1 // SPDX-License-Identifier: GPL-2.0-only 2 /* 3 * linux/arch/arm/kernel/traps.c 4 * 5 * Copyright (C) 1995-2009 Russell King 6 * Fragments that appear the same as linux/arch/i386/kernel/traps.c (C) Linus Torvalds 7 * 8 * 'traps.c' handles hardware exceptions after we have saved some state in 9 * 'linux/arch/arm/lib/traps.S'. Mostly a debugging aid, but will probably 10 * kill the offending process. 11 */ 12 #include <linux/signal.h> 13 #include <linux/personality.h> 14 #include <linux/kallsyms.h> 15 #include <linux/spinlock.h> 16 #include <linux/uaccess.h> 17 #include <linux/hardirq.h> 18 #include <linux/kdebug.h> 19 #include <linux/kprobes.h> 20 #include <linux/module.h> 21 #include <linux/kexec.h> 22 #include <linux/bug.h> 23 #include <linux/delay.h> 24 #include <linux/init.h> 25 #include <linux/sched/signal.h> 26 #include <linux/sched/debug.h> 27 #include <linux/sched/task_stack.h> 28 #include <linux/irq.h> 29 #include <linux/vmalloc.h> 30 31 #include <linux/atomic.h> 32 #include <asm/cacheflush.h> 33 #include <asm/exception.h> 34 #include <asm/spectre.h> 35 #include <asm/unistd.h> 36 #include <asm/traps.h> 37 #include <asm/ptrace.h> 38 #include <asm/unwind.h> 39 #include <asm/tls.h> 40 #include <asm/stacktrace.h> 41 #include <asm/system_misc.h> 42 #include <asm/opcodes.h> 43 44 45 static const char *handler[]= { 46 "prefetch abort", 47 "data abort", 48 "address exception", 49 "interrupt", 50 "undefined instruction", 51 }; 52 53 void *vectors_page; 54 55 #ifdef CONFIG_DEBUG_USER 56 unsigned int user_debug; 57 58 static int __init user_debug_setup(char *str) 59 { 60 get_option(&str, &user_debug); 61 return 1; 62 } 63 __setup("user_debug=", user_debug_setup); 64 #endif 65 66 void dump_backtrace_entry(unsigned long where, unsigned long from, 67 unsigned long frame, const char *loglvl) 68 { 69 unsigned long end = frame + 4 + sizeof(struct pt_regs); 70 71 if (IS_ENABLED(CONFIG_UNWINDER_FRAME_POINTER) && 72 IS_ENABLED(CONFIG_CC_IS_GCC) && 73 end > ALIGN(frame, THREAD_SIZE)) { 74 /* 75 * If we are walking past the end of the stack, it may be due 76 * to the fact that we are on an IRQ or overflow stack. In this 77 * case, we can load the address of the other stack from the 78 * frame record. 79 */ 80 frame = ((unsigned long *)frame)[-2] - 4; 81 end = frame + 4 + sizeof(struct pt_regs); 82 } 83 84 #ifndef CONFIG_KALLSYMS 85 printk("%sFunction entered at [<%08lx>] from [<%08lx>]\n", 86 loglvl, where, from); 87 #elif defined CONFIG_BACKTRACE_VERBOSE 88 printk("%s[<%08lx>] (%ps) from [<%08lx>] (%pS)\n", 89 loglvl, where, (void *)where, from, (void *)from); 90 #else 91 printk("%s %ps from %pS\n", loglvl, (void *)where, (void *)from); 92 #endif 93 94 if (in_entry_text(from) && end <= ALIGN(frame, THREAD_SIZE)) 95 dump_mem(loglvl, "Exception stack", frame + 4, end); 96 } 97 98 void dump_backtrace_stm(u32 *stack, u32 instruction, const char *loglvl) 99 { 100 char str[80], *p; 101 unsigned int x; 102 int reg; 103 104 for (reg = 10, x = 0, p = str; reg >= 0; reg--) { 105 if (instruction & BIT(reg)) { 106 p += sprintf(p, " r%d:%08x", reg, *stack--); 107 if (++x == 6) { 108 x = 0; 109 p = str; 110 printk("%s%s\n", loglvl, str); 111 } 112 } 113 } 114 if (p != str) 115 printk("%s%s\n", loglvl, str); 116 } 117 118 #ifndef CONFIG_ARM_UNWIND 119 /* 120 * Stack pointers should always be within the kernels view of 121 * physical memory. If it is not there, then we can't dump 122 * out any information relating to the stack. 123 */ 124 static int verify_stack(unsigned long sp) 125 { 126 if (sp < PAGE_OFFSET || 127 (!IS_ENABLED(CONFIG_VMAP_STACK) && 128 sp > (unsigned long)high_memory && high_memory != NULL)) 129 return -EFAULT; 130 131 return 0; 132 } 133 #endif 134 135 /* 136 * Dump out the contents of some memory nicely... 137 */ 138 void dump_mem(const char *lvl, const char *str, unsigned long bottom, 139 unsigned long top) 140 { 141 unsigned long first; 142 int i; 143 144 printk("%s%s(0x%08lx to 0x%08lx)\n", lvl, str, bottom, top); 145 146 for (first = bottom & ~31; first < top; first += 32) { 147 unsigned long p; 148 char str[sizeof(" 12345678") * 8 + 1]; 149 150 memset(str, ' ', sizeof(str)); 151 str[sizeof(str) - 1] = '\0'; 152 153 for (p = first, i = 0; i < 8 && p < top; i++, p += 4) { 154 if (p >= bottom && p < top) { 155 unsigned long val; 156 if (!get_kernel_nofault(val, (unsigned long *)p)) 157 sprintf(str + i * 9, " %08lx", val); 158 else 159 sprintf(str + i * 9, " ????????"); 160 } 161 } 162 printk("%s%04lx:%s\n", lvl, first & 0xffff, str); 163 } 164 } 165 166 static void dump_instr(const char *lvl, struct pt_regs *regs) 167 { 168 unsigned long addr = instruction_pointer(regs); 169 const int thumb = thumb_mode(regs); 170 const int width = thumb ? 4 : 8; 171 char str[sizeof("00000000 ") * 5 + 2 + 1], *p = str; 172 int i; 173 174 /* 175 * Note that we now dump the code first, just in case the backtrace 176 * kills us. 177 */ 178 179 for (i = -4; i < 1 + !!thumb; i++) { 180 unsigned int val, bad; 181 182 if (thumb) { 183 u16 tmp; 184 185 if (user_mode(regs)) 186 bad = get_user(tmp, &((u16 __user *)addr)[i]); 187 else 188 bad = get_kernel_nofault(tmp, &((u16 *)addr)[i]); 189 190 val = __mem_to_opcode_thumb16(tmp); 191 } else { 192 if (user_mode(regs)) 193 bad = get_user(val, &((u32 __user *)addr)[i]); 194 else 195 bad = get_kernel_nofault(val, &((u32 *)addr)[i]); 196 197 val = __mem_to_opcode_arm(val); 198 } 199 200 if (!bad) 201 p += sprintf(p, i == 0 ? "(%0*x) " : "%0*x ", 202 width, val); 203 else { 204 p += sprintf(p, "bad PC value"); 205 break; 206 } 207 } 208 printk("%sCode: %s\n", lvl, str); 209 } 210 211 #ifdef CONFIG_ARM_UNWIND 212 void dump_backtrace(struct pt_regs *regs, struct task_struct *tsk, 213 const char *loglvl) 214 { 215 unwind_backtrace(regs, tsk, loglvl); 216 } 217 #else 218 void dump_backtrace(struct pt_regs *regs, struct task_struct *tsk, 219 const char *loglvl) 220 { 221 unsigned int fp, mode; 222 int ok = 1; 223 224 printk("%sCall trace: ", loglvl); 225 226 if (!tsk) 227 tsk = current; 228 229 if (regs) { 230 fp = frame_pointer(regs); 231 mode = processor_mode(regs); 232 } else if (tsk != current) { 233 fp = thread_saved_fp(tsk); 234 mode = 0x10; 235 } else { 236 asm("mov %0, fp" : "=r" (fp) : : "cc"); 237 mode = 0x10; 238 } 239 240 if (!fp) { 241 pr_cont("no frame pointer"); 242 ok = 0; 243 } else if (verify_stack(fp)) { 244 pr_cont("invalid frame pointer 0x%08x", fp); 245 ok = 0; 246 } else if (fp < (unsigned long)end_of_stack(tsk)) 247 pr_cont("frame pointer underflow"); 248 pr_cont("\n"); 249 250 if (ok) 251 c_backtrace(fp, mode, loglvl); 252 } 253 #endif 254 255 void show_stack(struct task_struct *tsk, unsigned long *sp, const char *loglvl) 256 { 257 dump_backtrace(NULL, tsk, loglvl); 258 barrier(); 259 } 260 261 #ifdef CONFIG_PREEMPT 262 #define S_PREEMPT " PREEMPT" 263 #elif defined(CONFIG_PREEMPT_RT) 264 #define S_PREEMPT " PREEMPT_RT" 265 #else 266 #define S_PREEMPT "" 267 #endif 268 #ifdef CONFIG_SMP 269 #define S_SMP " SMP" 270 #else 271 #define S_SMP "" 272 #endif 273 #ifdef CONFIG_THUMB2_KERNEL 274 #define S_ISA " THUMB2" 275 #else 276 #define S_ISA " ARM" 277 #endif 278 279 static int __die(const char *str, int err, struct pt_regs *regs) 280 { 281 struct task_struct *tsk = current; 282 static int die_counter; 283 int ret; 284 285 pr_emerg("Internal error: %s: %x [#%d]" S_PREEMPT S_SMP S_ISA "\n", 286 str, err, ++die_counter); 287 288 /* trap and error numbers are mostly meaningless on ARM */ 289 ret = notify_die(DIE_OOPS, str, regs, err, tsk->thread.trap_no, SIGSEGV); 290 if (ret == NOTIFY_STOP) 291 return 1; 292 293 print_modules(); 294 __show_regs(regs); 295 __show_regs_alloc_free(regs); 296 pr_emerg("Process %.*s (pid: %d, stack limit = 0x%p)\n", 297 TASK_COMM_LEN, tsk->comm, task_pid_nr(tsk), end_of_stack(tsk)); 298 299 if (!user_mode(regs) || in_interrupt()) { 300 dump_mem(KERN_EMERG, "Stack: ", regs->ARM_sp, 301 ALIGN(regs->ARM_sp - THREAD_SIZE, THREAD_ALIGN) 302 + THREAD_SIZE); 303 dump_backtrace(regs, tsk, KERN_EMERG); 304 dump_instr(KERN_EMERG, regs); 305 } 306 307 return 0; 308 } 309 310 static arch_spinlock_t die_lock = __ARCH_SPIN_LOCK_UNLOCKED; 311 static int die_owner = -1; 312 static unsigned int die_nest_count; 313 314 static unsigned long oops_begin(void) 315 { 316 int cpu; 317 unsigned long flags; 318 319 oops_enter(); 320 321 /* racy, but better than risking deadlock. */ 322 raw_local_irq_save(flags); 323 cpu = smp_processor_id(); 324 if (!arch_spin_trylock(&die_lock)) { 325 if (cpu == die_owner) 326 /* nested oops. should stop eventually */; 327 else 328 arch_spin_lock(&die_lock); 329 } 330 die_nest_count++; 331 die_owner = cpu; 332 console_verbose(); 333 bust_spinlocks(1); 334 return flags; 335 } 336 337 static void oops_end(unsigned long flags, struct pt_regs *regs, int signr) 338 { 339 if (regs && kexec_should_crash(current)) 340 crash_kexec(regs); 341 342 bust_spinlocks(0); 343 die_owner = -1; 344 add_taint(TAINT_DIE, LOCKDEP_NOW_UNRELIABLE); 345 die_nest_count--; 346 if (!die_nest_count) 347 /* Nest count reaches zero, release the lock. */ 348 arch_spin_unlock(&die_lock); 349 raw_local_irq_restore(flags); 350 oops_exit(); 351 352 if (in_interrupt()) 353 panic("Fatal exception in interrupt"); 354 if (panic_on_oops) 355 panic("Fatal exception"); 356 if (signr) 357 make_task_dead(signr); 358 } 359 360 /* 361 * This function is protected against re-entrancy. 362 */ 363 void die(const char *str, struct pt_regs *regs, int err) 364 { 365 enum bug_trap_type bug_type = BUG_TRAP_TYPE_NONE; 366 unsigned long flags = oops_begin(); 367 int sig = SIGSEGV; 368 369 if (!user_mode(regs)) 370 bug_type = report_bug(regs->ARM_pc, regs); 371 if (bug_type != BUG_TRAP_TYPE_NONE) 372 str = "Oops - BUG"; 373 374 if (__die(str, err, regs)) 375 sig = 0; 376 377 oops_end(flags, regs, sig); 378 } 379 380 void arm_notify_die(const char *str, struct pt_regs *regs, 381 int signo, int si_code, void __user *addr, 382 unsigned long err, unsigned long trap) 383 { 384 if (user_mode(regs)) { 385 current->thread.error_code = err; 386 current->thread.trap_no = trap; 387 388 force_sig_fault(signo, si_code, addr); 389 } else { 390 die(str, regs, err); 391 } 392 } 393 394 #ifdef CONFIG_GENERIC_BUG 395 396 int is_valid_bugaddr(unsigned long pc) 397 { 398 #ifdef CONFIG_THUMB2_KERNEL 399 u16 bkpt; 400 u16 insn = __opcode_to_mem_thumb16(BUG_INSTR_VALUE); 401 #else 402 u32 bkpt; 403 u32 insn = __opcode_to_mem_arm(BUG_INSTR_VALUE); 404 #endif 405 406 if (get_kernel_nofault(bkpt, (void *)pc)) 407 return 0; 408 409 return bkpt == insn; 410 } 411 412 #endif 413 414 static LIST_HEAD(undef_hook); 415 static DEFINE_RAW_SPINLOCK(undef_lock); 416 417 void register_undef_hook(struct undef_hook *hook) 418 { 419 unsigned long flags; 420 421 raw_spin_lock_irqsave(&undef_lock, flags); 422 list_add(&hook->node, &undef_hook); 423 raw_spin_unlock_irqrestore(&undef_lock, flags); 424 } 425 426 void unregister_undef_hook(struct undef_hook *hook) 427 { 428 unsigned long flags; 429 430 raw_spin_lock_irqsave(&undef_lock, flags); 431 list_del(&hook->node); 432 raw_spin_unlock_irqrestore(&undef_lock, flags); 433 } 434 435 static nokprobe_inline 436 int call_undef_hook(struct pt_regs *regs, unsigned int instr) 437 { 438 struct undef_hook *hook; 439 unsigned long flags; 440 int (*fn)(struct pt_regs *regs, unsigned int instr) = NULL; 441 442 raw_spin_lock_irqsave(&undef_lock, flags); 443 list_for_each_entry(hook, &undef_hook, node) 444 if ((instr & hook->instr_mask) == hook->instr_val && 445 (regs->ARM_cpsr & hook->cpsr_mask) == hook->cpsr_val) 446 fn = hook->fn; 447 raw_spin_unlock_irqrestore(&undef_lock, flags); 448 449 return fn ? fn(regs, instr) : 1; 450 } 451 452 asmlinkage void do_undefinstr(struct pt_regs *regs) 453 { 454 unsigned int instr; 455 void __user *pc; 456 457 pc = (void __user *)instruction_pointer(regs); 458 459 if (processor_mode(regs) == SVC_MODE) { 460 #ifdef CONFIG_THUMB2_KERNEL 461 if (thumb_mode(regs)) { 462 instr = __mem_to_opcode_thumb16(((u16 *)pc)[0]); 463 if (is_wide_instruction(instr)) { 464 u16 inst2; 465 inst2 = __mem_to_opcode_thumb16(((u16 *)pc)[1]); 466 instr = __opcode_thumb32_compose(instr, inst2); 467 } 468 } else 469 #endif 470 instr = __mem_to_opcode_arm(*(u32 *) pc); 471 } else if (thumb_mode(regs)) { 472 if (get_user(instr, (u16 __user *)pc)) 473 goto die_sig; 474 instr = __mem_to_opcode_thumb16(instr); 475 if (is_wide_instruction(instr)) { 476 unsigned int instr2; 477 if (get_user(instr2, (u16 __user *)pc+1)) 478 goto die_sig; 479 instr2 = __mem_to_opcode_thumb16(instr2); 480 instr = __opcode_thumb32_compose(instr, instr2); 481 } 482 } else { 483 if (get_user(instr, (u32 __user *)pc)) 484 goto die_sig; 485 instr = __mem_to_opcode_arm(instr); 486 } 487 488 if (call_undef_hook(regs, instr) == 0) 489 return; 490 491 die_sig: 492 #ifdef CONFIG_DEBUG_USER 493 if (user_debug & UDBG_UNDEFINED) { 494 pr_info("%s (%d): undefined instruction: pc=%px\n", 495 current->comm, task_pid_nr(current), pc); 496 __show_regs(regs); 497 dump_instr(KERN_INFO, regs); 498 } 499 #endif 500 arm_notify_die("Oops - undefined instruction", regs, 501 SIGILL, ILL_ILLOPC, pc, 0, 6); 502 } 503 NOKPROBE_SYMBOL(do_undefinstr) 504 505 /* 506 * Handle FIQ similarly to NMI on x86 systems. 507 * 508 * The runtime environment for NMIs is extremely restrictive 509 * (NMIs can pre-empt critical sections meaning almost all locking is 510 * forbidden) meaning this default FIQ handling must only be used in 511 * circumstances where non-maskability improves robustness, such as 512 * watchdog or debug logic. 513 * 514 * This handler is not appropriate for general purpose use in drivers 515 * platform code and can be overrideen using set_fiq_handler. 516 */ 517 asmlinkage void __exception_irq_entry handle_fiq_as_nmi(struct pt_regs *regs) 518 { 519 struct pt_regs *old_regs = set_irq_regs(regs); 520 521 nmi_enter(); 522 523 /* nop. FIQ handlers for special arch/arm features can be added here. */ 524 525 nmi_exit(); 526 527 set_irq_regs(old_regs); 528 } 529 530 /* 531 * bad_mode handles the impossible case in the vectors. If you see one of 532 * these, then it's extremely serious, and could mean you have buggy hardware. 533 * It never returns, and never tries to sync. We hope that we can at least 534 * dump out some state information... 535 */ 536 asmlinkage void bad_mode(struct pt_regs *regs, int reason) 537 { 538 console_verbose(); 539 540 pr_crit("Bad mode in %s handler detected\n", handler[reason]); 541 542 die("Oops - bad mode", regs, 0); 543 local_irq_disable(); 544 panic("bad mode"); 545 } 546 547 static int bad_syscall(int n, struct pt_regs *regs) 548 { 549 if ((current->personality & PER_MASK) != PER_LINUX) { 550 send_sig(SIGSEGV, current, 1); 551 return regs->ARM_r0; 552 } 553 554 #ifdef CONFIG_DEBUG_USER 555 if (user_debug & UDBG_SYSCALL) { 556 pr_err("[%d] %s: obsolete system call %08x.\n", 557 task_pid_nr(current), current->comm, n); 558 dump_instr(KERN_ERR, regs); 559 } 560 #endif 561 562 arm_notify_die("Oops - bad syscall", regs, SIGILL, ILL_ILLTRP, 563 (void __user *)instruction_pointer(regs) - 564 (thumb_mode(regs) ? 2 : 4), 565 n, 0); 566 567 return regs->ARM_r0; 568 } 569 570 static inline int 571 __do_cache_op(unsigned long start, unsigned long end) 572 { 573 unsigned int ua_flags; 574 int ret; 575 576 do { 577 unsigned long chunk = min(PAGE_SIZE, end - start); 578 579 if (fatal_signal_pending(current)) 580 return 0; 581 582 ua_flags = uaccess_save_and_enable(); 583 ret = flush_icache_user_range(start, start + chunk); 584 uaccess_restore(ua_flags); 585 if (ret) 586 return ret; 587 588 cond_resched(); 589 start += chunk; 590 } while (start < end); 591 592 return 0; 593 } 594 595 static inline int 596 do_cache_op(unsigned long start, unsigned long end, int flags) 597 { 598 if (end < start || flags) 599 return -EINVAL; 600 601 if (!access_ok((void __user *)start, end - start)) 602 return -EFAULT; 603 604 return __do_cache_op(start, end); 605 } 606 607 /* 608 * Handle all unrecognised system calls. 609 * 0x9f0000 - 0x9fffff are some more esoteric system calls 610 */ 611 #define NR(x) ((__ARM_NR_##x) - __ARM_NR_BASE) 612 asmlinkage int arm_syscall(int no, struct pt_regs *regs) 613 { 614 if ((no >> 16) != (__ARM_NR_BASE>> 16)) 615 return bad_syscall(no, regs); 616 617 switch (no & 0xffff) { 618 case 0: /* branch through 0 */ 619 arm_notify_die("branch through zero", regs, 620 SIGSEGV, SEGV_MAPERR, NULL, 0, 0); 621 return 0; 622 623 case NR(breakpoint): /* SWI BREAK_POINT */ 624 regs->ARM_pc -= thumb_mode(regs) ? 2 : 4; 625 ptrace_break(regs); 626 return regs->ARM_r0; 627 628 /* 629 * Flush a region from virtual address 'r0' to virtual address 'r1' 630 * _exclusive_. There is no alignment requirement on either address; 631 * user space does not need to know the hardware cache layout. 632 * 633 * r2 contains flags. It should ALWAYS be passed as ZERO until it 634 * is defined to be something else. For now we ignore it, but may 635 * the fires of hell burn in your belly if you break this rule. ;) 636 * 637 * (at a later date, we may want to allow this call to not flush 638 * various aspects of the cache. Passing '0' will guarantee that 639 * everything necessary gets flushed to maintain consistency in 640 * the specified region). 641 */ 642 case NR(cacheflush): 643 return do_cache_op(regs->ARM_r0, regs->ARM_r1, regs->ARM_r2); 644 645 case NR(usr26): 646 if (!(elf_hwcap & HWCAP_26BIT)) 647 break; 648 regs->ARM_cpsr &= ~MODE32_BIT; 649 return regs->ARM_r0; 650 651 case NR(usr32): 652 if (!(elf_hwcap & HWCAP_26BIT)) 653 break; 654 regs->ARM_cpsr |= MODE32_BIT; 655 return regs->ARM_r0; 656 657 case NR(set_tls): 658 set_tls(regs->ARM_r0); 659 return 0; 660 661 case NR(get_tls): 662 return current_thread_info()->tp_value[0]; 663 664 default: 665 /* Calls 9f00xx..9f07ff are defined to return -ENOSYS 666 if not implemented, rather than raising SIGILL. This 667 way the calling program can gracefully determine whether 668 a feature is supported. */ 669 if ((no & 0xffff) <= 0x7ff) 670 return -ENOSYS; 671 break; 672 } 673 #ifdef CONFIG_DEBUG_USER 674 /* 675 * experience shows that these seem to indicate that 676 * something catastrophic has happened 677 */ 678 if (user_debug & UDBG_SYSCALL) { 679 pr_err("[%d] %s: arm syscall %d\n", 680 task_pid_nr(current), current->comm, no); 681 dump_instr(KERN_ERR, regs); 682 if (user_mode(regs)) { 683 __show_regs(regs); 684 c_backtrace(frame_pointer(regs), processor_mode(regs), KERN_ERR); 685 } 686 } 687 #endif 688 arm_notify_die("Oops - bad syscall(2)", regs, SIGILL, ILL_ILLTRP, 689 (void __user *)instruction_pointer(regs) - 690 (thumb_mode(regs) ? 2 : 4), 691 no, 0); 692 return 0; 693 } 694 695 #ifdef CONFIG_TLS_REG_EMUL 696 697 /* 698 * We might be running on an ARMv6+ processor which should have the TLS 699 * register but for some reason we can't use it, or maybe an SMP system 700 * using a pre-ARMv6 processor (there are apparently a few prototypes like 701 * that in existence) and therefore access to that register must be 702 * emulated. 703 */ 704 705 static int get_tp_trap(struct pt_regs *regs, unsigned int instr) 706 { 707 int reg = (instr >> 12) & 15; 708 if (reg == 15) 709 return 1; 710 regs->uregs[reg] = current_thread_info()->tp_value[0]; 711 regs->ARM_pc += 4; 712 return 0; 713 } 714 715 static struct undef_hook arm_mrc_hook = { 716 .instr_mask = 0x0fff0fff, 717 .instr_val = 0x0e1d0f70, 718 .cpsr_mask = PSR_T_BIT, 719 .cpsr_val = 0, 720 .fn = get_tp_trap, 721 }; 722 723 static int __init arm_mrc_hook_init(void) 724 { 725 register_undef_hook(&arm_mrc_hook); 726 return 0; 727 } 728 729 late_initcall(arm_mrc_hook_init); 730 731 #endif 732 733 /* 734 * A data abort trap was taken, but we did not handle the instruction. 735 * Try to abort the user program, or panic if it was the kernel. 736 */ 737 asmlinkage void 738 baddataabort(int code, unsigned long instr, struct pt_regs *regs) 739 { 740 unsigned long addr = instruction_pointer(regs); 741 742 #ifdef CONFIG_DEBUG_USER 743 if (user_debug & UDBG_BADABORT) { 744 pr_err("8<--- cut here ---\n"); 745 pr_err("[%d] %s: bad data abort: code %d instr 0x%08lx\n", 746 task_pid_nr(current), current->comm, code, instr); 747 dump_instr(KERN_ERR, regs); 748 show_pte(KERN_ERR, current->mm, addr); 749 } 750 #endif 751 752 arm_notify_die("unknown data abort code", regs, 753 SIGILL, ILL_ILLOPC, (void __user *)addr, instr, 0); 754 } 755 756 void __readwrite_bug(const char *fn) 757 { 758 pr_err("%s called, but not implemented\n", fn); 759 BUG(); 760 } 761 EXPORT_SYMBOL(__readwrite_bug); 762 763 #ifdef CONFIG_MMU 764 void __pte_error(const char *file, int line, pte_t pte) 765 { 766 pr_err("%s:%d: bad pte %08llx.\n", file, line, (long long)pte_val(pte)); 767 } 768 769 void __pmd_error(const char *file, int line, pmd_t pmd) 770 { 771 pr_err("%s:%d: bad pmd %08llx.\n", file, line, (long long)pmd_val(pmd)); 772 } 773 774 void __pgd_error(const char *file, int line, pgd_t pgd) 775 { 776 pr_err("%s:%d: bad pgd %08llx.\n", file, line, (long long)pgd_val(pgd)); 777 } 778 #endif 779 780 asmlinkage void __div0(void) 781 { 782 pr_err("Division by zero in kernel.\n"); 783 dump_stack(); 784 } 785 EXPORT_SYMBOL(__div0); 786 787 void abort(void) 788 { 789 BUG(); 790 791 /* if that doesn't kill us, halt */ 792 panic("Oops failed to kill thread"); 793 } 794 795 #ifdef CONFIG_KUSER_HELPERS 796 static void __init kuser_init(void *vectors) 797 { 798 extern char __kuser_helper_start[], __kuser_helper_end[]; 799 int kuser_sz = __kuser_helper_end - __kuser_helper_start; 800 801 memcpy(vectors + 0x1000 - kuser_sz, __kuser_helper_start, kuser_sz); 802 803 /* 804 * vectors + 0xfe0 = __kuser_get_tls 805 * vectors + 0xfe8 = hardware TLS instruction at 0xffff0fe8 806 */ 807 if (tls_emu || has_tls_reg) 808 memcpy(vectors + 0xfe0, vectors + 0xfe8, 4); 809 } 810 #else 811 static inline void __init kuser_init(void *vectors) 812 { 813 } 814 #endif 815 816 #ifndef CONFIG_CPU_V7M 817 static void copy_from_lma(void *vma, void *lma_start, void *lma_end) 818 { 819 memcpy(vma, lma_start, lma_end - lma_start); 820 } 821 822 static void flush_vectors(void *vma, size_t offset, size_t size) 823 { 824 unsigned long start = (unsigned long)vma + offset; 825 unsigned long end = start + size; 826 827 flush_icache_range(start, end); 828 } 829 830 #ifdef CONFIG_HARDEN_BRANCH_HISTORY 831 int spectre_bhb_update_vectors(unsigned int method) 832 { 833 extern char __vectors_bhb_bpiall_start[], __vectors_bhb_bpiall_end[]; 834 extern char __vectors_bhb_loop8_start[], __vectors_bhb_loop8_end[]; 835 void *vec_start, *vec_end; 836 837 if (system_state >= SYSTEM_FREEING_INITMEM) { 838 pr_err("CPU%u: Spectre BHB workaround too late - system vulnerable\n", 839 smp_processor_id()); 840 return SPECTRE_VULNERABLE; 841 } 842 843 switch (method) { 844 case SPECTRE_V2_METHOD_LOOP8: 845 vec_start = __vectors_bhb_loop8_start; 846 vec_end = __vectors_bhb_loop8_end; 847 break; 848 849 case SPECTRE_V2_METHOD_BPIALL: 850 vec_start = __vectors_bhb_bpiall_start; 851 vec_end = __vectors_bhb_bpiall_end; 852 break; 853 854 default: 855 pr_err("CPU%u: unknown Spectre BHB state %d\n", 856 smp_processor_id(), method); 857 return SPECTRE_VULNERABLE; 858 } 859 860 copy_from_lma(vectors_page, vec_start, vec_end); 861 flush_vectors(vectors_page, 0, vec_end - vec_start); 862 863 return SPECTRE_MITIGATED; 864 } 865 #endif 866 867 void __init early_trap_init(void *vectors_base) 868 { 869 extern char __stubs_start[], __stubs_end[]; 870 extern char __vectors_start[], __vectors_end[]; 871 unsigned i; 872 873 vectors_page = vectors_base; 874 875 /* 876 * Poison the vectors page with an undefined instruction. This 877 * instruction is chosen to be undefined for both ARM and Thumb 878 * ISAs. The Thumb version is an undefined instruction with a 879 * branch back to the undefined instruction. 880 */ 881 for (i = 0; i < PAGE_SIZE / sizeof(u32); i++) 882 ((u32 *)vectors_base)[i] = 0xe7fddef1; 883 884 /* 885 * Copy the vectors, stubs and kuser helpers (in entry-armv.S) 886 * into the vector page, mapped at 0xffff0000, and ensure these 887 * are visible to the instruction stream. 888 */ 889 copy_from_lma(vectors_base, __vectors_start, __vectors_end); 890 copy_from_lma(vectors_base + 0x1000, __stubs_start, __stubs_end); 891 892 kuser_init(vectors_base); 893 894 flush_vectors(vectors_base, 0, PAGE_SIZE * 2); 895 } 896 #else /* ifndef CONFIG_CPU_V7M */ 897 void __init early_trap_init(void *vectors_base) 898 { 899 /* 900 * on V7-M there is no need to copy the vector table to a dedicated 901 * memory area. The address is configurable and so a table in the kernel 902 * image can be used. 903 */ 904 } 905 #endif 906 907 #ifdef CONFIG_VMAP_STACK 908 909 DECLARE_PER_CPU(u8 *, irq_stack_ptr); 910 911 asmlinkage DEFINE_PER_CPU(u8 *, overflow_stack_ptr); 912 913 static int __init allocate_overflow_stacks(void) 914 { 915 u8 *stack; 916 int cpu; 917 918 for_each_possible_cpu(cpu) { 919 stack = (u8 *)__get_free_page(GFP_KERNEL); 920 if (WARN_ON(!stack)) 921 return -ENOMEM; 922 per_cpu(overflow_stack_ptr, cpu) = &stack[OVERFLOW_STACK_SIZE]; 923 } 924 return 0; 925 } 926 early_initcall(allocate_overflow_stacks); 927 928 asmlinkage void handle_bad_stack(struct pt_regs *regs) 929 { 930 unsigned long tsk_stk = (unsigned long)current->stack; 931 #ifdef CONFIG_IRQSTACKS 932 unsigned long irq_stk = (unsigned long)raw_cpu_read(irq_stack_ptr); 933 #endif 934 unsigned long ovf_stk = (unsigned long)raw_cpu_read(overflow_stack_ptr); 935 936 console_verbose(); 937 pr_emerg("Insufficient stack space to handle exception!"); 938 939 pr_emerg("Task stack: [0x%08lx..0x%08lx]\n", 940 tsk_stk, tsk_stk + THREAD_SIZE); 941 #ifdef CONFIG_IRQSTACKS 942 pr_emerg("IRQ stack: [0x%08lx..0x%08lx]\n", 943 irq_stk - THREAD_SIZE, irq_stk); 944 #endif 945 pr_emerg("Overflow stack: [0x%08lx..0x%08lx]\n", 946 ovf_stk - OVERFLOW_STACK_SIZE, ovf_stk); 947 948 die("kernel stack overflow", regs, 0); 949 } 950 951 #ifndef CONFIG_ARM_LPAE 952 /* 953 * Normally, we rely on the logic in do_translation_fault() to update stale PMD 954 * entries covering the vmalloc space in a task's page tables when it first 955 * accesses the region in question. Unfortunately, this is not sufficient when 956 * the task stack resides in the vmalloc region, as do_translation_fault() is a 957 * C function that needs a stack to run. 958 * 959 * So we need to ensure that these PMD entries are up to date *before* the MM 960 * switch. As we already have some logic in the MM switch path that takes care 961 * of this, let's trigger it by bumping the counter every time the core vmalloc 962 * code modifies a PMD entry in the vmalloc region. Use release semantics on 963 * the store so that other CPUs observing the counter's new value are 964 * guaranteed to see the updated page table entries as well. 965 */ 966 void arch_sync_kernel_mappings(unsigned long start, unsigned long end) 967 { 968 if (start < VMALLOC_END && end > VMALLOC_START) 969 atomic_inc_return_release(&init_mm.context.vmalloc_seq); 970 } 971 #endif 972 #endif 973