1 /* 2 * Copyright (c) 2015, Linaro Limited 3 * All rights reserved. 4 * 5 * Redistribution and use in source and binary forms, with or without 6 * modification, are permitted provided that the following conditions are met: 7 * 8 * 1. Redistributions of source code must retain the above copyright notice, 9 * this list of conditions and the following disclaimer. 10 * 11 * 2. Redistributions in binary form must reproduce the above copyright notice, 12 * this list of conditions and the following disclaimer in the documentation 13 * and/or other materials provided with the distribution. 14 * 15 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" 16 * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 17 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 18 * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE 19 * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 20 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 21 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 22 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 23 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 24 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 25 * POSSIBILITY OF SUCH DAMAGE. 26 */ 27 28 #include <kernel/abort.h> 29 #include <kernel/misc.h> 30 #include <kernel/tee_ta_manager.h> 31 #include <kernel/panic.h> 32 #include <kernel/user_ta.h> 33 #include <kernel/unwind.h> 34 #include <mm/core_mmu.h> 35 #include <mm/tee_pager.h> 36 #include <tee/tee_svc.h> 37 #include <trace.h> 38 #include <arm.h> 39 40 enum fault_type { 41 FAULT_TYPE_USER_TA_PANIC, 42 FAULT_TYPE_USER_TA_VFP, 43 FAULT_TYPE_PAGEABLE, 44 FAULT_TYPE_IGNORE, 45 }; 46 47 #ifdef CFG_CORE_UNWIND 48 #ifdef ARM32 49 static void __print_stack_unwind(struct abort_info *ai) 50 { 51 struct unwind_state state; 52 53 memset(&state, 0, sizeof(state)); 54 state.registers[0] = ai->regs->r0; 55 state.registers[1] = ai->regs->r1; 56 state.registers[2] = ai->regs->r2; 57 state.registers[3] = ai->regs->r3; 58 state.registers[4] = ai->regs->r4; 59 state.registers[5] = ai->regs->r5; 60 state.registers[6] = ai->regs->r6; 61 state.registers[7] = ai->regs->r7; 62 state.registers[8] = ai->regs->r8; 63 state.registers[9] = ai->regs->r9; 64 state.registers[10] = ai->regs->r10; 65 state.registers[11] = ai->regs->r11; 66 state.registers[13] = read_mode_sp(ai->regs->spsr & CPSR_MODE_MASK); 67 state.registers[14] = read_mode_lr(ai->regs->spsr & CPSR_MODE_MASK); 68 state.registers[15] = ai->pc; 69 70 do { 71 EMSG_RAW(" pc 0x%08x", state.registers[15]); 72 } while (unwind_stack(&state)); 73 } 74 #endif /*ARM32*/ 75 76 #ifdef ARM64 77 static void __print_stack_unwind(struct abort_info *ai) 78 { 79 struct unwind_state state; 80 81 memset(&state, 0, sizeof(state)); 82 state.pc = ai->regs->elr; 83 state.fp = ai->regs->x29; 84 85 do { 86 EMSG_RAW("pc 0x%016" PRIx64, state.pc); 87 } while (unwind_stack(&state)); 88 } 89 #endif /*ARM64*/ 90 91 static void print_stack_unwind(struct abort_info *ai) 92 { 93 EMSG_RAW("Call stack:"); 94 __print_stack_unwind(ai); 95 } 96 #else /*CFG_CORE_UNWIND*/ 97 static void print_stack_unwind(struct abort_info *ai __unused) 98 { 99 } 100 #endif /*CFG_CORE_UNWIND*/ 101 102 static __maybe_unused const char *abort_type_to_str(uint32_t abort_type) 103 { 104 if (abort_type == ABORT_TYPE_DATA) 105 return "data"; 106 if (abort_type == ABORT_TYPE_PREFETCH) 107 return "prefetch"; 108 return "undef"; 109 } 110 111 static __maybe_unused void print_detailed_abort( 112 struct abort_info *ai __maybe_unused, 113 const char *ctx __maybe_unused) 114 { 115 EMSG_RAW("\n"); 116 EMSG_RAW("%s %s-abort at address 0x%" PRIxVA "\n", 117 ctx, abort_type_to_str(ai->abort_type), ai->va); 118 #ifdef ARM32 119 EMSG_RAW(" fsr 0x%08x ttbr0 0x%08x ttbr1 0x%08x cidr 0x%X\n", 120 ai->fault_descr, read_ttbr0(), read_ttbr1(), 121 read_contextidr()); 122 EMSG_RAW(" cpu #%zu cpsr 0x%08x\n", 123 get_core_pos(), ai->regs->spsr); 124 EMSG_RAW(" r0 0x%08x r4 0x%08x r8 0x%08x r12 0x%08x\n", 125 ai->regs->r0, ai->regs->r4, ai->regs->r8, ai->regs->ip); 126 EMSG_RAW(" r1 0x%08x r5 0x%08x r9 0x%08x sp 0x%08x\n", 127 ai->regs->r1, ai->regs->r5, ai->regs->r9, 128 read_mode_sp(ai->regs->spsr & CPSR_MODE_MASK)); 129 EMSG_RAW(" r2 0x%08x r6 0x%08x r10 0x%08x lr 0x%08x\n", 130 ai->regs->r2, ai->regs->r6, ai->regs->r10, 131 read_mode_lr(ai->regs->spsr & CPSR_MODE_MASK)); 132 EMSG_RAW(" r3 0x%08x r7 0x%08x r11 0x%08x pc 0x%08x\n", 133 ai->regs->r3, ai->regs->r7, ai->regs->r11, ai->pc); 134 #endif /*ARM32*/ 135 #ifdef ARM64 136 EMSG_RAW(" esr 0x%08x ttbr0 0x%08" PRIx64 " ttbr1 0x%08" PRIx64 " cidr 0x%X\n", 137 ai->fault_descr, read_ttbr0_el1(), read_ttbr1_el1(), 138 read_contextidr_el1()); 139 EMSG_RAW(" cpu #%zu cpsr 0x%08x\n", 140 get_core_pos(), (uint32_t)ai->regs->spsr); 141 EMSG_RAW("x0 %016" PRIx64 " x1 %016" PRIx64, 142 ai->regs->x0, ai->regs->x1); 143 EMSG_RAW("x2 %016" PRIx64 " x3 %016" PRIx64, 144 ai->regs->x2, ai->regs->x3); 145 EMSG_RAW("x4 %016" PRIx64 " x5 %016" PRIx64, 146 ai->regs->x4, ai->regs->x5); 147 EMSG_RAW("x6 %016" PRIx64 " x7 %016" PRIx64, 148 ai->regs->x6, ai->regs->x7); 149 EMSG_RAW("x8 %016" PRIx64 " x9 %016" PRIx64, 150 ai->regs->x8, ai->regs->x9); 151 EMSG_RAW("x10 %016" PRIx64 " x11 %016" PRIx64, 152 ai->regs->x10, ai->regs->x11); 153 EMSG_RAW("x12 %016" PRIx64 " x13 %016" PRIx64, 154 ai->regs->x12, ai->regs->x13); 155 EMSG_RAW("x14 %016" PRIx64 " x15 %016" PRIx64, 156 ai->regs->x14, ai->regs->x15); 157 EMSG_RAW("x16 %016" PRIx64 " x17 %016" PRIx64, 158 ai->regs->x16, ai->regs->x17); 159 EMSG_RAW("x18 %016" PRIx64 " x19 %016" PRIx64, 160 ai->regs->x18, ai->regs->x19); 161 EMSG_RAW("x20 %016" PRIx64 " x21 %016" PRIx64, 162 ai->regs->x20, ai->regs->x21); 163 EMSG_RAW("x22 %016" PRIx64 " x23 %016" PRIx64, 164 ai->regs->x22, ai->regs->x23); 165 EMSG_RAW("x24 %016" PRIx64 " x25 %016" PRIx64, 166 ai->regs->x24, ai->regs->x25); 167 EMSG_RAW("x26 %016" PRIx64 " x27 %016" PRIx64, 168 ai->regs->x26, ai->regs->x27); 169 EMSG_RAW("x28 %016" PRIx64 " x29 %016" PRIx64, 170 ai->regs->x28, ai->regs->x29); 171 EMSG_RAW("x30 %016" PRIx64 " elr %016" PRIx64, 172 ai->regs->x30, ai->regs->elr); 173 EMSG_RAW("sp_el0 %016" PRIx64, ai->regs->sp_el0); 174 #endif /*ARM64*/ 175 } 176 177 static void print_user_abort(struct abort_info *ai __maybe_unused) 178 { 179 #ifdef CFG_TEE_CORE_TA_TRACE 180 print_detailed_abort(ai, "user TA"); 181 tee_ta_dump_current(); 182 #endif 183 } 184 185 void abort_print(struct abort_info *ai __maybe_unused) 186 { 187 #if (TRACE_LEVEL >= TRACE_INFO) 188 print_detailed_abort(ai, "core"); 189 #endif /*TRACE_LEVEL >= TRACE_DEBUG*/ 190 } 191 192 void abort_print_error(struct abort_info *ai) 193 { 194 #if (TRACE_LEVEL >= TRACE_INFO) 195 /* full verbose log at DEBUG level */ 196 print_detailed_abort(ai, "core"); 197 #else 198 #ifdef ARM32 199 EMSG("%s-abort at 0x%" PRIxVA "\n" 200 "FSR 0x%x PC 0x%x TTBR0 0x%X CONTEXIDR 0x%X\n" 201 "CPUID 0x%x CPSR 0x%x (read from SPSR)", 202 abort_type_to_str(ai->abort_type), 203 ai->va, ai->fault_descr, ai->pc, read_ttbr0(), read_contextidr(), 204 read_mpidr(), read_spsr()); 205 #endif /*ARM32*/ 206 #ifdef ARM64 207 EMSG("%s-abort at 0x%" PRIxVA "\n" 208 "ESR 0x%x PC 0x%x TTBR0 0x%" PRIx64 " CONTEXIDR 0x%X\n" 209 "CPUID 0x%" PRIx64 " CPSR 0x%x (read from SPSR)", 210 abort_type_to_str(ai->abort_type), 211 ai->va, ai->fault_descr, ai->pc, read_ttbr0_el1(), 212 read_contextidr_el1(), 213 read_mpidr_el1(), (uint32_t)ai->regs->spsr); 214 #endif /*ARM64*/ 215 #endif /*TRACE_LEVEL >= TRACE_DEBUG*/ 216 print_stack_unwind(ai); 217 } 218 219 #ifdef ARM32 220 static void set_abort_info(uint32_t abort_type, struct thread_abort_regs *regs, 221 struct abort_info *ai) 222 { 223 switch (abort_type) { 224 case ABORT_TYPE_DATA: 225 ai->fault_descr = read_dfsr(); 226 ai->va = read_dfar(); 227 break; 228 case ABORT_TYPE_PREFETCH: 229 ai->fault_descr = read_ifsr(); 230 ai->va = read_ifar(); 231 break; 232 default: 233 ai->fault_descr = 0; 234 ai->va = regs->elr; 235 break; 236 } 237 ai->abort_type = abort_type; 238 ai->pc = regs->elr; 239 ai->regs = regs; 240 } 241 #endif /*ARM32*/ 242 243 #ifdef ARM64 244 static void set_abort_info(uint32_t abort_type __unused, 245 struct thread_abort_regs *regs, struct abort_info *ai) 246 { 247 ai->fault_descr = read_esr_el1(); 248 switch ((ai->fault_descr >> ESR_EC_SHIFT) & ESR_EC_MASK) { 249 case ESR_EC_IABT_EL0: 250 case ESR_EC_IABT_EL1: 251 ai->abort_type = ABORT_TYPE_PREFETCH; 252 ai->va = read_far_el1(); 253 break; 254 case ESR_EC_DABT_EL0: 255 case ESR_EC_DABT_EL1: 256 case ESR_EC_SP_ALIGN: 257 ai->abort_type = ABORT_TYPE_DATA; 258 ai->va = read_far_el1(); 259 break; 260 default: 261 ai->abort_type = ABORT_TYPE_UNDEF; 262 ai->va = regs->elr; 263 } 264 ai->pc = regs->elr; 265 ai->regs = regs; 266 } 267 #endif /*ARM64*/ 268 269 #ifdef ARM32 270 static void handle_user_ta_panic(struct abort_info *ai) 271 { 272 /* 273 * It was a user exception, stop user execution and return 274 * to TEE Core. 275 */ 276 ai->regs->r0 = TEE_ERROR_TARGET_DEAD; 277 ai->regs->r1 = true; 278 ai->regs->r2 = 0xdeadbeef; 279 ai->regs->elr = (uint32_t)thread_unwind_user_mode; 280 ai->regs->spsr = read_cpsr(); 281 ai->regs->spsr &= ~CPSR_MODE_MASK; 282 ai->regs->spsr |= CPSR_MODE_SVC; 283 ai->regs->spsr &= ~CPSR_FIA; 284 ai->regs->spsr |= read_spsr() & CPSR_FIA; 285 /* Select Thumb or ARM mode */ 286 if (ai->regs->elr & 1) 287 ai->regs->spsr |= CPSR_T; 288 else 289 ai->regs->spsr &= ~CPSR_T; 290 } 291 #endif /*ARM32*/ 292 293 #ifdef ARM64 294 static void handle_user_ta_panic(struct abort_info *ai) 295 { 296 uint32_t daif; 297 298 /* 299 * It was a user exception, stop user execution and return 300 * to TEE Core. 301 */ 302 ai->regs->x0 = TEE_ERROR_TARGET_DEAD; 303 ai->regs->x1 = true; 304 ai->regs->x2 = 0xdeadbeef; 305 ai->regs->elr = (vaddr_t)thread_unwind_user_mode; 306 ai->regs->sp_el0 = thread_get_saved_thread_sp(); 307 308 daif = (ai->regs->spsr >> SPSR_32_AIF_SHIFT) & SPSR_32_AIF_MASK; 309 /* XXX what about DAIF_D? */ 310 ai->regs->spsr = SPSR_64(SPSR_64_MODE_EL1, SPSR_64_MODE_SP_EL0, daif); 311 } 312 #endif /*ARM64*/ 313 314 #ifdef CFG_WITH_VFP 315 static void handle_user_ta_vfp(void) 316 { 317 TEE_Result res; 318 struct tee_ta_session *s; 319 320 res = tee_ta_get_current_session(&s); 321 if (res != TEE_SUCCESS) 322 panic(); 323 324 thread_user_enable_vfp(&to_user_ta_ctx(s->ctx)->vfp); 325 } 326 #endif /*CFG_WITH_VFP*/ 327 328 #ifdef ARM32 329 /* Returns true if the exception originated from user mode */ 330 static bool is_user_exception(struct abort_info *ai) 331 { 332 return (ai->regs->spsr & ARM32_CPSR_MODE_MASK) == ARM32_CPSR_MODE_USR; 333 } 334 #endif /*ARM32*/ 335 336 #ifdef ARM64 337 /* Returns true if the exception originated from user mode */ 338 static bool is_user_exception(struct abort_info *ai) 339 { 340 uint32_t spsr = ai->regs->spsr; 341 342 if (spsr & (SPSR_MODE_RW_32 << SPSR_MODE_RW_SHIFT)) 343 return true; 344 if (((spsr >> SPSR_64_MODE_EL_SHIFT) & SPSR_64_MODE_EL_MASK) == 345 SPSR_64_MODE_EL0) 346 return true; 347 return false; 348 } 349 #endif /*ARM64*/ 350 351 #ifdef ARM32 352 /* Returns true if the exception originated from abort mode */ 353 static bool is_abort_in_abort_handler(struct abort_info *ai) 354 { 355 return (ai->regs->spsr & ARM32_CPSR_MODE_MASK) == ARM32_CPSR_MODE_ABT; 356 } 357 #endif /*ARM32*/ 358 359 #ifdef ARM64 360 /* Returns true if the exception originated from abort mode */ 361 static bool is_abort_in_abort_handler(struct abort_info *ai __unused) 362 { 363 return false; 364 } 365 #endif /*ARM64*/ 366 367 #ifdef ARM32 368 369 #define T32_INSTR(w1, w0) \ 370 ((((uint32_t)(w0) & 0xffff) << 16) | ((uint32_t)(w1) & 0xffff)) 371 372 #define T32_VTRANS32_MASK T32_INSTR(0xff << 8, (7 << 9) | 1 << 4) 373 #define T32_VTRANS32_VAL T32_INSTR(0xee << 8, (5 << 9) | 1 << 4) 374 375 #define T32_VTRANS64_MASK T32_INSTR((0xff << 8) | (7 << 5), 7 << 9) 376 #define T32_VTRANS64_VAL T32_INSTR((0xec << 8) | (2 << 5), 5 << 9) 377 378 #define T32_VLDST_MASK T32_INSTR((0xff << 8) | (1 << 4), 0) 379 #define T32_VLDST_VAL T32_INSTR( 0xf9 << 8 , 0) 380 381 #define T32_VXLDST_MASK T32_INSTR(0xfc << 8, 7 << 9) 382 #define T32_VXLDST_VAL T32_INSTR(0xec << 8, 5 << 9) 383 384 #define T32_VPROC_MASK T32_INSTR(0xef << 8, 0) 385 #define T32_VPROC_VAL T32_VPROC_MASK 386 387 #define A32_INSTR(x) ((uint32_t)(x)) 388 389 #define A32_VTRANS32_MASK A32_INSTR((0xf << 24) | (7 << 9) | (1 << 4)) 390 #define A32_VTRANS32_VAL A32_INSTR((0xe << 24) | (5 << 9) | (1 << 4)) 391 392 #define A32_VTRANS64_MASK A32_INSTR((0x7f << 21) | (7 << 9)) 393 #define A32_VTRANS64_VAL A32_INSTR((0x62 << 21) | (5 << 9)) 394 395 #define A32_VLDST_MASK A32_INSTR((0xff << 24) | (1 << 20)) 396 #define A32_VLDST_VAL A32_INSTR((0xf4 << 24)) 397 398 #define A32_VXLDST_MASK A32_INSTR((7 << 25) | (7 << 9)) 399 #define A32_VXLDST_VAL A32_INSTR((6 << 25) | (5 << 9)) 400 401 #define A32_VPROC_MASK A32_INSTR(0x7f << 25) 402 #define A32_VPROC_VAL A32_INSTR(0x79 << 25) 403 404 static bool is_vfp_fault(struct abort_info *ai) 405 { 406 TEE_Result res; 407 uint32_t instr; 408 409 if ((ai->abort_type != ABORT_TYPE_UNDEF) || vfp_is_enabled()) 410 return false; 411 412 res = tee_svc_copy_from_user(NULL, &instr, (void *)ai->pc, 413 sizeof(instr)); 414 if (res != TEE_SUCCESS) 415 return false; 416 417 if (ai->regs->spsr & CPSR_T) { 418 /* Thumb mode */ 419 return ((instr & T32_VTRANS32_MASK) == T32_VTRANS32_VAL) || 420 ((instr & T32_VTRANS64_MASK) == T32_VTRANS64_VAL) || 421 ((instr & T32_VLDST_MASK) == T32_VLDST_VAL) || 422 ((instr & T32_VXLDST_MASK) == T32_VXLDST_VAL) || 423 ((instr & T32_VPROC_MASK) == T32_VPROC_VAL); 424 } else { 425 /* ARM mode */ 426 return ((instr & A32_VTRANS32_MASK) == A32_VTRANS32_VAL) || 427 ((instr & A32_VTRANS64_MASK) == A32_VTRANS64_VAL) || 428 ((instr & A32_VLDST_MASK) == A32_VLDST_VAL) || 429 ((instr & A32_VXLDST_MASK) == A32_VXLDST_VAL) || 430 ((instr & A32_VPROC_MASK) == A32_VPROC_VAL); 431 } 432 } 433 #endif /*ARM32*/ 434 435 #ifdef ARM64 436 static bool is_vfp_fault(struct abort_info *ai) 437 { 438 switch ((ai->fault_descr >> ESR_EC_SHIFT) & ESR_EC_MASK) { 439 case ESR_EC_FP_ASIMD: 440 case ESR_EC_AARCH32_FP: 441 case ESR_EC_AARCH64_FP: 442 return true; 443 default: 444 return false; 445 } 446 } 447 #endif /*ARM64*/ 448 449 static enum fault_type get_fault_type(struct abort_info *ai) 450 { 451 if (is_user_exception(ai)) { 452 if (is_vfp_fault(ai)) 453 return FAULT_TYPE_USER_TA_VFP; 454 print_user_abort(ai); 455 DMSG("[abort] abort in User mode (TA will panic)"); 456 return FAULT_TYPE_USER_TA_PANIC; 457 } 458 459 if (is_abort_in_abort_handler(ai)) { 460 abort_print_error(ai); 461 EMSG("[abort] abort in abort handler (trap CPU)"); 462 panic(); 463 } 464 465 if (ai->abort_type == ABORT_TYPE_UNDEF) { 466 abort_print_error(ai); 467 EMSG("[abort] undefined abort (trap CPU)"); 468 panic(); 469 } 470 471 switch (core_mmu_get_fault_type(ai->fault_descr)) { 472 case CORE_MMU_FAULT_ALIGNMENT: 473 abort_print_error(ai); 474 EMSG("[abort] alignement fault! (trap CPU)"); 475 panic(); 476 break; 477 478 case CORE_MMU_FAULT_ACCESS_BIT: 479 abort_print_error(ai); 480 EMSG("[abort] access bit fault! (trap CPU)"); 481 panic(); 482 break; 483 484 case CORE_MMU_FAULT_DEBUG_EVENT: 485 abort_print(ai); 486 DMSG("[abort] Ignoring debug event!"); 487 return FAULT_TYPE_IGNORE; 488 489 case CORE_MMU_FAULT_TRANSLATION: 490 case CORE_MMU_FAULT_WRITE_PERMISSION: 491 case CORE_MMU_FAULT_READ_PERMISSION: 492 return FAULT_TYPE_PAGEABLE; 493 494 case CORE_MMU_FAULT_ASYNC_EXTERNAL: 495 abort_print(ai); 496 DMSG("[abort] Ignoring async external abort!"); 497 return FAULT_TYPE_IGNORE; 498 499 case CORE_MMU_FAULT_OTHER: 500 default: 501 abort_print(ai); 502 DMSG("[abort] Unhandled fault!"); 503 return FAULT_TYPE_IGNORE; 504 } 505 } 506 507 void abort_handler(uint32_t abort_type, struct thread_abort_regs *regs) 508 { 509 struct abort_info ai; 510 511 set_abort_info(abort_type, regs, &ai); 512 513 switch (get_fault_type(&ai)) { 514 case FAULT_TYPE_IGNORE: 515 break; 516 case FAULT_TYPE_USER_TA_PANIC: 517 vfp_disable(); 518 handle_user_ta_panic(&ai); 519 break; 520 #ifdef CFG_WITH_VFP 521 case FAULT_TYPE_USER_TA_VFP: 522 handle_user_ta_vfp(); 523 break; 524 #endif 525 case FAULT_TYPE_PAGEABLE: 526 default: 527 thread_kernel_save_vfp(); 528 tee_pager_handle_fault(&ai); 529 thread_kernel_restore_vfp(); 530 break; 531 } 532 } 533