Gennady Sharapov | ea2ba7d | 2006-01-08 01:01:31 -0800 | [diff] [blame] | 1 | /* |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 2 | * Copyright (C) 2000, 2001 Jeff Dike (jdike@karaya.com) |
| 3 | * Licensed under the GPL |
| 4 | */ |
| 5 | |
| 6 | #include "linux/kernel.h" |
| 7 | #include "asm/errno.h" |
| 8 | #include "linux/sched.h" |
| 9 | #include "linux/mm.h" |
| 10 | #include "linux/spinlock.h" |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 11 | #include "linux/init.h" |
| 12 | #include "linux/ptrace.h" |
| 13 | #include "asm/semaphore.h" |
| 14 | #include "asm/pgtable.h" |
| 15 | #include "asm/pgalloc.h" |
| 16 | #include "asm/tlbflush.h" |
| 17 | #include "asm/a.out.h" |
| 18 | #include "asm/current.h" |
| 19 | #include "asm/irq.h" |
Paolo 'Blaisorblade' Giarrusso | 546fe1c | 2005-09-22 21:44:16 -0700 | [diff] [blame] | 20 | #include "sysdep/sigcontext.h" |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 21 | #include "user_util.h" |
| 22 | #include "kern_util.h" |
| 23 | #include "kern.h" |
| 24 | #include "chan_kern.h" |
| 25 | #include "mconsole_kern.h" |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 26 | #include "mem.h" |
| 27 | #include "mem_kern.h" |
Gennady Sharapov | c66fdd5 | 2006-01-08 01:01:32 -0800 | [diff] [blame] | 28 | #include "sysdep/sigcontext.h" |
| 29 | #include "sysdep/ptrace.h" |
| 30 | #include "os.h" |
Paolo 'Blaisorblade' Giarrusso | be662a1 | 2005-09-30 11:58:59 -0700 | [diff] [blame] | 31 | #ifdef CONFIG_MODE_SKAS |
| 32 | #include "skas.h" |
| 33 | #endif |
Gennady Sharapov | ea2ba7d | 2006-01-08 01:01:31 -0800 | [diff] [blame] | 34 | #include "os.h" |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 35 | |
Paolo 'Blaisorblade' Giarrusso | 3b52166 | 2005-09-03 15:57:26 -0700 | [diff] [blame] | 36 | /* Note this is constrained to return 0, -EFAULT, -EACCESS, -ENOMEM by segv(). */ |
Jeff Dike | 1d3468a | 2006-07-10 04:45:13 -0700 | [diff] [blame] | 37 | int handle_page_fault(unsigned long address, unsigned long ip, |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 38 | int is_write, int is_user, int *code_out) |
| 39 | { |
| 40 | struct mm_struct *mm = current->mm; |
| 41 | struct vm_area_struct *vma; |
| 42 | pgd_t *pgd; |
| 43 | pud_t *pud; |
| 44 | pmd_t *pmd; |
| 45 | pte_t *pte; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 46 | int err = -EFAULT; |
| 47 | |
| 48 | *code_out = SEGV_MAPERR; |
Paolo 'Blaisorblade' Giarrusso | fea03cb | 2005-09-22 21:44:20 -0700 | [diff] [blame] | 49 | |
| 50 | /* If the fault was during atomic operation, don't take the fault, just |
| 51 | * fail. */ |
| 52 | if (in_atomic()) |
| 53 | goto out_nosemaphore; |
| 54 | |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 55 | down_read(&mm->mmap_sem); |
| 56 | vma = find_vma(mm, address); |
Jeff Dike | 1d3468a | 2006-07-10 04:45:13 -0700 | [diff] [blame] | 57 | if(!vma) |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 58 | goto out; |
Jeff Dike | 1d3468a | 2006-07-10 04:45:13 -0700 | [diff] [blame] | 59 | else if(vma->vm_start <= address) |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 60 | goto good_area; |
Jeff Dike | 1d3468a | 2006-07-10 04:45:13 -0700 | [diff] [blame] | 61 | else if(!(vma->vm_flags & VM_GROWSDOWN)) |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 62 | goto out; |
Jeff Dike | 2d58cc9 | 2005-05-06 21:30:55 -0700 | [diff] [blame] | 63 | else if(is_user && !ARCH_IS_STACKGROW(address)) |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 64 | goto out; |
Jeff Dike | 1d3468a | 2006-07-10 04:45:13 -0700 | [diff] [blame] | 65 | else if(expand_stack(vma, address)) |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 66 | goto out; |
| 67 | |
Paolo 'Blaisorblade' Giarrusso | 3b52166 | 2005-09-03 15:57:26 -0700 | [diff] [blame] | 68 | good_area: |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 69 | *code_out = SEGV_ACCERR; |
Jeff Dike | 1d3468a | 2006-07-10 04:45:13 -0700 | [diff] [blame] | 70 | if(is_write && !(vma->vm_flags & VM_WRITE)) |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 71 | goto out; |
Jeff Dike | 13479d5 | 2005-05-20 13:59:08 -0700 | [diff] [blame] | 72 | |
Paolo 'Blaisorblade' Giarrusso | d129f31 | 2005-09-10 19:44:57 +0200 | [diff] [blame] | 73 | /* Don't require VM_READ|VM_EXEC for write faults! */ |
| 74 | if(!is_write && !(vma->vm_flags & (VM_READ | VM_EXEC))) |
Jeff Dike | 13479d5 | 2005-05-20 13:59:08 -0700 | [diff] [blame] | 75 | goto out; |
| 76 | |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 77 | do { |
Paolo 'Blaisorblade' Giarrusso | 3b52166 | 2005-09-03 15:57:26 -0700 | [diff] [blame] | 78 | survive: |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 79 | switch (handle_mm_fault(mm, vma, address, is_write)){ |
| 80 | case VM_FAULT_MINOR: |
| 81 | current->min_flt++; |
| 82 | break; |
| 83 | case VM_FAULT_MAJOR: |
| 84 | current->maj_flt++; |
| 85 | break; |
| 86 | case VM_FAULT_SIGBUS: |
| 87 | err = -EACCES; |
| 88 | goto out; |
| 89 | case VM_FAULT_OOM: |
| 90 | err = -ENOMEM; |
| 91 | goto out_of_memory; |
| 92 | default: |
| 93 | BUG(); |
| 94 | } |
Paolo 'Blaisorblade' Giarrusso | 3b52166 | 2005-09-03 15:57:26 -0700 | [diff] [blame] | 95 | pgd = pgd_offset(mm, address); |
| 96 | pud = pud_offset(pgd, address); |
| 97 | pmd = pmd_offset(pud, address); |
| 98 | pte = pte_offset_kernel(pmd, address); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 99 | } while(!pte_present(*pte)); |
| 100 | err = 0; |
Paolo 'Blaisorblade' Giarrusso | cbc24af | 2005-11-13 16:07:04 -0800 | [diff] [blame] | 101 | /* The below warning was added in place of |
| 102 | * pte_mkyoung(); if (is_write) pte_mkdirty(); |
| 103 | * If it's triggered, we'd see normally a hang here (a clean pte is |
| 104 | * marked read-only to emulate the dirty bit). |
| 105 | * However, the generic code can mark a PTE writable but clean on a |
| 106 | * concurrent read fault, triggering this harmlessly. So comment it out. |
| 107 | */ |
| 108 | #if 0 |
Paolo 'Blaisorblade' Giarrusso | 16b0367 | 2005-09-10 19:44:58 +0200 | [diff] [blame] | 109 | WARN_ON(!pte_young(*pte) || (is_write && !pte_dirty(*pte))); |
Paolo 'Blaisorblade' Giarrusso | cbc24af | 2005-11-13 16:07:04 -0800 | [diff] [blame] | 110 | #endif |
Paolo 'Blaisorblade' Giarrusso | 3b52166 | 2005-09-03 15:57:26 -0700 | [diff] [blame] | 111 | flush_tlb_page(vma, address); |
| 112 | out: |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 113 | up_read(&mm->mmap_sem); |
Paolo 'Blaisorblade' Giarrusso | fea03cb | 2005-09-22 21:44:20 -0700 | [diff] [blame] | 114 | out_nosemaphore: |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 115 | return(err); |
| 116 | |
| 117 | /* |
| 118 | * We ran out of memory, or some other thing happened to us that made |
| 119 | * us unable to handle the page fault gracefully. |
| 120 | */ |
| 121 | out_of_memory: |
Sukadev Bhattiprolu | f400e19 | 2006-09-29 02:00:07 -0700 | [diff] [blame] | 122 | if (is_init(current)) { |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 123 | up_read(&mm->mmap_sem); |
| 124 | yield(); |
| 125 | down_read(&mm->mmap_sem); |
| 126 | goto survive; |
| 127 | } |
| 128 | goto out; |
| 129 | } |
| 130 | |
Gennady Sharapov | c66fdd5 | 2006-01-08 01:01:32 -0800 | [diff] [blame] | 131 | void segv_handler(int sig, union uml_pt_regs *regs) |
| 132 | { |
| 133 | struct faultinfo * fi = UPT_FAULTINFO(regs); |
| 134 | |
| 135 | if(UPT_IS_USER(regs) && !SEGV_IS_FIXABLE(fi)){ |
| 136 | bad_segv(*fi, UPT_IP(regs)); |
| 137 | return; |
| 138 | } |
| 139 | segv(*fi, UPT_IP(regs), UPT_IS_USER(regs), regs); |
| 140 | } |
| 141 | |
Bodo Stroesser | c578455 | 2005-05-05 16:15:31 -0700 | [diff] [blame] | 142 | /* |
| 143 | * We give a *copy* of the faultinfo in the regs to segv. |
| 144 | * This must be done, since nesting SEGVs could overwrite |
| 145 | * the info in the regs. A pointer to the info then would |
| 146 | * give us bad data! |
| 147 | */ |
| 148 | unsigned long segv(struct faultinfo fi, unsigned long ip, int is_user, void *sc) |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 149 | { |
| 150 | struct siginfo si; |
| 151 | void *catcher; |
| 152 | int err; |
Bodo Stroesser | c578455 | 2005-05-05 16:15:31 -0700 | [diff] [blame] | 153 | int is_write = FAULT_WRITE(fi); |
| 154 | unsigned long address = FAULT_ADDRESS(fi); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 155 | |
| 156 | if(!is_user && (address >= start_vm) && (address < end_vm)){ |
| 157 | flush_tlb_kernel_vm(); |
| 158 | return(0); |
| 159 | } |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 160 | else if(current->mm == NULL) |
| 161 | panic("Segfault with no mm"); |
Paolo 'Blaisorblade' Giarrusso | 546fe1c | 2005-09-22 21:44:16 -0700 | [diff] [blame] | 162 | |
Paolo 'Blaisorblade' Giarrusso | be662a1 | 2005-09-30 11:58:59 -0700 | [diff] [blame] | 163 | if (SEGV_IS_FIXABLE(&fi) || SEGV_MAYBE_FIXABLE(&fi)) |
Paolo 'Blaisorblade' Giarrusso | 546fe1c | 2005-09-22 21:44:16 -0700 | [diff] [blame] | 164 | err = handle_page_fault(address, ip, is_write, is_user, &si.si_code); |
| 165 | else { |
| 166 | err = -EFAULT; |
| 167 | /* A thread accessed NULL, we get a fault, but CR2 is invalid. |
| 168 | * This code is used in __do_copy_from_user() of TT mode. */ |
| 169 | address = 0; |
| 170 | } |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 171 | |
| 172 | catcher = current->thread.fault_catcher; |
| 173 | if(!err) |
| 174 | return(0); |
| 175 | else if(catcher != NULL){ |
| 176 | current->thread.fault_addr = (void *) address; |
| 177 | do_longjmp(catcher, 1); |
Jeff Dike | 1d3468a | 2006-07-10 04:45:13 -0700 | [diff] [blame] | 178 | } |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 179 | else if(current->thread.fault_addr != NULL) |
| 180 | panic("fault_addr set but no fault catcher"); |
Bodo Stroesser | c578455 | 2005-05-05 16:15:31 -0700 | [diff] [blame] | 181 | else if(!is_user && arch_fixup(ip, sc)) |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 182 | return(0); |
| 183 | |
Jeff Dike | 1d3468a | 2006-07-10 04:45:13 -0700 | [diff] [blame] | 184 | if(!is_user) |
| 185 | panic("Kernel mode fault at addr 0x%lx, ip 0x%lx", |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 186 | address, ip); |
| 187 | |
Paolo 'Blaisorblade' Giarrusso | 3b52166 | 2005-09-03 15:57:26 -0700 | [diff] [blame] | 188 | if (err == -EACCES) { |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 189 | si.si_signo = SIGBUS; |
| 190 | si.si_errno = 0; |
| 191 | si.si_code = BUS_ADRERR; |
Al Viro | 4d338e1 | 2006-03-31 02:30:15 -0800 | [diff] [blame] | 192 | si.si_addr = (void __user *)address; |
Bodo Stroesser | c578455 | 2005-05-05 16:15:31 -0700 | [diff] [blame] | 193 | current->thread.arch.faultinfo = fi; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 194 | force_sig_info(SIGBUS, &si, current); |
Paolo 'Blaisorblade' Giarrusso | 3b52166 | 2005-09-03 15:57:26 -0700 | [diff] [blame] | 195 | } else if (err == -ENOMEM) { |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 196 | printk("VM: killing process %s\n", current->comm); |
| 197 | do_exit(SIGKILL); |
Paolo 'Blaisorblade' Giarrusso | 3b52166 | 2005-09-03 15:57:26 -0700 | [diff] [blame] | 198 | } else { |
| 199 | BUG_ON(err != -EFAULT); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 200 | si.si_signo = SIGSEGV; |
Al Viro | 4d338e1 | 2006-03-31 02:30:15 -0800 | [diff] [blame] | 201 | si.si_addr = (void __user *) address; |
Bodo Stroesser | c578455 | 2005-05-05 16:15:31 -0700 | [diff] [blame] | 202 | current->thread.arch.faultinfo = fi; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 203 | force_sig_info(SIGSEGV, &si, current); |
| 204 | } |
| 205 | return(0); |
| 206 | } |
| 207 | |
Bodo Stroesser | c578455 | 2005-05-05 16:15:31 -0700 | [diff] [blame] | 208 | void bad_segv(struct faultinfo fi, unsigned long ip) |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 209 | { |
| 210 | struct siginfo si; |
| 211 | |
| 212 | si.si_signo = SIGSEGV; |
| 213 | si.si_code = SEGV_ACCERR; |
Al Viro | 4d338e1 | 2006-03-31 02:30:15 -0800 | [diff] [blame] | 214 | si.si_addr = (void __user *) FAULT_ADDRESS(fi); |
| 215 | current->thread.arch.faultinfo = fi; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 216 | force_sig_info(SIGSEGV, &si, current); |
| 217 | } |
| 218 | |
| 219 | void relay_signal(int sig, union uml_pt_regs *regs) |
| 220 | { |
Jeff Dike | 6edf428 | 2006-09-25 23:33:03 -0700 | [diff] [blame] | 221 | if(arch_handle_signal(sig, regs)) |
| 222 | return; |
| 223 | |
| 224 | if(!UPT_IS_USER(regs)){ |
| 225 | if(sig == SIGBUS) |
| 226 | printk("Bus error - the /dev/shm or /tmp mount likely " |
| 227 | "just ran out of space\n"); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 228 | panic("Kernel mode signal %d", sig); |
Jeff Dike | 6edf428 | 2006-09-25 23:33:03 -0700 | [diff] [blame] | 229 | } |
| 230 | |
Bodo Stroesser | c578455 | 2005-05-05 16:15:31 -0700 | [diff] [blame] | 231 | current->thread.arch.faultinfo = *UPT_FAULTINFO(regs); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 232 | force_sig(sig, current); |
| 233 | } |
| 234 | |
| 235 | void bus_handler(int sig, union uml_pt_regs *regs) |
| 236 | { |
| 237 | if(current->thread.fault_catcher != NULL) |
| 238 | do_longjmp(current->thread.fault_catcher, 1); |
| 239 | else relay_signal(sig, regs); |
| 240 | } |
| 241 | |
| 242 | void winch(int sig, union uml_pt_regs *regs) |
| 243 | { |
| 244 | do_IRQ(WINCH_IRQ, regs); |
| 245 | } |
| 246 | |
Jeff Dike | 53dd2b5 | 2006-09-27 01:50:37 -0700 | [diff] [blame] | 247 | const struct kern_handlers handlinfo_kern = { |
| 248 | .relay_signal = relay_signal, |
| 249 | .winch = winch, |
| 250 | .bus_handler = bus_handler, |
| 251 | .page_fault = segv_handler, |
| 252 | .sigio_handler = sigio_handler, |
| 253 | .timer_handler = timer_handler |
| 254 | }; |
| 255 | |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 256 | void trap_init(void) |
| 257 | { |
| 258 | } |