1 // SPDX-License-Identifier: GPL-2.0
5  *  Copyright (C) 2008-2009, Red Hat Inc., Ingo Molnar
50 			return -1;  in kmmio_fault()
57  * 32-bit mode:
62  * 64-bit mode:
89 		 * In 64-bit mode 0x40..0x4F are valid REX prefixes  in check_prefetch_opcode()
117 			c->x86_vendor == X86_VENDOR_AMD &&  in is_amd_k8_pre_npt()
118 			c->x86 == 0xf && c->x86_model < 0x40);  in is_amd_k8_pre_npt()
128 	/* Erratum #91 affects AMD K8, pre-NPT CPUs */  in is_prefetch()
144 	 * not-present page (e.g. due to a race).  No one has ever  in is_prefetch()
190 	 * and redundant with the set_pmd() on non-PAE. As would  in vmalloc_sync_one()
222  *   where it synchronizes this update with the other page-tables in the
228  *   which are not mapped in every page-table in the system, causing an
229  *   unhandled page-fault when they are accessed.
239 		return -1;  in vmalloc_fault()
242 	 * Synchronize this task's top level page-table  in vmalloc_fault()
251 		return -1;  in vmalloc_fault()
258 		return -1;  in vmalloc_fault()
278 			pgt_lock = &pgd_page_get_mm(page)->page_table_lock;  in arch_sync_kernel_mappings()
319 	 * And let's rather not kmap-atomic the pte, just in case  in dump_pagetable()
416  * Does nothing on 32-bit.
428 	if (address != regs->ip)  in is_errata93()
438 		regs->ip = address;  in is_errata93()
456 	if ((regs->cs == __USER32_CS || (regs->cs & (1<<2))) && (address >> 32))  in is_errata100()
487 	if (offset + sizeof(struct ldttss_desc) >= gdt->size) {  in show_ldttss()
488 		pr_alert("%s: 0x%hx -- out of bounds\n", name, index);  in show_ldttss()
492 	if (copy_from_kernel_nofault(&desc, (void *)(gdt->address + offset),  in show_ldttss()
494 		pr_alert("%s: 0x%hx -- GDT entry is not readable\n",  in show_ldttss()
503 	pr_alert("%s: 0x%hx -- base=0x%lx limit=0x%x\n",  in show_ldttss()
524 			pr_crit("kernel tried to execute NX-protected page - exploit attempt? (uid: %d)\n",  in show_fault_oops()
546 	pr_alert("#PF: error_code(0x%04lx) - %s\n", error_code,  in show_fault_oops()
547 		 !(error_code & X86_PF_PROT) ? "not-present page" :  in show_fault_oops()
568 		/* Usable even on Xen PV -- it's just slow. */  in show_fault_oops()
597 	       tsk->comm, address);  in pgtable_bad()
611 	 * table layout, pretend that user-mode accesses to  in sanitize_error_code()
627 	tsk->thread.trap_nr = X86_TRAP_PF;  in set_signal_archinfo()
628 	tsk->thread.error_code = error_code | X86_PF_USER;  in set_signal_archinfo()
629 	tsk->thread.cr2 = address;  in set_signal_archinfo()
647 		goto oops;  in page_fault_oops()
653 	 * stack in the direct map, but that's not an overflow -- check  in page_fault_oops()
661 		 * double-fault even before we get this far, in which case  in page_fault_oops()
662 		 * we're fine: the double-fault handler will deal with it.  in page_fault_oops()
664 		 * We don't want to make it all the way into the oops code  in page_fault_oops()
665 		 * and then double-fault, though, because we're likely to  in page_fault_oops()
666 		 * break the console driver and lose most of the stack dump.  in page_fault_oops()
668 		call_on_stack(__this_cpu_ist_top_va(DF) - sizeof(void*),  in page_fault_oops()
679 	 * this happens, EFI has a special OOPS path that will try to  in page_fault_oops()
685 	/* Only not-present faults should be handled by KFENCE. */  in page_fault_oops()
690 oops:  in page_fault_oops()
692 	 * Oops. The kernel tried to access some bad page. We'll have to  in page_fault_oops()
703 	if (__die("Oops", regs, error_code))  in page_fault_oops()
706 	/* Executive summary in case the body of the oops scrolled away */  in page_fault_oops()
735 		if (current->thread.sig_on_uaccess_err && signal) {  in kernelmode_fixup_or_oops()
783 		loglvl, tsk->comm, task_pid_nr(tsk), address,  in show_signal_msg()
784 		(void *)regs->ip, (void *)regs->sp, error_code);  in show_signal_msg()
786 	print_vma_addr(KERN_CONT " in ", regs->ip);  in show_signal_msg()
789 	 * Dump the likely CPU where the fatal segfault happened.  in show_signal_msg()
803  * of the address space that has user-accessible permissions.
823 		/* Implicit user access to kernel memory -- just oops */  in __bad_area_nosemaphore()
873 	struct mm_struct *mm = current->mm;  in __bad_area()
949 	/* User-space => ok to do another page fault: */  in do_sigbus()
967 			tsk->comm, tsk->pid, address);  in do_sigbus()
994  * permissions of a kernel page (RO -> RW or NX -> X).  Doing it
996  * cross-processor TLB flush, even if no stale TLB entries exist
1000  * fewer permission than the page table entry.  Non-present (P = 0)
1003  * There are no security implications to leaving a stale TLB when
1006  * Returns non-zero if a spurious fault was handled, zero otherwise.
1089 	 * a follow-up action to resolve the fault, like a COW.  in access_error()
1099 	 * error even in cases where no actual access violation  in access_error()
1120 		if (unlikely(!(vma->vm_flags & VM_SHADOW_STACK)))  in access_error()
1122 		if (unlikely(!(vma->vm_flags & VM_WRITE)))  in access_error()
1129 		if (unlikely(vma->vm_flags & VM_SHADOW_STACK))  in access_error()
1131 		if (unlikely(!(vma->vm_flags & VM_WRITE)))  in access_error()
1150 	 * On 64-bit systems, the vsyscall page is at an address above  in fault_in_kernel_space()
1171 	 * have no user pages in the kernel portion of the address  in do_kern_addr_fault()
1178 	 * We can fault-in kernel-space virtual memory on-demand. The  in do_kern_addr_fault()
1186 	 * Before doing this on-demand faulting, ensure that the  in do_kern_addr_fault()
1189 	 * 2. A fault caused by a user-mode access.  (Do not demand-  in do_kern_addr_fault()
1190 	 *    fault kernel memory due to user-mode accesses).  in do_kern_addr_fault()
1191 	 * 3. A fault caused by a page-level protection violation.  in do_kern_addr_fault()
1192 	 *    (A demand fault would be on a non-present page which  in do_kern_addr_fault()
1195 	 * This is only needed to close a race condition on x86-32 in  in do_kern_addr_fault()
1197 	 * vmalloc_fault() for details. On x86-64 the race does not  in do_kern_addr_fault()
1250 	mm = tsk->mm;  in do_user_addr_fault()
1287 		     !(regs->flags & X86_EFLAGS_AC))) {  in do_user_addr_fault()
1289 		 * No extable entry here.  This was a kernel access to an  in do_user_addr_fault()
1297 	 * If we're in an interrupt, have no user context or are running  in do_user_addr_fault()
1309 	 * User-mode registers count as a user access even for any  in do_user_addr_fault()
1316 		if (regs->flags & X86_EFLAGS_IF)  in do_user_addr_fault()
1323 	 * Read-only permissions can not be expressed in shadow stack PTEs.  in do_user_addr_fault()
1433 	 * and if there is a fatal signal pending there is no guarantee  in do_user_addr_fault()
1464 		 * oom-killed):  in do_user_addr_fault()
1501 	/* Was the fault on kernel-controlled part of the address space? */  in handle_page_fault()
1522 	prefetchw(&current->mm->mmap_lock);  in DEFINE_IDTENTRY_RAW_ERRORCODE()