traps.c 32 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782783784785786787788789790791792793794795796797798799800801802803804805806807808809810811812813814815816817818819820821822823824825826827828829830831832833834835836837838839840841842843844845846847848849850851852853854855856857858859860861862863864865866867868869870871872873874875876877878879880881882883884885886887888889890891892893894895896897898899900901902903904905906907908909910911912913914915916917918919920921922923924925926927928929930931932933934935936937938939940941942943944945946947948949950951952953954955956957958959960961962963964965966967968969970971972973974975976977978979980981982983984985986987988989990991992993994995996997998999100010011002100310041005100610071008100910101011101210131014101510161017101810191020102110221023102410251026102710281029103010311032103310341035103610371038103910401041104210431044104510461047104810491050105110521053105410551056105710581059106010611062106310641065106610671068106910701071107210731074107510761077107810791080108110821083108410851086108710881089109010911092109310941095109610971098109911001101110211031104110511061107110811091110111111121113111411151116111711181119112011211122112311241125112611271128112911301131113211331134113511361137113811391140114111421143114411451146114711481149115011511152115311541155115611571158115911601161116211631164116511661167116811691170117111721173117411751176117711781179118011811182118311841185118611871188118911901191119211931194
  1. /*
  2. * Copyright (C) 1991, 1992 Linus Torvalds
  3. * Copyright (C) 2000, 2001, 2002 Andi Kleen, SuSE Labs
  4. *
  5. * Pentium III FXSR, SSE support
  6. * Gareth Hughes <gareth@valinux.com>, May 2000
  7. */
  8. /*
  9. * Handle hardware traps and faults.
  10. */
  11. #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
  12. #include <linux/context_tracking.h>
  13. #include <linux/interrupt.h>
  14. #include <linux/kallsyms.h>
  15. #include <linux/spinlock.h>
  16. #include <linux/kprobes.h>
  17. #include <linux/uaccess.h>
  18. #include <linux/kdebug.h>
  19. #include <linux/kgdb.h>
  20. #include <linux/kernel.h>
  21. #include <linux/export.h>
  22. #include <linux/ptrace.h>
  23. #include <linux/uprobes.h>
  24. #include <linux/string.h>
  25. #include <linux/delay.h>
  26. #include <linux/errno.h>
  27. #include <linux/kexec.h>
  28. #include <linux/sched.h>
  29. #include <linux/sched/task_stack.h>
  30. #include <linux/timer.h>
  31. #include <linux/init.h>
  32. #include <linux/bug.h>
  33. #include <linux/nmi.h>
  34. #include <linux/mm.h>
  35. #include <linux/smp.h>
  36. #include <linux/io.h>
  37. #include <linux/hardirq.h>
  38. #include <linux/atomic.h>
  39. #include <asm/stacktrace.h>
  40. #include <asm/processor.h>
  41. #include <asm/debugreg.h>
  42. #include <asm/realmode.h>
  43. #include <asm/text-patching.h>
  44. #include <asm/ftrace.h>
  45. #include <asm/traps.h>
  46. #include <asm/desc.h>
  47. #include <asm/fpu/internal.h>
  48. #include <asm/cpu.h>
  49. #include <asm/cpu_entry_area.h>
  50. #include <asm/mce.h>
  51. #include <asm/fixmap.h>
  52. #include <asm/mach_traps.h>
  53. #include <asm/alternative.h>
  54. #include <asm/fpu/xstate.h>
  55. #include <asm/vm86.h>
  56. #include <asm/umip.h>
  57. #include <asm/insn.h>
  58. #include <asm/insn-eval.h>
  59. #ifdef CONFIG_X86_64
  60. #include <asm/x86_init.h>
  61. #include <asm/proto.h>
  62. #else
  63. #include <asm/processor-flags.h>
  64. #include <asm/setup.h>
  65. #include <asm/proto.h>
  66. #endif
  67. DECLARE_BITMAP(system_vectors, NR_VECTORS);
  68. static inline void cond_local_irq_enable(struct pt_regs *regs)
  69. {
  70. if (regs->flags & X86_EFLAGS_IF)
  71. local_irq_enable();
  72. }
  73. static inline void cond_local_irq_disable(struct pt_regs *regs)
  74. {
  75. if (regs->flags & X86_EFLAGS_IF)
  76. local_irq_disable();
  77. }
  78. __always_inline int is_valid_bugaddr(unsigned long addr)
  79. {
  80. if (addr < TASK_SIZE_MAX)
  81. return 0;
  82. /*
  83. * We got #UD, if the text isn't readable we'd have gotten
  84. * a different exception.
  85. */
  86. return *(unsigned short *)addr == INSN_UD2;
  87. }
  88. static nokprobe_inline int
  89. do_trap_no_signal(struct task_struct *tsk, int trapnr, const char *str,
  90. struct pt_regs *regs, long error_code)
  91. {
  92. if (v8086_mode(regs)) {
  93. /*
  94. * Traps 0, 1, 3, 4, and 5 should be forwarded to vm86.
  95. * On nmi (interrupt 2), do_trap should not be called.
  96. */
  97. if (trapnr < X86_TRAP_UD) {
  98. if (!handle_vm86_trap((struct kernel_vm86_regs *) regs,
  99. error_code, trapnr))
  100. return 0;
  101. }
  102. } else if (!user_mode(regs)) {
  103. if (fixup_exception(regs, trapnr, error_code, 0))
  104. return 0;
  105. tsk->thread.error_code = error_code;
  106. tsk->thread.trap_nr = trapnr;
  107. die(str, regs, error_code);
  108. }
  109. /*
  110. * We want error_code and trap_nr set for userspace faults and
  111. * kernelspace faults which result in die(), but not
  112. * kernelspace faults which are fixed up. die() gives the
  113. * process no chance to handle the signal and notice the
  114. * kernel fault information, so that won't result in polluting
  115. * the information about previously queued, but not yet
  116. * delivered, faults. See also exc_general_protection below.
  117. */
  118. tsk->thread.error_code = error_code;
  119. tsk->thread.trap_nr = trapnr;
  120. return -1;
  121. }
  122. static void show_signal(struct task_struct *tsk, int signr,
  123. const char *type, const char *desc,
  124. struct pt_regs *regs, long error_code)
  125. {
  126. if (show_unhandled_signals && unhandled_signal(tsk, signr) &&
  127. printk_ratelimit()) {
  128. pr_info("%s[%d] %s%s ip:%lx sp:%lx error:%lx",
  129. tsk->comm, task_pid_nr(tsk), type, desc,
  130. regs->ip, regs->sp, error_code);
  131. print_vma_addr(KERN_CONT " in ", regs->ip);
  132. pr_cont("\n");
  133. }
  134. }
  135. static void
  136. do_trap(int trapnr, int signr, char *str, struct pt_regs *regs,
  137. long error_code, int sicode, void __user *addr)
  138. {
  139. struct task_struct *tsk = current;
  140. if (!do_trap_no_signal(tsk, trapnr, str, regs, error_code))
  141. return;
  142. show_signal(tsk, signr, "trap ", str, regs, error_code);
  143. if (!sicode)
  144. force_sig(signr);
  145. else
  146. force_sig_fault(signr, sicode, addr);
  147. }
  148. NOKPROBE_SYMBOL(do_trap);
  149. static void do_error_trap(struct pt_regs *regs, long error_code, char *str,
  150. unsigned long trapnr, int signr, int sicode, void __user *addr)
  151. {
  152. RCU_LOCKDEP_WARN(!rcu_is_watching(), "entry code didn't wake RCU");
  153. if (notify_die(DIE_TRAP, str, regs, error_code, trapnr, signr) !=
  154. NOTIFY_STOP) {
  155. cond_local_irq_enable(regs);
  156. do_trap(trapnr, signr, str, regs, error_code, sicode, addr);
  157. cond_local_irq_disable(regs);
  158. }
  159. }
  160. /*
  161. * Posix requires to provide the address of the faulting instruction for
  162. * SIGILL (#UD) and SIGFPE (#DE) in the si_addr member of siginfo_t.
  163. *
  164. * This address is usually regs->ip, but when an uprobe moved the code out
  165. * of line then regs->ip points to the XOL code which would confuse
  166. * anything which analyzes the fault address vs. the unmodified binary. If
  167. * a trap happened in XOL code then uprobe maps regs->ip back to the
  168. * original instruction address.
  169. */
  170. static __always_inline void __user *error_get_trap_addr(struct pt_regs *regs)
  171. {
  172. return (void __user *)uprobe_get_trap_addr(regs);
  173. }
  174. DEFINE_IDTENTRY(exc_divide_error)
  175. {
  176. do_error_trap(regs, 0, "divide error", X86_TRAP_DE, SIGFPE,
  177. FPE_INTDIV, error_get_trap_addr(regs));
  178. }
  179. DEFINE_IDTENTRY(exc_overflow)
  180. {
  181. do_error_trap(regs, 0, "overflow", X86_TRAP_OF, SIGSEGV, 0, NULL);
  182. }
  183. #ifdef CONFIG_X86_F00F_BUG
  184. void handle_invalid_op(struct pt_regs *regs)
  185. #else
  186. static inline void handle_invalid_op(struct pt_regs *regs)
  187. #endif
  188. {
  189. do_error_trap(regs, 0, "invalid opcode", X86_TRAP_UD, SIGILL,
  190. ILL_ILLOPN, error_get_trap_addr(regs));
  191. }
  192. static noinstr bool handle_bug(struct pt_regs *regs)
  193. {
  194. bool handled = false;
  195. if (!is_valid_bugaddr(regs->ip))
  196. return handled;
  197. /*
  198. * All lies, just get the WARN/BUG out.
  199. */
  200. instrumentation_begin();
  201. /*
  202. * Since we're emulating a CALL with exceptions, restore the interrupt
  203. * state to what it was at the exception site.
  204. */
  205. if (regs->flags & X86_EFLAGS_IF)
  206. raw_local_irq_enable();
  207. if (report_bug(regs->ip, regs) == BUG_TRAP_TYPE_WARN) {
  208. regs->ip += LEN_UD2;
  209. handled = true;
  210. }
  211. if (regs->flags & X86_EFLAGS_IF)
  212. raw_local_irq_disable();
  213. instrumentation_end();
  214. return handled;
  215. }
  216. DEFINE_IDTENTRY_RAW(exc_invalid_op)
  217. {
  218. irqentry_state_t state;
  219. /*
  220. * We use UD2 as a short encoding for 'CALL __WARN', as such
  221. * handle it before exception entry to avoid recursive WARN
  222. * in case exception entry is the one triggering WARNs.
  223. */
  224. if (!user_mode(regs) && handle_bug(regs))
  225. return;
  226. state = irqentry_enter(regs);
  227. instrumentation_begin();
  228. handle_invalid_op(regs);
  229. instrumentation_end();
  230. irqentry_exit(regs, state);
  231. }
  232. DEFINE_IDTENTRY(exc_coproc_segment_overrun)
  233. {
  234. do_error_trap(regs, 0, "coprocessor segment overrun",
  235. X86_TRAP_OLD_MF, SIGFPE, 0, NULL);
  236. }
  237. DEFINE_IDTENTRY_ERRORCODE(exc_invalid_tss)
  238. {
  239. do_error_trap(regs, error_code, "invalid TSS", X86_TRAP_TS, SIGSEGV,
  240. 0, NULL);
  241. }
  242. DEFINE_IDTENTRY_ERRORCODE(exc_segment_not_present)
  243. {
  244. do_error_trap(regs, error_code, "segment not present", X86_TRAP_NP,
  245. SIGBUS, 0, NULL);
  246. }
  247. DEFINE_IDTENTRY_ERRORCODE(exc_stack_segment)
  248. {
  249. do_error_trap(regs, error_code, "stack segment", X86_TRAP_SS, SIGBUS,
  250. 0, NULL);
  251. }
  252. DEFINE_IDTENTRY_ERRORCODE(exc_alignment_check)
  253. {
  254. char *str = "alignment check";
  255. if (notify_die(DIE_TRAP, str, regs, error_code, X86_TRAP_AC, SIGBUS) == NOTIFY_STOP)
  256. return;
  257. if (!user_mode(regs))
  258. die("Split lock detected\n", regs, error_code);
  259. local_irq_enable();
  260. if (handle_user_split_lock(regs, error_code))
  261. goto out;
  262. do_trap(X86_TRAP_AC, SIGBUS, "alignment check", regs,
  263. error_code, BUS_ADRALN, NULL);
  264. out:
  265. local_irq_disable();
  266. }
  267. #ifdef CONFIG_VMAP_STACK
  268. __visible void __noreturn handle_stack_overflow(const char *message,
  269. struct pt_regs *regs,
  270. unsigned long fault_address)
  271. {
  272. printk(KERN_EMERG "BUG: stack guard page was hit at %p (stack is %p..%p)\n",
  273. (void *)fault_address, current->stack,
  274. (char *)current->stack + THREAD_SIZE - 1);
  275. die(message, regs, 0);
  276. /* Be absolutely certain we don't return. */
  277. panic("%s", message);
  278. }
  279. #endif
  280. /*
  281. * Runs on an IST stack for x86_64 and on a special task stack for x86_32.
  282. *
  283. * On x86_64, this is more or less a normal kernel entry. Notwithstanding the
  284. * SDM's warnings about double faults being unrecoverable, returning works as
  285. * expected. Presumably what the SDM actually means is that the CPU may get
  286. * the register state wrong on entry, so returning could be a bad idea.
  287. *
  288. * Various CPU engineers have promised that double faults due to an IRET fault
  289. * while the stack is read-only are, in fact, recoverable.
  290. *
  291. * On x86_32, this is entered through a task gate, and regs are synthesized
  292. * from the TSS. Returning is, in principle, okay, but changes to regs will
  293. * be lost. If, for some reason, we need to return to a context with modified
  294. * regs, the shim code could be adjusted to synchronize the registers.
  295. *
  296. * The 32bit #DF shim provides CR2 already as an argument. On 64bit it needs
  297. * to be read before doing anything else.
  298. */
  299. DEFINE_IDTENTRY_DF(exc_double_fault)
  300. {
  301. static const char str[] = "double fault";
  302. struct task_struct *tsk = current;
  303. #ifdef CONFIG_VMAP_STACK
  304. unsigned long address = read_cr2();
  305. #endif
  306. #ifdef CONFIG_X86_ESPFIX64
  307. extern unsigned char native_irq_return_iret[];
  308. /*
  309. * If IRET takes a non-IST fault on the espfix64 stack, then we
  310. * end up promoting it to a doublefault. In that case, take
  311. * advantage of the fact that we're not using the normal (TSS.sp0)
  312. * stack right now. We can write a fake #GP(0) frame at TSS.sp0
  313. * and then modify our own IRET frame so that, when we return,
  314. * we land directly at the #GP(0) vector with the stack already
  315. * set up according to its expectations.
  316. *
  317. * The net result is that our #GP handler will think that we
  318. * entered from usermode with the bad user context.
  319. *
  320. * No need for nmi_enter() here because we don't use RCU.
  321. */
  322. if (((long)regs->sp >> P4D_SHIFT) == ESPFIX_PGD_ENTRY &&
  323. regs->cs == __KERNEL_CS &&
  324. regs->ip == (unsigned long)native_irq_return_iret)
  325. {
  326. struct pt_regs *gpregs = (struct pt_regs *)this_cpu_read(cpu_tss_rw.x86_tss.sp0) - 1;
  327. unsigned long *p = (unsigned long *)regs->sp;
  328. /*
  329. * regs->sp points to the failing IRET frame on the
  330. * ESPFIX64 stack. Copy it to the entry stack. This fills
  331. * in gpregs->ss through gpregs->ip.
  332. *
  333. */
  334. gpregs->ip = p[0];
  335. gpregs->cs = p[1];
  336. gpregs->flags = p[2];
  337. gpregs->sp = p[3];
  338. gpregs->ss = p[4];
  339. gpregs->orig_ax = 0; /* Missing (lost) #GP error code */
  340. /*
  341. * Adjust our frame so that we return straight to the #GP
  342. * vector with the expected RSP value. This is safe because
  343. * we won't enable interupts or schedule before we invoke
  344. * general_protection, so nothing will clobber the stack
  345. * frame we just set up.
  346. *
  347. * We will enter general_protection with kernel GSBASE,
  348. * which is what the stub expects, given that the faulting
  349. * RIP will be the IRET instruction.
  350. */
  351. regs->ip = (unsigned long)asm_exc_general_protection;
  352. regs->sp = (unsigned long)&gpregs->orig_ax;
  353. return;
  354. }
  355. #endif
  356. irqentry_nmi_enter(regs);
  357. instrumentation_begin();
  358. notify_die(DIE_TRAP, str, regs, error_code, X86_TRAP_DF, SIGSEGV);
  359. tsk->thread.error_code = error_code;
  360. tsk->thread.trap_nr = X86_TRAP_DF;
  361. #ifdef CONFIG_VMAP_STACK
  362. /*
  363. * If we overflow the stack into a guard page, the CPU will fail
  364. * to deliver #PF and will send #DF instead. Similarly, if we
  365. * take any non-IST exception while too close to the bottom of
  366. * the stack, the processor will get a page fault while
  367. * delivering the exception and will generate a double fault.
  368. *
  369. * According to the SDM (footnote in 6.15 under "Interrupt 14 -
  370. * Page-Fault Exception (#PF):
  371. *
  372. * Processors update CR2 whenever a page fault is detected. If a
  373. * second page fault occurs while an earlier page fault is being
  374. * delivered, the faulting linear address of the second fault will
  375. * overwrite the contents of CR2 (replacing the previous
  376. * address). These updates to CR2 occur even if the page fault
  377. * results in a double fault or occurs during the delivery of a
  378. * double fault.
  379. *
  380. * The logic below has a small possibility of incorrectly diagnosing
  381. * some errors as stack overflows. For example, if the IDT or GDT
  382. * gets corrupted such that #GP delivery fails due to a bad descriptor
  383. * causing #GP and we hit this condition while CR2 coincidentally
  384. * points to the stack guard page, we'll think we overflowed the
  385. * stack. Given that we're going to panic one way or another
  386. * if this happens, this isn't necessarily worth fixing.
  387. *
  388. * If necessary, we could improve the test by only diagnosing
  389. * a stack overflow if the saved RSP points within 47 bytes of
  390. * the bottom of the stack: if RSP == tsk_stack + 48 and we
  391. * take an exception, the stack is already aligned and there
  392. * will be enough room SS, RSP, RFLAGS, CS, RIP, and a
  393. * possible error code, so a stack overflow would *not* double
  394. * fault. With any less space left, exception delivery could
  395. * fail, and, as a practical matter, we've overflowed the
  396. * stack even if the actual trigger for the double fault was
  397. * something else.
  398. */
  399. if ((unsigned long)task_stack_page(tsk) - 1 - address < PAGE_SIZE) {
  400. handle_stack_overflow("kernel stack overflow (double-fault)",
  401. regs, address);
  402. }
  403. #endif
  404. pr_emerg("PANIC: double fault, error_code: 0x%lx\n", error_code);
  405. die("double fault", regs, error_code);
  406. panic("Machine halted.");
  407. instrumentation_end();
  408. }
  409. DEFINE_IDTENTRY(exc_bounds)
  410. {
  411. if (notify_die(DIE_TRAP, "bounds", regs, 0,
  412. X86_TRAP_BR, SIGSEGV) == NOTIFY_STOP)
  413. return;
  414. cond_local_irq_enable(regs);
  415. if (!user_mode(regs))
  416. die("bounds", regs, 0);
  417. do_trap(X86_TRAP_BR, SIGSEGV, "bounds", regs, 0, 0, NULL);
  418. cond_local_irq_disable(regs);
  419. }
  420. enum kernel_gp_hint {
  421. GP_NO_HINT,
  422. GP_NON_CANONICAL,
  423. GP_CANONICAL
  424. };
  425. /*
  426. * When an uncaught #GP occurs, try to determine the memory address accessed by
  427. * the instruction and return that address to the caller. Also, try to figure
  428. * out whether any part of the access to that address was non-canonical.
  429. */
  430. static enum kernel_gp_hint get_kernel_gp_address(struct pt_regs *regs,
  431. unsigned long *addr)
  432. {
  433. u8 insn_buf[MAX_INSN_SIZE];
  434. struct insn insn;
  435. if (copy_from_kernel_nofault(insn_buf, (void *)regs->ip,
  436. MAX_INSN_SIZE))
  437. return GP_NO_HINT;
  438. kernel_insn_init(&insn, insn_buf, MAX_INSN_SIZE);
  439. insn_get_modrm(&insn);
  440. insn_get_sib(&insn);
  441. *addr = (unsigned long)insn_get_addr_ref(&insn, regs);
  442. if (*addr == -1UL)
  443. return GP_NO_HINT;
  444. #ifdef CONFIG_X86_64
  445. /*
  446. * Check that:
  447. * - the operand is not in the kernel half
  448. * - the last byte of the operand is not in the user canonical half
  449. */
  450. if (*addr < ~__VIRTUAL_MASK &&
  451. *addr + insn.opnd_bytes - 1 > __VIRTUAL_MASK)
  452. return GP_NON_CANONICAL;
  453. #endif
  454. return GP_CANONICAL;
  455. }
  456. #define GPFSTR "general protection fault"
  457. static bool fixup_iopl_exception(struct pt_regs *regs)
  458. {
  459. struct thread_struct *t = &current->thread;
  460. unsigned char byte;
  461. unsigned long ip;
  462. if (!IS_ENABLED(CONFIG_X86_IOPL_IOPERM) || t->iopl_emul != 3)
  463. return false;
  464. ip = insn_get_effective_ip(regs);
  465. if (!ip)
  466. return false;
  467. if (get_user(byte, (const char __user *)ip))
  468. return false;
  469. if (byte != 0xfa && byte != 0xfb)
  470. return false;
  471. if (!t->iopl_warn && printk_ratelimit()) {
  472. pr_err("%s[%d] attempts to use CLI/STI, pretending it's a NOP, ip:%lx",
  473. current->comm, task_pid_nr(current), ip);
  474. print_vma_addr(KERN_CONT " in ", ip);
  475. pr_cont("\n");
  476. t->iopl_warn = 1;
  477. }
  478. regs->ip += 1;
  479. return true;
  480. }
  481. DEFINE_IDTENTRY_ERRORCODE(exc_general_protection)
  482. {
  483. char desc[sizeof(GPFSTR) + 50 + 2*sizeof(unsigned long) + 1] = GPFSTR;
  484. enum kernel_gp_hint hint = GP_NO_HINT;
  485. struct task_struct *tsk;
  486. unsigned long gp_addr;
  487. int ret;
  488. cond_local_irq_enable(regs);
  489. if (static_cpu_has(X86_FEATURE_UMIP)) {
  490. if (user_mode(regs) && fixup_umip_exception(regs))
  491. goto exit;
  492. }
  493. if (v8086_mode(regs)) {
  494. local_irq_enable();
  495. handle_vm86_fault((struct kernel_vm86_regs *) regs, error_code);
  496. local_irq_disable();
  497. return;
  498. }
  499. tsk = current;
  500. if (user_mode(regs)) {
  501. if (fixup_iopl_exception(regs))
  502. goto exit;
  503. tsk->thread.error_code = error_code;
  504. tsk->thread.trap_nr = X86_TRAP_GP;
  505. show_signal(tsk, SIGSEGV, "", desc, regs, error_code);
  506. force_sig(SIGSEGV);
  507. goto exit;
  508. }
  509. if (fixup_exception(regs, X86_TRAP_GP, error_code, 0))
  510. goto exit;
  511. tsk->thread.error_code = error_code;
  512. tsk->thread.trap_nr = X86_TRAP_GP;
  513. /*
  514. * To be potentially processing a kprobe fault and to trust the result
  515. * from kprobe_running(), we have to be non-preemptible.
  516. */
  517. if (!preemptible() &&
  518. kprobe_running() &&
  519. kprobe_fault_handler(regs, X86_TRAP_GP))
  520. goto exit;
  521. ret = notify_die(DIE_GPF, desc, regs, error_code, X86_TRAP_GP, SIGSEGV);
  522. if (ret == NOTIFY_STOP)
  523. goto exit;
  524. if (error_code)
  525. snprintf(desc, sizeof(desc), "segment-related " GPFSTR);
  526. else
  527. hint = get_kernel_gp_address(regs, &gp_addr);
  528. if (hint != GP_NO_HINT)
  529. snprintf(desc, sizeof(desc), GPFSTR ", %s 0x%lx",
  530. (hint == GP_NON_CANONICAL) ? "probably for non-canonical address"
  531. : "maybe for address",
  532. gp_addr);
  533. /*
  534. * KASAN is interested only in the non-canonical case, clear it
  535. * otherwise.
  536. */
  537. if (hint != GP_NON_CANONICAL)
  538. gp_addr = 0;
  539. die_addr(desc, regs, error_code, gp_addr);
  540. exit:
  541. cond_local_irq_disable(regs);
  542. }
  543. static bool do_int3(struct pt_regs *regs)
  544. {
  545. int res;
  546. #ifdef CONFIG_KGDB_LOW_LEVEL_TRAP
  547. if (kgdb_ll_trap(DIE_INT3, "int3", regs, 0, X86_TRAP_BP,
  548. SIGTRAP) == NOTIFY_STOP)
  549. return true;
  550. #endif /* CONFIG_KGDB_LOW_LEVEL_TRAP */
  551. #ifdef CONFIG_KPROBES
  552. if (kprobe_int3_handler(regs))
  553. return true;
  554. #endif
  555. res = notify_die(DIE_INT3, "int3", regs, 0, X86_TRAP_BP, SIGTRAP);
  556. return res == NOTIFY_STOP;
  557. }
  558. NOKPROBE_SYMBOL(do_int3);
  559. static void do_int3_user(struct pt_regs *regs)
  560. {
  561. if (do_int3(regs))
  562. return;
  563. cond_local_irq_enable(regs);
  564. do_trap(X86_TRAP_BP, SIGTRAP, "int3", regs, 0, 0, NULL);
  565. cond_local_irq_disable(regs);
  566. }
  567. DEFINE_IDTENTRY_RAW(exc_int3)
  568. {
  569. /*
  570. * poke_int3_handler() is completely self contained code; it does (and
  571. * must) *NOT* call out to anything, lest it hits upon yet another
  572. * INT3.
  573. */
  574. if (poke_int3_handler(regs))
  575. return;
  576. /*
  577. * irqentry_enter_from_user_mode() uses static_branch_{,un}likely()
  578. * and therefore can trigger INT3, hence poke_int3_handler() must
  579. * be done before. If the entry came from kernel mode, then use
  580. * nmi_enter() because the INT3 could have been hit in any context
  581. * including NMI.
  582. */
  583. if (user_mode(regs)) {
  584. irqentry_enter_from_user_mode(regs);
  585. instrumentation_begin();
  586. do_int3_user(regs);
  587. instrumentation_end();
  588. irqentry_exit_to_user_mode(regs);
  589. } else {
  590. irqentry_state_t irq_state = irqentry_nmi_enter(regs);
  591. instrumentation_begin();
  592. if (!do_int3(regs))
  593. die("int3", regs, 0);
  594. instrumentation_end();
  595. irqentry_nmi_exit(regs, irq_state);
  596. }
  597. }
  598. #ifdef CONFIG_X86_64
  599. /*
  600. * Help handler running on a per-cpu (IST or entry trampoline) stack
  601. * to switch to the normal thread stack if the interrupted code was in
  602. * user mode. The actual stack switch is done in entry_64.S
  603. */
  604. asmlinkage __visible noinstr struct pt_regs *sync_regs(struct pt_regs *eregs)
  605. {
  606. struct pt_regs *regs = (struct pt_regs *)this_cpu_read(cpu_current_top_of_stack) - 1;
  607. if (regs != eregs)
  608. *regs = *eregs;
  609. return regs;
  610. }
  611. #ifdef CONFIG_AMD_MEM_ENCRYPT
  612. asmlinkage __visible noinstr struct pt_regs *vc_switch_off_ist(struct pt_regs *regs)
  613. {
  614. unsigned long sp, *stack;
  615. struct stack_info info;
  616. struct pt_regs *regs_ret;
  617. /*
  618. * In the SYSCALL entry path the RSP value comes from user-space - don't
  619. * trust it and switch to the current kernel stack
  620. */
  621. if (ip_within_syscall_gap(regs)) {
  622. sp = this_cpu_read(cpu_current_top_of_stack);
  623. goto sync;
  624. }
  625. /*
  626. * From here on the RSP value is trusted. Now check whether entry
  627. * happened from a safe stack. Not safe are the entry or unknown stacks,
  628. * use the fall-back stack instead in this case.
  629. */
  630. sp = regs->sp;
  631. stack = (unsigned long *)sp;
  632. if (!get_stack_info_noinstr(stack, current, &info) || info.type == STACK_TYPE_ENTRY ||
  633. info.type > STACK_TYPE_EXCEPTION_LAST)
  634. sp = __this_cpu_ist_top_va(VC2);
  635. sync:
  636. /*
  637. * Found a safe stack - switch to it as if the entry didn't happen via
  638. * IST stack. The code below only copies pt_regs, the real switch happens
  639. * in assembly code.
  640. */
  641. sp = ALIGN_DOWN(sp, 8) - sizeof(*regs_ret);
  642. regs_ret = (struct pt_regs *)sp;
  643. *regs_ret = *regs;
  644. return regs_ret;
  645. }
  646. #endif
  647. struct bad_iret_stack {
  648. void *error_entry_ret;
  649. struct pt_regs regs;
  650. };
  651. asmlinkage __visible noinstr
  652. struct bad_iret_stack *fixup_bad_iret(struct bad_iret_stack *s)
  653. {
  654. /*
  655. * This is called from entry_64.S early in handling a fault
  656. * caused by a bad iret to user mode. To handle the fault
  657. * correctly, we want to move our stack frame to where it would
  658. * be had we entered directly on the entry stack (rather than
  659. * just below the IRET frame) and we want to pretend that the
  660. * exception came from the IRET target.
  661. */
  662. struct bad_iret_stack tmp, *new_stack =
  663. (struct bad_iret_stack *)__this_cpu_read(cpu_tss_rw.x86_tss.sp0) - 1;
  664. /* Copy the IRET target to the temporary storage. */
  665. __memcpy(&tmp.regs.ip, (void *)s->regs.sp, 5*8);
  666. /* Copy the remainder of the stack from the current stack. */
  667. __memcpy(&tmp, s, offsetof(struct bad_iret_stack, regs.ip));
  668. /* Update the entry stack */
  669. __memcpy(new_stack, &tmp, sizeof(tmp));
  670. BUG_ON(!user_mode(&new_stack->regs));
  671. return new_stack;
  672. }
  673. #endif
  674. static bool is_sysenter_singlestep(struct pt_regs *regs)
  675. {
  676. /*
  677. * We don't try for precision here. If we're anywhere in the region of
  678. * code that can be single-stepped in the SYSENTER entry path, then
  679. * assume that this is a useless single-step trap due to SYSENTER
  680. * being invoked with TF set. (We don't know in advance exactly
  681. * which instructions will be hit because BTF could plausibly
  682. * be set.)
  683. */
  684. #ifdef CONFIG_X86_32
  685. return (regs->ip - (unsigned long)__begin_SYSENTER_singlestep_region) <
  686. (unsigned long)__end_SYSENTER_singlestep_region -
  687. (unsigned long)__begin_SYSENTER_singlestep_region;
  688. #elif defined(CONFIG_IA32_EMULATION)
  689. return (regs->ip - (unsigned long)entry_SYSENTER_compat) <
  690. (unsigned long)__end_entry_SYSENTER_compat -
  691. (unsigned long)entry_SYSENTER_compat;
  692. #else
  693. return false;
  694. #endif
  695. }
  696. static __always_inline unsigned long debug_read_clear_dr6(void)
  697. {
  698. unsigned long dr6;
  699. /*
  700. * The Intel SDM says:
  701. *
  702. * Certain debug exceptions may clear bits 0-3. The remaining
  703. * contents of the DR6 register are never cleared by the
  704. * processor. To avoid confusion in identifying debug
  705. * exceptions, debug handlers should clear the register before
  706. * returning to the interrupted task.
  707. *
  708. * Keep it simple: clear DR6 immediately.
  709. */
  710. get_debugreg(dr6, 6);
  711. set_debugreg(DR6_RESERVED, 6);
  712. dr6 ^= DR6_RESERVED; /* Flip to positive polarity */
  713. return dr6;
  714. }
  715. /*
  716. * Our handling of the processor debug registers is non-trivial.
  717. * We do not clear them on entry and exit from the kernel. Therefore
  718. * it is possible to get a watchpoint trap here from inside the kernel.
  719. * However, the code in ./ptrace.c has ensured that the user can
  720. * only set watchpoints on userspace addresses. Therefore the in-kernel
  721. * watchpoint trap can only occur in code which is reading/writing
  722. * from user space. Such code must not hold kernel locks (since it
  723. * can equally take a page fault), therefore it is safe to call
  724. * force_sig_info even though that claims and releases locks.
  725. *
  726. * Code in ./signal.c ensures that the debug control register
  727. * is restored before we deliver any signal, and therefore that
  728. * user code runs with the correct debug control register even though
  729. * we clear it here.
  730. *
  731. * Being careful here means that we don't have to be as careful in a
  732. * lot of more complicated places (task switching can be a bit lazy
  733. * about restoring all the debug state, and ptrace doesn't have to
  734. * find every occurrence of the TF bit that could be saved away even
  735. * by user code)
  736. *
  737. * May run on IST stack.
  738. */
  739. static bool notify_debug(struct pt_regs *regs, unsigned long *dr6)
  740. {
  741. /*
  742. * Notifiers will clear bits in @dr6 to indicate the event has been
  743. * consumed - hw_breakpoint_handler(), single_stop_cont().
  744. *
  745. * Notifiers will set bits in @virtual_dr6 to indicate the desire
  746. * for signals - ptrace_triggered(), kgdb_hw_overflow_handler().
  747. */
  748. if (notify_die(DIE_DEBUG, "debug", regs, (long)dr6, 0, SIGTRAP) == NOTIFY_STOP)
  749. return true;
  750. return false;
  751. }
  752. static __always_inline void exc_debug_kernel(struct pt_regs *regs,
  753. unsigned long dr6)
  754. {
  755. /*
  756. * Disable breakpoints during exception handling; recursive exceptions
  757. * are exceedingly 'fun'.
  758. *
  759. * Since this function is NOKPROBE, and that also applies to
  760. * HW_BREAKPOINT_X, we can't hit a breakpoint before this (XXX except a
  761. * HW_BREAKPOINT_W on our stack)
  762. *
  763. * Entry text is excluded for HW_BP_X and cpu_entry_area, which
  764. * includes the entry stack is excluded for everything.
  765. */
  766. unsigned long dr7 = local_db_save();
  767. irqentry_state_t irq_state = irqentry_nmi_enter(regs);
  768. instrumentation_begin();
  769. /*
  770. * If something gets miswired and we end up here for a user mode
  771. * #DB, we will malfunction.
  772. */
  773. WARN_ON_ONCE(user_mode(regs));
  774. if (test_thread_flag(TIF_BLOCKSTEP)) {
  775. /*
  776. * The SDM says "The processor clears the BTF flag when it
  777. * generates a debug exception." but PTRACE_BLOCKSTEP requested
  778. * it for userspace, but we just took a kernel #DB, so re-set
  779. * BTF.
  780. */
  781. unsigned long debugctl;
  782. rdmsrl(MSR_IA32_DEBUGCTLMSR, debugctl);
  783. debugctl |= DEBUGCTLMSR_BTF;
  784. wrmsrl(MSR_IA32_DEBUGCTLMSR, debugctl);
  785. }
  786. /*
  787. * Catch SYSENTER with TF set and clear DR_STEP. If this hit a
  788. * watchpoint at the same time then that will still be handled.
  789. */
  790. if ((dr6 & DR_STEP) && is_sysenter_singlestep(regs))
  791. dr6 &= ~DR_STEP;
  792. if (kprobe_debug_handler(regs))
  793. goto out;
  794. /*
  795. * The kernel doesn't use INT1
  796. */
  797. if (!dr6)
  798. goto out;
  799. if (notify_debug(regs, &dr6))
  800. goto out;
  801. /*
  802. * The kernel doesn't use TF single-step outside of:
  803. *
  804. * - Kprobes, consumed through kprobe_debug_handler()
  805. * - KGDB, consumed through notify_debug()
  806. *
  807. * So if we get here with DR_STEP set, something is wonky.
  808. *
  809. * A known way to trigger this is through QEMU's GDB stub,
  810. * which leaks #DB into the guest and causes IST recursion.
  811. */
  812. if (WARN_ON_ONCE(dr6 & DR_STEP))
  813. regs->flags &= ~X86_EFLAGS_TF;
  814. out:
  815. instrumentation_end();
  816. irqentry_nmi_exit(regs, irq_state);
  817. local_db_restore(dr7);
  818. }
  819. static __always_inline void exc_debug_user(struct pt_regs *regs,
  820. unsigned long dr6)
  821. {
  822. bool icebp;
  823. /*
  824. * If something gets miswired and we end up here for a kernel mode
  825. * #DB, we will malfunction.
  826. */
  827. WARN_ON_ONCE(!user_mode(regs));
  828. /*
  829. * NB: We can't easily clear DR7 here because
  830. * irqentry_exit_to_usermode() can invoke ptrace, schedule, access
  831. * user memory, etc. This means that a recursive #DB is possible. If
  832. * this happens, that #DB will hit exc_debug_kernel() and clear DR7.
  833. * Since we're not on the IST stack right now, everything will be
  834. * fine.
  835. */
  836. irqentry_enter_from_user_mode(regs);
  837. instrumentation_begin();
  838. /*
  839. * Start the virtual/ptrace DR6 value with just the DR_STEP mask
  840. * of the real DR6. ptrace_triggered() will set the DR_TRAPn bits.
  841. *
  842. * Userspace expects DR_STEP to be visible in ptrace_get_debugreg(6)
  843. * even if it is not the result of PTRACE_SINGLESTEP.
  844. */
  845. current->thread.virtual_dr6 = (dr6 & DR_STEP);
  846. /*
  847. * The SDM says "The processor clears the BTF flag when it
  848. * generates a debug exception." Clear TIF_BLOCKSTEP to keep
  849. * TIF_BLOCKSTEP in sync with the hardware BTF flag.
  850. */
  851. clear_thread_flag(TIF_BLOCKSTEP);
  852. /*
  853. * If dr6 has no reason to give us about the origin of this trap,
  854. * then it's very likely the result of an icebp/int01 trap.
  855. * User wants a sigtrap for that.
  856. */
  857. icebp = !dr6;
  858. if (notify_debug(regs, &dr6))
  859. goto out;
  860. /* It's safe to allow irq's after DR6 has been saved */
  861. local_irq_enable();
  862. if (v8086_mode(regs)) {
  863. handle_vm86_trap((struct kernel_vm86_regs *)regs, 0, X86_TRAP_DB);
  864. goto out_irq;
  865. }
  866. /* Add the virtual_dr6 bits for signals. */
  867. dr6 |= current->thread.virtual_dr6;
  868. if (dr6 & (DR_STEP | DR_TRAP_BITS) || icebp)
  869. send_sigtrap(regs, 0, get_si_code(dr6));
  870. out_irq:
  871. local_irq_disable();
  872. out:
  873. instrumentation_end();
  874. irqentry_exit_to_user_mode(regs);
  875. }
  876. #ifdef CONFIG_X86_64
  877. /* IST stack entry */
  878. DEFINE_IDTENTRY_DEBUG(exc_debug)
  879. {
  880. exc_debug_kernel(regs, debug_read_clear_dr6());
  881. }
  882. /* User entry, runs on regular task stack */
  883. DEFINE_IDTENTRY_DEBUG_USER(exc_debug)
  884. {
  885. exc_debug_user(regs, debug_read_clear_dr6());
  886. }
  887. #else
  888. /* 32 bit does not have separate entry points. */
  889. DEFINE_IDTENTRY_RAW(exc_debug)
  890. {
  891. unsigned long dr6 = debug_read_clear_dr6();
  892. if (user_mode(regs))
  893. exc_debug_user(regs, dr6);
  894. else
  895. exc_debug_kernel(regs, dr6);
  896. }
  897. #endif
  898. /*
  899. * Note that we play around with the 'TS' bit in an attempt to get
  900. * the correct behaviour even in the presence of the asynchronous
  901. * IRQ13 behaviour
  902. */
  903. static void math_error(struct pt_regs *regs, int trapnr)
  904. {
  905. struct task_struct *task = current;
  906. struct fpu *fpu = &task->thread.fpu;
  907. int si_code;
  908. char *str = (trapnr == X86_TRAP_MF) ? "fpu exception" :
  909. "simd exception";
  910. cond_local_irq_enable(regs);
  911. if (!user_mode(regs)) {
  912. if (fixup_exception(regs, trapnr, 0, 0))
  913. goto exit;
  914. task->thread.error_code = 0;
  915. task->thread.trap_nr = trapnr;
  916. if (notify_die(DIE_TRAP, str, regs, 0, trapnr,
  917. SIGFPE) != NOTIFY_STOP)
  918. die(str, regs, 0);
  919. goto exit;
  920. }
  921. /*
  922. * Save the info for the exception handler and clear the error.
  923. */
  924. fpu__save(fpu);
  925. task->thread.trap_nr = trapnr;
  926. task->thread.error_code = 0;
  927. si_code = fpu__exception_code(fpu, trapnr);
  928. /* Retry when we get spurious exceptions: */
  929. if (!si_code)
  930. goto exit;
  931. force_sig_fault(SIGFPE, si_code,
  932. (void __user *)uprobe_get_trap_addr(regs));
  933. exit:
  934. cond_local_irq_disable(regs);
  935. }
  936. DEFINE_IDTENTRY(exc_coprocessor_error)
  937. {
  938. math_error(regs, X86_TRAP_MF);
  939. }
  940. DEFINE_IDTENTRY(exc_simd_coprocessor_error)
  941. {
  942. if (IS_ENABLED(CONFIG_X86_INVD_BUG)) {
  943. /* AMD 486 bug: INVD in CPL 0 raises #XF instead of #GP */
  944. if (!static_cpu_has(X86_FEATURE_XMM)) {
  945. __exc_general_protection(regs, 0);
  946. return;
  947. }
  948. }
  949. math_error(regs, X86_TRAP_XF);
  950. }
  951. DEFINE_IDTENTRY(exc_spurious_interrupt_bug)
  952. {
  953. /*
  954. * This addresses a Pentium Pro Erratum:
  955. *
  956. * PROBLEM: If the APIC subsystem is configured in mixed mode with
  957. * Virtual Wire mode implemented through the local APIC, an
  958. * interrupt vector of 0Fh (Intel reserved encoding) may be
  959. * generated by the local APIC (Int 15). This vector may be
  960. * generated upon receipt of a spurious interrupt (an interrupt
  961. * which is removed before the system receives the INTA sequence)
  962. * instead of the programmed 8259 spurious interrupt vector.
  963. *
  964. * IMPLICATION: The spurious interrupt vector programmed in the
  965. * 8259 is normally handled by an operating system's spurious
  966. * interrupt handler. However, a vector of 0Fh is unknown to some
  967. * operating systems, which would crash if this erratum occurred.
  968. *
  969. * In theory this could be limited to 32bit, but the handler is not
  970. * hurting and who knows which other CPUs suffer from this.
  971. */
  972. }
  973. DEFINE_IDTENTRY(exc_device_not_available)
  974. {
  975. unsigned long cr0 = read_cr0();
  976. #ifdef CONFIG_MATH_EMULATION
  977. if (!boot_cpu_has(X86_FEATURE_FPU) && (cr0 & X86_CR0_EM)) {
  978. struct math_emu_info info = { };
  979. cond_local_irq_enable(regs);
  980. info.regs = regs;
  981. math_emulate(&info);
  982. cond_local_irq_disable(regs);
  983. return;
  984. }
  985. #endif
  986. /* This should not happen. */
  987. if (WARN(cr0 & X86_CR0_TS, "CR0.TS was set")) {
  988. /* Try to fix it up and carry on. */
  989. write_cr0(cr0 & ~X86_CR0_TS);
  990. } else {
  991. /*
  992. * Something terrible happened, and we're better off trying
  993. * to kill the task than getting stuck in a never-ending
  994. * loop of #NM faults.
  995. */
  996. die("unexpected #NM exception", regs, 0);
  997. }
  998. }
  999. #ifdef CONFIG_X86_32
  1000. DEFINE_IDTENTRY_SW(iret_error)
  1001. {
  1002. local_irq_enable();
  1003. if (notify_die(DIE_TRAP, "iret exception", regs, 0,
  1004. X86_TRAP_IRET, SIGILL) != NOTIFY_STOP) {
  1005. do_trap(X86_TRAP_IRET, SIGILL, "iret exception", regs, 0,
  1006. ILL_BADSTK, (void __user *)NULL);
  1007. }
  1008. local_irq_disable();
  1009. }
  1010. #endif
  1011. void __init trap_init(void)
  1012. {
  1013. /* Init cpu_entry_area before IST entries are set up */
  1014. setup_cpu_entry_areas();
  1015. /* Init GHCB memory pages when running as an SEV-ES guest */
  1016. sev_es_init_vc_handling();
  1017. idt_setup_traps();
  1018. /*
  1019. * Should be a barrier for any external CPU state:
  1020. */
  1021. cpu_init();
  1022. idt_setup_ist_traps();
  1023. }