2 * Architecture-specific unaligned trap handling.
4 * Copyright (C) 1999-2002, 2004 Hewlett-Packard Co
5 * Stephane Eranian <eranian@hpl.hp.com>
6 * David Mosberger-Tang <davidm@hpl.hp.com>
8 * 2002/12/09 Fix rotating register handling (off-by-1 error, missing fr-rotation). Fix
9 * get_rse_reg() to not leak kernel bits to user-level (reading an out-of-frame
10 * stacked register returns an undefined value; it does NOT trigger a
11 * "rsvd register fault").
12 * 2001/10/11 Fix unaligned access to rotating registers in s/w pipelined loops.
13 * 2001/08/13 Correct size of extended floats (float_fsz) from 16 to 10 bytes.
14 * 2001/01/17 Add support emulation of unaligned kernel accesses.
16 #include <linux/kernel.h>
17 #include <linux/sched.h>
18 #include <linux/smp_lock.h>
19 #include <linux/tty.h>
21 #include <asm/intrinsics.h>
22 #include <asm/processor.h>
24 #include <asm/uaccess.h>
25 #include <asm/unaligned.h>
27 extern void die_if_kernel(char *str, struct pt_regs *regs, long err) __attribute__ ((noreturn));
29 #undef DEBUG_UNALIGNED_TRAP
31 #ifdef DEBUG_UNALIGNED_TRAP
32 # define DPRINT(a...) do { printk("%s %u: ", __FUNCTION__, __LINE__); printk (a); } while (0)
33 # define DDUMP(str,vp,len) dump(str, vp, len)
36 dump (const char *str, void *vp, size_t len)
38 unsigned char *cp = vp;
42 for (i = 0; i < len; ++i)
43 printk (" %02x", *cp++);
48 # define DDUMP(str,vp,len)
51 #define IA64_FIRST_STACKED_GR 32
52 #define IA64_FIRST_ROTATING_FR 32
53 #define SIGN_EXT9 0xffffffffffffff00ul
59 * --------|------|---------|
60 * [40-37] | [36] | [35:30] |
61 * --------|------|---------|
62 * 4 | 1 | 6 | = 11 bits
63 * --------------------------
64 * However bits [31:30] are not directly useful to distinguish between
65 * load/store so we can use [35:32] instead, which gives the following
66 * mask ([40:32]) using 9 bits. The 'e' comes from the fact that we defer
67 * checking the m-bit until later in the load/store emulation.
69 #define IA64_OPCODE_MASK 0x1ef
70 #define IA64_OPCODE_SHIFT 32
73 * Table C-28 Integer Load/Store
75 * We ignore [35:32]= 0x6, 0x7, 0xE, 0xF
77 * ld8.fill, st8.fill MUST be aligned because the RNATs are based on
78 * the address (bits [8:3]), so we must failed.
84 #define LDBIAS_OP 0x084
85 #define LDACQ_OP 0x085
86 /* 0x086, 0x087 are not relevant */
87 #define LDCCLR_OP 0x088
88 #define LDCNC_OP 0x089
89 #define LDCCLRACQ_OP 0x08a
91 #define STREL_OP 0x08d
92 /* 0x08e,0x8f are not relevant */
95 * Table C-29 Integer Load +Reg
97 * we use the ld->m (bit [36:36]) field to determine whether or not we have
98 * a load/store of this form.
102 * Table C-30 Integer Load/Store +Imm
104 * We ignore [35:32]= 0x6, 0x7, 0xE, 0xF
106 * ld8.fill, st8.fill must be aligned because the Nat register are based on
107 * the address, so we must fail and the program must be fixed.
109 #define LD_IMM_OP 0x0a0
110 #define LDS_IMM_OP 0x0a1
111 #define LDA_IMM_OP 0x0a2
112 #define LDSA_IMM_OP 0x0a3
113 #define LDBIAS_IMM_OP 0x0a4
114 #define LDACQ_IMM_OP 0x0a5
115 /* 0x0a6, 0xa7 are not relevant */
116 #define LDCCLR_IMM_OP 0x0a8
117 #define LDCNC_IMM_OP 0x0a9
118 #define LDCCLRACQ_IMM_OP 0x0aa
119 #define ST_IMM_OP 0x0ac
120 #define STREL_IMM_OP 0x0ad
121 /* 0x0ae,0xaf are not relevant */
124 * Table C-32 Floating-point Load/Store
127 #define LDFS_OP 0x0c1
128 #define LDFA_OP 0x0c2
129 #define LDFSA_OP 0x0c3
130 /* 0x0c6 is irrelevant */
131 #define LDFCCLR_OP 0x0c8
132 #define LDFCNC_OP 0x0c9
133 /* 0x0cb is irrelevant */
137 * Table C-33 Floating-point Load +Reg
139 * we use the ld->m (bit [36:36]) field to determine whether or not we have
140 * a load/store of this form.
144 * Table C-34 Floating-point Load/Store +Imm
146 #define LDF_IMM_OP 0x0e0
147 #define LDFS_IMM_OP 0x0e1
148 #define LDFA_IMM_OP 0x0e2
149 #define LDFSA_IMM_OP 0x0e3
150 /* 0x0e6 is irrelevant */
151 #define LDFCCLR_IMM_OP 0x0e8
152 #define LDFCNC_IMM_OP 0x0e9
153 #define STF_IMM_OP 0x0ec
156 unsigned long qp:6; /* [0:5] */
157 unsigned long r1:7; /* [6:12] */
158 unsigned long imm:7; /* [13:19] */
159 unsigned long r3:7; /* [20:26] */
160 unsigned long x:1; /* [27:27] */
161 unsigned long hint:2; /* [28:29] */
162 unsigned long x6_sz:2; /* [30:31] */
163 unsigned long x6_op:4; /* [32:35], x6 = x6_sz|x6_op */
164 unsigned long m:1; /* [36:36] */
165 unsigned long op:4; /* [37:40] */
166 unsigned long pad:23; /* [41:63] */
171 UPD_IMMEDIATE, /* ldXZ r1=[r3],imm(9) */
172 UPD_REG /* ldXZ r1=[r3],r2 */
176 * We use tables to keep track of the offsets of registers in the saved state.
177 * This way we save having big switch/case statements.
179 * We use bit 0 to indicate switch_stack or pt_regs.
180 * The offset is simply shifted by 1 bit.
181 * A 2-byte value should be enough to hold any kind of offset
183 * In case the calling convention changes (and thus pt_regs/switch_stack)
184 * simply use RSW instead of RPT or vice-versa.
187 #define RPO(x) ((size_t) &((struct pt_regs *)0)->x)
188 #define RSO(x) ((size_t) &((struct switch_stack *)0)->x)
190 #define RPT(x) (RPO(x) << 1)
191 #define RSW(x) (1| RSO(x)<<1)
193 #define GR_OFFS(x) (gr_info[x]>>1)
194 #define GR_IN_SW(x) (gr_info[x] & 0x1)
196 #define FR_OFFS(x) (fr_info[x]>>1)
197 #define FR_IN_SW(x) (fr_info[x] & 0x1)
199 static u16 gr_info[32]={
200 0, /* r0 is read-only : WE SHOULD NEVER GET THIS */
202 RPT(r1), RPT(r2), RPT(r3),
204 RSW(r4), RSW(r5), RSW(r6), RSW(r7),
206 RPT(r8), RPT(r9), RPT(r10), RPT(r11),
207 RPT(r12), RPT(r13), RPT(r14), RPT(r15),
209 RPT(r16), RPT(r17), RPT(r18), RPT(r19),
210 RPT(r20), RPT(r21), RPT(r22), RPT(r23),
211 RPT(r24), RPT(r25), RPT(r26), RPT(r27),
212 RPT(r28), RPT(r29), RPT(r30), RPT(r31)
215 static u16 fr_info[32]={
216 0, /* constant : WE SHOULD NEVER GET THIS */
217 0, /* constant : WE SHOULD NEVER GET THIS */
219 RSW(f2), RSW(f3), RSW(f4), RSW(f5),
221 RPT(f6), RPT(f7), RPT(f8), RPT(f9),
224 RSW(f12), RSW(f13), RSW(f14),
225 RSW(f15), RSW(f16), RSW(f17), RSW(f18), RSW(f19),
226 RSW(f20), RSW(f21), RSW(f22), RSW(f23), RSW(f24),
227 RSW(f25), RSW(f26), RSW(f27), RSW(f28), RSW(f29),
231 /* Invalidate ALAT entry for integer register REGNO. */
233 invala_gr (int regno)
235 # define F(reg) case reg: ia64_invala_gr(reg); break
238 F( 0); F( 1); F( 2); F( 3); F( 4); F( 5); F( 6); F( 7);
239 F( 8); F( 9); F( 10); F( 11); F( 12); F( 13); F( 14); F( 15);
240 F( 16); F( 17); F( 18); F( 19); F( 20); F( 21); F( 22); F( 23);
241 F( 24); F( 25); F( 26); F( 27); F( 28); F( 29); F( 30); F( 31);
242 F( 32); F( 33); F( 34); F( 35); F( 36); F( 37); F( 38); F( 39);
243 F( 40); F( 41); F( 42); F( 43); F( 44); F( 45); F( 46); F( 47);
244 F( 48); F( 49); F( 50); F( 51); F( 52); F( 53); F( 54); F( 55);
245 F( 56); F( 57); F( 58); F( 59); F( 60); F( 61); F( 62); F( 63);
246 F( 64); F( 65); F( 66); F( 67); F( 68); F( 69); F( 70); F( 71);
247 F( 72); F( 73); F( 74); F( 75); F( 76); F( 77); F( 78); F( 79);
248 F( 80); F( 81); F( 82); F( 83); F( 84); F( 85); F( 86); F( 87);
249 F( 88); F( 89); F( 90); F( 91); F( 92); F( 93); F( 94); F( 95);
250 F( 96); F( 97); F( 98); F( 99); F(100); F(101); F(102); F(103);
251 F(104); F(105); F(106); F(107); F(108); F(109); F(110); F(111);
252 F(112); F(113); F(114); F(115); F(116); F(117); F(118); F(119);
253 F(120); F(121); F(122); F(123); F(124); F(125); F(126); F(127);
258 /* Invalidate ALAT entry for floating-point register REGNO. */
260 invala_fr (int regno)
262 # define F(reg) case reg: ia64_invala_fr(reg); break
265 F( 0); F( 1); F( 2); F( 3); F( 4); F( 5); F( 6); F( 7);
266 F( 8); F( 9); F( 10); F( 11); F( 12); F( 13); F( 14); F( 15);
267 F( 16); F( 17); F( 18); F( 19); F( 20); F( 21); F( 22); F( 23);
268 F( 24); F( 25); F( 26); F( 27); F( 28); F( 29); F( 30); F( 31);
269 F( 32); F( 33); F( 34); F( 35); F( 36); F( 37); F( 38); F( 39);
270 F( 40); F( 41); F( 42); F( 43); F( 44); F( 45); F( 46); F( 47);
271 F( 48); F( 49); F( 50); F( 51); F( 52); F( 53); F( 54); F( 55);
272 F( 56); F( 57); F( 58); F( 59); F( 60); F( 61); F( 62); F( 63);
273 F( 64); F( 65); F( 66); F( 67); F( 68); F( 69); F( 70); F( 71);
274 F( 72); F( 73); F( 74); F( 75); F( 76); F( 77); F( 78); F( 79);
275 F( 80); F( 81); F( 82); F( 83); F( 84); F( 85); F( 86); F( 87);
276 F( 88); F( 89); F( 90); F( 91); F( 92); F( 93); F( 94); F( 95);
277 F( 96); F( 97); F( 98); F( 99); F(100); F(101); F(102); F(103);
278 F(104); F(105); F(106); F(107); F(108); F(109); F(110); F(111);
279 F(112); F(113); F(114); F(115); F(116); F(117); F(118); F(119);
280 F(120); F(121); F(122); F(123); F(124); F(125); F(126); F(127);
285 static inline unsigned long
286 rotate_reg (unsigned long sor, unsigned long rrb, unsigned long reg)
295 set_rse_reg (struct pt_regs *regs, unsigned long r1, unsigned long val, int nat)
297 struct switch_stack *sw = (struct switch_stack *) regs - 1;
298 unsigned long *bsp, *bspstore, *addr, *rnat_addr, *ubs_end;
299 unsigned long *kbs = (void *) current + IA64_RBS_OFFSET;
300 unsigned long rnats, nat_mask;
301 unsigned long on_kbs;
302 long sof = (regs->cr_ifs) & 0x7f;
303 long sor = 8 * ((regs->cr_ifs >> 14) & 0xf);
304 long rrb_gr = (regs->cr_ifs >> 18) & 0x7f;
308 /* this should never happen, as the "rsvd register fault" has higher priority */
309 DPRINT("ignoring write to r%lu; only %lu registers are allocated!\n", r1, sof);
314 ridx = rotate_reg(sor, rrb_gr, ridx);
316 DPRINT("r%lu, sw.bspstore=%lx pt.bspstore=%lx sof=%ld sol=%ld ridx=%ld\n",
317 r1, sw->ar_bspstore, regs->ar_bspstore, sof, (regs->cr_ifs >> 7) & 0x7f, ridx);
319 on_kbs = ia64_rse_num_regs(kbs, (unsigned long *) sw->ar_bspstore);
320 addr = ia64_rse_skip_regs((unsigned long *) sw->ar_bspstore, -sof + ridx);
322 /* the register is on the kernel backing store: easy... */
323 rnat_addr = ia64_rse_rnat_addr(addr);
324 if ((unsigned long) rnat_addr >= sw->ar_bspstore)
325 rnat_addr = &sw->ar_rnat;
326 nat_mask = 1UL << ia64_rse_slot_num(addr);
330 *rnat_addr |= nat_mask;
332 *rnat_addr &= ~nat_mask;
336 if (!user_stack(current, regs)) {
337 DPRINT("ignoring kernel write to r%lu; register isn't on the kernel RBS!", r1);
341 bspstore = (unsigned long *)regs->ar_bspstore;
342 ubs_end = ia64_rse_skip_regs(bspstore, on_kbs);
343 bsp = ia64_rse_skip_regs(ubs_end, -sof);
344 addr = ia64_rse_skip_regs(bsp, ridx);
346 DPRINT("ubs_end=%p bsp=%p addr=%p\n", (void *) ubs_end, (void *) bsp, (void *) addr);
348 ia64_poke(current, sw, (unsigned long) ubs_end, (unsigned long) addr, val);
350 rnat_addr = ia64_rse_rnat_addr(addr);
352 ia64_peek(current, sw, (unsigned long) ubs_end, (unsigned long) rnat_addr, &rnats);
353 DPRINT("rnat @%p = 0x%lx nat=%d old nat=%ld\n",
354 (void *) rnat_addr, rnats, nat, (rnats >> ia64_rse_slot_num(addr)) & 1);
356 nat_mask = 1UL << ia64_rse_slot_num(addr);
361 ia64_poke(current, sw, (unsigned long) ubs_end, (unsigned long) rnat_addr, rnats);
363 DPRINT("rnat changed to @%p = 0x%lx\n", (void *) rnat_addr, rnats);
368 get_rse_reg (struct pt_regs *regs, unsigned long r1, unsigned long *val, int *nat)
370 struct switch_stack *sw = (struct switch_stack *) regs - 1;
371 unsigned long *bsp, *addr, *rnat_addr, *ubs_end, *bspstore;
372 unsigned long *kbs = (void *) current + IA64_RBS_OFFSET;
373 unsigned long rnats, nat_mask;
374 unsigned long on_kbs;
375 long sof = (regs->cr_ifs) & 0x7f;
376 long sor = 8 * ((regs->cr_ifs >> 14) & 0xf);
377 long rrb_gr = (regs->cr_ifs >> 18) & 0x7f;
381 /* read of out-of-frame register returns an undefined value; 0 in our case. */
382 DPRINT("ignoring read from r%lu; only %lu registers are allocated!\n", r1, sof);
387 ridx = rotate_reg(sor, rrb_gr, ridx);
389 DPRINT("r%lu, sw.bspstore=%lx pt.bspstore=%lx sof=%ld sol=%ld ridx=%ld\n",
390 r1, sw->ar_bspstore, regs->ar_bspstore, sof, (regs->cr_ifs >> 7) & 0x7f, ridx);
392 on_kbs = ia64_rse_num_regs(kbs, (unsigned long *) sw->ar_bspstore);
393 addr = ia64_rse_skip_regs((unsigned long *) sw->ar_bspstore, -sof + ridx);
395 /* the register is on the kernel backing store: easy... */
398 rnat_addr = ia64_rse_rnat_addr(addr);
399 if ((unsigned long) rnat_addr >= sw->ar_bspstore)
400 rnat_addr = &sw->ar_rnat;
401 nat_mask = 1UL << ia64_rse_slot_num(addr);
402 *nat = (*rnat_addr & nat_mask) != 0;
407 if (!user_stack(current, regs)) {
408 DPRINT("ignoring kernel read of r%lu; register isn't on the RBS!", r1);
412 bspstore = (unsigned long *)regs->ar_bspstore;
413 ubs_end = ia64_rse_skip_regs(bspstore, on_kbs);
414 bsp = ia64_rse_skip_regs(ubs_end, -sof);
415 addr = ia64_rse_skip_regs(bsp, ridx);
417 DPRINT("ubs_end=%p bsp=%p addr=%p\n", (void *) ubs_end, (void *) bsp, (void *) addr);
419 ia64_peek(current, sw, (unsigned long) ubs_end, (unsigned long) addr, val);
422 rnat_addr = ia64_rse_rnat_addr(addr);
423 nat_mask = 1UL << ia64_rse_slot_num(addr);
425 DPRINT("rnat @%p = 0x%lx\n", (void *) rnat_addr, rnats);
427 ia64_peek(current, sw, (unsigned long) ubs_end, (unsigned long) rnat_addr, &rnats);
428 *nat = (rnats & nat_mask) != 0;
441 setreg (unsigned long regnum, unsigned long val, int nat, struct pt_regs *regs)
443 struct switch_stack *sw = (struct switch_stack *) regs - 1;
445 unsigned long bitmask;
449 * First takes care of stacked registers
451 if (regnum >= IA64_FIRST_STACKED_GR) {
452 set_rse_reg(regs, regnum, val, nat);
457 * Using r0 as a target raises a General Exception fault which has higher priority
458 * than the Unaligned Reference fault.
462 * Now look at registers in [0-31] range and init correct UNAT
464 if (GR_IN_SW(regnum)) {
465 addr = (unsigned long)sw;
468 addr = (unsigned long)regs;
469 unat = &sw->caller_unat;
471 DPRINT("tmp_base=%lx switch_stack=%s offset=%d\n",
472 addr, unat==&sw->ar_unat ? "yes":"no", GR_OFFS(regnum));
474 * add offset from base of struct
477 addr += GR_OFFS(regnum);
479 *(unsigned long *)addr = val;
482 * We need to clear the corresponding UNAT bit to fully emulate the load
483 * UNAT bit_pos = GR[r3]{8:3} form EAS-2.4
485 bitmask = 1UL << (addr >> 3 & 0x3f);
486 DPRINT("*0x%lx=0x%lx NaT=%d prev_unat @%p=%lx\n", addr, val, nat, (void *) unat, *unat);
492 DPRINT("*0x%lx=0x%lx NaT=%d new unat: %p=%lx\n", addr, val, nat, (void *) unat,*unat);
496 * Return the (rotated) index for floating point register REGNUM (REGNUM must be in the
497 * range from 32-127, result is in the range from 0-95.
499 static inline unsigned long
500 fph_index (struct pt_regs *regs, long regnum)
502 unsigned long rrb_fr = (regs->cr_ifs >> 25) & 0x7f;
503 return rotate_reg(96, rrb_fr, (regnum - IA64_FIRST_ROTATING_FR));
507 setfpreg (unsigned long regnum, struct ia64_fpreg *fpval, struct pt_regs *regs)
509 struct switch_stack *sw = (struct switch_stack *)regs - 1;
513 * From EAS-2.5: FPDisableFault has higher priority than Unaligned
514 * Fault. Thus, when we get here, we know the partition is enabled.
515 * To update f32-f127, there are three choices:
517 * (1) save f32-f127 to thread.fph and update the values there
518 * (2) use a gigantic switch statement to directly access the registers
519 * (3) generate code on the fly to update the desired register
521 * For now, we are using approach (1).
523 if (regnum >= IA64_FIRST_ROTATING_FR) {
524 ia64_sync_fph(current);
525 current->thread.fph[fph_index(regs, regnum)] = *fpval;
528 * pt_regs or switch_stack ?
530 if (FR_IN_SW(regnum)) {
531 addr = (unsigned long)sw;
533 addr = (unsigned long)regs;
536 DPRINT("tmp_base=%lx offset=%d\n", addr, FR_OFFS(regnum));
538 addr += FR_OFFS(regnum);
539 *(struct ia64_fpreg *)addr = *fpval;
542 * mark the low partition as being used now
544 * It is highly unlikely that this bit is not already set, but
545 * let's do it for safety.
547 regs->cr_ipsr |= IA64_PSR_MFL;
552 * Those 2 inline functions generate the spilled versions of the constant floating point
553 * registers which can be used with stfX
556 float_spill_f0 (struct ia64_fpreg *final)
558 ia64_stf_spill(final, 0);
562 float_spill_f1 (struct ia64_fpreg *final)
564 ia64_stf_spill(final, 1);
568 getfpreg (unsigned long regnum, struct ia64_fpreg *fpval, struct pt_regs *regs)
570 struct switch_stack *sw = (struct switch_stack *) regs - 1;
574 * From EAS-2.5: FPDisableFault has higher priority than
575 * Unaligned Fault. Thus, when we get here, we know the partition is
578 * When regnum > 31, the register is still live and we need to force a save
579 * to current->thread.fph to get access to it. See discussion in setfpreg()
580 * for reasons and other ways of doing this.
582 if (regnum >= IA64_FIRST_ROTATING_FR) {
583 ia64_flush_fph(current);
584 *fpval = current->thread.fph[fph_index(regs, regnum)];
587 * f0 = 0.0, f1= 1.0. Those registers are constant and are thus
588 * not saved, we must generate their spilled form on the fly
592 float_spill_f0(fpval);
595 float_spill_f1(fpval);
599 * pt_regs or switch_stack ?
601 addr = FR_IN_SW(regnum) ? (unsigned long)sw
602 : (unsigned long)regs;
604 DPRINT("is_sw=%d tmp_base=%lx offset=0x%x\n",
605 FR_IN_SW(regnum), addr, FR_OFFS(regnum));
607 addr += FR_OFFS(regnum);
608 *fpval = *(struct ia64_fpreg *)addr;
615 getreg (unsigned long regnum, unsigned long *val, int *nat, struct pt_regs *regs)
617 struct switch_stack *sw = (struct switch_stack *) regs - 1;
618 unsigned long addr, *unat;
620 if (regnum >= IA64_FIRST_STACKED_GR) {
621 get_rse_reg(regs, regnum, val, nat);
626 * take care of r0 (read-only always evaluate to 0)
636 * Now look at registers in [0-31] range and init correct UNAT
638 if (GR_IN_SW(regnum)) {
639 addr = (unsigned long)sw;
642 addr = (unsigned long)regs;
643 unat = &sw->caller_unat;
646 DPRINT("addr_base=%lx offset=0x%x\n", addr, GR_OFFS(regnum));
648 addr += GR_OFFS(regnum);
650 *val = *(unsigned long *)addr;
653 * do it only when requested
656 *nat = (*unat >> (addr >> 3 & 0x3f)) & 0x1UL;
660 emulate_load_updates (update_t type, load_store_t ld, struct pt_regs *regs, unsigned long ifa)
664 * Given the way we handle unaligned speculative loads, we should
665 * not get to this point in the code but we keep this sanity check,
668 if (ld.x6_op == 1 || ld.x6_op == 3) {
669 printk(KERN_ERR "%s: register update on speculative load, error\n", __FUNCTION__);
670 die_if_kernel("unaligned reference on speculative load with register update\n",
676 * at this point, we know that the base register to update is valid i.e.,
679 if (type == UPD_IMMEDIATE) {
683 * Load +Imm: ldXZ r1=[r3],imm(9)
686 * form imm9: [13:19] contain the first 7 bits
688 imm = ld.x << 7 | ld.imm;
691 * sign extend (1+8bits) if m set
693 if (ld.m) imm |= SIGN_EXT9;
696 * ifa == r3 and we know that the NaT bit on r3 was clear so
697 * we can directly use ifa.
701 setreg(ld.r3, ifa, 0, regs);
703 DPRINT("ld.x=%d ld.m=%d imm=%ld r3=0x%lx\n", ld.x, ld.m, imm, ifa);
710 * Load +Reg Opcode: ldXZ r1=[r3],r2
712 * Note: that we update r3 even in the case of ldfX.a
713 * (where the load does not happen)
715 * The way the load algorithm works, we know that r3 does not
716 * have its NaT bit set (would have gotten NaT consumption
717 * before getting the unaligned fault). So we can use ifa
718 * which equals r3 at this point.
721 * The above statement holds ONLY because we know that we
722 * never reach this code when trying to do a ldX.s.
723 * If we ever make it to here on an ldfX.s then
725 getreg(ld.imm, &r2, &nat_r2, regs);
730 * propagate Nat r2 -> r3
732 setreg(ld.r3, ifa, nat_r2, regs);
734 DPRINT("imm=%d r2=%ld r3=0x%lx nat_r2=%d\n",ld.imm, r2, ifa, nat_r2);
740 emulate_load_int (unsigned long ifa, load_store_t ld, struct pt_regs *regs)
742 unsigned int len = 1 << ld.x6_sz;
743 unsigned long val = 0;
746 * r0, as target, doesn't need to be checked because Illegal Instruction
747 * faults have higher priority than unaligned faults.
749 * r0 cannot be found as the base as it would never generate an
750 * unaligned reference.
754 * ldX.a we will emulate load and also invalidate the ALAT entry.
755 * See comment below for explanation on how we handle ldX.a
758 if (len != 2 && len != 4 && len != 8) {
759 DPRINT("unknown size: x6=%d\n", ld.x6_sz);
762 /* this assumes little-endian byte-order: */
763 if (copy_from_user(&val, (void __user *) ifa, len))
765 setreg(ld.r1, val, 0, regs);
768 * check for updates on any kind of loads
770 if (ld.op == 0x5 || ld.m)
771 emulate_load_updates(ld.op == 0x5 ? UPD_IMMEDIATE: UPD_REG, ld, regs, ifa);
774 * handling of various loads (based on EAS2.4):
776 * ldX.acq (ordered load):
777 * - acquire semantics would have been used, so force fence instead.
779 * ldX.c.clr (check load and clear):
780 * - if we get to this handler, it's because the entry was not in the ALAT.
781 * Therefore the operation reverts to a normal load
783 * ldX.c.nc (check load no clear):
784 * - same as previous one
786 * ldX.c.clr.acq (ordered check load and clear):
787 * - same as above for c.clr part. The load needs to have acquire semantics. So
788 * we use the fence semantics which is stronger and thus ensures correctness.
790 * ldX.a (advanced load):
791 * - suppose ldX.a r1=[r3]. If we get to the unaligned trap it's because the
792 * address doesn't match requested size alignment. This means that we would
793 * possibly need more than one load to get the result.
795 * The load part can be handled just like a normal load, however the difficult
796 * part is to get the right thing into the ALAT. The critical piece of information
797 * in the base address of the load & size. To do that, a ld.a must be executed,
798 * clearly any address can be pushed into the table by using ld1.a r1=[r3]. Now
799 * if we use the same target register, we will be okay for the check.a instruction.
800 * If we look at the store, basically a stX [r3]=r1 checks the ALAT for any entry
801 * which would overlap within [r3,r3+X] (the size of the load was store in the
802 * ALAT). If such an entry is found the entry is invalidated. But this is not good
803 * enough, take the following example:
807 * Could be emulated by doing:
809 * store to temporary;
811 * store & shift to temporary;
813 * store & shift to temporary;
815 * store & shift to temporary;
818 * So in this case, you would get the right value is r1 but the wrong info in
819 * the ALAT. Notice that you could do it in reverse to finish with address 3
820 * but you would still get the size wrong. To get the size right, one needs to
821 * execute exactly the same kind of load. You could do it from a aligned
822 * temporary location, but you would get the address wrong.
824 * So no matter what, it is not possible to emulate an advanced load
825 * correctly. But is that really critical ?
827 * We will always convert ld.a into a normal load with ALAT invalidated. This
828 * will enable compiler to do optimization where certain code path after ld.a
829 * is not required to have ld.c/chk.a, e.g., code path with no intervening stores.
831 * If there is a store after the advanced load, one must either do a ld.c.* or
832 * chk.a.* to reuse the value stored in the ALAT. Both can "fail" (meaning no
833 * entry found in ALAT), and that's perfectly ok because:
835 * - ld.c.*, if the entry is not present a normal load is executed
836 * - chk.a.*, if the entry is not present, execution jumps to recovery code
838 * In either case, the load can be potentially retried in another form.
840 * ALAT must be invalidated for the register (so that chk.a or ld.c don't pick
841 * up a stale entry later). The register base update MUST also be performed.
845 * when the load has the .acq completer then
846 * use ordering fence.
848 if (ld.x6_op == 0x5 || ld.x6_op == 0xa)
852 * invalidate ALAT entry in case of advanced load
861 emulate_store_int (unsigned long ifa, load_store_t ld, struct pt_regs *regs)
864 unsigned int len = 1 << ld.x6_sz;
867 * if we get to this handler, Nat bits on both r3 and r2 have already
868 * been checked. so we don't need to do it
870 * extract the value to be stored
872 getreg(ld.imm, &r2, NULL, regs);
875 * we rely on the macros in unaligned.h for now i.e.,
876 * we let the compiler figure out how to read memory gracefully.
878 * We need this switch/case because the way the inline function
879 * works. The code is optimized by the compiler and looks like
880 * a single switch/case.
882 DPRINT("st%d [%lx]=%lx\n", len, ifa, r2);
884 if (len != 2 && len != 4 && len != 8) {
885 DPRINT("unknown size: x6=%d\n", ld.x6_sz);
889 /* this assumes little-endian byte-order: */
890 if (copy_to_user((void __user *) ifa, &r2, len))
897 * ld.r3 can never be r0, because r0 would not generate an
904 * form imm9: [12:6] contain first 7bits
906 imm = ld.x << 7 | ld.r1;
908 * sign extend (8bits) if m set
910 if (ld.m) imm |= SIGN_EXT9;
912 * ifa == r3 (NaT is necessarily cleared)
916 DPRINT("imm=%lx r3=%lx\n", imm, ifa);
918 setreg(ld.r3, ifa, 0, regs);
921 * we don't have alat_invalidate_multiple() so we need
922 * to do the complete flush :-<<
927 * stX.rel: use fence instead of release
936 * floating point operations sizes in bytes
938 static const unsigned char float_fsz[4]={
939 10, /* extended precision (e) */
941 4, /* single precision (s) */
942 8 /* double precision (d) */
946 mem2float_extended (struct ia64_fpreg *init, struct ia64_fpreg *final)
950 ia64_stf_spill(final, 6);
954 mem2float_integer (struct ia64_fpreg *init, struct ia64_fpreg *final)
958 ia64_stf_spill(final, 6);
962 mem2float_single (struct ia64_fpreg *init, struct ia64_fpreg *final)
966 ia64_stf_spill(final, 6);
970 mem2float_double (struct ia64_fpreg *init, struct ia64_fpreg *final)
974 ia64_stf_spill(final, 6);
978 float2mem_extended (struct ia64_fpreg *init, struct ia64_fpreg *final)
980 ia64_ldf_fill(6, init);
986 float2mem_integer (struct ia64_fpreg *init, struct ia64_fpreg *final)
988 ia64_ldf_fill(6, init);
994 float2mem_single (struct ia64_fpreg *init, struct ia64_fpreg *final)
996 ia64_ldf_fill(6, init);
1002 float2mem_double (struct ia64_fpreg *init, struct ia64_fpreg *final)
1004 ia64_ldf_fill(6, init);
1006 ia64_stfd(final, 6);
1010 emulate_load_floatpair (unsigned long ifa, load_store_t ld, struct pt_regs *regs)
1012 struct ia64_fpreg fpr_init[2];
1013 struct ia64_fpreg fpr_final[2];
1014 unsigned long len = float_fsz[ld.x6_sz];
1017 * fr0 & fr1 don't need to be checked because Illegal Instruction faults have
1018 * higher priority than unaligned faults.
1020 * r0 cannot be found as the base as it would never generate an unaligned
1025 * make sure we get clean buffers
1027 memset(&fpr_init, 0, sizeof(fpr_init));
1028 memset(&fpr_final, 0, sizeof(fpr_final));
1031 * ldfpX.a: we don't try to emulate anything but we must
1032 * invalidate the ALAT entry and execute updates, if any.
1034 if (ld.x6_op != 0x2) {
1036 * This assumes little-endian byte-order. Note that there is no "ldfpe"
1039 if (copy_from_user(&fpr_init[0], (void __user *) ifa, len)
1040 || copy_from_user(&fpr_init[1], (void __user *) (ifa + len), len))
1043 DPRINT("ld.r1=%d ld.imm=%d x6_sz=%d\n", ld.r1, ld.imm, ld.x6_sz);
1044 DDUMP("frp_init =", &fpr_init, 2*len);
1047 * Could optimize inlines by using ldfpX & 2 spills
1049 switch( ld.x6_sz ) {
1051 mem2float_extended(&fpr_init[0], &fpr_final[0]);
1052 mem2float_extended(&fpr_init[1], &fpr_final[1]);
1055 mem2float_integer(&fpr_init[0], &fpr_final[0]);
1056 mem2float_integer(&fpr_init[1], &fpr_final[1]);
1059 mem2float_single(&fpr_init[0], &fpr_final[0]);
1060 mem2float_single(&fpr_init[1], &fpr_final[1]);
1063 mem2float_double(&fpr_init[0], &fpr_final[0]);
1064 mem2float_double(&fpr_init[1], &fpr_final[1]);
1067 DDUMP("fpr_final =", &fpr_final, 2*len);
1071 * A possible optimization would be to drop fpr_final and directly
1072 * use the storage from the saved context i.e., the actual final
1073 * destination (pt_regs, switch_stack or thread structure).
1075 setfpreg(ld.r1, &fpr_final[0], regs);
1076 setfpreg(ld.imm, &fpr_final[1], regs);
1080 * Check for updates: only immediate updates are available for this
1085 * the immediate is implicit given the ldsz of the operation:
1086 * single: 8 (2x4) and for all others it's 16 (2x8)
1092 * the fact that we force the NaT of r3 to zero is ONLY valid
1093 * as long as we don't come here with a ldfpX.s.
1094 * For this reason we keep this sanity check
1096 if (ld.x6_op == 1 || ld.x6_op == 3)
1097 printk(KERN_ERR "%s: register update on speculative load pair, error\n",
1100 setreg(ld.r3, ifa, 0, regs);
1104 * Invalidate ALAT entries, if any, for both registers.
1106 if (ld.x6_op == 0x2) {
1115 emulate_load_float (unsigned long ifa, load_store_t ld, struct pt_regs *regs)
1117 struct ia64_fpreg fpr_init;
1118 struct ia64_fpreg fpr_final;
1119 unsigned long len = float_fsz[ld.x6_sz];
1122 * fr0 & fr1 don't need to be checked because Illegal Instruction
1123 * faults have higher priority than unaligned faults.
1125 * r0 cannot be found as the base as it would never generate an
1126 * unaligned reference.
1130 * make sure we get clean buffers
1132 memset(&fpr_init,0, sizeof(fpr_init));
1133 memset(&fpr_final,0, sizeof(fpr_final));
1136 * ldfX.a we don't try to emulate anything but we must
1137 * invalidate the ALAT entry.
1138 * See comments in ldX for descriptions on how the various loads are handled.
1140 if (ld.x6_op != 0x2) {
1141 if (copy_from_user(&fpr_init, (void __user *) ifa, len))
1144 DPRINT("ld.r1=%d x6_sz=%d\n", ld.r1, ld.x6_sz);
1145 DDUMP("fpr_init =", &fpr_init, len);
1147 * we only do something for x6_op={0,8,9}
1149 switch( ld.x6_sz ) {
1151 mem2float_extended(&fpr_init, &fpr_final);
1154 mem2float_integer(&fpr_init, &fpr_final);
1157 mem2float_single(&fpr_init, &fpr_final);
1160 mem2float_double(&fpr_init, &fpr_final);
1163 DDUMP("fpr_final =", &fpr_final, len);
1167 * A possible optimization would be to drop fpr_final and directly
1168 * use the storage from the saved context i.e., the actual final
1169 * destination (pt_regs, switch_stack or thread structure).
1171 setfpreg(ld.r1, &fpr_final, regs);
1175 * check for updates on any loads
1177 if (ld.op == 0x7 || ld.m)
1178 emulate_load_updates(ld.op == 0x7 ? UPD_IMMEDIATE: UPD_REG, ld, regs, ifa);
1181 * invalidate ALAT entry in case of advanced floating point loads
1183 if (ld.x6_op == 0x2)
1191 emulate_store_float (unsigned long ifa, load_store_t ld, struct pt_regs *regs)
1193 struct ia64_fpreg fpr_init;
1194 struct ia64_fpreg fpr_final;
1195 unsigned long len = float_fsz[ld.x6_sz];
1198 * make sure we get clean buffers
1200 memset(&fpr_init,0, sizeof(fpr_init));
1201 memset(&fpr_final,0, sizeof(fpr_final));
1204 * if we get to this handler, Nat bits on both r3 and r2 have already
1205 * been checked. so we don't need to do it
1207 * extract the value to be stored
1209 getfpreg(ld.imm, &fpr_init, regs);
1211 * during this step, we extract the spilled registers from the saved
1212 * context i.e., we refill. Then we store (no spill) to temporary
1215 switch( ld.x6_sz ) {
1217 float2mem_extended(&fpr_init, &fpr_final);
1220 float2mem_integer(&fpr_init, &fpr_final);
1223 float2mem_single(&fpr_init, &fpr_final);
1226 float2mem_double(&fpr_init, &fpr_final);
1229 DPRINT("ld.r1=%d x6_sz=%d\n", ld.r1, ld.x6_sz);
1230 DDUMP("fpr_init =", &fpr_init, len);
1231 DDUMP("fpr_final =", &fpr_final, len);
1233 if (copy_to_user((void __user *) ifa, &fpr_final, len))
1237 * stfX [r3]=r2,imm(9)
1240 * ld.r3 can never be r0, because r0 would not generate an
1247 * form imm9: [12:6] contain first 7bits
1249 imm = ld.x << 7 | ld.r1;
1251 * sign extend (8bits) if m set
1256 * ifa == r3 (NaT is necessarily cleared)
1260 DPRINT("imm=%lx r3=%lx\n", imm, ifa);
1262 setreg(ld.r3, ifa, 0, regs);
1265 * we don't have alat_invalidate_multiple() so we need
1266 * to do the complete flush :-<<
1274 * Make sure we log the unaligned access, so that user/sysadmin can notice it and
1275 * eventually fix the program. However, we don't want to do that for every access so we
1276 * pace it with jiffies. This isn't really MP-safe, but it doesn't really have to be
1280 within_logging_rate_limit (void)
1282 static unsigned long count, last_time;
1284 if (jiffies - last_time > 5*HZ)
1287 last_time = jiffies;
1295 ia64_handle_unaligned (unsigned long ifa, struct pt_regs *regs)
1297 struct ia64_psr *ipsr = ia64_psr(regs);
1298 mm_segment_t old_fs = get_fs();
1299 unsigned long bundle[2];
1300 unsigned long opcode;
1302 const struct exception_table_entry *eh = NULL;
1309 if (ia64_psr(regs)->be) {
1310 /* we don't support big-endian accesses */
1311 die_if_kernel("big-endian unaligned accesses are not supported", regs, 0);
1316 * Treat kernel accesses for which there is an exception handler entry the same as
1317 * user-level unaligned accesses. Otherwise, a clever program could trick this
1318 * handler into reading an arbitrary kernel addresses...
1320 if (!user_mode(regs))
1321 eh = search_exception_tables(regs->cr_iip + ia64_psr(regs)->ri);
1322 if (user_mode(regs) || eh) {
1323 if ((current->thread.flags & IA64_THREAD_UAC_SIGBUS) != 0)
1326 if (!(current->thread.flags & IA64_THREAD_UAC_NOPRINT)
1327 && within_logging_rate_limit())
1329 char buf[200]; /* comm[] is at most 16 bytes... */
1332 len = sprintf(buf, "%s(%d): unaligned access to 0x%016lx, "
1333 "ip=0x%016lx\n\r", current->comm, current->pid,
1334 ifa, regs->cr_iip + ipsr->ri);
1336 * Don't call tty_write_message() if we're in the kernel; we might
1337 * be holding locks...
1339 if (user_mode(regs))
1340 tty_write_message(current->signal->tty, buf);
1341 buf[len-1] = '\0'; /* drop '\r' */
1342 printk(KERN_WARNING "%s", buf); /* watch for command names containing %s */
1345 if (within_logging_rate_limit())
1346 printk(KERN_WARNING "kernel unaligned access to 0x%016lx, ip=0x%016lx\n",
1347 ifa, regs->cr_iip + ipsr->ri);
1351 DPRINT("iip=%lx ifa=%lx isr=%lx (ei=%d, sp=%d)\n",
1352 regs->cr_iip, ifa, regs->cr_ipsr, ipsr->ri, ipsr->it);
1354 if (__copy_from_user(bundle, (void __user *) regs->cr_iip, 16))
1358 * extract the instruction from the bundle given the slot number
1361 case 0: u.l = (bundle[0] >> 5); break;
1362 case 1: u.l = (bundle[0] >> 46) | (bundle[1] << 18); break;
1363 case 2: u.l = (bundle[1] >> 23); break;
1365 opcode = (u.l >> IA64_OPCODE_SHIFT) & IA64_OPCODE_MASK;
1367 DPRINT("opcode=%lx ld.qp=%d ld.r1=%d ld.imm=%d ld.r3=%d ld.x=%d ld.hint=%d "
1368 "ld.x6=0x%x ld.m=%d ld.op=%d\n", opcode, u.insn.qp, u.insn.r1, u.insn.imm,
1369 u.insn.r3, u.insn.x, u.insn.hint, u.insn.x6_sz, u.insn.m, u.insn.op);
1373 * Notice that the switch statement DOES not cover all possible instructions
1374 * that DO generate unaligned references. This is made on purpose because for some
1375 * instructions it DOES NOT make sense to try and emulate the access. Sometimes it
1376 * is WRONG to try and emulate. Here is a list of instruction we don't emulate i.e.,
1377 * the program will get a signal and die:
1382 * Reason: RNATs are based on addresses
1385 * Reason: ld16 and st16 are supposed to occur in a single
1392 * Reason: ATOMIC operations cannot be emulated properly using multiple
1395 * speculative loads:
1397 * Reason: side effects, code must be ready to deal with failure so simpler
1398 * to let the load fail.
1399 * ---------------------------------------------------------------------------------
1402 * I would like to get rid of this switch case and do something
1409 /* oops, really a semaphore op (cmpxchg, etc) */
1418 * The instruction will be retried with deferred exceptions turned on, and
1419 * we should get Nat bit installed
1421 * IMPORTANT: When PSR_ED is set, the register & immediate update forms
1422 * are actually executed even though the operation failed. So we don't
1423 * need to take care of this.
1425 DPRINT("forcing PSR_ED\n");
1426 regs->cr_ipsr |= IA64_PSR_ED;
1437 /* oops, really a semaphore op (cmpxchg, etc) */
1446 case LDCCLRACQ_IMM_OP:
1447 ret = emulate_load_int(ifa, u.insn, regs);
1453 /* oops, really a semaphore op (cmpxchg, etc) */
1458 ret = emulate_store_int(ifa, u.insn, regs);
1467 case LDFCCLR_IMM_OP:
1470 ret = emulate_load_floatpair(ifa, u.insn, regs);
1472 ret = emulate_load_float(ifa, u.insn, regs);
1477 ret = emulate_store_float(ifa, u.insn, regs);
1483 DPRINT("ret=%d\n", ret);
1489 * given today's architecture this case is not likely to happen because a
1490 * memory access instruction (M) can never be in the last slot of a
1491 * bundle. But let's keep it for now.
1494 ipsr->ri = (ipsr->ri + 1) & 0x3;
1496 DPRINT("ipsr->ri=%d iip=%lx\n", ipsr->ri, regs->cr_iip);
1498 set_fs(old_fs); /* restore original address limit */
1502 /* something went wrong... */
1503 if (!user_mode(regs)) {
1505 ia64_handle_exception(regs, eh);
1508 die_if_kernel("error during unaligned kernel access\n", regs, ret);
1512 si.si_signo = SIGBUS;
1514 si.si_code = BUS_ADRALN;
1515 si.si_addr = (void __user *) ifa;
1519 force_sig_info(SIGBUS, &si, current);