xref: /openbmc/linux/arch/x86/entry/entry_64.S (revision 113094f7)
1/* SPDX-License-Identifier: GPL-2.0 */
2/*
3 *  linux/arch/x86_64/entry.S
4 *
5 *  Copyright (C) 1991, 1992  Linus Torvalds
6 *  Copyright (C) 2000, 2001, 2002  Andi Kleen SuSE Labs
7 *  Copyright (C) 2000  Pavel Machek <pavel@suse.cz>
8 *
9 * entry.S contains the system-call and fault low-level handling routines.
10 *
11 * Some of this is documented in Documentation/x86/entry_64.rst
12 *
13 * A note on terminology:
14 * - iret frame:	Architecture defined interrupt frame from SS to RIP
15 *			at the top of the kernel process stack.
16 *
17 * Some macro usage:
18 * - ENTRY/END:		Define functions in the symbol table.
19 * - TRACE_IRQ_*:	Trace hardirq state for lock debugging.
20 * - idtentry:		Define exception entry points.
21 */
22#include <linux/linkage.h>
23#include <asm/segment.h>
24#include <asm/cache.h>
25#include <asm/errno.h>
26#include <asm/asm-offsets.h>
27#include <asm/msr.h>
28#include <asm/unistd.h>
29#include <asm/thread_info.h>
30#include <asm/hw_irq.h>
31#include <asm/page_types.h>
32#include <asm/irqflags.h>
33#include <asm/paravirt.h>
34#include <asm/percpu.h>
35#include <asm/asm.h>
36#include <asm/smap.h>
37#include <asm/pgtable_types.h>
38#include <asm/export.h>
39#include <asm/frame.h>
40#include <asm/nospec-branch.h>
41#include <linux/err.h>
42
43#include "calling.h"
44
45.code64
46.section .entry.text, "ax"
47
48#ifdef CONFIG_PARAVIRT
49ENTRY(native_usergs_sysret64)
50	UNWIND_HINT_EMPTY
51	swapgs
52	sysretq
53END(native_usergs_sysret64)
54#endif /* CONFIG_PARAVIRT */
55
56.macro TRACE_IRQS_FLAGS flags:req
57#ifdef CONFIG_TRACE_IRQFLAGS
58	btl	$9, \flags		/* interrupts off? */
59	jnc	1f
60	TRACE_IRQS_ON
611:
62#endif
63.endm
64
65.macro TRACE_IRQS_IRETQ
66	TRACE_IRQS_FLAGS EFLAGS(%rsp)
67.endm
68
69/*
70 * When dynamic function tracer is enabled it will add a breakpoint
71 * to all locations that it is about to modify, sync CPUs, update
72 * all the code, sync CPUs, then remove the breakpoints. In this time
73 * if lockdep is enabled, it might jump back into the debug handler
74 * outside the updating of the IST protection. (TRACE_IRQS_ON/OFF).
75 *
76 * We need to change the IDT table before calling TRACE_IRQS_ON/OFF to
77 * make sure the stack pointer does not get reset back to the top
78 * of the debug stack, and instead just reuses the current stack.
79 */
80#if defined(CONFIG_DYNAMIC_FTRACE) && defined(CONFIG_TRACE_IRQFLAGS)
81
82.macro TRACE_IRQS_OFF_DEBUG
83	call	debug_stack_set_zero
84	TRACE_IRQS_OFF
85	call	debug_stack_reset
86.endm
87
88.macro TRACE_IRQS_ON_DEBUG
89	call	debug_stack_set_zero
90	TRACE_IRQS_ON
91	call	debug_stack_reset
92.endm
93
94.macro TRACE_IRQS_IRETQ_DEBUG
95	btl	$9, EFLAGS(%rsp)		/* interrupts off? */
96	jnc	1f
97	TRACE_IRQS_ON_DEBUG
981:
99.endm
100
101#else
102# define TRACE_IRQS_OFF_DEBUG			TRACE_IRQS_OFF
103# define TRACE_IRQS_ON_DEBUG			TRACE_IRQS_ON
104# define TRACE_IRQS_IRETQ_DEBUG			TRACE_IRQS_IRETQ
105#endif
106
107/*
108 * 64-bit SYSCALL instruction entry. Up to 6 arguments in registers.
109 *
110 * This is the only entry point used for 64-bit system calls.  The
111 * hardware interface is reasonably well designed and the register to
112 * argument mapping Linux uses fits well with the registers that are
113 * available when SYSCALL is used.
114 *
115 * SYSCALL instructions can be found inlined in libc implementations as
116 * well as some other programs and libraries.  There are also a handful
117 * of SYSCALL instructions in the vDSO used, for example, as a
118 * clock_gettimeofday fallback.
119 *
120 * 64-bit SYSCALL saves rip to rcx, clears rflags.RF, then saves rflags to r11,
121 * then loads new ss, cs, and rip from previously programmed MSRs.
122 * rflags gets masked by a value from another MSR (so CLD and CLAC
123 * are not needed). SYSCALL does not save anything on the stack
124 * and does not change rsp.
125 *
126 * Registers on entry:
127 * rax  system call number
128 * rcx  return address
129 * r11  saved rflags (note: r11 is callee-clobbered register in C ABI)
130 * rdi  arg0
131 * rsi  arg1
132 * rdx  arg2
133 * r10  arg3 (needs to be moved to rcx to conform to C ABI)
134 * r8   arg4
135 * r9   arg5
136 * (note: r12-r15, rbp, rbx are callee-preserved in C ABI)
137 *
138 * Only called from user space.
139 *
140 * When user can change pt_regs->foo always force IRET. That is because
141 * it deals with uncanonical addresses better. SYSRET has trouble
142 * with them due to bugs in both AMD and Intel CPUs.
143 */
144
145ENTRY(entry_SYSCALL_64)
146	UNWIND_HINT_EMPTY
147	/*
148	 * Interrupts are off on entry.
149	 * We do not frame this tiny irq-off block with TRACE_IRQS_OFF/ON,
150	 * it is too small to ever cause noticeable irq latency.
151	 */
152
153	swapgs
154	/* tss.sp2 is scratch space. */
155	movq	%rsp, PER_CPU_VAR(cpu_tss_rw + TSS_sp2)
156	SWITCH_TO_KERNEL_CR3 scratch_reg=%rsp
157	movq	PER_CPU_VAR(cpu_current_top_of_stack), %rsp
158
159	/* Construct struct pt_regs on stack */
160	pushq	$__USER_DS				/* pt_regs->ss */
161	pushq	PER_CPU_VAR(cpu_tss_rw + TSS_sp2)	/* pt_regs->sp */
162	pushq	%r11					/* pt_regs->flags */
163	pushq	$__USER_CS				/* pt_regs->cs */
164	pushq	%rcx					/* pt_regs->ip */
165GLOBAL(entry_SYSCALL_64_after_hwframe)
166	pushq	%rax					/* pt_regs->orig_ax */
167
168	PUSH_AND_CLEAR_REGS rax=$-ENOSYS
169
170	TRACE_IRQS_OFF
171
172	/* IRQs are off. */
173	movq	%rax, %rdi
174	movq	%rsp, %rsi
175	call	do_syscall_64		/* returns with IRQs disabled */
176
177	TRACE_IRQS_IRETQ		/* we're about to change IF */
178
179	/*
180	 * Try to use SYSRET instead of IRET if we're returning to
181	 * a completely clean 64-bit userspace context.  If we're not,
182	 * go to the slow exit path.
183	 */
184	movq	RCX(%rsp), %rcx
185	movq	RIP(%rsp), %r11
186
187	cmpq	%rcx, %r11	/* SYSRET requires RCX == RIP */
188	jne	swapgs_restore_regs_and_return_to_usermode
189
190	/*
191	 * On Intel CPUs, SYSRET with non-canonical RCX/RIP will #GP
192	 * in kernel space.  This essentially lets the user take over
193	 * the kernel, since userspace controls RSP.
194	 *
195	 * If width of "canonical tail" ever becomes variable, this will need
196	 * to be updated to remain correct on both old and new CPUs.
197	 *
198	 * Change top bits to match most significant bit (47th or 56th bit
199	 * depending on paging mode) in the address.
200	 */
201#ifdef CONFIG_X86_5LEVEL
202	ALTERNATIVE "shl $(64 - 48), %rcx; sar $(64 - 48), %rcx", \
203		"shl $(64 - 57), %rcx; sar $(64 - 57), %rcx", X86_FEATURE_LA57
204#else
205	shl	$(64 - (__VIRTUAL_MASK_SHIFT+1)), %rcx
206	sar	$(64 - (__VIRTUAL_MASK_SHIFT+1)), %rcx
207#endif
208
209	/* If this changed %rcx, it was not canonical */
210	cmpq	%rcx, %r11
211	jne	swapgs_restore_regs_and_return_to_usermode
212
213	cmpq	$__USER_CS, CS(%rsp)		/* CS must match SYSRET */
214	jne	swapgs_restore_regs_and_return_to_usermode
215
216	movq	R11(%rsp), %r11
217	cmpq	%r11, EFLAGS(%rsp)		/* R11 == RFLAGS */
218	jne	swapgs_restore_regs_and_return_to_usermode
219
220	/*
221	 * SYSCALL clears RF when it saves RFLAGS in R11 and SYSRET cannot
222	 * restore RF properly. If the slowpath sets it for whatever reason, we
223	 * need to restore it correctly.
224	 *
225	 * SYSRET can restore TF, but unlike IRET, restoring TF results in a
226	 * trap from userspace immediately after SYSRET.  This would cause an
227	 * infinite loop whenever #DB happens with register state that satisfies
228	 * the opportunistic SYSRET conditions.  For example, single-stepping
229	 * this user code:
230	 *
231	 *           movq	$stuck_here, %rcx
232	 *           pushfq
233	 *           popq %r11
234	 *   stuck_here:
235	 *
236	 * would never get past 'stuck_here'.
237	 */
238	testq	$(X86_EFLAGS_RF|X86_EFLAGS_TF), %r11
239	jnz	swapgs_restore_regs_and_return_to_usermode
240
241	/* nothing to check for RSP */
242
243	cmpq	$__USER_DS, SS(%rsp)		/* SS must match SYSRET */
244	jne	swapgs_restore_regs_and_return_to_usermode
245
246	/*
247	 * We win! This label is here just for ease of understanding
248	 * perf profiles. Nothing jumps here.
249	 */
250syscall_return_via_sysret:
251	/* rcx and r11 are already restored (see code above) */
252	UNWIND_HINT_EMPTY
253	POP_REGS pop_rdi=0 skip_r11rcx=1
254
255	/*
256	 * Now all regs are restored except RSP and RDI.
257	 * Save old stack pointer and switch to trampoline stack.
258	 */
259	movq	%rsp, %rdi
260	movq	PER_CPU_VAR(cpu_tss_rw + TSS_sp0), %rsp
261
262	pushq	RSP-RDI(%rdi)	/* RSP */
263	pushq	(%rdi)		/* RDI */
264
265	/*
266	 * We are on the trampoline stack.  All regs except RDI are live.
267	 * We can do future final exit work right here.
268	 */
269	STACKLEAK_ERASE_NOCLOBBER
270
271	SWITCH_TO_USER_CR3_STACK scratch_reg=%rdi
272
273	popq	%rdi
274	popq	%rsp
275	USERGS_SYSRET64
276END(entry_SYSCALL_64)
277
278/*
279 * %rdi: prev task
280 * %rsi: next task
281 */
282ENTRY(__switch_to_asm)
283	UNWIND_HINT_FUNC
284	/*
285	 * Save callee-saved registers
286	 * This must match the order in inactive_task_frame
287	 */
288	pushq	%rbp
289	pushq	%rbx
290	pushq	%r12
291	pushq	%r13
292	pushq	%r14
293	pushq	%r15
294
295	/* switch stack */
296	movq	%rsp, TASK_threadsp(%rdi)
297	movq	TASK_threadsp(%rsi), %rsp
298
299#ifdef CONFIG_STACKPROTECTOR
300	movq	TASK_stack_canary(%rsi), %rbx
301	movq	%rbx, PER_CPU_VAR(fixed_percpu_data) + stack_canary_offset
302#endif
303
304#ifdef CONFIG_RETPOLINE
305	/*
306	 * When switching from a shallower to a deeper call stack
307	 * the RSB may either underflow or use entries populated
308	 * with userspace addresses. On CPUs where those concerns
309	 * exist, overwrite the RSB with entries which capture
310	 * speculative execution to prevent attack.
311	 */
312	FILL_RETURN_BUFFER %r12, RSB_CLEAR_LOOPS, X86_FEATURE_RSB_CTXSW
313#endif
314
315	/* restore callee-saved registers */
316	popq	%r15
317	popq	%r14
318	popq	%r13
319	popq	%r12
320	popq	%rbx
321	popq	%rbp
322
323	jmp	__switch_to
324END(__switch_to_asm)
325
326/*
327 * A newly forked process directly context switches into this address.
328 *
329 * rax: prev task we switched from
330 * rbx: kernel thread func (NULL for user thread)
331 * r12: kernel thread arg
332 */
333ENTRY(ret_from_fork)
334	UNWIND_HINT_EMPTY
335	movq	%rax, %rdi
336	call	schedule_tail			/* rdi: 'prev' task parameter */
337
338	testq	%rbx, %rbx			/* from kernel_thread? */
339	jnz	1f				/* kernel threads are uncommon */
340
3412:
342	UNWIND_HINT_REGS
343	movq	%rsp, %rdi
344	call	syscall_return_slowpath	/* returns with IRQs disabled */
345	TRACE_IRQS_ON			/* user mode is traced as IRQS on */
346	jmp	swapgs_restore_regs_and_return_to_usermode
347
3481:
349	/* kernel thread */
350	UNWIND_HINT_EMPTY
351	movq	%r12, %rdi
352	CALL_NOSPEC %rbx
353	/*
354	 * A kernel thread is allowed to return here after successfully
355	 * calling do_execve().  Exit to userspace to complete the execve()
356	 * syscall.
357	 */
358	movq	$0, RAX(%rsp)
359	jmp	2b
360END(ret_from_fork)
361
362/*
363 * Build the entry stubs with some assembler magic.
364 * We pack 1 stub into every 8-byte block.
365 */
366	.align 8
367ENTRY(irq_entries_start)
368    vector=FIRST_EXTERNAL_VECTOR
369    .rept (FIRST_SYSTEM_VECTOR - FIRST_EXTERNAL_VECTOR)
370	UNWIND_HINT_IRET_REGS
371	pushq	$(~vector+0x80)			/* Note: always in signed byte range */
372	jmp	common_interrupt
373	.align	8
374	vector=vector+1
375    .endr
376END(irq_entries_start)
377
378	.align 8
379ENTRY(spurious_entries_start)
380    vector=FIRST_SYSTEM_VECTOR
381    .rept (NR_VECTORS - FIRST_SYSTEM_VECTOR)
382	UNWIND_HINT_IRET_REGS
383	pushq	$(~vector+0x80)			/* Note: always in signed byte range */
384	jmp	common_spurious
385	.align	8
386	vector=vector+1
387    .endr
388END(spurious_entries_start)
389
390.macro DEBUG_ENTRY_ASSERT_IRQS_OFF
391#ifdef CONFIG_DEBUG_ENTRY
392	pushq %rax
393	SAVE_FLAGS(CLBR_RAX)
394	testl $X86_EFLAGS_IF, %eax
395	jz .Lokay_\@
396	ud2
397.Lokay_\@:
398	popq %rax
399#endif
400.endm
401
402/*
403 * Enters the IRQ stack if we're not already using it.  NMI-safe.  Clobbers
404 * flags and puts old RSP into old_rsp, and leaves all other GPRs alone.
405 * Requires kernel GSBASE.
406 *
407 * The invariant is that, if irq_count != -1, then the IRQ stack is in use.
408 */
409.macro ENTER_IRQ_STACK regs=1 old_rsp save_ret=0
410	DEBUG_ENTRY_ASSERT_IRQS_OFF
411
412	.if \save_ret
413	/*
414	 * If save_ret is set, the original stack contains one additional
415	 * entry -- the return address. Therefore, move the address one
416	 * entry below %rsp to \old_rsp.
417	 */
418	leaq	8(%rsp), \old_rsp
419	.else
420	movq	%rsp, \old_rsp
421	.endif
422
423	.if \regs
424	UNWIND_HINT_REGS base=\old_rsp
425	.endif
426
427	incl	PER_CPU_VAR(irq_count)
428	jnz	.Lirq_stack_push_old_rsp_\@
429
430	/*
431	 * Right now, if we just incremented irq_count to zero, we've
432	 * claimed the IRQ stack but we haven't switched to it yet.
433	 *
434	 * If anything is added that can interrupt us here without using IST,
435	 * it must be *extremely* careful to limit its stack usage.  This
436	 * could include kprobes and a hypothetical future IST-less #DB
437	 * handler.
438	 *
439	 * The OOPS unwinder relies on the word at the top of the IRQ
440	 * stack linking back to the previous RSP for the entire time we're
441	 * on the IRQ stack.  For this to work reliably, we need to write
442	 * it before we actually move ourselves to the IRQ stack.
443	 */
444
445	movq	\old_rsp, PER_CPU_VAR(irq_stack_backing_store + IRQ_STACK_SIZE - 8)
446	movq	PER_CPU_VAR(hardirq_stack_ptr), %rsp
447
448#ifdef CONFIG_DEBUG_ENTRY
449	/*
450	 * If the first movq above becomes wrong due to IRQ stack layout
451	 * changes, the only way we'll notice is if we try to unwind right
452	 * here.  Assert that we set up the stack right to catch this type
453	 * of bug quickly.
454	 */
455	cmpq	-8(%rsp), \old_rsp
456	je	.Lirq_stack_okay\@
457	ud2
458	.Lirq_stack_okay\@:
459#endif
460
461.Lirq_stack_push_old_rsp_\@:
462	pushq	\old_rsp
463
464	.if \regs
465	UNWIND_HINT_REGS indirect=1
466	.endif
467
468	.if \save_ret
469	/*
470	 * Push the return address to the stack. This return address can
471	 * be found at the "real" original RSP, which was offset by 8 at
472	 * the beginning of this macro.
473	 */
474	pushq	-8(\old_rsp)
475	.endif
476.endm
477
478/*
479 * Undoes ENTER_IRQ_STACK.
480 */
481.macro LEAVE_IRQ_STACK regs=1
482	DEBUG_ENTRY_ASSERT_IRQS_OFF
483	/* We need to be off the IRQ stack before decrementing irq_count. */
484	popq	%rsp
485
486	.if \regs
487	UNWIND_HINT_REGS
488	.endif
489
490	/*
491	 * As in ENTER_IRQ_STACK, irq_count == 0, we are still claiming
492	 * the irq stack but we're not on it.
493	 */
494
495	decl	PER_CPU_VAR(irq_count)
496.endm
497
498/*
499 * Interrupt entry helper function.
500 *
501 * Entry runs with interrupts off. Stack layout at entry:
502 * +----------------------------------------------------+
503 * | regs->ss						|
504 * | regs->rsp						|
505 * | regs->eflags					|
506 * | regs->cs						|
507 * | regs->ip						|
508 * +----------------------------------------------------+
509 * | regs->orig_ax = ~(interrupt number)		|
510 * +----------------------------------------------------+
511 * | return address					|
512 * +----------------------------------------------------+
513 */
514ENTRY(interrupt_entry)
515	UNWIND_HINT_FUNC
516	ASM_CLAC
517	cld
518
519	testb	$3, CS-ORIG_RAX+8(%rsp)
520	jz	1f
521	SWAPGS
522
523	/*
524	 * Switch to the thread stack. The IRET frame and orig_ax are
525	 * on the stack, as well as the return address. RDI..R12 are
526	 * not (yet) on the stack and space has not (yet) been
527	 * allocated for them.
528	 */
529	pushq	%rdi
530
531	/* Need to switch before accessing the thread stack. */
532	SWITCH_TO_KERNEL_CR3 scratch_reg=%rdi
533	movq	%rsp, %rdi
534	movq	PER_CPU_VAR(cpu_current_top_of_stack), %rsp
535
536	 /*
537	  * We have RDI, return address, and orig_ax on the stack on
538	  * top of the IRET frame. That means offset=24
539	  */
540	UNWIND_HINT_IRET_REGS base=%rdi offset=24
541
542	pushq	7*8(%rdi)		/* regs->ss */
543	pushq	6*8(%rdi)		/* regs->rsp */
544	pushq	5*8(%rdi)		/* regs->eflags */
545	pushq	4*8(%rdi)		/* regs->cs */
546	pushq	3*8(%rdi)		/* regs->ip */
547	pushq	2*8(%rdi)		/* regs->orig_ax */
548	pushq	8(%rdi)			/* return address */
549	UNWIND_HINT_FUNC
550
551	movq	(%rdi), %rdi
5521:
553
554	PUSH_AND_CLEAR_REGS save_ret=1
555	ENCODE_FRAME_POINTER 8
556
557	testb	$3, CS+8(%rsp)
558	jz	1f
559
560	/*
561	 * IRQ from user mode.
562	 *
563	 * We need to tell lockdep that IRQs are off.  We can't do this until
564	 * we fix gsbase, and we should do it before enter_from_user_mode
565	 * (which can take locks).  Since TRACE_IRQS_OFF is idempotent,
566	 * the simplest way to handle it is to just call it twice if
567	 * we enter from user mode.  There's no reason to optimize this since
568	 * TRACE_IRQS_OFF is a no-op if lockdep is off.
569	 */
570	TRACE_IRQS_OFF
571
572	CALL_enter_from_user_mode
573
5741:
575	ENTER_IRQ_STACK old_rsp=%rdi save_ret=1
576	/* We entered an interrupt context - irqs are off: */
577	TRACE_IRQS_OFF
578
579	ret
580END(interrupt_entry)
581_ASM_NOKPROBE(interrupt_entry)
582
583
584/* Interrupt entry/exit. */
585
586/*
587 * The interrupt stubs push (~vector+0x80) onto the stack and
588 * then jump to common_spurious/interrupt.
589 */
590common_spurious:
591	addq	$-0x80, (%rsp)			/* Adjust vector to [-256, -1] range */
592	call	interrupt_entry
593	UNWIND_HINT_REGS indirect=1
594	call	smp_spurious_interrupt		/* rdi points to pt_regs */
595	jmp	ret_from_intr
596END(common_spurious)
597_ASM_NOKPROBE(common_spurious)
598
599/* common_interrupt is a hotpath. Align it */
600	.p2align CONFIG_X86_L1_CACHE_SHIFT
601common_interrupt:
602	addq	$-0x80, (%rsp)			/* Adjust vector to [-256, -1] range */
603	call	interrupt_entry
604	UNWIND_HINT_REGS indirect=1
605	call	do_IRQ	/* rdi points to pt_regs */
606	/* 0(%rsp): old RSP */
607ret_from_intr:
608	DISABLE_INTERRUPTS(CLBR_ANY)
609	TRACE_IRQS_OFF
610
611	LEAVE_IRQ_STACK
612
613	testb	$3, CS(%rsp)
614	jz	retint_kernel
615
616	/* Interrupt came from user space */
617GLOBAL(retint_user)
618	mov	%rsp,%rdi
619	call	prepare_exit_to_usermode
620	TRACE_IRQS_IRETQ
621
622GLOBAL(swapgs_restore_regs_and_return_to_usermode)
623#ifdef CONFIG_DEBUG_ENTRY
624	/* Assert that pt_regs indicates user mode. */
625	testb	$3, CS(%rsp)
626	jnz	1f
627	ud2
6281:
629#endif
630	POP_REGS pop_rdi=0
631
632	/*
633	 * The stack is now user RDI, orig_ax, RIP, CS, EFLAGS, RSP, SS.
634	 * Save old stack pointer and switch to trampoline stack.
635	 */
636	movq	%rsp, %rdi
637	movq	PER_CPU_VAR(cpu_tss_rw + TSS_sp0), %rsp
638
639	/* Copy the IRET frame to the trampoline stack. */
640	pushq	6*8(%rdi)	/* SS */
641	pushq	5*8(%rdi)	/* RSP */
642	pushq	4*8(%rdi)	/* EFLAGS */
643	pushq	3*8(%rdi)	/* CS */
644	pushq	2*8(%rdi)	/* RIP */
645
646	/* Push user RDI on the trampoline stack. */
647	pushq	(%rdi)
648
649	/*
650	 * We are on the trampoline stack.  All regs except RDI are live.
651	 * We can do future final exit work right here.
652	 */
653	STACKLEAK_ERASE_NOCLOBBER
654
655	SWITCH_TO_USER_CR3_STACK scratch_reg=%rdi
656
657	/* Restore RDI. */
658	popq	%rdi
659	SWAPGS
660	INTERRUPT_RETURN
661
662
663/* Returning to kernel space */
664retint_kernel:
665#ifdef CONFIG_PREEMPT
666	/* Interrupts are off */
667	/* Check if we need preemption */
668	btl	$9, EFLAGS(%rsp)		/* were interrupts off? */
669	jnc	1f
670	cmpl	$0, PER_CPU_VAR(__preempt_count)
671	jnz	1f
672	call	preempt_schedule_irq
6731:
674#endif
675	/*
676	 * The iretq could re-enable interrupts:
677	 */
678	TRACE_IRQS_IRETQ
679
680GLOBAL(restore_regs_and_return_to_kernel)
681#ifdef CONFIG_DEBUG_ENTRY
682	/* Assert that pt_regs indicates kernel mode. */
683	testb	$3, CS(%rsp)
684	jz	1f
685	ud2
6861:
687#endif
688	POP_REGS
689	addq	$8, %rsp	/* skip regs->orig_ax */
690	/*
691	 * ARCH_HAS_MEMBARRIER_SYNC_CORE rely on IRET core serialization
692	 * when returning from IPI handler.
693	 */
694	INTERRUPT_RETURN
695
696ENTRY(native_iret)
697	UNWIND_HINT_IRET_REGS
698	/*
699	 * Are we returning to a stack segment from the LDT?  Note: in
700	 * 64-bit mode SS:RSP on the exception stack is always valid.
701	 */
702#ifdef CONFIG_X86_ESPFIX64
703	testb	$4, (SS-RIP)(%rsp)
704	jnz	native_irq_return_ldt
705#endif
706
707.global native_irq_return_iret
708native_irq_return_iret:
709	/*
710	 * This may fault.  Non-paranoid faults on return to userspace are
711	 * handled by fixup_bad_iret.  These include #SS, #GP, and #NP.
712	 * Double-faults due to espfix64 are handled in do_double_fault.
713	 * Other faults here are fatal.
714	 */
715	iretq
716
717#ifdef CONFIG_X86_ESPFIX64
718native_irq_return_ldt:
719	/*
720	 * We are running with user GSBASE.  All GPRs contain their user
721	 * values.  We have a percpu ESPFIX stack that is eight slots
722	 * long (see ESPFIX_STACK_SIZE).  espfix_waddr points to the bottom
723	 * of the ESPFIX stack.
724	 *
725	 * We clobber RAX and RDI in this code.  We stash RDI on the
726	 * normal stack and RAX on the ESPFIX stack.
727	 *
728	 * The ESPFIX stack layout we set up looks like this:
729	 *
730	 * --- top of ESPFIX stack ---
731	 * SS
732	 * RSP
733	 * RFLAGS
734	 * CS
735	 * RIP  <-- RSP points here when we're done
736	 * RAX  <-- espfix_waddr points here
737	 * --- bottom of ESPFIX stack ---
738	 */
739
740	pushq	%rdi				/* Stash user RDI */
741	SWAPGS					/* to kernel GS */
742	SWITCH_TO_KERNEL_CR3 scratch_reg=%rdi	/* to kernel CR3 */
743
744	movq	PER_CPU_VAR(espfix_waddr), %rdi
745	movq	%rax, (0*8)(%rdi)		/* user RAX */
746	movq	(1*8)(%rsp), %rax		/* user RIP */
747	movq	%rax, (1*8)(%rdi)
748	movq	(2*8)(%rsp), %rax		/* user CS */
749	movq	%rax, (2*8)(%rdi)
750	movq	(3*8)(%rsp), %rax		/* user RFLAGS */
751	movq	%rax, (3*8)(%rdi)
752	movq	(5*8)(%rsp), %rax		/* user SS */
753	movq	%rax, (5*8)(%rdi)
754	movq	(4*8)(%rsp), %rax		/* user RSP */
755	movq	%rax, (4*8)(%rdi)
756	/* Now RAX == RSP. */
757
758	andl	$0xffff0000, %eax		/* RAX = (RSP & 0xffff0000) */
759
760	/*
761	 * espfix_stack[31:16] == 0.  The page tables are set up such that
762	 * (espfix_stack | (X & 0xffff0000)) points to a read-only alias of
763	 * espfix_waddr for any X.  That is, there are 65536 RO aliases of
764	 * the same page.  Set up RSP so that RSP[31:16] contains the
765	 * respective 16 bits of the /userspace/ RSP and RSP nonetheless
766	 * still points to an RO alias of the ESPFIX stack.
767	 */
768	orq	PER_CPU_VAR(espfix_stack), %rax
769
770	SWITCH_TO_USER_CR3_STACK scratch_reg=%rdi
771	SWAPGS					/* to user GS */
772	popq	%rdi				/* Restore user RDI */
773
774	movq	%rax, %rsp
775	UNWIND_HINT_IRET_REGS offset=8
776
777	/*
778	 * At this point, we cannot write to the stack any more, but we can
779	 * still read.
780	 */
781	popq	%rax				/* Restore user RAX */
782
783	/*
784	 * RSP now points to an ordinary IRET frame, except that the page
785	 * is read-only and RSP[31:16] are preloaded with the userspace
786	 * values.  We can now IRET back to userspace.
787	 */
788	jmp	native_irq_return_iret
789#endif
790END(common_interrupt)
791_ASM_NOKPROBE(common_interrupt)
792
793/*
794 * APIC interrupts.
795 */
796.macro apicinterrupt3 num sym do_sym
797ENTRY(\sym)
798	UNWIND_HINT_IRET_REGS
799	pushq	$~(\num)
800.Lcommon_\sym:
801	call	interrupt_entry
802	UNWIND_HINT_REGS indirect=1
803	call	\do_sym	/* rdi points to pt_regs */
804	jmp	ret_from_intr
805END(\sym)
806_ASM_NOKPROBE(\sym)
807.endm
808
809/* Make sure APIC interrupt handlers end up in the irqentry section: */
810#define PUSH_SECTION_IRQENTRY	.pushsection .irqentry.text, "ax"
811#define POP_SECTION_IRQENTRY	.popsection
812
813.macro apicinterrupt num sym do_sym
814PUSH_SECTION_IRQENTRY
815apicinterrupt3 \num \sym \do_sym
816POP_SECTION_IRQENTRY
817.endm
818
819#ifdef CONFIG_SMP
820apicinterrupt3 IRQ_MOVE_CLEANUP_VECTOR		irq_move_cleanup_interrupt	smp_irq_move_cleanup_interrupt
821apicinterrupt3 REBOOT_VECTOR			reboot_interrupt		smp_reboot_interrupt
822#endif
823
824#ifdef CONFIG_X86_UV
825apicinterrupt3 UV_BAU_MESSAGE			uv_bau_message_intr1		uv_bau_message_interrupt
826#endif
827
828apicinterrupt LOCAL_TIMER_VECTOR		apic_timer_interrupt		smp_apic_timer_interrupt
829apicinterrupt X86_PLATFORM_IPI_VECTOR		x86_platform_ipi		smp_x86_platform_ipi
830
831#ifdef CONFIG_HAVE_KVM
832apicinterrupt3 POSTED_INTR_VECTOR		kvm_posted_intr_ipi		smp_kvm_posted_intr_ipi
833apicinterrupt3 POSTED_INTR_WAKEUP_VECTOR	kvm_posted_intr_wakeup_ipi	smp_kvm_posted_intr_wakeup_ipi
834apicinterrupt3 POSTED_INTR_NESTED_VECTOR	kvm_posted_intr_nested_ipi	smp_kvm_posted_intr_nested_ipi
835#endif
836
837#ifdef CONFIG_X86_MCE_THRESHOLD
838apicinterrupt THRESHOLD_APIC_VECTOR		threshold_interrupt		smp_threshold_interrupt
839#endif
840
841#ifdef CONFIG_X86_MCE_AMD
842apicinterrupt DEFERRED_ERROR_VECTOR		deferred_error_interrupt	smp_deferred_error_interrupt
843#endif
844
845#ifdef CONFIG_X86_THERMAL_VECTOR
846apicinterrupt THERMAL_APIC_VECTOR		thermal_interrupt		smp_thermal_interrupt
847#endif
848
849#ifdef CONFIG_SMP
850apicinterrupt CALL_FUNCTION_SINGLE_VECTOR	call_function_single_interrupt	smp_call_function_single_interrupt
851apicinterrupt CALL_FUNCTION_VECTOR		call_function_interrupt		smp_call_function_interrupt
852apicinterrupt RESCHEDULE_VECTOR			reschedule_interrupt		smp_reschedule_interrupt
853#endif
854
855apicinterrupt ERROR_APIC_VECTOR			error_interrupt			smp_error_interrupt
856apicinterrupt SPURIOUS_APIC_VECTOR		spurious_interrupt		smp_spurious_interrupt
857
858#ifdef CONFIG_IRQ_WORK
859apicinterrupt IRQ_WORK_VECTOR			irq_work_interrupt		smp_irq_work_interrupt
860#endif
861
862/*
863 * Exception entry points.
864 */
865#define CPU_TSS_IST(x) PER_CPU_VAR(cpu_tss_rw) + (TSS_ist + (x) * 8)
866
867/**
868 * idtentry - Generate an IDT entry stub
869 * @sym:		Name of the generated entry point
870 * @do_sym: 		C function to be called
871 * @has_error_code: 	True if this IDT vector has an error code on the stack
872 * @paranoid: 		non-zero means that this vector may be invoked from
873 *			kernel mode with user GSBASE and/or user CR3.
874 *			2 is special -- see below.
875 * @shift_ist:		Set to an IST index if entries from kernel mode should
876 *             		decrement the IST stack so that nested entries get a
877 *			fresh stack.  (This is for #DB, which has a nasty habit
878 *             		of recursing.)
879 *
880 * idtentry generates an IDT stub that sets up a usable kernel context,
881 * creates struct pt_regs, and calls @do_sym.  The stub has the following
882 * special behaviors:
883 *
884 * On an entry from user mode, the stub switches from the trampoline or
885 * IST stack to the normal thread stack.  On an exit to user mode, the
886 * normal exit-to-usermode path is invoked.
887 *
888 * On an exit to kernel mode, if @paranoid == 0, we check for preemption,
889 * whereas we omit the preemption check if @paranoid != 0.  This is purely
890 * because the implementation is simpler this way.  The kernel only needs
891 * to check for asynchronous kernel preemption when IRQ handlers return.
892 *
893 * If @paranoid == 0, then the stub will handle IRET faults by pretending
894 * that the fault came from user mode.  It will handle gs_change faults by
895 * pretending that the fault happened with kernel GSBASE.  Since this handling
896 * is omitted for @paranoid != 0, the #GP, #SS, and #NP stubs must have
897 * @paranoid == 0.  This special handling will do the wrong thing for
898 * espfix-induced #DF on IRET, so #DF must not use @paranoid == 0.
899 *
900 * @paranoid == 2 is special: the stub will never switch stacks.  This is for
901 * #DF: if the thread stack is somehow unusable, we'll still get a useful OOPS.
902 */
903.macro idtentry sym do_sym has_error_code:req paranoid=0 shift_ist=-1 ist_offset=0 create_gap=0
904ENTRY(\sym)
905	UNWIND_HINT_IRET_REGS offset=\has_error_code*8
906
907	/* Sanity check */
908	.if \shift_ist != -1 && \paranoid == 0
909	.error "using shift_ist requires paranoid=1"
910	.endif
911
912	ASM_CLAC
913
914	.if \has_error_code == 0
915	pushq	$-1				/* ORIG_RAX: no syscall to restart */
916	.endif
917
918	.if \paranoid == 1
919	testb	$3, CS-ORIG_RAX(%rsp)		/* If coming from userspace, switch stacks */
920	jnz	.Lfrom_usermode_switch_stack_\@
921	.endif
922
923	.if \create_gap == 1
924	/*
925	 * If coming from kernel space, create a 6-word gap to allow the
926	 * int3 handler to emulate a call instruction.
927	 */
928	testb	$3, CS-ORIG_RAX(%rsp)
929	jnz	.Lfrom_usermode_no_gap_\@
930	.rept	6
931	pushq	5*8(%rsp)
932	.endr
933	UNWIND_HINT_IRET_REGS offset=8
934.Lfrom_usermode_no_gap_\@:
935	.endif
936
937	.if \paranoid
938	call	paranoid_entry
939	.else
940	call	error_entry
941	.endif
942	UNWIND_HINT_REGS
943	/* returned flag: ebx=0: need swapgs on exit, ebx=1: don't need it */
944
945	.if \paranoid
946	.if \shift_ist != -1
947	TRACE_IRQS_OFF_DEBUG			/* reload IDT in case of recursion */
948	.else
949	TRACE_IRQS_OFF
950	.endif
951	.endif
952
953	movq	%rsp, %rdi			/* pt_regs pointer */
954
955	.if \has_error_code
956	movq	ORIG_RAX(%rsp), %rsi		/* get error code */
957	movq	$-1, ORIG_RAX(%rsp)		/* no syscall to restart */
958	.else
959	xorl	%esi, %esi			/* no error code */
960	.endif
961
962	.if \shift_ist != -1
963	subq	$\ist_offset, CPU_TSS_IST(\shift_ist)
964	.endif
965
966	call	\do_sym
967
968	.if \shift_ist != -1
969	addq	$\ist_offset, CPU_TSS_IST(\shift_ist)
970	.endif
971
972	/* these procedures expect "no swapgs" flag in ebx */
973	.if \paranoid
974	jmp	paranoid_exit
975	.else
976	jmp	error_exit
977	.endif
978
979	.if \paranoid == 1
980	/*
981	 * Entry from userspace.  Switch stacks and treat it
982	 * as a normal entry.  This means that paranoid handlers
983	 * run in real process context if user_mode(regs).
984	 */
985.Lfrom_usermode_switch_stack_\@:
986	call	error_entry
987
988	movq	%rsp, %rdi			/* pt_regs pointer */
989
990	.if \has_error_code
991	movq	ORIG_RAX(%rsp), %rsi		/* get error code */
992	movq	$-1, ORIG_RAX(%rsp)		/* no syscall to restart */
993	.else
994	xorl	%esi, %esi			/* no error code */
995	.endif
996
997	call	\do_sym
998
999	jmp	error_exit
1000	.endif
1001_ASM_NOKPROBE(\sym)
1002END(\sym)
1003.endm
1004
1005idtentry divide_error			do_divide_error			has_error_code=0
1006idtentry overflow			do_overflow			has_error_code=0
1007idtentry bounds				do_bounds			has_error_code=0
1008idtentry invalid_op			do_invalid_op			has_error_code=0
1009idtentry device_not_available		do_device_not_available		has_error_code=0
1010idtentry double_fault			do_double_fault			has_error_code=1 paranoid=2
1011idtentry coprocessor_segment_overrun	do_coprocessor_segment_overrun	has_error_code=0
1012idtentry invalid_TSS			do_invalid_TSS			has_error_code=1
1013idtentry segment_not_present		do_segment_not_present		has_error_code=1
1014idtentry spurious_interrupt_bug		do_spurious_interrupt_bug	has_error_code=0
1015idtentry coprocessor_error		do_coprocessor_error		has_error_code=0
1016idtentry alignment_check		do_alignment_check		has_error_code=1
1017idtentry simd_coprocessor_error		do_simd_coprocessor_error	has_error_code=0
1018
1019
1020	/*
1021	 * Reload gs selector with exception handling
1022	 * edi:  new selector
1023	 */
1024ENTRY(native_load_gs_index)
1025	FRAME_BEGIN
1026	pushfq
1027	DISABLE_INTERRUPTS(CLBR_ANY & ~CLBR_RDI)
1028	TRACE_IRQS_OFF
1029	SWAPGS
1030.Lgs_change:
1031	movl	%edi, %gs
10322:	ALTERNATIVE "", "mfence", X86_BUG_SWAPGS_FENCE
1033	SWAPGS
1034	TRACE_IRQS_FLAGS (%rsp)
1035	popfq
1036	FRAME_END
1037	ret
1038ENDPROC(native_load_gs_index)
1039EXPORT_SYMBOL(native_load_gs_index)
1040
1041	_ASM_EXTABLE(.Lgs_change, bad_gs)
1042	.section .fixup, "ax"
1043	/* running with kernelgs */
1044bad_gs:
1045	SWAPGS					/* switch back to user gs */
1046.macro ZAP_GS
1047	/* This can't be a string because the preprocessor needs to see it. */
1048	movl $__USER_DS, %eax
1049	movl %eax, %gs
1050.endm
1051	ALTERNATIVE "", "ZAP_GS", X86_BUG_NULL_SEG
1052	xorl	%eax, %eax
1053	movl	%eax, %gs
1054	jmp	2b
1055	.previous
1056
1057/* Call softirq on interrupt stack. Interrupts are off. */
1058ENTRY(do_softirq_own_stack)
1059	pushq	%rbp
1060	mov	%rsp, %rbp
1061	ENTER_IRQ_STACK regs=0 old_rsp=%r11
1062	call	__do_softirq
1063	LEAVE_IRQ_STACK regs=0
1064	leaveq
1065	ret
1066ENDPROC(do_softirq_own_stack)
1067
1068#ifdef CONFIG_XEN_PV
1069idtentry hypervisor_callback xen_do_hypervisor_callback has_error_code=0
1070
1071/*
1072 * A note on the "critical region" in our callback handler.
1073 * We want to avoid stacking callback handlers due to events occurring
1074 * during handling of the last event. To do this, we keep events disabled
1075 * until we've done all processing. HOWEVER, we must enable events before
1076 * popping the stack frame (can't be done atomically) and so it would still
1077 * be possible to get enough handler activations to overflow the stack.
1078 * Although unlikely, bugs of that kind are hard to track down, so we'd
1079 * like to avoid the possibility.
1080 * So, on entry to the handler we detect whether we interrupted an
1081 * existing activation in its critical region -- if so, we pop the current
1082 * activation and restart the handler using the previous one.
1083 */
1084ENTRY(xen_do_hypervisor_callback)		/* do_hypervisor_callback(struct *pt_regs) */
1085
1086/*
1087 * Since we don't modify %rdi, evtchn_do_upall(struct *pt_regs) will
1088 * see the correct pointer to the pt_regs
1089 */
1090	UNWIND_HINT_FUNC
1091	movq	%rdi, %rsp			/* we don't return, adjust the stack frame */
1092	UNWIND_HINT_REGS
1093
1094	ENTER_IRQ_STACK old_rsp=%r10
1095	call	xen_evtchn_do_upcall
1096	LEAVE_IRQ_STACK
1097
1098#ifndef CONFIG_PREEMPT
1099	call	xen_maybe_preempt_hcall
1100#endif
1101	jmp	error_exit
1102END(xen_do_hypervisor_callback)
1103
1104/*
1105 * Hypervisor uses this for application faults while it executes.
1106 * We get here for two reasons:
1107 *  1. Fault while reloading DS, ES, FS or GS
1108 *  2. Fault while executing IRET
1109 * Category 1 we do not need to fix up as Xen has already reloaded all segment
1110 * registers that could be reloaded and zeroed the others.
1111 * Category 2 we fix up by killing the current process. We cannot use the
1112 * normal Linux return path in this case because if we use the IRET hypercall
1113 * to pop the stack frame we end up in an infinite loop of failsafe callbacks.
1114 * We distinguish between categories by comparing each saved segment register
1115 * with its current contents: any discrepancy means we in category 1.
1116 */
1117ENTRY(xen_failsafe_callback)
1118	UNWIND_HINT_EMPTY
1119	movl	%ds, %ecx
1120	cmpw	%cx, 0x10(%rsp)
1121	jne	1f
1122	movl	%es, %ecx
1123	cmpw	%cx, 0x18(%rsp)
1124	jne	1f
1125	movl	%fs, %ecx
1126	cmpw	%cx, 0x20(%rsp)
1127	jne	1f
1128	movl	%gs, %ecx
1129	cmpw	%cx, 0x28(%rsp)
1130	jne	1f
1131	/* All segments match their saved values => Category 2 (Bad IRET). */
1132	movq	(%rsp), %rcx
1133	movq	8(%rsp), %r11
1134	addq	$0x30, %rsp
1135	pushq	$0				/* RIP */
1136	UNWIND_HINT_IRET_REGS offset=8
1137	jmp	general_protection
11381:	/* Segment mismatch => Category 1 (Bad segment). Retry the IRET. */
1139	movq	(%rsp), %rcx
1140	movq	8(%rsp), %r11
1141	addq	$0x30, %rsp
1142	UNWIND_HINT_IRET_REGS
1143	pushq	$-1 /* orig_ax = -1 => not a system call */
1144	PUSH_AND_CLEAR_REGS
1145	ENCODE_FRAME_POINTER
1146	jmp	error_exit
1147END(xen_failsafe_callback)
1148#endif /* CONFIG_XEN_PV */
1149
1150#ifdef CONFIG_XEN_PVHVM
1151apicinterrupt3 HYPERVISOR_CALLBACK_VECTOR \
1152	xen_hvm_callback_vector xen_evtchn_do_upcall
1153#endif
1154
1155
1156#if IS_ENABLED(CONFIG_HYPERV)
1157apicinterrupt3 HYPERVISOR_CALLBACK_VECTOR \
1158	hyperv_callback_vector hyperv_vector_handler
1159
1160apicinterrupt3 HYPERV_REENLIGHTENMENT_VECTOR \
1161	hyperv_reenlightenment_vector hyperv_reenlightenment_intr
1162
1163apicinterrupt3 HYPERV_STIMER0_VECTOR \
1164	hv_stimer0_callback_vector hv_stimer0_vector_handler
1165#endif /* CONFIG_HYPERV */
1166
1167#if IS_ENABLED(CONFIG_ACRN_GUEST)
1168apicinterrupt3 HYPERVISOR_CALLBACK_VECTOR \
1169	acrn_hv_callback_vector acrn_hv_vector_handler
1170#endif
1171
1172idtentry debug			do_debug		has_error_code=0	paranoid=1 shift_ist=IST_INDEX_DB ist_offset=DB_STACK_OFFSET
1173idtentry int3			do_int3			has_error_code=0	create_gap=1
1174idtentry stack_segment		do_stack_segment	has_error_code=1
1175
1176#ifdef CONFIG_XEN_PV
1177idtentry xennmi			do_nmi			has_error_code=0
1178idtentry xendebug		do_debug		has_error_code=0
1179idtentry xenint3		do_int3			has_error_code=0
1180#endif
1181
1182idtentry general_protection	do_general_protection	has_error_code=1
1183idtentry page_fault		do_page_fault		has_error_code=1
1184
1185#ifdef CONFIG_KVM_GUEST
1186idtentry async_page_fault	do_async_page_fault	has_error_code=1
1187#endif
1188
1189#ifdef CONFIG_X86_MCE
1190idtentry machine_check		do_mce			has_error_code=0	paranoid=1
1191#endif
1192
1193/*
1194 * Save all registers in pt_regs, and switch gs if needed.
1195 * Use slow, but surefire "are we in kernel?" check.
1196 * Return: ebx=0: need swapgs on exit, ebx=1: otherwise
1197 */
1198ENTRY(paranoid_entry)
1199	UNWIND_HINT_FUNC
1200	cld
1201	PUSH_AND_CLEAR_REGS save_ret=1
1202	ENCODE_FRAME_POINTER 8
1203	movl	$1, %ebx
1204	movl	$MSR_GS_BASE, %ecx
1205	rdmsr
1206	testl	%edx, %edx
1207	js	1f				/* negative -> in kernel */
1208	SWAPGS
1209	xorl	%ebx, %ebx
1210
12111:
1212	/*
1213	 * Always stash CR3 in %r14.  This value will be restored,
1214	 * verbatim, at exit.  Needed if paranoid_entry interrupted
1215	 * another entry that already switched to the user CR3 value
1216	 * but has not yet returned to userspace.
1217	 *
1218	 * This is also why CS (stashed in the "iret frame" by the
1219	 * hardware at entry) can not be used: this may be a return
1220	 * to kernel code, but with a user CR3 value.
1221	 */
1222	SAVE_AND_SWITCH_TO_KERNEL_CR3 scratch_reg=%rax save_reg=%r14
1223
1224	ret
1225END(paranoid_entry)
1226
1227/*
1228 * "Paranoid" exit path from exception stack.  This is invoked
1229 * only on return from non-NMI IST interrupts that came
1230 * from kernel space.
1231 *
1232 * We may be returning to very strange contexts (e.g. very early
1233 * in syscall entry), so checking for preemption here would
1234 * be complicated.  Fortunately, we there's no good reason
1235 * to try to handle preemption here.
1236 *
1237 * On entry, ebx is "no swapgs" flag (1: don't need swapgs, 0: need it)
1238 */
1239ENTRY(paranoid_exit)
1240	UNWIND_HINT_REGS
1241	DISABLE_INTERRUPTS(CLBR_ANY)
1242	TRACE_IRQS_OFF_DEBUG
1243	testl	%ebx, %ebx			/* swapgs needed? */
1244	jnz	.Lparanoid_exit_no_swapgs
1245	TRACE_IRQS_IRETQ
1246	/* Always restore stashed CR3 value (see paranoid_entry) */
1247	RESTORE_CR3	scratch_reg=%rbx save_reg=%r14
1248	SWAPGS_UNSAFE_STACK
1249	jmp	.Lparanoid_exit_restore
1250.Lparanoid_exit_no_swapgs:
1251	TRACE_IRQS_IRETQ_DEBUG
1252	/* Always restore stashed CR3 value (see paranoid_entry) */
1253	RESTORE_CR3	scratch_reg=%rbx save_reg=%r14
1254.Lparanoid_exit_restore:
1255	jmp restore_regs_and_return_to_kernel
1256END(paranoid_exit)
1257
1258/*
1259 * Save all registers in pt_regs, and switch GS if needed.
1260 */
1261ENTRY(error_entry)
1262	UNWIND_HINT_FUNC
1263	cld
1264	PUSH_AND_CLEAR_REGS save_ret=1
1265	ENCODE_FRAME_POINTER 8
1266	testb	$3, CS+8(%rsp)
1267	jz	.Lerror_kernelspace
1268
1269	/*
1270	 * We entered from user mode or we're pretending to have entered
1271	 * from user mode due to an IRET fault.
1272	 */
1273	SWAPGS
1274	/* We have user CR3.  Change to kernel CR3. */
1275	SWITCH_TO_KERNEL_CR3 scratch_reg=%rax
1276
1277.Lerror_entry_from_usermode_after_swapgs:
1278	/* Put us onto the real thread stack. */
1279	popq	%r12				/* save return addr in %12 */
1280	movq	%rsp, %rdi			/* arg0 = pt_regs pointer */
1281	call	sync_regs
1282	movq	%rax, %rsp			/* switch stack */
1283	ENCODE_FRAME_POINTER
1284	pushq	%r12
1285
1286	/*
1287	 * We need to tell lockdep that IRQs are off.  We can't do this until
1288	 * we fix gsbase, and we should do it before enter_from_user_mode
1289	 * (which can take locks).
1290	 */
1291	TRACE_IRQS_OFF
1292	CALL_enter_from_user_mode
1293	ret
1294
1295.Lerror_entry_done:
1296	TRACE_IRQS_OFF
1297	ret
1298
1299	/*
1300	 * There are two places in the kernel that can potentially fault with
1301	 * usergs. Handle them here.  B stepping K8s sometimes report a
1302	 * truncated RIP for IRET exceptions returning to compat mode. Check
1303	 * for these here too.
1304	 */
1305.Lerror_kernelspace:
1306	leaq	native_irq_return_iret(%rip), %rcx
1307	cmpq	%rcx, RIP+8(%rsp)
1308	je	.Lerror_bad_iret
1309	movl	%ecx, %eax			/* zero extend */
1310	cmpq	%rax, RIP+8(%rsp)
1311	je	.Lbstep_iret
1312	cmpq	$.Lgs_change, RIP+8(%rsp)
1313	jne	.Lerror_entry_done
1314
1315	/*
1316	 * hack: .Lgs_change can fail with user gsbase.  If this happens, fix up
1317	 * gsbase and proceed.  We'll fix up the exception and land in
1318	 * .Lgs_change's error handler with kernel gsbase.
1319	 */
1320	SWAPGS
1321	SWITCH_TO_KERNEL_CR3 scratch_reg=%rax
1322	jmp .Lerror_entry_done
1323
1324.Lbstep_iret:
1325	/* Fix truncated RIP */
1326	movq	%rcx, RIP+8(%rsp)
1327	/* fall through */
1328
1329.Lerror_bad_iret:
1330	/*
1331	 * We came from an IRET to user mode, so we have user
1332	 * gsbase and CR3.  Switch to kernel gsbase and CR3:
1333	 */
1334	SWAPGS
1335	SWITCH_TO_KERNEL_CR3 scratch_reg=%rax
1336
1337	/*
1338	 * Pretend that the exception came from user mode: set up pt_regs
1339	 * as if we faulted immediately after IRET.
1340	 */
1341	mov	%rsp, %rdi
1342	call	fixup_bad_iret
1343	mov	%rax, %rsp
1344	jmp	.Lerror_entry_from_usermode_after_swapgs
1345END(error_entry)
1346
1347ENTRY(error_exit)
1348	UNWIND_HINT_REGS
1349	DISABLE_INTERRUPTS(CLBR_ANY)
1350	TRACE_IRQS_OFF
1351	testb	$3, CS(%rsp)
1352	jz	retint_kernel
1353	jmp	retint_user
1354END(error_exit)
1355
1356/*
1357 * Runs on exception stack.  Xen PV does not go through this path at all,
1358 * so we can use real assembly here.
1359 *
1360 * Registers:
1361 *	%r14: Used to save/restore the CR3 of the interrupted context
1362 *	      when PAGE_TABLE_ISOLATION is in use.  Do not clobber.
1363 */
1364ENTRY(nmi)
1365	UNWIND_HINT_IRET_REGS
1366
1367	/*
1368	 * We allow breakpoints in NMIs. If a breakpoint occurs, then
1369	 * the iretq it performs will take us out of NMI context.
1370	 * This means that we can have nested NMIs where the next
1371	 * NMI is using the top of the stack of the previous NMI. We
1372	 * can't let it execute because the nested NMI will corrupt the
1373	 * stack of the previous NMI. NMI handlers are not re-entrant
1374	 * anyway.
1375	 *
1376	 * To handle this case we do the following:
1377	 *  Check the a special location on the stack that contains
1378	 *  a variable that is set when NMIs are executing.
1379	 *  The interrupted task's stack is also checked to see if it
1380	 *  is an NMI stack.
1381	 *  If the variable is not set and the stack is not the NMI
1382	 *  stack then:
1383	 *    o Set the special variable on the stack
1384	 *    o Copy the interrupt frame into an "outermost" location on the
1385	 *      stack
1386	 *    o Copy the interrupt frame into an "iret" location on the stack
1387	 *    o Continue processing the NMI
1388	 *  If the variable is set or the previous stack is the NMI stack:
1389	 *    o Modify the "iret" location to jump to the repeat_nmi
1390	 *    o return back to the first NMI
1391	 *
1392	 * Now on exit of the first NMI, we first clear the stack variable
1393	 * The NMI stack will tell any nested NMIs at that point that it is
1394	 * nested. Then we pop the stack normally with iret, and if there was
1395	 * a nested NMI that updated the copy interrupt stack frame, a
1396	 * jump will be made to the repeat_nmi code that will handle the second
1397	 * NMI.
1398	 *
1399	 * However, espfix prevents us from directly returning to userspace
1400	 * with a single IRET instruction.  Similarly, IRET to user mode
1401	 * can fault.  We therefore handle NMIs from user space like
1402	 * other IST entries.
1403	 */
1404
1405	ASM_CLAC
1406
1407	/* Use %rdx as our temp variable throughout */
1408	pushq	%rdx
1409
1410	testb	$3, CS-RIP+8(%rsp)
1411	jz	.Lnmi_from_kernel
1412
1413	/*
1414	 * NMI from user mode.  We need to run on the thread stack, but we
1415	 * can't go through the normal entry paths: NMIs are masked, and
1416	 * we don't want to enable interrupts, because then we'll end
1417	 * up in an awkward situation in which IRQs are on but NMIs
1418	 * are off.
1419	 *
1420	 * We also must not push anything to the stack before switching
1421	 * stacks lest we corrupt the "NMI executing" variable.
1422	 */
1423
1424	swapgs
1425	cld
1426	SWITCH_TO_KERNEL_CR3 scratch_reg=%rdx
1427	movq	%rsp, %rdx
1428	movq	PER_CPU_VAR(cpu_current_top_of_stack), %rsp
1429	UNWIND_HINT_IRET_REGS base=%rdx offset=8
1430	pushq	5*8(%rdx)	/* pt_regs->ss */
1431	pushq	4*8(%rdx)	/* pt_regs->rsp */
1432	pushq	3*8(%rdx)	/* pt_regs->flags */
1433	pushq	2*8(%rdx)	/* pt_regs->cs */
1434	pushq	1*8(%rdx)	/* pt_regs->rip */
1435	UNWIND_HINT_IRET_REGS
1436	pushq   $-1		/* pt_regs->orig_ax */
1437	PUSH_AND_CLEAR_REGS rdx=(%rdx)
1438	ENCODE_FRAME_POINTER
1439
1440	/*
1441	 * At this point we no longer need to worry about stack damage
1442	 * due to nesting -- we're on the normal thread stack and we're
1443	 * done with the NMI stack.
1444	 */
1445
1446	movq	%rsp, %rdi
1447	movq	$-1, %rsi
1448	call	do_nmi
1449
1450	/*
1451	 * Return back to user mode.  We must *not* do the normal exit
1452	 * work, because we don't want to enable interrupts.
1453	 */
1454	jmp	swapgs_restore_regs_and_return_to_usermode
1455
1456.Lnmi_from_kernel:
1457	/*
1458	 * Here's what our stack frame will look like:
1459	 * +---------------------------------------------------------+
1460	 * | original SS                                             |
1461	 * | original Return RSP                                     |
1462	 * | original RFLAGS                                         |
1463	 * | original CS                                             |
1464	 * | original RIP                                            |
1465	 * +---------------------------------------------------------+
1466	 * | temp storage for rdx                                    |
1467	 * +---------------------------------------------------------+
1468	 * | "NMI executing" variable                                |
1469	 * +---------------------------------------------------------+
1470	 * | iret SS          } Copied from "outermost" frame        |
1471	 * | iret Return RSP  } on each loop iteration; overwritten  |
1472	 * | iret RFLAGS      } by a nested NMI to force another     |
1473	 * | iret CS          } iteration if needed.                 |
1474	 * | iret RIP         }                                      |
1475	 * +---------------------------------------------------------+
1476	 * | outermost SS          } initialized in first_nmi;       |
1477	 * | outermost Return RSP  } will not be changed before      |
1478	 * | outermost RFLAGS      } NMI processing is done.         |
1479	 * | outermost CS          } Copied to "iret" frame on each  |
1480	 * | outermost RIP         } iteration.                      |
1481	 * +---------------------------------------------------------+
1482	 * | pt_regs                                                 |
1483	 * +---------------------------------------------------------+
1484	 *
1485	 * The "original" frame is used by hardware.  Before re-enabling
1486	 * NMIs, we need to be done with it, and we need to leave enough
1487	 * space for the asm code here.
1488	 *
1489	 * We return by executing IRET while RSP points to the "iret" frame.
1490	 * That will either return for real or it will loop back into NMI
1491	 * processing.
1492	 *
1493	 * The "outermost" frame is copied to the "iret" frame on each
1494	 * iteration of the loop, so each iteration starts with the "iret"
1495	 * frame pointing to the final return target.
1496	 */
1497
1498	/*
1499	 * Determine whether we're a nested NMI.
1500	 *
1501	 * If we interrupted kernel code between repeat_nmi and
1502	 * end_repeat_nmi, then we are a nested NMI.  We must not
1503	 * modify the "iret" frame because it's being written by
1504	 * the outer NMI.  That's okay; the outer NMI handler is
1505	 * about to about to call do_nmi anyway, so we can just
1506	 * resume the outer NMI.
1507	 */
1508
1509	movq	$repeat_nmi, %rdx
1510	cmpq	8(%rsp), %rdx
1511	ja	1f
1512	movq	$end_repeat_nmi, %rdx
1513	cmpq	8(%rsp), %rdx
1514	ja	nested_nmi_out
15151:
1516
1517	/*
1518	 * Now check "NMI executing".  If it's set, then we're nested.
1519	 * This will not detect if we interrupted an outer NMI just
1520	 * before IRET.
1521	 */
1522	cmpl	$1, -8(%rsp)
1523	je	nested_nmi
1524
1525	/*
1526	 * Now test if the previous stack was an NMI stack.  This covers
1527	 * the case where we interrupt an outer NMI after it clears
1528	 * "NMI executing" but before IRET.  We need to be careful, though:
1529	 * there is one case in which RSP could point to the NMI stack
1530	 * despite there being no NMI active: naughty userspace controls
1531	 * RSP at the very beginning of the SYSCALL targets.  We can
1532	 * pull a fast one on naughty userspace, though: we program
1533	 * SYSCALL to mask DF, so userspace cannot cause DF to be set
1534	 * if it controls the kernel's RSP.  We set DF before we clear
1535	 * "NMI executing".
1536	 */
1537	lea	6*8(%rsp), %rdx
1538	/* Compare the NMI stack (rdx) with the stack we came from (4*8(%rsp)) */
1539	cmpq	%rdx, 4*8(%rsp)
1540	/* If the stack pointer is above the NMI stack, this is a normal NMI */
1541	ja	first_nmi
1542
1543	subq	$EXCEPTION_STKSZ, %rdx
1544	cmpq	%rdx, 4*8(%rsp)
1545	/* If it is below the NMI stack, it is a normal NMI */
1546	jb	first_nmi
1547
1548	/* Ah, it is within the NMI stack. */
1549
1550	testb	$(X86_EFLAGS_DF >> 8), (3*8 + 1)(%rsp)
1551	jz	first_nmi	/* RSP was user controlled. */
1552
1553	/* This is a nested NMI. */
1554
1555nested_nmi:
1556	/*
1557	 * Modify the "iret" frame to point to repeat_nmi, forcing another
1558	 * iteration of NMI handling.
1559	 */
1560	subq	$8, %rsp
1561	leaq	-10*8(%rsp), %rdx
1562	pushq	$__KERNEL_DS
1563	pushq	%rdx
1564	pushfq
1565	pushq	$__KERNEL_CS
1566	pushq	$repeat_nmi
1567
1568	/* Put stack back */
1569	addq	$(6*8), %rsp
1570
1571nested_nmi_out:
1572	popq	%rdx
1573
1574	/* We are returning to kernel mode, so this cannot result in a fault. */
1575	iretq
1576
1577first_nmi:
1578	/* Restore rdx. */
1579	movq	(%rsp), %rdx
1580
1581	/* Make room for "NMI executing". */
1582	pushq	$0
1583
1584	/* Leave room for the "iret" frame */
1585	subq	$(5*8), %rsp
1586
1587	/* Copy the "original" frame to the "outermost" frame */
1588	.rept 5
1589	pushq	11*8(%rsp)
1590	.endr
1591	UNWIND_HINT_IRET_REGS
1592
1593	/* Everything up to here is safe from nested NMIs */
1594
1595#ifdef CONFIG_DEBUG_ENTRY
1596	/*
1597	 * For ease of testing, unmask NMIs right away.  Disabled by
1598	 * default because IRET is very expensive.
1599	 */
1600	pushq	$0		/* SS */
1601	pushq	%rsp		/* RSP (minus 8 because of the previous push) */
1602	addq	$8, (%rsp)	/* Fix up RSP */
1603	pushfq			/* RFLAGS */
1604	pushq	$__KERNEL_CS	/* CS */
1605	pushq	$1f		/* RIP */
1606	iretq			/* continues at repeat_nmi below */
1607	UNWIND_HINT_IRET_REGS
16081:
1609#endif
1610
1611repeat_nmi:
1612	/*
1613	 * If there was a nested NMI, the first NMI's iret will return
1614	 * here. But NMIs are still enabled and we can take another
1615	 * nested NMI. The nested NMI checks the interrupted RIP to see
1616	 * if it is between repeat_nmi and end_repeat_nmi, and if so
1617	 * it will just return, as we are about to repeat an NMI anyway.
1618	 * This makes it safe to copy to the stack frame that a nested
1619	 * NMI will update.
1620	 *
1621	 * RSP is pointing to "outermost RIP".  gsbase is unknown, but, if
1622	 * we're repeating an NMI, gsbase has the same value that it had on
1623	 * the first iteration.  paranoid_entry will load the kernel
1624	 * gsbase if needed before we call do_nmi.  "NMI executing"
1625	 * is zero.
1626	 */
1627	movq	$1, 10*8(%rsp)		/* Set "NMI executing". */
1628
1629	/*
1630	 * Copy the "outermost" frame to the "iret" frame.  NMIs that nest
1631	 * here must not modify the "iret" frame while we're writing to
1632	 * it or it will end up containing garbage.
1633	 */
1634	addq	$(10*8), %rsp
1635	.rept 5
1636	pushq	-6*8(%rsp)
1637	.endr
1638	subq	$(5*8), %rsp
1639end_repeat_nmi:
1640
1641	/*
1642	 * Everything below this point can be preempted by a nested NMI.
1643	 * If this happens, then the inner NMI will change the "iret"
1644	 * frame to point back to repeat_nmi.
1645	 */
1646	pushq	$-1				/* ORIG_RAX: no syscall to restart */
1647
1648	/*
1649	 * Use paranoid_entry to handle SWAPGS, but no need to use paranoid_exit
1650	 * as we should not be calling schedule in NMI context.
1651	 * Even with normal interrupts enabled. An NMI should not be
1652	 * setting NEED_RESCHED or anything that normal interrupts and
1653	 * exceptions might do.
1654	 */
1655	call	paranoid_entry
1656	UNWIND_HINT_REGS
1657
1658	/* paranoidentry do_nmi, 0; without TRACE_IRQS_OFF */
1659	movq	%rsp, %rdi
1660	movq	$-1, %rsi
1661	call	do_nmi
1662
1663	/* Always restore stashed CR3 value (see paranoid_entry) */
1664	RESTORE_CR3 scratch_reg=%r15 save_reg=%r14
1665
1666	testl	%ebx, %ebx			/* swapgs needed? */
1667	jnz	nmi_restore
1668nmi_swapgs:
1669	SWAPGS_UNSAFE_STACK
1670nmi_restore:
1671	POP_REGS
1672
1673	/*
1674	 * Skip orig_ax and the "outermost" frame to point RSP at the "iret"
1675	 * at the "iret" frame.
1676	 */
1677	addq	$6*8, %rsp
1678
1679	/*
1680	 * Clear "NMI executing".  Set DF first so that we can easily
1681	 * distinguish the remaining code between here and IRET from
1682	 * the SYSCALL entry and exit paths.
1683	 *
1684	 * We arguably should just inspect RIP instead, but I (Andy) wrote
1685	 * this code when I had the misapprehension that Xen PV supported
1686	 * NMIs, and Xen PV would break that approach.
1687	 */
1688	std
1689	movq	$0, 5*8(%rsp)		/* clear "NMI executing" */
1690
1691	/*
1692	 * iretq reads the "iret" frame and exits the NMI stack in a
1693	 * single instruction.  We are returning to kernel mode, so this
1694	 * cannot result in a fault.  Similarly, we don't need to worry
1695	 * about espfix64 on the way back to kernel mode.
1696	 */
1697	iretq
1698END(nmi)
1699
1700#ifndef CONFIG_IA32_EMULATION
1701/*
1702 * This handles SYSCALL from 32-bit code.  There is no way to program
1703 * MSRs to fully disable 32-bit SYSCALL.
1704 */
1705ENTRY(ignore_sysret)
1706	UNWIND_HINT_EMPTY
1707	mov	$-ENOSYS, %eax
1708	sysret
1709END(ignore_sysret)
1710#endif
1711
1712ENTRY(rewind_stack_do_exit)
1713	UNWIND_HINT_FUNC
1714	/* Prevent any naive code from trying to unwind to our caller. */
1715	xorl	%ebp, %ebp
1716
1717	movq	PER_CPU_VAR(cpu_current_top_of_stack), %rax
1718	leaq	-PTREGS_SIZE(%rax), %rsp
1719	UNWIND_HINT_FUNC sp_offset=PTREGS_SIZE
1720
1721	call	do_exit
1722END(rewind_stack_do_exit)
1723