1 // SPDX-License-Identifier: GPL-2.0-only
2 /*
3 * linux/arch/arm/mm/alignment.c
4 *
5 * Copyright (C) 1995 Linus Torvalds
6 * Modifications for ARM processor (c) 1995-2001 Russell King
7 * Thumb alignment fault fixups (c) 2004 MontaVista Software, Inc.
8 * - Adapted from gdb/sim/arm/thumbemu.c -- Thumb instruction emulation.
9 * Copyright (C) 1996, Cygnus Software Technologies Ltd.
10 */
11 #include <linux/moduleparam.h>
12 #include <linux/compiler.h>
13 #include <linux/kernel.h>
14 #include <linux/sched/debug.h>
15 #include <linux/errno.h>
16 #include <linux/string.h>
17 #include <linux/proc_fs.h>
18 #include <linux/seq_file.h>
19 #include <linux/init.h>
20 #include <linux/sched/signal.h>
21 #include <linux/uaccess.h>
22
23 #include <asm/cp15.h>
24 #include <asm/extable.h>
25 #include <asm/system_info.h>
26 #include <asm/unaligned.h>
27 #include <asm/opcodes.h>
28
29 #include "fault.h"
30 #include "mm.h"
31
32 /*
33 * 32-bit misaligned trap handler (c) 1998 San Mehat (CCC) -July 1998
34 * /proc/sys/debug/alignment, modified and integrated into
35 * Linux 2.1 by Russell King
36 *
37 * Speed optimisations and better fault handling by Russell King.
38 *
39 * *** NOTE ***
40 * This code is not portable to processors with late data abort handling.
41 */
42 #define CODING_BITS(i) (i & 0x0e000000)
43 #define COND_BITS(i) (i & 0xf0000000)
44
45 #define LDST_I_BIT(i) (i & (1 << 26)) /* Immediate constant */
46 #define LDST_P_BIT(i) (i & (1 << 24)) /* Preindex */
47 #define LDST_U_BIT(i) (i & (1 << 23)) /* Add offset */
48 #define LDST_W_BIT(i) (i & (1 << 21)) /* Writeback */
49 #define LDST_L_BIT(i) (i & (1 << 20)) /* Load */
50
51 #define LDST_P_EQ_U(i) ((((i) ^ ((i) >> 1)) & (1 << 23)) == 0)
52
53 #define LDSTHD_I_BIT(i) (i & (1 << 22)) /* double/half-word immed */
54 #define LDM_S_BIT(i) (i & (1 << 22)) /* write CPSR from SPSR */
55
56 #define RN_BITS(i) ((i >> 16) & 15) /* Rn */
57 #define RD_BITS(i) ((i >> 12) & 15) /* Rd */
58 #define RM_BITS(i) (i & 15) /* Rm */
59
60 #define REGMASK_BITS(i) (i & 0xffff)
61 #define OFFSET_BITS(i) (i & 0x0fff)
62
63 #define IS_SHIFT(i) (i & 0x0ff0)
64 #define SHIFT_BITS(i) ((i >> 7) & 0x1f)
65 #define SHIFT_TYPE(i) (i & 0x60)
66 #define SHIFT_LSL 0x00
67 #define SHIFT_LSR 0x20
68 #define SHIFT_ASR 0x40
69 #define SHIFT_RORRRX 0x60
70
71 #define BAD_INSTR 0xdeadc0de
72
73 /* Thumb-2 32 bit format per ARMv7 DDI0406A A6.3, either f800h,e800h,f800h */
74 #define IS_T32(hi16) \
75 (((hi16) & 0xe000) == 0xe000 && ((hi16) & 0x1800))
76
77 static unsigned long ai_user;
78 static unsigned long ai_sys;
79 static void *ai_sys_last_pc;
80 static unsigned long ai_skipped;
81 static unsigned long ai_half;
82 static unsigned long ai_word;
83 static unsigned long ai_dword;
84 static unsigned long ai_multi;
85 static int ai_usermode;
86 static unsigned long cr_no_alignment;
87
88 core_param(alignment, ai_usermode, int, 0600);
89
90 #define UM_WARN (1 << 0)
91 #define UM_FIXUP (1 << 1)
92 #define UM_SIGNAL (1 << 2)
93
94 /* Return true if and only if the ARMv6 unaligned access model is in use. */
cpu_is_v6_unaligned(void)95 static bool cpu_is_v6_unaligned(void)
96 {
97 return cpu_architecture() >= CPU_ARCH_ARMv6 && get_cr() & CR_U;
98 }
99
safe_usermode(int new_usermode,bool warn)100 static int safe_usermode(int new_usermode, bool warn)
101 {
102 /*
103 * ARMv6 and later CPUs can perform unaligned accesses for
104 * most single load and store instructions up to word size.
105 * LDM, STM, LDRD and STRD still need to be handled.
106 *
107 * Ignoring the alignment fault is not an option on these
108 * CPUs since we spin re-faulting the instruction without
109 * making any progress.
110 */
111 if (cpu_is_v6_unaligned() && !(new_usermode & (UM_FIXUP | UM_SIGNAL))) {
112 new_usermode |= UM_FIXUP;
113
114 if (warn)
115 pr_warn("alignment: ignoring faults is unsafe on this CPU. Defaulting to fixup mode.\n");
116 }
117
118 return new_usermode;
119 }
120
121 #ifdef CONFIG_PROC_FS
122 static const char *usermode_action[] = {
123 "ignored",
124 "warn",
125 "fixup",
126 "fixup+warn",
127 "signal",
128 "signal+warn"
129 };
130
alignment_proc_show(struct seq_file * m,void * v)131 static int alignment_proc_show(struct seq_file *m, void *v)
132 {
133 seq_printf(m, "User:\t\t%lu\n", ai_user);
134 seq_printf(m, "System:\t\t%lu (%pS)\n", ai_sys, ai_sys_last_pc);
135 seq_printf(m, "Skipped:\t%lu\n", ai_skipped);
136 seq_printf(m, "Half:\t\t%lu\n", ai_half);
137 seq_printf(m, "Word:\t\t%lu\n", ai_word);
138 if (cpu_architecture() >= CPU_ARCH_ARMv5TE)
139 seq_printf(m, "DWord:\t\t%lu\n", ai_dword);
140 seq_printf(m, "Multi:\t\t%lu\n", ai_multi);
141 seq_printf(m, "User faults:\t%i (%s)\n", ai_usermode,
142 usermode_action[ai_usermode]);
143
144 return 0;
145 }
146
alignment_proc_open(struct inode * inode,struct file * file)147 static int alignment_proc_open(struct inode *inode, struct file *file)
148 {
149 return single_open(file, alignment_proc_show, NULL);
150 }
151
alignment_proc_write(struct file * file,const char __user * buffer,size_t count,loff_t * pos)152 static ssize_t alignment_proc_write(struct file *file, const char __user *buffer,
153 size_t count, loff_t *pos)
154 {
155 char mode;
156
157 if (count > 0) {
158 if (get_user(mode, buffer))
159 return -EFAULT;
160 if (mode >= '0' && mode <= '5')
161 ai_usermode = safe_usermode(mode - '0', true);
162 }
163 return count;
164 }
165
166 static const struct proc_ops alignment_proc_ops = {
167 .proc_open = alignment_proc_open,
168 .proc_read = seq_read,
169 .proc_lseek = seq_lseek,
170 .proc_release = single_release,
171 .proc_write = alignment_proc_write,
172 };
173 #endif /* CONFIG_PROC_FS */
174
175 union offset_union {
176 unsigned long un;
177 signed long sn;
178 };
179
180 #define TYPE_ERROR 0
181 #define TYPE_FAULT 1
182 #define TYPE_LDST 2
183 #define TYPE_DONE 3
184
185 #ifdef __ARMEB__
186 #define BE 1
187 #define FIRST_BYTE_16 "mov %1, %1, ror #8\n"
188 #define FIRST_BYTE_32 "mov %1, %1, ror #24\n"
189 #define NEXT_BYTE "ror #24"
190 #else
191 #define BE 0
192 #define FIRST_BYTE_16
193 #define FIRST_BYTE_32
194 #define NEXT_BYTE "lsr #8"
195 #endif
196
197 #define __get8_unaligned_check(ins,val,addr,err) \
198 __asm__( \
199 ARM( "1: "ins" %1, [%2], #1\n" ) \
200 THUMB( "1: "ins" %1, [%2]\n" ) \
201 THUMB( " add %2, %2, #1\n" ) \
202 "2:\n" \
203 " .pushsection .text.fixup,\"ax\"\n" \
204 " .align 2\n" \
205 "3: mov %0, #1\n" \
206 " b 2b\n" \
207 " .popsection\n" \
208 " ex_entry 1b, 3b\n" \
209 : "=r" (err), "=&r" (val), "=r" (addr) \
210 : "0" (err), "2" (addr))
211
212 #define __get16_unaligned_check(ins,val,addr) \
213 do { \
214 unsigned int err = 0, v, a = addr; \
215 __get8_unaligned_check(ins,v,a,err); \
216 val = v << ((BE) ? 8 : 0); \
217 __get8_unaligned_check(ins,v,a,err); \
218 val |= v << ((BE) ? 0 : 8); \
219 if (err) \
220 goto fault; \
221 } while (0)
222
223 #define get16_unaligned_check(val,addr) \
224 __get16_unaligned_check("ldrb",val,addr)
225
226 #define get16t_unaligned_check(val,addr) \
227 __get16_unaligned_check("ldrbt",val,addr)
228
229 #define __get32_unaligned_check(ins,val,addr) \
230 do { \
231 unsigned int err = 0, v, a = addr; \
232 __get8_unaligned_check(ins,v,a,err); \
233 val = v << ((BE) ? 24 : 0); \
234 __get8_unaligned_check(ins,v,a,err); \
235 val |= v << ((BE) ? 16 : 8); \
236 __get8_unaligned_check(ins,v,a,err); \
237 val |= v << ((BE) ? 8 : 16); \
238 __get8_unaligned_check(ins,v,a,err); \
239 val |= v << ((BE) ? 0 : 24); \
240 if (err) \
241 goto fault; \
242 } while (0)
243
244 #define get32_unaligned_check(val,addr) \
245 __get32_unaligned_check("ldrb",val,addr)
246
247 #define get32t_unaligned_check(val,addr) \
248 __get32_unaligned_check("ldrbt",val,addr)
249
250 #define __put16_unaligned_check(ins,val,addr) \
251 do { \
252 unsigned int err = 0, v = val, a = addr; \
253 __asm__( FIRST_BYTE_16 \
254 ARM( "1: "ins" %1, [%2], #1\n" ) \
255 THUMB( "1: "ins" %1, [%2]\n" ) \
256 THUMB( " add %2, %2, #1\n" ) \
257 " mov %1, %1, "NEXT_BYTE"\n" \
258 "2: "ins" %1, [%2]\n" \
259 "3:\n" \
260 " .pushsection .text.fixup,\"ax\"\n" \
261 " .align 2\n" \
262 "4: mov %0, #1\n" \
263 " b 3b\n" \
264 " .popsection\n" \
265 " ex_entry 1b, 4b\n" \
266 " ex_entry 2b, 4b\n" \
267 : "=r" (err), "=&r" (v), "=&r" (a) \
268 : "0" (err), "1" (v), "2" (a)); \
269 if (err) \
270 goto fault; \
271 } while (0)
272
273 #define put16_unaligned_check(val,addr) \
274 __put16_unaligned_check("strb",val,addr)
275
276 #define put16t_unaligned_check(val,addr) \
277 __put16_unaligned_check("strbt",val,addr)
278
279 #define __put32_unaligned_check(ins,val,addr) \
280 do { \
281 unsigned int err = 0, v = val, a = addr; \
282 __asm__( FIRST_BYTE_32 \
283 ARM( "1: "ins" %1, [%2], #1\n" ) \
284 THUMB( "1: "ins" %1, [%2]\n" ) \
285 THUMB( " add %2, %2, #1\n" ) \
286 " mov %1, %1, "NEXT_BYTE"\n" \
287 ARM( "2: "ins" %1, [%2], #1\n" ) \
288 THUMB( "2: "ins" %1, [%2]\n" ) \
289 THUMB( " add %2, %2, #1\n" ) \
290 " mov %1, %1, "NEXT_BYTE"\n" \
291 ARM( "3: "ins" %1, [%2], #1\n" ) \
292 THUMB( "3: "ins" %1, [%2]\n" ) \
293 THUMB( " add %2, %2, #1\n" ) \
294 " mov %1, %1, "NEXT_BYTE"\n" \
295 "4: "ins" %1, [%2]\n" \
296 "5:\n" \
297 " .pushsection .text.fixup,\"ax\"\n" \
298 " .align 2\n" \
299 "6: mov %0, #1\n" \
300 " b 5b\n" \
301 " .popsection\n" \
302 " ex_entry 1b, 6b\n" \
303 " ex_entry 2b, 6b\n" \
304 " ex_entry 3b, 6b\n" \
305 " ex_entry 4b, 6b\n" \
306 : "=r" (err), "=&r" (v), "=&r" (a) \
307 : "0" (err), "1" (v), "2" (a)); \
308 if (err) \
309 goto fault; \
310 } while (0)
311
312 #define put32_unaligned_check(val,addr) \
313 __put32_unaligned_check("strb", val, addr)
314
315 #define put32t_unaligned_check(val,addr) \
316 __put32_unaligned_check("strbt", val, addr)
317
318 static void
do_alignment_finish_ldst(unsigned long addr,u32 instr,struct pt_regs * regs,union offset_union offset)319 do_alignment_finish_ldst(unsigned long addr, u32 instr, struct pt_regs *regs, union offset_union offset)
320 {
321 if (!LDST_U_BIT(instr))
322 offset.un = -offset.un;
323
324 if (!LDST_P_BIT(instr))
325 addr += offset.un;
326
327 if (!LDST_P_BIT(instr) || LDST_W_BIT(instr))
328 regs->uregs[RN_BITS(instr)] = addr;
329 }
330
331 static int
do_alignment_ldrhstrh(unsigned long addr,u32 instr,struct pt_regs * regs)332 do_alignment_ldrhstrh(unsigned long addr, u32 instr, struct pt_regs *regs)
333 {
334 unsigned int rd = RD_BITS(instr);
335
336 ai_half += 1;
337
338 if (user_mode(regs))
339 goto user;
340
341 if (LDST_L_BIT(instr)) {
342 unsigned long val;
343 get16_unaligned_check(val, addr);
344
345 /* signed half-word? */
346 if (instr & 0x40)
347 val = (signed long)((signed short) val);
348
349 regs->uregs[rd] = val;
350 } else
351 put16_unaligned_check(regs->uregs[rd], addr);
352
353 return TYPE_LDST;
354
355 user:
356 if (LDST_L_BIT(instr)) {
357 unsigned long val;
358 unsigned int __ua_flags = uaccess_save_and_enable();
359
360 get16t_unaligned_check(val, addr);
361 uaccess_restore(__ua_flags);
362
363 /* signed half-word? */
364 if (instr & 0x40)
365 val = (signed long)((signed short) val);
366
367 regs->uregs[rd] = val;
368 } else {
369 unsigned int __ua_flags = uaccess_save_and_enable();
370 put16t_unaligned_check(regs->uregs[rd], addr);
371 uaccess_restore(__ua_flags);
372 }
373
374 return TYPE_LDST;
375
376 fault:
377 return TYPE_FAULT;
378 }
379
380 static int
do_alignment_ldrdstrd(unsigned long addr,u32 instr,struct pt_regs * regs)381 do_alignment_ldrdstrd(unsigned long addr, u32 instr, struct pt_regs *regs)
382 {
383 unsigned int rd = RD_BITS(instr);
384 unsigned int rd2;
385 int load;
386
387 if ((instr & 0xfe000000) == 0xe8000000) {
388 /* ARMv7 Thumb-2 32-bit LDRD/STRD */
389 rd2 = (instr >> 8) & 0xf;
390 load = !!(LDST_L_BIT(instr));
391 } else if (((rd & 1) == 1) || (rd == 14))
392 goto bad;
393 else {
394 load = ((instr & 0xf0) == 0xd0);
395 rd2 = rd + 1;
396 }
397
398 ai_dword += 1;
399
400 if (user_mode(regs))
401 goto user;
402
403 if (load) {
404 unsigned long val;
405 get32_unaligned_check(val, addr);
406 regs->uregs[rd] = val;
407 get32_unaligned_check(val, addr + 4);
408 regs->uregs[rd2] = val;
409 } else {
410 put32_unaligned_check(regs->uregs[rd], addr);
411 put32_unaligned_check(regs->uregs[rd2], addr + 4);
412 }
413
414 return TYPE_LDST;
415
416 user:
417 if (load) {
418 unsigned long val, val2;
419 unsigned int __ua_flags = uaccess_save_and_enable();
420
421 get32t_unaligned_check(val, addr);
422 get32t_unaligned_check(val2, addr + 4);
423
424 uaccess_restore(__ua_flags);
425
426 regs->uregs[rd] = val;
427 regs->uregs[rd2] = val2;
428 } else {
429 unsigned int __ua_flags = uaccess_save_and_enable();
430 put32t_unaligned_check(regs->uregs[rd], addr);
431 put32t_unaligned_check(regs->uregs[rd2], addr + 4);
432 uaccess_restore(__ua_flags);
433 }
434
435 return TYPE_LDST;
436 bad:
437 return TYPE_ERROR;
438 fault:
439 return TYPE_FAULT;
440 }
441
442 static int
do_alignment_ldrstr(unsigned long addr,u32 instr,struct pt_regs * regs)443 do_alignment_ldrstr(unsigned long addr, u32 instr, struct pt_regs *regs)
444 {
445 unsigned int rd = RD_BITS(instr);
446
447 ai_word += 1;
448
449 if ((!LDST_P_BIT(instr) && LDST_W_BIT(instr)) || user_mode(regs))
450 goto trans;
451
452 if (LDST_L_BIT(instr)) {
453 unsigned int val;
454 get32_unaligned_check(val, addr);
455 regs->uregs[rd] = val;
456 } else
457 put32_unaligned_check(regs->uregs[rd], addr);
458 return TYPE_LDST;
459
460 trans:
461 if (LDST_L_BIT(instr)) {
462 unsigned int val;
463 unsigned int __ua_flags = uaccess_save_and_enable();
464 get32t_unaligned_check(val, addr);
465 uaccess_restore(__ua_flags);
466 regs->uregs[rd] = val;
467 } else {
468 unsigned int __ua_flags = uaccess_save_and_enable();
469 put32t_unaligned_check(regs->uregs[rd], addr);
470 uaccess_restore(__ua_flags);
471 }
472 return TYPE_LDST;
473
474 fault:
475 return TYPE_FAULT;
476 }
477
478 /*
479 * LDM/STM alignment handler.
480 *
481 * There are 4 variants of this instruction:
482 *
483 * B = rn pointer before instruction, A = rn pointer after instruction
484 * ------ increasing address ----->
485 * | | r0 | r1 | ... | rx | |
486 * PU = 01 B A
487 * PU = 11 B A
488 * PU = 00 A B
489 * PU = 10 A B
490 */
491 static int
do_alignment_ldmstm(unsigned long addr,u32 instr,struct pt_regs * regs)492 do_alignment_ldmstm(unsigned long addr, u32 instr, struct pt_regs *regs)
493 {
494 unsigned int rd, rn, correction, nr_regs, regbits;
495 unsigned long eaddr, newaddr;
496
497 if (LDM_S_BIT(instr))
498 goto bad;
499
500 correction = 4; /* processor implementation defined */
501 regs->ARM_pc += correction;
502
503 ai_multi += 1;
504
505 /* count the number of registers in the mask to be transferred */
506 nr_regs = hweight16(REGMASK_BITS(instr)) * 4;
507
508 rn = RN_BITS(instr);
509 newaddr = eaddr = regs->uregs[rn];
510
511 if (!LDST_U_BIT(instr))
512 nr_regs = -nr_regs;
513 newaddr += nr_regs;
514 if (!LDST_U_BIT(instr))
515 eaddr = newaddr;
516
517 if (LDST_P_EQ_U(instr)) /* U = P */
518 eaddr += 4;
519
520 /*
521 * For alignment faults on the ARM922T/ARM920T the MMU makes
522 * the FSR (and hence addr) equal to the updated base address
523 * of the multiple access rather than the restored value.
524 * Switch this message off if we've got a ARM92[02], otherwise
525 * [ls]dm alignment faults are noisy!
526 */
527 #if !(defined CONFIG_CPU_ARM922T) && !(defined CONFIG_CPU_ARM920T)
528 /*
529 * This is a "hint" - we already have eaddr worked out by the
530 * processor for us.
531 */
532 if (addr != eaddr) {
533 pr_err("LDMSTM: PC = %08lx, instr = %08x, "
534 "addr = %08lx, eaddr = %08lx\n",
535 instruction_pointer(regs), instr, addr, eaddr);
536 show_regs(regs);
537 }
538 #endif
539
540 if (user_mode(regs)) {
541 unsigned int __ua_flags = uaccess_save_and_enable();
542 for (regbits = REGMASK_BITS(instr), rd = 0; regbits;
543 regbits >>= 1, rd += 1)
544 if (regbits & 1) {
545 if (LDST_L_BIT(instr)) {
546 unsigned int val;
547 get32t_unaligned_check(val, eaddr);
548 regs->uregs[rd] = val;
549 } else
550 put32t_unaligned_check(regs->uregs[rd], eaddr);
551 eaddr += 4;
552 }
553 uaccess_restore(__ua_flags);
554 } else {
555 for (regbits = REGMASK_BITS(instr), rd = 0; regbits;
556 regbits >>= 1, rd += 1)
557 if (regbits & 1) {
558 if (LDST_L_BIT(instr)) {
559 unsigned int val;
560 get32_unaligned_check(val, eaddr);
561 regs->uregs[rd] = val;
562 } else
563 put32_unaligned_check(regs->uregs[rd], eaddr);
564 eaddr += 4;
565 }
566 }
567
568 if (LDST_W_BIT(instr))
569 regs->uregs[rn] = newaddr;
570 if (!LDST_L_BIT(instr) || !(REGMASK_BITS(instr) & (1 << 15)))
571 regs->ARM_pc -= correction;
572 return TYPE_DONE;
573
574 fault:
575 regs->ARM_pc -= correction;
576 return TYPE_FAULT;
577
578 bad:
579 pr_err("Alignment trap: not handling ldm with s-bit set\n");
580 return TYPE_ERROR;
581 }
582
583 /*
584 * Convert Thumb ld/st instruction forms to equivalent ARM instructions so
585 * we can reuse ARM userland alignment fault fixups for Thumb.
586 *
587 * This implementation was initially based on the algorithm found in
588 * gdb/sim/arm/thumbemu.c. It is basically just a code reduction of same
589 * to convert only Thumb ld/st instruction forms to equivalent ARM forms.
590 *
591 * NOTES:
592 * 1. Comments below refer to ARM ARM DDI0100E Thumb Instruction sections.
593 * 2. If for some reason we're passed an non-ld/st Thumb instruction to
594 * decode, we return 0xdeadc0de. This should never happen under normal
595 * circumstances but if it does, we've got other problems to deal with
596 * elsewhere and we obviously can't fix those problems here.
597 */
598
599 static unsigned long
thumb2arm(u16 tinstr)600 thumb2arm(u16 tinstr)
601 {
602 u32 L = (tinstr & (1<<11)) >> 11;
603
604 switch ((tinstr & 0xf800) >> 11) {
605 /* 6.5.1 Format 1: */
606 case 0x6000 >> 11: /* 7.1.52 STR(1) */
607 case 0x6800 >> 11: /* 7.1.26 LDR(1) */
608 case 0x7000 >> 11: /* 7.1.55 STRB(1) */
609 case 0x7800 >> 11: /* 7.1.30 LDRB(1) */
610 return 0xe5800000 |
611 ((tinstr & (1<<12)) << (22-12)) | /* fixup */
612 (L<<20) | /* L==1? */
613 ((tinstr & (7<<0)) << (12-0)) | /* Rd */
614 ((tinstr & (7<<3)) << (16-3)) | /* Rn */
615 ((tinstr & (31<<6)) >> /* immed_5 */
616 (6 - ((tinstr & (1<<12)) ? 0 : 2)));
617 case 0x8000 >> 11: /* 7.1.57 STRH(1) */
618 case 0x8800 >> 11: /* 7.1.32 LDRH(1) */
619 return 0xe1c000b0 |
620 (L<<20) | /* L==1? */
621 ((tinstr & (7<<0)) << (12-0)) | /* Rd */
622 ((tinstr & (7<<3)) << (16-3)) | /* Rn */
623 ((tinstr & (7<<6)) >> (6-1)) | /* immed_5[2:0] */
624 ((tinstr & (3<<9)) >> (9-8)); /* immed_5[4:3] */
625
626 /* 6.5.1 Format 2: */
627 case 0x5000 >> 11:
628 case 0x5800 >> 11:
629 {
630 static const u32 subset[8] = {
631 0xe7800000, /* 7.1.53 STR(2) */
632 0xe18000b0, /* 7.1.58 STRH(2) */
633 0xe7c00000, /* 7.1.56 STRB(2) */
634 0xe19000d0, /* 7.1.34 LDRSB */
635 0xe7900000, /* 7.1.27 LDR(2) */
636 0xe19000b0, /* 7.1.33 LDRH(2) */
637 0xe7d00000, /* 7.1.31 LDRB(2) */
638 0xe19000f0 /* 7.1.35 LDRSH */
639 };
640 return subset[(tinstr & (7<<9)) >> 9] |
641 ((tinstr & (7<<0)) << (12-0)) | /* Rd */
642 ((tinstr & (7<<3)) << (16-3)) | /* Rn */
643 ((tinstr & (7<<6)) >> (6-0)); /* Rm */
644 }
645
646 /* 6.5.1 Format 3: */
647 case 0x4800 >> 11: /* 7.1.28 LDR(3) */
648 /* NOTE: This case is not technically possible. We're
649 * loading 32-bit memory data via PC relative
650 * addressing mode. So we can and should eliminate
651 * this case. But I'll leave it here for now.
652 */
653 return 0xe59f0000 |
654 ((tinstr & (7<<8)) << (12-8)) | /* Rd */
655 ((tinstr & 255) << (2-0)); /* immed_8 */
656
657 /* 6.5.1 Format 4: */
658 case 0x9000 >> 11: /* 7.1.54 STR(3) */
659 case 0x9800 >> 11: /* 7.1.29 LDR(4) */
660 return 0xe58d0000 |
661 (L<<20) | /* L==1? */
662 ((tinstr & (7<<8)) << (12-8)) | /* Rd */
663 ((tinstr & 255) << 2); /* immed_8 */
664
665 /* 6.6.1 Format 1: */
666 case 0xc000 >> 11: /* 7.1.51 STMIA */
667 case 0xc800 >> 11: /* 7.1.25 LDMIA */
668 {
669 u32 Rn = (tinstr & (7<<8)) >> 8;
670 u32 W = ((L<<Rn) & (tinstr&255)) ? 0 : 1<<21;
671
672 return 0xe8800000 | W | (L<<20) | (Rn<<16) |
673 (tinstr&255);
674 }
675
676 /* 6.6.1 Format 2: */
677 case 0xb000 >> 11: /* 7.1.48 PUSH */
678 case 0xb800 >> 11: /* 7.1.47 POP */
679 if ((tinstr & (3 << 9)) == 0x0400) {
680 static const u32 subset[4] = {
681 0xe92d0000, /* STMDB sp!,{registers} */
682 0xe92d4000, /* STMDB sp!,{registers,lr} */
683 0xe8bd0000, /* LDMIA sp!,{registers} */
684 0xe8bd8000 /* LDMIA sp!,{registers,pc} */
685 };
686 return subset[(L<<1) | ((tinstr & (1<<8)) >> 8)] |
687 (tinstr & 255); /* register_list */
688 }
689 fallthrough; /* for illegal instruction case */
690
691 default:
692 return BAD_INSTR;
693 }
694 }
695
696 /*
697 * Convert Thumb-2 32 bit LDM, STM, LDRD, STRD to equivalent instruction
698 * handlable by ARM alignment handler, also find the corresponding handler,
699 * so that we can reuse ARM userland alignment fault fixups for Thumb.
700 *
701 * @pinstr: original Thumb-2 instruction; returns new handlable instruction
702 * @regs: register context.
703 * @poffset: return offset from faulted addr for later writeback
704 *
705 * NOTES:
706 * 1. Comments below refer to ARMv7 DDI0406A Thumb Instruction sections.
707 * 2. Register name Rt from ARMv7 is same as Rd from ARMv6 (Rd is Rt)
708 */
709 static void *
do_alignment_t32_to_handler(u32 * pinstr,struct pt_regs * regs,union offset_union * poffset)710 do_alignment_t32_to_handler(u32 *pinstr, struct pt_regs *regs,
711 union offset_union *poffset)
712 {
713 u32 instr = *pinstr;
714 u16 tinst1 = (instr >> 16) & 0xffff;
715 u16 tinst2 = instr & 0xffff;
716
717 switch (tinst1 & 0xffe0) {
718 /* A6.3.5 Load/Store multiple */
719 case 0xe880: /* STM/STMIA/STMEA,LDM/LDMIA, PUSH/POP T2 */
720 case 0xe8a0: /* ...above writeback version */
721 case 0xe900: /* STMDB/STMFD, LDMDB/LDMEA */
722 case 0xe920: /* ...above writeback version */
723 /* no need offset decision since handler calculates it */
724 return do_alignment_ldmstm;
725
726 case 0xf840: /* POP/PUSH T3 (single register) */
727 if (RN_BITS(instr) == 13 && (tinst2 & 0x09ff) == 0x0904) {
728 u32 L = !!(LDST_L_BIT(instr));
729 const u32 subset[2] = {
730 0xe92d0000, /* STMDB sp!,{registers} */
731 0xe8bd0000, /* LDMIA sp!,{registers} */
732 };
733 *pinstr = subset[L] | (1<<RD_BITS(instr));
734 return do_alignment_ldmstm;
735 }
736 /* Else fall through for illegal instruction case */
737 break;
738
739 /* A6.3.6 Load/store double, STRD/LDRD(immed, lit, reg) */
740 case 0xe860:
741 case 0xe960:
742 case 0xe8e0:
743 case 0xe9e0:
744 poffset->un = (tinst2 & 0xff) << 2;
745 fallthrough;
746
747 case 0xe940:
748 case 0xe9c0:
749 return do_alignment_ldrdstrd;
750
751 /*
752 * No need to handle load/store instructions up to word size
753 * since ARMv6 and later CPUs can perform unaligned accesses.
754 */
755 default:
756 break;
757 }
758 return NULL;
759 }
760
alignment_get_arm(struct pt_regs * regs,u32 * ip,u32 * inst)761 static int alignment_get_arm(struct pt_regs *regs, u32 *ip, u32 *inst)
762 {
763 u32 instr = 0;
764 int fault;
765
766 if (user_mode(regs))
767 fault = get_user(instr, ip);
768 else
769 fault = get_kernel_nofault(instr, ip);
770
771 *inst = __mem_to_opcode_arm(instr);
772
773 return fault;
774 }
775
alignment_get_thumb(struct pt_regs * regs,u16 * ip,u16 * inst)776 static int alignment_get_thumb(struct pt_regs *regs, u16 *ip, u16 *inst)
777 {
778 u16 instr = 0;
779 int fault;
780
781 if (user_mode(regs))
782 fault = get_user(instr, ip);
783 else
784 fault = get_kernel_nofault(instr, ip);
785
786 *inst = __mem_to_opcode_thumb16(instr);
787
788 return fault;
789 }
790
791 static int
do_alignment(unsigned long addr,unsigned int fsr,struct pt_regs * regs)792 do_alignment(unsigned long addr, unsigned int fsr, struct pt_regs *regs)
793 {
794 union offset_union offset;
795 unsigned long instrptr;
796 int (*handler)(unsigned long addr, u32 instr, struct pt_regs *regs);
797 unsigned int type;
798 u32 instr = 0;
799 u16 tinstr = 0;
800 int isize = 4;
801 int thumb2_32b = 0;
802 int fault;
803
804 if (interrupts_enabled(regs))
805 local_irq_enable();
806
807 instrptr = instruction_pointer(regs);
808
809 if (thumb_mode(regs)) {
810 u16 *ptr = (u16 *)(instrptr & ~1);
811
812 fault = alignment_get_thumb(regs, ptr, &tinstr);
813 if (!fault) {
814 if (cpu_architecture() >= CPU_ARCH_ARMv7 &&
815 IS_T32(tinstr)) {
816 /* Thumb-2 32-bit */
817 u16 tinst2;
818 fault = alignment_get_thumb(regs, ptr + 1, &tinst2);
819 instr = __opcode_thumb32_compose(tinstr, tinst2);
820 thumb2_32b = 1;
821 } else {
822 isize = 2;
823 instr = thumb2arm(tinstr);
824 }
825 }
826 } else {
827 fault = alignment_get_arm(regs, (void *)instrptr, &instr);
828 }
829
830 if (fault) {
831 type = TYPE_FAULT;
832 goto bad_or_fault;
833 }
834
835 if (user_mode(regs))
836 goto user;
837
838 ai_sys += 1;
839 ai_sys_last_pc = (void *)instruction_pointer(regs);
840
841 fixup:
842
843 regs->ARM_pc += isize;
844
845 switch (CODING_BITS(instr)) {
846 case 0x00000000: /* 3.13.4 load/store instruction extensions */
847 if (LDSTHD_I_BIT(instr))
848 offset.un = (instr & 0xf00) >> 4 | (instr & 15);
849 else
850 offset.un = regs->uregs[RM_BITS(instr)];
851
852 if ((instr & 0x000000f0) == 0x000000b0 || /* LDRH, STRH */
853 (instr & 0x001000f0) == 0x001000f0) /* LDRSH */
854 handler = do_alignment_ldrhstrh;
855 else if ((instr & 0x001000f0) == 0x000000d0 || /* LDRD */
856 (instr & 0x001000f0) == 0x000000f0) /* STRD */
857 handler = do_alignment_ldrdstrd;
858 else if ((instr & 0x01f00ff0) == 0x01000090) /* SWP */
859 goto swp;
860 else
861 goto bad;
862 break;
863
864 case 0x04000000: /* ldr or str immediate */
865 if (COND_BITS(instr) == 0xf0000000) /* NEON VLDn, VSTn */
866 goto bad;
867 offset.un = OFFSET_BITS(instr);
868 handler = do_alignment_ldrstr;
869 break;
870
871 case 0x06000000: /* ldr or str register */
872 offset.un = regs->uregs[RM_BITS(instr)];
873
874 if (IS_SHIFT(instr)) {
875 unsigned int shiftval = SHIFT_BITS(instr);
876
877 switch(SHIFT_TYPE(instr)) {
878 case SHIFT_LSL:
879 offset.un <<= shiftval;
880 break;
881
882 case SHIFT_LSR:
883 offset.un >>= shiftval;
884 break;
885
886 case SHIFT_ASR:
887 offset.sn >>= shiftval;
888 break;
889
890 case SHIFT_RORRRX:
891 if (shiftval == 0) {
892 offset.un >>= 1;
893 if (regs->ARM_cpsr & PSR_C_BIT)
894 offset.un |= 1 << 31;
895 } else
896 offset.un = offset.un >> shiftval |
897 offset.un << (32 - shiftval);
898 break;
899 }
900 }
901 handler = do_alignment_ldrstr;
902 break;
903
904 case 0x08000000: /* ldm or stm, or thumb-2 32bit instruction */
905 if (thumb2_32b) {
906 offset.un = 0;
907 handler = do_alignment_t32_to_handler(&instr, regs, &offset);
908 } else {
909 offset.un = 0;
910 handler = do_alignment_ldmstm;
911 }
912 break;
913
914 default:
915 goto bad;
916 }
917
918 if (!handler)
919 goto bad;
920 type = handler(addr, instr, regs);
921
922 if (type == TYPE_ERROR || type == TYPE_FAULT) {
923 regs->ARM_pc -= isize;
924 goto bad_or_fault;
925 }
926
927 if (type == TYPE_LDST)
928 do_alignment_finish_ldst(addr, instr, regs, offset);
929
930 if (thumb_mode(regs))
931 regs->ARM_cpsr = it_advance(regs->ARM_cpsr);
932
933 return 0;
934
935 bad_or_fault:
936 if (type == TYPE_ERROR)
937 goto bad;
938 /*
939 * We got a fault - fix it up, or die.
940 */
941 do_bad_area(addr, fsr, regs);
942 return 0;
943
944 swp:
945 pr_err("Alignment trap: not handling swp instruction\n");
946
947 bad:
948 /*
949 * Oops, we didn't handle the instruction.
950 */
951 pr_err("Alignment trap: not handling instruction "
952 "%0*x at [<%08lx>]\n",
953 isize << 1,
954 isize == 2 ? tinstr : instr, instrptr);
955 ai_skipped += 1;
956 return 1;
957
958 user:
959 ai_user += 1;
960
961 if (ai_usermode & UM_WARN)
962 printk("Alignment trap: %s (%d) PC=0x%08lx Instr=0x%0*x "
963 "Address=0x%08lx FSR 0x%03x\n", current->comm,
964 task_pid_nr(current), instrptr,
965 isize << 1,
966 isize == 2 ? tinstr : instr,
967 addr, fsr);
968
969 if (ai_usermode & UM_FIXUP)
970 goto fixup;
971
972 if (ai_usermode & UM_SIGNAL) {
973 force_sig_fault(SIGBUS, BUS_ADRALN, (void __user *)addr);
974 } else {
975 /*
976 * We're about to disable the alignment trap and return to
977 * user space. But if an interrupt occurs before actually
978 * reaching user space, then the IRQ vector entry code will
979 * notice that we were still in kernel space and therefore
980 * the alignment trap won't be re-enabled in that case as it
981 * is presumed to be always on from kernel space.
982 * Let's prevent that race by disabling interrupts here (they
983 * are disabled on the way back to user space anyway in
984 * entry-common.S) and disable the alignment trap only if
985 * there is no work pending for this thread.
986 */
987 raw_local_irq_disable();
988 if (!(current_thread_info()->flags & _TIF_WORK_MASK))
989 set_cr(cr_no_alignment);
990 }
991
992 return 0;
993 }
994
noalign_setup(char * __unused)995 static int __init noalign_setup(char *__unused)
996 {
997 set_cr(__clear_cr(CR_A));
998 return 1;
999 }
1000 __setup("noalign", noalign_setup);
1001
1002 /*
1003 * This needs to be done after sysctl_init, otherwise sys/ will be
1004 * overwritten. Actually, this shouldn't be in sys/ at all since
1005 * it isn't a sysctl, and it doesn't contain sysctl information.
1006 * We now locate it in /proc/cpu/alignment instead.
1007 */
alignment_init(void)1008 static int __init alignment_init(void)
1009 {
1010 #ifdef CONFIG_PROC_FS
1011 struct proc_dir_entry *res;
1012
1013 res = proc_create("cpu/alignment", S_IWUSR | S_IRUGO, NULL,
1014 &alignment_proc_ops);
1015 if (!res)
1016 return -ENOMEM;
1017 #endif
1018
1019 if (cpu_is_v6_unaligned()) {
1020 set_cr(__clear_cr(CR_A));
1021 ai_usermode = safe_usermode(ai_usermode, false);
1022 }
1023
1024 cr_no_alignment = get_cr() & ~CR_A;
1025
1026 hook_fault_code(FAULT_CODE_ALIGNMENT, do_alignment, SIGBUS, BUS_ADRALN,
1027 "alignment exception");
1028
1029 /*
1030 * ARMv6K and ARMv7 use fault status 3 (0b00011) as Access Flag section
1031 * fault, not as alignment error.
1032 *
1033 * TODO: handle ARMv6K properly. Runtime check for 'K' extension is
1034 * needed.
1035 */
1036 if (cpu_architecture() <= CPU_ARCH_ARMv6) {
1037 hook_fault_code(3, do_alignment, SIGBUS, BUS_ADRALN,
1038 "alignment exception");
1039 }
1040
1041 return 0;
1042 }
1043
1044 fs_initcall(alignment_init);
1045