xref: /openbmc/linux/arch/arm64/mm/fault.c (revision 089a49b6)
1 /*
2  * Based on arch/arm/mm/fault.c
3  *
4  * Copyright (C) 1995  Linus Torvalds
5  * Copyright (C) 1995-2004 Russell King
6  * Copyright (C) 2012 ARM Ltd.
7  *
8  * This program is free software; you can redistribute it and/or modify
9  * it under the terms of the GNU General Public License version 2 as
10  * published by the Free Software Foundation.
11  *
12  * This program is distributed in the hope that it will be useful,
13  * but WITHOUT ANY WARRANTY; without even the implied warranty of
14  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
15  * GNU General Public License for more details.
16  *
17  * You should have received a copy of the GNU General Public License
18  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
19  */
20 
21 #include <linux/module.h>
22 #include <linux/signal.h>
23 #include <linux/mm.h>
24 #include <linux/hardirq.h>
25 #include <linux/init.h>
26 #include <linux/kprobes.h>
27 #include <linux/uaccess.h>
28 #include <linux/page-flags.h>
29 #include <linux/sched.h>
30 #include <linux/highmem.h>
31 #include <linux/perf_event.h>
32 
33 #include <asm/exception.h>
34 #include <asm/debug-monitors.h>
35 #include <asm/system_misc.h>
36 #include <asm/pgtable.h>
37 #include <asm/tlbflush.h>
38 
39 static const char *fault_name(unsigned int esr);
40 
41 /*
42  * Dump out the page tables associated with 'addr' in mm 'mm'.
43  */
44 void show_pte(struct mm_struct *mm, unsigned long addr)
45 {
46 	pgd_t *pgd;
47 
48 	if (!mm)
49 		mm = &init_mm;
50 
51 	pr_alert("pgd = %p\n", mm->pgd);
52 	pgd = pgd_offset(mm, addr);
53 	pr_alert("[%08lx] *pgd=%016llx", addr, pgd_val(*pgd));
54 
55 	do {
56 		pud_t *pud;
57 		pmd_t *pmd;
58 		pte_t *pte;
59 
60 		if (pgd_none(*pgd) || pgd_bad(*pgd))
61 			break;
62 
63 		pud = pud_offset(pgd, addr);
64 		if (pud_none(*pud) || pud_bad(*pud))
65 			break;
66 
67 		pmd = pmd_offset(pud, addr);
68 		printk(", *pmd=%016llx", pmd_val(*pmd));
69 		if (pmd_none(*pmd) || pmd_bad(*pmd))
70 			break;
71 
72 		pte = pte_offset_map(pmd, addr);
73 		printk(", *pte=%016llx", pte_val(*pte));
74 		pte_unmap(pte);
75 	} while(0);
76 
77 	printk("\n");
78 }
79 
80 /*
81  * The kernel tried to access some page that wasn't present.
82  */
83 static void __do_kernel_fault(struct mm_struct *mm, unsigned long addr,
84 			      unsigned int esr, struct pt_regs *regs)
85 {
86 	/*
87 	 * Are we prepared to handle this kernel fault?
88 	 */
89 	if (fixup_exception(regs))
90 		return;
91 
92 	/*
93 	 * No handler, we'll have to terminate things with extreme prejudice.
94 	 */
95 	bust_spinlocks(1);
96 	pr_alert("Unable to handle kernel %s at virtual address %08lx\n",
97 		 (addr < PAGE_SIZE) ? "NULL pointer dereference" :
98 		 "paging request", addr);
99 
100 	show_pte(mm, addr);
101 	die("Oops", regs, esr);
102 	bust_spinlocks(0);
103 	do_exit(SIGKILL);
104 }
105 
106 /*
107  * Something tried to access memory that isn't in our memory map. User mode
108  * accesses just cause a SIGSEGV
109  */
110 static void __do_user_fault(struct task_struct *tsk, unsigned long addr,
111 			    unsigned int esr, unsigned int sig, int code,
112 			    struct pt_regs *regs)
113 {
114 	struct siginfo si;
115 
116 	if (show_unhandled_signals && unhandled_signal(tsk, sig) &&
117 	    printk_ratelimit()) {
118 		pr_info("%s[%d]: unhandled %s (%d) at 0x%08lx, esr 0x%03x\n",
119 			tsk->comm, task_pid_nr(tsk), fault_name(esr), sig,
120 			addr, esr);
121 		show_pte(tsk->mm, addr);
122 		show_regs(regs);
123 	}
124 
125 	tsk->thread.fault_address = addr;
126 	si.si_signo = sig;
127 	si.si_errno = 0;
128 	si.si_code = code;
129 	si.si_addr = (void __user *)addr;
130 	force_sig_info(sig, &si, tsk);
131 }
132 
133 static void do_bad_area(unsigned long addr, unsigned int esr, struct pt_regs *regs)
134 {
135 	struct task_struct *tsk = current;
136 	struct mm_struct *mm = tsk->active_mm;
137 
138 	/*
139 	 * If we are in kernel mode at this point, we have no context to
140 	 * handle this fault with.
141 	 */
142 	if (user_mode(regs))
143 		__do_user_fault(tsk, addr, esr, SIGSEGV, SEGV_MAPERR, regs);
144 	else
145 		__do_kernel_fault(mm, addr, esr, regs);
146 }
147 
148 #define VM_FAULT_BADMAP		0x010000
149 #define VM_FAULT_BADACCESS	0x020000
150 
151 #define ESR_WRITE		(1 << 6)
152 #define ESR_CM			(1 << 8)
153 #define ESR_LNX_EXEC		(1 << 24)
154 
155 static int __do_page_fault(struct mm_struct *mm, unsigned long addr,
156 			   unsigned int mm_flags, unsigned long vm_flags,
157 			   struct task_struct *tsk)
158 {
159 	struct vm_area_struct *vma;
160 	int fault;
161 
162 	vma = find_vma(mm, addr);
163 	fault = VM_FAULT_BADMAP;
164 	if (unlikely(!vma))
165 		goto out;
166 	if (unlikely(vma->vm_start > addr))
167 		goto check_stack;
168 
169 	/*
170 	 * Ok, we have a good vm_area for this memory access, so we can handle
171 	 * it.
172 	 */
173 good_area:
174 	/*
175 	 * Check that the permissions on the VMA allow for the fault which
176 	 * occurred. If we encountered a write or exec fault, we must have
177 	 * appropriate permissions, otherwise we allow any permission.
178 	 */
179 	if (!(vma->vm_flags & vm_flags)) {
180 		fault = VM_FAULT_BADACCESS;
181 		goto out;
182 	}
183 
184 	return handle_mm_fault(mm, vma, addr & PAGE_MASK, mm_flags);
185 
186 check_stack:
187 	if (vma->vm_flags & VM_GROWSDOWN && !expand_stack(vma, addr))
188 		goto good_area;
189 out:
190 	return fault;
191 }
192 
193 static int __kprobes do_page_fault(unsigned long addr, unsigned int esr,
194 				   struct pt_regs *regs)
195 {
196 	struct task_struct *tsk;
197 	struct mm_struct *mm;
198 	int fault, sig, code;
199 	unsigned long vm_flags = VM_READ | VM_WRITE | VM_EXEC;
200 	unsigned int mm_flags = FAULT_FLAG_ALLOW_RETRY | FAULT_FLAG_KILLABLE;
201 
202 	tsk = current;
203 	mm  = tsk->mm;
204 
205 	/* Enable interrupts if they were enabled in the parent context. */
206 	if (interrupts_enabled(regs))
207 		local_irq_enable();
208 
209 	/*
210 	 * If we're in an interrupt or have no user context, we must not take
211 	 * the fault.
212 	 */
213 	if (in_atomic() || !mm)
214 		goto no_context;
215 
216 	if (user_mode(regs))
217 		mm_flags |= FAULT_FLAG_USER;
218 
219 	if (esr & ESR_LNX_EXEC) {
220 		vm_flags = VM_EXEC;
221 	} else if ((esr & ESR_WRITE) && !(esr & ESR_CM)) {
222 		vm_flags = VM_WRITE;
223 		mm_flags |= FAULT_FLAG_WRITE;
224 	}
225 
226 	/*
227 	 * As per x86, we may deadlock here. However, since the kernel only
228 	 * validly references user space from well defined areas of the code,
229 	 * we can bug out early if this is from code which shouldn't.
230 	 */
231 	if (!down_read_trylock(&mm->mmap_sem)) {
232 		if (!user_mode(regs) && !search_exception_tables(regs->pc))
233 			goto no_context;
234 retry:
235 		down_read(&mm->mmap_sem);
236 	} else {
237 		/*
238 		 * The above down_read_trylock() might have succeeded in which
239 		 * case, we'll have missed the might_sleep() from down_read().
240 		 */
241 		might_sleep();
242 #ifdef CONFIG_DEBUG_VM
243 		if (!user_mode(regs) && !search_exception_tables(regs->pc))
244 			goto no_context;
245 #endif
246 	}
247 
248 	fault = __do_page_fault(mm, addr, mm_flags, vm_flags, tsk);
249 
250 	/*
251 	 * If we need to retry but a fatal signal is pending, handle the
252 	 * signal first. We do not need to release the mmap_sem because it
253 	 * would already be released in __lock_page_or_retry in mm/filemap.c.
254 	 */
255 	if ((fault & VM_FAULT_RETRY) && fatal_signal_pending(current))
256 		return 0;
257 
258 	/*
259 	 * Major/minor page fault accounting is only done on the initial
260 	 * attempt. If we go through a retry, it is extremely likely that the
261 	 * page will be found in page cache at that point.
262 	 */
263 
264 	perf_sw_event(PERF_COUNT_SW_PAGE_FAULTS, 1, regs, addr);
265 	if (mm_flags & FAULT_FLAG_ALLOW_RETRY) {
266 		if (fault & VM_FAULT_MAJOR) {
267 			tsk->maj_flt++;
268 			perf_sw_event(PERF_COUNT_SW_PAGE_FAULTS_MAJ, 1, regs,
269 				      addr);
270 		} else {
271 			tsk->min_flt++;
272 			perf_sw_event(PERF_COUNT_SW_PAGE_FAULTS_MIN, 1, regs,
273 				      addr);
274 		}
275 		if (fault & VM_FAULT_RETRY) {
276 			/*
277 			 * Clear FAULT_FLAG_ALLOW_RETRY to avoid any risk of
278 			 * starvation.
279 			 */
280 			mm_flags &= ~FAULT_FLAG_ALLOW_RETRY;
281 			goto retry;
282 		}
283 	}
284 
285 	up_read(&mm->mmap_sem);
286 
287 	/*
288 	 * Handle the "normal" case first - VM_FAULT_MAJOR / VM_FAULT_MINOR
289 	 */
290 	if (likely(!(fault & (VM_FAULT_ERROR | VM_FAULT_BADMAP |
291 			      VM_FAULT_BADACCESS))))
292 		return 0;
293 
294 	/*
295 	 * If we are in kernel mode at this point, we have no context to
296 	 * handle this fault with.
297 	 */
298 	if (!user_mode(regs))
299 		goto no_context;
300 
301 	if (fault & VM_FAULT_OOM) {
302 		/*
303 		 * We ran out of memory, call the OOM killer, and return to
304 		 * userspace (which will retry the fault, or kill us if we got
305 		 * oom-killed).
306 		 */
307 		pagefault_out_of_memory();
308 		return 0;
309 	}
310 
311 	if (fault & VM_FAULT_SIGBUS) {
312 		/*
313 		 * We had some memory, but were unable to successfully fix up
314 		 * this page fault.
315 		 */
316 		sig = SIGBUS;
317 		code = BUS_ADRERR;
318 	} else {
319 		/*
320 		 * Something tried to access memory that isn't in our memory
321 		 * map.
322 		 */
323 		sig = SIGSEGV;
324 		code = fault == VM_FAULT_BADACCESS ?
325 			SEGV_ACCERR : SEGV_MAPERR;
326 	}
327 
328 	__do_user_fault(tsk, addr, esr, sig, code, regs);
329 	return 0;
330 
331 no_context:
332 	__do_kernel_fault(mm, addr, esr, regs);
333 	return 0;
334 }
335 
336 /*
337  * First Level Translation Fault Handler
338  *
339  * We enter here because the first level page table doesn't contain a valid
340  * entry for the address.
341  *
342  * If the address is in kernel space (>= TASK_SIZE), then we are probably
343  * faulting in the vmalloc() area.
344  *
345  * If the init_task's first level page tables contains the relevant entry, we
346  * copy the it to this task.  If not, we send the process a signal, fixup the
347  * exception, or oops the kernel.
348  *
349  * NOTE! We MUST NOT take any locks for this case. We may be in an interrupt
350  * or a critical region, and should only copy the information from the master
351  * page table, nothing more.
352  */
353 static int __kprobes do_translation_fault(unsigned long addr,
354 					  unsigned int esr,
355 					  struct pt_regs *regs)
356 {
357 	if (addr < TASK_SIZE)
358 		return do_page_fault(addr, esr, regs);
359 
360 	do_bad_area(addr, esr, regs);
361 	return 0;
362 }
363 
364 /*
365  * This abort handler always returns "fault".
366  */
367 static int do_bad(unsigned long addr, unsigned int esr, struct pt_regs *regs)
368 {
369 	return 1;
370 }
371 
372 static struct fault_info {
373 	int	(*fn)(unsigned long addr, unsigned int esr, struct pt_regs *regs);
374 	int	sig;
375 	int	code;
376 	const char *name;
377 } fault_info[] = {
378 	{ do_bad,		SIGBUS,  0,		"ttbr address size fault"	},
379 	{ do_bad,		SIGBUS,  0,		"level 1 address size fault"	},
380 	{ do_bad,		SIGBUS,  0,		"level 2 address size fault"	},
381 	{ do_bad,		SIGBUS,  0,		"level 3 address size fault"	},
382 	{ do_translation_fault,	SIGSEGV, SEGV_MAPERR,	"input address range fault"	},
383 	{ do_translation_fault,	SIGSEGV, SEGV_MAPERR,	"level 1 translation fault"	},
384 	{ do_translation_fault,	SIGSEGV, SEGV_MAPERR,	"level 2 translation fault"	},
385 	{ do_page_fault,	SIGSEGV, SEGV_MAPERR,	"level 3 translation fault"	},
386 	{ do_bad,		SIGBUS,  0,		"reserved access flag fault"	},
387 	{ do_page_fault,	SIGSEGV, SEGV_ACCERR,	"level 1 access flag fault"	},
388 	{ do_page_fault,	SIGSEGV, SEGV_ACCERR,	"level 2 access flag fault"	},
389 	{ do_page_fault,	SIGSEGV, SEGV_ACCERR,	"level 3 access flag fault"	},
390 	{ do_bad,		SIGBUS,  0,		"reserved permission fault"	},
391 	{ do_page_fault,	SIGSEGV, SEGV_ACCERR,	"level 1 permission fault"	},
392 	{ do_page_fault,	SIGSEGV, SEGV_ACCERR,	"level 2 permission fault"	},
393 	{ do_page_fault,	SIGSEGV, SEGV_ACCERR,	"level 3 permission fault"	},
394 	{ do_bad,		SIGBUS,  0,		"synchronous external abort"	},
395 	{ do_bad,		SIGBUS,  0,		"asynchronous external abort"	},
396 	{ do_bad,		SIGBUS,  0,		"unknown 18"			},
397 	{ do_bad,		SIGBUS,  0,		"unknown 19"			},
398 	{ do_bad,		SIGBUS,  0,		"synchronous abort (translation table walk)" },
399 	{ do_bad,		SIGBUS,  0,		"synchronous abort (translation table walk)" },
400 	{ do_bad,		SIGBUS,  0,		"synchronous abort (translation table walk)" },
401 	{ do_bad,		SIGBUS,  0,		"synchronous abort (translation table walk)" },
402 	{ do_bad,		SIGBUS,  0,		"synchronous parity error"	},
403 	{ do_bad,		SIGBUS,  0,		"asynchronous parity error"	},
404 	{ do_bad,		SIGBUS,  0,		"unknown 26"			},
405 	{ do_bad,		SIGBUS,  0,		"unknown 27"			},
406 	{ do_bad,		SIGBUS,  0,		"synchronous parity error (translation table walk" },
407 	{ do_bad,		SIGBUS,  0,		"synchronous parity error (translation table walk" },
408 	{ do_bad,		SIGBUS,  0,		"synchronous parity error (translation table walk" },
409 	{ do_bad,		SIGBUS,  0,		"synchronous parity error (translation table walk" },
410 	{ do_bad,		SIGBUS,  0,		"unknown 32"			},
411 	{ do_bad,		SIGBUS,  BUS_ADRALN,	"alignment fault"		},
412 	{ do_bad,		SIGBUS,  0,		"debug event"			},
413 	{ do_bad,		SIGBUS,  0,		"unknown 35"			},
414 	{ do_bad,		SIGBUS,  0,		"unknown 36"			},
415 	{ do_bad,		SIGBUS,  0,		"unknown 37"			},
416 	{ do_bad,		SIGBUS,  0,		"unknown 38"			},
417 	{ do_bad,		SIGBUS,  0,		"unknown 39"			},
418 	{ do_bad,		SIGBUS,  0,		"unknown 40"			},
419 	{ do_bad,		SIGBUS,  0,		"unknown 41"			},
420 	{ do_bad,		SIGBUS,  0,		"unknown 42"			},
421 	{ do_bad,		SIGBUS,  0,		"unknown 43"			},
422 	{ do_bad,		SIGBUS,  0,		"unknown 44"			},
423 	{ do_bad,		SIGBUS,  0,		"unknown 45"			},
424 	{ do_bad,		SIGBUS,  0,		"unknown 46"			},
425 	{ do_bad,		SIGBUS,  0,		"unknown 47"			},
426 	{ do_bad,		SIGBUS,  0,		"unknown 48"			},
427 	{ do_bad,		SIGBUS,  0,		"unknown 49"			},
428 	{ do_bad,		SIGBUS,  0,		"unknown 50"			},
429 	{ do_bad,		SIGBUS,  0,		"unknown 51"			},
430 	{ do_bad,		SIGBUS,  0,		"implementation fault (lockdown abort)" },
431 	{ do_bad,		SIGBUS,  0,		"unknown 53"			},
432 	{ do_bad,		SIGBUS,  0,		"unknown 54"			},
433 	{ do_bad,		SIGBUS,  0,		"unknown 55"			},
434 	{ do_bad,		SIGBUS,  0,		"unknown 56"			},
435 	{ do_bad,		SIGBUS,  0,		"unknown 57"			},
436 	{ do_bad,		SIGBUS,  0,		"implementation fault (coprocessor abort)" },
437 	{ do_bad,		SIGBUS,  0,		"unknown 59"			},
438 	{ do_bad,		SIGBUS,  0,		"unknown 60"			},
439 	{ do_bad,		SIGBUS,  0,		"unknown 61"			},
440 	{ do_bad,		SIGBUS,  0,		"unknown 62"			},
441 	{ do_bad,		SIGBUS,  0,		"unknown 63"			},
442 };
443 
444 static const char *fault_name(unsigned int esr)
445 {
446 	const struct fault_info *inf = fault_info + (esr & 63);
447 	return inf->name;
448 }
449 
450 /*
451  * Dispatch a data abort to the relevant handler.
452  */
453 asmlinkage void __exception do_mem_abort(unsigned long addr, unsigned int esr,
454 					 struct pt_regs *regs)
455 {
456 	const struct fault_info *inf = fault_info + (esr & 63);
457 	struct siginfo info;
458 
459 	if (!inf->fn(addr, esr, regs))
460 		return;
461 
462 	pr_alert("Unhandled fault: %s (0x%08x) at 0x%016lx\n",
463 		 inf->name, esr, addr);
464 
465 	info.si_signo = inf->sig;
466 	info.si_errno = 0;
467 	info.si_code  = inf->code;
468 	info.si_addr  = (void __user *)addr;
469 	arm64_notify_die("", regs, &info, esr);
470 }
471 
472 /*
473  * Handle stack alignment exceptions.
474  */
475 asmlinkage void __exception do_sp_pc_abort(unsigned long addr,
476 					   unsigned int esr,
477 					   struct pt_regs *regs)
478 {
479 	struct siginfo info;
480 
481 	info.si_signo = SIGBUS;
482 	info.si_errno = 0;
483 	info.si_code  = BUS_ADRALN;
484 	info.si_addr  = (void __user *)addr;
485 	arm64_notify_die("", regs, &info, esr);
486 }
487 
488 static struct fault_info debug_fault_info[] = {
489 	{ do_bad,	SIGTRAP,	TRAP_HWBKPT,	"hardware breakpoint"	},
490 	{ do_bad,	SIGTRAP,	TRAP_HWBKPT,	"hardware single-step"	},
491 	{ do_bad,	SIGTRAP,	TRAP_HWBKPT,	"hardware watchpoint"	},
492 	{ do_bad,	SIGBUS,		0,		"unknown 3"		},
493 	{ do_bad,	SIGTRAP,	TRAP_BRKPT,	"aarch32 BKPT"		},
494 	{ do_bad,	SIGTRAP,	0,		"aarch32 vector catch"	},
495 	{ do_bad,	SIGTRAP,	TRAP_BRKPT,	"aarch64 BRK"		},
496 	{ do_bad,	SIGBUS,		0,		"unknown 7"		},
497 };
498 
499 void __init hook_debug_fault_code(int nr,
500 				  int (*fn)(unsigned long, unsigned int, struct pt_regs *),
501 				  int sig, int code, const char *name)
502 {
503 	BUG_ON(nr < 0 || nr >= ARRAY_SIZE(debug_fault_info));
504 
505 	debug_fault_info[nr].fn		= fn;
506 	debug_fault_info[nr].sig	= sig;
507 	debug_fault_info[nr].code	= code;
508 	debug_fault_info[nr].name	= name;
509 }
510 
511 asmlinkage int __exception do_debug_exception(unsigned long addr,
512 					      unsigned int esr,
513 					      struct pt_regs *regs)
514 {
515 	const struct fault_info *inf = debug_fault_info + DBG_ESR_EVT(esr);
516 	struct siginfo info;
517 
518 	if (!inf->fn(addr, esr, regs))
519 		return 1;
520 
521 	pr_alert("Unhandled debug exception: %s (0x%08x) at 0x%016lx\n",
522 		 inf->name, esr, addr);
523 
524 	info.si_signo = inf->sig;
525 	info.si_errno = 0;
526 	info.si_code  = inf->code;
527 	info.si_addr  = (void __user *)addr;
528 	arm64_notify_die("", regs, &info, esr);
529 
530 	return 0;
531 }
532