xref: /linux/arch/x86/entry/entry_64.S (revision 627fce14809ba5610b0cb476cd0186d3fcedecfc)
1/*
2 *  linux/arch/x86_64/entry.S
3 *
4 *  Copyright (C) 1991, 1992  Linus Torvalds
5 *  Copyright (C) 2000, 2001, 2002  Andi Kleen SuSE Labs
6 *  Copyright (C) 2000  Pavel Machek <pavel@suse.cz>
7 *
8 * entry.S contains the system-call and fault low-level handling routines.
9 *
10 * Some of this is documented in Documentation/x86/entry_64.txt
11 *
12 * A note on terminology:
13 * - iret frame:	Architecture defined interrupt frame from SS to RIP
14 *			at the top of the kernel process stack.
15 *
16 * Some macro usage:
17 * - ENTRY/END:		Define functions in the symbol table.
18 * - TRACE_IRQ_*:	Trace hardirq state for lock debugging.
19 * - idtentry:		Define exception entry points.
20 */
21#include <linux/linkage.h>
22#include <asm/segment.h>
23#include <asm/cache.h>
24#include <asm/errno.h>
25#include "calling.h"
26#include <asm/asm-offsets.h>
27#include <asm/msr.h>
28#include <asm/unistd.h>
29#include <asm/thread_info.h>
30#include <asm/hw_irq.h>
31#include <asm/page_types.h>
32#include <asm/irqflags.h>
33#include <asm/paravirt.h>
34#include <asm/percpu.h>
35#include <asm/asm.h>
36#include <asm/smap.h>
37#include <asm/pgtable_types.h>
38#include <asm/export.h>
39#include <linux/err.h>
40
41.code64
42.section .entry.text, "ax"
43
44#ifdef CONFIG_PARAVIRT
45ENTRY(native_usergs_sysret64)
46	swapgs
47	sysretq
48ENDPROC(native_usergs_sysret64)
49#endif /* CONFIG_PARAVIRT */
50
51.macro TRACE_IRQS_IRETQ
52#ifdef CONFIG_TRACE_IRQFLAGS
53	bt	$9, EFLAGS(%rsp)		/* interrupts off? */
54	jnc	1f
55	TRACE_IRQS_ON
561:
57#endif
58.endm
59
60/*
61 * When dynamic function tracer is enabled it will add a breakpoint
62 * to all locations that it is about to modify, sync CPUs, update
63 * all the code, sync CPUs, then remove the breakpoints. In this time
64 * if lockdep is enabled, it might jump back into the debug handler
65 * outside the updating of the IST protection. (TRACE_IRQS_ON/OFF).
66 *
67 * We need to change the IDT table before calling TRACE_IRQS_ON/OFF to
68 * make sure the stack pointer does not get reset back to the top
69 * of the debug stack, and instead just reuses the current stack.
70 */
71#if defined(CONFIG_DYNAMIC_FTRACE) && defined(CONFIG_TRACE_IRQFLAGS)
72
73.macro TRACE_IRQS_OFF_DEBUG
74	call	debug_stack_set_zero
75	TRACE_IRQS_OFF
76	call	debug_stack_reset
77.endm
78
79.macro TRACE_IRQS_ON_DEBUG
80	call	debug_stack_set_zero
81	TRACE_IRQS_ON
82	call	debug_stack_reset
83.endm
84
85.macro TRACE_IRQS_IRETQ_DEBUG
86	bt	$9, EFLAGS(%rsp)		/* interrupts off? */
87	jnc	1f
88	TRACE_IRQS_ON_DEBUG
891:
90.endm
91
92#else
93# define TRACE_IRQS_OFF_DEBUG			TRACE_IRQS_OFF
94# define TRACE_IRQS_ON_DEBUG			TRACE_IRQS_ON
95# define TRACE_IRQS_IRETQ_DEBUG			TRACE_IRQS_IRETQ
96#endif
97
98/*
99 * 64-bit SYSCALL instruction entry. Up to 6 arguments in registers.
100 *
101 * This is the only entry point used for 64-bit system calls.  The
102 * hardware interface is reasonably well designed and the register to
103 * argument mapping Linux uses fits well with the registers that are
104 * available when SYSCALL is used.
105 *
106 * SYSCALL instructions can be found inlined in libc implementations as
107 * well as some other programs and libraries.  There are also a handful
108 * of SYSCALL instructions in the vDSO used, for example, as a
109 * clock_gettimeofday fallback.
110 *
111 * 64-bit SYSCALL saves rip to rcx, clears rflags.RF, then saves rflags to r11,
112 * then loads new ss, cs, and rip from previously programmed MSRs.
113 * rflags gets masked by a value from another MSR (so CLD and CLAC
114 * are not needed). SYSCALL does not save anything on the stack
115 * and does not change rsp.
116 *
117 * Registers on entry:
118 * rax  system call number
119 * rcx  return address
120 * r11  saved rflags (note: r11 is callee-clobbered register in C ABI)
121 * rdi  arg0
122 * rsi  arg1
123 * rdx  arg2
124 * r10  arg3 (needs to be moved to rcx to conform to C ABI)
125 * r8   arg4
126 * r9   arg5
127 * (note: r12-r15, rbp, rbx are callee-preserved in C ABI)
128 *
129 * Only called from user space.
130 *
131 * When user can change pt_regs->foo always force IRET. That is because
132 * it deals with uncanonical addresses better. SYSRET has trouble
133 * with them due to bugs in both AMD and Intel CPUs.
134 */
135
136ENTRY(entry_SYSCALL_64)
137	/*
138	 * Interrupts are off on entry.
139	 * We do not frame this tiny irq-off block with TRACE_IRQS_OFF/ON,
140	 * it is too small to ever cause noticeable irq latency.
141	 */
142	SWAPGS_UNSAFE_STACK
143	/*
144	 * A hypervisor implementation might want to use a label
145	 * after the swapgs, so that it can do the swapgs
146	 * for the guest and jump here on syscall.
147	 */
148GLOBAL(entry_SYSCALL_64_after_swapgs)
149
150	movq	%rsp, PER_CPU_VAR(rsp_scratch)
151	movq	PER_CPU_VAR(cpu_current_top_of_stack), %rsp
152
153	TRACE_IRQS_OFF
154
155	/* Construct struct pt_regs on stack */
156	pushq	$__USER_DS			/* pt_regs->ss */
157	pushq	PER_CPU_VAR(rsp_scratch)	/* pt_regs->sp */
158	pushq	%r11				/* pt_regs->flags */
159	pushq	$__USER_CS			/* pt_regs->cs */
160	pushq	%rcx				/* pt_regs->ip */
161	pushq	%rax				/* pt_regs->orig_ax */
162	pushq	%rdi				/* pt_regs->di */
163	pushq	%rsi				/* pt_regs->si */
164	pushq	%rdx				/* pt_regs->dx */
165	pushq	%rcx				/* pt_regs->cx */
166	pushq	$-ENOSYS			/* pt_regs->ax */
167	pushq	%r8				/* pt_regs->r8 */
168	pushq	%r9				/* pt_regs->r9 */
169	pushq	%r10				/* pt_regs->r10 */
170	pushq	%r11				/* pt_regs->r11 */
171	sub	$(6*8), %rsp			/* pt_regs->bp, bx, r12-15 not saved */
172
173	/*
174	 * If we need to do entry work or if we guess we'll need to do
175	 * exit work, go straight to the slow path.
176	 */
177	movq	PER_CPU_VAR(current_task), %r11
178	testl	$_TIF_WORK_SYSCALL_ENTRY|_TIF_ALLWORK_MASK, TASK_TI_flags(%r11)
179	jnz	entry_SYSCALL64_slow_path
180
181entry_SYSCALL_64_fastpath:
182	/*
183	 * Easy case: enable interrupts and issue the syscall.  If the syscall
184	 * needs pt_regs, we'll call a stub that disables interrupts again
185	 * and jumps to the slow path.
186	 */
187	TRACE_IRQS_ON
188	ENABLE_INTERRUPTS(CLBR_NONE)
189#if __SYSCALL_MASK == ~0
190	cmpq	$__NR_syscall_max, %rax
191#else
192	andl	$__SYSCALL_MASK, %eax
193	cmpl	$__NR_syscall_max, %eax
194#endif
195	ja	1f				/* return -ENOSYS (already in pt_regs->ax) */
196	movq	%r10, %rcx
197
198	/*
199	 * This call instruction is handled specially in stub_ptregs_64.
200	 * It might end up jumping to the slow path.  If it jumps, RAX
201	 * and all argument registers are clobbered.
202	 */
203	call	*sys_call_table(, %rax, 8)
204.Lentry_SYSCALL_64_after_fastpath_call:
205
206	movq	%rax, RAX(%rsp)
2071:
208
209	/*
210	 * If we get here, then we know that pt_regs is clean for SYSRET64.
211	 * If we see that no exit work is required (which we are required
212	 * to check with IRQs off), then we can go straight to SYSRET64.
213	 */
214	DISABLE_INTERRUPTS(CLBR_ANY)
215	TRACE_IRQS_OFF
216	movq	PER_CPU_VAR(current_task), %r11
217	testl	$_TIF_ALLWORK_MASK, TASK_TI_flags(%r11)
218	jnz	1f
219
220	LOCKDEP_SYS_EXIT
221	TRACE_IRQS_ON		/* user mode is traced as IRQs on */
222	movq	RIP(%rsp), %rcx
223	movq	EFLAGS(%rsp), %r11
224	RESTORE_C_REGS_EXCEPT_RCX_R11
225	movq	RSP(%rsp), %rsp
226	USERGS_SYSRET64
227
2281:
229	/*
230	 * The fast path looked good when we started, but something changed
231	 * along the way and we need to switch to the slow path.  Calling
232	 * raise(3) will trigger this, for example.  IRQs are off.
233	 */
234	TRACE_IRQS_ON
235	ENABLE_INTERRUPTS(CLBR_ANY)
236	SAVE_EXTRA_REGS
237	movq	%rsp, %rdi
238	call	syscall_return_slowpath	/* returns with IRQs disabled */
239	jmp	return_from_SYSCALL_64
240
241entry_SYSCALL64_slow_path:
242	/* IRQs are off. */
243	SAVE_EXTRA_REGS
244	movq	%rsp, %rdi
245	call	do_syscall_64		/* returns with IRQs disabled */
246
247return_from_SYSCALL_64:
248	RESTORE_EXTRA_REGS
249	TRACE_IRQS_IRETQ		/* we're about to change IF */
250
251	/*
252	 * Try to use SYSRET instead of IRET if we're returning to
253	 * a completely clean 64-bit userspace context.
254	 */
255	movq	RCX(%rsp), %rcx
256	movq	RIP(%rsp), %r11
257	cmpq	%rcx, %r11			/* RCX == RIP */
258	jne	opportunistic_sysret_failed
259
260	/*
261	 * On Intel CPUs, SYSRET with non-canonical RCX/RIP will #GP
262	 * in kernel space.  This essentially lets the user take over
263	 * the kernel, since userspace controls RSP.
264	 *
265	 * If width of "canonical tail" ever becomes variable, this will need
266	 * to be updated to remain correct on both old and new CPUs.
267	 *
268	 * Change top bits to match most significant bit (47th or 56th bit
269	 * depending on paging mode) in the address.
270	 */
271	shl	$(64 - (__VIRTUAL_MASK_SHIFT+1)), %rcx
272	sar	$(64 - (__VIRTUAL_MASK_SHIFT+1)), %rcx
273
274	/* If this changed %rcx, it was not canonical */
275	cmpq	%rcx, %r11
276	jne	opportunistic_sysret_failed
277
278	cmpq	$__USER_CS, CS(%rsp)		/* CS must match SYSRET */
279	jne	opportunistic_sysret_failed
280
281	movq	R11(%rsp), %r11
282	cmpq	%r11, EFLAGS(%rsp)		/* R11 == RFLAGS */
283	jne	opportunistic_sysret_failed
284
285	/*
286	 * SYSCALL clears RF when it saves RFLAGS in R11 and SYSRET cannot
287	 * restore RF properly. If the slowpath sets it for whatever reason, we
288	 * need to restore it correctly.
289	 *
290	 * SYSRET can restore TF, but unlike IRET, restoring TF results in a
291	 * trap from userspace immediately after SYSRET.  This would cause an
292	 * infinite loop whenever #DB happens with register state that satisfies
293	 * the opportunistic SYSRET conditions.  For example, single-stepping
294	 * this user code:
295	 *
296	 *           movq	$stuck_here, %rcx
297	 *           pushfq
298	 *           popq %r11
299	 *   stuck_here:
300	 *
301	 * would never get past 'stuck_here'.
302	 */
303	testq	$(X86_EFLAGS_RF|X86_EFLAGS_TF), %r11
304	jnz	opportunistic_sysret_failed
305
306	/* nothing to check for RSP */
307
308	cmpq	$__USER_DS, SS(%rsp)		/* SS must match SYSRET */
309	jne	opportunistic_sysret_failed
310
311	/*
312	 * We win! This label is here just for ease of understanding
313	 * perf profiles. Nothing jumps here.
314	 */
315syscall_return_via_sysret:
316	/* rcx and r11 are already restored (see code above) */
317	RESTORE_C_REGS_EXCEPT_RCX_R11
318	movq	RSP(%rsp), %rsp
319	USERGS_SYSRET64
320
321opportunistic_sysret_failed:
322	SWAPGS
323	jmp	restore_c_regs_and_iret
324END(entry_SYSCALL_64)
325
326ENTRY(stub_ptregs_64)
327	/*
328	 * Syscalls marked as needing ptregs land here.
329	 * If we are on the fast path, we need to save the extra regs,
330	 * which we achieve by trying again on the slow path.  If we are on
331	 * the slow path, the extra regs are already saved.
332	 *
333	 * RAX stores a pointer to the C function implementing the syscall.
334	 * IRQs are on.
335	 */
336	cmpq	$.Lentry_SYSCALL_64_after_fastpath_call, (%rsp)
337	jne	1f
338
339	/*
340	 * Called from fast path -- disable IRQs again, pop return address
341	 * and jump to slow path
342	 */
343	DISABLE_INTERRUPTS(CLBR_ANY)
344	TRACE_IRQS_OFF
345	popq	%rax
346	jmp	entry_SYSCALL64_slow_path
347
3481:
349	jmp	*%rax				/* Called from C */
350END(stub_ptregs_64)
351
352.macro ptregs_stub func
353ENTRY(ptregs_\func)
354	leaq	\func(%rip), %rax
355	jmp	stub_ptregs_64
356END(ptregs_\func)
357.endm
358
359/* Instantiate ptregs_stub for each ptregs-using syscall */
360#define __SYSCALL_64_QUAL_(sym)
361#define __SYSCALL_64_QUAL_ptregs(sym) ptregs_stub sym
362#define __SYSCALL_64(nr, sym, qual) __SYSCALL_64_QUAL_##qual(sym)
363#include <asm/syscalls_64.h>
364
365/*
366 * %rdi: prev task
367 * %rsi: next task
368 */
369ENTRY(__switch_to_asm)
370	/*
371	 * Save callee-saved registers
372	 * This must match the order in inactive_task_frame
373	 */
374	pushq	%rbp
375	pushq	%rbx
376	pushq	%r12
377	pushq	%r13
378	pushq	%r14
379	pushq	%r15
380
381	/* switch stack */
382	movq	%rsp, TASK_threadsp(%rdi)
383	movq	TASK_threadsp(%rsi), %rsp
384
385#ifdef CONFIG_CC_STACKPROTECTOR
386	movq	TASK_stack_canary(%rsi), %rbx
387	movq	%rbx, PER_CPU_VAR(irq_stack_union)+stack_canary_offset
388#endif
389
390	/* restore callee-saved registers */
391	popq	%r15
392	popq	%r14
393	popq	%r13
394	popq	%r12
395	popq	%rbx
396	popq	%rbp
397
398	jmp	__switch_to
399END(__switch_to_asm)
400
401/*
402 * A newly forked process directly context switches into this address.
403 *
404 * rax: prev task we switched from
405 * rbx: kernel thread func (NULL for user thread)
406 * r12: kernel thread arg
407 */
408ENTRY(ret_from_fork)
409	movq	%rax, %rdi
410	call	schedule_tail			/* rdi: 'prev' task parameter */
411
412	testq	%rbx, %rbx			/* from kernel_thread? */
413	jnz	1f				/* kernel threads are uncommon */
414
4152:
416	movq	%rsp, %rdi
417	call	syscall_return_slowpath	/* returns with IRQs disabled */
418	TRACE_IRQS_ON			/* user mode is traced as IRQS on */
419	SWAPGS
420	jmp	restore_regs_and_iret
421
4221:
423	/* kernel thread */
424	movq	%r12, %rdi
425	call	*%rbx
426	/*
427	 * A kernel thread is allowed to return here after successfully
428	 * calling do_execve().  Exit to userspace to complete the execve()
429	 * syscall.
430	 */
431	movq	$0, RAX(%rsp)
432	jmp	2b
433END(ret_from_fork)
434
435/*
436 * Build the entry stubs with some assembler magic.
437 * We pack 1 stub into every 8-byte block.
438 */
439	.align 8
440ENTRY(irq_entries_start)
441    vector=FIRST_EXTERNAL_VECTOR
442    .rept (FIRST_SYSTEM_VECTOR - FIRST_EXTERNAL_VECTOR)
443	pushq	$(~vector+0x80)			/* Note: always in signed byte range */
444    vector=vector+1
445	jmp	common_interrupt
446	.align	8
447    .endr
448END(irq_entries_start)
449
450.macro DEBUG_ENTRY_ASSERT_IRQS_OFF
451#ifdef CONFIG_DEBUG_ENTRY
452	pushfq
453	testl $X86_EFLAGS_IF, (%rsp)
454	jz .Lokay_\@
455	ud2
456.Lokay_\@:
457	addq $8, %rsp
458#endif
459.endm
460
461/*
462 * Enters the IRQ stack if we're not already using it.  NMI-safe.  Clobbers
463 * flags and puts old RSP into old_rsp, and leaves all other GPRs alone.
464 * Requires kernel GSBASE.
465 *
466 * The invariant is that, if irq_count != -1, then the IRQ stack is in use.
467 */
468.macro ENTER_IRQ_STACK old_rsp
469	DEBUG_ENTRY_ASSERT_IRQS_OFF
470	movq	%rsp, \old_rsp
471	incl	PER_CPU_VAR(irq_count)
472	jnz	.Lirq_stack_push_old_rsp_\@
473
474	/*
475	 * Right now, if we just incremented irq_count to zero, we've
476	 * claimed the IRQ stack but we haven't switched to it yet.
477	 *
478	 * If anything is added that can interrupt us here without using IST,
479	 * it must be *extremely* careful to limit its stack usage.  This
480	 * could include kprobes and a hypothetical future IST-less #DB
481	 * handler.
482	 *
483	 * The OOPS unwinder relies on the word at the top of the IRQ
484	 * stack linking back to the previous RSP for the entire time we're
485	 * on the IRQ stack.  For this to work reliably, we need to write
486	 * it before we actually move ourselves to the IRQ stack.
487	 */
488
489	movq	\old_rsp, PER_CPU_VAR(irq_stack_union + IRQ_STACK_SIZE - 8)
490	movq	PER_CPU_VAR(irq_stack_ptr), %rsp
491
492#ifdef CONFIG_DEBUG_ENTRY
493	/*
494	 * If the first movq above becomes wrong due to IRQ stack layout
495	 * changes, the only way we'll notice is if we try to unwind right
496	 * here.  Assert that we set up the stack right to catch this type
497	 * of bug quickly.
498	 */
499	cmpq	-8(%rsp), \old_rsp
500	je	.Lirq_stack_okay\@
501	ud2
502	.Lirq_stack_okay\@:
503#endif
504
505.Lirq_stack_push_old_rsp_\@:
506	pushq	\old_rsp
507.endm
508
509/*
510 * Undoes ENTER_IRQ_STACK.
511 */
512.macro LEAVE_IRQ_STACK
513	DEBUG_ENTRY_ASSERT_IRQS_OFF
514	/* We need to be off the IRQ stack before decrementing irq_count. */
515	popq	%rsp
516
517	/*
518	 * As in ENTER_IRQ_STACK, irq_count == 0, we are still claiming
519	 * the irq stack but we're not on it.
520	 */
521
522	decl	PER_CPU_VAR(irq_count)
523.endm
524
525/*
526 * Interrupt entry/exit.
527 *
528 * Interrupt entry points save only callee clobbered registers in fast path.
529 *
530 * Entry runs with interrupts off.
531 */
532
533/* 0(%rsp): ~(interrupt number) */
534	.macro interrupt func
535	cld
536	ALLOC_PT_GPREGS_ON_STACK
537	SAVE_C_REGS
538	SAVE_EXTRA_REGS
539	ENCODE_FRAME_POINTER
540
541	testb	$3, CS(%rsp)
542	jz	1f
543
544	/*
545	 * IRQ from user mode.  Switch to kernel gsbase and inform context
546	 * tracking that we're in kernel mode.
547	 */
548	SWAPGS
549
550	/*
551	 * We need to tell lockdep that IRQs are off.  We can't do this until
552	 * we fix gsbase, and we should do it before enter_from_user_mode
553	 * (which can take locks).  Since TRACE_IRQS_OFF idempotent,
554	 * the simplest way to handle it is to just call it twice if
555	 * we enter from user mode.  There's no reason to optimize this since
556	 * TRACE_IRQS_OFF is a no-op if lockdep is off.
557	 */
558	TRACE_IRQS_OFF
559
560	CALL_enter_from_user_mode
561
5621:
563	ENTER_IRQ_STACK old_rsp=%rdi
564	/* We entered an interrupt context - irqs are off: */
565	TRACE_IRQS_OFF
566
567	call	\func	/* rdi points to pt_regs */
568	.endm
569
570	/*
571	 * The interrupt stubs push (~vector+0x80) onto the stack and
572	 * then jump to common_interrupt.
573	 */
574	.p2align CONFIG_X86_L1_CACHE_SHIFT
575common_interrupt:
576	ASM_CLAC
577	addq	$-0x80, (%rsp)			/* Adjust vector to [-256, -1] range */
578	interrupt do_IRQ
579	/* 0(%rsp): old RSP */
580ret_from_intr:
581	DISABLE_INTERRUPTS(CLBR_ANY)
582	TRACE_IRQS_OFF
583
584	LEAVE_IRQ_STACK
585
586	testb	$3, CS(%rsp)
587	jz	retint_kernel
588
589	/* Interrupt came from user space */
590GLOBAL(retint_user)
591	mov	%rsp,%rdi
592	call	prepare_exit_to_usermode
593	TRACE_IRQS_IRETQ
594	SWAPGS
595	jmp	restore_regs_and_iret
596
597/* Returning to kernel space */
598retint_kernel:
599#ifdef CONFIG_PREEMPT
600	/* Interrupts are off */
601	/* Check if we need preemption */
602	bt	$9, EFLAGS(%rsp)		/* were interrupts off? */
603	jnc	1f
6040:	cmpl	$0, PER_CPU_VAR(__preempt_count)
605	jnz	1f
606	call	preempt_schedule_irq
607	jmp	0b
6081:
609#endif
610	/*
611	 * The iretq could re-enable interrupts:
612	 */
613	TRACE_IRQS_IRETQ
614
615/*
616 * At this label, code paths which return to kernel and to user,
617 * which come from interrupts/exception and from syscalls, merge.
618 */
619GLOBAL(restore_regs_and_iret)
620	RESTORE_EXTRA_REGS
621restore_c_regs_and_iret:
622	RESTORE_C_REGS
623	REMOVE_PT_GPREGS_FROM_STACK 8
624	INTERRUPT_RETURN
625
626ENTRY(native_iret)
627	/*
628	 * Are we returning to a stack segment from the LDT?  Note: in
629	 * 64-bit mode SS:RSP on the exception stack is always valid.
630	 */
631#ifdef CONFIG_X86_ESPFIX64
632	testb	$4, (SS-RIP)(%rsp)
633	jnz	native_irq_return_ldt
634#endif
635
636.global native_irq_return_iret
637native_irq_return_iret:
638	/*
639	 * This may fault.  Non-paranoid faults on return to userspace are
640	 * handled by fixup_bad_iret.  These include #SS, #GP, and #NP.
641	 * Double-faults due to espfix64 are handled in do_double_fault.
642	 * Other faults here are fatal.
643	 */
644	iretq
645
646#ifdef CONFIG_X86_ESPFIX64
647native_irq_return_ldt:
648	/*
649	 * We are running with user GSBASE.  All GPRs contain their user
650	 * values.  We have a percpu ESPFIX stack that is eight slots
651	 * long (see ESPFIX_STACK_SIZE).  espfix_waddr points to the bottom
652	 * of the ESPFIX stack.
653	 *
654	 * We clobber RAX and RDI in this code.  We stash RDI on the
655	 * normal stack and RAX on the ESPFIX stack.
656	 *
657	 * The ESPFIX stack layout we set up looks like this:
658	 *
659	 * --- top of ESPFIX stack ---
660	 * SS
661	 * RSP
662	 * RFLAGS
663	 * CS
664	 * RIP  <-- RSP points here when we're done
665	 * RAX  <-- espfix_waddr points here
666	 * --- bottom of ESPFIX stack ---
667	 */
668
669	pushq	%rdi				/* Stash user RDI */
670	SWAPGS
671	movq	PER_CPU_VAR(espfix_waddr), %rdi
672	movq	%rax, (0*8)(%rdi)		/* user RAX */
673	movq	(1*8)(%rsp), %rax		/* user RIP */
674	movq	%rax, (1*8)(%rdi)
675	movq	(2*8)(%rsp), %rax		/* user CS */
676	movq	%rax, (2*8)(%rdi)
677	movq	(3*8)(%rsp), %rax		/* user RFLAGS */
678	movq	%rax, (3*8)(%rdi)
679	movq	(5*8)(%rsp), %rax		/* user SS */
680	movq	%rax, (5*8)(%rdi)
681	movq	(4*8)(%rsp), %rax		/* user RSP */
682	movq	%rax, (4*8)(%rdi)
683	/* Now RAX == RSP. */
684
685	andl	$0xffff0000, %eax		/* RAX = (RSP & 0xffff0000) */
686	popq	%rdi				/* Restore user RDI */
687
688	/*
689	 * espfix_stack[31:16] == 0.  The page tables are set up such that
690	 * (espfix_stack | (X & 0xffff0000)) points to a read-only alias of
691	 * espfix_waddr for any X.  That is, there are 65536 RO aliases of
692	 * the same page.  Set up RSP so that RSP[31:16] contains the
693	 * respective 16 bits of the /userspace/ RSP and RSP nonetheless
694	 * still points to an RO alias of the ESPFIX stack.
695	 */
696	orq	PER_CPU_VAR(espfix_stack), %rax
697	SWAPGS
698	movq	%rax, %rsp
699
700	/*
701	 * At this point, we cannot write to the stack any more, but we can
702	 * still read.
703	 */
704	popq	%rax				/* Restore user RAX */
705
706	/*
707	 * RSP now points to an ordinary IRET frame, except that the page
708	 * is read-only and RSP[31:16] are preloaded with the userspace
709	 * values.  We can now IRET back to userspace.
710	 */
711	jmp	native_irq_return_iret
712#endif
713END(common_interrupt)
714
715/*
716 * APIC interrupts.
717 */
718.macro apicinterrupt3 num sym do_sym
719ENTRY(\sym)
720	ASM_CLAC
721	pushq	$~(\num)
722.Lcommon_\sym:
723	interrupt \do_sym
724	jmp	ret_from_intr
725END(\sym)
726.endm
727
728#ifdef CONFIG_TRACING
729#define trace(sym) trace_##sym
730#define smp_trace(sym) smp_trace_##sym
731
732.macro trace_apicinterrupt num sym
733apicinterrupt3 \num trace(\sym) smp_trace(\sym)
734.endm
735#else
736.macro trace_apicinterrupt num sym do_sym
737.endm
738#endif
739
740/* Make sure APIC interrupt handlers end up in the irqentry section: */
741#if defined(CONFIG_FUNCTION_GRAPH_TRACER) || defined(CONFIG_KASAN)
742# define PUSH_SECTION_IRQENTRY	.pushsection .irqentry.text, "ax"
743# define POP_SECTION_IRQENTRY	.popsection
744#else
745# define PUSH_SECTION_IRQENTRY
746# define POP_SECTION_IRQENTRY
747#endif
748
749.macro apicinterrupt num sym do_sym
750PUSH_SECTION_IRQENTRY
751apicinterrupt3 \num \sym \do_sym
752trace_apicinterrupt \num \sym
753POP_SECTION_IRQENTRY
754.endm
755
756#ifdef CONFIG_SMP
757apicinterrupt3 IRQ_MOVE_CLEANUP_VECTOR		irq_move_cleanup_interrupt	smp_irq_move_cleanup_interrupt
758apicinterrupt3 REBOOT_VECTOR			reboot_interrupt		smp_reboot_interrupt
759#endif
760
761#ifdef CONFIG_X86_UV
762apicinterrupt3 UV_BAU_MESSAGE			uv_bau_message_intr1		uv_bau_message_interrupt
763#endif
764
765apicinterrupt LOCAL_TIMER_VECTOR		apic_timer_interrupt		smp_apic_timer_interrupt
766apicinterrupt X86_PLATFORM_IPI_VECTOR		x86_platform_ipi		smp_x86_platform_ipi
767
768#ifdef CONFIG_HAVE_KVM
769apicinterrupt3 POSTED_INTR_VECTOR		kvm_posted_intr_ipi		smp_kvm_posted_intr_ipi
770apicinterrupt3 POSTED_INTR_WAKEUP_VECTOR	kvm_posted_intr_wakeup_ipi	smp_kvm_posted_intr_wakeup_ipi
771#endif
772
773#ifdef CONFIG_X86_MCE_THRESHOLD
774apicinterrupt THRESHOLD_APIC_VECTOR		threshold_interrupt		smp_threshold_interrupt
775#endif
776
777#ifdef CONFIG_X86_MCE_AMD
778apicinterrupt DEFERRED_ERROR_VECTOR		deferred_error_interrupt	smp_deferred_error_interrupt
779#endif
780
781#ifdef CONFIG_X86_THERMAL_VECTOR
782apicinterrupt THERMAL_APIC_VECTOR		thermal_interrupt		smp_thermal_interrupt
783#endif
784
785#ifdef CONFIG_SMP
786apicinterrupt CALL_FUNCTION_SINGLE_VECTOR	call_function_single_interrupt	smp_call_function_single_interrupt
787apicinterrupt CALL_FUNCTION_VECTOR		call_function_interrupt		smp_call_function_interrupt
788apicinterrupt RESCHEDULE_VECTOR			reschedule_interrupt		smp_reschedule_interrupt
789#endif
790
791apicinterrupt ERROR_APIC_VECTOR			error_interrupt			smp_error_interrupt
792apicinterrupt SPURIOUS_APIC_VECTOR		spurious_interrupt		smp_spurious_interrupt
793
794#ifdef CONFIG_IRQ_WORK
795apicinterrupt IRQ_WORK_VECTOR			irq_work_interrupt		smp_irq_work_interrupt
796#endif
797
798/*
799 * Exception entry points.
800 */
801#define CPU_TSS_IST(x) PER_CPU_VAR(cpu_tss) + (TSS_ist + ((x) - 1) * 8)
802
803.macro idtentry sym do_sym has_error_code:req paranoid=0 shift_ist=-1
804ENTRY(\sym)
805	/* Sanity check */
806	.if \shift_ist != -1 && \paranoid == 0
807	.error "using shift_ist requires paranoid=1"
808	.endif
809
810	ASM_CLAC
811	PARAVIRT_ADJUST_EXCEPTION_FRAME
812
813	.ifeq \has_error_code
814	pushq	$-1				/* ORIG_RAX: no syscall to restart */
815	.endif
816
817	ALLOC_PT_GPREGS_ON_STACK
818
819	.if \paranoid
820	.if \paranoid == 1
821	testb	$3, CS(%rsp)			/* If coming from userspace, switch stacks */
822	jnz	1f
823	.endif
824	call	paranoid_entry
825	.else
826	call	error_entry
827	.endif
828	/* returned flag: ebx=0: need swapgs on exit, ebx=1: don't need it */
829
830	.if \paranoid
831	.if \shift_ist != -1
832	TRACE_IRQS_OFF_DEBUG			/* reload IDT in case of recursion */
833	.else
834	TRACE_IRQS_OFF
835	.endif
836	.endif
837
838	movq	%rsp, %rdi			/* pt_regs pointer */
839
840	.if \has_error_code
841	movq	ORIG_RAX(%rsp), %rsi		/* get error code */
842	movq	$-1, ORIG_RAX(%rsp)		/* no syscall to restart */
843	.else
844	xorl	%esi, %esi			/* no error code */
845	.endif
846
847	.if \shift_ist != -1
848	subq	$EXCEPTION_STKSZ, CPU_TSS_IST(\shift_ist)
849	.endif
850
851	call	\do_sym
852
853	.if \shift_ist != -1
854	addq	$EXCEPTION_STKSZ, CPU_TSS_IST(\shift_ist)
855	.endif
856
857	/* these procedures expect "no swapgs" flag in ebx */
858	.if \paranoid
859	jmp	paranoid_exit
860	.else
861	jmp	error_exit
862	.endif
863
864	.if \paranoid == 1
865	/*
866	 * Paranoid entry from userspace.  Switch stacks and treat it
867	 * as a normal entry.  This means that paranoid handlers
868	 * run in real process context if user_mode(regs).
869	 */
8701:
871	call	error_entry
872
873
874	movq	%rsp, %rdi			/* pt_regs pointer */
875	call	sync_regs
876	movq	%rax, %rsp			/* switch stack */
877
878	movq	%rsp, %rdi			/* pt_regs pointer */
879
880	.if \has_error_code
881	movq	ORIG_RAX(%rsp), %rsi		/* get error code */
882	movq	$-1, ORIG_RAX(%rsp)		/* no syscall to restart */
883	.else
884	xorl	%esi, %esi			/* no error code */
885	.endif
886
887	call	\do_sym
888
889	jmp	error_exit			/* %ebx: no swapgs flag */
890	.endif
891END(\sym)
892.endm
893
894#ifdef CONFIG_TRACING
895.macro trace_idtentry sym do_sym has_error_code:req
896idtentry trace(\sym) trace(\do_sym) has_error_code=\has_error_code
897idtentry \sym \do_sym has_error_code=\has_error_code
898.endm
899#else
900.macro trace_idtentry sym do_sym has_error_code:req
901idtentry \sym \do_sym has_error_code=\has_error_code
902.endm
903#endif
904
905idtentry divide_error			do_divide_error			has_error_code=0
906idtentry overflow			do_overflow			has_error_code=0
907idtentry bounds				do_bounds			has_error_code=0
908idtentry invalid_op			do_invalid_op			has_error_code=0
909idtentry device_not_available		do_device_not_available		has_error_code=0
910idtentry double_fault			do_double_fault			has_error_code=1 paranoid=2
911idtentry coprocessor_segment_overrun	do_coprocessor_segment_overrun	has_error_code=0
912idtentry invalid_TSS			do_invalid_TSS			has_error_code=1
913idtentry segment_not_present		do_segment_not_present		has_error_code=1
914idtentry spurious_interrupt_bug		do_spurious_interrupt_bug	has_error_code=0
915idtentry coprocessor_error		do_coprocessor_error		has_error_code=0
916idtentry alignment_check		do_alignment_check		has_error_code=1
917idtentry simd_coprocessor_error		do_simd_coprocessor_error	has_error_code=0
918
919
920	/*
921	 * Reload gs selector with exception handling
922	 * edi:  new selector
923	 */
924ENTRY(native_load_gs_index)
925	pushfq
926	DISABLE_INTERRUPTS(CLBR_ANY & ~CLBR_RDI)
927	SWAPGS
928.Lgs_change:
929	movl	%edi, %gs
9302:	ALTERNATIVE "", "mfence", X86_BUG_SWAPGS_FENCE
931	SWAPGS
932	popfq
933	ret
934END(native_load_gs_index)
935EXPORT_SYMBOL(native_load_gs_index)
936
937	_ASM_EXTABLE(.Lgs_change, bad_gs)
938	.section .fixup, "ax"
939	/* running with kernelgs */
940bad_gs:
941	SWAPGS					/* switch back to user gs */
942.macro ZAP_GS
943	/* This can't be a string because the preprocessor needs to see it. */
944	movl $__USER_DS, %eax
945	movl %eax, %gs
946.endm
947	ALTERNATIVE "", "ZAP_GS", X86_BUG_NULL_SEG
948	xorl	%eax, %eax
949	movl	%eax, %gs
950	jmp	2b
951	.previous
952
953/* Call softirq on interrupt stack. Interrupts are off. */
954ENTRY(do_softirq_own_stack)
955	pushq	%rbp
956	mov	%rsp, %rbp
957	ENTER_IRQ_STACK old_rsp=%r11
958	call	__do_softirq
959	LEAVE_IRQ_STACK
960	leaveq
961	ret
962END(do_softirq_own_stack)
963
964#ifdef CONFIG_XEN
965idtentry xen_hypervisor_callback xen_do_hypervisor_callback has_error_code=0
966
967/*
968 * A note on the "critical region" in our callback handler.
969 * We want to avoid stacking callback handlers due to events occurring
970 * during handling of the last event. To do this, we keep events disabled
971 * until we've done all processing. HOWEVER, we must enable events before
972 * popping the stack frame (can't be done atomically) and so it would still
973 * be possible to get enough handler activations to overflow the stack.
974 * Although unlikely, bugs of that kind are hard to track down, so we'd
975 * like to avoid the possibility.
976 * So, on entry to the handler we detect whether we interrupted an
977 * existing activation in its critical region -- if so, we pop the current
978 * activation and restart the handler using the previous one.
979 */
980ENTRY(xen_do_hypervisor_callback)		/* do_hypervisor_callback(struct *pt_regs) */
981
982/*
983 * Since we don't modify %rdi, evtchn_do_upall(struct *pt_regs) will
984 * see the correct pointer to the pt_regs
985 */
986	movq	%rdi, %rsp			/* we don't return, adjust the stack frame */
987
988	ENTER_IRQ_STACK old_rsp=%r10
989	call	xen_evtchn_do_upcall
990	LEAVE_IRQ_STACK
991
992#ifndef CONFIG_PREEMPT
993	call	xen_maybe_preempt_hcall
994#endif
995	jmp	error_exit
996END(xen_do_hypervisor_callback)
997
998/*
999 * Hypervisor uses this for application faults while it executes.
1000 * We get here for two reasons:
1001 *  1. Fault while reloading DS, ES, FS or GS
1002 *  2. Fault while executing IRET
1003 * Category 1 we do not need to fix up as Xen has already reloaded all segment
1004 * registers that could be reloaded and zeroed the others.
1005 * Category 2 we fix up by killing the current process. We cannot use the
1006 * normal Linux return path in this case because if we use the IRET hypercall
1007 * to pop the stack frame we end up in an infinite loop of failsafe callbacks.
1008 * We distinguish between categories by comparing each saved segment register
1009 * with its current contents: any discrepancy means we in category 1.
1010 */
1011ENTRY(xen_failsafe_callback)
1012	movl	%ds, %ecx
1013	cmpw	%cx, 0x10(%rsp)
1014	jne	1f
1015	movl	%es, %ecx
1016	cmpw	%cx, 0x18(%rsp)
1017	jne	1f
1018	movl	%fs, %ecx
1019	cmpw	%cx, 0x20(%rsp)
1020	jne	1f
1021	movl	%gs, %ecx
1022	cmpw	%cx, 0x28(%rsp)
1023	jne	1f
1024	/* All segments match their saved values => Category 2 (Bad IRET). */
1025	movq	(%rsp), %rcx
1026	movq	8(%rsp), %r11
1027	addq	$0x30, %rsp
1028	pushq	$0				/* RIP */
1029	pushq	%r11
1030	pushq	%rcx
1031	jmp	general_protection
10321:	/* Segment mismatch => Category 1 (Bad segment). Retry the IRET. */
1033	movq	(%rsp), %rcx
1034	movq	8(%rsp), %r11
1035	addq	$0x30, %rsp
1036	pushq	$-1 /* orig_ax = -1 => not a system call */
1037	ALLOC_PT_GPREGS_ON_STACK
1038	SAVE_C_REGS
1039	SAVE_EXTRA_REGS
1040	ENCODE_FRAME_POINTER
1041	jmp	error_exit
1042END(xen_failsafe_callback)
1043
1044apicinterrupt3 HYPERVISOR_CALLBACK_VECTOR \
1045	xen_hvm_callback_vector xen_evtchn_do_upcall
1046
1047#endif /* CONFIG_XEN */
1048
1049#if IS_ENABLED(CONFIG_HYPERV)
1050apicinterrupt3 HYPERVISOR_CALLBACK_VECTOR \
1051	hyperv_callback_vector hyperv_vector_handler
1052#endif /* CONFIG_HYPERV */
1053
1054idtentry debug			do_debug		has_error_code=0	paranoid=1 shift_ist=DEBUG_STACK
1055idtentry int3			do_int3			has_error_code=0	paranoid=1 shift_ist=DEBUG_STACK
1056idtentry stack_segment		do_stack_segment	has_error_code=1
1057
1058#ifdef CONFIG_XEN
1059idtentry xen_debug		do_debug		has_error_code=0
1060idtentry xen_int3		do_int3			has_error_code=0
1061idtentry xen_stack_segment	do_stack_segment	has_error_code=1
1062#endif
1063
1064idtentry general_protection	do_general_protection	has_error_code=1
1065trace_idtentry page_fault	do_page_fault		has_error_code=1
1066
1067#ifdef CONFIG_KVM_GUEST
1068idtentry async_page_fault	do_async_page_fault	has_error_code=1
1069#endif
1070
1071#ifdef CONFIG_X86_MCE
1072idtentry machine_check					has_error_code=0	paranoid=1 do_sym=*machine_check_vector(%rip)
1073#endif
1074
1075/*
1076 * Save all registers in pt_regs, and switch gs if needed.
1077 * Use slow, but surefire "are we in kernel?" check.
1078 * Return: ebx=0: need swapgs on exit, ebx=1: otherwise
1079 */
1080ENTRY(paranoid_entry)
1081	cld
1082	SAVE_C_REGS 8
1083	SAVE_EXTRA_REGS 8
1084	ENCODE_FRAME_POINTER 8
1085	movl	$1, %ebx
1086	movl	$MSR_GS_BASE, %ecx
1087	rdmsr
1088	testl	%edx, %edx
1089	js	1f				/* negative -> in kernel */
1090	SWAPGS
1091	xorl	%ebx, %ebx
10921:	ret
1093END(paranoid_entry)
1094
1095/*
1096 * "Paranoid" exit path from exception stack.  This is invoked
1097 * only on return from non-NMI IST interrupts that came
1098 * from kernel space.
1099 *
1100 * We may be returning to very strange contexts (e.g. very early
1101 * in syscall entry), so checking for preemption here would
1102 * be complicated.  Fortunately, we there's no good reason
1103 * to try to handle preemption here.
1104 *
1105 * On entry, ebx is "no swapgs" flag (1: don't need swapgs, 0: need it)
1106 */
1107ENTRY(paranoid_exit)
1108	DISABLE_INTERRUPTS(CLBR_ANY)
1109	TRACE_IRQS_OFF_DEBUG
1110	testl	%ebx, %ebx			/* swapgs needed? */
1111	jnz	paranoid_exit_no_swapgs
1112	TRACE_IRQS_IRETQ
1113	SWAPGS_UNSAFE_STACK
1114	jmp	paranoid_exit_restore
1115paranoid_exit_no_swapgs:
1116	TRACE_IRQS_IRETQ_DEBUG
1117paranoid_exit_restore:
1118	RESTORE_EXTRA_REGS
1119	RESTORE_C_REGS
1120	REMOVE_PT_GPREGS_FROM_STACK 8
1121	INTERRUPT_RETURN
1122END(paranoid_exit)
1123
1124/*
1125 * Save all registers in pt_regs, and switch gs if needed.
1126 * Return: EBX=0: came from user mode; EBX=1: otherwise
1127 */
1128ENTRY(error_entry)
1129	cld
1130	SAVE_C_REGS 8
1131	SAVE_EXTRA_REGS 8
1132	ENCODE_FRAME_POINTER 8
1133	xorl	%ebx, %ebx
1134	testb	$3, CS+8(%rsp)
1135	jz	.Lerror_kernelspace
1136
1137	/*
1138	 * We entered from user mode or we're pretending to have entered
1139	 * from user mode due to an IRET fault.
1140	 */
1141	SWAPGS
1142
1143.Lerror_entry_from_usermode_after_swapgs:
1144	/*
1145	 * We need to tell lockdep that IRQs are off.  We can't do this until
1146	 * we fix gsbase, and we should do it before enter_from_user_mode
1147	 * (which can take locks).
1148	 */
1149	TRACE_IRQS_OFF
1150	CALL_enter_from_user_mode
1151	ret
1152
1153.Lerror_entry_done:
1154	TRACE_IRQS_OFF
1155	ret
1156
1157	/*
1158	 * There are two places in the kernel that can potentially fault with
1159	 * usergs. Handle them here.  B stepping K8s sometimes report a
1160	 * truncated RIP for IRET exceptions returning to compat mode. Check
1161	 * for these here too.
1162	 */
1163.Lerror_kernelspace:
1164	incl	%ebx
1165	leaq	native_irq_return_iret(%rip), %rcx
1166	cmpq	%rcx, RIP+8(%rsp)
1167	je	.Lerror_bad_iret
1168	movl	%ecx, %eax			/* zero extend */
1169	cmpq	%rax, RIP+8(%rsp)
1170	je	.Lbstep_iret
1171	cmpq	$.Lgs_change, RIP+8(%rsp)
1172	jne	.Lerror_entry_done
1173
1174	/*
1175	 * hack: .Lgs_change can fail with user gsbase.  If this happens, fix up
1176	 * gsbase and proceed.  We'll fix up the exception and land in
1177	 * .Lgs_change's error handler with kernel gsbase.
1178	 */
1179	SWAPGS
1180	jmp .Lerror_entry_done
1181
1182.Lbstep_iret:
1183	/* Fix truncated RIP */
1184	movq	%rcx, RIP+8(%rsp)
1185	/* fall through */
1186
1187.Lerror_bad_iret:
1188	/*
1189	 * We came from an IRET to user mode, so we have user gsbase.
1190	 * Switch to kernel gsbase:
1191	 */
1192	SWAPGS
1193
1194	/*
1195	 * Pretend that the exception came from user mode: set up pt_regs
1196	 * as if we faulted immediately after IRET and clear EBX so that
1197	 * error_exit knows that we will be returning to user mode.
1198	 */
1199	mov	%rsp, %rdi
1200	call	fixup_bad_iret
1201	mov	%rax, %rsp
1202	decl	%ebx
1203	jmp	.Lerror_entry_from_usermode_after_swapgs
1204END(error_entry)
1205
1206
1207/*
1208 * On entry, EBX is a "return to kernel mode" flag:
1209 *   1: already in kernel mode, don't need SWAPGS
1210 *   0: user gsbase is loaded, we need SWAPGS and standard preparation for return to usermode
1211 */
1212ENTRY(error_exit)
1213	DISABLE_INTERRUPTS(CLBR_ANY)
1214	TRACE_IRQS_OFF
1215	testl	%ebx, %ebx
1216	jnz	retint_kernel
1217	jmp	retint_user
1218END(error_exit)
1219
1220/* Runs on exception stack */
1221ENTRY(nmi)
1222	/*
1223	 * Fix up the exception frame if we're on Xen.
1224	 * PARAVIRT_ADJUST_EXCEPTION_FRAME is guaranteed to push at most
1225	 * one value to the stack on native, so it may clobber the rdx
1226	 * scratch slot, but it won't clobber any of the important
1227	 * slots past it.
1228	 *
1229	 * Xen is a different story, because the Xen frame itself overlaps
1230	 * the "NMI executing" variable.
1231	 */
1232	PARAVIRT_ADJUST_EXCEPTION_FRAME
1233
1234	/*
1235	 * We allow breakpoints in NMIs. If a breakpoint occurs, then
1236	 * the iretq it performs will take us out of NMI context.
1237	 * This means that we can have nested NMIs where the next
1238	 * NMI is using the top of the stack of the previous NMI. We
1239	 * can't let it execute because the nested NMI will corrupt the
1240	 * stack of the previous NMI. NMI handlers are not re-entrant
1241	 * anyway.
1242	 *
1243	 * To handle this case we do the following:
1244	 *  Check the a special location on the stack that contains
1245	 *  a variable that is set when NMIs are executing.
1246	 *  The interrupted task's stack is also checked to see if it
1247	 *  is an NMI stack.
1248	 *  If the variable is not set and the stack is not the NMI
1249	 *  stack then:
1250	 *    o Set the special variable on the stack
1251	 *    o Copy the interrupt frame into an "outermost" location on the
1252	 *      stack
1253	 *    o Copy the interrupt frame into an "iret" location on the stack
1254	 *    o Continue processing the NMI
1255	 *  If the variable is set or the previous stack is the NMI stack:
1256	 *    o Modify the "iret" location to jump to the repeat_nmi
1257	 *    o return back to the first NMI
1258	 *
1259	 * Now on exit of the first NMI, we first clear the stack variable
1260	 * The NMI stack will tell any nested NMIs at that point that it is
1261	 * nested. Then we pop the stack normally with iret, and if there was
1262	 * a nested NMI that updated the copy interrupt stack frame, a
1263	 * jump will be made to the repeat_nmi code that will handle the second
1264	 * NMI.
1265	 *
1266	 * However, espfix prevents us from directly returning to userspace
1267	 * with a single IRET instruction.  Similarly, IRET to user mode
1268	 * can fault.  We therefore handle NMIs from user space like
1269	 * other IST entries.
1270	 */
1271
1272	/* Use %rdx as our temp variable throughout */
1273	pushq	%rdx
1274
1275	testb	$3, CS-RIP+8(%rsp)
1276	jz	.Lnmi_from_kernel
1277
1278	/*
1279	 * NMI from user mode.  We need to run on the thread stack, but we
1280	 * can't go through the normal entry paths: NMIs are masked, and
1281	 * we don't want to enable interrupts, because then we'll end
1282	 * up in an awkward situation in which IRQs are on but NMIs
1283	 * are off.
1284	 *
1285	 * We also must not push anything to the stack before switching
1286	 * stacks lest we corrupt the "NMI executing" variable.
1287	 */
1288
1289	SWAPGS_UNSAFE_STACK
1290	cld
1291	movq	%rsp, %rdx
1292	movq	PER_CPU_VAR(cpu_current_top_of_stack), %rsp
1293	pushq	5*8(%rdx)	/* pt_regs->ss */
1294	pushq	4*8(%rdx)	/* pt_regs->rsp */
1295	pushq	3*8(%rdx)	/* pt_regs->flags */
1296	pushq	2*8(%rdx)	/* pt_regs->cs */
1297	pushq	1*8(%rdx)	/* pt_regs->rip */
1298	pushq   $-1		/* pt_regs->orig_ax */
1299	pushq   %rdi		/* pt_regs->di */
1300	pushq   %rsi		/* pt_regs->si */
1301	pushq   (%rdx)		/* pt_regs->dx */
1302	pushq   %rcx		/* pt_regs->cx */
1303	pushq   %rax		/* pt_regs->ax */
1304	pushq   %r8		/* pt_regs->r8 */
1305	pushq   %r9		/* pt_regs->r9 */
1306	pushq   %r10		/* pt_regs->r10 */
1307	pushq   %r11		/* pt_regs->r11 */
1308	pushq	%rbx		/* pt_regs->rbx */
1309	pushq	%rbp		/* pt_regs->rbp */
1310	pushq	%r12		/* pt_regs->r12 */
1311	pushq	%r13		/* pt_regs->r13 */
1312	pushq	%r14		/* pt_regs->r14 */
1313	pushq	%r15		/* pt_regs->r15 */
1314	ENCODE_FRAME_POINTER
1315
1316	/*
1317	 * At this point we no longer need to worry about stack damage
1318	 * due to nesting -- we're on the normal thread stack and we're
1319	 * done with the NMI stack.
1320	 */
1321
1322	movq	%rsp, %rdi
1323	movq	$-1, %rsi
1324	call	do_nmi
1325
1326	/*
1327	 * Return back to user mode.  We must *not* do the normal exit
1328	 * work, because we don't want to enable interrupts.
1329	 */
1330	SWAPGS
1331	jmp	restore_regs_and_iret
1332
1333.Lnmi_from_kernel:
1334	/*
1335	 * Here's what our stack frame will look like:
1336	 * +---------------------------------------------------------+
1337	 * | original SS                                             |
1338	 * | original Return RSP                                     |
1339	 * | original RFLAGS                                         |
1340	 * | original CS                                             |
1341	 * | original RIP                                            |
1342	 * +---------------------------------------------------------+
1343	 * | temp storage for rdx                                    |
1344	 * +---------------------------------------------------------+
1345	 * | "NMI executing" variable                                |
1346	 * +---------------------------------------------------------+
1347	 * | iret SS          } Copied from "outermost" frame        |
1348	 * | iret Return RSP  } on each loop iteration; overwritten  |
1349	 * | iret RFLAGS      } by a nested NMI to force another     |
1350	 * | iret CS          } iteration if needed.                 |
1351	 * | iret RIP         }                                      |
1352	 * +---------------------------------------------------------+
1353	 * | outermost SS          } initialized in first_nmi;       |
1354	 * | outermost Return RSP  } will not be changed before      |
1355	 * | outermost RFLAGS      } NMI processing is done.         |
1356	 * | outermost CS          } Copied to "iret" frame on each  |
1357	 * | outermost RIP         } iteration.                      |
1358	 * +---------------------------------------------------------+
1359	 * | pt_regs                                                 |
1360	 * +---------------------------------------------------------+
1361	 *
1362	 * The "original" frame is used by hardware.  Before re-enabling
1363	 * NMIs, we need to be done with it, and we need to leave enough
1364	 * space for the asm code here.
1365	 *
1366	 * We return by executing IRET while RSP points to the "iret" frame.
1367	 * That will either return for real or it will loop back into NMI
1368	 * processing.
1369	 *
1370	 * The "outermost" frame is copied to the "iret" frame on each
1371	 * iteration of the loop, so each iteration starts with the "iret"
1372	 * frame pointing to the final return target.
1373	 */
1374
1375	/*
1376	 * Determine whether we're a nested NMI.
1377	 *
1378	 * If we interrupted kernel code between repeat_nmi and
1379	 * end_repeat_nmi, then we are a nested NMI.  We must not
1380	 * modify the "iret" frame because it's being written by
1381	 * the outer NMI.  That's okay; the outer NMI handler is
1382	 * about to about to call do_nmi anyway, so we can just
1383	 * resume the outer NMI.
1384	 */
1385
1386	movq	$repeat_nmi, %rdx
1387	cmpq	8(%rsp), %rdx
1388	ja	1f
1389	movq	$end_repeat_nmi, %rdx
1390	cmpq	8(%rsp), %rdx
1391	ja	nested_nmi_out
13921:
1393
1394	/*
1395	 * Now check "NMI executing".  If it's set, then we're nested.
1396	 * This will not detect if we interrupted an outer NMI just
1397	 * before IRET.
1398	 */
1399	cmpl	$1, -8(%rsp)
1400	je	nested_nmi
1401
1402	/*
1403	 * Now test if the previous stack was an NMI stack.  This covers
1404	 * the case where we interrupt an outer NMI after it clears
1405	 * "NMI executing" but before IRET.  We need to be careful, though:
1406	 * there is one case in which RSP could point to the NMI stack
1407	 * despite there being no NMI active: naughty userspace controls
1408	 * RSP at the very beginning of the SYSCALL targets.  We can
1409	 * pull a fast one on naughty userspace, though: we program
1410	 * SYSCALL to mask DF, so userspace cannot cause DF to be set
1411	 * if it controls the kernel's RSP.  We set DF before we clear
1412	 * "NMI executing".
1413	 */
1414	lea	6*8(%rsp), %rdx
1415	/* Compare the NMI stack (rdx) with the stack we came from (4*8(%rsp)) */
1416	cmpq	%rdx, 4*8(%rsp)
1417	/* If the stack pointer is above the NMI stack, this is a normal NMI */
1418	ja	first_nmi
1419
1420	subq	$EXCEPTION_STKSZ, %rdx
1421	cmpq	%rdx, 4*8(%rsp)
1422	/* If it is below the NMI stack, it is a normal NMI */
1423	jb	first_nmi
1424
1425	/* Ah, it is within the NMI stack. */
1426
1427	testb	$(X86_EFLAGS_DF >> 8), (3*8 + 1)(%rsp)
1428	jz	first_nmi	/* RSP was user controlled. */
1429
1430	/* This is a nested NMI. */
1431
1432nested_nmi:
1433	/*
1434	 * Modify the "iret" frame to point to repeat_nmi, forcing another
1435	 * iteration of NMI handling.
1436	 */
1437	subq	$8, %rsp
1438	leaq	-10*8(%rsp), %rdx
1439	pushq	$__KERNEL_DS
1440	pushq	%rdx
1441	pushfq
1442	pushq	$__KERNEL_CS
1443	pushq	$repeat_nmi
1444
1445	/* Put stack back */
1446	addq	$(6*8), %rsp
1447
1448nested_nmi_out:
1449	popq	%rdx
1450
1451	/* We are returning to kernel mode, so this cannot result in a fault. */
1452	INTERRUPT_RETURN
1453
1454first_nmi:
1455	/* Restore rdx. */
1456	movq	(%rsp), %rdx
1457
1458	/* Make room for "NMI executing". */
1459	pushq	$0
1460
1461	/* Leave room for the "iret" frame */
1462	subq	$(5*8), %rsp
1463
1464	/* Copy the "original" frame to the "outermost" frame */
1465	.rept 5
1466	pushq	11*8(%rsp)
1467	.endr
1468
1469	/* Everything up to here is safe from nested NMIs */
1470
1471#ifdef CONFIG_DEBUG_ENTRY
1472	/*
1473	 * For ease of testing, unmask NMIs right away.  Disabled by
1474	 * default because IRET is very expensive.
1475	 */
1476	pushq	$0		/* SS */
1477	pushq	%rsp		/* RSP (minus 8 because of the previous push) */
1478	addq	$8, (%rsp)	/* Fix up RSP */
1479	pushfq			/* RFLAGS */
1480	pushq	$__KERNEL_CS	/* CS */
1481	pushq	$1f		/* RIP */
1482	INTERRUPT_RETURN	/* continues at repeat_nmi below */
14831:
1484#endif
1485
1486repeat_nmi:
1487	/*
1488	 * If there was a nested NMI, the first NMI's iret will return
1489	 * here. But NMIs are still enabled and we can take another
1490	 * nested NMI. The nested NMI checks the interrupted RIP to see
1491	 * if it is between repeat_nmi and end_repeat_nmi, and if so
1492	 * it will just return, as we are about to repeat an NMI anyway.
1493	 * This makes it safe to copy to the stack frame that a nested
1494	 * NMI will update.
1495	 *
1496	 * RSP is pointing to "outermost RIP".  gsbase is unknown, but, if
1497	 * we're repeating an NMI, gsbase has the same value that it had on
1498	 * the first iteration.  paranoid_entry will load the kernel
1499	 * gsbase if needed before we call do_nmi.  "NMI executing"
1500	 * is zero.
1501	 */
1502	movq	$1, 10*8(%rsp)		/* Set "NMI executing". */
1503
1504	/*
1505	 * Copy the "outermost" frame to the "iret" frame.  NMIs that nest
1506	 * here must not modify the "iret" frame while we're writing to
1507	 * it or it will end up containing garbage.
1508	 */
1509	addq	$(10*8), %rsp
1510	.rept 5
1511	pushq	-6*8(%rsp)
1512	.endr
1513	subq	$(5*8), %rsp
1514end_repeat_nmi:
1515
1516	/*
1517	 * Everything below this point can be preempted by a nested NMI.
1518	 * If this happens, then the inner NMI will change the "iret"
1519	 * frame to point back to repeat_nmi.
1520	 */
1521	pushq	$-1				/* ORIG_RAX: no syscall to restart */
1522	ALLOC_PT_GPREGS_ON_STACK
1523
1524	/*
1525	 * Use paranoid_entry to handle SWAPGS, but no need to use paranoid_exit
1526	 * as we should not be calling schedule in NMI context.
1527	 * Even with normal interrupts enabled. An NMI should not be
1528	 * setting NEED_RESCHED or anything that normal interrupts and
1529	 * exceptions might do.
1530	 */
1531	call	paranoid_entry
1532
1533	/* paranoidentry do_nmi, 0; without TRACE_IRQS_OFF */
1534	movq	%rsp, %rdi
1535	movq	$-1, %rsi
1536	call	do_nmi
1537
1538	testl	%ebx, %ebx			/* swapgs needed? */
1539	jnz	nmi_restore
1540nmi_swapgs:
1541	SWAPGS_UNSAFE_STACK
1542nmi_restore:
1543	RESTORE_EXTRA_REGS
1544	RESTORE_C_REGS
1545
1546	/* Point RSP at the "iret" frame. */
1547	REMOVE_PT_GPREGS_FROM_STACK 6*8
1548
1549	/*
1550	 * Clear "NMI executing".  Set DF first so that we can easily
1551	 * distinguish the remaining code between here and IRET from
1552	 * the SYSCALL entry and exit paths.  On a native kernel, we
1553	 * could just inspect RIP, but, on paravirt kernels,
1554	 * INTERRUPT_RETURN can translate into a jump into a
1555	 * hypercall page.
1556	 */
1557	std
1558	movq	$0, 5*8(%rsp)		/* clear "NMI executing" */
1559
1560	/*
1561	 * INTERRUPT_RETURN reads the "iret" frame and exits the NMI
1562	 * stack in a single instruction.  We are returning to kernel
1563	 * mode, so this cannot result in a fault.
1564	 */
1565	INTERRUPT_RETURN
1566END(nmi)
1567
1568ENTRY(ignore_sysret)
1569	mov	$-ENOSYS, %eax
1570	sysret
1571END(ignore_sysret)
1572
1573ENTRY(rewind_stack_do_exit)
1574	/* Prevent any naive code from trying to unwind to our caller. */
1575	xorl	%ebp, %ebp
1576
1577	movq	PER_CPU_VAR(cpu_current_top_of_stack), %rax
1578	leaq	-TOP_OF_KERNEL_STACK_PADDING-PTREGS_SIZE(%rax), %rsp
1579
1580	call	do_exit
15811:	jmp 1b
1582END(rewind_stack_do_exit)
1583