2 * Copyright 2010 Tilera Corporation. All Rights Reserved.
4 * This program is free software; you can redistribute it and/or
5 * modify it under the terms of the GNU General Public License
6 * as published by the Free Software Foundation, version 2.
8 * This program is distributed in the hope that it will be useful, but
9 * WITHOUT ANY WARRANTY; without even the implied warranty of
10 * MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE, GOOD TITLE or
11 * NON INFRINGEMENT. See the GNU General Public License for
14 * A code-rewriter that enables instruction single-stepping.
15 * Derived from iLib's single-stepping code.
18 #ifndef __tilegx__ /* Hardware support for single step unavailable. */
20 /* These functions are only used on the TILE platform */
21 #include <linux/slab.h>
22 #include <linux/thread_info.h>
23 #include <linux/uaccess.h>
24 #include <linux/mman.h>
25 #include <linux/types.h>
26 #include <linux/err.h>
27 #include <asm/cacheflush.h>
28 #include <asm/unaligned.h>
30 #include <arch/opcode.h>
32 #define signExtend17(val) sign_extend((val), 17)
33 #define TILE_X1_MASK (0xffffffffULL << 31)
37 static int __init setup_unaligned_printk(char *str)
40 if (strict_strtol(str, 0, &val) != 0)
42 unaligned_printk = val;
43 pr_info("Printk for each unaligned data accesses is %s\n",
44 unaligned_printk ? "enabled" : "disabled");
47 __setup("unaligned_printk=", setup_unaligned_printk);
49 unsigned int unaligned_fixup_count;
59 static inline tile_bundle_bits set_BrOff_X1(tile_bundle_bits n, s32 offset)
61 tile_bundle_bits result;
63 /* mask out the old offset */
64 tile_bundle_bits mask = create_BrOff_X1(-1);
67 /* or in the new offset */
68 result |= create_BrOff_X1(offset);
73 static inline tile_bundle_bits move_X1(tile_bundle_bits n, int dest, int src)
75 tile_bundle_bits result;
78 result = n & (~TILE_X1_MASK);
80 op = create_Opcode_X1(SPECIAL_0_OPCODE_X1) |
81 create_RRROpcodeExtension_X1(OR_SPECIAL_0_OPCODE_X1) |
82 create_Dest_X1(dest) |
83 create_SrcB_X1(TREG_ZERO) |
90 static inline tile_bundle_bits nop_X1(tile_bundle_bits n)
92 return move_X1(n, TREG_ZERO, TREG_ZERO);
95 static inline tile_bundle_bits addi_X1(
96 tile_bundle_bits n, int dest, int src, int imm)
100 n |= (create_SrcA_X1(src) |
101 create_Dest_X1(dest) |
102 create_Imm8_X1(imm) |
104 create_Opcode_X1(IMM_0_OPCODE_X1) |
105 create_ImmOpcodeExtension_X1(ADDI_IMM_0_OPCODE_X1));
110 static tile_bundle_bits rewrite_load_store_unaligned(
111 struct single_step_state *state,
112 tile_bundle_bits bundle,
113 struct pt_regs *regs,
115 int size, int sign_ext)
117 unsigned char __user *addr;
118 int val_reg, addr_reg, err, val;
120 /* Get address and value registers */
121 if (bundle & TILEPRO_BUNDLE_Y_ENCODING_MASK) {
122 addr_reg = get_SrcA_Y2(bundle);
123 val_reg = get_SrcBDest_Y2(bundle);
124 } else if (mem_op == MEMOP_LOAD || mem_op == MEMOP_LOAD_POSTINCR) {
125 addr_reg = get_SrcA_X1(bundle);
126 val_reg = get_Dest_X1(bundle);
128 addr_reg = get_SrcA_X1(bundle);
129 val_reg = get_SrcB_X1(bundle);
133 * If registers are not GPRs, don't try to handle it.
135 * FIXME: we could handle non-GPR loads by getting the real value
136 * from memory, writing it to the single step buffer, using a
137 * temp_reg to hold a pointer to that memory, then executing that
138 * instruction and resetting temp_reg. For non-GPR stores, it's a
139 * little trickier; we could use the single step buffer for that
140 * too, but we'd have to add some more state bits so that we could
141 * call back in here to copy that value to the real target. For
142 * now, we just handle the simple case.
144 if ((val_reg >= PTREGS_NR_GPRS &&
145 (val_reg != TREG_ZERO ||
146 mem_op == MEMOP_LOAD ||
147 mem_op == MEMOP_LOAD_POSTINCR)) ||
148 addr_reg >= PTREGS_NR_GPRS)
151 /* If it's aligned, don't handle it specially */
152 addr = (void __user *)regs->regs[addr_reg];
153 if (((unsigned long)addr % size) == 0)
157 * Return SIGBUS with the unaligned address, if requested.
158 * Note that we return SIGBUS even for completely invalid addresses
159 * as long as they are in fact unaligned; this matches what the
160 * tilepro hardware would be doing, if it could provide us with the
161 * actual bad address in an SPR, which it doesn't.
163 if (unaligned_fixup == 0) {
166 .si_code = BUS_ADRALN,
169 trace_unhandled_signal("unaligned trap", regs,
170 (unsigned long)addr, SIGBUS);
171 force_sig_info(info.si_signo, &info, current);
172 return (tilepro_bundle_bits) 0;
175 #ifndef __LITTLE_ENDIAN
176 # error We assume little-endian representation with copy_xx_user size 2 here
178 /* Handle unaligned load/store */
179 if (mem_op == MEMOP_LOAD || mem_op == MEMOP_LOAD_POSTINCR) {
180 unsigned short val_16;
183 err = copy_from_user(&val_16, addr, sizeof(val_16));
184 val = sign_ext ? ((short)val_16) : val_16;
187 err = copy_from_user(&val, addr, sizeof(val));
193 state->update_reg = val_reg;
194 state->update_value = val;
198 val = (val_reg == TREG_ZERO) ? 0 : regs->regs[val_reg];
199 err = copy_to_user(addr, &val, size);
205 .si_code = SEGV_MAPERR,
208 trace_unhandled_signal("segfault", regs,
209 (unsigned long)addr, SIGSEGV);
210 force_sig_info(info.si_signo, &info, current);
211 return (tile_bundle_bits) 0;
214 if (unaligned_printk || unaligned_fixup_count == 0) {
215 pr_info("Process %d/%s: PC %#lx: Fixup of"
216 " unaligned %s at %#lx.\n",
217 current->pid, current->comm, regs->pc,
218 (mem_op == MEMOP_LOAD ||
219 mem_op == MEMOP_LOAD_POSTINCR) ?
221 (unsigned long)addr);
222 if (!unaligned_printk) {
225 P("Unaligned fixups in the kernel will slow your application considerably.\n");
226 P("To find them, write a \"1\" to /proc/sys/tile/unaligned_fixup/printk,\n");
227 P("which requests the kernel show all unaligned fixups, or write a \"0\"\n");
228 P("to /proc/sys/tile/unaligned_fixup/enabled, in which case each unaligned\n");
229 P("access will become a SIGBUS you can debug. No further warnings will be\n");
230 P("shown so as to avoid additional slowdown, but you can track the number\n");
231 P("of fixups performed via /proc/sys/tile/unaligned_fixup/count.\n");
232 P("Use the tile-addr2line command (see \"info addr2line\") to decode PCs.\n");
237 ++unaligned_fixup_count;
239 if (bundle & TILEPRO_BUNDLE_Y_ENCODING_MASK) {
240 /* Convert the Y2 instruction to a prefetch. */
241 bundle &= ~(create_SrcBDest_Y2(-1) |
242 create_Opcode_Y2(-1));
243 bundle |= (create_SrcBDest_Y2(TREG_ZERO) |
244 create_Opcode_Y2(LW_OPCODE_Y2));
245 /* Replace the load postincr with an addi */
246 } else if (mem_op == MEMOP_LOAD_POSTINCR) {
247 bundle = addi_X1(bundle, addr_reg, addr_reg,
248 get_Imm8_X1(bundle));
249 /* Replace the store postincr with an addi */
250 } else if (mem_op == MEMOP_STORE_POSTINCR) {
251 bundle = addi_X1(bundle, addr_reg, addr_reg,
252 get_Dest_Imm8_X1(bundle));
254 /* Convert the X1 instruction to a nop. */
255 bundle &= ~(create_Opcode_X1(-1) |
256 create_UnShOpcodeExtension_X1(-1) |
257 create_UnOpcodeExtension_X1(-1));
258 bundle |= (create_Opcode_X1(SHUN_0_OPCODE_X1) |
259 create_UnShOpcodeExtension_X1(
260 UN_0_SHUN_0_OPCODE_X1) |
261 create_UnOpcodeExtension_X1(
262 NOP_UN_0_SHUN_0_OPCODE_X1));
269 * Called after execve() has started the new image. This allows us
270 * to reset the info state. Note that the the mmap'ed memory, if there
271 * was any, has already been unmapped by the exec.
273 void single_step_execve(void)
275 struct thread_info *ti = current_thread_info();
276 kfree(ti->step_state);
277 ti->step_state = NULL;
281 * single_step_once() - entry point when single stepping has been triggered.
282 * @regs: The machine register state
284 * When we arrive at this routine via a trampoline, the single step
285 * engine copies the executing bundle to the single step buffer.
286 * If the instruction is a condition branch, then the target is
287 * reset to one past the next instruction. If the instruction
288 * sets the lr, then that is noted. If the instruction is a jump
289 * or call, then the new target pc is preserved and the current
290 * bundle instruction set to null.
292 * The necessary post-single-step rewriting information is stored in
293 * single_step_state-> We use data segment values because the
294 * stack will be rewound when we run the rewritten single-stepped
297 void single_step_once(struct pt_regs *regs)
299 extern tile_bundle_bits __single_step_ill_insn;
300 extern tile_bundle_bits __single_step_j_insn;
301 extern tile_bundle_bits __single_step_addli_insn;
302 extern tile_bundle_bits __single_step_auli_insn;
303 struct thread_info *info = (void *)current_thread_info();
304 struct single_step_state *state = info->step_state;
305 int is_single_step = test_ti_thread_flag(info, TIF_SINGLESTEP);
306 tile_bundle_bits __user *buffer, *pc;
307 tile_bundle_bits bundle;
309 int target_reg = TREG_LR;
311 enum mem_op mem_op = MEMOP_NONE;
312 int size = 0, sign_ext = 0; /* happy compiler */
315 " .pushsection .rodata.single_step\n"
317 " .globl __single_step_ill_insn\n"
318 "__single_step_ill_insn:\n"
320 " .globl __single_step_addli_insn\n"
321 "__single_step_addli_insn:\n"
322 " { nop; addli r0, zero, 0 }\n"
323 " .globl __single_step_auli_insn\n"
324 "__single_step_auli_insn:\n"
325 " { nop; auli r0, r0, 0 }\n"
326 " .globl __single_step_j_insn\n"
327 "__single_step_j_insn:\n"
333 * Enable interrupts here to allow touching userspace and the like.
334 * The callers expect this: do_trap() already has interrupts
335 * enabled, and do_work_pending() handles functions that enable
336 * interrupts internally.
341 /* allocate a page of writable, executable memory */
342 state = kmalloc(sizeof(struct single_step_state), GFP_KERNEL);
344 pr_err("Out of kernel memory trying to single-step\n");
348 /* allocate a cache line of writable, executable memory */
349 down_write(¤t->mm->mmap_sem);
350 buffer = (void __user *) do_mmap(NULL, 0, 64,
351 PROT_EXEC | PROT_READ | PROT_WRITE,
352 MAP_PRIVATE | MAP_ANONYMOUS,
354 up_write(¤t->mm->mmap_sem);
356 if (IS_ERR((void __force *)buffer)) {
358 pr_err("Out of kernel pages trying to single-step\n");
362 state->buffer = buffer;
363 state->is_enabled = 0;
365 info->step_state = state;
367 /* Validate our stored instruction patterns */
368 BUG_ON(get_Opcode_X1(__single_step_addli_insn) !=
370 BUG_ON(get_Opcode_X1(__single_step_auli_insn) !=
372 BUG_ON(get_SrcA_X1(__single_step_addli_insn) != TREG_ZERO);
373 BUG_ON(get_Dest_X1(__single_step_addli_insn) != 0);
374 BUG_ON(get_JOffLong_X1(__single_step_j_insn) != 0);
378 * If we are returning from a syscall, we still haven't hit the
379 * "ill" for the swint1 instruction. So back the PC up to be
380 * pointing at the swint1, but we'll actually return directly
381 * back to the "ill" so we come back in via SIGILL as if we
382 * had "executed" the swint1 without ever being in kernel space.
384 if (regs->faultnum == INT_SWINT_1)
387 pc = (tile_bundle_bits __user *)(regs->pc);
388 if (get_user(bundle, pc) != 0) {
389 pr_err("Couldn't read instruction at %p trying to step\n", pc);
393 /* We'll follow the instruction with 2 ill op bundles */
394 state->orig_pc = (unsigned long)pc;
395 state->next_pc = (unsigned long)(pc + 1);
396 state->branch_next_pc = 0;
399 if (!(bundle & TILEPRO_BUNDLE_Y_ENCODING_MASK)) {
400 /* two wide, check for control flow */
401 int opcode = get_Opcode_X1(bundle);
405 case BRANCH_OPCODE_X1:
407 s32 offset = signExtend17(get_BrOff_X1(bundle));
410 * For branches, we use a rewriting trick to let the
411 * hardware evaluate whether the branch is taken or
412 * untaken. We record the target offset and then
413 * rewrite the branch instruction to target 1 insn
414 * ahead if the branch is taken. We then follow the
415 * rewritten branch with two bundles, each containing
416 * an "ill" instruction. The supervisor examines the
417 * pc after the single step code is executed, and if
418 * the pc is the first ill instruction, then the
419 * branch (if any) was not taken. If the pc is the
420 * second ill instruction, then the branch was
421 * taken. The new pc is computed for these cases, and
422 * inserted into the registers for the thread. If
423 * the pc is the start of the single step code, then
424 * an exception or interrupt was taken before the
425 * code started processing, and the same "original"
426 * pc is restored. This change, different from the
427 * original implementation, has the advantage of
428 * executing a single user instruction.
430 state->branch_next_pc = (unsigned long)(pc + offset);
432 /* rewrite branch offset to go forward one bundle */
433 bundle = set_BrOff_X1(bundle, 2);
442 (unsigned long) (pc + get_JOffLong_X1(bundle));
448 (unsigned long) (pc + get_JOffLong_X1(bundle));
449 bundle = nop_X1(bundle);
452 case SPECIAL_0_OPCODE_X1:
453 switch (get_RRROpcodeExtension_X1(bundle)) {
455 case JALRP_SPECIAL_0_OPCODE_X1:
456 case JALR_SPECIAL_0_OPCODE_X1:
459 regs->regs[get_SrcA_X1(bundle)];
462 case JRP_SPECIAL_0_OPCODE_X1:
463 case JR_SPECIAL_0_OPCODE_X1:
465 regs->regs[get_SrcA_X1(bundle)];
466 bundle = nop_X1(bundle);
469 case LNK_SPECIAL_0_OPCODE_X1:
471 target_reg = get_Dest_X1(bundle);
475 case SH_SPECIAL_0_OPCODE_X1:
476 mem_op = MEMOP_STORE;
480 case SW_SPECIAL_0_OPCODE_X1:
481 mem_op = MEMOP_STORE;
488 case SHUN_0_OPCODE_X1:
489 if (get_UnShOpcodeExtension_X1(bundle) ==
490 UN_0_SHUN_0_OPCODE_X1) {
491 switch (get_UnOpcodeExtension_X1(bundle)) {
492 case LH_UN_0_SHUN_0_OPCODE_X1:
498 case LH_U_UN_0_SHUN_0_OPCODE_X1:
504 case LW_UN_0_SHUN_0_OPCODE_X1:
509 case IRET_UN_0_SHUN_0_OPCODE_X1:
511 unsigned long ex0_0 = __insn_mfspr(
513 unsigned long ex0_1 = __insn_mfspr(
516 * Special-case it if we're iret'ing
517 * to PL0 again. Otherwise just let
518 * it run and it will generate SIGILL.
520 if (EX1_PL(ex0_1) == USER_PL) {
521 state->next_pc = ex0_0;
523 bundle = nop_X1(bundle);
531 /* postincrement operations */
532 case IMM_0_OPCODE_X1:
533 switch (get_ImmOpcodeExtension_X1(bundle)) {
534 case LWADD_IMM_0_OPCODE_X1:
535 mem_op = MEMOP_LOAD_POSTINCR;
539 case LHADD_IMM_0_OPCODE_X1:
540 mem_op = MEMOP_LOAD_POSTINCR;
545 case LHADD_U_IMM_0_OPCODE_X1:
546 mem_op = MEMOP_LOAD_POSTINCR;
551 case SWADD_IMM_0_OPCODE_X1:
552 mem_op = MEMOP_STORE_POSTINCR;
556 case SHADD_IMM_0_OPCODE_X1:
557 mem_op = MEMOP_STORE_POSTINCR;
565 #endif /* CHIP_HAS_WH64() */
570 * Get an available register. We start with a
571 * bitmask with 1's for available registers.
572 * We truncate to the low 32 registers since
573 * we are guaranteed to have set bits in the
574 * low 32 bits, then use ctz to pick the first.
576 u32 mask = (u32) ~((1ULL << get_Dest_X0(bundle)) |
577 (1ULL << get_SrcA_X0(bundle)) |
578 (1ULL << get_SrcB_X0(bundle)) |
579 (1ULL << target_reg));
580 temp_reg = __builtin_ctz(mask);
581 state->update_reg = temp_reg;
582 state->update_value = regs->regs[temp_reg];
583 regs->regs[temp_reg] = (unsigned long) (pc+1);
584 regs->flags |= PT_FLAGS_RESTORE_REGS;
585 bundle = move_X1(bundle, target_reg, temp_reg);
588 int opcode = get_Opcode_Y2(bundle);
611 mem_op = MEMOP_STORE;
616 mem_op = MEMOP_STORE;
623 * Check if we need to rewrite an unaligned load/store.
624 * Returning zero is a special value meaning we need to SIGSEGV.
626 if (mem_op != MEMOP_NONE && unaligned_fixup >= 0) {
627 bundle = rewrite_load_store_unaligned(state, bundle, regs,
628 mem_op, size, sign_ext);
633 /* write the bundle to our execution area */
634 buffer = state->buffer;
635 err = __put_user(bundle, buffer++);
638 * If we're really single-stepping, we take an INT_ILL after.
639 * If we're just handling an unaligned access, we can just
640 * jump directly back to where we were in user code.
642 if (is_single_step) {
643 err |= __put_user(__single_step_ill_insn, buffer++);
644 err |= __put_user(__single_step_ill_insn, buffer++);
649 /* We have some state to update; do it inline */
651 bundle = __single_step_addli_insn;
652 bundle |= create_Dest_X1(state->update_reg);
653 bundle |= create_Imm16_X1(state->update_value);
654 err |= __put_user(bundle, buffer++);
655 bundle = __single_step_auli_insn;
656 bundle |= create_Dest_X1(state->update_reg);
657 bundle |= create_SrcA_X1(state->update_reg);
658 ha16 = (state->update_value + 0x8000) >> 16;
659 bundle |= create_Imm16_X1(ha16);
660 err |= __put_user(bundle, buffer++);
664 /* End with a jump back to the next instruction */
665 delta = ((regs->pc + TILE_BUNDLE_SIZE_IN_BYTES) -
666 (unsigned long)buffer) >>
667 TILE_LOG2_BUNDLE_ALIGNMENT_IN_BYTES;
668 bundle = __single_step_j_insn;
669 bundle |= create_JOffLong_X1(delta);
670 err |= __put_user(bundle, buffer++);
674 pr_err("Fault when writing to single-step buffer\n");
680 * We do a local flush only, since this is a thread-specific buffer.
682 __flush_icache_range((unsigned long)state->buffer,
683 (unsigned long)buffer);
685 /* Indicate enabled */
686 state->is_enabled = is_single_step;
687 regs->pc = (unsigned long)state->buffer;
689 /* Fault immediately if we are coming back from a syscall. */
690 if (regs->faultnum == INT_SWINT_1)
695 #include <linux/smp.h>
696 #include <linux/ptrace.h>
697 #include <arch/spr_def.h>
699 static DEFINE_PER_CPU(unsigned long, ss_saved_pc);
703 * Called directly on the occasion of an interrupt.
705 * If the process doesn't have single step set, then we use this as an
706 * opportunity to turn single step off.
708 * It has been mentioned that we could conditionally turn off single stepping
709 * on each entry into the kernel and rely on single_step_once to turn it
710 * on for the processes that matter (as we already do), but this
711 * implementation is somewhat more efficient in that we muck with registers
712 * once on a bum interrupt rather than on every entry into the kernel.
714 * If SINGLE_STEP_CONTROL_K has CANCELED set, then an interrupt occurred,
715 * so we have to run through this process again before we can say that an
716 * instruction has executed.
718 * swint will set CANCELED, but it's a legitimate instruction. Fortunately
719 * it changes the PC. If it hasn't changed, then we know that the interrupt
720 * wasn't generated by swint and we'll need to run this process again before
721 * we can say an instruction has executed.
723 * If either CANCELED == 0 or the PC's changed, we send out SIGTRAPs and get
727 void gx_singlestep_handle(struct pt_regs *regs, int fault_num)
729 unsigned long *ss_pc = &__get_cpu_var(ss_saved_pc);
730 struct thread_info *info = (void *)current_thread_info();
731 int is_single_step = test_ti_thread_flag(info, TIF_SINGLESTEP);
732 unsigned long control = __insn_mfspr(SPR_SINGLE_STEP_CONTROL_K);
734 if (is_single_step == 0) {
735 __insn_mtspr(SPR_SINGLE_STEP_EN_K_K, 0);
737 } else if ((*ss_pc != regs->pc) ||
738 (!(control & SPR_SINGLE_STEP_CONTROL_1__CANCELED_MASK))) {
740 ptrace_notify(SIGTRAP);
741 control |= SPR_SINGLE_STEP_CONTROL_1__CANCELED_MASK;
742 control |= SPR_SINGLE_STEP_CONTROL_1__INHIBIT_MASK;
743 __insn_mtspr(SPR_SINGLE_STEP_CONTROL_K, control);
749 * Called from need_singlestep. Set up the control registers and the enable
750 * register, then return back.
753 void single_step_once(struct pt_regs *regs)
755 unsigned long *ss_pc = &__get_cpu_var(ss_saved_pc);
756 unsigned long control = __insn_mfspr(SPR_SINGLE_STEP_CONTROL_K);
759 control |= SPR_SINGLE_STEP_CONTROL_1__CANCELED_MASK;
760 control |= SPR_SINGLE_STEP_CONTROL_1__INHIBIT_MASK;
761 __insn_mtspr(SPR_SINGLE_STEP_CONTROL_K, control);
762 __insn_mtspr(SPR_SINGLE_STEP_EN_K_K, 1 << USER_PL);
765 void single_step_execve(void)
770 #endif /* !__tilegx__ */