1 // SPDX-License-Identifier: GPL-2.0 2 #include <linux/mm.h> 3 #include <linux/sched.h> 4 #include <linux/sched/debug.h> 5 #include <linux/init_task.h> 6 #include <linux/fs.h> 7 8 #include <linux/uaccess.h> 9 #include <asm/pgtable.h> 10 #include <asm/processor.h> 11 #include <asm/desc.h> 12 #include <asm/traps.h> 13 14 extern void double_fault(void); 15 #define ptr_ok(x) ((x) > PAGE_OFFSET && (x) < PAGE_OFFSET + MAXMEM) 16 17 #define TSS(x) this_cpu_read(cpu_tss_rw.x86_tss.x) 18 19 static void set_df_gdt_entry(unsigned int cpu); 20 21 /* 22 * Called by double_fault with CR0.TS and EFLAGS.NT cleared. The CPU thinks 23 * we're running the doublefault task. Cannot return. 24 */ 25 asmlinkage notrace void __noreturn doublefault_shim(void) 26 { 27 unsigned long cr2; 28 struct pt_regs regs; 29 30 BUILD_BUG_ON(sizeof(struct doublefault_stack) != PAGE_SIZE); 31 32 cr2 = native_read_cr2(); 33 34 /* Reset back to the normal kernel task. */ 35 force_reload_TR(); 36 set_df_gdt_entry(smp_processor_id()); 37 38 trace_hardirqs_off(); 39 40 /* 41 * Fill in pt_regs. A downside of doing this in C is that the unwinder 42 * won't see it (no ENCODE_FRAME_POINTER), so a nested stack dump 43 * won't successfully unwind to the source of the double fault. 44 * The main dump from do_double_fault() is fine, though, since it 45 * uses these regs directly. 46 * 47 * If anyone ever cares, this could be moved to asm. 48 */ 49 regs.ss = TSS(ss); 50 regs.__ssh = 0; 51 regs.sp = TSS(sp); 52 regs.flags = TSS(flags); 53 regs.cs = TSS(cs); 54 /* We won't go through the entry asm, so we can leave __csh as 0. */ 55 regs.__csh = 0; 56 regs.ip = TSS(ip); 57 regs.orig_ax = 0; 58 regs.gs = TSS(gs); 59 regs.__gsh = 0; 60 regs.fs = TSS(fs); 61 regs.__fsh = 0; 62 regs.es = TSS(es); 63 regs.__esh = 0; 64 regs.ds = TSS(ds); 65 regs.__dsh = 0; 66 regs.ax = TSS(ax); 67 regs.bp = TSS(bp); 68 regs.di = TSS(di); 69 regs.si = TSS(si); 70 regs.dx = TSS(dx); 71 regs.cx = TSS(cx); 72 regs.bx = TSS(bx); 73 74 do_double_fault(®s, 0, cr2); 75 76 /* 77 * x86_32 does not save the original CR3 anywhere on a task switch. 78 * This means that, even if we wanted to return, we would need to find 79 * some way to reconstruct CR3. We could make a credible guess based 80 * on cpu_tlbstate, but that would be racy and would not account for 81 * PTI. 82 * 83 * Instead, don't bother. We can return through 84 * rewind_stack_do_exit() instead. 85 */ 86 panic("cannot return from double fault\n"); 87 } 88 NOKPROBE_SYMBOL(doublefault_shim); 89 90 DEFINE_PER_CPU_PAGE_ALIGNED(struct doublefault_stack, doublefault_stack) = { 91 .tss = { 92 /* 93 * No sp0 or ss0 -- we never run CPL != 0 with this TSS 94 * active. sp is filled in later. 95 */ 96 .ldt = 0, 97 .io_bitmap_base = IO_BITMAP_OFFSET_INVALID, 98 99 .ip = (unsigned long) double_fault, 100 .flags = X86_EFLAGS_FIXED, 101 .es = __USER_DS, 102 .cs = __KERNEL_CS, 103 .ss = __KERNEL_DS, 104 .ds = __USER_DS, 105 .fs = __KERNEL_PERCPU, 106 #ifndef CONFIG_X86_32_LAZY_GS 107 .gs = __KERNEL_STACK_CANARY, 108 #endif 109 110 .__cr3 = __pa_nodebug(swapper_pg_dir), 111 }, 112 }; 113 114 static void set_df_gdt_entry(unsigned int cpu) 115 { 116 /* Set up doublefault TSS pointer in the GDT */ 117 __set_tss_desc(cpu, GDT_ENTRY_DOUBLEFAULT_TSS, 118 &get_cpu_entry_area(cpu)->doublefault_stack.tss); 119 120 } 121 122 void doublefault_init_cpu_tss(void) 123 { 124 unsigned int cpu = smp_processor_id(); 125 struct cpu_entry_area *cea = get_cpu_entry_area(cpu); 126 127 /* 128 * The linker isn't smart enough to initialize percpu variables that 129 * point to other places in percpu space. 130 */ 131 this_cpu_write(doublefault_stack.tss.sp, 132 (unsigned long)&cea->doublefault_stack.stack + 133 sizeof(doublefault_stack.stack)); 134 135 set_df_gdt_entry(cpu); 136 } 137