1 // SPDX-License-Identifier: GPL-2.0
2 /*
3 * S390 version
4 * Copyright IBM Corp. 1999, 2000
5 * Author(s): Martin Schwidefsky (schwidefsky@de.ibm.com),
6 * Denis Joseph Barrow (djbarrow@de.ibm.com,barrow_dj@yahoo.com),
7 *
8 * Derived from "arch/i386/kernel/traps.c"
9 * Copyright (C) 1991, 1992 Linus Torvalds
10 */
11
12 #include <linux/cpufeature.h>
13 #include <linux/kprobes.h>
14 #include <linux/kdebug.h>
15 #include <linux/randomize_kstack.h>
16 #include <linux/extable.h>
17 #include <linux/ptrace.h>
18 #include <linux/sched.h>
19 #include <linux/sched/debug.h>
20 #include <linux/mm.h>
21 #include <linux/slab.h>
22 #include <linux/uaccess.h>
23 #include <linux/cpu.h>
24 #include <linux/entry-common.h>
25 #include <linux/kmsan.h>
26 #include <linux/bug.h>
27 #include <asm/asm-extable.h>
28 #include <asm/irqflags.h>
29 #include <asm/ptrace.h>
30 #include <asm/vtime.h>
31 #include <asm/fpu.h>
32 #include <asm/fault.h>
33 #include "entry.h"
34
get_trap_ip(struct pt_regs * regs)35 static inline void __user *get_trap_ip(struct pt_regs *regs)
36 {
37 unsigned long address;
38
39 if (regs->int_code & 0x200)
40 address = current->thread.trap_tdb.data[3];
41 else
42 address = regs->psw.addr;
43 return (void __user *)(address - (regs->int_code >> 16));
44 }
45
46 #ifdef CONFIG_GENERIC_BUG
is_valid_bugaddr(unsigned long addr)47 int is_valid_bugaddr(unsigned long addr)
48 {
49 return 1;
50 }
51 #endif
52
do_report_trap(struct pt_regs * regs,int si_signo,int si_code,char * str)53 void do_report_trap(struct pt_regs *regs, int si_signo, int si_code, char *str)
54 {
55 if (user_mode(regs)) {
56 force_sig_fault(si_signo, si_code, get_trap_ip(regs));
57 report_user_fault(regs, si_signo, 0);
58 } else {
59 if (!fixup_exception(regs))
60 die(regs, str);
61 }
62 }
63
do_trap(struct pt_regs * regs,int si_signo,int si_code,char * str)64 static void do_trap(struct pt_regs *regs, int si_signo, int si_code, char *str)
65 {
66 if (notify_die(DIE_TRAP, str, regs, 0, regs->int_code, si_signo) == NOTIFY_STOP)
67 return;
68 do_report_trap(regs, si_signo, si_code, str);
69 }
70 NOKPROBE_SYMBOL(do_trap);
71
do_per_trap(struct pt_regs * regs)72 void do_per_trap(struct pt_regs *regs)
73 {
74 if (notify_die(DIE_SSTEP, "sstep", regs, 0, 0, SIGTRAP) == NOTIFY_STOP)
75 return;
76 if (!current->ptrace)
77 return;
78 force_sig_fault(SIGTRAP, TRAP_HWBKPT, (void __force __user *)current->thread.per_event.address);
79 }
80 NOKPROBE_SYMBOL(do_per_trap);
81
default_trap_handler(struct pt_regs * regs)82 static void default_trap_handler(struct pt_regs *regs)
83 {
84 if (user_mode(regs)) {
85 report_user_fault(regs, SIGSEGV, 0);
86 force_exit_sig(SIGSEGV);
87 } else
88 die(regs, "Unknown program exception");
89 }
90
91 #define DO_ERROR_INFO(name, signr, sicode, str) \
92 static void name(struct pt_regs *regs) \
93 { \
94 do_trap(regs, signr, sicode, str); \
95 }
96
97 DO_ERROR_INFO(addressing_exception, SIGILL, ILL_ILLADR, "addressing exception")
98 DO_ERROR_INFO(divide_exception, SIGFPE, FPE_INTDIV, "fixpoint divide exception")
99 DO_ERROR_INFO(execute_exception, SIGILL, ILL_ILLOPN, "execute exception")
100 DO_ERROR_INFO(hfp_divide_exception, SIGFPE, FPE_FLTDIV, "HFP divide exception")
101 DO_ERROR_INFO(hfp_overflow_exception, SIGFPE, FPE_FLTOVF, "HFP overflow exception")
102 DO_ERROR_INFO(hfp_significance_exception, SIGFPE, FPE_FLTRES, "HFP significance exception")
103 DO_ERROR_INFO(hfp_sqrt_exception, SIGFPE, FPE_FLTINV, "HFP square root exception")
104 DO_ERROR_INFO(hfp_underflow_exception, SIGFPE, FPE_FLTUND, "HFP underflow exception")
105 DO_ERROR_INFO(operand_exception, SIGILL, ILL_ILLOPN, "operand exception")
106 DO_ERROR_INFO(overflow_exception, SIGFPE, FPE_INTOVF, "fixpoint overflow exception")
107 DO_ERROR_INFO(privileged_op, SIGILL, ILL_PRVOPC, "privileged operation")
108 DO_ERROR_INFO(special_op_exception, SIGILL, ILL_ILLOPN, "special operation exception")
109 DO_ERROR_INFO(specification_exception, SIGILL, ILL_ILLOPN, "specification exception");
110 DO_ERROR_INFO(transaction_exception, SIGILL, ILL_ILLOPN, "transaction constraint exception")
111
do_fp_trap(struct pt_regs * regs,__u32 fpc)112 static inline void do_fp_trap(struct pt_regs *regs, __u32 fpc)
113 {
114 int si_code = 0;
115
116 /* FPC[2] is Data Exception Code */
117 if ((fpc & 0x00000300) == 0) {
118 /* bits 6 and 7 of DXC are 0 iff IEEE exception */
119 if (fpc & 0x8000) /* invalid fp operation */
120 si_code = FPE_FLTINV;
121 else if (fpc & 0x4000) /* div by 0 */
122 si_code = FPE_FLTDIV;
123 else if (fpc & 0x2000) /* overflow */
124 si_code = FPE_FLTOVF;
125 else if (fpc & 0x1000) /* underflow */
126 si_code = FPE_FLTUND;
127 else if (fpc & 0x0800) /* inexact */
128 si_code = FPE_FLTRES;
129 }
130 do_trap(regs, SIGFPE, si_code, "floating point exception");
131 }
132
translation_specification_exception(struct pt_regs * regs)133 static void translation_specification_exception(struct pt_regs *regs)
134 {
135 /* May never happen. */
136 panic("Translation-Specification Exception");
137 }
138
illegal_op(struct pt_regs * regs)139 static void illegal_op(struct pt_regs *regs)
140 {
141 int is_uprobe_insn = 0;
142 u16 __user *location;
143 int signal = 0;
144 u16 opcode;
145
146 location = get_trap_ip(regs);
147 if (user_mode(regs)) {
148 if (get_user(opcode, location))
149 return;
150 if (opcode == S390_BREAKPOINT_U16) {
151 if (current->ptrace)
152 force_sig_fault(SIGTRAP, TRAP_BRKPT, location);
153 else
154 signal = SIGILL;
155 #ifdef CONFIG_UPROBES
156 } else if (opcode == UPROBE_SWBP_INSN) {
157 is_uprobe_insn = 1;
158 #endif
159 } else {
160 signal = SIGILL;
161 }
162 }
163 /*
164 * This is either an illegal op in kernel mode, or user space trapped
165 * on a uprobes illegal instruction. See if kprobes or uprobes picks
166 * it up. If not, SIGILL.
167 */
168 if (is_uprobe_insn || !user_mode(regs)) {
169 if (notify_die(DIE_BPT, "bpt", regs, 0, 3, SIGTRAP) != NOTIFY_STOP)
170 signal = SIGILL;
171 }
172 if (signal)
173 do_trap(regs, signal, ILL_ILLOPC, "illegal operation");
174 }
175 NOKPROBE_SYMBOL(illegal_op);
176
vector_exception(struct pt_regs * regs)177 static void vector_exception(struct pt_regs *regs)
178 {
179 int si_code, vic;
180
181 /* get vector interrupt code from fpc */
182 save_user_fpu_regs();
183 vic = (current->thread.ufpu.fpc & 0xf00) >> 8;
184 switch (vic) {
185 case 1: /* invalid vector operation */
186 si_code = FPE_FLTINV;
187 break;
188 case 2: /* division by zero */
189 si_code = FPE_FLTDIV;
190 break;
191 case 3: /* overflow */
192 si_code = FPE_FLTOVF;
193 break;
194 case 4: /* underflow */
195 si_code = FPE_FLTUND;
196 break;
197 case 5: /* inexact */
198 si_code = FPE_FLTRES;
199 break;
200 default: /* unknown cause */
201 si_code = 0;
202 }
203 do_trap(regs, SIGFPE, si_code, "vector exception");
204 }
205
data_exception(struct pt_regs * regs)206 static void data_exception(struct pt_regs *regs)
207 {
208 save_user_fpu_regs();
209 if (current->thread.ufpu.fpc & FPC_DXC_MASK)
210 do_fp_trap(regs, current->thread.ufpu.fpc);
211 else
212 do_trap(regs, SIGILL, ILL_ILLOPN, "data exception");
213 }
214
space_switch_exception(struct pt_regs * regs)215 static void space_switch_exception(struct pt_regs *regs)
216 {
217 /* Set user psw back to home space mode. */
218 if (user_mode(regs))
219 regs->psw.mask |= PSW_ASC_HOME;
220 /* Send SIGILL. */
221 do_trap(regs, SIGILL, ILL_PRVOPC, "space switch event");
222 }
223
224 #if defined(CONFIG_BUG) && defined(CONFIG_CC_HAS_ASM_IMMEDIATE_STRINGS)
225
__warn_args(struct arch_va_list * args,struct pt_regs * regs)226 void *__warn_args(struct arch_va_list *args, struct pt_regs *regs)
227 {
228 struct stack_frame *stack_frame;
229
230 /*
231 * Generate va_list from pt_regs. See ELF Application Binary Interface
232 * s390x Supplement documentation for details.
233 *
234 * - __overflow_arg_area needs to point to the parameter area, which
235 * is right above the standard stack frame (160 bytes)
236 *
237 * - __reg_save_area needs to point to a register save area where
238 * general registers (%r2 - %r6) can be found at offset 16. Which
239 * means that the gprs save area of pt_regs can be used
240 *
241 * - __gpr must be set to one, since the first parameter has been
242 * processed (pointer to bug_entry)
243 */
244 stack_frame = (struct stack_frame *)regs->gprs[15];
245 args->__overflow_arg_area = stack_frame + 1;
246 args->__reg_save_area = regs->gprs;
247 args->__gpr = 1;
248 return args;
249 }
250
251 #endif /* CONFIG_BUG && CONFIG_CC_HAS_ASM_IMMEDIATE_STRINGS */
252
monitor_event_exception(struct pt_regs * regs)253 static void monitor_event_exception(struct pt_regs *regs)
254 {
255 enum bug_trap_type btt;
256
257 if (user_mode(regs))
258 return;
259 if (regs->monitor_code == MONCODE_BUG_ARG) {
260 regs->psw.addr = regs->gprs[14];
261 btt = report_bug_entry((struct bug_entry *)regs->gprs[2], regs);
262 } else {
263 btt = report_bug(regs->psw.addr - (regs->int_code >> 16), regs);
264 }
265 switch (btt) {
266 case BUG_TRAP_TYPE_NONE:
267 fixup_exception(regs);
268 break;
269 case BUG_TRAP_TYPE_WARN:
270 break;
271 case BUG_TRAP_TYPE_BUG:
272 die(regs, "monitor event");
273 break;
274 }
275 }
276
kernel_stack_invalid(struct pt_regs * regs)277 void kernel_stack_invalid(struct pt_regs *regs)
278 {
279 /*
280 * Normally regs are unpoisoned by the generic entry code, but
281 * kernel_stack_overflow() is a rare case that is called bypassing it.
282 */
283 kmsan_unpoison_entry_regs(regs);
284 bust_spinlocks(1);
285 pr_emerg("Kernel stack pointer invalid\n");
286 show_regs(regs);
287 bust_spinlocks(0);
288 panic("Invalid kernel stack pointer, cannot continue");
289 }
290 NOKPROBE_SYMBOL(kernel_stack_invalid);
291
test_monitor_call(void)292 static void __init test_monitor_call(void)
293 {
294 int val = 1;
295
296 if (!IS_ENABLED(CONFIG_BUG))
297 return;
298 asm_inline volatile(
299 " mc %[monc](%%r0),0\n"
300 "0: lhi %[val],0\n"
301 "1:\n"
302 EX_TABLE(0b, 1b)
303 : [val] "+d" (val)
304 : [monc] "i" (MONCODE_BUG));
305 if (!val)
306 panic("Monitor call doesn't work!\n");
307 }
308
trap_init(void)309 void __init trap_init(void)
310 {
311 struct lowcore *lc = get_lowcore();
312 unsigned long flags;
313 struct ctlreg cr0;
314
315 local_irq_save(flags);
316 cr0 = local_ctl_clear_bit(0, CR0_LOW_ADDRESS_PROTECTION_BIT);
317 psw_bits(lc->external_new_psw).mcheck = 1;
318 psw_bits(lc->program_new_psw).mcheck = 1;
319 psw_bits(lc->svc_new_psw).mcheck = 1;
320 psw_bits(lc->io_new_psw).mcheck = 1;
321 local_ctl_load(0, &cr0);
322 local_irq_restore(flags);
323 local_mcck_enable();
324 test_monitor_call();
325 }
326
327 static void (*pgm_check_table[128])(struct pt_regs *regs);
328
__do_pgm_check(struct pt_regs * regs)329 void noinstr __do_pgm_check(struct pt_regs *regs)
330 {
331 struct lowcore *lc = get_lowcore();
332 irqentry_state_t state;
333 unsigned int trapnr;
334 union teid teid;
335
336 teid.val = lc->trans_exc_code;
337 regs->int_code = lc->pgm_int_code;
338 regs->int_parm_long = teid.val;
339 regs->monitor_code = lc->monitor_code;
340 /*
341 * In case of a guest fault, short-circuit the fault handler and return.
342 * This way the sie64a() function will return 0; fault address and
343 * other relevant bits are saved in current->thread.gmap_teid, and
344 * the fault number in current->thread.gmap_int_code. KVM will be
345 * able to use this information to handle the fault.
346 */
347 if (test_pt_regs_flag(regs, PIF_GUEST_FAULT)) {
348 current->thread.gmap_teid.val = regs->int_parm_long;
349 current->thread.gmap_int_code = regs->int_code & 0xffff;
350 return;
351 }
352 state = irqentry_enter(regs);
353 if (user_mode(regs)) {
354 update_timer_sys();
355 if (!cpu_has_bear()) {
356 if (regs->last_break < 4096)
357 regs->last_break = 1;
358 }
359 current->thread.last_break = regs->last_break;
360 }
361 if (lc->pgm_code & 0x0200) {
362 /* transaction abort */
363 current->thread.trap_tdb = lc->pgm_tdb;
364 }
365 if (lc->pgm_code & PGM_INT_CODE_PER) {
366 if (user_mode(regs)) {
367 struct per_event *ev = ¤t->thread.per_event;
368
369 set_thread_flag(TIF_PER_TRAP);
370 ev->address = lc->per_address;
371 ev->cause = lc->per_code_combined;
372 ev->paid = lc->per_access_id;
373 } else {
374 /* PER event in kernel is kprobes */
375 __arch_local_irq_ssm(regs->psw.mask & ~PSW_MASK_PER);
376 do_per_trap(regs);
377 goto out;
378 }
379 }
380 if (!irqs_disabled_flags(regs->psw.mask))
381 trace_hardirqs_on();
382 __arch_local_irq_ssm(regs->psw.mask & ~PSW_MASK_PER);
383 trapnr = regs->int_code & PGM_INT_CODE_MASK;
384 if (trapnr)
385 pgm_check_table[trapnr](regs);
386 out:
387 local_irq_disable();
388 irqentry_exit(regs, state);
389 }
390
391 /*
392 * The program check table contains exactly 128 (0x00-0x7f) entries. Each
393 * line defines the function to be called corresponding to the program check
394 * interruption code.
395 */
396 static void (*pgm_check_table[128])(struct pt_regs *regs) = {
397 [0x00] = default_trap_handler,
398 [0x01] = illegal_op,
399 [0x02] = privileged_op,
400 [0x03] = execute_exception,
401 [0x04] = do_protection_exception,
402 [0x05] = addressing_exception,
403 [0x06] = specification_exception,
404 [0x07] = data_exception,
405 [0x08] = overflow_exception,
406 [0x09] = divide_exception,
407 [0x0a] = overflow_exception,
408 [0x0b] = divide_exception,
409 [0x0c] = hfp_overflow_exception,
410 [0x0d] = hfp_underflow_exception,
411 [0x0e] = hfp_significance_exception,
412 [0x0f] = hfp_divide_exception,
413 [0x10] = do_dat_exception,
414 [0x11] = do_dat_exception,
415 [0x12] = translation_specification_exception,
416 [0x13] = special_op_exception,
417 [0x14] = default_trap_handler,
418 [0x15] = operand_exception,
419 [0x16] = default_trap_handler,
420 [0x17] = default_trap_handler,
421 [0x18] = transaction_exception,
422 [0x19] = default_trap_handler,
423 [0x1a] = default_trap_handler,
424 [0x1b] = vector_exception,
425 [0x1c] = space_switch_exception,
426 [0x1d] = hfp_sqrt_exception,
427 [0x1e ... 0x37] = default_trap_handler,
428 [0x38] = do_dat_exception,
429 [0x39] = do_dat_exception,
430 [0x3a] = do_dat_exception,
431 [0x3b] = do_dat_exception,
432 [0x3c] = default_trap_handler,
433 [0x3d] = do_secure_storage_access,
434 [0x3e] = default_trap_handler,
435 [0x3f] = default_trap_handler,
436 [0x40] = monitor_event_exception,
437 [0x41 ... 0x7f] = default_trap_handler,
438 };
439
440 #define COND_TRAP(x) asm( \
441 ".weak " __stringify(x) "\n\t" \
442 ".set " __stringify(x) "," \
443 __stringify(default_trap_handler))
444
445 COND_TRAP(do_secure_storage_access);
446