xref: /openbmc/linux/arch/arm64/mm/fault.c (revision e1e0a9e6)
1 /*
2  * Based on arch/arm/mm/fault.c
3  *
4  * Copyright (C) 1995  Linus Torvalds
5  * Copyright (C) 1995-2004 Russell King
6  * Copyright (C) 2012 ARM Ltd.
7  *
8  * This program is free software; you can redistribute it and/or modify
9  * it under the terms of the GNU General Public License version 2 as
10  * published by the Free Software Foundation.
11  *
12  * This program is distributed in the hope that it will be useful,
13  * but WITHOUT ANY WARRANTY; without even the implied warranty of
14  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
15  * GNU General Public License for more details.
16  *
17  * You should have received a copy of the GNU General Public License
18  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
19  */
20 
21 #include <linux/module.h>
22 #include <linux/signal.h>
23 #include <linux/mm.h>
24 #include <linux/hardirq.h>
25 #include <linux/init.h>
26 #include <linux/kprobes.h>
27 #include <linux/uaccess.h>
28 #include <linux/page-flags.h>
29 #include <linux/sched.h>
30 #include <linux/highmem.h>
31 #include <linux/perf_event.h>
32 
33 #include <asm/exception.h>
34 #include <asm/debug-monitors.h>
35 #include <asm/system_misc.h>
36 #include <asm/pgtable.h>
37 #include <asm/tlbflush.h>
38 
39 static const char *fault_name(unsigned int esr);
40 
41 /*
42  * Dump out the page tables associated with 'addr' in mm 'mm'.
43  */
44 void show_pte(struct mm_struct *mm, unsigned long addr)
45 {
46 	pgd_t *pgd;
47 
48 	if (!mm)
49 		mm = &init_mm;
50 
51 	pr_alert("pgd = %p\n", mm->pgd);
52 	pgd = pgd_offset(mm, addr);
53 	pr_alert("[%08lx] *pgd=%016llx", addr, pgd_val(*pgd));
54 
55 	do {
56 		pud_t *pud;
57 		pmd_t *pmd;
58 		pte_t *pte;
59 
60 		if (pgd_none_or_clear_bad(pgd))
61 			break;
62 
63 		pud = pud_offset(pgd, addr);
64 		if (pud_none_or_clear_bad(pud))
65 			break;
66 
67 		pmd = pmd_offset(pud, addr);
68 		printk(", *pmd=%016llx", pmd_val(*pmd));
69 		if (pmd_none_or_clear_bad(pmd))
70 			break;
71 
72 		pte = pte_offset_map(pmd, addr);
73 		printk(", *pte=%016llx", pte_val(*pte));
74 		pte_unmap(pte);
75 	} while(0);
76 
77 	printk("\n");
78 }
79 
80 /*
81  * The kernel tried to access some page that wasn't present.
82  */
83 static void __do_kernel_fault(struct mm_struct *mm, unsigned long addr,
84 			      unsigned int esr, struct pt_regs *regs)
85 {
86 	/*
87 	 * Are we prepared to handle this kernel fault?
88 	 */
89 	if (fixup_exception(regs))
90 		return;
91 
92 	/*
93 	 * No handler, we'll have to terminate things with extreme prejudice.
94 	 */
95 	bust_spinlocks(1);
96 	pr_alert("Unable to handle kernel %s at virtual address %08lx\n",
97 		 (addr < PAGE_SIZE) ? "NULL pointer dereference" :
98 		 "paging request", addr);
99 
100 	show_pte(mm, addr);
101 	die("Oops", regs, esr);
102 	bust_spinlocks(0);
103 	do_exit(SIGKILL);
104 }
105 
106 /*
107  * Something tried to access memory that isn't in our memory map. User mode
108  * accesses just cause a SIGSEGV
109  */
110 static void __do_user_fault(struct task_struct *tsk, unsigned long addr,
111 			    unsigned int esr, unsigned int sig, int code,
112 			    struct pt_regs *regs)
113 {
114 	struct siginfo si;
115 
116 	if (show_unhandled_signals) {
117 		pr_info("%s[%d]: unhandled %s (%d) at 0x%08lx, esr 0x%03x\n",
118 			tsk->comm, task_pid_nr(tsk), fault_name(esr), sig,
119 			addr, esr);
120 		show_pte(tsk->mm, addr);
121 		show_regs(regs);
122 	}
123 
124 	tsk->thread.fault_address = addr;
125 	si.si_signo = sig;
126 	si.si_errno = 0;
127 	si.si_code = code;
128 	si.si_addr = (void __user *)addr;
129 	force_sig_info(sig, &si, tsk);
130 }
131 
132 void do_bad_area(unsigned long addr, unsigned int esr, struct pt_regs *regs)
133 {
134 	struct task_struct *tsk = current;
135 	struct mm_struct *mm = tsk->active_mm;
136 
137 	/*
138 	 * If we are in kernel mode at this point, we have no context to
139 	 * handle this fault with.
140 	 */
141 	if (user_mode(regs))
142 		__do_user_fault(tsk, addr, esr, SIGSEGV, SEGV_MAPERR, regs);
143 	else
144 		__do_kernel_fault(mm, addr, esr, regs);
145 }
146 
147 #define VM_FAULT_BADMAP		0x010000
148 #define VM_FAULT_BADACCESS	0x020000
149 
150 #define ESR_WRITE		(1 << 6)
151 #define ESR_LNX_EXEC		(1 << 24)
152 
153 /*
154  * Check that the permissions on the VMA allow for the fault which occurred.
155  * If we encountered a write fault, we must have write permission, otherwise
156  * we allow any permission.
157  */
158 static inline bool access_error(unsigned int esr, struct vm_area_struct *vma)
159 {
160 	unsigned int mask = VM_READ | VM_WRITE | VM_EXEC;
161 
162 	if (esr & ESR_WRITE)
163 		mask = VM_WRITE;
164 	if (esr & ESR_LNX_EXEC)
165 		mask = VM_EXEC;
166 
167 	return vma->vm_flags & mask ? false : true;
168 }
169 
170 static int __do_page_fault(struct mm_struct *mm, unsigned long addr,
171 			   unsigned int esr, unsigned int flags,
172 			   struct task_struct *tsk)
173 {
174 	struct vm_area_struct *vma;
175 	int fault;
176 
177 	vma = find_vma(mm, addr);
178 	fault = VM_FAULT_BADMAP;
179 	if (unlikely(!vma))
180 		goto out;
181 	if (unlikely(vma->vm_start > addr))
182 		goto check_stack;
183 
184 	/*
185 	 * Ok, we have a good vm_area for this memory access, so we can handle
186 	 * it.
187 	 */
188 good_area:
189 	if (access_error(esr, vma)) {
190 		fault = VM_FAULT_BADACCESS;
191 		goto out;
192 	}
193 
194 	return handle_mm_fault(mm, vma, addr & PAGE_MASK, flags);
195 
196 check_stack:
197 	if (vma->vm_flags & VM_GROWSDOWN && !expand_stack(vma, addr))
198 		goto good_area;
199 out:
200 	return fault;
201 }
202 
203 static int __kprobes do_page_fault(unsigned long addr, unsigned int esr,
204 				   struct pt_regs *regs)
205 {
206 	struct task_struct *tsk;
207 	struct mm_struct *mm;
208 	int fault, sig, code;
209 	int write = esr & ESR_WRITE;
210 	unsigned int flags = FAULT_FLAG_ALLOW_RETRY | FAULT_FLAG_KILLABLE |
211 		(write ? FAULT_FLAG_WRITE : 0);
212 
213 	tsk = current;
214 	mm  = tsk->mm;
215 
216 	/* Enable interrupts if they were enabled in the parent context. */
217 	if (interrupts_enabled(regs))
218 		local_irq_enable();
219 
220 	/*
221 	 * If we're in an interrupt or have no user context, we must not take
222 	 * the fault.
223 	 */
224 	if (in_atomic() || !mm)
225 		goto no_context;
226 
227 	/*
228 	 * As per x86, we may deadlock here. However, since the kernel only
229 	 * validly references user space from well defined areas of the code,
230 	 * we can bug out early if this is from code which shouldn't.
231 	 */
232 	if (!down_read_trylock(&mm->mmap_sem)) {
233 		if (!user_mode(regs) && !search_exception_tables(regs->pc))
234 			goto no_context;
235 retry:
236 		down_read(&mm->mmap_sem);
237 	} else {
238 		/*
239 		 * The above down_read_trylock() might have succeeded in which
240 		 * case, we'll have missed the might_sleep() from down_read().
241 		 */
242 		might_sleep();
243 #ifdef CONFIG_DEBUG_VM
244 		if (!user_mode(regs) && !search_exception_tables(regs->pc))
245 			goto no_context;
246 #endif
247 	}
248 
249 	fault = __do_page_fault(mm, addr, esr, flags, tsk);
250 
251 	/*
252 	 * If we need to retry but a fatal signal is pending, handle the
253 	 * signal first. We do not need to release the mmap_sem because it
254 	 * would already be released in __lock_page_or_retry in mm/filemap.c.
255 	 */
256 	if ((fault & VM_FAULT_RETRY) && fatal_signal_pending(current))
257 		return 0;
258 
259 	/*
260 	 * Major/minor page fault accounting is only done on the initial
261 	 * attempt. If we go through a retry, it is extremely likely that the
262 	 * page will be found in page cache at that point.
263 	 */
264 
265 	perf_sw_event(PERF_COUNT_SW_PAGE_FAULTS, 1, regs, addr);
266 	if (flags & FAULT_FLAG_ALLOW_RETRY) {
267 		if (fault & VM_FAULT_MAJOR) {
268 			tsk->maj_flt++;
269 			perf_sw_event(PERF_COUNT_SW_PAGE_FAULTS_MAJ, 1, regs,
270 				      addr);
271 		} else {
272 			tsk->min_flt++;
273 			perf_sw_event(PERF_COUNT_SW_PAGE_FAULTS_MIN, 1, regs,
274 				      addr);
275 		}
276 		if (fault & VM_FAULT_RETRY) {
277 			/*
278 			 * Clear FAULT_FLAG_ALLOW_RETRY to avoid any risk of
279 			 * starvation.
280 			 */
281 			flags &= ~FAULT_FLAG_ALLOW_RETRY;
282 			goto retry;
283 		}
284 	}
285 
286 	up_read(&mm->mmap_sem);
287 
288 	/*
289 	 * Handle the "normal" case first - VM_FAULT_MAJOR / VM_FAULT_MINOR
290 	 */
291 	if (likely(!(fault & (VM_FAULT_ERROR | VM_FAULT_BADMAP |
292 			      VM_FAULT_BADACCESS))))
293 		return 0;
294 
295 	if (fault & VM_FAULT_OOM) {
296 		/*
297 		 * We ran out of memory, call the OOM killer, and return to
298 		 * userspace (which will retry the fault, or kill us if we got
299 		 * oom-killed).
300 		 */
301 		pagefault_out_of_memory();
302 		return 0;
303 	}
304 
305 	/*
306 	 * If we are in kernel mode at this point, we have no context to
307 	 * handle this fault with.
308 	 */
309 	if (!user_mode(regs))
310 		goto no_context;
311 
312 	if (fault & VM_FAULT_SIGBUS) {
313 		/*
314 		 * We had some memory, but were unable to successfully fix up
315 		 * this page fault.
316 		 */
317 		sig = SIGBUS;
318 		code = BUS_ADRERR;
319 	} else {
320 		/*
321 		 * Something tried to access memory that isn't in our memory
322 		 * map.
323 		 */
324 		sig = SIGSEGV;
325 		code = fault == VM_FAULT_BADACCESS ?
326 			SEGV_ACCERR : SEGV_MAPERR;
327 	}
328 
329 	__do_user_fault(tsk, addr, esr, sig, code, regs);
330 	return 0;
331 
332 no_context:
333 	__do_kernel_fault(mm, addr, esr, regs);
334 	return 0;
335 }
336 
337 /*
338  * First Level Translation Fault Handler
339  *
340  * We enter here because the first level page table doesn't contain a valid
341  * entry for the address.
342  *
343  * If the address is in kernel space (>= TASK_SIZE), then we are probably
344  * faulting in the vmalloc() area.
345  *
346  * If the init_task's first level page tables contains the relevant entry, we
347  * copy the it to this task.  If not, we send the process a signal, fixup the
348  * exception, or oops the kernel.
349  *
350  * NOTE! We MUST NOT take any locks for this case. We may be in an interrupt
351  * or a critical region, and should only copy the information from the master
352  * page table, nothing more.
353  */
354 static int __kprobes do_translation_fault(unsigned long addr,
355 					  unsigned int esr,
356 					  struct pt_regs *regs)
357 {
358 	if (addr < TASK_SIZE)
359 		return do_page_fault(addr, esr, regs);
360 
361 	do_bad_area(addr, esr, regs);
362 	return 0;
363 }
364 
365 /*
366  * Some section permission faults need to be handled gracefully.  They can
367  * happen due to a __{get,put}_user during an oops.
368  */
369 static int do_sect_fault(unsigned long addr, unsigned int esr,
370 			 struct pt_regs *regs)
371 {
372 	do_bad_area(addr, esr, regs);
373 	return 0;
374 }
375 
376 /*
377  * This abort handler always returns "fault".
378  */
379 static int do_bad(unsigned long addr, unsigned int esr, struct pt_regs *regs)
380 {
381 	return 1;
382 }
383 
384 static struct fault_info {
385 	int	(*fn)(unsigned long addr, unsigned int esr, struct pt_regs *regs);
386 	int	sig;
387 	int	code;
388 	const char *name;
389 } fault_info[] = {
390 	{ do_bad,		SIGBUS,  0,		"ttbr address size fault"	},
391 	{ do_bad,		SIGBUS,  0,		"level 1 address size fault"	},
392 	{ do_bad,		SIGBUS,  0,		"level 2 address size fault"	},
393 	{ do_bad,		SIGBUS,  0,		"level 3 address size fault"	},
394 	{ do_translation_fault,	SIGSEGV, SEGV_MAPERR,	"input address range fault"	},
395 	{ do_translation_fault,	SIGSEGV, SEGV_MAPERR,	"level 1 translation fault"	},
396 	{ do_translation_fault,	SIGSEGV, SEGV_MAPERR,	"level 2 translation fault"	},
397 	{ do_page_fault,	SIGSEGV, SEGV_MAPERR,	"level 3 translation fault"	},
398 	{ do_bad,		SIGBUS,  0,		"reserved access flag fault"	},
399 	{ do_bad,		SIGSEGV, SEGV_ACCERR,	"level 1 access flag fault"	},
400 	{ do_bad,		SIGSEGV, SEGV_ACCERR,	"level 2 access flag fault"	},
401 	{ do_page_fault,	SIGSEGV, SEGV_ACCERR,	"level 3 access flag fault"	},
402 	{ do_bad,		SIGBUS,  0,		"reserved permission fault"	},
403 	{ do_bad,		SIGSEGV, SEGV_ACCERR,	"level 1 permission fault"	},
404 	{ do_sect_fault,	SIGSEGV, SEGV_ACCERR,	"level 2 permission fault"	},
405 	{ do_page_fault,	SIGSEGV, SEGV_ACCERR,	"level 3 permission fault"	},
406 	{ do_bad,		SIGBUS,  0,		"synchronous external abort"	},
407 	{ do_bad,		SIGBUS,  0,		"asynchronous external abort"	},
408 	{ do_bad,		SIGBUS,  0,		"unknown 18"			},
409 	{ do_bad,		SIGBUS,  0,		"unknown 19"			},
410 	{ do_bad,		SIGBUS,  0,		"synchronous abort (translation table walk)" },
411 	{ do_bad,		SIGBUS,  0,		"synchronous abort (translation table walk)" },
412 	{ do_bad,		SIGBUS,  0,		"synchronous abort (translation table walk)" },
413 	{ do_bad,		SIGBUS,  0,		"synchronous abort (translation table walk)" },
414 	{ do_bad,		SIGBUS,  0,		"synchronous parity error"	},
415 	{ do_bad,		SIGBUS,  0,		"asynchronous parity error"	},
416 	{ do_bad,		SIGBUS,  0,		"unknown 26"			},
417 	{ do_bad,		SIGBUS,  0,		"unknown 27"			},
418 	{ do_bad,		SIGBUS,  0,		"synchronous parity error (translation table walk" },
419 	{ do_bad,		SIGBUS,  0,		"synchronous parity error (translation table walk" },
420 	{ do_bad,		SIGBUS,  0,		"synchronous parity error (translation table walk" },
421 	{ do_bad,		SIGBUS,  0,		"synchronous parity error (translation table walk" },
422 	{ do_bad,		SIGBUS,  0,		"unknown 32"			},
423 	{ do_bad,		SIGBUS,  BUS_ADRALN,	"alignment fault"		},
424 	{ do_bad,		SIGBUS,  0,		"debug event"			},
425 	{ do_bad,		SIGBUS,  0,		"unknown 35"			},
426 	{ do_bad,		SIGBUS,  0,		"unknown 36"			},
427 	{ do_bad,		SIGBUS,  0,		"unknown 37"			},
428 	{ do_bad,		SIGBUS,  0,		"unknown 38"			},
429 	{ do_bad,		SIGBUS,  0,		"unknown 39"			},
430 	{ do_bad,		SIGBUS,  0,		"unknown 40"			},
431 	{ do_bad,		SIGBUS,  0,		"unknown 41"			},
432 	{ do_bad,		SIGBUS,  0,		"unknown 42"			},
433 	{ do_bad,		SIGBUS,  0,		"unknown 43"			},
434 	{ do_bad,		SIGBUS,  0,		"unknown 44"			},
435 	{ do_bad,		SIGBUS,  0,		"unknown 45"			},
436 	{ do_bad,		SIGBUS,  0,		"unknown 46"			},
437 	{ do_bad,		SIGBUS,  0,		"unknown 47"			},
438 	{ do_bad,		SIGBUS,  0,		"unknown 48"			},
439 	{ do_bad,		SIGBUS,  0,		"unknown 49"			},
440 	{ do_bad,		SIGBUS,  0,		"unknown 50"			},
441 	{ do_bad,		SIGBUS,  0,		"unknown 51"			},
442 	{ do_bad,		SIGBUS,  0,		"implementation fault (lockdown abort)" },
443 	{ do_bad,		SIGBUS,  0,		"unknown 53"			},
444 	{ do_bad,		SIGBUS,  0,		"unknown 54"			},
445 	{ do_bad,		SIGBUS,  0,		"unknown 55"			},
446 	{ do_bad,		SIGBUS,  0,		"unknown 56"			},
447 	{ do_bad,		SIGBUS,  0,		"unknown 57"			},
448 	{ do_bad,		SIGBUS,  0,		"implementation fault (coprocessor abort)" },
449 	{ do_bad,		SIGBUS,  0,		"unknown 59"			},
450 	{ do_bad,		SIGBUS,  0,		"unknown 60"			},
451 	{ do_bad,		SIGBUS,  0,		"unknown 61"			},
452 	{ do_bad,		SIGBUS,  0,		"unknown 62"			},
453 	{ do_bad,		SIGBUS,  0,		"unknown 63"			},
454 };
455 
456 static const char *fault_name(unsigned int esr)
457 {
458 	const struct fault_info *inf = fault_info + (esr & 63);
459 	return inf->name;
460 }
461 
462 /*
463  * Dispatch a data abort to the relevant handler.
464  */
465 asmlinkage void __exception do_mem_abort(unsigned long addr, unsigned int esr,
466 					 struct pt_regs *regs)
467 {
468 	const struct fault_info *inf = fault_info + (esr & 63);
469 	struct siginfo info;
470 
471 	if (!inf->fn(addr, esr, regs))
472 		return;
473 
474 	pr_alert("Unhandled fault: %s (0x%08x) at 0x%016lx\n",
475 		 inf->name, esr, addr);
476 
477 	info.si_signo = inf->sig;
478 	info.si_errno = 0;
479 	info.si_code  = inf->code;
480 	info.si_addr  = (void __user *)addr;
481 	arm64_notify_die("", regs, &info, esr);
482 }
483 
484 /*
485  * Handle stack alignment exceptions.
486  */
487 asmlinkage void __exception do_sp_pc_abort(unsigned long addr,
488 					   unsigned int esr,
489 					   struct pt_regs *regs)
490 {
491 	struct siginfo info;
492 
493 	info.si_signo = SIGBUS;
494 	info.si_errno = 0;
495 	info.si_code  = BUS_ADRALN;
496 	info.si_addr  = (void __user *)addr;
497 	arm64_notify_die("", regs, &info, esr);
498 }
499 
500 static struct fault_info debug_fault_info[] = {
501 	{ do_bad,	SIGTRAP,	TRAP_HWBKPT,	"hardware breakpoint"	},
502 	{ do_bad,	SIGTRAP,	TRAP_HWBKPT,	"hardware single-step"	},
503 	{ do_bad,	SIGTRAP,	TRAP_HWBKPT,	"hardware watchpoint"	},
504 	{ do_bad,	SIGBUS,		0,		"unknown 3"		},
505 	{ do_bad,	SIGTRAP,	TRAP_BRKPT,	"aarch32 BKPT"		},
506 	{ do_bad,	SIGTRAP,	0,		"aarch32 vector catch"	},
507 	{ do_bad,	SIGTRAP,	TRAP_BRKPT,	"aarch64 BRK"		},
508 	{ do_bad,	SIGBUS,		0,		"unknown 7"		},
509 };
510 
511 void __init hook_debug_fault_code(int nr,
512 				  int (*fn)(unsigned long, unsigned int, struct pt_regs *),
513 				  int sig, int code, const char *name)
514 {
515 	BUG_ON(nr < 0 || nr >= ARRAY_SIZE(debug_fault_info));
516 
517 	debug_fault_info[nr].fn		= fn;
518 	debug_fault_info[nr].sig	= sig;
519 	debug_fault_info[nr].code	= code;
520 	debug_fault_info[nr].name	= name;
521 }
522 
523 asmlinkage int __exception do_debug_exception(unsigned long addr,
524 					      unsigned int esr,
525 					      struct pt_regs *regs)
526 {
527 	const struct fault_info *inf = debug_fault_info + DBG_ESR_EVT(esr);
528 	struct siginfo info;
529 
530 	if (!inf->fn(addr, esr, regs))
531 		return 1;
532 
533 	pr_alert("Unhandled debug exception: %s (0x%08x) at 0x%016lx\n",
534 		 inf->name, esr, addr);
535 
536 	info.si_signo = inf->sig;
537 	info.si_errno = 0;
538 	info.si_code  = inf->code;
539 	info.si_addr  = (void __user *)addr;
540 	arm64_notify_die("", regs, &info, esr);
541 
542 	return 0;
543 }
544