2012-03-05 19:49:27 +08:00
|
|
|
/*
|
|
|
|
* Based on arch/arm/mm/fault.c
|
|
|
|
*
|
|
|
|
* Copyright (C) 1995 Linus Torvalds
|
|
|
|
* Copyright (C) 1995-2004 Russell King
|
|
|
|
* Copyright (C) 2012 ARM Ltd.
|
|
|
|
*
|
|
|
|
* This program is free software; you can redistribute it and/or modify
|
|
|
|
* it under the terms of the GNU General Public License version 2 as
|
|
|
|
* published by the Free Software Foundation.
|
|
|
|
*
|
|
|
|
* This program is distributed in the hope that it will be useful,
|
|
|
|
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
|
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
|
|
* GNU General Public License for more details.
|
|
|
|
*
|
|
|
|
* You should have received a copy of the GNU General Public License
|
|
|
|
* along with this program. If not, see <http://www.gnu.org/licenses/>.
|
|
|
|
*/
|
|
|
|
|
2016-09-20 05:38:55 +08:00
|
|
|
#include <linux/extable.h>
|
2012-03-05 19:49:27 +08:00
|
|
|
#include <linux/signal.h>
|
|
|
|
#include <linux/mm.h>
|
|
|
|
#include <linux/hardirq.h>
|
|
|
|
#include <linux/init.h>
|
|
|
|
#include <linux/kprobes.h>
|
|
|
|
#include <linux/uaccess.h>
|
|
|
|
#include <linux/page-flags.h>
|
2017-02-09 01:51:30 +08:00
|
|
|
#include <linux/sched/signal.h>
|
2017-02-09 01:51:35 +08:00
|
|
|
#include <linux/sched/debug.h>
|
2012-03-05 19:49:27 +08:00
|
|
|
#include <linux/highmem.h>
|
|
|
|
#include <linux/perf_event.h>
|
2016-10-18 18:27:47 +08:00
|
|
|
#include <linux/preempt.h>
|
2017-06-09 01:25:27 +08:00
|
|
|
#include <linux/hugetlb.h>
|
2012-03-05 19:49:27 +08:00
|
|
|
|
2016-10-18 18:27:47 +08:00
|
|
|
#include <asm/bug.h>
|
2017-06-26 21:27:36 +08:00
|
|
|
#include <asm/cmpxchg.h>
|
2015-07-23 02:05:54 +08:00
|
|
|
#include <asm/cpufeature.h>
|
2012-03-05 19:49:27 +08:00
|
|
|
#include <asm/exception.h>
|
|
|
|
#include <asm/debug-monitors.h>
|
2014-04-07 06:04:12 +08:00
|
|
|
#include <asm/esr.h>
|
2015-07-23 02:05:54 +08:00
|
|
|
#include <asm/sysreg.h>
|
2012-03-05 19:49:27 +08:00
|
|
|
#include <asm/system_misc.h>
|
|
|
|
#include <asm/pgtable.h>
|
|
|
|
#include <asm/tlbflush.h>
|
2018-02-20 22:53:22 +08:00
|
|
|
#include <asm/traps.h>
|
2012-03-05 19:49:27 +08:00
|
|
|
|
2017-06-22 02:17:09 +08:00
|
|
|
#include <acpi/ghes.h>
|
|
|
|
|
2017-04-04 13:51:01 +08:00
|
|
|
struct fault_info {
|
|
|
|
int (*fn)(unsigned long addr, unsigned int esr,
|
|
|
|
struct pt_regs *regs);
|
|
|
|
int sig;
|
|
|
|
int code;
|
|
|
|
const char *name;
|
|
|
|
};
|
|
|
|
|
|
|
|
static const struct fault_info fault_info[];
|
|
|
|
|
|
|
|
static inline const struct fault_info *esr_to_fault_info(unsigned int esr)
|
|
|
|
{
|
|
|
|
return fault_info + (esr & 63);
|
|
|
|
}
|
2012-10-24 23:34:02 +08:00
|
|
|
|
arm64: Kprobes with single stepping support
Add support for basic kernel probes(kprobes) and jump probes
(jprobes) for ARM64.
Kprobes utilizes software breakpoint and single step debug
exceptions supported on ARM v8.
A software breakpoint is placed at the probe address to trap the
kernel execution into the kprobe handler.
ARM v8 supports enabling single stepping before the break exception
return (ERET), with next PC in exception return address (ELR_EL1). The
kprobe handler prepares an executable memory slot for out-of-line
execution with a copy of the original instruction being probed, and
enables single stepping. The PC is set to the out-of-line slot address
before the ERET. With this scheme, the instruction is executed with the
exact same register context except for the PC (and DAIF) registers.
Debug mask (PSTATE.D) is enabled only when single stepping a recursive
kprobe, e.g.: during kprobes reenter so that probed instruction can be
single stepped within the kprobe handler -exception- context.
The recursion depth of kprobe is always 2, i.e. upon probe re-entry,
any further re-entry is prevented by not calling handlers and the case
counted as a missed kprobe).
Single stepping from the x-o-l slot has a drawback for PC-relative accesses
like branching and symbolic literals access as the offset from the new PC
(slot address) may not be ensured to fit in the immediate value of
the opcode. Such instructions need simulation, so reject
probing them.
Instructions generating exceptions or cpu mode change are rejected
for probing.
Exclusive load/store instructions are rejected too. Additionally, the
code is checked to see if it is inside an exclusive load/store sequence
(code from Pratyush).
System instructions are mostly enabled for stepping, except MSR/MRS
accesses to "DAIF" flags in PSTATE, which are not safe for
probing.
This also changes arch/arm64/include/asm/ptrace.h to use
include/asm-generic/ptrace.h.
Thanks to Steve Capper and Pratyush Anand for several suggested
Changes.
Signed-off-by: Sandeepa Prabhu <sandeepa.s.prabhu@gmail.com>
Signed-off-by: David A. Long <dave.long@linaro.org>
Signed-off-by: Pratyush Anand <panand@redhat.com>
Acked-by: Masami Hiramatsu <mhiramat@kernel.org>
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
2016-07-09 00:35:48 +08:00
|
|
|
#ifdef CONFIG_KPROBES
|
|
|
|
static inline int notify_page_fault(struct pt_regs *regs, unsigned int esr)
|
|
|
|
{
|
|
|
|
int ret = 0;
|
|
|
|
|
|
|
|
/* kprobe_running() needs smp_processor_id() */
|
|
|
|
if (!user_mode(regs)) {
|
|
|
|
preempt_disable();
|
|
|
|
if (kprobe_running() && kprobe_fault_handler(regs, esr))
|
|
|
|
ret = 1;
|
|
|
|
preempt_enable();
|
|
|
|
}
|
|
|
|
|
|
|
|
return ret;
|
|
|
|
}
|
|
|
|
#else
|
|
|
|
static inline int notify_page_fault(struct pt_regs *regs, unsigned int esr)
|
|
|
|
{
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
#endif
|
|
|
|
|
2017-08-04 16:31:42 +08:00
|
|
|
static void data_abort_decode(unsigned int esr)
|
|
|
|
{
|
|
|
|
pr_alert("Data abort info:\n");
|
|
|
|
|
|
|
|
if (esr & ESR_ELx_ISV) {
|
|
|
|
pr_alert(" Access size = %u byte(s)\n",
|
|
|
|
1U << ((esr & ESR_ELx_SAS) >> ESR_ELx_SAS_SHIFT));
|
|
|
|
pr_alert(" SSE = %lu, SRT = %lu\n",
|
|
|
|
(esr & ESR_ELx_SSE) >> ESR_ELx_SSE_SHIFT,
|
|
|
|
(esr & ESR_ELx_SRT_MASK) >> ESR_ELx_SRT_SHIFT);
|
|
|
|
pr_alert(" SF = %lu, AR = %lu\n",
|
|
|
|
(esr & ESR_ELx_SF) >> ESR_ELx_SF_SHIFT,
|
|
|
|
(esr & ESR_ELx_AR) >> ESR_ELx_AR_SHIFT);
|
|
|
|
} else {
|
2017-10-02 19:42:00 +08:00
|
|
|
pr_alert(" ISV = 0, ISS = 0x%08lx\n", esr & ESR_ELx_ISS_MASK);
|
2017-08-04 16:31:42 +08:00
|
|
|
}
|
|
|
|
|
|
|
|
pr_alert(" CM = %lu, WnR = %lu\n",
|
|
|
|
(esr & ESR_ELx_CM) >> ESR_ELx_CM_SHIFT,
|
|
|
|
(esr & ESR_ELx_WNR) >> ESR_ELx_WNR_SHIFT);
|
|
|
|
}
|
|
|
|
|
|
|
|
static void mem_abort_decode(unsigned int esr)
|
|
|
|
{
|
|
|
|
pr_alert("Mem abort info:\n");
|
|
|
|
|
2017-10-19 18:19:55 +08:00
|
|
|
pr_alert(" ESR = 0x%08x\n", esr);
|
2017-08-04 16:31:42 +08:00
|
|
|
pr_alert(" Exception class = %s, IL = %u bits\n",
|
|
|
|
esr_get_class_string(esr),
|
|
|
|
(esr & ESR_ELx_IL) ? 32 : 16);
|
|
|
|
pr_alert(" SET = %lu, FnV = %lu\n",
|
|
|
|
(esr & ESR_ELx_SET_MASK) >> ESR_ELx_SET_SHIFT,
|
|
|
|
(esr & ESR_ELx_FnV) >> ESR_ELx_FnV_SHIFT);
|
|
|
|
pr_alert(" EA = %lu, S1PTW = %lu\n",
|
|
|
|
(esr & ESR_ELx_EA) >> ESR_ELx_EA_SHIFT,
|
|
|
|
(esr & ESR_ELx_S1PTW) >> ESR_ELx_S1PTW_SHIFT);
|
|
|
|
|
|
|
|
if (esr_is_data_abort(esr))
|
|
|
|
data_abort_decode(esr);
|
|
|
|
}
|
|
|
|
|
2012-03-05 19:49:27 +08:00
|
|
|
/*
|
2017-06-09 23:35:52 +08:00
|
|
|
* Dump out the page tables associated with 'addr' in the currently active mm.
|
2012-03-05 19:49:27 +08:00
|
|
|
*/
|
2017-06-09 23:35:52 +08:00
|
|
|
void show_pte(unsigned long addr)
|
2012-03-05 19:49:27 +08:00
|
|
|
{
|
2017-06-09 23:35:52 +08:00
|
|
|
struct mm_struct *mm;
|
2018-02-15 19:14:56 +08:00
|
|
|
pgd_t *pgdp;
|
|
|
|
pgd_t pgd;
|
2012-03-05 19:49:27 +08:00
|
|
|
|
2017-06-09 23:35:52 +08:00
|
|
|
if (addr < TASK_SIZE) {
|
|
|
|
/* TTBR0 */
|
|
|
|
mm = current->active_mm;
|
|
|
|
if (mm == &init_mm) {
|
|
|
|
pr_alert("[%016lx] user address but active_mm is swapper\n",
|
|
|
|
addr);
|
|
|
|
return;
|
|
|
|
}
|
|
|
|
} else if (addr >= VA_START) {
|
|
|
|
/* TTBR1 */
|
2012-03-05 19:49:27 +08:00
|
|
|
mm = &init_mm;
|
2017-06-09 23:35:52 +08:00
|
|
|
} else {
|
|
|
|
pr_alert("[%016lx] address between user and kernel address ranges\n",
|
|
|
|
addr);
|
|
|
|
return;
|
|
|
|
}
|
2012-03-05 19:49:27 +08:00
|
|
|
|
2018-02-15 19:14:56 +08:00
|
|
|
pr_alert("%s pgtable: %luk pages, %u-bit VAs, pgdp = %p\n",
|
2017-05-15 22:23:58 +08:00
|
|
|
mm == &init_mm ? "swapper" : "user", PAGE_SIZE / SZ_1K,
|
|
|
|
VA_BITS, mm->pgd);
|
2018-02-15 19:14:56 +08:00
|
|
|
pgdp = pgd_offset(mm, addr);
|
|
|
|
pgd = READ_ONCE(*pgdp);
|
|
|
|
pr_alert("[%016lx] pgd=%016llx", addr, pgd_val(pgd));
|
2012-03-05 19:49:27 +08:00
|
|
|
|
|
|
|
do {
|
2018-02-15 19:14:56 +08:00
|
|
|
pud_t *pudp, pud;
|
|
|
|
pmd_t *pmdp, pmd;
|
|
|
|
pte_t *ptep, pte;
|
2012-03-05 19:49:27 +08:00
|
|
|
|
2018-02-15 19:14:56 +08:00
|
|
|
if (pgd_none(pgd) || pgd_bad(pgd))
|
2012-03-05 19:49:27 +08:00
|
|
|
break;
|
|
|
|
|
2018-02-15 19:14:56 +08:00
|
|
|
pudp = pud_offset(pgdp, addr);
|
|
|
|
pud = READ_ONCE(*pudp);
|
|
|
|
pr_cont(", pud=%016llx", pud_val(pud));
|
|
|
|
if (pud_none(pud) || pud_bad(pud))
|
2012-03-05 19:49:27 +08:00
|
|
|
break;
|
|
|
|
|
2018-02-15 19:14:56 +08:00
|
|
|
pmdp = pmd_offset(pudp, addr);
|
|
|
|
pmd = READ_ONCE(*pmdp);
|
|
|
|
pr_cont(", pmd=%016llx", pmd_val(pmd));
|
|
|
|
if (pmd_none(pmd) || pmd_bad(pmd))
|
2012-03-05 19:49:27 +08:00
|
|
|
break;
|
|
|
|
|
2018-02-15 19:14:56 +08:00
|
|
|
ptep = pte_offset_map(pmdp, addr);
|
|
|
|
pte = READ_ONCE(*ptep);
|
|
|
|
pr_cont(", pte=%016llx", pte_val(pte));
|
|
|
|
pte_unmap(ptep);
|
2012-03-05 19:49:27 +08:00
|
|
|
} while(0);
|
|
|
|
|
2017-01-03 22:27:26 +08:00
|
|
|
pr_cont("\n");
|
2012-03-05 19:49:27 +08:00
|
|
|
}
|
|
|
|
|
2016-04-13 23:01:22 +08:00
|
|
|
/*
|
|
|
|
* This function sets the access flags (dirty, accessed), as well as write
|
|
|
|
* permission, and only to a more permissive setting.
|
|
|
|
*
|
|
|
|
* It needs to cope with hardware update of the accessed/dirty state by other
|
|
|
|
* agents in the system and can safely skip the __sync_icache_dcache() call as,
|
|
|
|
* like set_pte_at(), the PTE is never changed from no-exec to exec here.
|
|
|
|
*
|
|
|
|
* Returns whether or not the PTE actually changed.
|
|
|
|
*/
|
|
|
|
int ptep_set_access_flags(struct vm_area_struct *vma,
|
|
|
|
unsigned long address, pte_t *ptep,
|
|
|
|
pte_t entry, int dirty)
|
|
|
|
{
|
2017-06-26 21:27:36 +08:00
|
|
|
pteval_t old_pteval, pteval;
|
2018-02-15 19:14:56 +08:00
|
|
|
pte_t pte = READ_ONCE(*ptep);
|
2016-04-13 23:01:22 +08:00
|
|
|
|
2018-02-15 19:14:56 +08:00
|
|
|
if (pte_same(pte, entry))
|
2016-04-13 23:01:22 +08:00
|
|
|
return 0;
|
|
|
|
|
|
|
|
/* only preserve the access flags and write permission */
|
2017-07-05 02:04:18 +08:00
|
|
|
pte_val(entry) &= PTE_RDONLY | PTE_AF | PTE_WRITE | PTE_DIRTY;
|
2016-04-13 23:01:22 +08:00
|
|
|
|
|
|
|
/*
|
|
|
|
* Setting the flags must be done atomically to avoid racing with the
|
2017-07-25 21:53:03 +08:00
|
|
|
* hardware update of the access/dirty state. The PTE_RDONLY bit must
|
|
|
|
* be set to the most permissive (lowest value) of *ptep and entry
|
|
|
|
* (calculated as: a & b == ~(~a | ~b)).
|
2016-04-13 23:01:22 +08:00
|
|
|
*/
|
2017-07-25 21:53:03 +08:00
|
|
|
pte_val(entry) ^= PTE_RDONLY;
|
2018-02-15 19:14:56 +08:00
|
|
|
pteval = pte_val(pte);
|
2017-06-26 21:27:36 +08:00
|
|
|
do {
|
|
|
|
old_pteval = pteval;
|
|
|
|
pteval ^= PTE_RDONLY;
|
|
|
|
pteval |= pte_val(entry);
|
|
|
|
pteval ^= PTE_RDONLY;
|
|
|
|
pteval = cmpxchg_relaxed(&pte_val(*ptep), old_pteval, pteval);
|
|
|
|
} while (pteval != old_pteval);
|
2016-04-13 23:01:22 +08:00
|
|
|
|
|
|
|
flush_tlb_fix_spurious_fault(vma, address);
|
|
|
|
return 1;
|
|
|
|
}
|
|
|
|
|
2016-08-10 09:25:26 +08:00
|
|
|
static bool is_el1_instruction_abort(unsigned int esr)
|
|
|
|
{
|
|
|
|
return ESR_ELx_EC(esr) == ESR_ELx_EC_IABT_CUR;
|
|
|
|
}
|
|
|
|
|
2017-04-06 03:18:31 +08:00
|
|
|
static inline bool is_permission_fault(unsigned int esr, struct pt_regs *regs,
|
|
|
|
unsigned long addr)
|
|
|
|
{
|
|
|
|
unsigned int ec = ESR_ELx_EC(esr);
|
|
|
|
unsigned int fsc_type = esr & ESR_ELx_FSC_TYPE;
|
|
|
|
|
|
|
|
if (ec != ESR_ELx_EC_DABT_CUR && ec != ESR_ELx_EC_IABT_CUR)
|
|
|
|
return false;
|
|
|
|
|
|
|
|
if (fsc_type == ESR_ELx_FSC_PERM)
|
|
|
|
return true;
|
|
|
|
|
2018-02-05 23:34:18 +08:00
|
|
|
if (addr < TASK_SIZE && system_uses_ttbr0_pan())
|
2017-04-06 03:18:31 +08:00
|
|
|
return fsc_type == ESR_ELx_FSC_FAULT &&
|
|
|
|
(regs->pstate & PSR_PAN_BIT);
|
|
|
|
|
|
|
|
return false;
|
|
|
|
}
|
|
|
|
|
2017-06-09 23:35:52 +08:00
|
|
|
static void __do_kernel_fault(unsigned long addr, unsigned int esr,
|
|
|
|
struct pt_regs *regs)
|
2012-03-05 19:49:27 +08:00
|
|
|
{
|
2017-04-06 03:18:31 +08:00
|
|
|
const char *msg;
|
|
|
|
|
2012-03-05 19:49:27 +08:00
|
|
|
/*
|
|
|
|
* Are we prepared to handle this kernel fault?
|
2016-08-10 09:25:26 +08:00
|
|
|
* We are almost certainly not prepared to handle instruction faults.
|
2012-03-05 19:49:27 +08:00
|
|
|
*/
|
2016-08-10 09:25:26 +08:00
|
|
|
if (!is_el1_instruction_abort(esr) && fixup_exception(regs))
|
2012-03-05 19:49:27 +08:00
|
|
|
return;
|
|
|
|
|
|
|
|
bust_spinlocks(1);
|
2017-04-06 03:18:31 +08:00
|
|
|
|
|
|
|
if (is_permission_fault(esr, regs, addr)) {
|
|
|
|
if (esr & ESR_ELx_WNR)
|
|
|
|
msg = "write to read-only memory";
|
|
|
|
else
|
|
|
|
msg = "read from unreadable memory";
|
|
|
|
} else if (addr < PAGE_SIZE) {
|
|
|
|
msg = "NULL pointer dereference";
|
|
|
|
} else {
|
|
|
|
msg = "paging request";
|
|
|
|
}
|
|
|
|
|
|
|
|
pr_alert("Unable to handle kernel %s at virtual address %08lx\n", msg,
|
|
|
|
addr);
|
2012-03-05 19:49:27 +08:00
|
|
|
|
2017-08-04 16:31:42 +08:00
|
|
|
mem_abort_decode(esr);
|
|
|
|
|
2017-06-09 23:35:52 +08:00
|
|
|
show_pte(addr);
|
2012-03-05 19:49:27 +08:00
|
|
|
die("Oops", regs, esr);
|
|
|
|
bust_spinlocks(0);
|
|
|
|
do_exit(SIGKILL);
|
|
|
|
}
|
|
|
|
|
2018-02-20 22:53:22 +08:00
|
|
|
static void __do_user_fault(struct siginfo *info, unsigned int esr)
|
2012-03-05 19:49:27 +08:00
|
|
|
{
|
2018-02-20 22:53:22 +08:00
|
|
|
current->thread.fault_address = (unsigned long)info->si_addr;
|
|
|
|
current->thread.fault_code = esr;
|
|
|
|
arm64_force_sig_info(info, esr_to_fault_info(esr)->name, current);
|
2012-03-05 19:49:27 +08:00
|
|
|
}
|
|
|
|
|
2013-09-16 22:18:28 +08:00
|
|
|
static void do_bad_area(unsigned long addr, unsigned int esr, struct pt_regs *regs)
|
2012-03-05 19:49:27 +08:00
|
|
|
{
|
|
|
|
/*
|
|
|
|
* If we are in kernel mode at this point, we have no context to
|
|
|
|
* handle this fault with.
|
|
|
|
*/
|
2017-04-04 13:51:01 +08:00
|
|
|
if (user_mode(regs)) {
|
2018-02-20 22:53:22 +08:00
|
|
|
const struct fault_info *inf = esr_to_fault_info(esr);
|
|
|
|
struct siginfo si = {
|
|
|
|
.si_signo = inf->sig,
|
|
|
|
.si_code = inf->code,
|
|
|
|
.si_addr = (void __user *)addr,
|
|
|
|
};
|
|
|
|
|
|
|
|
__do_user_fault(&si, esr);
|
|
|
|
} else {
|
2017-06-09 23:35:52 +08:00
|
|
|
__do_kernel_fault(addr, esr, regs);
|
2018-02-20 22:53:22 +08:00
|
|
|
}
|
2012-03-05 19:49:27 +08:00
|
|
|
}
|
|
|
|
|
|
|
|
#define VM_FAULT_BADMAP 0x010000
|
|
|
|
#define VM_FAULT_BADACCESS 0x020000
|
|
|
|
|
|
|
|
static int __do_page_fault(struct mm_struct *mm, unsigned long addr,
|
2013-07-19 22:37:12 +08:00
|
|
|
unsigned int mm_flags, unsigned long vm_flags,
|
2012-03-05 19:49:27 +08:00
|
|
|
struct task_struct *tsk)
|
|
|
|
{
|
|
|
|
struct vm_area_struct *vma;
|
|
|
|
int fault;
|
|
|
|
|
|
|
|
vma = find_vma(mm, addr);
|
|
|
|
fault = VM_FAULT_BADMAP;
|
|
|
|
if (unlikely(!vma))
|
|
|
|
goto out;
|
|
|
|
if (unlikely(vma->vm_start > addr))
|
|
|
|
goto check_stack;
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Ok, we have a good vm_area for this memory access, so we can handle
|
|
|
|
* it.
|
|
|
|
*/
|
|
|
|
good_area:
|
2013-07-19 22:37:12 +08:00
|
|
|
/*
|
|
|
|
* Check that the permissions on the VMA allow for the fault which
|
2016-08-12 01:44:50 +08:00
|
|
|
* occurred.
|
2013-07-19 22:37:12 +08:00
|
|
|
*/
|
|
|
|
if (!(vma->vm_flags & vm_flags)) {
|
2012-03-05 19:49:27 +08:00
|
|
|
fault = VM_FAULT_BADACCESS;
|
|
|
|
goto out;
|
|
|
|
}
|
|
|
|
|
2016-07-27 06:25:18 +08:00
|
|
|
return handle_mm_fault(vma, addr & PAGE_MASK, mm_flags);
|
2012-03-05 19:49:27 +08:00
|
|
|
|
|
|
|
check_stack:
|
|
|
|
if (vma->vm_flags & VM_GROWSDOWN && !expand_stack(vma, addr))
|
|
|
|
goto good_area;
|
|
|
|
out:
|
|
|
|
return fault;
|
|
|
|
}
|
|
|
|
|
arm64: kill ESR_LNX_EXEC
Currently we treat ESR_EL1 bit 24 as software-defined for distinguishing
instruction aborts from data aborts, but this bit is architecturally
RES0 for instruction aborts, and could be allocated for an arbitrary
purpose in future. Additionally, we hard-code the value in entry.S
without the mnemonic, making the code difficult to understand.
Instead, remove ESR_LNX_EXEC, and distinguish aborts based on the esr,
which we already pass to the sole use of ESR_LNX_EXEC. A new helper,
is_el0_instruction_abort() is added to make the logic clear. Any
instruction aborts taken from EL1 will already have been handled by
bad_mode, so we need not handle that case in the helper.
For consistency, the existing permission_fault helper is renamed to
is_permission_fault, and the return type is changed to bool. There
should be no functional changes as the return value was a boolean
expression, and the result is only used in another boolean expression.
Signed-off-by: Mark Rutland <mark.rutland@arm.com>
Cc: Dave P Martin <dave.martin@arm.com>
Cc: Huang Shijie <shijie.huang@arm.com>
Cc: James Morse <james.morse@arm.com>
Cc: Marc Zyngier <marc.zyngier@arm.com>
Cc: Will Deacon <will.deacon@arm.com>
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
2016-05-31 19:33:03 +08:00
|
|
|
static bool is_el0_instruction_abort(unsigned int esr)
|
|
|
|
{
|
|
|
|
return ESR_ELx_EC(esr) == ESR_ELx_EC_IABT_LOW;
|
|
|
|
}
|
|
|
|
|
2012-03-05 19:49:27 +08:00
|
|
|
static int __kprobes do_page_fault(unsigned long addr, unsigned int esr,
|
|
|
|
struct pt_regs *regs)
|
|
|
|
{
|
|
|
|
struct task_struct *tsk;
|
|
|
|
struct mm_struct *mm;
|
2018-02-20 22:53:22 +08:00
|
|
|
struct siginfo si;
|
|
|
|
int fault, major = 0;
|
2016-08-12 01:44:50 +08:00
|
|
|
unsigned long vm_flags = VM_READ | VM_WRITE;
|
2013-07-19 22:37:12 +08:00
|
|
|
unsigned int mm_flags = FAULT_FLAG_ALLOW_RETRY | FAULT_FLAG_KILLABLE;
|
|
|
|
|
arm64: Kprobes with single stepping support
Add support for basic kernel probes(kprobes) and jump probes
(jprobes) for ARM64.
Kprobes utilizes software breakpoint and single step debug
exceptions supported on ARM v8.
A software breakpoint is placed at the probe address to trap the
kernel execution into the kprobe handler.
ARM v8 supports enabling single stepping before the break exception
return (ERET), with next PC in exception return address (ELR_EL1). The
kprobe handler prepares an executable memory slot for out-of-line
execution with a copy of the original instruction being probed, and
enables single stepping. The PC is set to the out-of-line slot address
before the ERET. With this scheme, the instruction is executed with the
exact same register context except for the PC (and DAIF) registers.
Debug mask (PSTATE.D) is enabled only when single stepping a recursive
kprobe, e.g.: during kprobes reenter so that probed instruction can be
single stepped within the kprobe handler -exception- context.
The recursion depth of kprobe is always 2, i.e. upon probe re-entry,
any further re-entry is prevented by not calling handlers and the case
counted as a missed kprobe).
Single stepping from the x-o-l slot has a drawback for PC-relative accesses
like branching and symbolic literals access as the offset from the new PC
(slot address) may not be ensured to fit in the immediate value of
the opcode. Such instructions need simulation, so reject
probing them.
Instructions generating exceptions or cpu mode change are rejected
for probing.
Exclusive load/store instructions are rejected too. Additionally, the
code is checked to see if it is inside an exclusive load/store sequence
(code from Pratyush).
System instructions are mostly enabled for stepping, except MSR/MRS
accesses to "DAIF" flags in PSTATE, which are not safe for
probing.
This also changes arch/arm64/include/asm/ptrace.h to use
include/asm-generic/ptrace.h.
Thanks to Steve Capper and Pratyush Anand for several suggested
Changes.
Signed-off-by: Sandeepa Prabhu <sandeepa.s.prabhu@gmail.com>
Signed-off-by: David A. Long <dave.long@linaro.org>
Signed-off-by: Pratyush Anand <panand@redhat.com>
Acked-by: Masami Hiramatsu <mhiramat@kernel.org>
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
2016-07-09 00:35:48 +08:00
|
|
|
if (notify_page_fault(regs, esr))
|
|
|
|
return 0;
|
|
|
|
|
2012-03-05 19:49:27 +08:00
|
|
|
tsk = current;
|
|
|
|
mm = tsk->mm;
|
|
|
|
|
|
|
|
/*
|
|
|
|
* If we're in an interrupt or have no user context, we must not take
|
|
|
|
* the fault.
|
|
|
|
*/
|
2015-05-11 23:52:11 +08:00
|
|
|
if (faulthandler_disabled() || !mm)
|
2012-03-05 19:49:27 +08:00
|
|
|
goto no_context;
|
|
|
|
|
2013-09-13 06:13:39 +08:00
|
|
|
if (user_mode(regs))
|
|
|
|
mm_flags |= FAULT_FLAG_USER;
|
|
|
|
|
arm64: kill ESR_LNX_EXEC
Currently we treat ESR_EL1 bit 24 as software-defined for distinguishing
instruction aborts from data aborts, but this bit is architecturally
RES0 for instruction aborts, and could be allocated for an arbitrary
purpose in future. Additionally, we hard-code the value in entry.S
without the mnemonic, making the code difficult to understand.
Instead, remove ESR_LNX_EXEC, and distinguish aborts based on the esr,
which we already pass to the sole use of ESR_LNX_EXEC. A new helper,
is_el0_instruction_abort() is added to make the logic clear. Any
instruction aborts taken from EL1 will already have been handled by
bad_mode, so we need not handle that case in the helper.
For consistency, the existing permission_fault helper is renamed to
is_permission_fault, and the return type is changed to bool. There
should be no functional changes as the return value was a boolean
expression, and the result is only used in another boolean expression.
Signed-off-by: Mark Rutland <mark.rutland@arm.com>
Cc: Dave P Martin <dave.martin@arm.com>
Cc: Huang Shijie <shijie.huang@arm.com>
Cc: James Morse <james.morse@arm.com>
Cc: Marc Zyngier <marc.zyngier@arm.com>
Cc: Will Deacon <will.deacon@arm.com>
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
2016-05-31 19:33:03 +08:00
|
|
|
if (is_el0_instruction_abort(esr)) {
|
2013-09-13 06:13:39 +08:00
|
|
|
vm_flags = VM_EXEC;
|
2014-11-24 20:31:40 +08:00
|
|
|
} else if ((esr & ESR_ELx_WNR) && !(esr & ESR_ELx_CM)) {
|
2013-09-13 06:13:39 +08:00
|
|
|
vm_flags = VM_WRITE;
|
|
|
|
mm_flags |= FAULT_FLAG_WRITE;
|
|
|
|
}
|
|
|
|
|
2018-02-05 23:34:18 +08:00
|
|
|
if (addr < TASK_SIZE && is_permission_fault(esr, regs, addr)) {
|
2016-06-21 01:28:01 +08:00
|
|
|
/* regs->orig_addr_limit may be 0 if we entered from EL0 */
|
|
|
|
if (regs->orig_addr_limit == KERNEL_DS)
|
2016-02-19 22:28:58 +08:00
|
|
|
die("Accessing user space memory with fs=KERNEL_DS", regs, esr);
|
2016-02-05 22:58:50 +08:00
|
|
|
|
2016-08-10 09:25:26 +08:00
|
|
|
if (is_el1_instruction_abort(esr))
|
|
|
|
die("Attempting to execute userspace memory", regs, esr);
|
|
|
|
|
2016-02-05 22:58:48 +08:00
|
|
|
if (!search_exception_tables(regs->pc))
|
2016-02-19 22:28:58 +08:00
|
|
|
die("Accessing user space memory outside uaccess.h routines", regs, esr);
|
2016-02-05 22:58:48 +08:00
|
|
|
}
|
2015-07-23 02:05:54 +08:00
|
|
|
|
2017-06-09 01:25:28 +08:00
|
|
|
perf_sw_event(PERF_COUNT_SW_PAGE_FAULTS, 1, regs, addr);
|
|
|
|
|
2012-03-05 19:49:27 +08:00
|
|
|
/*
|
|
|
|
* As per x86, we may deadlock here. However, since the kernel only
|
|
|
|
* validly references user space from well defined areas of the code,
|
|
|
|
* we can bug out early if this is from code which shouldn't.
|
|
|
|
*/
|
|
|
|
if (!down_read_trylock(&mm->mmap_sem)) {
|
|
|
|
if (!user_mode(regs) && !search_exception_tables(regs->pc))
|
|
|
|
goto no_context;
|
|
|
|
retry:
|
|
|
|
down_read(&mm->mmap_sem);
|
|
|
|
} else {
|
|
|
|
/*
|
|
|
|
* The above down_read_trylock() might have succeeded in which
|
|
|
|
* case, we'll have missed the might_sleep() from down_read().
|
|
|
|
*/
|
|
|
|
might_sleep();
|
|
|
|
#ifdef CONFIG_DEBUG_VM
|
|
|
|
if (!user_mode(regs) && !search_exception_tables(regs->pc))
|
|
|
|
goto no_context;
|
|
|
|
#endif
|
|
|
|
}
|
|
|
|
|
2013-07-19 22:37:12 +08:00
|
|
|
fault = __do_page_fault(mm, addr, mm_flags, vm_flags, tsk);
|
2017-06-09 01:25:28 +08:00
|
|
|
major |= fault & VM_FAULT_MAJOR;
|
2012-03-05 19:49:27 +08:00
|
|
|
|
2017-06-09 01:25:28 +08:00
|
|
|
if (fault & VM_FAULT_RETRY) {
|
|
|
|
/*
|
|
|
|
* If we need to retry but a fatal signal is pending,
|
|
|
|
* handle the signal first. We do not need to release
|
|
|
|
* the mmap_sem because it would already be released
|
|
|
|
* in __lock_page_or_retry in mm/filemap.c.
|
|
|
|
*/
|
arm64: mm: abort uaccess retries upon fatal signal
When there's a fatal signal pending, arm64's do_page_fault()
implementation returns 0. The intent is that we'll return to the
faulting userspace instruction, delivering the signal on the way.
However, if we take a fatal signal during fixing up a uaccess, this
results in a return to the faulting kernel instruction, which will be
instantly retried, resulting in the same fault being taken forever. As
the task never reaches userspace, the signal is not delivered, and the
task is left unkillable. While the task is stuck in this state, it can
inhibit the forward progress of the system.
To avoid this, we must ensure that when a fatal signal is pending, we
apply any necessary fixup for a faulting kernel instruction. Thus we
will return to an error path, and it is up to that code to make forward
progress towards delivering the fatal signal.
Cc: Catalin Marinas <catalin.marinas@arm.com>
Cc: Laura Abbott <labbott@redhat.com>
Cc: stable@vger.kernel.org
Reviewed-by: Steve Capper <steve.capper@arm.com>
Tested-by: Steve Capper <steve.capper@arm.com>
Reviewed-by: James Morse <james.morse@arm.com>
Tested-by: James Morse <james.morse@arm.com>
Signed-off-by: Mark Rutland <mark.rutland@arm.com>
Signed-off-by: Will Deacon <will.deacon@arm.com>
2017-07-11 22:19:22 +08:00
|
|
|
if (fatal_signal_pending(current)) {
|
|
|
|
if (!user_mode(regs))
|
|
|
|
goto no_context;
|
2017-06-09 01:25:28 +08:00
|
|
|
return 0;
|
arm64: mm: abort uaccess retries upon fatal signal
When there's a fatal signal pending, arm64's do_page_fault()
implementation returns 0. The intent is that we'll return to the
faulting userspace instruction, delivering the signal on the way.
However, if we take a fatal signal during fixing up a uaccess, this
results in a return to the faulting kernel instruction, which will be
instantly retried, resulting in the same fault being taken forever. As
the task never reaches userspace, the signal is not delivered, and the
task is left unkillable. While the task is stuck in this state, it can
inhibit the forward progress of the system.
To avoid this, we must ensure that when a fatal signal is pending, we
apply any necessary fixup for a faulting kernel instruction. Thus we
will return to an error path, and it is up to that code to make forward
progress towards delivering the fatal signal.
Cc: Catalin Marinas <catalin.marinas@arm.com>
Cc: Laura Abbott <labbott@redhat.com>
Cc: stable@vger.kernel.org
Reviewed-by: Steve Capper <steve.capper@arm.com>
Tested-by: Steve Capper <steve.capper@arm.com>
Reviewed-by: James Morse <james.morse@arm.com>
Tested-by: James Morse <james.morse@arm.com>
Signed-off-by: Mark Rutland <mark.rutland@arm.com>
Signed-off-by: Will Deacon <will.deacon@arm.com>
2017-07-11 22:19:22 +08:00
|
|
|
}
|
2017-06-09 01:25:28 +08:00
|
|
|
|
|
|
|
/*
|
|
|
|
* Clear FAULT_FLAG_ALLOW_RETRY to avoid any risk of
|
|
|
|
* starvation.
|
|
|
|
*/
|
|
|
|
if (mm_flags & FAULT_FLAG_ALLOW_RETRY) {
|
|
|
|
mm_flags &= ~FAULT_FLAG_ALLOW_RETRY;
|
|
|
|
mm_flags |= FAULT_FLAG_TRIED;
|
|
|
|
goto retry;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
up_read(&mm->mmap_sem);
|
2012-03-05 19:49:27 +08:00
|
|
|
|
|
|
|
/*
|
2017-06-09 01:25:28 +08:00
|
|
|
* Handle the "normal" (no error) case first.
|
2012-03-05 19:49:27 +08:00
|
|
|
*/
|
2017-06-09 01:25:28 +08:00
|
|
|
if (likely(!(fault & (VM_FAULT_ERROR | VM_FAULT_BADMAP |
|
|
|
|
VM_FAULT_BADACCESS)))) {
|
|
|
|
/*
|
|
|
|
* Major/minor page fault accounting is only done
|
|
|
|
* once. If we go through a retry, it is extremely
|
|
|
|
* likely that the page will be found in page cache at
|
|
|
|
* that point.
|
|
|
|
*/
|
|
|
|
if (major) {
|
2012-03-05 19:49:27 +08:00
|
|
|
tsk->maj_flt++;
|
|
|
|
perf_sw_event(PERF_COUNT_SW_PAGE_FAULTS_MAJ, 1, regs,
|
|
|
|
addr);
|
|
|
|
} else {
|
|
|
|
tsk->min_flt++;
|
|
|
|
perf_sw_event(PERF_COUNT_SW_PAGE_FAULTS_MIN, 1, regs,
|
|
|
|
addr);
|
|
|
|
}
|
|
|
|
|
|
|
|
return 0;
|
2017-06-09 01:25:28 +08:00
|
|
|
}
|
2012-03-05 19:49:27 +08:00
|
|
|
|
2013-09-13 06:13:38 +08:00
|
|
|
/*
|
|
|
|
* If we are in kernel mode at this point, we have no context to
|
|
|
|
* handle this fault with.
|
|
|
|
*/
|
|
|
|
if (!user_mode(regs))
|
|
|
|
goto no_context;
|
|
|
|
|
2012-03-05 19:49:27 +08:00
|
|
|
if (fault & VM_FAULT_OOM) {
|
|
|
|
/*
|
|
|
|
* We ran out of memory, call the OOM killer, and return to
|
|
|
|
* userspace (which will retry the fault, or kill us if we got
|
|
|
|
* oom-killed).
|
|
|
|
*/
|
|
|
|
pagefault_out_of_memory();
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2018-02-20 22:53:22 +08:00
|
|
|
clear_siginfo(&si);
|
|
|
|
si.si_addr = (void __user *)addr;
|
|
|
|
|
2012-03-05 19:49:27 +08:00
|
|
|
if (fault & VM_FAULT_SIGBUS) {
|
|
|
|
/*
|
|
|
|
* We had some memory, but were unable to successfully fix up
|
|
|
|
* this page fault.
|
|
|
|
*/
|
2018-02-20 22:53:22 +08:00
|
|
|
si.si_signo = SIGBUS;
|
|
|
|
si.si_code = BUS_ADRERR;
|
|
|
|
} else if (fault & VM_FAULT_HWPOISON_LARGE) {
|
|
|
|
unsigned int hindex = VM_FAULT_GET_HINDEX(fault);
|
|
|
|
|
|
|
|
si.si_signo = SIGBUS;
|
|
|
|
si.si_code = BUS_MCEERR_AR;
|
|
|
|
si.si_addr_lsb = hstate_index_to_shift(hindex);
|
|
|
|
} else if (fault & VM_FAULT_HWPOISON) {
|
|
|
|
si.si_signo = SIGBUS;
|
|
|
|
si.si_code = BUS_MCEERR_AR;
|
|
|
|
si.si_addr_lsb = PAGE_SHIFT;
|
2012-03-05 19:49:27 +08:00
|
|
|
} else {
|
|
|
|
/*
|
|
|
|
* Something tried to access memory that isn't in our memory
|
|
|
|
* map.
|
|
|
|
*/
|
2018-02-20 22:53:22 +08:00
|
|
|
si.si_signo = SIGSEGV;
|
|
|
|
si.si_code = fault == VM_FAULT_BADACCESS ?
|
|
|
|
SEGV_ACCERR : SEGV_MAPERR;
|
2012-03-05 19:49:27 +08:00
|
|
|
}
|
|
|
|
|
2018-02-20 22:53:22 +08:00
|
|
|
__do_user_fault(&si, esr);
|
2012-03-05 19:49:27 +08:00
|
|
|
return 0;
|
|
|
|
|
|
|
|
no_context:
|
2017-06-09 23:35:52 +08:00
|
|
|
__do_kernel_fault(addr, esr, regs);
|
2012-03-05 19:49:27 +08:00
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
static int __kprobes do_translation_fault(unsigned long addr,
|
|
|
|
unsigned int esr,
|
|
|
|
struct pt_regs *regs)
|
|
|
|
{
|
|
|
|
if (addr < TASK_SIZE)
|
|
|
|
return do_page_fault(addr, esr, regs);
|
|
|
|
|
|
|
|
do_bad_area(addr, esr, regs);
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2016-02-16 12:44:35 +08:00
|
|
|
static int do_alignment_fault(unsigned long addr, unsigned int esr,
|
|
|
|
struct pt_regs *regs)
|
|
|
|
{
|
|
|
|
do_bad_area(addr, esr, regs);
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2012-03-05 19:49:27 +08:00
|
|
|
static int do_bad(unsigned long addr, unsigned int esr, struct pt_regs *regs)
|
|
|
|
{
|
2017-09-22 18:01:26 +08:00
|
|
|
return 1; /* "fault" */
|
2012-03-05 19:49:27 +08:00
|
|
|
}
|
|
|
|
|
2017-06-22 02:17:08 +08:00
|
|
|
static int do_sea(unsigned long addr, unsigned int esr, struct pt_regs *regs)
|
|
|
|
{
|
|
|
|
struct siginfo info;
|
|
|
|
const struct fault_info *inf;
|
|
|
|
|
|
|
|
inf = esr_to_fault_info(esr);
|
|
|
|
|
2017-06-22 02:17:09 +08:00
|
|
|
/*
|
|
|
|
* Synchronous aborts may interrupt code which had interrupts masked.
|
|
|
|
* Before calling out into the wider kernel tell the interested
|
|
|
|
* subsystems.
|
|
|
|
*/
|
|
|
|
if (IS_ENABLED(CONFIG_ACPI_APEI_SEA)) {
|
|
|
|
if (interrupts_enabled(regs))
|
|
|
|
nmi_enter();
|
|
|
|
|
2017-12-13 18:36:47 +08:00
|
|
|
ghes_notify_sea();
|
2017-06-22 02:17:09 +08:00
|
|
|
|
|
|
|
if (interrupts_enabled(regs))
|
|
|
|
nmi_exit();
|
|
|
|
}
|
|
|
|
|
arm64: signal: Ensure si_code is valid for all fault signals
Currently, as reported by Eric, an invalid si_code value 0 is
passed in many signals delivered to userspace in response to faults
and other kernel errors. Typically 0 is passed when the fault is
insufficiently diagnosable or when there does not appear to be any
sensible alternative value to choose.
This appears to violate POSIX, and is intuitively wrong for at
least two reasons arising from the fact that 0 == SI_USER:
1) si_code is a union selector, and SI_USER (and si_code <= 0 in
general) implies the existence of a different set of fields
(siginfo._kill) from that which exists for a fault signal
(siginfo._sigfault). However, the code raising the signal
typically writes only the _sigfault fields, and the _kill
fields make no sense in this case.
Thus when userspace sees si_code == 0 (SI_USER) it may
legitimately inspect fields in the inactive union member _kill
and obtain garbage as a result.
There appears to be software in the wild relying on this,
albeit generally only for printing diagnostic messages.
2) Software that wants to be robust against spurious signals may
discard signals where si_code == SI_USER (or <= 0), or may
filter such signals based on the si_uid and si_pid fields of
siginfo._sigkill. In the case of fault signals, this means
that important (and usually fatal) error conditions may be
silently ignored.
In practice, many of the faults for which arm64 passes si_code == 0
are undiagnosable conditions such as exceptions with syndrome
values in ESR_ELx to which the architecture does not yet assign any
meaning, or conditions indicative of a bug or error in the kernel
or system and thus that are unrecoverable and should never occur in
normal operation.
The approach taken in this patch is to translate all such
undiagnosable or "impossible" synchronous fault conditions to
SIGKILL, since these are at least probably localisable to a single
process. Some of these conditions should really result in a kernel
panic, but due to the lack of diagnostic information it is
difficult to be certain: this patch does not add any calls to
panic(), but this could change later if justified.
Although si_code will not reach userspace in the case of SIGKILL,
it is still desirable to pass a nonzero value so that the common
siginfo handling code can detect incorrect use of si_code == 0
without false positives. In this case the si_code dependent
siginfo fields will not be correctly initialised, but since they
are not passed to userspace I deem this not to matter.
A few faults can reasonably occur in realistic userspace scenarios,
and _should_ raise a regular, handleable (but perhaps not
ignorable/blockable) signal: for these, this patch attempts to
choose a suitable standard si_code value for the raised signal in
each case instead of 0.
arm64 was the only arch to define a BUS_FIXME code, so after this
patch nobody defines it. This patch therefore also removes the
relevant code from siginfo_layout().
Cc: James Morse <james.morse@arm.com>
Reported-by: Eric W. Biederman <ebiederm@xmission.com>
Signed-off-by: Dave Martin <Dave.Martin@arm.com>
Signed-off-by: Will Deacon <will.deacon@arm.com>
2018-03-09 01:41:05 +08:00
|
|
|
info.si_signo = inf->sig;
|
2017-06-22 02:17:08 +08:00
|
|
|
info.si_errno = 0;
|
arm64: signal: Ensure si_code is valid for all fault signals
Currently, as reported by Eric, an invalid si_code value 0 is
passed in many signals delivered to userspace in response to faults
and other kernel errors. Typically 0 is passed when the fault is
insufficiently diagnosable or when there does not appear to be any
sensible alternative value to choose.
This appears to violate POSIX, and is intuitively wrong for at
least two reasons arising from the fact that 0 == SI_USER:
1) si_code is a union selector, and SI_USER (and si_code <= 0 in
general) implies the existence of a different set of fields
(siginfo._kill) from that which exists for a fault signal
(siginfo._sigfault). However, the code raising the signal
typically writes only the _sigfault fields, and the _kill
fields make no sense in this case.
Thus when userspace sees si_code == 0 (SI_USER) it may
legitimately inspect fields in the inactive union member _kill
and obtain garbage as a result.
There appears to be software in the wild relying on this,
albeit generally only for printing diagnostic messages.
2) Software that wants to be robust against spurious signals may
discard signals where si_code == SI_USER (or <= 0), or may
filter such signals based on the si_uid and si_pid fields of
siginfo._sigkill. In the case of fault signals, this means
that important (and usually fatal) error conditions may be
silently ignored.
In practice, many of the faults for which arm64 passes si_code == 0
are undiagnosable conditions such as exceptions with syndrome
values in ESR_ELx to which the architecture does not yet assign any
meaning, or conditions indicative of a bug or error in the kernel
or system and thus that are unrecoverable and should never occur in
normal operation.
The approach taken in this patch is to translate all such
undiagnosable or "impossible" synchronous fault conditions to
SIGKILL, since these are at least probably localisable to a single
process. Some of these conditions should really result in a kernel
panic, but due to the lack of diagnostic information it is
difficult to be certain: this patch does not add any calls to
panic(), but this could change later if justified.
Although si_code will not reach userspace in the case of SIGKILL,
it is still desirable to pass a nonzero value so that the common
siginfo handling code can detect incorrect use of si_code == 0
without false positives. In this case the si_code dependent
siginfo fields will not be correctly initialised, but since they
are not passed to userspace I deem this not to matter.
A few faults can reasonably occur in realistic userspace scenarios,
and _should_ raise a regular, handleable (but perhaps not
ignorable/blockable) signal: for these, this patch attempts to
choose a suitable standard si_code value for the raised signal in
each case instead of 0.
arm64 was the only arch to define a BUS_FIXME code, so after this
patch nobody defines it. This patch therefore also removes the
relevant code from siginfo_layout().
Cc: James Morse <james.morse@arm.com>
Reported-by: Eric W. Biederman <ebiederm@xmission.com>
Signed-off-by: Dave Martin <Dave.Martin@arm.com>
Signed-off-by: Will Deacon <will.deacon@arm.com>
2018-03-09 01:41:05 +08:00
|
|
|
info.si_code = inf->code;
|
2017-06-22 02:17:08 +08:00
|
|
|
if (esr & ESR_ELx_FnV)
|
|
|
|
info.si_addr = NULL;
|
|
|
|
else
|
|
|
|
info.si_addr = (void __user *)addr;
|
2018-02-20 22:41:02 +08:00
|
|
|
arm64_notify_die(inf->name, regs, &info, esr);
|
2017-06-22 02:17:08 +08:00
|
|
|
|
2017-12-13 18:36:47 +08:00
|
|
|
return 0;
|
2017-06-22 02:17:08 +08:00
|
|
|
}
|
|
|
|
|
2017-04-04 13:51:01 +08:00
|
|
|
static const struct fault_info fault_info[] = {
|
arm64: signal: Ensure si_code is valid for all fault signals
Currently, as reported by Eric, an invalid si_code value 0 is
passed in many signals delivered to userspace in response to faults
and other kernel errors. Typically 0 is passed when the fault is
insufficiently diagnosable or when there does not appear to be any
sensible alternative value to choose.
This appears to violate POSIX, and is intuitively wrong for at
least two reasons arising from the fact that 0 == SI_USER:
1) si_code is a union selector, and SI_USER (and si_code <= 0 in
general) implies the existence of a different set of fields
(siginfo._kill) from that which exists for a fault signal
(siginfo._sigfault). However, the code raising the signal
typically writes only the _sigfault fields, and the _kill
fields make no sense in this case.
Thus when userspace sees si_code == 0 (SI_USER) it may
legitimately inspect fields in the inactive union member _kill
and obtain garbage as a result.
There appears to be software in the wild relying on this,
albeit generally only for printing diagnostic messages.
2) Software that wants to be robust against spurious signals may
discard signals where si_code == SI_USER (or <= 0), or may
filter such signals based on the si_uid and si_pid fields of
siginfo._sigkill. In the case of fault signals, this means
that important (and usually fatal) error conditions may be
silently ignored.
In practice, many of the faults for which arm64 passes si_code == 0
are undiagnosable conditions such as exceptions with syndrome
values in ESR_ELx to which the architecture does not yet assign any
meaning, or conditions indicative of a bug or error in the kernel
or system and thus that are unrecoverable and should never occur in
normal operation.
The approach taken in this patch is to translate all such
undiagnosable or "impossible" synchronous fault conditions to
SIGKILL, since these are at least probably localisable to a single
process. Some of these conditions should really result in a kernel
panic, but due to the lack of diagnostic information it is
difficult to be certain: this patch does not add any calls to
panic(), but this could change later if justified.
Although si_code will not reach userspace in the case of SIGKILL,
it is still desirable to pass a nonzero value so that the common
siginfo handling code can detect incorrect use of si_code == 0
without false positives. In this case the si_code dependent
siginfo fields will not be correctly initialised, but since they
are not passed to userspace I deem this not to matter.
A few faults can reasonably occur in realistic userspace scenarios,
and _should_ raise a regular, handleable (but perhaps not
ignorable/blockable) signal: for these, this patch attempts to
choose a suitable standard si_code value for the raised signal in
each case instead of 0.
arm64 was the only arch to define a BUS_FIXME code, so after this
patch nobody defines it. This patch therefore also removes the
relevant code from siginfo_layout().
Cc: James Morse <james.morse@arm.com>
Reported-by: Eric W. Biederman <ebiederm@xmission.com>
Signed-off-by: Dave Martin <Dave.Martin@arm.com>
Signed-off-by: Will Deacon <will.deacon@arm.com>
2018-03-09 01:41:05 +08:00
|
|
|
{ do_bad, SIGKILL, SI_KERNEL, "ttbr address size fault" },
|
|
|
|
{ do_bad, SIGKILL, SI_KERNEL, "level 1 address size fault" },
|
|
|
|
{ do_bad, SIGKILL, SI_KERNEL, "level 2 address size fault" },
|
|
|
|
{ do_bad, SIGKILL, SI_KERNEL, "level 3 address size fault" },
|
2014-11-21 22:22:22 +08:00
|
|
|
{ do_translation_fault, SIGSEGV, SEGV_MAPERR, "level 0 translation fault" },
|
2012-03-05 19:49:27 +08:00
|
|
|
{ do_translation_fault, SIGSEGV, SEGV_MAPERR, "level 1 translation fault" },
|
|
|
|
{ do_translation_fault, SIGSEGV, SEGV_MAPERR, "level 2 translation fault" },
|
2017-09-29 19:27:41 +08:00
|
|
|
{ do_translation_fault, SIGSEGV, SEGV_MAPERR, "level 3 translation fault" },
|
arm64: signal: Ensure si_code is valid for all fault signals
Currently, as reported by Eric, an invalid si_code value 0 is
passed in many signals delivered to userspace in response to faults
and other kernel errors. Typically 0 is passed when the fault is
insufficiently diagnosable or when there does not appear to be any
sensible alternative value to choose.
This appears to violate POSIX, and is intuitively wrong for at
least two reasons arising from the fact that 0 == SI_USER:
1) si_code is a union selector, and SI_USER (and si_code <= 0 in
general) implies the existence of a different set of fields
(siginfo._kill) from that which exists for a fault signal
(siginfo._sigfault). However, the code raising the signal
typically writes only the _sigfault fields, and the _kill
fields make no sense in this case.
Thus when userspace sees si_code == 0 (SI_USER) it may
legitimately inspect fields in the inactive union member _kill
and obtain garbage as a result.
There appears to be software in the wild relying on this,
albeit generally only for printing diagnostic messages.
2) Software that wants to be robust against spurious signals may
discard signals where si_code == SI_USER (or <= 0), or may
filter such signals based on the si_uid and si_pid fields of
siginfo._sigkill. In the case of fault signals, this means
that important (and usually fatal) error conditions may be
silently ignored.
In practice, many of the faults for which arm64 passes si_code == 0
are undiagnosable conditions such as exceptions with syndrome
values in ESR_ELx to which the architecture does not yet assign any
meaning, or conditions indicative of a bug or error in the kernel
or system and thus that are unrecoverable and should never occur in
normal operation.
The approach taken in this patch is to translate all such
undiagnosable or "impossible" synchronous fault conditions to
SIGKILL, since these are at least probably localisable to a single
process. Some of these conditions should really result in a kernel
panic, but due to the lack of diagnostic information it is
difficult to be certain: this patch does not add any calls to
panic(), but this could change later if justified.
Although si_code will not reach userspace in the case of SIGKILL,
it is still desirable to pass a nonzero value so that the common
siginfo handling code can detect incorrect use of si_code == 0
without false positives. In this case the si_code dependent
siginfo fields will not be correctly initialised, but since they
are not passed to userspace I deem this not to matter.
A few faults can reasonably occur in realistic userspace scenarios,
and _should_ raise a regular, handleable (but perhaps not
ignorable/blockable) signal: for these, this patch attempts to
choose a suitable standard si_code value for the raised signal in
each case instead of 0.
arm64 was the only arch to define a BUS_FIXME code, so after this
patch nobody defines it. This patch therefore also removes the
relevant code from siginfo_layout().
Cc: James Morse <james.morse@arm.com>
Reported-by: Eric W. Biederman <ebiederm@xmission.com>
Signed-off-by: Dave Martin <Dave.Martin@arm.com>
Signed-off-by: Will Deacon <will.deacon@arm.com>
2018-03-09 01:41:05 +08:00
|
|
|
{ do_bad, SIGKILL, SI_KERNEL, "unknown 8" },
|
2013-04-10 20:48:00 +08:00
|
|
|
{ do_page_fault, SIGSEGV, SEGV_ACCERR, "level 1 access flag fault" },
|
|
|
|
{ do_page_fault, SIGSEGV, SEGV_ACCERR, "level 2 access flag fault" },
|
2012-03-05 19:49:27 +08:00
|
|
|
{ do_page_fault, SIGSEGV, SEGV_ACCERR, "level 3 access flag fault" },
|
arm64: signal: Ensure si_code is valid for all fault signals
Currently, as reported by Eric, an invalid si_code value 0 is
passed in many signals delivered to userspace in response to faults
and other kernel errors. Typically 0 is passed when the fault is
insufficiently diagnosable or when there does not appear to be any
sensible alternative value to choose.
This appears to violate POSIX, and is intuitively wrong for at
least two reasons arising from the fact that 0 == SI_USER:
1) si_code is a union selector, and SI_USER (and si_code <= 0 in
general) implies the existence of a different set of fields
(siginfo._kill) from that which exists for a fault signal
(siginfo._sigfault). However, the code raising the signal
typically writes only the _sigfault fields, and the _kill
fields make no sense in this case.
Thus when userspace sees si_code == 0 (SI_USER) it may
legitimately inspect fields in the inactive union member _kill
and obtain garbage as a result.
There appears to be software in the wild relying on this,
albeit generally only for printing diagnostic messages.
2) Software that wants to be robust against spurious signals may
discard signals where si_code == SI_USER (or <= 0), or may
filter such signals based on the si_uid and si_pid fields of
siginfo._sigkill. In the case of fault signals, this means
that important (and usually fatal) error conditions may be
silently ignored.
In practice, many of the faults for which arm64 passes si_code == 0
are undiagnosable conditions such as exceptions with syndrome
values in ESR_ELx to which the architecture does not yet assign any
meaning, or conditions indicative of a bug or error in the kernel
or system and thus that are unrecoverable and should never occur in
normal operation.
The approach taken in this patch is to translate all such
undiagnosable or "impossible" synchronous fault conditions to
SIGKILL, since these are at least probably localisable to a single
process. Some of these conditions should really result in a kernel
panic, but due to the lack of diagnostic information it is
difficult to be certain: this patch does not add any calls to
panic(), but this could change later if justified.
Although si_code will not reach userspace in the case of SIGKILL,
it is still desirable to pass a nonzero value so that the common
siginfo handling code can detect incorrect use of si_code == 0
without false positives. In this case the si_code dependent
siginfo fields will not be correctly initialised, but since they
are not passed to userspace I deem this not to matter.
A few faults can reasonably occur in realistic userspace scenarios,
and _should_ raise a regular, handleable (but perhaps not
ignorable/blockable) signal: for these, this patch attempts to
choose a suitable standard si_code value for the raised signal in
each case instead of 0.
arm64 was the only arch to define a BUS_FIXME code, so after this
patch nobody defines it. This patch therefore also removes the
relevant code from siginfo_layout().
Cc: James Morse <james.morse@arm.com>
Reported-by: Eric W. Biederman <ebiederm@xmission.com>
Signed-off-by: Dave Martin <Dave.Martin@arm.com>
Signed-off-by: Will Deacon <will.deacon@arm.com>
2018-03-09 01:41:05 +08:00
|
|
|
{ do_bad, SIGKILL, SI_KERNEL, "unknown 12" },
|
2013-04-10 20:48:00 +08:00
|
|
|
{ do_page_fault, SIGSEGV, SEGV_ACCERR, "level 1 permission fault" },
|
|
|
|
{ do_page_fault, SIGSEGV, SEGV_ACCERR, "level 2 permission fault" },
|
2012-03-05 19:49:27 +08:00
|
|
|
{ do_page_fault, SIGSEGV, SEGV_ACCERR, "level 3 permission fault" },
|
arm64: signal: Ensure si_code is valid for all fault signals
Currently, as reported by Eric, an invalid si_code value 0 is
passed in many signals delivered to userspace in response to faults
and other kernel errors. Typically 0 is passed when the fault is
insufficiently diagnosable or when there does not appear to be any
sensible alternative value to choose.
This appears to violate POSIX, and is intuitively wrong for at
least two reasons arising from the fact that 0 == SI_USER:
1) si_code is a union selector, and SI_USER (and si_code <= 0 in
general) implies the existence of a different set of fields
(siginfo._kill) from that which exists for a fault signal
(siginfo._sigfault). However, the code raising the signal
typically writes only the _sigfault fields, and the _kill
fields make no sense in this case.
Thus when userspace sees si_code == 0 (SI_USER) it may
legitimately inspect fields in the inactive union member _kill
and obtain garbage as a result.
There appears to be software in the wild relying on this,
albeit generally only for printing diagnostic messages.
2) Software that wants to be robust against spurious signals may
discard signals where si_code == SI_USER (or <= 0), or may
filter such signals based on the si_uid and si_pid fields of
siginfo._sigkill. In the case of fault signals, this means
that important (and usually fatal) error conditions may be
silently ignored.
In practice, many of the faults for which arm64 passes si_code == 0
are undiagnosable conditions such as exceptions with syndrome
values in ESR_ELx to which the architecture does not yet assign any
meaning, or conditions indicative of a bug or error in the kernel
or system and thus that are unrecoverable and should never occur in
normal operation.
The approach taken in this patch is to translate all such
undiagnosable or "impossible" synchronous fault conditions to
SIGKILL, since these are at least probably localisable to a single
process. Some of these conditions should really result in a kernel
panic, but due to the lack of diagnostic information it is
difficult to be certain: this patch does not add any calls to
panic(), but this could change later if justified.
Although si_code will not reach userspace in the case of SIGKILL,
it is still desirable to pass a nonzero value so that the common
siginfo handling code can detect incorrect use of si_code == 0
without false positives. In this case the si_code dependent
siginfo fields will not be correctly initialised, but since they
are not passed to userspace I deem this not to matter.
A few faults can reasonably occur in realistic userspace scenarios,
and _should_ raise a regular, handleable (but perhaps not
ignorable/blockable) signal: for these, this patch attempts to
choose a suitable standard si_code value for the raised signal in
each case instead of 0.
arm64 was the only arch to define a BUS_FIXME code, so after this
patch nobody defines it. This patch therefore also removes the
relevant code from siginfo_layout().
Cc: James Morse <james.morse@arm.com>
Reported-by: Eric W. Biederman <ebiederm@xmission.com>
Signed-off-by: Dave Martin <Dave.Martin@arm.com>
Signed-off-by: Will Deacon <will.deacon@arm.com>
2018-03-09 01:41:05 +08:00
|
|
|
{ do_sea, SIGBUS, BUS_OBJERR, "synchronous external abort" },
|
|
|
|
{ do_bad, SIGKILL, SI_KERNEL, "unknown 17" },
|
|
|
|
{ do_bad, SIGKILL, SI_KERNEL, "unknown 18" },
|
|
|
|
{ do_bad, SIGKILL, SI_KERNEL, "unknown 19" },
|
|
|
|
{ do_sea, SIGKILL, SI_KERNEL, "level 0 (translation table walk)" },
|
|
|
|
{ do_sea, SIGKILL, SI_KERNEL, "level 1 (translation table walk)" },
|
|
|
|
{ do_sea, SIGKILL, SI_KERNEL, "level 2 (translation table walk)" },
|
|
|
|
{ do_sea, SIGKILL, SI_KERNEL, "level 3 (translation table walk)" },
|
|
|
|
{ do_sea, SIGBUS, BUS_OBJERR, "synchronous parity or ECC error" }, // Reserved when RAS is implemented
|
|
|
|
{ do_bad, SIGKILL, SI_KERNEL, "unknown 25" },
|
|
|
|
{ do_bad, SIGKILL, SI_KERNEL, "unknown 26" },
|
|
|
|
{ do_bad, SIGKILL, SI_KERNEL, "unknown 27" },
|
|
|
|
{ do_sea, SIGKILL, SI_KERNEL, "level 0 synchronous parity error (translation table walk)" }, // Reserved when RAS is implemented
|
|
|
|
{ do_sea, SIGKILL, SI_KERNEL, "level 1 synchronous parity error (translation table walk)" }, // Reserved when RAS is implemented
|
|
|
|
{ do_sea, SIGKILL, SI_KERNEL, "level 2 synchronous parity error (translation table walk)" }, // Reserved when RAS is implemented
|
|
|
|
{ do_sea, SIGKILL, SI_KERNEL, "level 3 synchronous parity error (translation table walk)" }, // Reserved when RAS is implemented
|
|
|
|
{ do_bad, SIGKILL, SI_KERNEL, "unknown 32" },
|
2016-02-16 12:44:35 +08:00
|
|
|
{ do_alignment_fault, SIGBUS, BUS_ADRALN, "alignment fault" },
|
arm64: signal: Ensure si_code is valid for all fault signals
Currently, as reported by Eric, an invalid si_code value 0 is
passed in many signals delivered to userspace in response to faults
and other kernel errors. Typically 0 is passed when the fault is
insufficiently diagnosable or when there does not appear to be any
sensible alternative value to choose.
This appears to violate POSIX, and is intuitively wrong for at
least two reasons arising from the fact that 0 == SI_USER:
1) si_code is a union selector, and SI_USER (and si_code <= 0 in
general) implies the existence of a different set of fields
(siginfo._kill) from that which exists for a fault signal
(siginfo._sigfault). However, the code raising the signal
typically writes only the _sigfault fields, and the _kill
fields make no sense in this case.
Thus when userspace sees si_code == 0 (SI_USER) it may
legitimately inspect fields in the inactive union member _kill
and obtain garbage as a result.
There appears to be software in the wild relying on this,
albeit generally only for printing diagnostic messages.
2) Software that wants to be robust against spurious signals may
discard signals where si_code == SI_USER (or <= 0), or may
filter such signals based on the si_uid and si_pid fields of
siginfo._sigkill. In the case of fault signals, this means
that important (and usually fatal) error conditions may be
silently ignored.
In practice, many of the faults for which arm64 passes si_code == 0
are undiagnosable conditions such as exceptions with syndrome
values in ESR_ELx to which the architecture does not yet assign any
meaning, or conditions indicative of a bug or error in the kernel
or system and thus that are unrecoverable and should never occur in
normal operation.
The approach taken in this patch is to translate all such
undiagnosable or "impossible" synchronous fault conditions to
SIGKILL, since these are at least probably localisable to a single
process. Some of these conditions should really result in a kernel
panic, but due to the lack of diagnostic information it is
difficult to be certain: this patch does not add any calls to
panic(), but this could change later if justified.
Although si_code will not reach userspace in the case of SIGKILL,
it is still desirable to pass a nonzero value so that the common
siginfo handling code can detect incorrect use of si_code == 0
without false positives. In this case the si_code dependent
siginfo fields will not be correctly initialised, but since they
are not passed to userspace I deem this not to matter.
A few faults can reasonably occur in realistic userspace scenarios,
and _should_ raise a regular, handleable (but perhaps not
ignorable/blockable) signal: for these, this patch attempts to
choose a suitable standard si_code value for the raised signal in
each case instead of 0.
arm64 was the only arch to define a BUS_FIXME code, so after this
patch nobody defines it. This patch therefore also removes the
relevant code from siginfo_layout().
Cc: James Morse <james.morse@arm.com>
Reported-by: Eric W. Biederman <ebiederm@xmission.com>
Signed-off-by: Dave Martin <Dave.Martin@arm.com>
Signed-off-by: Will Deacon <will.deacon@arm.com>
2018-03-09 01:41:05 +08:00
|
|
|
{ do_bad, SIGKILL, SI_KERNEL, "unknown 34" },
|
|
|
|
{ do_bad, SIGKILL, SI_KERNEL, "unknown 35" },
|
|
|
|
{ do_bad, SIGKILL, SI_KERNEL, "unknown 36" },
|
|
|
|
{ do_bad, SIGKILL, SI_KERNEL, "unknown 37" },
|
|
|
|
{ do_bad, SIGKILL, SI_KERNEL, "unknown 38" },
|
|
|
|
{ do_bad, SIGKILL, SI_KERNEL, "unknown 39" },
|
|
|
|
{ do_bad, SIGKILL, SI_KERNEL, "unknown 40" },
|
|
|
|
{ do_bad, SIGKILL, SI_KERNEL, "unknown 41" },
|
|
|
|
{ do_bad, SIGKILL, SI_KERNEL, "unknown 42" },
|
|
|
|
{ do_bad, SIGKILL, SI_KERNEL, "unknown 43" },
|
|
|
|
{ do_bad, SIGKILL, SI_KERNEL, "unknown 44" },
|
|
|
|
{ do_bad, SIGKILL, SI_KERNEL, "unknown 45" },
|
|
|
|
{ do_bad, SIGKILL, SI_KERNEL, "unknown 46" },
|
|
|
|
{ do_bad, SIGKILL, SI_KERNEL, "unknown 47" },
|
|
|
|
{ do_bad, SIGKILL, SI_KERNEL, "TLB conflict abort" },
|
|
|
|
{ do_bad, SIGKILL, SI_KERNEL, "Unsupported atomic hardware update fault" },
|
|
|
|
{ do_bad, SIGKILL, SI_KERNEL, "unknown 50" },
|
|
|
|
{ do_bad, SIGKILL, SI_KERNEL, "unknown 51" },
|
|
|
|
{ do_bad, SIGKILL, SI_KERNEL, "implementation fault (lockdown abort)" },
|
|
|
|
{ do_bad, SIGBUS, BUS_OBJERR, "implementation fault (unsupported exclusive)" },
|
|
|
|
{ do_bad, SIGKILL, SI_KERNEL, "unknown 54" },
|
|
|
|
{ do_bad, SIGKILL, SI_KERNEL, "unknown 55" },
|
|
|
|
{ do_bad, SIGKILL, SI_KERNEL, "unknown 56" },
|
|
|
|
{ do_bad, SIGKILL, SI_KERNEL, "unknown 57" },
|
|
|
|
{ do_bad, SIGKILL, SI_KERNEL, "unknown 58" },
|
|
|
|
{ do_bad, SIGKILL, SI_KERNEL, "unknown 59" },
|
|
|
|
{ do_bad, SIGKILL, SI_KERNEL, "unknown 60" },
|
|
|
|
{ do_bad, SIGKILL, SI_KERNEL, "section domain fault" },
|
|
|
|
{ do_bad, SIGKILL, SI_KERNEL, "page domain fault" },
|
|
|
|
{ do_bad, SIGKILL, SI_KERNEL, "unknown 63" },
|
2012-03-05 19:49:27 +08:00
|
|
|
};
|
|
|
|
|
2017-06-22 02:17:14 +08:00
|
|
|
int handle_guest_sea(phys_addr_t addr, unsigned int esr)
|
|
|
|
{
|
|
|
|
int ret = -ENOENT;
|
|
|
|
|
|
|
|
if (IS_ENABLED(CONFIG_ACPI_APEI_SEA))
|
|
|
|
ret = ghes_notify_sea();
|
|
|
|
|
|
|
|
return ret;
|
|
|
|
}
|
|
|
|
|
2012-03-05 19:49:27 +08:00
|
|
|
asmlinkage void __exception do_mem_abort(unsigned long addr, unsigned int esr,
|
|
|
|
struct pt_regs *regs)
|
|
|
|
{
|
2017-04-04 13:51:01 +08:00
|
|
|
const struct fault_info *inf = esr_to_fault_info(esr);
|
2012-03-05 19:49:27 +08:00
|
|
|
struct siginfo info;
|
|
|
|
|
|
|
|
if (!inf->fn(addr, esr, regs))
|
|
|
|
return;
|
|
|
|
|
2018-02-20 22:41:02 +08:00
|
|
|
if (!user_mode(regs)) {
|
|
|
|
pr_alert("Unhandled fault at 0x%016lx\n", addr);
|
|
|
|
mem_abort_decode(esr);
|
2017-10-31 23:56:11 +08:00
|
|
|
show_pte(addr);
|
2018-02-20 22:41:02 +08:00
|
|
|
}
|
2017-10-19 18:19:55 +08:00
|
|
|
|
2012-03-05 19:49:27 +08:00
|
|
|
info.si_signo = inf->sig;
|
|
|
|
info.si_errno = 0;
|
|
|
|
info.si_code = inf->code;
|
|
|
|
info.si_addr = (void __user *)addr;
|
2018-02-20 22:41:02 +08:00
|
|
|
arm64_notify_die(inf->name, regs, &info, esr);
|
2012-03-05 19:49:27 +08:00
|
|
|
}
|
|
|
|
|
2018-02-03 01:31:40 +08:00
|
|
|
asmlinkage void __exception do_el0_irq_bp_hardening(void)
|
|
|
|
{
|
|
|
|
/* PC has already been checked in entry.S */
|
|
|
|
arm64_apply_bp_hardening();
|
|
|
|
}
|
|
|
|
|
2018-01-03 19:17:58 +08:00
|
|
|
asmlinkage void __exception do_el0_ia_bp_hardening(unsigned long addr,
|
|
|
|
unsigned int esr,
|
|
|
|
struct pt_regs *regs)
|
|
|
|
{
|
|
|
|
/*
|
|
|
|
* We've taken an instruction abort from userspace and not yet
|
|
|
|
* re-enabled IRQs. If the address is a kernel address, apply
|
|
|
|
* BP hardening prior to enabling IRQs and pre-emption.
|
|
|
|
*/
|
|
|
|
if (addr > TASK_SIZE)
|
|
|
|
arm64_apply_bp_hardening();
|
|
|
|
|
|
|
|
local_irq_enable();
|
|
|
|
do_mem_abort(addr, esr, regs);
|
|
|
|
}
|
|
|
|
|
|
|
|
|
2012-03-05 19:49:27 +08:00
|
|
|
asmlinkage void __exception do_sp_pc_abort(unsigned long addr,
|
|
|
|
unsigned int esr,
|
|
|
|
struct pt_regs *regs)
|
|
|
|
{
|
|
|
|
struct siginfo info;
|
2015-06-19 22:28:16 +08:00
|
|
|
|
2018-02-03 01:31:39 +08:00
|
|
|
if (user_mode(regs)) {
|
|
|
|
if (instruction_pointer(regs) > TASK_SIZE)
|
|
|
|
arm64_apply_bp_hardening();
|
|
|
|
local_irq_enable();
|
|
|
|
}
|
|
|
|
|
2012-03-05 19:49:27 +08:00
|
|
|
info.si_signo = SIGBUS;
|
|
|
|
info.si_errno = 0;
|
|
|
|
info.si_code = BUS_ADRALN;
|
|
|
|
info.si_addr = (void __user *)addr;
|
2018-02-20 22:41:02 +08:00
|
|
|
arm64_notify_die("SP/PC alignment exception", regs, &info, esr);
|
2012-03-05 19:49:27 +08:00
|
|
|
}
|
|
|
|
|
2015-07-24 23:37:48 +08:00
|
|
|
int __init early_brk64(unsigned long addr, unsigned int esr,
|
|
|
|
struct pt_regs *regs);
|
|
|
|
|
|
|
|
/*
|
|
|
|
* __refdata because early_brk64 is __init, but the reference to it is
|
|
|
|
* clobbered at arch_initcall time.
|
|
|
|
* See traps.c and debug-monitors.c:debug_traps_init().
|
|
|
|
*/
|
|
|
|
static struct fault_info __refdata debug_fault_info[] = {
|
2012-03-05 19:49:27 +08:00
|
|
|
{ do_bad, SIGTRAP, TRAP_HWBKPT, "hardware breakpoint" },
|
|
|
|
{ do_bad, SIGTRAP, TRAP_HWBKPT, "hardware single-step" },
|
|
|
|
{ do_bad, SIGTRAP, TRAP_HWBKPT, "hardware watchpoint" },
|
arm64: signal: Ensure si_code is valid for all fault signals
Currently, as reported by Eric, an invalid si_code value 0 is
passed in many signals delivered to userspace in response to faults
and other kernel errors. Typically 0 is passed when the fault is
insufficiently diagnosable or when there does not appear to be any
sensible alternative value to choose.
This appears to violate POSIX, and is intuitively wrong for at
least two reasons arising from the fact that 0 == SI_USER:
1) si_code is a union selector, and SI_USER (and si_code <= 0 in
general) implies the existence of a different set of fields
(siginfo._kill) from that which exists for a fault signal
(siginfo._sigfault). However, the code raising the signal
typically writes only the _sigfault fields, and the _kill
fields make no sense in this case.
Thus when userspace sees si_code == 0 (SI_USER) it may
legitimately inspect fields in the inactive union member _kill
and obtain garbage as a result.
There appears to be software in the wild relying on this,
albeit generally only for printing diagnostic messages.
2) Software that wants to be robust against spurious signals may
discard signals where si_code == SI_USER (or <= 0), or may
filter such signals based on the si_uid and si_pid fields of
siginfo._sigkill. In the case of fault signals, this means
that important (and usually fatal) error conditions may be
silently ignored.
In practice, many of the faults for which arm64 passes si_code == 0
are undiagnosable conditions such as exceptions with syndrome
values in ESR_ELx to which the architecture does not yet assign any
meaning, or conditions indicative of a bug or error in the kernel
or system and thus that are unrecoverable and should never occur in
normal operation.
The approach taken in this patch is to translate all such
undiagnosable or "impossible" synchronous fault conditions to
SIGKILL, since these are at least probably localisable to a single
process. Some of these conditions should really result in a kernel
panic, but due to the lack of diagnostic information it is
difficult to be certain: this patch does not add any calls to
panic(), but this could change later if justified.
Although si_code will not reach userspace in the case of SIGKILL,
it is still desirable to pass a nonzero value so that the common
siginfo handling code can detect incorrect use of si_code == 0
without false positives. In this case the si_code dependent
siginfo fields will not be correctly initialised, but since they
are not passed to userspace I deem this not to matter.
A few faults can reasonably occur in realistic userspace scenarios,
and _should_ raise a regular, handleable (but perhaps not
ignorable/blockable) signal: for these, this patch attempts to
choose a suitable standard si_code value for the raised signal in
each case instead of 0.
arm64 was the only arch to define a BUS_FIXME code, so after this
patch nobody defines it. This patch therefore also removes the
relevant code from siginfo_layout().
Cc: James Morse <james.morse@arm.com>
Reported-by: Eric W. Biederman <ebiederm@xmission.com>
Signed-off-by: Dave Martin <Dave.Martin@arm.com>
Signed-off-by: Will Deacon <will.deacon@arm.com>
2018-03-09 01:41:05 +08:00
|
|
|
{ do_bad, SIGKILL, SI_KERNEL, "unknown 3" },
|
2012-03-05 19:49:27 +08:00
|
|
|
{ do_bad, SIGTRAP, TRAP_BRKPT, "aarch32 BKPT" },
|
arm64: signal: Ensure si_code is valid for all fault signals
Currently, as reported by Eric, an invalid si_code value 0 is
passed in many signals delivered to userspace in response to faults
and other kernel errors. Typically 0 is passed when the fault is
insufficiently diagnosable or when there does not appear to be any
sensible alternative value to choose.
This appears to violate POSIX, and is intuitively wrong for at
least two reasons arising from the fact that 0 == SI_USER:
1) si_code is a union selector, and SI_USER (and si_code <= 0 in
general) implies the existence of a different set of fields
(siginfo._kill) from that which exists for a fault signal
(siginfo._sigfault). However, the code raising the signal
typically writes only the _sigfault fields, and the _kill
fields make no sense in this case.
Thus when userspace sees si_code == 0 (SI_USER) it may
legitimately inspect fields in the inactive union member _kill
and obtain garbage as a result.
There appears to be software in the wild relying on this,
albeit generally only for printing diagnostic messages.
2) Software that wants to be robust against spurious signals may
discard signals where si_code == SI_USER (or <= 0), or may
filter such signals based on the si_uid and si_pid fields of
siginfo._sigkill. In the case of fault signals, this means
that important (and usually fatal) error conditions may be
silently ignored.
In practice, many of the faults for which arm64 passes si_code == 0
are undiagnosable conditions such as exceptions with syndrome
values in ESR_ELx to which the architecture does not yet assign any
meaning, or conditions indicative of a bug or error in the kernel
or system and thus that are unrecoverable and should never occur in
normal operation.
The approach taken in this patch is to translate all such
undiagnosable or "impossible" synchronous fault conditions to
SIGKILL, since these are at least probably localisable to a single
process. Some of these conditions should really result in a kernel
panic, but due to the lack of diagnostic information it is
difficult to be certain: this patch does not add any calls to
panic(), but this could change later if justified.
Although si_code will not reach userspace in the case of SIGKILL,
it is still desirable to pass a nonzero value so that the common
siginfo handling code can detect incorrect use of si_code == 0
without false positives. In this case the si_code dependent
siginfo fields will not be correctly initialised, but since they
are not passed to userspace I deem this not to matter.
A few faults can reasonably occur in realistic userspace scenarios,
and _should_ raise a regular, handleable (but perhaps not
ignorable/blockable) signal: for these, this patch attempts to
choose a suitable standard si_code value for the raised signal in
each case instead of 0.
arm64 was the only arch to define a BUS_FIXME code, so after this
patch nobody defines it. This patch therefore also removes the
relevant code from siginfo_layout().
Cc: James Morse <james.morse@arm.com>
Reported-by: Eric W. Biederman <ebiederm@xmission.com>
Signed-off-by: Dave Martin <Dave.Martin@arm.com>
Signed-off-by: Will Deacon <will.deacon@arm.com>
2018-03-09 01:41:05 +08:00
|
|
|
{ do_bad, SIGKILL, SI_KERNEL, "aarch32 vector catch" },
|
2015-07-24 23:37:48 +08:00
|
|
|
{ early_brk64, SIGTRAP, TRAP_BRKPT, "aarch64 BRK" },
|
arm64: signal: Ensure si_code is valid for all fault signals
Currently, as reported by Eric, an invalid si_code value 0 is
passed in many signals delivered to userspace in response to faults
and other kernel errors. Typically 0 is passed when the fault is
insufficiently diagnosable or when there does not appear to be any
sensible alternative value to choose.
This appears to violate POSIX, and is intuitively wrong for at
least two reasons arising from the fact that 0 == SI_USER:
1) si_code is a union selector, and SI_USER (and si_code <= 0 in
general) implies the existence of a different set of fields
(siginfo._kill) from that which exists for a fault signal
(siginfo._sigfault). However, the code raising the signal
typically writes only the _sigfault fields, and the _kill
fields make no sense in this case.
Thus when userspace sees si_code == 0 (SI_USER) it may
legitimately inspect fields in the inactive union member _kill
and obtain garbage as a result.
There appears to be software in the wild relying on this,
albeit generally only for printing diagnostic messages.
2) Software that wants to be robust against spurious signals may
discard signals where si_code == SI_USER (or <= 0), or may
filter such signals based on the si_uid and si_pid fields of
siginfo._sigkill. In the case of fault signals, this means
that important (and usually fatal) error conditions may be
silently ignored.
In practice, many of the faults for which arm64 passes si_code == 0
are undiagnosable conditions such as exceptions with syndrome
values in ESR_ELx to which the architecture does not yet assign any
meaning, or conditions indicative of a bug or error in the kernel
or system and thus that are unrecoverable and should never occur in
normal operation.
The approach taken in this patch is to translate all such
undiagnosable or "impossible" synchronous fault conditions to
SIGKILL, since these are at least probably localisable to a single
process. Some of these conditions should really result in a kernel
panic, but due to the lack of diagnostic information it is
difficult to be certain: this patch does not add any calls to
panic(), but this could change later if justified.
Although si_code will not reach userspace in the case of SIGKILL,
it is still desirable to pass a nonzero value so that the common
siginfo handling code can detect incorrect use of si_code == 0
without false positives. In this case the si_code dependent
siginfo fields will not be correctly initialised, but since they
are not passed to userspace I deem this not to matter.
A few faults can reasonably occur in realistic userspace scenarios,
and _should_ raise a regular, handleable (but perhaps not
ignorable/blockable) signal: for these, this patch attempts to
choose a suitable standard si_code value for the raised signal in
each case instead of 0.
arm64 was the only arch to define a BUS_FIXME code, so after this
patch nobody defines it. This patch therefore also removes the
relevant code from siginfo_layout().
Cc: James Morse <james.morse@arm.com>
Reported-by: Eric W. Biederman <ebiederm@xmission.com>
Signed-off-by: Dave Martin <Dave.Martin@arm.com>
Signed-off-by: Will Deacon <will.deacon@arm.com>
2018-03-09 01:41:05 +08:00
|
|
|
{ do_bad, SIGKILL, SI_KERNEL, "unknown 7" },
|
2012-03-05 19:49:27 +08:00
|
|
|
};
|
|
|
|
|
|
|
|
void __init hook_debug_fault_code(int nr,
|
|
|
|
int (*fn)(unsigned long, unsigned int, struct pt_regs *),
|
|
|
|
int sig, int code, const char *name)
|
|
|
|
{
|
|
|
|
BUG_ON(nr < 0 || nr >= ARRAY_SIZE(debug_fault_info));
|
|
|
|
|
|
|
|
debug_fault_info[nr].fn = fn;
|
|
|
|
debug_fault_info[nr].sig = sig;
|
|
|
|
debug_fault_info[nr].code = code;
|
|
|
|
debug_fault_info[nr].name = name;
|
|
|
|
}
|
|
|
|
|
|
|
|
asmlinkage int __exception do_debug_exception(unsigned long addr,
|
|
|
|
unsigned int esr,
|
|
|
|
struct pt_regs *regs)
|
|
|
|
{
|
|
|
|
const struct fault_info *inf = debug_fault_info + DBG_ESR_EVT(esr);
|
|
|
|
struct siginfo info;
|
2016-04-13 20:40:00 +08:00
|
|
|
int rv;
|
2012-03-05 19:49:27 +08:00
|
|
|
|
2016-04-13 20:40:00 +08:00
|
|
|
/*
|
|
|
|
* Tell lockdep we disabled irqs in entry.S. Do nothing if they were
|
|
|
|
* already disabled to preserve the last enabled/disabled addresses.
|
|
|
|
*/
|
|
|
|
if (interrupts_enabled(regs))
|
|
|
|
trace_hardirqs_off();
|
2012-03-05 19:49:27 +08:00
|
|
|
|
2018-02-03 01:31:39 +08:00
|
|
|
if (user_mode(regs) && instruction_pointer(regs) > TASK_SIZE)
|
|
|
|
arm64_apply_bp_hardening();
|
|
|
|
|
2016-04-13 20:40:00 +08:00
|
|
|
if (!inf->fn(addr, esr, regs)) {
|
|
|
|
rv = 1;
|
|
|
|
} else {
|
|
|
|
info.si_signo = inf->sig;
|
|
|
|
info.si_errno = 0;
|
|
|
|
info.si_code = inf->code;
|
|
|
|
info.si_addr = (void __user *)addr;
|
2018-02-20 22:41:02 +08:00
|
|
|
arm64_notify_die(inf->name, regs, &info, esr);
|
2016-04-13 20:40:00 +08:00
|
|
|
rv = 0;
|
|
|
|
}
|
2012-03-05 19:49:27 +08:00
|
|
|
|
2016-04-13 20:40:00 +08:00
|
|
|
if (interrupts_enabled(regs))
|
|
|
|
trace_hardirqs_on();
|
2012-03-05 19:49:27 +08:00
|
|
|
|
2016-04-13 20:40:00 +08:00
|
|
|
return rv;
|
2012-03-05 19:49:27 +08:00
|
|
|
}
|
arm64: Kprobes with single stepping support
Add support for basic kernel probes(kprobes) and jump probes
(jprobes) for ARM64.
Kprobes utilizes software breakpoint and single step debug
exceptions supported on ARM v8.
A software breakpoint is placed at the probe address to trap the
kernel execution into the kprobe handler.
ARM v8 supports enabling single stepping before the break exception
return (ERET), with next PC in exception return address (ELR_EL1). The
kprobe handler prepares an executable memory slot for out-of-line
execution with a copy of the original instruction being probed, and
enables single stepping. The PC is set to the out-of-line slot address
before the ERET. With this scheme, the instruction is executed with the
exact same register context except for the PC (and DAIF) registers.
Debug mask (PSTATE.D) is enabled only when single stepping a recursive
kprobe, e.g.: during kprobes reenter so that probed instruction can be
single stepped within the kprobe handler -exception- context.
The recursion depth of kprobe is always 2, i.e. upon probe re-entry,
any further re-entry is prevented by not calling handlers and the case
counted as a missed kprobe).
Single stepping from the x-o-l slot has a drawback for PC-relative accesses
like branching and symbolic literals access as the offset from the new PC
(slot address) may not be ensured to fit in the immediate value of
the opcode. Such instructions need simulation, so reject
probing them.
Instructions generating exceptions or cpu mode change are rejected
for probing.
Exclusive load/store instructions are rejected too. Additionally, the
code is checked to see if it is inside an exclusive load/store sequence
(code from Pratyush).
System instructions are mostly enabled for stepping, except MSR/MRS
accesses to "DAIF" flags in PSTATE, which are not safe for
probing.
This also changes arch/arm64/include/asm/ptrace.h to use
include/asm-generic/ptrace.h.
Thanks to Steve Capper and Pratyush Anand for several suggested
Changes.
Signed-off-by: Sandeepa Prabhu <sandeepa.s.prabhu@gmail.com>
Signed-off-by: David A. Long <dave.long@linaro.org>
Signed-off-by: Pratyush Anand <panand@redhat.com>
Acked-by: Masami Hiramatsu <mhiramat@kernel.org>
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
2016-07-09 00:35:48 +08:00
|
|
|
NOKPROBE_SYMBOL(do_debug_exception);
|
2015-07-23 02:05:54 +08:00
|
|
|
|
|
|
|
#ifdef CONFIG_ARM64_PAN
|
2016-10-18 18:27:46 +08:00
|
|
|
int cpu_enable_pan(void *__unused)
|
2015-07-23 02:05:54 +08:00
|
|
|
{
|
2016-10-18 18:27:47 +08:00
|
|
|
/*
|
|
|
|
* We modify PSTATE. This won't work from irq context as the PSTATE
|
|
|
|
* is discarded once we return from the exception.
|
|
|
|
*/
|
|
|
|
WARN_ON_ONCE(in_interrupt());
|
|
|
|
|
2015-07-23 02:05:54 +08:00
|
|
|
config_sctlr_el1(SCTLR_EL1_SPAN, 0);
|
2016-10-18 18:27:47 +08:00
|
|
|
asm(SET_PSTATE_PAN(1));
|
2016-10-18 18:27:46 +08:00
|
|
|
return 0;
|
2015-07-23 02:05:54 +08:00
|
|
|
}
|
|
|
|
#endif /* CONFIG_ARM64_PAN */
|