1 /* 2 * unaligned.c: Unaligned load/store trap handling with special 3 * cases for the kernel to do them more quickly. 4 * 5 * Copyright (C) 1996,2008 David S. Miller (davem@davemloft.net) 6 * Copyright (C) 1996,1997 Jakub Jelinek (jj@sunsite.mff.cuni.cz) 7 */ 8 9 10 #include <linux/jiffies.h> 11 #include <linux/kernel.h> 12 #include <linux/sched.h> 13 #include <linux/mm.h> 14 #include <linux/module.h> 15 #include <asm/asi.h> 16 #include <asm/ptrace.h> 17 #include <asm/pstate.h> 18 #include <asm/processor.h> 19 #include <asm/uaccess.h> 20 #include <linux/smp.h> 21 #include <linux/bitops.h> 22 #include <linux/perf_event.h> 23 #include <linux/ratelimit.h> 24 #include <asm/fpumacro.h> 25 #include <asm/cacheflush.h> 26 27 enum direction { 28 load, /* ld, ldd, ldh, ldsh */ 29 store, /* st, std, sth, stsh */ 30 both, /* Swap, ldstub, cas, ... */ 31 fpld, 32 fpst, 33 invalid, 34 }; 35 36 static inline enum direction decode_direction(unsigned int insn) 37 { 38 unsigned long tmp = (insn >> 21) & 1; 39 40 if (!tmp) 41 return load; 42 else { 43 switch ((insn>>19)&0xf) { 44 case 15: /* swap* */ 45 return both; 46 default: 47 return store; 48 } 49 } 50 } 51 52 /* 16 = double-word, 8 = extra-word, 4 = word, 2 = half-word */ 53 static inline int decode_access_size(struct pt_regs *regs, unsigned int insn) 54 { 55 unsigned int tmp; 56 57 tmp = ((insn >> 19) & 0xf); 58 if (tmp == 11 || tmp == 14) /* ldx/stx */ 59 return 8; 60 tmp &= 3; 61 if (!tmp) 62 return 4; 63 else if (tmp == 3) 64 return 16; /* ldd/std - Although it is actually 8 */ 65 else if (tmp == 2) 66 return 2; 67 else { 68 printk("Impossible unaligned trap. insn=%08x\n", insn); 69 die_if_kernel("Byte sized unaligned access?!?!", regs); 70 71 /* GCC should never warn that control reaches the end 72 * of this function without returning a value because 73 * die_if_kernel() is marked with attribute 'noreturn'. 74 * Alas, some versions do... 75 */ 76 77 return 0; 78 } 79 } 80 81 static inline int decode_asi(unsigned int insn, struct pt_regs *regs) 82 { 83 if (insn & 0x800000) { 84 if (insn & 0x2000) 85 return (unsigned char)(regs->tstate >> 24); /* %asi */ 86 else 87 return (unsigned char)(insn >> 5); /* imm_asi */ 88 } else 89 return ASI_P; 90 } 91 92 /* 0x400000 = signed, 0 = unsigned */ 93 static inline int decode_signedness(unsigned int insn) 94 { 95 return (insn & 0x400000); 96 } 97 98 static inline void maybe_flush_windows(unsigned int rs1, unsigned int rs2, 99 unsigned int rd, int from_kernel) 100 { 101 if (rs2 >= 16 || rs1 >= 16 || rd >= 16) { 102 if (from_kernel != 0) 103 __asm__ __volatile__("flushw"); 104 else 105 flushw_user(); 106 } 107 } 108 109 static inline long sign_extend_imm13(long imm) 110 { 111 return imm << 51 >> 51; 112 } 113 114 static unsigned long fetch_reg(unsigned int reg, struct pt_regs *regs) 115 { 116 unsigned long value; 117 118 if (reg < 16) 119 return (!reg ? 0 : regs->u_regs[reg]); 120 if (regs->tstate & TSTATE_PRIV) { 121 struct reg_window *win; 122 win = (struct reg_window *)(regs->u_regs[UREG_FP] + STACK_BIAS); 123 value = win->locals[reg - 16]; 124 } else if (test_thread_flag(TIF_32BIT)) { 125 struct reg_window32 __user *win32; 126 win32 = (struct reg_window32 __user *)((unsigned long)((u32)regs->u_regs[UREG_FP])); 127 get_user(value, &win32->locals[reg - 16]); 128 } else { 129 struct reg_window __user *win; 130 win = (struct reg_window __user *)(regs->u_regs[UREG_FP] + STACK_BIAS); 131 get_user(value, &win->locals[reg - 16]); 132 } 133 return value; 134 } 135 136 static unsigned long *fetch_reg_addr(unsigned int reg, struct pt_regs *regs) 137 { 138 if (reg < 16) 139 return ®s->u_regs[reg]; 140 if (regs->tstate & TSTATE_PRIV) { 141 struct reg_window *win; 142 win = (struct reg_window *)(regs->u_regs[UREG_FP] + STACK_BIAS); 143 return &win->locals[reg - 16]; 144 } else if (test_thread_flag(TIF_32BIT)) { 145 struct reg_window32 *win32; 146 win32 = (struct reg_window32 *)((unsigned long)((u32)regs->u_regs[UREG_FP])); 147 return (unsigned long *)&win32->locals[reg - 16]; 148 } else { 149 struct reg_window *win; 150 win = (struct reg_window *)(regs->u_regs[UREG_FP] + STACK_BIAS); 151 return &win->locals[reg - 16]; 152 } 153 } 154 155 unsigned long compute_effective_address(struct pt_regs *regs, 156 unsigned int insn, unsigned int rd) 157 { 158 unsigned int rs1 = (insn >> 14) & 0x1f; 159 unsigned int rs2 = insn & 0x1f; 160 int from_kernel = (regs->tstate & TSTATE_PRIV) != 0; 161 162 if (insn & 0x2000) { 163 maybe_flush_windows(rs1, 0, rd, from_kernel); 164 return (fetch_reg(rs1, regs) + sign_extend_imm13(insn)); 165 } else { 166 maybe_flush_windows(rs1, rs2, rd, from_kernel); 167 return (fetch_reg(rs1, regs) + fetch_reg(rs2, regs)); 168 } 169 } 170 171 /* This is just to make gcc think die_if_kernel does return... */ 172 static void __used unaligned_panic(char *str, struct pt_regs *regs) 173 { 174 die_if_kernel(str, regs); 175 } 176 177 extern int do_int_load(unsigned long *dest_reg, int size, 178 unsigned long *saddr, int is_signed, int asi); 179 180 extern int __do_int_store(unsigned long *dst_addr, int size, 181 unsigned long src_val, int asi); 182 183 static inline int do_int_store(int reg_num, int size, unsigned long *dst_addr, 184 struct pt_regs *regs, int asi, int orig_asi) 185 { 186 unsigned long zero = 0; 187 unsigned long *src_val_p = &zero; 188 unsigned long src_val; 189 190 if (size == 16) { 191 size = 8; 192 zero = (((long)(reg_num ? 193 (unsigned)fetch_reg(reg_num, regs) : 0)) << 32) | 194 (unsigned)fetch_reg(reg_num + 1, regs); 195 } else if (reg_num) { 196 src_val_p = fetch_reg_addr(reg_num, regs); 197 } 198 src_val = *src_val_p; 199 if (unlikely(asi != orig_asi)) { 200 switch (size) { 201 case 2: 202 src_val = swab16(src_val); 203 break; 204 case 4: 205 src_val = swab32(src_val); 206 break; 207 case 8: 208 src_val = swab64(src_val); 209 break; 210 case 16: 211 default: 212 BUG(); 213 break; 214 } 215 } 216 return __do_int_store(dst_addr, size, src_val, asi); 217 } 218 219 static inline void advance(struct pt_regs *regs) 220 { 221 regs->tpc = regs->tnpc; 222 regs->tnpc += 4; 223 if (test_thread_flag(TIF_32BIT)) { 224 regs->tpc &= 0xffffffff; 225 regs->tnpc &= 0xffffffff; 226 } 227 } 228 229 static inline int floating_point_load_or_store_p(unsigned int insn) 230 { 231 return (insn >> 24) & 1; 232 } 233 234 static inline int ok_for_kernel(unsigned int insn) 235 { 236 return !floating_point_load_or_store_p(insn); 237 } 238 239 static void kernel_mna_trap_fault(int fixup_tstate_asi) 240 { 241 struct pt_regs *regs = current_thread_info()->kern_una_regs; 242 unsigned int insn = current_thread_info()->kern_una_insn; 243 const struct exception_table_entry *entry; 244 245 entry = search_exception_tables(regs->tpc); 246 if (!entry) { 247 unsigned long address; 248 249 address = compute_effective_address(regs, insn, 250 ((insn >> 25) & 0x1f)); 251 if (address < PAGE_SIZE) { 252 printk(KERN_ALERT "Unable to handle kernel NULL " 253 "pointer dereference in mna handler"); 254 } else 255 printk(KERN_ALERT "Unable to handle kernel paging " 256 "request in mna handler"); 257 printk(KERN_ALERT " at virtual address %016lx\n",address); 258 printk(KERN_ALERT "current->{active_,}mm->context = %016lx\n", 259 (current->mm ? CTX_HWBITS(current->mm->context) : 260 CTX_HWBITS(current->active_mm->context))); 261 printk(KERN_ALERT "current->{active_,}mm->pgd = %016lx\n", 262 (current->mm ? (unsigned long) current->mm->pgd : 263 (unsigned long) current->active_mm->pgd)); 264 die_if_kernel("Oops", regs); 265 /* Not reached */ 266 } 267 regs->tpc = entry->fixup; 268 regs->tnpc = regs->tpc + 4; 269 270 if (fixup_tstate_asi) { 271 regs->tstate &= ~TSTATE_ASI; 272 regs->tstate |= (ASI_AIUS << 24UL); 273 } 274 } 275 276 static void log_unaligned(struct pt_regs *regs) 277 { 278 static DEFINE_RATELIMIT_STATE(ratelimit, 5 * HZ, 5); 279 280 if (__ratelimit(&ratelimit)) { 281 printk("Kernel unaligned access at TPC[%lx] %pS\n", 282 regs->tpc, (void *) regs->tpc); 283 } 284 } 285 286 asmlinkage void kernel_unaligned_trap(struct pt_regs *regs, unsigned int insn) 287 { 288 enum direction dir = decode_direction(insn); 289 int size = decode_access_size(regs, insn); 290 int orig_asi, asi; 291 292 current_thread_info()->kern_una_regs = regs; 293 current_thread_info()->kern_una_insn = insn; 294 295 orig_asi = asi = decode_asi(insn, regs); 296 297 /* If this is a {get,put}_user() on an unaligned userspace pointer, 298 * just signal a fault and do not log the event. 299 */ 300 if (asi == ASI_AIUS) { 301 kernel_mna_trap_fault(0); 302 return; 303 } 304 305 log_unaligned(regs); 306 307 if (!ok_for_kernel(insn) || dir == both) { 308 printk("Unsupported unaligned load/store trap for kernel " 309 "at <%016lx>.\n", regs->tpc); 310 unaligned_panic("Kernel does fpu/atomic " 311 "unaligned load/store.", regs); 312 313 kernel_mna_trap_fault(0); 314 } else { 315 unsigned long addr, *reg_addr; 316 int err; 317 318 addr = compute_effective_address(regs, insn, 319 ((insn >> 25) & 0x1f)); 320 perf_sw_event(PERF_COUNT_SW_ALIGNMENT_FAULTS, 1, regs, addr); 321 switch (asi) { 322 case ASI_NL: 323 case ASI_AIUPL: 324 case ASI_AIUSL: 325 case ASI_PL: 326 case ASI_SL: 327 case ASI_PNFL: 328 case ASI_SNFL: 329 asi &= ~0x08; 330 break; 331 } 332 switch (dir) { 333 case load: 334 reg_addr = fetch_reg_addr(((insn>>25)&0x1f), regs); 335 err = do_int_load(reg_addr, size, 336 (unsigned long *) addr, 337 decode_signedness(insn), asi); 338 if (likely(!err) && unlikely(asi != orig_asi)) { 339 unsigned long val_in = *reg_addr; 340 switch (size) { 341 case 2: 342 val_in = swab16(val_in); 343 break; 344 case 4: 345 val_in = swab32(val_in); 346 break; 347 case 8: 348 val_in = swab64(val_in); 349 break; 350 case 16: 351 default: 352 BUG(); 353 break; 354 } 355 *reg_addr = val_in; 356 } 357 break; 358 359 case store: 360 err = do_int_store(((insn>>25)&0x1f), size, 361 (unsigned long *) addr, regs, 362 asi, orig_asi); 363 break; 364 365 default: 366 panic("Impossible kernel unaligned trap."); 367 /* Not reached... */ 368 } 369 if (unlikely(err)) 370 kernel_mna_trap_fault(1); 371 else 372 advance(regs); 373 } 374 } 375 376 int handle_popc(u32 insn, struct pt_regs *regs) 377 { 378 int from_kernel = (regs->tstate & TSTATE_PRIV) != 0; 379 int ret, rd = ((insn >> 25) & 0x1f); 380 u64 value; 381 382 perf_sw_event(PERF_COUNT_SW_EMULATION_FAULTS, 1, regs, 0); 383 if (insn & 0x2000) { 384 maybe_flush_windows(0, 0, rd, from_kernel); 385 value = sign_extend_imm13(insn); 386 } else { 387 maybe_flush_windows(0, insn & 0x1f, rd, from_kernel); 388 value = fetch_reg(insn & 0x1f, regs); 389 } 390 ret = hweight64(value); 391 if (rd < 16) { 392 if (rd) 393 regs->u_regs[rd] = ret; 394 } else { 395 if (test_thread_flag(TIF_32BIT)) { 396 struct reg_window32 __user *win32; 397 win32 = (struct reg_window32 __user *)((unsigned long)((u32)regs->u_regs[UREG_FP])); 398 put_user(ret, &win32->locals[rd - 16]); 399 } else { 400 struct reg_window __user *win; 401 win = (struct reg_window __user *)(regs->u_regs[UREG_FP] + STACK_BIAS); 402 put_user(ret, &win->locals[rd - 16]); 403 } 404 } 405 advance(regs); 406 return 1; 407 } 408 409 extern void do_fpother(struct pt_regs *regs); 410 extern void do_privact(struct pt_regs *regs); 411 extern void spitfire_data_access_exception(struct pt_regs *regs, 412 unsigned long sfsr, 413 unsigned long sfar); 414 extern void sun4v_data_access_exception(struct pt_regs *regs, 415 unsigned long addr, 416 unsigned long type_ctx); 417 418 int handle_ldf_stq(u32 insn, struct pt_regs *regs) 419 { 420 unsigned long addr = compute_effective_address(regs, insn, 0); 421 int freg = ((insn >> 25) & 0x1e) | ((insn >> 20) & 0x20); 422 struct fpustate *f = FPUSTATE; 423 int asi = decode_asi(insn, regs); 424 int flag = (freg < 32) ? FPRS_DL : FPRS_DU; 425 426 perf_sw_event(PERF_COUNT_SW_EMULATION_FAULTS, 1, regs, 0); 427 428 save_and_clear_fpu(); 429 current_thread_info()->xfsr[0] &= ~0x1c000; 430 if (freg & 3) { 431 current_thread_info()->xfsr[0] |= (6 << 14) /* invalid_fp_register */; 432 do_fpother(regs); 433 return 0; 434 } 435 if (insn & 0x200000) { 436 /* STQ */ 437 u64 first = 0, second = 0; 438 439 if (current_thread_info()->fpsaved[0] & flag) { 440 first = *(u64 *)&f->regs[freg]; 441 second = *(u64 *)&f->regs[freg+2]; 442 } 443 if (asi < 0x80) { 444 do_privact(regs); 445 return 1; 446 } 447 switch (asi) { 448 case ASI_P: 449 case ASI_S: break; 450 case ASI_PL: 451 case ASI_SL: 452 { 453 /* Need to convert endians */ 454 u64 tmp = __swab64p(&first); 455 456 first = __swab64p(&second); 457 second = tmp; 458 break; 459 } 460 default: 461 if (tlb_type == hypervisor) 462 sun4v_data_access_exception(regs, addr, 0); 463 else 464 spitfire_data_access_exception(regs, 0, addr); 465 return 1; 466 } 467 if (put_user (first >> 32, (u32 __user *)addr) || 468 __put_user ((u32)first, (u32 __user *)(addr + 4)) || 469 __put_user (second >> 32, (u32 __user *)(addr + 8)) || 470 __put_user ((u32)second, (u32 __user *)(addr + 12))) { 471 if (tlb_type == hypervisor) 472 sun4v_data_access_exception(regs, addr, 0); 473 else 474 spitfire_data_access_exception(regs, 0, addr); 475 return 1; 476 } 477 } else { 478 /* LDF, LDDF, LDQF */ 479 u32 data[4] __attribute__ ((aligned(8))); 480 int size, i; 481 int err; 482 483 if (asi < 0x80) { 484 do_privact(regs); 485 return 1; 486 } else if (asi > ASI_SNFL) { 487 if (tlb_type == hypervisor) 488 sun4v_data_access_exception(regs, addr, 0); 489 else 490 spitfire_data_access_exception(regs, 0, addr); 491 return 1; 492 } 493 switch (insn & 0x180000) { 494 case 0x000000: size = 1; break; 495 case 0x100000: size = 4; break; 496 default: size = 2; break; 497 } 498 for (i = 0; i < size; i++) 499 data[i] = 0; 500 501 err = get_user (data[0], (u32 __user *) addr); 502 if (!err) { 503 for (i = 1; i < size; i++) 504 err |= __get_user (data[i], (u32 __user *)(addr + 4*i)); 505 } 506 if (err && !(asi & 0x2 /* NF */)) { 507 if (tlb_type == hypervisor) 508 sun4v_data_access_exception(regs, addr, 0); 509 else 510 spitfire_data_access_exception(regs, 0, addr); 511 return 1; 512 } 513 if (asi & 0x8) /* Little */ { 514 u64 tmp; 515 516 switch (size) { 517 case 1: data[0] = le32_to_cpup(data + 0); break; 518 default:*(u64 *)(data + 0) = le64_to_cpup((u64 *)(data + 0)); 519 break; 520 case 4: tmp = le64_to_cpup((u64 *)(data + 0)); 521 *(u64 *)(data + 0) = le64_to_cpup((u64 *)(data + 2)); 522 *(u64 *)(data + 2) = tmp; 523 break; 524 } 525 } 526 if (!(current_thread_info()->fpsaved[0] & FPRS_FEF)) { 527 current_thread_info()->fpsaved[0] = FPRS_FEF; 528 current_thread_info()->gsr[0] = 0; 529 } 530 if (!(current_thread_info()->fpsaved[0] & flag)) { 531 if (freg < 32) 532 memset(f->regs, 0, 32*sizeof(u32)); 533 else 534 memset(f->regs+32, 0, 32*sizeof(u32)); 535 } 536 memcpy(f->regs + freg, data, size * 4); 537 current_thread_info()->fpsaved[0] |= flag; 538 } 539 advance(regs); 540 return 1; 541 } 542 543 void handle_ld_nf(u32 insn, struct pt_regs *regs) 544 { 545 int rd = ((insn >> 25) & 0x1f); 546 int from_kernel = (regs->tstate & TSTATE_PRIV) != 0; 547 unsigned long *reg; 548 549 perf_sw_event(PERF_COUNT_SW_EMULATION_FAULTS, 1, regs, 0); 550 551 maybe_flush_windows(0, 0, rd, from_kernel); 552 reg = fetch_reg_addr(rd, regs); 553 if (from_kernel || rd < 16) { 554 reg[0] = 0; 555 if ((insn & 0x780000) == 0x180000) 556 reg[1] = 0; 557 } else if (test_thread_flag(TIF_32BIT)) { 558 put_user(0, (int __user *) reg); 559 if ((insn & 0x780000) == 0x180000) 560 put_user(0, ((int __user *) reg) + 1); 561 } else { 562 put_user(0, (unsigned long __user *) reg); 563 if ((insn & 0x780000) == 0x180000) 564 put_user(0, (unsigned long __user *) reg + 1); 565 } 566 advance(regs); 567 } 568 569 void handle_lddfmna(struct pt_regs *regs, unsigned long sfar, unsigned long sfsr) 570 { 571 unsigned long pc = regs->tpc; 572 unsigned long tstate = regs->tstate; 573 u32 insn; 574 u64 value; 575 u8 freg; 576 int flag; 577 struct fpustate *f = FPUSTATE; 578 579 if (tstate & TSTATE_PRIV) 580 die_if_kernel("lddfmna from kernel", regs); 581 perf_sw_event(PERF_COUNT_SW_ALIGNMENT_FAULTS, 1, regs, sfar); 582 if (test_thread_flag(TIF_32BIT)) 583 pc = (u32)pc; 584 if (get_user(insn, (u32 __user *) pc) != -EFAULT) { 585 int asi = decode_asi(insn, regs); 586 u32 first, second; 587 int err; 588 589 if ((asi > ASI_SNFL) || 590 (asi < ASI_P)) 591 goto daex; 592 first = second = 0; 593 err = get_user(first, (u32 __user *)sfar); 594 if (!err) 595 err = get_user(second, (u32 __user *)(sfar + 4)); 596 if (err) { 597 if (!(asi & 0x2)) 598 goto daex; 599 first = second = 0; 600 } 601 save_and_clear_fpu(); 602 freg = ((insn >> 25) & 0x1e) | ((insn >> 20) & 0x20); 603 value = (((u64)first) << 32) | second; 604 if (asi & 0x8) /* Little */ 605 value = __swab64p(&value); 606 flag = (freg < 32) ? FPRS_DL : FPRS_DU; 607 if (!(current_thread_info()->fpsaved[0] & FPRS_FEF)) { 608 current_thread_info()->fpsaved[0] = FPRS_FEF; 609 current_thread_info()->gsr[0] = 0; 610 } 611 if (!(current_thread_info()->fpsaved[0] & flag)) { 612 if (freg < 32) 613 memset(f->regs, 0, 32*sizeof(u32)); 614 else 615 memset(f->regs+32, 0, 32*sizeof(u32)); 616 } 617 *(u64 *)(f->regs + freg) = value; 618 current_thread_info()->fpsaved[0] |= flag; 619 } else { 620 daex: 621 if (tlb_type == hypervisor) 622 sun4v_data_access_exception(regs, sfar, sfsr); 623 else 624 spitfire_data_access_exception(regs, sfsr, sfar); 625 return; 626 } 627 advance(regs); 628 } 629 630 void handle_stdfmna(struct pt_regs *regs, unsigned long sfar, unsigned long sfsr) 631 { 632 unsigned long pc = regs->tpc; 633 unsigned long tstate = regs->tstate; 634 u32 insn; 635 u64 value; 636 u8 freg; 637 int flag; 638 struct fpustate *f = FPUSTATE; 639 640 if (tstate & TSTATE_PRIV) 641 die_if_kernel("stdfmna from kernel", regs); 642 perf_sw_event(PERF_COUNT_SW_ALIGNMENT_FAULTS, 1, regs, sfar); 643 if (test_thread_flag(TIF_32BIT)) 644 pc = (u32)pc; 645 if (get_user(insn, (u32 __user *) pc) != -EFAULT) { 646 int asi = decode_asi(insn, regs); 647 freg = ((insn >> 25) & 0x1e) | ((insn >> 20) & 0x20); 648 value = 0; 649 flag = (freg < 32) ? FPRS_DL : FPRS_DU; 650 if ((asi > ASI_SNFL) || 651 (asi < ASI_P)) 652 goto daex; 653 save_and_clear_fpu(); 654 if (current_thread_info()->fpsaved[0] & flag) 655 value = *(u64 *)&f->regs[freg]; 656 switch (asi) { 657 case ASI_P: 658 case ASI_S: break; 659 case ASI_PL: 660 case ASI_SL: 661 value = __swab64p(&value); break; 662 default: goto daex; 663 } 664 if (put_user (value >> 32, (u32 __user *) sfar) || 665 __put_user ((u32)value, (u32 __user *)(sfar + 4))) 666 goto daex; 667 } else { 668 daex: 669 if (tlb_type == hypervisor) 670 sun4v_data_access_exception(regs, sfar, sfsr); 671 else 672 spitfire_data_access_exception(regs, sfsr, sfar); 673 return; 674 } 675 advance(regs); 676 } 677