xref: /openbmc/linux/arch/arm64/kernel/entry.S (revision 0d07cf5e)
1/* SPDX-License-Identifier: GPL-2.0-only */
2/*
3 * Low-level exception handling code
4 *
5 * Copyright (C) 2012 ARM Ltd.
6 * Authors:	Catalin Marinas <catalin.marinas@arm.com>
7 *		Will Deacon <will.deacon@arm.com>
8 */
9
10#include <linux/arm-smccc.h>
11#include <linux/init.h>
12#include <linux/linkage.h>
13
14#include <asm/alternative.h>
15#include <asm/assembler.h>
16#include <asm/asm-offsets.h>
17#include <asm/cpufeature.h>
18#include <asm/errno.h>
19#include <asm/esr.h>
20#include <asm/irq.h>
21#include <asm/memory.h>
22#include <asm/mmu.h>
23#include <asm/processor.h>
24#include <asm/ptrace.h>
25#include <asm/thread_info.h>
26#include <asm/asm-uaccess.h>
27#include <asm/unistd.h>
28
29/*
30 * Context tracking subsystem.  Used to instrument transitions
31 * between user and kernel mode.
32 */
33	.macro ct_user_exit
34#ifdef CONFIG_CONTEXT_TRACKING
35	bl	context_tracking_user_exit
36#endif
37	.endm
38
39	.macro ct_user_enter
40#ifdef CONFIG_CONTEXT_TRACKING
41	bl	context_tracking_user_enter
42#endif
43	.endm
44
45	.macro	clear_gp_regs
46	.irp	n,0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29
47	mov	x\n, xzr
48	.endr
49	.endm
50
51/*
52 * Bad Abort numbers
53 *-----------------
54 */
55#define BAD_SYNC	0
56#define BAD_IRQ		1
57#define BAD_FIQ		2
58#define BAD_ERROR	3
59
60	.macro kernel_ventry, el, label, regsize = 64
61	.align 7
62#ifdef CONFIG_UNMAP_KERNEL_AT_EL0
63alternative_if ARM64_UNMAP_KERNEL_AT_EL0
64	.if	\el == 0
65	.if	\regsize == 64
66	mrs	x30, tpidrro_el0
67	msr	tpidrro_el0, xzr
68	.else
69	mov	x30, xzr
70	.endif
71	.endif
72alternative_else_nop_endif
73#endif
74
75	sub	sp, sp, #S_FRAME_SIZE
76#ifdef CONFIG_VMAP_STACK
77	/*
78	 * Test whether the SP has overflowed, without corrupting a GPR.
79	 * Task and IRQ stacks are aligned to (1 << THREAD_SHIFT).
80	 */
81	add	sp, sp, x0			// sp' = sp + x0
82	sub	x0, sp, x0			// x0' = sp' - x0 = (sp + x0) - x0 = sp
83	tbnz	x0, #THREAD_SHIFT, 0f
84	sub	x0, sp, x0			// x0'' = sp' - x0' = (sp + x0) - sp = x0
85	sub	sp, sp, x0			// sp'' = sp' - x0 = (sp + x0) - x0 = sp
86	b	el\()\el\()_\label
87
880:
89	/*
90	 * Either we've just detected an overflow, or we've taken an exception
91	 * while on the overflow stack. Either way, we won't return to
92	 * userspace, and can clobber EL0 registers to free up GPRs.
93	 */
94
95	/* Stash the original SP (minus S_FRAME_SIZE) in tpidr_el0. */
96	msr	tpidr_el0, x0
97
98	/* Recover the original x0 value and stash it in tpidrro_el0 */
99	sub	x0, sp, x0
100	msr	tpidrro_el0, x0
101
102	/* Switch to the overflow stack */
103	adr_this_cpu sp, overflow_stack + OVERFLOW_STACK_SIZE, x0
104
105	/*
106	 * Check whether we were already on the overflow stack. This may happen
107	 * after panic() re-enables interrupts.
108	 */
109	mrs	x0, tpidr_el0			// sp of interrupted context
110	sub	x0, sp, x0			// delta with top of overflow stack
111	tst	x0, #~(OVERFLOW_STACK_SIZE - 1)	// within range?
112	b.ne	__bad_stack			// no? -> bad stack pointer
113
114	/* We were already on the overflow stack. Restore sp/x0 and carry on. */
115	sub	sp, sp, x0
116	mrs	x0, tpidrro_el0
117#endif
118	b	el\()\el\()_\label
119	.endm
120
121	.macro tramp_alias, dst, sym
122	mov_q	\dst, TRAMP_VALIAS
123	add	\dst, \dst, #(\sym - .entry.tramp.text)
124	.endm
125
126	// This macro corrupts x0-x3. It is the caller's duty
127	// to save/restore them if required.
128	.macro	apply_ssbd, state, tmp1, tmp2
129#ifdef CONFIG_ARM64_SSBD
130alternative_cb	arm64_enable_wa2_handling
131	b	.L__asm_ssbd_skip\@
132alternative_cb_end
133	ldr_this_cpu	\tmp2, arm64_ssbd_callback_required, \tmp1
134	cbz	\tmp2,	.L__asm_ssbd_skip\@
135	ldr	\tmp2, [tsk, #TSK_TI_FLAGS]
136	tbnz	\tmp2, #TIF_SSBD, .L__asm_ssbd_skip\@
137	mov	w0, #ARM_SMCCC_ARCH_WORKAROUND_2
138	mov	w1, #\state
139alternative_cb	arm64_update_smccc_conduit
140	nop					// Patched to SMC/HVC #0
141alternative_cb_end
142.L__asm_ssbd_skip\@:
143#endif
144	.endm
145
146	.macro	kernel_entry, el, regsize = 64
147	.if	\regsize == 32
148	mov	w0, w0				// zero upper 32 bits of x0
149	.endif
150	stp	x0, x1, [sp, #16 * 0]
151	stp	x2, x3, [sp, #16 * 1]
152	stp	x4, x5, [sp, #16 * 2]
153	stp	x6, x7, [sp, #16 * 3]
154	stp	x8, x9, [sp, #16 * 4]
155	stp	x10, x11, [sp, #16 * 5]
156	stp	x12, x13, [sp, #16 * 6]
157	stp	x14, x15, [sp, #16 * 7]
158	stp	x16, x17, [sp, #16 * 8]
159	stp	x18, x19, [sp, #16 * 9]
160	stp	x20, x21, [sp, #16 * 10]
161	stp	x22, x23, [sp, #16 * 11]
162	stp	x24, x25, [sp, #16 * 12]
163	stp	x26, x27, [sp, #16 * 13]
164	stp	x28, x29, [sp, #16 * 14]
165
166	.if	\el == 0
167	clear_gp_regs
168	mrs	x21, sp_el0
169	ldr_this_cpu	tsk, __entry_task, x20	// Ensure MDSCR_EL1.SS is clear,
170	ldr	x19, [tsk, #TSK_TI_FLAGS]	// since we can unmask debug
171	disable_step_tsk x19, x20		// exceptions when scheduling.
172
173	apply_ssbd 1, x22, x23
174
175	.else
176	add	x21, sp, #S_FRAME_SIZE
177	get_current_task tsk
178	/* Save the task's original addr_limit and set USER_DS */
179	ldr	x20, [tsk, #TSK_TI_ADDR_LIMIT]
180	str	x20, [sp, #S_ORIG_ADDR_LIMIT]
181	mov	x20, #USER_DS
182	str	x20, [tsk, #TSK_TI_ADDR_LIMIT]
183	/* No need to reset PSTATE.UAO, hardware's already set it to 0 for us */
184	.endif /* \el == 0 */
185	mrs	x22, elr_el1
186	mrs	x23, spsr_el1
187	stp	lr, x21, [sp, #S_LR]
188
189	/*
190	 * In order to be able to dump the contents of struct pt_regs at the
191	 * time the exception was taken (in case we attempt to walk the call
192	 * stack later), chain it together with the stack frames.
193	 */
194	.if \el == 0
195	stp	xzr, xzr, [sp, #S_STACKFRAME]
196	.else
197	stp	x29, x22, [sp, #S_STACKFRAME]
198	.endif
199	add	x29, sp, #S_STACKFRAME
200
201#ifdef CONFIG_ARM64_SW_TTBR0_PAN
202	/*
203	 * Set the TTBR0 PAN bit in SPSR. When the exception is taken from
204	 * EL0, there is no need to check the state of TTBR0_EL1 since
205	 * accesses are always enabled.
206	 * Note that the meaning of this bit differs from the ARMv8.1 PAN
207	 * feature as all TTBR0_EL1 accesses are disabled, not just those to
208	 * user mappings.
209	 */
210alternative_if ARM64_HAS_PAN
211	b	1f				// skip TTBR0 PAN
212alternative_else_nop_endif
213
214	.if	\el != 0
215	mrs	x21, ttbr0_el1
216	tst	x21, #TTBR_ASID_MASK		// Check for the reserved ASID
217	orr	x23, x23, #PSR_PAN_BIT		// Set the emulated PAN in the saved SPSR
218	b.eq	1f				// TTBR0 access already disabled
219	and	x23, x23, #~PSR_PAN_BIT		// Clear the emulated PAN in the saved SPSR
220	.endif
221
222	__uaccess_ttbr0_disable x21
2231:
224#endif
225
226	stp	x22, x23, [sp, #S_PC]
227
228	/* Not in a syscall by default (el0_svc overwrites for real syscall) */
229	.if	\el == 0
230	mov	w21, #NO_SYSCALL
231	str	w21, [sp, #S_SYSCALLNO]
232	.endif
233
234	/*
235	 * Set sp_el0 to current thread_info.
236	 */
237	.if	\el == 0
238	msr	sp_el0, tsk
239	.endif
240
241	/* Save pmr */
242alternative_if ARM64_HAS_IRQ_PRIO_MASKING
243	mrs_s	x20, SYS_ICC_PMR_EL1
244	str	x20, [sp, #S_PMR_SAVE]
245alternative_else_nop_endif
246
247	/*
248	 * Registers that may be useful after this macro is invoked:
249	 *
250	 * x20 - ICC_PMR_EL1
251	 * x21 - aborted SP
252	 * x22 - aborted PC
253	 * x23 - aborted PSTATE
254	*/
255	.endm
256
257	.macro	kernel_exit, el
258	.if	\el != 0
259	disable_daif
260
261	/* Restore the task's original addr_limit. */
262	ldr	x20, [sp, #S_ORIG_ADDR_LIMIT]
263	str	x20, [tsk, #TSK_TI_ADDR_LIMIT]
264
265	/* No need to restore UAO, it will be restored from SPSR_EL1 */
266	.endif
267
268	/* Restore pmr */
269alternative_if ARM64_HAS_IRQ_PRIO_MASKING
270	ldr	x20, [sp, #S_PMR_SAVE]
271	msr_s	SYS_ICC_PMR_EL1, x20
272	/* Ensure priority change is seen by redistributor */
273	dsb	sy
274alternative_else_nop_endif
275
276	ldp	x21, x22, [sp, #S_PC]		// load ELR, SPSR
277	.if	\el == 0
278	ct_user_enter
279	.endif
280
281#ifdef CONFIG_ARM64_SW_TTBR0_PAN
282	/*
283	 * Restore access to TTBR0_EL1. If returning to EL0, no need for SPSR
284	 * PAN bit checking.
285	 */
286alternative_if ARM64_HAS_PAN
287	b	2f				// skip TTBR0 PAN
288alternative_else_nop_endif
289
290	.if	\el != 0
291	tbnz	x22, #22, 1f			// Skip re-enabling TTBR0 access if the PSR_PAN_BIT is set
292	.endif
293
294	__uaccess_ttbr0_enable x0, x1
295
296	.if	\el == 0
297	/*
298	 * Enable errata workarounds only if returning to user. The only
299	 * workaround currently required for TTBR0_EL1 changes are for the
300	 * Cavium erratum 27456 (broadcast TLBI instructions may cause I-cache
301	 * corruption).
302	 */
303	bl	post_ttbr_update_workaround
304	.endif
3051:
306	.if	\el != 0
307	and	x22, x22, #~PSR_PAN_BIT		// ARMv8.0 CPUs do not understand this bit
308	.endif
3092:
310#endif
311
312	.if	\el == 0
313	ldr	x23, [sp, #S_SP]		// load return stack pointer
314	msr	sp_el0, x23
315	tst	x22, #PSR_MODE32_BIT		// native task?
316	b.eq	3f
317
318#ifdef CONFIG_ARM64_ERRATUM_845719
319alternative_if ARM64_WORKAROUND_845719
320#ifdef CONFIG_PID_IN_CONTEXTIDR
321	mrs	x29, contextidr_el1
322	msr	contextidr_el1, x29
323#else
324	msr contextidr_el1, xzr
325#endif
326alternative_else_nop_endif
327#endif
3283:
329#ifdef CONFIG_ARM64_ERRATUM_1418040
330alternative_if_not ARM64_WORKAROUND_1418040
331	b	4f
332alternative_else_nop_endif
333	/*
334	 * if (x22.mode32 == cntkctl_el1.el0vcten)
335	 *     cntkctl_el1.el0vcten = ~cntkctl_el1.el0vcten
336	 */
337	mrs	x1, cntkctl_el1
338	eon	x0, x1, x22, lsr #3
339	tbz	x0, #1, 4f
340	eor	x1, x1, #2	// ARCH_TIMER_USR_VCT_ACCESS_EN
341	msr	cntkctl_el1, x1
3424:
343#endif
344	apply_ssbd 0, x0, x1
345	.endif
346
347	msr	elr_el1, x21			// set up the return data
348	msr	spsr_el1, x22
349	ldp	x0, x1, [sp, #16 * 0]
350	ldp	x2, x3, [sp, #16 * 1]
351	ldp	x4, x5, [sp, #16 * 2]
352	ldp	x6, x7, [sp, #16 * 3]
353	ldp	x8, x9, [sp, #16 * 4]
354	ldp	x10, x11, [sp, #16 * 5]
355	ldp	x12, x13, [sp, #16 * 6]
356	ldp	x14, x15, [sp, #16 * 7]
357	ldp	x16, x17, [sp, #16 * 8]
358	ldp	x18, x19, [sp, #16 * 9]
359	ldp	x20, x21, [sp, #16 * 10]
360	ldp	x22, x23, [sp, #16 * 11]
361	ldp	x24, x25, [sp, #16 * 12]
362	ldp	x26, x27, [sp, #16 * 13]
363	ldp	x28, x29, [sp, #16 * 14]
364	ldr	lr, [sp, #S_LR]
365	add	sp, sp, #S_FRAME_SIZE		// restore sp
366
367	.if	\el == 0
368alternative_insn eret, nop, ARM64_UNMAP_KERNEL_AT_EL0
369#ifdef CONFIG_UNMAP_KERNEL_AT_EL0
370	bne	5f
371	msr	far_el1, x30
372	tramp_alias	x30, tramp_exit_native
373	br	x30
3745:
375	tramp_alias	x30, tramp_exit_compat
376	br	x30
377#endif
378	.else
379	eret
380	.endif
381	sb
382	.endm
383
384	.macro	irq_stack_entry
385	mov	x19, sp			// preserve the original sp
386
387	/*
388	 * Compare sp with the base of the task stack.
389	 * If the top ~(THREAD_SIZE - 1) bits match, we are on a task stack,
390	 * and should switch to the irq stack.
391	 */
392	ldr	x25, [tsk, TSK_STACK]
393	eor	x25, x25, x19
394	and	x25, x25, #~(THREAD_SIZE - 1)
395	cbnz	x25, 9998f
396
397	ldr_this_cpu x25, irq_stack_ptr, x26
398	mov	x26, #IRQ_STACK_SIZE
399	add	x26, x25, x26
400
401	/* switch to the irq stack */
402	mov	sp, x26
4039998:
404	.endm
405
406	/*
407	 * x19 should be preserved between irq_stack_entry and
408	 * irq_stack_exit.
409	 */
410	.macro	irq_stack_exit
411	mov	sp, x19
412	.endm
413
414/* GPRs used by entry code */
415tsk	.req	x28		// current thread_info
416
417/*
418 * Interrupt handling.
419 */
420	.macro	irq_handler
421	ldr_l	x1, handle_arch_irq
422	mov	x0, sp
423	irq_stack_entry
424	blr	x1
425	irq_stack_exit
426	.endm
427
428#ifdef CONFIG_ARM64_PSEUDO_NMI
429	/*
430	 * Set res to 0 if irqs were unmasked in interrupted context.
431	 * Otherwise set res to non-0 value.
432	 */
433	.macro	test_irqs_unmasked res:req, pmr:req
434alternative_if ARM64_HAS_IRQ_PRIO_MASKING
435	sub	\res, \pmr, #GIC_PRIO_IRQON
436alternative_else
437	mov	\res, xzr
438alternative_endif
439	.endm
440#endif
441
442	.macro	gic_prio_kentry_setup, tmp:req
443#ifdef CONFIG_ARM64_PSEUDO_NMI
444	alternative_if ARM64_HAS_IRQ_PRIO_MASKING
445	mov	\tmp, #(GIC_PRIO_PSR_I_SET | GIC_PRIO_IRQON)
446	msr_s	SYS_ICC_PMR_EL1, \tmp
447	alternative_else_nop_endif
448#endif
449	.endm
450
451	.macro	gic_prio_irq_setup, pmr:req, tmp:req
452#ifdef CONFIG_ARM64_PSEUDO_NMI
453	alternative_if ARM64_HAS_IRQ_PRIO_MASKING
454	orr	\tmp, \pmr, #GIC_PRIO_PSR_I_SET
455	msr_s	SYS_ICC_PMR_EL1, \tmp
456	alternative_else_nop_endif
457#endif
458	.endm
459
460	.text
461
462/*
463 * Exception vectors.
464 */
465	.pushsection ".entry.text", "ax"
466
467	.align	11
468ENTRY(vectors)
469	kernel_ventry	1, sync_invalid			// Synchronous EL1t
470	kernel_ventry	1, irq_invalid			// IRQ EL1t
471	kernel_ventry	1, fiq_invalid			// FIQ EL1t
472	kernel_ventry	1, error_invalid		// Error EL1t
473
474	kernel_ventry	1, sync				// Synchronous EL1h
475	kernel_ventry	1, irq				// IRQ EL1h
476	kernel_ventry	1, fiq_invalid			// FIQ EL1h
477	kernel_ventry	1, error			// Error EL1h
478
479	kernel_ventry	0, sync				// Synchronous 64-bit EL0
480	kernel_ventry	0, irq				// IRQ 64-bit EL0
481	kernel_ventry	0, fiq_invalid			// FIQ 64-bit EL0
482	kernel_ventry	0, error			// Error 64-bit EL0
483
484#ifdef CONFIG_COMPAT
485	kernel_ventry	0, sync_compat, 32		// Synchronous 32-bit EL0
486	kernel_ventry	0, irq_compat, 32		// IRQ 32-bit EL0
487	kernel_ventry	0, fiq_invalid_compat, 32	// FIQ 32-bit EL0
488	kernel_ventry	0, error_compat, 32		// Error 32-bit EL0
489#else
490	kernel_ventry	0, sync_invalid, 32		// Synchronous 32-bit EL0
491	kernel_ventry	0, irq_invalid, 32		// IRQ 32-bit EL0
492	kernel_ventry	0, fiq_invalid, 32		// FIQ 32-bit EL0
493	kernel_ventry	0, error_invalid, 32		// Error 32-bit EL0
494#endif
495END(vectors)
496
497#ifdef CONFIG_VMAP_STACK
498	/*
499	 * We detected an overflow in kernel_ventry, which switched to the
500	 * overflow stack. Stash the exception regs, and head to our overflow
501	 * handler.
502	 */
503__bad_stack:
504	/* Restore the original x0 value */
505	mrs	x0, tpidrro_el0
506
507	/*
508	 * Store the original GPRs to the new stack. The orginal SP (minus
509	 * S_FRAME_SIZE) was stashed in tpidr_el0 by kernel_ventry.
510	 */
511	sub	sp, sp, #S_FRAME_SIZE
512	kernel_entry 1
513	mrs	x0, tpidr_el0
514	add	x0, x0, #S_FRAME_SIZE
515	str	x0, [sp, #S_SP]
516
517	/* Stash the regs for handle_bad_stack */
518	mov	x0, sp
519
520	/* Time to die */
521	bl	handle_bad_stack
522	ASM_BUG()
523#endif /* CONFIG_VMAP_STACK */
524
525/*
526 * Invalid mode handlers
527 */
528	.macro	inv_entry, el, reason, regsize = 64
529	kernel_entry \el, \regsize
530	mov	x0, sp
531	mov	x1, #\reason
532	mrs	x2, esr_el1
533	bl	bad_mode
534	ASM_BUG()
535	.endm
536
537el0_sync_invalid:
538	inv_entry 0, BAD_SYNC
539ENDPROC(el0_sync_invalid)
540
541el0_irq_invalid:
542	inv_entry 0, BAD_IRQ
543ENDPROC(el0_irq_invalid)
544
545el0_fiq_invalid:
546	inv_entry 0, BAD_FIQ
547ENDPROC(el0_fiq_invalid)
548
549el0_error_invalid:
550	inv_entry 0, BAD_ERROR
551ENDPROC(el0_error_invalid)
552
553#ifdef CONFIG_COMPAT
554el0_fiq_invalid_compat:
555	inv_entry 0, BAD_FIQ, 32
556ENDPROC(el0_fiq_invalid_compat)
557#endif
558
559el1_sync_invalid:
560	inv_entry 1, BAD_SYNC
561ENDPROC(el1_sync_invalid)
562
563el1_irq_invalid:
564	inv_entry 1, BAD_IRQ
565ENDPROC(el1_irq_invalid)
566
567el1_fiq_invalid:
568	inv_entry 1, BAD_FIQ
569ENDPROC(el1_fiq_invalid)
570
571el1_error_invalid:
572	inv_entry 1, BAD_ERROR
573ENDPROC(el1_error_invalid)
574
575/*
576 * EL1 mode handlers.
577 */
578	.align	6
579el1_sync:
580	kernel_entry 1
581	mrs	x1, esr_el1			// read the syndrome register
582	lsr	x24, x1, #ESR_ELx_EC_SHIFT	// exception class
583	cmp	x24, #ESR_ELx_EC_DABT_CUR	// data abort in EL1
584	b.eq	el1_da
585	cmp	x24, #ESR_ELx_EC_IABT_CUR	// instruction abort in EL1
586	b.eq	el1_ia
587	cmp	x24, #ESR_ELx_EC_SYS64		// configurable trap
588	b.eq	el1_undef
589	cmp	x24, #ESR_ELx_EC_SP_ALIGN	// stack alignment exception
590	b.eq	el1_sp_pc
591	cmp	x24, #ESR_ELx_EC_PC_ALIGN	// pc alignment exception
592	b.eq	el1_sp_pc
593	cmp	x24, #ESR_ELx_EC_UNKNOWN	// unknown exception in EL1
594	b.eq	el1_undef
595	cmp	x24, #ESR_ELx_EC_BREAKPT_CUR	// debug exception in EL1
596	b.ge	el1_dbg
597	b	el1_inv
598
599el1_ia:
600	/*
601	 * Fall through to the Data abort case
602	 */
603el1_da:
604	/*
605	 * Data abort handling
606	 */
607	mrs	x3, far_el1
608	inherit_daif	pstate=x23, tmp=x2
609	clear_address_tag x0, x3
610	mov	x2, sp				// struct pt_regs
611	bl	do_mem_abort
612
613	kernel_exit 1
614el1_sp_pc:
615	/*
616	 * Stack or PC alignment exception handling
617	 */
618	mrs	x0, far_el1
619	inherit_daif	pstate=x23, tmp=x2
620	mov	x2, sp
621	bl	do_sp_pc_abort
622	ASM_BUG()
623el1_undef:
624	/*
625	 * Undefined instruction
626	 */
627	inherit_daif	pstate=x23, tmp=x2
628	mov	x0, sp
629	bl	do_undefinstr
630	kernel_exit 1
631el1_dbg:
632	/*
633	 * Debug exception handling
634	 */
635	cmp	x24, #ESR_ELx_EC_BRK64		// if BRK64
636	cinc	x24, x24, eq			// set bit '0'
637	tbz	x24, #0, el1_inv		// EL1 only
638	gic_prio_kentry_setup tmp=x3
639	mrs	x0, far_el1
640	mov	x2, sp				// struct pt_regs
641	bl	do_debug_exception
642	kernel_exit 1
643el1_inv:
644	// TODO: add support for undefined instructions in kernel mode
645	inherit_daif	pstate=x23, tmp=x2
646	mov	x0, sp
647	mov	x2, x1
648	mov	x1, #BAD_SYNC
649	bl	bad_mode
650	ASM_BUG()
651ENDPROC(el1_sync)
652
653	.align	6
654el1_irq:
655	kernel_entry 1
656	gic_prio_irq_setup pmr=x20, tmp=x1
657	enable_da_f
658
659#ifdef CONFIG_ARM64_PSEUDO_NMI
660	test_irqs_unmasked	res=x0, pmr=x20
661	cbz	x0, 1f
662	bl	asm_nmi_enter
6631:
664#endif
665
666#ifdef CONFIG_TRACE_IRQFLAGS
667	bl	trace_hardirqs_off
668#endif
669
670	irq_handler
671
672#ifdef CONFIG_PREEMPT
673	ldr	x24, [tsk, #TSK_TI_PREEMPT]	// get preempt count
674alternative_if ARM64_HAS_IRQ_PRIO_MASKING
675	/*
676	 * DA_F were cleared at start of handling. If anything is set in DAIF,
677	 * we come back from an NMI, so skip preemption
678	 */
679	mrs	x0, daif
680	orr	x24, x24, x0
681alternative_else_nop_endif
682	cbnz	x24, 1f				// preempt count != 0 || NMI return path
683	bl	preempt_schedule_irq		// irq en/disable is done inside
6841:
685#endif
686
687#ifdef CONFIG_ARM64_PSEUDO_NMI
688	/*
689	 * When using IRQ priority masking, we can get spurious interrupts while
690	 * PMR is set to GIC_PRIO_IRQOFF. An NMI might also have occurred in a
691	 * section with interrupts disabled. Skip tracing in those cases.
692	 */
693	test_irqs_unmasked	res=x0, pmr=x20
694	cbz	x0, 1f
695	bl	asm_nmi_exit
6961:
697#endif
698
699#ifdef CONFIG_TRACE_IRQFLAGS
700#ifdef CONFIG_ARM64_PSEUDO_NMI
701	test_irqs_unmasked	res=x0, pmr=x20
702	cbnz	x0, 1f
703#endif
704	bl	trace_hardirqs_on
7051:
706#endif
707
708	kernel_exit 1
709ENDPROC(el1_irq)
710
711/*
712 * EL0 mode handlers.
713 */
714	.align	6
715el0_sync:
716	kernel_entry 0
717	mrs	x25, esr_el1			// read the syndrome register
718	lsr	x24, x25, #ESR_ELx_EC_SHIFT	// exception class
719	cmp	x24, #ESR_ELx_EC_SVC64		// SVC in 64-bit state
720	b.eq	el0_svc
721	cmp	x24, #ESR_ELx_EC_DABT_LOW	// data abort in EL0
722	b.eq	el0_da
723	cmp	x24, #ESR_ELx_EC_IABT_LOW	// instruction abort in EL0
724	b.eq	el0_ia
725	cmp	x24, #ESR_ELx_EC_FP_ASIMD	// FP/ASIMD access
726	b.eq	el0_fpsimd_acc
727	cmp	x24, #ESR_ELx_EC_SVE		// SVE access
728	b.eq	el0_sve_acc
729	cmp	x24, #ESR_ELx_EC_FP_EXC64	// FP/ASIMD exception
730	b.eq	el0_fpsimd_exc
731	cmp	x24, #ESR_ELx_EC_SYS64		// configurable trap
732	ccmp	x24, #ESR_ELx_EC_WFx, #4, ne
733	b.eq	el0_sys
734	cmp	x24, #ESR_ELx_EC_SP_ALIGN	// stack alignment exception
735	b.eq	el0_sp_pc
736	cmp	x24, #ESR_ELx_EC_PC_ALIGN	// pc alignment exception
737	b.eq	el0_sp_pc
738	cmp	x24, #ESR_ELx_EC_UNKNOWN	// unknown exception in EL0
739	b.eq	el0_undef
740	cmp	x24, #ESR_ELx_EC_BREAKPT_LOW	// debug exception in EL0
741	b.ge	el0_dbg
742	b	el0_inv
743
744#ifdef CONFIG_COMPAT
745	.align	6
746el0_sync_compat:
747	kernel_entry 0, 32
748	mrs	x25, esr_el1			// read the syndrome register
749	lsr	x24, x25, #ESR_ELx_EC_SHIFT	// exception class
750	cmp	x24, #ESR_ELx_EC_SVC32		// SVC in 32-bit state
751	b.eq	el0_svc_compat
752	cmp	x24, #ESR_ELx_EC_DABT_LOW	// data abort in EL0
753	b.eq	el0_da
754	cmp	x24, #ESR_ELx_EC_IABT_LOW	// instruction abort in EL0
755	b.eq	el0_ia
756	cmp	x24, #ESR_ELx_EC_FP_ASIMD	// FP/ASIMD access
757	b.eq	el0_fpsimd_acc
758	cmp	x24, #ESR_ELx_EC_FP_EXC32	// FP/ASIMD exception
759	b.eq	el0_fpsimd_exc
760	cmp	x24, #ESR_ELx_EC_PC_ALIGN	// pc alignment exception
761	b.eq	el0_sp_pc
762	cmp	x24, #ESR_ELx_EC_UNKNOWN	// unknown exception in EL0
763	b.eq	el0_undef
764	cmp	x24, #ESR_ELx_EC_CP15_32	// CP15 MRC/MCR trap
765	b.eq	el0_cp15
766	cmp	x24, #ESR_ELx_EC_CP15_64	// CP15 MRRC/MCRR trap
767	b.eq	el0_cp15
768	cmp	x24, #ESR_ELx_EC_CP14_MR	// CP14 MRC/MCR trap
769	b.eq	el0_undef
770	cmp	x24, #ESR_ELx_EC_CP14_LS	// CP14 LDC/STC trap
771	b.eq	el0_undef
772	cmp	x24, #ESR_ELx_EC_CP14_64	// CP14 MRRC/MCRR trap
773	b.eq	el0_undef
774	cmp	x24, #ESR_ELx_EC_BREAKPT_LOW	// debug exception in EL0
775	b.ge	el0_dbg
776	b	el0_inv
777el0_svc_compat:
778	mov	x0, sp
779	bl	el0_svc_compat_handler
780	b	ret_to_user
781
782	.align	6
783el0_irq_compat:
784	kernel_entry 0, 32
785	b	el0_irq_naked
786
787el0_error_compat:
788	kernel_entry 0, 32
789	b	el0_error_naked
790
791el0_cp15:
792	/*
793	 * Trapped CP15 (MRC, MCR, MRRC, MCRR) instructions
794	 */
795	enable_daif
796	ct_user_exit
797	mov	x0, x25
798	mov	x1, sp
799	bl	do_cp15instr
800	b	ret_to_user
801#endif
802
803el0_da:
804	/*
805	 * Data abort handling
806	 */
807	mrs	x26, far_el1
808	enable_daif
809	ct_user_exit
810	clear_address_tag x0, x26
811	mov	x1, x25
812	mov	x2, sp
813	bl	do_mem_abort
814	b	ret_to_user
815el0_ia:
816	/*
817	 * Instruction abort handling
818	 */
819	mrs	x26, far_el1
820	gic_prio_kentry_setup tmp=x0
821	enable_da_f
822#ifdef CONFIG_TRACE_IRQFLAGS
823	bl	trace_hardirqs_off
824#endif
825	ct_user_exit
826	mov	x0, x26
827	mov	x1, x25
828	mov	x2, sp
829	bl	do_el0_ia_bp_hardening
830	b	ret_to_user
831el0_fpsimd_acc:
832	/*
833	 * Floating Point or Advanced SIMD access
834	 */
835	enable_daif
836	ct_user_exit
837	mov	x0, x25
838	mov	x1, sp
839	bl	do_fpsimd_acc
840	b	ret_to_user
841el0_sve_acc:
842	/*
843	 * Scalable Vector Extension access
844	 */
845	enable_daif
846	ct_user_exit
847	mov	x0, x25
848	mov	x1, sp
849	bl	do_sve_acc
850	b	ret_to_user
851el0_fpsimd_exc:
852	/*
853	 * Floating Point, Advanced SIMD or SVE exception
854	 */
855	enable_daif
856	ct_user_exit
857	mov	x0, x25
858	mov	x1, sp
859	bl	do_fpsimd_exc
860	b	ret_to_user
861el0_sp_pc:
862	/*
863	 * Stack or PC alignment exception handling
864	 */
865	mrs	x26, far_el1
866	gic_prio_kentry_setup tmp=x0
867	enable_da_f
868#ifdef CONFIG_TRACE_IRQFLAGS
869	bl	trace_hardirqs_off
870#endif
871	ct_user_exit
872	mov	x0, x26
873	mov	x1, x25
874	mov	x2, sp
875	bl	do_sp_pc_abort
876	b	ret_to_user
877el0_undef:
878	/*
879	 * Undefined instruction
880	 */
881	enable_daif
882	ct_user_exit
883	mov	x0, sp
884	bl	do_undefinstr
885	b	ret_to_user
886el0_sys:
887	/*
888	 * System instructions, for trapped cache maintenance instructions
889	 */
890	enable_daif
891	ct_user_exit
892	mov	x0, x25
893	mov	x1, sp
894	bl	do_sysinstr
895	b	ret_to_user
896el0_dbg:
897	/*
898	 * Debug exception handling
899	 */
900	tbnz	x24, #0, el0_inv		// EL0 only
901	gic_prio_kentry_setup tmp=x3
902	mrs	x0, far_el1
903	mov	x1, x25
904	mov	x2, sp
905	bl	do_debug_exception
906	enable_da_f
907	ct_user_exit
908	b	ret_to_user
909el0_inv:
910	enable_daif
911	ct_user_exit
912	mov	x0, sp
913	mov	x1, #BAD_SYNC
914	mov	x2, x25
915	bl	bad_el0_sync
916	b	ret_to_user
917ENDPROC(el0_sync)
918
919	.align	6
920el0_irq:
921	kernel_entry 0
922el0_irq_naked:
923	gic_prio_irq_setup pmr=x20, tmp=x0
924	enable_da_f
925
926#ifdef CONFIG_TRACE_IRQFLAGS
927	bl	trace_hardirqs_off
928#endif
929
930	ct_user_exit
931#ifdef CONFIG_HARDEN_BRANCH_PREDICTOR
932	tbz	x22, #55, 1f
933	bl	do_el0_irq_bp_hardening
9341:
935#endif
936	irq_handler
937
938#ifdef CONFIG_TRACE_IRQFLAGS
939	bl	trace_hardirqs_on
940#endif
941	b	ret_to_user
942ENDPROC(el0_irq)
943
944el1_error:
945	kernel_entry 1
946	mrs	x1, esr_el1
947	gic_prio_kentry_setup tmp=x2
948	enable_dbg
949	mov	x0, sp
950	bl	do_serror
951	kernel_exit 1
952ENDPROC(el1_error)
953
954el0_error:
955	kernel_entry 0
956el0_error_naked:
957	mrs	x1, esr_el1
958	gic_prio_kentry_setup tmp=x2
959	enable_dbg
960	mov	x0, sp
961	bl	do_serror
962	enable_da_f
963	ct_user_exit
964	b	ret_to_user
965ENDPROC(el0_error)
966
967/*
968 * Ok, we need to do extra processing, enter the slow path.
969 */
970work_pending:
971	mov	x0, sp				// 'regs'
972	bl	do_notify_resume
973#ifdef CONFIG_TRACE_IRQFLAGS
974	bl	trace_hardirqs_on		// enabled while in userspace
975#endif
976	ldr	x1, [tsk, #TSK_TI_FLAGS]	// re-check for single-step
977	b	finish_ret_to_user
978/*
979 * "slow" syscall return path.
980 */
981ret_to_user:
982	disable_daif
983	gic_prio_kentry_setup tmp=x3
984	ldr	x1, [tsk, #TSK_TI_FLAGS]
985	and	x2, x1, #_TIF_WORK_MASK
986	cbnz	x2, work_pending
987finish_ret_to_user:
988	enable_step_tsk x1, x2
989#ifdef CONFIG_GCC_PLUGIN_STACKLEAK
990	bl	stackleak_erase
991#endif
992	kernel_exit 0
993ENDPROC(ret_to_user)
994
995/*
996 * SVC handler.
997 */
998	.align	6
999el0_svc:
1000	gic_prio_kentry_setup tmp=x1
1001	mov	x0, sp
1002	bl	el0_svc_handler
1003	b	ret_to_user
1004ENDPROC(el0_svc)
1005
1006	.popsection				// .entry.text
1007
1008#ifdef CONFIG_UNMAP_KERNEL_AT_EL0
1009/*
1010 * Exception vectors trampoline.
1011 */
1012	.pushsection ".entry.tramp.text", "ax"
1013
1014	.macro tramp_map_kernel, tmp
1015	mrs	\tmp, ttbr1_el1
1016	add	\tmp, \tmp, #(PAGE_SIZE + RESERVED_TTBR0_SIZE)
1017	bic	\tmp, \tmp, #USER_ASID_FLAG
1018	msr	ttbr1_el1, \tmp
1019#ifdef CONFIG_QCOM_FALKOR_ERRATUM_1003
1020alternative_if ARM64_WORKAROUND_QCOM_FALKOR_E1003
1021	/* ASID already in \tmp[63:48] */
1022	movk	\tmp, #:abs_g2_nc:(TRAMP_VALIAS >> 12)
1023	movk	\tmp, #:abs_g1_nc:(TRAMP_VALIAS >> 12)
1024	/* 2MB boundary containing the vectors, so we nobble the walk cache */
1025	movk	\tmp, #:abs_g0_nc:((TRAMP_VALIAS & ~(SZ_2M - 1)) >> 12)
1026	isb
1027	tlbi	vae1, \tmp
1028	dsb	nsh
1029alternative_else_nop_endif
1030#endif /* CONFIG_QCOM_FALKOR_ERRATUM_1003 */
1031	.endm
1032
1033	.macro tramp_unmap_kernel, tmp
1034	mrs	\tmp, ttbr1_el1
1035	sub	\tmp, \tmp, #(PAGE_SIZE + RESERVED_TTBR0_SIZE)
1036	orr	\tmp, \tmp, #USER_ASID_FLAG
1037	msr	ttbr1_el1, \tmp
1038	/*
1039	 * We avoid running the post_ttbr_update_workaround here because
1040	 * it's only needed by Cavium ThunderX, which requires KPTI to be
1041	 * disabled.
1042	 */
1043	.endm
1044
1045	.macro tramp_ventry, regsize = 64
1046	.align	7
10471:
1048	.if	\regsize == 64
1049	msr	tpidrro_el0, x30	// Restored in kernel_ventry
1050	.endif
1051	/*
1052	 * Defend against branch aliasing attacks by pushing a dummy
1053	 * entry onto the return stack and using a RET instruction to
1054	 * enter the full-fat kernel vectors.
1055	 */
1056	bl	2f
1057	b	.
10582:
1059	tramp_map_kernel	x30
1060#ifdef CONFIG_RANDOMIZE_BASE
1061	adr	x30, tramp_vectors + PAGE_SIZE
1062alternative_insn isb, nop, ARM64_WORKAROUND_QCOM_FALKOR_E1003
1063	ldr	x30, [x30]
1064#else
1065	ldr	x30, =vectors
1066#endif
1067	prfm	plil1strm, [x30, #(1b - tramp_vectors)]
1068	msr	vbar_el1, x30
1069	add	x30, x30, #(1b - tramp_vectors)
1070	isb
1071	ret
1072	.endm
1073
1074	.macro tramp_exit, regsize = 64
1075	adr	x30, tramp_vectors
1076	msr	vbar_el1, x30
1077	tramp_unmap_kernel	x30
1078	.if	\regsize == 64
1079	mrs	x30, far_el1
1080	.endif
1081	eret
1082	sb
1083	.endm
1084
1085	.align	11
1086ENTRY(tramp_vectors)
1087	.space	0x400
1088
1089	tramp_ventry
1090	tramp_ventry
1091	tramp_ventry
1092	tramp_ventry
1093
1094	tramp_ventry	32
1095	tramp_ventry	32
1096	tramp_ventry	32
1097	tramp_ventry	32
1098END(tramp_vectors)
1099
1100ENTRY(tramp_exit_native)
1101	tramp_exit
1102END(tramp_exit_native)
1103
1104ENTRY(tramp_exit_compat)
1105	tramp_exit	32
1106END(tramp_exit_compat)
1107
1108	.ltorg
1109	.popsection				// .entry.tramp.text
1110#ifdef CONFIG_RANDOMIZE_BASE
1111	.pushsection ".rodata", "a"
1112	.align PAGE_SHIFT
1113	.globl	__entry_tramp_data_start
1114__entry_tramp_data_start:
1115	.quad	vectors
1116	.popsection				// .rodata
1117#endif /* CONFIG_RANDOMIZE_BASE */
1118#endif /* CONFIG_UNMAP_KERNEL_AT_EL0 */
1119
1120/*
1121 * Register switch for AArch64. The callee-saved registers need to be saved
1122 * and restored. On entry:
1123 *   x0 = previous task_struct (must be preserved across the switch)
1124 *   x1 = next task_struct
1125 * Previous and next are guaranteed not to be the same.
1126 *
1127 */
1128ENTRY(cpu_switch_to)
1129	mov	x10, #THREAD_CPU_CONTEXT
1130	add	x8, x0, x10
1131	mov	x9, sp
1132	stp	x19, x20, [x8], #16		// store callee-saved registers
1133	stp	x21, x22, [x8], #16
1134	stp	x23, x24, [x8], #16
1135	stp	x25, x26, [x8], #16
1136	stp	x27, x28, [x8], #16
1137	stp	x29, x9, [x8], #16
1138	str	lr, [x8]
1139	add	x8, x1, x10
1140	ldp	x19, x20, [x8], #16		// restore callee-saved registers
1141	ldp	x21, x22, [x8], #16
1142	ldp	x23, x24, [x8], #16
1143	ldp	x25, x26, [x8], #16
1144	ldp	x27, x28, [x8], #16
1145	ldp	x29, x9, [x8], #16
1146	ldr	lr, [x8]
1147	mov	sp, x9
1148	msr	sp_el0, x1
1149	ret
1150ENDPROC(cpu_switch_to)
1151NOKPROBE(cpu_switch_to)
1152
1153/*
1154 * This is how we return from a fork.
1155 */
1156ENTRY(ret_from_fork)
1157	bl	schedule_tail
1158	cbz	x19, 1f				// not a kernel thread
1159	mov	x0, x20
1160	blr	x19
11611:	get_current_task tsk
1162	b	ret_to_user
1163ENDPROC(ret_from_fork)
1164NOKPROBE(ret_from_fork)
1165
1166#ifdef CONFIG_ARM_SDE_INTERFACE
1167
1168#include <asm/sdei.h>
1169#include <uapi/linux/arm_sdei.h>
1170
1171.macro sdei_handler_exit exit_mode
1172	/* On success, this call never returns... */
1173	cmp	\exit_mode, #SDEI_EXIT_SMC
1174	b.ne	99f
1175	smc	#0
1176	b	.
117799:	hvc	#0
1178	b	.
1179.endm
1180
1181#ifdef CONFIG_UNMAP_KERNEL_AT_EL0
1182/*
1183 * The regular SDEI entry point may have been unmapped along with the rest of
1184 * the kernel. This trampoline restores the kernel mapping to make the x1 memory
1185 * argument accessible.
1186 *
1187 * This clobbers x4, __sdei_handler() will restore this from firmware's
1188 * copy.
1189 */
1190.ltorg
1191.pushsection ".entry.tramp.text", "ax"
1192ENTRY(__sdei_asm_entry_trampoline)
1193	mrs	x4, ttbr1_el1
1194	tbz	x4, #USER_ASID_BIT, 1f
1195
1196	tramp_map_kernel tmp=x4
1197	isb
1198	mov	x4, xzr
1199
1200	/*
1201	 * Use reg->interrupted_regs.addr_limit to remember whether to unmap
1202	 * the kernel on exit.
1203	 */
12041:	str	x4, [x1, #(SDEI_EVENT_INTREGS + S_ORIG_ADDR_LIMIT)]
1205
1206#ifdef CONFIG_RANDOMIZE_BASE
1207	adr	x4, tramp_vectors + PAGE_SIZE
1208	add	x4, x4, #:lo12:__sdei_asm_trampoline_next_handler
1209	ldr	x4, [x4]
1210#else
1211	ldr	x4, =__sdei_asm_handler
1212#endif
1213	br	x4
1214ENDPROC(__sdei_asm_entry_trampoline)
1215NOKPROBE(__sdei_asm_entry_trampoline)
1216
1217/*
1218 * Make the exit call and restore the original ttbr1_el1
1219 *
1220 * x0 & x1: setup for the exit API call
1221 * x2: exit_mode
1222 * x4: struct sdei_registered_event argument from registration time.
1223 */
1224ENTRY(__sdei_asm_exit_trampoline)
1225	ldr	x4, [x4, #(SDEI_EVENT_INTREGS + S_ORIG_ADDR_LIMIT)]
1226	cbnz	x4, 1f
1227
1228	tramp_unmap_kernel	tmp=x4
1229
12301:	sdei_handler_exit exit_mode=x2
1231ENDPROC(__sdei_asm_exit_trampoline)
1232NOKPROBE(__sdei_asm_exit_trampoline)
1233	.ltorg
1234.popsection		// .entry.tramp.text
1235#ifdef CONFIG_RANDOMIZE_BASE
1236.pushsection ".rodata", "a"
1237__sdei_asm_trampoline_next_handler:
1238	.quad	__sdei_asm_handler
1239.popsection		// .rodata
1240#endif /* CONFIG_RANDOMIZE_BASE */
1241#endif /* CONFIG_UNMAP_KERNEL_AT_EL0 */
1242
1243/*
1244 * Software Delegated Exception entry point.
1245 *
1246 * x0: Event number
1247 * x1: struct sdei_registered_event argument from registration time.
1248 * x2: interrupted PC
1249 * x3: interrupted PSTATE
1250 * x4: maybe clobbered by the trampoline
1251 *
1252 * Firmware has preserved x0->x17 for us, we must save/restore the rest to
1253 * follow SMC-CC. We save (or retrieve) all the registers as the handler may
1254 * want them.
1255 */
1256ENTRY(__sdei_asm_handler)
1257	stp     x2, x3, [x1, #SDEI_EVENT_INTREGS + S_PC]
1258	stp     x4, x5, [x1, #SDEI_EVENT_INTREGS + 16 * 2]
1259	stp     x6, x7, [x1, #SDEI_EVENT_INTREGS + 16 * 3]
1260	stp     x8, x9, [x1, #SDEI_EVENT_INTREGS + 16 * 4]
1261	stp     x10, x11, [x1, #SDEI_EVENT_INTREGS + 16 * 5]
1262	stp     x12, x13, [x1, #SDEI_EVENT_INTREGS + 16 * 6]
1263	stp     x14, x15, [x1, #SDEI_EVENT_INTREGS + 16 * 7]
1264	stp     x16, x17, [x1, #SDEI_EVENT_INTREGS + 16 * 8]
1265	stp     x18, x19, [x1, #SDEI_EVENT_INTREGS + 16 * 9]
1266	stp     x20, x21, [x1, #SDEI_EVENT_INTREGS + 16 * 10]
1267	stp     x22, x23, [x1, #SDEI_EVENT_INTREGS + 16 * 11]
1268	stp     x24, x25, [x1, #SDEI_EVENT_INTREGS + 16 * 12]
1269	stp     x26, x27, [x1, #SDEI_EVENT_INTREGS + 16 * 13]
1270	stp     x28, x29, [x1, #SDEI_EVENT_INTREGS + 16 * 14]
1271	mov	x4, sp
1272	stp     lr, x4, [x1, #SDEI_EVENT_INTREGS + S_LR]
1273
1274	mov	x19, x1
1275
1276#ifdef CONFIG_VMAP_STACK
1277	/*
1278	 * entry.S may have been using sp as a scratch register, find whether
1279	 * this is a normal or critical event and switch to the appropriate
1280	 * stack for this CPU.
1281	 */
1282	ldrb	w4, [x19, #SDEI_EVENT_PRIORITY]
1283	cbnz	w4, 1f
1284	ldr_this_cpu dst=x5, sym=sdei_stack_normal_ptr, tmp=x6
1285	b	2f
12861:	ldr_this_cpu dst=x5, sym=sdei_stack_critical_ptr, tmp=x6
12872:	mov	x6, #SDEI_STACK_SIZE
1288	add	x5, x5, x6
1289	mov	sp, x5
1290#endif
1291
1292	/*
1293	 * We may have interrupted userspace, or a guest, or exit-from or
1294	 * return-to either of these. We can't trust sp_el0, restore it.
1295	 */
1296	mrs	x28, sp_el0
1297	ldr_this_cpu	dst=x0, sym=__entry_task, tmp=x1
1298	msr	sp_el0, x0
1299
1300	/* If we interrupted the kernel point to the previous stack/frame. */
1301	and     x0, x3, #0xc
1302	mrs     x1, CurrentEL
1303	cmp     x0, x1
1304	csel	x29, x29, xzr, eq	// fp, or zero
1305	csel	x4, x2, xzr, eq		// elr, or zero
1306
1307	stp	x29, x4, [sp, #-16]!
1308	mov	x29, sp
1309
1310	add	x0, x19, #SDEI_EVENT_INTREGS
1311	mov	x1, x19
1312	bl	__sdei_handler
1313
1314	msr	sp_el0, x28
1315	/* restore regs >x17 that we clobbered */
1316	mov	x4, x19         // keep x4 for __sdei_asm_exit_trampoline
1317	ldp	x28, x29, [x4, #SDEI_EVENT_INTREGS + 16 * 14]
1318	ldp	x18, x19, [x4, #SDEI_EVENT_INTREGS + 16 * 9]
1319	ldp	lr, x1, [x4, #SDEI_EVENT_INTREGS + S_LR]
1320	mov	sp, x1
1321
1322	mov	x1, x0			// address to complete_and_resume
1323	/* x0 = (x0 <= 1) ? EVENT_COMPLETE:EVENT_COMPLETE_AND_RESUME */
1324	cmp	x0, #1
1325	mov_q	x2, SDEI_1_0_FN_SDEI_EVENT_COMPLETE
1326	mov_q	x3, SDEI_1_0_FN_SDEI_EVENT_COMPLETE_AND_RESUME
1327	csel	x0, x2, x3, ls
1328
1329	ldr_l	x2, sdei_exit_mode
1330
1331alternative_if_not ARM64_UNMAP_KERNEL_AT_EL0
1332	sdei_handler_exit exit_mode=x2
1333alternative_else_nop_endif
1334
1335#ifdef CONFIG_UNMAP_KERNEL_AT_EL0
1336	tramp_alias	dst=x5, sym=__sdei_asm_exit_trampoline
1337	br	x5
1338#endif
1339ENDPROC(__sdei_asm_handler)
1340NOKPROBE(__sdei_asm_handler)
1341#endif /* CONFIG_ARM_SDE_INTERFACE */
1342