1 /* SPDX-License-Identifier: GPL-2.0 */
2 /*
3  * arch/ia64/kernel/entry.S
4  *
5  * Kernel entry points.
6  *
7  * Copyright (C) 1998-2003, 2005 Hewlett-Packard Co
8  *	David Mosberger-Tang <davidm@hpl.hp.com>
9  * Copyright (C) 1999, 2002-2003
10  *	Asit Mallick <Asit.K.Mallick@intel.com>
11  * 	Don Dugger <Don.Dugger@intel.com>
12  *	Suresh Siddha <suresh.b.siddha@intel.com>
13  *	Fenghua Yu <fenghua.yu@intel.com>
14  * Copyright (C) 1999 VA Linux Systems
15  * Copyright (C) 1999 Walt Drummond <drummond@valinux.com>
16  */
17 /*
18  * ia64_switch_to now places correct virtual mapping in in TR2 for
19  * kernel stack. This allows us to handle interrupts without changing
20  * to physical mode.
21  *
22  * Jonathan Nicklin	<nicklin@missioncriticallinux.com>
23  * Patrick O'Rourke	<orourke@missioncriticallinux.com>
24  * 11/07/2000
25  */
26 /*
27  * Copyright (c) 2008 Isaku Yamahata <yamahata at valinux co jp>
28  *                    VA Linux Systems Japan K.K.
29  *                    pv_ops.
30  */
31 /*
32  * Global (preserved) predicate usage on syscall entry/exit path:
33  *
34  *	pKStk:		See entry.h.
35  *	pUStk:		See entry.h.
36  *	pSys:		See entry.h.
37  *	pNonSys:	!pSys
38  */
39 
40 
41 #include <linux/pgtable.h>
42 #include <asm/asmmacro.h>
43 #include <asm/cache.h>
44 #include <asm/errno.h>
45 #include <asm/kregs.h>
46 #include <asm/asm-offsets.h>
47 #include <asm/percpu.h>
48 #include <asm/processor.h>
49 #include <asm/thread_info.h>
50 #include <asm/unistd.h>
51 #include <asm/ftrace.h>
52 #include <asm/export.h>
53 
54 #include "minstate.h"
55 
56 	/*
57 	 * execve() is special because in case of success, we need to
58 	 * setup a null register window frame.
59 	 */
60 ENTRY(ia64_execve)
61 	/*
62 	 * Allocate 8 input registers since ptrace() may clobber them
63 	 */
64 	.prologue ASM_UNW_PRLG_RP|ASM_UNW_PRLG_PFS, ASM_UNW_PRLG_GRSAVE(8)
65 	alloc loc1=ar.pfs,8,2,3,0
66 	mov loc0=rp
67 	.body
68 	mov out0=in0			// filename
69 	;;				// stop bit between alloc and call
70 	mov out1=in1			// argv
71 	mov out2=in2			// envp
72 	br.call.sptk.many rp=sys_execve
73 .ret0:
74 	cmp4.ge p6,p7=r8,r0
75 	mov ar.pfs=loc1			// restore ar.pfs
76 	sxt4 r8=r8			// return 64-bit result
77 	;;
78 	stf.spill [sp]=f0
79 	mov rp=loc0
80 (p6)	mov ar.pfs=r0			// clear ar.pfs on success
81 (p7)	br.ret.sptk.many rp
82 
83 	/*
84 	 * In theory, we'd have to zap this state only to prevent leaking of
85 	 * security sensitive state (e.g., if current->mm->dumpable is zero).  However,
86 	 * this executes in less than 20 cycles even on Itanium, so it's not worth
87 	 * optimizing for...).
88 	 */
89 	mov ar.unat=0; 		mov ar.lc=0
90 	mov r4=0;		mov f2=f0;		mov b1=r0
91 	mov r5=0;		mov f3=f0;		mov b2=r0
92 	mov r6=0;		mov f4=f0;		mov b3=r0
93 	mov r7=0;		mov f5=f0;		mov b4=r0
94 	ldf.fill f12=[sp];	mov f13=f0;		mov b5=r0
95 	ldf.fill f14=[sp];	ldf.fill f15=[sp];	mov f16=f0
96 	ldf.fill f17=[sp];	ldf.fill f18=[sp];	mov f19=f0
97 	ldf.fill f20=[sp];	ldf.fill f21=[sp];	mov f22=f0
98 	ldf.fill f23=[sp];	ldf.fill f24=[sp];	mov f25=f0
99 	ldf.fill f26=[sp];	ldf.fill f27=[sp];	mov f28=f0
100 	ldf.fill f29=[sp];	ldf.fill f30=[sp];	mov f31=f0
101 	br.ret.sptk.many rp
102 END(ia64_execve)
103 
104 /*
105  * sys_clone2(u64 flags, u64 ustack_base, u64 ustack_size, u64 parent_tidptr, u64 child_tidptr,
106  *	      u64 tls)
107  */
108 GLOBAL_ENTRY(sys_clone2)
109 	/*
110 	 * Allocate 8 input registers since ptrace() may clobber them
111 	 */
112 	.prologue ASM_UNW_PRLG_RP|ASM_UNW_PRLG_PFS, ASM_UNW_PRLG_GRSAVE(8)
113 	alloc r16=ar.pfs,8,2,6,0
114 	DO_SAVE_SWITCH_STACK
115 	mov loc0=rp
116 	mov loc1=r16                             // save ar.pfs across ia64_clone
117 	.body
118 	mov out0=in0
119 	mov out1=in1
120 	mov out2=in2
121 	mov out3=in3
122 	mov out4=in4
123 	mov out5=in5
124 	br.call.sptk.many rp=ia64_clone
125 .ret1:	.restore sp
126 	adds sp=IA64_SWITCH_STACK_SIZE,sp	// pop the switch stack
127 	mov ar.pfs=loc1
128 	mov rp=loc0
129 	br.ret.sptk.many rp
130 END(sys_clone2)
131 
132 /*
133  * sys_clone(u64 flags, u64 ustack_base, u64 parent_tidptr, u64 child_tidptr, u64 tls)
134  *	Deprecated.  Use sys_clone2() instead.
135  */
136 GLOBAL_ENTRY(sys_clone)
137 	/*
138 	 * Allocate 8 input registers since ptrace() may clobber them
139 	 */
140 	.prologue ASM_UNW_PRLG_RP|ASM_UNW_PRLG_PFS, ASM_UNW_PRLG_GRSAVE(8)
141 	alloc r16=ar.pfs,8,2,6,0
142 	DO_SAVE_SWITCH_STACK
143 	mov loc0=rp
144 	mov loc1=r16                             // save ar.pfs across ia64_clone
145 	.body
146 	mov out0=in0
147 	mov out1=in1
148 	mov out2=16				// stacksize (compensates for 16-byte scratch area)
149 	mov out3=in3
150 	mov out4=in4
151 	mov out5=in5
152 	br.call.sptk.many rp=ia64_clone
153 .ret2:	.restore sp
154 	adds sp=IA64_SWITCH_STACK_SIZE,sp	// pop the switch stack
155 	mov ar.pfs=loc1
156 	mov rp=loc0
157 	br.ret.sptk.many rp
158 END(sys_clone)
159 
160 /*
161  * prev_task <- ia64_switch_to(struct task_struct *next)
162  *	With Ingo's new scheduler, interrupts are disabled when this routine gets
163  *	called.  The code starting at .map relies on this.  The rest of the code
164  *	doesn't care about the interrupt masking status.
165  */
166 GLOBAL_ENTRY(ia64_switch_to)
167 	.prologue
168 	alloc r16=ar.pfs,1,0,0,0
169 	DO_SAVE_SWITCH_STACK
170 	.body
171 
172 	adds r22=IA64_TASK_THREAD_KSP_OFFSET,r13
173 	movl r25=init_task
174 	mov r27=IA64_KR(CURRENT_STACK)
175 	adds r21=IA64_TASK_THREAD_KSP_OFFSET,in0
176 	dep r20=0,in0,61,3		// physical address of "next"
177 	;;
178 	st8 [r22]=sp			// save kernel stack pointer of old task
179 	shr.u r26=r20,IA64_GRANULE_SHIFT
180 	cmp.eq p7,p6=r25,in0
181 	;;
182 	/*
183 	 * If we've already mapped this task's page, we can skip doing it again.
184 	 */
185 (p6)	cmp.eq p7,p6=r26,r27
186 (p6)	br.cond.dpnt .map
187 	;;
188 .done:
189 	ld8 sp=[r21]			// load kernel stack pointer of new task
190 	MOV_TO_KR(CURRENT, in0, r8, r9)		// update "current" application register
191 	mov r8=r13			// return pointer to previously running task
192 	mov r13=in0			// set "current" pointer
193 	;;
194 	DO_LOAD_SWITCH_STACK
195 
196 #ifdef CONFIG_SMP
197 	sync.i				// ensure "fc"s done by this CPU are visible on other CPUs
198 #endif
199 	br.ret.sptk.many rp		// boogie on out in new context
200 
201 .map:
202 	RSM_PSR_IC(r25)			// interrupts (psr.i) are already disabled here
203 	movl r25=PAGE_KERNEL
204 	;;
205 	srlz.d
206 	or r23=r25,r20			// construct PA | page properties
207 	mov r25=IA64_GRANULE_SHIFT<<2
208 	;;
209 	MOV_TO_ITIR(p0, r25, r8)
210 	MOV_TO_IFA(in0, r8)		// VA of next task...
211 	;;
212 	mov r25=IA64_TR_CURRENT_STACK
213 	MOV_TO_KR(CURRENT_STACK, r26, r8, r9)	// remember last page we mapped...
214 	;;
215 	itr.d dtr[r25]=r23		// wire in new mapping...
216 	SSM_PSR_IC_AND_SRLZ_D(r8, r9)	// reenable the psr.ic bit
217 	br.cond.sptk .done
218 END(ia64_switch_to)
219 
220 /*
221  * Note that interrupts are enabled during save_switch_stack and load_switch_stack.  This
222  * means that we may get an interrupt with "sp" pointing to the new kernel stack while
223  * ar.bspstore is still pointing to the old kernel backing store area.  Since ar.rsc,
224  * ar.rnat, ar.bsp, and ar.bspstore are all preserved by interrupts, this is not a
225  * problem.  Also, we don't need to specify unwind information for preserved registers
226  * that are not modified in save_switch_stack as the right unwind information is already
227  * specified at the call-site of save_switch_stack.
228  */
229 
230 /*
231  * save_switch_stack:
232  *	- r16 holds ar.pfs
233  *	- b7 holds address to return to
234  *	- rp (b0) holds return address to save
235  */
236 GLOBAL_ENTRY(save_switch_stack)
237 	.prologue
238 	.altrp b7
239 	flushrs			// flush dirty regs to backing store (must be first in insn group)
240 	.save @priunat,r17
241 	mov r17=ar.unat		// preserve caller's
242 	.body
243 #ifdef CONFIG_ITANIUM
244 	adds r2=16+128,sp
245 	adds r3=16+64,sp
246 	adds r14=SW(R4)+16,sp
247 	;;
248 	st8.spill [r14]=r4,16		// spill r4
249 	lfetch.fault.excl.nt1 [r3],128
250 	;;
251 	lfetch.fault.excl.nt1 [r2],128
252 	lfetch.fault.excl.nt1 [r3],128
253 	;;
254 	lfetch.fault.excl [r2]
255 	lfetch.fault.excl [r3]
256 	adds r15=SW(R5)+16,sp
257 #else
258 	add r2=16+3*128,sp
259 	add r3=16,sp
260 	add r14=SW(R4)+16,sp
261 	;;
262 	st8.spill [r14]=r4,SW(R6)-SW(R4)	// spill r4 and prefetch offset 0x1c0
263 	lfetch.fault.excl.nt1 [r3],128	//		prefetch offset 0x010
264 	;;
265 	lfetch.fault.excl.nt1 [r3],128	//		prefetch offset 0x090
266 	lfetch.fault.excl.nt1 [r2],128	//		prefetch offset 0x190
267 	;;
268 	lfetch.fault.excl.nt1 [r3]	//		prefetch offset 0x110
269 	lfetch.fault.excl.nt1 [r2]	//		prefetch offset 0x210
270 	adds r15=SW(R5)+16,sp
271 #endif
272 	;;
273 	st8.spill [r15]=r5,SW(R7)-SW(R5)	// spill r5
274 	mov.m ar.rsc=0			// put RSE in mode: enforced lazy, little endian, pl 0
275 	add r2=SW(F2)+16,sp		// r2 = &sw->f2
276 	;;
277 	st8.spill [r14]=r6,SW(B0)-SW(R6)	// spill r6
278 	mov.m r18=ar.fpsr		// preserve fpsr
279 	add r3=SW(F3)+16,sp		// r3 = &sw->f3
280 	;;
281 	stf.spill [r2]=f2,32
282 	mov.m r19=ar.rnat
283 	mov r21=b0
284 
285 	stf.spill [r3]=f3,32
286 	st8.spill [r15]=r7,SW(B2)-SW(R7)	// spill r7
287 	mov r22=b1
288 	;;
289 	// since we're done with the spills, read and save ar.unat:
290 	mov.m r29=ar.unat
291 	mov.m r20=ar.bspstore
292 	mov r23=b2
293 	stf.spill [r2]=f4,32
294 	stf.spill [r3]=f5,32
295 	mov r24=b3
296 	;;
297 	st8 [r14]=r21,SW(B1)-SW(B0)		// save b0
298 	st8 [r15]=r23,SW(B3)-SW(B2)		// save b2
299 	mov r25=b4
300 	mov r26=b5
301 	;;
302 	st8 [r14]=r22,SW(B4)-SW(B1)		// save b1
303 	st8 [r15]=r24,SW(AR_PFS)-SW(B3)		// save b3
304 	mov r21=ar.lc		// I-unit
305 	stf.spill [r2]=f12,32
306 	stf.spill [r3]=f13,32
307 	;;
308 	st8 [r14]=r25,SW(B5)-SW(B4)		// save b4
309 	st8 [r15]=r16,SW(AR_LC)-SW(AR_PFS)	// save ar.pfs
310 	stf.spill [r2]=f14,32
311 	stf.spill [r3]=f15,32
312 	;;
313 	st8 [r14]=r26				// save b5
314 	st8 [r15]=r21				// save ar.lc
315 	stf.spill [r2]=f16,32
316 	stf.spill [r3]=f17,32
317 	;;
318 	stf.spill [r2]=f18,32
319 	stf.spill [r3]=f19,32
320 	;;
321 	stf.spill [r2]=f20,32
322 	stf.spill [r3]=f21,32
323 	;;
324 	stf.spill [r2]=f22,32
325 	stf.spill [r3]=f23,32
326 	;;
327 	stf.spill [r2]=f24,32
328 	stf.spill [r3]=f25,32
329 	;;
330 	stf.spill [r2]=f26,32
331 	stf.spill [r3]=f27,32
332 	;;
333 	stf.spill [r2]=f28,32
334 	stf.spill [r3]=f29,32
335 	;;
336 	stf.spill [r2]=f30,SW(AR_UNAT)-SW(F30)
337 	stf.spill [r3]=f31,SW(PR)-SW(F31)
338 	add r14=SW(CALLER_UNAT)+16,sp
339 	;;
340 	st8 [r2]=r29,SW(AR_RNAT)-SW(AR_UNAT)	// save ar.unat
341 	st8 [r14]=r17,SW(AR_FPSR)-SW(CALLER_UNAT) // save caller_unat
342 	mov r21=pr
343 	;;
344 	st8 [r2]=r19,SW(AR_BSPSTORE)-SW(AR_RNAT) // save ar.rnat
345 	st8 [r3]=r21				// save predicate registers
346 	;;
347 	st8 [r2]=r20				// save ar.bspstore
348 	st8 [r14]=r18				// save fpsr
349 	mov ar.rsc=3		// put RSE back into eager mode, pl 0
350 	br.cond.sptk.many b7
351 END(save_switch_stack)
352 
353 /*
354  * load_switch_stack:
355  *	- "invala" MUST be done at call site (normally in DO_LOAD_SWITCH_STACK)
356  *	- b7 holds address to return to
357  *	- must not touch r8-r11
358  */
359 GLOBAL_ENTRY(load_switch_stack)
360 	.prologue
361 	.altrp b7
362 
363 	.body
364 	lfetch.fault.nt1 [sp]
365 	adds r2=SW(AR_BSPSTORE)+16,sp
366 	adds r3=SW(AR_UNAT)+16,sp
367 	mov ar.rsc=0						// put RSE into enforced lazy mode
368 	adds r14=SW(CALLER_UNAT)+16,sp
369 	adds r15=SW(AR_FPSR)+16,sp
370 	;;
371 	ld8 r27=[r2],(SW(B0)-SW(AR_BSPSTORE))	// bspstore
372 	ld8 r29=[r3],(SW(B1)-SW(AR_UNAT))	// unat
373 	;;
374 	ld8 r21=[r2],16		// restore b0
375 	ld8 r22=[r3],16		// restore b1
376 	;;
377 	ld8 r23=[r2],16		// restore b2
378 	ld8 r24=[r3],16		// restore b3
379 	;;
380 	ld8 r25=[r2],16		// restore b4
381 	ld8 r26=[r3],16		// restore b5
382 	;;
383 	ld8 r16=[r2],(SW(PR)-SW(AR_PFS))	// ar.pfs
384 	ld8 r17=[r3],(SW(AR_RNAT)-SW(AR_LC))	// ar.lc
385 	;;
386 	ld8 r28=[r2]		// restore pr
387 	ld8 r30=[r3]		// restore rnat
388 	;;
389 	ld8 r18=[r14],16	// restore caller's unat
390 	ld8 r19=[r15],24	// restore fpsr
391 	;;
392 	ldf.fill f2=[r14],32
393 	ldf.fill f3=[r15],32
394 	;;
395 	ldf.fill f4=[r14],32
396 	ldf.fill f5=[r15],32
397 	;;
398 	ldf.fill f12=[r14],32
399 	ldf.fill f13=[r15],32
400 	;;
401 	ldf.fill f14=[r14],32
402 	ldf.fill f15=[r15],32
403 	;;
404 	ldf.fill f16=[r14],32
405 	ldf.fill f17=[r15],32
406 	;;
407 	ldf.fill f18=[r14],32
408 	ldf.fill f19=[r15],32
409 	mov b0=r21
410 	;;
411 	ldf.fill f20=[r14],32
412 	ldf.fill f21=[r15],32
413 	mov b1=r22
414 	;;
415 	ldf.fill f22=[r14],32
416 	ldf.fill f23=[r15],32
417 	mov b2=r23
418 	;;
419 	mov ar.bspstore=r27
420 	mov ar.unat=r29		// establish unat holding the NaT bits for r4-r7
421 	mov b3=r24
422 	;;
423 	ldf.fill f24=[r14],32
424 	ldf.fill f25=[r15],32
425 	mov b4=r25
426 	;;
427 	ldf.fill f26=[r14],32
428 	ldf.fill f27=[r15],32
429 	mov b5=r26
430 	;;
431 	ldf.fill f28=[r14],32
432 	ldf.fill f29=[r15],32
433 	mov ar.pfs=r16
434 	;;
435 	ldf.fill f30=[r14],32
436 	ldf.fill f31=[r15],24
437 	mov ar.lc=r17
438 	;;
439 	ld8.fill r4=[r14],16
440 	ld8.fill r5=[r15],16
441 	mov pr=r28,-1
442 	;;
443 	ld8.fill r6=[r14],16
444 	ld8.fill r7=[r15],16
445 
446 	mov ar.unat=r18				// restore caller's unat
447 	mov ar.rnat=r30				// must restore after bspstore but before rsc!
448 	mov ar.fpsr=r19				// restore fpsr
449 	mov ar.rsc=3				// put RSE back into eager mode, pl 0
450 	br.cond.sptk.many b7
451 END(load_switch_stack)
452 
453 	/*
454 	 * Invoke a system call, but do some tracing before and after the call.
455 	 * We MUST preserve the current register frame throughout this routine
456 	 * because some system calls (such as ia64_execve) directly
457 	 * manipulate ar.pfs.
458 	 */
459 GLOBAL_ENTRY(ia64_trace_syscall)
460 	PT_REGS_UNWIND_INFO(0)
461 	/*
462 	 * We need to preserve the scratch registers f6-f11 in case the system
463 	 * call is sigreturn.
464 	 */
465 	adds r16=PT(F6)+16,sp
466 	adds r17=PT(F7)+16,sp
467 	;;
468  	stf.spill [r16]=f6,32
469  	stf.spill [r17]=f7,32
470 	;;
471  	stf.spill [r16]=f8,32
472  	stf.spill [r17]=f9,32
473 	;;
474  	stf.spill [r16]=f10
475  	stf.spill [r17]=f11
476 	br.call.sptk.many rp=syscall_trace_enter // give parent a chance to catch syscall args
477 	cmp.lt p6,p0=r8,r0			// check tracehook
478 	adds r2=PT(R8)+16,sp			// r2 = &pt_regs.r8
479 	adds r3=PT(R10)+16,sp			// r3 = &pt_regs.r10
480 	mov r10=0
481 (p6)	br.cond.sptk strace_error		// syscall failed ->
482 	adds r16=PT(F6)+16,sp
483 	adds r17=PT(F7)+16,sp
484 	;;
485 	ldf.fill f6=[r16],32
486 	ldf.fill f7=[r17],32
487 	;;
488 	ldf.fill f8=[r16],32
489 	ldf.fill f9=[r17],32
490 	;;
491 	ldf.fill f10=[r16]
492 	ldf.fill f11=[r17]
493 	// the syscall number may have changed, so re-load it and re-calculate the
494 	// syscall entry-point:
495 	adds r15=PT(R15)+16,sp			// r15 = &pt_regs.r15 (syscall #)
496 	;;
497 	ld8 r15=[r15]
498 	mov r3=NR_syscalls - 1
499 	;;
500 	adds r15=-1024,r15
501 	movl r16=sys_call_table
502 	;;
503 	shladd r20=r15,3,r16			// r20 = sys_call_table + 8*(syscall-1024)
504 	cmp.leu p6,p7=r15,r3
505 	;;
506 (p6)	ld8 r20=[r20]				// load address of syscall entry point
507 (p7)	movl r20=sys_ni_syscall
508 	;;
509 	mov b6=r20
510 	br.call.sptk.many rp=b6			// do the syscall
511 .strace_check_retval:
512 	cmp.lt p6,p0=r8,r0			// syscall failed?
513 	adds r2=PT(R8)+16,sp			// r2 = &pt_regs.r8
514 	adds r3=PT(R10)+16,sp			// r3 = &pt_regs.r10
515 	mov r10=0
516 (p6)	br.cond.sptk strace_error		// syscall failed ->
517 	;;					// avoid RAW on r10
518 .strace_save_retval:
519 .mem.offset 0,0; st8.spill [r2]=r8		// store return value in slot for r8
520 .mem.offset 8,0; st8.spill [r3]=r10		// clear error indication in slot for r10
521 	br.call.sptk.many rp=syscall_trace_leave // give parent a chance to catch return value
522 .ret3:
523 (pUStk)	cmp.eq.unc p6,p0=r0,r0			// p6 <- pUStk
524 (pUStk)	rsm psr.i				// disable interrupts
525 	br.cond.sptk ia64_work_pending_syscall_end
526 
527 strace_error:
528 	ld8 r3=[r2]				// load pt_regs.r8
529 	sub r9=0,r8				// negate return value to get errno value
530 	;;
531 	cmp.ne p6,p0=r3,r0			// is pt_regs.r8!=0?
532 	adds r3=16,r2				// r3=&pt_regs.r10
533 	;;
534 (p6)	mov r10=-1
535 (p6)	mov r8=r9
536 	br.cond.sptk .strace_save_retval
537 END(ia64_trace_syscall)
538 
539 	/*
540 	 * When traced and returning from sigreturn, we invoke syscall_trace but then
541 	 * go straight to ia64_leave_kernel rather than ia64_leave_syscall.
542 	 */
543 GLOBAL_ENTRY(ia64_strace_leave_kernel)
544 	PT_REGS_UNWIND_INFO(0)
545 {	/*
546 	 * Some versions of gas generate bad unwind info if the first instruction of a
547 	 * procedure doesn't go into the first slot of a bundle.  This is a workaround.
548 	 */
549 	nop.m 0
550 	nop.i 0
551 	br.call.sptk.many rp=syscall_trace_leave // give parent a chance to catch return value
552 }
553 .ret4:	br.cond.sptk ia64_leave_kernel
554 END(ia64_strace_leave_kernel)
555 
556 ENTRY(call_payload)
557 	.prologue ASM_UNW_PRLG_RP|ASM_UNW_PRLG_PFS, ASM_UNW_PRLG_GRSAVE(0)
558 	/* call the kernel_thread payload; fn is in r4, arg - in r5 */
559 	alloc loc1=ar.pfs,0,3,1,0
560 	mov loc0=rp
561 	mov loc2=gp
562 	mov out0=r5		// arg
563 	ld8 r14 = [r4], 8	// fn.address
564 	;;
565 	mov b6 = r14
566 	ld8 gp = [r4]		// fn.gp
567 	;;
568 	br.call.sptk.many rp=b6	// fn(arg)
569 .ret12:	mov gp=loc2
570 	mov rp=loc0
571 	mov ar.pfs=loc1
572 	/* ... and if it has returned, we are going to userland */
573 	cmp.ne pKStk,pUStk=r0,r0
574 	br.ret.sptk.many rp
575 END(call_payload)
576 
577 GLOBAL_ENTRY(ia64_ret_from_clone)
578 	PT_REGS_UNWIND_INFO(0)
579 {	/*
580 	 * Some versions of gas generate bad unwind info if the first instruction of a
581 	 * procedure doesn't go into the first slot of a bundle.  This is a workaround.
582 	 */
583 	nop.m 0
584 	nop.i 0
585 	/*
586 	 * We need to call schedule_tail() to complete the scheduling process.
587 	 * Called by ia64_switch_to() after ia64_clone()->copy_thread().  r8 contains the
588 	 * address of the previously executing task.
589 	 */
590 	br.call.sptk.many rp=ia64_invoke_schedule_tail
591 }
592 .ret8:
593 (pKStk)	br.call.sptk.many rp=call_payload
594 	adds r2=TI_FLAGS+IA64_TASK_SIZE,r13
595 	;;
596 	ld4 r2=[r2]
597 	;;
598 	mov r8=0
599 	and r2=_TIF_SYSCALL_TRACEAUDIT,r2
600 	;;
601 	cmp.ne p6,p0=r2,r0
602 (p6)	br.cond.spnt .strace_check_retval
603 	;;					// added stop bits to prevent r8 dependency
604 END(ia64_ret_from_clone)
605 	// fall through
606 GLOBAL_ENTRY(ia64_ret_from_syscall)
607 	PT_REGS_UNWIND_INFO(0)
608 	cmp.ge p6,p7=r8,r0			// syscall executed successfully?
609 	adds r2=PT(R8)+16,sp			// r2 = &pt_regs.r8
610 	mov r10=r0				// clear error indication in r10
611 (p7)	br.cond.spnt handle_syscall_error	// handle potential syscall failure
612 END(ia64_ret_from_syscall)
613 	// fall through
614 
615 /*
616  * ia64_leave_syscall(): Same as ia64_leave_kernel, except that it doesn't
617  *	need to switch to bank 0 and doesn't restore the scratch registers.
618  *	To avoid leaking kernel bits, the scratch registers are set to
619  *	the following known-to-be-safe values:
620  *
621  *		  r1: restored (global pointer)
622  *		  r2: cleared
623  *		  r3: 1 (when returning to user-level)
624  *	      r8-r11: restored (syscall return value(s))
625  *		 r12: restored (user-level stack pointer)
626  *		 r13: restored (user-level thread pointer)
627  *		 r14: set to __kernel_syscall_via_epc
628  *		 r15: restored (syscall #)
629  *	     r16-r17: cleared
630  *		 r18: user-level b6
631  *		 r19: cleared
632  *		 r20: user-level ar.fpsr
633  *		 r21: user-level b0
634  *		 r22: cleared
635  *		 r23: user-level ar.bspstore
636  *		 r24: user-level ar.rnat
637  *		 r25: user-level ar.unat
638  *		 r26: user-level ar.pfs
639  *		 r27: user-level ar.rsc
640  *		 r28: user-level ip
641  *		 r29: user-level psr
642  *		 r30: user-level cfm
643  *		 r31: user-level pr
644  *	      f6-f11: cleared
645  *		  pr: restored (user-level pr)
646  *		  b0: restored (user-level rp)
647  *	          b6: restored
648  *		  b7: set to __kernel_syscall_via_epc
649  *	     ar.unat: restored (user-level ar.unat)
650  *	      ar.pfs: restored (user-level ar.pfs)
651  *	      ar.rsc: restored (user-level ar.rsc)
652  *	     ar.rnat: restored (user-level ar.rnat)
653  *	 ar.bspstore: restored (user-level ar.bspstore)
654  *	     ar.fpsr: restored (user-level ar.fpsr)
655  *	      ar.ccv: cleared
656  *	      ar.csd: cleared
657  *	      ar.ssd: cleared
658  */
659 GLOBAL_ENTRY(ia64_leave_syscall)
660 	PT_REGS_UNWIND_INFO(0)
661 	/*
662 	 * work.need_resched etc. mustn't get changed by this CPU before it returns to
663 	 * user- or fsys-mode, hence we disable interrupts early on.
664 	 *
665 	 * p6 controls whether current_thread_info()->flags needs to be check for
666 	 * extra work.  We always check for extra work when returning to user-level.
667 	 * With CONFIG_PREEMPTION, we also check for extra work when the preempt_count
668 	 * is 0.  After extra work processing has been completed, execution
669 	 * resumes at ia64_work_processed_syscall with p6 set to 1 if the extra-work-check
670 	 * needs to be redone.
671 	 */
672 #ifdef CONFIG_PREEMPTION
673 	RSM_PSR_I(p0, r2, r18)			// disable interrupts
674 	cmp.eq pLvSys,p0=r0,r0			// pLvSys=1: leave from syscall
675 (pKStk) adds r20=TI_PRE_COUNT+IA64_TASK_SIZE,r13
676 	;;
677 	.pred.rel.mutex pUStk,pKStk
678 (pKStk) ld4 r21=[r20]			// r21 <- preempt_count
679 (pUStk)	mov r21=0			// r21 <- 0
680 	;;
681 	cmp.eq p6,p0=r21,r0		// p6 <- pUStk || (preempt_count == 0)
682 #else /* !CONFIG_PREEMPTION */
683 	RSM_PSR_I(pUStk, r2, r18)
684 	cmp.eq pLvSys,p0=r0,r0		// pLvSys=1: leave from syscall
685 (pUStk)	cmp.eq.unc p6,p0=r0,r0		// p6 <- pUStk
686 #endif
687 .global ia64_work_processed_syscall;
688 ia64_work_processed_syscall:
689 #ifdef CONFIG_VIRT_CPU_ACCOUNTING_NATIVE
690 	adds r2=PT(LOADRS)+16,r12
691 	MOV_FROM_ITC(pUStk, p9, r22, r19)	// fetch time at leave
692 	adds r18=TI_FLAGS+IA64_TASK_SIZE,r13
693 	;;
694 (p6)	ld4 r31=[r18]				// load current_thread_info()->flags
695 	ld8 r19=[r2],PT(B6)-PT(LOADRS)		// load ar.rsc value for "loadrs"
696 	adds r3=PT(AR_BSPSTORE)+16,r12		// deferred
697 	;;
698 #else
699 	adds r2=PT(LOADRS)+16,r12
700 	adds r3=PT(AR_BSPSTORE)+16,r12
701 	adds r18=TI_FLAGS+IA64_TASK_SIZE,r13
702 	;;
703 (p6)	ld4 r31=[r18]				// load current_thread_info()->flags
704 	ld8 r19=[r2],PT(B6)-PT(LOADRS)		// load ar.rsc value for "loadrs"
705 	nop.i 0
706 	;;
707 #endif
708 	mov r16=ar.bsp				// M2  get existing backing store pointer
709 	ld8 r18=[r2],PT(R9)-PT(B6)		// load b6
710 (p6)	and r15=TIF_WORK_MASK,r31		// any work other than TIF_SYSCALL_TRACE?
711 	;;
712 	ld8 r23=[r3],PT(R11)-PT(AR_BSPSTORE)	// load ar.bspstore (may be garbage)
713 (p6)	cmp4.ne.unc p6,p0=r15, r0		// any special work pending?
714 (p6)	br.cond.spnt .work_pending_syscall
715 	;;
716 	// start restoring the state saved on the kernel stack (struct pt_regs):
717 	ld8 r9=[r2],PT(CR_IPSR)-PT(R9)
718 	ld8 r11=[r3],PT(CR_IIP)-PT(R11)
719 (pNonSys) break 0		//      bug check: we shouldn't be here if pNonSys is TRUE!
720 	;;
721 	invala			// M0|1 invalidate ALAT
722 	RSM_PSR_I_IC(r28, r29, r30)	// M2   turn off interrupts and interruption collection
723 	cmp.eq p9,p0=r0,r0	// A    set p9 to indicate that we should restore cr.ifs
724 
725 	ld8 r29=[r2],16		// M0|1 load cr.ipsr
726 	ld8 r28=[r3],16		// M0|1 load cr.iip
727 #ifdef CONFIG_VIRT_CPU_ACCOUNTING_NATIVE
728 (pUStk) add r14=TI_AC_LEAVE+IA64_TASK_SIZE,r13
729 	;;
730 	ld8 r30=[r2],16		// M0|1 load cr.ifs
731 	ld8 r25=[r3],16		// M0|1 load ar.unat
732 (pUStk) add r15=IA64_TASK_THREAD_ON_USTACK_OFFSET,r13
733 	;;
734 #else
735 	mov r22=r0		// A    clear r22
736 	;;
737 	ld8 r30=[r2],16		// M0|1 load cr.ifs
738 	ld8 r25=[r3],16		// M0|1 load ar.unat
739 (pUStk) add r14=IA64_TASK_THREAD_ON_USTACK_OFFSET,r13
740 	;;
741 #endif
742 	ld8 r26=[r2],PT(B0)-PT(AR_PFS)	// M0|1 load ar.pfs
743 	MOV_FROM_PSR(pKStk, r22, r21)	// M2   read PSR now that interrupts are disabled
744 	nop 0
745 	;;
746 	ld8 r21=[r2],PT(AR_RNAT)-PT(B0) // M0|1 load b0
747 	ld8 r27=[r3],PT(PR)-PT(AR_RSC)	// M0|1 load ar.rsc
748 	mov f6=f0			// F    clear f6
749 	;;
750 	ld8 r24=[r2],PT(AR_FPSR)-PT(AR_RNAT)	// M0|1 load ar.rnat (may be garbage)
751 	ld8 r31=[r3],PT(R1)-PT(PR)		// M0|1 load predicates
752 	mov f7=f0				// F    clear f7
753 	;;
754 	ld8 r20=[r2],PT(R12)-PT(AR_FPSR)	// M0|1 load ar.fpsr
755 	ld8.fill r1=[r3],16			// M0|1 load r1
756 (pUStk) mov r17=1				// A
757 	;;
758 #ifdef CONFIG_VIRT_CPU_ACCOUNTING_NATIVE
759 (pUStk) st1 [r15]=r17				// M2|3
760 #else
761 (pUStk) st1 [r14]=r17				// M2|3
762 #endif
763 	ld8.fill r13=[r3],16			// M0|1
764 	mov f8=f0				// F    clear f8
765 	;;
766 	ld8.fill r12=[r2]			// M0|1 restore r12 (sp)
767 	ld8.fill r15=[r3]			// M0|1 restore r15
768 	mov b6=r18				// I0   restore b6
769 
770 	LOAD_PHYS_STACK_REG_SIZE(r17)
771 	mov f9=f0					// F    clear f9
772 (pKStk) br.cond.dpnt.many skip_rbs_switch		// B
773 
774 	srlz.d				// M0   ensure interruption collection is off (for cover)
775 	shr.u r18=r19,16		// I0|1 get byte size of existing "dirty" partition
776 	COVER				// B    add current frame into dirty partition & set cr.ifs
777 	;;
778 #ifdef CONFIG_VIRT_CPU_ACCOUNTING_NATIVE
779 	mov r19=ar.bsp			// M2   get new backing store pointer
780 	st8 [r14]=r22			// M	save time at leave
781 	mov f10=f0			// F    clear f10
782 
783 	mov r22=r0			// A	clear r22
784 	movl r14=__kernel_syscall_via_epc // X
785 	;;
786 #else
787 	mov r19=ar.bsp			// M2   get new backing store pointer
788 	mov f10=f0			// F    clear f10
789 
790 	nop.m 0
791 	movl r14=__kernel_syscall_via_epc // X
792 	;;
793 #endif
794 	mov.m ar.csd=r0			// M2   clear ar.csd
795 	mov.m ar.ccv=r0			// M2   clear ar.ccv
796 	mov b7=r14			// I0   clear b7 (hint with __kernel_syscall_via_epc)
797 
798 	mov.m ar.ssd=r0			// M2   clear ar.ssd
799 	mov f11=f0			// F    clear f11
800 	br.cond.sptk.many rbs_switch	// B
801 END(ia64_leave_syscall)
802 
803 GLOBAL_ENTRY(ia64_leave_kernel)
804 	PT_REGS_UNWIND_INFO(0)
805 	/*
806 	 * work.need_resched etc. mustn't get changed by this CPU before it returns to
807 	 * user- or fsys-mode, hence we disable interrupts early on.
808 	 *
809 	 * p6 controls whether current_thread_info()->flags needs to be check for
810 	 * extra work.  We always check for extra work when returning to user-level.
811 	 * With CONFIG_PREEMPTION, we also check for extra work when the preempt_count
812 	 * is 0.  After extra work processing has been completed, execution
813 	 * resumes at .work_processed_syscall with p6 set to 1 if the extra-work-check
814 	 * needs to be redone.
815 	 */
816 #ifdef CONFIG_PREEMPTION
817 	RSM_PSR_I(p0, r17, r31)			// disable interrupts
818 	cmp.eq p0,pLvSys=r0,r0			// pLvSys=0: leave from kernel
819 (pKStk)	adds r20=TI_PRE_COUNT+IA64_TASK_SIZE,r13
820 	;;
821 	.pred.rel.mutex pUStk,pKStk
822 (pKStk)	ld4 r21=[r20]			// r21 <- preempt_count
823 (pUStk)	mov r21=0			// r21 <- 0
824 	;;
825 	cmp.eq p6,p0=r21,r0		// p6 <- pUStk || (preempt_count == 0)
826 #else
827 	RSM_PSR_I(pUStk, r17, r31)
828 	cmp.eq p0,pLvSys=r0,r0		// pLvSys=0: leave from kernel
829 (pUStk)	cmp.eq.unc p6,p0=r0,r0		// p6 <- pUStk
830 #endif
831 .work_processed_kernel:
832 	adds r17=TI_FLAGS+IA64_TASK_SIZE,r13
833 	;;
834 (p6)	ld4 r31=[r17]				// load current_thread_info()->flags
835 	adds r21=PT(PR)+16,r12
836 	;;
837 
838 	lfetch [r21],PT(CR_IPSR)-PT(PR)
839 	adds r2=PT(B6)+16,r12
840 	adds r3=PT(R16)+16,r12
841 	;;
842 	lfetch [r21]
843 	ld8 r28=[r2],8		// load b6
844 	adds r29=PT(R24)+16,r12
845 
846 	ld8.fill r16=[r3],PT(AR_CSD)-PT(R16)
847 	adds r30=PT(AR_CCV)+16,r12
848 (p6)	and r19=TIF_WORK_MASK,r31		// any work other than TIF_SYSCALL_TRACE?
849 	;;
850 	ld8.fill r24=[r29]
851 	ld8 r15=[r30]		// load ar.ccv
852 (p6)	cmp4.ne.unc p6,p0=r19, r0		// any special work pending?
853 	;;
854 	ld8 r29=[r2],16		// load b7
855 	ld8 r30=[r3],16		// load ar.csd
856 (p6)	br.cond.spnt .work_pending
857 	;;
858 	ld8 r31=[r2],16		// load ar.ssd
859 	ld8.fill r8=[r3],16
860 	;;
861 	ld8.fill r9=[r2],16
862 	ld8.fill r10=[r3],PT(R17)-PT(R10)
863 	;;
864 	ld8.fill r11=[r2],PT(R18)-PT(R11)
865 	ld8.fill r17=[r3],16
866 	;;
867 	ld8.fill r18=[r2],16
868 	ld8.fill r19=[r3],16
869 	;;
870 	ld8.fill r20=[r2],16
871 	ld8.fill r21=[r3],16
872 	mov ar.csd=r30
873 	mov ar.ssd=r31
874 	;;
875 	RSM_PSR_I_IC(r23, r22, r25)	// initiate turning off of interrupt and interruption collection
876 	invala			// invalidate ALAT
877 	;;
878 	ld8.fill r22=[r2],24
879 	ld8.fill r23=[r3],24
880 	mov b6=r28
881 	;;
882 	ld8.fill r25=[r2],16
883 	ld8.fill r26=[r3],16
884 	mov b7=r29
885 	;;
886 	ld8.fill r27=[r2],16
887 	ld8.fill r28=[r3],16
888 	;;
889 	ld8.fill r29=[r2],16
890 	ld8.fill r30=[r3],24
891 	;;
892 	ld8.fill r31=[r2],PT(F9)-PT(R31)
893 	adds r3=PT(F10)-PT(F6),r3
894 	;;
895 	ldf.fill f9=[r2],PT(F6)-PT(F9)
896 	ldf.fill f10=[r3],PT(F8)-PT(F10)
897 	;;
898 	ldf.fill f6=[r2],PT(F7)-PT(F6)
899 	;;
900 	ldf.fill f7=[r2],PT(F11)-PT(F7)
901 	ldf.fill f8=[r3],32
902 	;;
903 	srlz.d	// ensure that inter. collection is off (VHPT is don't care, since text is pinned)
904 	mov ar.ccv=r15
905 	;;
906 	ldf.fill f11=[r2]
907 	BSW_0(r2, r3, r15)	// switch back to bank 0 (no stop bit required beforehand...)
908 	;;
909 (pUStk)	mov r18=IA64_KR(CURRENT)// M2 (12 cycle read latency)
910 	adds r16=PT(CR_IPSR)+16,r12
911 	adds r17=PT(CR_IIP)+16,r12
912 
913 #ifdef CONFIG_VIRT_CPU_ACCOUNTING_NATIVE
914 	.pred.rel.mutex pUStk,pKStk
915 	MOV_FROM_PSR(pKStk, r22, r29)	// M2 read PSR now that interrupts are disabled
916 	MOV_FROM_ITC(pUStk, p9, r22, r29)	// M  fetch time at leave
917 	nop.i 0
918 	;;
919 #else
920 	MOV_FROM_PSR(pKStk, r22, r29)	// M2 read PSR now that interrupts are disabled
921 	nop.i 0
922 	nop.i 0
923 	;;
924 #endif
925 	ld8 r29=[r16],16	// load cr.ipsr
926 	ld8 r28=[r17],16	// load cr.iip
927 	;;
928 	ld8 r30=[r16],16	// load cr.ifs
929 	ld8 r25=[r17],16	// load ar.unat
930 	;;
931 	ld8 r26=[r16],16	// load ar.pfs
932 	ld8 r27=[r17],16	// load ar.rsc
933 	cmp.eq p9,p0=r0,r0	// set p9 to indicate that we should restore cr.ifs
934 	;;
935 	ld8 r24=[r16],16	// load ar.rnat (may be garbage)
936 	ld8 r23=[r17],16	// load ar.bspstore (may be garbage)
937 	;;
938 	ld8 r31=[r16],16	// load predicates
939 	ld8 r21=[r17],16	// load b0
940 	;;
941 	ld8 r19=[r16],16	// load ar.rsc value for "loadrs"
942 	ld8.fill r1=[r17],16	// load r1
943 	;;
944 	ld8.fill r12=[r16],16
945 	ld8.fill r13=[r17],16
946 #ifdef CONFIG_VIRT_CPU_ACCOUNTING_NATIVE
947 (pUStk)	adds r3=TI_AC_LEAVE+IA64_TASK_SIZE,r18
948 #else
949 (pUStk)	adds r18=IA64_TASK_THREAD_ON_USTACK_OFFSET,r18
950 #endif
951 	;;
952 	ld8 r20=[r16],16	// ar.fpsr
953 	ld8.fill r15=[r17],16
954 #ifdef CONFIG_VIRT_CPU_ACCOUNTING_NATIVE
955 (pUStk)	adds r18=IA64_TASK_THREAD_ON_USTACK_OFFSET,r18	// deferred
956 #endif
957 	;;
958 	ld8.fill r14=[r16],16
959 	ld8.fill r2=[r17]
960 (pUStk)	mov r17=1
961 	;;
962 #ifdef CONFIG_VIRT_CPU_ACCOUNTING_NATIVE
963 	//  mmi_ :  ld8 st1 shr;;         mmi_ : st8 st1 shr;;
964 	//  mib  :  mov add br        ->  mib  : ld8 add br
965 	//  bbb_ :  br  nop cover;;       mbb_ : mov br  cover;;
966 	//
967 	//  no one require bsp in r16 if (pKStk) branch is selected.
968 (pUStk)	st8 [r3]=r22		// save time at leave
969 (pUStk)	st1 [r18]=r17		// restore current->thread.on_ustack
970 	shr.u r18=r19,16	// get byte size of existing "dirty" partition
971 	;;
972 	ld8.fill r3=[r16]	// deferred
973 	LOAD_PHYS_STACK_REG_SIZE(r17)
974 (pKStk)	br.cond.dpnt skip_rbs_switch
975 	mov r16=ar.bsp		// get existing backing store pointer
976 #else
977 	ld8.fill r3=[r16]
978 (pUStk)	st1 [r18]=r17		// restore current->thread.on_ustack
979 	shr.u r18=r19,16	// get byte size of existing "dirty" partition
980 	;;
981 	mov r16=ar.bsp		// get existing backing store pointer
982 	LOAD_PHYS_STACK_REG_SIZE(r17)
983 (pKStk)	br.cond.dpnt skip_rbs_switch
984 #endif
985 
986 	/*
987 	 * Restore user backing store.
988 	 *
989 	 * NOTE: alloc, loadrs, and cover can't be predicated.
990 	 */
991 (pNonSys) br.cond.dpnt dont_preserve_current_frame
992 	COVER				// add current frame into dirty partition and set cr.ifs
993 	;;
994 	mov r19=ar.bsp			// get new backing store pointer
995 rbs_switch:
996 	sub r16=r16,r18			// krbs = old bsp - size of dirty partition
997 	cmp.ne p9,p0=r0,r0		// clear p9 to skip restore of cr.ifs
998 	;;
999 	sub r19=r19,r16			// calculate total byte size of dirty partition
1000 	add r18=64,r18			// don't force in0-in7 into memory...
1001 	;;
1002 	shl r19=r19,16			// shift size of dirty partition into loadrs position
1003 	;;
1004 dont_preserve_current_frame:
1005 	/*
1006 	 * To prevent leaking bits between the kernel and user-space,
1007 	 * we must clear the stacked registers in the "invalid" partition here.
1008 	 * Not pretty, but at least it's fast (3.34 registers/cycle on Itanium,
1009 	 * 5 registers/cycle on McKinley).
1010 	 */
1011 #	define pRecurse	p6
1012 #	define pReturn	p7
1013 #ifdef CONFIG_ITANIUM
1014 #	define Nregs	10
1015 #else
1016 #	define Nregs	14
1017 #endif
1018 	alloc loc0=ar.pfs,2,Nregs-2,2,0
1019 	shr.u loc1=r18,9		// RNaTslots <= floor(dirtySize / (64*8))
1020 	sub r17=r17,r18			// r17 = (physStackedSize + 8) - dirtySize
1021 	;;
1022 	mov ar.rsc=r19			// load ar.rsc to be used for "loadrs"
1023 	shladd in0=loc1,3,r17
1024 	mov in1=0
1025 	;;
1026 	TEXT_ALIGN(32)
1027 rse_clear_invalid:
1028 #ifdef CONFIG_ITANIUM
1029 	// cycle 0
1030  { .mii
1031 	alloc loc0=ar.pfs,2,Nregs-2,2,0
1032 	cmp.lt pRecurse,p0=Nregs*8,in0	// if more than Nregs regs left to clear, (re)curse
1033 	add out0=-Nregs*8,in0
1034 }{ .mfb
1035 	add out1=1,in1			// increment recursion count
1036 	nop.f 0
1037 	nop.b 0				// can't do br.call here because of alloc (WAW on CFM)
1038 	;;
1039 }{ .mfi	// cycle 1
1040 	mov loc1=0
1041 	nop.f 0
1042 	mov loc2=0
1043 }{ .mib
1044 	mov loc3=0
1045 	mov loc4=0
1046 (pRecurse) br.call.sptk.many b0=rse_clear_invalid
1047 
1048 }{ .mfi	// cycle 2
1049 	mov loc5=0
1050 	nop.f 0
1051 	cmp.ne pReturn,p0=r0,in1	// if recursion count != 0, we need to do a br.ret
1052 }{ .mib
1053 	mov loc6=0
1054 	mov loc7=0
1055 (pReturn) br.ret.sptk.many b0
1056 }
1057 #else /* !CONFIG_ITANIUM */
1058 	alloc loc0=ar.pfs,2,Nregs-2,2,0
1059 	cmp.lt pRecurse,p0=Nregs*8,in0	// if more than Nregs regs left to clear, (re)curse
1060 	add out0=-Nregs*8,in0
1061 	add out1=1,in1			// increment recursion count
1062 	mov loc1=0
1063 	mov loc2=0
1064 	;;
1065 	mov loc3=0
1066 	mov loc4=0
1067 	mov loc5=0
1068 	mov loc6=0
1069 	mov loc7=0
1070 (pRecurse) br.call.dptk.few b0=rse_clear_invalid
1071 	;;
1072 	mov loc8=0
1073 	mov loc9=0
1074 	cmp.ne pReturn,p0=r0,in1	// if recursion count != 0, we need to do a br.ret
1075 	mov loc10=0
1076 	mov loc11=0
1077 (pReturn) br.ret.dptk.many b0
1078 #endif /* !CONFIG_ITANIUM */
1079 #	undef pRecurse
1080 #	undef pReturn
1081 	;;
1082 	alloc r17=ar.pfs,0,0,0,0	// drop current register frame
1083 	;;
1084 	loadrs
1085 	;;
1086 skip_rbs_switch:
1087 	mov ar.unat=r25		// M2
1088 (pKStk)	extr.u r22=r22,21,1	// I0 extract current value of psr.pp from r22
1089 (pLvSys)mov r19=r0		// A  clear r19 for leave_syscall, no-op otherwise
1090 	;;
1091 (pUStk)	mov ar.bspstore=r23	// M2
1092 (pKStk)	dep r29=r22,r29,21,1	// I0 update ipsr.pp with psr.pp
1093 (pLvSys)mov r16=r0		// A  clear r16 for leave_syscall, no-op otherwise
1094 	;;
1095 	MOV_TO_IPSR(p0, r29, r25)	// M2
1096 	mov ar.pfs=r26		// I0
1097 (pLvSys)mov r17=r0		// A  clear r17 for leave_syscall, no-op otherwise
1098 
1099 	MOV_TO_IFS(p9, r30, r25)// M2
1100 	mov b0=r21		// I0
1101 (pLvSys)mov r18=r0		// A  clear r18 for leave_syscall, no-op otherwise
1102 
1103 	mov ar.fpsr=r20		// M2
1104 	MOV_TO_IIP(r28, r25)	// M2
1105 	nop 0
1106 	;;
1107 (pUStk)	mov ar.rnat=r24		// M2 must happen with RSE in lazy mode
1108 	nop 0
1109 (pLvSys)mov r2=r0
1110 
1111 	mov ar.rsc=r27		// M2
1112 	mov pr=r31,-1		// I0
1113 	RFI			// B
1114 
1115 	/*
1116 	 * On entry:
1117 	 *	r20 = &current->thread_info->pre_count (if CONFIG_PREEMPTION)
1118 	 *	r31 = current->thread_info->flags
1119 	 * On exit:
1120 	 *	p6 = TRUE if work-pending-check needs to be redone
1121 	 *
1122 	 * Interrupts are disabled on entry, reenabled depend on work, and
1123 	 * disabled on exit.
1124 	 */
1125 .work_pending_syscall:
1126 	add r2=-8,r2
1127 	add r3=-8,r3
1128 	;;
1129 	st8 [r2]=r8
1130 	st8 [r3]=r10
1131 .work_pending:
1132 	tbit.z p6,p0=r31,TIF_NEED_RESCHED	// is resched not needed?
1133 (p6)	br.cond.sptk.few .notify
1134 	br.call.spnt.many rp=preempt_schedule_irq
1135 .ret9:	cmp.eq p6,p0=r0,r0	// p6 <- 1 (re-check)
1136 (pLvSys)br.cond.sptk.few  ia64_work_pending_syscall_end
1137 	br.cond.sptk.many .work_processed_kernel
1138 
1139 .notify:
1140 (pUStk)	br.call.spnt.many rp=notify_resume_user
1141 .ret10:	cmp.ne p6,p0=r0,r0	// p6 <- 0 (don't re-check)
1142 (pLvSys)br.cond.sptk.few  ia64_work_pending_syscall_end
1143 	br.cond.sptk.many .work_processed_kernel
1144 
1145 .global ia64_work_pending_syscall_end;
1146 ia64_work_pending_syscall_end:
1147 	adds r2=PT(R8)+16,r12
1148 	adds r3=PT(R10)+16,r12
1149 	;;
1150 	ld8 r8=[r2]
1151 	ld8 r10=[r3]
1152 	br.cond.sptk.many ia64_work_processed_syscall
1153 END(ia64_leave_kernel)
1154 
1155 ENTRY(handle_syscall_error)
1156 	/*
1157 	 * Some system calls (e.g., ptrace, mmap) can return arbitrary values which could
1158 	 * lead us to mistake a negative return value as a failed syscall.  Those syscall
1159 	 * must deposit a non-zero value in pt_regs.r8 to indicate an error.  If
1160 	 * pt_regs.r8 is zero, we assume that the call completed successfully.
1161 	 */
1162 	PT_REGS_UNWIND_INFO(0)
1163 	ld8 r3=[r2]		// load pt_regs.r8
1164 	;;
1165 	cmp.eq p6,p7=r3,r0	// is pt_regs.r8==0?
1166 	;;
1167 (p7)	mov r10=-1
1168 (p7)	sub r8=0,r8		// negate return value to get errno
1169 	br.cond.sptk ia64_leave_syscall
1170 END(handle_syscall_error)
1171 
1172 	/*
1173 	 * Invoke schedule_tail(task) while preserving in0-in7, which may be needed
1174 	 * in case a system call gets restarted.
1175 	 */
1176 GLOBAL_ENTRY(ia64_invoke_schedule_tail)
1177 	.prologue ASM_UNW_PRLG_RP|ASM_UNW_PRLG_PFS, ASM_UNW_PRLG_GRSAVE(8)
1178 	alloc loc1=ar.pfs,8,2,1,0
1179 	mov loc0=rp
1180 	mov out0=r8				// Address of previous task
1181 	;;
1182 	br.call.sptk.many rp=schedule_tail
1183 .ret11:	mov ar.pfs=loc1
1184 	mov rp=loc0
1185 	br.ret.sptk.many rp
1186 END(ia64_invoke_schedule_tail)
1187 
1188 	/*
1189 	 * Setup stack and call do_notify_resume_user(), keeping interrupts
1190 	 * disabled.
1191 	 *
1192 	 * Note that pSys and pNonSys need to be set up by the caller.
1193 	 * We declare 8 input registers so the system call args get preserved,
1194 	 * in case we need to restart a system call.
1195 	 */
1196 GLOBAL_ENTRY(notify_resume_user)
1197 	.prologue ASM_UNW_PRLG_RP|ASM_UNW_PRLG_PFS, ASM_UNW_PRLG_GRSAVE(8)
1198 	alloc loc1=ar.pfs,8,2,3,0 // preserve all eight input regs in case of syscall restart!
1199 	mov r9=ar.unat
1200 	mov loc0=rp				// save return address
1201 	mov out0=0				// there is no "oldset"
1202 	adds out1=8,sp				// out1=&sigscratch->ar_pfs
1203 (pSys)	mov out2=1				// out2==1 => we're in a syscall
1204 	;;
1205 (pNonSys) mov out2=0				// out2==0 => not a syscall
1206 	.fframe 16
1207 	.spillsp ar.unat, 16
1208 	st8 [sp]=r9,-16				// allocate space for ar.unat and save it
1209 	st8 [out1]=loc1,-8			// save ar.pfs, out1=&sigscratch
1210 	.body
1211 	br.call.sptk.many rp=do_notify_resume_user
1212 .ret15:	.restore sp
1213 	adds sp=16,sp				// pop scratch stack space
1214 	;;
1215 	ld8 r9=[sp]				// load new unat from sigscratch->scratch_unat
1216 	mov rp=loc0
1217 	;;
1218 	mov ar.unat=r9
1219 	mov ar.pfs=loc1
1220 	br.ret.sptk.many rp
1221 END(notify_resume_user)
1222 
1223 ENTRY(sys_rt_sigreturn)
1224 	PT_REGS_UNWIND_INFO(0)
1225 	/*
1226 	 * Allocate 8 input registers since ptrace() may clobber them
1227 	 */
1228 	alloc r2=ar.pfs,8,0,1,0
1229 	.prologue
1230 	PT_REGS_SAVES(16)
1231 	adds sp=-16,sp
1232 	.body
1233 	cmp.eq pNonSys,pSys=r0,r0		// sigreturn isn't a normal syscall...
1234 	;;
1235 	/*
1236 	 * leave_kernel() restores f6-f11 from pt_regs, but since the streamlined
1237 	 * syscall-entry path does not save them we save them here instead.  Note: we
1238 	 * don't need to save any other registers that are not saved by the stream-lined
1239 	 * syscall path, because restore_sigcontext() restores them.
1240 	 */
1241 	adds r16=PT(F6)+32,sp
1242 	adds r17=PT(F7)+32,sp
1243 	;;
1244  	stf.spill [r16]=f6,32
1245  	stf.spill [r17]=f7,32
1246 	;;
1247  	stf.spill [r16]=f8,32
1248  	stf.spill [r17]=f9,32
1249 	;;
1250  	stf.spill [r16]=f10
1251  	stf.spill [r17]=f11
1252 	adds out0=16,sp				// out0 = &sigscratch
1253 	br.call.sptk.many rp=ia64_rt_sigreturn
1254 .ret19:	.restore sp,0
1255 	adds sp=16,sp
1256 	;;
1257 	ld8 r9=[sp]				// load new ar.unat
1258 	mov.sptk b7=r8,ia64_leave_kernel
1259 	;;
1260 	mov ar.unat=r9
1261 	br.many b7
1262 END(sys_rt_sigreturn)
1263 
1264 GLOBAL_ENTRY(ia64_prepare_handle_unaligned)
1265 	.prologue
1266 	/*
1267 	 * r16 = fake ar.pfs, we simply need to make sure privilege is still 0
1268 	 */
1269 	mov r16=r0
1270 	DO_SAVE_SWITCH_STACK
1271 	br.call.sptk.many rp=ia64_handle_unaligned	// stack frame setup in ivt
1272 .ret21:	.body
1273 	DO_LOAD_SWITCH_STACK
1274 	br.cond.sptk.many rp				// goes to ia64_leave_kernel
1275 END(ia64_prepare_handle_unaligned)
1276 
1277 	//
1278 	// unw_init_running(void (*callback)(info, arg), void *arg)
1279 	//
1280 #	define EXTRA_FRAME_SIZE	((UNW_FRAME_INFO_SIZE+15)&~15)
1281 
1282 GLOBAL_ENTRY(unw_init_running)
1283 	.prologue ASM_UNW_PRLG_RP|ASM_UNW_PRLG_PFS, ASM_UNW_PRLG_GRSAVE(2)
1284 	alloc loc1=ar.pfs,2,3,3,0
1285 	;;
1286 	ld8 loc2=[in0],8
1287 	mov loc0=rp
1288 	mov r16=loc1
1289 	DO_SAVE_SWITCH_STACK
1290 	.body
1291 
1292 	.prologue ASM_UNW_PRLG_RP|ASM_UNW_PRLG_PFS, ASM_UNW_PRLG_GRSAVE(2)
1293 	.fframe IA64_SWITCH_STACK_SIZE+EXTRA_FRAME_SIZE
1294 	SWITCH_STACK_SAVES(EXTRA_FRAME_SIZE)
1295 	adds sp=-EXTRA_FRAME_SIZE,sp
1296 	.body
1297 	;;
1298 	adds out0=16,sp				// &info
1299 	mov out1=r13				// current
1300 	adds out2=16+EXTRA_FRAME_SIZE,sp	// &switch_stack
1301 	br.call.sptk.many rp=unw_init_frame_info
1302 1:	adds out0=16,sp				// &info
1303 	mov b6=loc2
1304 	mov loc2=gp				// save gp across indirect function call
1305 	;;
1306 	ld8 gp=[in0]
1307 	mov out1=in1				// arg
1308 	br.call.sptk.many rp=b6			// invoke the callback function
1309 1:	mov gp=loc2				// restore gp
1310 
1311 	// For now, we don't allow changing registers from within
1312 	// unw_init_running; if we ever want to allow that, we'd
1313 	// have to do a load_switch_stack here:
1314 	.restore sp
1315 	adds sp=IA64_SWITCH_STACK_SIZE+EXTRA_FRAME_SIZE,sp
1316 
1317 	mov ar.pfs=loc1
1318 	mov rp=loc0
1319 	br.ret.sptk.many rp
1320 END(unw_init_running)
1321 EXPORT_SYMBOL(unw_init_running)
1322 
1323 #ifdef CONFIG_FUNCTION_TRACER
1324 #ifdef CONFIG_DYNAMIC_FTRACE
1325 GLOBAL_ENTRY(_mcount)
1326 	br ftrace_stub
1327 END(_mcount)
1328 EXPORT_SYMBOL(_mcount)
1329 
1330 .here:
1331 	br.ret.sptk.many b0
1332 
1333 GLOBAL_ENTRY(ftrace_caller)
1334 	alloc out0 = ar.pfs, 8, 0, 4, 0
1335 	mov out3 = r0
1336 	;;
1337 	mov out2 = b0
1338 	add r3 = 0x20, r3
1339 	mov out1 = r1;
1340 	br.call.sptk.many b0 = ftrace_patch_gp
1341 	//this might be called from module, so we must patch gp
1342 ftrace_patch_gp:
1343 	movl gp=__gp
1344 	mov b0 = r3
1345 	;;
1346 .global ftrace_call;
1347 ftrace_call:
1348 {
1349 	.mlx
1350 	nop.m 0x0
1351 	movl r3 = .here;;
1352 }
1353 	alloc loc0 = ar.pfs, 4, 4, 2, 0
1354 	;;
1355 	mov loc1 = b0
1356 	mov out0 = b0
1357 	mov loc2 = r8
1358 	mov loc3 = r15
1359 	;;
1360 	adds out0 = -MCOUNT_INSN_SIZE, out0
1361 	mov out1 = in2
1362 	mov b6 = r3
1363 
1364 	br.call.sptk.many b0 = b6
1365 	;;
1366 	mov ar.pfs = loc0
1367 	mov b0 = loc1
1368 	mov r8 = loc2
1369 	mov r15 = loc3
1370 	br ftrace_stub
1371 	;;
1372 END(ftrace_caller)
1373 
1374 #else
1375 GLOBAL_ENTRY(_mcount)
1376 	movl r2 = ftrace_stub
1377 	movl r3 = ftrace_trace_function;;
1378 	ld8 r3 = [r3];;
1379 	ld8 r3 = [r3];;
1380 	cmp.eq p7,p0 = r2, r3
1381 (p7)	br.sptk.many ftrace_stub
1382 	;;
1383 
1384 	alloc loc0 = ar.pfs, 4, 4, 2, 0
1385 	;;
1386 	mov loc1 = b0
1387 	mov out0 = b0
1388 	mov loc2 = r8
1389 	mov loc3 = r15
1390 	;;
1391 	adds out0 = -MCOUNT_INSN_SIZE, out0
1392 	mov out1 = in2
1393 	mov b6 = r3
1394 
1395 	br.call.sptk.many b0 = b6
1396 	;;
1397 	mov ar.pfs = loc0
1398 	mov b0 = loc1
1399 	mov r8 = loc2
1400 	mov r15 = loc3
1401 	br ftrace_stub
1402 	;;
1403 END(_mcount)
1404 #endif
1405 
1406 GLOBAL_ENTRY(ftrace_stub)
1407 	mov r3 = b0
1408 	movl r2 = _mcount_ret_helper
1409 	;;
1410 	mov b6 = r2
1411 	mov b7 = r3
1412 	br.ret.sptk.many b6
1413 
1414 _mcount_ret_helper:
1415 	mov b0 = r42
1416 	mov r1 = r41
1417 	mov ar.pfs = r40
1418 	br b7
1419 END(ftrace_stub)
1420 
1421 #endif /* CONFIG_FUNCTION_TRACER */
1422 
1423 #define __SYSCALL(nr, entry, nargs) data8 entry
1424 	.rodata
1425 	.align 8
1426 	.globl sys_call_table
1427 sys_call_table:
1428 #include <asm/syscall_table.h>
1429 #undef __SYSCALL
1430