Linux page fault handling--User space "Go"

Transferred from: http://blog.csdn.net/vanbreaker/article/details/7870769

Copyright NOTICE: This article for Bo Master original article, without Bo Master permission not reproduced.

There are two types of fault pages in user space--

1. The linear address that triggered the exception is in the VMA of the user space, but the physical page is not assigned, and if Access is OK, the kernel assigns the corresponding physical page to the process.

2. The linear address of the triggering exception is not in the VMA of the user space, this situation is determined not because the user process stack space consumed by the page fault triggered by the exception, if it is in the user space to expand the stack area, and assign the corresponding physical page, if not as an illegal address access to deal with, The kernel will end the process

Here's how the Do_page_fault () function handles the error of user space pages

[CPP]View PlainCopy

2. Dotraplinkage void __kprobes
4. Do_page_fault (struct pt_regs *regs, unsigned long error_code)
6. {
8. struct vm_area_struct *vma;
10. struct task_struct *tsk;
12. unsigned long address;
14. struct mm_struct *mm;
16. int write;
18. int fault;
22. Tsk = current; //Get current process
24. MM = tsk->mm; //Gets the address space of the current process
28. /* Get the faulting address: */
30. Address = Read_cr2 (); //Read the CR2 register to get the access address that triggered the exception
34. ...
36. ...
38. ...
40. ...
44. VMA = FIND_VMA (mm, address); //Try to find a vma,vma that is closest to address contains address or after address
48. / * Does not find such a VMA that there is no virtual memory area after address, so the address is definitely invalid,
50. Handled by the Bad_area () path, the body of the Bad_area () is __bad_area ()-->bad_area_nosemaphore () */
52. if (unlikely (!VMA)) {
54. Bad_area (Regs, Error_code, address);
56. return;
58. }
60. / * If the address is included in VMA, jump to good_area for processing * /
62. if (likely (Vma->vm_start <= address))
64. Goto Good_area;
68. /* is not the first two cases, the decision is not due to the user stack occupied by the page box has been used, and a push instruction
70. An exception that is referenced by a virtual memory region that has not yet been bound to the page box, which belongs to the virtual memory area of the stack, its vm_growsdown bit
72. Be placed */
74. if (Unlikely (!) ( Vma->vm_flags & Vm_growsdown )) {
76. Bad_area (Regs, Error_code, address); //Is not a stack area, it is handled with Bad_area ()
78. return;
80. }
82. if (Error_code & pf_user) {//must be in user space
84. /* 
86. * Accessing the stack below%SP is always a bug.
88. * The large cushion allows instructions like enter
90. * and Pusha to work. ("Enter $65535, $31" pushes
92. * Pointers and then decrements%sp by 65535.)
94. */
96. / * Here, only the address is high enough (the difference from the stack pointer is not greater than 65536+32*sizeof (unsigned long)),
98. To allow the user process to extend its stack address space, otherwise bad_area () processing */
100. if (unlikely (address + 65536 + * sizeof (unsigned long) < REGS->SP)) {
102. Bad_area (Regs, Error_code, address);
104. return;
106. }
108. }
110. if (Unlikely (Expand_stack (VMA, address))) {//stack extension not successful also handled by Bad_area ()
112. Bad_area (Regs, Error_code, address);
114. return;
116. }
120. /* 
122. * Ok, we have a good vm_area for this memory access, so
124. * We can handle it.
126. */
128. Good_area:
130. Write = Error_code & pf_write;
134. / * Insufficient access is handled by Bad_area_access_error (), which is the encapsulation of __bad_area (), except
136. The signal sent to the user process is segv_accerr*/
138. if (Unlikely (Access_error (Error_code, write, VMA))) {
140. Bad_area_access_error (Regs, Error_code, address);
142. return;
144. }
148. /* 
150. * If for any reason at all we couldn ' t handle the fault,
152. * Make sure we exit gracefully rather than endlessly redo
154. * The fault:
156. */
158. /* Assign a new Page table and Page box */
160. Fault = Handle_mm_fault (mm, VMA, address, write?) fault_flag_write:0);
164. if (Unlikely (Fault & Vm_fault_error)) {
166. Mm_fault_error (Regs, Error_code, address, fault);
168. return;
170. }
174. if (fault & vm_fault_major) {
176. tsk->maj_flt++;
178. Perf_sw_event (Perf_count_sw_page_faults_maj, 1, 0,
180. Regs, address);
182. } Else {
184. tsk->min_flt++;
186. Perf_sw_event (perf_count_sw_page_faults_min, 1, 0,
188. Regs, address);
190. }
194. Check_v8086_mode (regs, Address, tsk);
198. Up_read (&mm->mmap_sem);
200. }

The body function of the Bad_area () function is __bad_area ()-->__bad_area_nosemaphore (), which analyzes its handling of illegal access to the kernel in its previous blog post, and now sees its handling of illegal access to user space

[CPP]View PlainCopy

2. __bad_area_nosemaphore (struct pt_regs *regs, unsigned long error_code,
4. Unsigned long address, int si_code)
6. {
8. struct Task_struct *tsk = current;
12. / * User mode accesses just cause a SIGSEGV * /
14. / * error occurs in the user state, then a sigseg signal is sent to the user process v*/
16. if (Error_code & Pf_user) {
18. /* 
20. * It ' s possible to has interrupts off here:
22. */
24. Local_irq_enable ();
28. /* 
30. * Valid to does another page fault here because this one came
32. * FROM User space:
34. */
36. if (Is_prefetch (regs, Error_code, address))
38. return;
42. if (is_errata100 (regs, address))
44. return;
48. if (unlikely (show_unhandled_signals))
50. Show_signal_msg (Regs, Error_code, Address, tsk);
54. /* Kernel addresses is always protection faults: */
56. tsk->thread.cr2 = address;
58. tsk->Thread.error_code = Error_code |  (Address >= task_size);
60. tsk->thread.trap_no = 14;
64. Force_sig_info_fault (SIGSEGV, Si_code, Address, tsk);
68. return;
70. }
72. ...
74. ...
76. }

After determining that the exception is due to the physical page is not assigned, and then through the Good_area path to processing, it is conceivable that the path in determining the access rights sufficient, will complete the page table and the physical page allocation, the task has Handle_mm_fault () function to complete

[CPP]View PlainCopy

2. int Handle_mm_fault (struct mm_struct *mm, struct vm_area_struct *vma,
4. Unsigned long address, unsigned int flags)
6. {
8. pgd_t *PGD;
10. pud_t *pud;
12. pmd_t *PMD;
14. pte_t *pte;
18. __set_current_state (task_running);
22. Count_vm_event (Pgfault);
26. if (Unlikely (Is_vm_hugetlb_page (VMA)))
28. return Hugetlb_fault (mm, VMA, address, flags);
32. PGD = Pgd_offset (mm, address);
34. PUD = Pud_alloc (mm, PGD, address); //Assign the PUD directory
36. if (!pud)
38. return vm_fault_oom;
40. PMD = Pmd_alloc (mm, pud, address); //Assign PMD directory
42. if (!PMD)
44. return vm_fault_oom;
46. Pte = Pte_alloc_map (mm, PMD, address); //Allocation Pte Table
48. if (!pte)
50. return vm_fault_oom;
54. the task of/*handle_pte_fault () is to bind the PTE with a new page box, which will be processed differently depending on the condition of the PTEs page table entry.
56. return Handle_pte_fault (mm, VMA, address, PTE, PMD, flags);
58. }

The processing of the Handle_pte_fault () function is complicated, because it has to do a variety of different processing according to the different state of the physical page corresponding to the PTE page table item, and the specific analysis is given later.

Linux page fault handling--User space "Go"