arch/x86/kernel/doublefault_32.c

   1 // SPDX-License-Identifier: GPL-2.0
   2 #include <linux/mm.h>
   3 #include <linux/sched.h>
   4 #include <linux/sched/debug.h>
   5 #include <linux/init_task.h>
   6 #include <linux/fs.h>
   7
   8 #include <linux/uaccess.h>
   9 #include <asm/pgtable.h>
  10 #include <asm/processor.h>
  11 #include <asm/desc.h>
  12 #include <asm/traps.h>
  13
  14 extern void double_fault(void);
  15 #define ptr_ok(x) ((x) > PAGE_OFFSET && (x) < PAGE_OFFSET + MAXMEM)
  16
  17 #define TSS(x) this_cpu_read(cpu_tss_rw.x86_tss.x)
  18
  19 static void set_df_gdt_entry(unsigned int cpu);
  20
  21 /*
  22  * Called by double_fault with CR0.TS and EFLAGS.NT cleared.  The CPU thinks
  23  * we're running the doublefault task.  Cannot return.
  24  */
  25 asmlinkage notrace void __noreturn doublefault_shim(void)
  26 {
  27         unsigned long cr2;
  28         struct pt_regs regs;
  29
  30         BUILD_BUG_ON(sizeof(struct doublefault_stack) != PAGE_SIZE);
  31
  32         cr2 = native_read_cr2();
  33
  34         /* Reset back to the normal kernel task. */
  35         force_reload_TR();
  36         set_df_gdt_entry(smp_processor_id());
  37
  38         trace_hardirqs_off();
  39
  40         /*
  41          * Fill in pt_regs.  A downside of doing this in C is that the unwinder
  42          * won't see it (no ENCODE_FRAME_POINTER), so a nested stack dump
  43          * won't successfully unwind to the source of the double fault.
  44          * The main dump from do_double_fault() is fine, though, since it
  45          * uses these regs directly.
  46          *
  47          * If anyone ever cares, this could be moved to asm.
  48          */
  49         regs.ss         = TSS(ss);
  50         regs.__ssh      = 0;
  51         regs.sp         = TSS(sp);
  52         regs.flags      = TSS(flags);
  53         regs.cs         = TSS(cs);
  54         /* We won't go through the entry asm, so we can leave __csh as 0. */
  55         regs.__csh      = 0;
  56         regs.ip         = TSS(ip);
  57         regs.orig_ax    = 0;
  58         regs.gs         = TSS(gs);
  59         regs.__gsh      = 0;
  60         regs.fs         = TSS(fs);
  61         regs.__fsh      = 0;
  62         regs.es         = TSS(es);
  63         regs.__esh      = 0;
  64         regs.ds         = TSS(ds);
  65         regs.__dsh      = 0;
  66         regs.ax         = TSS(ax);
  67         regs.bp         = TSS(bp);
  68         regs.di         = TSS(di);
  69         regs.si         = TSS(si);
  70         regs.dx         = TSS(dx);
  71         regs.cx         = TSS(cx);
  72         regs.bx         = TSS(bx);
  73
  74         do_double_fault(&regs, 0, cr2);
  75
  76         /*
  77          * x86_32 does not save the original CR3 anywhere on a task switch.
  78          * This means that, even if we wanted to return, we would need to find
  79          * some way to reconstruct CR3.  We could make a credible guess based
  80          * on cpu_tlbstate, but that would be racy and would not account for
  81          * PTI.
  82          *
  83          * Instead, don't bother.  We can return through
  84          * rewind_stack_do_exit() instead.
  85          */
  86         panic("cannot return from double fault\n");
  87 }
  88 NOKPROBE_SYMBOL(doublefault_shim);
  89
  90 DEFINE_PER_CPU_PAGE_ALIGNED(struct doublefault_stack, doublefault_stack) = {
  91         .tss = {
  92                 /*
  93                  * No sp0 or ss0 -- we never run CPL != 0 with this TSS
  94                  * active.  sp is filled in later.
  95                  */
  96                 .ldt            = 0,
  97         .io_bitmap_base = IO_BITMAP_OFFSET_INVALID,
  98
  99                 .ip             = (unsigned long) double_fault,
 100                 .flags          = X86_EFLAGS_FIXED,
 101                 .es             = __USER_DS,
 102                 .cs             = __KERNEL_CS,
 103                 .ss             = __KERNEL_DS,
 104                 .ds             = __USER_DS,
 105                 .fs             = __KERNEL_PERCPU,
 106 #ifndef CONFIG_X86_32_LAZY_GS
 107                 .gs             = __KERNEL_STACK_CANARY,
 108 #endif
 109
 110                 .__cr3          = __pa_nodebug(swapper_pg_dir),
 111         },
 112 };
 113
 114 static void set_df_gdt_entry(unsigned int cpu)
 115 {
 116         /* Set up doublefault TSS pointer in the GDT */
 117         __set_tss_desc(cpu, GDT_ENTRY_DOUBLEFAULT_TSS,
 118                        &get_cpu_entry_area(cpu)->doublefault_stack.tss);
 119
 120 }
 121
 122 void doublefault_init_cpu_tss(void)
 123 {
 124         unsigned int cpu = smp_processor_id();
 125         struct cpu_entry_area *cea = get_cpu_entry_area(cpu);
 126
 127         /*
 128          * The linker isn't smart enough to initialize percpu variables that
 129          * point to other places in percpu space.
 130          */
 131         this_cpu_write(doublefault_stack.tss.sp,
 132                        (unsigned long)&cea->doublefault_stack.stack +
 133                        sizeof(doublefault_stack.stack));
 134
 135         set_df_gdt_entry(cpu);
 136 }