2 * Linux/PA-RISC Project (http://www.parisc-linux.org/)
4 * System call entry code / Linux gateway page
5 * Copyright (c) Matthew Wilcox 1999 <willy@bofh.ai>
6 * Licensed under the GNU GPL.
7 * thanks to Philipp Rumpf, Mike Shaver and various others
8 * sorry about the wall, puffin..
12 How does the Linux gateway page on PA-RISC work?
13 ------------------------------------------------
14 The Linux gateway page on PA-RISC is "special".
15 It actually has PAGE_GATEWAY bits set (this is linux terminology; in parisc
16 terminology it's Execute, promote to PL0) in the page map. So anything
17 executing on this page executes with kernel level privilege (there's more to it
18 than that: to have this happen, you also have to use a branch with a ,gate
19 completer to activate the privilege promotion). The upshot is that everything
20 that runs on the gateway page runs at kernel privilege but with the current
21 user process address space (although you have access to kernel space via %sr2).
22 For the 0x100 syscall entry, we redo the space registers to point to the kernel
23 address space (preserving the user address space in %sr3), move to wide mode if
24 required, save the user registers and branch into the kernel syscall entry
25 point. For all the other functions, we execute at kernel privilege but don't
26 flip address spaces. The basic upshot of this is that these code snippets are
27 executed atomically (because the kernel can't be pre-empted) and they may
28 perform architecturally forbidden (to PL3) operations (like setting control
33 #include <asm/asm-offsets.h>
34 #include <asm/unistd.h>
35 #include <asm/errno.h>
38 #include <asm/thread_info.h>
39 #include <asm/assembly.h>
40 #include <asm/processor.h>
41 #include <asm/cache.h>
43 #include <linux/linkage.h>
45 /* We fill the empty parts of the gateway page with
46 * something that will kill the kernel or a
47 * userspace application.
49 #define KILL_INSN break 0,0
55 .import syscall_exit,code
56 .import syscall_exit_rfi,code
58 /* Linux gateway page is aliased to virtual page 0 in the kernel
59 * address space. Since it is a gateway page it cannot be
60 * dereferenced, so null pointers will still fault. We start
61 * the actual entry point at 0x100. We put break instructions
62 * at the beginning of the page to trap null indirect function
67 ENTRY(linux_gateway_page)
69 /* ADDRESS 0x00 to 0xb0 = 176 bytes / 4 bytes per insn = 44 insns */
74 /* ADDRESS 0xb0 to 0xb8, lws uses two insns for entry */
75 /* Light-weight-syscall entry must always be located at 0xb0 */
76 /* WARNING: Keep this number updated with table size changes */
77 #define __NR_lws_entries (2)
80 gate lws_start, %r0 /* increase privilege */
81 depi 3, 31, 2, %r31 /* Ensure we return into user mode. */
83 /* Fill from 0xb8 to 0xe0 */
88 /* This function MUST be located at 0xe0 for glibc's threading
89 mechanism to work. DO NOT MOVE THIS CODE EVER! */
91 gate .+8, %r0 /* increase privilege */
92 depi 3, 31, 2, %r31 /* Ensure we return into user mode. */
93 be 0(%sr7,%r31) /* return to user space */
94 mtctl %r26, %cr27 /* move arg0 to the control register */
96 /* Increase the chance of trapping if random jumps occur to this
97 address, fill from 0xf0 to 0x100 */
102 /* This address must remain fixed at 0x100 for glibc's syscalls to work */
105 gate .+8, %r0 /* become privileged */
106 mtsp %r0,%sr4 /* get kernel space into sr4 */
107 mtsp %r0,%sr5 /* get kernel space into sr5 */
108 mtsp %r0,%sr6 /* get kernel space into sr6 */
109 mfsp %sr7,%r1 /* save user sr7 */
110 mtsp %r1,%sr3 /* and store it in sr3 */
113 /* for now we can *always* set the W bit on entry to the syscall
114 * since we don't support wide userland processes. We could
115 * also save the current SM other than in r0 and restore it on
116 * exit from the syscall, and also use that value to know
117 * whether to do narrow or wide syscalls. -PB
120 extrd,u %r1,PSW_W_BIT,1,%r1
121 /* sp must be aligned on 4, so deposit the W bit setting into
122 * the bottom of sp temporarily */
125 /* The top halves of argument registers must be cleared on syscall
126 * entry from narrow executable.
128 depdi 0, 31, 32, %r26
129 depdi 0, 31, 32, %r25
130 depdi 0, 31, 32, %r24
131 depdi 0, 31, 32, %r23
132 depdi 0, 31, 32, %r22
133 depdi 0, 31, 32, %r21
137 xor %r1,%r30,%r30 /* ye olde xor trick */
141 ldo THREAD_SZ_ALGN+FRAME_SIZE(%r30),%r30 /* set up kernel stack */
143 /* N.B.: It is critical that we don't set sr7 to 0 until r30
144 * contains a valid kernel stack pointer. It is also
145 * critical that we don't start using the kernel stack
146 * until after sr7 has been set to 0.
149 mtsp %r0,%sr7 /* get kernel space into sr7 */
150 STREGM %r1,FRAME_SIZE(%r30) /* save r1 (usp) here for now */
151 mfctl %cr30,%r1 /* get task ptr in %r1 */
152 LDREG TI_TASK(%r1),%r1
154 /* Save some registers for sigcontext and potential task
155 switch (see entry.S for the details of which ones are
156 saved/restored). TASK_PT_PSW is zeroed so we can see whether
157 a process is on a syscall or not. For an interrupt the real
158 PSW value is stored. This is needed for gdb and sys_ptrace. */
159 STREG %r0, TASK_PT_PSW(%r1)
160 STREG %r2, TASK_PT_GR2(%r1) /* preserve rp */
161 STREG %r19, TASK_PT_GR19(%r1)
163 LDREGM -FRAME_SIZE(%r30), %r2 /* get users sp back */
165 extrd,u %r2,63,1,%r19 /* W hidden in bottom bit */
167 xor %r19,%r2,%r2 /* clear bottom bit */
169 std %r19,TASK_PT_PSW(%r1)
172 STREG %r2, TASK_PT_GR30(%r1) /* ... and save it */
174 STREG %r20, TASK_PT_GR20(%r1) /* Syscall number */
175 STREG %r21, TASK_PT_GR21(%r1)
176 STREG %r22, TASK_PT_GR22(%r1)
177 STREG %r23, TASK_PT_GR23(%r1) /* 4th argument */
178 STREG %r24, TASK_PT_GR24(%r1) /* 3rd argument */
179 STREG %r25, TASK_PT_GR25(%r1) /* 2nd argument */
180 STREG %r26, TASK_PT_GR26(%r1) /* 1st argument */
181 STREG %r27, TASK_PT_GR27(%r1) /* user dp */
182 STREG %r28, TASK_PT_GR28(%r1) /* return value 0 */
183 STREG %r0, TASK_PT_ORIG_R28(%r1) /* don't prohibit restarts */
184 STREG %r29, TASK_PT_GR29(%r1) /* return value 1 */
185 STREG %r31, TASK_PT_GR31(%r1) /* preserve syscall return ptr */
187 ldo TASK_PT_FR0(%r1), %r27 /* save fpregs from the kernel */
188 save_fp %r27 /* or potential task switch */
190 mfctl %cr11, %r27 /* i.e. SAR */
191 STREG %r27, TASK_PT_SAR(%r1)
196 ldo -16(%r30),%r29 /* Reference param save area */
197 copy %r19,%r2 /* W bit back to r2 */
199 /* no need to save these on stack in wide mode because the first 8
200 * args are passed in registers */
201 stw %r22, -52(%r30) /* 5th argument */
202 stw %r21, -56(%r30) /* 6th argument */
205 /* Are we being ptraced? */
207 LDREG TI_FLAGS(%r1),%r1
208 ldi _TIF_SYSCALL_TRACE_MASK, %r19
209 and,COND(=) %r1, %r19, %r0
212 /* Note! We cannot use the syscall table that is mapped
213 nearby since the gateway page is mapped execute-only. */
216 ldil L%sys_call_table, %r1
218 addil L%(sys_call_table64-sys_call_table), %r1
219 ldo R%sys_call_table(%r1), %r19
221 ldo R%sys_call_table64(%r1), %r19
223 ldil L%sys_call_table, %r1
224 ldo R%sys_call_table(%r1), %r19
226 comiclr,>> __NR_Linux_syscalls, %r20, %r0
229 LDREGX %r20(%r19), %r19
231 /* If this is a sys_rt_sigreturn call, and the signal was received
232 * when not in_syscall, then we want to return via syscall_exit_rfi,
233 * not syscall_exit. Signal no. in r20, in_syscall in r25 (see
234 * trampoline code in signal.c).
236 ldi __NR_rt_sigreturn,%r2
237 comb,= %r2,%r20,.Lrt_sigreturn
239 ldil L%syscall_exit,%r2
241 ldo R%syscall_exit(%r2),%r2
243 comib,<> 0,%r25,.Lin_syscall
244 ldil L%syscall_exit_rfi,%r2
246 ldo R%syscall_exit_rfi(%r2),%r2
248 /* Note! Because we are not running where we were linked, any
249 calls to functions external to this file must be indirect. To
250 be safe, we apply the opposite rule to functions within this
251 file, with local labels given to them to ensure correctness. */
255 ldil L%syscall_exit,%r1
256 be R%syscall_exit(%sr7,%r1)
257 ldo -ENOSYS(%r0),%r28 /* set errno */
260 /* Warning! This trace code is a virtual duplicate of the code above so be
261 * sure to maintain both! */
264 /* Need to save more registers so the debugger can see where we
265 * are. This saves only the lower 8 bits of PSW, so that the C
266 * bit is still clear on syscalls, and the D bit is set if this
267 * full register save path has been executed. We check the D
268 * bit on syscall_return_rfi to determine which registers to
269 * restore. An interrupt results in a full PSW saved with the
270 * C bit set, a non-straced syscall entry results in C and D clear
273 ldo -THREAD_SZ_ALGN-FRAME_SIZE(%r30),%r1 /* get task ptr */
274 LDREG TI_TASK(%r1), %r1
276 STREG %r2,TASK_PT_PSW(%r1) /* Lower 8 bits only!! */
278 STREG %r2,TASK_PT_SR0(%r1)
280 STREG %r2,TASK_PT_SR1(%r1)
282 STREG %r2,TASK_PT_SR2(%r1)
284 STREG %r2,TASK_PT_SR3(%r1)
285 STREG %r2,TASK_PT_SR4(%r1)
286 STREG %r2,TASK_PT_SR5(%r1)
287 STREG %r2,TASK_PT_SR6(%r1)
288 STREG %r2,TASK_PT_SR7(%r1)
289 STREG %r2,TASK_PT_IASQ0(%r1)
290 STREG %r2,TASK_PT_IASQ1(%r1)
291 LDREG TASK_PT_GR31(%r1),%r2
292 STREG %r2,TASK_PT_IAOQ0(%r1)
294 STREG %r2,TASK_PT_IAOQ1(%r1)
295 ldo TASK_REGS(%r1),%r2
297 STREG %r3,PT_GR3(%r2)
298 STREG %r4,PT_GR4(%r2)
299 STREG %r5,PT_GR5(%r2)
300 STREG %r6,PT_GR6(%r2)
301 STREG %r7,PT_GR7(%r2)
302 STREG %r8,PT_GR8(%r2)
303 STREG %r9,PT_GR9(%r2)
304 STREG %r10,PT_GR10(%r2)
305 STREG %r11,PT_GR11(%r2)
306 STREG %r12,PT_GR12(%r2)
307 STREG %r13,PT_GR13(%r2)
308 STREG %r14,PT_GR14(%r2)
309 STREG %r15,PT_GR15(%r2)
310 STREG %r16,PT_GR16(%r2)
311 STREG %r17,PT_GR17(%r2)
312 STREG %r18,PT_GR18(%r2)
313 /* Finished saving things for the debugger */
316 ldil L%do_syscall_trace_enter,%r1
317 ldil L%tracesys_next,%r2
318 be R%do_syscall_trace_enter(%sr7,%r1)
319 ldo R%tracesys_next(%r2),%r2
322 /* do_syscall_trace_enter either returned the syscallno, or -1L,
323 * so we skip restoring the PT_GR20 below, since we pulled it from
324 * task->thread.regs.gr[20] above.
327 ldil L%sys_call_table,%r1
328 ldo R%sys_call_table(%r1), %r19
330 ldo -THREAD_SZ_ALGN-FRAME_SIZE(%r30),%r1 /* get task ptr */
331 LDREG TI_TASK(%r1), %r1
332 LDREG TASK_PT_GR26(%r1), %r26 /* Restore the users args */
333 LDREG TASK_PT_GR25(%r1), %r25
334 LDREG TASK_PT_GR24(%r1), %r24
335 LDREG TASK_PT_GR23(%r1), %r23
336 LDREG TASK_PT_GR22(%r1), %r22
337 LDREG TASK_PT_GR21(%r1), %r21
339 ldo -16(%r30),%r29 /* Reference param save area */
341 stw %r22, -52(%r30) /* 5th argument */
342 stw %r21, -56(%r30) /* 6th argument */
345 comiclr,>>= __NR_Linux_syscalls, %r20, %r0
348 LDREGX %r20(%r19), %r19
350 /* If this is a sys_rt_sigreturn call, and the signal was received
351 * when not in_syscall, then we want to return via syscall_exit_rfi,
352 * not syscall_exit. Signal no. in r20, in_syscall in r25 (see
353 * trampoline code in signal.c).
355 ldi __NR_rt_sigreturn,%r2
356 comb,= %r2,%r20,.Ltrace_rt_sigreturn
358 ldil L%tracesys_exit,%r2
360 ldo R%tracesys_exit(%r2),%r2
362 /* Do *not* call this function on the gateway page, because it
363 makes a direct call to syscall_trace. */
366 ldo -THREAD_SZ_ALGN-FRAME_SIZE(%r30),%r1 /* get task ptr */
367 LDREG TI_TASK(%r1), %r1
369 ldo -16(%r30),%r29 /* Reference param save area */
371 ldo TASK_REGS(%r1),%r26
372 bl do_syscall_trace_exit,%r2
373 STREG %r28,TASK_PT_GR28(%r1) /* save return value now */
374 ldo -THREAD_SZ_ALGN-FRAME_SIZE(%r30),%r1 /* get task ptr */
375 LDREG TI_TASK(%r1), %r1
376 LDREG TASK_PT_GR28(%r1), %r28 /* Restore return val. */
378 ldil L%syscall_exit,%r1
379 be,n R%syscall_exit(%sr7,%r1)
381 .Ltrace_rt_sigreturn:
382 comib,<> 0,%r25,.Ltrace_in_syscall
383 ldil L%tracesys_sigexit,%r2
385 ldo R%tracesys_sigexit(%r2),%r2
388 ldo -THREAD_SZ_ALGN-FRAME_SIZE(%r30),%r1 /* get task ptr */
389 LDREG TI_TASK(%r1), %r1
391 ldo -16(%r30),%r29 /* Reference param save area */
393 bl do_syscall_trace_exit,%r2
394 ldo TASK_REGS(%r1),%r26
396 ldil L%syscall_exit_rfi,%r1
397 be,n R%syscall_exit_rfi(%sr7,%r1)
400 /*********************************************************
401 32/64-bit Light-Weight-Syscall ABI
403 * - Indicates a hint for userspace inline asm
406 Syscall number (caller-saves)
410 Argument registers (caller-saves)
411 - %r26, %r25, %r24, %r23, %r22
414 Return registers (caller-saves)
415 - %r28 (return), %r21 (errno)
418 Caller-saves registers
420 - %r2 (return pointer)
421 - %r31 (ble link register)
424 Callee-saves registers
426 - %r30 (stack pointer)
427 * Not in asm clobber.
429 If userspace is 32-bit:
430 Callee-saves registers
431 - %r19 (32-bit PIC register)
433 Differences from 32-bit calling convention:
434 - Syscall number in %r20
435 - Additional argument register %r22 (arg4)
438 If userspace is 64-bit:
439 Callee-saves registers
440 - %r27 (64-bit PIC register)
442 Differences from 64-bit calling convention:
443 - Syscall number in %r20
444 - Additional argument register %r22 (arg4)
447 Error codes returned by entry path:
449 ENOSYS - r20 was an invalid LWS number.
451 *********************************************************/
455 /* FIXME: If we are a 64-bit kernel just
456 * turn this on unconditionally.
459 extrd,u %r1,PSW_W_BIT,1,%r1
460 /* sp must be aligned on 4, so deposit the W bit setting into
461 * the bottom of sp temporarily */
464 /* Clip LWS number to a 32-bit value always */
465 depdi 0, 31, 32, %r20
468 /* Is the lws entry number valid? */
469 comiclr,>> __NR_lws_entries, %r20, %r0
472 /* WARNING: Trashing sr2 and sr3 */
473 mfsp %sr7,%r1 /* get userspace into sr3 */
475 mtsp %r0,%sr2 /* get kernel space into sr2 */
477 /* Load table start */
478 ldil L%lws_table, %r1
479 ldo R%lws_table(%r1), %r28 /* Scratch use of r28 */
480 LDREGX %r20(%sr2,r28), %r21 /* Scratch use of r21 */
482 /* Jump to lws, lws table pointers already relocated */
486 ldo -ENOSYS(%r0),%r21 /* set errno */
487 /* Fall through: Return to userspace */
491 /* decide whether to reset the wide mode bit
493 * For a syscall, the W bit is stored in the lowest bit
494 * of sp. Extract it and reset W if it is zero */
495 extrd,u,*<> %r30,63,1,%r1
497 /* now reset the lowest bit of sp if it was set */
504 /***************************************************
505 Implementing CAS as an atomic operation:
507 %r26 - Address to examine
508 %r25 - Old value to check (old)
509 %r24 - New value to set (new)
510 %r28 - Return prev through this register.
511 %r21 - Kernel error code
513 If debugging is DISabled:
515 %r21 has the following meanings:
517 EAGAIN - CAS is busy, ldcw failed, try again.
518 EFAULT - Read or write failed.
520 If debugging is enabled:
522 EDEADLOCK - CAS called recursively.
523 EAGAIN && r28 == 1 - CAS is busy. Lock contended.
524 EAGAIN && r28 == 2 - CAS is busy. ldcw failed.
525 EFAULT - Read or write failed.
527 Scratch: r20, r28, r1
529 ****************************************************/
531 /* Do not enable LWS debugging */
532 #define ENABLE_LWS_DEBUG 0
534 /* ELF64 Process entry path */
535 lws_compare_and_swap64:
537 b,n lws_compare_and_swap
539 /* If we are not a 64-bit kernel, then we don't
540 * have 64-bit input registers, and calling
541 * the 64-bit LWS CAS returns ENOSYS.
546 /* ELF32 Process entry path */
547 lws_compare_and_swap32:
549 /* Clip all the input registers */
550 depdi 0, 31, 32, %r26
551 depdi 0, 31, 32, %r25
552 depdi 0, 31, 32, %r24
555 lws_compare_and_swap:
556 /* Load start of lock table */
557 ldil L%lws_lock_start, %r20
558 ldo R%lws_lock_start(%r20), %r28
560 /* Extract four bits from r26 and hash lock (Bits 4-7) */
561 extru %r26, 27, 4, %r20
563 /* Find lock to use, the hash is either one of 0 to
564 15, multiplied by 16 (keep it 16-byte aligned)
565 and add to the lock table offset. */
569 # if ENABLE_LWS_DEBUG
571 DEBUG, check for deadlock!
572 If the thread register values are the same
573 then we were the one that locked it last and
574 this is a recurisve call that will deadlock.
575 We *must* giveup this call and fail.
577 ldw 4(%sr2,%r20), %r28 /* Load thread register */
578 /* WARNING: If cr27 cycles to the same value we have problems */
579 mfctl %cr27, %r21 /* Get current thread register */
580 cmpb,<>,n %r21, %r28, cas_lock /* Called recursive? */
581 b lws_exit /* Return error! */
582 ldo -EDEADLOCK(%r0), %r21
584 cmpb,=,n %r0, %r28, cas_nocontend /* Is nobody using it? */
585 ldo 1(%r0), %r28 /* 1st case */
586 b lws_exit /* Contended... */
587 ldo -EAGAIN(%r0), %r21 /* Spin in userspace */
590 /* ENABLE_LWS_DEBUG */
592 LDCW 0(%sr2,%r20), %r28 /* Try to acquire the lock */
593 cmpb,<>,n %r0, %r28, cas_action /* Did we get it? */
595 ldo 2(%r0), %r28 /* 2nd case */
596 b lws_exit /* Contended... */
597 ldo -EAGAIN(%r0), %r21 /* Spin in userspace */
607 This all works becuse intr_do_signal
608 and schedule both check the return iasq
609 and see that we are on the kernel page
610 so this process is never scheduled off
611 or is ever sent any signal of any sort,
612 thus it is wholly atomic from usrspaces
616 #if defined CONFIG_SMP && ENABLE_LWS_DEBUG
619 stw %r1, 4(%sr2,%r20)
621 /* The load and store could fail */
622 1: ldw 0(%sr3,%r26), %r28
623 sub,<> %r28, %r25, %r0
624 2: stw %r24, 0(%sr3,%r26)
626 stw %r20, 0(%sr2,%r20)
628 /* Clear thread register indicator */
629 stw %r0, 4(%sr2,%r20)
631 /* Return to userspace, set no error */
636 /* Error occurred on load or store */
638 stw %r20, 0(%sr2,%r20)
640 stw %r0, 4(%sr2,%r20)
643 ldo -EFAULT(%r0),%r21 /* set errno */
649 /* Two exception table entries, one for the load,
650 the other for the store. Either return -EFAULT.
651 Each of the entries must be relocated. */
652 .section __ex_table,"aw"
653 ASM_ULONG_INSN (1b - linux_gateway_page), (3b - linux_gateway_page)
654 ASM_ULONG_INSN (2b - linux_gateway_page), (3b - linux_gateway_page)
658 /* Make sure nothing else is placed on this page */
660 END(linux_gateway_page)
661 ENTRY(end_linux_gateway_page)
663 /* Relocate symbols assuming linux_gateway_page is mapped
664 to virtual address 0x0 */
666 #define LWS_ENTRY(_name_) ASM_ULONG_INSN (lws_##_name_ - linux_gateway_page)
671 /* Light-weight-syscall table */
672 /* Start of lws table. */
674 LWS_ENTRY(compare_and_swap32) /* 0 - ELF32 Atomic compare and swap */
675 LWS_ENTRY(compare_and_swap64) /* 1 - ELF64 Atomic compare and swap */
677 /* End of lws table */
680 ENTRY(sys_call_table)
681 #include "syscall_table.S"
686 ENTRY(sys_call_table64)
687 #define SYSCALL_TABLE_64BIT
688 #include "syscall_table.S"
689 END(sys_call_table64)
693 All light-weight-syscall atomic operations
694 will use this set of locks
696 NOTE: The lws_lock_start symbol must be
697 at least 16-byte aligned for safe use
701 .align L1_CACHE_BYTES
702 ENTRY(lws_lock_start)
705 /* Keep locks aligned at 16-bytes */