Commit | Line | Data |
---|---|---|
ea2ba7dc | 1 | /* |
4c9e1385 | 2 | * Copyright (C) 2000 - 2007 Jeff Dike (jdike@{addtoit,linux.intel}.com) |
1da177e4 LT |
3 | * Licensed under the GPL |
4 | */ | |
5 | ||
4c9e1385 JD |
6 | #include <linux/mm.h> |
7 | #include <linux/sched.h> | |
8 | #include <linux/hardirq.h> | |
73395a00 | 9 | #include <linux/module.h> |
4c9e1385 JD |
10 | #include <asm/current.h> |
11 | #include <asm/pgtable.h> | |
12 | #include <asm/tlbflush.h> | |
37185b33 AV |
13 | #include <arch.h> |
14 | #include <as-layout.h> | |
15 | #include <kern_util.h> | |
16 | #include <os.h> | |
17 | #include <skas.h> | |
1da177e4 | 18 | |
4c9e1385 JD |
19 | /* |
20 | * Note this is constrained to return 0, -EFAULT, -EACCESS, -ENOMEM by | |
21 | * segv(). | |
22 | */ | |
1d3468a6 | 23 | int handle_page_fault(unsigned long address, unsigned long ip, |
1da177e4 LT |
24 | int is_write, int is_user, int *code_out) |
25 | { | |
26 | struct mm_struct *mm = current->mm; | |
27 | struct vm_area_struct *vma; | |
28 | pgd_t *pgd; | |
29 | pud_t *pud; | |
30 | pmd_t *pmd; | |
31 | pte_t *pte; | |
1da177e4 | 32 | int err = -EFAULT; |
e2ec2c2b | 33 | unsigned int flags = FAULT_FLAG_ALLOW_RETRY | FAULT_FLAG_KILLABLE; |
1da177e4 LT |
34 | |
35 | *code_out = SEGV_MAPERR; | |
fea03cb4 | 36 | |
4c9e1385 JD |
37 | /* |
38 | * If the fault was during atomic operation, don't take the fault, just | |
39 | * fail. | |
40 | */ | |
fea03cb4 PBG |
41 | if (in_atomic()) |
42 | goto out_nosemaphore; | |
43 | ||
e2ec2c2b JW |
44 | if (is_user) |
45 | flags |= FAULT_FLAG_USER; | |
1cefe28f | 46 | retry: |
1da177e4 LT |
47 | down_read(&mm->mmap_sem); |
48 | vma = find_vma(mm, address); | |
4c9e1385 | 49 | if (!vma) |
1da177e4 | 50 | goto out; |
4c9e1385 | 51 | else if (vma->vm_start <= address) |
1da177e4 | 52 | goto good_area; |
4c9e1385 | 53 | else if (!(vma->vm_flags & VM_GROWSDOWN)) |
1da177e4 | 54 | goto out; |
4c9e1385 | 55 | else if (is_user && !ARCH_IS_STACKGROW(address)) |
1da177e4 | 56 | goto out; |
4c9e1385 | 57 | else if (expand_stack(vma, address)) |
1da177e4 LT |
58 | goto out; |
59 | ||
3b52166c | 60 | good_area: |
1da177e4 | 61 | *code_out = SEGV_ACCERR; |
e2ec2c2b JW |
62 | if (is_write) { |
63 | if (!(vma->vm_flags & VM_WRITE)) | |
64 | goto out; | |
65 | flags |= FAULT_FLAG_WRITE; | |
66 | } else { | |
67 | /* Don't require VM_READ|VM_EXEC for write faults! */ | |
68 | if (!(vma->vm_flags & (VM_READ | VM_EXEC))) | |
69 | goto out; | |
70 | } | |
13479d52 | 71 | |
1da177e4 | 72 | do { |
83c54070 | 73 | int fault; |
1c0fe6e3 | 74 | |
1cefe28f KC |
75 | fault = handle_mm_fault(mm, vma, address, flags); |
76 | ||
77 | if ((fault & VM_FAULT_RETRY) && fatal_signal_pending(current)) | |
78 | goto out_nosemaphore; | |
79 | ||
83c54070 NP |
80 | if (unlikely(fault & VM_FAULT_ERROR)) { |
81 | if (fault & VM_FAULT_OOM) { | |
83c54070 NP |
82 | goto out_of_memory; |
83 | } else if (fault & VM_FAULT_SIGBUS) { | |
84 | err = -EACCES; | |
85 | goto out; | |
86 | } | |
1da177e4 LT |
87 | BUG(); |
88 | } | |
1cefe28f KC |
89 | if (flags & FAULT_FLAG_ALLOW_RETRY) { |
90 | if (fault & VM_FAULT_MAJOR) | |
91 | current->maj_flt++; | |
92 | else | |
93 | current->min_flt++; | |
94 | if (fault & VM_FAULT_RETRY) { | |
95 | flags &= ~FAULT_FLAG_ALLOW_RETRY; | |
45cac65b | 96 | flags |= FAULT_FLAG_TRIED; |
1cefe28f KC |
97 | |
98 | goto retry; | |
99 | } | |
100 | } | |
83c54070 | 101 | |
3b52166c PBG |
102 | pgd = pgd_offset(mm, address); |
103 | pud = pud_offset(pgd, address); | |
104 | pmd = pmd_offset(pud, address); | |
105 | pte = pte_offset_kernel(pmd, address); | |
4c9e1385 | 106 | } while (!pte_present(*pte)); |
1da177e4 | 107 | err = 0; |
4c9e1385 JD |
108 | /* |
109 | * The below warning was added in place of | |
cbc24afa PBG |
110 | * pte_mkyoung(); if (is_write) pte_mkdirty(); |
111 | * If it's triggered, we'd see normally a hang here (a clean pte is | |
112 | * marked read-only to emulate the dirty bit). | |
113 | * However, the generic code can mark a PTE writable but clean on a | |
114 | * concurrent read fault, triggering this harmlessly. So comment it out. | |
115 | */ | |
116 | #if 0 | |
16b03678 | 117 | WARN_ON(!pte_young(*pte) || (is_write && !pte_dirty(*pte))); |
cbc24afa | 118 | #endif |
3b52166c PBG |
119 | flush_tlb_page(vma, address); |
120 | out: | |
1da177e4 | 121 | up_read(&mm->mmap_sem); |
fea03cb4 | 122 | out_nosemaphore: |
4c9e1385 | 123 | return err; |
1da177e4 | 124 | |
1da177e4 | 125 | out_of_memory: |
1c0fe6e3 NP |
126 | /* |
127 | * We ran out of memory, call the OOM killer, and return the userspace | |
128 | * (which will retry the fault, or kill us if we got oom-killed). | |
129 | */ | |
130 | up_read(&mm->mmap_sem); | |
086c6cc5 JW |
131 | if (!is_user) |
132 | goto out_nosemaphore; | |
1c0fe6e3 NP |
133 | pagefault_out_of_memory(); |
134 | return 0; | |
1da177e4 | 135 | } |
73395a00 | 136 | EXPORT_SYMBOL(handle_page_fault); |
1da177e4 | 137 | |
3ef6130a RW |
138 | static void show_segv_info(struct uml_pt_regs *regs) |
139 | { | |
140 | struct task_struct *tsk = current; | |
141 | struct faultinfo *fi = UPT_FAULTINFO(regs); | |
142 | ||
143 | if (!unhandled_signal(tsk, SIGSEGV)) | |
144 | return; | |
145 | ||
146 | if (!printk_ratelimit()) | |
147 | return; | |
148 | ||
149 | printk("%s%s[%d]: segfault at %lx ip %p sp %p error %x", | |
150 | task_pid_nr(tsk) > 1 ? KERN_INFO : KERN_EMERG, | |
151 | tsk->comm, task_pid_nr(tsk), FAULT_ADDRESS(*fi), | |
152 | (void *)UPT_IP(regs), (void *)UPT_SP(regs), | |
153 | fi->error_code); | |
154 | ||
155 | print_vma_addr(KERN_CONT " in ", UPT_IP(regs)); | |
156 | printk(KERN_CONT "\n"); | |
157 | } | |
158 | ||
27aa6ef3 JD |
159 | static void bad_segv(struct faultinfo fi, unsigned long ip) |
160 | { | |
161 | struct siginfo si; | |
162 | ||
163 | si.si_signo = SIGSEGV; | |
164 | si.si_code = SEGV_ACCERR; | |
165 | si.si_addr = (void __user *) FAULT_ADDRESS(fi); | |
166 | current->thread.arch.faultinfo = fi; | |
167 | force_sig_info(SIGSEGV, &si, current); | |
168 | } | |
169 | ||
3e6f2ac4 JD |
170 | void fatal_sigsegv(void) |
171 | { | |
172 | force_sigsegv(SIGSEGV, current); | |
173 | do_signal(); | |
174 | /* | |
175 | * This is to tell gcc that we're not returning - do_signal | |
176 | * can, in general, return, but in this case, it's not, since | |
177 | * we just got a fatal SIGSEGV queued. | |
178 | */ | |
179 | os_dump_core(); | |
180 | } | |
181 | ||
d3c1cfcd | 182 | void segv_handler(int sig, struct siginfo *unused_si, struct uml_pt_regs *regs) |
c66fdd5e GS |
183 | { |
184 | struct faultinfo * fi = UPT_FAULTINFO(regs); | |
185 | ||
4c9e1385 | 186 | if (UPT_IS_USER(regs) && !SEGV_IS_FIXABLE(fi)) { |
3ef6130a | 187 | show_segv_info(regs); |
c66fdd5e GS |
188 | bad_segv(*fi, UPT_IP(regs)); |
189 | return; | |
190 | } | |
191 | segv(*fi, UPT_IP(regs), UPT_IS_USER(regs), regs); | |
192 | } | |
193 | ||
c578455a BS |
194 | /* |
195 | * We give a *copy* of the faultinfo in the regs to segv. | |
196 | * This must be done, since nesting SEGVs could overwrite | |
197 | * the info in the regs. A pointer to the info then would | |
198 | * give us bad data! | |
199 | */ | |
5d86456d | 200 | unsigned long segv(struct faultinfo fi, unsigned long ip, int is_user, |
77bf4400 | 201 | struct uml_pt_regs *regs) |
1da177e4 LT |
202 | { |
203 | struct siginfo si; | |
fab95c55 | 204 | jmp_buf *catcher; |
1da177e4 | 205 | int err; |
5d86456d JD |
206 | int is_write = FAULT_WRITE(fi); |
207 | unsigned long address = FAULT_ADDRESS(fi); | |
1da177e4 | 208 | |
4c9e1385 | 209 | if (!is_user && (address >= start_vm) && (address < end_vm)) { |
5d86456d JD |
210 | flush_tlb_kernel_vm(); |
211 | return 0; | |
212 | } | |
4c9e1385 | 213 | else if (current->mm == NULL) { |
377fad3a | 214 | show_regs(container_of(regs, struct pt_regs, regs)); |
4c9e1385 | 215 | panic("Segfault with no mm"); |
377fad3a | 216 | } |
546fe1cb | 217 | |
be662a18 | 218 | if (SEGV_IS_FIXABLE(&fi) || SEGV_MAYBE_FIXABLE(&fi)) |
4c9e1385 JD |
219 | err = handle_page_fault(address, ip, is_write, is_user, |
220 | &si.si_code); | |
546fe1cb PBG |
221 | else { |
222 | err = -EFAULT; | |
4c9e1385 JD |
223 | /* |
224 | * A thread accessed NULL, we get a fault, but CR2 is invalid. | |
225 | * This code is used in __do_copy_from_user() of TT mode. | |
226 | * XXX tt mode is gone, so maybe this isn't needed any more | |
227 | */ | |
546fe1cb PBG |
228 | address = 0; |
229 | } | |
1da177e4 LT |
230 | |
231 | catcher = current->thread.fault_catcher; | |
4c9e1385 | 232 | if (!err) |
5d86456d | 233 | return 0; |
4c9e1385 | 234 | else if (catcher != NULL) { |
1da177e4 | 235 | current->thread.fault_addr = (void *) address; |
fab95c55 | 236 | UML_LONGJMP(catcher, 1); |
1d3468a6 | 237 | } |
4c9e1385 | 238 | else if (current->thread.fault_addr != NULL) |
1da177e4 | 239 | panic("fault_addr set but no fault catcher"); |
4c9e1385 | 240 | else if (!is_user && arch_fixup(ip, regs)) |
5d86456d | 241 | return 0; |
1da177e4 | 242 | |
4c9e1385 | 243 | if (!is_user) { |
377fad3a | 244 | show_regs(container_of(regs, struct pt_regs, regs)); |
1d3468a6 | 245 | panic("Kernel mode fault at addr 0x%lx, ip 0x%lx", |
1da177e4 | 246 | address, ip); |
377fad3a | 247 | } |
1da177e4 | 248 | |
3ef6130a RW |
249 | show_segv_info(regs); |
250 | ||
3b52166c | 251 | if (err == -EACCES) { |
1da177e4 LT |
252 | si.si_signo = SIGBUS; |
253 | si.si_errno = 0; | |
254 | si.si_code = BUS_ADRERR; | |
4d338e1a | 255 | si.si_addr = (void __user *)address; |
5d86456d | 256 | current->thread.arch.faultinfo = fi; |
1da177e4 | 257 | force_sig_info(SIGBUS, &si, current); |
3b52166c PBG |
258 | } else { |
259 | BUG_ON(err != -EFAULT); | |
1da177e4 | 260 | si.si_signo = SIGSEGV; |
4d338e1a | 261 | si.si_addr = (void __user *) address; |
5d86456d | 262 | current->thread.arch.faultinfo = fi; |
1da177e4 LT |
263 | force_sig_info(SIGSEGV, &si, current); |
264 | } | |
5d86456d | 265 | return 0; |
1da177e4 LT |
266 | } |
267 | ||
d3c1cfcd | 268 | void relay_signal(int sig, struct siginfo *si, struct uml_pt_regs *regs) |
1da177e4 | 269 | { |
d3c1cfcd MP |
270 | struct faultinfo *fi; |
271 | struct siginfo clean_si; | |
272 | ||
4c9e1385 JD |
273 | if (!UPT_IS_USER(regs)) { |
274 | if (sig == SIGBUS) | |
275 | printk(KERN_ERR "Bus error - the host /dev/shm or /tmp " | |
276 | "mount likely just ran out of space\n"); | |
1da177e4 | 277 | panic("Kernel mode signal %d", sig); |
6edf428e JD |
278 | } |
279 | ||
9226b838 JD |
280 | arch_examine_signal(sig, regs); |
281 | ||
d3c1cfcd MP |
282 | memset(&clean_si, 0, sizeof(clean_si)); |
283 | clean_si.si_signo = si->si_signo; | |
284 | clean_si.si_errno = si->si_errno; | |
285 | clean_si.si_code = si->si_code; | |
286 | switch (sig) { | |
287 | case SIGILL: | |
288 | case SIGFPE: | |
289 | case SIGSEGV: | |
290 | case SIGBUS: | |
291 | case SIGTRAP: | |
292 | fi = UPT_FAULTINFO(regs); | |
293 | clean_si.si_addr = (void __user *) FAULT_ADDRESS(*fi); | |
294 | current->thread.arch.faultinfo = *fi; | |
295 | #ifdef __ARCH_SI_TRAPNO | |
296 | clean_si.si_trapno = si->si_trapno; | |
297 | #endif | |
298 | break; | |
299 | default: | |
300 | printk(KERN_ERR "Attempted to relay unknown signal %d (si_code = %d)\n", | |
301 | sig, si->si_code); | |
302 | } | |
303 | ||
304 | force_sig_info(sig, &clean_si, current); | |
1da177e4 LT |
305 | } |
306 | ||
d3c1cfcd | 307 | void bus_handler(int sig, struct siginfo *si, struct uml_pt_regs *regs) |
1da177e4 | 308 | { |
4c9e1385 | 309 | if (current->thread.fault_catcher != NULL) |
fab95c55 | 310 | UML_LONGJMP(current->thread.fault_catcher, 1); |
d3c1cfcd MP |
311 | else |
312 | relay_signal(sig, si, regs); | |
1da177e4 LT |
313 | } |
314 | ||
d3c1cfcd | 315 | void winch(int sig, struct siginfo *unused_si, struct uml_pt_regs *regs) |
1da177e4 LT |
316 | { |
317 | do_IRQ(WINCH_IRQ, regs); | |
318 | } | |
319 | ||
320 | void trap_init(void) | |
321 | { | |
322 | } |