1 /* SPDX-License-Identifier: GPL-2.0-or-later */
4 * Copyright (C) 1995-1996 Gary Thomas (gdt@linuxppc.org)
5 * Rewritten by Cort Dougan (cort@cs.nmt.edu) for PReP
6 * Copyright (C) 1996 Cort Dougan <cort@cs.nmt.edu>
7 * Adapted for Power Macintosh by Paul Mackerras.
8 * Low-level exception handlers and MMU support
9 * rewritten by Paul Mackerras.
10 * Copyright (C) 1996 Paul Mackerras.
11 * MPC8xx modifications Copyright (C) 1997 Dan Malek (dmalek@jlc.net).
13 * This file contains the system call entry code, context switch
14 * code, and exception/interrupt return code for PowerPC.
17 #include <linux/errno.h>
18 #include <linux/err.h>
19 #include <asm/cache.h>
20 #include <asm/unistd.h>
21 #include <asm/processor.h>
24 #include <asm/thread_info.h>
25 #include <asm/code-patching-asm.h>
26 #include <asm/ppc_asm.h>
27 #include <asm/asm-offsets.h>
28 #include <asm/cputable.h>
29 #include <asm/firmware.h>
31 #include <asm/ptrace.h>
32 #include <asm/irqflags.h>
33 #include <asm/hw_irq.h>
34 #include <asm/context_tracking.h>
36 #include <asm/ppc-opcode.h>
37 #include <asm/barrier.h>
38 #include <asm/export.h>
39 #include <asm/asm-compat.h>
40 #ifdef CONFIG_PPC_BOOK3S
41 #include <asm/exception-64s.h>
43 #include <asm/exception-64e.h>
45 #include <asm/feature-fixups.h>
53 .tc sys_call_table[TC],sys_call_table
56 COMPAT_SYS_CALL_TABLE:
57 .tc compat_sys_call_table[TC],compat_sys_call_table
60 /* This value is used to mark exception frames on the stack. */
62 .tc ID_EXC_MARKER[TC],STACK_FRAME_REGS_MARKER
67 .globl system_call_common
69 #ifdef CONFIG_PPC_TRANSACTIONAL_MEM
71 extrdi. r10, r12, 1, (63-MSR_TS_T_LG) /* transaction active? */
73 END_FTR_SECTION_IFSET(CPU_FTR_TM)
75 _ASM_NOKPROBE_SYMBOL(system_call_common)
84 #ifdef CONFIG_PPC_FSL_BOOK3E
85 START_BTB_FLUSH_SECTION
92 /* Can we avoid saving r3-r8 in common case? */
99 /* Zero r9-r12, this should only be required when restoring all GPRs */
111 * This clears CR0.SO (bit 28), which is the error indication on
112 * return from this system call.
114 rldimi r12,r11,28,(63-28)
120 addi r10,r1,STACK_FRAME_OVERHEAD
121 ld r11,exception_marker@toc(r2)
122 std r11,-16(r10) /* "regshere" marker */
125 * RECONCILE_IRQ_STATE without calling trace_hardirqs_off(), which
126 * would clobber syscall parameters. Also we always enter with IRQs
127 * enabled and nothing pending. system_call_exception() will call
128 * trace_hardirqs_off().
130 li r11,IRQS_ALL_DISABLED
131 li r12,PACA_IRQ_HARD_DIS
132 stb r11,PACAIRQSOFTMASK(r13)
133 stb r12,PACAIRQHAPPENED(r13)
135 /* Calling convention has r9 = orig r0, r10 = regs */
137 bl system_call_exception
140 addi r4,r1,STACK_FRAME_OVERHEAD
141 bl syscall_exit_prepare
149 stdcx. r0,0,r1 /* to clear the reservation */
150 END_FTR_SECTION_IFCLR(CPU_FTR_STCX_CHECKS_ADDRESS)
157 bne .Lsyscall_restore_regs
158 /* Zero volatile regs that may contain sensitive kernel data */
171 .Lsyscall_restore_regs_cont:
175 END_FTR_SECTION_IFSET(CPU_FTR_HAS_PPR)
178 * We don't need to restore AMR on the way back to userspace for KUAP.
179 * The value of AMR only matters while we're in the kernel.
187 b . /* prevent speculative execution */
189 .Lsyscall_restore_regs:
198 b .Lsyscall_restore_regs_cont
200 #ifdef CONFIG_PPC_TRANSACTIONAL_MEM
202 /* Firstly we need to enable TM in the kernel */
205 rldimi r10, r9, MSR_TM_LG, 63-MSR_TM_LG
208 /* tabort, this dooms the transaction, nothing else */
209 li r9, (TM_CAUSE_SYSCALL|TM_CAUSE_PERSISTENT)
213 * Return directly to userspace. We have corrupted user register state,
214 * but userspace will never see that register state. Execution will
215 * resume after the tbegin of the aborted transaction with the
216 * checkpointed register state.
224 b . /* prevent speculative execution */
227 _GLOBAL(ret_from_fork)
233 _GLOBAL(ret_from_kernel_thread)
238 #ifdef PPC64_ELF_ABI_v2
245 #ifdef CONFIG_PPC_BOOK3E
246 /* Save non-volatile GPRs, if not already saved. */
255 _ASM_NOKPROBE_SYMBOL(save_nvgprs);
258 #ifdef CONFIG_PPC_BOOK3S_64
260 #define FLUSH_COUNT_CACHE \
262 patch_site 1b, patch__call_flush_count_cache
265 #define BCCTR_FLUSH .long 0x4c400420
274 .global flush_count_cache
276 /* Save LR into r9 */
279 // Flush the link stack
290 // If we're just flushing the link stack, return here
292 patch_site 3b patch__flush_link_stack_return
300 patch_site 2b patch__flush_count_cache_return
312 #define FLUSH_COUNT_CACHE
313 #endif /* CONFIG_PPC_BOOK3S_64 */
316 * This routine switches between two different tasks. The process
317 * state of one is saved on its kernel stack. Then the state
318 * of the other is restored from its kernel stack. The memory
319 * management hardware is updated to the second process's state.
320 * Finally, we can return to the second process, via interrupt_return.
321 * On entry, r3 points to the THREAD for the current task, r4
322 * points to the THREAD for the new task.
324 * Note: there are two ways to get to the "going out" portion
325 * of this code; either by coming in via the entry (_switch)
326 * or via "fork" which must set up an environment equivalent
327 * to the "_switch" path. If you change this you'll have to change
328 * the fork code also.
330 * The code which creates the new task context is in 'copy_thread'
331 * in arch/powerpc/kernel/process.c
337 stdu r1,-SWITCH_FRAME_SIZE(r1)
338 /* r3-r13 are caller saved -- Cort */
340 std r0,_NIP(r1) /* Return to switch caller */
343 std r1,KSP(r3) /* Set old stack pointer */
345 kuap_check_amr r9, r10
350 * On SMP kernels, care must be taken because a task may be
351 * scheduled off CPUx and on to CPUy. Memory ordering must be
354 * Cacheable stores on CPUx will be visible when the task is
355 * scheduled on CPUy by virtue of the core scheduler barriers
356 * (see "Notes on Program-Order guarantees on SMP systems." in
357 * kernel/sched/core.c).
359 * Uncacheable stores in the case of involuntary preemption must
360 * be taken care of. The smp_mb__before_spin_lock() in __schedule()
361 * is implemented as hwsync on powerpc, which orders MMIO too. So
362 * long as there is an hwsync in the context switch path, it will
363 * be executed on the source CPU after the task has performed
364 * all MMIO ops on that CPU, and on the destination CPU before the
365 * task performs any MMIO ops there.
369 * The kernel context switch path must contain a spin_lock,
370 * which contains larx/stcx, which will clear any reservation
371 * of the task being switched.
373 #ifdef CONFIG_PPC_BOOK3S
374 /* Cancel all explict user streams as they will have no use after context
375 * switch and will stop the HW from creating streams itself
377 DCBT_BOOK3S_STOP_ALL_STREAM_IDS(r6)
380 addi r6,r4,-THREAD /* Convert THREAD to 'current' */
381 std r6,PACACURRENT(r13) /* Set new 'current' */
382 #if defined(CONFIG_STACKPROTECTOR)
383 ld r6, TASK_CANARY(r6)
384 std r6, PACA_CANARY(r13)
387 ld r8,KSP(r4) /* new stack pointer */
388 #ifdef CONFIG_PPC_BOOK3S_64
389 BEGIN_MMU_FTR_SECTION
391 END_MMU_FTR_SECTION_IFSET(MMU_FTR_TYPE_RADIX)
393 clrrdi r6,r8,28 /* get its ESID */
394 clrrdi r9,r1,28 /* get current sp ESID */
396 clrrdi r6,r8,40 /* get its 1T ESID */
397 clrrdi r9,r1,40 /* get current sp 1T ESID */
398 ALT_MMU_FTR_SECTION_END_IFCLR(MMU_FTR_1T_SEGMENT)
399 clrldi. r0,r6,2 /* is new ESID c00000000? */
400 cmpd cr1,r6,r9 /* or is new ESID the same as current ESID? */
402 beq 2f /* if yes, don't slbie it */
404 /* Bolt in the new stack SLB entry */
405 ld r7,KSP_VSID(r4) /* Get new stack's VSID */
406 oris r0,r6,(SLB_ESID_V)@h
407 ori r0,r0,(SLB_NUM_BOLTED-1)@l
409 li r9,MMU_SEGSIZE_1T /* insert B field */
410 oris r6,r6,(MMU_SEGSIZE_1T << SLBIE_SSIZE_SHIFT)@h
411 rldimi r7,r9,SLB_VSID_SSIZE_SHIFT,0
412 END_MMU_FTR_SECTION_IFSET(MMU_FTR_1T_SEGMENT)
414 /* Update the last bolted SLB. No write barriers are needed
415 * here, provided we only update the current CPU's SLB shadow
418 ld r9,PACA_SLBSHADOWPTR(r13)
420 std r12,SLBSHADOW_STACKESID(r9) /* Clear ESID */
421 li r12,SLBSHADOW_STACKVSID
422 STDX_BE r7,r12,r9 /* Save VSID */
423 li r12,SLBSHADOW_STACKESID
424 STDX_BE r0,r12,r9 /* Save ESID */
426 /* No need to check for MMU_FTR_NO_SLBIE_B here, since when
427 * we have 1TB segments, the only CPUs known to have the errata
428 * only support less than 1TB of system memory and we'll never
429 * actually hit this code path.
435 slbie r6 /* Workaround POWER5 < DD2.1 issue */
436 END_FTR_SECTION_IFCLR(CPU_FTR_ARCH_207S)
440 #endif /* CONFIG_PPC_BOOK3S_64 */
442 clrrdi r7, r8, THREAD_SHIFT /* base of new stack */
443 /* Note: this uses SWITCH_FRAME_SIZE rather than INT_FRAME_SIZE
444 because we don't need to leave the 288-byte ABI gap at the
445 top of the kernel stack. */
446 addi r7,r7,THREAD_SIZE-SWITCH_FRAME_SIZE
449 * PMU interrupts in radix may come in here. They will use r1, not
450 * PACAKSAVE, so this stack switch will not cause a problem. They
451 * will store to the process stack, which may then be migrated to
452 * another CPU. However the rq lock release on this CPU paired with
453 * the rq lock acquire on the new CPU before the stack becomes
454 * active on the new CPU, will order those stores.
456 mr r1,r8 /* start using new stack pointer */
457 std r7,PACAKSAVE(r13)
462 /* r3-r13 are destroyed -- Cort */
465 /* convert old thread to its task_struct for return value */
467 ld r7,_NIP(r1) /* Return to _switch caller in new task */
469 addi r1,r1,SWITCH_FRAME_SIZE
472 #ifdef CONFIG_PPC_BOOK3S
474 * If MSR EE/RI was never enabled, IRQs not reconciled, NVGPRs not
475 * touched, no exit work created, then this can be used.
477 .balign IFETCH_ALIGN_BYTES
478 .globl fast_interrupt_return
479 fast_interrupt_return:
480 _ASM_NOKPROBE_SYMBOL(fast_interrupt_return)
481 kuap_check_amr r3, r4
484 bne .Lfast_user_interrupt_return
487 li r3,0 /* 0 return value, no EMULATE_STACK_STORE */
488 bne+ .Lfast_kernel_interrupt_return
489 addi r3,r1,STACK_FRAME_OVERHEAD
490 bl unrecoverable_exception
491 b . /* should not get here */
493 .balign IFETCH_ALIGN_BYTES
494 .globl interrupt_return
496 _ASM_NOKPROBE_SYMBOL(interrupt_return)
499 beq .Lkernel_interrupt_return
500 addi r3,r1,STACK_FRAME_OVERHEAD
501 bl interrupt_exit_user_prepare
503 bne- .Lrestore_nvgprs
505 .Lfast_user_interrupt_return:
511 END_FTR_SECTION_IFSET(CPU_FTR_HAS_PPR)
516 stdcx. r0,0,r1 /* to clear the reservation */
519 ALT_FTR_SECTION_END_IFCLR(CPU_FTR_STCX_CHECKS_ADDRESS)
541 b . /* prevent speculative execution */
545 b .Lfast_user_interrupt_return
547 .balign IFETCH_ALIGN_BYTES
548 .Lkernel_interrupt_return:
549 addi r3,r1,STACK_FRAME_OVERHEAD
550 bl interrupt_exit_kernel_prepare
552 .Lfast_kernel_interrupt_return:
560 stdcx. r0,0,r1 /* to clear the reservation */
563 ALT_FTR_SECTION_END_IFCLR(CPU_FTR_STCX_CHECKS_ADDRESS)
579 * Leaving a stale exception_marker on the stack can confuse
580 * the reliable stack unwinder later on. Clear it.
582 std r0,STACK_FRAME_OVERHEAD-16(r1)
586 bne- cr1,1f /* emulate stack store */
592 b . /* prevent speculative execution */
595 * Emulate stack store with update. New r1 value was already calculated
596 * and updated in our interrupt regs by emulate_loadstore, but we can't
597 * store the previous value of r1 to the stack before re-loading our
598 * registers from it, otherwise they could be clobbered. Use
599 * PACA_EXGEN as temporary storage to hold the store data, as
600 * interrupts are disabled here so it won't be clobbered.
603 std r9,PACA_EXGEN+0(r13)
604 addi r9,r1,INT_FRAME_SIZE /* get original r1 */
608 std r9,0(r1) /* perform store component of stdu */
609 ld r9,PACA_EXGEN+0(r13)
612 b . /* prevent speculative execution */
613 #endif /* CONFIG_PPC_BOOK3S */
615 #ifdef CONFIG_PPC_RTAS
617 * On CHRP, the Run-Time Abstraction Services (RTAS) have to be
618 * called with the MMU off.
620 * In addition, we need to be in 32b mode, at least for now.
622 * Note: r3 is an input parameter to rtas, so don't trash it...
627 stdu r1,-SWITCH_FRAME_SIZE(r1) /* Save SP and create stack space. */
629 /* Because RTAS is running in 32b mode, it clobbers the high order half
630 * of all registers that it saves. We therefore save those registers
631 * RTAS might touch to the stack. (r0, r3-r13 are caller saved)
633 SAVE_GPR(2, r1) /* Save the TOC */
634 SAVE_GPR(13, r1) /* Save paca */
635 SAVE_NVGPRS(r1) /* Save the non-volatiles */
648 /* Temporary workaround to clear CR until RTAS can be modified to
655 /* There is no way it is acceptable to get here with interrupts enabled,
656 * check it with the asm equivalent of WARN_ON
658 lbz r0,PACAIRQSOFTMASK(r13)
659 1: tdeqi r0,IRQS_ENABLED
660 EMIT_BUG_ENTRY 1b,__FILE__,__LINE__,BUGFLAG_WARNING
663 /* Hard-disable interrupts */
669 /* Unfortunately, the stack pointer and the MSR are also clobbered,
670 * so they are saved in the PACA which allows us to restore
671 * our original state after RTAS returns.
674 std r6,PACASAVEDMSR(r13)
676 /* Setup our real return addr */
677 LOAD_REG_ADDR(r4,rtas_return_loc)
678 clrldi r4,r4,2 /* convert to realmode address */
682 ori r0,r0,MSR_EE|MSR_SE|MSR_BE|MSR_RI
686 rldicr r9,r9,MSR_SF_LG,(63-MSR_SF_LG)
687 ori r9,r9,MSR_IR|MSR_DR|MSR_FE0|MSR_FE1|MSR_FP|MSR_RI|MSR_LE
691 sync /* disable interrupts so SRR0/1 */
692 mtmsrd r0 /* don't get trashed */
694 LOAD_REG_ADDR(r4, rtas)
695 ld r5,RTASENTRY(r4) /* get the rtas->entry value */
696 ld r4,RTASBASE(r4) /* get the rtas->base value */
701 b . /* prevent speculative execution */
707 * Clear RI and set SF before anything.
712 sldi r0,r0,(MSR_SF_LG - MSR_RI_LG)
717 /* relocation is off at this point */
719 clrldi r4,r4,2 /* convert to realmode address */
723 ld r3,(1f-0b)(r3) /* get &rtas_restore_regs */
725 ld r1,PACAR1(r4) /* Restore our SP */
726 ld r4,PACASAVEDMSR(r4) /* Restore our MSR */
731 b . /* prevent speculative execution */
732 _ASM_NOKPROBE_SYMBOL(__enter_rtas)
733 _ASM_NOKPROBE_SYMBOL(rtas_return_loc)
736 1: .8byte rtas_restore_regs
739 /* relocation is on at this point */
740 REST_GPR(2, r1) /* Restore the TOC */
741 REST_GPR(13, r1) /* Restore paca */
742 REST_NVGPRS(r1) /* Restore the non-volatiles */
757 addi r1,r1,SWITCH_FRAME_SIZE /* Unstack our frame */
758 ld r0,16(r1) /* get return address */
761 blr /* return to caller */
763 #endif /* CONFIG_PPC_RTAS */
768 stdu r1,-SWITCH_FRAME_SIZE(r1) /* Save SP and create stack space */
770 /* Because PROM is running in 32b mode, it clobbers the high order half
771 * of all registers that it saves. We therefore save those registers
772 * PROM might touch to the stack. (r0, r3-r13 are caller saved)
782 /* Put PROM address in SRR0 */
785 /* Setup our trampoline return addr in LR */
791 /* Prepare a 32-bit mode big endian MSR
793 #ifdef CONFIG_PPC_BOOK3E
794 rlwinm r11,r11,0,1,31
797 #else /* CONFIG_PPC_BOOK3E */
798 LOAD_REG_IMMEDIATE(r12, MSR_SF | MSR_ISF | MSR_LE)
802 #endif /* CONFIG_PPC_BOOK3E */
804 1: /* Return from OF */
807 /* Just make sure that r1 top 32 bits didn't get
812 /* Restore the MSR (back to 64 bits) */
817 /* Restore other registers */
824 addi r1,r1,SWITCH_FRAME_SIZE