1 // SPDX-License-Identifier: GPL-2.0 2 /* 3 * S390 version 4 * Copyright IBM Corp. 1999, 2000 5 * Author(s): Martin Schwidefsky (schwidefsky@de.ibm.com), 6 * Denis Joseph Barrow (djbarrow@de.ibm.com,barrow_dj@yahoo.com), 7 * 8 * Derived from "arch/i386/kernel/traps.c" 9 * Copyright (C) 1991, 1992 Linus Torvalds 10 */ 11 12 #include <linux/capability.h> 13 #include <linux/cpufeature.h> 14 #include <linux/debugfs.h> 15 #include <linux/kprobes.h> 16 #include <linux/kdebug.h> 17 #include <linux/randomize_kstack.h> 18 #include <linux/extable.h> 19 #include <linux/ptrace.h> 20 #include <linux/sched.h> 21 #include <linux/sched/debug.h> 22 #include <linux/mm.h> 23 #include <linux/slab.h> 24 #include <linux/uaccess.h> 25 #include <linux/cpu.h> 26 #include <linux/entry-common.h> 27 #include <linux/kmsan.h> 28 #include <linux/bug.h> 29 #include <asm/entry-percpu.h> 30 #include <asm/asm-extable.h> 31 #include <asm/irqflags.h> 32 #include <asm/ptrace.h> 33 #include <asm/vtime.h> 34 #include <asm/fpu.h> 35 #include <asm/fault.h> 36 #include "entry.h" 37 38 struct pgm_stat { 39 unsigned int count[128]; 40 }; 41 42 static DEFINE_PER_CPU_SHARED_ALIGNED(struct pgm_stat, pgm_stat); 43 44 static inline void __user *get_trap_ip(struct pt_regs *regs) 45 { 46 unsigned long address; 47 48 if (regs->int_code & 0x200) 49 address = current->thread.trap_tdb.data[3]; 50 else 51 address = regs->psw.addr; 52 return (void __user *)(address - (regs->int_code >> 16)); 53 } 54 55 #ifdef CONFIG_GENERIC_BUG 56 int is_valid_bugaddr(unsigned long addr) 57 { 58 return 1; 59 } 60 #endif 61 62 void do_report_trap(struct pt_regs *regs, int si_signo, int si_code, char *str) 63 { 64 if (user_mode(regs)) { 65 force_sig_fault(si_signo, si_code, get_trap_ip(regs)); 66 report_user_fault(regs, si_signo, 0); 67 } else { 68 if (!fixup_exception(regs)) 69 die(regs, str); 70 } 71 } 72 73 static void do_trap(struct pt_regs *regs, int si_signo, int si_code, char *str) 74 { 75 if (notify_die(DIE_TRAP, str, regs, 0, regs->int_code, si_signo) == NOTIFY_STOP) 76 return; 77 do_report_trap(regs, si_signo, si_code, str); 78 } 79 NOKPROBE_SYMBOL(do_trap); 80 81 void do_per_trap(struct pt_regs *regs) 82 { 83 if (notify_die(DIE_SSTEP, "sstep", regs, 0, 0, SIGTRAP) == NOTIFY_STOP) 84 return; 85 if (!current->ptrace) 86 return; 87 force_sig_fault(SIGTRAP, TRAP_HWBKPT, (void __force __user *)current->thread.per_event.address); 88 } 89 NOKPROBE_SYMBOL(do_per_trap); 90 91 static void default_trap_handler(struct pt_regs *regs) 92 { 93 if (user_mode(regs)) { 94 report_user_fault(regs, SIGSEGV, 0); 95 force_exit_sig(SIGSEGV); 96 } else 97 die(regs, "Unknown program exception"); 98 } 99 100 #define DO_ERROR_INFO(name, signr, sicode, str) \ 101 static void name(struct pt_regs *regs) \ 102 { \ 103 do_trap(regs, signr, sicode, str); \ 104 } 105 106 DO_ERROR_INFO(addressing_exception, SIGILL, ILL_ILLADR, "addressing exception") 107 DO_ERROR_INFO(divide_exception, SIGFPE, FPE_INTDIV, "fixpoint divide exception") 108 DO_ERROR_INFO(execute_exception, SIGILL, ILL_ILLOPN, "execute exception") 109 DO_ERROR_INFO(hfp_divide_exception, SIGFPE, FPE_FLTDIV, "HFP divide exception") 110 DO_ERROR_INFO(hfp_overflow_exception, SIGFPE, FPE_FLTOVF, "HFP overflow exception") 111 DO_ERROR_INFO(hfp_significance_exception, SIGFPE, FPE_FLTRES, "HFP significance exception") 112 DO_ERROR_INFO(hfp_sqrt_exception, SIGFPE, FPE_FLTINV, "HFP square root exception") 113 DO_ERROR_INFO(hfp_underflow_exception, SIGFPE, FPE_FLTUND, "HFP underflow exception") 114 DO_ERROR_INFO(operand_exception, SIGILL, ILL_ILLOPN, "operand exception") 115 DO_ERROR_INFO(overflow_exception, SIGFPE, FPE_INTOVF, "fixpoint overflow exception") 116 DO_ERROR_INFO(privileged_op, SIGILL, ILL_PRVOPC, "privileged operation") 117 DO_ERROR_INFO(special_op_exception, SIGILL, ILL_ILLOPN, "special operation exception") 118 DO_ERROR_INFO(specification_exception, SIGILL, ILL_ILLOPN, "specification exception"); 119 DO_ERROR_INFO(transaction_exception, SIGILL, ILL_ILLOPN, "transaction constraint exception") 120 121 static inline void do_fp_trap(struct pt_regs *regs, __u32 fpc) 122 { 123 int si_code = 0; 124 125 /* FPC[2] is Data Exception Code */ 126 if ((fpc & 0x00000300) == 0) { 127 /* bits 6 and 7 of DXC are 0 iff IEEE exception */ 128 if (fpc & 0x8000) /* invalid fp operation */ 129 si_code = FPE_FLTINV; 130 else if (fpc & 0x4000) /* div by 0 */ 131 si_code = FPE_FLTDIV; 132 else if (fpc & 0x2000) /* overflow */ 133 si_code = FPE_FLTOVF; 134 else if (fpc & 0x1000) /* underflow */ 135 si_code = FPE_FLTUND; 136 else if (fpc & 0x0800) /* inexact */ 137 si_code = FPE_FLTRES; 138 } 139 do_trap(regs, SIGFPE, si_code, "floating point exception"); 140 } 141 142 static void translation_specification_exception(struct pt_regs *regs) 143 { 144 /* May never happen. */ 145 panic("Translation-Specification Exception"); 146 } 147 148 static void illegal_op(struct pt_regs *regs) 149 { 150 int is_uprobe_insn = 0; 151 u16 __user *location; 152 int signal = 0; 153 u16 opcode; 154 155 location = get_trap_ip(regs); 156 if (user_mode(regs)) { 157 if (get_user(opcode, location)) 158 return; 159 if (opcode == S390_BREAKPOINT_U16) { 160 if (current->ptrace) 161 force_sig_fault(SIGTRAP, TRAP_BRKPT, location); 162 else 163 signal = SIGILL; 164 #ifdef CONFIG_UPROBES 165 } else if (opcode == UPROBE_SWBP_INSN) { 166 is_uprobe_insn = 1; 167 #endif 168 } else { 169 signal = SIGILL; 170 } 171 } 172 /* 173 * This is either an illegal op in kernel mode, or user space trapped 174 * on a uprobes illegal instruction. See if kprobes or uprobes picks 175 * it up. If not, SIGILL. 176 */ 177 if (is_uprobe_insn || !user_mode(regs)) { 178 if (notify_die(DIE_BPT, "bpt", regs, 0, 3, SIGTRAP) != NOTIFY_STOP) 179 signal = SIGILL; 180 } 181 if (signal) 182 do_trap(regs, signal, ILL_ILLOPC, "illegal operation"); 183 } 184 NOKPROBE_SYMBOL(illegal_op); 185 186 static void vector_exception(struct pt_regs *regs) 187 { 188 int si_code, vic; 189 190 /* get vector interrupt code from fpc */ 191 save_user_fpu_regs(); 192 vic = (current->thread.ufpu.fpc & 0xf00) >> 8; 193 switch (vic) { 194 case 1: /* invalid vector operation */ 195 si_code = FPE_FLTINV; 196 break; 197 case 2: /* division by zero */ 198 si_code = FPE_FLTDIV; 199 break; 200 case 3: /* overflow */ 201 si_code = FPE_FLTOVF; 202 break; 203 case 4: /* underflow */ 204 si_code = FPE_FLTUND; 205 break; 206 case 5: /* inexact */ 207 si_code = FPE_FLTRES; 208 break; 209 default: /* unknown cause */ 210 si_code = 0; 211 } 212 do_trap(regs, SIGFPE, si_code, "vector exception"); 213 } 214 215 static void data_exception(struct pt_regs *regs) 216 { 217 save_user_fpu_regs(); 218 if (current->thread.ufpu.fpc & FPC_DXC_MASK) 219 do_fp_trap(regs, current->thread.ufpu.fpc); 220 else 221 do_trap(regs, SIGILL, ILL_ILLOPN, "data exception"); 222 } 223 224 static void space_switch_exception(struct pt_regs *regs) 225 { 226 /* Set user psw back to home space mode. */ 227 if (user_mode(regs)) 228 regs->psw.mask |= PSW_ASC_HOME; 229 /* Send SIGILL. */ 230 do_trap(regs, SIGILL, ILL_PRVOPC, "space switch event"); 231 } 232 233 #if defined(CONFIG_BUG) && defined(CONFIG_CC_HAS_ASM_IMMEDIATE_STRINGS) 234 235 void *__warn_args(struct arch_va_list *args, struct pt_regs *regs) 236 { 237 struct stack_frame *stack_frame; 238 239 /* 240 * Generate va_list from pt_regs. See ELF Application Binary Interface 241 * s390x Supplement documentation for details. 242 * 243 * - __overflow_arg_area needs to point to the parameter area, which 244 * is right above the standard stack frame (160 bytes) 245 * 246 * - __reg_save_area needs to point to a register save area where 247 * general registers (%r2 - %r6) can be found at offset 16. Which 248 * means that the gprs save area of pt_regs can be used 249 * 250 * - __gpr must be set to one, since the first parameter has been 251 * processed (pointer to bug_entry) 252 */ 253 stack_frame = (struct stack_frame *)regs->gprs[15]; 254 args->__overflow_arg_area = stack_frame + 1; 255 args->__reg_save_area = regs->gprs; 256 args->__gpr = 1; 257 return args; 258 } 259 260 #endif /* CONFIG_BUG && CONFIG_CC_HAS_ASM_IMMEDIATE_STRINGS */ 261 262 static void monitor_event_exception(struct pt_regs *regs) 263 { 264 enum bug_trap_type btt; 265 266 if (user_mode(regs)) 267 return; 268 if (regs->monitor_code == MONCODE_BUG_ARG) { 269 regs->psw.addr = regs->gprs[14]; 270 btt = report_bug_entry((struct bug_entry *)regs->gprs[2], regs); 271 } else { 272 btt = report_bug(regs->psw.addr - (regs->int_code >> 16), regs); 273 } 274 switch (btt) { 275 case BUG_TRAP_TYPE_NONE: 276 fixup_exception(regs); 277 break; 278 case BUG_TRAP_TYPE_WARN: 279 break; 280 case BUG_TRAP_TYPE_BUG: 281 die(regs, "monitor event"); 282 break; 283 } 284 } 285 286 void kernel_stack_invalid(struct pt_regs *regs) 287 { 288 /* 289 * Normally regs are unpoisoned by the generic entry code, but 290 * kernel_stack_overflow() is a rare case that is called bypassing it. 291 */ 292 kmsan_unpoison_entry_regs(regs); 293 bust_spinlocks(1); 294 pr_emerg("Kernel stack pointer invalid\n"); 295 show_regs(regs); 296 bust_spinlocks(0); 297 panic("Invalid kernel stack pointer, cannot continue"); 298 } 299 NOKPROBE_SYMBOL(kernel_stack_invalid); 300 301 static void __init test_monitor_call(void) 302 { 303 int val = 1; 304 305 if (!IS_ENABLED(CONFIG_BUG)) 306 return; 307 asm_inline volatile( 308 " mc %[monc](%%r0),0\n" 309 "0: lhi %[val],0\n" 310 "1:\n" 311 EX_TABLE(0b, 1b) 312 : [val] "+d" (val) 313 : [monc] "i" (MONCODE_BUG)); 314 if (!val) 315 panic("Monitor call doesn't work!\n"); 316 } 317 318 void __init trap_init(void) 319 { 320 struct lowcore *lc = get_lowcore(); 321 unsigned long flags; 322 struct ctlreg cr0; 323 324 local_irq_save(flags); 325 cr0 = local_ctl_clear_bit(0, CR0_LOW_ADDRESS_PROTECTION_BIT); 326 psw_bits(lc->external_new_psw).mcheck = 1; 327 psw_bits(lc->program_new_psw).mcheck = 1; 328 psw_bits(lc->svc_new_psw).mcheck = 1; 329 psw_bits(lc->io_new_psw).mcheck = 1; 330 local_ctl_load(0, &cr0); 331 local_irq_restore(flags); 332 local_mcck_enable(); 333 test_monitor_call(); 334 } 335 336 static void (*pgm_check_table[128])(struct pt_regs *regs); 337 338 void noinstr __do_pgm_check(struct pt_regs *regs, unsigned long flags) 339 { 340 struct lowcore *lc = get_lowcore(); 341 bool percpu_needs_fixup; 342 irqentry_state_t state; 343 struct pgm_stat *stat; 344 unsigned int trapnr; 345 union teid teid; 346 347 teid.val = lc->trans_exc_code; 348 regs->int_code = lc->pgm_int_code; 349 regs->int_parm_long = teid.val; 350 regs->monitor_code = lc->monitor_code; 351 352 trapnr = regs->int_code & PGM_INT_CODE_MASK; 353 stat = this_cpu_ptr(&pgm_stat); 354 stat->count[trapnr]++; 355 /* 356 * In case of a guest fault, short-circuit the fault handler and return. 357 * This way the sie64a() function will return 0; fault address and 358 * other relevant bits are saved in current->thread.gmap_teid, and 359 * the fault number in current->thread.gmap_int_code. KVM will be 360 * able to use this information to handle the fault. 361 */ 362 if (flags & PGM_FLAG_GUEST_FAULT) { 363 current->thread.gmap_teid.val = regs->int_parm_long; 364 current->thread.gmap_int_code = regs->int_code & 0xffff; 365 return; 366 } 367 percpu_entry(regs); 368 state = irqentry_enter(regs); 369 if (user_mode(regs)) { 370 update_timer_sys(); 371 if (!cpu_has_bear()) { 372 if (regs->last_break < 4096) 373 regs->last_break = 1; 374 } 375 current->thread.last_break = regs->last_break; 376 } 377 if (lc->pgm_code & 0x0200) { 378 /* transaction abort */ 379 current->thread.trap_tdb = lc->pgm_tdb; 380 } 381 if (lc->pgm_code & PGM_INT_CODE_PER) { 382 if (user_mode(regs)) { 383 struct per_event *ev = ¤t->thread.per_event; 384 385 set_thread_flag(TIF_PER_TRAP); 386 ev->address = lc->per_address; 387 ev->cause = lc->per_code_combined; 388 ev->paid = lc->per_access_id; 389 } else { 390 /* PER event in kernel is kprobes */ 391 __arch_local_irq_ssm(regs->psw.mask & ~PSW_MASK_PER); 392 do_per_trap(regs); 393 goto out; 394 } 395 } 396 if (!irqs_disabled_flags(regs->psw.mask)) 397 trace_hardirqs_on(); 398 __arch_local_irq_ssm(regs->psw.mask & ~PSW_MASK_PER); 399 if (trapnr) 400 pgm_check_table[trapnr](regs); 401 out: 402 local_irq_disable(); 403 percpu_needs_fixup = percpu_code_check(regs); 404 irqentry_exit(regs, state); 405 percpu_exit(regs, percpu_needs_fixup); 406 } 407 408 static int pgm_check_stat_show(struct seq_file *p, void *v) 409 { 410 int i, cpu; 411 412 cpus_read_lock(); 413 seq_puts(p, " "); 414 for_each_online_cpu(cpu) 415 seq_printf(p, "CPU%-8d", cpu); 416 seq_putc(p, '\n'); 417 for (i = 0; i < 128; i++) { 418 seq_printf(p, "%02x: ", i); 419 for_each_online_cpu(cpu) 420 seq_printf(p, "%10u ", per_cpu(pgm_stat, cpu).count[i]); 421 seq_putc(p, '\n'); 422 } 423 cpus_read_unlock(); 424 return 0; 425 } 426 DEFINE_SHOW_ATTRIBUTE(pgm_check_stat); 427 428 static int __init debugfs_pgm_check_init(void) 429 { 430 debugfs_create_file("exceptions", 0400, arch_debugfs_dir, NULL, &pgm_check_stat_fops); 431 return 0; 432 } 433 late_initcall(debugfs_pgm_check_init); 434 435 /* 436 * The program check table contains exactly 128 (0x00-0x7f) entries. Each 437 * line defines the function to be called corresponding to the program check 438 * interruption code. 439 */ 440 static void (*pgm_check_table[128])(struct pt_regs *regs) = { 441 [0x00] = default_trap_handler, 442 [0x01] = illegal_op, 443 [0x02] = privileged_op, 444 [0x03] = execute_exception, 445 [0x04] = do_protection_exception, 446 [0x05] = addressing_exception, 447 [0x06] = specification_exception, 448 [0x07] = data_exception, 449 [0x08] = overflow_exception, 450 [0x09] = divide_exception, 451 [0x0a] = overflow_exception, 452 [0x0b] = divide_exception, 453 [0x0c] = hfp_overflow_exception, 454 [0x0d] = hfp_underflow_exception, 455 [0x0e] = hfp_significance_exception, 456 [0x0f] = hfp_divide_exception, 457 [0x10] = do_dat_exception, 458 [0x11] = do_dat_exception, 459 [0x12] = translation_specification_exception, 460 [0x13] = special_op_exception, 461 [0x14] = default_trap_handler, 462 [0x15] = operand_exception, 463 [0x16] = default_trap_handler, 464 [0x17] = default_trap_handler, 465 [0x18] = transaction_exception, 466 [0x19] = default_trap_handler, 467 [0x1a] = default_trap_handler, 468 [0x1b] = vector_exception, 469 [0x1c] = space_switch_exception, 470 [0x1d] = hfp_sqrt_exception, 471 [0x1e ... 0x37] = default_trap_handler, 472 [0x38] = do_dat_exception, 473 [0x39] = do_dat_exception, 474 [0x3a] = do_dat_exception, 475 [0x3b] = do_dat_exception, 476 [0x3c] = default_trap_handler, 477 [0x3d] = do_secure_storage_access, 478 [0x3e] = default_trap_handler, 479 [0x3f] = default_trap_handler, 480 [0x40] = monitor_event_exception, 481 [0x41 ... 0x7f] = default_trap_handler, 482 }; 483 484 #define COND_TRAP(x) asm( \ 485 ".weak " __stringify(x) "\n\t" \ 486 ".set " __stringify(x) "," \ 487 __stringify(default_trap_handler)) 488 489 COND_TRAP(do_secure_storage_access); 490