2 * linux/arch/x86-64/mm/fault.c
4 * Copyright (C) 1995 Linus Torvalds
5 * Copyright (C) 2001,2002 Andi Kleen, SuSE Labs.
8 #include <linux/signal.h>
9 #include <linux/sched.h>
10 #include <linux/kernel.h>
11 #include <linux/errno.h>
12 #include <linux/string.h>
13 #include <linux/types.h>
14 #include <linux/tracehook.h>
15 #include <linux/mman.h>
17 #include <linux/smp.h>
18 #include <linux/smp_lock.h>
19 #include <linux/interrupt.h>
20 #include <linux/init.h>
21 #include <linux/tty.h>
22 #include <linux/vt_kern.h> /* For unblank_screen() */
23 #include <linux/compiler.h>
24 #include <linux/module.h>
25 #include <linux/kprobes.h>
27 #include <asm/system.h>
28 #include <asm/uaccess.h>
29 #include <asm/pgalloc.h>
31 #include <asm/tlbflush.h>
32 #include <asm/proto.h>
33 #include <asm/kdebug.h>
34 #include <asm-generic/sections.h>
36 /* Page fault error code bits */
37 #define PF_PROT (1<<0) /* or no page found */
38 #define PF_WRITE (1<<1)
39 #define PF_USER (1<<2)
40 #define PF_RSVD (1<<3)
41 #define PF_INSTR (1<<4)
44 ATOMIC_NOTIFIER_HEAD(notify_page_fault_chain);
46 /* Hook to register for page fault notifications */
47 int register_page_fault_notifier(struct notifier_block *nb)
50 return atomic_notifier_chain_register(¬ify_page_fault_chain, nb);
53 int unregister_page_fault_notifier(struct notifier_block *nb)
55 return atomic_notifier_chain_unregister(¬ify_page_fault_chain, nb);
58 static inline int notify_page_fault(enum die_val val, const char *str,
59 struct pt_regs *regs, long err, int trap, int sig)
61 struct die_args args = {
68 return atomic_notifier_call_chain(¬ify_page_fault_chain, val, &args);
71 static inline int notify_page_fault(enum die_val val, const char *str,
72 struct pt_regs *regs, long err, int trap, int sig)
78 void bust_spinlocks(int yes)
80 int loglevel_save = console_loglevel;
89 * OK, the message is on the console. Now we call printk()
90 * without oops_in_progress set so that printk will give klogd
91 * a poke. Hold onto your hats...
93 console_loglevel = 15; /* NMI oopser may have shut the console up */
95 console_loglevel = loglevel_save;
99 /* Sometimes the CPU reports invalid exceptions on prefetch.
100 Check that here and ignore.
101 Opcode checker based on code by Richard Brunner */
102 static noinline int is_prefetch(struct pt_regs *regs, unsigned long addr,
103 unsigned long error_code)
105 unsigned char *instr;
108 unsigned char *max_instr;
110 /* If it was a exec fault ignore */
111 if (error_code & PF_INSTR)
114 instr = (unsigned char *)convert_rip_to_linear(current, regs);
115 max_instr = instr + 15;
117 if (user_mode(regs) && instr >= (unsigned char *)TASK_SIZE64)
120 while (scan_more && instr < max_instr) {
121 unsigned char opcode;
122 unsigned char instr_hi;
123 unsigned char instr_lo;
125 if (__get_user(opcode, instr))
128 instr_hi = opcode & 0xf0;
129 instr_lo = opcode & 0x0f;
135 /* Values 0x26,0x2E,0x36,0x3E are valid x86
136 prefixes. In long mode, the CPU will signal
137 invalid opcode if some of these prefixes are
138 present so we will never get here anyway */
139 scan_more = ((instr_lo & 7) == 0x6);
143 /* In AMD64 long mode, 0x40 to 0x4F are valid REX prefixes
144 Need to figure out under what instruction mode the
145 instruction was issued ... */
146 /* Could check the LDT for lm, but for now it's good
147 enough to assume that long mode only uses well known
148 segments or kernel. */
149 scan_more = (!user_mode(regs)) || (regs->cs == __USER_CS);
153 /* 0x64 thru 0x67 are valid prefixes in all modes. */
154 scan_more = (instr_lo & 0xC) == 0x4;
157 /* 0xF0, 0xF2, and 0xF3 are valid prefixes in all modes. */
158 scan_more = !instr_lo || (instr_lo>>1) == 1;
161 /* Prefetch instruction is 0x0F0D or 0x0F18 */
163 if (__get_user(opcode, instr))
165 prefetch = (instr_lo == 0xF) &&
166 (opcode == 0x0D || opcode == 0x18);
176 static int bad_address(void *p)
179 return __get_user(dummy, (unsigned long *)p);
182 void dump_pagetable(unsigned long address)
189 asm("movq %%cr3,%0" : "=r" (pgd));
191 pgd = __va((unsigned long)pgd & PHYSICAL_PAGE_MASK);
192 pgd += pgd_index(address);
193 if (bad_address(pgd)) goto bad;
194 printk("PGD %lx ", pgd_val(*pgd));
195 if (!pgd_present(*pgd)) goto ret;
197 pud = pud_offset(pgd, address);
198 if (bad_address(pud)) goto bad;
199 printk("PUD %lx ", pud_val(*pud));
200 if (!pud_present(*pud)) goto ret;
202 pmd = pmd_offset(pud, address);
203 if (bad_address(pmd)) goto bad;
204 printk("PMD %lx ", pmd_val(*pmd));
205 if (!pmd_present(*pmd)) goto ret;
207 pte = pte_offset_kernel(pmd, address);
208 if (bad_address(pte)) goto bad;
209 printk("PTE %lx", pte_val(*pte));
217 static const char errata93_warning[] =
218 KERN_ERR "******* Your BIOS seems to not contain a fix for K8 errata #93\n"
219 KERN_ERR "******* Working around it, but it may cause SEGVs or burn power.\n"
220 KERN_ERR "******* Please consider a BIOS update.\n"
221 KERN_ERR "******* Disabling USB legacy in the BIOS may also help.\n";
223 /* Workaround for K8 erratum #93 & buggy BIOS.
224 BIOS SMM functions are required to use a specific workaround
225 to avoid corruption of the 64bit RIP register on C stepping K8.
226 A lot of BIOS that didn't get tested properly miss this.
227 The OS sees this as a page fault with the upper 32bits of RIP cleared.
228 Try to work around it here.
229 Note we only handle faults in kernel here. */
231 static int is_errata93(struct pt_regs *regs, unsigned long address)
234 if (address != regs->rip)
236 if ((address >> 32) != 0)
238 address |= 0xffffffffUL << 32;
239 if ((address >= (u64)_stext && address <= (u64)_etext) ||
240 (address >= MODULES_VADDR && address <= MODULES_END)) {
242 printk(errata93_warning);
251 int unhandled_signal(struct task_struct *tsk, int sig)
255 if (tracehook_consider_fatal_signal(tsk, sig))
257 return (tsk->sighand->action[sig-1].sa.sa_handler == SIG_IGN) ||
258 (tsk->sighand->action[sig-1].sa.sa_handler == SIG_DFL);
261 static noinline void pgtable_bad(unsigned long address, struct pt_regs *regs,
262 unsigned long error_code)
264 unsigned long flags = oops_begin();
265 struct task_struct *tsk;
267 printk(KERN_ALERT "%s: Corrupted page table at address %lx\n",
268 current->comm, address);
269 dump_pagetable(address);
271 tsk->thread.cr2 = address;
272 tsk->thread.trap_no = 14;
273 tsk->thread.error_code = error_code;
274 __die("Bad pagetable", regs, error_code);
280 * Handle a fault on the vmalloc area
282 * This assumes no large pages in there.
284 static int vmalloc_fault(unsigned long address)
286 pgd_t *pgd, *pgd_ref;
287 pud_t *pud, *pud_ref;
288 pmd_t *pmd, *pmd_ref;
289 pte_t *pte, *pte_ref;
291 /* Copy kernel mappings over when needed. This can also
292 happen within a race in page table update. In the later
295 pgd = pgd_offset(current->mm ?: &init_mm, address);
296 pgd_ref = pgd_offset_k(address);
297 if (pgd_none(*pgd_ref))
300 set_pgd(pgd, *pgd_ref);
302 BUG_ON(pgd_page(*pgd) != pgd_page(*pgd_ref));
304 /* Below here mismatches are bugs because these lower tables
307 pud = pud_offset(pgd, address);
308 pud_ref = pud_offset(pgd_ref, address);
309 if (pud_none(*pud_ref))
311 if (pud_none(*pud) || pud_page(*pud) != pud_page(*pud_ref))
313 pmd = pmd_offset(pud, address);
314 pmd_ref = pmd_offset(pud_ref, address);
315 if (pmd_none(*pmd_ref))
317 if (pmd_none(*pmd) || pmd_page(*pmd) != pmd_page(*pmd_ref))
319 pte_ref = pte_offset_kernel(pmd_ref, address);
320 if (!pte_present(*pte_ref))
322 pte = pte_offset_kernel(pmd, address);
323 /* Don't use pte_page here, because the mappings can point
324 outside mem_map, and the NUMA hash lookup cannot handle
326 if (!pte_present(*pte) || pte_pfn(*pte) != pte_pfn(*pte_ref))
331 int page_fault_trace = 0;
332 int exception_trace = 1;
335 * This routine handles page faults. It determines the address,
336 * and the problem, and then passes it off to one of the appropriate
339 asmlinkage void __kprobes do_page_fault(struct pt_regs *regs,
340 unsigned long error_code)
342 struct task_struct *tsk;
343 struct mm_struct *mm;
344 struct vm_area_struct * vma;
345 unsigned long address;
346 const struct exception_table_entry *fixup;
353 prefetchw(&mm->mmap_sem);
355 /* get the address */
356 __asm__("movq %%cr2,%0":"=r" (address));
358 info.si_code = SEGV_MAPERR;
362 * We fault-in kernel-space virtual memory on-demand. The
363 * 'reference' page table is init_mm.pgd.
365 * NOTE! We MUST NOT take any locks for this case. We may
366 * be in an interrupt or a critical region, and should
367 * only copy the information from the master page table,
370 * This verifies that the fault happens in kernel space
371 * (error_code & 4) == 0, and that the fault was not a
372 * protection error (error_code & 9) == 0.
374 if (unlikely(address >= TASK_SIZE64)) {
376 * Don't check for the module range here: its PML4
377 * is always initialized because it's shared with the main
378 * kernel text. Only vmalloc may need PML4 syncups.
380 if (!(error_code & (PF_RSVD|PF_USER|PF_PROT)) &&
381 ((address >= VMALLOC_START && address < VMALLOC_END))) {
382 if (vmalloc_fault(address) >= 0)
385 if (notify_page_fault(DIE_PAGE_FAULT, "page fault", regs, error_code, 14,
386 SIGSEGV) == NOTIFY_STOP)
389 * Don't take the mm semaphore here. If we fixup a prefetch
390 * fault we could otherwise deadlock.
392 goto bad_area_nosemaphore;
395 if (notify_page_fault(DIE_PAGE_FAULT, "page fault", regs, error_code, 14,
396 SIGSEGV) == NOTIFY_STOP)
399 if (likely(regs->eflags & X86_EFLAGS_IF))
402 if (unlikely(page_fault_trace))
403 printk("pagefault rip:%lx rsp:%lx cs:%lu ss:%lu address %lx error %lx\n",
404 regs->rip,regs->rsp,regs->cs,regs->ss,address,error_code);
406 if (unlikely(error_code & PF_RSVD))
407 pgtable_bad(address, regs, error_code);
410 * If we're in an interrupt or have no user
411 * context, we must not take the fault..
413 if (unlikely(in_atomic() || !mm))
414 goto bad_area_nosemaphore;
417 /* When running in the kernel we expect faults to occur only to
418 * addresses in user space. All other faults represent errors in the
419 * kernel and should generate an OOPS. Unfortunatly, in the case of an
420 * erroneous fault occurring in a code path which already holds mmap_sem
421 * we will deadlock attempting to validate the fault against the
422 * address space. Luckily the kernel only validly references user
423 * space from well defined areas of code, which are listed in the
426 * As the vast majority of faults will be valid we will only perform
427 * the source reference check when there is a possibilty of a deadlock.
428 * Attempt to lock the address space, if we cannot we then validate the
429 * source. If this is invalid we can skip the address space check,
430 * thus avoiding the deadlock.
432 if (!down_read_trylock(&mm->mmap_sem)) {
433 if ((error_code & PF_USER) == 0 &&
434 !search_exception_tables(regs->rip))
435 goto bad_area_nosemaphore;
436 down_read(&mm->mmap_sem);
439 vma = find_vma(mm, address);
442 if (likely(vma->vm_start <= address))
444 if (!(vma->vm_flags & VM_GROWSDOWN))
446 if (error_code & 4) {
447 /* Allow userspace just enough access below the stack pointer
448 * to let the 'enter' instruction work.
450 if (address + 65536 + 32 * sizeof(unsigned long) < regs->rsp)
453 if (expand_stack(vma, address))
456 * Ok, we have a good vm_area for this memory access, so
460 info.si_code = SEGV_ACCERR;
462 switch (error_code & (PF_PROT|PF_WRITE)) {
463 default: /* 3: write, present */
465 case PF_WRITE: /* write, not present */
466 if (!(vma->vm_flags & VM_WRITE))
470 case PF_PROT: /* read, present */
472 case 0: /* read, not present */
473 if (!(vma->vm_flags & (VM_READ | VM_EXEC)))
478 * If for any reason at all we couldn't handle the fault,
479 * make sure we exit gracefully rather than endlessly redo
482 switch (handle_mm_fault(mm, vma, address, write)) {
489 case VM_FAULT_SIGBUS:
495 up_read(&mm->mmap_sem);
499 * Something tried to access memory that isn't in our memory map..
500 * Fix it, but check if it's kernel or user first..
503 up_read(&mm->mmap_sem);
505 bad_area_nosemaphore:
506 /* User mode accesses just cause a SIGSEGV */
507 if (error_code & PF_USER) {
508 if (is_prefetch(regs, address, error_code))
511 /* Work around K8 erratum #100 K8 in compat mode
512 occasionally jumps to illegal addresses >4GB. We
513 catch this here in the page fault handler because
514 these addresses are not reachable. Just detect this
515 case and return. Any code segment in LDT is
516 compatibility mode. */
517 if ((regs->cs == __USER32_CS || (regs->cs & (1<<2))) &&
521 if (exception_trace && unhandled_signal(tsk, SIGSEGV)) {
523 "%s%s[%d]: segfault at %016lx rip %016lx rsp %016lx error %lx\n",
524 tsk->pid > 1 ? KERN_INFO : KERN_EMERG,
525 tsk->comm, tsk->pid, address, regs->rip,
526 regs->rsp, error_code);
529 tsk->thread.cr2 = address;
530 /* Kernel addresses are always protection faults */
531 tsk->thread.error_code = error_code | (address >= TASK_SIZE);
532 tsk->thread.trap_no = 14;
533 info.si_signo = SIGSEGV;
535 /* info.si_code has been set above */
536 info.si_addr = (void __user *)address;
537 force_sig_info(SIGSEGV, &info, tsk);
543 /* Are we prepared to handle this kernel fault? */
544 fixup = search_exception_tables(regs->rip);
546 regs->rip = fixup->fixup;
551 * Hall of shame of CPU/BIOS bugs.
554 if (is_prefetch(regs, address, error_code))
557 if (is_errata93(regs, address))
561 * Oops. The kernel tried to access some bad page. We'll have to
562 * terminate things with extreme prejudice.
565 flags = oops_begin();
567 if (address < PAGE_SIZE)
568 printk(KERN_ALERT "Unable to handle kernel NULL pointer dereference");
570 printk(KERN_ALERT "Unable to handle kernel paging request");
571 printk(" at %016lx RIP: \n" KERN_ALERT,address);
572 printk_address(regs->rip);
573 dump_pagetable(address);
574 tsk->thread.cr2 = address;
575 tsk->thread.trap_no = 14;
576 tsk->thread.error_code = error_code;
577 __die("Oops", regs, error_code);
578 /* Executive summary in case the body of the oops scrolled away */
579 printk(KERN_EMERG "CR2: %016lx\n", address);
584 * We ran out of memory, or some other thing happened to us that made
585 * us unable to handle the page fault gracefully.
588 up_read(&mm->mmap_sem);
589 if (current->pid == 1) {
593 printk("VM: killing process %s\n", tsk->comm);
599 up_read(&mm->mmap_sem);
601 /* Kernel mode? Handle exceptions or die */
602 if (!(error_code & PF_USER))
605 tsk->thread.cr2 = address;
606 tsk->thread.error_code = error_code;
607 tsk->thread.trap_no = 14;
608 info.si_signo = SIGBUS;
610 info.si_code = BUS_ADRERR;
611 info.si_addr = (void __user *)address;
612 force_sig_info(SIGBUS, &info, tsk);
616 DEFINE_SPINLOCK(pgd_lock);
617 struct page *pgd_list;
619 void vmalloc_sync_all(void)
621 /* Note that races in the updates of insync and start aren't
623 insync can only get set bits added, and updates to start are only
624 improving performance (without affecting correctness if undone). */
625 static DECLARE_BITMAP(insync, PTRS_PER_PGD);
626 static unsigned long start = VMALLOC_START & PGDIR_MASK;
627 unsigned long address;
629 for (address = start; address <= VMALLOC_END; address += PGDIR_SIZE) {
630 if (!test_bit(pgd_index(address), insync)) {
631 const pgd_t *pgd_ref = pgd_offset_k(address);
634 if (pgd_none(*pgd_ref))
636 spin_lock(&pgd_lock);
637 for (page = pgd_list; page;
638 page = (struct page *)page->index) {
640 pgd = (pgd_t *)page_address(page) + pgd_index(address);
642 set_pgd(pgd, *pgd_ref);
644 BUG_ON(pgd_page(*pgd) != pgd_page(*pgd_ref));
646 spin_unlock(&pgd_lock);
647 set_bit(pgd_index(address), insync);
649 if (address == start)
650 start = address + PGDIR_SIZE;
652 /* Check that there is no need to do the same for the modules area. */
653 BUILD_BUG_ON(!(MODULES_VADDR > __START_KERNEL));
654 BUILD_BUG_ON(!(((MODULES_END - 1) & PGDIR_MASK) ==
655 (__START_KERNEL & PGDIR_MASK)));
658 static int __init enable_pagefaulttrace(char *str)
660 page_fault_trace = 1;
663 __setup("pagefaulttrace", enable_pagefaulttrace);