1/* SPDX-License-Identifier: GPL-2.0 */
2/*
3 * wuf.S: Window underflow trap handler for the Sparc.
4 *
5 * Copyright (C) 1995 David S. Miller
6 */
7
8#include <asm/contregs.h>
9#include <asm/page.h>
10#include <asm/ptrace.h>
11#include <asm/psr.h>
12#include <asm/smp.h>
13#include <asm/asi.h>
14#include <asm/winmacro.h>
15#include <asm/asmmacro.h>
16#include <asm/thread_info.h>
17
18/* Just like the overflow handler we define macros for registers
19 * with fixed meanings in this routine.
20 */
21#define t_psr       l0
22#define t_pc        l1
23#define t_npc       l2
24#define t_wim       l3
25/* Don't touch the above registers or else you die horribly... */
26
27/* Now macros for the available scratch registers in this routine. */
28#define twin_tmp1    l4
29#define twin_tmp2    l5
30
31#define curptr       g6
32
33	.text
34	.align	4
35
36	/* The trap entry point has executed the following:
37	 *
38	 * rd    %psr, %l0
39	 * rd    %wim, %l3
40	 * b     fill_window_entry
41	 * andcc %l0, PSR_PS, %g0
42	 */
43
44	/* Datum current_thread_info->uwinmask contains at all times a bitmask
45	 * where if any user windows are active, at least one bit will
46	 * be set in to mask.  If no user windows are active, the bitmask
47	 * will be all zeroes.
48	 */
49
50	/* To get an idea of what has just happened to cause this
51	 * trap take a look at this diagram:
52	 *
53	 *      1  2  3  4     <--  Window number
54	 *      ----------
55	 *      T  O  W  I     <--  Symbolic name
56	 *
57	 *      O == the window that execution was in when
58	 *           the restore was attempted
59	 *
60	 *      T == the trap itself has save'd us into this
61	 *           window
62	 *
63	 *      W == this window is the one which is now invalid
64	 *           and must be made valid plus loaded from the
65	 *           stack
66	 *
67	 *      I == this window will be the invalid one when we
68	 *           are done and return from trap if successful
69	 */
70
71	/* BEGINNING OF PATCH INSTRUCTIONS */
72
73	/* On 7-window Sparc the boot code patches fnwin_patch1
74	 * with the following instruction.
75	 */
76	.globl	fnwin_patch1_7win, fnwin_patch2_7win
77fnwin_patch1_7win:	srl	%t_wim, 6, %twin_tmp2
78fnwin_patch2_7win:	and	%twin_tmp1, 0x7f, %twin_tmp1
79	/* END OF PATCH INSTRUCTIONS */
80
81	.globl	fill_window_entry, fnwin_patch1, fnwin_patch2
82fill_window_entry:
83	/* LOCATION: Window 'T' */
84
85	/* Compute what the new %wim is going to be if we retrieve
86	 * the proper window off of the stack.
87	 */
88		sll	%t_wim, 1, %twin_tmp1
89fnwin_patch1:	srl	%t_wim, 7, %twin_tmp2
90		or	%twin_tmp1, %twin_tmp2, %twin_tmp1
91fnwin_patch2:	and	%twin_tmp1, 0xff, %twin_tmp1
92
93	wr	%twin_tmp1, 0x0, %wim	/* Make window 'I' invalid */
94
95	andcc	%t_psr, PSR_PS, %g0
96	be	fwin_from_user
97	 restore	%g0, %g0, %g0		/* Restore to window 'O' */
98
99	/* Trapped from kernel, we trust that the kernel does not
100	 * 'over restore' sorta speak and just grab the window
101	 * from the stack and return.  Easy enough.
102	 */
103fwin_from_kernel:
104	/* LOCATION: Window 'O' */
105
106	restore %g0, %g0, %g0
107
108	/* LOCATION: Window 'W' */
109
110	LOAD_WINDOW(sp)	                /* Load it up */
111
112	/* Spin the wheel... */
113	save	%g0, %g0, %g0
114	save	%g0, %g0, %g0
115	/* I'd like to buy a vowel please... */
116
117	/* LOCATION: Window 'T' */
118
119	/* Now preserve the condition codes in %psr, pause, and
120	 * return from trap.  This is the simplest case of all.
121	 */
122	wr	%t_psr, 0x0, %psr
123	WRITE_PAUSE
124
125	jmp	%t_pc
126	rett	%t_npc
127
128fwin_from_user:
129	/* LOCATION: Window 'O' */
130
131	restore	%g0, %g0, %g0		/* Restore to window 'W' */
132
133	/* LOCATION: Window 'W' */
134
135	/* Branch to the stack validation routine */
136	b	srmmu_fwin_stackchk
137	 andcc	%sp, 0x7, %g0
138
139#define STACK_OFFSET (THREAD_SIZE - TRACEREG_SZ - STACKFRAME_SZ)
140
141fwin_user_stack_is_bolixed:
142	/* LOCATION: Window 'W' */
143
144	/* Place a pt_regs frame on the kernel stack, save back
145	 * to the trap window and call c-code to deal with this.
146	 */
147	LOAD_CURRENT(l4, l5)
148
149	sethi	%hi(STACK_OFFSET), %l5
150	or	%l5, %lo(STACK_OFFSET), %l5
151	add	%l4, %l5, %l5
152
153	/* Store globals into pt_regs frame. */
154	STORE_PT_GLOBALS(l5)
155	STORE_PT_YREG(l5, g3)
156
157	/* Save current in a global while we change windows. */
158	mov	%l4, %curptr
159
160	save	%g0, %g0, %g0
161
162	/* LOCATION: Window 'O' */
163
164	rd	%psr, %g3		/* Read %psr in live user window */
165	mov	%fp, %g4		/* Save bogus frame pointer. */
166
167	save	%g0, %g0, %g0
168
169	/* LOCATION: Window 'T' */
170
171	sethi	%hi(STACK_OFFSET), %l5
172	or	%l5, %lo(STACK_OFFSET), %l5
173	add	%curptr, %l5, %sp
174
175	/* Build rest of pt_regs. */
176	STORE_PT_INS(sp)
177	STORE_PT_PRIV(sp, t_psr, t_pc, t_npc)
178
179	/* re-set trap time %wim value */
180	wr	%t_wim, 0x0, %wim
181
182	/* Fix users window mask and buffer save count. */
183	mov	0x1, %g5
184	sll	%g5, %g3, %g5
185	st	%g5, [%curptr + TI_UWINMASK]		! one live user window still
186	st	%g0, [%curptr + TI_W_SAVED]		! no windows in the buffer
187
188	wr	%t_psr, PSR_ET, %psr			! enable traps
189	nop
190	call	window_underflow_fault
191	 mov	%g4, %o0
192
193	b	ret_trap_entry
194	 clr	%l6
195
196fwin_user_stack_is_ok:
197	/* LOCATION: Window 'W' */
198
199	/* The users stack area is kosher and mapped, load the
200	 * window and fall through to the finish up routine.
201	 */
202	LOAD_WINDOW(sp)
203
204	/* Round and round she goes... */
205	save	%g0, %g0, %g0		/* Save to window 'O' */
206	save	%g0, %g0, %g0		/* Save to window 'T' */
207	/* Where she'll trap nobody knows... */
208
209	/* LOCATION: Window 'T' */
210
211fwin_user_finish_up:
212	/* LOCATION: Window 'T' */
213
214	wr	%t_psr, 0x0, %psr
215	WRITE_PAUSE
216
217	jmp	%t_pc
218	rett	%t_npc
219
220	/* Here come the architecture specific checks for stack.
221	 * mappings.  Note that unlike the window overflow handler
222	 * we only need to check whether the user can read from
223	 * the appropriate addresses.  Also note that we are in
224	 * an invalid window which will be loaded, and this means
225	 * that until we actually load the window up we are free
226	 * to use any of the local registers contained within.
227	 *
228	 * On success these routine branch to fwin_user_stack_is_ok
229	 * if the area at %sp is user readable and the window still
230	 * needs to be loaded, else fwin_user_finish_up if the
231	 * routine has done the loading itself.  On failure (bogus
232	 * user stack) the routine shall branch to the label called
233	 * fwin_user_stack_is_bolixed.
234	 *
235	 * Contrary to the arch-specific window overflow stack
236	 * check routines in wof.S, these routines are free to use
237	 * any of the local registers they want to as this window
238	 * does not belong to anyone at this point, however the
239	 * outs and ins are still verboten as they are part of
240	 * 'someone elses' window possibly.
241	 */
242
243	.globl	srmmu_fwin_stackchk
244srmmu_fwin_stackchk:
245	/* LOCATION: Window 'W' */
246
247	/* Caller did 'andcc %sp, 0x7, %g0' */
248	bne	fwin_user_stack_is_bolixed
249	 sethi   %hi(PAGE_OFFSET), %l5
250
251	/* Check if the users stack is in kernel vma, then our
252	 * trial and error technique below would succeed for
253	 * the 'wrong' reason.
254	 */
255	mov	AC_M_SFSR, %l4
256	cmp	%l5, %sp
257	bleu	fwin_user_stack_is_bolixed
258LEON_PI( lda	[%l4] ASI_LEON_MMUREGS, %g0)	! clear fault status
259SUN_PI_( lda	[%l4] ASI_M_MMUREGS, %g0)	! clear fault status
260
261	/* The technique is, turn off faults on this processor,
262	 * just let the load rip, then check the sfsr to see if
263	 * a fault did occur.  Then we turn on fault traps again
264	 * and branch conditionally based upon what happened.
265	 */
266LEON_PI(lda	[%g0] ASI_LEON_MMUREGS, %l5)	! read mmu-ctrl reg
267SUN_PI_(lda	[%g0] ASI_M_MMUREGS, %l5)	! read mmu-ctrl reg
268	or	%l5, 0x2, %l5			! turn on no-fault bit
269LEON_PI(sta	%l5, [%g0] ASI_LEON_MMUREGS)	! store it
270SUN_PI_(sta	%l5, [%g0] ASI_M_MMUREGS)	! store it
271
272	/* Cross fingers and go for it. */
273	LOAD_WINDOW(sp)
274
275	/* A penny 'saved'... */
276	save	%g0, %g0, %g0
277	save	%g0, %g0, %g0
278	/* Is a BADTRAP earned... */
279
280	/* LOCATION: Window 'T' */
281
282LEON_PI(lda	[%g0] ASI_LEON_MMUREGS, %twin_tmp1)	! load mmu-ctrl again
283SUN_PI_(lda	[%g0] ASI_M_MMUREGS, %twin_tmp1)	! load mmu-ctrl again
284	andn	%twin_tmp1, 0x2, %twin_tmp1		! clear no-fault bit
285LEON_PI(sta	%twin_tmp1, [%g0] ASI_LEON_MMUREGS)	! store it
286SUN_PI_(sta	%twin_tmp1, [%g0] ASI_M_MMUREGS)	! store it
287
288	mov	AC_M_SFAR, %twin_tmp2
289LEON_PI(lda	[%twin_tmp2] ASI_LEON_MMUREGS, %g0)	! read fault address
290SUN_PI_(lda	[%twin_tmp2] ASI_M_MMUREGS, %g0)	! read fault address
291
292	mov	AC_M_SFSR, %twin_tmp2
293LEON_PI(lda	[%twin_tmp2] ASI_LEON_MMUREGS, %twin_tmp2) ! read fault status
294SUN_PI_(lda	[%twin_tmp2] ASI_M_MMUREGS, %twin_tmp2)	   ! read fault status
295	andcc	%twin_tmp2, 0x2, %g0			   ! did fault occur?
296
297	bne	1f					   ! yep, cleanup
298	 nop
299
300	wr	%t_psr, 0x0, %psr
301	nop
302	b	fwin_user_finish_up + 0x4
303	 nop
304
305	/* Did I ever tell you about my window lobotomy?
306	 * anyways... fwin_user_stack_is_bolixed expects
307	 * to be in window 'W' so make it happy or else
308	 * we watchdog badly.
309	 */
3101:
311	restore	%g0, %g0, %g0
312	b	fwin_user_stack_is_bolixed	! oh well
313	 restore	%g0, %g0, %g0
314