Catalin Marinas | 1d18c47 | 2012-03-05 11:49:27 +0000 | [diff] [blame] | 1 | /* |
| 2 | * Based on arch/arm/mm/fault.c |
| 3 | * |
| 4 | * Copyright (C) 1995 Linus Torvalds |
| 5 | * Copyright (C) 1995-2004 Russell King |
| 6 | * Copyright (C) 2012 ARM Ltd. |
| 7 | * |
| 8 | * This program is free software; you can redistribute it and/or modify |
| 9 | * it under the terms of the GNU General Public License version 2 as |
| 10 | * published by the Free Software Foundation. |
| 11 | * |
| 12 | * This program is distributed in the hope that it will be useful, |
| 13 | * but WITHOUT ANY WARRANTY; without even the implied warranty of |
| 14 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
| 15 | * GNU General Public License for more details. |
| 16 | * |
| 17 | * You should have received a copy of the GNU General Public License |
| 18 | * along with this program. If not, see <http://www.gnu.org/licenses/>. |
| 19 | */ |
| 20 | |
Paul Gortmaker | 0edfa83 | 2016-09-19 17:38:55 -0400 | [diff] [blame] | 21 | #include <linux/extable.h> |
Catalin Marinas | 1d18c47 | 2012-03-05 11:49:27 +0000 | [diff] [blame] | 22 | #include <linux/signal.h> |
| 23 | #include <linux/mm.h> |
| 24 | #include <linux/hardirq.h> |
| 25 | #include <linux/init.h> |
| 26 | #include <linux/kprobes.h> |
| 27 | #include <linux/uaccess.h> |
| 28 | #include <linux/page-flags.h> |
| 29 | #include <linux/sched.h> |
| 30 | #include <linux/highmem.h> |
| 31 | #include <linux/perf_event.h> |
| 32 | |
James Morse | 338d4f4 | 2015-07-22 19:05:54 +0100 | [diff] [blame] | 33 | #include <asm/cpufeature.h> |
Catalin Marinas | 1d18c47 | 2012-03-05 11:49:27 +0000 | [diff] [blame] | 34 | #include <asm/exception.h> |
| 35 | #include <asm/debug-monitors.h> |
Catalin Marinas | 9141300 | 2014-04-06 23:04:12 +0100 | [diff] [blame] | 36 | #include <asm/esr.h> |
James Morse | 338d4f4 | 2015-07-22 19:05:54 +0100 | [diff] [blame] | 37 | #include <asm/sysreg.h> |
Catalin Marinas | 1d18c47 | 2012-03-05 11:49:27 +0000 | [diff] [blame] | 38 | #include <asm/system_misc.h> |
| 39 | #include <asm/pgtable.h> |
| 40 | #include <asm/tlbflush.h> |
| 41 | |
Catalin Marinas | 3495386 | 2012-10-24 16:34:02 +0100 | [diff] [blame] | 42 | static const char *fault_name(unsigned int esr); |
| 43 | |
Sandeepa Prabhu | 2dd0e8d | 2016-07-08 12:35:48 -0400 | [diff] [blame] | 44 | #ifdef CONFIG_KPROBES |
| 45 | static inline int notify_page_fault(struct pt_regs *regs, unsigned int esr) |
| 46 | { |
| 47 | int ret = 0; |
| 48 | |
| 49 | /* kprobe_running() needs smp_processor_id() */ |
| 50 | if (!user_mode(regs)) { |
| 51 | preempt_disable(); |
| 52 | if (kprobe_running() && kprobe_fault_handler(regs, esr)) |
| 53 | ret = 1; |
| 54 | preempt_enable(); |
| 55 | } |
| 56 | |
| 57 | return ret; |
| 58 | } |
| 59 | #else |
| 60 | static inline int notify_page_fault(struct pt_regs *regs, unsigned int esr) |
| 61 | { |
| 62 | return 0; |
| 63 | } |
| 64 | #endif |
| 65 | |
Catalin Marinas | 1d18c47 | 2012-03-05 11:49:27 +0000 | [diff] [blame] | 66 | /* |
| 67 | * Dump out the page tables associated with 'addr' in mm 'mm'. |
| 68 | */ |
| 69 | void show_pte(struct mm_struct *mm, unsigned long addr) |
| 70 | { |
| 71 | pgd_t *pgd; |
| 72 | |
| 73 | if (!mm) |
| 74 | mm = &init_mm; |
| 75 | |
| 76 | pr_alert("pgd = %p\n", mm->pgd); |
| 77 | pgd = pgd_offset(mm, addr); |
| 78 | pr_alert("[%08lx] *pgd=%016llx", addr, pgd_val(*pgd)); |
| 79 | |
| 80 | do { |
| 81 | pud_t *pud; |
| 82 | pmd_t *pmd; |
| 83 | pte_t *pte; |
| 84 | |
Steve Capper | 4339e3f | 2013-04-19 15:49:31 +0100 | [diff] [blame] | 85 | if (pgd_none(*pgd) || pgd_bad(*pgd)) |
Catalin Marinas | 1d18c47 | 2012-03-05 11:49:27 +0000 | [diff] [blame] | 86 | break; |
| 87 | |
| 88 | pud = pud_offset(pgd, addr); |
Jungseok Lee | c79b954 | 2014-05-12 18:40:51 +0900 | [diff] [blame] | 89 | printk(", *pud=%016llx", pud_val(*pud)); |
Steve Capper | 4339e3f | 2013-04-19 15:49:31 +0100 | [diff] [blame] | 90 | if (pud_none(*pud) || pud_bad(*pud)) |
Catalin Marinas | 1d18c47 | 2012-03-05 11:49:27 +0000 | [diff] [blame] | 91 | break; |
| 92 | |
| 93 | pmd = pmd_offset(pud, addr); |
| 94 | printk(", *pmd=%016llx", pmd_val(*pmd)); |
Steve Capper | 4339e3f | 2013-04-19 15:49:31 +0100 | [diff] [blame] | 95 | if (pmd_none(*pmd) || pmd_bad(*pmd)) |
Catalin Marinas | 1d18c47 | 2012-03-05 11:49:27 +0000 | [diff] [blame] | 96 | break; |
| 97 | |
| 98 | pte = pte_offset_map(pmd, addr); |
| 99 | printk(", *pte=%016llx", pte_val(*pte)); |
| 100 | pte_unmap(pte); |
| 101 | } while(0); |
| 102 | |
| 103 | printk("\n"); |
| 104 | } |
| 105 | |
Catalin Marinas | 66dbd6e | 2016-04-13 16:01:22 +0100 | [diff] [blame] | 106 | #ifdef CONFIG_ARM64_HW_AFDBM |
| 107 | /* |
| 108 | * This function sets the access flags (dirty, accessed), as well as write |
| 109 | * permission, and only to a more permissive setting. |
| 110 | * |
| 111 | * It needs to cope with hardware update of the accessed/dirty state by other |
| 112 | * agents in the system and can safely skip the __sync_icache_dcache() call as, |
| 113 | * like set_pte_at(), the PTE is never changed from no-exec to exec here. |
| 114 | * |
| 115 | * Returns whether or not the PTE actually changed. |
| 116 | */ |
| 117 | int ptep_set_access_flags(struct vm_area_struct *vma, |
| 118 | unsigned long address, pte_t *ptep, |
| 119 | pte_t entry, int dirty) |
| 120 | { |
| 121 | pteval_t old_pteval; |
| 122 | unsigned int tmp; |
| 123 | |
| 124 | if (pte_same(*ptep, entry)) |
| 125 | return 0; |
| 126 | |
| 127 | /* only preserve the access flags and write permission */ |
| 128 | pte_val(entry) &= PTE_AF | PTE_WRITE | PTE_DIRTY; |
| 129 | |
| 130 | /* |
| 131 | * PTE_RDONLY is cleared by default in the asm below, so set it in |
| 132 | * back if necessary (read-only or clean PTE). |
| 133 | */ |
Will Deacon | 0106d45 | 2016-06-07 17:55:15 +0100 | [diff] [blame] | 134 | if (!pte_write(entry) || !pte_sw_dirty(entry)) |
Catalin Marinas | 66dbd6e | 2016-04-13 16:01:22 +0100 | [diff] [blame] | 135 | pte_val(entry) |= PTE_RDONLY; |
| 136 | |
| 137 | /* |
| 138 | * Setting the flags must be done atomically to avoid racing with the |
| 139 | * hardware update of the access/dirty state. |
| 140 | */ |
| 141 | asm volatile("// ptep_set_access_flags\n" |
| 142 | " prfm pstl1strm, %2\n" |
| 143 | "1: ldxr %0, %2\n" |
| 144 | " and %0, %0, %3 // clear PTE_RDONLY\n" |
| 145 | " orr %0, %0, %4 // set flags\n" |
| 146 | " stxr %w1, %0, %2\n" |
| 147 | " cbnz %w1, 1b\n" |
| 148 | : "=&r" (old_pteval), "=&r" (tmp), "+Q" (pte_val(*ptep)) |
| 149 | : "L" (~PTE_RDONLY), "r" (pte_val(entry))); |
| 150 | |
| 151 | flush_tlb_fix_spurious_fault(vma, address); |
| 152 | return 1; |
| 153 | } |
| 154 | #endif |
| 155 | |
Laura Abbott | 9adeb8e | 2016-08-09 18:25:26 -0700 | [diff] [blame] | 156 | static bool is_el1_instruction_abort(unsigned int esr) |
| 157 | { |
| 158 | return ESR_ELx_EC(esr) == ESR_ELx_EC_IABT_CUR; |
| 159 | } |
| 160 | |
Catalin Marinas | 1d18c47 | 2012-03-05 11:49:27 +0000 | [diff] [blame] | 161 | /* |
| 162 | * The kernel tried to access some page that wasn't present. |
| 163 | */ |
| 164 | static void __do_kernel_fault(struct mm_struct *mm, unsigned long addr, |
| 165 | unsigned int esr, struct pt_regs *regs) |
| 166 | { |
| 167 | /* |
| 168 | * Are we prepared to handle this kernel fault? |
Laura Abbott | 9adeb8e | 2016-08-09 18:25:26 -0700 | [diff] [blame] | 169 | * We are almost certainly not prepared to handle instruction faults. |
Catalin Marinas | 1d18c47 | 2012-03-05 11:49:27 +0000 | [diff] [blame] | 170 | */ |
Laura Abbott | 9adeb8e | 2016-08-09 18:25:26 -0700 | [diff] [blame] | 171 | if (!is_el1_instruction_abort(esr) && fixup_exception(regs)) |
Catalin Marinas | 1d18c47 | 2012-03-05 11:49:27 +0000 | [diff] [blame] | 172 | return; |
| 173 | |
| 174 | /* |
| 175 | * No handler, we'll have to terminate things with extreme prejudice. |
| 176 | */ |
| 177 | bust_spinlocks(1); |
| 178 | pr_alert("Unable to handle kernel %s at virtual address %08lx\n", |
| 179 | (addr < PAGE_SIZE) ? "NULL pointer dereference" : |
| 180 | "paging request", addr); |
| 181 | |
| 182 | show_pte(mm, addr); |
| 183 | die("Oops", regs, esr); |
| 184 | bust_spinlocks(0); |
| 185 | do_exit(SIGKILL); |
| 186 | } |
| 187 | |
| 188 | /* |
| 189 | * Something tried to access memory that isn't in our memory map. User mode |
| 190 | * accesses just cause a SIGSEGV |
| 191 | */ |
| 192 | static void __do_user_fault(struct task_struct *tsk, unsigned long addr, |
| 193 | unsigned int esr, unsigned int sig, int code, |
| 194 | struct pt_regs *regs) |
| 195 | { |
| 196 | struct siginfo si; |
| 197 | |
Suzuki K. Poulose | f871d26 | 2015-07-03 15:08:08 +0100 | [diff] [blame] | 198 | if (unhandled_signal(tsk, sig) && show_unhandled_signals_ratelimited()) { |
Catalin Marinas | 3495386 | 2012-10-24 16:34:02 +0100 | [diff] [blame] | 199 | pr_info("%s[%d]: unhandled %s (%d) at 0x%08lx, esr 0x%03x\n", |
| 200 | tsk->comm, task_pid_nr(tsk), fault_name(esr), sig, |
| 201 | addr, esr); |
Catalin Marinas | 1d18c47 | 2012-03-05 11:49:27 +0000 | [diff] [blame] | 202 | show_pte(tsk->mm, addr); |
| 203 | show_regs(regs); |
| 204 | } |
| 205 | |
| 206 | tsk->thread.fault_address = addr; |
Catalin Marinas | 9141300 | 2014-04-06 23:04:12 +0100 | [diff] [blame] | 207 | tsk->thread.fault_code = esr; |
Catalin Marinas | 1d18c47 | 2012-03-05 11:49:27 +0000 | [diff] [blame] | 208 | si.si_signo = sig; |
| 209 | si.si_errno = 0; |
| 210 | si.si_code = code; |
| 211 | si.si_addr = (void __user *)addr; |
| 212 | force_sig_info(sig, &si, tsk); |
| 213 | } |
| 214 | |
Catalin Marinas | 59f67e1 | 2013-09-16 15:18:28 +0100 | [diff] [blame] | 215 | static void do_bad_area(unsigned long addr, unsigned int esr, struct pt_regs *regs) |
Catalin Marinas | 1d18c47 | 2012-03-05 11:49:27 +0000 | [diff] [blame] | 216 | { |
| 217 | struct task_struct *tsk = current; |
| 218 | struct mm_struct *mm = tsk->active_mm; |
| 219 | |
| 220 | /* |
| 221 | * If we are in kernel mode at this point, we have no context to |
| 222 | * handle this fault with. |
| 223 | */ |
| 224 | if (user_mode(regs)) |
| 225 | __do_user_fault(tsk, addr, esr, SIGSEGV, SEGV_MAPERR, regs); |
| 226 | else |
| 227 | __do_kernel_fault(mm, addr, esr, regs); |
| 228 | } |
| 229 | |
| 230 | #define VM_FAULT_BADMAP 0x010000 |
| 231 | #define VM_FAULT_BADACCESS 0x020000 |
| 232 | |
Catalin Marinas | 1d18c47 | 2012-03-05 11:49:27 +0000 | [diff] [blame] | 233 | static int __do_page_fault(struct mm_struct *mm, unsigned long addr, |
Will Deacon | db6f410 | 2013-07-19 15:37:12 +0100 | [diff] [blame] | 234 | unsigned int mm_flags, unsigned long vm_flags, |
Catalin Marinas | 1d18c47 | 2012-03-05 11:49:27 +0000 | [diff] [blame] | 235 | struct task_struct *tsk) |
| 236 | { |
| 237 | struct vm_area_struct *vma; |
| 238 | int fault; |
| 239 | |
| 240 | vma = find_vma(mm, addr); |
| 241 | fault = VM_FAULT_BADMAP; |
| 242 | if (unlikely(!vma)) |
| 243 | goto out; |
| 244 | if (unlikely(vma->vm_start > addr)) |
| 245 | goto check_stack; |
| 246 | |
| 247 | /* |
| 248 | * Ok, we have a good vm_area for this memory access, so we can handle |
| 249 | * it. |
| 250 | */ |
| 251 | good_area: |
Will Deacon | db6f410 | 2013-07-19 15:37:12 +0100 | [diff] [blame] | 252 | /* |
| 253 | * Check that the permissions on the VMA allow for the fault which |
Catalin Marinas | cab15ce | 2016-08-11 18:44:50 +0100 | [diff] [blame] | 254 | * occurred. |
Will Deacon | db6f410 | 2013-07-19 15:37:12 +0100 | [diff] [blame] | 255 | */ |
| 256 | if (!(vma->vm_flags & vm_flags)) { |
Catalin Marinas | 1d18c47 | 2012-03-05 11:49:27 +0000 | [diff] [blame] | 257 | fault = VM_FAULT_BADACCESS; |
| 258 | goto out; |
| 259 | } |
| 260 | |
Kirill A. Shutemov | dcddffd | 2016-07-26 15:25:18 -0700 | [diff] [blame] | 261 | return handle_mm_fault(vma, addr & PAGE_MASK, mm_flags); |
Catalin Marinas | 1d18c47 | 2012-03-05 11:49:27 +0000 | [diff] [blame] | 262 | |
| 263 | check_stack: |
| 264 | if (vma->vm_flags & VM_GROWSDOWN && !expand_stack(vma, addr)) |
| 265 | goto good_area; |
| 266 | out: |
| 267 | return fault; |
| 268 | } |
| 269 | |
Mark Rutland | 541ec87 | 2016-05-31 12:33:03 +0100 | [diff] [blame] | 270 | static inline bool is_permission_fault(unsigned int esr) |
James Morse | 57f4959 | 2016-02-05 14:58:48 +0000 | [diff] [blame] | 271 | { |
Mark Rutland | 275f344 | 2016-05-31 12:33:01 +0100 | [diff] [blame] | 272 | unsigned int ec = ESR_ELx_EC(esr); |
James Morse | 57f4959 | 2016-02-05 14:58:48 +0000 | [diff] [blame] | 273 | unsigned int fsc_type = esr & ESR_ELx_FSC_TYPE; |
| 274 | |
Laura Abbott | 9adeb8e | 2016-08-09 18:25:26 -0700 | [diff] [blame] | 275 | return (ec == ESR_ELx_EC_DABT_CUR && fsc_type == ESR_ELx_FSC_PERM) || |
| 276 | (ec == ESR_ELx_EC_IABT_CUR && fsc_type == ESR_ELx_FSC_PERM); |
James Morse | 57f4959 | 2016-02-05 14:58:48 +0000 | [diff] [blame] | 277 | } |
| 278 | |
Mark Rutland | 541ec87 | 2016-05-31 12:33:03 +0100 | [diff] [blame] | 279 | static bool is_el0_instruction_abort(unsigned int esr) |
| 280 | { |
| 281 | return ESR_ELx_EC(esr) == ESR_ELx_EC_IABT_LOW; |
| 282 | } |
| 283 | |
Catalin Marinas | 1d18c47 | 2012-03-05 11:49:27 +0000 | [diff] [blame] | 284 | static int __kprobes do_page_fault(unsigned long addr, unsigned int esr, |
| 285 | struct pt_regs *regs) |
| 286 | { |
| 287 | struct task_struct *tsk; |
| 288 | struct mm_struct *mm; |
| 289 | int fault, sig, code; |
Catalin Marinas | cab15ce | 2016-08-11 18:44:50 +0100 | [diff] [blame] | 290 | unsigned long vm_flags = VM_READ | VM_WRITE; |
Will Deacon | db6f410 | 2013-07-19 15:37:12 +0100 | [diff] [blame] | 291 | unsigned int mm_flags = FAULT_FLAG_ALLOW_RETRY | FAULT_FLAG_KILLABLE; |
| 292 | |
Sandeepa Prabhu | 2dd0e8d | 2016-07-08 12:35:48 -0400 | [diff] [blame] | 293 | if (notify_page_fault(regs, esr)) |
| 294 | return 0; |
| 295 | |
Catalin Marinas | 1d18c47 | 2012-03-05 11:49:27 +0000 | [diff] [blame] | 296 | tsk = current; |
| 297 | mm = tsk->mm; |
| 298 | |
Catalin Marinas | 1d18c47 | 2012-03-05 11:49:27 +0000 | [diff] [blame] | 299 | /* |
| 300 | * If we're in an interrupt or have no user context, we must not take |
| 301 | * the fault. |
| 302 | */ |
David Hildenbrand | 70ffdb9 | 2015-05-11 17:52:11 +0200 | [diff] [blame] | 303 | if (faulthandler_disabled() || !mm) |
Catalin Marinas | 1d18c47 | 2012-03-05 11:49:27 +0000 | [diff] [blame] | 304 | goto no_context; |
| 305 | |
Johannes Weiner | 759496b | 2013-09-12 15:13:39 -0700 | [diff] [blame] | 306 | if (user_mode(regs)) |
| 307 | mm_flags |= FAULT_FLAG_USER; |
| 308 | |
Mark Rutland | 541ec87 | 2016-05-31 12:33:03 +0100 | [diff] [blame] | 309 | if (is_el0_instruction_abort(esr)) { |
Johannes Weiner | 759496b | 2013-09-12 15:13:39 -0700 | [diff] [blame] | 310 | vm_flags = VM_EXEC; |
Mark Rutland | aed40e0 | 2014-11-24 12:31:40 +0000 | [diff] [blame] | 311 | } else if ((esr & ESR_ELx_WNR) && !(esr & ESR_ELx_CM)) { |
Johannes Weiner | 759496b | 2013-09-12 15:13:39 -0700 | [diff] [blame] | 312 | vm_flags = VM_WRITE; |
| 313 | mm_flags |= FAULT_FLAG_WRITE; |
| 314 | } |
| 315 | |
Mark Rutland | 541ec87 | 2016-05-31 12:33:03 +0100 | [diff] [blame] | 316 | if (is_permission_fault(esr) && (addr < USER_DS)) { |
James Morse | e19a6ee | 2016-06-20 18:28:01 +0100 | [diff] [blame] | 317 | /* regs->orig_addr_limit may be 0 if we entered from EL0 */ |
| 318 | if (regs->orig_addr_limit == KERNEL_DS) |
Catalin Marinas | 70c8abc | 2016-02-19 14:28:58 +0000 | [diff] [blame] | 319 | die("Accessing user space memory with fs=KERNEL_DS", regs, esr); |
James Morse | 7054419 | 2016-02-05 14:58:50 +0000 | [diff] [blame] | 320 | |
Laura Abbott | 9adeb8e | 2016-08-09 18:25:26 -0700 | [diff] [blame] | 321 | if (is_el1_instruction_abort(esr)) |
| 322 | die("Attempting to execute userspace memory", regs, esr); |
| 323 | |
James Morse | 57f4959 | 2016-02-05 14:58:48 +0000 | [diff] [blame] | 324 | if (!search_exception_tables(regs->pc)) |
Catalin Marinas | 70c8abc | 2016-02-19 14:28:58 +0000 | [diff] [blame] | 325 | die("Accessing user space memory outside uaccess.h routines", regs, esr); |
James Morse | 57f4959 | 2016-02-05 14:58:48 +0000 | [diff] [blame] | 326 | } |
James Morse | 338d4f4 | 2015-07-22 19:05:54 +0100 | [diff] [blame] | 327 | |
| 328 | /* |
Catalin Marinas | 1d18c47 | 2012-03-05 11:49:27 +0000 | [diff] [blame] | 329 | * As per x86, we may deadlock here. However, since the kernel only |
| 330 | * validly references user space from well defined areas of the code, |
| 331 | * we can bug out early if this is from code which shouldn't. |
| 332 | */ |
| 333 | if (!down_read_trylock(&mm->mmap_sem)) { |
| 334 | if (!user_mode(regs) && !search_exception_tables(regs->pc)) |
| 335 | goto no_context; |
| 336 | retry: |
| 337 | down_read(&mm->mmap_sem); |
| 338 | } else { |
| 339 | /* |
| 340 | * The above down_read_trylock() might have succeeded in which |
| 341 | * case, we'll have missed the might_sleep() from down_read(). |
| 342 | */ |
| 343 | might_sleep(); |
| 344 | #ifdef CONFIG_DEBUG_VM |
| 345 | if (!user_mode(regs) && !search_exception_tables(regs->pc)) |
| 346 | goto no_context; |
| 347 | #endif |
| 348 | } |
| 349 | |
Will Deacon | db6f410 | 2013-07-19 15:37:12 +0100 | [diff] [blame] | 350 | fault = __do_page_fault(mm, addr, mm_flags, vm_flags, tsk); |
Catalin Marinas | 1d18c47 | 2012-03-05 11:49:27 +0000 | [diff] [blame] | 351 | |
| 352 | /* |
| 353 | * If we need to retry but a fatal signal is pending, handle the |
| 354 | * signal first. We do not need to release the mmap_sem because it |
| 355 | * would already be released in __lock_page_or_retry in mm/filemap.c. |
| 356 | */ |
| 357 | if ((fault & VM_FAULT_RETRY) && fatal_signal_pending(current)) |
| 358 | return 0; |
| 359 | |
| 360 | /* |
| 361 | * Major/minor page fault accounting is only done on the initial |
| 362 | * attempt. If we go through a retry, it is extremely likely that the |
| 363 | * page will be found in page cache at that point. |
| 364 | */ |
| 365 | |
| 366 | perf_sw_event(PERF_COUNT_SW_PAGE_FAULTS, 1, regs, addr); |
Will Deacon | db6f410 | 2013-07-19 15:37:12 +0100 | [diff] [blame] | 367 | if (mm_flags & FAULT_FLAG_ALLOW_RETRY) { |
Catalin Marinas | 1d18c47 | 2012-03-05 11:49:27 +0000 | [diff] [blame] | 368 | if (fault & VM_FAULT_MAJOR) { |
| 369 | tsk->maj_flt++; |
| 370 | perf_sw_event(PERF_COUNT_SW_PAGE_FAULTS_MAJ, 1, regs, |
| 371 | addr); |
| 372 | } else { |
| 373 | tsk->min_flt++; |
| 374 | perf_sw_event(PERF_COUNT_SW_PAGE_FAULTS_MIN, 1, regs, |
| 375 | addr); |
| 376 | } |
| 377 | if (fault & VM_FAULT_RETRY) { |
| 378 | /* |
| 379 | * Clear FAULT_FLAG_ALLOW_RETRY to avoid any risk of |
| 380 | * starvation. |
| 381 | */ |
Will Deacon | db6f410 | 2013-07-19 15:37:12 +0100 | [diff] [blame] | 382 | mm_flags &= ~FAULT_FLAG_ALLOW_RETRY; |
Mark Salyzyn | 569ba74 | 2015-09-21 21:39:50 +0100 | [diff] [blame] | 383 | mm_flags |= FAULT_FLAG_TRIED; |
Catalin Marinas | 1d18c47 | 2012-03-05 11:49:27 +0000 | [diff] [blame] | 384 | goto retry; |
| 385 | } |
| 386 | } |
| 387 | |
| 388 | up_read(&mm->mmap_sem); |
| 389 | |
| 390 | /* |
Jan Kara | 0e8fb93 | 2016-03-17 14:19:55 -0700 | [diff] [blame] | 391 | * Handle the "normal" case first - VM_FAULT_MAJOR |
Catalin Marinas | 1d18c47 | 2012-03-05 11:49:27 +0000 | [diff] [blame] | 392 | */ |
| 393 | if (likely(!(fault & (VM_FAULT_ERROR | VM_FAULT_BADMAP | |
| 394 | VM_FAULT_BADACCESS)))) |
| 395 | return 0; |
| 396 | |
Johannes Weiner | 8713410 | 2013-09-12 15:13:38 -0700 | [diff] [blame] | 397 | /* |
| 398 | * If we are in kernel mode at this point, we have no context to |
| 399 | * handle this fault with. |
| 400 | */ |
| 401 | if (!user_mode(regs)) |
| 402 | goto no_context; |
| 403 | |
Catalin Marinas | 1d18c47 | 2012-03-05 11:49:27 +0000 | [diff] [blame] | 404 | if (fault & VM_FAULT_OOM) { |
| 405 | /* |
| 406 | * We ran out of memory, call the OOM killer, and return to |
| 407 | * userspace (which will retry the fault, or kill us if we got |
| 408 | * oom-killed). |
| 409 | */ |
| 410 | pagefault_out_of_memory(); |
| 411 | return 0; |
| 412 | } |
| 413 | |
Catalin Marinas | 1d18c47 | 2012-03-05 11:49:27 +0000 | [diff] [blame] | 414 | if (fault & VM_FAULT_SIGBUS) { |
| 415 | /* |
| 416 | * We had some memory, but were unable to successfully fix up |
| 417 | * this page fault. |
| 418 | */ |
| 419 | sig = SIGBUS; |
| 420 | code = BUS_ADRERR; |
| 421 | } else { |
| 422 | /* |
| 423 | * Something tried to access memory that isn't in our memory |
| 424 | * map. |
| 425 | */ |
| 426 | sig = SIGSEGV; |
| 427 | code = fault == VM_FAULT_BADACCESS ? |
| 428 | SEGV_ACCERR : SEGV_MAPERR; |
| 429 | } |
| 430 | |
| 431 | __do_user_fault(tsk, addr, esr, sig, code, regs); |
| 432 | return 0; |
| 433 | |
| 434 | no_context: |
| 435 | __do_kernel_fault(mm, addr, esr, regs); |
| 436 | return 0; |
| 437 | } |
| 438 | |
| 439 | /* |
| 440 | * First Level Translation Fault Handler |
| 441 | * |
| 442 | * We enter here because the first level page table doesn't contain a valid |
| 443 | * entry for the address. |
| 444 | * |
| 445 | * If the address is in kernel space (>= TASK_SIZE), then we are probably |
| 446 | * faulting in the vmalloc() area. |
| 447 | * |
| 448 | * If the init_task's first level page tables contains the relevant entry, we |
| 449 | * copy the it to this task. If not, we send the process a signal, fixup the |
| 450 | * exception, or oops the kernel. |
| 451 | * |
| 452 | * NOTE! We MUST NOT take any locks for this case. We may be in an interrupt |
| 453 | * or a critical region, and should only copy the information from the master |
| 454 | * page table, nothing more. |
| 455 | */ |
| 456 | static int __kprobes do_translation_fault(unsigned long addr, |
| 457 | unsigned int esr, |
| 458 | struct pt_regs *regs) |
| 459 | { |
| 460 | if (addr < TASK_SIZE) |
| 461 | return do_page_fault(addr, esr, regs); |
| 462 | |
| 463 | do_bad_area(addr, esr, regs); |
| 464 | return 0; |
| 465 | } |
| 466 | |
EunTaik Lee | 52d7523 | 2016-02-16 04:44:35 +0000 | [diff] [blame] | 467 | static int do_alignment_fault(unsigned long addr, unsigned int esr, |
| 468 | struct pt_regs *regs) |
| 469 | { |
| 470 | do_bad_area(addr, esr, regs); |
| 471 | return 0; |
| 472 | } |
| 473 | |
Catalin Marinas | 1d18c47 | 2012-03-05 11:49:27 +0000 | [diff] [blame] | 474 | /* |
Catalin Marinas | 1d18c47 | 2012-03-05 11:49:27 +0000 | [diff] [blame] | 475 | * This abort handler always returns "fault". |
| 476 | */ |
| 477 | static int do_bad(unsigned long addr, unsigned int esr, struct pt_regs *regs) |
| 478 | { |
| 479 | return 1; |
| 480 | } |
| 481 | |
Mark Rutland | bbb1681 | 2016-06-13 17:57:02 +0100 | [diff] [blame] | 482 | static const struct fault_info { |
Catalin Marinas | 1d18c47 | 2012-03-05 11:49:27 +0000 | [diff] [blame] | 483 | int (*fn)(unsigned long addr, unsigned int esr, struct pt_regs *regs); |
| 484 | int sig; |
| 485 | int code; |
| 486 | const char *name; |
| 487 | } fault_info[] = { |
| 488 | { do_bad, SIGBUS, 0, "ttbr address size fault" }, |
| 489 | { do_bad, SIGBUS, 0, "level 1 address size fault" }, |
| 490 | { do_bad, SIGBUS, 0, "level 2 address size fault" }, |
| 491 | { do_bad, SIGBUS, 0, "level 3 address size fault" }, |
Will Deacon | 7f73f7a | 2014-11-21 14:22:22 +0000 | [diff] [blame] | 492 | { do_translation_fault, SIGSEGV, SEGV_MAPERR, "level 0 translation fault" }, |
Catalin Marinas | 1d18c47 | 2012-03-05 11:49:27 +0000 | [diff] [blame] | 493 | { do_translation_fault, SIGSEGV, SEGV_MAPERR, "level 1 translation fault" }, |
| 494 | { do_translation_fault, SIGSEGV, SEGV_MAPERR, "level 2 translation fault" }, |
| 495 | { do_page_fault, SIGSEGV, SEGV_MAPERR, "level 3 translation fault" }, |
Mark Rutland | c03784ee8 | 2015-11-23 15:09:36 +0000 | [diff] [blame] | 496 | { do_bad, SIGBUS, 0, "unknown 8" }, |
Steve Capper | 084bd29 | 2013-04-10 13:48:00 +0100 | [diff] [blame] | 497 | { do_page_fault, SIGSEGV, SEGV_ACCERR, "level 1 access flag fault" }, |
| 498 | { do_page_fault, SIGSEGV, SEGV_ACCERR, "level 2 access flag fault" }, |
Catalin Marinas | 1d18c47 | 2012-03-05 11:49:27 +0000 | [diff] [blame] | 499 | { do_page_fault, SIGSEGV, SEGV_ACCERR, "level 3 access flag fault" }, |
Mark Rutland | c03784ee8 | 2015-11-23 15:09:36 +0000 | [diff] [blame] | 500 | { do_bad, SIGBUS, 0, "unknown 12" }, |
Steve Capper | 084bd29 | 2013-04-10 13:48:00 +0100 | [diff] [blame] | 501 | { do_page_fault, SIGSEGV, SEGV_ACCERR, "level 1 permission fault" }, |
| 502 | { do_page_fault, SIGSEGV, SEGV_ACCERR, "level 2 permission fault" }, |
Catalin Marinas | 1d18c47 | 2012-03-05 11:49:27 +0000 | [diff] [blame] | 503 | { do_page_fault, SIGSEGV, SEGV_ACCERR, "level 3 permission fault" }, |
| 504 | { do_bad, SIGBUS, 0, "synchronous external abort" }, |
Mark Rutland | c03784ee8 | 2015-11-23 15:09:36 +0000 | [diff] [blame] | 505 | { do_bad, SIGBUS, 0, "unknown 17" }, |
Catalin Marinas | 1d18c47 | 2012-03-05 11:49:27 +0000 | [diff] [blame] | 506 | { do_bad, SIGBUS, 0, "unknown 18" }, |
| 507 | { do_bad, SIGBUS, 0, "unknown 19" }, |
| 508 | { do_bad, SIGBUS, 0, "synchronous abort (translation table walk)" }, |
| 509 | { do_bad, SIGBUS, 0, "synchronous abort (translation table walk)" }, |
| 510 | { do_bad, SIGBUS, 0, "synchronous abort (translation table walk)" }, |
| 511 | { do_bad, SIGBUS, 0, "synchronous abort (translation table walk)" }, |
| 512 | { do_bad, SIGBUS, 0, "synchronous parity error" }, |
Mark Rutland | c03784ee8 | 2015-11-23 15:09:36 +0000 | [diff] [blame] | 513 | { do_bad, SIGBUS, 0, "unknown 25" }, |
Catalin Marinas | 1d18c47 | 2012-03-05 11:49:27 +0000 | [diff] [blame] | 514 | { do_bad, SIGBUS, 0, "unknown 26" }, |
| 515 | { do_bad, SIGBUS, 0, "unknown 27" }, |
Mark Rutland | c03784ee8 | 2015-11-23 15:09:36 +0000 | [diff] [blame] | 516 | { do_bad, SIGBUS, 0, "synchronous parity error (translation table walk)" }, |
| 517 | { do_bad, SIGBUS, 0, "synchronous parity error (translation table walk)" }, |
| 518 | { do_bad, SIGBUS, 0, "synchronous parity error (translation table walk)" }, |
| 519 | { do_bad, SIGBUS, 0, "synchronous parity error (translation table walk)" }, |
Catalin Marinas | 1d18c47 | 2012-03-05 11:49:27 +0000 | [diff] [blame] | 520 | { do_bad, SIGBUS, 0, "unknown 32" }, |
EunTaik Lee | 52d7523 | 2016-02-16 04:44:35 +0000 | [diff] [blame] | 521 | { do_alignment_fault, SIGBUS, BUS_ADRALN, "alignment fault" }, |
Mark Rutland | c03784ee8 | 2015-11-23 15:09:36 +0000 | [diff] [blame] | 522 | { do_bad, SIGBUS, 0, "unknown 34" }, |
Catalin Marinas | 1d18c47 | 2012-03-05 11:49:27 +0000 | [diff] [blame] | 523 | { do_bad, SIGBUS, 0, "unknown 35" }, |
| 524 | { do_bad, SIGBUS, 0, "unknown 36" }, |
| 525 | { do_bad, SIGBUS, 0, "unknown 37" }, |
| 526 | { do_bad, SIGBUS, 0, "unknown 38" }, |
| 527 | { do_bad, SIGBUS, 0, "unknown 39" }, |
| 528 | { do_bad, SIGBUS, 0, "unknown 40" }, |
| 529 | { do_bad, SIGBUS, 0, "unknown 41" }, |
| 530 | { do_bad, SIGBUS, 0, "unknown 42" }, |
| 531 | { do_bad, SIGBUS, 0, "unknown 43" }, |
| 532 | { do_bad, SIGBUS, 0, "unknown 44" }, |
| 533 | { do_bad, SIGBUS, 0, "unknown 45" }, |
| 534 | { do_bad, SIGBUS, 0, "unknown 46" }, |
| 535 | { do_bad, SIGBUS, 0, "unknown 47" }, |
Mark Rutland | c03784ee8 | 2015-11-23 15:09:36 +0000 | [diff] [blame] | 536 | { do_bad, SIGBUS, 0, "TLB conflict abort" }, |
Catalin Marinas | 1d18c47 | 2012-03-05 11:49:27 +0000 | [diff] [blame] | 537 | { do_bad, SIGBUS, 0, "unknown 49" }, |
| 538 | { do_bad, SIGBUS, 0, "unknown 50" }, |
| 539 | { do_bad, SIGBUS, 0, "unknown 51" }, |
| 540 | { do_bad, SIGBUS, 0, "implementation fault (lockdown abort)" }, |
Mark Rutland | c03784ee8 | 2015-11-23 15:09:36 +0000 | [diff] [blame] | 541 | { do_bad, SIGBUS, 0, "implementation fault (unsupported exclusive)" }, |
Catalin Marinas | 1d18c47 | 2012-03-05 11:49:27 +0000 | [diff] [blame] | 542 | { do_bad, SIGBUS, 0, "unknown 54" }, |
| 543 | { do_bad, SIGBUS, 0, "unknown 55" }, |
| 544 | { do_bad, SIGBUS, 0, "unknown 56" }, |
| 545 | { do_bad, SIGBUS, 0, "unknown 57" }, |
Mark Rutland | c03784ee8 | 2015-11-23 15:09:36 +0000 | [diff] [blame] | 546 | { do_bad, SIGBUS, 0, "unknown 58" }, |
Catalin Marinas | 1d18c47 | 2012-03-05 11:49:27 +0000 | [diff] [blame] | 547 | { do_bad, SIGBUS, 0, "unknown 59" }, |
| 548 | { do_bad, SIGBUS, 0, "unknown 60" }, |
Mark Rutland | c03784ee8 | 2015-11-23 15:09:36 +0000 | [diff] [blame] | 549 | { do_bad, SIGBUS, 0, "section domain fault" }, |
| 550 | { do_bad, SIGBUS, 0, "page domain fault" }, |
Catalin Marinas | 1d18c47 | 2012-03-05 11:49:27 +0000 | [diff] [blame] | 551 | { do_bad, SIGBUS, 0, "unknown 63" }, |
| 552 | }; |
| 553 | |
Catalin Marinas | 3495386 | 2012-10-24 16:34:02 +0100 | [diff] [blame] | 554 | static const char *fault_name(unsigned int esr) |
| 555 | { |
| 556 | const struct fault_info *inf = fault_info + (esr & 63); |
| 557 | return inf->name; |
| 558 | } |
| 559 | |
Catalin Marinas | 1d18c47 | 2012-03-05 11:49:27 +0000 | [diff] [blame] | 560 | /* |
| 561 | * Dispatch a data abort to the relevant handler. |
| 562 | */ |
| 563 | asmlinkage void __exception do_mem_abort(unsigned long addr, unsigned int esr, |
| 564 | struct pt_regs *regs) |
| 565 | { |
| 566 | const struct fault_info *inf = fault_info + (esr & 63); |
| 567 | struct siginfo info; |
| 568 | |
| 569 | if (!inf->fn(addr, esr, regs)) |
| 570 | return; |
| 571 | |
| 572 | pr_alert("Unhandled fault: %s (0x%08x) at 0x%016lx\n", |
| 573 | inf->name, esr, addr); |
| 574 | |
| 575 | info.si_signo = inf->sig; |
| 576 | info.si_errno = 0; |
| 577 | info.si_code = inf->code; |
| 578 | info.si_addr = (void __user *)addr; |
| 579 | arm64_notify_die("", regs, &info, esr); |
| 580 | } |
| 581 | |
| 582 | /* |
| 583 | * Handle stack alignment exceptions. |
| 584 | */ |
| 585 | asmlinkage void __exception do_sp_pc_abort(unsigned long addr, |
| 586 | unsigned int esr, |
| 587 | struct pt_regs *regs) |
| 588 | { |
| 589 | struct siginfo info; |
Vladimir Murzin | 9e793ab | 2015-06-19 15:28:16 +0100 | [diff] [blame] | 590 | struct task_struct *tsk = current; |
| 591 | |
| 592 | if (show_unhandled_signals && unhandled_signal(tsk, SIGBUS)) |
| 593 | pr_info_ratelimited("%s[%d]: %s exception: pc=%p sp=%p\n", |
| 594 | tsk->comm, task_pid_nr(tsk), |
| 595 | esr_get_class_string(esr), (void *)regs->pc, |
| 596 | (void *)regs->sp); |
Catalin Marinas | 1d18c47 | 2012-03-05 11:49:27 +0000 | [diff] [blame] | 597 | |
| 598 | info.si_signo = SIGBUS; |
| 599 | info.si_errno = 0; |
| 600 | info.si_code = BUS_ADRALN; |
| 601 | info.si_addr = (void __user *)addr; |
Vladimir Murzin | 9e793ab | 2015-06-19 15:28:16 +0100 | [diff] [blame] | 602 | arm64_notify_die("Oops - SP/PC alignment exception", regs, &info, esr); |
Catalin Marinas | 1d18c47 | 2012-03-05 11:49:27 +0000 | [diff] [blame] | 603 | } |
| 604 | |
Dave P Martin | 9fb7410 | 2015-07-24 16:37:48 +0100 | [diff] [blame] | 605 | int __init early_brk64(unsigned long addr, unsigned int esr, |
| 606 | struct pt_regs *regs); |
| 607 | |
| 608 | /* |
| 609 | * __refdata because early_brk64 is __init, but the reference to it is |
| 610 | * clobbered at arch_initcall time. |
| 611 | * See traps.c and debug-monitors.c:debug_traps_init(). |
| 612 | */ |
| 613 | static struct fault_info __refdata debug_fault_info[] = { |
Catalin Marinas | 1d18c47 | 2012-03-05 11:49:27 +0000 | [diff] [blame] | 614 | { do_bad, SIGTRAP, TRAP_HWBKPT, "hardware breakpoint" }, |
| 615 | { do_bad, SIGTRAP, TRAP_HWBKPT, "hardware single-step" }, |
| 616 | { do_bad, SIGTRAP, TRAP_HWBKPT, "hardware watchpoint" }, |
| 617 | { do_bad, SIGBUS, 0, "unknown 3" }, |
| 618 | { do_bad, SIGTRAP, TRAP_BRKPT, "aarch32 BKPT" }, |
| 619 | { do_bad, SIGTRAP, 0, "aarch32 vector catch" }, |
Dave P Martin | 9fb7410 | 2015-07-24 16:37:48 +0100 | [diff] [blame] | 620 | { early_brk64, SIGTRAP, TRAP_BRKPT, "aarch64 BRK" }, |
Catalin Marinas | 1d18c47 | 2012-03-05 11:49:27 +0000 | [diff] [blame] | 621 | { do_bad, SIGBUS, 0, "unknown 7" }, |
| 622 | }; |
| 623 | |
| 624 | void __init hook_debug_fault_code(int nr, |
| 625 | int (*fn)(unsigned long, unsigned int, struct pt_regs *), |
| 626 | int sig, int code, const char *name) |
| 627 | { |
| 628 | BUG_ON(nr < 0 || nr >= ARRAY_SIZE(debug_fault_info)); |
| 629 | |
| 630 | debug_fault_info[nr].fn = fn; |
| 631 | debug_fault_info[nr].sig = sig; |
| 632 | debug_fault_info[nr].code = code; |
| 633 | debug_fault_info[nr].name = name; |
| 634 | } |
| 635 | |
| 636 | asmlinkage int __exception do_debug_exception(unsigned long addr, |
| 637 | unsigned int esr, |
| 638 | struct pt_regs *regs) |
| 639 | { |
| 640 | const struct fault_info *inf = debug_fault_info + DBG_ESR_EVT(esr); |
| 641 | struct siginfo info; |
James Morse | 6afedcd | 2016-04-13 13:40:00 +0100 | [diff] [blame] | 642 | int rv; |
Catalin Marinas | 1d18c47 | 2012-03-05 11:49:27 +0000 | [diff] [blame] | 643 | |
James Morse | 6afedcd | 2016-04-13 13:40:00 +0100 | [diff] [blame] | 644 | /* |
| 645 | * Tell lockdep we disabled irqs in entry.S. Do nothing if they were |
| 646 | * already disabled to preserve the last enabled/disabled addresses. |
| 647 | */ |
| 648 | if (interrupts_enabled(regs)) |
| 649 | trace_hardirqs_off(); |
Catalin Marinas | 1d18c47 | 2012-03-05 11:49:27 +0000 | [diff] [blame] | 650 | |
James Morse | 6afedcd | 2016-04-13 13:40:00 +0100 | [diff] [blame] | 651 | if (!inf->fn(addr, esr, regs)) { |
| 652 | rv = 1; |
| 653 | } else { |
| 654 | pr_alert("Unhandled debug exception: %s (0x%08x) at 0x%016lx\n", |
| 655 | inf->name, esr, addr); |
Catalin Marinas | 1d18c47 | 2012-03-05 11:49:27 +0000 | [diff] [blame] | 656 | |
James Morse | 6afedcd | 2016-04-13 13:40:00 +0100 | [diff] [blame] | 657 | info.si_signo = inf->sig; |
| 658 | info.si_errno = 0; |
| 659 | info.si_code = inf->code; |
| 660 | info.si_addr = (void __user *)addr; |
| 661 | arm64_notify_die("", regs, &info, 0); |
| 662 | rv = 0; |
| 663 | } |
Catalin Marinas | 1d18c47 | 2012-03-05 11:49:27 +0000 | [diff] [blame] | 664 | |
James Morse | 6afedcd | 2016-04-13 13:40:00 +0100 | [diff] [blame] | 665 | if (interrupts_enabled(regs)) |
| 666 | trace_hardirqs_on(); |
| 667 | |
| 668 | return rv; |
Catalin Marinas | 1d18c47 | 2012-03-05 11:49:27 +0000 | [diff] [blame] | 669 | } |
Sandeepa Prabhu | 2dd0e8d | 2016-07-08 12:35:48 -0400 | [diff] [blame] | 670 | NOKPROBE_SYMBOL(do_debug_exception); |
James Morse | 338d4f4 | 2015-07-22 19:05:54 +0100 | [diff] [blame] | 671 | |
| 672 | #ifdef CONFIG_ARM64_PAN |
Suzuki K. Poulose | dbb4e15 | 2015-10-19 14:24:50 +0100 | [diff] [blame] | 673 | void cpu_enable_pan(void *__unused) |
James Morse | 338d4f4 | 2015-07-22 19:05:54 +0100 | [diff] [blame] | 674 | { |
| 675 | config_sctlr_el1(SCTLR_EL1_SPAN, 0); |
| 676 | } |
| 677 | #endif /* CONFIG_ARM64_PAN */ |
James Morse | 57f4959 | 2016-02-05 14:58:48 +0000 | [diff] [blame] | 678 | |
| 679 | #ifdef CONFIG_ARM64_UAO |
| 680 | /* |
| 681 | * Kernel threads have fs=KERNEL_DS by default, and don't need to call |
| 682 | * set_fs(), devtmpfs in particular relies on this behaviour. |
| 683 | * We need to enable the feature at runtime (instead of adding it to |
| 684 | * PSR_MODE_EL1h) as the feature may not be implemented by the cpu. |
| 685 | */ |
| 686 | void cpu_enable_uao(void *__unused) |
| 687 | { |
| 688 | asm(SET_PSTATE_UAO(1)); |
| 689 | } |
| 690 | #endif /* CONFIG_ARM64_UAO */ |