1b2441318SGreg Kroah-Hartman /* SPDX-License-Identifier: GPL-2.0 */ 2478dc89cSAndy Lutomirski #include <linux/jump_label.h> 38c1f7558SJosh Poimboeuf #include <asm/unwind_hints.h> 48a09317bSDave Hansen #include <asm/cpufeatures.h> 58a09317bSDave Hansen #include <asm/page_types.h> 6478dc89cSAndy Lutomirski 7d36f9479SIngo Molnar /* 8d36f9479SIngo Molnar 9d36f9479SIngo Molnar x86 function call convention, 64-bit: 10d36f9479SIngo Molnar ------------------------------------- 11d36f9479SIngo Molnar arguments | callee-saved | extra caller-saved | return 12d36f9479SIngo Molnar [callee-clobbered] | | [callee-clobbered] | 13d36f9479SIngo Molnar --------------------------------------------------------------------------- 14d36f9479SIngo Molnar rdi rsi rdx rcx r8-9 | rbx rbp [*] r12-15 | r10-11 | rax, rdx [**] 15d36f9479SIngo Molnar 16d36f9479SIngo Molnar ( rsp is obviously invariant across normal function calls. (gcc can 'merge' 17d36f9479SIngo Molnar functions when it sees tail-call optimization possibilities) rflags is 18d36f9479SIngo Molnar clobbered. Leftover arguments are passed over the stack frame.) 19d36f9479SIngo Molnar 20d36f9479SIngo Molnar [*] In the frame-pointers case rbp is fixed to the stack frame. 21d36f9479SIngo Molnar 22d36f9479SIngo Molnar [**] for struct return values wider than 64 bits the return convention is a 23d36f9479SIngo Molnar bit more complex: up to 128 bits width we return small structures 24d36f9479SIngo Molnar straight in rax, rdx. For structures larger than that (3 words or 25d36f9479SIngo Molnar larger) the caller puts a pointer to an on-stack return struct 26d36f9479SIngo Molnar [allocated in the caller's stack frame] into the first argument - i.e. 27d36f9479SIngo Molnar into rdi. All other arguments shift up by one in this case. 28d36f9479SIngo Molnar Fortunately this case is rare in the kernel. 29d36f9479SIngo Molnar 30d36f9479SIngo Molnar For 32-bit we have the following conventions - kernel is built with 31d36f9479SIngo Molnar -mregparm=3 and -freg-struct-return: 32d36f9479SIngo Molnar 33d36f9479SIngo Molnar x86 function calling convention, 32-bit: 34d36f9479SIngo Molnar ---------------------------------------- 35d36f9479SIngo Molnar arguments | callee-saved | extra caller-saved | return 36d36f9479SIngo Molnar [callee-clobbered] | | [callee-clobbered] | 37d36f9479SIngo Molnar ------------------------------------------------------------------------- 38d36f9479SIngo Molnar eax edx ecx | ebx edi esi ebp [*] | <none> | eax, edx [**] 39d36f9479SIngo Molnar 40d36f9479SIngo Molnar ( here too esp is obviously invariant across normal function calls. eflags 41d36f9479SIngo Molnar is clobbered. Leftover arguments are passed over the stack frame. ) 42d36f9479SIngo Molnar 43d36f9479SIngo Molnar [*] In the frame-pointers case ebp is fixed to the stack frame. 44d36f9479SIngo Molnar 45d36f9479SIngo Molnar [**] We build with -freg-struct-return, which on 32-bit means similar 46d36f9479SIngo Molnar semantics as on 64-bit: edx can be used for a second return value 47d36f9479SIngo Molnar (i.e. covering integer and structure sizes up to 64 bits) - after that 48d36f9479SIngo Molnar it gets more complex and more expensive: 3-word or larger struct returns 49d36f9479SIngo Molnar get done in the caller's frame and the pointer to the return struct goes 50d36f9479SIngo Molnar into regparm0, i.e. eax - the other arguments shift up and the 51d36f9479SIngo Molnar function's register parameters degenerate to regparm=2 in essence. 52d36f9479SIngo Molnar 53d36f9479SIngo Molnar */ 54d36f9479SIngo Molnar 55d36f9479SIngo Molnar #ifdef CONFIG_X86_64 56d36f9479SIngo Molnar 57d36f9479SIngo Molnar /* 58d36f9479SIngo Molnar * 64-bit system call stack frame layout defines and helpers, 59d36f9479SIngo Molnar * for assembly code: 60d36f9479SIngo Molnar */ 61d36f9479SIngo Molnar 62d36f9479SIngo Molnar /* The layout forms the "struct pt_regs" on the stack: */ 63d36f9479SIngo Molnar /* 64d36f9479SIngo Molnar * C ABI says these regs are callee-preserved. They aren't saved on kernel entry 65d36f9479SIngo Molnar * unless syscall needs a complete, fully filled "struct pt_regs". 66d36f9479SIngo Molnar */ 67d36f9479SIngo Molnar #define R15 0*8 68d36f9479SIngo Molnar #define R14 1*8 69d36f9479SIngo Molnar #define R13 2*8 70d36f9479SIngo Molnar #define R12 3*8 71d36f9479SIngo Molnar #define RBP 4*8 72d36f9479SIngo Molnar #define RBX 5*8 73d36f9479SIngo Molnar /* These regs are callee-clobbered. Always saved on kernel entry. */ 74d36f9479SIngo Molnar #define R11 6*8 75d36f9479SIngo Molnar #define R10 7*8 76d36f9479SIngo Molnar #define R9 8*8 77d36f9479SIngo Molnar #define R8 9*8 78d36f9479SIngo Molnar #define RAX 10*8 79d36f9479SIngo Molnar #define RCX 11*8 80d36f9479SIngo Molnar #define RDX 12*8 81d36f9479SIngo Molnar #define RSI 13*8 82d36f9479SIngo Molnar #define RDI 14*8 83d36f9479SIngo Molnar /* 84d36f9479SIngo Molnar * On syscall entry, this is syscall#. On CPU exception, this is error code. 85d36f9479SIngo Molnar * On hw interrupt, it's IRQ number: 86d36f9479SIngo Molnar */ 87d36f9479SIngo Molnar #define ORIG_RAX 15*8 88d36f9479SIngo Molnar /* Return frame for iretq */ 89d36f9479SIngo Molnar #define RIP 16*8 90d36f9479SIngo Molnar #define CS 17*8 91d36f9479SIngo Molnar #define EFLAGS 18*8 92d36f9479SIngo Molnar #define RSP 19*8 93d36f9479SIngo Molnar #define SS 20*8 94d36f9479SIngo Molnar 95d36f9479SIngo Molnar #define SIZEOF_PTREGS 21*8 96d36f9479SIngo Molnar 9759df2268SAlexander Kuleshov .macro ALLOC_PT_GPREGS_ON_STACK 9859df2268SAlexander Kuleshov addq $-(15*8), %rsp 99d36f9479SIngo Molnar .endm 100d36f9479SIngo Molnar 101d36f9479SIngo Molnar .macro SAVE_C_REGS_HELPER offset=0 rax=1 rcx=1 r8910=1 r11=1 102d36f9479SIngo Molnar .if \r11 103d36f9479SIngo Molnar movq %r11, 6*8+\offset(%rsp) 104d36f9479SIngo Molnar .endif 105d36f9479SIngo Molnar .if \r8910 106d36f9479SIngo Molnar movq %r10, 7*8+\offset(%rsp) 107d36f9479SIngo Molnar movq %r9, 8*8+\offset(%rsp) 108d36f9479SIngo Molnar movq %r8, 9*8+\offset(%rsp) 109d36f9479SIngo Molnar .endif 110d36f9479SIngo Molnar .if \rax 111d36f9479SIngo Molnar movq %rax, 10*8+\offset(%rsp) 112d36f9479SIngo Molnar .endif 113d36f9479SIngo Molnar .if \rcx 114d36f9479SIngo Molnar movq %rcx, 11*8+\offset(%rsp) 115d36f9479SIngo Molnar .endif 116d36f9479SIngo Molnar movq %rdx, 12*8+\offset(%rsp) 117d36f9479SIngo Molnar movq %rsi, 13*8+\offset(%rsp) 118d36f9479SIngo Molnar movq %rdi, 14*8+\offset(%rsp) 1198c1f7558SJosh Poimboeuf UNWIND_HINT_REGS offset=\offset extra=0 120d36f9479SIngo Molnar .endm 121d36f9479SIngo Molnar .macro SAVE_C_REGS offset=0 122d36f9479SIngo Molnar SAVE_C_REGS_HELPER \offset, 1, 1, 1, 1 123d36f9479SIngo Molnar .endm 124d36f9479SIngo Molnar .macro SAVE_C_REGS_EXCEPT_RAX_RCX offset=0 125d36f9479SIngo Molnar SAVE_C_REGS_HELPER \offset, 0, 0, 1, 1 126d36f9479SIngo Molnar .endm 127d36f9479SIngo Molnar .macro SAVE_C_REGS_EXCEPT_R891011 128d36f9479SIngo Molnar SAVE_C_REGS_HELPER 0, 1, 1, 0, 0 129d36f9479SIngo Molnar .endm 130d36f9479SIngo Molnar .macro SAVE_C_REGS_EXCEPT_RCX_R891011 131d36f9479SIngo Molnar SAVE_C_REGS_HELPER 0, 1, 0, 0, 0 132d36f9479SIngo Molnar .endm 133d36f9479SIngo Molnar .macro SAVE_C_REGS_EXCEPT_RAX_RCX_R11 134d36f9479SIngo Molnar SAVE_C_REGS_HELPER 0, 0, 0, 1, 0 135d36f9479SIngo Molnar .endm 136d36f9479SIngo Molnar 137d36f9479SIngo Molnar .macro SAVE_EXTRA_REGS offset=0 138d36f9479SIngo Molnar movq %r15, 0*8+\offset(%rsp) 139d36f9479SIngo Molnar movq %r14, 1*8+\offset(%rsp) 140d36f9479SIngo Molnar movq %r13, 2*8+\offset(%rsp) 141d36f9479SIngo Molnar movq %r12, 3*8+\offset(%rsp) 142d36f9479SIngo Molnar movq %rbp, 4*8+\offset(%rsp) 143d36f9479SIngo Molnar movq %rbx, 5*8+\offset(%rsp) 1448c1f7558SJosh Poimboeuf UNWIND_HINT_REGS offset=\offset 145d36f9479SIngo Molnar .endm 146d36f9479SIngo Molnar 147e872045bSAndy Lutomirski .macro POP_EXTRA_REGS 148e872045bSAndy Lutomirski popq %r15 149e872045bSAndy Lutomirski popq %r14 150e872045bSAndy Lutomirski popq %r13 151e872045bSAndy Lutomirski popq %r12 152e872045bSAndy Lutomirski popq %rbp 153e872045bSAndy Lutomirski popq %rbx 154d36f9479SIngo Molnar .endm 155d36f9479SIngo Molnar 156e872045bSAndy Lutomirski .macro POP_C_REGS 157e872045bSAndy Lutomirski popq %r11 158e872045bSAndy Lutomirski popq %r10 159e872045bSAndy Lutomirski popq %r9 160e872045bSAndy Lutomirski popq %r8 161e872045bSAndy Lutomirski popq %rax 162e872045bSAndy Lutomirski popq %rcx 163e872045bSAndy Lutomirski popq %rdx 164e872045bSAndy Lutomirski popq %rsi 165e872045bSAndy Lutomirski popq %rdi 166d36f9479SIngo Molnar .endm 167d36f9479SIngo Molnar 168d36f9479SIngo Molnar .macro icebp 169d36f9479SIngo Molnar .byte 0xf1 170d36f9479SIngo Molnar .endm 171d36f9479SIngo Molnar 172946c1911SJosh Poimboeuf /* 173946c1911SJosh Poimboeuf * This is a sneaky trick to help the unwinder find pt_regs on the stack. The 174946c1911SJosh Poimboeuf * frame pointer is replaced with an encoded pointer to pt_regs. The encoding 175946c1911SJosh Poimboeuf * is just setting the LSB, which makes it an invalid stack address and is also 176946c1911SJosh Poimboeuf * a signal to the unwinder that it's a pt_regs pointer in disguise. 177946c1911SJosh Poimboeuf * 178946c1911SJosh Poimboeuf * NOTE: This macro must be used *after* SAVE_EXTRA_REGS because it corrupts 179946c1911SJosh Poimboeuf * the original rbp. 180946c1911SJosh Poimboeuf */ 181946c1911SJosh Poimboeuf .macro ENCODE_FRAME_POINTER ptregs_offset=0 182946c1911SJosh Poimboeuf #ifdef CONFIG_FRAME_POINTER 183946c1911SJosh Poimboeuf .if \ptregs_offset 184946c1911SJosh Poimboeuf leaq \ptregs_offset(%rsp), %rbp 185946c1911SJosh Poimboeuf .else 186946c1911SJosh Poimboeuf mov %rsp, %rbp 187946c1911SJosh Poimboeuf .endif 188946c1911SJosh Poimboeuf orq $0x1, %rbp 189946c1911SJosh Poimboeuf #endif 190946c1911SJosh Poimboeuf .endm 191946c1911SJosh Poimboeuf 1928a09317bSDave Hansen #ifdef CONFIG_PAGE_TABLE_ISOLATION 1938a09317bSDave Hansen 1948a09317bSDave Hansen /* PAGE_TABLE_ISOLATION PGDs are 8k. Flip bit 12 to switch between the two halves: */ 1958a09317bSDave Hansen #define PTI_SWITCH_MASK (1<<PAGE_SHIFT) 1968a09317bSDave Hansen 1978a09317bSDave Hansen .macro ADJUST_KERNEL_CR3 reg:req 1988a09317bSDave Hansen /* Clear "PAGE_TABLE_ISOLATION bit", point CR3 at kernel pagetables: */ 1998a09317bSDave Hansen andq $(~PTI_SWITCH_MASK), \reg 2008a09317bSDave Hansen .endm 2018a09317bSDave Hansen 2028a09317bSDave Hansen .macro ADJUST_USER_CR3 reg:req 2038a09317bSDave Hansen /* Move CR3 up a page to the user page tables: */ 2048a09317bSDave Hansen orq $(PTI_SWITCH_MASK), \reg 2058a09317bSDave Hansen .endm 2068a09317bSDave Hansen 2078a09317bSDave Hansen .macro SWITCH_TO_KERNEL_CR3 scratch_reg:req 208aa8c6248SThomas Gleixner ALTERNATIVE "jmp .Lend_\@", "", X86_FEATURE_PTI 2098a09317bSDave Hansen mov %cr3, \scratch_reg 2108a09317bSDave Hansen ADJUST_KERNEL_CR3 \scratch_reg 2118a09317bSDave Hansen mov \scratch_reg, %cr3 212aa8c6248SThomas Gleixner .Lend_\@: 2138a09317bSDave Hansen .endm 2148a09317bSDave Hansen 2158a09317bSDave Hansen .macro SWITCH_TO_USER_CR3 scratch_reg:req 216aa8c6248SThomas Gleixner ALTERNATIVE "jmp .Lend_\@", "", X86_FEATURE_PTI 2178a09317bSDave Hansen mov %cr3, \scratch_reg 2188a09317bSDave Hansen ADJUST_USER_CR3 \scratch_reg 2198a09317bSDave Hansen mov \scratch_reg, %cr3 220aa8c6248SThomas Gleixner .Lend_\@: 2218a09317bSDave Hansen .endm 2228a09317bSDave Hansen 2238a09317bSDave Hansen .macro SAVE_AND_SWITCH_TO_KERNEL_CR3 scratch_reg:req save_reg:req 224aa8c6248SThomas Gleixner ALTERNATIVE "jmp .Ldone_\@", "", X86_FEATURE_PTI 2258a09317bSDave Hansen movq %cr3, \scratch_reg 2268a09317bSDave Hansen movq \scratch_reg, \save_reg 2278a09317bSDave Hansen /* 2288a09317bSDave Hansen * Is the switch bit zero? This means the address is 2298a09317bSDave Hansen * up in real PAGE_TABLE_ISOLATION patches in a moment. 2308a09317bSDave Hansen */ 2318a09317bSDave Hansen testq $(PTI_SWITCH_MASK), \scratch_reg 2328a09317bSDave Hansen jz .Ldone_\@ 2338a09317bSDave Hansen 2348a09317bSDave Hansen ADJUST_KERNEL_CR3 \scratch_reg 2358a09317bSDave Hansen movq \scratch_reg, %cr3 2368a09317bSDave Hansen 2378a09317bSDave Hansen .Ldone_\@: 2388a09317bSDave Hansen .endm 2398a09317bSDave Hansen 2408a09317bSDave Hansen .macro RESTORE_CR3 save_reg:req 241aa8c6248SThomas Gleixner ALTERNATIVE "jmp .Lend_\@", "", X86_FEATURE_PTI 2428a09317bSDave Hansen /* 2438a09317bSDave Hansen * The CR3 write could be avoided when not changing its value, 2448a09317bSDave Hansen * but would require a CR3 read *and* a scratch register. 2458a09317bSDave Hansen */ 2468a09317bSDave Hansen movq \save_reg, %cr3 247aa8c6248SThomas Gleixner .Lend_\@: 2488a09317bSDave Hansen .endm 2498a09317bSDave Hansen 2508a09317bSDave Hansen #else /* CONFIG_PAGE_TABLE_ISOLATION=n: */ 2518a09317bSDave Hansen 2528a09317bSDave Hansen .macro SWITCH_TO_KERNEL_CR3 scratch_reg:req 2538a09317bSDave Hansen .endm 2548a09317bSDave Hansen .macro SWITCH_TO_USER_CR3 scratch_reg:req 2558a09317bSDave Hansen .endm 2568a09317bSDave Hansen .macro SAVE_AND_SWITCH_TO_KERNEL_CR3 scratch_reg:req save_reg:req 2578a09317bSDave Hansen .endm 2588a09317bSDave Hansen .macro RESTORE_CR3 save_reg:req 2598a09317bSDave Hansen .endm 2608a09317bSDave Hansen 2618a09317bSDave Hansen #endif 2628a09317bSDave Hansen 263d36f9479SIngo Molnar #endif /* CONFIG_X86_64 */ 264d36f9479SIngo Molnar 265478dc89cSAndy Lutomirski /* 266478dc89cSAndy Lutomirski * This does 'call enter_from_user_mode' unless we can avoid it based on 267478dc89cSAndy Lutomirski * kernel config or using the static jump infrastructure. 268478dc89cSAndy Lutomirski */ 269478dc89cSAndy Lutomirski .macro CALL_enter_from_user_mode 270478dc89cSAndy Lutomirski #ifdef CONFIG_CONTEXT_TRACKING 271478dc89cSAndy Lutomirski #ifdef HAVE_JUMP_LABEL 272478dc89cSAndy Lutomirski STATIC_JUMP_IF_FALSE .Lafter_call_\@, context_tracking_enabled, def=0 273478dc89cSAndy Lutomirski #endif 274478dc89cSAndy Lutomirski call enter_from_user_mode 275478dc89cSAndy Lutomirski .Lafter_call_\@: 276478dc89cSAndy Lutomirski #endif 277478dc89cSAndy Lutomirski .endm 278