 | { | |
28 | struct mm_struct *mm = current->mm; | |
29 | struct vm_area_struct *vma; | |
30 | pgd_t *pgd; | |
e19f97ed | 31 | p4d_t *p4d; |
1da177e4 LT |
32 | pud_t *pud; |
33 | pmd_t *pmd; | |
34 | pte_t *pte; | |
1da177e4 | 35 | int err = -EFAULT; |
dde16072 | 36 | unsigned int flags = FAULT_FLAG_DEFAULT; |
1da177e4 LT |
37 | |
38 | *code_out = SEGV_MAPERR; | |
fea03cb4 | 39 | |
4c9e1385 | 40 | /* |
70ffdb93 | 41 | * If the fault was with pagefaults disabled, don't take the fault, just |
4c9e1385 JD |
42 | * fail. |
43 | */ | |
70ffdb93 | 44 | if (faulthandler_disabled()) |
fea03cb4 PBG |
45 | goto out_nosemaphore; |
46 | ||
759496ba JW |
47 | if (is_user) |
48 | flags |= FAULT_FLAG_USER; | |
1cefe28f | 49 | retry: |
1da177e4 LT |
50 | down_read(&mm->mmap_sem); |
51 | vma = find_vma(mm, address); | |
4c9e1385 | 52 | if (!vma) |
1da177e4 | 53 | goto out; |
4c9e1385 | 54 | else if (vma->vm_start <= address) |
1da177e4 | 55 | goto good_area; |
4c9e1385 | 56 | else if (!(vma->vm_flags & VM_GROWSDOWN)) |
1da177e4 | 57 | goto out; |
4c9e1385 | 58 | else if (is_user && !ARCH_IS_STACKGROW(address)) |
1da177e4 | 59 | goto out; |
4c9e1385 | 60 | else if (expand_stack(vma, address)) |
1da177e4 LT |
61 | goto out; |
62 | ||
3b52166c | 63 | good_area: |
1da177e4 | 64 | *code_out = SEGV_ACCERR; |
759496ba JW |
65 | if (is_write) { |
66 | if (!(vma->vm_flags & VM_WRITE)) | |
67 | goto out; | |
68 | flags |= FAULT_FLAG_WRITE; | |
69 | } else { | |
70 | /* Don't require VM_READ|VM_EXEC for write faults! */ | |
71 | if (!(vma->vm_flags & (VM_READ | VM_EXEC))) | |
72 | goto out; | |
73 | } | |
13479d52 | 74 | |
1da177e4 | 75 | do { |
50a7ca3c | 76 | vm_fault_t fault; |
1c0fe6e3 | 77 | |
dcddffd4 | 78 | fault = handle_mm_fault(vma, address, flags); |
1cefe28f KC |
79 | |
80 | if ((fault & VM_FAULT_RETRY) && fatal_signal_pending(current)) | |
81 | goto out_nosemaphore; | |
82 | ||
83c54070 NP |
83 | if (unlikely(fault & VM_FAULT_ERROR)) { |
84 | if (fault & VM_FAULT_OOM) { | |
83c54070 | 85 | goto out_of_memory; |
33692f27 LT |
86 | } else if (fault & VM_FAULT_SIGSEGV) { |
87 | goto out; | |
83c54070 NP |
88 | } else if (fault & VM_FAULT_SIGBUS) { |
89 | err = -EACCES; | |
90 | goto out; | |
91 | } | |
1da177e4 LT |
92 | BUG(); |
93 | } | |
1cefe28f KC |
94 | if (flags & FAULT_FLAG_ALLOW_RETRY) { |
95 | if (fault & VM_FAULT_MAJOR) | |
96 | current->maj_flt++; | |
97 | else | |
98 | current->min_flt++; | |
99 | if (fault & VM_FAULT_RETRY) { | |
45cac65b | 100 | flags |= FAULT_FLAG_TRIED; |
1cefe28f KC |
101 | |
102 | goto retry; | |
103 | } | |
104 | } | |
83c54070 | 105 | |
3b52166c | 106 | pgd = pgd_offset(mm, address); |
e19f97ed MR |
107 | p4d = p4d_offset(pgd, address); |
108 | pud = pud_offset(p4d, address); | |
3b52166c PBG |
109 | pmd = pmd_offset(pud, address); |
110 | pte = pte_offset_kernel(pmd, address); | |
4c9e1385 | 111 | } while (!pte_present(*pte)); |
1da177e4 | 112 | err = 0; |
4c9e1385 JD |
113 | /* |
114 | * The below warning was added in place of | |
cbc24afa PBG |
115 | * pte_mkyoung(); if (is_write) pte_mkdirty(); |
116 | * If it's triggered, we'd see normally a hang here (a clean pte is | |
117 | * marked read-only to emulate the dirty bit). | |
118 | * However, the generic code can mark a PTE writable but clean on a | |
119 | * concurrent read fault, triggering this harmlessly. So comment it out. | |
120 | */ | |
121 | #if 0 | |
16b03678 | 122 | WARN_ON(!pte_young(*pte) || (is_write && !pte_dirty(*pte))); |
cbc24afa | 123 | #endif |
3b52166c PBG |
124 | flush_tlb_page(vma, address); |
125 | out: | |
1da177e4 | 126 | up_read(&mm->mmap_sem); |
fea03cb4 | 127 | out_nosemaphore: |
4c9e1385 | 128 | return err; |
1da177e4 | 129 | |
1da177e4 | 130 | out_of_memory: |
1c0fe6e3 NP |
131 | /* |
132 | * We ran out of memory, call the OOM killer, and return the userspace | |
133 | * (which will retry the fault, or kill us if we got oom-killed). | |
134 | */ | |
135 | up_read(&mm->mmap_sem); | |
87134102 JW |
136 | if (!is_user) |
137 | goto out_nosemaphore; | |
1c0fe6e3 NP |
138 | pagefault_out_of_memory(); |
139 | return 0; | |
1da177e4 | 140 | } |
73395a00 | 141 | EXPORT_SYMBOL(handle_page_fault); |
1da177e4 | 142 | |
3ef6130a RW |
143 | static void show_segv_info(struct uml_pt_regs *regs) |
144 | { | |
145 | struct task_struct *tsk = current; | |
146 | struct faultinfo *fi = UPT_FAULTINFO(regs); | |
147 | ||
148 | if (!unhandled_signal(tsk, SIGSEGV)) | |
149 | return; | |
150 | ||
151 | if (!printk_ratelimit()) | |
152 | return; | |
153 | ||
10a7e9d8 | 154 | printk("%s%s[%d]: segfault at %lx ip %px sp %px error %x", |
3ef6130a RW |
155 | task_pid_nr(tsk) > 1 ? KERN_INFO : KERN_EMERG, |
156 | tsk->comm, task_pid_nr(tsk), FAULT_ADDRESS(*fi), | |
157 | (void *)UPT_IP(regs), (void *)UPT_SP(regs), | |
158 | fi->error_code); | |
159 | ||
160 | print_vma_addr(KERN_CONT " in ", UPT_IP(regs)); | |
161 | printk(KERN_CONT "\n"); | |
162 | } | |
163 | ||
27aa6ef3 JD |
164 | static void bad_segv(struct faultinfo fi, unsigned long ip) |
165 | { | |
27aa6ef3 | 166 | current->thread.arch.faultinfo = fi; |
2e1661d2 | 167 | force_sig_fault(SIGSEGV, SEGV_ACCERR, (void __user *) FAULT_ADDRESS(fi)); |
27aa6ef3 JD |
168 | } |
169 | ||
3e6f2ac4 JD |
170 | void fatal_sigsegv(void) |
171 | { | |
cb44c9a0 | 172 | force_sigsegv(SIGSEGV); |
ccaee5f8 | 173 | do_signal(¤t->thread.regs); |
3e6f2ac4 JD |
174 | /* |
175 | * This is to tell gcc that we're not returning - do_signal | |
176 | * can, in general, return, but in this case, it's not, since | |
177 | * we just got a fatal SIGSEGV queued. | |
178 | */ | |
179 | os_dump_core(); | |
180 | } | |
181 | ||
88af2338 TM |
182 | /** |
183 | * segv_handler() - the SIGSEGV handler | |
184 | * @sig: the signal number | |
185 | * @unused_si: the signal info struct; unused in this handler | |
186 | * @regs: the ptrace register information | |
187 | * | |
188 | * The handler first extracts the faultinfo from the UML ptrace regs struct. | |
189 | * If the userfault did not happen in an UML userspace process, bad_segv is called. | |
190 | * Otherwise the signal did happen in a cloned userspace process, handle it. | |
191 | */ | |
d3c1cfcd | 192 | void segv_handler(int sig, struct siginfo *unused_si, struct uml_pt_regs *regs) |
c66fdd5e GS |
193 | { |
194 | struct faultinfo * fi = UPT_FAULTINFO(regs); | |
195 | ||
4c9e1385 | 196 | if (UPT_IS_USER(regs) && !SEGV_IS_FIXABLE(fi)) { |
3ef6130a | 197 | show_segv_info(regs); |
c66fdd5e GS |
198 | bad_segv(*fi, UPT_IP(regs)); |
199 | return; | |
200 | } | |
201 | segv(*fi, UPT_IP(regs), UPT_IS_USER(regs), regs); | |
202 | } | |
203 | ||
c578455a BS |
204 | /* |
205 | * We give a *copy* of the faultinfo in the regs to segv. | |
206 | * This must be done, since nesting SEGVs could overwrite | |
207 | * the info in the regs. A pointer to the info then would | |
208 | * give us bad data! | |
209 | */ | |
5d86456d | 210 | unsigned long segv(struct faultinfo fi, unsigned long ip, int is_user, |
77bf4400 | 211 | struct uml_pt_regs *regs) |
1da177e4 | 212 | { |
fab95c55 | 213 | jmp_buf *catcher; |
bc08c078 | 214 | int si_code; |
1da177e4 | 215 | int err; |
5d86456d JD |
216 | int is_write = FAULT_WRITE(fi); |
217 | unsigned long address = FAULT_ADDRESS(fi); | |
1da177e4 | 218 | |
bb6a1b2e | 219 | if (!is_user && regs) |
f72c22e4 RW |
220 | current->thread.segv_regs = container_of(regs, struct pt_regs, regs); |
221 | ||
4c9e1385 | 222 | if (!is_user && (address >= start_vm) && (address < end_vm)) { |
5d86456d | 223 | flush_tlb_kernel_vm(); |
f72c22e4 | 224 | goto out; |
5d86456d | 225 | } |
4c9e1385 | 226 | else if (current->mm == NULL) { |
377fad3a | 227 | show_regs(container_of(regs, struct pt_regs, regs)); |
4c9e1385 | 228 | panic("Segfault with no mm"); |
377fad3a | 229 | } |
56b88a3b | 230 | else if (!is_user && address > PAGE_SIZE && address < TASK_SIZE) { |
d2313084 RW |
231 | show_regs(container_of(regs, struct pt_regs, regs)); |
232 | panic("Kernel tried to access user memory at addr 0x%lx, ip 0x%lx", | |
233 | address, ip); | |
234 | } | |
546fe1cb | 235 | |
d0b5e15f | 236 | if (SEGV_IS_FIXABLE(&fi)) |
4c9e1385 | 237 | err = handle_page_fault(address, ip, is_write, is_user, |
bc08c078 | 238 | &si_code); |
546fe1cb PBG |
239 | else { |
240 | err = -EFAULT; | |
4c9e1385 JD |
241 | /* |
242 | * A thread accessed NULL, we get a fault, but CR2 is invalid. | |
243 | * This code is used in __do_copy_from_user() of TT mode. | |
244 | * XXX tt mode is gone, so maybe this isn't needed any more | |
245 | */ | |
546fe1cb PBG |
246 | address = 0; |
247 | } | |
1da177e4 LT |
248 | |
249 | catcher = current->thread.fault_catcher; | |
4c9e1385 | 250 | if (!err) |
f72c22e4 | 251 | goto out; |
4c9e1385 | 252 | else if (catcher != NULL) { |
1da177e4 | 253 | current->thread.fault_addr = (void *) address; |
fab95c55 | 254 | UML_LONGJMP(catcher, 1); |
1d3468a6 | 255 | } |
4c9e1385 | 256 | else if (current->thread.fault_addr != NULL) |
1da177e4 | 257 | panic("fault_addr set but no fault catcher"); |
4c9e1385 | 258 | else if (!is_user && arch_fixup(ip, regs)) |
f72c22e4 | 259 | goto out; |
1da177e4 | 260 | |
4c9e1385 | 261 | if (!is_user) { |
377fad3a | 262 | show_regs(container_of(regs, struct pt_regs, regs)); |
1d3468a6 | 263 | panic("Kernel mode fault at addr 0x%lx, ip 0x%lx", |
1da177e4 | 264 | address, ip); |
377fad3a | 265 | } |
1da177e4 | 266 | |
3ef6130a RW |
267 | show_segv_info(regs); |
268 | ||
3b52166c | 269 | if (err == -EACCES) { |
5d86456d | 270 | current->thread.arch.faultinfo = fi; |
2e1661d2 | 271 | force_sig_fault(SIGBUS, BUS_ADRERR, (void __user *)address); |
3b52166c PBG |
272 | } else { |
273 | BUG_ON(err != -EFAULT); | |
5d86456d | 274 | current->thread.arch.faultinfo = fi; |
2e1661d2 | 275 | force_sig_fault(SIGSEGV, si_code, (void __user *) address); |
1da177e4 | 276 | } |
f72c22e4 RW |
277 | |
278 | out: | |
279 | if (regs) | |
280 | current->thread.segv_regs = NULL; | |
281 | ||
5d86456d | 282 | return 0; |
1da177e4 LT |
283 | } |
284 | ||
d3c1cfcd | 285 | void relay_signal(int sig, struct siginfo *si, struct uml_pt_regs *regs) |
1da177e4 | 286 | { |
530621b7 | 287 | int code, err; |
4c9e1385 JD |
288 | if (!UPT_IS_USER(regs)) { |
289 | if (sig == SIGBUS) | |
290 | printk(KERN_ERR "Bus error - the host /dev/shm or /tmp " | |
291 | "mount likely just ran out of space\n"); | |
1da177e4 | 292 | panic("Kernel mode signal %d", sig); |
6edf428e JD |
293 | } |
294 | ||
9226b838 JD |
295 | arch_examine_signal(sig, regs); |
296 | ||
530621b7 EB |
297 | /* Is the signal layout for the signal known? |
298 | * Signal data must be scrubbed to prevent information leaks. | |
299 | */ | |
300 | code = si->si_code; | |
301 | err = si->si_errno; | |
302 | if ((err == 0) && (siginfo_layout(sig, code) == SIL_FAULT)) { | |
303 | struct faultinfo *fi = UPT_FAULTINFO(regs); | |
d3c1cfcd | 304 | current->thread.arch.faultinfo = *fi; |
2e1661d2 | 305 | force_sig_fault(sig, code, (void __user *)FAULT_ADDRESS(*fi)); |
530621b7 EB |
306 | } else { |
307 | printk(KERN_ERR "Attempted to relay unknown signal %d (si_code = %d) with errno %d\n", | |
308 | sig, code, err); | |
3cf5d076 | 309 | force_sig(sig); |
d3c1cfcd | 310 | } |
1da177e4 LT |
311 | } |
312 | ||
d3c1cfcd | 313 | void bus_handler(int sig, struct siginfo *si, struct uml_pt_regs *regs) |
1da177e4 | 314 | { |
4c9e1385 | 315 | if (current->thread.fault_catcher != NULL) |
fab95c55 | 316 | UML_LONGJMP(current->thread.fault_catcher, 1); |
d3c1cfcd MP |
317 | else |
318 | relay_signal(sig, si, regs); | |
1da177e4 LT |
319 | } |
320 | ||
d3c1cfcd | 321 | void winch(int sig, struct siginfo *unused_si, struct uml_pt_regs *regs) |
1da177e4 LT |
322 | { |
323 | do_IRQ(WINCH_IRQ, regs); | |
324 | } | |
325 | ||
326 | void trap_init(void) | |
327 | { | |
328 | } |