1 // SPDX-License-Identifier: GPL-2.0-only
2 #include <linux/extable.h>
3 #include <linux/uaccess.h>
4 #include <linux/sched/debug.h>
5 #include <xen/xen.h>
6
7 #include <asm/fpu/api.h>
8 #include <asm/sev.h>
9 #include <asm/traps.h>
10 #include <asm/kdebug.h>
11
12 static inline unsigned long
ex_fixup_addr(const struct exception_table_entry * x)13 ex_fixup_addr(const struct exception_table_entry *x)
14 {
15 return (unsigned long)&x->fixup + x->fixup;
16 }
17
ex_handler_default(const struct exception_table_entry * fixup,struct pt_regs * regs)18 static bool ex_handler_default(const struct exception_table_entry *fixup,
19 struct pt_regs *regs)
20 {
21 regs->ip = ex_fixup_addr(fixup);
22 return true;
23 }
24
ex_handler_fault(const struct exception_table_entry * fixup,struct pt_regs * regs,int trapnr)25 static bool ex_handler_fault(const struct exception_table_entry *fixup,
26 struct pt_regs *regs, int trapnr)
27 {
28 regs->ax = trapnr;
29 return ex_handler_default(fixup, regs);
30 }
31
32 /*
33 * Handler for when we fail to restore a task's FPU state. We should never get
34 * here because the FPU state of a task using the FPU (task->thread.fpu.state)
35 * should always be valid. However, past bugs have allowed userspace to set
36 * reserved bits in the XSAVE area using PTRACE_SETREGSET or sys_rt_sigreturn().
37 * These caused XRSTOR to fail when switching to the task, leaking the FPU
38 * registers of the task previously executing on the CPU. Mitigate this class
39 * of vulnerability by restoring from the initial state (essentially, zeroing
40 * out all the FPU registers) if we can't restore from the task's FPU state.
41 */
ex_handler_fprestore(const struct exception_table_entry * fixup,struct pt_regs * regs)42 static bool ex_handler_fprestore(const struct exception_table_entry *fixup,
43 struct pt_regs *regs)
44 {
45 regs->ip = ex_fixup_addr(fixup);
46
47 WARN_ONCE(1, "Bad FPU state detected at %pB, reinitializing FPU registers.",
48 (void *)instruction_pointer(regs));
49
50 fpu_reset_from_exception_fixup();
51 return true;
52 }
53
ex_handler_uaccess(const struct exception_table_entry * fixup,struct pt_regs * regs,int trapnr)54 static bool ex_handler_uaccess(const struct exception_table_entry *fixup,
55 struct pt_regs *regs, int trapnr)
56 {
57 WARN_ONCE(trapnr == X86_TRAP_GP, "General protection fault in user access. Non-canonical address?");
58 return ex_handler_default(fixup, regs);
59 }
60
ex_handler_copy(const struct exception_table_entry * fixup,struct pt_regs * regs,int trapnr)61 static bool ex_handler_copy(const struct exception_table_entry *fixup,
62 struct pt_regs *regs, int trapnr)
63 {
64 WARN_ONCE(trapnr == X86_TRAP_GP, "General protection fault in user access. Non-canonical address?");
65 return ex_handler_fault(fixup, regs, trapnr);
66 }
67
ex_handler_rdmsr_unsafe(const struct exception_table_entry * fixup,struct pt_regs * regs)68 static bool ex_handler_rdmsr_unsafe(const struct exception_table_entry *fixup,
69 struct pt_regs *regs)
70 {
71 if (pr_warn_once("unchecked MSR access error: RDMSR from 0x%x at rIP: 0x%lx (%pS)\n",
72 (unsigned int)regs->cx, regs->ip, (void *)regs->ip))
73 show_stack_regs(regs);
74
75 /* Pretend that the read succeeded and returned 0. */
76 regs->ax = 0;
77 regs->dx = 0;
78 return ex_handler_default(fixup, regs);
79 }
80
ex_handler_wrmsr_unsafe(const struct exception_table_entry * fixup,struct pt_regs * regs)81 static bool ex_handler_wrmsr_unsafe(const struct exception_table_entry *fixup,
82 struct pt_regs *regs)
83 {
84 if (pr_warn_once("unchecked MSR access error: WRMSR to 0x%x (tried to write 0x%08x%08x) at rIP: 0x%lx (%pS)\n",
85 (unsigned int)regs->cx, (unsigned int)regs->dx,
86 (unsigned int)regs->ax, regs->ip, (void *)regs->ip))
87 show_stack_regs(regs);
88
89 /* Pretend that the write succeeded. */
90 return ex_handler_default(fixup, regs);
91 }
92
ex_handler_clear_fs(const struct exception_table_entry * fixup,struct pt_regs * regs)93 static bool ex_handler_clear_fs(const struct exception_table_entry *fixup,
94 struct pt_regs *regs)
95 {
96 if (static_cpu_has(X86_BUG_NULL_SEG))
97 asm volatile ("mov %0, %%fs" : : "rm" (__USER_DS));
98 asm volatile ("mov %0, %%fs" : : "rm" (0));
99 return ex_handler_default(fixup, regs);
100 }
101
ex_get_fixup_type(unsigned long ip)102 int ex_get_fixup_type(unsigned long ip)
103 {
104 const struct exception_table_entry *e = search_exception_tables(ip);
105
106 return e ? e->type : EX_TYPE_NONE;
107 }
108
fixup_exception(struct pt_regs * regs,int trapnr,unsigned long error_code,unsigned long fault_addr)109 int fixup_exception(struct pt_regs *regs, int trapnr, unsigned long error_code,
110 unsigned long fault_addr)
111 {
112 const struct exception_table_entry *e;
113
114 #ifdef CONFIG_PNPBIOS
115 if (unlikely(SEGMENT_IS_PNP_CODE(regs->cs))) {
116 extern u32 pnp_bios_fault_eip, pnp_bios_fault_esp;
117 extern u32 pnp_bios_is_utter_crap;
118 pnp_bios_is_utter_crap = 1;
119 printk(KERN_CRIT "PNPBIOS fault.. attempting recovery.\n");
120 __asm__ volatile(
121 "movl %0, %%esp\n\t"
122 "jmp *%1\n\t"
123 : : "g" (pnp_bios_fault_esp), "g" (pnp_bios_fault_eip));
124 panic("do_trap: can't hit this");
125 }
126 #endif
127
128 e = search_exception_tables(regs->ip);
129 if (!e)
130 return 0;
131
132 switch (e->type) {
133 case EX_TYPE_DEFAULT:
134 case EX_TYPE_DEFAULT_MCE_SAFE:
135 return ex_handler_default(e, regs);
136 case EX_TYPE_FAULT:
137 case EX_TYPE_FAULT_MCE_SAFE:
138 return ex_handler_fault(e, regs, trapnr);
139 case EX_TYPE_UACCESS:
140 return ex_handler_uaccess(e, regs, trapnr);
141 case EX_TYPE_COPY:
142 return ex_handler_copy(e, regs, trapnr);
143 case EX_TYPE_CLEAR_FS:
144 return ex_handler_clear_fs(e, regs);
145 case EX_TYPE_FPU_RESTORE:
146 return ex_handler_fprestore(e, regs);
147 case EX_TYPE_RDMSR:
148 return ex_handler_rdmsr_unsafe(e, regs);
149 case EX_TYPE_WRMSR:
150 return ex_handler_wrmsr_unsafe(e, regs);
151 case EX_TYPE_BPF:
152 return ex_handler_bpf(e, regs);
153 case EX_TYPE_RDMSR_IN_MCE:
154 ex_handler_msr_mce(regs, false);
155 break;
156 case EX_TYPE_WRMSR_IN_MCE:
157 ex_handler_msr_mce(regs, true);
158 break;
159 }
160 BUG();
161 }
162
163 extern unsigned int early_recursion_flag;
164
165 /* Restricted version used during very early boot */
early_fixup_exception(struct pt_regs * regs,int trapnr)166 void __init early_fixup_exception(struct pt_regs *regs, int trapnr)
167 {
168 /* Ignore early NMIs. */
169 if (trapnr == X86_TRAP_NMI)
170 return;
171
172 if (early_recursion_flag > 2)
173 goto halt_loop;
174
175 /*
176 * Old CPUs leave the high bits of CS on the stack
177 * undefined. I'm not sure which CPUs do this, but at least
178 * the 486 DX works this way.
179 * Xen pv domains are not using the default __KERNEL_CS.
180 */
181 if (!xen_pv_domain() && regs->cs != __KERNEL_CS)
182 goto fail;
183
184 /*
185 * The full exception fixup machinery is available as soon as
186 * the early IDT is loaded. This means that it is the
187 * responsibility of extable users to either function correctly
188 * when handlers are invoked early or to simply avoid causing
189 * exceptions before they're ready to handle them.
190 *
191 * This is better than filtering which handlers can be used,
192 * because refusing to call a handler here is guaranteed to
193 * result in a hard-to-debug panic.
194 *
195 * Keep in mind that not all vectors actually get here. Early
196 * page faults, for example, are special.
197 */
198 if (fixup_exception(regs, trapnr, regs->orig_ax, 0))
199 return;
200
201 if (trapnr == X86_TRAP_UD) {
202 if (report_bug(regs->ip, regs) == BUG_TRAP_TYPE_WARN) {
203 /* Skip the ud2. */
204 regs->ip += LEN_UD2;
205 return;
206 }
207
208 /*
209 * If this was a BUG and report_bug returns or if this
210 * was just a normal #UD, we want to continue onward and
211 * crash.
212 */
213 }
214
215 fail:
216 early_printk("PANIC: early exception 0x%02x IP %lx:%lx error %lx cr2 0x%lx\n",
217 (unsigned)trapnr, (unsigned long)regs->cs, regs->ip,
218 regs->orig_ax, read_cr2());
219
220 show_regs(regs);
221
222 halt_loop:
223 while (true)
224 halt();
225 }
226