| 1 | /* |
| 2 | * Copyright (C) 2000, 2001 Jeff Dike (jdike@karaya.com) |
| 3 | * Licensed under the GPL |
| 4 | */ |
| 5 | |
| 6 | #include "linux/kernel.h" |
| 7 | #include "asm/errno.h" |
| 8 | #include "linux/sched.h" |
| 9 | #include "linux/mm.h" |
| 10 | #include "linux/spinlock.h" |
| 11 | #include "linux/init.h" |
| 12 | #include "linux/ptrace.h" |
| 13 | #include "asm/semaphore.h" |
| 14 | #include "asm/pgtable.h" |
| 15 | #include "asm/pgalloc.h" |
| 16 | #include "asm/tlbflush.h" |
| 17 | #include "asm/a.out.h" |
| 18 | #include "asm/current.h" |
| 19 | #include "asm/irq.h" |
| 20 | #include "sysdep/sigcontext.h" |
| 21 | #include "kern_util.h" |
| 22 | #include "as-layout.h" |
| 23 | #include "arch.h" |
| 24 | #include "kern.h" |
| 25 | #include "chan_kern.h" |
| 26 | #include "mconsole_kern.h" |
| 27 | #include "mem.h" |
| 28 | #include "mem_kern.h" |
| 29 | #include "sysdep/sigcontext.h" |
| 30 | #include "sysdep/ptrace.h" |
| 31 | #include "os.h" |
| 32 | #ifdef CONFIG_MODE_SKAS |
| 33 | #include "skas.h" |
| 34 | #endif |
| 35 | #include "os.h" |
| 36 | |
| 37 | /* Note this is constrained to return 0, -EFAULT, -EACCESS, -ENOMEM by segv(). */ |
| 38 | int handle_page_fault(unsigned long address, unsigned long ip, |
| 39 | int is_write, int is_user, int *code_out) |
| 40 | { |
| 41 | struct mm_struct *mm = current->mm; |
| 42 | struct vm_area_struct *vma; |
| 43 | pgd_t *pgd; |
| 44 | pud_t *pud; |
| 45 | pmd_t *pmd; |
| 46 | pte_t *pte; |
| 47 | int err = -EFAULT; |
| 48 | |
| 49 | *code_out = SEGV_MAPERR; |
| 50 | |
| 51 | /* If the fault was during atomic operation, don't take the fault, just |
| 52 | * fail. */ |
| 53 | if (in_atomic()) |
| 54 | goto out_nosemaphore; |
| 55 | |
| 56 | down_read(&mm->mmap_sem); |
| 57 | vma = find_vma(mm, address); |
| 58 | if(!vma) |
| 59 | goto out; |
| 60 | else if(vma->vm_start <= address) |
| 61 | goto good_area; |
| 62 | else if(!(vma->vm_flags & VM_GROWSDOWN)) |
| 63 | goto out; |
| 64 | else if(is_user && !ARCH_IS_STACKGROW(address)) |
| 65 | goto out; |
| 66 | else if(expand_stack(vma, address)) |
| 67 | goto out; |
| 68 | |
| 69 | good_area: |
| 70 | *code_out = SEGV_ACCERR; |
| 71 | if(is_write && !(vma->vm_flags & VM_WRITE)) |
| 72 | goto out; |
| 73 | |
| 74 | /* Don't require VM_READ|VM_EXEC for write faults! */ |
| 75 | if(!is_write && !(vma->vm_flags & (VM_READ | VM_EXEC))) |
| 76 | goto out; |
| 77 | |
| 78 | do { |
| 79 | int fault; |
| 80 | survive: |
| 81 | fault = handle_mm_fault(mm, vma, address, is_write); |
| 82 | if (unlikely(fault & VM_FAULT_ERROR)) { |
| 83 | if (fault & VM_FAULT_OOM) { |
| 84 | err = -ENOMEM; |
| 85 | goto out_of_memory; |
| 86 | } else if (fault & VM_FAULT_SIGBUS) { |
| 87 | err = -EACCES; |
| 88 | goto out; |
| 89 | } |
| 90 | BUG(); |
| 91 | } |
| 92 | if (fault & VM_FAULT_MAJOR) |
| 93 | current->maj_flt++; |
| 94 | else |
| 95 | current->min_flt++; |
| 96 | |
| 97 | pgd = pgd_offset(mm, address); |
| 98 | pud = pud_offset(pgd, address); |
| 99 | pmd = pmd_offset(pud, address); |
| 100 | pte = pte_offset_kernel(pmd, address); |
| 101 | } while(!pte_present(*pte)); |
| 102 | err = 0; |
| 103 | /* The below warning was added in place of |
| 104 | * pte_mkyoung(); if (is_write) pte_mkdirty(); |
| 105 | * If it's triggered, we'd see normally a hang here (a clean pte is |
| 106 | * marked read-only to emulate the dirty bit). |
| 107 | * However, the generic code can mark a PTE writable but clean on a |
| 108 | * concurrent read fault, triggering this harmlessly. So comment it out. |
| 109 | */ |
| 110 | #if 0 |
| 111 | WARN_ON(!pte_young(*pte) || (is_write && !pte_dirty(*pte))); |
| 112 | #endif |
| 113 | flush_tlb_page(vma, address); |
| 114 | out: |
| 115 | up_read(&mm->mmap_sem); |
| 116 | out_nosemaphore: |
| 117 | return(err); |
| 118 | |
| 119 | /* |
| 120 | * We ran out of memory, or some other thing happened to us that made |
| 121 | * us unable to handle the page fault gracefully. |
| 122 | */ |
| 123 | out_of_memory: |
| 124 | if (is_init(current)) { |
| 125 | up_read(&mm->mmap_sem); |
| 126 | yield(); |
| 127 | down_read(&mm->mmap_sem); |
| 128 | goto survive; |
| 129 | } |
| 130 | goto out; |
| 131 | } |
| 132 | |
| 133 | static void bad_segv(struct faultinfo fi, unsigned long ip) |
| 134 | { |
| 135 | struct siginfo si; |
| 136 | |
| 137 | si.si_signo = SIGSEGV; |
| 138 | si.si_code = SEGV_ACCERR; |
| 139 | si.si_addr = (void __user *) FAULT_ADDRESS(fi); |
| 140 | current->thread.arch.faultinfo = fi; |
| 141 | force_sig_info(SIGSEGV, &si, current); |
| 142 | } |
| 143 | |
| 144 | static void segv_handler(int sig, union uml_pt_regs *regs) |
| 145 | { |
| 146 | struct faultinfo * fi = UPT_FAULTINFO(regs); |
| 147 | |
| 148 | if(UPT_IS_USER(regs) && !SEGV_IS_FIXABLE(fi)){ |
| 149 | bad_segv(*fi, UPT_IP(regs)); |
| 150 | return; |
| 151 | } |
| 152 | segv(*fi, UPT_IP(regs), UPT_IS_USER(regs), regs); |
| 153 | } |
| 154 | |
| 155 | /* |
| 156 | * We give a *copy* of the faultinfo in the regs to segv. |
| 157 | * This must be done, since nesting SEGVs could overwrite |
| 158 | * the info in the regs. A pointer to the info then would |
| 159 | * give us bad data! |
| 160 | */ |
| 161 | unsigned long segv(struct faultinfo fi, unsigned long ip, int is_user, |
| 162 | union uml_pt_regs *regs) |
| 163 | { |
| 164 | struct siginfo si; |
| 165 | void *catcher; |
| 166 | int err; |
| 167 | int is_write = FAULT_WRITE(fi); |
| 168 | unsigned long address = FAULT_ADDRESS(fi); |
| 169 | |
| 170 | if(!is_user && (address >= start_vm) && (address < end_vm)){ |
| 171 | flush_tlb_kernel_vm(); |
| 172 | return 0; |
| 173 | } |
| 174 | else if(current->mm == NULL) { |
| 175 | show_regs(container_of(regs, struct pt_regs, regs)); |
| 176 | panic("Segfault with no mm"); |
| 177 | } |
| 178 | |
| 179 | if (SEGV_IS_FIXABLE(&fi) || SEGV_MAYBE_FIXABLE(&fi)) |
| 180 | err = handle_page_fault(address, ip, is_write, is_user, &si.si_code); |
| 181 | else { |
| 182 | err = -EFAULT; |
| 183 | /* A thread accessed NULL, we get a fault, but CR2 is invalid. |
| 184 | * This code is used in __do_copy_from_user() of TT mode. */ |
| 185 | address = 0; |
| 186 | } |
| 187 | |
| 188 | catcher = current->thread.fault_catcher; |
| 189 | if(!err) |
| 190 | return 0; |
| 191 | else if(catcher != NULL){ |
| 192 | current->thread.fault_addr = (void *) address; |
| 193 | do_longjmp(catcher, 1); |
| 194 | } |
| 195 | else if(current->thread.fault_addr != NULL) |
| 196 | panic("fault_addr set but no fault catcher"); |
| 197 | else if(!is_user && arch_fixup(ip, regs)) |
| 198 | return 0; |
| 199 | |
| 200 | if(!is_user) { |
| 201 | show_regs(container_of(regs, struct pt_regs, regs)); |
| 202 | panic("Kernel mode fault at addr 0x%lx, ip 0x%lx", |
| 203 | address, ip); |
| 204 | } |
| 205 | |
| 206 | if (err == -EACCES) { |
| 207 | si.si_signo = SIGBUS; |
| 208 | si.si_errno = 0; |
| 209 | si.si_code = BUS_ADRERR; |
| 210 | si.si_addr = (void __user *)address; |
| 211 | current->thread.arch.faultinfo = fi; |
| 212 | force_sig_info(SIGBUS, &si, current); |
| 213 | } else if (err == -ENOMEM) { |
| 214 | printk("VM: killing process %s\n", current->comm); |
| 215 | do_exit(SIGKILL); |
| 216 | } else { |
| 217 | BUG_ON(err != -EFAULT); |
| 218 | si.si_signo = SIGSEGV; |
| 219 | si.si_addr = (void __user *) address; |
| 220 | current->thread.arch.faultinfo = fi; |
| 221 | force_sig_info(SIGSEGV, &si, current); |
| 222 | } |
| 223 | return 0; |
| 224 | } |
| 225 | |
| 226 | void relay_signal(int sig, union uml_pt_regs *regs) |
| 227 | { |
| 228 | if(arch_handle_signal(sig, regs)) |
| 229 | return; |
| 230 | |
| 231 | if(!UPT_IS_USER(regs)){ |
| 232 | if(sig == SIGBUS) |
| 233 | printk("Bus error - the host /dev/shm or /tmp mount " |
| 234 | "likely just ran out of space\n"); |
| 235 | panic("Kernel mode signal %d", sig); |
| 236 | } |
| 237 | |
| 238 | current->thread.arch.faultinfo = *UPT_FAULTINFO(regs); |
| 239 | force_sig(sig, current); |
| 240 | } |
| 241 | |
| 242 | static void bus_handler(int sig, union uml_pt_regs *regs) |
| 243 | { |
| 244 | if(current->thread.fault_catcher != NULL) |
| 245 | do_longjmp(current->thread.fault_catcher, 1); |
| 246 | else relay_signal(sig, regs); |
| 247 | } |
| 248 | |
| 249 | static void winch(int sig, union uml_pt_regs *regs) |
| 250 | { |
| 251 | do_IRQ(WINCH_IRQ, regs); |
| 252 | } |
| 253 | |
| 254 | const struct kern_handlers handlinfo_kern = { |
| 255 | .relay_signal = relay_signal, |
| 256 | .winch = winch, |
| 257 | .bus_handler = bus_handler, |
| 258 | .page_fault = segv_handler, |
| 259 | .sigio_handler = sigio_handler, |
| 260 | .timer_handler = timer_handler |
| 261 | }; |
| 262 | |
| 263 | void trap_init(void) |
| 264 | { |
| 265 | } |