xref: /openbmc/linux/arch/arm64/mm/fault.c (revision ee89bd6b)
1 /*
2  * Based on arch/arm/mm/fault.c
3  *
4  * Copyright (C) 1995  Linus Torvalds
5  * Copyright (C) 1995-2004 Russell King
6  * Copyright (C) 2012 ARM Ltd.
7  *
8  * This program is free software; you can redistribute it and/or modify
9  * it under the terms of the GNU General Public License version 2 as
10  * published by the Free Software Foundation.
11  *
12  * This program is distributed in the hope that it will be useful,
13  * but WITHOUT ANY WARRANTY; without even the implied warranty of
14  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
15  * GNU General Public License for more details.
16  *
17  * You should have received a copy of the GNU General Public License
18  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
19  */
20 
21 #include <linux/module.h>
22 #include <linux/signal.h>
23 #include <linux/mm.h>
24 #include <linux/hardirq.h>
25 #include <linux/init.h>
26 #include <linux/kprobes.h>
27 #include <linux/uaccess.h>
28 #include <linux/page-flags.h>
29 #include <linux/sched.h>
30 #include <linux/highmem.h>
31 #include <linux/perf_event.h>
32 
33 #include <asm/exception.h>
34 #include <asm/debug-monitors.h>
35 #include <asm/system_misc.h>
36 #include <asm/pgtable.h>
37 #include <asm/tlbflush.h>
38 
39 static const char *fault_name(unsigned int esr);
40 
41 /*
42  * Dump out the page tables associated with 'addr' in mm 'mm'.
43  */
44 void show_pte(struct mm_struct *mm, unsigned long addr)
45 {
46 	pgd_t *pgd;
47 
48 	if (!mm)
49 		mm = &init_mm;
50 
51 	pr_alert("pgd = %p\n", mm->pgd);
52 	pgd = pgd_offset(mm, addr);
53 	pr_alert("[%08lx] *pgd=%016llx", addr, pgd_val(*pgd));
54 
55 	do {
56 		pud_t *pud;
57 		pmd_t *pmd;
58 		pte_t *pte;
59 
60 		if (pgd_none(*pgd) || pgd_bad(*pgd))
61 			break;
62 
63 		pud = pud_offset(pgd, addr);
64 		if (pud_none(*pud) || pud_bad(*pud))
65 			break;
66 
67 		pmd = pmd_offset(pud, addr);
68 		printk(", *pmd=%016llx", pmd_val(*pmd));
69 		if (pmd_none(*pmd) || pmd_bad(*pmd))
70 			break;
71 
72 		pte = pte_offset_map(pmd, addr);
73 		printk(", *pte=%016llx", pte_val(*pte));
74 		pte_unmap(pte);
75 	} while(0);
76 
77 	printk("\n");
78 }
79 
80 /*
81  * The kernel tried to access some page that wasn't present.
82  */
83 static void __do_kernel_fault(struct mm_struct *mm, unsigned long addr,
84 			      unsigned int esr, struct pt_regs *regs)
85 {
86 	/*
87 	 * Are we prepared to handle this kernel fault?
88 	 */
89 	if (fixup_exception(regs))
90 		return;
91 
92 	/*
93 	 * No handler, we'll have to terminate things with extreme prejudice.
94 	 */
95 	bust_spinlocks(1);
96 	pr_alert("Unable to handle kernel %s at virtual address %08lx\n",
97 		 (addr < PAGE_SIZE) ? "NULL pointer dereference" :
98 		 "paging request", addr);
99 
100 	show_pte(mm, addr);
101 	die("Oops", regs, esr);
102 	bust_spinlocks(0);
103 	do_exit(SIGKILL);
104 }
105 
106 /*
107  * Something tried to access memory that isn't in our memory map. User mode
108  * accesses just cause a SIGSEGV
109  */
110 static void __do_user_fault(struct task_struct *tsk, unsigned long addr,
111 			    unsigned int esr, unsigned int sig, int code,
112 			    struct pt_regs *regs)
113 {
114 	struct siginfo si;
115 
116 	if (show_unhandled_signals && unhandled_signal(tsk, sig) &&
117 	    printk_ratelimit()) {
118 		pr_info("%s[%d]: unhandled %s (%d) at 0x%08lx, esr 0x%03x\n",
119 			tsk->comm, task_pid_nr(tsk), fault_name(esr), sig,
120 			addr, esr);
121 		show_pte(tsk->mm, addr);
122 		show_regs(regs);
123 	}
124 
125 	tsk->thread.fault_address = addr;
126 	si.si_signo = sig;
127 	si.si_errno = 0;
128 	si.si_code = code;
129 	si.si_addr = (void __user *)addr;
130 	force_sig_info(sig, &si, tsk);
131 }
132 
133 void do_bad_area(unsigned long addr, unsigned int esr, struct pt_regs *regs)
134 {
135 	struct task_struct *tsk = current;
136 	struct mm_struct *mm = tsk->active_mm;
137 
138 	/*
139 	 * If we are in kernel mode at this point, we have no context to
140 	 * handle this fault with.
141 	 */
142 	if (user_mode(regs))
143 		__do_user_fault(tsk, addr, esr, SIGSEGV, SEGV_MAPERR, regs);
144 	else
145 		__do_kernel_fault(mm, addr, esr, regs);
146 }
147 
148 #define VM_FAULT_BADMAP		0x010000
149 #define VM_FAULT_BADACCESS	0x020000
150 
151 #define ESR_WRITE		(1 << 6)
152 #define ESR_CM			(1 << 8)
153 #define ESR_LNX_EXEC		(1 << 24)
154 
155 /*
156  * Check that the permissions on the VMA allow for the fault which occurred.
157  * If we encountered a write fault, we must have write permission, otherwise
158  * we allow any permission.
159  */
160 static inline bool access_error(unsigned int esr, struct vm_area_struct *vma)
161 {
162 	unsigned int mask = VM_READ | VM_WRITE | VM_EXEC;
163 
164 	if (esr & ESR_WRITE)
165 		mask = VM_WRITE;
166 	if (esr & ESR_LNX_EXEC)
167 		mask = VM_EXEC;
168 
169 	return vma->vm_flags & mask ? false : true;
170 }
171 
172 static int __do_page_fault(struct mm_struct *mm, unsigned long addr,
173 			   unsigned int esr, unsigned int flags,
174 			   struct task_struct *tsk)
175 {
176 	struct vm_area_struct *vma;
177 	int fault;
178 
179 	vma = find_vma(mm, addr);
180 	fault = VM_FAULT_BADMAP;
181 	if (unlikely(!vma))
182 		goto out;
183 	if (unlikely(vma->vm_start > addr))
184 		goto check_stack;
185 
186 	/*
187 	 * Ok, we have a good vm_area for this memory access, so we can handle
188 	 * it.
189 	 */
190 good_area:
191 	if (access_error(esr, vma)) {
192 		fault = VM_FAULT_BADACCESS;
193 		goto out;
194 	}
195 
196 	return handle_mm_fault(mm, vma, addr & PAGE_MASK, flags);
197 
198 check_stack:
199 	if (vma->vm_flags & VM_GROWSDOWN && !expand_stack(vma, addr))
200 		goto good_area;
201 out:
202 	return fault;
203 }
204 
205 static int __kprobes do_page_fault(unsigned long addr, unsigned int esr,
206 				   struct pt_regs *regs)
207 {
208 	struct task_struct *tsk;
209 	struct mm_struct *mm;
210 	int fault, sig, code;
211 	bool write = (esr & ESR_WRITE) && !(esr & ESR_CM);
212 	unsigned int flags = FAULT_FLAG_ALLOW_RETRY | FAULT_FLAG_KILLABLE |
213 		(write ? FAULT_FLAG_WRITE : 0);
214 
215 	tsk = current;
216 	mm  = tsk->mm;
217 
218 	/* Enable interrupts if they were enabled in the parent context. */
219 	if (interrupts_enabled(regs))
220 		local_irq_enable();
221 
222 	/*
223 	 * If we're in an interrupt or have no user context, we must not take
224 	 * the fault.
225 	 */
226 	if (in_atomic() || !mm)
227 		goto no_context;
228 
229 	/*
230 	 * As per x86, we may deadlock here. However, since the kernel only
231 	 * validly references user space from well defined areas of the code,
232 	 * we can bug out early if this is from code which shouldn't.
233 	 */
234 	if (!down_read_trylock(&mm->mmap_sem)) {
235 		if (!user_mode(regs) && !search_exception_tables(regs->pc))
236 			goto no_context;
237 retry:
238 		down_read(&mm->mmap_sem);
239 	} else {
240 		/*
241 		 * The above down_read_trylock() might have succeeded in which
242 		 * case, we'll have missed the might_sleep() from down_read().
243 		 */
244 		might_sleep();
245 #ifdef CONFIG_DEBUG_VM
246 		if (!user_mode(regs) && !search_exception_tables(regs->pc))
247 			goto no_context;
248 #endif
249 	}
250 
251 	fault = __do_page_fault(mm, addr, esr, flags, tsk);
252 
253 	/*
254 	 * If we need to retry but a fatal signal is pending, handle the
255 	 * signal first. We do not need to release the mmap_sem because it
256 	 * would already be released in __lock_page_or_retry in mm/filemap.c.
257 	 */
258 	if ((fault & VM_FAULT_RETRY) && fatal_signal_pending(current))
259 		return 0;
260 
261 	/*
262 	 * Major/minor page fault accounting is only done on the initial
263 	 * attempt. If we go through a retry, it is extremely likely that the
264 	 * page will be found in page cache at that point.
265 	 */
266 
267 	perf_sw_event(PERF_COUNT_SW_PAGE_FAULTS, 1, regs, addr);
268 	if (flags & FAULT_FLAG_ALLOW_RETRY) {
269 		if (fault & VM_FAULT_MAJOR) {
270 			tsk->maj_flt++;
271 			perf_sw_event(PERF_COUNT_SW_PAGE_FAULTS_MAJ, 1, regs,
272 				      addr);
273 		} else {
274 			tsk->min_flt++;
275 			perf_sw_event(PERF_COUNT_SW_PAGE_FAULTS_MIN, 1, regs,
276 				      addr);
277 		}
278 		if (fault & VM_FAULT_RETRY) {
279 			/*
280 			 * Clear FAULT_FLAG_ALLOW_RETRY to avoid any risk of
281 			 * starvation.
282 			 */
283 			flags &= ~FAULT_FLAG_ALLOW_RETRY;
284 			goto retry;
285 		}
286 	}
287 
288 	up_read(&mm->mmap_sem);
289 
290 	/*
291 	 * Handle the "normal" case first - VM_FAULT_MAJOR / VM_FAULT_MINOR
292 	 */
293 	if (likely(!(fault & (VM_FAULT_ERROR | VM_FAULT_BADMAP |
294 			      VM_FAULT_BADACCESS))))
295 		return 0;
296 
297 	if (fault & VM_FAULT_OOM) {
298 		/*
299 		 * We ran out of memory, call the OOM killer, and return to
300 		 * userspace (which will retry the fault, or kill us if we got
301 		 * oom-killed).
302 		 */
303 		pagefault_out_of_memory();
304 		return 0;
305 	}
306 
307 	/*
308 	 * If we are in kernel mode at this point, we have no context to
309 	 * handle this fault with.
310 	 */
311 	if (!user_mode(regs))
312 		goto no_context;
313 
314 	if (fault & VM_FAULT_SIGBUS) {
315 		/*
316 		 * We had some memory, but were unable to successfully fix up
317 		 * this page fault.
318 		 */
319 		sig = SIGBUS;
320 		code = BUS_ADRERR;
321 	} else {
322 		/*
323 		 * Something tried to access memory that isn't in our memory
324 		 * map.
325 		 */
326 		sig = SIGSEGV;
327 		code = fault == VM_FAULT_BADACCESS ?
328 			SEGV_ACCERR : SEGV_MAPERR;
329 	}
330 
331 	__do_user_fault(tsk, addr, esr, sig, code, regs);
332 	return 0;
333 
334 no_context:
335 	__do_kernel_fault(mm, addr, esr, regs);
336 	return 0;
337 }
338 
339 /*
340  * First Level Translation Fault Handler
341  *
342  * We enter here because the first level page table doesn't contain a valid
343  * entry for the address.
344  *
345  * If the address is in kernel space (>= TASK_SIZE), then we are probably
346  * faulting in the vmalloc() area.
347  *
348  * If the init_task's first level page tables contains the relevant entry, we
349  * copy the it to this task.  If not, we send the process a signal, fixup the
350  * exception, or oops the kernel.
351  *
352  * NOTE! We MUST NOT take any locks for this case. We may be in an interrupt
353  * or a critical region, and should only copy the information from the master
354  * page table, nothing more.
355  */
356 static int __kprobes do_translation_fault(unsigned long addr,
357 					  unsigned int esr,
358 					  struct pt_regs *regs)
359 {
360 	if (addr < TASK_SIZE)
361 		return do_page_fault(addr, esr, regs);
362 
363 	do_bad_area(addr, esr, regs);
364 	return 0;
365 }
366 
367 /*
368  * Some section permission faults need to be handled gracefully.  They can
369  * happen due to a __{get,put}_user during an oops.
370  */
371 static int do_sect_fault(unsigned long addr, unsigned int esr,
372 			 struct pt_regs *regs)
373 {
374 	do_bad_area(addr, esr, regs);
375 	return 0;
376 }
377 
378 /*
379  * This abort handler always returns "fault".
380  */
381 static int do_bad(unsigned long addr, unsigned int esr, struct pt_regs *regs)
382 {
383 	return 1;
384 }
385 
386 static struct fault_info {
387 	int	(*fn)(unsigned long addr, unsigned int esr, struct pt_regs *regs);
388 	int	sig;
389 	int	code;
390 	const char *name;
391 } fault_info[] = {
392 	{ do_bad,		SIGBUS,  0,		"ttbr address size fault"	},
393 	{ do_bad,		SIGBUS,  0,		"level 1 address size fault"	},
394 	{ do_bad,		SIGBUS,  0,		"level 2 address size fault"	},
395 	{ do_bad,		SIGBUS,  0,		"level 3 address size fault"	},
396 	{ do_translation_fault,	SIGSEGV, SEGV_MAPERR,	"input address range fault"	},
397 	{ do_translation_fault,	SIGSEGV, SEGV_MAPERR,	"level 1 translation fault"	},
398 	{ do_translation_fault,	SIGSEGV, SEGV_MAPERR,	"level 2 translation fault"	},
399 	{ do_page_fault,	SIGSEGV, SEGV_MAPERR,	"level 3 translation fault"	},
400 	{ do_bad,		SIGBUS,  0,		"reserved access flag fault"	},
401 	{ do_bad,		SIGSEGV, SEGV_ACCERR,	"level 1 access flag fault"	},
402 	{ do_bad,		SIGSEGV, SEGV_ACCERR,	"level 2 access flag fault"	},
403 	{ do_page_fault,	SIGSEGV, SEGV_ACCERR,	"level 3 access flag fault"	},
404 	{ do_bad,		SIGBUS,  0,		"reserved permission fault"	},
405 	{ do_bad,		SIGSEGV, SEGV_ACCERR,	"level 1 permission fault"	},
406 	{ do_sect_fault,	SIGSEGV, SEGV_ACCERR,	"level 2 permission fault"	},
407 	{ do_page_fault,	SIGSEGV, SEGV_ACCERR,	"level 3 permission fault"	},
408 	{ do_bad,		SIGBUS,  0,		"synchronous external abort"	},
409 	{ do_bad,		SIGBUS,  0,		"asynchronous external abort"	},
410 	{ do_bad,		SIGBUS,  0,		"unknown 18"			},
411 	{ do_bad,		SIGBUS,  0,		"unknown 19"			},
412 	{ do_bad,		SIGBUS,  0,		"synchronous abort (translation table walk)" },
413 	{ do_bad,		SIGBUS,  0,		"synchronous abort (translation table walk)" },
414 	{ do_bad,		SIGBUS,  0,		"synchronous abort (translation table walk)" },
415 	{ do_bad,		SIGBUS,  0,		"synchronous abort (translation table walk)" },
416 	{ do_bad,		SIGBUS,  0,		"synchronous parity error"	},
417 	{ do_bad,		SIGBUS,  0,		"asynchronous parity error"	},
418 	{ do_bad,		SIGBUS,  0,		"unknown 26"			},
419 	{ do_bad,		SIGBUS,  0,		"unknown 27"			},
420 	{ do_bad,		SIGBUS,  0,		"synchronous parity error (translation table walk" },
421 	{ do_bad,		SIGBUS,  0,		"synchronous parity error (translation table walk" },
422 	{ do_bad,		SIGBUS,  0,		"synchronous parity error (translation table walk" },
423 	{ do_bad,		SIGBUS,  0,		"synchronous parity error (translation table walk" },
424 	{ do_bad,		SIGBUS,  0,		"unknown 32"			},
425 	{ do_bad,		SIGBUS,  BUS_ADRALN,	"alignment fault"		},
426 	{ do_bad,		SIGBUS,  0,		"debug event"			},
427 	{ do_bad,		SIGBUS,  0,		"unknown 35"			},
428 	{ do_bad,		SIGBUS,  0,		"unknown 36"			},
429 	{ do_bad,		SIGBUS,  0,		"unknown 37"			},
430 	{ do_bad,		SIGBUS,  0,		"unknown 38"			},
431 	{ do_bad,		SIGBUS,  0,		"unknown 39"			},
432 	{ do_bad,		SIGBUS,  0,		"unknown 40"			},
433 	{ do_bad,		SIGBUS,  0,		"unknown 41"			},
434 	{ do_bad,		SIGBUS,  0,		"unknown 42"			},
435 	{ do_bad,		SIGBUS,  0,		"unknown 43"			},
436 	{ do_bad,		SIGBUS,  0,		"unknown 44"			},
437 	{ do_bad,		SIGBUS,  0,		"unknown 45"			},
438 	{ do_bad,		SIGBUS,  0,		"unknown 46"			},
439 	{ do_bad,		SIGBUS,  0,		"unknown 47"			},
440 	{ do_bad,		SIGBUS,  0,		"unknown 48"			},
441 	{ do_bad,		SIGBUS,  0,		"unknown 49"			},
442 	{ do_bad,		SIGBUS,  0,		"unknown 50"			},
443 	{ do_bad,		SIGBUS,  0,		"unknown 51"			},
444 	{ do_bad,		SIGBUS,  0,		"implementation fault (lockdown abort)" },
445 	{ do_bad,		SIGBUS,  0,		"unknown 53"			},
446 	{ do_bad,		SIGBUS,  0,		"unknown 54"			},
447 	{ do_bad,		SIGBUS,  0,		"unknown 55"			},
448 	{ do_bad,		SIGBUS,  0,		"unknown 56"			},
449 	{ do_bad,		SIGBUS,  0,		"unknown 57"			},
450 	{ do_bad,		SIGBUS,  0,		"implementation fault (coprocessor abort)" },
451 	{ do_bad,		SIGBUS,  0,		"unknown 59"			},
452 	{ do_bad,		SIGBUS,  0,		"unknown 60"			},
453 	{ do_bad,		SIGBUS,  0,		"unknown 61"			},
454 	{ do_bad,		SIGBUS,  0,		"unknown 62"			},
455 	{ do_bad,		SIGBUS,  0,		"unknown 63"			},
456 };
457 
458 static const char *fault_name(unsigned int esr)
459 {
460 	const struct fault_info *inf = fault_info + (esr & 63);
461 	return inf->name;
462 }
463 
464 /*
465  * Dispatch a data abort to the relevant handler.
466  */
467 asmlinkage void __exception do_mem_abort(unsigned long addr, unsigned int esr,
468 					 struct pt_regs *regs)
469 {
470 	const struct fault_info *inf = fault_info + (esr & 63);
471 	struct siginfo info;
472 
473 	if (!inf->fn(addr, esr, regs))
474 		return;
475 
476 	pr_alert("Unhandled fault: %s (0x%08x) at 0x%016lx\n",
477 		 inf->name, esr, addr);
478 
479 	info.si_signo = inf->sig;
480 	info.si_errno = 0;
481 	info.si_code  = inf->code;
482 	info.si_addr  = (void __user *)addr;
483 	arm64_notify_die("", regs, &info, esr);
484 }
485 
486 /*
487  * Handle stack alignment exceptions.
488  */
489 asmlinkage void __exception do_sp_pc_abort(unsigned long addr,
490 					   unsigned int esr,
491 					   struct pt_regs *regs)
492 {
493 	struct siginfo info;
494 
495 	info.si_signo = SIGBUS;
496 	info.si_errno = 0;
497 	info.si_code  = BUS_ADRALN;
498 	info.si_addr  = (void __user *)addr;
499 	arm64_notify_die("", regs, &info, esr);
500 }
501 
502 static struct fault_info debug_fault_info[] = {
503 	{ do_bad,	SIGTRAP,	TRAP_HWBKPT,	"hardware breakpoint"	},
504 	{ do_bad,	SIGTRAP,	TRAP_HWBKPT,	"hardware single-step"	},
505 	{ do_bad,	SIGTRAP,	TRAP_HWBKPT,	"hardware watchpoint"	},
506 	{ do_bad,	SIGBUS,		0,		"unknown 3"		},
507 	{ do_bad,	SIGTRAP,	TRAP_BRKPT,	"aarch32 BKPT"		},
508 	{ do_bad,	SIGTRAP,	0,		"aarch32 vector catch"	},
509 	{ do_bad,	SIGTRAP,	TRAP_BRKPT,	"aarch64 BRK"		},
510 	{ do_bad,	SIGBUS,		0,		"unknown 7"		},
511 };
512 
513 void __init hook_debug_fault_code(int nr,
514 				  int (*fn)(unsigned long, unsigned int, struct pt_regs *),
515 				  int sig, int code, const char *name)
516 {
517 	BUG_ON(nr < 0 || nr >= ARRAY_SIZE(debug_fault_info));
518 
519 	debug_fault_info[nr].fn		= fn;
520 	debug_fault_info[nr].sig	= sig;
521 	debug_fault_info[nr].code	= code;
522 	debug_fault_info[nr].name	= name;
523 }
524 
525 asmlinkage int __exception do_debug_exception(unsigned long addr,
526 					      unsigned int esr,
527 					      struct pt_regs *regs)
528 {
529 	const struct fault_info *inf = debug_fault_info + DBG_ESR_EVT(esr);
530 	struct siginfo info;
531 
532 	if (!inf->fn(addr, esr, regs))
533 		return 1;
534 
535 	pr_alert("Unhandled debug exception: %s (0x%08x) at 0x%016lx\n",
536 		 inf->name, esr, addr);
537 
538 	info.si_signo = inf->sig;
539 	info.si_errno = 0;
540 	info.si_code  = inf->code;
541 	info.si_addr  = (void __user *)addr;
542 	arm64_notify_die("", regs, &info, esr);
543 
544 	return 0;
545 }
546