1 // SPDX-License-Identifier: GPL-2.0
3 * Exception handling code
5 * Copyright (C) 2019 ARM Ltd.
8 #include <linux/context_tracking.h>
9 #include <linux/linkage.h>
10 #include <linux/lockdep.h>
11 #include <linux/ptrace.h>
12 #include <linux/sched.h>
13 #include <linux/sched/debug.h>
14 #include <linux/thread_info.h>
16 #include <asm/cpufeature.h>
17 #include <asm/daifflags.h>
19 #include <asm/exception.h>
20 #include <asm/kprobes.h>
22 #include <asm/processor.h>
24 #include <asm/stacktrace.h>
25 #include <asm/sysreg.h>
26 #include <asm/system_misc.h>
29 * Handle IRQ/context state management when entering from kernel mode.
30 * Before this function is called it is not safe to call regular kernel code,
31 * intrumentable code, or any code which may trigger an exception.
33 * This is intended to match the logic in irqentry_enter(), handling the kernel
34 * mode transitions only.
36 static __always_inline void __enter_from_kernel_mode(struct pt_regs *regs)
38 regs->exit_rcu = false;
40 if (!IS_ENABLED(CONFIG_TINY_RCU) && is_idle_task(current)) {
41 lockdep_hardirqs_off(CALLER_ADDR0);
43 trace_hardirqs_off_finish();
45 regs->exit_rcu = true;
49 lockdep_hardirqs_off(CALLER_ADDR0);
50 rcu_irq_enter_check_tick();
51 trace_hardirqs_off_finish();
54 static void noinstr enter_from_kernel_mode(struct pt_regs *regs)
56 __enter_from_kernel_mode(regs);
57 mte_check_tfsr_entry();
61 * Handle IRQ/context state management when exiting to kernel mode.
62 * After this function returns it is not safe to call regular kernel code,
63 * intrumentable code, or any code which may trigger an exception.
65 * This is intended to match the logic in irqentry_exit(), handling the kernel
66 * mode transitions only, and with preemption handled elsewhere.
68 static __always_inline void __exit_to_kernel_mode(struct pt_regs *regs)
70 lockdep_assert_irqs_disabled();
72 if (interrupts_enabled(regs)) {
74 trace_hardirqs_on_prepare();
75 lockdep_hardirqs_on_prepare(CALLER_ADDR0);
77 lockdep_hardirqs_on(CALLER_ADDR0);
88 static void noinstr exit_to_kernel_mode(struct pt_regs *regs)
90 mte_check_tfsr_exit();
91 __exit_to_kernel_mode(regs);
95 * Handle IRQ/context state management when entering from user mode.
96 * Before this function is called it is not safe to call regular kernel code,
97 * intrumentable code, or any code which may trigger an exception.
99 static __always_inline void __enter_from_user_mode(void)
101 lockdep_hardirqs_off(CALLER_ADDR0);
102 CT_WARN_ON(ct_state() != CONTEXT_USER);
104 trace_hardirqs_off_finish();
107 static __always_inline void enter_from_user_mode(struct pt_regs *regs)
109 __enter_from_user_mode();
113 * Handle IRQ/context state management when exiting to user mode.
114 * After this function returns it is not safe to call regular kernel code,
115 * intrumentable code, or any code which may trigger an exception.
117 static __always_inline void __exit_to_user_mode(void)
119 trace_hardirqs_on_prepare();
120 lockdep_hardirqs_on_prepare(CALLER_ADDR0);
122 lockdep_hardirqs_on(CALLER_ADDR0);
125 static __always_inline void prepare_exit_to_user_mode(struct pt_regs *regs)
131 flags = READ_ONCE(current_thread_info()->flags);
132 if (unlikely(flags & _TIF_WORK_MASK))
133 do_notify_resume(regs, flags);
136 static __always_inline void exit_to_user_mode(struct pt_regs *regs)
138 prepare_exit_to_user_mode(regs);
139 mte_check_tfsr_exit();
140 __exit_to_user_mode();
143 asmlinkage void noinstr asm_exit_to_user_mode(struct pt_regs *regs)
145 exit_to_user_mode(regs);
149 * Handle IRQ/context state management when entering an NMI from user/kernel
150 * mode. Before this function is called it is not safe to call regular kernel
151 * code, intrumentable code, or any code which may trigger an exception.
153 static void noinstr arm64_enter_nmi(struct pt_regs *regs)
155 regs->lockdep_hardirqs = lockdep_hardirqs_enabled();
158 lockdep_hardirqs_off(CALLER_ADDR0);
159 lockdep_hardirq_enter();
162 trace_hardirqs_off_finish();
167 * Handle IRQ/context state management when exiting an NMI from user/kernel
168 * mode. After this function returns it is not safe to call regular kernel
169 * code, intrumentable code, or any code which may trigger an exception.
171 static void noinstr arm64_exit_nmi(struct pt_regs *regs)
173 bool restore = regs->lockdep_hardirqs;
177 trace_hardirqs_on_prepare();
178 lockdep_hardirqs_on_prepare(CALLER_ADDR0);
182 lockdep_hardirq_exit();
184 lockdep_hardirqs_on(CALLER_ADDR0);
189 * Handle IRQ/context state management when entering a debug exception from
190 * kernel mode. Before this function is called it is not safe to call regular
191 * kernel code, intrumentable code, or any code which may trigger an exception.
193 static void noinstr arm64_enter_el1_dbg(struct pt_regs *regs)
195 regs->lockdep_hardirqs = lockdep_hardirqs_enabled();
197 lockdep_hardirqs_off(CALLER_ADDR0);
200 trace_hardirqs_off_finish();
204 * Handle IRQ/context state management when exiting a debug exception from
205 * kernel mode. After this function returns it is not safe to call regular
206 * kernel code, intrumentable code, or any code which may trigger an exception.
208 static void noinstr arm64_exit_el1_dbg(struct pt_regs *regs)
210 bool restore = regs->lockdep_hardirqs;
213 trace_hardirqs_on_prepare();
214 lockdep_hardirqs_on_prepare(CALLER_ADDR0);
219 lockdep_hardirqs_on(CALLER_ADDR0);
222 static void noinstr enter_el1_irq_or_nmi(struct pt_regs *regs)
224 if (IS_ENABLED(CONFIG_ARM64_PSEUDO_NMI) && !interrupts_enabled(regs))
225 arm64_enter_nmi(regs);
227 enter_from_kernel_mode(regs);
230 static void noinstr exit_el1_irq_or_nmi(struct pt_regs *regs)
232 if (IS_ENABLED(CONFIG_ARM64_PSEUDO_NMI) && !interrupts_enabled(regs))
233 arm64_exit_nmi(regs);
235 exit_to_kernel_mode(regs);
238 static void __sched arm64_preempt_schedule_irq(void)
240 lockdep_assert_irqs_disabled();
243 * DAIF.DA are cleared at the start of IRQ/FIQ handling, and when GIC
244 * priority masking is used the GIC irqchip driver will clear DAIF.IF
245 * using gic_arch_enable_irqs() for normal IRQs. If anything is set in
246 * DAIF we must have handled an NMI, so skip preemption.
248 if (system_uses_irq_prio_masking() && read_sysreg(daif))
252 * Preempting a task from an IRQ means we leave copies of PSTATE
253 * on the stack. cpufeature's enable calls may modify PSTATE, but
254 * resuming one of these preempted tasks would undo those changes.
256 * Only allow a task to be preempted once cpufeatures have been
259 if (system_capabilities_finalized())
260 preempt_schedule_irq();
263 static void do_interrupt_handler(struct pt_regs *regs,
264 void (*handler)(struct pt_regs *))
266 if (on_thread_stack())
267 call_on_irq_stack(regs, handler);
272 extern void (*handle_arch_irq)(struct pt_regs *);
273 extern void (*handle_arch_fiq)(struct pt_regs *);
275 static void noinstr __panic_unhandled(struct pt_regs *regs, const char *vector,
278 arm64_enter_nmi(regs);
282 pr_crit("Unhandled %s exception on CPU%d, ESR 0x%08x -- %s\n",
283 vector, smp_processor_id(), esr,
284 esr_get_class_string(esr));
287 panic("Unhandled exception");
290 #define UNHANDLED(el, regsize, vector) \
291 asmlinkage void noinstr el##_##regsize##_##vector##_handler(struct pt_regs *regs) \
293 const char *desc = #regsize "-bit " #el " " #vector; \
294 __panic_unhandled(regs, desc, read_sysreg(esr_el1)); \
297 #ifdef CONFIG_ARM64_ERRATUM_1463225
298 static DEFINE_PER_CPU(int, __in_cortex_a76_erratum_1463225_wa);
300 static void cortex_a76_erratum_1463225_svc_handler(void)
304 if (!unlikely(test_thread_flag(TIF_SINGLESTEP)))
307 if (!unlikely(this_cpu_has_cap(ARM64_WORKAROUND_1463225)))
310 __this_cpu_write(__in_cortex_a76_erratum_1463225_wa, 1);
311 reg = read_sysreg(mdscr_el1);
312 val = reg | DBG_MDSCR_SS | DBG_MDSCR_KDE;
313 write_sysreg(val, mdscr_el1);
314 asm volatile("msr daifclr, #8");
317 /* We will have taken a single-step exception by this point */
319 write_sysreg(reg, mdscr_el1);
320 __this_cpu_write(__in_cortex_a76_erratum_1463225_wa, 0);
323 static bool cortex_a76_erratum_1463225_debug_handler(struct pt_regs *regs)
325 if (!__this_cpu_read(__in_cortex_a76_erratum_1463225_wa))
329 * We've taken a dummy step exception from the kernel to ensure
330 * that interrupts are re-enabled on the syscall path. Return back
331 * to cortex_a76_erratum_1463225_svc_handler() with debug exceptions
332 * masked so that we can safely restore the mdscr and get on with
333 * handling the syscall.
335 regs->pstate |= PSR_D_BIT;
338 #else /* CONFIG_ARM64_ERRATUM_1463225 */
339 static void cortex_a76_erratum_1463225_svc_handler(void) { }
340 static bool cortex_a76_erratum_1463225_debug_handler(struct pt_regs *regs)
344 #endif /* CONFIG_ARM64_ERRATUM_1463225 */
346 UNHANDLED(el1t, 64, sync)
347 UNHANDLED(el1t, 64, irq)
348 UNHANDLED(el1t, 64, fiq)
349 UNHANDLED(el1t, 64, error)
351 static void noinstr el1_abort(struct pt_regs *regs, unsigned long esr)
353 unsigned long far = read_sysreg(far_el1);
355 enter_from_kernel_mode(regs);
356 local_daif_inherit(regs);
357 do_mem_abort(far, esr, regs);
359 exit_to_kernel_mode(regs);
362 static void noinstr el1_pc(struct pt_regs *regs, unsigned long esr)
364 unsigned long far = read_sysreg(far_el1);
366 enter_from_kernel_mode(regs);
367 local_daif_inherit(regs);
368 do_sp_pc_abort(far, esr, regs);
370 exit_to_kernel_mode(regs);
373 static void noinstr el1_undef(struct pt_regs *regs)
375 enter_from_kernel_mode(regs);
376 local_daif_inherit(regs);
379 exit_to_kernel_mode(regs);
382 static void noinstr el1_dbg(struct pt_regs *regs, unsigned long esr)
384 unsigned long far = read_sysreg(far_el1);
386 arm64_enter_el1_dbg(regs);
387 if (!cortex_a76_erratum_1463225_debug_handler(regs))
388 do_debug_exception(far, esr, regs);
389 arm64_exit_el1_dbg(regs);
392 static void noinstr el1_fpac(struct pt_regs *regs, unsigned long esr)
394 enter_from_kernel_mode(regs);
395 local_daif_inherit(regs);
396 do_ptrauth_fault(regs, esr);
398 exit_to_kernel_mode(regs);
401 asmlinkage void noinstr el1h_64_sync_handler(struct pt_regs *regs)
403 unsigned long esr = read_sysreg(esr_el1);
405 switch (ESR_ELx_EC(esr)) {
406 case ESR_ELx_EC_DABT_CUR:
407 case ESR_ELx_EC_IABT_CUR:
408 el1_abort(regs, esr);
411 * We don't handle ESR_ELx_EC_SP_ALIGN, since we will have hit a
412 * recursive exception when trying to push the initial pt_regs.
414 case ESR_ELx_EC_PC_ALIGN:
417 case ESR_ELx_EC_SYS64:
418 case ESR_ELx_EC_UNKNOWN:
421 case ESR_ELx_EC_BREAKPT_CUR:
422 case ESR_ELx_EC_SOFTSTP_CUR:
423 case ESR_ELx_EC_WATCHPT_CUR:
424 case ESR_ELx_EC_BRK64:
427 case ESR_ELx_EC_FPAC:
431 __panic_unhandled(regs, "64-bit el1h sync", esr);
435 static void noinstr el1_interrupt(struct pt_regs *regs,
436 void (*handler)(struct pt_regs *))
438 write_sysreg(DAIF_PROCCTX_NOIRQ, daif);
440 enter_el1_irq_or_nmi(regs);
441 do_interrupt_handler(regs, handler);
444 * Note: thread_info::preempt_count includes both thread_info::count
445 * and thread_info::need_resched, and is not equivalent to
448 if (IS_ENABLED(CONFIG_PREEMPTION) &&
449 READ_ONCE(current_thread_info()->preempt_count) == 0)
450 arm64_preempt_schedule_irq();
452 exit_el1_irq_or_nmi(regs);
455 asmlinkage void noinstr el1h_64_irq_handler(struct pt_regs *regs)
457 el1_interrupt(regs, handle_arch_irq);
460 asmlinkage void noinstr el1h_64_fiq_handler(struct pt_regs *regs)
462 el1_interrupt(regs, handle_arch_fiq);
465 asmlinkage void noinstr el1h_64_error_handler(struct pt_regs *regs)
467 unsigned long esr = read_sysreg(esr_el1);
469 local_daif_restore(DAIF_ERRCTX);
470 arm64_enter_nmi(regs);
471 do_serror(regs, esr);
472 arm64_exit_nmi(regs);
475 static void noinstr el0_da(struct pt_regs *regs, unsigned long esr)
477 unsigned long far = read_sysreg(far_el1);
479 enter_from_user_mode(regs);
480 local_daif_restore(DAIF_PROCCTX);
481 do_mem_abort(far, esr, regs);
482 exit_to_user_mode(regs);
485 static void noinstr el0_ia(struct pt_regs *regs, unsigned long esr)
487 unsigned long far = read_sysreg(far_el1);
490 * We've taken an instruction abort from userspace and not yet
491 * re-enabled IRQs. If the address is a kernel address, apply
492 * BP hardening prior to enabling IRQs and pre-emption.
494 if (!is_ttbr0_addr(far))
495 arm64_apply_bp_hardening();
497 enter_from_user_mode(regs);
498 local_daif_restore(DAIF_PROCCTX);
499 do_mem_abort(far, esr, regs);
500 exit_to_user_mode(regs);
503 static void noinstr el0_fpsimd_acc(struct pt_regs *regs, unsigned long esr)
505 enter_from_user_mode(regs);
506 local_daif_restore(DAIF_PROCCTX);
507 do_fpsimd_acc(esr, regs);
508 exit_to_user_mode(regs);
511 static void noinstr el0_sve_acc(struct pt_regs *regs, unsigned long esr)
513 enter_from_user_mode(regs);
514 local_daif_restore(DAIF_PROCCTX);
515 do_sve_acc(esr, regs);
516 exit_to_user_mode(regs);
519 static void noinstr el0_fpsimd_exc(struct pt_regs *regs, unsigned long esr)
521 enter_from_user_mode(regs);
522 local_daif_restore(DAIF_PROCCTX);
523 do_fpsimd_exc(esr, regs);
524 exit_to_user_mode(regs);
527 static void noinstr el0_sys(struct pt_regs *regs, unsigned long esr)
529 enter_from_user_mode(regs);
530 local_daif_restore(DAIF_PROCCTX);
531 do_sysinstr(esr, regs);
532 exit_to_user_mode(regs);
535 static void noinstr el0_pc(struct pt_regs *regs, unsigned long esr)
537 unsigned long far = read_sysreg(far_el1);
539 if (!is_ttbr0_addr(instruction_pointer(regs)))
540 arm64_apply_bp_hardening();
542 enter_from_user_mode(regs);
543 local_daif_restore(DAIF_PROCCTX);
544 do_sp_pc_abort(far, esr, regs);
545 exit_to_user_mode(regs);
548 static void noinstr el0_sp(struct pt_regs *regs, unsigned long esr)
550 enter_from_user_mode(regs);
551 local_daif_restore(DAIF_PROCCTX);
552 do_sp_pc_abort(regs->sp, esr, regs);
553 exit_to_user_mode(regs);
556 static void noinstr el0_undef(struct pt_regs *regs)
558 enter_from_user_mode(regs);
559 local_daif_restore(DAIF_PROCCTX);
561 exit_to_user_mode(regs);
564 static void noinstr el0_bti(struct pt_regs *regs)
566 enter_from_user_mode(regs);
567 local_daif_restore(DAIF_PROCCTX);
569 exit_to_user_mode(regs);
572 static void noinstr el0_inv(struct pt_regs *regs, unsigned long esr)
574 enter_from_user_mode(regs);
575 local_daif_restore(DAIF_PROCCTX);
576 bad_el0_sync(regs, 0, esr);
577 exit_to_user_mode(regs);
580 static void noinstr el0_dbg(struct pt_regs *regs, unsigned long esr)
582 /* Only watchpoints write FAR_EL1, otherwise its UNKNOWN */
583 unsigned long far = read_sysreg(far_el1);
585 enter_from_user_mode(regs);
586 do_debug_exception(far, esr, regs);
587 local_daif_restore(DAIF_PROCCTX);
588 exit_to_user_mode(regs);
591 static void noinstr el0_svc(struct pt_regs *regs)
593 enter_from_user_mode(regs);
594 cortex_a76_erratum_1463225_svc_handler();
596 exit_to_user_mode(regs);
599 static void noinstr el0_fpac(struct pt_regs *regs, unsigned long esr)
601 enter_from_user_mode(regs);
602 local_daif_restore(DAIF_PROCCTX);
603 do_ptrauth_fault(regs, esr);
604 exit_to_user_mode(regs);
607 asmlinkage void noinstr el0t_64_sync_handler(struct pt_regs *regs)
609 unsigned long esr = read_sysreg(esr_el1);
611 switch (ESR_ELx_EC(esr)) {
612 case ESR_ELx_EC_SVC64:
615 case ESR_ELx_EC_DABT_LOW:
618 case ESR_ELx_EC_IABT_LOW:
621 case ESR_ELx_EC_FP_ASIMD:
622 el0_fpsimd_acc(regs, esr);
625 el0_sve_acc(regs, esr);
627 case ESR_ELx_EC_FP_EXC64:
628 el0_fpsimd_exc(regs, esr);
630 case ESR_ELx_EC_SYS64:
634 case ESR_ELx_EC_SP_ALIGN:
637 case ESR_ELx_EC_PC_ALIGN:
640 case ESR_ELx_EC_UNKNOWN:
646 case ESR_ELx_EC_BREAKPT_LOW:
647 case ESR_ELx_EC_SOFTSTP_LOW:
648 case ESR_ELx_EC_WATCHPT_LOW:
649 case ESR_ELx_EC_BRK64:
652 case ESR_ELx_EC_FPAC:
660 static void noinstr el0_interrupt(struct pt_regs *regs,
661 void (*handler)(struct pt_regs *))
663 enter_from_user_mode(regs);
665 write_sysreg(DAIF_PROCCTX_NOIRQ, daif);
667 if (regs->pc & BIT(55))
668 arm64_apply_bp_hardening();
670 do_interrupt_handler(regs, handler);
672 exit_to_user_mode(regs);
675 static void noinstr __el0_irq_handler_common(struct pt_regs *regs)
677 el0_interrupt(regs, handle_arch_irq);
680 asmlinkage void noinstr el0t_64_irq_handler(struct pt_regs *regs)
682 __el0_irq_handler_common(regs);
685 static void noinstr __el0_fiq_handler_common(struct pt_regs *regs)
687 el0_interrupt(regs, handle_arch_fiq);
690 asmlinkage void noinstr el0t_64_fiq_handler(struct pt_regs *regs)
692 __el0_fiq_handler_common(regs);
695 static void noinstr __el0_error_handler_common(struct pt_regs *regs)
697 unsigned long esr = read_sysreg(esr_el1);
699 enter_from_user_mode(regs);
700 local_daif_restore(DAIF_ERRCTX);
701 arm64_enter_nmi(regs);
702 do_serror(regs, esr);
703 arm64_exit_nmi(regs);
704 local_daif_restore(DAIF_PROCCTX);
705 exit_to_user_mode(regs);
708 asmlinkage void noinstr el0t_64_error_handler(struct pt_regs *regs)
710 __el0_error_handler_common(regs);
714 static void noinstr el0_cp15(struct pt_regs *regs, unsigned long esr)
716 enter_from_user_mode(regs);
717 local_daif_restore(DAIF_PROCCTX);
718 do_cp15instr(esr, regs);
719 exit_to_user_mode(regs);
722 static void noinstr el0_svc_compat(struct pt_regs *regs)
724 enter_from_user_mode(regs);
725 cortex_a76_erratum_1463225_svc_handler();
726 do_el0_svc_compat(regs);
727 exit_to_user_mode(regs);
730 asmlinkage void noinstr el0t_32_sync_handler(struct pt_regs *regs)
732 unsigned long esr = read_sysreg(esr_el1);
734 switch (ESR_ELx_EC(esr)) {
735 case ESR_ELx_EC_SVC32:
736 el0_svc_compat(regs);
738 case ESR_ELx_EC_DABT_LOW:
741 case ESR_ELx_EC_IABT_LOW:
744 case ESR_ELx_EC_FP_ASIMD:
745 el0_fpsimd_acc(regs, esr);
747 case ESR_ELx_EC_FP_EXC32:
748 el0_fpsimd_exc(regs, esr);
750 case ESR_ELx_EC_PC_ALIGN:
753 case ESR_ELx_EC_UNKNOWN:
754 case ESR_ELx_EC_CP14_MR:
755 case ESR_ELx_EC_CP14_LS:
756 case ESR_ELx_EC_CP14_64:
759 case ESR_ELx_EC_CP15_32:
760 case ESR_ELx_EC_CP15_64:
763 case ESR_ELx_EC_BREAKPT_LOW:
764 case ESR_ELx_EC_SOFTSTP_LOW:
765 case ESR_ELx_EC_WATCHPT_LOW:
766 case ESR_ELx_EC_BKPT32:
774 asmlinkage void noinstr el0t_32_irq_handler(struct pt_regs *regs)
776 __el0_irq_handler_common(regs);
779 asmlinkage void noinstr el0t_32_fiq_handler(struct pt_regs *regs)
781 __el0_fiq_handler_common(regs);
784 asmlinkage void noinstr el0t_32_error_handler(struct pt_regs *regs)
786 __el0_error_handler_common(regs);
788 #else /* CONFIG_COMPAT */
789 UNHANDLED(el0t, 32, sync)
790 UNHANDLED(el0t, 32, irq)
791 UNHANDLED(el0t, 32, fiq)
792 UNHANDLED(el0t, 32, error)
793 #endif /* CONFIG_COMPAT */
795 #ifdef CONFIG_VMAP_STACK
796 asmlinkage void noinstr handle_bad_stack(struct pt_regs *regs)
798 unsigned int esr = read_sysreg(esr_el1);
799 unsigned long far = read_sysreg(far_el1);
801 arm64_enter_nmi(regs);
802 panic_bad_stack(regs, esr, far);
804 #endif /* CONFIG_VMAP_STACK */
806 #ifdef CONFIG_ARM_SDE_INTERFACE
807 asmlinkage noinstr unsigned long
808 __sdei_handler(struct pt_regs *regs, struct sdei_registered_event *arg)
813 * We didn't take an exception to get here, so the HW hasn't
814 * set/cleared bits in PSTATE that we may rely on.
816 * The original SDEI spec (ARM DEN 0054A) can be read ambiguously as to
817 * whether PSTATE bits are inherited unchanged or generated from
818 * scratch, and the TF-A implementation always clears PAN and always
819 * clears UAO. There are no other known implementations.
821 * Subsequent revisions (ARM DEN 0054B) follow the usual rules for how
822 * PSTATE is modified upon architectural exceptions, and so PAN is
823 * either inherited or set per SCTLR_ELx.SPAN, and UAO is always
826 * We must explicitly reset PAN to the expected state, including
827 * clearing it when the host isn't using it, in case a VM had it set.
829 if (system_uses_hw_pan())
831 else if (cpu_has_pan())
834 arm64_enter_nmi(regs);
835 ret = do_sdei_event(regs, arg);
836 arm64_exit_nmi(regs);
840 #endif /* CONFIG_ARM_SDE_INTERFACE */