2 * This file contains the code that gets mapped at the upper end of each task's text
3 * region. For now, it contains the signal trampoline code only.
5 * Copyright (C) 1999-2003 Hewlett-Packard Co
6 * David Mosberger-Tang <davidm@hpl.hp.com>
9 #include <asm/asmmacro.h>
10 #include <asm/errno.h>
11 #include <asm/asm-offsets.h>
12 #include <asm/sigcontext.h>
13 #include <asm/system.h>
14 #include <asm/unistd.h>
15 #ifdef CONFIG_XEN_IA64_VDSO_PARAVIRT
16 # include <asm/privop.h>
20 * We can't easily refer to symbols inside the kernel. To avoid full runtime relocation,
21 * complications with the linker (which likes to create PLT stubs for branches
22 * to targets outside the shared object) and to avoid multi-phase kernel builds, we
23 * simply create minimalistic "patch lists" in special ELF sections.
25 .section ".data.patch.fsyscall_table", "a"
27 #define LOAD_FSYSCALL_TABLE(reg) \
29 .xdata4 ".data.patch.fsyscall_table", 1b-.
31 .section ".data.patch.brl_fsys_bubble_down", "a"
33 #define BRL_COND_FSYS_BUBBLE_DOWN(pr) \
34 [1:](pr)brl.cond.sptk 0; \
35 .xdata4 ".data.patch.brl_fsys_bubble_down", 1b-.
37 #ifdef CONFIG_XEN_IA64_VDSO_PARAVIRT
38 // The page in which hyperprivop lives must be pinned by ITR.
39 // However vDSO area isn't pinned. So issuing hyperprivop
40 // from vDSO page causes trouble that Kevin pointed out.
41 // After clearing vpsr.ic, the vcpu is pre-empted and the itlb
42 // is flushed. Then vcpu get cpu again, tlb miss fault occures.
43 // However it results in nested dtlb fault because vpsr.ic is off.
44 // To avoid such a situation, we jump into the kernel text area
45 // which is pinned, and then issue hyperprivop and return back
47 // This is Dan Magenheimer's idea.
49 // Currently is_running_on_xen() is defined as running_on_xen.
50 // If is_running_on_xen() is a real function, we must update
52 .section ".data.patch.running_on_xen", "a"
54 #define LOAD_RUNNING_ON_XEN(reg) \
56 .xdata4 ".data.patch.running_on_xen", 1b-.
58 .section ".data.patch.brl_xen_rsm_be_i", "a"
60 #define BRL_COND_XEN_RSM_BE_I(pr) \
61 [1:](pr)brl.cond.sptk 0; \
62 .xdata4 ".data.patch.brl_xen_rsm_be_i", 1b-.
64 .section ".data.patch.brl_xen_get_psr", "a"
66 #define BRL_COND_XEN_GET_PSR(pr) \
67 [1:](pr)brl.cond.sptk 0; \
68 .xdata4 ".data.patch.brl_xen_get_psr", 1b-.
70 .section ".data.patch.brl_xen_ssm_i_0", "a"
72 #define BRL_COND_XEN_SSM_I_0(pr) \
73 [1:](pr)brl.cond.sptk 0; \
74 .xdata4 ".data.patch.brl_xen_ssm_i_0", 1b-.
76 .section ".data.patch.brl_xen_ssm_i_1", "a"
78 #define BRL_COND_XEN_SSM_I_1(pr) \
79 [1:](pr)brl.cond.sptk 0; \
80 .xdata4 ".data.patch.brl_xen_ssm_i_1", 1b-.
83 GLOBAL_ENTRY(__kernel_syscall_via_break)
88 * Note: for (fast) syscall restart to work, the break instruction must be
89 * the first one in the bundle addressed by syscall_via_break.
96 END(__kernel_syscall_via_break)
101 * r15 = system call #
102 * b0 = saved return address
103 * b6 = return address
106 * r15 = system call #
107 * b0 = saved return address
108 * all other "scratch" registers: undefined
109 * all "preserved" registers: same as on entry
112 GLOBAL_ENTRY(__kernel_syscall_via_epc)
118 * Note: the kernel cannot assume that the first two instructions in this
119 * bundle get executed. The remaining code must be safe even if
120 * they do not get executed.
122 adds r17=-1024,r15 // A
123 mov r10=0 // A default to successful syscall execution
124 epc // B causes split-issue
127 #ifdef CONFIG_XEN_IA64_VDSO_PARAVIRT
129 // r22 = &vcpu->evtchn_mask
131 // r24 = &vcpu->pending_interruption
133 // r28 = &running_on_xen
134 // r30 = running_on_xen
137 // p12 = running_on_xen
138 // p13 = !running_on_xen
143 LOAD_RUNNING_ON_XEN(r28)
144 movl r22=XSI_PSR_I_ADDR
146 movl r24=XSI_PSR_I_ADDR+(XSI_PEND_OFS-XSI_PSR_I_ADDR_OFS)
151 cmp.ne isXen,isRaw=r0,r30
153 (isRaw) rsm psr.be | psr.i
154 BRL_COND_XEN_RSM_BE_I(isXen)
155 .global .vdso_rsm_be_i_ret
158 rsm psr.be | psr.i // M2 (5 cyc to srlz.d)
160 LOAD_FSYSCALL_TABLE(r14) // X
162 mov r16=IA64_KR(CURRENT) // M2 (12 cyc)
163 shladd r18=r17,3,r14 // A
164 mov r19=NR_syscalls-1 // A
167 #ifdef CONFIG_XEN_IA64_VDSO_PARAVIRT
169 BRL_COND_XEN_GET_PSR(isXen)
170 .global .vdso_get_psr_ret
173 mov r29=psr // M2 (12 cyc)
175 // If r17 is a NaT, p6 will be zero
176 cmp.geu p6,p7=r19,r17 // A (sysnr > 0 && sysnr < 1024+NR_syscalls)?
178 mov r21=ar.fpsr // M2 (12 cyc)
179 tnat.nz p10,p9=r15 // I0
180 mov.i r26=ar.pfs // I0 (would stall anyhow due to srlz.d...)
182 srlz.d // M0 (forces split-issue) ensure PSR.BE==0
183 (p6) ld8 r18=[r18] // M0|1
187 (p6) tbit.z.unc p8,p0=r18,0 // I0 (dual-issues with "mov b7=r18"!)
188 #ifdef CONFIG_XEN_IA64_VDSO_PARAVIRT
190 // p14 = running_on_xen && p8
191 // p15 = !running_on_xen && p8
192 (p8) cmp.ne.unc p14,p15=r0,r30
195 BRL_COND_XEN_SSM_I_0(p14)
196 .global .vdso_ssm_i_0_ret
203 (p6) mov b7=r18 // I0
204 (p8) br.dptk.many b7 // B
206 mov r27=ar.rsc // M2 (12 cyc)
208 * brl.cond doesn't work as intended because the linker would convert this branch
209 * into a branch to a PLT. Perhaps there will be a way to avoid this with some
210 * future version of the linker. In the meantime, we just use an indirect branch
213 #ifdef CONFIG_ITANIUM
214 (p6) add r14=-8,r14 // r14 <- addr of fsys_bubble_down entry
216 (p6) ld8 r14=[r14] // r14 <- fsys_bubble_down
221 BRL_COND_FSYS_BUBBLE_DOWN(p6)
223 #ifdef CONFIG_XEN_IA64_VDSO_PARAVIRT
225 BRL_COND_XEN_SSM_I_1(isXen)
226 .global .vdso_ssm_i_1_ret
233 #ifdef CONFIG_XEN_IA64_VDSO_PARAVIRT
234 dv_serialize_data // shut up gas warning.
235 // we know xen_hyper_ssm_i_0 or xen_hyper_ssm_i_1
236 // doesn't change p9 and p10
240 END(__kernel_syscall_via_epc)
242 # define ARG0_OFF (16 + IA64_SIGFRAME_ARG0_OFFSET)
243 # define ARG1_OFF (16 + IA64_SIGFRAME_ARG1_OFFSET)
244 # define ARG2_OFF (16 + IA64_SIGFRAME_ARG2_OFFSET)
245 # define SIGHANDLER_OFF (16 + IA64_SIGFRAME_HANDLER_OFFSET)
246 # define SIGCONTEXT_OFF (16 + IA64_SIGFRAME_SIGCONTEXT_OFFSET)
248 # define FLAGS_OFF IA64_SIGCONTEXT_FLAGS_OFFSET
249 # define CFM_OFF IA64_SIGCONTEXT_CFM_OFFSET
250 # define FR6_OFF IA64_SIGCONTEXT_FR6_OFFSET
251 # define BSP_OFF IA64_SIGCONTEXT_AR_BSP_OFFSET
252 # define RNAT_OFF IA64_SIGCONTEXT_AR_RNAT_OFFSET
253 # define UNAT_OFF IA64_SIGCONTEXT_AR_UNAT_OFFSET
254 # define FPSR_OFF IA64_SIGCONTEXT_AR_FPSR_OFFSET
255 # define PR_OFF IA64_SIGCONTEXT_PR_OFFSET
256 # define RP_OFF IA64_SIGCONTEXT_IP_OFFSET
257 # define SP_OFF IA64_SIGCONTEXT_R12_OFFSET
258 # define RBS_BASE_OFF IA64_SIGCONTEXT_RBS_BASE_OFFSET
259 # define LOADRS_OFF IA64_SIGCONTEXT_LOADRS_OFFSET
263 * When we get here, the memory stack looks like this:
265 * +===============================+
267 * // struct sigframe //
269 * +-------------------------------+ <-- sp+16
270 * | 16 byte of scratch |
272 * +-------------------------------+ <-- sp
274 * The register stack looks _exactly_ the way it looked at the time the signal
275 * occurred. In other words, we're treading on a potential mine-field: each
276 * incoming general register may be a NaT value (including sp, in which case the
277 * process ends up dying with a SIGSEGV).
279 * The first thing need to do is a cover to get the registers onto the backing
280 * store. Once that is done, we invoke the signal handler which may modify some
281 * of the machine state. After returning from the signal handler, we return
282 * control to the previous context by executing a sigreturn system call. A signal
283 * handler may call the rt_sigreturn() function to directly return to a given
284 * sigcontext. However, the user-level sigreturn() needs to do much more than
285 * calling the rt_sigreturn() system call as it needs to unwind the stack to
286 * restore preserved registers that may have been saved on the signal handler's
290 #define SIGTRAMP_SAVES \
291 .unwabi 3, 's'; /* mark this as a sigtramp handler (saves scratch regs) */ \
292 .unwabi @svr4, 's'; /* backwards compatibility with old unwinders (remove in v2.7) */ \
293 .savesp ar.unat, UNAT_OFF+SIGCONTEXT_OFF; \
294 .savesp ar.fpsr, FPSR_OFF+SIGCONTEXT_OFF; \
295 .savesp pr, PR_OFF+SIGCONTEXT_OFF; \
296 .savesp rp, RP_OFF+SIGCONTEXT_OFF; \
297 .savesp ar.pfs, CFM_OFF+SIGCONTEXT_OFF; \
298 .vframesp SP_OFF+SIGCONTEXT_OFF
300 GLOBAL_ENTRY(__kernel_sigtramp)
301 // describe the state that is active when we get here:
308 adds base0=SIGHANDLER_OFF,sp
309 adds base1=RBS_BASE_OFF+SIGCONTEXT_OFF,sp
310 br.call.sptk.many rp=1f
312 ld8 r17=[base0],(ARG0_OFF-SIGHANDLER_OFF) // get pointer to signal handler's plabel
313 ld8 r15=[base1] // get address of new RBS base (or NULL)
314 cover // push args in interrupted frame onto backing store
316 cmp.ne p1,p0=r15,r0 // do we need to switch rbs? (note: pr is saved by kernel)
317 mov.m r9=ar.bsp // fetch ar.bsp
318 .spillsp.p p1, ar.rnat, RNAT_OFF+SIGCONTEXT_OFF
319 (p1) br.cond.spnt setup_rbs // yup -> (clobbers p8, r14-r16, and r18-r20)
321 alloc r8=ar.pfs,0,0,3,0
322 ld8 out0=[base0],16 // load arg0 (signum)
323 adds base1=(ARG1_OFF-(RBS_BASE_OFF+SIGCONTEXT_OFF)),base1
325 ld8 out1=[base1] // load arg1 (siginfop)
326 ld8 r10=[r17],8 // get signal handler entry point
328 ld8 out2=[base0] // load arg2 (sigcontextp)
329 ld8 gp=[r17] // get signal handler's global pointer
330 adds base0=(BSP_OFF+SIGCONTEXT_OFF),sp
332 .spillsp ar.bsp, BSP_OFF+SIGCONTEXT_OFF
333 st8 [base0]=r9 // save sc_ar_bsp
334 adds base0=(FR6_OFF+SIGCONTEXT_OFF),sp
335 adds base1=(FR6_OFF+16+SIGCONTEXT_OFF),sp
337 stf.spill [base0]=f6,32
338 stf.spill [base1]=f7,32
340 stf.spill [base0]=f8,32
341 stf.spill [base1]=f9,32
344 stf.spill [base0]=f10,32
345 stf.spill [base1]=f11,32
347 stf.spill [base0]=f12,32
348 stf.spill [base1]=f13,32
350 stf.spill [base0]=f14,32
351 stf.spill [base1]=f15,32
352 br.call.sptk.many rp=b6 // call the signal handler
353 .ret0: adds base0=(BSP_OFF+SIGCONTEXT_OFF),sp
355 ld8 r15=[base0] // fetch sc_ar_bsp
358 cmp.ne p1,p0=r14,r15 // do we need to restore the rbs?
359 (p1) br.cond.spnt restore_rbs // yup -> (clobbers r14-r18, f6 & f7)
361 back_from_restore_rbs:
362 adds base0=(FR6_OFF+SIGCONTEXT_OFF),sp
363 adds base1=(FR6_OFF+16+SIGCONTEXT_OFF),sp
365 ldf.fill f6=[base0],32
366 ldf.fill f7=[base1],32
368 ldf.fill f8=[base0],32
369 ldf.fill f9=[base1],32
371 ldf.fill f10=[base0],32
372 ldf.fill f11=[base1],32
374 ldf.fill f12=[base0],32
375 ldf.fill f13=[base1],32
377 ldf.fill f14=[base0],32
378 ldf.fill f15=[base1],32
379 mov r15=__NR_rt_sigreturn
380 .restore sp // pop .prologue
381 break __BREAK_SYSCALL
386 mov ar.rsc=0 // put RSE into enforced lazy mode
389 mov r19=ar.rnat // save RNaT before switching backing store area
390 adds r14=(RNAT_OFF+SIGCONTEXT_OFF),sp
393 mov ar.bspstore=r15 // switch over to new register backing store area
396 .spillsp ar.rnat, RNAT_OFF+SIGCONTEXT_OFF
397 st8 [r14]=r19 // save sc_ar_rnat
399 mov.m r16=ar.bsp // sc_loadrs <- (new bsp - new bspstore) << 16
400 adds r14=(LOADRS_OFF+SIGCONTEXT_OFF),sp
406 mov ar.rsc=0xf // set RSE into eager mode, pl 3
410 st8 [r14]=r15 // save sc_loadrs
411 (p8) st8 [r18]=r19 // if bspstore points at RNaT slot, store RNaT there now
412 .restore sp // pop .prologue
413 br.cond.sptk back_from_setup_rbs
417 .spillsp ar.rnat, RNAT_OFF+SIGCONTEXT_OFF
421 // r14 = bsp1 (bsp at the time of return from signal handler)
422 // r15 = bsp0 (bsp at the time the signal occurred)
424 // Here, we need to calculate bspstore0, the value that ar.bspstore needs
425 // to be set to, based on bsp0 and the size of the dirty partition on
426 // the alternate stack (sc_loadrs >> 16). This can be done with the
427 // following algorithm:
429 // bspstore0 = rse_skip_regs(bsp0, -rse_num_regs(bsp1 - (loadrs >> 19), bsp1));
431 // This is what the code below does.
433 alloc r2=ar.pfs,0,0,0,0 // alloc null frame
434 adds r16=(LOADRS_OFF+SIGCONTEXT_OFF),sp
435 adds r18=(RNAT_OFF+SIGCONTEXT_OFF),sp
438 ld8 r16=[r18] // get new rnat
439 extr.u r18=r15,3,6 // r18 <- rse_slot_num(bsp0)
441 mov ar.rsc=r17 // put RSE into enforced lazy mode
444 sub r14=r14,r17 // r14 (bspstore1) <- bsp1 - (sc_loadrs >> 16)
445 shr.u r17=r17,3 // r17 <- (sc_loadrs >> 19)
447 loadrs // restore dirty partition
448 extr.u r14=r14,3,6 // r14 <- rse_slot_num(bspstore1)
450 add r14=r14,r17 // r14 <- rse_slot_num(bspstore1) + (sc_loadrs >> 19)
452 shr.u r14=r14,6 // r14 <- (rse_slot_num(bspstore1) + (sc_loadrs >> 19))/0x40
454 sub r14=r14,r17 // r14 <- -rse_num_regs(bspstore1, bsp1)
455 movl r17=0x8208208208208209
457 add r18=r18,r14 // r18 (delta) <- rse_slot_num(bsp0) - rse_num_regs(bspstore1,bsp1)
459 cmp.lt p7,p0=r14,r0 // p7 <- (r14 < 0)?
461 (p7) adds r18=-62,r18 // delta -= 62
474 sub r17=r17,r18 // r17 = delta/63
476 add r17=r14,r17 // r17 <- delta/63 - rse_num_regs(bspstore1, bsp1)
478 shladd r15=r17,3,r15 // r15 <- bsp0 + 8*(delta/63 - rse_num_regs(bspstore1, bsp1))
480 mov ar.bspstore=r15 // switch back to old register backing store area
482 mov ar.rnat=r16 // restore RNaT
483 mov ar.rsc=0xf // (will be restored later on from sc_ar_rsc)
484 // invala not necessary as that will happen when returning to user-mode
485 br.cond.sptk back_from_restore_rbs
486 END(__kernel_sigtramp)