4 * The contents of this file are subject to the terms of the
5 * Common Development and Distribution License (the "License").
6 * You may not use this file except in compliance with the License.
8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9 * or http://www.opensolaris.org/os/licensing.
10 * See the License for the specific language governing permissions
11 * and limitations under the License.
13 * When distributing Covered Code, include this CDDL HEADER in each
14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15 * If applicable, add the following below this CDDL HEADER, with the
16 * fields enclosed by brackets "[]" replaced with your own identifying
17 * information: Portions Copyright [yyyy] [name of copyright owner]
22 * Copyright (c) 2004, 2010, Oracle and/or its affiliates. All rights reserved.
23 * Copyright 2015 Joyent, Inc.
24 * Copyright (c) 2016 by Delphix. All rights reserved.
27 #include <sys/asm_linkage.h>
28 #include <sys/asm_misc.h>
29 #include <sys/regset.h>
30 #include <sys/privregs.h>
32 #include <sys/machbrand.h>
35 #include <sys/segments.h>
38 #include <sys/ftrace.h>
39 #include <sys/traptrace.h>
40 #include <sys/clock.h>
41 #include <sys/model.h>
42 #include <sys/panic.h>
49 * We implement five flavours of system call entry points
51 * - syscall/sysretq (amd64 generic)
52 * - syscall/sysretl (i386 plus SYSC bit)
53 * - sysenter/sysexit (i386 plus SEP bit)
54 * - int/iret (i386 generic)
55 * - lcall/iret (i386 generic)
57 * The current libc included in Solaris uses int/iret as the base unoptimized
58 * kernel entry method. Older libc implementations and legacy binaries may use
59 * the lcall call gate, so it must continue to be supported.
61 * System calls that use an lcall call gate are processed in trap() via a
62 * segment-not-present trap, i.e. lcalls are extremely slow(!).
64 * The basic pattern used in the 32-bit SYSC handler at this point in time is
65 * to have the bare minimum of assembler, and get to the C handlers as
66 * quickly as possible.
68 * The 64-bit handler is much closer to the sparcv9 handler; that's
69 * because of passing arguments in registers. The 32-bit world still
70 * passes arguments on the stack -- that makes that handler substantially
73 * The two handlers share a few code fragments which are broken
74 * out into preprocessor macros below.
76 * XX64 come back and speed all this up later. The 32-bit stuff looks
77 * especially easy to speed up the argument copying part ..
80 * Notes about segment register usage (c.f. the 32-bit kernel)
82 * In the 32-bit kernel, segment registers are dutifully saved and
83 * restored on all mode transitions because the kernel uses them directly.
84 * When the processor is running in 64-bit mode, segment registers are
88 * controlled by the hardware mechanisms that make mode transitions
90 * The remaining segment registers have to either be pointing at a valid
91 * descriptor i.e. with the 'present' bit set, or they can NULL descriptors
97 * fsbase and gsbase are used to control the place they really point at.
98 * The kernel only depends on %gs, and controls its own gsbase via swapgs
100 * Note that loading segment registers is still costly because the GDT
101 * lookup still happens (this is because the hardware can't know that we're
102 * not setting up these segment registers for a 32-bit program). Thus we
103 * avoid doing this in the syscall path, and defer them to lwp context switch
104 * handlers, so the register values remain virtualized to the lwp.
107 #if defined(SYSCALLTRACE)
108 #define ORL_SYSCALLTRACE(r32) \
109 orl syscalltrace
(%rip
), r32
111 #define ORL_SYSCALLTRACE(r32)
115 * In the 32-bit kernel, we do absolutely nothing before getting into the
116 * brand callback checks. In 64-bit land, we do swapgs and then come here.
117 * We assume that the %rsp- and %r15-stashing fields in the CPU structure
120 * Check if a brand_mach_ops callback is defined for the specified callback_id
121 * type. If so invoke it with the kernel's %gs value loaded and the following
124 * stack: --------------------------------------
125 * 32 | callback pointer |
126 * | 24 | user (or interrupt) stack pointer |
127 * | 16 | lwp pointer |
128 * v 8 | userland return address |
129 * 0 | callback wrapper return addr |
130 * --------------------------------------
132 * Since we're pushing the userland return address onto the kernel stack
133 * we need to get that address without accessing the user's stack (since we
134 * can't trust that data). There are different ways to get the userland
135 * return address depending on how the syscall trap was made:
137 * a) For sys_syscall and sys_syscall32 the return address is in %rcx.
138 * b) For sys_sysenter the return address is in %rdx.
139 * c) For sys_int80 and sys_syscall_int (int91), upon entry into the macro,
140 * the stack pointer points at the state saved when we took the interrupt:
141 * ------------------------
144 * | | EFLAGS register |
147 * ------------------------
149 * The 2nd parameter to the BRAND_CALLBACK macro is either the
150 * BRAND_URET_FROM_REG or BRAND_URET_FROM_INTR_STACK macro. These macros are
151 * used to generate the proper code to get the userland return address for
152 * each syscall entry point.
154 * The interface to the brand callbacks on the 64-bit kernel assumes %r15
155 * is available as a scratch register within the callback. If the callback
156 * returns within the kernel then this macro will restore %r15. If the
157 * callback is going to return directly to userland then it should restore
158 * %r15 before returning to userland.
160 #define BRAND_URET_FROM_REG(rip_reg) \
161 pushq rip_reg
/* push the return address */
164 * The interrupt stack pointer we saved on entry to the BRAND_CALLBACK macro
165 * is currently pointing at the user return address (%eip).
167 #define BRAND_URET_FROM_INTR_STACK() \
168 movq
%gs
:CPU_RTMP_RSP
, %r15 /* grab the intr. stack pointer */ ;\
169 pushq
(%r15) /* push the return address */
171 #define BRAND_CALLBACK(callback_id, push_userland_ret) \
172 movq
%rsp
, %gs
:CPU_RTMP_RSP
/* save the stack pointer */ ;\
173 movq
%r15, %gs
:CPU_RTMP_R15
/* save %r15 */ ;\
174 movq
%gs
:CPU_THREAD
, %r15 /* load the thread pointer */ ;\
175 movq T_STACK
(%r15), %rsp
/* switch to the kernel stack */ ;\
176 subq $
16, %rsp
/* save space for 2 pointers */ ;\
177 pushq
%r14 /* save %r14 */ ;\
178 movq
%gs
:CPU_RTMP_RSP
, %r14 ;\
179 movq
%r14, 8(%rsp
) /* stash the user stack pointer */ ;\
180 popq
%r14 /* restore %r14 */ ;\
181 movq T_LWP
(%r15), %r15 /* load the lwp pointer */ ;\
182 pushq
%r15 /* push the lwp pointer */ ;\
183 movq LWP_PROCP
(%r15), %r15 /* load the proc pointer */ ;\
184 movq P_BRAND
(%r15), %r15 /* load the brand pointer */ ;\
185 movq B_MACHOPS
(%r15), %r15 /* load the machops pointer */ ;\
186 movq _CONST
(_MUL
(callback_id
, CPTRSIZE
))(%r15), %r15 ;\
189 movq
%r15, 16(%rsp
) /* save the callback pointer */ ;\
190 push_userland_ret
/* push the return address */ ;\
191 call
*24(%rsp
) /* call callback */ ;\
192 1: movq
%gs
:CPU_RTMP_R15
, %r15 /* restore %r15 */ ;\
193 movq
%gs
:CPU_RTMP_RSP
, %rsp
/* restore the stack pointer */
195 #define MSTATE_TRANSITION(from, to) \
201 * Check to see if a simple (direct) return is possible i.e.
203 * if (t->t_post_sys_ast | syscalltrace |
204 * lwp->lwp_pcb.pcb_rupdate == 1)
210 * - condition code NE is set if post-sys is too complex
211 * - rtmp is zeroed if it isn't (we rely on this!)
214 #define CHECK_POSTSYS_NE(t, ltmp, rtmp) \
215 movq T_LWP
(t), ltmp; \
216 movzbl PCB_RUPDATE
(ltmp
), rtmp; \
217 ORL_SYSCALLTRACE
(rtmp
); \
218 orl T_POST_SYS_AST
(t), rtmp; \
222 * Fix up the lwp, thread, and eflags for a successful return
225 * - zwreg contains zero
227 #define SIMPLE_SYSCALL_POSTSYS(t, lwp, zwreg) \
228 movb $LWP_USER
, LWP_STATE
(lwp
); \
229 movw zwreg
, T_SYSNUM
(t); \
230 andb $_CONST
(0xffff - PS_C
), REGOFF_RFL
(%rsp
)
233 * ASSERT(lwptoregs(lwp) == rp);
235 * This may seem obvious, but very odd things happen if this
239 * (%rsp is ready for normal call sequence)
240 * Postconditions (if assertion is true):
243 * ASSERT(rp->r_cs == descnum)
245 * The code selector is written into the regs structure when the
246 * lwp stack is created. We use this ASSERT to validate that
247 * the regs structure really matches how we came in.
250 * (%rsp is ready for normal call sequence)
251 * Postconditions (if assertion is true):
254 * ASSERT(lwp->lwp_pcb.pcb_rupdate == 0);
256 * If this is false, it meant that we returned to userland without
257 * updating the segment registers as we were supposed to.
259 * Note that we must ensure no interrupts or other traps intervene
260 * between entering privileged mode and performing the assertion,
261 * otherwise we may perform a context switch on the thread, which
262 * will end up setting pcb_rupdate to 1 again.
268 .string "syscall_asm_amd64.s:%d lwptoregs(%p) [%p] != rp [%p]"
271 .string "syscall_asm_amd64.s:%d rp->r_cs [%ld] != %ld"
274 .string "syscall_asm_amd64.s:%d lwp %p, pcb_rupdate != 0"
277 #define ASSERT_LWPTOREGS(lwp, rp) \
278 movq LWP_REGS
(lwp
), %r11; \
281 leaq __lwptoregs_msg
(%rip
), %rdi; \
282 movl $__LINE__
, %esi; \
290 #define ASSERT_NO_RUPDATE_PENDING(lwp) \
291 testb $
0x1, PCB_RUPDATE
(lwp
); \
294 leaq __no_rupdate_msg
(%rip
), %rdi; \
295 movl $__LINE__
, %esi; \
301 #define ASSERT_LWPTOREGS(lwp, rp)
302 #define ASSERT_NO_RUPDATE_PENDING(lwp)
306 * Do the traptrace thing and restore any registers we used
307 * in situ. Assumes that %rsp is pointing at the base of
308 * the struct regs, obviously ..
311 #define SYSCALL_TRAPTRACE(ttype) \
312 TRACE_PTR
(%rdi
, %rbx
, %ebx
, %rcx
, ttype
); \
313 TRACE_REGS
(%rdi
, %rsp
, %rbx
, %rcx
); \
314 TRACE_STAMP
(%rdi
);
/* rdtsc clobbers %eax, %edx */ \
315 movq REGOFF_RAX
(%rsp
), %rax; \
316 movq REGOFF_RBX
(%rsp
), %rbx; \
317 movq REGOFF_RCX
(%rsp
), %rcx; \
318 movq REGOFF_RDX
(%rsp
), %rdx; \
319 movl
%eax
, TTR_SYSNUM
(%rdi
); \
320 movq REGOFF_RDI
(%rsp
), %rdi
322 #define SYSCALL_TRAPTRACE32(ttype) \
323 SYSCALL_TRAPTRACE
(ttype
); \
324 /* paranoia: clean the top 32-bits of the registers */ \
330 #else /* TRAPTRACE */
331 #define SYSCALL_TRAPTRACE(ttype)
332 #define SYSCALL_TRAPTRACE32(ttype)
333 #endif /* TRAPTRACE */
336 * The 64-bit libc syscall wrapper does this:
340 * movq %rcx, %r10 -- because syscall smashes %rcx
346 * Thus when we come into the kernel:
348 * %rdi, %rsi, %rdx, %r10, %r8, %r9 contain first six args
349 * %rax is the syscall number
350 * %r12-%r15 contain caller state
352 * The syscall instruction arranges that:
354 * %rcx contains the return %rip
355 * %r11d contains bottom 32-bits of %rflags
356 * %rflags is masked (as determined by the SFMASK msr)
357 * %cs is set to UCS_SEL (as determined by the STAR msr)
358 * %ss is set to UDS_SEL (as determined by the STAR msr)
359 * %rip is set to sys_syscall (as determined by the LSTAR msr)
361 * Or in other words, we have no registers available at all.
362 * Only swapgs can save us!
364 * Under the hypervisor, the swapgs has happened already. However, the
365 * state of the world is very different from that we're familiar with.
367 * In particular, we have a stack structure like that for interrupt
368 * gates, except that the %cs and %ss registers are modified for reasons
369 * that are not entirely clear. Critically, the %rcx/%r11 values do
370 * *not* reflect the usage of those registers under a 'real' syscall[1];
371 * the stack, therefore, looks like this:
373 * 0x0(rsp) potentially junk %rcx
374 * 0x8(rsp) potentially junk %r11
375 * 0x10(rsp) user %rip
376 * 0x18(rsp) modified %cs
377 * 0x20(rsp) user %rflags
378 * 0x28(rsp) user %rsp
379 * 0x30(rsp) modified %ss
382 * and before continuing on, we must load the %rip into %rcx and the
385 * [1] They used to, and we relied on it, but this was broken in 3.1.1.
388 #define XPV_SYSCALL_PROD /* nothing */
391 ENTRY_NP2
(brand_sys_syscall
,_allsyscalls
)
392 SWAPGS
/* kernel gsbase */
394 BRAND_CALLBACK
(BRAND_CB_SYSCALL
, BRAND_URET_FROM_REG
(%rcx
))
395 jmp noprod_sys_syscall
397 ALTENTRY
(sys_syscall
)
398 SWAPGS
/* kernel gsbase */
402 movq
%r15, %gs
:CPU_RTMP_R15
403 movq
%rsp
, %gs
:CPU_RTMP_RSP
405 movq
%gs
:CPU_THREAD
, %r15
406 movq T_STACK
(%r15), %rsp
/* switch from user to kernel stack */
408 ASSERT_UPCALL_MASK_IS_SET
410 movl $UCS_SEL
, REGOFF_CS
(%rsp
)
411 movq
%rcx
, REGOFF_RIP
(%rsp
) /* syscall: %rip -> %rcx */
412 movq
%r11, REGOFF_RFL
(%rsp
) /* syscall: %rfl -> %r11d */
413 movl $UDS_SEL
, REGOFF_SS
(%rsp
)
415 movl
%eax
, %eax
/* wrapper: sysc# -> %eax */
416 movq
%rdi
, REGOFF_RDI
(%rsp
)
417 movq
%rsi
, REGOFF_RSI
(%rsp
)
418 movq
%rdx
, REGOFF_RDX
(%rsp
)
419 movq
%r10, REGOFF_RCX
(%rsp
) /* wrapper: %rcx -> %r10 */
420 movq
%r10, %rcx
/* arg[3] for direct calls */
422 movq
%r8, REGOFF_R8
(%rsp
)
423 movq
%r9, REGOFF_R9
(%rsp
)
424 movq
%rax
, REGOFF_RAX
(%rsp
)
425 movq
%rbx
, REGOFF_RBX
(%rsp
)
427 movq
%rbp
, REGOFF_RBP
(%rsp
)
428 movq
%r10, REGOFF_R10
(%rsp
)
429 movq
%gs
:CPU_RTMP_RSP
, %r11
430 movq
%r11, REGOFF_RSP
(%rsp
)
431 movq
%r12, REGOFF_R12
(%rsp
)
433 movq
%r13, REGOFF_R13
(%rsp
)
434 movq
%r14, REGOFF_R14
(%rsp
)
435 movq
%gs
:CPU_RTMP_R15
, %r10
436 movq
%r10, REGOFF_R15
(%rsp
)
437 movq $
0, REGOFF_SAVFP
(%rsp
)
438 movq $
0, REGOFF_SAVPC
(%rsp
)
441 * Copy these registers here in case we end up stopped with
442 * someone (like, say, /proc) messing with our register state.
443 * We don't -restore- them unless we have to in update_sregs.
445 * Since userland -can't- change fsbase or gsbase directly,
446 * and capturing them involves two serializing instructions,
447 * we don't bother to capture them here.
451 movq
%rbx
, REGOFF_DS
(%rsp
)
453 movq
%rbx
, REGOFF_ES
(%rsp
)
455 movq
%rbx
, REGOFF_FS
(%rsp
)
457 movq
%rbx
, REGOFF_GS
(%rsp
)
460 * Machine state saved in the regs structure on the stack
461 * First six args in %rdi, %rsi, %rdx, %rcx, %r8, %r9
462 * %eax is the syscall number
463 * %rsp is the thread's stack, %r15 is curthread
464 * REG_RSP(%rsp) is the user's stack
467 SYSCALL_TRAPTRACE
($TT_SYSC64
)
471 movq T_LWP
(%r15), %r14
472 ASSERT_NO_RUPDATE_PENDING
(%r14)
475 MSTATE_TRANSITION
(LMS_USER
, LMS_SYSTEM
)
476 movl REGOFF_RAX
(%rsp
), %eax
/* (%rax damaged by mstate call) */
478 ASSERT_LWPTOREGS
(%r14, %rsp
)
480 movb $LWP_SYS
, LWP_STATE
(%r14)
481 incq LWP_RU_SYSC
(%r14)
482 movb $NORMALRETURN
, LWP_EOSYS
(%r14)
484 incq
%gs
:CPU_STATS_SYS_SYSCALL
486 movw
%ax
, T_SYSNUM
(%r15)
487 movzbl T_PRE_SYS
(%r15), %ebx
488 ORL_SYSCALLTRACE
(%ebx
)
493 movq REGOFF_RDI
(%rbp
), %rdi
494 movq REGOFF_RSI
(%rbp
), %rsi
495 movq REGOFF_RDX
(%rbp
), %rdx
496 movq REGOFF_RCX
(%rbp
), %rcx
497 movq REGOFF_R8
(%rbp
), %r8
498 movq REGOFF_R9
(%rbp
), %r9
502 shll $SYSENT_SIZE_SHIFT
, %eax
503 leaq sysent
(%rax
), %rbx
511 * If the handler returns two ints, then we need to split the
512 * 64-bit return value into two 32-bit values.
514 testw $SE_32RVAL2
, SY_FLAGS
(%rbx
)
517 shrq $
32, %r13 /* upper 32-bits into %edx */
518 movl
%r12d
, %r12d
/* lower 32-bits into %eax */
521 * Optimistically assume that there's no post-syscall
522 * work to do. (This is to avoid having to call syscall_mstate()
523 * with interrupts disabled)
525 MSTATE_TRANSITION
(LMS_SYSTEM
, LMS_USER
)
528 * We must protect ourselves from being descheduled here;
529 * If we were, and we ended up on another cpu, or another
530 * lwp got in ahead of us, it could change the segment
531 * registers without us noticing before we return to userland.
534 CHECK_POSTSYS_NE
(%r15, %r14, %ebx
)
538 * We need to protect ourselves against non-canonical return values
539 * because Intel doesn't check for them on sysret (AMD does). Canonical
540 * addresses on current amd64 processors only use 48-bits for VAs; an
541 * address is canonical if all upper bits (47-63) are identical. If we
542 * find a non-canonical %rip, we opt to go through the full
543 * _syscall_post path which takes us into an iretq which is not
544 * susceptible to the same problems sysret is.
546 * We're checking for a canonical address by first doing an arithmetic
547 * shift. This will fill in the remaining bits with the value of bit 63.
548 * If the address were canonical, the register would now have either all
549 * zeroes or all ones in it. Therefore we add one (inducing overflow)
550 * and compare against 1. A canonical address will either be zero or one
551 * at this point, hence the use of ja.
553 * At this point, r12 and r13 have the return value so we can't use
556 movq REGOFF_RIP
(%rsp
), %rcx
563 SIMPLE_SYSCALL_POSTSYS
(%r15, %r14, %bx
)
565 movq
%r12, REGOFF_RAX
(%rsp
)
566 movq
%r13, REGOFF_RDX
(%rsp
)
569 * To get back to userland, we need the return %rip in %rcx and
570 * the return %rfl in %r11d. The sysretq instruction also arranges
571 * to fix up %cs and %ss; everything else is our responsibility.
573 movq REGOFF_RDI
(%rsp
), %rdi
574 movq REGOFF_RSI
(%rsp
), %rsi
575 movq REGOFF_RDX
(%rsp
), %rdx
576 /* %rcx used to restore %rip value */
578 movq REGOFF_R8
(%rsp
), %r8
579 movq REGOFF_R9
(%rsp
), %r9
580 movq REGOFF_RAX
(%rsp
), %rax
581 movq REGOFF_RBX
(%rsp
), %rbx
583 movq REGOFF_RBP
(%rsp
), %rbp
584 movq REGOFF_R10
(%rsp
), %r10
585 /* %r11 used to restore %rfl value */
586 movq REGOFF_R12
(%rsp
), %r12
588 movq REGOFF_R13
(%rsp
), %r13
589 movq REGOFF_R14
(%rsp
), %r14
590 movq REGOFF_R15
(%rsp
), %r15
592 movq REGOFF_RIP
(%rsp
), %rcx
593 movl REGOFF_RFL
(%rsp
), %r11d
595 movq REGOFF_RSP
(%rsp
), %rsp
598 * There can be no instructions between the ALTENTRY below and
599 * SYSRET or we could end up breaking brand support. See label usage
600 * in sn1_brand_syscall_callback for an example.
602 ASSERT_UPCALL_MASK_IS_SET
603 ALTENTRY
(nopop_sys_syscall_swapgs_sysretq
)
604 SWAPGS
/* user gsbase */
607 SET_SIZE
(nopop_sys_syscall_swapgs_sysretq
)
613 jne _syscall_post_call
615 * Didn't abort, so reload the syscall args and invoke the handler.
617 movzwl T_SYSNUM
(%r15), %eax
624 jmp _syscall_post_call
629 * Sigh, our optimism wasn't justified, put it back to LMS_SYSTEM
630 * so that we can account for the extra work it takes us to finish.
632 MSTATE_TRANSITION
(LMS_USER
, LMS_SYSTEM
)
637 MSTATE_TRANSITION
(LMS_SYSTEM
, LMS_USER
)
639 SET_SIZE
(sys_syscall
)
640 SET_SIZE
(brand_sys_syscall
)
644 ENTRY_NP
(brand_sys_syscall32
)
645 SWAPGS
/* kernel gsbase */
647 BRAND_CALLBACK
(BRAND_CB_SYSCALL32
, BRAND_URET_FROM_REG
(%rcx
))
648 jmp nopop_sys_syscall32
650 ALTENTRY
(sys_syscall32
)
651 SWAPGS
/* kernel gsbase */
656 movq
%gs
:CPU_THREAD
, %r15
657 movq T_STACK
(%r15), %rsp
660 movl $U32CS_SEL
, REGOFF_CS
(%rsp
)
661 movl
%ecx
, REGOFF_RIP
(%rsp
) /* syscall: %rip -> %rcx */
662 movq
%r11, REGOFF_RFL
(%rsp
) /* syscall: %rfl -> %r11d */
663 movq
%r10, REGOFF_RSP
(%rsp
)
664 movl $UDS_SEL
, REGOFF_SS
(%rsp
)
667 movl
%edi
, REGOFF_RDI
(%rsp
)
668 movl
%esi
, REGOFF_RSI
(%rsp
)
669 movl
%ebp
, REGOFF_RBP
(%rsp
)
670 movl
%ebx
, REGOFF_RBX
(%rsp
)
671 movl
%edx
, REGOFF_RDX
(%rsp
)
672 movl
%ecx
, REGOFF_RCX
(%rsp
)
673 movl
%eax
, REGOFF_RAX
(%rsp
) /* wrapper: sysc# -> %eax */
674 movq $
0, REGOFF_SAVFP
(%rsp
)
675 movq $
0, REGOFF_SAVPC
(%rsp
)
678 * Copy these registers here in case we end up stopped with
679 * someone (like, say, /proc) messing with our register state.
680 * We don't -restore- them unless we have to in update_sregs.
682 * Since userland -can't- change fsbase or gsbase directly,
683 * we don't bother to capture them here.
687 movq
%rbx
, REGOFF_DS
(%rsp
)
689 movq
%rbx
, REGOFF_ES
(%rsp
)
691 movq
%rbx
, REGOFF_FS
(%rsp
)
693 movq
%rbx
, REGOFF_GS
(%rsp
)
696 * Application state saved in the regs structure on the stack
697 * %eax is the syscall number
698 * %rsp is the thread's stack, %r15 is curthread
699 * REG_RSP(%rsp) is the user's stack
702 SYSCALL_TRAPTRACE32
($TT_SYSC
)
706 movq T_LWP
(%r15), %r14
707 ASSERT_NO_RUPDATE_PENDING
(%r14)
711 MSTATE_TRANSITION
(LMS_USER
, LMS_SYSTEM
)
712 movl REGOFF_RAX
(%rsp
), %eax
/* (%rax damaged by mstate call) */
714 ASSERT_LWPTOREGS
(%r14, %rsp
)
716 incq
%gs
:CPU_STATS_SYS_SYSCALL
719 * Make some space for MAXSYSARGS (currently 8) 32-bit args placed
720 * into 64-bit (long) arg slots, maintaining 16 byte alignment. Or
723 * SA(MAXSYSARGS * sizeof (long)) == 64
725 #define SYS_DROP 64 /* drop for args */
727 movb $LWP_SYS
, LWP_STATE
(%r14)
733 * Fetch the arguments copied onto the kernel stack and put
734 * them in the right registers to invoke a C-style syscall handler.
735 * %rax contains the handler address.
737 * Ideas for making all this go faster of course include simply
738 * forcibly fetching 6 arguments from the user stack under lofault
739 * protection, reverting to copyin_args only when watchpoints
742 * (If we do this, make sure that exec and libthread leave
743 * enough space at the top of the stack to ensure that we'll
744 * never do a fetch from an invalid page.)
746 * Lots of ideas here, but they won't really help with bringup B-)
747 * Correctness can't wait, performance can wait a little longer ..
753 movl
0x10(%rsp
), %edx
754 movl
0x18(%rsp
), %ecx
755 movl
0x20(%rsp
), %r8d
756 movl
0x28(%rsp
), %r9d
760 movq
%rbp
, %rsp
/* pop the args */
763 * amd64 syscall handlers -always- return a 64-bit value in %rax.
764 * On the 32-bit kernel, they always return that value in %eax:%edx
765 * as required by the 32-bit ABI.
767 * Simulate the same behaviour by unconditionally splitting the
768 * return value in the same way.
771 shrq $
32, %r13 /* upper 32-bits into %edx */
772 movl
%eax
, %r12d
/* lower 32-bits into %eax */
775 * Optimistically assume that there's no post-syscall
776 * work to do. (This is to avoid having to call syscall_mstate()
777 * with interrupts disabled)
779 MSTATE_TRANSITION
(LMS_SYSTEM
, LMS_USER
)
782 * We must protect ourselves from being descheduled here;
783 * If we were, and we ended up on another cpu, or another
784 * lwp got in ahead of us, it could change the segment
785 * registers without us noticing before we return to userland.
788 CHECK_POSTSYS_NE
(%r15, %r14, %ebx
)
789 jne _full_syscall_postsys32
790 SIMPLE_SYSCALL_POSTSYS
(%r15, %r14, %bx
)
793 * To get back to userland, we need to put the return %rip in %rcx and
794 * the return %rfl in %r11d. The sysret instruction also arranges
795 * to fix up %cs and %ss; everything else is our responsibility.
798 movl
%r12d
, %eax
/* %eax: rval1 */
799 movl REGOFF_RBX
(%rsp
), %ebx
800 /* %ecx used for return pointer */
801 movl
%r13d
, %edx
/* %edx: rval2 */
802 movl REGOFF_RBP
(%rsp
), %ebp
803 movl REGOFF_RSI
(%rsp
), %esi
804 movl REGOFF_RDI
(%rsp
), %edi
806 movl REGOFF_RFL
(%rsp
), %r11d
/* %r11 -> eflags */
807 movl REGOFF_RIP
(%rsp
), %ecx
/* %ecx -> %eip */
808 movl REGOFF_RSP
(%rsp
), %esp
810 ASSERT_UPCALL_MASK_IS_SET
811 ALTENTRY
(nopop_sys_syscall32_swapgs_sysretl
)
812 SWAPGS
/* user gsbase */
814 SET_SIZE
(nopop_sys_syscall32_swapgs_sysretl
)
817 _full_syscall_postsys32
:
820 * Sigh, our optimism wasn't justified, put it back to LMS_SYSTEM
821 * so that we can account for the extra work it takes us to finish.
823 MSTATE_TRANSITION
(LMS_USER
, LMS_SYSTEM
)
825 movq
%r12, %rsi
/* rval1 - %eax */
826 movq
%r13, %rdx
/* rval2 - %edx */
828 MSTATE_TRANSITION
(LMS_SYSTEM
, LMS_USER
)
830 SET_SIZE
(sys_syscall32
)
831 SET_SIZE
(brand_sys_syscall32
)
835 * System call handler via the sysenter instruction
836 * Used only for 32-bit system calls on the 64-bit kernel.
838 * The caller in userland has arranged that:
840 * - %eax contains the syscall number
841 * - %ecx contains the user %esp
842 * - %edx contains the return %eip
843 * - the user stack contains the args to the syscall
845 * Hardware and (privileged) initialization code have arranged that by
846 * the time the sysenter instructions completes:
848 * - %rip is pointing to sys_sysenter (below).
849 * - %cs and %ss are set to kernel text and stack (data) selectors.
850 * - %rsp is pointing at the lwp's stack
851 * - interrupts have been disabled.
853 * Note that we are unable to return both "rvals" to userland with
854 * this call, as %edx is used by the sysexit instruction.
856 * One final complication in this routine is its interaction with
857 * single-stepping in a debugger. For most of the system call mechanisms,
858 * the CPU automatically clears the single-step flag before we enter the
859 * kernel. The sysenter mechanism does not clear the flag, so a user
860 * single-stepping through a libc routine may suddenly find themself
861 * single-stepping through the kernel. To detect this, kmdb compares the
862 * trap %pc to the [brand_]sys_enter addresses on each single-step trap.
863 * If it finds that we have single-stepped to a sysenter entry point, it
864 * explicitly clears the flag and executes the sys_sysenter routine.
866 * One final complication in this final complication is the fact that we
867 * have two different entry points for sysenter: brand_sys_sysenter and
868 * sys_sysenter. If we enter at brand_sys_sysenter and start single-stepping
869 * through the kernel with kmdb, we will eventually hit the instruction at
870 * sys_sysenter. kmdb cannot distinguish between that valid single-step
871 * and the undesirable one mentioned above. To avoid this situation, we
872 * simply add a jump over the instruction at sys_sysenter to make it
873 * impossible to single-step to it.
876 ENTRY_NP
(brand_sys_sysenter
)
877 SWAPGS
/* kernel gsbase */
878 ALTENTRY
(_brand_sys_sysenter_post_swapgs
)
879 BRAND_CALLBACK
(BRAND_CB_SYSENTER
, BRAND_URET_FROM_REG
(%rdx
))
881 * Jump over sys_sysenter to allow single-stepping as described
884 jmp _sys_sysenter_post_swapgs
886 ALTENTRY
(sys_sysenter
)
887 SWAPGS
/* kernel gsbase */
889 ALTENTRY
(_sys_sysenter_post_swapgs
)
890 movq
%gs
:CPU_THREAD
, %r15
892 movl $U32CS_SEL
, REGOFF_CS
(%rsp
)
893 movl
%ecx
, REGOFF_RSP
(%rsp
) /* wrapper: %esp -> %ecx */
894 movl
%edx
, REGOFF_RIP
(%rsp
) /* wrapper: %eip -> %edx */
897 movl $UDS_SEL
, REGOFF_SS
(%rsp
)
900 * Set the interrupt flag before storing the flags to the
901 * flags image on the stack so we can return to user with
902 * interrupts enabled if we return via sys_rtt_syscall32
905 movq
%r10, REGOFF_RFL
(%rsp
)
907 movl
%edi
, REGOFF_RDI
(%rsp
)
908 movl
%esi
, REGOFF_RSI
(%rsp
)
909 movl
%ebp
, REGOFF_RBP
(%rsp
)
910 movl
%ebx
, REGOFF_RBX
(%rsp
)
911 movl
%edx
, REGOFF_RDX
(%rsp
)
912 movl
%ecx
, REGOFF_RCX
(%rsp
)
913 movl
%eax
, REGOFF_RAX
(%rsp
) /* wrapper: sysc# -> %eax */
914 movq $
0, REGOFF_SAVFP
(%rsp
)
915 movq $
0, REGOFF_SAVPC
(%rsp
)
918 * Copy these registers here in case we end up stopped with
919 * someone (like, say, /proc) messing with our register state.
920 * We don't -restore- them unless we have to in update_sregs.
922 * Since userland -can't- change fsbase or gsbase directly,
923 * we don't bother to capture them here.
927 movq
%rbx
, REGOFF_DS
(%rsp
)
929 movq
%rbx
, REGOFF_ES
(%rsp
)
931 movq
%rbx
, REGOFF_FS
(%rsp
)
933 movq
%rbx
, REGOFF_GS
(%rsp
)
936 * Application state saved in the regs structure on the stack
937 * %eax is the syscall number
938 * %rsp is the thread's stack, %r15 is curthread
939 * REG_RSP(%rsp) is the user's stack
942 SYSCALL_TRAPTRACE
($TT_SYSENTER
)
946 movq T_LWP
(%r15), %r14
947 ASSERT_NO_RUPDATE_PENDING
(%r14)
952 * Catch 64-bit process trying to issue sysenter instruction
953 * on Nocona based systems.
955 movq LWP_PROCP
(%r14), %rax
956 cmpq $DATAMODEL_ILP32
, P_MODEL
(%rax
)
960 * For a non-32-bit process, simulate a #ud, since that's what
961 * native hardware does. The traptrace entry (above) will
962 * let you know what really happened.
964 movq $T_ILLINST
, REGOFF_TRAPNO
(%rsp
)
965 movq REGOFF_CS
(%rsp
), %rdi
966 movq
%rdi
, REGOFF_ERR
(%rsp
)
968 movq REGOFF_RIP
(%rsp
), %rsi
969 movl
%gs
:CPU_ID
, %edx
974 MSTATE_TRANSITION
(LMS_USER
, LMS_SYSTEM
)
975 movl REGOFF_RAX
(%rsp
), %eax
/* (%rax damaged by mstate calls) */
977 ASSERT_LWPTOREGS
(%r14, %rsp
)
979 incq
%gs
:CPU_STATS_SYS_SYSCALL
982 * Make some space for MAXSYSARGS (currently 8) 32-bit args
983 * placed into 64-bit (long) arg slots, plus one 64-bit
984 * (long) arg count, maintaining 16 byte alignment.
987 movb $LWP_SYS
, LWP_STATE
(%r14)
993 * Fetch the arguments copied onto the kernel stack and put
994 * them in the right registers to invoke a C-style syscall handler.
995 * %rax contains the handler address.
1000 movl
0x10(%rsp
), %edx
1001 movl
0x18(%rsp
), %ecx
1002 movl
0x20(%rsp
), %r8d
1003 movl
0x28(%rsp
), %r9d
1005 call
*SY_CALLC
(%rbx
)
1007 movq
%rbp
, %rsp
/* pop the args */
1010 * amd64 syscall handlers -always- return a 64-bit value in %rax.
1011 * On the 32-bit kernel, the always return that value in %eax:%edx
1012 * as required by the 32-bit ABI.
1014 * Simulate the same behaviour by unconditionally splitting the
1015 * return value in the same way.
1018 shrq $
32, %r13 /* upper 32-bits into %edx */
1019 movl
%eax
, %r12d
/* lower 32-bits into %eax */
1022 * Optimistically assume that there's no post-syscall
1023 * work to do. (This is to avoid having to call syscall_mstate()
1024 * with interrupts disabled)
1026 MSTATE_TRANSITION
(LMS_SYSTEM
, LMS_USER
)
1029 * We must protect ourselves from being descheduled here;
1030 * If we were, and we ended up on another cpu, or another
1031 * lwp got int ahead of us, it could change the segment
1032 * registers without us noticing before we return to userland.
1035 CHECK_POSTSYS_NE
(%r15, %r14, %ebx
)
1036 jne _full_syscall_postsys32
1037 SIMPLE_SYSCALL_POSTSYS
(%r15, %r14, %bx
)
1040 * To get back to userland, load up the 32-bit registers and
1041 * sysexit back where we came from.
1045 * Interrupts will be turned on by the 'sti' executed just before
1046 * sysexit. The following ensures that restoring the user's rflags
1047 * doesn't enable interrupts too soon.
1049 andq $_BITNOT
(PS_IE
), REGOFF_RFL
(%rsp
)
1052 * (There's no point in loading up %edx because the sysexit
1053 * mechanism smashes it.)
1056 movl REGOFF_RBX
(%rsp
), %ebx
1057 movl REGOFF_RBP
(%rsp
), %ebp
1058 movl REGOFF_RSI
(%rsp
), %esi
1059 movl REGOFF_RDI
(%rsp
), %edi
1061 movl REGOFF_RIP
(%rsp
), %edx
/* sysexit: %edx -> %eip */
1062 pushq REGOFF_RFL
(%rsp
)
1064 movl REGOFF_RSP
(%rsp
), %ecx
/* sysexit: %ecx -> %esp */
1065 ALTENTRY
(sys_sysenter_swapgs_sysexit
)
1069 SET_SIZE
(sys_sysenter_swapgs_sysexit
)
1070 SET_SIZE
(sys_sysenter
)
1071 SET_SIZE
(_sys_sysenter_post_swapgs
)
1072 SET_SIZE
(brand_sys_sysenter
)
1076 * This is the destination of the "int $T_SYSCALLINT" interrupt gate, used by
1077 * the generic i386 libc to do system calls. We do a small amount of setup
1078 * before jumping into the existing sys_syscall32 path.
1081 ENTRY_NP
(brand_sys_syscall_int
)
1082 SWAPGS
/* kernel gsbase */
1085 BRAND_CALLBACK
(BRAND_CB_INT91
, BRAND_URET_FROM_INTR_STACK
())
1086 jmp nopop_syscall_int
1088 ALTENTRY
(sys_syscall_int
)
1089 SWAPGS
/* kernel gsbase */
1094 movq
%gs
:CPU_THREAD
, %r15
1095 movq T_STACK
(%r15), %rsp
1098 * Set t_post_sys on this thread to force ourselves out via the slow
1099 * path. It might be possible at some later date to optimize this out
1100 * and use a faster return mechanism.
1102 movb $
1, T_POST_SYS
(%r15)
1106 * There should be no instructions between this label and SWAPGS/IRET
1107 * or we could end up breaking branded zone support. See the usage of
1108 * this label in lx_brand_int80_callback and sn1_brand_int91_callback
1111 ALTENTRY
(sys_sysint_swapgs_iret
)
1112 SWAPGS
/* user gsbase */
1115 SET_SIZE
(sys_sysint_swapgs_iret
)
1116 SET_SIZE
(sys_syscall_int
)
1117 SET_SIZE
(brand_sys_syscall_int
)
1120 * Legacy 32-bit applications and old libc implementations do lcalls;
1121 * we should never get here because the LDT entry containing the syscall
1122 * segment descriptor has the "segment present" bit cleared, which means
1123 * we end up processing those system calls in trap() via a not-present trap.
1125 * We do it this way because a call gate unhelpfully does -nothing- to the
1126 * interrupt flag bit, so an interrupt can run us just after the lcall
1127 * completes, but just before the swapgs takes effect. Thus the INTR_PUSH and
1128 * INTR_POP paths would have to be slightly more complex to dance around
1129 * this problem, and end up depending explicitly on the first
1130 * instruction of this handler being either swapgs or cli.
1134 ENTRY_NP
(sys_lcall32
)
1135 SWAPGS
/* kernel gsbase */
1139 leaq __lcall_panic_str
(%rip
), %rdi
1142 SET_SIZE
(sys_lcall32
)
1145 .string "sys_lcall32: shouldn't be here!"
1148 * Declare a uintptr_t which covers the entire pc range of syscall
1149 * handlers for the stack walkers that need this.
1152 .globl _allsyscalls_size
1153 .type _allsyscalls_size, @object
1155 .NWORD . - _allsyscalls
1156 SET_SIZE
(_allsyscalls_size
)
1160 * These are the thread context handlers for lwps using sysenter/sysexit.
1165 * setting this value to zero as we switch away causes the
1166 * stack-pointer-on-sysenter to be NULL, ensuring that we
1167 * don't silently corrupt another (preempted) thread stack
1168 * when running an lwp that (somehow) didn't get sep_restore'd
1173 movl $MSR_INTC_SEP_ESP
, %ecx
1179 * Update the kernel stack pointer as we resume onto this cpu.
1181 ENTRY_NP
(sep_restore
)
1185 movl $MSR_INTC_SEP_ESP
, %ecx
1188 SET_SIZE
(sep_restore
)