//++ // // Module Name: // trap.s // // Abstract: // Low level interruption handlers // // Author: // Bernard Lint 12-Jun-1995 // // Environment: // Kernel mode only // // Revision History: // // // Open Design Issues: // //-- #if DBG // interruption logging is enabled in checked and free builds #define INTERRUPTION_LOGGING 1 #endif // DBG #include "ksia64.h" .file "trap.s" .explicit // // Globals imported: // PublicFunction(KeBugCheckEx) PublicFunction(KiApcInterrupt) PublicFunction(KiCheckForSoftwareInterrupt) PublicFunction(KiDispatchException) PublicFunction(KiExternalInterruptHandler) PublicFunction(KiFloatTrap) PublicFunction(KiFloatFault) PublicFunction(KiGeneralExceptions) PublicFunction(KiUnimplementedAddressTrap) PublicFunction(KiNatExceptions) PublicFunction(KiMemoryFault) PublicFunction(KiOtherBreakException) PublicFunction(KiPanicHandler) PublicFunction(KiSingleStep) PublicFunction(KiUnalignedFault) PublicFunction(PsConvertToGuiThread) PublicFunction(ExpInterlockedPopEntrySListFault) PublicFunction(KiDebugFault) PublicFunction(KeSetLowPsrBit) PublicFunction(KiIA32ExceptionVectorHandler) PublicFunction(KiIA32InterruptionVectorHandler) PublicFunction(KiIA32InterceptionVectorHandler) .global KiSystemServiceHandler .global KeServiceDescriptorTableShadow .global KeGdiFlushUserBatch .global KdDebuggerEnabled .global MiDefaultPpe .global MiNatPte .global KiIA64RseNumOfMaxDirty #include "icecap.h" #ifdef _CAPKERN PublicFunction(_CAP_ThreadID) PublicFunction(_CAP_SetCPU) #endif // For Conditional Interrupt Logging #define UserSystemcallBit 61 #define ExternalInterruptBit 62 .global KiVectorLogMask // // Register aliases used throughout the entire module // // // Banked general registers // // h16-h23 can only be used when psr.ic=1. // // h24-h31 can only be used when psr.ic=0 (these are reserved for tlb // and pal/machine check handlers when psr.ic=1). // // // Shown below are aliases of bank 0 registers used in the low level handlers // by macros ALLOCATE_TRAP_FRAME, SAVE_INTERRUPTION_RESOURCES, and // RETURN_FROM_INTERRUPTION. When the code in the macros are changes, these // register aliases must be reviewed. // rHIPSR = h16 rHpT2 = h16 rHIIPA = h17 rHRSC = h17 rHDfhPFS = h17 // used to preserve pfs in KiDisabledFpRegisterVector rHIIP = h18 rHFPSR = h18 rHRNAT2 = h18 rHOldPreds = h19 rHBrp = h19 rHInitBStore= h19 rHIFS = h20 rHPFS = h20 rHBSP = h20 rHISR = h21 rHUNAT = h21 rHBSPSTORE = h21 rHpT3 = h21 rHSp = h22 rHDfhBrp = h22 // used to preserve brp in KiDisabledFpRegisterVector rHRNAT = h22 rHpT4 = h22 rHpT1 = h23 rTH3 = h24 rHHandler = h25 rTH1 = h26 rTH2 = h27 rHIIM = h28 rHIFA = h28 rHEPCVa = h29 rHVector = h29 rHEPCVa2 = h30 rPanicCode = h30 rTH4 = h31 // // General registers used through out module // pApc = ps0 // User Apc Pending pUser = ps1 // mode on entry was user pKrnl = ps2 // mode on entry was kernel pUstk = ps3 pKstk = ps4 pEM = ps5 // EM ISA on kernel entry pIA = ps6 // X86 ISA on kernel entry pKDbg = ps7 // Kernel debug Active pUDbg = ps8 // Kernel debug Active // // Kernel registers used through out module // rkHandler = k6 // specific exception handler // // Macro definitions for this module only // // // Define vector/exception entry/exit macros. // N.B. All HANDLER_ENTRY functions go into .nsc section with // KiNormalSystemCall being the first. // #define HANDLER_ENTRY(Name) \ .##global Name; \ .##proc Name; \ Name:: #define HANDLER_ENTRY_EX(Name, Handler) \ .##global Name; \ .##proc Name; \ .##type Handler, @function; \ .##personality Handler; \ Name:: #define VECTOR_ENTRY(Offset, Name, Extra0) \ .##org Offset; \ .##global Name; \ .##proc Name; \ Name:: #define VECTOR_EXIT(Name) \ .##endp Name #define HANDLER_EXIT(Name) \ .##endp Name //++ // Routine: // // IO_END_OF_INTERRUPT(rVector,rT1,rT2,pEOI) // // Routine Description: // // HalEOITable Entry corresponding to the vectorNo is tested. // If the entry is nonzero, then vectorNo is stored to the location // specified in the entry. If the entry is zero, return. // // Arguements: // // // Notes: // // MS preprocessor requires /* */ style comments // //-- #define IO_END_OF_INTERRUPT(rVector,rT1,rT2,pEOI) ;\ movl rT1 = KiPcr+PcEOITable ;\ ;; ;\ ld8 rT1 = [rT1] ;\ ;; ;\ shladd rT2 = rVector,3,rT1 ;\ ;; ;\ ld8 rT1 = [rT2] ;\ ;; ;\ cmp.ne pEOI = zero, rT1 ;\ ;; ;\ (pEOI) st4.rel [rT1] = rVector //++ // Routine: // // VECTOR_CALL_HANDLER(Handler, SpecificHandler) // // Routine Description: // // Common code for transfer to heavyweight handlers from // interruption vectors. Put RSE in store intensive mode, // cover current frame and call handler. // // Arguments: // // Handler: First level handler for this vector // SpecificHandler: Specific handler to be called by the generic // exception handler. // // Return Value: // // None // // Notes: // Uses just the kernel banked registers (h16-h31) // // MS preprocessor requires /* */ style comments //-- #define VECTOR_CALL_HANDLER(Handler,SpecificHandler) ;\ mov rHIFA = cr##.##ifa ;\ movl rHHandler = SpecificHandler ;\ br##.##sptk Handler ;\ ;; //++ // Routine: // // ALLOCATE_TRAP_FRAME // // Routine Description: // // Common code for allocating trap frame on kernel entry for heavyweight // handler. // // On entry: // // On exit: sp -> trap frame; any instruction that depends on sp must be // placed in the new instruction group. Interruption resources // ipsr, iipa, iip, predicates, isr, sp, ifs are captured in // seven of the banked registers h16-23. The last one is used // by SAVE_INTERRUPTION_STATE as a pointer to save these resources // in the trap frame. // // Return Value: // // None // // Notes: // Uses just the kernel banked registers (h16-h31) // // MS preprocessor requires /* */ style comments below //-- #define ALLOCATE_TRAP_FRAME ;\ ;\ pOverflow1 = pt2 ;\ pOverflow2 = pt3 ;\ pOverflow3 = pt4 ;\ ;\ mov rHIPSR = cr##.##ipsr ;\ movl rTH1 = KiPcr+PcInitialStack ;\ ;\ mov rHIIP = cr##.##iip ;\ mov rHOldPreds = pr ;\ cover /* cover and save IFS */;\ ;; ;\ ;\ ld8 rTH4 = [rTH1], PcBStoreLimit-PcInitialStack ;\ mov rTH3 = ar##.##bsp ;\ tbit##.##z pt1, pt0 = sp, 63 ;\ ;; ;\ ;\ mov rHIIPA = cr##.##iipa ;\ ld8 rTH2 = [rTH1], PcStackLimit-PcBStoreLimit ;\ mov rHVector = ip /* Save this vectors address */;\ ;\ mov rHIFS = cr##.##ifs ;\ mov rHSp = sp ;\ extr##.##u rHpT1 = rHIPSR, PSR_CPL, PSR_CPL_LEN /* get mode */;\ ;; ;\ ;\ cmp4##.##eq pKrnl, pUser = PL_KERNEL, rHpT1 /* set mode pred */;\ cmp4##.##eq pKstk, pUstk = PL_KERNEL, rHpT1 /* set stack pred */;\ add rHpT1 = PcKernelDebugActive-PcStackLimit, rTH1 ;\ ;; ;\ ;\ (pKstk) ld8 rTH1 = [rTH1] ;\ (pKstk) cmp##.##geu##.##unc pOverflow2 = rTH3, rTH2 ;\ (pKstk) add sp = -TrapFrameLength, sp /* allocate TF */;\ ;; ;\ ;\ ld1 rHpT1 = [rHpT1] /* load kernel db state */;\ (pKstk) cmp##.##leu##.##unc pOverflow1 = sp, rTH1 ;\ (pKstk) cmp##.##geu##.##unc pOverflow3 = sp, rTH3 ;\ ;; ;\ ;\ mov rHISR = cr##.##isr ;\ cmp##.##ne##.##or pKDbg = r0, rHpT1 /* kernel debug active? */;\ mov rPanicCode = PANIC_STACK_SWITCH ;\ ;\ (pUstk) add sp = -ThreadStateSaveAreaLength-TrapFrameLength, rTH4 ;\ (pOverflow1) br.spnt.few KiPanicHandler ;\ (pOverflow2) br.spnt.few KiPanicHandler ;\ (pOverflow3) br.spnt.few KiPanicHandler //++ // Routine: // // SAVE_INTERRUPTION_STATE // // Routine Description: // // Common code for saving interruption state on entry to a heavyweight // handler. // // Arguments: // // None // // On entry: // // sp -> trap frame // // On exit: // // Static registers gp, teb, sp, fpsr spilled into the trap frame. // Registers gp, teb, fpsr are set up for kernel mode execution. // // Return Value: // // None // // Notes: // // Interruption resources already captured in bank 0 registers h16-h23. // It's safe to take data TLB fault when saving them into the trap // frame because kernel stack is always resident in memory. This macro // is carefully constructed to save the bank registers' contents in // the trap frame and reuse them to capture other register states as // soon as they are available. Until we have a virtual register // allocation scheme in place, the bank 0 register aliases defined at // the beginning of the file must be updated when this macro is modified. // // MS preprocessor requires /* */ style comments below //-- #define SAVE_INTERRUPTION_STATE ;\ ;\ /* Save interruption resources in trap frame */ ;\ ;\ ;\ ssm (1 << PSR_IC) | (1 << PSR_DFH) | (1 << PSR_AC) ;\ add rHpT1 = TrStIPSR, sp /* -> IPSR */;\ ;; ;\ srlz##.##d ;\ st8 [rHpT1] = rHIPSR, TrStISR-TrStIPSR /* save IPSR */;\ add rHpT2 = TrPreds, sp /* -> Preds */;\ ;; ;\ ;\ st8 [rHpT1] = rHISR, TrStIIP-TrStISR /* save ISR */;\ st8 [rHpT2] = rHOldPreds, TrIntSp-TrPreds ;\ ;; ;\ ;\ mov rHUNAT = ar##.##unat ;\ st8 [rHpT1] = rHIIP, TrStIFS-TrStIIP /* save IIP */;\ mov rHBrp = brp ;\ ;; ;\ ;\ mov rHFPSR = ar##.##fpsr ;\ st8 [rHpT1] = rHIFS, TrStIIPA-TrStIFS /* save IFS */;\ mov rHPFS = ar##.##pfs ;\ st8.spill [rHpT2] = rHSp, TrBrRp-TrIntSp /* save SP */;\ ;; ;\ ;\ st8 [rHpT1] = rHIIPA, TrStFPSR-TrStIIPA /* save IIPA */;\ st8 [rHpT2] = rHBrp, TrRsPFS-TrBrRp ;\ ;; ;\ ;\ mov rHRSC = ar##.##rsc ;\ st8 [rHpT2] = rHPFS /* save PFS */;\ add rHpT2 = TrApUNAT, sp ;\ ;\ mov rHBSP = ar##.##bsp ;\ (pUstk) movl rHInitBStore = KiPcr + PcInitialBStore ;\ ;; ;\ ;\ mov ar##.##rsc = r0 /* put RSE in lazy mode */;\ st8 [rHpT2] = rHUNAT, TrIntGp-TrApUNAT /* save UNAT */;\ (pUstk) ld8 rHInitBStore = [rHInitBStore] ;\ ;; ;\ ;\ mov rHBSPSTORE = ar##.##bspstore /* get user bspstore point */;\ st8 [rHpT1] = rHFPSR, TrRsBSP-TrStFPSR /* save FPSR */;\ ;; ;\ ;\ st8##.##spill [rHpT2] = gp, TrIntTeb-TrIntGp /* spill GP */;\ st8 [rHpT1] = rHBSP, TrRsBSPSTORE - TrRsBSP /* save BSP */;\ (pUstk) mov rHRNAT = ar##.##rnat /* get RNAT */;\ movl rHFPSR = FPSR_FOR_KERNEL /* initial fpsr value */;\ ;; ;\ ;\ st8 [rHpT1] = rHBSPSTORE /* save BSPSTORE */;\ st8##.##spill [rHpT2] = teb, TrRsRSC-TrIntTeb /* spill TEB (r13) */;\ sub rHBSP = rHBSP, rHBSPSTORE /* size of dirty region */;\ (pUstk) mov teb = kteb /* sanitize teb */;\ (pUstk) dep rHInitBStore = rHBSPSTORE, rHInitBStore, 0, 9 ;\ ;; ;\ ;\ mov ar##.##fpsr = rHFPSR /* set fpsr */;\ movl rHpT1 = KiPcr + PcKernelGP ;\ ;\ (pUstk) mov ar##.##bspstore = rHInitBStore ;\ dep rHRSC = rHBSP, rHRSC, RSC_MBZ1, RSC_LOADRS_LEN ;\ ;; ;\ ;\ (pUstk) mov ar##.##rnat = rHRNAT /* preserve the user RNAT */;\ st8 [rHpT2] = rHRSC, TrRsRNAT-TrRsRSC ;\ ld8 gp = [rHpT1] /* load GP */;\ ;; ;\ ;\ /* */;\ /* If previous mode is user, switch to kernel backing store */;\ /* -- uses the "loadrs" approach. Note that we do not save the */;\ /* BSP/BSPSTORE in the trap frame if prvious mode was kernel */;\ /* */;\ ;\ (pUstk) mov ar##.##rsc = RSC_KERNEL /* turn rse on, kernel mode */;\ (pUstk) st8 [rHpT2] = rHRNAT /* save user RNAT */;\ /* adjust kernel BSPSTORE */;\ /* for NAT collection */;\ bsw##.##1 /* switch back to user bank */;\ ;; /* stop bit required */;\ //++ // Routine: // // RETURN_FROM_INTERRUPTION // // Routine Description: // // Common handler code to restore trap frame and resume execution // at the interruption address. // // Arguments: // // Label // // Return Value: // // None // // Note: // // On entry: interrrupts disabled, sp -> trap frame // On exit: // MS preprocessor requires /* */ style comments below //-- #define RETURN_FROM_INTERRUPTION(Label) ;\ ;\ .##regstk 0,5,2,0 /* must match the alloc instruction below */ ;\ ;\ rBSP = loc0 ;\ rRnat = loc1 ;\ ;\ rpT1 = t1 ;\ rpT2 = t2 ;\ rpT3 = t3 ;\ rpT4 = t4 ;\ rThread = t6 ;\ rApcFlag = t7 ;\ rT1 = t8 ;\ rT2 = t9 ;\ ;\ ;\ alloc rT1 = 0,5,2,0 ;\ movl rpT1 = KiPcr + PcCurrentThread /* ->PcCurrentThread */;\ ;; ;\ ;\ (pUstk) ld8 rThread = [rpT1] ;\ add loc4 = TrStIPSR, sp ;\ (pKstk) br##.##call##.##spnt brp = KiRestoreTrapFrame ;\ ;; ;\ ;\ ld8 loc4 = [loc4] /* load StIPSR */ ;\ (pUstk) add rpT1 = ThApcState+AsUserApcPending, rThread ;\ (pKstk) br##.##spnt Label##CriticalExitCode ;\ ;; ;\ ;\ ld1 rApcFlag = [rpT1], ThAlerted-ThApcState-AsUserApcPending ;\ add rBSP = TrRsBSP, sp ;\ add rRnat = TrRsRNAT, sp /* -> user RNAT */;\ ;; ;\ ;\ st1##.##nta [rpT1] = zero ;\ cmp##.##ne pApc = zero, rApcFlag ;\ (pUstk) tbit##.##nz.unc pUDbg = loc4, PSR_DB /* if non-zero, user debug active */;\ ;; ;\ ;\ PSET_IRQL (pApc, APC_LEVEL) ;\ movl gp = _gp /* restore to kernel gp value */;\ ;\ (pApc) FAST_ENABLE_INTERRUPTS ;\ (pApc) mov out1 = sp ;\ (pApc) br##.##call##.##sptk brp = KiApcInterrupt ;\ ;; ;\ ;\ ld8 rBSP = [rBSP] /* user BSP */;\ ld8 rRnat = [rRnat] /* user RNAT */;\ ;\ (pApc) FAST_DISABLE_INTERRUPTS ;\ PSET_IRQL (pApc, zero) ;\ (pUDbg) br##.##call##.##spnt brp = KiLoadUserDebugRegisters ;\ ;; ;\ ;\ br##.##call##.##sptk brp = KiRestoreTrapFrame ;\ ;; ;\ ;\ ;\ Label##CriticalExitCode: ;\ ;\ add loc2 = TrBrRp, sp ;\ add loc3 = TrRsRSC, sp ;\ bsw##.##0 ;\ ;; ;\ ;\ ld8 rHBrp = [loc2], TrRsPFS-TrBrRp ;\ ld8 rHRSC = [loc3] ;\ mov loc3 = RSC_KERNEL_DISABLED ;\ ;; ;\ ;\ invala ;\ (pUstk) movl out0 = KiIA64RseNumOfMaxDirty ;\ ;\ mov rHIPSR = loc4 ;\ movl rHpT1 = KiPcr+PcHighFpOwner ;\ ;; ;\ ;\ ld8 rHPFS = [loc2] ;\ ld8 rHpT4 = [rHpT1], PcCurrentThread-PcHighFpOwner ;\ extr##.##u loc2 = rHRSC, RSC_MBZ1, RSC_LOADRS_LEN ;\ ;; ;\ ;\ (pUstk) ld8 out0 = [out0] ;\ shr##.##u out1 = loc2, 3 ;\ sub rHBSPSTORE = rBSP, loc2 ;\ ;\ ld8 loc4 = [rHpT1], PcKernelDebugActive-PcCurrentThread ;\ (pUstk) mov rHRNAT2 = rRnat ;\ ;; ;\ ;\ ld1 rHpT1 = [rHpT1] ;\ dep loc3 = loc2, loc3, RSC_LOADRS, RSC_LOADRS_LEN ;\ cmp##.##ne pt2 = rHpT4, loc4 ;\ ;; ;\ ;\ mov ar##.##rsc = loc3 /* RSE off */ ;\ (pUstk) cmp##.##gt pt0 = out0, out1 ;\ (pt2) dep rHIPSR = 0, rHIPSR, PSR_MFH, 1 ;\ (pUstk) sub loc0 = out0, out1 ;\ (pKstk) br##.##spnt Label##KernelExit ;\ ;; ;\ ;\ alloc rTH1 = 0, 0, 1, 0 ;\ (pt2) dep rHIPSR = 1, rHIPSR, PSR_DFH, 1 ;\ ;; ;\ (pt0) br##.##call##.##sptk brp = KeScrubBackingStoreRegisters ;\ ;; ;\ alloc rTH1 = 0,0,0,0 ;\ ;; ;\ ;\ loadrs /* pull in user regs */;\ ;; ;\ ;\ Label##KernelExit: ;\ (pUstk) mov ar##.##bspstore = rHBSPSTORE /* restore user BSP */ ;\ dep rHRSC = r0, rHRSC, RSC_MBZ1, RSC_LOADRS_LEN ;\ (pKstk) cmp##.##ne##.##unc pKDbg, pt2 = rHpT1, r0 /* hardware debug? */ ;\ ;\ add rHpT4 = TrApUNAT, sp /* -> previous UNAT */;\ mov ar##.##pfs = rHPFS /* restore PFS */;\ add rHIFS = TrStIFS, sp ;\ ;; ;\ ;\ (pUstk) mov ar##.##rnat = rHRNAT2 /* restore user RNAT */;\ ld8 rHIFS = [rHIFS] /* load IFS */;\ add rHpT1 = TrStIIPA, sp ;\ ;; ;\ ;\ mov ar##.##rsc = rHRSC /* restore user RSC */;\ ld8 rHUNAT = [rHpT4],TrPreds-TrApUNAT ;\ mov brp = rHBrp ;\ ;; ;\ ;\ ld8 rHIIPA = [rHpT1], TrStIIP-TrStIIPA ;\ ld8 rHOldPreds = [rHpT4], TrIntSp-TrPreds ;\ (pt2) dep rHIPSR = 0, rHIPSR, PSR_DB, 1 ;\ ;; ;\ ;\ ld8 rHIIP = [rHpT1], TrStIFS-TrStIIP /* load IIP */;\ ld8##.##fill sp = [rHpT4], TrStIFS-TrIntSp ;\ (pKDbg) dep rHIPSR = 1, rHIPSR, PSR_DB, 1 ;\ ;\ rsm 1 << PSR_IC /* reset ic bit */;\ ;; ;\ srlz##.##d /* must serialize */;\ ;\ /* */;\ /* Restore status registers */;\ /* */;\ ;\ mov cr##.##ipsr = rHIPSR /* restore previous IPSR */;\ mov cr##.##iipa = rHIIPA /* restore previous IIPA */;\ ;\ mov cr##.##ifs = rHIFS /* restore previous IFS */;\ mov cr##.##iip = rHIIP /* restore previous IIP */;\ mov pr = rHOldPreds, -1 /* restore preds */;\ ;; ;\ ;\ /* */;\ /* Resume at point of interruption (rfi must be at end of instruction group)*/;\ /* */;\ mov ar##.##unat = rHUNAT /* restore UNAT */;\ mov h17 = r0 /* clear TB loop count */;\ rfi ;\ ;; // // Interruption Vector Table. First level interruption vectors. // This section must be 32K aligned. The special section ".drectve" // is used to pass the align command to the linker. // .section .drectve, "MI", "progbits" string "-section:.ivt,,align=0x8000" .section .ivt = "ax", "progbits" KiIvtBase:: // symbol for start of IVT //++ // // KiVhptTransVector // // Cause: The hardware VHPT walker encountered a TLB miss while attempting to // reference the virtuall addressed VHPT linear table. // // Parameters: cr.iip - address of bundle for which the hardware VHPT walker was // trying to resolve the TLB miss // // cr.ipsr - copy of PSR at the time of the fault // // cr.idtr - default translation inforamtion for the address that caused // a VHPT translation fault // // cr.ifa - original faulting address // // cr.isr - original faulting status information // // Handle: Extracts the PDE index from cr.iha (PTE address in VHPT) and // generates a PDE address by adding to VHPT_DIRBASE. When accesses // a page directory entry (PDE), there might be a TLB miss on the // page directory table and returns a NaT on ld8.s. If so, branches // to KiPageDirectoryTableFault. If the page-not-present bit of the // PDE is not set, branches to KiPageNotPresentFault. Otherwise, // inserts the PDE entry into the data TC (translation cache). // //-- VECTOR_ENTRY(0x0000, KiVhptTransVector, cr.ifa) #if 1 rva = h24 riha = h25 rpr = h26 rPte = h27 rK5 = h28 rPte2 = h28 rCache = h28 rps = h29 risr = h30 riha2 = h31 mov rva = cr.ifa // M0 mov rps = PAGE_SIZE mov riha = cr.iha // M0 mov rpr = pr // I mov risr = cr.isr // M0 ;; mov rK5 = ar.k5 tbit.nz pt6 = risr, ISR_SP ;; #ifndef NO_IHA_CHECK thash riha2 = rva // M0, for extra IHA checking #endif (pt6) cmp.gtu.unc pt6 = rps, rva (pt6) br.cond.spnt KiPageZeroFault ld8.s rPte = [riha] // M tbit.z pt3, pt4 = risr, ISR_X // I cmp.le pt7,pt8 = 20, rK5 add rK5 = 2, rK5 ;; (pt7) mov ar.k5 = r0 tnat.nz pt0 = rPte // I (pt8) mov ar.k5 = rK5 tbit.z pt1 = rPte, PTE_VALID // I (pt0) br.cond.spnt KiPageTableFault // B (pt1) br.cond.spnt KiPteNotPresentFault // B extr.u rCache = rPte, 2, 3 // I ;; cmp.eq pt5 = 1, rCache // A (pt5) br.cond.spnt KiPageTableFault // B ;; .pred.rel "mutex",pt3,pt4 (pt4) itc.i rPte // M ;; (pt3) itc.d rPte // M ;; #if !defined(NT_UP) ld8.s rPte2 = [riha] // M mov rps = PAGE_SHIFT << PS_SHIFT // I cmp.ne pt0 = zero, zero // I ;; cmp.ne.or pt0 = rPte2, rPte // M #ifndef NO_IHA_CHECK cmp.ne.or pt0 = riha, riha2 // M, check if IHA is correct #endif tnat.nz.or pt0 = rPte2 // I ;; (pt0) ptc.l rva, rps // M #else #ifndef NO_IHA_CHECK cmp.ne pt0 = riha, riha2 // M, check if IHA is correct mov rps = PAGE_SHIFT << PS_SHIFT // I ;; (pt0) ptc.l rva, rps // M #endif #endif mov pr = rpr, -1 // I rfi;; // B #else rva = h24 riha = h25 rpr = h26 rpPde = h27 rPde = h28 rPde2 = h29 rps = h30 mov riha = cr.iha // M mov rva = cr.ifa // M mov rpr = pr // I ;; thash rpPde = riha // M ;; ld8.s rPde = [rpPde] // M, load PDE ;; tnat.nz pt0, p0 = rPde // I tbit.z pt1, p0 = rPde, PTE_VALID // I, if non-present page fault (pt0) br.cond.spnt KiPageDirectoryFault // B (pt1) br.cond.spnt KiPdeNotPresentFault // B mov cr.ifa = riha // M ;; itc.d rPde // M ;; #if !defined(NT_UP) ld8.s rPde2 = [rpPde] // M mov rps = PAGE_SHIFT << PS_SHIFT // I cmp.ne pt0 = zero, zero // I ;; cmp.ne.or pt0 = rPde2, rPde // M, if PTEs are different tnat.nz.or pt0 = rPde2 // I ;; (pt0) ptc.l riha, rps // M, purge it #endif mov pr = rpr, -1 // I rfi // B ;; #endif VECTOR_EXIT(KiVhptTransVector) //++ // // KiInstTlbVector // // Cause: The VHPT walker aborted the search for the instruction translation. // // Parameters: cr.iip - address of bundle for which the hardware VHPT walker was // trying to resolve the TLB miss // // cr.ipsr - copy of PSR at the time of the fault // // cr.iha - PTE address in the VHPT which the VHPT walker was attempting to // reference // // cr.iitr - default translation inforamtion for the address that caused // a instruction TLB miss // // cr.isr - faulting status information // // Handle: As the VHPT has aborted the search or the implemenation does not // support the h/w page table walk, the handler needs to emulates the // function. Since the offending PTE address is already available // with cr.iha, the handler can access the PTE without performing THASH. // Accessing a PTE with ld8.s may return a NaT. If so, it branches to // KiPageTableFault. If the page-not-present bit of the PTE is not set, // it branches to KiPageFault. // // Comments: Merced never casues this fault since it never abort the search on the // VHPT. // //-- VECTOR_ENTRY(0x0400, KiInstTlbVector, cr.iipa) rva = h24 riha = h25 rpr = h26 rPte = h27 rPte2 = h28 rps = h29 rCache = h28 KiInstTlbVector0: mov riha = cr.iha // M mov rva = cr.ifa // M mov rpr = pr // I ;; ld8.s rPte = [riha] // M ;; tnat.nz pt0, p0 = rPte // I tbit.z pt1, p0 = rPte, PTE_VALID // I (pt0) br.cond.spnt KiPageTableFault // B (pt1) br.cond.spnt KiPteNotPresentFault // B extr.u rCache = rPte, 2, 3 // I ;; cmp.eq pt3 = 1, rCache // A (pt3) br.cond.spnt Ki4KInstTlbFault // B itc.i rPte // M ;; #if !defined(NT_UP) ld8.s rPte2 = [riha] // M mov rps = PAGE_SHIFT << PS_SHIFT // I cmp.ne pt0 = zero, zero // I ;; cmp.ne.or pt0 = rPte2, rPte // M tnat.nz.or pt0 = rPte2 // I ;; (pt0) ptc.l rva, rps // M #endif mov pr = rpr, -1 // I rfi;; // B VECTOR_EXIT(KiInstTlbVector) //++ // // KiDataTlbVector // // Cause: The VHPT walker aborted the search for the data translation. // // Parameters: cr.iip - address of bundle for which the hardware VHPT walker was // trying to resolve the TLB miss // // cr.ipsr - copy of PSR at the time of the fault // // cr.iha - PTE address in the VHPT which the VHPT walker was attempting to // reference // // cr.idtr - default translation inforamtion for the address that caused // a data TLB miss // // cr.ifa - address that caused a data TLB miss // // cr.isr - faulting status information // // Handle: As the VHPT has aborted the search or the implemenation does not // support the h/w page table walk, the handler needs to emulates the // function. Since the offending PTE address is already available // with cr.iha, the handler can access the PTE without performing THASH. // Accessing a PTE with ld8.s may return a NaT. If so, it branches to // KiPageTableFault. If the page-not-present bit of the PTE is not set, // it branches to KiPageFault. // // Comments: Merced never casues instruction TLB faults since the VHPT search always // sucesses. // //-- VECTOR_ENTRY(0x0800, KiDataTlbVector, cr.ifa) rva = h24 riha = h25 rpr = h26 rPte = h27 rK5 = h28 rPte2 = h28 rCache = h28 rps = h29 KiDataTlbVector0: mov riha = cr.iha // M mov rps = PAGE_SIZE mov rva = cr.ifa // M mov rpr = pr // I ;; mov rK5 = ar.k5 tbit.nz pt6 = risr, ISR_SP ;; (pt6) cmp.gtu.unc pt6 = rps, rva (pt6) br.cond.spnt KiPageZeroFault ld8.s rPte = [riha] // M cmp.le pt7,pt8 = 20, rK5 add rK5 = 2, rK5 ;; (pt7) mov ar.k5 = r0 (pt8) mov ar.k5 = rK5 extr.u rCache = rPte, 2, 3 // I ;; cmp.eq pt3 = 1, rCache // A (pt3) br.cond.spnt Ki4KDataTlbFault // B tnat.nz pt0, p0 = rPte // I tbit.z pt1, p0 = rPte, PTE_VALID // I (pt0) br.cond.spnt KiPageTableFault // B (pt1) br.cond.spnt KiPteNotPresentFault // B itc.d rPte // M ;; #if !defined(NT_UP) ld8.s rPte2 = [riha] // M mov rps = PAGE_SHIFT << PS_SHIFT // I cmp.ne pt0 = zero, zero // I ;; cmp.ne.or pt0 = rPte2, rPte // M tnat.nz.or pt0 = rPte2 // I ;; (pt0) ptc.l rva, rps // M #endif mov pr = rpr, -1 // I rfi;; // B VECTOR_EXIT(KiDataTlbVector) //++ // // KiAltTlbVector // // Cause: There was a TLB miss for instruction execution and the VHPT // walker was not enabled for the referenced region. // // Parameters: cr.iip - address of bundle that caused a TLB miss // // cr.ipsr - copy of PSR at the time of the fault // // cr.idtr - default translation inforamtion for the address that caused // the fault. // // cr.isr - faulting status information // // Handle: Currently, NT does not have any use of this vector. // //-- VECTOR_ENTRY(0x0c00, KiAltInstTlbVector, cr.iipa) rva = h24 riha = h25 mov rva = cr.ifa ;; thash riha = rva ;; mov cr.iha = riha ;; srlz.d br.sptk KiInstTlbVector0 VECTOR_CALL_HANDLER(KiGenericExceptionHandler, KiMemoryFault) VECTOR_EXIT(KiAltInstTlbVector) //++ // // KiAltDataTlbVector // // Cause: There was a data TLB miss and the VHPT walker was not enabled for // the referenced region. // // Parameters: cr.iip - address of bundle that caused a TLB miss // // cr.ipsr - copy of PSR at the time of the fault // // cr.idtr - default translation inforamtion for the address that caused // the fault. // // cr.isr - faulting status information // // Handle: Currently, NT does not have any use of this vector. // //-- VECTOR_ENTRY(0x1000, KiAltDataTlbVector, cr.ifa) rva = h24 riha = h25 rpr = h26 rPte = h27 rKseglimit = h28 rIPSR = h30 rISR = h29 rVrn = h31 #if NO_VHPT_WALKER rRR = h30 mov rva = cr.ifa // M mov rpr = pr // I ;; mov rRR = rr[rva] movl rKseglimit = KSEG3_LIMIT ;; thash riha = rva tbit.z pt4 = rRR, 0 mov rIPSR = cr.ipsr shr.u rVrn = rva, VRN_SHIFT // I, get VPN (pt4) br.cond.spnt AltFault ;; mov cr.iha = riha ;; srlz.d mov pr = rpr, -1 br.sptk KiDataTlbVector0 ;; AltFault: #else mov rva = cr.ifa // M movl rKseglimit = KSEG3_LIMIT ;; mov rIPSR = cr.ipsr mov rpr = pr // I shr.u rVrn = rva, VRN_SHIFT // I, get VPN ;; #endif extr.u rIPSR = rIPSR, PSR_CPL, PSR_CPL_LEN ;; cmp.ne pt1 = PL_KERNEL, rIPSR cmp.ne pt2 = KSEG3_VRN, rVrn // M/I cmp.eq pt4 = KSEG4_VRN, rVrn (pt1) br.cond.spnt KiCallMemoryFault // if it was User (pt4) br.cond.spnt KiKseg4Fault (pt2) br.cond.spnt NoKsegFault // B cmp.leu pt0 = rKseglimit, rva (pt0) br.cond.spnt NoKsegFault mov rISR = cr.isr // M movl rPte = VALID_KERNEL_PTE // L mov rIPSR = cr.ipsr // M shr.u rva = rva, PAGE_SHIFT // I ;; tbit.z pt2, pt3 = rISR, ISR_SP // I dep.z rva = rva, PAGE_SHIFT, 32 // I ;; or rPte = rPte, rva // I dep rIPSR = 1, rIPSR, PSR_ED, 1 // I ;; (pt2) itc.d rPte // M ;; (pt3) mov cr.ipsr = rIPSR // M ;; mov pr = rpr, -1 // I rfi // B ;; NoKsegFault: rPdeUtbase = h27 rva0 = h29 rPpe = h30 shr.u rva0 = rva, PAGE_SHIFT movl rPdeUtbase = KiPcr+PcPdeUtbase ;; dep.z rva0 = rva0, PAGE_SHIFT, VRN_SHIFT-PAGE_SHIFT ld8 rPdeUtbase = [rPdeUtbase] movl rPpe = MiDefaultPpe ;; ld8 rPpe = [rPpe] cmp.ne pt3, p0 = rva0, rPdeUtbase (pt3) br.cond.spnt KiPageFault ;; itc.d rPpe ;; mov pr = rpr, -1 rfi;; VECTOR_EXIT(KiAltDataTlbVector) //++ // // KiNestedTlbVector // // Cause: Instruction/Data TLB miss handler encountered a TLB miss while // attempting to reference the PTE in the virtuall addressed // VHPT linear table. // // Parameters: cr.iip - address of bundle for which the hardware VHPT walker was // trying to resolve the TLB miss // // cr.ipsr - copy of PSR at the time of VHPT translation fault // // cr.iha - address in VHPT which the VHPT walker was attempting to // reference // // cr.idtr - default translation inforamtion for the virtual address // contained in cr.iha // // cr.ifa - original faulting address // // cr.isr - faulting status information // // h16(riha) - PTE address in the VHPT which caused the Nested miss // // Handle: Currently, there is no use for Nested TLB vector. This should be // a bug fault. Call KiPanicHandler. // //-- VECTOR_ENTRY(0x1400, KiNestedTlbVector, cr.ifa) ALLOCATE_TRAP_FRAME mov rHIFA = cr.ifa br.sptk KiPanicHandler VECTOR_EXIT(KiNestedTlbVector) //++ // // KiInstKeyMissVector // // Cause: There was a instruction key miss in the translation. Since the // architecture allows an implementation to choose a unified TC // structure, the hyper space translation brought by the data // access-bit may cause a instruction key miss fault. Only erroneous // user code tries to execute the NT page table and hyper space. // // Parameters: cr.iip - address of bundle which caused a instruction key miss fault // // cr.ipsr - copy of PSR at the time of the data key miss fault // // cr.idtr - default translation inforamtion of the address that caused // the fault. // // cr.isr - faulting status information // // Handle: Save the whole register state and call MmAccessFault(). // //-- VECTOR_ENTRY(0x1800, KiInstKeyMissVector, cr.iipa) VECTOR_CALL_HANDLER(KiGenericExceptionHandler, KiMemoryFault) VECTOR_EXIT(KiInstKeyMissVector) //++ // // KiDataKeyMissVector // // Cause: The referenced translation had the different key ID from the one // specified the key permission register. This is an indication of // TLB miss on the NT page table and hyperspace. // // Parameters: cr.iip - address of bundle which caused the fault // // cr.ipsr - copy of PSR at the time of the data key miss fault // // cr.idtr - default translation inforamtion of the address that caused // the fault. // // cr.ifa - address that caused a data key miss // // cr.isr - faulting status information // // Handle: The handler needs to purge the faulting translation and install // a new PTE by loading it from the VHPT. The key ID of the IDTR // for the installing translation should be modified to be the same // ID as the local region ID. This effectively creates a local // space within the global kernel space. // //-- VECTOR_ENTRY(0x1c00, KiDataKeyMissVector, cr.ifa) VECTOR_CALL_HANDLER(KiGenericExceptionHandler, KiMemoryFault) VECTOR_EXIT(KiDataKeyMissVector) //++ // // KiDirtyBitVector // // Cause: The refereced data translation did not have the dirty-bit set and // a write operation was made to this page. // // Parameters: cr.iip - address of bundle which caused a dirty bit fault // // cr.ipsr - copy of PSR at the time of a data access fault // // cr.idtr - default translation inforamtion for the address that // caused the fault // // cr.ifa - referenced data address that caused the dirty-bit fault // // cr.isr - faulting status information // // Handle: Save the whole register state and call MmAccessFault(). // // Comments: There is always a TLB coherency problem on a multiprocessor // system. Rather than implementing an atomic operation of setting // dirty-bit within this handler, the handler instead calls the high // level C routine, MmAccessFault(), to perform locking the page table // and setting the dirty-bit of the PTE. // // It is too much effort to implement the atomic operation of setting // the dirty-bit using cmpxchg; a potential nested TLB miss on load/store // and restoring ar.ccv complicate the design of the handler. // //-- VECTOR_ENTRY(0x2000, KiDirtyBitVector, cr.ifa) VECTOR_CALL_HANDLER(KiGenericExceptionHandler, KiMemoryFault) VECTOR_EXIT(KiDirtyBitVector) //++ // // KiInstAccessBitVector // // Cause: There is a access-bit fault on the instruction translation. This only // happens if the erroneous user mistakenly accesses the NT page table and // hyper space. // // Parameters: cr.iip - address of bundle which caused a instruction access bit fault // // cr.ipsr - copy of PSR at the time of a data access fault // // cr.idtr - default translation inforamtion for the address that // caused the fault // // cr.ifa - referenced data address that caused the data access-bit fault // // cr.isr - faulting status information // // Handle: Save the whole register state and call MmAccessFault(). // //-- VECTOR_ENTRY(0x2400, KiInstAccessBitVector, cr.iipa) VECTOR_CALL_HANDLER(KiGenericExceptionHandler, KiMemoryFault) VECTOR_EXIT(KiInstAccessBitVector) //++ // // KiDataBitAccessVector // // Cause: The reference-bit in the the referenced translation was zero, // indicating there was a TLB miss on the NT page table or hyperspace. // // Parameters: cr.iip - address of bundle which caused a data access bit fault // // cr.ipsr - copy of PSR at the time of a data access fault // // cr.idtr - default translation inforamtion for the address that // caused the fault // // cr.ifa - referenced data address that caused the data access-bit fault // // cr.isr - faulting status information // // Handle: The reference-bit is used to fault on PTEs for the NT page table and // hyperspace. On a data access-bit fault, the handler needs to change the // the default key ID of the IDTR to be the local key ID. This effectively // creates the local space within the global kernel space. // //-- VECTOR_ENTRY(0x2800, KiDataAccessBitVector, cr.ifa) rva = h24 rpr = h26 rIPSR = h27 rISR = h31 // // check to see if non-present fault occurred on a speculative load. // if so, set IPSR.ed bit. This forces to generate a NaT on ld.s after // rfi // mov rpr = pr mov rISR = cr.isr // M mov rIPSR = cr.ipsr // M ;; tbit.z pt0, p0 = rISR, ISR_SP // I dep rIPSR = 1, rIPSR, PSR_ED, 1 // I (pt0) br.cond.spnt KiCallMemoryFault // B ;; mov cr.ipsr = rIPSR // M ;; mov pr = rpr, -1 // I rfi // B ;; VECTOR_EXIT(KiDataBitAccessVector) //-------------------------------------------------------------------- // Routine: // // KiBreakVector // // Description: // // Interruption vector for break instruction. // // On entry: // // IIM contains break immediate value: // -- BREAK_SYSCALL -> standard system call // interrupts disabled // r16-r31 switched to kernel bank // r16-r31 all available since no TLB faults at this point // // Return value: // // if system call, sys call return value in v0. // // Process: //-------------------------------------------------------------------- VECTOR_ENTRY(0x2C00, KiBreakVector, cr.iim) mov rHIIM = cr.iim // get break value movl rTH1 = KiPcr+PcSavedIIM ;; st8 [rTH1] = rHIIM VECTOR_CALL_HANDLER(KiGenericExceptionHandler, KiOtherBreakException) // // Do not return from handler // VECTOR_EXIT(KiBreakVector) //-------------------------------------------------------------------- // Routine: // // KiExternalInterruptVector // // Routine Description: // // Interruption vector for External Interrrupt // // On entry: // // interrupts disabled // r16-r31 switched to kernel bank // // Return value: // // none // // Process: //-------------------------------------------------------------------- VECTOR_ENTRY(0x3000, KiExternalInterruptVector, r0) mov h24 = cr.iip movl h25 = MM_EPC_VA+0x20 ;; mov h26 = pr cmp.ne pt0 = h25, h24 add h25 = 0x10, h25 ;; mov h27 = cr.ipsr (pt0) cmp.ne pt0 = h25, h24 ;; dep h27 = 0, h27, PSR_I, 1 (pt0) br.cond.sptk kei_taken ;; mov cr.ipsr = h27 ;; mov pr = h26, -1 rfi ;; kei_taken: mov pr = h26, -1 ;; ALLOCATE_TRAP_FRAME ;; SAVE_INTERRUPTION_STATE br.many KiExternalInterruptHandler ;; // // Do not return (rfi from handler) // VECTOR_EXIT(KiExternalInterruptVector) //++ // // KiPageNotPresentVector // // Cause: The translation for the referenced page did not have a present-bit // set. // // Parameters: cr.iip - address of bundle which caused a page not present fault // // cr.ipsr - copy of PSR at the time of a page not present ault // // cr.idtr - default translation inforamtion for the address that // caused the fault // // cr.ifa - referenced data address if the fault occurred on the data // reference // // cr.isr - faulting status information // // Handle: This is the page fault. The handler saves the register context and // calls MmAccessFault(). // //-- VECTOR_ENTRY(0x5000, KiPageNotPresentVector, cr.ifa) rva = h24 riha = h25 rpr = h26 rPte = h27 rps = h29 mov rva = cr.ifa // M mov rpr = pr // I ;; thash riha = rva // M cmp.ne pt1 = r0, r0 mov rps = PAGE_SHIFT << PS_SHIFT // I ;; ld8.s rPte = [riha] // M ;; tnat.nz pt0, p0 = rPte // I tbit.z.or pt1, p0 = rPte, PTE_ACCESS tbit.z.or pt1, p0 = rPte, PTE_VALID // I, if non-present page fault (pt0) br.cond.spnt KiPageTableFault // B (pt1) br.cond.spnt KiPteNotPresentFault // B // // if we find a valid PTE that is speculatively fetched into the TLB // then, purge it and return. // ptc.l rva, rps // M ;; mov pr = rpr, -1 // I rfi;; // B VECTOR_EXIT(KiPageNotPresentVector) //++ // // KiKeyPermVector // // Cause: Read, write or execution key permissions were violated. // // Parameters: cr.iip - address of bundle which caused a key permission fault // // cr.ipsr - copy of PSR at the time of a key permission fault // // cr.idtr - default translation inforamtion for the address that // caused the fault // // cr.ifa - referenced data address if the key permission occurred on // the data reference // // cr.isr - faulting status information // // Handle: This should not happen. The EM/NT does not utilize the key permissions. // The handler saves the register state and calls the bug check. // //-- VECTOR_ENTRY(0x5100, KiKeyPermVector, cr.ifa) VECTOR_CALL_HANDLER(KiGenericExceptionHandler, KiMemoryFault) VECTOR_EXIT(KiKeyPermVector) //++ // // KiInstAccessRightsVector // // Cause: The referenced page had a access rights violation. // // Parameters: cr.iip - address of bundle which caused a data access bit fault // // cr.ipsr - copy of PSR at the time of a data access fault // // cr.idtr - default translation inforamtion for the address that // caused the fault // // cr.ifa - referenced data address that caused the data ccess-bit fault // // cr.isr - faulting status information // // Handle: The handler saves the register context and calls MmAccessFault(). // //-- VECTOR_ENTRY(0x5200, KiInstAccessRightsVector, cr.iipa) VECTOR_CALL_HANDLER(KiGenericExceptionHandler, KiMemoryFault) VECTOR_EXIT(KiInstAccessRightsVector) //++ // // KiDataAccessRightsVector // // Cause: The referenced page had a data access rights violation. // // Parameters: cr.iip - address of bundle which caused a data access rights fault // // cr.ipsr - copy of PSR at the time of a data access rights fault // // cr.idtr - default translation inforamtion for the address that // caused the fault // // cr.ifa - referenced data address that caused the data access rights // fault // // cr.isr - faulting status information // // Handle: The handler saves the register context and calls MmAccessFault(). // //-- VECTOR_ENTRY(0x5300, KiDataAccessRightsVector, cr.ifa) rva = h24 rpr = h26 rIPSR = h27 rISR = h31 // // check to see if non-present fault occurred on a speculative load. // if so, set IPSR.ed bit. This forces to generate a NaT on ld.s after // rfi // mov rpr = pr mov rISR = cr.isr // M mov rIPSR = cr.ipsr // M ;; tbit.z pt0, p0 = rISR, ISR_SP // I dep rIPSR = 1, rIPSR, PSR_ED, 1 // I (pt0) br.cond.spnt KiCallMemoryFault2 // B ;; mov cr.ipsr = rIPSR // M ;; mov pr = rpr, -1 // I rfi // B ;; KiCallMemoryFault2: mov rHIFA = cr.ifa movl rHHandler = KiMemoryFault mov pr = rpr, -1 br.sptk KiGenericExceptionHandler VECTOR_EXIT(KiDataAccessRightsVector) //-------------------------------------------------------------------- // Routine: // // KiGeneralExceptionsVector // // Description: // // Interruption vector for General Exceptions // // On entry: // interrupts disabled // r16-r31 switched to kernel bank // // Return value: // // none // // Process: //-------------------------------------------------------------------- VECTOR_ENTRY(0x5400, KiGeneralExceptionsVector, cr.isr) rPSR_ED = h25 rpr = h26 rIPSR = h27 rCode = h30 rISR = h31 rLfetch = h28 mov rISR = cr.isr // M movl rPSR_ED = 1 << PSR_ED // L mov rIPSR = cr.ipsr // M mov rpr = pr ;; cmp.ne pt0 = r0, r0 extr.u rCode = rISR, 0, 8 mov rLfetch = ISR_LFETCH|ISR_RESVD_REG << 4 ;; cmp.ne.or pt0 = rCode, rLfetch tbit.z.or pt0 = rISR, ISR_NA (pt0) br.cond.sptk KiCallGeneralExceptions ;; or rIPSR = rIPSR, rPSR_ED // A ;; mov cr.ipsr = rIPSR // M mov pr = rpr, -1 // I ;; rfi ;; KiCallGeneralExceptions: mov rHIFA = cr.ifa movl rHHandler = KiGeneralExceptions mov pr = rpr, -1 br.sptk KiGenericExceptionHandler // // Do not return (rfi from handler) // VECTOR_EXIT(KiGeneralExceptionsVector) //-------------------------------------------------------------------- // Routine: // // KiDisabledFpRegisterVector // // Description: // // Interruption vector for Disabled FP-register vector // // On entry: // interrupts disabled // r16-r31 switched to kernel bank // // Return value: // // none // // Process: //-------------------------------------------------------------------- VECTOR_ENTRY(0x5500, KiDisabledFpRegisterVector, cr.isr) mov rHIPSR = cr.ipsr mov rHIIP = cr.iip cover ;; mov rHIFS = cr.ifs extr.u rTH1 = rHIPSR, PSR_CPL, PSR_CPL_LEN mov rHOldPreds = pr ;; cmp4.eq pKrnl, pUser = PL_KERNEL, rTH1 ;; (pUser) tbit.z.unc pt0, pt1 = rHIPSR, PSR_DFH // if dfh not set, // dfl must be set (pKrnl) br.spnt.few Kdfrv10 // Kernel mode should never get here. ;; (pt1) ssm 1 << PSR_IC // set ic bit (pt1) mov rHDfhPFS = ar.pfs (pt1) mov rHDfhBrp = brp ;; (pt1) srlz.d (pt1) br.call.sptk.many brp = KiRestoreHigherFPVolatile (pt0) br.spnt.few Kdfrv10 ;; rsm 1 << PSR_IC // reset ic bit dep rHIPSR = 0, rHIPSR, PSR_DFH, 1 // reset dfh bit mov brp = rHDfhBrp ;; srlz.d mov cr.ifs = rHIFS mov ar.pfs = rHDfhPFS mov cr.ipsr = rHIPSR mov cr.iip = rHIIP mov pr = rHOldPreds, -1 ;; rfi ;; Kdfrv10: mov pr = rHOldPreds, -1 VECTOR_CALL_HANDLER(KiGenericExceptionHandler, KiGeneralExceptions) ;; VECTOR_EXIT(KiDisabledFpRegisterVector) //-------------------------------------------------------------------- // Routine: // // KiNatConsumptionVector // // Description: // // Interruption vector for Nat Consumption Vector // // On entry: // interrupts disabled // r16-r31 switched to kernel bank // // Return value: // // none // // Process: //-------------------------------------------------------------------- VECTOR_ENTRY(0x5600, KiNatConsumptionVector, cr.isr) mov h16 = cr.isr mov h17 = pr ;; mov rHIFA = cr.ifa extr.u h16 = h16, 4, 4 // extract the error code ;; cmp.eq pt0, pt1 = ISR_NAT_PAGE, h16 ;; (pt0) movl rHHandler = KiMemoryFault (pt1) movl rHHandler = KiNatExceptions ;; mov pr = h17, -1 br.sptk KiGenericExceptionHandler VECTOR_EXIT(KiNatConsumptionVector) //++ // // KiSpeculationVector // // Cause: CHK.S, CHK.A, FCHK detected an exception condition. // // Parameters: cr.iip - address of bundle which caused a speculation fault // // cr.ipsr - copy of PSR at the time of a speculation fault // // cr.iipa - address of bundle containing the last // successfully executed instruction // // cr.iim - contains the immediate value in either // CHK.S, CHK.A, or FCHK opecode // // cr.isr - faulting status information // // Handle: The handler implements a branch operation to the // recovery code specified by the IIM IP-offset. // // Note: This code will not be exercised until the compiler // generates the speculation code. // // TBD: Need to check for taken branch trap. // //-- VECTOR_ENTRY(0x5700, KiSpeculationVector, cr.iim) mov h16 = cr.iim // get imm offset mov h17 = cr.iip // get IIP ;; extr h16 = h16, 0, 21 // get sign-extended mov h18 = cr.ipsr ;; shladd h16 = h16, 4, h17 // get addr for recovery handler dep h18 = 0, h18, PSR_RI, 2 // zero target slot number ;; mov cr.ipsr = h18 mov cr.iip = h16 ;; rfi ;; VECTOR_EXIT(KiSpeculationVector) //++ // // KiDebugFaultVector // // Cause: A unaligned data access fault has occured // // Parameters: cr.iip - address of bundle causing the fault. // // cr.ipsr - copy of PSR at the time of interruption. // // cr.iipa - address of bundle containing the last // successfully executed instruction // // cr.isr - faulting status information. ISR.ei bits are // set to indicate which instruction caused the // exception. // The ISR.code contains information about the // FP exception fault. See trapc.c and the EAS // //-- VECTOR_ENTRY(0x5900, KiDebugFaultVector, cr.isr) VECTOR_CALL_HANDLER(KiGenericExceptionHandler, KiDebugFault) // // Do not return (rfi from handler) // VECTOR_EXIT(KiDebugFaultVector) //++ // // KiUnalignedFaultVector // // Cause: A unaligned data access fault has occured // // Parameters: cr.iip - address of bundle causing the fault. // // cr.ipsr - copy of PSR at the time of interruption. // // cr.iipa - address of bundle containing the last // successfully executed instruction // // cr.isr - faulting status information. ISR.ei bits are // set to indicate which instruction caused the // exception. // The ISR.code contains information about the // FP exception fault. See trapc.c and the EAS // //-- VECTOR_ENTRY(0x5a00, KiUnalignedFaultVector, cr.ifa) VECTOR_CALL_HANDLER(KiGenericExceptionHandler, KiUnalignedFault) // // Do not return (rfi from handler) // VECTOR_EXIT(KiUnalignedFaultVector) //++ // // KiFloatFaultVector // // Cause: A floating point fault has occured // // Parameters: cr.iip - address of bundle causing the fault. // // cr.ipsr - copy of PSR at the time of interruption. // // cr.iipa - address of bundle containing the last // successfully executed instruction // // cr.isr - faulting status information. ISR.ei bits are // set to indicate which instruction caused the // exception. // The ISR.code contains information about the // FP exception fault. See trapc.c and the EAS // //-- VECTOR_ENTRY(0x5c00, KiFloatFaultVector, cr.isr) VECTOR_CALL_HANDLER(KiGenericExceptionHandler, KiFloatFault) // // Do not return (rfi from handler) // VECTOR_EXIT(KiFloatFaultVector) //++ // // KiFloatTrapVector // // Cause: A floating point trap has occured // // Parameters: cr.iip - address of bundle with the instruction to be // executed next. // // cr.ipsr - copy of PSR at the time of interruption. // // cr.iipa - address of bundle containing the last // successfully executed instruction // // cr.isr - faulting status information. ISR.ei bits are // set to indicate which instruction caused the // exception. // The ISR.code contains information about the // FP trap. See trapc.c and the EAS // //-- VECTOR_ENTRY(0x5d00, KiFloatTrapVector, cr.isr) VECTOR_CALL_HANDLER(KiGenericExceptionHandler, KiFloatTrap) // // Do not return (rfi from handler) // VECTOR_EXIT(KiFloatTrapVector) //++ // // KiLowerPrivilegeVector // // Cause: A branch lowers the privilege level and PSR.lp is 1. // Or an attempt made to execute an instruction // in the unimplemented address space. // This trap is higher priority than taken branch // or single step traps. // // Parameters: cr.iip - address of bundle containing the instruction to // be executed next. // // cr.ipsr - copy of PSR at the time of interruption. // // cr.iipa - address of bundle containing the last // successfully executed instruction // // cr.isr - faulting status information. The ISR.code // contains a bit vector for all traps which // occurred in the trapping bundle. // //-- VECTOR_ENTRY(0x5e00, KiLowerPrivilegeVector, cr.iipa) mov rHISR = cr.isr mov rHOldPreds = pr mov rHIIPA = cr.iipa mov rHIPSR = cr.ipsr ;; tbit.z pt1, pt0 = rHISR, ISR_UI_TRAP (pt1) br.cond.spnt Klpv10 ;; mov rHIFA = cr.iip movl rHHandler = KiUnimplementedAddressTrap mov pr = rHOldPreds, -2 // must restore predicates br.sptk KiGenericExceptionHandler ;; Klpv10: mov rHVector = ip mov rPanicCode = UNEXPECTED_KERNEL_MODE_TRAP br.sptk KiPanicHandler VECTOR_EXIT(KiLowerPrivilegeVector) //++ // // KiTakenBranchVector // // Cause: A taken branch was successfully execcuted and the PSR.tb // bit is 1. This trap is higher priority than single step trap. // // Parameters: cr.iip - address of bundle containing the instruction to // be executed next. // // cr.ipsr - copy of PSR at the time of interruption. // // cr.iipa - address of bundle containing the last // successfully executed instruction // // cr.isr - faulting status information. The ISR.code // contains a bit vector for all traps which // occurred in the trapping bundle. // //-- VECTOR_ENTRY(0x5f00, KiTakenBranchVector, cr.iipa) mov rHIPSR = cr.ipsr movl rHEPCVa = MM_EPC_VA+0x20 // user system call entry point mov rHIIP = cr.iip movl rHpT1 = KiPcr+PcInitialStack ;; ld8 rHpT1 = [rHpT1] extr.u rTH1 = rHIPSR, PSR_CPL, PSR_CPL_LEN mov rHOldPreds = pr ;; cmp.eq pt0 = rHEPCVa, rHIIP ;; (pt0) ssm 1 << PSR_IC (pt0) movl rHpT3 = 1 << PSR_LP ;; (pt0) or rHpT3 = rHIPSR, rHpT3 (pt0) srlz.d add rHpT1=-ThreadStateSaveAreaLength-TrapFrameLength+TrStIPSR,rHpT1 (pt0) br.spnt.few Ktbv10 mov pr = rHOldPreds, -2 VECTOR_CALL_HANDLER(KiGenericExceptionHandler, KiSingleStep) ;; Ktbv10: st8 [rHpT1] = rHpT3 movl rHpT3 = 1 << PSR_SS | 1 << PSR_TB | 1 << PSR_DB ;; rsm 1 << PSR_IC mov pr = rHOldPreds, -2 andcm rHIPSR = rHIPSR, rHpT3 // clear ss, tb, db bits ;; srlz.d mov cr.ipsr = rHIPSR ;; rfi ;; VECTOR_EXIT(KiTakenBranchVector) //++ // // KiSingleStepVector // // Cause: An instruction was successfully execcuted and the PSR.ss // bit is 1. // // Parameters: cr.iip - address of bundle containing the instruction to // be executed next. // // cr.ipsr - copy of PSR at the time of interruption. // // cr.iipa - address of bundle containing the last // successfully executed instruction // // cr.isr - faulting status information. The ISR.code // contains a bit vector for all traps which // occurred in the trapping bundle. // //-- VECTOR_ENTRY(0x6000, KiSingleStepVector, cr.iipa) mov rHIPSR = cr.ipsr movl rHEPCVa = MM_EPC_VA+0x20 // user system call entry point mov rHIIP = cr.iip movl rHpT1 = KiPcr+PcInitialStack ;; ld8 rHpT1 = [rHpT1] extr.u rTH1 = rHIPSR, PSR_CPL, PSR_CPL_LEN mov rHOldPreds = pr ;; cmp.eq pt0 = rHEPCVa, rHIIP ;; (pt0) ssm 1 << PSR_IC (pt0) movl rHpT3 = 1 << PSR_LP ;; (pt0) or rHpT3 = rHIPSR, rHpT3 (pt0) srlz.d add rHpT1=-ThreadStateSaveAreaLength-TrapFrameLength+TrStIPSR,rHpT1 (pt0) br.spnt.few Kssv10 mov pr = rHOldPreds, -2 VECTOR_CALL_HANDLER(KiGenericExceptionHandler, KiSingleStep) ;; Kssv10: st8 [rHpT1] = rHpT3 movl rHpT3 = 1 << PSR_SS | 1 << PSR_DB ;; rsm 1 << PSR_IC mov pr = rHOldPreds, -2 andcm rHIPSR = rHIPSR, rHpT3 // clear ss, db bits ;; srlz.d mov cr.ipsr = rHIPSR ;; rfi ;; VECTOR_EXIT(KiSingleStepVector) //++ // // KiIA32ExceptionVector // // Cause: A fault or trap was generated while executing from the // iA-32 instruction set. // // Parameters: cr.iip - address of the iA-32 instruction causing interruption // // cr.ipsr - copy of PSR at the time of the instruction // // cr.iipa - Address of the last successfully executed // iA-32 or EM instruction // // cr.isr - The ISR.ei exception indicator is cleared. // ISR.iA_vector contains the iA-32 interruption vector // number. ISR.code contains the iA-32 16-bit error cod // // Handle: Save the whole register state and // call KiIA32ExceptionVectorHandler()(). // //-- VECTOR_ENTRY(0x6900, KiIA32ExceptionVector, r0) mov rHIIM = cr.iim // save info from IIM movl rTH1 = KiPcr+PcSavedIIM ;; st8 [rTH1] = rHIIM VECTOR_CALL_HANDLER(KiGenericExceptionHandler, KiIA32ExceptionVectorHandler) VECTOR_EXIT(KiIA32ExceptionVector) //++ // // KiIA32InterceptionVector // // Cause: A interception fault or trap was generated while executing // from the iA-32 instruction set. // // Parameters: cr.iip - address of the iA-32 instruction causing interruption // // cr.ipsr - copy of PSR at the time of the instruction // // cr.iipa - Address of the last successfully executed // iA-32 or EM instruction // // cr.isr - The ISR.ei exception indicator is cleared. // ISR.iA_vector contains the iA-32 interruption vector // number. ISR.code contains the iA-32specific // interception information // // Handle: Save the whole register state and // call KiIA32InterceptionVectorHandler()(). // //-- VECTOR_ENTRY(0x6a00, KiIA32InterceptionVector, r0) mov rHIIM = cr.iim // save info from IIM movl rTH1 = KiPcr+PcSavedIIM ;; st8 [rTH1] = rHIIM VECTOR_CALL_HANDLER(KiGenericExceptionHandler, KiIA32InterceptionVectorHandler) VECTOR_EXIT(KiIA32InterceptionVector) //++ // // KiIA32InterruptionVector // // Cause: An iA software interrupt was executed // // Parameters: cr.iip - address of the iA-32 instruction causing interruption // // cr.ipsr - copy of PSR at the time of the instruction // // cr.iipa - Address of the last successfully executed // iA-32 or EM instruction // // cr.isr - ISR.iA_vector contains the iA-32 defined vector // number. ISR.code contains 0 // ISR.ei excepting instruction indicator is cleared. // ISR.iA_vector contains the iA-32 instruction vector. // ISR.code contains iA-32 specific information. // // Handle: Save the whole register state and // call KiIA32InterruptionVectorHandler()(). // //-- VECTOR_ENTRY(0x6b00, KiIA32InterruptionVector, r0) // This one doesn't need IIM, so we won't bother to save it VECTOR_CALL_HANDLER(KiGenericExceptionHandler, KiIA32InterruptionVectorHandler) VECTOR_EXIT(KiIA32InterruptionVector) // // All non-VECTOR_ENTRY functions must follow KiNormalSystemCall. // // N.B. KiNormalSystemCall must be the first function body in the .nsc // section. // //-------------------------------------------------------------------- // Routine: // // KiNormalSystemCall // // Description: // // Handler for normal (not fast) system calls // // On entry: // // ic off // interrupts disabled // v0: contains sys call # // cover done by call // r32-r39: sys call arguments // CFM: sof = # args, ins = 0, outs = # args // clear mfh bit (high fp registers are scratch per s/w convention) // // Return value: // // v0: system call return value // // Process: // //-------------------------------------------------------------------- .section .drectve, "MI", "progbits" string " -section:.nsc,,align=0x2000" .section .nsc = "ax", "progbits" HANDLER_ENTRY_EX(KiNormalSystemCall, KiSystemServiceHandler) .prologue .unwabi @nt, EXCEPTION_FRAME rPFS = t0 rThread = t1 // current thread rIFS = t1 rIIP = t2 rPreds = t3 rIPSR = t4 rUNAT = t5 rSp = t6 rpT1 = t7 rpT2 = t8 rpT3 = t9 rpT4 = t10 rT0 = t11 rT1 = t12 rT2 = t13 rT3 = t14 rT4 = t15 rKDbgActive = t16 rIntNats = t17 rpSd = t16 /* -> service descriptor entry */ rArgTable = t18 /* pointer to argument table */ rArgNum = t20 /* number of arguments */ rArgBytes = t21 rRscD = t16 rRNAT = t17 rRscE = t18 rKBSPStore = t18 rBSPStore = t19 rRscDelta = t20 rBSP = t21 rPreviousMode = t22 pInvl = ps9 /* pInvl = not GUI service */ pVal = pt1 pGui = pt2 /* true if GUI call */ pNoGui = pt3 /* true if no GUI call */ pNatedArg = pt4 /* true if any input argument */ /* register is Nat'ed */ pNoCopy = pt5 /* no in-memory arguments to copy */ pCopy = pt6 pNatedSp = pt7 mov rUNAT = ar.unat mov rPreds = pr mov rPreviousMode = KernelMode mov rIPSR = psr rsm 1 << PSR_I | 1 << PSR_MFH br.sptk Knsc_Allocate ;; // // N.B. KiUserSystemCall is at an offset of 0x20 from KiNormalSystemCall. // Whenever this offset is changed, the definition of kernel system call // stub in services.stb must be updated to reflect the new value. // ALTERNATE_ENTRY(KiUserSystemCall) mov rUNAT = ar.unat mov rPreds = pr epc ;; mov rIPSR = psr rsm (1 << PSR_I) | (1 << PSR_BE) mov rPreviousMode = UserMode ;; // stop bit needed to ensure interrupt is off Knsc_Allocate:: #if defined(INTERRUPTION_LOGGING) // For Conditional Interrupt Logging movl rpT1 = KiVectorLogMask ;; ld8 rT1 = [rpT1] ;; tbit.z pt1 = rT1, UserSystemcallBit (pt1) br.cond.sptk EndOfLogging1 mov rT1 = 0x80 // dummy offset for sys call movl rpT1 = KiPcr+PcInterruptionCount mov rT2 = b0 mov rT3 = MAX_NUMBER_OF_IHISTORY_RECORDS - 1 ;; ld4.nt1 rT4 = [rpT1] // get current count or rT1 = rT1, rPreviousMode // kernel/user ;; add rT0 = 1, rT4 // incr count and rT4 = rT3, rT4 // index of current entry add rpT2 = 0x1000-PcInterruptionCount, rpT1 // base of history ;; st4.nta [rpT1] = rT0 // save count shl rT4 = rT4, 5 // offset of current entry ;; add rpT2 = rpT2, rT4 // address of current entry ;; st8 [rpT2] = rT1, 8 // save sys call offset ;; st8 [rpT2] = rT2, 8 // save return address ;; st8 [rpT2] = rIPSR, 8 // save psr ;; st8.spill [rpT2] = v0; // save sys call number ;; // For Conditional Interrupt Logging EndOfLogging1: #endif // INTERRUPTION_LOGGING // // if sp is Nat'ed return to caller with an error status // N.B. sp is spilled and a value of zero is saved in the IntNats field // tnat.nz pNatedSp = sp movl rpT4 = KiPcr+PcInitialStack ;; mov rSp = sp (pNatedSp) movl rT4 = Knsc_ErrorReturn ;; tnat.nz pNatedArg = v0 // Test service number for NAT. cmp.eq pUser, pKrnl = UserMode, rPreviousMode mov rBSP = ar.bsp (pNatedSp) movl v0 = STATUS_IA64_INVALID_STACK ;; (pUser) ld8 sp = [rpT4], PcInitialBStore-PcInitialStack // set new sp mov rIIP = brp mov rPFS = ar.pfs ;; mov rT2 = ar.rsc (pUser) ld8 rKBSPStore = [rpT4], PcKernelDebugActive-PcInitialBStore (pNatedSp) mov bt1 = rT4 ;; (pUser) ld1 rKDbgActive = [rpT4], PcCurrentThread-PcKernelDebugActive (pKrnl) add rpT4 = PcCurrentThread-PcInitialStack, rpT4 extr.u rIFS = rPFS, 0, 38 mov rT0 = ar.fpsr (pUser) movl rT3 = 1 << PSR_SS | 1 << PSR_DB | 1 << PSR_TB | 1 << PSR_LP (pUser) mov ar.rsc = r0 // put RSE in lazy mode (pUser) add sp = -ThreadStateSaveAreaLength-TrapFrameLength, sp (pKrnl) add sp = -TrapFrameLength, sp // allocate TF ;; (pUser) mov rBSPStore = ar.bspstore // get user bsp store point add rpT1 = TrStIPSR, sp // -> IPSR add rpT2 = TrIntSp, sp // -> IntSp ;; // // Get the previous value of the IPRS from the stack. This is used to get user's debug // values TB, SS, and DB from before they call the system service. KiSingleStepVector and // KiTakenBranchVector clear these bits if they hit on the EPC instruction. This value is // initialized to zero at thread startup and then copied if the user trap frame moves because // of stack convertion or user call backs. // (pUser) ld8 rT4 = [rpT1] st8.spill [rpT2] = rSp, TrApUNAT-TrIntSp // sp is not Nat'ed add rpT3 = TrStIFS, sp // -> IFS (pNatedArg) mov v0 = SERVICE_NUMBER_MASK // v0 is NATed set it to the maximum system service number. dep rIFS = 1, rIFS, 63, 1 // set IFS.v ;; st8 [rpT2] = rUNAT, TrPreds-TrApUNAT st8 [rpT3] = rIFS, TrRsPFS-TrStIFS // save IFS (pUser) and rT4 = rT3, rT4 // capture psr.db, tb, ss ;; st8 [rpT2] = rPreds, TrIntNats-TrPreds st8.nta [rpT3] = rPFS, TrStFPSR-TrRsPFS // save PFS (pUser) mov rT3 = rIPSR rBspOff = t5 extr.u rBspOff = rBSP, 0, 9 extr.u t0 = rIFS, 0, 7 extr.u rIFS = rIFS, 7, 7 ;; (pUser) mov rRNAT = ar.rnat movl rT1 = 1 << PSR_I | 1 << PSR_MFH | 1 << PSR_BE sub rIFS = t0, rIFS movl t0 = 1 << PSR_I | 1 << PSR_BN ;; (pUser) or rIPSR = rIPSR, rT4 (pUser) cmp.ne.unc pKDbg, pt2 = zero, rKDbgActive // kernel debug active? shladd rBspOff = rIFS, 3, rBspOff shladd rBSP = rIFS, 3, rBSP mov rT4 = 0x1F8 (pUser) dep t0 = 1, t0, PSR_CPL, 2 ;; st8 [rpT2] = zero,TrIntGp-TrIntNats // all integer Nats are 0 st8 [rpT3] = rT0, TrStIIP-TrStFPSR // save FPSR (pUser) andcm rT3 = rT3, rT1 // clear i, mfh, be cmp.ge pt0 = rBspOff, rT4 or rIPSR = t0, rIPSR // set i, cpl, bn for the saved IPSR ;; st8 [rpT1] = rIPSR // save IPSR st8 [rpT3] = rIIP, TrBrRp-TrStIIP // save IIP (pt2) dep rT3 = 0, rT3, PSR_DB, 1 // disable db in kernel ;; st8.nta [rpT3] = rIIP, TrRsBSP-TrBrRp // save BRP st8.spill [rpT2] = gp, TrIntV0-TrIntGp // Save GP even though it is a temporary // If someone does a get/set context and GP // is zero in the trap fram then set context // will think IIP is a plabel and dereference i. (pt0) add rBSP = 8, rBSP (pUser) dep rT3 = 1, rT3, PSR_AC, 1 // enable alignment check ;; (pt0) add rIFS = 1, rIFS st8.nta [rpT2] = v0, TrRsRSC-TrIntV0 // Sanitize the return value in trap frame. st8 [rpT3] = rBSP, TrRsBSPSTORE-TrRsBSP (pUser) sub rBSP = rBSP, rBSPStore (pUser) mov psr.l = rT3 ;; (pUser) st8 [rpT3] = rBSPStore // save user BSP Store (pUser) dep rT2 = rBSP, rT2, RSC_MBZ1, RSC_LOADRS_LEN (pUser) mov teb = kteb // get Teb pointer movl rT1 = Knsc10 // Leave the EPC page ;; st8 [rpT2] = rT2, TrRsRNAT-TrRsRSC // save RSC (pUser) dep rKBSPStore = rBSPStore, rKBSPStore, 0, 9 mov bt0 = rT1 // Addres of Knsc10 in KSEG0. ;; (pUser) mov ar.bspstore = rKBSPStore // switch to kernel BSP movl gp = _gp // set up kernel gp ;; (pUser) mov ar.rnat = rRNAT // preserve uer RNAT bits (pUser) st8 [rpT2] = rRNAT // save RNAT in trap frame (pUser) mov ar.rsc = RSC_KERNEL // turn rse on, in kernel mode (pNatedSp) br.spnt bt1 br.sptk bt0 ;; // // Register aliases for rest of procedure // #ifdef _CAPKERN .regstk 8, 9, 2, 0 #else .regstk 8, 9, 0, 0 #endif rScallGp = loc0 rpThObj = loc1 // pointer to thread object rSavedV0 = loc2 // saved v0 for GUI thread rpEntry = loc3 // syscall routine entry point rSnumber = loc4 // service number rSdOffset = loc5 rCount = loc6 /* index of the first Nat'ed input register */ rUserSp = loc7 rUserPFS = loc8 // // The following code is an out of band error path. Since we always // branch between the EPC page to Knsc10 below. // Knsc_Invalid: // // If rSdOffset == SERVICE_TABLE_TEST then service number is GUI service // cmp.ne pInvl, pVal = SERVICE_TABLE_TEST, rSdOffset mov v0 = 1 (pVal) br.call.sptk brp = PsConvertToGuiThread ;; cmp4.eq pVal, p0 = 0, v0 // pVal = 1, if successful movl v0 = STATUS_INVALID_SYSTEM_SERVICE // invalid, if not successful ;; add rpEntry = @gprel(KeServiceDescriptorTableShadow),gp // Load address of table of shadow table // Used by KiSystemServiceRepeat and the // fall through case below. (pVal) br.sptk KiSystemServiceRepeat // br if successful (pInvl) br.spnt Knsc_ErrorReturn // br to KiSystemServiceExit if ;; // system call out of range // // The conversion to a Gui thread failed. The correct return value is encoded // in a byte table indexed by the service number that is at the end of the // service address table. The encoding is as follows: ;; // // 0 - return 0. // -1 - return -1. // 1 - return status code. // add rpT1 = SERVICE_TABLE_TEST, rpEntry // Get addr of the GUI table ;; ld8 rpT2 = [rpT1], SdLimit - SdBase // Get the table base. ;; ld4 rT1 = [rpT1] // Get the limit. add rpT2 = rpT2, rSnumber // Index by the server number to the correct byte. ;; shladd rpT2 = rT1, 3, rpT2 // Calculate the end of the table. cmp4.ltu pt1, pt0 = rSnumber, rT1 // pt1 = number < limit ;; // pt1 == 0 implies return an ntstatus. (pt1) ld1 rT1 = [rpT2] // Load the flag byte if within table ;; sxt1 rT2 = rT1 // Sign extend the result (pt1) cmp.eq pt0, pt1 = 1, rT1 // Test for 1 which means return STATUS_INVALID_SYSTEM_SERVICE ;; (pt1) mov v0 = rT2 // Use the flag value if needed. br.sptk Knsc_ErrorReturn // br to KiSystemServiceExit ;; // // Now running with user banked registers and on kernel backing store // // Can now take TLB faults // // Preserve the output args (as in's) in the local frame until it's ready to // call the specified system service because other calls may have to be made // before that. Also allocate locals and one out. // Knsc10: #ifdef _CAPKERN alloc rUserPFS = 8, 9, 2, 0 #else alloc rUserPFS = 8, 9, 0, 0 #endif ld8 rpThObj = [rpT4] add rpT1 = TrEOFMarker, sp ;; mov rUserSp = ar.bsp movl rT1 = FPSR_FOR_KERNEL // initial fpsr value ;; mov ar.fpsr = rT1 // set fpsr movl rT3 = KTRAP_FRAME_EOF | SYSCALL_FRAME ;; st8 [rpT1] = rT3, TrNewBSP - TrEOFMarker mov rCount = pr // save local predicates shladd rUserSp = rIFS, 3, rUserSp ;; st8 [rpT1] = rUserSp // Save NewBSP. mov rSavedV0 = v0 // save syscall # across call mov rUserSp = rSp add rpT2 = ThServiceTable, rpThObj // Address of thread service table add rpT3 = ThTrapFrame, rpThObj mov pr = zero, -1 ;; ld8 rT4 = [rpT3], ThPreviousMode-ThTrapFrame // // the following code uses the predicates to determine the first of // the 8 input argument register whose Nat bit is set. The result // is saved in register rCount and used to determine whether to fail // the system call in Knsc_CheckArguments. // cmp.eq p1 = r32, r32 cmp.eq p9 = r33, r33 cmp.eq p17 = r34, r34 cmp.eq p25 = r35, r35 cmp.eq p33 = r36, r36 cmp.eq p41 = r37, r37 cmp.eq p49 = r38, r38 cmp.eq p57 = r39, r39 ld8 rpEntry = [rpT2] // Load service describtor add rpT1 = TrTrapFrame, sp // -> TrTrapFrame shr.u rSdOffset = rSavedV0, SERVICE_TABLE_SHIFT // isolate service descriptor offset ;; ld1 rT0 = [rpT3] // rT0 = thread's previous mode st1 [rpT3] = rPreviousMode // set new thread previous mode mov rT1 = pr ;; st8 [rpT1] = rT4, TrPreviousMode-TrTrapFrame dep rT1 = 0, rT1, 0, 1 // clear bit 0 mov pr = rCount, -1 // restore local predicates ;; and rSdOffset = SERVICE_TABLE_MASK, rSdOffset extr.u rSnumber = rSavedV0, 0, 12 czx1.r rCount = rT1 // determine which arg is Nat'ed st4 [rpT1] = rT0 FAST_ENABLE_INTERRUPTS (pKDbg) br.call.spnt brp = KiLoadKernelDebugRegisters ;; PROLOGUE_END // // If the specified system service number is not within range, then // attempt to convert the thread to a GUI thread and retry the service // dispatch. // // N.B. The system call arguments, the system service entry point (rpEntry), // the service number (Snumber) // are implicitly preserved in the register stack while attempting to // convert the thread to a GUI thread. v0 and the gp must be preserved // explicitly. // // Validate sys call number // #ifdef _CAPKERN br.call.sptk.few b0=_CAP_ThreadID#;; #endif ALTERNATE_ENTRY(KiSystemServiceRepeat) add rpT1 = ThTrapFrame, rpThObj // rpT1 -> ThTrapFrame add rpSd = rSdOffset, rpEntry // service descriptor -> rpSd cmp4.ne pNoGui, pGui = SERVICE_TABLE_TEST, rSdOffset // check if GUI system service ;; st8 [rpT1] = sp // set trap frame address ld8 rT4 = [rpSd], SdLimit-SdBase // rT4 = table base add rpT1 = TeGdiBatchCount, teb ;; // We assume SdBase == 0 #if SdBase #error "SdBase not equal zero." #endif KiSystemServiceTeb:: ld4 rT1 = [rpSd] // rT1 = table limit (pGui) ld4 rT2 = [rpT1] // get number of batched calls add rScallGp = -8, rT4 // The GP values is just before the Base ;; (pGui) cmp4.eq pNoGui, pGui = 0, rT2 // if bacth calls is non-zero then call flush. cmp4.ltu pt1, pt0 = rSnumber, rT1 // pt1 = number < limit shladd rpT3 = rSnumber, 3, rT4 // -> entry point address ;; (pt1) ld8 rScallGp = [rScallGp] // load syscall gp (pt1) add rpT1 = @gprel(KeGdiFlushUserBatch), gp (pt0) br.dpnt Knsc_Invalid // The system call is out of range. ;; ld8 rpEntry = [rpT3] // -> sys call routine plabel (pGui) ld8 rpT1 = [rpT1] // get KeGdiFlushUserBatch() (pNoGui) br.dptk Knsc_NotGUI // Not a GUI thread ;; Knsc_GUI: // // If the system service is a GUI service and the GDI user batch queue is // not empty, then call the appropriate service to flush the user batch. // ld8 rT1 = [rpT1], PlGlobalPointer-PlEntryPoint // get entry point mov rSavedV0 = rpSd // save service descriptor ;; ld8 gp = [rpT1] // set global pointer mov bt0 = rT1 br.call.sptk brp = bt0 // call to KeGdiFlushUserBatch ;; #if DBG mov rpSd = rSavedV0 // restore service descriptor ;; #endif // // Check for Nat'ed input argument register and // Copy in-memory arguments from caller stack to kernel stack // Knsc_NotGUI: #ifdef _CAPKERN movl out0 = @fptr(KiNormalSystemCall) mov out1 = rpEntry br.call.sptk.few b0=_CAP_Start_Profiling2 #endif #if DBG // checked build code add rpT1 = SdCount-SdLimit, rpSd // rpT1 -> count table address ;; ld8 rpT2 = [rpT1] // service count table address ;; cmp.ne pt0 = rpT2, zero // if zero, no table defined shladd rpT3 = rSnumber, 2, rpT2 // compute service count address ;; (pt0) ld4 rT1 = [rpT3] // increment count ;; (pt0) add rT1 = 1, rT1 ;; (pt0) st4 [rpT3] = rT1 // store result #endif // DBG and rArgNum = 0xf, rpEntry // extract # of arguments and rpEntry = -16, rpEntry // clear least significant 4 bit cmp.ne pNatedArg = zero, zero // assume no Nat'ed argument mov gp = rScallGp movl v0 = STATUS_INVALID_PARAMETER_1 ;; cmp.geu pNoCopy, pCopy = 8, rArgNum // any in-memory arguments ? mov bt0 = rpEntry mov rSp = rUserSp ;; add v0 = rCount, v0 // set return status dep rPFS = 0, rUserPFS, 62, 2 add rArgBytes = -8, rArgNum // rArgBytes contion the number of 16 byte chunks to copy. ;; (pNoCopy) cmp.gt pNatedArg = rArgNum, rCount // any Nat'ed argument ? mov ar.pfs = rPFS // Make the user PFS look like our PFS (pCopy) cmp.gt pNatedArg = 8, rCount ;; alloc rT1 = 0,0,8,0 // output regs are ready (pNatedArg) br.spnt Knsc_ErrorReturn // exit if Nat'ed arg found (pNoCopy) br.sptk KiSystemServiceEnd // skip copy if no memory args // // Get the caller's sp. If caller was user mode, validate the stack pointer // ar.unat contains Nat for previous sp (in TrIntSp) // (pUser) movl rT2 = MI_USER_PROBE_ADDRESS // User sp limit ;; add rArgBytes = -1, rArgBytes // decrement count (pUser) tnat.nz.unc pt1, pt2 = rSp // test user sp for Nat add rpT1 = STACK_SCRATCH_AREA, rSp // adjust previous sp for scratch area ;; (pt2) cmp.geu pt1 = rSp, rT2 // user sp >= PROBE ADDRESS ? add rpT2 = STACK_SCRATCH_AREA, sp // adjust for scratch area ;; add rpT3 = 8, rpT1 // second source pointer add rpT4 = 8, rpT2 // second destination pointer (pt1) mov rpT1 = rT2 // set out of range (includes Nat case) ;; // // At this point rpT1, rpT3 -> source and rpT2, rpT4 -> destination // Copy rArgBytes from source to destination, 16 bytes per iteration // Exceptions handled by KiSystemServiceHandler // KiSystemServiceStart:: Knsc_CopyLoop: ld8 rT1 = [rpT1], 16 // get caller arg ld8 rT2 = [rpT3], 16 // get caller arg cmp4.gt pt1 = rArgBytes, zero // loop if # bytes > 0 ;; nop.m 0 nop.f 0 add rArgBytes = -1, rArgBytes // decrement count st8 [rpT2] = rT1, 16 // store in kernel stack st8 [rpT4] = rT2, 16 // store in kernel stack (pt1) br.dpnt Knsc_CopyLoop ;; KiSystemServiceEnd:: // // N.B. t0 is reserved to pass trap frame address to NtContinue() // mov t0 = sp // for NtContinue() movl rT1 = KiSystemServiceExit ;; // // This is not call since that would change the stack registers. // we want to got to the routine with the same argument regisers // that we entered with. // mov brp = rT1 br.sptk bt0 // call routine(args) ;; KiSystemServiceExit:: // // make the current bsp the same as the saved BSP in the trap frame // add rpT2 = TrStIPSR, sp cover ;; #ifdef _CAPKERN alloc rT1 = ar.pfs, 0, 0, 1, 0 movl gp = _gp // restore to kernel GP value ;; CAPEND(KiNormalSystemCall) br.call.sptk.few b0=_CAP_SetCPU# ;; add rpT2 = TrStIPSR, sp ;; #endif // // At this point: // ar.unat contains Nat for previous sp (ar.unat is preserved register) // sp -> trap frame // // Returning from "call": no need to restore volatile state // *** TBD *** : zero volatile state for security? PPC does zero, mips does not. // // // Update PbSystemCalls // // // Restore thread previous mode and trap frame address from the trap frame // lfetch [rpT2], TrTrapFrame-TrStIPSR movl rpT1 = KiPcr + PcPrcb // rpT1 -> Prcb ;; ld8 rT2 = [rpT2], TrPreviousMode-TrTrapFrame ld8 rpT3 = [rpT1], PcCurrentThread-PcPrcb ;; FAST_DISABLE_INTERRUPTS ld8 rThread = [rpT1] // rpT1 -> current thread add rpT3 = PbSystemCalls, rpT3 // pointer to sys call counter ;; ld4 rT1 = [rpT3] // rT1.4 = counter value ld4 rT3 = [rpT2], TrRsRSC-TrPreviousMode add rpT4 = ThTrapFrame, rThread // -> thread trap frame add rpT1 = ThApcState+AsUserApcPending, rThread ;; (pKrnl) ld8 rRscE = [rpT2] // load user RSC (pUser) ld1 rT4 = [rpT1], ThAlerted - ThApcState - AsUserApcPending add rT1 = 1, rT1 // increment ;; st8 [rpT4] = rT2, ThPreviousMode-ThTrapFrame st4 [rpT3] = rT1 // store ;; st1 [rpT4] = rT3 // restore prevmode in thread mov t0 = sp // set t0 to trap frame (pKrnl) br.spnt Knsc_CommonExit // br if returning to kernel ;; st1 [rpT1] = zero cmp4.eq pt0 = zero, rT4 (pt0) br.sptk KiUserServiceExit ;; alloc rT1 = ar.pfs, 0, 1, 2, 0 add loc0 = TrIntV0, sp add rpT1 = TrIntTeb, sp // // v0 is saved in the trap frame so the return status can be restored // by NtContinue after the user APC has been dispatched. // ssm 1 << PSR_I // enable interrupts mov rT3 = APC_LEVEL ;; SET_IRQL (rT3) ;; st8.nta [loc0] = v0 // save return status in trap frame movl gp = _gp // restore to kernel gp value st8.nta [rpT1] = teb #ifdef _CAPKERN mov rpT1 = out0 ;; CAPSTART(KiNormalSystemCall,KiApcInterrupt) mov out0 = rpT1 #endif mov out1 = sp br.call.sptk brp = KiApcInterrupt ;; CAPEND(KiNormalSystemCall) rsm 1 << PSR_I // disable interrupt ld8.nta v0 = [loc0] // restore system call return status SET_IRQL (zero) HANDLER_EXIT(KiNormalSystemCall) // // KiServiceExit is carefully constructed as a continuation of // KiNormalSystemCall. From now on, t0 must be preserved because it is // used to hold the trap frame address. v0 must be preserved because it // is holding the return status. // This section of code is also written to overwrite the tempoary interger // registers so that no information is leaked back to the user. // HANDLER_ENTRY_EX(KiServiceExit, KiSystemServiceHandler) .prologue .unwabi @nt, EXCEPTION_FRAME .vframe t0 mov t0 = sp ;; ALTERNATE_ENTRY(KiUserServiceExit) (pUser) add rpT3 = TrStIPSR, t0 ;; (pUser) ld8 rpT3 = [rpT3] invala ;; (pUser) tbit.nz.unc pUDbg = rpT3, PSR_DB // if user psr.db set, load user DRs (pUDbg) br.call.spnt brp = KiLoadUserDebugRegisters ;; add rpT1 = TrRsRSC, t0 // -> user RSC add rpT2 = TrRsBSP, t0 // -> user BSP Store ;; PROLOGUE_END ld8 rRscE = [rpT1], TrRsRNAT-TrRsRSC // load user RSC ld8 rBSP = [rpT2] mov rRscD = RSC_KERNEL_DISABLED ;; // // Switch to user BSP -- put in load intensive mode to overlap RS restore // with volatile state restore. // ld8 rRNAT = [rpT1] // user RNAT extr.u rRscDelta = rRscE, RSC_MBZ1, RSC_LOADRS_LEN dep rRscE = r0, rRscE, RSC_MBZ1, RSC_LOADRS_LEN movl rpT1 = KiIA64RseNumOfMaxDirty ;; .regstk 0, 0, 1, 0 alloc rT2 = 0,0,1,0 ld8 rpT1 = [rpT1] dep rRscD = rRscDelta, rRscD, RSC_LOADRS, RSC_LOADRS_LEN sub rBSPStore = rBSP, rRscDelta shr.u out0 = rRscDelta, 3 ;; cmp.gt pt0 = rpT1, out0 sub out0 = rpT1, out0 (pt0) br.call.sptk brp = KeScrubBackingStoreRegisters ;; alloc rT2 = 0, 0, 0, 0 mov ar.rsc = rRscD // turn off RSE ;; loadrs // pull in user regs ;; mov ar.bspstore = rBSPStore // restore user BSP ;; mov ar.rnat = rRNAT // restore user RNAT Knsc_CommonExit: add rpT1 = TrIntSp, t0 movl rpT2 = KiPcr+PcCurrentThread add rpT4 = TrStIPSR, t0 add rpT3 = TrStIIP, t0 ;; ld8 rSp = [rpT1], TrPreds-TrIntSp .pred.rel "mutex",pUser,pKrnl (pUser) ld8 rT1 = [rpT2], PcHighFpOwner-PcCurrentThread (pKrnl) add rpT2 = PcKernelDebugActive-PcCurrentThread, rpT2 ;; ld8 rIPSR = [rpT4], TrStIFS-TrStIPSR (pUser) ld8 rT2 = [rpT2] (pKrnl) mov rPreviousMode = KernelMode ;; ld8 rIIP = [rpT3], TrStFPSR-TrStIIP (pKrnl) ld1 rT2 = [rpT2] (pUser) mov rPreviousMode = UserMode ;; mov ar.rsc = rRscE // restore RSC (pUser) cmp.ne.unc pt0 = rT1, rT2 ;; ld8 rT3 = [rpT3] // load fpsr ld8 rIFS = [rpT4] // load IFS (pt0) dep rIPSR = 1, rIPSR, PSR_DFH, 1 ;; (pKrnl) cmp.ne.unc pKDbg, pt2 = rT2, r0 // hardware debug active? dep rIPSR = 0, rIPSR, PSR_MFH, 1 // psr.mfh ;; ld8 rPreds = [rpT1], TrApUNAT-TrPreds (pt2) dep rIPSR = 0, rIPSR, PSR_DB, 1 // disable db in kernel (pKDbg) dep rIPSR = 1, rIPSR, PSR_DB, 1 // enable db in kernel ;; ld8 rUNAT = [rpT1] mov t11 = r0 // Sanitize mov pr = rPreds // restore preds ;; mov ar.csd = r0 // Sanitize CSD rsm 1 << PSR_IC // disable PSR.ic mov ar.unat = rUNAT // restore UNAT ;; srlz.d // must serialize mov ar.fpsr = rT3 // restore FPSR ;; // // The system return case must be handle separately from the user return // case, so we can determine which stack we are currently using in case // a trap is take before we can return. // mov sp = rSp // // Restore status registers // mov cr.ipsr = rIPSR // restore previous IPSR mov cr.ifs = rIFS // restore previous IFS mov cr.iip = rIIP // restore previous IIP ;; // // Resume at point of interruption (rfi must be at end of instruction group) // rfi ;; Knsc_ErrorReturn: // // N.B. t0 is reserved to pass trap frame address to NtContinue() // add rPFS = TrRsPFS, sp ;; ld8 rPFS = [rPFS] ;; dep rPFS = 0, rPFS, 62, 2 ;; mov ar.pfs = rPFS movl rT1 = KiSystemServiceExit ;; mov brp = rT1 br.ret.sptk brp ;; HANDLER_EXIT(KiServiceExit) .text //++ //-------------------------------------------------------------------- // Routine: // // KiGenericExceptionHandler // // Description: // // First level handler for heavyweight exceptions. // // On entry: // // ic off // interrupts disabled // current frame covered // rHIFA must be initialized to a non-nated value // // Process: // // Notes: // // PCR page mapped with TR //-------------------------------------------------------------------- HANDLER_ENTRY(KiGenericExceptionHandler) .prologue .unwabi @nt, EXCEPTION_FRAME ALLOCATE_TRAP_FRAME // // sp points to trap frame // // Save exception handler routine in kernel register // mov rkHandler = rHHandler movl rTH3 = KiPcr+PcSavedIFA ;; st8 [rTH3] = rHIFA // // Save interruption state in trap frame and switch to user bank registers // and switch to kernel backing store. // SAVE_INTERRUPTION_STATE // // Now running with user banked registers and on kernel stack. // // Can now take TLB faults // // sp -> trap frame // br.call.sptk brp = KiSaveTrapFrame ;; // // Register aliases // rpT1 = t0 rpT2 = t1 rpT3 = t2 rT1 = t3 rT2 = t4 rT3 = t5 rPreviousMode = t6 // previous mode rT4 = t7 mov rT1 = rkHandler // restore address of interruption routine movl rpT1 = KiPcr+PcSavedIIM ;; ld8 rT2 = [rpT1], PcSavedIFA-PcSavedIIM // load saved IIM add rpT2 = TrEOFMarker, sp add rpT3 = TrStIIM, sp ;; ld8 rT4 = [rpT1] // load saved IFA movl rT3 = KTRAP_FRAME_EOF | EXCEPTION_FRAME ;; mov t8 = ar.bsp st8 [rpT2] = rT3, TrNewBSP-TrEOFMarker st8 [rpT3] = rT2, TrStIFA-TrStIIM // save IIM in trap frame ;; .regstk 0, 1, 2, 0 // must match KiExceptionExit alloc out1 = 0,1,2,0 st8 [rpT3] = rT4 // save IFA in trap frame mov bt0 = rT1 // set destination address PROLOGUE_END // // Dispatch the exception via call to address in rkHandler // .pred.rel "mutex",pUser,pKrnl add rpT1 = TrPreviousMode, sp // -> previous mode (pUser) mov rPreviousMode = UserMode // set previous mode (pKrnl) mov rPreviousMode = KernelMode ;; st4 [rpT1] = rPreviousMode // save in trap frame st8 [rpT2] = t8 // Save new BSP for debugging (pKDbg) br.call.spnt brp = KiLoadKernelDebugRegisters ;; FAST_ENABLE_INTERRUPTS // enable interrupt mov out0 = sp // trap frame pointer br.call.sptk brp = bt0 // call handler(tf) (C code) ;; .pred.rel "mutex",pUser,pKrnl cmp.ne pt0, pt1 = v0, zero (pUser) mov out1 = UserMode (pKrnl) mov out1 = KernelMode // // does not return // mov out0 = sp (pt1) br.cond.sptk KiAlternateExit (pt0) br.call.spnt brp = KiExceptionDispatch ;; // // Interrupts need to be disable be for mess up the stack such that // the unwind code does not work. // FAST_DISABLE_INTERRUPTS ;; ALTERNATE_ENTRY(KiExceptionExit) //++ // // Routine Description: // // This routine is called to exit from an exception. // // N.B. This transfer of control occurs from: // // 1. fall-through from above // 2. exit from continue system service // 3. exit from raise exception system service // 4. exit into user mode from thread startup // // Arguments: // // loc0 - pointer to trap frame // sp - pointer to high preserved float save area + STACK_SCRATCH_AREA // // Return Value: // // Does not return. // //-- // // upon entry of this block, s0 and s1 must be set to the address of // the trap and the exception frames respectively. // // preserved state is restored here because they may have been modified // by SetContext // LEAF_SETUP(0, 1, 2, 0) // must be in sync with // KiGenericExceptionHandler mov loc0 = s0 // -> trap frame mov out0 = s1 // -> exception frame ;; br.call.sptk brp = KiRestoreExceptionFrame ;; mov sp = loc0 // deallocate exception // frame by restoring sp ALTERNATE_ENTRY(KiAlternateExit) // // sp -> trap frame addres // // Interrupts disabled from here to rfi // FAST_DISABLE_INTERRUPTS ;; RETURN_FROM_INTERRUPTION(Ked) // // Add four nop cycles (two bundles) bundles of NOP's to // workaround McKinly Errata. // nop.m 0 ;; nop.m 0 ;; nop.m 0 ;; nop.m 0 ;; HANDLER_EXIT(KiGenericExceptionHandler) //-------------------------------------------------------------------- // Routine: // // KiExternalInterruptHandler // // Description: // // First level external interrupt handler. Dispatch highest priority // pending interrupt. // // On entry: // // ic off // interrupts disabled // current frame covered // // Process: //-------------------------------------------------------------------- HANDLER_ENTRY(KiExternalInterruptHandler) // // Now running with user banked registers and on kernel backing store. // N.B. sp -> trap frame // // Can now take TLB faults // .prologue .unwabi @nt, INTERRUPT_FRAME .regstk 0, 4, 2, 0 alloc loc0 = 0, 4, 2, 0 // // Register aliases // rVector = loc0 rSaveGP = loc1 rpSaveIrql = loc2 // -> old irql in trap frame rOldIrql = loc3 rpT1 = t0 rpT2 = t1 rpT3 = t2 rT1 = t3 rT2 = t4 rT3 = t5 rPreviousMode = t6 // previous mode rNewIrql = t7 pEOI = pt1 movl rOldIrql = KiPcr+PcCurrentIrql ;; // // Save kernel gp // mov rSaveGP = gp // // Get the vector number // mov rVector = cr.ivr // for A0 2173 workaround br.call.sptk brp = KiSaveTrapFrame ;; #if defined(INTERRUPTION_LOGGING) movl t0 = KiVectorLogMask ;; ld8 t1 = [t0] ;; tbit.z pt1 = t1, ExternalInterruptBit (pt1) br.cond.sptk EndOfLogging2 movl t0 = KiPcr+PcInterruptionCount ;; ld4.nt1 t0 = [t0] mov t1 = MAX_NUMBER_OF_IHISTORY_RECORDS - 1 ;; add t0 = -1, t0 movl t2 = KiPcr+0x1000 ;; and t1 = t0, t1 ;; shl t1 = t1, 5 ;; add t0 = t2, t1 ;; add t0 = 24, t0 ;; st8.nta [t0] = rVector // save ivr in the Extra0 field // For Conditional Interrupt Logging EndOfLogging2: #endif // defined(INTERRUPTION_LOGGING) // // Exit if spurious interrupt vector // cmp.eq pt0, pt1 = 0xF, rVector ld1 rOldIrql = [rOldIrql] // The Irql in the PCR has been santized in // SAVE_INTERRUPTION_STATE. (pt0) br.spnt Keih_Exit ;; // // sp -> trap frame // add rpSaveIrql = TrEOFMarker, sp movl rT3 = KTRAP_FRAME_EOF | INTERRUPT_FRAME ;; st8 [rpSaveIrql] = rT3, TrPreviousMode - TrEOFMarker .pred.rel "mutex",pUser,pKrnl (pUser) mov rPreviousMode = UserMode // set previous mode (pKrnl) mov rPreviousMode = KernelMode ;; st4 [rpSaveIrql] = rPreviousMode, TrOldIrql-TrPreviousMode ;; st4 [rpSaveIrql] = rOldIrql // save irql in trap frame (pKDbg) br.call.spnt brp = KiLoadKernelDebugRegisters ;; PROLOGUE_END Keih_InterruptLoop: // // Dispatch the interrupt: first raise the IRQL to the level of the new // interrupt and enable interrupts. // GET_IRQL_FOR_VECTOR(p0, rNewIrql, rVector) movl rpT3 = KiPcr+PcInterruptRoutine // -> interrupt routine table ;; shladd rpT3 = rVector, INT_ROUTINES_SHIFT, rpT3 // base + offset SET_IRQL (rNewIrql) // raise to new level movl rpT1 = KiPcr + PcPrcb // pointer to prcb ;; ld8 out0 = [rpT3] // out0 -> interrupt dispatcher ld8 rpT1 = [rpT1] mov out1 = sp // out1 -> trap frame ;; FAST_ENABLE_INTERRUPTS add rpT1 = PbInterruptCount, rpT1 // -> interrupt counter ;; ld4.nta rT1 = [rpT1] // counter value ld8.nta rT2 = [out0], PlGlobalPointer-PlEntryPoint // get entry point ;; add rT1 = 1, rT1 // increment ;; // // Call the interrupt dispatch routine via a function pointer // st4.nta [rpT1] = rT1 // store, ignore overflow ;; ld8.nta gp = [out0], PlEntryPoint-PlGlobalPointer mov bt0 = rT2 br.call.sptk brp = bt0 // call ISR ;; ld4 rOldIrql = [rpSaveIrql] mov gp = rSaveGP END_OF_INTERRUPT // end of interrupt processing IO_END_OF_INTERRUPT(rVector,rT1,rT2,pEOI) ;; srlz.d // // Disable interrupts and restore IRQL level // FAST_DISABLE_INTERRUPTS cmp.gt pt0 = APC_LEVEL, rOldIrql mov t0 = APC_LEVEL ;; (pt0) br.spnt ke_call_apc ke_call_apc_resume: LOWER_IRQL (rOldIrql) // // Get the next vector number // mov rVector = cr.ivr // for A0 2173 workaround ;; // // Loop if more interrupts pending (spurious vector == 0xF) // cmp.ne pt0 = 0xF, rVector ;; (pt0) br.spnt Keih_InterruptLoop br.sptk Keih_Exit ;; ke_call_apc: LOWER_IRQL (t0) ke_call_apc1: movl t0 = KiPcr+PcApcInterrupt ;; ld1 t1 = [t0] st1 [t0] = r0 ;; cmp.eq pt0 = r0, t1 ;; (pt0) br.sptk ke_call_apc_resume FAST_ENABLE_INTERRUPTS mov out1 = sp br.call.sptk brp = KiApcInterrupt FAST_DISABLE_INTERRUPTS br.sptk ke_call_apc1 Keih_Exit: RETURN_FROM_INTERRUPTION(Keih) HANDLER_EXIT(KiExternalInterruptHandler) //-------------------------------------------------------------------- // Routine: // // KiPanicHandler // // Description: // // Handler for panic. Call the bug check routine. A place // holder for now. // // On entry: // // running on kernel memory stack and kernel backing store // sp: top of stack -- points to trap frame // interrupts enabled // // IIP: address of bundle causing fault // // IPSR: copy of PSR at time of interruption // // Output: // // sp: top of stack -- points to trap frame // // Return value: // // none // // Notes: // // If ISR code out of bounds, this code will inovke the panic handler // //-------------------------------------------------------------------- HANDLER_ENTRY(KiPanicHandler) .prologue .unwabi @nt, EXCEPTION_FRAME mov ar.k1 = rTH1 // Save Old Stack Limit mov ar.k2 = rTH2 // Save Old BSP Limit mov ar.k4 = rHVector mov rkHandler = rHHandler ;; mov rHpT1 = KERNEL_STACK_SIZE movl rTH1 = KiPcr+PcPanicStack ;; ld8 sp = [rTH1], PcInitialStack-PcPanicStack movl rTH2 = KiPcr+PcSystemReserved ;; st4 [rTH2] = rPanicCode st8 [rTH1] = sp, PcStackLimit-PcInitialStack sub rTH2 = sp, rHpT1 ;; st8 [rTH1] = rTH2, PcInitialBStore-PcStackLimit mov rHpT1 = KERNEL_BSTORE_SIZE ;; st8 [rTH1] = sp, PcBStoreLimit-PcInitialBStore add rTH2 = rHpT1, sp add sp = -TrapFrameLength, sp ;; st8 [rTH1] = rTH2, PcSavedIFA - PcBStoreLimit ;; st8 [rTH1] = rHIFA, PcSavedIIM - PcSavedIFA mov rTH2 = cr.iha ;; st8 [rTH1] = rTH2 // save iha in the iim field SAVE_INTERRUPTION_STATE // // switch to kernel back // bsw.0 ;; rpRNAT = h16 rpBSPStore= h17 rBSPStore = h18 rKBSPStore= h19 rRNAT = h20 rKrnlFPSR = h21 mov ar.rsc = r0 // put RSE in lazy mode movl rKBSPStore = KiPcr+PcInitialBStore ;; mov rBSPStore = ar.bspstore mov rRNAT = ar.rnat ;; ld8 rKBSPStore = [rKBSPStore] add rpRNAT = TrRsRNAT, sp add rpBSPStore = TrRsBSPSTORE, sp ;; st8 [rpRNAT] = rRNAT st8 [rpBSPStore] = rBSPStore dep rKBSPStore = rBSPStore, rKBSPStore, 0, 9 ;; mov ar.bspstore = rKBSPStore mov ar.rsc = RSC_KERNEL ;; // // switch to user bank // bsw.1 ;; alloc out0 = ar.pfs, 0, 0, 5, 0 ;; PROLOGUE_END br.call.sptk brp = KiSaveTrapFrame ;; movl rpT1 = KiPcr+PcSavedIIM ;; ld8 rT2 = [rpT1], PcSavedIFA-PcSavedIIM // load iha ;; ld8 rT3 = [rpT1] // load ifa add rpT3 = TrStIHA, sp ;; st8 [rpT3] = rT2, TrStIFA-TrStIHA ;; st8 [rpT3] = rT3 // Raise the IRQL to HIGH add rpT2 = TrOldIrql, sp movl rpT1 = KiPcr + PcCurrentIrql ;; ld1 rT1 = [rpT1] mov rT2 = HIGH_LEVEL ;; st1 [rpT2] = rT1 st1 [rpT1] = rT2 dep.z rT3 = rT2, TPR_MIC, TPR_MIC_LEN ;; mov cr.tpr = rT3 mov out2 = ar.k4 // 3rd argument: caller of panic mov out3 = rkHandler movl out0 = KiPcr+PcSystemReserved ;; ld4 out0 = [out0] // 1st argument: panic code mov out1 = sp // 2nd argument: trap frame br.call.sptk.many brp = KeBugCheckEx ;; nop.m 0 nop.m 0 nop.i 0 ;; HANDLER_EXIT(KiPanicHandler) //++ //-------------------------------------------------------------------- // Routine: // // VOID // KiSaveTrapFrame(PKTRAP_FRAME) // // Description: // // Save volatile application state in trap frame. // Note: sp, brp, UNAT, RSC, predicates, BSP, BSP Store, // PFS, CSD, and FPSR saved elsewhere. // // Input: // // sp: points to trap frame // ar.unat: contains the Nats of sp, gp, teb, which have already // been spilled into the trap frame. // // Output: // // None // // Return value: // // none // //-------------------------------------------------------------------- LEAF_ENTRY(KiSaveTrapFrame) .regstk 0, 3, 0, 0 // // Local register aliases // rpTF1 = loc0 rpTF2 = loc1 rL1 = t0 rL2 = t1 rL3 = t2 rL4 = t3 rL5 = t4 // // (ar.unat unchanged from point of save) // Spill temporary (volatile) integer registers // alloc loc2 = 0,3,0,0 // don't destroy static register add rpTF1 = TrIntT0, sp // -> t0 save area add rpTF2 = TrIntT1, sp // -> t1 save area ;; .mem.offset 0,0 st8.spill [rpTF1] = t0, TrIntT2-TrIntT0 // spill t0 - t22 .mem.offset 8,0 st8.spill [rpTF2] = t1, TrIntT3-TrIntT1 ;; .mem.offset 0,0 st8.spill [rpTF1] = t2, TrIntT4-TrIntT2 .mem.offset 8,0 st8.spill [rpTF2] = t3, TrIntT5-TrIntT3 ;; .mem.offset 0,0 st8.spill [rpTF1] = t4, TrIntT6-TrIntT4 .mem.offset 8,0 st8.spill [rpTF2] = t5, TrIntT7-TrIntT5 mov rL2 = bt0 ;; mov rL1 = ar.csd mov rL4 = ar.ccv mov rL3 = bt1 ;; .mem.offset 0,0 st8.spill [rpTF1] = t6, TrIntT8-TrIntT6 .mem.offset 8,0 st8.spill [rpTF2] = t7, TrIntT9-TrIntT7 mov t5 = cr.tpr // Capture the real IRQL ;; .mem.offset 0,0 st8.spill [rpTF1] = t8, TrIntT10-TrIntT8 .mem.offset 8,0 st8.spill [rpTF2] = t9, TrIntT11-TrIntT9 ;; .mem.offset 0,0 st8.spill [rpTF1] = t10, TrIntT12-TrIntT10 .mem.offset 8,0 st8.spill [rpTF2] = t11, TrIntT13-TrIntT11 ;; .mem.offset 0,0 st8.spill [rpTF1] = t12, TrIntT14-TrIntT12 .mem.offset 8,0 st8.spill [rpTF2] = t13, TrIntT15-TrIntT13 ;; .mem.offset 0,0 st8.spill [rpTF1] = t14, TrIntT16-TrIntT14 .mem.offset 8,0 st8.spill [rpTF2] = t15, TrIntT17-TrIntT15 ;; .mem.offset 0,0 st8.spill [rpTF1] = t16, TrIntT18-TrIntT16 .mem.offset 8,0 st8.spill [rpTF2] = t17, TrIntT19-TrIntT17 ;; .mem.offset 0,0 st8.spill [rpTF1] = t18, TrIntT20-TrIntT18 .mem.offset 8,0 st8.spill [rpTF2] = t19, TrIntT21-TrIntT19 ;; .mem.offset 0,0 st8.spill [rpTF1] = t20, TrIntT22-TrIntT20 .mem.offset 8,0 st8.spill [rpTF2] = t21, TrIntV0-TrIntT21 ;; .mem.offset 0,0 st8.spill [rpTF1] = t22, TrBrT0-TrIntT22 .mem.offset 8,0 st8.spill [rpTF2] = v0, TrBrT1-TrIntV0 // spill old V0 ;; st8 [rpTF1] = rL2, TrApCCV-TrBrT0 // save old bt0 - bt1 st8 [rpTF2] = rL3 mov rL5 = ar.unat ;; st8 [rpTF1] = rL4, TrSegCSD-TrApCCV // save ar.ccv movl rL3 = KiPcr+PcCurrentIrql ;; st8 [rpTF1] = rL1 // save ar.csd add rpTF1 = TrFltT0, sp // point to FltT0 add rpTF2 = TrFltT1, sp // point to FltT1 ;; // // Spill temporary (volatile) floating point registers // stf.spill [rpTF1] = ft0, TrFltT2-TrFltT0 // spill float tmp 0 - 9 stf.spill [rpTF2] = ft1, TrFltT3-TrFltT1 ;; stf.spill [rpTF1] = ft2, TrFltT4-TrFltT2 stf.spill [rpTF2] = ft3, TrFltT5-TrFltT3 ;; stf.spill [rpTF1] = ft4, TrFltT6-TrFltT4 stf.spill [rpTF2] = ft5, TrFltT7-TrFltT5 ;; stf.spill [rpTF1] = ft6, TrFltT8-TrFltT6 stf.spill [rpTF2] = ft7, TrFltT9-TrFltT7 add t20 = TrIntNats, sp ;; stf.spill [rpTF1] = ft8 stf.spill [rpTF2] = ft9 extr.u t5 = t5, TPR_MIC, TPR_MIC_LEN ;; st8 [t20] = rL5 // save volatile iNats st1 [rL3] = t5 // Sanitize currnet IRQL in PCR. LEAF_RETURN ;; LEAF_EXIT(KiSaveTrapFrame) //++ //-------------------------------------------------------------------- // Routine: // // VOID // KiRestoreTrapFrame(PKTRAP_FRAME) // // Description: // // Restore volatile application state from trap frame. Restore CSD // Note: sp, brp, RSC, UNAT, predicates, BSP, BSP Store, PFS, // CSD and FPSR not restored here. // // Input: // // sp: points to trap frame // RSE frame size is zero // // Output: // // None // // Return value: // // none // //-------------------------------------------------------------------- LEAF_ENTRY(KiRestoreTrapFrame) LEAF_SETUP(0,2,0,0) rpTF1 = loc0 rpTF2 = loc1 mov t21 = psr add t12 = TrIntNats, sp add rpTF2 = TrApCCV, sp ;; ld8 t0 = [t12], TrBrT0-TrIntNats ld8 t1 = [rpTF2], TrBrT1-TrApCCV add rpTF1 = TrFltT0, sp ;; ld8 t2 = [t12], TrStFPSR-TrBrT0 ld8 t3 = [rpTF2], TrSegCSD-TrBrT1 ;; ld8 t10 = [t12] ld8 t11 = [rpTF2], TrFltT1-TrSegCSD ;; ldf.fill ft0 = [rpTF1], TrFltT2-TrFltT0 ldf.fill ft1 = [rpTF2], TrFltT3-TrFltT1 ;; mov ar.unat = t0 ldf.fill ft2 = [rpTF1], TrFltT4-TrFltT2 ldf.fill ft3 = [rpTF2], TrFltT5-TrFltT3 ;; ldf.fill ft4 = [rpTF1], TrFltT6-TrFltT4 ldf.fill ft5 = [rpTF2], TrFltT7-TrFltT5 ;; ldf.fill ft6 = [rpTF1], TrFltT8-TrFltT6 ldf.fill ft7 = [rpTF2], TrFltT9-TrFltT7 ;; ldf.fill ft8 = [rpTF1], TrIntGp-TrFltT8 ldf.fill ft9 = [rpTF2], TrIntT0-TrFltT9 ;; mov ar.ccv = t1 ld8.fill gp = [rpTF1], TrIntT1-TrIntGp ;; ld8.fill t0 = [rpTF2], TrIntT2-TrIntT0 ld8.fill t1 = [rpTF1], TrIntT3-TrIntT1 mov bt0 = t2 ;; mov ar.csd = t11 ld8.fill t2 = [rpTF2], TrIntT4-TrIntT2 mov bt1 = t3 ;; ld8.fill t3 = [rpTF1], TrIntT5-TrIntT3 tbit.z pt1 = t21, PSR_MFL mov ar.fpsr = t10 ld8.fill t4 = [rpTF2], TrIntT6-TrIntT4 ;; ld8.fill t5 = [rpTF1], TrIntT7-TrIntT5 ld8.fill t6 = [rpTF2], TrIntT8-TrIntT6 ;; ld8.fill t7 = [rpTF1], TrIntT9-TrIntT7 ld8.fill t8 = [rpTF2], TrIntT10-TrIntT8 ;; ld8.fill t9 = [rpTF1], TrIntT11-TrIntT9 ld8.fill t10 = [rpTF2], TrIntT12-TrIntT10 ;; ld8.fill t11 = [rpTF1], TrIntT13-TrIntT11 ld8.fill t12 = [rpTF2], TrIntT14-TrIntT12 ;; ld8.fill t13 = [rpTF1], TrIntT15-TrIntT13 ld8.fill t14 = [rpTF2], TrIntT16-TrIntT14 ;; ld8.fill t15 = [rpTF1], TrIntT17-TrIntT15 ld8.fill t16 = [rpTF2], TrIntT18-TrIntT16 ;; ld8.fill t17 = [rpTF1], TrIntT19-TrIntT17 ld8.fill t18 = [rpTF2], TrIntT20-TrIntT18 ;; ld8.fill t19 = [rpTF1], TrIntT21-TrIntT19 ld8.fill t20 = [rpTF2], TrIntT22-TrIntT20 ;; ld8.fill t21 = [rpTF1], TrIntTeb-TrIntT21 ld8.fill t22 = [rpTF2], TrIntV0-TrIntT22 ;; ld8.fill teb = [rpTF1] ld8.fill v0 = [rpTF2] br.ret.sptk.many brp ;; LEAF_EXIT(KiRestoreTrapFrame) //++ //-------------------------------------------------------------------- // Routine: // // VOID // KiLoadKernelDebugRegisters // // Description: // // We maintain two debug register flags: // 1. Thread DebugActive: Debug registers active for current thread // 2. PCR KernelDebugActive: Debug registers active in kernel mode // (setup by kernel debugger) // // On user -> kernel transitions there are four possibilities: // // Thread Kernel // DebugActive DebugActive Action // // 1. 0 0 None // // 2. 1 0 None (kernel PSR.db = 0 by default) // // 3. 0 1 Set PSR.db = 1 for kernel // // 4. 1 1 Set PSR.db = 1 for kernel and // load kernel debug registers // // Note we never save the user debug registers: // the user cannot change the DRs so the values in the DR save area are // always up-to-date (set by SetContext). // // Input: // // None (Previous mode is USER) // // Output: // // None // // Return value: // // none // //-------------------------------------------------------------------- NESTED_ENTRY(KiLoadKernelDebugRegisters) PROLOGUE_BEGIN movl t10 = KiPcr+PcPrcb ;; ld8 t10 = [t10] // load prcb address cmp.eq pt3, pt2 = r0, r0 ;; add t11 = PbProcessorState+KpsSpecialRegisters+KsKernelDbI0,t10 add t12 = PbProcessorState+KpsSpecialRegisters+KsKernelDbI1,t10 add t13 = PbProcessorState+KpsSpecialRegisters+KsKernelDbD0,t10 add t14 = PbProcessorState+KpsSpecialRegisters+KsKernelDbD1,t10 br Krdr_Common ;; ALTERNATE_ENTRY(KiLoadUserDebugRegisters) // // Restore debug registers, if debug active // cmp.ne pt3, pt2 = r0, r0 movl t10 = KiPcr+PcCurrentThread ;; ld8 t10 = [t10] // get current thread pointer ;; add t10 = ThStackBase, t10 ;; ld8.nta t10 = [t10] // get stack base ;; add t11 = -ThreadStateSaveAreaLength+TsDebugRegisters+DrDbI0,t10 add t12 = -ThreadStateSaveAreaLength+TsDebugRegisters+DrDbI1,t10 add t13 = -ThreadStateSaveAreaLength+TsDebugRegisters+DrDbD0,t10 add t14 = -ThreadStateSaveAreaLength+TsDebugRegisters+DrDbD1,t10 ;; Krdr_Common: .regstk 0, 2, 2, 0 .save ar.pfs, savedpfs alloc savedpfs = ar.pfs, 0, 2, 2, 0 .save b0, savedbrp mov savedbrp = brp .save ar.lc, t22 mov t22 = ar.lc // save ar.lc mov t7 = 0 mov t8 = 1 PROLOGUE_END mov ar.lc = 1 // 2 pairs of debug registers ;; Krdr_Loop: ld8 t1 = [t11], 16 // get dbr pair ld8 t2 = [t12], 16 // step by 16 = 1 pair of DRs ld8 t3 = [t13], 16 // get dbr pair ld8 t4 = [t14], 16 // step by 16 = 1 pair of DRs ;; .auto mov ibr[t7] = t1 // restore ibr pair mov ibr[t8] = t2 .auto mov dbr[t7] = t3 // restore dbr pair mov dbr[t8] = t4 ;; #ifndef NO_12241 srlz.d #endif .default add t7 = 2, t7 // next pair add t8 = 2, t8 br.cloop.sptk Krdr_Loop ;; mov ar.lc = t22 // restore ar.lc (pt2) br.ret.sptk brp // return if loading user mov out0 = PSR_DB mov out1 = 1 (pt3) br.call.spnt brp = KeSetLowPsrBit // set psr.db if loading kernel ;; NESTED_RETURN ;; NESTED_EXIT(KiLoadKernelDebugRegisters) //++ //-------------------------------------------------------------------- // Routine: // // VOID // KiSaveExceptionFrame(PKEXCEPTION_FRAME) // // Description: // // Save preserved context in exception frame. // // Note: This routine modifies the UNAT register. The caller // is resposible for preserving UNAT before calling. // // Input: // // a0: points to exception frame // // Output: // // None // // Return value: // // none // // Note: t0 may contain the trap frame address; don't touch it. // //-------------------------------------------------------------------- LEAF_ENTRY(KiSaveExceptionFrame) // // Local register aliases // rpEF1 = t10 rpEF2 = t11 add rpEF1 = ExIntS0, a0 // -> ExIntS0 movl t12 = PFS_EC_MASK << PFS_EC_SHIFT ;; add rpEF2 = ExIntS1, a0 // -> ExIntS1 mov t3 = ar.pfs ;; and t3 = t3, t12 .mem.offset 0,0 st8.spill [rpEF1] = s0, ExIntS2-ExIntS0 .mem.offset 8,0 st8.spill [rpEF2] = s1, ExIntS3-ExIntS1 mov t4 = ar.lc ;; .mem.offset 0,0 st8.spill [rpEF1] = s2, ExApEC-ExIntS2 .mem.offset 8,0 st8.spill [rpEF2] = s3, ExApLC-ExIntS3 mov t5 = bs0 ;; st8 [rpEF1] = t3, ExBrS0-ExApEC st8 [rpEF2] = t4, ExBrS1-ExApLC mov t6 = bs1 ;; mov t2 = ar.unat // save user nat register for mov t7 = bs2 mov t8 = bs3 st8 [rpEF1] = t5, ExBrS2-ExBrS0 st8 [rpEF2] = t6, ExBrS3-ExBrS1 mov t9 = bs4 ;; st8 [rpEF1] = t7, ExBrS4-ExBrS2 st8 [rpEF2] = t8, ExIntNats-ExBrS3 ;; st8 [rpEF1] = t9, ExFltS0-ExBrS4 st8 [rpEF2] = t2, ExFltS1-ExIntNats ;; stf.spill [rpEF1] = fs0, ExFltS2-ExFltS0 stf.spill [rpEF2] = fs1, ExFltS3-ExFltS1 ;; stf.spill [rpEF1] = fs2, ExFltS4-ExFltS2 stf.spill [rpEF2] = fs3, ExFltS5-ExFltS3 ;; stf.spill [rpEF1] = fs4, ExFltS6-ExFltS4 stf.spill [rpEF2] = fs5, ExFltS7-ExFltS5 ;; stf.spill [rpEF1] = fs6, ExFltS8-ExFltS6 stf.spill [rpEF2] = fs7, ExFltS9-ExFltS7 ;; stf.spill [rpEF1] = fs8, ExFltS10-ExFltS8 stf.spill [rpEF2] = fs9, ExFltS11-ExFltS9 ;; stf.spill [rpEF1] = fs10, ExFltS12-ExFltS10 stf.spill [rpEF2] = fs11, ExFltS13-ExFltS11 ;; stf.spill [rpEF1] = fs12, ExFltS14-ExFltS12 stf.spill [rpEF2] = fs13, ExFltS15-ExFltS13 ;; stf.spill [rpEF1] = fs14, ExFltS16-ExFltS14 stf.spill [rpEF2] = fs15, ExFltS17-ExFltS15 ;; stf.spill [rpEF1] = fs16, ExFltS18-ExFltS16 stf.spill [rpEF2] = fs17, ExFltS19-ExFltS17 ;; stf.spill [rpEF1] = fs18 stf.spill [rpEF2] = fs19 LEAF_RETURN ;; LEAF_EXIT(KiSaveExceptionFrame) //-------------------------------------------------------------------- // Routine: // // VOID // KiRestoreExceptionFrame(PKEXCEPTION_FRAME) // // Description: // // Restores preserved context from the exception frame. Also // restore volatile part of floating point context not restored with // rest of volatile context. // // Note: This routine does not use v0, t21 or t22. This routine's // caller may be dependent on these registers (for performance // in the context switch path). // // Note: This routine modifies the UNAT register. The caller // is resposible for restoring UNAT to the correct value. // // Input: // // a0: points to exception frame // // Output: // // None // // Return value: // // none // //-------------------------------------------------------------------- LEAF_ENTRY(KiRestoreExceptionFrame) add t16 = ExIntNats, a0 movl t12 = PFS_EC_MASK << PFS_EC_SHIFT add t17 = ExApEC, a0 nop.f 0 mov t13 = ar.pfs ;; ld8.nta t2 = [t16], ExBrS0-ExIntNats ld8.nta t3 = [t17], ExApLC-ExApEC ;; ld8.nta t5 = [t16], ExBrS1-ExBrS0 ld8.nta t4 = [t17], ExBrS2-ExApLC ;; ld8.nta t6 = [t16], ExBrS3-ExBrS1 ld8.nta t7 = [t17], ExBrS4-ExBrS2 ;; ld8.nta t8 = [t16], ExFltS0-ExBrS3 ld8.nta t9 = [t17], ExFltS1-ExBrS4 ;; ldf.fill.nta fs0 = [t16], ExFltS2-ExFltS0 ldf.fill.nta fs1 = [t17], ExFltS3-ExFltS1 add t18 = ExIntS0, a0 ;; ldf.fill.nta fs2 = [t16], ExFltS4-ExFltS2 ldf.fill.nta fs3 = [t17], ExFltS5-ExFltS3 add t19 = ExIntS1, a0 ;; ldf.fill.nta fs4 = [t16], ExFltS6-ExFltS4 ldf.fill.nta fs5 = [t17], ExFltS7-ExFltS5 andcm t13 = t13, t12 // zero out EC field ;; ldf.fill.nta fs6 = [t16], ExFltS8-ExFltS6 ldf.fill.nta fs7 = [t17], ExFltS9-ExFltS7 and t3 = t3, t12 // capture EC value ;; mov ar.unat = t2 or t13 = t3, t13 // deposit into PFS.EC field ;; ldf.fill.nta fs8 = [t16], ExFltS10-ExFltS8 ldf.fill.nta fs9 = [t17], ExFltS11-ExFltS9 mov ar.pfs = t13 ;; ldf.fill.nta fs10 = [t16], ExFltS12-ExFltS10 ldf.fill.nta fs11 = [t17], ExFltS13-ExFltS11 mov ar.lc = t4 ;; ldf.fill.nta fs12 = [t16], ExFltS14-ExFltS12 ldf.fill.nta fs13 = [t17], ExFltS15-ExFltS13 mov bs0 = t5 ;; ldf.fill.nta fs14 = [t16], ExFltS16-ExFltS14 ldf.fill.nta fs15 = [t17], ExFltS17-ExFltS15 mov bs1 = t6 ;; ldf.fill.nta fs16 = [t16], ExFltS18-ExFltS16 ldf.fill.nta fs17 = [t17], ExFltS19-ExFltS17 mov bs2 = t7 ;; ldf.fill.nta fs18 = [t16] ldf.fill.nta fs19 = [t17] mov bs3 = t8 ld8.fill.nta s0 = [t18], ExIntS2-ExIntS0 ld8.fill.nta s1 = [t19], ExIntS3-ExIntS1 mov bs4 = t9 ;; ld8.fill.nta s2 = [t18] ld8.fill.nta s3 = [t19] LEAF_RETURN ;; LEAF_EXIT(KiRestoreExceptionFrame) //++ //-------------------------------------------------------------------- // Routine: // // KiSaveHigherFPVolatile(PKHIGHER_FP_SAVEAREA) // // Description: // // Save higher FP volatile context in higher FP save area // // Input: // // a0: pointer to higher FP save area // brp: return address // // Output: // // None // // Return value: // // None // //-------------------------------------------------------------------- NESTED_ENTRY(KiSaveHigherFPVolatile) NESTED_SETUP(1, 3, 1, 0) PROLOGUE_END // // Local register aliases // rpSA1 = t0 rpSA2 = t1 // // Clear DFH bit so the high floating point set may be saved by the kernel // Disable interrupts so that save is atomic // GET_IRQL (loc2) mov t2 = psr.um movl t3 = KiPcr+PcCurrentThread ;; cmp.ge pt2, pt3 = APC_LEVEL, loc2 ;; PSET_IRQL (pt2, DISPATCH_LEVEL) ld8 t4 = [t3], PcHighFpOwner-PcCurrentThread ;; ld8 t5 = [t3] ;; cmp.ne pt1 = t4, t5 (pt1) br.cond.spnt Kshfpv20 ;; tbit.z pt0 = t2, PSR_MFH (pt0) br.cond.spnt Kshfpv20 br Kshfpv10 ;; ALTERNATE_ENTRY(KiSaveHigherFPVolatileAtDispatchLevel) NESTED_SETUP(1, 3, 1, 0) cmp.ne pt2, pt3 = r0, r0 // set pt2 to FALSE, pt3 to TRUE PROLOGUE_END movl t3 = KiPcr+PcCurrentThread ;; ld8 t4 = [t3], PcHighFpOwner-PcCurrentThread ;; ld8 t5 = [t3] ;; cmp.ne pt1 = t4, t5 ;; (pt1) break.i BREAKPOINT_STOP Kshfpv10: rsm (1 << PSR_DFH) add rpSA1 = HiFltF32, a0 // -> HiFltF32 add rpSA2 = HiFltF33, a0 // -> HiFltF33 ;; srlz.d stf.spill.nta [rpSA1] = f32, HiFltF34-HiFltF32 stf.spill.nta [rpSA2] = f33, HiFltF35-HiFltF33 ;; stf.spill.nta [rpSA1] = f34, HiFltF36-HiFltF34 stf.spill.nta [rpSA2] = f35, HiFltF37-HiFltF35 ;; stf.spill.nta [rpSA1] = f36, HiFltF38-HiFltF36 stf.spill.nta [rpSA2] = f37, HiFltF39-HiFltF37 ;; stf.spill.nta [rpSA1] = f38, HiFltF40-HiFltF38 stf.spill.nta [rpSA2] = f39, HiFltF41-HiFltF39 ;; stf.spill.nta [rpSA1] = f40, HiFltF42-HiFltF40 stf.spill.nta [rpSA2] = f41, HiFltF43-HiFltF41 ;; stf.spill.nta [rpSA1] = f42, HiFltF44-HiFltF42 stf.spill.nta [rpSA2] = f43, HiFltF45-HiFltF43 ;; stf.spill.nta [rpSA1] = f44, HiFltF46-HiFltF44 stf.spill.nta [rpSA2] = f45, HiFltF47-HiFltF45 ;; stf.spill.nta [rpSA1] = f46, HiFltF48-HiFltF46 stf.spill.nta [rpSA2] = f47, HiFltF49-HiFltF47 ;; stf.spill.nta [rpSA1] = f48, HiFltF50-HiFltF48 stf.spill.nta [rpSA2] = f49, HiFltF51-HiFltF49 ;; stf.spill.nta [rpSA1] = f50, HiFltF52-HiFltF50 stf.spill.nta [rpSA2] = f51, HiFltF53-HiFltF51 ;; stf.spill.nta [rpSA1] = f52, HiFltF54-HiFltF52 stf.spill.nta [rpSA2] = f53, HiFltF55-HiFltF53 ;; stf.spill.nta [rpSA1] = f54, HiFltF56-HiFltF54 stf.spill.nta [rpSA2] = f55, HiFltF57-HiFltF55 ;; stf.spill.nta [rpSA1] = f56, HiFltF58-HiFltF56 stf.spill.nta [rpSA2] = f57, HiFltF59-HiFltF57 ;; stf.spill.nta [rpSA1] = f58, HiFltF60-HiFltF58 stf.spill.nta [rpSA2] = f59, HiFltF61-HiFltF59 ;; stf.spill.nta [rpSA1] = f60, HiFltF62-HiFltF60 stf.spill.nta [rpSA2] = f61, HiFltF63-HiFltF61 ;; stf.spill.nta [rpSA1] = f62, HiFltF64-HiFltF62 stf.spill.nta [rpSA2] = f63, HiFltF65-HiFltF63 ;; stf.spill.nta [rpSA1] = f64, HiFltF66-HiFltF64 stf.spill.nta [rpSA2] = f65, HiFltF67-HiFltF65 ;; stf.spill.nta [rpSA1] = f66, HiFltF68-HiFltF66 stf.spill.nta [rpSA2] = f67, HiFltF69-HiFltF67 ;; stf.spill.nta [rpSA1] = f68, HiFltF70-HiFltF68 stf.spill.nta [rpSA2] = f69, HiFltF71-HiFltF69 ;; stf.spill.nta [rpSA1] = f70, HiFltF72-HiFltF70 stf.spill.nta [rpSA2] = f71, HiFltF73-HiFltF71 ;; stf.spill.nta [rpSA1] = f72, HiFltF74-HiFltF72 stf.spill.nta [rpSA2] = f73, HiFltF75-HiFltF73 ;; stf.spill.nta [rpSA1] = f74, HiFltF76-HiFltF74 stf.spill.nta [rpSA2] = f75, HiFltF77-HiFltF75 ;; stf.spill.nta [rpSA1] = f76, HiFltF78-HiFltF76 stf.spill.nta [rpSA2] = f77, HiFltF79-HiFltF77 ;; stf.spill.nta [rpSA1] = f78, HiFltF80-HiFltF78 stf.spill.nta [rpSA2] = f79, HiFltF81-HiFltF79 ;; stf.spill.nta [rpSA1] = f80, HiFltF82-HiFltF80 stf.spill.nta [rpSA2] = f81, HiFltF83-HiFltF81 ;; stf.spill.nta [rpSA1] = f82, HiFltF84-HiFltF82 stf.spill.nta [rpSA2] = f83, HiFltF85-HiFltF83 ;; stf.spill.nta [rpSA1] = f84, HiFltF86-HiFltF84 stf.spill.nta [rpSA2] = f85, HiFltF87-HiFltF85 ;; stf.spill.nta [rpSA1] = f86, HiFltF88-HiFltF86 stf.spill.nta [rpSA2] = f87, HiFltF89-HiFltF87 ;; stf.spill.nta [rpSA1] = f88, HiFltF90-HiFltF88 stf.spill.nta [rpSA2] = f89, HiFltF91-HiFltF89 ;; stf.spill.nta [rpSA1] = f90, HiFltF92-HiFltF90 stf.spill.nta [rpSA2] = f91, HiFltF93-HiFltF91 ;; stf.spill.nta [rpSA1] = f92, HiFltF94-HiFltF92 stf.spill.nta [rpSA2] = f93, HiFltF95-HiFltF93 ;; stf.spill.nta [rpSA1] = f94, HiFltF96-HiFltF94 stf.spill.nta [rpSA2] = f95, HiFltF97-HiFltF95 ;; stf.spill.nta [rpSA1] = f96, HiFltF98-HiFltF96 stf.spill.nta [rpSA2] = f97, HiFltF99-HiFltF97 ;; stf.spill.nta [rpSA1] = f98, HiFltF100-HiFltF98 stf.spill.nta [rpSA2] = f99, HiFltF101-HiFltF99 ;; stf.spill.nta [rpSA1] = f100, HiFltF102-HiFltF100 stf.spill.nta [rpSA2] = f101, HiFltF103-HiFltF101 ;; stf.spill.nta [rpSA1] = f102, HiFltF104-HiFltF102 stf.spill.nta [rpSA2] = f103, HiFltF105-HiFltF103 ;; stf.spill.nta [rpSA1] = f104, HiFltF106-HiFltF104 stf.spill.nta [rpSA2] = f105, HiFltF107-HiFltF105 ;; stf.spill.nta [rpSA1] = f106, HiFltF108-HiFltF106 stf.spill.nta [rpSA2] = f107, HiFltF109-HiFltF107 ;; stf.spill.nta [rpSA1] = f108, HiFltF110-HiFltF108 stf.spill.nta [rpSA2] = f109, HiFltF111-HiFltF109 ;; stf.spill.nta [rpSA1] = f110, HiFltF112-HiFltF110 stf.spill.nta [rpSA2] = f111, HiFltF113-HiFltF111 ;; stf.spill.nta [rpSA1] = f112, HiFltF114-HiFltF112 stf.spill.nta [rpSA2] = f113, HiFltF115-HiFltF113 ;; stf.spill.nta [rpSA1] = f114, HiFltF116-HiFltF114 stf.spill.nta [rpSA2] = f115, HiFltF117-HiFltF115 ;; stf.spill.nta [rpSA1] = f116, HiFltF118-HiFltF116 stf.spill.nta [rpSA2] = f117, HiFltF119-HiFltF117 ;; stf.spill.nta [rpSA1] = f118, HiFltF120-HiFltF118 stf.spill.nta [rpSA2] = f119, HiFltF121-HiFltF119 ;; stf.spill.nta [rpSA1] = f120, HiFltF122-HiFltF120 stf.spill.nta [rpSA2] = f121, HiFltF123-HiFltF121 ;; stf.spill.nta [rpSA1] = f122, HiFltF124-HiFltF122 stf.spill.nta [rpSA2] = f123, HiFltF125-HiFltF123 ;; stf.spill.nta [rpSA1] = f124, HiFltF126-HiFltF124 stf.spill.nta [rpSA2] = f125, HiFltF127-HiFltF125 ;; stf.spill.nta [rpSA1] = f126 stf.spill.nta [rpSA2] = f127 // // Set DFH bit so the high floating point set may not be used by the kernel // Must clear mfh after fp registers saved // Kshfpv20: ssm 1 << PSR_DFH ;; rum 1 << PSR_MFH (pt3) br.ret.sptk brp LOWER_IRQL(loc2) NESTED_RETURN ;; LEAF_EXIT(KiSaveHigherFPVolatile) //++ //-------------------------------------------------------------------- // Routine: // // KiRestoreHigherFPVolatile() // // Description: // // Restore higher FP volatile context from higher FP save area // // N.B. This function is carefully constructed to use only scratch // registers rHpT1, rHpT3, and rTH2. This function may be // called by C code and the disabled fp vector when user // and kernel bank is used respectively. // N.B. Caller must ensure higher fp enabled (psr.dfh=0) // N.B. Caller must ensure no interrupt during restore // // Input: // // None. // // Output: // // None // // Return value: // // None // //-------------------------------------------------------------------- LEAF_ENTRY(KiRestoreHigherFPVolatile) movl rHpT1 = KiPcr+PcCurrentThread ;; ld8 rHpT3 = [rHpT1], PcHighFpOwner-PcCurrentThread ;; st8 [rHpT1] = rHpT3, PcNumber-PcHighFpOwner add rHpT3 = ThNumber, rHpT3 ;; ld1 rHpT1 = [rHpT1] // load processor # ;; st1 [rHpT3] = rHpT1 // save it in Thread->Number add rHpT3 = ThStackBase-ThNumber, rHpT3 ;; ld8 rHpT3 = [rHpT3] // load kernel stack base ;; add rHpT1 = -ThreadStateSaveAreaLength+TsHigherFPVolatile+HiFltF32, rHpT3 add rHpT3 = -ThreadStateSaveAreaLength+TsHigherFPVolatile+HiFltF33, rHpT3 ;; ldf.fill.nta f32 = [rHpT1], HiFltF34-HiFltF32 ldf.fill.nta f33 = [rHpT3], HiFltF35-HiFltF33 ;; ldf.fill.nta f34 = [rHpT1], HiFltF36-HiFltF34 ldf.fill.nta f35 = [rHpT3], HiFltF37-HiFltF35 ;; ldf.fill.nta f36 = [rHpT1], HiFltF38-HiFltF36 ldf.fill.nta f37 = [rHpT3], HiFltF39-HiFltF37 ;; ldf.fill.nta f38 = [rHpT1], HiFltF40-HiFltF38 ldf.fill.nta f39 = [rHpT3], HiFltF41-HiFltF39 ;; ldf.fill.nta f40 = [rHpT1], HiFltF42-HiFltF40 ldf.fill.nta f41 = [rHpT3], HiFltF43-HiFltF41 ;; ldf.fill.nta f42 = [rHpT1], HiFltF44-HiFltF42 ldf.fill.nta f43 = [rHpT3], HiFltF45-HiFltF43 ;; ldf.fill.nta f44 = [rHpT1], HiFltF46-HiFltF44 ldf.fill.nta f45 = [rHpT3], HiFltF47-HiFltF45 ;; ldf.fill.nta f46 = [rHpT1], HiFltF48-HiFltF46 ldf.fill.nta f47 = [rHpT3], HiFltF49-HiFltF47 ;; ldf.fill.nta f48 = [rHpT1], HiFltF50-HiFltF48 ldf.fill.nta f49 = [rHpT3], HiFltF51-HiFltF49 ;; ldf.fill.nta f50 = [rHpT1], HiFltF52-HiFltF50 ldf.fill.nta f51 = [rHpT3], HiFltF53-HiFltF51 ;; ldf.fill.nta f52 = [rHpT1], HiFltF54-HiFltF52 ldf.fill.nta f53 = [rHpT3], HiFltF55-HiFltF53 ;; ldf.fill.nta f54 = [rHpT1], HiFltF56-HiFltF54 ldf.fill.nta f55 = [rHpT3], HiFltF57-HiFltF55 ;; ldf.fill.nta f56 = [rHpT1], HiFltF58-HiFltF56 ldf.fill.nta f57 = [rHpT3], HiFltF59-HiFltF57 ;; ldf.fill.nta f58 = [rHpT1], HiFltF60-HiFltF58 ldf.fill.nta f59 = [rHpT3], HiFltF61-HiFltF59 ;; ldf.fill.nta f60 = [rHpT1], HiFltF62-HiFltF60 ldf.fill.nta f61 = [rHpT3], HiFltF63-HiFltF61 ;; ldf.fill.nta f62 = [rHpT1], HiFltF64-HiFltF62 ldf.fill.nta f63 = [rHpT3], HiFltF65-HiFltF63 ;; ldf.fill.nta f64 = [rHpT1], HiFltF66-HiFltF64 ldf.fill.nta f65 = [rHpT3], HiFltF67-HiFltF65 ;; ldf.fill.nta f66 = [rHpT1], HiFltF68-HiFltF66 ldf.fill.nta f67 = [rHpT3], HiFltF69-HiFltF67 ;; ldf.fill.nta f68 = [rHpT1], HiFltF70-HiFltF68 ldf.fill.nta f69 = [rHpT3], HiFltF71-HiFltF69 ;; ldf.fill.nta f70 = [rHpT1], HiFltF72-HiFltF70 ldf.fill.nta f71 = [rHpT3], HiFltF73-HiFltF71 ;; ldf.fill.nta f72 = [rHpT1], HiFltF74-HiFltF72 ldf.fill.nta f73 = [rHpT3], HiFltF75-HiFltF73 ;; ldf.fill.nta f74 = [rHpT1], HiFltF76-HiFltF74 ldf.fill.nta f75 = [rHpT3], HiFltF77-HiFltF75 ;; ldf.fill.nta f76 = [rHpT1], HiFltF78-HiFltF76 ldf.fill.nta f77 = [rHpT3], HiFltF79-HiFltF77 ;; ldf.fill.nta f78 = [rHpT1], HiFltF80-HiFltF78 ldf.fill.nta f79 = [rHpT3], HiFltF81-HiFltF79 ;; ldf.fill.nta f80 = [rHpT1], HiFltF82-HiFltF80 ldf.fill.nta f81 = [rHpT3], HiFltF83-HiFltF81 ;; ldf.fill.nta f82 = [rHpT1], HiFltF84-HiFltF82 ldf.fill.nta f83 = [rHpT3], HiFltF85-HiFltF83 ;; ldf.fill.nta f84 = [rHpT1], HiFltF86-HiFltF84 ldf.fill.nta f85 = [rHpT3], HiFltF87-HiFltF85 ;; ldf.fill.nta f86 = [rHpT1], HiFltF88-HiFltF86 ldf.fill.nta f87 = [rHpT3], HiFltF89-HiFltF87 ;; ldf.fill.nta f88 = [rHpT1], HiFltF90-HiFltF88 ldf.fill.nta f89 = [rHpT3], HiFltF91-HiFltF89 ;; ldf.fill.nta f90 = [rHpT1], HiFltF92-HiFltF90 ldf.fill.nta f91 = [rHpT3], HiFltF93-HiFltF91 ;; ldf.fill.nta f92 = [rHpT1], HiFltF94-HiFltF92 ldf.fill.nta f93 = [rHpT3], HiFltF95-HiFltF93 ;; ldf.fill.nta f94 = [rHpT1], HiFltF96-HiFltF94 ldf.fill.nta f95 = [rHpT3], HiFltF97-HiFltF95 ;; ldf.fill.nta f96 = [rHpT1], HiFltF98-HiFltF96 ldf.fill.nta f97 = [rHpT3], HiFltF99-HiFltF97 ;; ldf.fill.nta f98 = [rHpT1], HiFltF100-HiFltF98 ldf.fill.nta f99 = [rHpT3], HiFltF101-HiFltF99 ;; ldf.fill.nta f100 = [rHpT1], HiFltF102-HiFltF100 ldf.fill.nta f101 = [rHpT3], HiFltF103-HiFltF101 ;; ldf.fill.nta f102 = [rHpT1], HiFltF104-HiFltF102 ldf.fill.nta f103 = [rHpT3], HiFltF105-HiFltF103 ;; ldf.fill.nta f104 = [rHpT1], HiFltF106-HiFltF104 ldf.fill.nta f105 = [rHpT3], HiFltF107-HiFltF105 ;; ldf.fill.nta f106 = [rHpT1], HiFltF108-HiFltF106 ldf.fill.nta f107 = [rHpT3], HiFltF109-HiFltF107 ;; ldf.fill.nta f108 = [rHpT1], HiFltF110-HiFltF108 ldf.fill.nta f109 = [rHpT3], HiFltF111-HiFltF109 ;; ldf.fill.nta f110 = [rHpT1], HiFltF112-HiFltF110 ldf.fill.nta f111 = [rHpT3], HiFltF113-HiFltF111 ;; ldf.fill.nta f112 = [rHpT1], HiFltF114-HiFltF112 ldf.fill.nta f113 = [rHpT3], HiFltF115-HiFltF113 ;; ldf.fill.nta f114 = [rHpT1], HiFltF116-HiFltF114 ldf.fill.nta f115 = [rHpT3], HiFltF117-HiFltF115 ;; ldf.fill.nta f116 = [rHpT1], HiFltF118-HiFltF116 ldf.fill.nta f117 = [rHpT3], HiFltF119-HiFltF117 ;; ldf.fill.nta f118 = [rHpT1], HiFltF120-HiFltF118 ldf.fill.nta f119 = [rHpT3], HiFltF121-HiFltF119 ;; ldf.fill.nta f120 = [rHpT1], HiFltF122-HiFltF120 ldf.fill.nta f121 = [rHpT3], HiFltF123-HiFltF121 ;; ldf.fill.nta f122 = [rHpT1], HiFltF124-HiFltF122 ldf.fill.nta f123 = [rHpT3], HiFltF125-HiFltF123 ;; ldf.fill.nta f124 = [rHpT1], HiFltF126-HiFltF124 ldf.fill.nta f125 = [rHpT3], HiFltF127-HiFltF125 ;; ldf.fill.nta f126 = [rHpT1] ldf.fill.nta f127 = [rHpT3] ;; rsm 1 << PSR_MFH // clear psr.mfh bit br.ret.sptk brp ;; LEAF_EXIT(KiRestoreHigherFPVolatile) // // ++ // // Routine: // // KiPageTableFault // // Description: // // Branched from Inst/DataTlbVector // Inserts a missing PDE translation for VHPT mapping // If PageNotPresent-bit of PDE is not set, // branches out to KiPageFault // // On entry: // // rva (h24) : offending virtual address // riha (h25) : a offending PTE address // rpr: (h26) : saved predicate // // Handle: // // Extracts the PDE index from riha (PTE address in VHPT) and // generates a PDE address by adding to VHPT_DIRBASE. When accesses // a page directory entry (PDE), there might be a TLB miss on the // page directory table and returns a NaT on ld8.s. If so, branches // to KiPageDirectoryTableFault. If the page-not-present bit of the // PDE is not set, branches to KiPageNotPresentFault. Otherwise, // inserts the PDE entry into the data TC (translation cache). // // Notes: // // // -- HANDLER_ENTRY(KiPageTableFault) rva = h24 riha = h25 rpr = h26 rpPde = h27 rPde = h28 rPde2 = h29 rps = h30 rISR = h31 thash rpPde = riha // M cmp.ne pt1 = r0, r0 mov rps = PAGE_SHIFT << PS_SHIFT // I ;; mov cr.itir = rps // M ld8.s rPde = [rpPde] // M, load PDE ;; extr.u rPde2 = rPde, 2, 3 // I tnat.nz pt0, p0 = rPde // I tbit.z.or pt1, p0 = rPde, PTE_ACCESS tbit.z.or pt1, p0 = rPde, PTE_VALID // I, if non-present page fault (pt0) br.cond.spnt KiPageDirectoryFault // B, tb miss on PDE access (pt1) br.cond.spnt KiPageFault // B, page fault ;; cmp.eq pt3 = 1, rPde2 // A mov cr.ifa = riha // M (pt3) br.cond.spnt KiLargePage ;; itc.d rPde // M ;; #if !defined(NT_UP) ld8.s rPde2 = [rpPde] // M cmp.ne pt0 = zero, zero // I ;; cmp.ne.or pt0, p0 = rPde2, rPde // I, if PTEs are different tnat.nz.or pt0, p0 = rPde2 // I ;; (pt0) ptc.l riha, rps // M, purge it #endif mov pr = rpr, -1 // I rfi;; // B // // This is a large page PDE entry. // KiLargePage: mov cr.ifa = rva // M mov rISR = cr.isr extr.u rPde2 = rPde, PTE_LP_CACHE_SHIFT, PTE_CACHE_LEN ;; mov rps = LARGE_PAGE_SHIFT << PS_SHIFT dep rPde2 = rPde2, rPde, 2, 3 // Set the cachable attribute. ;; mov cr.itir = rps // M tbit.z pt3, pt4 = rISR, ISR_X // I ;; (pt3) itc.d rPde2 // M ;; (pt4) itc.i rPde2 // M ;; #if !defined(NT_UP) ld8.s rPde2 = [rpPde] // M cmp.ne pt0 = zero, zero // I ;; cmp.ne.or pt0, p0 = rPde2, rPde // I, if PTEs are different tnat.nz.or pt0, p0 = rPde2 // I ;; (pt0) ptc.l rva, rps // M, purge it #endif mov pr = rpr, -1 // I rfi;; // B HANDLER_EXIT(KiPageTableFault) //++ // // KiPageDirectoryFault // // Cause: // // Parameters: // rpPde (h28) : pointer to PDE entry // rpr (h26) : saved predicate // // // Handle: // //-- HANDLER_ENTRY(KiPageDirectoryFault) rva = h24 rpPpe = h25 rpr = h26 rpPde = h27 rPpe = h28 rPpe2 = h29 rps = h30 thash rpPpe = rpPde // M cmp.ne pt0 = r0, r0 ;; ld8.s rPpe = [rpPpe] // M ;; tnat.nz.or pt0, p0 = rPpe // I tbit.z.or pt0, p0 = rPpe, PTE_ACCESS tbit.z.or pt0, p0 = rPpe, PTE_VALID // I, if non-present page fault (pt0) br.cond.spnt KiPageFault // B ;; mov cr.ifa = rpPde // M, set tva for vhpt translation ;; itc.d rPpe // M ;; #if !defined(NT_UP) ld8.s rPpe2 = [rpPpe] // M mov rps = PAGE_SHIFT << PS_SHIFT // I cmp.ne pt0 = zero, zero // I ;; cmp.ne.or pt0, p0 = rPpe2, rPpe // I, if PTEs are different tnat.nz.or pt0, p0 = rPpe2 // I ;; (pt0) ptc.l rpPde, rps // M, purge it #endif mov pr = rpr, -1 // I rfi;; // B HANDLER_EXIT(KiPageDirectoryFault) // // ++ // // Routine: // // KiPteNotPresentFault // // Description: // // Branched from KiVhptTransVector and KiPageTableFault. // Inserts a missing PDE translation for VHPT mapping // If no PDE for it, branches out to KiPageFault // // On entry: // // rva (h24) : offending virtual address // rpr (h26) : saved predicate // rPde (h28) : PDE entry // // Handle: // // Check to see if PDE is marked as LARGE_PAGE. If so, // make it valid and install the large page size PTE. // If not, branch to KiPageFault. // // // Notes: // // PCR page mapped with TR // -- HANDLER_ENTRY(KiPteNotPresentFault) rva = h24 // passed riha = h25 // passed rpr = h26 // passed rps = h27 rPfn = h28 rpAte = h28 rAte = h29 rAteEnd = h30 rAteBase = h31 rAteMask = h22 pIndr = pt1 mov rps = PS_4K << PS_SHIFT // M movl rAteBase = ALT4KB_BASE // L mov rAteMask = ATE_MASK0 // I shr.u rPfn = rva, PAGE4K_SHIFT // I ;; shladd rpAte = rPfn, PTE_SHIFT, rAteBase // M movl rAteEnd = ALT4KB_END // L ;; ld8.s rAte = [rpAte] // M andcm rAteMask = -1, rAteMask // I cmp.ltu pIndr = rpAte, rAteEnd // I ;; tnat.z.and pIndr = rAte // I tbit.nz.and pIndr = rAte, PTE_VALID // I or rAteMask = rAte, rAteMask // M tbit.nz.and pIndr = rAte, PTE_ACCESS // I tbit.nz.and pIndr = rAte, ATE_INDIRECT // I (pIndr) br.cond.spnt KiPteIndirectFault br.sptk KiPageFault // B HANDLER_EXIT(KiPteNotPresentFault) // // ++ // // Routine: // // KiKseg4Fault // // Description: // // TLB miss on KSEG4 space // // // On entry: // // rva (h24) : faulting virtual address // riha (h25) : IHA address // rpr (h26) : saved predicate // // Process: // // // Notes: // // PCR page mapped with TR // -- HANDLER_ENTRY(KiKseg4Fault) rIPSR = h22 rISR = h23 rva = h24 // passed riha = h25 rpr = h26 // passed rPte = h27 mov rISR = cr.isr // M movl rPte = VALID_KERNEL_PTE | PTE_NOCACHE // L mov rIPSR = cr.ipsr // M shr.u rva = rva, PAGE_SHIFT // I ;; tbit.z pt2, pt3 = rISR, ISR_SP // I dep.z rva = rva, PAGE_SHIFT, 32 // I ;; or rPte = rPte, rva // I dep rIPSR = 1, rIPSR, PSR_ED, 1 // I ;; (pt2) itc.d rPte // M ;; (pt3) mov cr.ipsr = rIPSR // M ;; mov pr = rpr, -1 // I rfi // B ;; HANDLER_EXIT(KiKseg4Fault) // // ++ // // Routine: // // KiPageFault // // Description: // // This must be a genuine page fault. Call KiMemoryFault(). // // // On entry: // // rva (h24) : offending virtual address // rpr (h26) : PDE contents // // Process: // // Restores the save predicate (pr), and branches to // KiGenericExceptionHandler with the argument KiMemoryFault with // macro VECTOR_CALL_HANDLER(). // // Notes: // // PCR page mapped with TR // -- HANDLER_ENTRY(KiPageFault) rva = h24 rPSR_ED = h25 rpr = h26 rIPSR = h27 rps = h29 rCode = h30 rISR = h31 // // check to see if a page fault occurred on a speculative load or // lfetch.fault. if so, set IPSR.ed bit. This forces to generate a NaT on // ld.s and steps out to the next instruction on lfetch.fault after // rfi. // mov rISR = cr.isr // M movl rPSR_ED = 1 << PSR_ED // L mov rIPSR = cr.ipsr // M ;; and rCode = ISR_NA_CODE_MASK, rISR // A or rIPSR = rIPSR, rPSR_ED // A tbit.nz pt1, pt2 = rISR, ISR_NA // I ;; (pt1) cmp.ne pt0, p0 = ISR_LFETCH, rCode // A (pt2) tbit.z pt0, p0 = rISR, ISR_SP // I (pt0) br.cond.spnt KiCallMemoryFault // B mov cr.ipsr = rIPSR // M ;; mov pr = rpr, -1 // I rfi // B ;; KiCallMemoryFault: mov rHIFA = cr.ifa movl rHHandler = KiMemoryFault mov rps = PAGE_SHIFT << PS_SHIFT mov pr = rpr, -1 // I ;; ptc.l rHIFA, rps br.sptk KiGenericExceptionHandler HANDLER_EXIT(KiPageFault) // // ++ // // Routine: // // KiPteIndirectFault // // Description: // // The PTE itself indicates a PteIndirect fault. The target PTE address // should be generated by extracting PteOffset from PTE and adding it to // PTE_UBASE. The owner field of the target PTE must be 1. Otherwise, // Call MmX86Fault(). // // On entry: // // rva (h24) : offending virtual address // rpr (h26) : PDE contents // // Process: // // Restores the save predicate (pr), and branches to // KiGenericExceptionHandler with the argument KiMemoryFault with // macro VECTOR_CALL_HANDLER(). // // Notes: // // PCR page mapped with TR // -- HANDLER_ENTRY(KiPteIndirectFault) rpr = h26 // passed rps = h27 // passed rpAte = h28 // passed rAte = h29 // passed rPte = h30 rPte0 = h31 rAteMask = h22 // passed rVa12 = h23 rPteOffset = h23 rpNewPte = h21 rOldIIP = h17 // preserved rIA32IIP = h18 rpVa = h19 // preserved rIndex = h20 // preserved rpBuffer= h16 rpPte = h22 pBr = pt0 pPrg = pt3 pLoop = pt4 pClear = pt5 mov cr.itir = rps // M thash rpNewPte = r0 // M mov rIA32IIP = cr.iip // M extr.u rPteOffset = rAte, PAGE4K_SHIFT, 32 // I ;; add rpNewPte = rPteOffset, rpNewPte // M/I cmp.eq pLoop, pClear = rIA32IIP, rOldIIP // I ;; ld8.s rPte = [rpNewPte] // M shr rVa12 = rpAte, PTE_SHIFT // I ;; tnat.nz.or pBr = rPte // I tbit.z.or pBr = rPte, PTE_VALID // I tbit.z.or pBr = rPte, PTE_ACCESS // I (pBr) br.cond.spnt KiPageFault ;; (pClear)mov rIndex = 0 // M and rPte0 = rPte, rAteMask // I ;; #if 1 // // try to acquire the spinlock // if failed, resume execution and try again on the next fault // mov rpVa = 1 movl rpBuffer = KiPcr + PcFpbLock // L ;; xchg8 rpVa = [rpBuffer], rpVa ;; cmp.ne pt1 = 0, rpVa (pt1) br.cond.spnt Kpif10 ;; #endif // // deposit extra PFN bits for 4k page // dep rPte0 = rVa12, rPte0, PAGE4K_SHIFT, PAGE_SHIFT-PAGE4K_SHIFT // I ;; (pClear)itc.d rPte0 // M ;; and rIndex = 7, rIndex // A movl rpBuffer = KiPcr + PcForwardProgressBuffer // L ;; shladd rpVa = rIndex, 4, rpBuffer // M add rIndex = 1, rIndex // I ;; st8 [rpVa] = rva // M add rpPte = 8, rpVa // I ;; st8 [rpPte] = rPte0 // M #if 1 // // done updating the forward progress buffer entry, release spinlock // movl rpBuffer = KiPcr + PcFpbLock // L ;; st8.rel [rpBuffer] = r0, PcForwardProgressBuffer - PcFpbLock #endif mov rOldIIP = rIA32IIP // I #if !defined(NT_UP) rAte2 = h28 rPte2 = h31 ld8.s rPte2 = [rpNewPte] // M ld8.s rAte2 = [rpAte] // M cmp.ne pPrg = zero, zero // I ;; cmp.ne.or pPrg = rPte, rPte2 // I tnat.nz.or pPrg = rPte2 // I cmp.ne.or pPrg = rAte, rAte2 // I tnat.nz.or pPrg = rAte2 // I ;; (pPrg) ptc.l rva, rps // M (pPrg) st8 [rpPte] = r0 // M #endif (pLoop) br.cond.spnt KiFillForwardProgressTb // B Kpif10: mov pr = rpr, -1 // I rfi;; // B HANDLER_EXIT(KiPteIndirectFault) // // ++ // // Routine: // // Ki4KDataTlbFault // // Description: // // Branched from KiDataTlbVector if PTE.Cache indicates the reserved // encoding. Reads the corresponding ATE and creates a 4kb TB on the // fly inserts it to the TLB. If a looping condition at IIP is // detected, it branches to KiFillForwardProgressTb and insert the TBs // from the forward progress TB queue. // // On entry: // // rva (h24) : offending virtual address // riha(h25) : IHA address // rpr (h26) : PDE contents // // Notes: // // -- HANDLER_ENTRY(Ki4KDataTlbFault) rva = h24 // passed riha = h25 // passed rpr = h26 // passed rps = h27 rPfn = h28 rpAte = h28 rAte = h29 rPte = h30 rAltBase = h31 rPte0 = h31 rAteMask = h22 rVa12 = h23 rOldIIP = h17 // preserved rIA32IIP = h18 rpVa = h19 rIndex = h20 // preserved rpBuffer= h16 rpPte = h21 pBr = pt0 pIndr = pt1 pMiss = pt2 pPrg = pt3 pLoop = pt4 pClear = pt5 pMiss2 = pt6 mov rIA32IIP = cr.iip // M mov rps = PS_4K << PS_SHIFT // I dep rAteMask = 1, r0, 32, 1 // Set rAteMask equal to 2**32 ;; cmp.ge pBr, pt7 = rva, rAteMask // M/I, Test to see if rva is out of bounds. movl rAltBase = ALT4KB_BASE // L ld8.s rPte = [riha] // M shr.u rPfn = rva, PAGE4K_SHIFT // I ;; shladd rpAte = rPfn, PTE_SHIFT, rAltBase // I ;; ld8.s rAte = [rpAte] // M movl rAteMask = ATE_MASK // L ;; cmp.eq pLoop, pClear = rIA32IIP, rOldIIP// M tnat.nz pMiss = rPte // I (pMiss) br.cond.spnt KiPageTableFault // B (pt7) tnat.nz pMiss2 = rAte // I (pMiss2)br.cond.spnt KiAltTableFault // B tbit.z.or pBr = rPte, PTE_VALID // I tbit.z.or pBr = rAte, PTE_VALID // I tbit.z.or pBr = rAte, PTE_ACCESS // I or rAteMask = rAte, rAteMask // M tbit.nz pIndr, p0 = rAte, ATE_INDIRECT // I (pBr) br.cond.spnt KiPageFault // B dep rPte0 = 0, rPte, 2, 3 // I, make it WB shr rVa12 = rpAte, PTE_SHIFT // I (pIndr) br.cond.spnt KiPteIndirectFault // B ;; (pClear)mov rIndex = 0 // M mov cr.itir = rps // M and rPte0 = rPte0, rAteMask // I ;; #if 1 // // try to acquire the spinlock // if failed, resume execution and try again on the next fault // mov rpVa = 1 movl rpBuffer = KiPcr + PcFpbLock // L ;; xchg8 rpVa = [rpBuffer], rpVa ;; cmp.ne pt1 = 0, rpVa (pt1) br.cond.spnt K4dtf10 ;; #endif // // deposit extra PFN bits for 4k page // dep rPte0 = rVa12, rPte0, PAGE4K_SHIFT, PAGE_SHIFT-PAGE4K_SHIFT // I ;; (pClear)itc.d rPte0 // M, install PTE ;; and rIndex = 7, rIndex // A movl rpBuffer = KiPcr + PcForwardProgressBuffer // L ;; shladd rpVa = rIndex, 4, rpBuffer // M add rIndex = 1, rIndex // I ;; st8 [rpVa] = rva // M add rpPte = 8, rpVa // I ;; st8 [rpPte] = rPte0 // M // // done updating the forward progress buffer entry, release spinlock // movl rpBuffer = KiPcr + PcFpbLock // L ;; st8.rel [rpBuffer] = r0, PcForwardProgressBuffer - PcFpbLock mov rOldIIP = rIA32IIP // I #if !defined(NT_UP) rps = h27 rAte2 = h28 rPte2 = h31 ld8.s rPte2 = [riha] // M ld8.s rAte2 = [rpAte] // M cmp.ne pPrg = zero, zero // I ;; cmp.ne.or pPrg = rPte, rPte2 // M tnat.nz.or pPrg = rPte2 // I cmp.ne.or pPrg = rAte, rAte2 // M tnat.nz.or pPrg = rAte2 // I ;; (pPrg) ptc.l rva, rps // M (pPrg) st8 [rpPte] = r0 // M #endif (pLoop) br.cond.spnt KiFillForwardProgressTb // B K4dtf10: mov pr = rpr, -1 // I rfi;; // B HANDLER_EXIT(Ki4KDataTlbFault) // // ++ // // Routine: // // Ki4KInstTlbFault // // Description: // // Branched from KiInstTlbVector if PTE.Cache indicates the reserved // encoding. Reads the corresponding ATE and creates a 4kb TB on the // fly inserts it to the TLB. // // On entry: // // rva (h24) : offending virtual address // riha(h25) : IHA address // rpr (h26) : PDE contents // // Notes: // // -- HANDLER_ENTRY(Ki4KInstTlbFault) rva = h24 // passed riha = h25 // passed rpr = h26 // passed rps = h27 rPfn = h28 rpAte = h28 rAte = h29 rPte = h30 rAltBase = h31 rPte0 = h31 rAteMask = h22 rVa12 = h23 pBr = pt0 pIndr = pt1 pMiss = pt2 pPrg = pt3 pMiss2 = pt6 mov rps = PS_4K << PS_SHIFT // M movl rAltBase = ALT4KB_BASE // L shr.u rPfn = rva, PAGE4K_SHIFT // I dep rAteMask = 1, r0, 32, 1 // Set rAteMask equal to 2**32 ;; ld8.s rPte = [riha] // M cmp.ge pBr, pt7 = rva, rAteMask // M/I, Test to see if rva is out of bounds. shladd rpAte = rPfn, PTE_SHIFT, rAltBase // I ;; ld8.s rAte = [rpAte] // M movl rAteMask = ATE_MASK // L ;; tnat.nz pMiss = rPte // I (pMiss) br.cond.spnt KiPageTableFault // B (pt7) tnat.nz pMiss2 = rAte // I (pMiss2)br.cond.spnt KiAltTableFault // B tbit.z.or pBr = rPte, PTE_VALID // I tbit.z.or pBr = rAte, PTE_VALID // I tbit.z.or pBr = rAte, PTE_ACCESS // I or rAteMask = rAte, rAteMask // M tbit.nz pIndr, p0 = rAte, ATE_INDIRECT // I (pBr) br.cond.spnt KiPageFault // B dep rPte0 = 0, rPte, 2, 3 // I, make it WB shr rVa12 = rpAte, PTE_SHIFT // I (pIndr) br.cond.spnt KiPteIndirectFault // B ;; mov cr.itir = rps // M and rPte0 = rPte0, rAteMask // I ;; // // deposit extra PFN bits for 4k page // dep rPte0 = rVa12, rPte0, PAGE4K_SHIFT, PAGE_SHIFT-PAGE4K_SHIFT // I ;; itc.i rPte0 // M, install PTE ;; #if !defined(NT_UP) rps = h27 rAte2 = h28 rPte2 = h31 ld8.s rPte2 = [riha] // M ld8.s rAte2 = [rpAte] // M cmp.ne pPrg = zero, zero // I ;; cmp.ne.or pPrg = rPte, rPte2 // M tnat.nz.or pPrg = rPte2 // I cmp.ne.or pPrg = rAte, rAte2 // M tnat.nz.or pPrg = rAte2 // I ;; (pPrg) ptc.l rva, rps // M #endif mov pr = rpr, -1 // I rfi;; // B HANDLER_EXIT(Ki4KInstTlbFault) // // ++ // // Routine: // // KiAltTableFault // // Description: // // Branched from Inst/DataAccessBitVector // Inserts a missing PTE translation for the alt table. // // On entry: // // rva (h24) : offending virtual address // riha (h25) : a offending PTE address // rpr: (h26) : saved predicate // // Handle: // // -- HANDLER_ENTRY(KiAltTableFault) rpAte = h28 // passed rva = h24 riha = h25 rpr = h26 // passed rPte = h27 rPte2 = h28 rps = h29 thash riha = rpAte // M cmp.ne pt1 = r0, r0 mov rva = rpAte // I ;; ld8.s rPte = [riha] // M ;; tnat.nz pt0, p0 = rPte // I tbit.z.or pt1, p0 = rPte, PTE_ACCESS tbit.z.or pt1, p0 = rPte, PTE_VALID // I, if non-present page fault (pt0) br.cond.spnt KiPageTableFault // B (pt1) br.cond.spnt KiPteNotPresentFault // B ;; mov cr.ifa = rva ;; itc.d rPte // M ;; #if !defined(NT_UP) ld8.s rPte2 = [riha] // M mov rps = PAGE_SHIFT << PS_SHIFT // I cmp.ne pt0 = zero, zero // I ;; cmp.ne.or pt0 = rPte2, rPte // M tnat.nz.or pt0 = rPte2 // I ;; (pt0) ptc.l rva, rps // M #endif mov pr = rpr, -1 // I rfi;; // B HANDLER_EXIT(KiAltTableFault) // // ++ // // Routine: // // KiFillForwardProgressTb // // Description: // // Fill TB from TLB forward progress buffer. // // On entry: // // rpBuffer (h16) : forward progress buffer address // rpr: (h26) : saved predicate // // Handle: // // -- HANDLER_ENTRY(KiFillForwardProgressTb) rLc = h29 rT0 = h28 rps = h27 rpr = h26 rVa = h22 rPte = h21 rpVa = h19 rpPte = h17 rpBuffer= h16 mov rpVa = rpBuffer // A mov.i rLc = ar.lc // I mov rT0 = NUMBER_OF_FWP_ENTRIES - 1 // ;; add rpPte = 8, rpBuffer // A mov.i ar.lc = rT0 // I ;; fpb_loop: // // use ALAT to see if somebody modify the PTE entry // ld8 rVa = [rpVa], 16 // M ld8.a rPte = [rpPte] // M ;; mov cr.ifa = rVa // M cmp.ne pt0, pt1 = rPte, r0 // I ;; (pt0) itc.d rPte // M ;; (pt0) ld8.c.clr rPte = [rpPte] // M add rpPte = 16, rpPte // I ;; (pt1) invala.e rPte // M, invalidate ALAT entry (pt0) cmp.eq.and pt0 = rPte, r0 // I ;; (pt0) ptc.l rVa, rps // M br.cloop.dptk.many fpb_loop;; // B mov.i ar.lc = rLc mov pr = rpr, -1 // I rfi // B ;; // // Add four nop cycles (two bundles) bundles of NOP's to // workaround McKinly Errata. // nop.m 0 ;; nop.m 0 ;; nop.m 0 ;; nop.m 0 ;; HANDLER_EXIT(KiFillForwardProgressTb) //++ // // Routine Description: // // This routine begins the common code for raising an exception. // The routine saves the non-volatile state and dispatches to the // next level exception dispatcher. // // Arguments: // // a0 - pointer to trap frame // a1 - previous mode // // Return Value: // // None. // //-- NESTED_ENTRY(KiExceptionDispatch) // // Build exception frame // .regstk 2, 3, 5, 0 .prologue 0xA, loc0 alloc t16 = ar.pfs, 2, 3, 5, 0 mov loc0 = sp cmp4.eq pt0 = UserMode, a1 // previous mode is user? mov loc1 = brp .fframe ExceptionFrameLength add sp = -ExceptionFrameLength, sp ;; .save ar.unat, loc2 mov loc2 = ar.unat add t0 = ExFltS19+STACK_SCRATCH_AREA, sp add t1 = ExFltS18+STACK_SCRATCH_AREA, sp ;; .save.gf 0x0, 0xC0000 stf.spill [t0] = fs19, ExFltS17-ExFltS19 stf.spill [t1] = fs18, ExFltS16-ExFltS18 ;; .save.gf 0x0, 0x30000 stf.spill [t0] = fs17, ExFltS15-ExFltS17 stf.spill [t1] = fs16, ExFltS14-ExFltS16 mov t10 = bs4 ;; .save.gf 0x0, 0xC000 stf.spill [t0] = fs15, ExFltS13-ExFltS15 stf.spill [t1] = fs14, ExFltS12-ExFltS14 mov t11 = bs3 ;; .save.gf 0x0, 0x3000 stf.spill [t0] = fs13, ExFltS11-ExFltS13 stf.spill [t1] = fs12, ExFltS10-ExFltS12 mov t12 = bs2 ;; .save.gf 0x0, 0xC00 stf.spill [t0] = fs11, ExFltS9-ExFltS11 stf.spill [t1] = fs10, ExFltS8-ExFltS10 mov t13 = bs1 ;; .save.gf 0x0, 0x300 stf.spill [t0] = fs9, ExFltS7-ExFltS9 stf.spill [t1] = fs8, ExFltS6-ExFltS8 mov t14 = bs0 ;; .save.gf 0x0, 0xC0 stf.spill [t0] = fs7, ExFltS5-ExFltS7 stf.spill [t1] = fs6, ExFltS4-ExFltS6 mov t15 = ar.lc ;; .save.gf 0x0, 0x30 stf.spill [t0] = fs5, ExFltS3-ExFltS5 stf.spill [t1] = fs4, ExFltS2-ExFltS4 ;; .save.f 0xC stf.spill [t0] = fs3, ExFltS1-ExFltS3 // save fs3 stf.spill [t1] = fs2, ExFltS0-ExFltS2 // save fs2 ;; .save.f 0x3 stf.spill [t0] = fs1, ExBrS4-ExFltS1 // save fs1 stf.spill [t1] = fs0, ExBrS3-ExFltS0 // save fs0 ;; .save.b 0x18 st8 [t0] = t10, ExBrS2-ExBrS4 // save bs4 st8 [t1] = t11, ExBrS1-ExBrS3 // save bs3 ;; .save.b 0x6 st8 [t0] = t12, ExBrS0-ExBrS2 // save bs2 st8 [t1] = t13, ExIntS2-ExBrS1 // save bs1 ;; .save.b 0x1 st8 [t0] = t14, ExIntS3-ExBrS0 // save bs0 movl out0 = KiPcr+PcCurrentThread ;; .save.gf 0xC, 0x0 .mem.offset 0,0 st8.spill [t0] = s3, ExIntS1-ExIntS3 // save s3 .mem.offset 8,0 st8.spill [t1] = s2, ExIntS0-ExIntS2 // save s2 ;; .save.gf 0x3, 0x0 .mem.offset 0,0 st8.spill [t0] = s1, ExApLC-ExIntS1 // save s1 .mem.offset 8,0 st8.spill [t1] = s0, ExApEC-ExIntS0 // save s0 ;; .savepsp ar.pfs, ExceptionFrameLength-ExApEC-STACK_SCRATCH_AREA st8 [t1] = t16, ExIntNats-ExApEC mov t4 = ar.unat // captured Nats of s0-s3 ;; (pt0) ld8 out0 = [out0] ;; (pt0) add out0 = ThStackBase, out0 .savepsp ar.lc, ExceptionFrameLength-ExApLC-STACK_SCRATCH_AREA st8 [t0] = t15 .savepsp @priunat, ExceptionFrameLength-ExIntNats-STACK_SCRATCH_AREA st8 [t1] = t4 // save Nats of s0-s3 ;; PROLOGUE_END (pt0) ld8 out0 = [out0] ;; (pt0) add out0 = -ThreadStateSaveAreaLength+TsHigherFPVolatile, out0 (pt0) br.call.sptk brp = KiSaveHigherFPVolatile ;; CAPSTART(KiExceptionDispatch,KiDispatchException) add out0 = TrExceptionRecord, a0 // -> exception record add out1 = STACK_SCRATCH_AREA, sp // -> exception frame mov out2 = a0 // -> trap frame mov out3 = a1 // previous mode mov out4 = 1 // first chance br.call.sptk.many brp = KiDispatchException ;; CAPEND(KiExceptionDispatch) add t1 = ExApEC+STACK_SCRATCH_AREA, sp movl t0 = KiExceptionExit ;; // // Interrupts must be disabled before calling KiExceptionExit // because the unwind code cannot unwind from that point. // FAST_DISABLE_INTERRUPTS ld8 t1 = [t1] mov brp = t0 ;; mov ar.unat = loc2 mov ar.pfs = t1 add s1 = STACK_SCRATCH_AREA, sp // s1 -> exception frame mov s0 = a0 // s0 -> trap frame br.ret.sptk brp ;; NESTED_EXIT(KiExceptionDispatch) //++ // // BOOLEAN // KeInvalidAccessAllowed ( // IN PVOID TrapInformation // ) // // Routine Description: // // Mm will pass a pointer to a trap frame prior to issuing a bug check on // a pagefault. This routine lets Mm know if it is ok to bugcheck. The // specific case we must protect are the interlocked pop sequences which can // blindly access memory that may have been freed and/or reused prior to the // access. We don't want to bugcheck the system in these cases, so we check // the instruction pointer here. // // Arguments: // // TrapFrame (a0) - Supplies a trap frame pointer. NULL means return False. // // Return Value: // // True if the invalid access should be ignored. // False which will usually trigger a bugcheck. // //-- LEAF_ENTRY(KeInvalidAccessAllowed) .regstk 1, 0, 0, 0 cmp.eq pt0 = 0, a0 movl t1 = ExpInterlockedPopEntrySListFault add t0 = TrStIIP, a0 mov v0 = zero // assume access not allowed (pt0) br.ret.spnt brp ;; ld8 t0 = [t0] ;; cmp.eq pt2 = t0, t1 ;; nop.m 0 (pt2) mov v0 = 1 br.ret.sptk brp LEAF_EXIT(KeInvalidAccessAllowed) LEAF_ENTRY(KeScrubBackingStoreRegisters) .regstk 1, 15, 1, 0 alloc loc0 = 1, 15, 1, 0 mov loc1 = brp cmp.ge pt0, pt1 = 17, a0 add out0 = -16, a0 mov loc2 = r0 mov loc3 = r0 ;; mov loc4 = r0 mov loc5 = r0 mov loc6 = r0 mov loc7 = r0 mov loc8 = r0 mov loc9 = r0 mov loc10 = r0 mov loc11 = r0 mov loc12 = r0 mov loc13 = r0 mov loc14 = r0 (pt1) br.call.dpnt brp = KeScrubBackingStoreRegisters mov out0 = r0 mov brp = loc1 mov loc1 = r0 mov a0 = r0 mov ar.pfs = loc0 mov loc0 = r0 br.ret.sptk brp LEAF_EXIT (KeScrubBackingStoreRegisters) LEAF_ENTRY(KiPageZeroFault) rpr = h26 rK5 = h28 mov h29 = cr.ipsr tbit.z pt1, pt0 = rK5, 0 ;; dep h29 = 1, h29, PSR_ED, 1 // I (pt0) itc.d r0 ;; mov cr.ipsr = h29 (pt0) mov rK5 = r0 (pt1) add rK5 = 3, rK5 ;; mov ar.k5 = rK5 mov pr = rpr, -1 // I rfi;; // B LEAF_EXIT(KiPageZeroFault)