1 // SPDX-License-Identifier: BSD-2-Clause 2 /* 3 * Copyright 2022-2023 NXP 4 * Copyright (c) 2015-2022, Linaro Limited 5 */ 6 7 #include <kernel/abort.h> 8 #include <kernel/linker.h> 9 #include <kernel/misc.h> 10 #include <kernel/panic.h> 11 #include <kernel/tee_ta_manager.h> 12 #include <kernel/thread_private.h> 13 #include <kernel/user_mode_ctx.h> 14 #include <mm/core_mmu.h> 15 #include <mm/mobj.h> 16 #include <riscv.h> 17 #include <tee/tee_svc.h> 18 #include <trace.h> 19 #include <unw/unwind.h> 20 21 enum fault_type { 22 FAULT_TYPE_USER_MODE_PANIC, 23 FAULT_TYPE_USER_MODE_VFP, 24 FAULT_TYPE_PAGE_FAULT, 25 FAULT_TYPE_IGNORE, 26 }; 27 28 #ifdef CFG_UNWIND 29 30 /* Kernel mode unwind */ 31 static void __print_stack_unwind(struct abort_info *ai) 32 { 33 struct unwind_state_riscv state = { 34 .fp = ai->regs->s0, 35 .pc = ai->regs->epc, 36 }; 37 38 print_stack_riscv(&state, thread_stack_start(), thread_stack_size()); 39 } 40 41 #else /* CFG_UNWIND */ 42 static void __print_stack_unwind(struct abort_info *ai __unused) 43 { 44 } 45 #endif /* CFG_UNWIND */ 46 47 static __maybe_unused const char *abort_type_to_str(uint32_t abort_type) 48 { 49 if (abort_type == ABORT_TYPE_DATA) 50 return "data"; 51 if (abort_type == ABORT_TYPE_PREFETCH) 52 return "prefetch"; 53 return "undef"; 54 } 55 56 static __maybe_unused const char * 57 fault_to_str(uint32_t abort_type, uint32_t fault_descr) 58 { 59 /* fault_descr is only valid for data or prefetch abort */ 60 if (abort_type != ABORT_TYPE_DATA && abort_type != ABORT_TYPE_PREFETCH) 61 return ""; 62 63 switch (core_mmu_get_fault_type(fault_descr)) { 64 case CORE_MMU_FAULT_ALIGNMENT: 65 return " (alignment fault)"; 66 case CORE_MMU_FAULT_TRANSLATION: 67 return " (translation fault)"; 68 case CORE_MMU_FAULT_READ_PERMISSION: 69 return " (read permission fault)"; 70 case CORE_MMU_FAULT_WRITE_PERMISSION: 71 return " (write permission fault)"; 72 case CORE_MMU_FAULT_TAG_CHECK: 73 return " (tag check fault)"; 74 default: 75 return ""; 76 } 77 } 78 79 static __maybe_unused void 80 __print_abort_info(struct abort_info *ai __maybe_unused, 81 const char *ctx __maybe_unused) 82 { 83 __maybe_unused size_t core_pos = 0; 84 85 if (abort_is_user_exception(ai)) 86 core_pos = thread_get_tsd()->abort_core; 87 else 88 core_pos = get_core_pos(); 89 90 EMSG_RAW(""); 91 EMSG_RAW("%s %s-abort at address 0x%" PRIxVA "%s", 92 ctx, abort_type_to_str(ai->abort_type), ai->va, 93 fault_to_str(ai->abort_type, ai->fault_descr)); 94 EMSG_RAW("cpu\t#%zu", core_pos); 95 EMSG_RAW("cause\t%016" PRIxPTR " epc\t%016" PRIxPTR, 96 ai->regs->cause, ai->regs->epc); 97 EMSG_RAW("tval\t%016" PRIxPTR " status\t%016" PRIxPTR, 98 ai->regs->tval, ai->regs->status); 99 EMSG_RAW("ra\t%016" PRIxPTR " sp\t%016" PRIxPTR, 100 ai->regs->ra, ai->regs->sp); 101 EMSG_RAW("gp\t%016" PRIxPTR " tp\t%016" PRIxPTR, 102 ai->regs->gp, ai->regs->tp); 103 EMSG_RAW("t0\t%016" PRIxPTR " t1\t%016" PRIxPTR, 104 ai->regs->t0, ai->regs->t1); 105 EMSG_RAW("t2\t%016" PRIxPTR " s0\t%016" PRIxPTR, 106 ai->regs->t2, ai->regs->s0); 107 EMSG_RAW("s1\t%016" PRIxPTR " a0\t%016" PRIxPTR, 108 ai->regs->s1, ai->regs->a0); 109 EMSG_RAW("a1\t%016" PRIxPTR " a2\t%016" PRIxPTR, 110 ai->regs->a1, ai->regs->a2); 111 EMSG_RAW("a3\t%016" PRIxPTR " a4\t%016" PRIxPTR, 112 ai->regs->a3, ai->regs->a4); 113 EMSG_RAW("a5\t%016" PRIxPTR " a5\t%016" PRIxPTR, 114 ai->regs->a5, ai->regs->a5); 115 EMSG_RAW("a6\t%016" PRIxPTR " a7\t%016" PRIxPTR, 116 ai->regs->a6, ai->regs->a7); 117 EMSG_RAW("s2\t%016" PRIxPTR " s3\t%016" PRIxPTR, 118 ai->regs->s2, ai->regs->s3); 119 EMSG_RAW("s4\t%016" PRIxPTR " s5\t%016" PRIxPTR, 120 ai->regs->s4, ai->regs->s5); 121 EMSG_RAW("s6\t%016" PRIxPTR " s7\t%016" PRIxPTR, 122 ai->regs->s6, ai->regs->s7); 123 EMSG_RAW("s8\t%016" PRIxPTR " s9\t%016" PRIxPTR, 124 ai->regs->s8, ai->regs->s9); 125 EMSG_RAW("s10\t%016" PRIxPTR " s11\t%016" PRIxPTR, 126 ai->regs->s10, ai->regs->s11); 127 EMSG_RAW("t3\t%016" PRIxPTR " t4\t%016" PRIxPTR, 128 ai->regs->t3, ai->regs->t4); 129 EMSG_RAW("t5\t%016" PRIxPTR " t6\t%016" PRIxPTR, 130 ai->regs->t5, ai->regs->t6); 131 } 132 133 /* 134 * Print abort info and (optionally) stack dump to the console 135 * @ai kernel-mode abort info. 136 * @stack_dump true to show a stack trace 137 */ 138 static void __abort_print(struct abort_info *ai, bool stack_dump) 139 { 140 assert(!abort_is_user_exception(ai)); 141 142 __print_abort_info(ai, "Core"); 143 144 if (stack_dump) { 145 trace_printf_helper_raw(TRACE_ERROR, true, 146 "TEE load address @ %#"PRIxVA, 147 VCORE_START_VA); 148 __print_stack_unwind(ai); 149 } 150 } 151 152 void abort_print(struct abort_info *ai) 153 { 154 __abort_print(ai, false); 155 } 156 157 void abort_print_error(struct abort_info *ai) 158 { 159 __abort_print(ai, true); 160 } 161 162 /* This function must be called from a normal thread */ 163 void abort_print_current_ts(void) 164 { 165 struct thread_specific_data *tsd = thread_get_tsd(); 166 struct abort_info ai = { }; 167 struct ts_session *s = ts_get_current_session(); 168 169 ai.abort_type = tsd->abort_type; 170 ai.fault_descr = tsd->abort_descr; 171 ai.va = tsd->abort_va; 172 ai.pc = tsd->abort_regs.epc; 173 ai.regs = &tsd->abort_regs; 174 175 if (ai.abort_type != ABORT_TYPE_USER_MODE_PANIC) 176 __print_abort_info(&ai, "User mode"); 177 178 s->ctx->ops->dump_state(s->ctx); 179 180 #if defined(CFG_FTRACE_SUPPORT) 181 if (s->ctx->ops->dump_ftrace) 182 s->ctx->ops->dump_ftrace(s->ctx); 183 #endif 184 } 185 186 static void save_abort_info_in_tsd(struct abort_info *ai) 187 { 188 struct thread_specific_data *tsd = thread_get_tsd(); 189 190 tsd->abort_type = ai->abort_type; 191 tsd->abort_descr = ai->fault_descr; 192 tsd->abort_va = ai->va; 193 tsd->abort_regs = *ai->regs; 194 tsd->abort_core = get_core_pos(); 195 } 196 197 static void set_abort_info(uint32_t abort_type __unused, 198 struct thread_abort_regs *regs, 199 struct abort_info *ai) 200 { 201 ai->fault_descr = regs->cause; 202 switch (ai->fault_descr) { 203 case CAUSE_MISALIGNED_FETCH: 204 case CAUSE_FETCH_ACCESS: 205 case CAUSE_FETCH_PAGE_FAULT: 206 case CAUSE_FETCH_GUEST_PAGE_FAULT: 207 ai->abort_type = ABORT_TYPE_PREFETCH; 208 break; 209 case CAUSE_MISALIGNED_LOAD: 210 case CAUSE_LOAD_ACCESS: 211 case CAUSE_MISALIGNED_STORE: 212 case CAUSE_STORE_ACCESS: 213 case CAUSE_LOAD_PAGE_FAULT: 214 case CAUSE_STORE_PAGE_FAULT: 215 case CAUSE_LOAD_GUEST_PAGE_FAULT: 216 case CAUSE_STORE_GUEST_PAGE_FAULT: 217 ai->abort_type = ABORT_TYPE_DATA; 218 break; 219 default: 220 ai->abort_type = ABORT_TYPE_UNDEF; 221 } 222 223 ai->va = regs->tval; 224 ai->pc = regs->epc; 225 ai->regs = regs; 226 } 227 228 static void handle_user_mode_panic(struct abort_info *ai) 229 { 230 /* 231 * It was a user exception, stop user execution and return 232 * to TEE Core. 233 */ 234 ai->regs->a0 = TEE_ERROR_TARGET_DEAD; 235 ai->regs->a1 = true; 236 ai->regs->a2 = 0xdeadbeef; 237 ai->regs->epc = (vaddr_t)thread_unwind_user_mode; 238 ai->regs->sp = thread_get_saved_thread_sp(); 239 ai->regs->status = xstatus_for_xret(true, PRV_S); 240 ai->regs->ie = 0; 241 } 242 243 #ifdef CFG_WITH_VFP 244 static void handle_user_mode_vfp(void) 245 { 246 struct ts_session *s = ts_get_current_session(); 247 248 thread_user_enable_vfp(&to_user_mode_ctx(s->ctx)->vfp); 249 } 250 #endif /*CFG_WITH_VFP*/ 251 252 #ifdef CFG_WITH_USER_TA 253 254 /* Returns true if the exception originated from user mode */ 255 bool abort_is_user_exception(struct abort_info *ai) 256 { 257 return (ai->regs->status & CSR_XSTATUS_SPP) == 0; 258 } 259 260 #else /*CFG_WITH_USER_TA*/ 261 bool abort_is_user_exception(struct abort_info *ai __unused) 262 { 263 return false; 264 } 265 #endif /*CFG_WITH_USER_TA*/ 266 267 #if defined(CFG_WITH_VFP) && defined(CFG_WITH_USER_TA) 268 static bool is_vfp_fault(struct abort_info *ai) 269 { 270 /* Implement */ 271 return false; 272 } 273 #else /*CFG_WITH_VFP && CFG_WITH_USER_TA*/ 274 static bool is_vfp_fault(struct abort_info *ai __unused) 275 { 276 return false; 277 } 278 #endif /*CFG_WITH_VFP && CFG_WITH_USER_TA*/ 279 280 static enum fault_type get_fault_type(struct abort_info *ai) 281 { 282 if (abort_is_user_exception(ai)) { 283 if (is_vfp_fault(ai)) 284 return FAULT_TYPE_USER_MODE_VFP; 285 return FAULT_TYPE_USER_MODE_PANIC; 286 } 287 288 if (thread_is_from_abort_mode()) { 289 abort_print_error(ai); 290 panic("[abort] abort in abort handler (trap CPU)"); 291 } 292 293 if (ai->abort_type == ABORT_TYPE_UNDEF) { 294 if (abort_is_user_exception(ai)) 295 return FAULT_TYPE_USER_MODE_PANIC; 296 abort_print_error(ai); 297 panic("[abort] undefined abort (trap CPU)"); 298 } 299 300 switch (core_mmu_get_fault_type(ai->fault_descr)) { 301 case CORE_MMU_FAULT_ALIGNMENT: 302 if (abort_is_user_exception(ai)) 303 return FAULT_TYPE_USER_MODE_PANIC; 304 abort_print_error(ai); 305 panic("[abort] alignment fault! (trap CPU)"); 306 break; 307 308 case CORE_MMU_FAULT_ACCESS_BIT: 309 if (abort_is_user_exception(ai)) 310 return FAULT_TYPE_USER_MODE_PANIC; 311 abort_print_error(ai); 312 panic("[abort] access bit fault! (trap CPU)"); 313 break; 314 315 case CORE_MMU_FAULT_DEBUG_EVENT: 316 if (!abort_is_user_exception(ai)) 317 abort_print(ai); 318 DMSG("[abort] Ignoring debug event!"); 319 return FAULT_TYPE_IGNORE; 320 321 case CORE_MMU_FAULT_TRANSLATION: 322 case CORE_MMU_FAULT_WRITE_PERMISSION: 323 case CORE_MMU_FAULT_READ_PERMISSION: 324 return FAULT_TYPE_PAGE_FAULT; 325 326 case CORE_MMU_FAULT_ASYNC_EXTERNAL: 327 if (!abort_is_user_exception(ai)) 328 abort_print(ai); 329 DMSG("[abort] Ignoring async external abort!"); 330 return FAULT_TYPE_IGNORE; 331 332 case CORE_MMU_FAULT_TAG_CHECK: 333 if (abort_is_user_exception(ai)) 334 return FAULT_TYPE_USER_MODE_PANIC; 335 abort_print_error(ai); 336 panic("[abort] Tag check fault! (trap CPU)"); 337 break; 338 339 case CORE_MMU_FAULT_OTHER: 340 default: 341 if (!abort_is_user_exception(ai)) 342 abort_print(ai); 343 DMSG("[abort] Unhandled fault!"); 344 return FAULT_TYPE_IGNORE; 345 } 346 } 347 348 void abort_handler(uint32_t abort_type, struct thread_abort_regs *regs) 349 { 350 struct abort_info ai; 351 352 set_abort_info(abort_type, regs, &ai); 353 354 switch (get_fault_type(&ai)) { 355 case FAULT_TYPE_IGNORE: 356 break; 357 case FAULT_TYPE_USER_MODE_PANIC: 358 DMSG("[abort] abort in User mode (TA will panic)"); 359 save_abort_info_in_tsd(&ai); 360 #ifdef CFG_WITH_VFP 361 vfp_disable(); 362 #endif 363 handle_user_mode_panic(&ai); 364 break; 365 #ifdef CFG_WITH_VFP 366 case FAULT_TYPE_USER_MODE_VFP: 367 handle_user_mode_vfp(); 368 break; 369 #endif 370 case FAULT_TYPE_PAGE_FAULT: 371 default: 372 if (thread_get_id_may_fail() < 0) { 373 abort_print_error(&ai); 374 panic("abort outside thread context"); 375 } 376 377 if (!abort_is_user_exception(&ai)) { 378 abort_print_error(&ai); 379 panic("unhandled page fault abort"); 380 } 381 DMSG("[abort] abort in User mode (TA will panic)"); 382 save_abort_info_in_tsd(&ai); 383 #ifdef CFG_WITH_VFP 384 vfp_disable(); 385 #endif 386 handle_user_mode_panic(&ai); 387 break; 388 } 389 } 390