cachepc-linux

Fork of AMDESE/linux with modifications for CachePC side-channel attack
git clone https://git.sinitax.com/sinitax/cachepc-linux
Log | Files | Refs | README | LICENSE | sfeed.txt

fault.c (6571B)


      1/*
      2 * Copyright (C) 2009 Wind River Systems Inc
      3 *   Implemented by fredrik.markstrom@gmail.com and ivarholmqvist@gmail.com
      4 *
      5 * based on arch/mips/mm/fault.c which is:
      6 *
      7 * Copyright (C) 1995-2000 Ralf Baechle
      8 *
      9 * This file is subject to the terms and conditions of the GNU General Public
     10 * License.  See the file "COPYING" in the main directory of this archive
     11 * for more details.
     12 */
     13
     14#include <linux/signal.h>
     15#include <linux/sched.h>
     16#include <linux/sched/debug.h>
     17#include <linux/interrupt.h>
     18#include <linux/kernel.h>
     19#include <linux/errno.h>
     20#include <linux/string.h>
     21#include <linux/types.h>
     22#include <linux/ptrace.h>
     23#include <linux/mman.h>
     24#include <linux/mm.h>
     25#include <linux/extable.h>
     26#include <linux/uaccess.h>
     27#include <linux/perf_event.h>
     28
     29#include <asm/mmu_context.h>
     30#include <asm/traps.h>
     31
     32#define EXC_SUPERV_INSN_ACCESS	9  /* Supervisor only instruction address */
     33#define EXC_SUPERV_DATA_ACCESS	11 /* Supervisor only data address */
     34#define EXC_X_PROTECTION_FAULT	13 /* TLB permission violation (x) */
     35#define EXC_R_PROTECTION_FAULT	14 /* TLB permission violation (r) */
     36#define EXC_W_PROTECTION_FAULT	15 /* TLB permission violation (w) */
     37
     38/*
     39 * This routine handles page faults.  It determines the address,
     40 * and the problem, and then passes it off to one of the appropriate
     41 * routines.
     42 */
     43asmlinkage void do_page_fault(struct pt_regs *regs, unsigned long cause,
     44				unsigned long address)
     45{
     46	struct vm_area_struct *vma = NULL;
     47	struct task_struct *tsk = current;
     48	struct mm_struct *mm = tsk->mm;
     49	int code = SEGV_MAPERR;
     50	vm_fault_t fault;
     51	unsigned int flags = FAULT_FLAG_DEFAULT;
     52
     53	cause >>= 2;
     54
     55	/* Restart the instruction */
     56	regs->ea -= 4;
     57
     58	/*
     59	 * We fault-in kernel-space virtual memory on-demand. The
     60	 * 'reference' page table is init_mm.pgd.
     61	 *
     62	 * NOTE! We MUST NOT take any locks for this case. We may
     63	 * be in an interrupt or a critical region, and should
     64	 * only copy the information from the master page table,
     65	 * nothing more.
     66	 */
     67	if (unlikely(address >= VMALLOC_START && address <= VMALLOC_END)) {
     68		if (user_mode(regs))
     69			goto bad_area_nosemaphore;
     70		else
     71			goto vmalloc_fault;
     72	}
     73
     74	if (unlikely(address >= TASK_SIZE))
     75		goto bad_area_nosemaphore;
     76
     77	/*
     78	 * If we're in an interrupt or have no user
     79	 * context, we must not take the fault..
     80	 */
     81	if (faulthandler_disabled() || !mm)
     82		goto bad_area_nosemaphore;
     83
     84	if (user_mode(regs))
     85		flags |= FAULT_FLAG_USER;
     86
     87	perf_sw_event(PERF_COUNT_SW_PAGE_FAULTS, 1, regs, address);
     88
     89	if (!mmap_read_trylock(mm)) {
     90		if (!user_mode(regs) && !search_exception_tables(regs->ea))
     91			goto bad_area_nosemaphore;
     92retry:
     93		mmap_read_lock(mm);
     94	}
     95
     96	vma = find_vma(mm, address);
     97	if (!vma)
     98		goto bad_area;
     99	if (vma->vm_start <= address)
    100		goto good_area;
    101	if (!(vma->vm_flags & VM_GROWSDOWN))
    102		goto bad_area;
    103	if (expand_stack(vma, address))
    104		goto bad_area;
    105/*
    106 * Ok, we have a good vm_area for this memory access, so
    107 * we can handle it..
    108 */
    109good_area:
    110	code = SEGV_ACCERR;
    111
    112	switch (cause) {
    113	case EXC_SUPERV_INSN_ACCESS:
    114		goto bad_area;
    115	case EXC_SUPERV_DATA_ACCESS:
    116		goto bad_area;
    117	case EXC_X_PROTECTION_FAULT:
    118		if (!(vma->vm_flags & VM_EXEC))
    119			goto bad_area;
    120		break;
    121	case EXC_R_PROTECTION_FAULT:
    122		if (!(vma->vm_flags & VM_READ))
    123			goto bad_area;
    124		break;
    125	case EXC_W_PROTECTION_FAULT:
    126		if (!(vma->vm_flags & VM_WRITE))
    127			goto bad_area;
    128		flags = FAULT_FLAG_WRITE;
    129		break;
    130	}
    131
    132	/*
    133	 * If for any reason at all we couldn't handle the fault,
    134	 * make sure we exit gracefully rather than endlessly redo
    135	 * the fault.
    136	 */
    137	fault = handle_mm_fault(vma, address, flags, regs);
    138
    139	if (fault_signal_pending(fault, regs))
    140		return;
    141
    142	if (unlikely(fault & VM_FAULT_ERROR)) {
    143		if (fault & VM_FAULT_OOM)
    144			goto out_of_memory;
    145		else if (fault & VM_FAULT_SIGSEGV)
    146			goto bad_area;
    147		else if (fault & VM_FAULT_SIGBUS)
    148			goto do_sigbus;
    149		BUG();
    150	}
    151
    152	if (fault & VM_FAULT_RETRY) {
    153		flags |= FAULT_FLAG_TRIED;
    154
    155		/*
    156		 * No need to mmap_read_unlock(mm) as we would
    157		 * have already released it in __lock_page_or_retry
    158		 * in mm/filemap.c.
    159		 */
    160
    161		goto retry;
    162	}
    163
    164	mmap_read_unlock(mm);
    165	return;
    166
    167/*
    168 * Something tried to access memory that isn't in our memory map..
    169 * Fix it, but check if it's kernel or user first..
    170 */
    171bad_area:
    172	mmap_read_unlock(mm);
    173
    174bad_area_nosemaphore:
    175	/* User mode accesses just cause a SIGSEGV */
    176	if (user_mode(regs)) {
    177		if (unhandled_signal(current, SIGSEGV) && printk_ratelimit()) {
    178			pr_info("%s: unhandled page fault (%d) at 0x%08lx, "
    179				"cause %ld\n", current->comm, SIGSEGV, address, cause);
    180			show_regs(regs);
    181		}
    182		_exception(SIGSEGV, regs, code, address);
    183		return;
    184	}
    185
    186no_context:
    187	/* Are we prepared to handle this kernel fault? */
    188	if (fixup_exception(regs))
    189		return;
    190
    191	/*
    192	 * Oops. The kernel tried to access some bad page. We'll have to
    193	 * terminate things with extreme prejudice.
    194	 */
    195	bust_spinlocks(1);
    196
    197	pr_alert("Unable to handle kernel %s at virtual address %08lx",
    198		address < PAGE_SIZE ? "NULL pointer dereference" :
    199		"paging request", address);
    200	pr_alert("ea = %08lx, ra = %08lx, cause = %ld\n", regs->ea, regs->ra,
    201		cause);
    202	panic("Oops");
    203	return;
    204
    205/*
    206 * We ran out of memory, or some other thing happened to us that made
    207 * us unable to handle the page fault gracefully.
    208 */
    209out_of_memory:
    210	mmap_read_unlock(mm);
    211	if (!user_mode(regs))
    212		goto no_context;
    213	pagefault_out_of_memory();
    214	return;
    215
    216do_sigbus:
    217	mmap_read_unlock(mm);
    218
    219	/* Kernel mode? Handle exceptions or die */
    220	if (!user_mode(regs))
    221		goto no_context;
    222
    223	_exception(SIGBUS, regs, BUS_ADRERR, address);
    224	return;
    225
    226vmalloc_fault:
    227	{
    228		/*
    229		 * Synchronize this task's top level page-table
    230		 * with the 'reference' page table.
    231		 *
    232		 * Do _not_ use "tsk" here. We might be inside
    233		 * an interrupt in the middle of a task switch..
    234		 */
    235		int offset = pgd_index(address);
    236		pgd_t *pgd, *pgd_k;
    237		p4d_t *p4d, *p4d_k;
    238		pud_t *pud, *pud_k;
    239		pmd_t *pmd, *pmd_k;
    240		pte_t *pte_k;
    241
    242		pgd = pgd_current + offset;
    243		pgd_k = init_mm.pgd + offset;
    244
    245		if (!pgd_present(*pgd_k))
    246			goto no_context;
    247		set_pgd(pgd, *pgd_k);
    248
    249		p4d = p4d_offset(pgd, address);
    250		p4d_k = p4d_offset(pgd_k, address);
    251		if (!p4d_present(*p4d_k))
    252			goto no_context;
    253		pud = pud_offset(p4d, address);
    254		pud_k = pud_offset(p4d_k, address);
    255		if (!pud_present(*pud_k))
    256			goto no_context;
    257		pmd = pmd_offset(pud, address);
    258		pmd_k = pmd_offset(pud_k, address);
    259		if (!pmd_present(*pmd_k))
    260			goto no_context;
    261		set_pmd(pmd, *pmd_k);
    262
    263		pte_k = pte_offset_kernel(pmd_k, address);
    264		if (!pte_present(*pte_k))
    265			goto no_context;
    266
    267		flush_tlb_kernel_page(address);
    268		return;
    269	}
    270}