1 /* 2 * Based on arch/arm/kernel/traps.c 3 * 4 * Copyright (C) 1995-2009 Russell King 5 * Copyright (C) 2012 ARM Ltd. 6 * 7 * This program is free software; you can redistribute it and/or modify 8 * it under the terms of the GNU General Public License version 2 as 9 * published by the Free Software Foundation. 10 * 11 * This program is distributed in the hope that it will be useful, 12 * but WITHOUT ANY WARRANTY; without even the implied warranty of 13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 14 * GNU General Public License for more details. 15 * 16 * You should have received a copy of the GNU General Public License 17 * along with this program. If not, see <http://www.gnu.org/licenses/>. 18 */ 19 20 #include <linux/bug.h> 21 #include <linux/signal.h> 22 #include <linux/personality.h> 23 #include <linux/kallsyms.h> 24 #include <linux/spinlock.h> 25 #include <linux/uaccess.h> 26 #include <linux/hardirq.h> 27 #include <linux/kdebug.h> 28 #include <linux/module.h> 29 #include <linux/kexec.h> 30 #include <linux/delay.h> 31 #include <linux/init.h> 32 #include <linux/sched.h> 33 #include <linux/syscalls.h> 34 35 #include <asm/atomic.h> 36 #include <asm/bug.h> 37 #include <asm/debug-monitors.h> 38 #include <asm/esr.h> 39 #include <asm/insn.h> 40 #include <asm/traps.h> 41 #include <asm/stacktrace.h> 42 #include <asm/exception.h> 43 #include <asm/system_misc.h> 44 45 static const char *handler[]= { 46 "Synchronous Abort", 47 "IRQ", 48 "FIQ", 49 "Error" 50 }; 51 52 int show_unhandled_signals = 1; 53 54 /* 55 * Dump out the contents of some memory nicely... 56 */ 57 static void dump_mem(const char *lvl, const char *str, unsigned long bottom, 58 unsigned long top, bool compat) 59 { 60 unsigned long first; 61 mm_segment_t fs; 62 int i; 63 unsigned int width = compat ? 4 : 8; 64 65 /* 66 * We need to switch to kernel mode so that we can use __get_user 67 * to safely read from kernel space. Note that we now dump the 68 * code first, just in case the backtrace kills us. 69 */ 70 fs = get_fs(); 71 set_fs(KERNEL_DS); 72 73 printk("%s%s(0x%016lx to 0x%016lx)\n", lvl, str, bottom, top); 74 75 for (first = bottom & ~31; first < top; first += 32) { 76 unsigned long p; 77 char str[sizeof(" 12345678") * 8 + 1]; 78 79 memset(str, ' ', sizeof(str)); 80 str[sizeof(str) - 1] = '\0'; 81 82 for (p = first, i = 0; i < (32 / width) 83 && p < top; i++, p += width) { 84 if (p >= bottom && p < top) { 85 unsigned long val; 86 87 if (width == 8) { 88 if (__get_user(val, (unsigned long *)p) == 0) 89 sprintf(str + i * 17, " %016lx", val); 90 else 91 sprintf(str + i * 17, " ????????????????"); 92 } else { 93 if (__get_user(val, (unsigned int *)p) == 0) 94 sprintf(str + i * 9, " %08lx", val); 95 else 96 sprintf(str + i * 9, " ????????"); 97 } 98 } 99 } 100 printk("%s%04lx:%s\n", lvl, first & 0xffff, str); 101 } 102 103 set_fs(fs); 104 } 105 106 static void dump_backtrace_entry(unsigned long where) 107 { 108 /* 109 * Note that 'where' can have a physical address, but it's not handled. 110 */ 111 print_ip_sym(where); 112 } 113 114 static void dump_instr(const char *lvl, struct pt_regs *regs) 115 { 116 unsigned long addr = instruction_pointer(regs); 117 mm_segment_t fs; 118 char str[sizeof("00000000 ") * 5 + 2 + 1], *p = str; 119 int i; 120 121 /* 122 * We need to switch to kernel mode so that we can use __get_user 123 * to safely read from kernel space. Note that we now dump the 124 * code first, just in case the backtrace kills us. 125 */ 126 fs = get_fs(); 127 set_fs(KERNEL_DS); 128 129 for (i = -4; i < 1; i++) { 130 unsigned int val, bad; 131 132 bad = __get_user(val, &((u32 *)addr)[i]); 133 134 if (!bad) 135 p += sprintf(p, i == 0 ? "(%08x) " : "%08x ", val); 136 else { 137 p += sprintf(p, "bad PC value"); 138 break; 139 } 140 } 141 printk("%sCode: %s\n", lvl, str); 142 143 set_fs(fs); 144 } 145 146 static void dump_backtrace(struct pt_regs *regs, struct task_struct *tsk) 147 { 148 struct stackframe frame; 149 unsigned long irq_stack_ptr; 150 int skip; 151 152 /* 153 * Switching between stacks is valid when tracing current and in 154 * non-preemptible context. 155 */ 156 if (tsk == current && !preemptible()) 157 irq_stack_ptr = IRQ_STACK_PTR(smp_processor_id()); 158 else 159 irq_stack_ptr = 0; 160 161 pr_debug("%s(regs = %p tsk = %p)\n", __func__, regs, tsk); 162 163 if (!tsk) 164 tsk = current; 165 166 if (tsk == current) { 167 frame.fp = (unsigned long)__builtin_frame_address(0); 168 frame.sp = current_stack_pointer; 169 frame.pc = (unsigned long)dump_backtrace; 170 } else { 171 /* 172 * task blocked in __switch_to 173 */ 174 frame.fp = thread_saved_fp(tsk); 175 frame.sp = thread_saved_sp(tsk); 176 frame.pc = thread_saved_pc(tsk); 177 } 178 #ifdef CONFIG_FUNCTION_GRAPH_TRACER 179 frame.graph = tsk->curr_ret_stack; 180 #endif 181 182 skip = !!regs; 183 printk("Call trace:\n"); 184 while (1) { 185 unsigned long where = frame.pc; 186 unsigned long stack; 187 int ret; 188 189 /* skip until specified stack frame */ 190 if (!skip) { 191 dump_backtrace_entry(where); 192 } else if (frame.fp == regs->regs[29]) { 193 skip = 0; 194 /* 195 * Mostly, this is the case where this function is 196 * called in panic/abort. As exception handler's 197 * stack frame does not contain the corresponding pc 198 * at which an exception has taken place, use regs->pc 199 * instead. 200 */ 201 dump_backtrace_entry(regs->pc); 202 } 203 ret = unwind_frame(tsk, &frame); 204 if (ret < 0) 205 break; 206 stack = frame.sp; 207 if (in_exception_text(where)) { 208 /* 209 * If we switched to the irq_stack before calling this 210 * exception handler, then the pt_regs will be on the 211 * task stack. The easiest way to tell is if the large 212 * pt_regs would overlap with the end of the irq_stack. 213 */ 214 if (stack < irq_stack_ptr && 215 (stack + sizeof(struct pt_regs)) > irq_stack_ptr) 216 stack = IRQ_STACK_TO_TASK_STACK(irq_stack_ptr); 217 218 dump_mem("", "Exception stack", stack, 219 stack + sizeof(struct pt_regs), false); 220 } 221 } 222 } 223 224 void show_stack(struct task_struct *tsk, unsigned long *sp) 225 { 226 dump_backtrace(NULL, tsk); 227 barrier(); 228 } 229 230 #ifdef CONFIG_PREEMPT 231 #define S_PREEMPT " PREEMPT" 232 #else 233 #define S_PREEMPT "" 234 #endif 235 #define S_SMP " SMP" 236 237 static int __die(const char *str, int err, struct thread_info *thread, 238 struct pt_regs *regs) 239 { 240 struct task_struct *tsk = thread->task; 241 static int die_counter; 242 int ret; 243 244 pr_emerg("Internal error: %s: %x [#%d]" S_PREEMPT S_SMP "\n", 245 str, err, ++die_counter); 246 247 /* trap and error numbers are mostly meaningless on ARM */ 248 ret = notify_die(DIE_OOPS, str, regs, err, 0, SIGSEGV); 249 if (ret == NOTIFY_STOP) 250 return ret; 251 252 print_modules(); 253 __show_regs(regs); 254 pr_emerg("Process %.*s (pid: %d, stack limit = 0x%p)\n", 255 TASK_COMM_LEN, tsk->comm, task_pid_nr(tsk), thread + 1); 256 257 if (!user_mode(regs) || in_interrupt()) { 258 dump_mem(KERN_EMERG, "Stack: ", regs->sp, 259 THREAD_SIZE + (unsigned long)task_stack_page(tsk), 260 compat_user_mode(regs)); 261 dump_backtrace(regs, tsk); 262 dump_instr(KERN_EMERG, regs); 263 } 264 265 return ret; 266 } 267 268 static DEFINE_RAW_SPINLOCK(die_lock); 269 270 /* 271 * This function is protected against re-entrancy. 272 */ 273 void die(const char *str, struct pt_regs *regs, int err) 274 { 275 struct thread_info *thread = current_thread_info(); 276 int ret; 277 278 oops_enter(); 279 280 raw_spin_lock_irq(&die_lock); 281 console_verbose(); 282 bust_spinlocks(1); 283 ret = __die(str, err, thread, regs); 284 285 if (regs && kexec_should_crash(thread->task)) 286 crash_kexec(regs); 287 288 bust_spinlocks(0); 289 add_taint(TAINT_DIE, LOCKDEP_NOW_UNRELIABLE); 290 raw_spin_unlock_irq(&die_lock); 291 oops_exit(); 292 293 if (in_interrupt()) 294 panic("Fatal exception in interrupt"); 295 if (panic_on_oops) 296 panic("Fatal exception"); 297 if (ret != NOTIFY_STOP) 298 do_exit(SIGSEGV); 299 } 300 301 void arm64_notify_die(const char *str, struct pt_regs *regs, 302 struct siginfo *info, int err) 303 { 304 if (user_mode(regs)) { 305 current->thread.fault_address = 0; 306 current->thread.fault_code = err; 307 force_sig_info(info->si_signo, info, current); 308 } else { 309 die(str, regs, err); 310 } 311 } 312 313 static LIST_HEAD(undef_hook); 314 static DEFINE_RAW_SPINLOCK(undef_lock); 315 316 void register_undef_hook(struct undef_hook *hook) 317 { 318 unsigned long flags; 319 320 raw_spin_lock_irqsave(&undef_lock, flags); 321 list_add(&hook->node, &undef_hook); 322 raw_spin_unlock_irqrestore(&undef_lock, flags); 323 } 324 325 void unregister_undef_hook(struct undef_hook *hook) 326 { 327 unsigned long flags; 328 329 raw_spin_lock_irqsave(&undef_lock, flags); 330 list_del(&hook->node); 331 raw_spin_unlock_irqrestore(&undef_lock, flags); 332 } 333 334 static int call_undef_hook(struct pt_regs *regs) 335 { 336 struct undef_hook *hook; 337 unsigned long flags; 338 u32 instr; 339 int (*fn)(struct pt_regs *regs, u32 instr) = NULL; 340 void __user *pc = (void __user *)instruction_pointer(regs); 341 342 if (!user_mode(regs)) 343 return 1; 344 345 if (compat_thumb_mode(regs)) { 346 /* 16-bit Thumb instruction */ 347 if (get_user(instr, (u16 __user *)pc)) 348 goto exit; 349 instr = le16_to_cpu(instr); 350 if (aarch32_insn_is_wide(instr)) { 351 u32 instr2; 352 353 if (get_user(instr2, (u16 __user *)(pc + 2))) 354 goto exit; 355 instr2 = le16_to_cpu(instr2); 356 instr = (instr << 16) | instr2; 357 } 358 } else { 359 /* 32-bit ARM instruction */ 360 if (get_user(instr, (u32 __user *)pc)) 361 goto exit; 362 instr = le32_to_cpu(instr); 363 } 364 365 raw_spin_lock_irqsave(&undef_lock, flags); 366 list_for_each_entry(hook, &undef_hook, node) 367 if ((instr & hook->instr_mask) == hook->instr_val && 368 (regs->pstate & hook->pstate_mask) == hook->pstate_val) 369 fn = hook->fn; 370 371 raw_spin_unlock_irqrestore(&undef_lock, flags); 372 exit: 373 return fn ? fn(regs, instr) : 1; 374 } 375 376 asmlinkage void __exception do_undefinstr(struct pt_regs *regs) 377 { 378 siginfo_t info; 379 void __user *pc = (void __user *)instruction_pointer(regs); 380 381 /* check for AArch32 breakpoint instructions */ 382 if (!aarch32_break_handler(regs)) 383 return; 384 385 if (call_undef_hook(regs) == 0) 386 return; 387 388 if (unhandled_signal(current, SIGILL) && show_unhandled_signals_ratelimited()) { 389 pr_info("%s[%d]: undefined instruction: pc=%p\n", 390 current->comm, task_pid_nr(current), pc); 391 dump_instr(KERN_INFO, regs); 392 } 393 394 info.si_signo = SIGILL; 395 info.si_errno = 0; 396 info.si_code = ILL_ILLOPC; 397 info.si_addr = pc; 398 399 arm64_notify_die("Oops - undefined instruction", regs, &info, 0); 400 } 401 402 long compat_arm_syscall(struct pt_regs *regs); 403 404 asmlinkage long do_ni_syscall(struct pt_regs *regs) 405 { 406 #ifdef CONFIG_COMPAT 407 long ret; 408 if (is_compat_task()) { 409 ret = compat_arm_syscall(regs); 410 if (ret != -ENOSYS) 411 return ret; 412 } 413 #endif 414 415 if (show_unhandled_signals_ratelimited()) { 416 pr_info("%s[%d]: syscall %d\n", current->comm, 417 task_pid_nr(current), (int)regs->syscallno); 418 dump_instr("", regs); 419 if (user_mode(regs)) 420 __show_regs(regs); 421 } 422 423 return sys_ni_syscall(); 424 } 425 426 static const char *esr_class_str[] = { 427 [0 ... ESR_ELx_EC_MAX] = "UNRECOGNIZED EC", 428 [ESR_ELx_EC_UNKNOWN] = "Unknown/Uncategorized", 429 [ESR_ELx_EC_WFx] = "WFI/WFE", 430 [ESR_ELx_EC_CP15_32] = "CP15 MCR/MRC", 431 [ESR_ELx_EC_CP15_64] = "CP15 MCRR/MRRC", 432 [ESR_ELx_EC_CP14_MR] = "CP14 MCR/MRC", 433 [ESR_ELx_EC_CP14_LS] = "CP14 LDC/STC", 434 [ESR_ELx_EC_FP_ASIMD] = "ASIMD", 435 [ESR_ELx_EC_CP10_ID] = "CP10 MRC/VMRS", 436 [ESR_ELx_EC_CP14_64] = "CP14 MCRR/MRRC", 437 [ESR_ELx_EC_ILL] = "PSTATE.IL", 438 [ESR_ELx_EC_SVC32] = "SVC (AArch32)", 439 [ESR_ELx_EC_HVC32] = "HVC (AArch32)", 440 [ESR_ELx_EC_SMC32] = "SMC (AArch32)", 441 [ESR_ELx_EC_SVC64] = "SVC (AArch64)", 442 [ESR_ELx_EC_HVC64] = "HVC (AArch64)", 443 [ESR_ELx_EC_SMC64] = "SMC (AArch64)", 444 [ESR_ELx_EC_SYS64] = "MSR/MRS (AArch64)", 445 [ESR_ELx_EC_IMP_DEF] = "EL3 IMP DEF", 446 [ESR_ELx_EC_IABT_LOW] = "IABT (lower EL)", 447 [ESR_ELx_EC_IABT_CUR] = "IABT (current EL)", 448 [ESR_ELx_EC_PC_ALIGN] = "PC Alignment", 449 [ESR_ELx_EC_DABT_LOW] = "DABT (lower EL)", 450 [ESR_ELx_EC_DABT_CUR] = "DABT (current EL)", 451 [ESR_ELx_EC_SP_ALIGN] = "SP Alignment", 452 [ESR_ELx_EC_FP_EXC32] = "FP (AArch32)", 453 [ESR_ELx_EC_FP_EXC64] = "FP (AArch64)", 454 [ESR_ELx_EC_SERROR] = "SError", 455 [ESR_ELx_EC_BREAKPT_LOW] = "Breakpoint (lower EL)", 456 [ESR_ELx_EC_BREAKPT_CUR] = "Breakpoint (current EL)", 457 [ESR_ELx_EC_SOFTSTP_LOW] = "Software Step (lower EL)", 458 [ESR_ELx_EC_SOFTSTP_CUR] = "Software Step (current EL)", 459 [ESR_ELx_EC_WATCHPT_LOW] = "Watchpoint (lower EL)", 460 [ESR_ELx_EC_WATCHPT_CUR] = "Watchpoint (current EL)", 461 [ESR_ELx_EC_BKPT32] = "BKPT (AArch32)", 462 [ESR_ELx_EC_VECTOR32] = "Vector catch (AArch32)", 463 [ESR_ELx_EC_BRK64] = "BRK (AArch64)", 464 }; 465 466 const char *esr_get_class_string(u32 esr) 467 { 468 return esr_class_str[esr >> ESR_ELx_EC_SHIFT]; 469 } 470 471 /* 472 * bad_mode handles the impossible case in the exception vector. 473 */ 474 asmlinkage void bad_mode(struct pt_regs *regs, int reason, unsigned int esr) 475 { 476 siginfo_t info; 477 void __user *pc = (void __user *)instruction_pointer(regs); 478 console_verbose(); 479 480 pr_crit("Bad mode in %s handler detected, code 0x%08x -- %s\n", 481 handler[reason], esr, esr_get_class_string(esr)); 482 __show_regs(regs); 483 484 info.si_signo = SIGILL; 485 info.si_errno = 0; 486 info.si_code = ILL_ILLOPC; 487 info.si_addr = pc; 488 489 arm64_notify_die("Oops - bad mode", regs, &info, 0); 490 } 491 492 void __pte_error(const char *file, int line, unsigned long val) 493 { 494 pr_err("%s:%d: bad pte %016lx.\n", file, line, val); 495 } 496 497 void __pmd_error(const char *file, int line, unsigned long val) 498 { 499 pr_err("%s:%d: bad pmd %016lx.\n", file, line, val); 500 } 501 502 void __pud_error(const char *file, int line, unsigned long val) 503 { 504 pr_err("%s:%d: bad pud %016lx.\n", file, line, val); 505 } 506 507 void __pgd_error(const char *file, int line, unsigned long val) 508 { 509 pr_err("%s:%d: bad pgd %016lx.\n", file, line, val); 510 } 511 512 /* GENERIC_BUG traps */ 513 514 int is_valid_bugaddr(unsigned long addr) 515 { 516 /* 517 * bug_handler() only called for BRK #BUG_BRK_IMM. 518 * So the answer is trivial -- any spurious instances with no 519 * bug table entry will be rejected by report_bug() and passed 520 * back to the debug-monitors code and handled as a fatal 521 * unexpected debug exception. 522 */ 523 return 1; 524 } 525 526 static int bug_handler(struct pt_regs *regs, unsigned int esr) 527 { 528 if (user_mode(regs)) 529 return DBG_HOOK_ERROR; 530 531 switch (report_bug(regs->pc, regs)) { 532 case BUG_TRAP_TYPE_BUG: 533 die("Oops - BUG", regs, 0); 534 break; 535 536 case BUG_TRAP_TYPE_WARN: 537 /* Ideally, report_bug() should backtrace for us... but no. */ 538 dump_backtrace(regs, NULL); 539 break; 540 541 default: 542 /* unknown/unrecognised bug trap type */ 543 return DBG_HOOK_ERROR; 544 } 545 546 /* If thread survives, skip over the BUG instruction and continue: */ 547 regs->pc += AARCH64_INSN_SIZE; /* skip BRK and resume */ 548 return DBG_HOOK_HANDLED; 549 } 550 551 static struct break_hook bug_break_hook = { 552 .esr_val = 0xf2000000 | BUG_BRK_IMM, 553 .esr_mask = 0xffffffff, 554 .fn = bug_handler, 555 }; 556 557 /* 558 * Initial handler for AArch64 BRK exceptions 559 * This handler only used until debug_traps_init(). 560 */ 561 int __init early_brk64(unsigned long addr, unsigned int esr, 562 struct pt_regs *regs) 563 { 564 return bug_handler(regs, esr) != DBG_HOOK_HANDLED; 565 } 566 567 /* This registration must happen early, before debug_traps_init(). */ 568 void __init trap_init(void) 569 { 570 register_break_hook(&bug_break_hook); 571 } 572