xref: /openbmc/linux/arch/openrisc/kernel/entry.S (revision d0e22329)
1/*
2 * OpenRISC entry.S
3 *
4 * Linux architectural port borrowing liberally from similar works of
5 * others.  All original copyrights apply as per the original source
6 * declaration.
7 *
8 * Modifications for the OpenRISC architecture:
9 * Copyright (C) 2003 Matjaz Breskvar <phoenix@bsemi.com>
10 * Copyright (C) 2005 Gyorgy Jeney <nog@bsemi.com>
11 * Copyright (C) 2010-2011 Jonas Bonn <jonas@southpole.se>
12 *
13 *      This program is free software; you can redistribute it and/or
14 *      modify it under the terms of the GNU General Public License
15 *      as published by the Free Software Foundation; either version
16 *      2 of the License, or (at your option) any later version.
17 */
18
19#include <linux/linkage.h>
20
21#include <asm/processor.h>
22#include <asm/unistd.h>
23#include <asm/thread_info.h>
24#include <asm/errno.h>
25#include <asm/spr_defs.h>
26#include <asm/page.h>
27#include <asm/mmu.h>
28#include <asm/pgtable.h>
29#include <asm/asm-offsets.h>
30
31#define DISABLE_INTERRUPTS(t1,t2)			\
32	l.mfspr t2,r0,SPR_SR				;\
33	l.movhi	t1,hi(~(SPR_SR_IEE|SPR_SR_TEE))		;\
34	l.ori	t1,t1,lo(~(SPR_SR_IEE|SPR_SR_TEE))	;\
35	l.and   t2,t2,t1				;\
36	l.mtspr r0,t2,SPR_SR
37
38#define ENABLE_INTERRUPTS(t1)				\
39	l.mfspr	t1,r0,SPR_SR				;\
40	l.ori	t1,t1,lo(SPR_SR_IEE|SPR_SR_TEE)		;\
41	l.mtspr	r0,t1,SPR_SR
42
43/* =========================================================[ macros ]=== */
44
45#ifdef CONFIG_TRACE_IRQFLAGS
46/*
47 * Trace irq on/off creating a stack frame.
48 */
49#define TRACE_IRQS_OP(trace_op)					\
50	l.sw 	-8(r1),r2	/* store frame pointer */		;\
51	l.sw	-4(r1),r9	/* store return address */		;\
52	l.addi	r2,r1,0		/* move sp to fp */			;\
53	l.jal	trace_op						;\
54	 l.addi	r1,r1,-8						;\
55	l.ori	r1,r2,0		/* restore sp */			;\
56	l.lwz	r9,-4(r1)	/* restore return address */		;\
57	l.lwz	r2,-8(r1)	/* restore fp */			;\
58/*
59 * Trace irq on/off and save registers we need that would otherwise be
60 * clobbered.
61 */
62#define TRACE_IRQS_SAVE(t1,trace_op)					\
63	l.sw	-12(r1),t1	/* save extra reg */			;\
64	l.sw 	-8(r1),r2	/* store frame pointer */		;\
65	l.sw	-4(r1),r9	/* store return address */		;\
66	l.addi	r2,r1,0		/* move sp to fp */			;\
67	l.jal	trace_op						;\
68	 l.addi	r1,r1,-12						;\
69	l.ori	r1,r2,0		/* restore sp */			;\
70	l.lwz	r9,-4(r1)	/* restore return address */		;\
71	l.lwz	r2,-8(r1)	/* restore fp */			;\
72	l.lwz	t1,-12(r1)	/* restore extra reg */
73
74#define TRACE_IRQS_OFF	TRACE_IRQS_OP(trace_hardirqs_off)
75#define TRACE_IRQS_ON	TRACE_IRQS_OP(trace_hardirqs_on)
76#define TRACE_IRQS_ON_SYSCALL						\
77	TRACE_IRQS_SAVE(r10,trace_hardirqs_on)				;\
78	l.lwz	r3,PT_GPR3(r1)						;\
79	l.lwz	r4,PT_GPR4(r1)						;\
80	l.lwz	r5,PT_GPR5(r1)						;\
81	l.lwz	r6,PT_GPR6(r1)						;\
82	l.lwz	r7,PT_GPR7(r1)						;\
83	l.lwz	r8,PT_GPR8(r1)						;\
84	l.lwz	r11,PT_GPR11(r1)
85#define TRACE_IRQS_OFF_ENTRY						\
86	l.lwz	r5,PT_SR(r1)						;\
87	l.andi	r3,r5,(SPR_SR_IEE|SPR_SR_TEE)				;\
88	l.sfeq	r5,r0		/* skip trace if irqs were already off */;\
89	l.bf	1f							;\
90	 l.nop								;\
91	TRACE_IRQS_SAVE(r4,trace_hardirqs_off)				;\
921:
93#else
94#define TRACE_IRQS_OFF
95#define TRACE_IRQS_ON
96#define TRACE_IRQS_OFF_ENTRY
97#define TRACE_IRQS_ON_SYSCALL
98#endif
99
100/*
101 * We need to disable interrupts at beginning of RESTORE_ALL
102 * since interrupt might come in after we've loaded EPC return address
103 * and overwrite EPC with address somewhere in RESTORE_ALL
104 * which is of course wrong!
105 */
106
107#define RESTORE_ALL						\
108	DISABLE_INTERRUPTS(r3,r4)				;\
109	l.lwz   r3,PT_PC(r1)					;\
110	l.mtspr r0,r3,SPR_EPCR_BASE				;\
111	l.lwz   r3,PT_SR(r1)					;\
112	l.mtspr r0,r3,SPR_ESR_BASE				;\
113	l.lwz   r2,PT_GPR2(r1)					;\
114	l.lwz   r3,PT_GPR3(r1)					;\
115	l.lwz   r4,PT_GPR4(r1)					;\
116	l.lwz   r5,PT_GPR5(r1)					;\
117	l.lwz   r6,PT_GPR6(r1)					;\
118	l.lwz   r7,PT_GPR7(r1)					;\
119	l.lwz   r8,PT_GPR8(r1)					;\
120	l.lwz   r9,PT_GPR9(r1)					;\
121	l.lwz   r10,PT_GPR10(r1)					;\
122	l.lwz   r11,PT_GPR11(r1)					;\
123	l.lwz   r12,PT_GPR12(r1)					;\
124	l.lwz   r13,PT_GPR13(r1)					;\
125	l.lwz   r14,PT_GPR14(r1)					;\
126	l.lwz   r15,PT_GPR15(r1)					;\
127	l.lwz   r16,PT_GPR16(r1)					;\
128	l.lwz   r17,PT_GPR17(r1)					;\
129	l.lwz   r18,PT_GPR18(r1)					;\
130	l.lwz   r19,PT_GPR19(r1)					;\
131	l.lwz   r20,PT_GPR20(r1)					;\
132	l.lwz   r21,PT_GPR21(r1)					;\
133	l.lwz   r22,PT_GPR22(r1)					;\
134	l.lwz   r23,PT_GPR23(r1)					;\
135	l.lwz   r24,PT_GPR24(r1)					;\
136	l.lwz   r25,PT_GPR25(r1)					;\
137	l.lwz   r26,PT_GPR26(r1)					;\
138	l.lwz   r27,PT_GPR27(r1)					;\
139	l.lwz   r28,PT_GPR28(r1)					;\
140	l.lwz   r29,PT_GPR29(r1)					;\
141	l.lwz   r30,PT_GPR30(r1)					;\
142	l.lwz   r31,PT_GPR31(r1)					;\
143	l.lwz   r1,PT_SP(r1)					;\
144	l.rfe
145
146
147#define EXCEPTION_ENTRY(handler)				\
148	.global	handler						;\
149handler:							;\
150	/* r1, EPCR, ESR a already saved */			;\
151	l.sw	PT_GPR2(r1),r2					;\
152	l.sw    PT_GPR3(r1),r3					;\
153	/* r4 already save */					;\
154	l.sw    PT_GPR5(r1),r5					;\
155	l.sw    PT_GPR6(r1),r6					;\
156	l.sw    PT_GPR7(r1),r7					;\
157	l.sw    PT_GPR8(r1),r8					;\
158	l.sw    PT_GPR9(r1),r9					;\
159	/* r10 already saved */					;\
160	l.sw    PT_GPR11(r1),r11					;\
161	/* r12 already saved */					;\
162	l.sw    PT_GPR13(r1),r13					;\
163	l.sw    PT_GPR14(r1),r14					;\
164	l.sw    PT_GPR15(r1),r15					;\
165	l.sw    PT_GPR16(r1),r16					;\
166	l.sw    PT_GPR17(r1),r17					;\
167	l.sw    PT_GPR18(r1),r18					;\
168	l.sw    PT_GPR19(r1),r19					;\
169	l.sw    PT_GPR20(r1),r20					;\
170	l.sw    PT_GPR21(r1),r21					;\
171	l.sw    PT_GPR22(r1),r22					;\
172	l.sw    PT_GPR23(r1),r23					;\
173	l.sw    PT_GPR24(r1),r24					;\
174	l.sw    PT_GPR25(r1),r25					;\
175	l.sw    PT_GPR26(r1),r26					;\
176	l.sw    PT_GPR27(r1),r27					;\
177	l.sw    PT_GPR28(r1),r28					;\
178	l.sw    PT_GPR29(r1),r29					;\
179	/* r30 already save */					;\
180/*        l.sw    PT_GPR30(r1),r30*/					;\
181	l.sw    PT_GPR31(r1),r31					;\
182	TRACE_IRQS_OFF_ENTRY						;\
183	/* Store -1 in orig_gpr11 for non-syscall exceptions */	;\
184	l.addi	r30,r0,-1					;\
185	l.sw	PT_ORIG_GPR11(r1),r30
186
187#define UNHANDLED_EXCEPTION(handler,vector)			\
188	.global	handler						;\
189handler:							;\
190	/* r1, EPCR, ESR already saved */			;\
191	l.sw    PT_GPR2(r1),r2					;\
192	l.sw    PT_GPR3(r1),r3					;\
193	l.sw    PT_GPR5(r1),r5					;\
194	l.sw    PT_GPR6(r1),r6					;\
195	l.sw    PT_GPR7(r1),r7					;\
196	l.sw    PT_GPR8(r1),r8					;\
197	l.sw    PT_GPR9(r1),r9					;\
198	/* r10 already saved */					;\
199	l.sw    PT_GPR11(r1),r11					;\
200	/* r12 already saved */					;\
201	l.sw    PT_GPR13(r1),r13					;\
202	l.sw    PT_GPR14(r1),r14					;\
203	l.sw    PT_GPR15(r1),r15					;\
204	l.sw    PT_GPR16(r1),r16					;\
205	l.sw    PT_GPR17(r1),r17					;\
206	l.sw    PT_GPR18(r1),r18					;\
207	l.sw    PT_GPR19(r1),r19					;\
208	l.sw    PT_GPR20(r1),r20					;\
209	l.sw    PT_GPR21(r1),r21					;\
210	l.sw    PT_GPR22(r1),r22					;\
211	l.sw    PT_GPR23(r1),r23					;\
212	l.sw    PT_GPR24(r1),r24					;\
213	l.sw    PT_GPR25(r1),r25					;\
214	l.sw    PT_GPR26(r1),r26					;\
215	l.sw    PT_GPR27(r1),r27					;\
216	l.sw    PT_GPR28(r1),r28					;\
217	l.sw    PT_GPR29(r1),r29					;\
218	/* r31 already saved */					;\
219	l.sw    PT_GPR30(r1),r30					;\
220/*        l.sw    PT_GPR31(r1),r31	*/				;\
221	/* Store -1 in orig_gpr11 for non-syscall exceptions */	;\
222	l.addi	r30,r0,-1					;\
223	l.sw	PT_ORIG_GPR11(r1),r30				;\
224	l.addi	r3,r1,0						;\
225	/* r4 is exception EA */				;\
226	l.addi	r5,r0,vector					;\
227	l.jal	unhandled_exception				;\
228	 l.nop							;\
229	l.j	_ret_from_exception				;\
230	 l.nop
231
232/* clobbers 'reg' */
233#define CLEAR_LWA_FLAG(reg)		\
234	l.movhi	reg,hi(lwa_flag)	;\
235	l.ori	reg,reg,lo(lwa_flag)	;\
236	l.sw	0(reg),r0
237/*
238 * NOTE: one should never assume that SPR_EPC, SPR_ESR, SPR_EEAR
239 *       contain the same values as when exception we're handling
240 *	 occured. in fact they never do. if you need them use
241 *	 values saved on stack (for SPR_EPC, SPR_ESR) or content
242 *       of r4 (for SPR_EEAR). for details look at EXCEPTION_HANDLE()
243 *       in 'arch/openrisc/kernel/head.S'
244 */
245
246/* =====================================================[ exceptions] === */
247
248/* ---[ 0x100: RESET exception ]----------------------------------------- */
249
250EXCEPTION_ENTRY(_tng_kernel_start)
251	l.jal	_start
252	 l.andi r0,r0,0
253
254/* ---[ 0x200: BUS exception ]------------------------------------------- */
255
256EXCEPTION_ENTRY(_bus_fault_handler)
257	CLEAR_LWA_FLAG(r3)
258	/* r4: EA of fault (set by EXCEPTION_HANDLE) */
259	l.jal   do_bus_fault
260	 l.addi  r3,r1,0 /* pt_regs */
261
262	l.j     _ret_from_exception
263	 l.nop
264
265/* ---[ 0x300: Data Page Fault exception ]------------------------------- */
266EXCEPTION_ENTRY(_dtlb_miss_page_fault_handler)
267	CLEAR_LWA_FLAG(r3)
268	l.and	r5,r5,r0
269	l.j	1f
270	 l.nop
271
272EXCEPTION_ENTRY(_data_page_fault_handler)
273	CLEAR_LWA_FLAG(r3)
274	/* set up parameters for do_page_fault */
275	l.ori	r5,r0,0x300		   // exception vector
2761:
277	l.addi  r3,r1,0                    // pt_regs
278	/* r4 set be EXCEPTION_HANDLE */   // effective address of fault
279
280#ifdef CONFIG_OPENRISC_NO_SPR_SR_DSX
281	l.lwz   r6,PT_PC(r3)               // address of an offending insn
282	l.lwz   r6,0(r6)                   // instruction that caused pf
283
284	l.srli  r6,r6,26                   // check opcode for jump insn
285	l.sfeqi r6,0                       // l.j
286	l.bf    8f
287	l.sfeqi r6,1                       // l.jal
288	l.bf    8f
289	l.sfeqi r6,3                       // l.bnf
290	l.bf    8f
291	l.sfeqi r6,4                       // l.bf
292	l.bf    8f
293	l.sfeqi r6,0x11                    // l.jr
294	l.bf    8f
295	l.sfeqi r6,0x12                    // l.jalr
296	l.bf    8f
297	 l.nop
298
299	l.j     9f
300	 l.nop
301
3028: // offending insn is in delay slot
303	l.lwz   r6,PT_PC(r3)               // address of an offending insn
304	l.addi  r6,r6,4
305	l.lwz   r6,0(r6)                   // instruction that caused pf
306	l.srli  r6,r6,26                   // get opcode
3079: // offending instruction opcode loaded in r6
308
309#else
310
311	l.mfspr r6,r0,SPR_SR               // SR
312	l.andi  r6,r6,SPR_SR_DSX           // check for delay slot exception
313	l.sfne  r6,r0                      // exception happened in delay slot
314	l.bnf   7f
315	 l.lwz  r6,PT_PC(r3)               // address of an offending insn
316
317	l.addi	r6,r6,4                    // offending insn is in delay slot
3187:
319	l.lwz   r6,0(r6)                   // instruction that caused pf
320	l.srli  r6,r6,26                   // check opcode for write access
321#endif
322
323	l.sfgeui r6,0x33                   // check opcode for write access
324	l.bnf   1f
325	l.sfleui r6,0x37
326	l.bnf   1f
327	l.ori   r6,r0,0x1                  // write access
328	l.j     2f
329	 l.nop
3301:	l.ori   r6,r0,0x0                  // !write access
3312:
332
333	/* call fault.c handler in or32/mm/fault.c */
334	l.jal   do_page_fault
335	 l.nop
336	l.j     _ret_from_exception
337	 l.nop
338
339/* ---[ 0x400: Insn Page Fault exception ]------------------------------- */
340EXCEPTION_ENTRY(_itlb_miss_page_fault_handler)
341	CLEAR_LWA_FLAG(r3)
342	l.and	r5,r5,r0
343	l.j	1f
344	 l.nop
345
346EXCEPTION_ENTRY(_insn_page_fault_handler)
347	CLEAR_LWA_FLAG(r3)
348	/* set up parameters for do_page_fault */
349	l.ori	r5,r0,0x400		   // exception vector
3501:
351	l.addi  r3,r1,0                    // pt_regs
352	/* r4 set be EXCEPTION_HANDLE */   // effective address of fault
353	l.ori	r6,r0,0x0		   // !write access
354
355	/* call fault.c handler in or32/mm/fault.c */
356	l.jal   do_page_fault
357	 l.nop
358	l.j     _ret_from_exception
359	 l.nop
360
361
362/* ---[ 0x500: Timer exception ]----------------------------------------- */
363
364EXCEPTION_ENTRY(_timer_handler)
365	CLEAR_LWA_FLAG(r3)
366	l.jal	timer_interrupt
367	 l.addi r3,r1,0 /* pt_regs */
368
369	l.j    _ret_from_intr
370	 l.nop
371
372/* ---[ 0x600: Alignment exception ]-------------------------------------- */
373
374EXCEPTION_ENTRY(_alignment_handler)
375	CLEAR_LWA_FLAG(r3)
376	/* r4: EA of fault (set by EXCEPTION_HANDLE) */
377	l.jal   do_unaligned_access
378	 l.addi  r3,r1,0 /* pt_regs */
379
380	l.j     _ret_from_exception
381	 l.nop
382
383#if 0
384EXCEPTION_ENTRY(_alignment_handler)
385//        l.mfspr r2,r0,SPR_EEAR_BASE     /* Load the effective address */
386	l.addi	r2,r4,0
387//        l.mfspr r5,r0,SPR_EPCR_BASE     /* Load the insn address */
388	l.lwz   r5,PT_PC(r1)
389
390	l.lwz   r3,0(r5)                /* Load insn */
391	l.srli  r4,r3,26                /* Shift left to get the insn opcode */
392
393	l.sfeqi r4,0x00                 /* Check if the load/store insn is in delay slot */
394	l.bf    jmp
395	l.sfeqi r4,0x01
396	l.bf    jmp
397	l.sfeqi r4,0x03
398	l.bf    jmp
399	l.sfeqi r4,0x04
400	l.bf    jmp
401	l.sfeqi r4,0x11
402	l.bf    jr
403	l.sfeqi r4,0x12
404	l.bf    jr
405	l.nop
406	l.j     1f
407	l.addi  r5,r5,4                 /* Increment PC to get return insn address */
408
409jmp:
410	l.slli  r4,r3,6                 /* Get the signed extended jump length */
411	l.srai  r4,r4,4
412
413	l.lwz   r3,4(r5)                /* Load the real load/store insn */
414
415	l.add   r5,r5,r4                /* Calculate jump target address */
416
417	l.j     1f
418	l.srli  r4,r3,26                /* Shift left to get the insn opcode */
419
420jr:
421	l.slli  r4,r3,9                 /* Shift to get the reg nb */
422	l.andi  r4,r4,0x7c
423
424	l.lwz   r3,4(r5)                /* Load the real load/store insn */
425
426	l.add   r4,r4,r1                /* Load the jump register value from the stack */
427	l.lwz   r5,0(r4)
428
429	l.srli  r4,r3,26                /* Shift left to get the insn opcode */
430
431
4321:
433//	  l.mtspr r0,r5,SPR_EPCR_BASE
434	l.sw	PT_PC(r1),r5
435
436	l.sfeqi r4,0x26
437	l.bf    lhs
438	l.sfeqi r4,0x25
439	l.bf    lhz
440	l.sfeqi r4,0x22
441	l.bf    lws
442	l.sfeqi r4,0x21
443	l.bf    lwz
444	l.sfeqi r4,0x37
445	l.bf    sh
446	l.sfeqi r4,0x35
447	l.bf    sw
448	l.nop
449
4501:      l.j     1b                      /* I don't know what to do */
451	l.nop
452
453lhs:    l.lbs   r5,0(r2)
454	l.slli  r5,r5,8
455	l.lbz   r6,1(r2)
456	l.or    r5,r5,r6
457	l.srli  r4,r3,19
458	l.andi  r4,r4,0x7c
459	l.add   r4,r4,r1
460	l.j     align_end
461	l.sw    0(r4),r5
462
463lhz:    l.lbz   r5,0(r2)
464	l.slli  r5,r5,8
465	l.lbz   r6,1(r2)
466	l.or    r5,r5,r6
467	l.srli  r4,r3,19
468	l.andi  r4,r4,0x7c
469	l.add   r4,r4,r1
470	l.j     align_end
471	l.sw    0(r4),r5
472
473lws:    l.lbs   r5,0(r2)
474	l.slli  r5,r5,24
475	l.lbz   r6,1(r2)
476	l.slli  r6,r6,16
477	l.or    r5,r5,r6
478	l.lbz   r6,2(r2)
479	l.slli  r6,r6,8
480	l.or    r5,r5,r6
481	l.lbz   r6,3(r2)
482	l.or    r5,r5,r6
483	l.srli  r4,r3,19
484	l.andi  r4,r4,0x7c
485	l.add   r4,r4,r1
486	l.j     align_end
487	l.sw    0(r4),r5
488
489lwz:    l.lbz   r5,0(r2)
490	l.slli  r5,r5,24
491	l.lbz   r6,1(r2)
492	l.slli  r6,r6,16
493	l.or    r5,r5,r6
494	l.lbz   r6,2(r2)
495	l.slli  r6,r6,8
496	l.or    r5,r5,r6
497	l.lbz   r6,3(r2)
498	l.or    r5,r5,r6
499	l.srli  r4,r3,19
500	l.andi  r4,r4,0x7c
501	l.add   r4,r4,r1
502	l.j     align_end
503	l.sw    0(r4),r5
504
505sh:
506	l.srli  r4,r3,9
507	l.andi  r4,r4,0x7c
508	l.add   r4,r4,r1
509	l.lwz   r5,0(r4)
510	l.sb    1(r2),r5
511	l.srli  r5,r5,8
512	l.j     align_end
513	l.sb    0(r2),r5
514
515sw:
516	l.srli  r4,r3,9
517	l.andi  r4,r4,0x7c
518	l.add   r4,r4,r1
519	l.lwz   r5,0(r4)
520	l.sb    3(r2),r5
521	l.srli  r5,r5,8
522	l.sb    2(r2),r5
523	l.srli  r5,r5,8
524	l.sb    1(r2),r5
525	l.srli  r5,r5,8
526	l.j     align_end
527	l.sb    0(r2),r5
528
529align_end:
530	l.j    _ret_from_intr
531	l.nop
532#endif
533
534/* ---[ 0x700: Illegal insn exception ]---------------------------------- */
535
536EXCEPTION_ENTRY(_illegal_instruction_handler)
537	/* r4: EA of fault (set by EXCEPTION_HANDLE) */
538	l.jal   do_illegal_instruction
539	 l.addi  r3,r1,0 /* pt_regs */
540
541	l.j     _ret_from_exception
542	 l.nop
543
544/* ---[ 0x800: External interrupt exception ]---------------------------- */
545
546EXCEPTION_ENTRY(_external_irq_handler)
547#ifdef CONFIG_OPENRISC_ESR_EXCEPTION_BUG_CHECK
548	l.lwz	r4,PT_SR(r1)		// were interrupts enabled ?
549	l.andi	r4,r4,SPR_SR_IEE
550	l.sfeqi	r4,0
551	l.bnf	1f			// ext irq enabled, all ok.
552	l.nop
553
554	l.addi  r1,r1,-0x8
555	l.movhi r3,hi(42f)
556	l.ori	r3,r3,lo(42f)
557	l.sw    0x0(r1),r3
558	l.jal   printk
559	l.sw    0x4(r1),r4
560	l.addi  r1,r1,0x8
561
562	.section .rodata, "a"
56342:
564		.string "\n\rESR interrupt bug: in _external_irq_handler (ESR %x)\n\r"
565		.align 4
566	.previous
567
568	l.ori	r4,r4,SPR_SR_IEE	// fix the bug
569//	l.sw	PT_SR(r1),r4
5701:
571#endif
572	CLEAR_LWA_FLAG(r3)
573	l.addi	r3,r1,0
574	l.movhi	r8,hi(do_IRQ)
575	l.ori	r8,r8,lo(do_IRQ)
576	l.jalr r8
577	l.nop
578	l.j    _ret_from_intr
579	l.nop
580
581/* ---[ 0x900: DTLB miss exception ]------------------------------------- */
582
583
584/* ---[ 0xa00: ITLB miss exception ]------------------------------------- */
585
586
587/* ---[ 0xb00: Range exception ]----------------------------------------- */
588
589UNHANDLED_EXCEPTION(_vector_0xb00,0xb00)
590
591/* ---[ 0xc00: Syscall exception ]--------------------------------------- */
592
593/*
594 * Syscalls are a special type of exception in that they are
595 * _explicitly_ invoked by userspace and can therefore be
596 * held to conform to the same ABI as normal functions with
597 * respect to whether registers are preserved across the call
598 * or not.
599 */
600
601/* Upon syscall entry we just save the callee-saved registers
602 * and not the call-clobbered ones.
603 */
604
605_string_syscall_return:
606	.string "syscall return %ld \n\r\0"
607	.align 4
608
609ENTRY(_sys_call_handler)
610	/* r1, EPCR, ESR a already saved */
611	l.sw	PT_GPR2(r1),r2
612	/* r3-r8 must be saved because syscall restart relies
613	 * on us being able to restart the syscall args... technically
614	 * they should be clobbered, otherwise
615	 */
616	l.sw    PT_GPR3(r1),r3
617	/*
618	 * r4 already saved
619	 * r4 holds the EEAR address of the fault, use it as screatch reg and
620	 * then load the original r4
621	 */
622	CLEAR_LWA_FLAG(r4)
623	l.lwz	r4,PT_GPR4(r1)
624	l.sw    PT_GPR5(r1),r5
625	l.sw    PT_GPR6(r1),r6
626	l.sw    PT_GPR7(r1),r7
627	l.sw    PT_GPR8(r1),r8
628	l.sw    PT_GPR9(r1),r9
629	/* r10 already saved */
630	l.sw    PT_GPR11(r1),r11
631	/* orig_gpr11 must be set for syscalls */
632	l.sw    PT_ORIG_GPR11(r1),r11
633	/* r12,r13 already saved */
634
635	/* r14-r28 (even) aren't touched by the syscall fast path below
636	 * so we don't need to save them.  However, the functions that return
637	 * to userspace via a call to switch() DO need to save these because
638	 * switch() effectively clobbers them... saving these registers for
639	 * such functions is handled in their syscall wrappers (see fork, vfork,
640	 * and clone, below).
641
642	/* r30 is the only register we clobber in the fast path */
643	/* r30 already saved */
644/*	l.sw    PT_GPR30(r1),r30 */
645
646_syscall_check_trace_enter:
647	/* syscalls run with interrupts enabled */
648	TRACE_IRQS_ON_SYSCALL
649	ENABLE_INTERRUPTS(r29)		// enable interrupts, r29 is temp
650
651	/* If TIF_SYSCALL_TRACE is set, then we want to do syscall tracing */
652	l.lwz	r30,TI_FLAGS(r10)
653	l.andi	r30,r30,_TIF_SYSCALL_TRACE
654	l.sfne	r30,r0
655	l.bf	_syscall_trace_enter
656	 l.nop
657
658_syscall_check:
659	/* Ensure that the syscall number is reasonable */
660	l.sfgeui r11,__NR_syscalls
661	l.bf	_syscall_badsys
662	 l.nop
663
664_syscall_call:
665	l.movhi r29,hi(sys_call_table)
666	l.ori   r29,r29,lo(sys_call_table)
667	l.slli  r11,r11,2
668	l.add   r29,r29,r11
669	l.lwz   r29,0(r29)
670
671	l.jalr  r29
672	 l.nop
673
674_syscall_return:
675	/* All syscalls return here... just pay attention to ret_from_fork
676	 * which does it in a round-about way.
677	 */
678	l.sw    PT_GPR11(r1),r11           // save return value
679
680#if 0
681_syscall_debug:
682	l.movhi r3,hi(_string_syscall_return)
683	l.ori   r3,r3,lo(_string_syscall_return)
684	l.ori   r27,r0,1
685	l.sw    -4(r1),r27
686	l.sw    -8(r1),r11
687	l.addi  r1,r1,-8
688	l.movhi r27,hi(printk)
689	l.ori   r27,r27,lo(printk)
690	l.jalr  r27
691	 l.nop
692	l.addi  r1,r1,8
693#endif
694
695_syscall_check_trace_leave:
696	/* r30 is a callee-saved register so this should still hold the
697	 * _TIF_SYSCALL_TRACE flag from _syscall_check_trace_enter above...
698	 * _syscall_trace_leave expects syscall result to be in pt_regs->r11.
699	 */
700	l.sfne	r30,r0
701	l.bf	_syscall_trace_leave
702	 l.nop
703
704/* This is where the exception-return code begins... interrupts need to be
705 * disabled the rest of the way here because we can't afford to miss any
706 * interrupts that set NEED_RESCHED or SIGNALPENDING... really true? */
707
708_syscall_check_work:
709	/* Here we need to disable interrupts */
710	DISABLE_INTERRUPTS(r27,r29)
711	TRACE_IRQS_OFF
712	l.lwz	r30,TI_FLAGS(r10)
713	l.andi	r30,r30,_TIF_WORK_MASK
714	l.sfne	r30,r0
715
716	l.bnf	_syscall_resume_userspace
717	 l.nop
718
719	/* Work pending follows a different return path, so we need to
720	 * make sure that all the call-saved registers get into pt_regs
721	 * before branching...
722	 */
723	l.sw    PT_GPR14(r1),r14
724	l.sw    PT_GPR16(r1),r16
725	l.sw    PT_GPR18(r1),r18
726	l.sw    PT_GPR20(r1),r20
727	l.sw    PT_GPR22(r1),r22
728	l.sw    PT_GPR24(r1),r24
729	l.sw    PT_GPR26(r1),r26
730	l.sw    PT_GPR28(r1),r28
731
732	/* _work_pending needs to be called with interrupts disabled */
733	l.j	_work_pending
734	 l.nop
735
736_syscall_resume_userspace:
737//	ENABLE_INTERRUPTS(r29)
738
739
740/* This is the hot path for returning to userspace from a syscall.  If there's
741 * work to be done and the branch to _work_pending was taken above, then the
742 * return to userspace will be done via the normal exception return path...
743 * that path restores _all_ registers and will overwrite the "clobbered"
744 * registers with whatever garbage is in pt_regs -- that's OK because those
745 * registers are clobbered anyway and because the extra work is insignificant
746 * in the context of the extra work that _work_pending is doing.
747
748/* Once again, syscalls are special and only guarantee to preserve the
749 * same registers as a normal function call */
750
751/* The assumption here is that the registers r14-r28 (even) are untouched and
752 * don't need to be restored... be sure that that's really the case!
753 */
754
755/* This is still too much... we should only be restoring what we actually
756 * clobbered... we should even be using 'scratch' (odd) regs above so that
757 * we don't need to restore anything, hardly...
758 */
759
760	l.lwz	r2,PT_GPR2(r1)
761
762	/* Restore args */
763	/* r3-r8 are technically clobbered, but syscall restart needs these
764	 * to be restored...
765	 */
766	l.lwz	r3,PT_GPR3(r1)
767	l.lwz	r4,PT_GPR4(r1)
768	l.lwz	r5,PT_GPR5(r1)
769	l.lwz	r6,PT_GPR6(r1)
770	l.lwz	r7,PT_GPR7(r1)
771	l.lwz	r8,PT_GPR8(r1)
772
773	l.lwz	r9,PT_GPR9(r1)
774	l.lwz	r10,PT_GPR10(r1)
775	l.lwz	r11,PT_GPR11(r1)
776
777	/* r30 is the only register we clobber in the fast path */
778	l.lwz	r30,PT_GPR30(r1)
779
780	/* Here we use r13-r19 (odd) as scratch regs */
781	l.lwz   r13,PT_PC(r1)
782	l.lwz   r15,PT_SR(r1)
783	l.lwz	r1,PT_SP(r1)
784	/* Interrupts need to be disabled for setting EPCR and ESR
785	 * so that another interrupt doesn't come in here and clobber
786	 * them before we can use them for our l.rfe */
787	DISABLE_INTERRUPTS(r17,r19)
788	l.mtspr r0,r13,SPR_EPCR_BASE
789	l.mtspr r0,r15,SPR_ESR_BASE
790	l.rfe
791
792/* End of hot path!
793 * Keep the below tracing and error handling out of the hot path...
794*/
795
796_syscall_trace_enter:
797	/* Here we pass pt_regs to do_syscall_trace_enter.  Make sure
798	 * that function is really getting all the info it needs as
799	 * pt_regs isn't a complete set of userspace regs, just the
800	 * ones relevant to the syscall...
801	 *
802	 * Note use of delay slot for setting argument.
803	 */
804	l.jal	do_syscall_trace_enter
805	 l.addi	r3,r1,0
806
807	/* Restore arguments (not preserved across do_syscall_trace_enter)
808	 * so that we can do the syscall for real and return to the syscall
809	 * hot path.
810	 */
811	l.lwz	r11,PT_GPR11(r1)
812	l.lwz	r3,PT_GPR3(r1)
813	l.lwz	r4,PT_GPR4(r1)
814	l.lwz	r5,PT_GPR5(r1)
815	l.lwz	r6,PT_GPR6(r1)
816	l.lwz	r7,PT_GPR7(r1)
817
818	l.j	_syscall_check
819	 l.lwz	r8,PT_GPR8(r1)
820
821_syscall_trace_leave:
822	l.jal	do_syscall_trace_leave
823	 l.addi	r3,r1,0
824
825	l.j	_syscall_check_work
826	 l.nop
827
828_syscall_badsys:
829	/* Here we effectively pretend to have executed an imaginary
830	 * syscall that returns -ENOSYS and then return to the regular
831	 * syscall hot path.
832	 * Note that "return value" is set in the delay slot...
833	 */
834	l.j	_syscall_return
835	 l.addi	r11,r0,-ENOSYS
836
837/******* END SYSCALL HANDLING *******/
838
839/* ---[ 0xd00: Trap exception ]------------------------------------------ */
840
841UNHANDLED_EXCEPTION(_vector_0xd00,0xd00)
842
843/* ---[ 0xe00: Trap exception ]------------------------------------------ */
844
845EXCEPTION_ENTRY(_trap_handler)
846	CLEAR_LWA_FLAG(r3)
847	/* r4: EA of fault (set by EXCEPTION_HANDLE) */
848	l.jal   do_trap
849	 l.addi  r3,r1,0 /* pt_regs */
850
851	l.j     _ret_from_exception
852	 l.nop
853
854/* ---[ 0xf00: Reserved exception ]-------------------------------------- */
855
856UNHANDLED_EXCEPTION(_vector_0xf00,0xf00)
857
858/* ---[ 0x1000: Reserved exception ]------------------------------------- */
859
860UNHANDLED_EXCEPTION(_vector_0x1000,0x1000)
861
862/* ---[ 0x1100: Reserved exception ]------------------------------------- */
863
864UNHANDLED_EXCEPTION(_vector_0x1100,0x1100)
865
866/* ---[ 0x1200: Reserved exception ]------------------------------------- */
867
868UNHANDLED_EXCEPTION(_vector_0x1200,0x1200)
869
870/* ---[ 0x1300: Reserved exception ]------------------------------------- */
871
872UNHANDLED_EXCEPTION(_vector_0x1300,0x1300)
873
874/* ---[ 0x1400: Reserved exception ]------------------------------------- */
875
876UNHANDLED_EXCEPTION(_vector_0x1400,0x1400)
877
878/* ---[ 0x1500: Reserved exception ]------------------------------------- */
879
880UNHANDLED_EXCEPTION(_vector_0x1500,0x1500)
881
882/* ---[ 0x1600: Reserved exception ]------------------------------------- */
883
884UNHANDLED_EXCEPTION(_vector_0x1600,0x1600)
885
886/* ---[ 0x1700: Reserved exception ]------------------------------------- */
887
888UNHANDLED_EXCEPTION(_vector_0x1700,0x1700)
889
890/* ---[ 0x1800: Reserved exception ]------------------------------------- */
891
892UNHANDLED_EXCEPTION(_vector_0x1800,0x1800)
893
894/* ---[ 0x1900: Reserved exception ]------------------------------------- */
895
896UNHANDLED_EXCEPTION(_vector_0x1900,0x1900)
897
898/* ---[ 0x1a00: Reserved exception ]------------------------------------- */
899
900UNHANDLED_EXCEPTION(_vector_0x1a00,0x1a00)
901
902/* ---[ 0x1b00: Reserved exception ]------------------------------------- */
903
904UNHANDLED_EXCEPTION(_vector_0x1b00,0x1b00)
905
906/* ---[ 0x1c00: Reserved exception ]------------------------------------- */
907
908UNHANDLED_EXCEPTION(_vector_0x1c00,0x1c00)
909
910/* ---[ 0x1d00: Reserved exception ]------------------------------------- */
911
912UNHANDLED_EXCEPTION(_vector_0x1d00,0x1d00)
913
914/* ---[ 0x1e00: Reserved exception ]------------------------------------- */
915
916UNHANDLED_EXCEPTION(_vector_0x1e00,0x1e00)
917
918/* ---[ 0x1f00: Reserved exception ]------------------------------------- */
919
920UNHANDLED_EXCEPTION(_vector_0x1f00,0x1f00)
921
922/* ========================================================[ return ] === */
923
924_resume_userspace:
925	DISABLE_INTERRUPTS(r3,r4)
926	TRACE_IRQS_OFF
927	l.lwz	r4,TI_FLAGS(r10)
928	l.andi	r13,r4,_TIF_WORK_MASK
929	l.sfeqi	r13,0
930	l.bf	_restore_all
931	 l.nop
932
933_work_pending:
934	l.lwz	r5,PT_ORIG_GPR11(r1)
935	l.sfltsi r5,0
936	l.bnf	1f
937	 l.nop
938	l.andi	r5,r5,0
9391:
940	l.jal	do_work_pending
941	 l.ori	r3,r1,0			/* pt_regs */
942
943	l.sfeqi	r11,0
944	l.bf	_restore_all
945	 l.nop
946	l.sfltsi r11,0
947	l.bnf	1f
948	 l.nop
949	l.and	r11,r11,r0
950	l.ori	r11,r11,__NR_restart_syscall
951	l.j	_syscall_check_trace_enter
952	 l.nop
9531:
954	l.lwz	r11,PT_ORIG_GPR11(r1)
955	/* Restore arg registers */
956	l.lwz	r3,PT_GPR3(r1)
957	l.lwz	r4,PT_GPR4(r1)
958	l.lwz	r5,PT_GPR5(r1)
959	l.lwz	r6,PT_GPR6(r1)
960	l.lwz	r7,PT_GPR7(r1)
961	l.j	_syscall_check_trace_enter
962	 l.lwz	r8,PT_GPR8(r1)
963
964_restore_all:
965#ifdef CONFIG_TRACE_IRQFLAGS
966	l.lwz	r4,PT_SR(r1)
967	l.andi	r3,r4,(SPR_SR_IEE|SPR_SR_TEE)
968	l.sfeq	r3,r0		/* skip trace if irqs were off */
969	l.bf	skip_hardirqs_on
970	 l.nop
971	TRACE_IRQS_ON
972skip_hardirqs_on:
973#endif
974	RESTORE_ALL
975	/* This returns to userspace code */
976
977
978ENTRY(_ret_from_intr)
979ENTRY(_ret_from_exception)
980	l.lwz	r4,PT_SR(r1)
981	l.andi	r3,r4,SPR_SR_SM
982	l.sfeqi	r3,0
983	l.bnf	_restore_all
984	 l.nop
985	l.j	_resume_userspace
986	 l.nop
987
988ENTRY(ret_from_fork)
989	l.jal	schedule_tail
990	 l.nop
991
992	/* Check if we are a kernel thread */
993	l.sfeqi	r20,0
994	l.bf	1f
995	 l.nop
996
997	/* ...we are a kernel thread so invoke the requested callback */
998	l.jalr	r20
999	 l.or	r3,r22,r0
1000
10011:
1002	/* _syscall_returns expect r11 to contain return value */
1003	l.lwz	r11,PT_GPR11(r1)
1004
1005	/* The syscall fast path return expects call-saved registers
1006	 * r12-r28 to be untouched, so we restore them here as they
1007	 * will have been effectively clobbered when arriving here
1008	 * via the call to switch()
1009	 */
1010	l.lwz	r12,PT_GPR12(r1)
1011	l.lwz	r14,PT_GPR14(r1)
1012	l.lwz	r16,PT_GPR16(r1)
1013	l.lwz	r18,PT_GPR18(r1)
1014	l.lwz	r20,PT_GPR20(r1)
1015	l.lwz	r22,PT_GPR22(r1)
1016	l.lwz	r24,PT_GPR24(r1)
1017	l.lwz	r26,PT_GPR26(r1)
1018	l.lwz	r28,PT_GPR28(r1)
1019
1020	l.j	_syscall_return
1021	 l.nop
1022
1023/* ========================================================[ switch ] === */
1024
1025/*
1026 * This routine switches between two different tasks.  The process
1027 * state of one is saved on its kernel stack.  Then the state
1028 * of the other is restored from its kernel stack.  The memory
1029 * management hardware is updated to the second process's state.
1030 * Finally, we can return to the second process, via the 'return'.
1031 *
1032 * Note: there are two ways to get to the "going out" portion
1033 * of this code; either by coming in via the entry (_switch)
1034 * or via "fork" which must set up an environment equivalent
1035 * to the "_switch" path.  If you change this (or in particular, the
1036 * SAVE_REGS macro), you'll have to change the fork code also.
1037 */
1038
1039
1040/* _switch MUST never lay on page boundry, cause it runs from
1041 * effective addresses and beeing interrupted by iTLB miss would kill it.
1042 * dTLB miss seams to never accour in the bad place since data accesses
1043 * are from task structures which are always page aligned.
1044 *
1045 * The problem happens in RESTORE_ALL_NO_R11 where we first set the EPCR
1046 * register, then load the previous register values and only at the end call
1047 * the l.rfe instruction. If get TLB miss in beetwen the EPCR register gets
1048 * garbled and we end up calling l.rfe with the wrong EPCR. (same probably
1049 * holds for ESR)
1050 *
1051 * To avoid this problems it is sufficient to align _switch to
1052 * some nice round number smaller than it's size...
1053 */
1054
1055/* ABI rules apply here... we either enter _switch via schedule() or via
1056 * an imaginary call to which we shall return at return_from_fork.  Either
1057 * way, we are a function call and only need to preserve the callee-saved
1058 * registers when we return.  As such, we don't need to save the registers
1059 * on the stack that we won't be returning as they were...
1060 */
1061
1062	.align 0x400
1063ENTRY(_switch)
1064	/* We don't store SR as _switch only gets called in a context where
1065	 * the SR will be the same going in and coming out... */
1066
1067	/* Set up new pt_regs struct for saving task state */
1068	l.addi  r1,r1,-(INT_FRAME_SIZE)
1069
1070	/* No need to store r1/PT_SP as it goes into KSP below */
1071	l.sw    PT_GPR2(r1),r2
1072	l.sw    PT_GPR9(r1),r9
1073	/* This is wrong, r12 shouldn't be here... but GCC is broken for the time being
1074	 * and expects r12 to be callee-saved... */
1075	l.sw    PT_GPR12(r1),r12
1076	l.sw    PT_GPR14(r1),r14
1077	l.sw    PT_GPR16(r1),r16
1078	l.sw    PT_GPR18(r1),r18
1079	l.sw    PT_GPR20(r1),r20
1080	l.sw    PT_GPR22(r1),r22
1081	l.sw    PT_GPR24(r1),r24
1082	l.sw    PT_GPR26(r1),r26
1083	l.sw    PT_GPR28(r1),r28
1084	l.sw    PT_GPR30(r1),r30
1085
1086	l.addi	r11,r10,0			/* Save old 'current' to 'last' return value*/
1087
1088	/* We use thread_info->ksp for storing the address of the above
1089	 * structure so that we can get back to it later... we don't want
1090	 * to lose the value of thread_info->ksp, though, so store it as
1091	 * pt_regs->sp so that we can easily restore it when we are made
1092	 * live again...
1093	 */
1094
1095	/* Save the old value of thread_info->ksp as pt_regs->sp */
1096	l.lwz	r29,TI_KSP(r10)
1097	l.sw	PT_SP(r1),r29
1098
1099	/* Swap kernel stack pointers */
1100	l.sw    TI_KSP(r10),r1			/* Save old stack pointer */
1101	l.or	r10,r4,r0			/* Set up new current_thread_info */
1102	l.lwz   r1,TI_KSP(r10)			/* Load new stack pointer */
1103
1104	/* Restore the old value of thread_info->ksp */
1105	l.lwz	r29,PT_SP(r1)
1106	l.sw	TI_KSP(r10),r29
1107
1108	/* ...and restore the registers, except r11 because the return value
1109	 * has already been set above.
1110	 */
1111	l.lwz   r2,PT_GPR2(r1)
1112	l.lwz   r9,PT_GPR9(r1)
1113	/* No need to restore r10 */
1114	/* ...and do not restore r11 */
1115
1116	/* This is wrong, r12 shouldn't be here... but GCC is broken for the time being
1117	 * and expects r12 to be callee-saved... */
1118	l.lwz   r12,PT_GPR12(r1)
1119	l.lwz   r14,PT_GPR14(r1)
1120	l.lwz   r16,PT_GPR16(r1)
1121	l.lwz   r18,PT_GPR18(r1)
1122	l.lwz   r20,PT_GPR20(r1)
1123	l.lwz   r22,PT_GPR22(r1)
1124	l.lwz   r24,PT_GPR24(r1)
1125	l.lwz   r26,PT_GPR26(r1)
1126	l.lwz   r28,PT_GPR28(r1)
1127	l.lwz   r30,PT_GPR30(r1)
1128
1129	/* Unwind stack to pre-switch state */
1130	l.addi  r1,r1,(INT_FRAME_SIZE)
1131
1132	/* Return via the link-register back to where we 'came from', where
1133	 * that may be either schedule(), ret_from_fork(), or
1134	 * ret_from_kernel_thread().  If we are returning to a new thread,
1135	 * we are expected to have set up the arg to schedule_tail already,
1136	 * hence we do so here unconditionally:
1137	 */
1138	l.lwz   r3,TI_TASK(r3)		/* Load 'prev' as schedule_tail arg */
1139	l.jr	r9
1140	 l.nop
1141
1142/* ==================================================================== */
1143
1144/* These all use the delay slot for setting the argument register, so the
1145 * jump is always happening after the l.addi instruction.
1146 *
1147 * These are all just wrappers that don't touch the link-register r9, so the
1148 * return from the "real" syscall function will return back to the syscall
1149 * code that did the l.jal that brought us here.
1150 */
1151
1152/* fork requires that we save all the callee-saved registers because they
1153 * are all effectively clobbered by the call to _switch.  Here we store
1154 * all the registers that aren't touched by the syscall fast path and thus
1155 * weren't saved there.
1156 */
1157
1158_fork_save_extra_regs_and_call:
1159	l.sw    PT_GPR14(r1),r14
1160	l.sw    PT_GPR16(r1),r16
1161	l.sw    PT_GPR18(r1),r18
1162	l.sw    PT_GPR20(r1),r20
1163	l.sw    PT_GPR22(r1),r22
1164	l.sw    PT_GPR24(r1),r24
1165	l.sw    PT_GPR26(r1),r26
1166	l.jr	r29
1167	 l.sw    PT_GPR28(r1),r28
1168
1169ENTRY(__sys_clone)
1170	l.movhi	r29,hi(sys_clone)
1171	l.ori	r29,r29,lo(sys_clone)
1172	l.j	_fork_save_extra_regs_and_call
1173	 l.addi	r7,r1,0
1174
1175ENTRY(__sys_fork)
1176	l.movhi	r29,hi(sys_fork)
1177	l.ori	r29,r29,lo(sys_fork)
1178	l.j	_fork_save_extra_regs_and_call
1179	 l.addi	r3,r1,0
1180
1181ENTRY(sys_rt_sigreturn)
1182	l.jal	_sys_rt_sigreturn
1183	 l.addi	r3,r1,0
1184	l.sfne	r30,r0
1185	l.bnf	_no_syscall_trace
1186	 l.nop
1187	l.jal	do_syscall_trace_leave
1188	 l.addi	r3,r1,0
1189_no_syscall_trace:
1190	l.j	_resume_userspace
1191	 l.nop
1192
1193/* This is a catch-all syscall for atomic instructions for the OpenRISC 1000.
1194 * The functions takes a variable number of parameters depending on which
1195 * particular flavour of atomic you want... parameter 1 is a flag identifying
1196 * the atomic in question.  Currently, this function implements the
1197 * following variants:
1198 *
1199 * XCHG:
1200 *  @flag: 1
1201 *  @ptr1:
1202 *  @ptr2:
1203 * Atomically exchange the values in pointers 1 and 2.
1204 *
1205 */
1206
1207ENTRY(sys_or1k_atomic)
1208	/* FIXME: This ignores r3 and always does an XCHG */
1209	DISABLE_INTERRUPTS(r17,r19)
1210	l.lwz	r29,0(r4)
1211	l.lwz	r27,0(r5)
1212	l.sw	0(r4),r27
1213	l.sw	0(r5),r29
1214	ENABLE_INTERRUPTS(r17)
1215	l.jr	r9
1216	 l.or	r11,r0,r0
1217
1218/* ============================================================[ EOF ]=== */
1219