xref: /openbmc/linux/arch/powerpc/kernel/traps.c (revision 762a8ea5)
1 // SPDX-License-Identifier: GPL-2.0-or-later
2 /*
3  *  Copyright (C) 1995-1996  Gary Thomas (gdt@linuxppc.org)
4  *  Copyright 2007-2010 Freescale Semiconductor, Inc.
5  *
6  *  Modified by Cort Dougan (cort@cs.nmt.edu)
7  *  and Paul Mackerras (paulus@samba.org)
8  */
9 
10 /*
11  * This file handles the architecture-dependent parts of hardware exceptions
12  */
13 
14 #include <linux/errno.h>
15 #include <linux/sched.h>
16 #include <linux/sched/debug.h>
17 #include <linux/kernel.h>
18 #include <linux/mm.h>
19 #include <linux/pkeys.h>
20 #include <linux/stddef.h>
21 #include <linux/unistd.h>
22 #include <linux/ptrace.h>
23 #include <linux/user.h>
24 #include <linux/interrupt.h>
25 #include <linux/init.h>
26 #include <linux/extable.h>
27 #include <linux/module.h>	/* print_modules */
28 #include <linux/prctl.h>
29 #include <linux/delay.h>
30 #include <linux/kprobes.h>
31 #include <linux/kexec.h>
32 #include <linux/backlight.h>
33 #include <linux/bug.h>
34 #include <linux/kdebug.h>
35 #include <linux/ratelimit.h>
36 #include <linux/context_tracking.h>
37 #include <linux/smp.h>
38 #include <linux/console.h>
39 #include <linux/kmsg_dump.h>
40 
41 #include <asm/emulated_ops.h>
42 #include <linux/uaccess.h>
43 #include <asm/debugfs.h>
44 #include <asm/io.h>
45 #include <asm/machdep.h>
46 #include <asm/rtas.h>
47 #include <asm/pmc.h>
48 #include <asm/reg.h>
49 #ifdef CONFIG_PMAC_BACKLIGHT
50 #include <asm/backlight.h>
51 #endif
52 #ifdef CONFIG_PPC64
53 #include <asm/firmware.h>
54 #include <asm/processor.h>
55 #include <asm/tm.h>
56 #endif
57 #include <asm/kexec.h>
58 #include <asm/ppc-opcode.h>
59 #include <asm/rio.h>
60 #include <asm/fadump.h>
61 #include <asm/switch_to.h>
62 #include <asm/tm.h>
63 #include <asm/debug.h>
64 #include <asm/asm-prototypes.h>
65 #include <asm/hmi.h>
66 #include <sysdev/fsl_pci.h>
67 #include <asm/kprobes.h>
68 #include <asm/stacktrace.h>
69 #include <asm/nmi.h>
70 
71 #if defined(CONFIG_DEBUGGER) || defined(CONFIG_KEXEC_CORE)
72 int (*__debugger)(struct pt_regs *regs) __read_mostly;
73 int (*__debugger_ipi)(struct pt_regs *regs) __read_mostly;
74 int (*__debugger_bpt)(struct pt_regs *regs) __read_mostly;
75 int (*__debugger_sstep)(struct pt_regs *regs) __read_mostly;
76 int (*__debugger_iabr_match)(struct pt_regs *regs) __read_mostly;
77 int (*__debugger_break_match)(struct pt_regs *regs) __read_mostly;
78 int (*__debugger_fault_handler)(struct pt_regs *regs) __read_mostly;
79 
80 EXPORT_SYMBOL(__debugger);
81 EXPORT_SYMBOL(__debugger_ipi);
82 EXPORT_SYMBOL(__debugger_bpt);
83 EXPORT_SYMBOL(__debugger_sstep);
84 EXPORT_SYMBOL(__debugger_iabr_match);
85 EXPORT_SYMBOL(__debugger_break_match);
86 EXPORT_SYMBOL(__debugger_fault_handler);
87 #endif
88 
89 /* Transactional Memory trap debug */
90 #ifdef TM_DEBUG_SW
91 #define TM_DEBUG(x...) printk(KERN_INFO x)
92 #else
93 #define TM_DEBUG(x...) do { } while(0)
94 #endif
95 
96 static const char *signame(int signr)
97 {
98 	switch (signr) {
99 	case SIGBUS:	return "bus error";
100 	case SIGFPE:	return "floating point exception";
101 	case SIGILL:	return "illegal instruction";
102 	case SIGSEGV:	return "segfault";
103 	case SIGTRAP:	return "unhandled trap";
104 	}
105 
106 	return "unknown signal";
107 }
108 
109 /*
110  * Trap & Exception support
111  */
112 
113 #ifdef CONFIG_PMAC_BACKLIGHT
114 static void pmac_backlight_unblank(void)
115 {
116 	mutex_lock(&pmac_backlight_mutex);
117 	if (pmac_backlight) {
118 		struct backlight_properties *props;
119 
120 		props = &pmac_backlight->props;
121 		props->brightness = props->max_brightness;
122 		props->power = FB_BLANK_UNBLANK;
123 		backlight_update_status(pmac_backlight);
124 	}
125 	mutex_unlock(&pmac_backlight_mutex);
126 }
127 #else
128 static inline void pmac_backlight_unblank(void) { }
129 #endif
130 
131 /*
132  * If oops/die is expected to crash the machine, return true here.
133  *
134  * This should not be expected to be 100% accurate, there may be
135  * notifiers registered or other unexpected conditions that may bring
136  * down the kernel. Or if the current process in the kernel is holding
137  * locks or has other critical state, the kernel may become effectively
138  * unusable anyway.
139  */
140 bool die_will_crash(void)
141 {
142 	if (should_fadump_crash())
143 		return true;
144 	if (kexec_should_crash(current))
145 		return true;
146 	if (in_interrupt() || panic_on_oops ||
147 			!current->pid || is_global_init(current))
148 		return true;
149 
150 	return false;
151 }
152 
153 static arch_spinlock_t die_lock = __ARCH_SPIN_LOCK_UNLOCKED;
154 static int die_owner = -1;
155 static unsigned int die_nest_count;
156 static int die_counter;
157 
158 extern void panic_flush_kmsg_start(void)
159 {
160 	/*
161 	 * These are mostly taken from kernel/panic.c, but tries to do
162 	 * relatively minimal work. Don't use delay functions (TB may
163 	 * be broken), don't crash dump (need to set a firmware log),
164 	 * don't run notifiers. We do want to get some information to
165 	 * Linux console.
166 	 */
167 	console_verbose();
168 	bust_spinlocks(1);
169 }
170 
171 extern void panic_flush_kmsg_end(void)
172 {
173 	printk_safe_flush_on_panic();
174 	kmsg_dump(KMSG_DUMP_PANIC);
175 	bust_spinlocks(0);
176 	debug_locks_off();
177 	console_flush_on_panic(CONSOLE_FLUSH_PENDING);
178 }
179 
180 static unsigned long oops_begin(struct pt_regs *regs)
181 {
182 	int cpu;
183 	unsigned long flags;
184 
185 	oops_enter();
186 
187 	/* racy, but better than risking deadlock. */
188 	raw_local_irq_save(flags);
189 	cpu = smp_processor_id();
190 	if (!arch_spin_trylock(&die_lock)) {
191 		if (cpu == die_owner)
192 			/* nested oops. should stop eventually */;
193 		else
194 			arch_spin_lock(&die_lock);
195 	}
196 	die_nest_count++;
197 	die_owner = cpu;
198 	console_verbose();
199 	bust_spinlocks(1);
200 	if (machine_is(powermac))
201 		pmac_backlight_unblank();
202 	return flags;
203 }
204 NOKPROBE_SYMBOL(oops_begin);
205 
206 static void oops_end(unsigned long flags, struct pt_regs *regs,
207 			       int signr)
208 {
209 	bust_spinlocks(0);
210 	add_taint(TAINT_DIE, LOCKDEP_NOW_UNRELIABLE);
211 	die_nest_count--;
212 	oops_exit();
213 	printk("\n");
214 	if (!die_nest_count) {
215 		/* Nest count reaches zero, release the lock. */
216 		die_owner = -1;
217 		arch_spin_unlock(&die_lock);
218 	}
219 	raw_local_irq_restore(flags);
220 
221 	/*
222 	 * system_reset_excption handles debugger, crash dump, panic, for 0x100
223 	 */
224 	if (TRAP(regs) == 0x100)
225 		return;
226 
227 	crash_fadump(regs, "die oops");
228 
229 	if (kexec_should_crash(current))
230 		crash_kexec(regs);
231 
232 	if (!signr)
233 		return;
234 
235 	/*
236 	 * While our oops output is serialised by a spinlock, output
237 	 * from panic() called below can race and corrupt it. If we
238 	 * know we are going to panic, delay for 1 second so we have a
239 	 * chance to get clean backtraces from all CPUs that are oopsing.
240 	 */
241 	if (in_interrupt() || panic_on_oops || !current->pid ||
242 	    is_global_init(current)) {
243 		mdelay(MSEC_PER_SEC);
244 	}
245 
246 	if (panic_on_oops)
247 		panic("Fatal exception");
248 	do_exit(signr);
249 }
250 NOKPROBE_SYMBOL(oops_end);
251 
252 static char *get_mmu_str(void)
253 {
254 	if (early_radix_enabled())
255 		return " MMU=Radix";
256 	if (early_mmu_has_feature(MMU_FTR_HPTE_TABLE))
257 		return " MMU=Hash";
258 	return "";
259 }
260 
261 static int __die(const char *str, struct pt_regs *regs, long err)
262 {
263 	printk("Oops: %s, sig: %ld [#%d]\n", str, err, ++die_counter);
264 
265 	printk("%s PAGE_SIZE=%luK%s%s%s%s%s%s %s\n",
266 	       IS_ENABLED(CONFIG_CPU_LITTLE_ENDIAN) ? "LE" : "BE",
267 	       PAGE_SIZE / 1024, get_mmu_str(),
268 	       IS_ENABLED(CONFIG_PREEMPT) ? " PREEMPT" : "",
269 	       IS_ENABLED(CONFIG_SMP) ? " SMP" : "",
270 	       IS_ENABLED(CONFIG_SMP) ? (" NR_CPUS=" __stringify(NR_CPUS)) : "",
271 	       debug_pagealloc_enabled() ? " DEBUG_PAGEALLOC" : "",
272 	       IS_ENABLED(CONFIG_NUMA) ? " NUMA" : "",
273 	       ppc_md.name ? ppc_md.name : "");
274 
275 	if (notify_die(DIE_OOPS, str, regs, err, 255, SIGSEGV) == NOTIFY_STOP)
276 		return 1;
277 
278 	print_modules();
279 	show_regs(regs);
280 
281 	return 0;
282 }
283 NOKPROBE_SYMBOL(__die);
284 
285 void die(const char *str, struct pt_regs *regs, long err)
286 {
287 	unsigned long flags;
288 
289 	/*
290 	 * system_reset_excption handles debugger, crash dump, panic, for 0x100
291 	 */
292 	if (TRAP(regs) != 0x100) {
293 		if (debugger(regs))
294 			return;
295 	}
296 
297 	flags = oops_begin(regs);
298 	if (__die(str, regs, err))
299 		err = 0;
300 	oops_end(flags, regs, err);
301 }
302 NOKPROBE_SYMBOL(die);
303 
304 void user_single_step_report(struct pt_regs *regs)
305 {
306 	force_sig_fault(SIGTRAP, TRAP_TRACE, (void __user *)regs->nip);
307 }
308 
309 static void show_signal_msg(int signr, struct pt_regs *regs, int code,
310 			    unsigned long addr)
311 {
312 	static DEFINE_RATELIMIT_STATE(rs, DEFAULT_RATELIMIT_INTERVAL,
313 				      DEFAULT_RATELIMIT_BURST);
314 
315 	if (!show_unhandled_signals)
316 		return;
317 
318 	if (!unhandled_signal(current, signr))
319 		return;
320 
321 	if (!__ratelimit(&rs))
322 		return;
323 
324 	pr_info("%s[%d]: %s (%d) at %lx nip %lx lr %lx code %x",
325 		current->comm, current->pid, signame(signr), signr,
326 		addr, regs->nip, regs->link, code);
327 
328 	print_vma_addr(KERN_CONT " in ", regs->nip);
329 
330 	pr_cont("\n");
331 
332 	show_user_instructions(regs);
333 }
334 
335 static bool exception_common(int signr, struct pt_regs *regs, int code,
336 			      unsigned long addr)
337 {
338 	if (!user_mode(regs)) {
339 		die("Exception in kernel mode", regs, signr);
340 		return false;
341 	}
342 
343 	show_signal_msg(signr, regs, code, addr);
344 
345 	if (arch_irqs_disabled() && !arch_irq_disabled_regs(regs))
346 		local_irq_enable();
347 
348 	current->thread.trap_nr = code;
349 
350 	return true;
351 }
352 
353 void _exception_pkey(struct pt_regs *regs, unsigned long addr, int key)
354 {
355 	if (!exception_common(SIGSEGV, regs, SEGV_PKUERR, addr))
356 		return;
357 
358 	force_sig_pkuerr((void __user *) addr, key);
359 }
360 
361 void _exception(int signr, struct pt_regs *regs, int code, unsigned long addr)
362 {
363 	if (!exception_common(signr, regs, code, addr))
364 		return;
365 
366 	force_sig_fault(signr, code, (void __user *)addr);
367 }
368 
369 /*
370  * The interrupt architecture has a quirk in that the HV interrupts excluding
371  * the NMIs (0x100 and 0x200) do not clear MSR[RI] at entry. The first thing
372  * that an interrupt handler must do is save off a GPR into a scratch register,
373  * and all interrupts on POWERNV (HV=1) use the HSPRG1 register as scratch.
374  * Therefore an NMI can clobber an HV interrupt's live HSPRG1 without noticing
375  * that it is non-reentrant, which leads to random data corruption.
376  *
377  * The solution is for NMI interrupts in HV mode to check if they originated
378  * from these critical HV interrupt regions. If so, then mark them not
379  * recoverable.
380  *
381  * An alternative would be for HV NMIs to use SPRG for scratch to avoid the
382  * HSPRG1 clobber, however this would cause guest SPRG to be clobbered. Linux
383  * guests should always have MSR[RI]=0 when its scratch SPRG is in use, so
384  * that would work. However any other guest OS that may have the SPRG live
385  * and MSR[RI]=1 could encounter silent corruption.
386  *
387  * Builds that do not support KVM could take this second option to increase
388  * the recoverability of NMIs.
389  */
390 void hv_nmi_check_nonrecoverable(struct pt_regs *regs)
391 {
392 #ifdef CONFIG_PPC_POWERNV
393 	unsigned long kbase = (unsigned long)_stext;
394 	unsigned long nip = regs->nip;
395 
396 	if (!(regs->msr & MSR_RI))
397 		return;
398 	if (!(regs->msr & MSR_HV))
399 		return;
400 	if (regs->msr & MSR_PR)
401 		return;
402 
403 	/*
404 	 * Now test if the interrupt has hit a range that may be using
405 	 * HSPRG1 without having RI=0 (i.e., an HSRR interrupt). The
406 	 * problem ranges all run un-relocated. Test real and virt modes
407 	 * at the same time by droping the high bit of the nip (virt mode
408 	 * entry points still have the +0x4000 offset).
409 	 */
410 	nip &= ~0xc000000000000000ULL;
411 	if ((nip >= 0x500 && nip < 0x600) || (nip >= 0x4500 && nip < 0x4600))
412 		goto nonrecoverable;
413 	if ((nip >= 0x980 && nip < 0xa00) || (nip >= 0x4980 && nip < 0x4a00))
414 		goto nonrecoverable;
415 	if ((nip >= 0xe00 && nip < 0xec0) || (nip >= 0x4e00 && nip < 0x4ec0))
416 		goto nonrecoverable;
417 	if ((nip >= 0xf80 && nip < 0xfa0) || (nip >= 0x4f80 && nip < 0x4fa0))
418 		goto nonrecoverable;
419 
420 	/* Trampoline code runs un-relocated so subtract kbase. */
421 	if (nip >= (unsigned long)(start_real_trampolines - kbase) &&
422 			nip < (unsigned long)(end_real_trampolines - kbase))
423 		goto nonrecoverable;
424 	if (nip >= (unsigned long)(start_virt_trampolines - kbase) &&
425 			nip < (unsigned long)(end_virt_trampolines - kbase))
426 		goto nonrecoverable;
427 	return;
428 
429 nonrecoverable:
430 	regs->msr &= ~MSR_RI;
431 #endif
432 }
433 
434 void system_reset_exception(struct pt_regs *regs)
435 {
436 	unsigned long hsrr0, hsrr1;
437 	bool saved_hsrrs = false;
438 	u8 ftrace_enabled = this_cpu_get_ftrace_enabled();
439 
440 	this_cpu_set_ftrace_enabled(0);
441 
442 	nmi_enter();
443 
444 	/*
445 	 * System reset can interrupt code where HSRRs are live and MSR[RI]=1.
446 	 * The system reset interrupt itself may clobber HSRRs (e.g., to call
447 	 * OPAL), so save them here and restore them before returning.
448 	 *
449 	 * Machine checks don't need to save HSRRs, as the real mode handler
450 	 * is careful to avoid them, and the regular handler is not delivered
451 	 * as an NMI.
452 	 */
453 	if (cpu_has_feature(CPU_FTR_HVMODE)) {
454 		hsrr0 = mfspr(SPRN_HSRR0);
455 		hsrr1 = mfspr(SPRN_HSRR1);
456 		saved_hsrrs = true;
457 	}
458 
459 	hv_nmi_check_nonrecoverable(regs);
460 
461 	__this_cpu_inc(irq_stat.sreset_irqs);
462 
463 	/* See if any machine dependent calls */
464 	if (ppc_md.system_reset_exception) {
465 		if (ppc_md.system_reset_exception(regs))
466 			goto out;
467 	}
468 
469 	if (debugger(regs))
470 		goto out;
471 
472 	kmsg_dump(KMSG_DUMP_OOPS);
473 	/*
474 	 * A system reset is a request to dump, so we always send
475 	 * it through the crashdump code (if fadump or kdump are
476 	 * registered).
477 	 */
478 	crash_fadump(regs, "System Reset");
479 
480 	crash_kexec(regs);
481 
482 	/*
483 	 * We aren't the primary crash CPU. We need to send it
484 	 * to a holding pattern to avoid it ending up in the panic
485 	 * code.
486 	 */
487 	crash_kexec_secondary(regs);
488 
489 	/*
490 	 * No debugger or crash dump registered, print logs then
491 	 * panic.
492 	 */
493 	die("System Reset", regs, SIGABRT);
494 
495 	mdelay(2*MSEC_PER_SEC); /* Wait a little while for others to print */
496 	add_taint(TAINT_DIE, LOCKDEP_NOW_UNRELIABLE);
497 	nmi_panic(regs, "System Reset");
498 
499 out:
500 #ifdef CONFIG_PPC_BOOK3S_64
501 	BUG_ON(get_paca()->in_nmi == 0);
502 	if (get_paca()->in_nmi > 1)
503 		die("Unrecoverable nested System Reset", regs, SIGABRT);
504 #endif
505 	/* Must die if the interrupt is not recoverable */
506 	if (!(regs->msr & MSR_RI))
507 		die("Unrecoverable System Reset", regs, SIGABRT);
508 
509 	if (saved_hsrrs) {
510 		mtspr(SPRN_HSRR0, hsrr0);
511 		mtspr(SPRN_HSRR1, hsrr1);
512 	}
513 
514 	nmi_exit();
515 
516 	this_cpu_set_ftrace_enabled(ftrace_enabled);
517 
518 	/* What should we do here? We could issue a shutdown or hard reset. */
519 }
520 
521 /*
522  * I/O accesses can cause machine checks on powermacs.
523  * Check if the NIP corresponds to the address of a sync
524  * instruction for which there is an entry in the exception
525  * table.
526  *  -- paulus.
527  */
528 static inline int check_io_access(struct pt_regs *regs)
529 {
530 #ifdef CONFIG_PPC32
531 	unsigned long msr = regs->msr;
532 	const struct exception_table_entry *entry;
533 	unsigned int *nip = (unsigned int *)regs->nip;
534 
535 	if (((msr & 0xffff0000) == 0 || (msr & (0x80000 | 0x40000)))
536 	    && (entry = search_exception_tables(regs->nip)) != NULL) {
537 		/*
538 		 * Check that it's a sync instruction, or somewhere
539 		 * in the twi; isync; nop sequence that inb/inw/inl uses.
540 		 * As the address is in the exception table
541 		 * we should be able to read the instr there.
542 		 * For the debug message, we look at the preceding
543 		 * load or store.
544 		 */
545 		if (*nip == PPC_INST_NOP)
546 			nip -= 2;
547 		else if (*nip == PPC_INST_ISYNC)
548 			--nip;
549 		if (*nip == PPC_INST_SYNC || (*nip >> 26) == OP_TRAP) {
550 			unsigned int rb;
551 
552 			--nip;
553 			rb = (*nip >> 11) & 0x1f;
554 			printk(KERN_DEBUG "%s bad port %lx at %p\n",
555 			       (*nip & 0x100)? "OUT to": "IN from",
556 			       regs->gpr[rb] - _IO_BASE, nip);
557 			regs->msr |= MSR_RI;
558 			regs->nip = extable_fixup(entry);
559 			return 1;
560 		}
561 	}
562 #endif /* CONFIG_PPC32 */
563 	return 0;
564 }
565 
566 #ifdef CONFIG_PPC_ADV_DEBUG_REGS
567 /* On 4xx, the reason for the machine check or program exception
568    is in the ESR. */
569 #define get_reason(regs)	((regs)->dsisr)
570 #define REASON_FP		ESR_FP
571 #define REASON_ILLEGAL		(ESR_PIL | ESR_PUO)
572 #define REASON_PRIVILEGED	ESR_PPR
573 #define REASON_TRAP		ESR_PTR
574 #define REASON_PREFIXED		0
575 #define REASON_BOUNDARY		0
576 
577 /* single-step stuff */
578 #define single_stepping(regs)	(current->thread.debug.dbcr0 & DBCR0_IC)
579 #define clear_single_step(regs)	(current->thread.debug.dbcr0 &= ~DBCR0_IC)
580 #define clear_br_trace(regs)	do {} while(0)
581 #else
582 /* On non-4xx, the reason for the machine check or program
583    exception is in the MSR. */
584 #define get_reason(regs)	((regs)->msr)
585 #define REASON_TM		SRR1_PROGTM
586 #define REASON_FP		SRR1_PROGFPE
587 #define REASON_ILLEGAL		SRR1_PROGILL
588 #define REASON_PRIVILEGED	SRR1_PROGPRIV
589 #define REASON_TRAP		SRR1_PROGTRAP
590 #define REASON_PREFIXED		SRR1_PREFIXED
591 #define REASON_BOUNDARY		SRR1_BOUNDARY
592 
593 #define single_stepping(regs)	((regs)->msr & MSR_SE)
594 #define clear_single_step(regs)	((regs)->msr &= ~MSR_SE)
595 #define clear_br_trace(regs)	((regs)->msr &= ~MSR_BE)
596 #endif
597 
598 #define inst_length(reason)	(((reason) & REASON_PREFIXED) ? 8 : 4)
599 
600 #if defined(CONFIG_E500)
601 int machine_check_e500mc(struct pt_regs *regs)
602 {
603 	unsigned long mcsr = mfspr(SPRN_MCSR);
604 	unsigned long pvr = mfspr(SPRN_PVR);
605 	unsigned long reason = mcsr;
606 	int recoverable = 1;
607 
608 	if (reason & MCSR_LD) {
609 		recoverable = fsl_rio_mcheck_exception(regs);
610 		if (recoverable == 1)
611 			goto silent_out;
612 	}
613 
614 	printk("Machine check in kernel mode.\n");
615 	printk("Caused by (from MCSR=%lx): ", reason);
616 
617 	if (reason & MCSR_MCP)
618 		pr_cont("Machine Check Signal\n");
619 
620 	if (reason & MCSR_ICPERR) {
621 		pr_cont("Instruction Cache Parity Error\n");
622 
623 		/*
624 		 * This is recoverable by invalidating the i-cache.
625 		 */
626 		mtspr(SPRN_L1CSR1, mfspr(SPRN_L1CSR1) | L1CSR1_ICFI);
627 		while (mfspr(SPRN_L1CSR1) & L1CSR1_ICFI)
628 			;
629 
630 		/*
631 		 * This will generally be accompanied by an instruction
632 		 * fetch error report -- only treat MCSR_IF as fatal
633 		 * if it wasn't due to an L1 parity error.
634 		 */
635 		reason &= ~MCSR_IF;
636 	}
637 
638 	if (reason & MCSR_DCPERR_MC) {
639 		pr_cont("Data Cache Parity Error\n");
640 
641 		/*
642 		 * In write shadow mode we auto-recover from the error, but it
643 		 * may still get logged and cause a machine check.  We should
644 		 * only treat the non-write shadow case as non-recoverable.
645 		 */
646 		/* On e6500 core, L1 DCWS (Data cache write shadow mode) bit
647 		 * is not implemented but L1 data cache always runs in write
648 		 * shadow mode. Hence on data cache parity errors HW will
649 		 * automatically invalidate the L1 Data Cache.
650 		 */
651 		if (PVR_VER(pvr) != PVR_VER_E6500) {
652 			if (!(mfspr(SPRN_L1CSR2) & L1CSR2_DCWS))
653 				recoverable = 0;
654 		}
655 	}
656 
657 	if (reason & MCSR_L2MMU_MHIT) {
658 		pr_cont("Hit on multiple TLB entries\n");
659 		recoverable = 0;
660 	}
661 
662 	if (reason & MCSR_NMI)
663 		pr_cont("Non-maskable interrupt\n");
664 
665 	if (reason & MCSR_IF) {
666 		pr_cont("Instruction Fetch Error Report\n");
667 		recoverable = 0;
668 	}
669 
670 	if (reason & MCSR_LD) {
671 		pr_cont("Load Error Report\n");
672 		recoverable = 0;
673 	}
674 
675 	if (reason & MCSR_ST) {
676 		pr_cont("Store Error Report\n");
677 		recoverable = 0;
678 	}
679 
680 	if (reason & MCSR_LDG) {
681 		pr_cont("Guarded Load Error Report\n");
682 		recoverable = 0;
683 	}
684 
685 	if (reason & MCSR_TLBSYNC)
686 		pr_cont("Simultaneous tlbsync operations\n");
687 
688 	if (reason & MCSR_BSL2_ERR) {
689 		pr_cont("Level 2 Cache Error\n");
690 		recoverable = 0;
691 	}
692 
693 	if (reason & MCSR_MAV) {
694 		u64 addr;
695 
696 		addr = mfspr(SPRN_MCAR);
697 		addr |= (u64)mfspr(SPRN_MCARU) << 32;
698 
699 		pr_cont("Machine Check %s Address: %#llx\n",
700 		       reason & MCSR_MEA ? "Effective" : "Physical", addr);
701 	}
702 
703 silent_out:
704 	mtspr(SPRN_MCSR, mcsr);
705 	return mfspr(SPRN_MCSR) == 0 && recoverable;
706 }
707 
708 int machine_check_e500(struct pt_regs *regs)
709 {
710 	unsigned long reason = mfspr(SPRN_MCSR);
711 
712 	if (reason & MCSR_BUS_RBERR) {
713 		if (fsl_rio_mcheck_exception(regs))
714 			return 1;
715 		if (fsl_pci_mcheck_exception(regs))
716 			return 1;
717 	}
718 
719 	printk("Machine check in kernel mode.\n");
720 	printk("Caused by (from MCSR=%lx): ", reason);
721 
722 	if (reason & MCSR_MCP)
723 		pr_cont("Machine Check Signal\n");
724 	if (reason & MCSR_ICPERR)
725 		pr_cont("Instruction Cache Parity Error\n");
726 	if (reason & MCSR_DCP_PERR)
727 		pr_cont("Data Cache Push Parity Error\n");
728 	if (reason & MCSR_DCPERR)
729 		pr_cont("Data Cache Parity Error\n");
730 	if (reason & MCSR_BUS_IAERR)
731 		pr_cont("Bus - Instruction Address Error\n");
732 	if (reason & MCSR_BUS_RAERR)
733 		pr_cont("Bus - Read Address Error\n");
734 	if (reason & MCSR_BUS_WAERR)
735 		pr_cont("Bus - Write Address Error\n");
736 	if (reason & MCSR_BUS_IBERR)
737 		pr_cont("Bus - Instruction Data Error\n");
738 	if (reason & MCSR_BUS_RBERR)
739 		pr_cont("Bus - Read Data Bus Error\n");
740 	if (reason & MCSR_BUS_WBERR)
741 		pr_cont("Bus - Write Data Bus Error\n");
742 	if (reason & MCSR_BUS_IPERR)
743 		pr_cont("Bus - Instruction Parity Error\n");
744 	if (reason & MCSR_BUS_RPERR)
745 		pr_cont("Bus - Read Parity Error\n");
746 
747 	return 0;
748 }
749 
750 int machine_check_generic(struct pt_regs *regs)
751 {
752 	return 0;
753 }
754 #elif defined(CONFIG_PPC32)
755 int machine_check_generic(struct pt_regs *regs)
756 {
757 	unsigned long reason = regs->msr;
758 
759 	printk("Machine check in kernel mode.\n");
760 	printk("Caused by (from SRR1=%lx): ", reason);
761 	switch (reason & 0x601F0000) {
762 	case 0x80000:
763 		pr_cont("Machine check signal\n");
764 		break;
765 	case 0x40000:
766 	case 0x140000:	/* 7450 MSS error and TEA */
767 		pr_cont("Transfer error ack signal\n");
768 		break;
769 	case 0x20000:
770 		pr_cont("Data parity error signal\n");
771 		break;
772 	case 0x10000:
773 		pr_cont("Address parity error signal\n");
774 		break;
775 	case 0x20000000:
776 		pr_cont("L1 Data Cache error\n");
777 		break;
778 	case 0x40000000:
779 		pr_cont("L1 Instruction Cache error\n");
780 		break;
781 	case 0x00100000:
782 		pr_cont("L2 data cache parity error\n");
783 		break;
784 	default:
785 		pr_cont("Unknown values in msr\n");
786 	}
787 	return 0;
788 }
789 #endif /* everything else */
790 
791 void machine_check_exception(struct pt_regs *regs)
792 {
793 	int recover = 0;
794 
795 	/*
796 	 * BOOK3S_64 does not call this handler as a non-maskable interrupt
797 	 * (it uses its own early real-mode handler to handle the MCE proper
798 	 * and then raises irq_work to call this handler when interrupts are
799 	 * enabled).
800 	 *
801 	 * This is silly. The BOOK3S_64 should just call a different function
802 	 * rather than expecting semantics to magically change. Something
803 	 * like 'non_nmi_machine_check_exception()', perhaps?
804 	 */
805 	const bool nmi = !IS_ENABLED(CONFIG_PPC_BOOK3S_64);
806 
807 	if (nmi) nmi_enter();
808 
809 	__this_cpu_inc(irq_stat.mce_exceptions);
810 
811 	add_taint(TAINT_MACHINE_CHECK, LOCKDEP_NOW_UNRELIABLE);
812 
813 	/* See if any machine dependent calls. In theory, we would want
814 	 * to call the CPU first, and call the ppc_md. one if the CPU
815 	 * one returns a positive number. However there is existing code
816 	 * that assumes the board gets a first chance, so let's keep it
817 	 * that way for now and fix things later. --BenH.
818 	 */
819 	if (ppc_md.machine_check_exception)
820 		recover = ppc_md.machine_check_exception(regs);
821 	else if (cur_cpu_spec->machine_check)
822 		recover = cur_cpu_spec->machine_check(regs);
823 
824 	if (recover > 0)
825 		goto bail;
826 
827 	if (debugger_fault_handler(regs))
828 		goto bail;
829 
830 	if (check_io_access(regs))
831 		goto bail;
832 
833 	if (nmi) nmi_exit();
834 
835 	die("Machine check", regs, SIGBUS);
836 
837 	/* Must die if the interrupt is not recoverable */
838 	if (!(regs->msr & MSR_RI))
839 		die("Unrecoverable Machine check", regs, SIGBUS);
840 
841 	return;
842 
843 bail:
844 	if (nmi) nmi_exit();
845 }
846 
847 void SMIException(struct pt_regs *regs)
848 {
849 	die("System Management Interrupt", regs, SIGABRT);
850 }
851 
852 #ifdef CONFIG_VSX
853 static void p9_hmi_special_emu(struct pt_regs *regs)
854 {
855 	unsigned int ra, rb, t, i, sel, instr, rc;
856 	const void __user *addr;
857 	u8 vbuf[16] __aligned(16), *vdst;
858 	unsigned long ea, msr, msr_mask;
859 	bool swap;
860 
861 	if (__get_user_inatomic(instr, (unsigned int __user *)regs->nip))
862 		return;
863 
864 	/*
865 	 * lxvb16x	opcode: 0x7c0006d8
866 	 * lxvd2x	opcode: 0x7c000698
867 	 * lxvh8x	opcode: 0x7c000658
868 	 * lxvw4x	opcode: 0x7c000618
869 	 */
870 	if ((instr & 0xfc00073e) != 0x7c000618) {
871 		pr_devel("HMI vec emu: not vector CI %i:%s[%d] nip=%016lx"
872 			 " instr=%08x\n",
873 			 smp_processor_id(), current->comm, current->pid,
874 			 regs->nip, instr);
875 		return;
876 	}
877 
878 	/* Grab vector registers into the task struct */
879 	msr = regs->msr; /* Grab msr before we flush the bits */
880 	flush_vsx_to_thread(current);
881 	enable_kernel_altivec();
882 
883 	/*
884 	 * Is userspace running with a different endian (this is rare but
885 	 * not impossible)
886 	 */
887 	swap = (msr & MSR_LE) != (MSR_KERNEL & MSR_LE);
888 
889 	/* Decode the instruction */
890 	ra = (instr >> 16) & 0x1f;
891 	rb = (instr >> 11) & 0x1f;
892 	t = (instr >> 21) & 0x1f;
893 	if (instr & 1)
894 		vdst = (u8 *)&current->thread.vr_state.vr[t];
895 	else
896 		vdst = (u8 *)&current->thread.fp_state.fpr[t][0];
897 
898 	/* Grab the vector address */
899 	ea = regs->gpr[rb] + (ra ? regs->gpr[ra] : 0);
900 	if (is_32bit_task())
901 		ea &= 0xfffffffful;
902 	addr = (__force const void __user *)ea;
903 
904 	/* Check it */
905 	if (!access_ok(addr, 16)) {
906 		pr_devel("HMI vec emu: bad access %i:%s[%d] nip=%016lx"
907 			 " instr=%08x addr=%016lx\n",
908 			 smp_processor_id(), current->comm, current->pid,
909 			 regs->nip, instr, (unsigned long)addr);
910 		return;
911 	}
912 
913 	/* Read the vector */
914 	rc = 0;
915 	if ((unsigned long)addr & 0xfUL)
916 		/* unaligned case */
917 		rc = __copy_from_user_inatomic(vbuf, addr, 16);
918 	else
919 		__get_user_atomic_128_aligned(vbuf, addr, rc);
920 	if (rc) {
921 		pr_devel("HMI vec emu: page fault %i:%s[%d] nip=%016lx"
922 			 " instr=%08x addr=%016lx\n",
923 			 smp_processor_id(), current->comm, current->pid,
924 			 regs->nip, instr, (unsigned long)addr);
925 		return;
926 	}
927 
928 	pr_devel("HMI vec emu: emulated vector CI %i:%s[%d] nip=%016lx"
929 		 " instr=%08x addr=%016lx\n",
930 		 smp_processor_id(), current->comm, current->pid, regs->nip,
931 		 instr, (unsigned long) addr);
932 
933 	/* Grab instruction "selector" */
934 	sel = (instr >> 6) & 3;
935 
936 	/*
937 	 * Check to make sure the facility is actually enabled. This
938 	 * could happen if we get a false positive hit.
939 	 *
940 	 * lxvd2x/lxvw4x always check MSR VSX sel = 0,2
941 	 * lxvh8x/lxvb16x check MSR VSX or VEC depending on VSR used sel = 1,3
942 	 */
943 	msr_mask = MSR_VSX;
944 	if ((sel & 1) && (instr & 1)) /* lxvh8x & lxvb16x + VSR >= 32 */
945 		msr_mask = MSR_VEC;
946 	if (!(msr & msr_mask)) {
947 		pr_devel("HMI vec emu: MSR fac clear %i:%s[%d] nip=%016lx"
948 			 " instr=%08x msr:%016lx\n",
949 			 smp_processor_id(), current->comm, current->pid,
950 			 regs->nip, instr, msr);
951 		return;
952 	}
953 
954 	/* Do logging here before we modify sel based on endian */
955 	switch (sel) {
956 	case 0:	/* lxvw4x */
957 		PPC_WARN_EMULATED(lxvw4x, regs);
958 		break;
959 	case 1: /* lxvh8x */
960 		PPC_WARN_EMULATED(lxvh8x, regs);
961 		break;
962 	case 2: /* lxvd2x */
963 		PPC_WARN_EMULATED(lxvd2x, regs);
964 		break;
965 	case 3: /* lxvb16x */
966 		PPC_WARN_EMULATED(lxvb16x, regs);
967 		break;
968 	}
969 
970 #ifdef __LITTLE_ENDIAN__
971 	/*
972 	 * An LE kernel stores the vector in the task struct as an LE
973 	 * byte array (effectively swapping both the components and
974 	 * the content of the components). Those instructions expect
975 	 * the components to remain in ascending address order, so we
976 	 * swap them back.
977 	 *
978 	 * If we are running a BE user space, the expectation is that
979 	 * of a simple memcpy, so forcing the emulation to look like
980 	 * a lxvb16x should do the trick.
981 	 */
982 	if (swap)
983 		sel = 3;
984 
985 	switch (sel) {
986 	case 0:	/* lxvw4x */
987 		for (i = 0; i < 4; i++)
988 			((u32 *)vdst)[i] = ((u32 *)vbuf)[3-i];
989 		break;
990 	case 1: /* lxvh8x */
991 		for (i = 0; i < 8; i++)
992 			((u16 *)vdst)[i] = ((u16 *)vbuf)[7-i];
993 		break;
994 	case 2: /* lxvd2x */
995 		for (i = 0; i < 2; i++)
996 			((u64 *)vdst)[i] = ((u64 *)vbuf)[1-i];
997 		break;
998 	case 3: /* lxvb16x */
999 		for (i = 0; i < 16; i++)
1000 			vdst[i] = vbuf[15-i];
1001 		break;
1002 	}
1003 #else /* __LITTLE_ENDIAN__ */
1004 	/* On a big endian kernel, a BE userspace only needs a memcpy */
1005 	if (!swap)
1006 		sel = 3;
1007 
1008 	/* Otherwise, we need to swap the content of the components */
1009 	switch (sel) {
1010 	case 0:	/* lxvw4x */
1011 		for (i = 0; i < 4; i++)
1012 			((u32 *)vdst)[i] = cpu_to_le32(((u32 *)vbuf)[i]);
1013 		break;
1014 	case 1: /* lxvh8x */
1015 		for (i = 0; i < 8; i++)
1016 			((u16 *)vdst)[i] = cpu_to_le16(((u16 *)vbuf)[i]);
1017 		break;
1018 	case 2: /* lxvd2x */
1019 		for (i = 0; i < 2; i++)
1020 			((u64 *)vdst)[i] = cpu_to_le64(((u64 *)vbuf)[i]);
1021 		break;
1022 	case 3: /* lxvb16x */
1023 		memcpy(vdst, vbuf, 16);
1024 		break;
1025 	}
1026 #endif /* !__LITTLE_ENDIAN__ */
1027 
1028 	/* Go to next instruction */
1029 	regs->nip += 4;
1030 }
1031 #endif /* CONFIG_VSX */
1032 
1033 void handle_hmi_exception(struct pt_regs *regs)
1034 {
1035 	struct pt_regs *old_regs;
1036 
1037 	old_regs = set_irq_regs(regs);
1038 	irq_enter();
1039 
1040 #ifdef CONFIG_VSX
1041 	/* Real mode flagged P9 special emu is needed */
1042 	if (local_paca->hmi_p9_special_emu) {
1043 		local_paca->hmi_p9_special_emu = 0;
1044 
1045 		/*
1046 		 * We don't want to take page faults while doing the
1047 		 * emulation, we just replay the instruction if necessary.
1048 		 */
1049 		pagefault_disable();
1050 		p9_hmi_special_emu(regs);
1051 		pagefault_enable();
1052 	}
1053 #endif /* CONFIG_VSX */
1054 
1055 	if (ppc_md.handle_hmi_exception)
1056 		ppc_md.handle_hmi_exception(regs);
1057 
1058 	irq_exit();
1059 	set_irq_regs(old_regs);
1060 }
1061 
1062 void unknown_exception(struct pt_regs *regs)
1063 {
1064 	enum ctx_state prev_state = exception_enter();
1065 
1066 	printk("Bad trap at PC: %lx, SR: %lx, vector=%lx\n",
1067 	       regs->nip, regs->msr, regs->trap);
1068 
1069 	_exception(SIGTRAP, regs, TRAP_UNK, 0);
1070 
1071 	exception_exit(prev_state);
1072 }
1073 
1074 void instruction_breakpoint_exception(struct pt_regs *regs)
1075 {
1076 	enum ctx_state prev_state = exception_enter();
1077 
1078 	if (notify_die(DIE_IABR_MATCH, "iabr_match", regs, 5,
1079 					5, SIGTRAP) == NOTIFY_STOP)
1080 		goto bail;
1081 	if (debugger_iabr_match(regs))
1082 		goto bail;
1083 	_exception(SIGTRAP, regs, TRAP_BRKPT, regs->nip);
1084 
1085 bail:
1086 	exception_exit(prev_state);
1087 }
1088 
1089 void RunModeException(struct pt_regs *regs)
1090 {
1091 	_exception(SIGTRAP, regs, TRAP_UNK, 0);
1092 }
1093 
1094 void single_step_exception(struct pt_regs *regs)
1095 {
1096 	enum ctx_state prev_state = exception_enter();
1097 
1098 	clear_single_step(regs);
1099 	clear_br_trace(regs);
1100 
1101 	if (kprobe_post_handler(regs))
1102 		return;
1103 
1104 	if (notify_die(DIE_SSTEP, "single_step", regs, 5,
1105 					5, SIGTRAP) == NOTIFY_STOP)
1106 		goto bail;
1107 	if (debugger_sstep(regs))
1108 		goto bail;
1109 
1110 	_exception(SIGTRAP, regs, TRAP_TRACE, regs->nip);
1111 
1112 bail:
1113 	exception_exit(prev_state);
1114 }
1115 NOKPROBE_SYMBOL(single_step_exception);
1116 
1117 /*
1118  * After we have successfully emulated an instruction, we have to
1119  * check if the instruction was being single-stepped, and if so,
1120  * pretend we got a single-step exception.  This was pointed out
1121  * by Kumar Gala.  -- paulus
1122  */
1123 static void emulate_single_step(struct pt_regs *regs)
1124 {
1125 	if (single_stepping(regs))
1126 		single_step_exception(regs);
1127 }
1128 
1129 static inline int __parse_fpscr(unsigned long fpscr)
1130 {
1131 	int ret = FPE_FLTUNK;
1132 
1133 	/* Invalid operation */
1134 	if ((fpscr & FPSCR_VE) && (fpscr & FPSCR_VX))
1135 		ret = FPE_FLTINV;
1136 
1137 	/* Overflow */
1138 	else if ((fpscr & FPSCR_OE) && (fpscr & FPSCR_OX))
1139 		ret = FPE_FLTOVF;
1140 
1141 	/* Underflow */
1142 	else if ((fpscr & FPSCR_UE) && (fpscr & FPSCR_UX))
1143 		ret = FPE_FLTUND;
1144 
1145 	/* Divide by zero */
1146 	else if ((fpscr & FPSCR_ZE) && (fpscr & FPSCR_ZX))
1147 		ret = FPE_FLTDIV;
1148 
1149 	/* Inexact result */
1150 	else if ((fpscr & FPSCR_XE) && (fpscr & FPSCR_XX))
1151 		ret = FPE_FLTRES;
1152 
1153 	return ret;
1154 }
1155 
1156 static void parse_fpe(struct pt_regs *regs)
1157 {
1158 	int code = 0;
1159 
1160 	flush_fp_to_thread(current);
1161 
1162 #ifdef CONFIG_PPC_FPU_REGS
1163 	code = __parse_fpscr(current->thread.fp_state.fpscr);
1164 #endif
1165 
1166 	_exception(SIGFPE, regs, code, regs->nip);
1167 }
1168 
1169 /*
1170  * Illegal instruction emulation support.  Originally written to
1171  * provide the PVR to user applications using the mfspr rd, PVR.
1172  * Return non-zero if we can't emulate, or -EFAULT if the associated
1173  * memory access caused an access fault.  Return zero on success.
1174  *
1175  * There are a couple of ways to do this, either "decode" the instruction
1176  * or directly match lots of bits.  In this case, matching lots of
1177  * bits is faster and easier.
1178  *
1179  */
1180 static int emulate_string_inst(struct pt_regs *regs, u32 instword)
1181 {
1182 	u8 rT = (instword >> 21) & 0x1f;
1183 	u8 rA = (instword >> 16) & 0x1f;
1184 	u8 NB_RB = (instword >> 11) & 0x1f;
1185 	u32 num_bytes;
1186 	unsigned long EA;
1187 	int pos = 0;
1188 
1189 	/* Early out if we are an invalid form of lswx */
1190 	if ((instword & PPC_INST_STRING_MASK) == PPC_INST_LSWX)
1191 		if ((rT == rA) || (rT == NB_RB))
1192 			return -EINVAL;
1193 
1194 	EA = (rA == 0) ? 0 : regs->gpr[rA];
1195 
1196 	switch (instword & PPC_INST_STRING_MASK) {
1197 		case PPC_INST_LSWX:
1198 		case PPC_INST_STSWX:
1199 			EA += NB_RB;
1200 			num_bytes = regs->xer & 0x7f;
1201 			break;
1202 		case PPC_INST_LSWI:
1203 		case PPC_INST_STSWI:
1204 			num_bytes = (NB_RB == 0) ? 32 : NB_RB;
1205 			break;
1206 		default:
1207 			return -EINVAL;
1208 	}
1209 
1210 	while (num_bytes != 0)
1211 	{
1212 		u8 val;
1213 		u32 shift = 8 * (3 - (pos & 0x3));
1214 
1215 		/* if process is 32-bit, clear upper 32 bits of EA */
1216 		if ((regs->msr & MSR_64BIT) == 0)
1217 			EA &= 0xFFFFFFFF;
1218 
1219 		switch ((instword & PPC_INST_STRING_MASK)) {
1220 			case PPC_INST_LSWX:
1221 			case PPC_INST_LSWI:
1222 				if (get_user(val, (u8 __user *)EA))
1223 					return -EFAULT;
1224 				/* first time updating this reg,
1225 				 * zero it out */
1226 				if (pos == 0)
1227 					regs->gpr[rT] = 0;
1228 				regs->gpr[rT] |= val << shift;
1229 				break;
1230 			case PPC_INST_STSWI:
1231 			case PPC_INST_STSWX:
1232 				val = regs->gpr[rT] >> shift;
1233 				if (put_user(val, (u8 __user *)EA))
1234 					return -EFAULT;
1235 				break;
1236 		}
1237 		/* move EA to next address */
1238 		EA += 1;
1239 		num_bytes--;
1240 
1241 		/* manage our position within the register */
1242 		if (++pos == 4) {
1243 			pos = 0;
1244 			if (++rT == 32)
1245 				rT = 0;
1246 		}
1247 	}
1248 
1249 	return 0;
1250 }
1251 
1252 static int emulate_popcntb_inst(struct pt_regs *regs, u32 instword)
1253 {
1254 	u32 ra,rs;
1255 	unsigned long tmp;
1256 
1257 	ra = (instword >> 16) & 0x1f;
1258 	rs = (instword >> 21) & 0x1f;
1259 
1260 	tmp = regs->gpr[rs];
1261 	tmp = tmp - ((tmp >> 1) & 0x5555555555555555ULL);
1262 	tmp = (tmp & 0x3333333333333333ULL) + ((tmp >> 2) & 0x3333333333333333ULL);
1263 	tmp = (tmp + (tmp >> 4)) & 0x0f0f0f0f0f0f0f0fULL;
1264 	regs->gpr[ra] = tmp;
1265 
1266 	return 0;
1267 }
1268 
1269 static int emulate_isel(struct pt_regs *regs, u32 instword)
1270 {
1271 	u8 rT = (instword >> 21) & 0x1f;
1272 	u8 rA = (instword >> 16) & 0x1f;
1273 	u8 rB = (instword >> 11) & 0x1f;
1274 	u8 BC = (instword >> 6) & 0x1f;
1275 	u8 bit;
1276 	unsigned long tmp;
1277 
1278 	tmp = (rA == 0) ? 0 : regs->gpr[rA];
1279 	bit = (regs->ccr >> (31 - BC)) & 0x1;
1280 
1281 	regs->gpr[rT] = bit ? tmp : regs->gpr[rB];
1282 
1283 	return 0;
1284 }
1285 
1286 #ifdef CONFIG_PPC_TRANSACTIONAL_MEM
1287 static inline bool tm_abort_check(struct pt_regs *regs, int cause)
1288 {
1289         /* If we're emulating a load/store in an active transaction, we cannot
1290          * emulate it as the kernel operates in transaction suspended context.
1291          * We need to abort the transaction.  This creates a persistent TM
1292          * abort so tell the user what caused it with a new code.
1293 	 */
1294 	if (MSR_TM_TRANSACTIONAL(regs->msr)) {
1295 		tm_enable();
1296 		tm_abort(cause);
1297 		return true;
1298 	}
1299 	return false;
1300 }
1301 #else
1302 static inline bool tm_abort_check(struct pt_regs *regs, int reason)
1303 {
1304 	return false;
1305 }
1306 #endif
1307 
1308 static int emulate_instruction(struct pt_regs *regs)
1309 {
1310 	u32 instword;
1311 	u32 rd;
1312 
1313 	if (!user_mode(regs))
1314 		return -EINVAL;
1315 	CHECK_FULL_REGS(regs);
1316 
1317 	if (get_user(instword, (u32 __user *)(regs->nip)))
1318 		return -EFAULT;
1319 
1320 	/* Emulate the mfspr rD, PVR. */
1321 	if ((instword & PPC_INST_MFSPR_PVR_MASK) == PPC_INST_MFSPR_PVR) {
1322 		PPC_WARN_EMULATED(mfpvr, regs);
1323 		rd = (instword >> 21) & 0x1f;
1324 		regs->gpr[rd] = mfspr(SPRN_PVR);
1325 		return 0;
1326 	}
1327 
1328 	/* Emulating the dcba insn is just a no-op.  */
1329 	if ((instword & PPC_INST_DCBA_MASK) == PPC_INST_DCBA) {
1330 		PPC_WARN_EMULATED(dcba, regs);
1331 		return 0;
1332 	}
1333 
1334 	/* Emulate the mcrxr insn.  */
1335 	if ((instword & PPC_INST_MCRXR_MASK) == PPC_INST_MCRXR) {
1336 		int shift = (instword >> 21) & 0x1c;
1337 		unsigned long msk = 0xf0000000UL >> shift;
1338 
1339 		PPC_WARN_EMULATED(mcrxr, regs);
1340 		regs->ccr = (regs->ccr & ~msk) | ((regs->xer >> shift) & msk);
1341 		regs->xer &= ~0xf0000000UL;
1342 		return 0;
1343 	}
1344 
1345 	/* Emulate load/store string insn. */
1346 	if ((instword & PPC_INST_STRING_GEN_MASK) == PPC_INST_STRING) {
1347 		if (tm_abort_check(regs,
1348 				   TM_CAUSE_EMULATE | TM_CAUSE_PERSISTENT))
1349 			return -EINVAL;
1350 		PPC_WARN_EMULATED(string, regs);
1351 		return emulate_string_inst(regs, instword);
1352 	}
1353 
1354 	/* Emulate the popcntb (Population Count Bytes) instruction. */
1355 	if ((instword & PPC_INST_POPCNTB_MASK) == PPC_INST_POPCNTB) {
1356 		PPC_WARN_EMULATED(popcntb, regs);
1357 		return emulate_popcntb_inst(regs, instword);
1358 	}
1359 
1360 	/* Emulate isel (Integer Select) instruction */
1361 	if ((instword & PPC_INST_ISEL_MASK) == PPC_INST_ISEL) {
1362 		PPC_WARN_EMULATED(isel, regs);
1363 		return emulate_isel(regs, instword);
1364 	}
1365 
1366 	/* Emulate sync instruction variants */
1367 	if ((instword & PPC_INST_SYNC_MASK) == PPC_INST_SYNC) {
1368 		PPC_WARN_EMULATED(sync, regs);
1369 		asm volatile("sync");
1370 		return 0;
1371 	}
1372 
1373 #ifdef CONFIG_PPC64
1374 	/* Emulate the mfspr rD, DSCR. */
1375 	if ((((instword & PPC_INST_MFSPR_DSCR_USER_MASK) ==
1376 		PPC_INST_MFSPR_DSCR_USER) ||
1377 	     ((instword & PPC_INST_MFSPR_DSCR_MASK) ==
1378 		PPC_INST_MFSPR_DSCR)) &&
1379 			cpu_has_feature(CPU_FTR_DSCR)) {
1380 		PPC_WARN_EMULATED(mfdscr, regs);
1381 		rd = (instword >> 21) & 0x1f;
1382 		regs->gpr[rd] = mfspr(SPRN_DSCR);
1383 		return 0;
1384 	}
1385 	/* Emulate the mtspr DSCR, rD. */
1386 	if ((((instword & PPC_INST_MTSPR_DSCR_USER_MASK) ==
1387 		PPC_INST_MTSPR_DSCR_USER) ||
1388 	     ((instword & PPC_INST_MTSPR_DSCR_MASK) ==
1389 		PPC_INST_MTSPR_DSCR)) &&
1390 			cpu_has_feature(CPU_FTR_DSCR)) {
1391 		PPC_WARN_EMULATED(mtdscr, regs);
1392 		rd = (instword >> 21) & 0x1f;
1393 		current->thread.dscr = regs->gpr[rd];
1394 		current->thread.dscr_inherit = 1;
1395 		mtspr(SPRN_DSCR, current->thread.dscr);
1396 		return 0;
1397 	}
1398 #endif
1399 
1400 	return -EINVAL;
1401 }
1402 
1403 int is_valid_bugaddr(unsigned long addr)
1404 {
1405 	return is_kernel_addr(addr);
1406 }
1407 
1408 #ifdef CONFIG_MATH_EMULATION
1409 static int emulate_math(struct pt_regs *regs)
1410 {
1411 	int ret;
1412 	extern int do_mathemu(struct pt_regs *regs);
1413 
1414 	ret = do_mathemu(regs);
1415 	if (ret >= 0)
1416 		PPC_WARN_EMULATED(math, regs);
1417 
1418 	switch (ret) {
1419 	case 0:
1420 		emulate_single_step(regs);
1421 		return 0;
1422 	case 1: {
1423 			int code = 0;
1424 			code = __parse_fpscr(current->thread.fp_state.fpscr);
1425 			_exception(SIGFPE, regs, code, regs->nip);
1426 			return 0;
1427 		}
1428 	case -EFAULT:
1429 		_exception(SIGSEGV, regs, SEGV_MAPERR, regs->nip);
1430 		return 0;
1431 	}
1432 
1433 	return -1;
1434 }
1435 #else
1436 static inline int emulate_math(struct pt_regs *regs) { return -1; }
1437 #endif
1438 
1439 void program_check_exception(struct pt_regs *regs)
1440 {
1441 	enum ctx_state prev_state = exception_enter();
1442 	unsigned int reason = get_reason(regs);
1443 
1444 	/* We can now get here via a FP Unavailable exception if the core
1445 	 * has no FPU, in that case the reason flags will be 0 */
1446 
1447 	if (reason & REASON_FP) {
1448 		/* IEEE FP exception */
1449 		parse_fpe(regs);
1450 		goto bail;
1451 	}
1452 	if (reason & REASON_TRAP) {
1453 		unsigned long bugaddr;
1454 		/* Debugger is first in line to stop recursive faults in
1455 		 * rcu_lock, notify_die, or atomic_notifier_call_chain */
1456 		if (debugger_bpt(regs))
1457 			goto bail;
1458 
1459 		if (kprobe_handler(regs))
1460 			goto bail;
1461 
1462 		/* trap exception */
1463 		if (notify_die(DIE_BPT, "breakpoint", regs, 5, 5, SIGTRAP)
1464 				== NOTIFY_STOP)
1465 			goto bail;
1466 
1467 		bugaddr = regs->nip;
1468 		/*
1469 		 * Fixup bugaddr for BUG_ON() in real mode
1470 		 */
1471 		if (!is_kernel_addr(bugaddr) && !(regs->msr & MSR_IR))
1472 			bugaddr += PAGE_OFFSET;
1473 
1474 		if (!(regs->msr & MSR_PR) &&  /* not user-mode */
1475 		    report_bug(bugaddr, regs) == BUG_TRAP_TYPE_WARN) {
1476 			regs->nip += 4;
1477 			goto bail;
1478 		}
1479 		_exception(SIGTRAP, regs, TRAP_BRKPT, regs->nip);
1480 		goto bail;
1481 	}
1482 #ifdef CONFIG_PPC_TRANSACTIONAL_MEM
1483 	if (reason & REASON_TM) {
1484 		/* This is a TM "Bad Thing Exception" program check.
1485 		 * This occurs when:
1486 		 * -  An rfid/hrfid/mtmsrd attempts to cause an illegal
1487 		 *    transition in TM states.
1488 		 * -  A trechkpt is attempted when transactional.
1489 		 * -  A treclaim is attempted when non transactional.
1490 		 * -  A tend is illegally attempted.
1491 		 * -  writing a TM SPR when transactional.
1492 		 *
1493 		 * If usermode caused this, it's done something illegal and
1494 		 * gets a SIGILL slap on the wrist.  We call it an illegal
1495 		 * operand to distinguish from the instruction just being bad
1496 		 * (e.g. executing a 'tend' on a CPU without TM!); it's an
1497 		 * illegal /placement/ of a valid instruction.
1498 		 */
1499 		if (user_mode(regs)) {
1500 			_exception(SIGILL, regs, ILL_ILLOPN, regs->nip);
1501 			goto bail;
1502 		} else {
1503 			printk(KERN_EMERG "Unexpected TM Bad Thing exception "
1504 			       "at %lx (msr 0x%lx) tm_scratch=%llx\n",
1505 			       regs->nip, regs->msr, get_paca()->tm_scratch);
1506 			die("Unrecoverable exception", regs, SIGABRT);
1507 		}
1508 	}
1509 #endif
1510 
1511 	/*
1512 	 * If we took the program check in the kernel skip down to sending a
1513 	 * SIGILL. The subsequent cases all relate to emulating instructions
1514 	 * which we should only do for userspace. We also do not want to enable
1515 	 * interrupts for kernel faults because that might lead to further
1516 	 * faults, and loose the context of the original exception.
1517 	 */
1518 	if (!user_mode(regs))
1519 		goto sigill;
1520 
1521 	/* We restore the interrupt state now */
1522 	if (!arch_irq_disabled_regs(regs))
1523 		local_irq_enable();
1524 
1525 	/* (reason & REASON_ILLEGAL) would be the obvious thing here,
1526 	 * but there seems to be a hardware bug on the 405GP (RevD)
1527 	 * that means ESR is sometimes set incorrectly - either to
1528 	 * ESR_DST (!?) or 0.  In the process of chasing this with the
1529 	 * hardware people - not sure if it can happen on any illegal
1530 	 * instruction or only on FP instructions, whether there is a
1531 	 * pattern to occurrences etc. -dgibson 31/Mar/2003
1532 	 */
1533 	if (!emulate_math(regs))
1534 		goto bail;
1535 
1536 	/* Try to emulate it if we should. */
1537 	if (reason & (REASON_ILLEGAL | REASON_PRIVILEGED)) {
1538 		switch (emulate_instruction(regs)) {
1539 		case 0:
1540 			regs->nip += 4;
1541 			emulate_single_step(regs);
1542 			goto bail;
1543 		case -EFAULT:
1544 			_exception(SIGSEGV, regs, SEGV_MAPERR, regs->nip);
1545 			goto bail;
1546 		}
1547 	}
1548 
1549 sigill:
1550 	if (reason & REASON_PRIVILEGED)
1551 		_exception(SIGILL, regs, ILL_PRVOPC, regs->nip);
1552 	else
1553 		_exception(SIGILL, regs, ILL_ILLOPC, regs->nip);
1554 
1555 bail:
1556 	exception_exit(prev_state);
1557 }
1558 NOKPROBE_SYMBOL(program_check_exception);
1559 
1560 /*
1561  * This occurs when running in hypervisor mode on POWER6 or later
1562  * and an illegal instruction is encountered.
1563  */
1564 void emulation_assist_interrupt(struct pt_regs *regs)
1565 {
1566 	regs->msr |= REASON_ILLEGAL;
1567 	program_check_exception(regs);
1568 }
1569 NOKPROBE_SYMBOL(emulation_assist_interrupt);
1570 
1571 void alignment_exception(struct pt_regs *regs)
1572 {
1573 	enum ctx_state prev_state = exception_enter();
1574 	int sig, code, fixed = 0;
1575 	unsigned long  reason;
1576 
1577 	/* We restore the interrupt state now */
1578 	if (!arch_irq_disabled_regs(regs))
1579 		local_irq_enable();
1580 
1581 	reason = get_reason(regs);
1582 
1583 	if (reason & REASON_BOUNDARY) {
1584 		sig = SIGBUS;
1585 		code = BUS_ADRALN;
1586 		goto bad;
1587 	}
1588 
1589 	if (tm_abort_check(regs, TM_CAUSE_ALIGNMENT | TM_CAUSE_PERSISTENT))
1590 		goto bail;
1591 
1592 	/* we don't implement logging of alignment exceptions */
1593 	if (!(current->thread.align_ctl & PR_UNALIGN_SIGBUS))
1594 		fixed = fix_alignment(regs);
1595 
1596 	if (fixed == 1) {
1597 		/* skip over emulated instruction */
1598 		regs->nip += inst_length(reason);
1599 		emulate_single_step(regs);
1600 		goto bail;
1601 	}
1602 
1603 	/* Operand address was bad */
1604 	if (fixed == -EFAULT) {
1605 		sig = SIGSEGV;
1606 		code = SEGV_ACCERR;
1607 	} else {
1608 		sig = SIGBUS;
1609 		code = BUS_ADRALN;
1610 	}
1611 bad:
1612 	if (user_mode(regs))
1613 		_exception(sig, regs, code, regs->dar);
1614 	else
1615 		bad_page_fault(regs, regs->dar, sig);
1616 
1617 bail:
1618 	exception_exit(prev_state);
1619 }
1620 
1621 void StackOverflow(struct pt_regs *regs)
1622 {
1623 	pr_crit("Kernel stack overflow in process %s[%d], r1=%lx\n",
1624 		current->comm, task_pid_nr(current), regs->gpr[1]);
1625 	debugger(regs);
1626 	show_regs(regs);
1627 	panic("kernel stack overflow");
1628 }
1629 
1630 void stack_overflow_exception(struct pt_regs *regs)
1631 {
1632 	enum ctx_state prev_state = exception_enter();
1633 
1634 	die("Kernel stack overflow", regs, SIGSEGV);
1635 
1636 	exception_exit(prev_state);
1637 }
1638 
1639 void kernel_fp_unavailable_exception(struct pt_regs *regs)
1640 {
1641 	enum ctx_state prev_state = exception_enter();
1642 
1643 	printk(KERN_EMERG "Unrecoverable FP Unavailable Exception "
1644 			  "%lx at %lx\n", regs->trap, regs->nip);
1645 	die("Unrecoverable FP Unavailable Exception", regs, SIGABRT);
1646 
1647 	exception_exit(prev_state);
1648 }
1649 
1650 void altivec_unavailable_exception(struct pt_regs *regs)
1651 {
1652 	enum ctx_state prev_state = exception_enter();
1653 
1654 	if (user_mode(regs)) {
1655 		/* A user program has executed an altivec instruction,
1656 		   but this kernel doesn't support altivec. */
1657 		_exception(SIGILL, regs, ILL_ILLOPC, regs->nip);
1658 		goto bail;
1659 	}
1660 
1661 	printk(KERN_EMERG "Unrecoverable VMX/Altivec Unavailable Exception "
1662 			"%lx at %lx\n", regs->trap, regs->nip);
1663 	die("Unrecoverable VMX/Altivec Unavailable Exception", regs, SIGABRT);
1664 
1665 bail:
1666 	exception_exit(prev_state);
1667 }
1668 
1669 void vsx_unavailable_exception(struct pt_regs *regs)
1670 {
1671 	if (user_mode(regs)) {
1672 		/* A user program has executed an vsx instruction,
1673 		   but this kernel doesn't support vsx. */
1674 		_exception(SIGILL, regs, ILL_ILLOPC, regs->nip);
1675 		return;
1676 	}
1677 
1678 	printk(KERN_EMERG "Unrecoverable VSX Unavailable Exception "
1679 			"%lx at %lx\n", regs->trap, regs->nip);
1680 	die("Unrecoverable VSX Unavailable Exception", regs, SIGABRT);
1681 }
1682 
1683 #ifdef CONFIG_PPC64
1684 static void tm_unavailable(struct pt_regs *regs)
1685 {
1686 #ifdef CONFIG_PPC_TRANSACTIONAL_MEM
1687 	if (user_mode(regs)) {
1688 		current->thread.load_tm++;
1689 		regs->msr |= MSR_TM;
1690 		tm_enable();
1691 		tm_restore_sprs(&current->thread);
1692 		return;
1693 	}
1694 #endif
1695 	pr_emerg("Unrecoverable TM Unavailable Exception "
1696 			"%lx at %lx\n", regs->trap, regs->nip);
1697 	die("Unrecoverable TM Unavailable Exception", regs, SIGABRT);
1698 }
1699 
1700 void facility_unavailable_exception(struct pt_regs *regs)
1701 {
1702 	static char *facility_strings[] = {
1703 		[FSCR_FP_LG] = "FPU",
1704 		[FSCR_VECVSX_LG] = "VMX/VSX",
1705 		[FSCR_DSCR_LG] = "DSCR",
1706 		[FSCR_PM_LG] = "PMU SPRs",
1707 		[FSCR_BHRB_LG] = "BHRB",
1708 		[FSCR_TM_LG] = "TM",
1709 		[FSCR_EBB_LG] = "EBB",
1710 		[FSCR_TAR_LG] = "TAR",
1711 		[FSCR_MSGP_LG] = "MSGP",
1712 		[FSCR_SCV_LG] = "SCV",
1713 		[FSCR_PREFIX_LG] = "PREFIX",
1714 	};
1715 	char *facility = "unknown";
1716 	u64 value;
1717 	u32 instword, rd;
1718 	u8 status;
1719 	bool hv;
1720 
1721 	hv = (TRAP(regs) == 0xf80);
1722 	if (hv)
1723 		value = mfspr(SPRN_HFSCR);
1724 	else
1725 		value = mfspr(SPRN_FSCR);
1726 
1727 	status = value >> 56;
1728 	if ((hv || status >= 2) &&
1729 	    (status < ARRAY_SIZE(facility_strings)) &&
1730 	    facility_strings[status])
1731 		facility = facility_strings[status];
1732 
1733 	/* We should not have taken this interrupt in kernel */
1734 	if (!user_mode(regs)) {
1735 		pr_emerg("Facility '%s' unavailable (%d) exception in kernel mode at %lx\n",
1736 			 facility, status, regs->nip);
1737 		die("Unexpected facility unavailable exception", regs, SIGABRT);
1738 	}
1739 
1740 	/* We restore the interrupt state now */
1741 	if (!arch_irq_disabled_regs(regs))
1742 		local_irq_enable();
1743 
1744 	if (status == FSCR_DSCR_LG) {
1745 		/*
1746 		 * User is accessing the DSCR register using the problem
1747 		 * state only SPR number (0x03) either through a mfspr or
1748 		 * a mtspr instruction. If it is a write attempt through
1749 		 * a mtspr, then we set the inherit bit. This also allows
1750 		 * the user to write or read the register directly in the
1751 		 * future by setting via the FSCR DSCR bit. But in case it
1752 		 * is a read DSCR attempt through a mfspr instruction, we
1753 		 * just emulate the instruction instead. This code path will
1754 		 * always emulate all the mfspr instructions till the user
1755 		 * has attempted at least one mtspr instruction. This way it
1756 		 * preserves the same behaviour when the user is accessing
1757 		 * the DSCR through privilege level only SPR number (0x11)
1758 		 * which is emulated through illegal instruction exception.
1759 		 * We always leave HFSCR DSCR set.
1760 		 */
1761 		if (get_user(instword, (u32 __user *)(regs->nip))) {
1762 			pr_err("Failed to fetch the user instruction\n");
1763 			return;
1764 		}
1765 
1766 		/* Write into DSCR (mtspr 0x03, RS) */
1767 		if ((instword & PPC_INST_MTSPR_DSCR_USER_MASK)
1768 				== PPC_INST_MTSPR_DSCR_USER) {
1769 			rd = (instword >> 21) & 0x1f;
1770 			current->thread.dscr = regs->gpr[rd];
1771 			current->thread.dscr_inherit = 1;
1772 			current->thread.fscr |= FSCR_DSCR;
1773 			mtspr(SPRN_FSCR, current->thread.fscr);
1774 		}
1775 
1776 		/* Read from DSCR (mfspr RT, 0x03) */
1777 		if ((instword & PPC_INST_MFSPR_DSCR_USER_MASK)
1778 				== PPC_INST_MFSPR_DSCR_USER) {
1779 			if (emulate_instruction(regs)) {
1780 				pr_err("DSCR based mfspr emulation failed\n");
1781 				return;
1782 			}
1783 			regs->nip += 4;
1784 			emulate_single_step(regs);
1785 		}
1786 		return;
1787 	}
1788 
1789 	if (status == FSCR_TM_LG) {
1790 		/*
1791 		 * If we're here then the hardware is TM aware because it
1792 		 * generated an exception with FSRM_TM set.
1793 		 *
1794 		 * If cpu_has_feature(CPU_FTR_TM) is false, then either firmware
1795 		 * told us not to do TM, or the kernel is not built with TM
1796 		 * support.
1797 		 *
1798 		 * If both of those things are true, then userspace can spam the
1799 		 * console by triggering the printk() below just by continually
1800 		 * doing tbegin (or any TM instruction). So in that case just
1801 		 * send the process a SIGILL immediately.
1802 		 */
1803 		if (!cpu_has_feature(CPU_FTR_TM))
1804 			goto out;
1805 
1806 		tm_unavailable(regs);
1807 		return;
1808 	}
1809 
1810 	pr_err_ratelimited("%sFacility '%s' unavailable (%d), exception at 0x%lx, MSR=%lx\n",
1811 		hv ? "Hypervisor " : "", facility, status, regs->nip, regs->msr);
1812 
1813 out:
1814 	_exception(SIGILL, regs, ILL_ILLOPC, regs->nip);
1815 }
1816 #endif
1817 
1818 #ifdef CONFIG_PPC_TRANSACTIONAL_MEM
1819 
1820 void fp_unavailable_tm(struct pt_regs *regs)
1821 {
1822 	/* Note:  This does not handle any kind of FP laziness. */
1823 
1824 	TM_DEBUG("FP Unavailable trap whilst transactional at 0x%lx, MSR=%lx\n",
1825 		 regs->nip, regs->msr);
1826 
1827         /* We can only have got here if the task started using FP after
1828          * beginning the transaction.  So, the transactional regs are just a
1829          * copy of the checkpointed ones.  But, we still need to recheckpoint
1830          * as we're enabling FP for the process; it will return, abort the
1831          * transaction, and probably retry but now with FP enabled.  So the
1832          * checkpointed FP registers need to be loaded.
1833 	 */
1834 	tm_reclaim_current(TM_CAUSE_FAC_UNAV);
1835 
1836 	/*
1837 	 * Reclaim initially saved out bogus (lazy) FPRs to ckfp_state, and
1838 	 * then it was overwrite by the thr->fp_state by tm_reclaim_thread().
1839 	 *
1840 	 * At this point, ck{fp,vr}_state contains the exact values we want to
1841 	 * recheckpoint.
1842 	 */
1843 
1844 	/* Enable FP for the task: */
1845 	current->thread.load_fp = 1;
1846 
1847 	/*
1848 	 * Recheckpoint all the checkpointed ckpt, ck{fp, vr}_state registers.
1849 	 */
1850 	tm_recheckpoint(&current->thread);
1851 }
1852 
1853 void altivec_unavailable_tm(struct pt_regs *regs)
1854 {
1855 	/* See the comments in fp_unavailable_tm().  This function operates
1856 	 * the same way.
1857 	 */
1858 
1859 	TM_DEBUG("Vector Unavailable trap whilst transactional at 0x%lx,"
1860 		 "MSR=%lx\n",
1861 		 regs->nip, regs->msr);
1862 	tm_reclaim_current(TM_CAUSE_FAC_UNAV);
1863 	current->thread.load_vec = 1;
1864 	tm_recheckpoint(&current->thread);
1865 	current->thread.used_vr = 1;
1866 }
1867 
1868 void vsx_unavailable_tm(struct pt_regs *regs)
1869 {
1870 	/* See the comments in fp_unavailable_tm().  This works similarly,
1871 	 * though we're loading both FP and VEC registers in here.
1872 	 *
1873 	 * If FP isn't in use, load FP regs.  If VEC isn't in use, load VEC
1874 	 * regs.  Either way, set MSR_VSX.
1875 	 */
1876 
1877 	TM_DEBUG("VSX Unavailable trap whilst transactional at 0x%lx,"
1878 		 "MSR=%lx\n",
1879 		 regs->nip, regs->msr);
1880 
1881 	current->thread.used_vsr = 1;
1882 
1883 	/* This reclaims FP and/or VR regs if they're already enabled */
1884 	tm_reclaim_current(TM_CAUSE_FAC_UNAV);
1885 
1886 	current->thread.load_vec = 1;
1887 	current->thread.load_fp = 1;
1888 
1889 	tm_recheckpoint(&current->thread);
1890 }
1891 #endif /* CONFIG_PPC_TRANSACTIONAL_MEM */
1892 
1893 void performance_monitor_exception(struct pt_regs *regs)
1894 {
1895 	__this_cpu_inc(irq_stat.pmu_irqs);
1896 
1897 	perf_irq(regs);
1898 }
1899 
1900 #ifdef CONFIG_PPC_ADV_DEBUG_REGS
1901 static void handle_debug(struct pt_regs *regs, unsigned long debug_status)
1902 {
1903 	int changed = 0;
1904 	/*
1905 	 * Determine the cause of the debug event, clear the
1906 	 * event flags and send a trap to the handler. Torez
1907 	 */
1908 	if (debug_status & (DBSR_DAC1R | DBSR_DAC1W)) {
1909 		dbcr_dac(current) &= ~(DBCR_DAC1R | DBCR_DAC1W);
1910 #ifdef CONFIG_PPC_ADV_DEBUG_DAC_RANGE
1911 		current->thread.debug.dbcr2 &= ~DBCR2_DAC12MODE;
1912 #endif
1913 		do_send_trap(regs, mfspr(SPRN_DAC1), debug_status,
1914 			     5);
1915 		changed |= 0x01;
1916 	}  else if (debug_status & (DBSR_DAC2R | DBSR_DAC2W)) {
1917 		dbcr_dac(current) &= ~(DBCR_DAC2R | DBCR_DAC2W);
1918 		do_send_trap(regs, mfspr(SPRN_DAC2), debug_status,
1919 			     6);
1920 		changed |= 0x01;
1921 	}  else if (debug_status & DBSR_IAC1) {
1922 		current->thread.debug.dbcr0 &= ~DBCR0_IAC1;
1923 		dbcr_iac_range(current) &= ~DBCR_IAC12MODE;
1924 		do_send_trap(regs, mfspr(SPRN_IAC1), debug_status,
1925 			     1);
1926 		changed |= 0x01;
1927 	}  else if (debug_status & DBSR_IAC2) {
1928 		current->thread.debug.dbcr0 &= ~DBCR0_IAC2;
1929 		do_send_trap(regs, mfspr(SPRN_IAC2), debug_status,
1930 			     2);
1931 		changed |= 0x01;
1932 	}  else if (debug_status & DBSR_IAC3) {
1933 		current->thread.debug.dbcr0 &= ~DBCR0_IAC3;
1934 		dbcr_iac_range(current) &= ~DBCR_IAC34MODE;
1935 		do_send_trap(regs, mfspr(SPRN_IAC3), debug_status,
1936 			     3);
1937 		changed |= 0x01;
1938 	}  else if (debug_status & DBSR_IAC4) {
1939 		current->thread.debug.dbcr0 &= ~DBCR0_IAC4;
1940 		do_send_trap(regs, mfspr(SPRN_IAC4), debug_status,
1941 			     4);
1942 		changed |= 0x01;
1943 	}
1944 	/*
1945 	 * At the point this routine was called, the MSR(DE) was turned off.
1946 	 * Check all other debug flags and see if that bit needs to be turned
1947 	 * back on or not.
1948 	 */
1949 	if (DBCR_ACTIVE_EVENTS(current->thread.debug.dbcr0,
1950 			       current->thread.debug.dbcr1))
1951 		regs->msr |= MSR_DE;
1952 	else
1953 		/* Make sure the IDM flag is off */
1954 		current->thread.debug.dbcr0 &= ~DBCR0_IDM;
1955 
1956 	if (changed & 0x01)
1957 		mtspr(SPRN_DBCR0, current->thread.debug.dbcr0);
1958 }
1959 
1960 void DebugException(struct pt_regs *regs, unsigned long debug_status)
1961 {
1962 	current->thread.debug.dbsr = debug_status;
1963 
1964 	/* Hack alert: On BookE, Branch Taken stops on the branch itself, while
1965 	 * on server, it stops on the target of the branch. In order to simulate
1966 	 * the server behaviour, we thus restart right away with a single step
1967 	 * instead of stopping here when hitting a BT
1968 	 */
1969 	if (debug_status & DBSR_BT) {
1970 		regs->msr &= ~MSR_DE;
1971 
1972 		/* Disable BT */
1973 		mtspr(SPRN_DBCR0, mfspr(SPRN_DBCR0) & ~DBCR0_BT);
1974 		/* Clear the BT event */
1975 		mtspr(SPRN_DBSR, DBSR_BT);
1976 
1977 		/* Do the single step trick only when coming from userspace */
1978 		if (user_mode(regs)) {
1979 			current->thread.debug.dbcr0 &= ~DBCR0_BT;
1980 			current->thread.debug.dbcr0 |= DBCR0_IDM | DBCR0_IC;
1981 			regs->msr |= MSR_DE;
1982 			return;
1983 		}
1984 
1985 		if (kprobe_post_handler(regs))
1986 			return;
1987 
1988 		if (notify_die(DIE_SSTEP, "block_step", regs, 5,
1989 			       5, SIGTRAP) == NOTIFY_STOP) {
1990 			return;
1991 		}
1992 		if (debugger_sstep(regs))
1993 			return;
1994 	} else if (debug_status & DBSR_IC) { 	/* Instruction complete */
1995 		regs->msr &= ~MSR_DE;
1996 
1997 		/* Disable instruction completion */
1998 		mtspr(SPRN_DBCR0, mfspr(SPRN_DBCR0) & ~DBCR0_IC);
1999 		/* Clear the instruction completion event */
2000 		mtspr(SPRN_DBSR, DBSR_IC);
2001 
2002 		if (kprobe_post_handler(regs))
2003 			return;
2004 
2005 		if (notify_die(DIE_SSTEP, "single_step", regs, 5,
2006 			       5, SIGTRAP) == NOTIFY_STOP) {
2007 			return;
2008 		}
2009 
2010 		if (debugger_sstep(regs))
2011 			return;
2012 
2013 		if (user_mode(regs)) {
2014 			current->thread.debug.dbcr0 &= ~DBCR0_IC;
2015 			if (DBCR_ACTIVE_EVENTS(current->thread.debug.dbcr0,
2016 					       current->thread.debug.dbcr1))
2017 				regs->msr |= MSR_DE;
2018 			else
2019 				/* Make sure the IDM bit is off */
2020 				current->thread.debug.dbcr0 &= ~DBCR0_IDM;
2021 		}
2022 
2023 		_exception(SIGTRAP, regs, TRAP_TRACE, regs->nip);
2024 	} else
2025 		handle_debug(regs, debug_status);
2026 }
2027 NOKPROBE_SYMBOL(DebugException);
2028 #endif /* CONFIG_PPC_ADV_DEBUG_REGS */
2029 
2030 #ifdef CONFIG_ALTIVEC
2031 void altivec_assist_exception(struct pt_regs *regs)
2032 {
2033 	int err;
2034 
2035 	if (!user_mode(regs)) {
2036 		printk(KERN_EMERG "VMX/Altivec assist exception in kernel mode"
2037 		       " at %lx\n", regs->nip);
2038 		die("Kernel VMX/Altivec assist exception", regs, SIGILL);
2039 	}
2040 
2041 	flush_altivec_to_thread(current);
2042 
2043 	PPC_WARN_EMULATED(altivec, regs);
2044 	err = emulate_altivec(regs);
2045 	if (err == 0) {
2046 		regs->nip += 4;		/* skip emulated instruction */
2047 		emulate_single_step(regs);
2048 		return;
2049 	}
2050 
2051 	if (err == -EFAULT) {
2052 		/* got an error reading the instruction */
2053 		_exception(SIGSEGV, regs, SEGV_ACCERR, regs->nip);
2054 	} else {
2055 		/* didn't recognize the instruction */
2056 		/* XXX quick hack for now: set the non-Java bit in the VSCR */
2057 		printk_ratelimited(KERN_ERR "Unrecognized altivec instruction "
2058 				   "in %s at %lx\n", current->comm, regs->nip);
2059 		current->thread.vr_state.vscr.u[3] |= 0x10000;
2060 	}
2061 }
2062 #endif /* CONFIG_ALTIVEC */
2063 
2064 #ifdef CONFIG_FSL_BOOKE
2065 void CacheLockingException(struct pt_regs *regs, unsigned long address,
2066 			   unsigned long error_code)
2067 {
2068 	/* We treat cache locking instructions from the user
2069 	 * as priv ops, in the future we could try to do
2070 	 * something smarter
2071 	 */
2072 	if (error_code & (ESR_DLK|ESR_ILK))
2073 		_exception(SIGILL, regs, ILL_PRVOPC, regs->nip);
2074 	return;
2075 }
2076 #endif /* CONFIG_FSL_BOOKE */
2077 
2078 #ifdef CONFIG_SPE
2079 void SPEFloatingPointException(struct pt_regs *regs)
2080 {
2081 	extern int do_spe_mathemu(struct pt_regs *regs);
2082 	unsigned long spefscr;
2083 	int fpexc_mode;
2084 	int code = FPE_FLTUNK;
2085 	int err;
2086 
2087 	/* We restore the interrupt state now */
2088 	if (!arch_irq_disabled_regs(regs))
2089 		local_irq_enable();
2090 
2091 	flush_spe_to_thread(current);
2092 
2093 	spefscr = current->thread.spefscr;
2094 	fpexc_mode = current->thread.fpexc_mode;
2095 
2096 	if ((spefscr & SPEFSCR_FOVF) && (fpexc_mode & PR_FP_EXC_OVF)) {
2097 		code = FPE_FLTOVF;
2098 	}
2099 	else if ((spefscr & SPEFSCR_FUNF) && (fpexc_mode & PR_FP_EXC_UND)) {
2100 		code = FPE_FLTUND;
2101 	}
2102 	else if ((spefscr & SPEFSCR_FDBZ) && (fpexc_mode & PR_FP_EXC_DIV))
2103 		code = FPE_FLTDIV;
2104 	else if ((spefscr & SPEFSCR_FINV) && (fpexc_mode & PR_FP_EXC_INV)) {
2105 		code = FPE_FLTINV;
2106 	}
2107 	else if ((spefscr & (SPEFSCR_FG | SPEFSCR_FX)) && (fpexc_mode & PR_FP_EXC_RES))
2108 		code = FPE_FLTRES;
2109 
2110 	err = do_spe_mathemu(regs);
2111 	if (err == 0) {
2112 		regs->nip += 4;		/* skip emulated instruction */
2113 		emulate_single_step(regs);
2114 		return;
2115 	}
2116 
2117 	if (err == -EFAULT) {
2118 		/* got an error reading the instruction */
2119 		_exception(SIGSEGV, regs, SEGV_ACCERR, regs->nip);
2120 	} else if (err == -EINVAL) {
2121 		/* didn't recognize the instruction */
2122 		printk(KERN_ERR "unrecognized spe instruction "
2123 		       "in %s at %lx\n", current->comm, regs->nip);
2124 	} else {
2125 		_exception(SIGFPE, regs, code, regs->nip);
2126 	}
2127 
2128 	return;
2129 }
2130 
2131 void SPEFloatingPointRoundException(struct pt_regs *regs)
2132 {
2133 	extern int speround_handler(struct pt_regs *regs);
2134 	int err;
2135 
2136 	/* We restore the interrupt state now */
2137 	if (!arch_irq_disabled_regs(regs))
2138 		local_irq_enable();
2139 
2140 	preempt_disable();
2141 	if (regs->msr & MSR_SPE)
2142 		giveup_spe(current);
2143 	preempt_enable();
2144 
2145 	regs->nip -= 4;
2146 	err = speround_handler(regs);
2147 	if (err == 0) {
2148 		regs->nip += 4;		/* skip emulated instruction */
2149 		emulate_single_step(regs);
2150 		return;
2151 	}
2152 
2153 	if (err == -EFAULT) {
2154 		/* got an error reading the instruction */
2155 		_exception(SIGSEGV, regs, SEGV_ACCERR, regs->nip);
2156 	} else if (err == -EINVAL) {
2157 		/* didn't recognize the instruction */
2158 		printk(KERN_ERR "unrecognized spe instruction "
2159 		       "in %s at %lx\n", current->comm, regs->nip);
2160 	} else {
2161 		_exception(SIGFPE, regs, FPE_FLTUNK, regs->nip);
2162 		return;
2163 	}
2164 }
2165 #endif
2166 
2167 /*
2168  * We enter here if we get an unrecoverable exception, that is, one
2169  * that happened at a point where the RI (recoverable interrupt) bit
2170  * in the MSR is 0.  This indicates that SRR0/1 are live, and that
2171  * we therefore lost state by taking this exception.
2172  */
2173 void unrecoverable_exception(struct pt_regs *regs)
2174 {
2175 	pr_emerg("Unrecoverable exception %lx at %lx (msr=%lx)\n",
2176 		 regs->trap, regs->nip, regs->msr);
2177 	die("Unrecoverable exception", regs, SIGABRT);
2178 }
2179 NOKPROBE_SYMBOL(unrecoverable_exception);
2180 
2181 #if defined(CONFIG_BOOKE_WDT) || defined(CONFIG_40x)
2182 /*
2183  * Default handler for a Watchdog exception,
2184  * spins until a reboot occurs
2185  */
2186 void __attribute__ ((weak)) WatchdogHandler(struct pt_regs *regs)
2187 {
2188 	/* Generic WatchdogHandler, implement your own */
2189 	mtspr(SPRN_TCR, mfspr(SPRN_TCR)&(~TCR_WIE));
2190 	return;
2191 }
2192 
2193 void WatchdogException(struct pt_regs *regs)
2194 {
2195 	printk (KERN_EMERG "PowerPC Book-E Watchdog Exception\n");
2196 	WatchdogHandler(regs);
2197 }
2198 #endif
2199 
2200 /*
2201  * We enter here if we discover during exception entry that we are
2202  * running in supervisor mode with a userspace value in the stack pointer.
2203  */
2204 void kernel_bad_stack(struct pt_regs *regs)
2205 {
2206 	printk(KERN_EMERG "Bad kernel stack pointer %lx at %lx\n",
2207 	       regs->gpr[1], regs->nip);
2208 	die("Bad kernel stack pointer", regs, SIGABRT);
2209 }
2210 NOKPROBE_SYMBOL(kernel_bad_stack);
2211 
2212 void __init trap_init(void)
2213 {
2214 }
2215 
2216 
2217 #ifdef CONFIG_PPC_EMULATED_STATS
2218 
2219 #define WARN_EMULATED_SETUP(type)	.type = { .name = #type }
2220 
2221 struct ppc_emulated ppc_emulated = {
2222 #ifdef CONFIG_ALTIVEC
2223 	WARN_EMULATED_SETUP(altivec),
2224 #endif
2225 	WARN_EMULATED_SETUP(dcba),
2226 	WARN_EMULATED_SETUP(dcbz),
2227 	WARN_EMULATED_SETUP(fp_pair),
2228 	WARN_EMULATED_SETUP(isel),
2229 	WARN_EMULATED_SETUP(mcrxr),
2230 	WARN_EMULATED_SETUP(mfpvr),
2231 	WARN_EMULATED_SETUP(multiple),
2232 	WARN_EMULATED_SETUP(popcntb),
2233 	WARN_EMULATED_SETUP(spe),
2234 	WARN_EMULATED_SETUP(string),
2235 	WARN_EMULATED_SETUP(sync),
2236 	WARN_EMULATED_SETUP(unaligned),
2237 #ifdef CONFIG_MATH_EMULATION
2238 	WARN_EMULATED_SETUP(math),
2239 #endif
2240 #ifdef CONFIG_VSX
2241 	WARN_EMULATED_SETUP(vsx),
2242 #endif
2243 #ifdef CONFIG_PPC64
2244 	WARN_EMULATED_SETUP(mfdscr),
2245 	WARN_EMULATED_SETUP(mtdscr),
2246 	WARN_EMULATED_SETUP(lq_stq),
2247 	WARN_EMULATED_SETUP(lxvw4x),
2248 	WARN_EMULATED_SETUP(lxvh8x),
2249 	WARN_EMULATED_SETUP(lxvd2x),
2250 	WARN_EMULATED_SETUP(lxvb16x),
2251 #endif
2252 };
2253 
2254 u32 ppc_warn_emulated;
2255 
2256 void ppc_warn_emulated_print(const char *type)
2257 {
2258 	pr_warn_ratelimited("%s used emulated %s instruction\n", current->comm,
2259 			    type);
2260 }
2261 
2262 static int __init ppc_warn_emulated_init(void)
2263 {
2264 	struct dentry *dir;
2265 	unsigned int i;
2266 	struct ppc_emulated_entry *entries = (void *)&ppc_emulated;
2267 
2268 	dir = debugfs_create_dir("emulated_instructions",
2269 				 powerpc_debugfs_root);
2270 
2271 	debugfs_create_u32("do_warn", 0644, dir, &ppc_warn_emulated);
2272 
2273 	for (i = 0; i < sizeof(ppc_emulated)/sizeof(*entries); i++)
2274 		debugfs_create_u32(entries[i].name, 0644, dir,
2275 				   (u32 *)&entries[i].val.counter);
2276 
2277 	return 0;
2278 }
2279 
2280 device_initcall(ppc_warn_emulated_init);
2281 
2282 #endif /* CONFIG_PPC_EMULATED_STATS */
2283