Linux Audio

Check our new training course

Loading...
v5.9
  1// SPDX-License-Identifier: GPL-2.0-only
  2#include <linux/extable.h>
  3#include <linux/uaccess.h>
  4#include <linux/sched/debug.h>
 
  5#include <xen/xen.h>
  6
  7#include <asm/fpu/internal.h>
 
 
  8#include <asm/traps.h>
  9#include <asm/kdebug.h>
 
 
 10
 11typedef bool (*ex_handler_t)(const struct exception_table_entry *,
 12			    struct pt_regs *, int, unsigned long,
 13			    unsigned long);
 
 
 
 
 
 
 
 14
 15static inline unsigned long
 16ex_fixup_addr(const struct exception_table_entry *x)
 17{
 18	return (unsigned long)&x->fixup + x->fixup;
 19}
 20static inline ex_handler_t
 21ex_fixup_handler(const struct exception_table_entry *x)
 22{
 23	return (ex_handler_t)((unsigned long)&x->handler + x->handler);
 24}
 25
 26__visible bool ex_handler_default(const struct exception_table_entry *fixup,
 27				  struct pt_regs *regs, int trapnr,
 28				  unsigned long error_code,
 29				  unsigned long fault_addr)
 30{
 31	regs->ip = ex_fixup_addr(fixup);
 
 
 
 
 
 32	return true;
 33}
 34EXPORT_SYMBOL(ex_handler_default);
 35
 36__visible bool ex_handler_fault(const struct exception_table_entry *fixup,
 37				struct pt_regs *regs, int trapnr,
 38				unsigned long error_code,
 39				unsigned long fault_addr)
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 40{
 41	regs->ip = ex_fixup_addr(fixup);
 42	regs->ax = trapnr;
 43	return true;
 
 
 
 
 
 
 
 44}
 45EXPORT_SYMBOL_GPL(ex_handler_fault);
 46
 47/*
 48 * Handler for when we fail to restore a task's FPU state.  We should never get
 49 * here because the FPU state of a task using the FPU (task->thread.fpu.state)
 50 * should always be valid.  However, past bugs have allowed userspace to set
 51 * reserved bits in the XSAVE area using PTRACE_SETREGSET or sys_rt_sigreturn().
 52 * These caused XRSTOR to fail when switching to the task, leaking the FPU
 53 * registers of the task previously executing on the CPU.  Mitigate this class
 54 * of vulnerability by restoring from the initial state (essentially, zeroing
 55 * out all the FPU registers) if we can't restore from the task's FPU state.
 56 */
 57__visible bool ex_handler_fprestore(const struct exception_table_entry *fixup,
 58				    struct pt_regs *regs, int trapnr,
 59				    unsigned long error_code,
 60				    unsigned long fault_addr)
 61{
 62	regs->ip = ex_fixup_addr(fixup);
 63
 64	WARN_ONCE(1, "Bad FPU state detected at %pB, reinitializing FPU registers.",
 65		  (void *)instruction_pointer(regs));
 66
 67	__copy_kernel_to_fpregs(&init_fpstate, -1);
 68	return true;
 69}
 70EXPORT_SYMBOL_GPL(ex_handler_fprestore);
 71
 72__visible bool ex_handler_uaccess(const struct exception_table_entry *fixup,
 73				  struct pt_regs *regs, int trapnr,
 74				  unsigned long error_code,
 75				  unsigned long fault_addr)
 
 
 
 
 
 
 76{
 77	WARN_ONCE(trapnr == X86_TRAP_GP, "General protection fault in user access. Non-canonical address?");
 78	regs->ip = ex_fixup_addr(fixup);
 79	return true;
 
 
 
 
 
 
 
 
 80}
 81EXPORT_SYMBOL(ex_handler_uaccess);
 82
 83__visible bool ex_handler_rdmsr_unsafe(const struct exception_table_entry *fixup,
 84				       struct pt_regs *regs, int trapnr,
 85				       unsigned long error_code,
 86				       unsigned long fault_addr)
 
 
 
 
 
 
 
 87{
 88	if (pr_warn_once("unchecked MSR access error: RDMSR from 0x%x at rIP: 0x%lx (%pS)\n",
 89			 (unsigned int)regs->cx, regs->ip, (void *)regs->ip))
 
 
 90		show_stack_regs(regs);
 
 91
 92	/* Pretend that the read succeeded and returned 0. */
 93	regs->ip = ex_fixup_addr(fixup);
 94	regs->ax = 0;
 95	regs->dx = 0;
 96	return true;
 97}
 98EXPORT_SYMBOL(ex_handler_rdmsr_unsafe);
 99
100__visible bool ex_handler_wrmsr_unsafe(const struct exception_table_entry *fixup,
101				       struct pt_regs *regs, int trapnr,
102				       unsigned long error_code,
103				       unsigned long fault_addr)
104{
105	if (pr_warn_once("unchecked MSR access error: WRMSR to 0x%x (tried to write 0x%08x%08x) at rIP: 0x%lx (%pS)\n",
106			 (unsigned int)regs->cx, (unsigned int)regs->dx,
107			 (unsigned int)regs->ax,  regs->ip, (void *)regs->ip))
108		show_stack_regs(regs);
 
109
110	/* Pretend that the write succeeded. */
111	regs->ip = ex_fixup_addr(fixup);
112	return true;
 
 
 
 
 
 
 
113}
114EXPORT_SYMBOL(ex_handler_wrmsr_unsafe);
115
116__visible bool ex_handler_clear_fs(const struct exception_table_entry *fixup,
117				   struct pt_regs *regs, int trapnr,
118				   unsigned long error_code,
119				   unsigned long fault_addr)
120{
121	if (static_cpu_has(X86_BUG_NULL_SEG))
122		asm volatile ("mov %0, %%fs" : : "rm" (__USER_DS));
123	asm volatile ("mov %0, %%fs" : : "rm" (0));
124	return ex_handler_default(fixup, regs, trapnr, error_code, fault_addr);
125}
126EXPORT_SYMBOL(ex_handler_clear_fs);
127
128__visible bool ex_has_fault_handler(unsigned long ip)
 
129{
130	const struct exception_table_entry *e;
131	ex_handler_t handler;
 
132
133	e = search_exception_tables(ip);
134	if (!e)
135		return false;
136	handler = ex_fixup_handler(e);
 
 
 
 
137
138	return handler == ex_handler_fault;
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
139}
140
141int fixup_exception(struct pt_regs *regs, int trapnr, unsigned long error_code,
142		    unsigned long fault_addr)
143{
144	const struct exception_table_entry *e;
145	ex_handler_t handler;
146
147#ifdef CONFIG_PNPBIOS
148	if (unlikely(SEGMENT_IS_PNP_CODE(regs->cs))) {
149		extern u32 pnp_bios_fault_eip, pnp_bios_fault_esp;
150		extern u32 pnp_bios_is_utter_crap;
151		pnp_bios_is_utter_crap = 1;
152		printk(KERN_CRIT "PNPBIOS fault.. attempting recovery.\n");
153		__asm__ volatile(
154			"movl %0, %%esp\n\t"
155			"jmp *%1\n\t"
156			: : "g" (pnp_bios_fault_esp), "g" (pnp_bios_fault_eip));
157		panic("do_trap: can't hit this");
158	}
159#endif
160
161	e = search_exception_tables(regs->ip);
162	if (!e)
163		return 0;
164
165	handler = ex_fixup_handler(e);
166	return handler(e, regs, trapnr, error_code, fault_addr);
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
167}
168
169extern unsigned int early_recursion_flag;
170
171/* Restricted version used during very early boot */
172void __init early_fixup_exception(struct pt_regs *regs, int trapnr)
173{
174	/* Ignore early NMIs. */
175	if (trapnr == X86_TRAP_NMI)
176		return;
177
178	if (early_recursion_flag > 2)
179		goto halt_loop;
180
181	/*
182	 * Old CPUs leave the high bits of CS on the stack
183	 * undefined.  I'm not sure which CPUs do this, but at least
184	 * the 486 DX works this way.
185	 * Xen pv domains are not using the default __KERNEL_CS.
186	 */
187	if (!xen_pv_domain() && regs->cs != __KERNEL_CS)
188		goto fail;
189
190	/*
191	 * The full exception fixup machinery is available as soon as
192	 * the early IDT is loaded.  This means that it is the
193	 * responsibility of extable users to either function correctly
194	 * when handlers are invoked early or to simply avoid causing
195	 * exceptions before they're ready to handle them.
196	 *
197	 * This is better than filtering which handlers can be used,
198	 * because refusing to call a handler here is guaranteed to
199	 * result in a hard-to-debug panic.
200	 *
201	 * Keep in mind that not all vectors actually get here.  Early
202	 * page faults, for example, are special.
203	 */
204	if (fixup_exception(regs, trapnr, regs->orig_ax, 0))
205		return;
206
207	if (trapnr == X86_TRAP_UD) {
208		if (report_bug(regs->ip, regs) == BUG_TRAP_TYPE_WARN) {
209			/* Skip the ud2. */
210			regs->ip += LEN_UD2;
211			return;
212		}
213
214		/*
215		 * If this was a BUG and report_bug returns or if this
216		 * was just a normal #UD, we want to continue onward and
217		 * crash.
218		 */
219	}
220
221fail:
222	early_printk("PANIC: early exception 0x%02x IP %lx:%lx error %lx cr2 0x%lx\n",
223		     (unsigned)trapnr, (unsigned long)regs->cs, regs->ip,
224		     regs->orig_ax, read_cr2());
225
226	show_regs(regs);
227
228halt_loop:
229	while (true)
230		halt();
231}
v6.13.7
  1// SPDX-License-Identifier: GPL-2.0-only
  2#include <linux/extable.h>
  3#include <linux/uaccess.h>
  4#include <linux/sched/debug.h>
  5#include <linux/bitfield.h>
  6#include <xen/xen.h>
  7
  8#include <asm/fpu/api.h>
  9#include <asm/fred.h>
 10#include <asm/sev.h>
 11#include <asm/traps.h>
 12#include <asm/kdebug.h>
 13#include <asm/insn-eval.h>
 14#include <asm/sgx.h>
 15
 16static inline unsigned long *pt_regs_nr(struct pt_regs *regs, int nr)
 17{
 18	int reg_offset = pt_regs_offset(regs, nr);
 19	static unsigned long __dummy;
 20
 21	if (WARN_ON_ONCE(reg_offset < 0))
 22		return &__dummy;
 23
 24	return (unsigned long *)((unsigned long)regs + reg_offset);
 25}
 26
 27static inline unsigned long
 28ex_fixup_addr(const struct exception_table_entry *x)
 29{
 30	return (unsigned long)&x->fixup + x->fixup;
 31}
 
 
 
 
 
 32
 33static bool ex_handler_default(const struct exception_table_entry *e,
 34			       struct pt_regs *regs)
 
 
 35{
 36	if (e->data & EX_FLAG_CLEAR_AX)
 37		regs->ax = 0;
 38	if (e->data & EX_FLAG_CLEAR_DX)
 39		regs->dx = 0;
 40
 41	regs->ip = ex_fixup_addr(e);
 42	return true;
 43}
 
 44
 45/*
 46 * This is the *very* rare case where we do a "load_unaligned_zeropad()"
 47 * and it's a page crosser into a non-existent page.
 48 *
 49 * This happens when we optimistically load a pathname a word-at-a-time
 50 * and the name is less than the full word and the  next page is not
 51 * mapped. Typically that only happens for CONFIG_DEBUG_PAGEALLOC.
 52 *
 53 * NOTE! The faulting address is always a 'mov mem,reg' type instruction
 54 * of size 'long', and the exception fixup must always point to right
 55 * after the instruction.
 56 */
 57static bool ex_handler_zeropad(const struct exception_table_entry *e,
 58			       struct pt_regs *regs,
 59			       unsigned long fault_addr)
 60{
 61	struct insn insn;
 62	const unsigned long mask = sizeof(long) - 1;
 63	unsigned long offset, addr, next_ip, len;
 64	unsigned long *reg;
 65
 66	next_ip = ex_fixup_addr(e);
 67	len = next_ip - regs->ip;
 68	if (len > MAX_INSN_SIZE)
 69		return false;
 70
 71	if (insn_decode(&insn, (void *) regs->ip, len, INSN_MODE_KERN))
 72		return false;
 73	if (insn.length != len)
 74		return false;
 75
 76	if (insn.opcode.bytes[0] != 0x8b)
 77		return false;
 78	if (insn.opnd_bytes != sizeof(long))
 79		return false;
 80
 81	addr = (unsigned long) insn_get_addr_ref(&insn, regs);
 82	if (addr == ~0ul)
 83		return false;
 84
 85	offset = addr & mask;
 86	addr = addr & ~mask;
 87	if (fault_addr != addr + sizeof(long))
 88		return false;
 89
 90	reg = insn_get_modrm_reg_ptr(&insn, regs);
 91	if (!reg)
 92		return false;
 93
 94	*reg = *(unsigned long *)addr >> (offset * 8);
 95	return ex_handler_default(e, regs);
 96}
 97
 98static bool ex_handler_fault(const struct exception_table_entry *fixup,
 99			     struct pt_regs *regs, int trapnr)
100{
 
101	regs->ax = trapnr;
102	return ex_handler_default(fixup, regs);
103}
104
105static bool ex_handler_sgx(const struct exception_table_entry *fixup,
106			   struct pt_regs *regs, int trapnr)
107{
108	regs->ax = trapnr | SGX_ENCLS_FAULT_FLAG;
109	return ex_handler_default(fixup, regs);
110}
 
111
112/*
113 * Handler for when we fail to restore a task's FPU state.  We should never get
114 * here because the FPU state of a task using the FPU (task->thread.fpu.state)
115 * should always be valid.  However, past bugs have allowed userspace to set
116 * reserved bits in the XSAVE area using PTRACE_SETREGSET or sys_rt_sigreturn().
117 * These caused XRSTOR to fail when switching to the task, leaking the FPU
118 * registers of the task previously executing on the CPU.  Mitigate this class
119 * of vulnerability by restoring from the initial state (essentially, zeroing
120 * out all the FPU registers) if we can't restore from the task's FPU state.
121 */
122static bool ex_handler_fprestore(const struct exception_table_entry *fixup,
123				 struct pt_regs *regs)
 
 
124{
125	regs->ip = ex_fixup_addr(fixup);
126
127	WARN_ONCE(1, "Bad FPU state detected at %pB, reinitializing FPU registers.",
128		  (void *)instruction_pointer(regs));
129
130	fpu_reset_from_exception_fixup();
131	return true;
132}
 
133
134/*
135 * On x86-64, we end up being imprecise with 'access_ok()', and allow
136 * non-canonical user addresses to make the range comparisons simpler,
137 * and to not have to worry about LAM being enabled.
138 *
139 * In fact, we allow up to one page of "slop" at the sign boundary,
140 * which means that we can do access_ok() by just checking the sign
141 * of the pointer for the common case of having a small access size.
142 */
143static bool gp_fault_address_ok(unsigned long fault_address)
144{
145#ifdef CONFIG_X86_64
146	/* Is it in the "user space" part of the non-canonical space? */
147	if (valid_user_address(fault_address))
148		return true;
149
150	/* .. or just above it? */
151	fault_address -= PAGE_SIZE;
152	if (valid_user_address(fault_address))
153		return true;
154#endif
155	return false;
156}
 
157
158static bool ex_handler_uaccess(const struct exception_table_entry *fixup,
159			       struct pt_regs *regs, int trapnr,
160			       unsigned long fault_address)
161{
162	WARN_ONCE(trapnr == X86_TRAP_GP && !gp_fault_address_ok(fault_address),
163		"General protection fault in user access. Non-canonical address?");
164	return ex_handler_default(fixup, regs);
165}
166
167static bool ex_handler_msr(const struct exception_table_entry *fixup,
168			   struct pt_regs *regs, bool wrmsr, bool safe, int reg)
169{
170	if (__ONCE_LITE_IF(!safe && wrmsr)) {
171		pr_warn("unchecked MSR access error: WRMSR to 0x%x (tried to write 0x%08x%08x) at rIP: 0x%lx (%pS)\n",
172			(unsigned int)regs->cx, (unsigned int)regs->dx,
173			(unsigned int)regs->ax,  regs->ip, (void *)regs->ip);
174		show_stack_regs(regs);
175	}
176
177	if (__ONCE_LITE_IF(!safe && !wrmsr)) {
178		pr_warn("unchecked MSR access error: RDMSR from 0x%x at rIP: 0x%lx (%pS)\n",
179			(unsigned int)regs->cx, regs->ip, (void *)regs->ip);
 
 
 
 
 
 
 
 
 
 
 
 
 
180		show_stack_regs(regs);
181	}
182
183	if (!wrmsr) {
184		/* Pretend that the read succeeded and returned 0. */
185		regs->ax = 0;
186		regs->dx = 0;
187	}
188
189	if (safe)
190		*pt_regs_nr(regs, reg) = -EIO;
191
192	return ex_handler_default(fixup, regs);
193}
 
194
195static bool ex_handler_clear_fs(const struct exception_table_entry *fixup,
196				struct pt_regs *regs)
 
 
197{
198	if (static_cpu_has(X86_BUG_NULL_SEG))
199		asm volatile ("mov %0, %%fs" : : "rm" (__USER_DS));
200	asm volatile ("mov %0, %%fs" : : "rm" (0));
201	return ex_handler_default(fixup, regs);
202}
 
203
204static bool ex_handler_imm_reg(const struct exception_table_entry *fixup,
205			       struct pt_regs *regs, int reg, int imm)
206{
207	*pt_regs_nr(regs, reg) = (long)imm;
208	return ex_handler_default(fixup, regs);
209}
210
211static bool ex_handler_ucopy_len(const struct exception_table_entry *fixup,
212				  struct pt_regs *regs, int trapnr,
213				  unsigned long fault_address,
214				  int reg, int imm)
215{
216	regs->cx = imm * regs->cx + *pt_regs_nr(regs, reg);
217	return ex_handler_uaccess(fixup, regs, trapnr, fault_address);
218}
219
220#ifdef CONFIG_X86_FRED
221static bool ex_handler_eretu(const struct exception_table_entry *fixup,
222			     struct pt_regs *regs, unsigned long error_code)
223{
224	struct pt_regs *uregs = (struct pt_regs *)(regs->sp - offsetof(struct pt_regs, orig_ax));
225	unsigned short ss = uregs->ss;
226	unsigned short cs = uregs->cs;
227
228	/*
229	 * Move the NMI bit from the invalid stack frame, which caused ERETU
230	 * to fault, to the fault handler's stack frame, thus to unblock NMI
231	 * with the fault handler's ERETS instruction ASAP if NMI is blocked.
232	 */
233	regs->fred_ss.nmi = uregs->fred_ss.nmi;
234
235	/*
236	 * Sync event information to uregs, i.e., the ERETU return frame, but
237	 * is it safe to write to the ERETU return frame which is just above
238	 * current event stack frame?
239	 *
240	 * The RSP used by FRED to push a stack frame is not the value in %rsp,
241	 * it is calculated from %rsp with the following 2 steps:
242	 * 1) RSP = %rsp - (IA32_FRED_CONFIG & 0x1c0)	// Reserve N*64 bytes
243	 * 2) RSP = RSP & ~0x3f		// Align to a 64-byte cache line
244	 * when an event delivery doesn't trigger a stack level change.
245	 *
246	 * Here is an example with N*64 (N=1) bytes reserved:
247	 *
248	 *  64-byte cache line ==>  ______________
249	 *                         |___Reserved___|
250	 *                         |__Event_data__|
251	 *                         |_____SS_______|
252	 *                         |_____RSP______|
253	 *                         |_____FLAGS____|
254	 *                         |_____CS_______|
255	 *                         |_____IP_______|
256	 *  64-byte cache line ==> |__Error_code__| <== ERETU return frame
257	 *                         |______________|
258	 *                         |______________|
259	 *                         |______________|
260	 *                         |______________|
261	 *                         |______________|
262	 *                         |______________|
263	 *                         |______________|
264	 *  64-byte cache line ==> |______________| <== RSP after step 1) and 2)
265	 *                         |___Reserved___|
266	 *                         |__Event_data__|
267	 *                         |_____SS_______|
268	 *                         |_____RSP______|
269	 *                         |_____FLAGS____|
270	 *                         |_____CS_______|
271	 *                         |_____IP_______|
272	 *  64-byte cache line ==> |__Error_code__| <== ERETS return frame
273	 *
274	 * Thus a new FRED stack frame will always be pushed below a previous
275	 * FRED stack frame ((N*64) bytes may be reserved between), and it is
276	 * safe to write to a previous FRED stack frame as they never overlap.
277	 */
278	fred_info(uregs)->edata = fred_event_data(regs);
279	uregs->ssx = regs->ssx;
280	uregs->fred_ss.ss = ss;
281	/* The NMI bit was moved away above */
282	uregs->fred_ss.nmi = 0;
283	uregs->csx = regs->csx;
284	uregs->fred_cs.sl = 0;
285	uregs->fred_cs.wfe = 0;
286	uregs->cs = cs;
287	uregs->orig_ax = error_code;
288
289	return ex_handler_default(fixup, regs);
290}
291#endif
292
293int ex_get_fixup_type(unsigned long ip)
294{
295	const struct exception_table_entry *e = search_exception_tables(ip);
296
297	return e ? FIELD_GET(EX_DATA_TYPE_MASK, e->data) : EX_TYPE_NONE;
298}
299
300int fixup_exception(struct pt_regs *regs, int trapnr, unsigned long error_code,
301		    unsigned long fault_addr)
302{
303	const struct exception_table_entry *e;
304	int type, reg, imm;
305
306#ifdef CONFIG_PNPBIOS
307	if (unlikely(SEGMENT_IS_PNP_CODE(regs->cs))) {
308		extern u32 pnp_bios_fault_eip, pnp_bios_fault_esp;
309		extern u32 pnp_bios_is_utter_crap;
310		pnp_bios_is_utter_crap = 1;
311		printk(KERN_CRIT "PNPBIOS fault.. attempting recovery.\n");
312		__asm__ volatile(
313			"movl %0, %%esp\n\t"
314			"jmp *%1\n\t"
315			: : "g" (pnp_bios_fault_esp), "g" (pnp_bios_fault_eip));
316		panic("do_trap: can't hit this");
317	}
318#endif
319
320	e = search_exception_tables(regs->ip);
321	if (!e)
322		return 0;
323
324	type = FIELD_GET(EX_DATA_TYPE_MASK, e->data);
325	reg  = FIELD_GET(EX_DATA_REG_MASK,  e->data);
326	imm  = FIELD_GET(EX_DATA_IMM_MASK,  e->data);
327
328	switch (type) {
329	case EX_TYPE_DEFAULT:
330	case EX_TYPE_DEFAULT_MCE_SAFE:
331		return ex_handler_default(e, regs);
332	case EX_TYPE_FAULT:
333	case EX_TYPE_FAULT_MCE_SAFE:
334		return ex_handler_fault(e, regs, trapnr);
335	case EX_TYPE_UACCESS:
336		return ex_handler_uaccess(e, regs, trapnr, fault_addr);
337	case EX_TYPE_CLEAR_FS:
338		return ex_handler_clear_fs(e, regs);
339	case EX_TYPE_FPU_RESTORE:
340		return ex_handler_fprestore(e, regs);
341	case EX_TYPE_BPF:
342		return ex_handler_bpf(e, regs);
343	case EX_TYPE_WRMSR:
344		return ex_handler_msr(e, regs, true, false, reg);
345	case EX_TYPE_RDMSR:
346		return ex_handler_msr(e, regs, false, false, reg);
347	case EX_TYPE_WRMSR_SAFE:
348		return ex_handler_msr(e, regs, true, true, reg);
349	case EX_TYPE_RDMSR_SAFE:
350		return ex_handler_msr(e, regs, false, true, reg);
351	case EX_TYPE_WRMSR_IN_MCE:
352		ex_handler_msr_mce(regs, true);
353		break;
354	case EX_TYPE_RDMSR_IN_MCE:
355		ex_handler_msr_mce(regs, false);
356		break;
357	case EX_TYPE_POP_REG:
358		regs->sp += sizeof(long);
359		fallthrough;
360	case EX_TYPE_IMM_REG:
361		return ex_handler_imm_reg(e, regs, reg, imm);
362	case EX_TYPE_FAULT_SGX:
363		return ex_handler_sgx(e, regs, trapnr);
364	case EX_TYPE_UCOPY_LEN:
365		return ex_handler_ucopy_len(e, regs, trapnr, fault_addr, reg, imm);
366	case EX_TYPE_ZEROPAD:
367		return ex_handler_zeropad(e, regs, fault_addr);
368#ifdef CONFIG_X86_FRED
369	case EX_TYPE_ERETU:
370		return ex_handler_eretu(e, regs, error_code);
371#endif
372	}
373	BUG();
374}
375
376extern unsigned int early_recursion_flag;
377
378/* Restricted version used during very early boot */
379void __init early_fixup_exception(struct pt_regs *regs, int trapnr)
380{
381	/* Ignore early NMIs. */
382	if (trapnr == X86_TRAP_NMI)
383		return;
384
385	if (early_recursion_flag > 2)
386		goto halt_loop;
387
388	/*
389	 * Old CPUs leave the high bits of CS on the stack
390	 * undefined.  I'm not sure which CPUs do this, but at least
391	 * the 486 DX works this way.
392	 * Xen pv domains are not using the default __KERNEL_CS.
393	 */
394	if (!xen_pv_domain() && regs->cs != __KERNEL_CS)
395		goto fail;
396
397	/*
398	 * The full exception fixup machinery is available as soon as
399	 * the early IDT is loaded.  This means that it is the
400	 * responsibility of extable users to either function correctly
401	 * when handlers are invoked early or to simply avoid causing
402	 * exceptions before they're ready to handle them.
403	 *
404	 * This is better than filtering which handlers can be used,
405	 * because refusing to call a handler here is guaranteed to
406	 * result in a hard-to-debug panic.
407	 *
408	 * Keep in mind that not all vectors actually get here.  Early
409	 * page faults, for example, are special.
410	 */
411	if (fixup_exception(regs, trapnr, regs->orig_ax, 0))
412		return;
413
414	if (trapnr == X86_TRAP_UD) {
415		if (report_bug(regs->ip, regs) == BUG_TRAP_TYPE_WARN) {
416			/* Skip the ud2. */
417			regs->ip += LEN_UD2;
418			return;
419		}
420
421		/*
422		 * If this was a BUG and report_bug returns or if this
423		 * was just a normal #UD, we want to continue onward and
424		 * crash.
425		 */
426	}
427
428fail:
429	early_printk("PANIC: early exception 0x%02x IP %lx:%lx error %lx cr2 0x%lx\n",
430		     (unsigned)trapnr, (unsigned long)regs->cs, regs->ip,
431		     regs->orig_ax, read_cr2());
432
433	show_regs(regs);
434
435halt_loop:
436	while (true)
437		halt();
438}