kernel - Fix some rare pmap races in i386 and x86_64.
[dragonfly.git] / sys / platform / pc32 / i386 / swtch.s
blob91a66e09327920cc7fda48704d9de69d058e7765
1 /*
2 * Copyright (c) 2003,2004 The DragonFly Project. All rights reserved.
3 *
4 * This code is derived from software contributed to The DragonFly Project
5 * by Matthew Dillon <dillon@backplane.com>
6 *
7 * Redistribution and use in source and binary forms, with or without
8 * modification, are permitted provided that the following conditions
9 * are met:
11 * 1. Redistributions of source code must retain the above copyright
12 * notice, this list of conditions and the following disclaimer.
13 * 2. Redistributions in binary form must reproduce the above copyright
14 * notice, this list of conditions and the following disclaimer in
15 * the documentation and/or other materials provided with the
16 * distribution.
17 * 3. Neither the name of The DragonFly Project nor the names of its
18 * contributors may be used to endorse or promote products derived
19 * from this software without specific, prior written permission.
21 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
22 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
23 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
24 * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
25 * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
26 * INCIDENTAL, SPECIAL, EXEMPLARY OR CONSEQUENTIAL DAMAGES (INCLUDING,
27 * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
28 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
29 * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
30 * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
31 * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
32 * SUCH DAMAGE.
34 * Copyright (c) 1990 The Regents of the University of California.
35 * All rights reserved.
37 * This code is derived from software contributed to Berkeley by
38 * William Jolitz.
40 * Redistribution and use in source and binary forms, with or without
41 * modification, are permitted provided that the following conditions
42 * are met:
43 * 1. Redistributions of source code must retain the above copyright
44 * notice, this list of conditions and the following disclaimer.
45 * 2. Redistributions in binary form must reproduce the above copyright
46 * notice, this list of conditions and the following disclaimer in the
47 * documentation and/or other materials provided with the distribution.
48 * 3. All advertising materials mentioning features or use of this software
49 * must display the following acknowledgement:
50 * This product includes software developed by the University of
51 * California, Berkeley and its contributors.
52 * 4. Neither the name of the University nor the names of its contributors
53 * may be used to endorse or promote products derived from this software
54 * without specific prior written permission.
56 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
57 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
58 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
59 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
60 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
61 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
62 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
63 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
64 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
65 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
66 * SUCH DAMAGE.
68 * $FreeBSD: src/sys/i386/i386/swtch.s,v 1.89.2.10 2003/01/23 03:36:24 ps Exp $
69 * $DragonFly: src/sys/platform/pc32/i386/swtch.s,v 1.47 2007/06/29 21:54:10 dillon Exp $
72 #include "use_npx.h"
74 #include <sys/rtprio.h>
76 #include <machine/asmacros.h>
77 #include <machine/segments.h>
79 #include <machine/pmap.h>
80 #include <machine_base/apic/apicreg.h>
81 #include <machine/lock.h>
83 #include "assym.s"
85 #if defined(SMP)
86 #define MPLOCKED lock ;
87 #else
88 #define MPLOCKED
89 #endif
91 .data
93 .globl panic
95 #if defined(SWTCH_OPTIM_STATS)
96 .globl swtch_optim_stats, tlb_flush_count
97 swtch_optim_stats: .long 0 /* number of _swtch_optims */
98 tlb_flush_count: .long 0
99 #endif
101 .text
105 * cpu_heavy_switch(next_thread)
107 * Switch from the current thread to a new thread. This entry
108 * is normally called via the thread->td_switch function, and will
109 * only be called when the current thread is a heavy weight process.
111 * Some instructions have been reordered to reduce pipeline stalls.
113 * YYY disable interrupts once giant is removed.
115 ENTRY(cpu_heavy_switch)
117 * Save general regs
119 movl PCPU(curthread),%ecx
120 movl (%esp),%eax /* (reorder optimization) */
121 movl TD_PCB(%ecx),%edx /* EDX = PCB */
122 movl %eax,PCB_EIP(%edx) /* return PC may be modified */
123 movl %ebx,PCB_EBX(%edx)
124 movl %esp,PCB_ESP(%edx)
125 movl %ebp,PCB_EBP(%edx)
126 movl %esi,PCB_ESI(%edx)
127 movl %edi,PCB_EDI(%edx)
129 movl %ecx,%ebx /* EBX = curthread */
130 movl TD_LWP(%ecx),%ecx
131 movl PCPU(cpuid), %eax
132 movl LWP_VMSPACE(%ecx), %ecx /* ECX = vmspace */
133 MPLOCKED btrl %eax, VM_PMAP+PM_ACTIVE(%ecx)
136 * Push the LWKT switch restore function, which resumes a heavy
137 * weight process. Note that the LWKT switcher is based on
138 * TD_SP, while the heavy weight process switcher is based on
139 * PCB_ESP. TD_SP is usually two ints pushed relative to
140 * PCB_ESP. We push the flags for later restore by cpu_heavy_restore.
142 pushfl
143 pushl $cpu_heavy_restore
144 movl %esp,TD_SP(%ebx)
147 * Save debug regs if necessary
149 movb PCB_FLAGS(%edx),%al
150 andb $PCB_DBREGS,%al
151 jz 1f /* no, skip over */
152 movl %dr7,%eax /* yes, do the save */
153 movl %eax,PCB_DR7(%edx)
154 andl $0x0000fc00, %eax /* disable all watchpoints */
155 movl %eax,%dr7
156 movl %dr6,%eax
157 movl %eax,PCB_DR6(%edx)
158 movl %dr3,%eax
159 movl %eax,PCB_DR3(%edx)
160 movl %dr2,%eax
161 movl %eax,PCB_DR2(%edx)
162 movl %dr1,%eax
163 movl %eax,PCB_DR1(%edx)
164 movl %dr0,%eax
165 movl %eax,PCB_DR0(%edx)
168 #if NNPX > 0
170 * Save the FP state if we have used the FP. Note that calling
171 * npxsave will NULL out PCPU(npxthread).
173 cmpl %ebx,PCPU(npxthread)
174 jne 1f
175 pushl TD_SAVEFPU(%ebx)
176 call npxsave /* do it in a big C function */
177 addl $4,%esp /* EAX, ECX, EDX trashed */
179 #endif /* NNPX > 0 */
182 * Switch to the next thread, which was passed as an argument
183 * to cpu_heavy_switch(). Due to the eflags and switch-restore
184 * function we pushed, the argument is at 12(%esp). Set the current
185 * thread, load the stack pointer, and 'ret' into the switch-restore
186 * function.
188 * The switch restore function expects the new thread to be in %eax
189 * and the old one to be in %ebx.
191 * There is a one-instruction window where curthread is the new
192 * thread but %esp still points to the old thread's stack, but
193 * we are protected by a critical section so it is ok.
195 movl 12(%esp),%eax /* EAX = newtd, EBX = oldtd */
196 movl %eax,PCPU(curthread)
197 movl TD_SP(%eax),%esp
201 * cpu_exit_switch()
203 * The switch function is changed to this when a thread is going away
204 * for good. We have to ensure that the MMU state is not cached, and
205 * we don't bother saving the existing thread state before switching.
207 * At this point we are in a critical section and this cpu owns the
208 * thread's token, which serves as an interlock until the switchout is
209 * complete.
211 ENTRY(cpu_exit_switch)
213 * Get us out of the vmspace
215 movl IdlePTD,%ecx
216 movl %cr3,%eax
217 cmpl %ecx,%eax
218 je 1f
219 movl %ecx,%cr3
221 movl PCPU(curthread),%ebx
224 * If this is a process/lwp, deactivate the pmap after we've
225 * switched it out.
227 movl TD_LWP(%ebx),%ecx
228 testl %ecx,%ecx
229 jz 2f
230 movl PCPU(cpuid), %eax
231 movl LWP_VMSPACE(%ecx), %ecx /* ECX = vmspace */
232 MPLOCKED btrl %eax, VM_PMAP+PM_ACTIVE(%ecx)
235 * Switch to the next thread. RET into the restore function, which
236 * expects the new thread in EAX and the old in EBX.
238 * There is a one-instruction window where curthread is the new
239 * thread but %esp still points to the old thread's stack, but
240 * we are protected by a critical section so it is ok.
242 movl 4(%esp),%eax
243 movl %eax,PCPU(curthread)
244 movl TD_SP(%eax),%esp
248 * cpu_heavy_restore() (current thread in %eax on entry)
250 * Restore the thread after an LWKT switch. This entry is normally
251 * called via the LWKT switch restore function, which was pulled
252 * off the thread stack and jumped to.
254 * This entry is only called if the thread was previously saved
255 * using cpu_heavy_switch() (the heavy weight process thread switcher),
256 * or when a new process is initially scheduled. The first thing we
257 * do is clear the TDF_RUNNING bit in the old thread and set it in the
258 * new thread.
260 * NOTE: The lwp may be in any state, not necessarily LSRUN, because
261 * a preemption switch may interrupt the process and then return via
262 * cpu_heavy_restore.
264 * YYY theoretically we do not have to restore everything here, a lot
265 * of this junk can wait until we return to usermode. But for now
266 * we restore everything.
268 * YYY the PCB crap is really crap, it makes startup a bitch because
269 * we can't switch away.
271 * YYY note: spl check is done in mi_switch when it splx()'s.
274 ENTRY(cpu_heavy_restore)
275 popfl
276 movl TD_LWP(%eax),%ecx
278 #if defined(SWTCH_OPTIM_STATS)
279 incl _swtch_optim_stats
280 #endif
282 * Tell the pmap that our cpu is using the VMSPACE now. We cannot
283 * safely test/reload %cr3 until after we have set the bit in the
284 * pmap (remember, we do not hold the MP lock in the switch code).
286 movl LWP_VMSPACE(%ecx), %ecx /* ECX = vmspace */
287 movl PCPU(cpumask), %esi
288 MPLOCKED orl %esi, VM_PMAP+PM_ACTIVE(%ecx)
289 #ifdef SMP
290 testl $CPUMASK_LOCK,VM_PMAP+PM_ACTIVE(%ecx)
291 jz 1f
292 pushl %eax
293 pushl %ecx
294 call pmap_interlock_wait
295 popl %ecx
296 popl %eax
298 #endif
301 * Restore the MMU address space. If it is the same as the last
302 * thread we don't have to invalidate the tlb (i.e. reload cr3).
303 * YYY which naturally also means that the PM_ACTIVE bit had better
304 * already have been set before we set it above, check? YYY
306 movl TD_PCB(%eax),%edx /* EDX = PCB */
307 movl %cr3,%esi
308 movl PCB_CR3(%edx),%ecx
309 cmpl %esi,%ecx
310 je 4f
311 #if defined(SWTCH_OPTIM_STATS)
312 decl _swtch_optim_stats
313 incl _tlb_flush_count
314 #endif
315 movl %ecx,%cr3
318 * Clear TDF_RUNNING flag in old thread only after cleaning up
319 * %cr3. The target thread is already protected by being TDF_RUNQ
320 * so setting TDF_RUNNING isn't as big a deal.
322 andl $~TDF_RUNNING,TD_FLAGS(%ebx)
323 orl $TDF_RUNNING,TD_FLAGS(%eax)
326 * Deal with the PCB extension, restore the private tss
328 movl PCB_EXT(%edx),%edi /* check for a PCB extension */
329 movl $1,%ebx /* maybe mark use of a private tss */
330 testl %edi,%edi
331 jnz 2f
334 * Going back to the common_tss. We may need to update TSS_ESP0
335 * which sets the top of the supervisor stack when entering from
336 * usermode. The PCB is at the top of the stack but we need another
337 * 16 bytes to take vm86 into account.
339 leal -16(%edx),%ebx
340 movl %ebx, PCPU(common_tss) + TSS_ESP0
342 cmpl $0,PCPU(private_tss) /* don't have to reload if */
343 je 3f /* already using the common TSS */
345 subl %ebx,%ebx /* unmark use of private tss */
348 * Get the address of the common TSS descriptor for the ltr.
349 * There is no way to get the address of a segment-accessed variable
350 * so we store a self-referential pointer at the base of the per-cpu
351 * data area and add the appropriate offset.
353 movl $gd_common_tssd, %edi
354 addl %fs:0, %edi
357 * Move the correct TSS descriptor into the GDT slot, then reload
358 * ltr.
361 movl %ebx,PCPU(private_tss) /* mark/unmark private tss */
362 movl PCPU(tss_gdt), %ebx /* entry in GDT */
363 movl 0(%edi), %eax
364 movl %eax, 0(%ebx)
365 movl 4(%edi), %eax
366 movl %eax, 4(%ebx)
367 movl $GPROC0_SEL*8, %esi /* GSEL(entry, SEL_KPL) */
368 ltr %si
372 * Restore general registers.
374 movl PCB_EBX(%edx),%ebx
375 movl PCB_ESP(%edx),%esp
376 movl PCB_EBP(%edx),%ebp
377 movl PCB_ESI(%edx),%esi
378 movl PCB_EDI(%edx),%edi
379 movl PCB_EIP(%edx),%eax
380 movl %eax,(%esp)
383 * Restore the user LDT if we have one
385 cmpl $0, PCB_USERLDT(%edx)
386 jnz 1f
387 movl _default_ldt,%eax
388 cmpl PCPU(currentldt),%eax
389 je 2f
390 lldt _default_ldt
391 movl %eax,PCPU(currentldt)
392 jmp 2f
393 1: pushl %edx
394 call set_user_ldt
395 popl %edx
398 * Restore the user TLS if we have one
400 pushl %edx
401 call set_user_TLS
402 popl %edx
405 * Restore the DEBUG register state if necessary.
407 movb PCB_FLAGS(%edx),%al
408 andb $PCB_DBREGS,%al
409 jz 1f /* no, skip over */
410 movl PCB_DR6(%edx),%eax /* yes, do the restore */
411 movl %eax,%dr6
412 movl PCB_DR3(%edx),%eax
413 movl %eax,%dr3
414 movl PCB_DR2(%edx),%eax
415 movl %eax,%dr2
416 movl PCB_DR1(%edx),%eax
417 movl %eax,%dr1
418 movl PCB_DR0(%edx),%eax
419 movl %eax,%dr0
420 movl %dr7,%eax /* load dr7 so as not to disturb */
421 andl $0x0000fc00,%eax /* reserved bits */
422 pushl %ebx
423 movl PCB_DR7(%edx),%ebx
424 andl $~0x0000fc00,%ebx
425 orl %ebx,%eax
426 popl %ebx
427 movl %eax,%dr7
433 * savectx(pcb)
435 * Update pcb, saving current processor state.
437 ENTRY(savectx)
438 /* fetch PCB */
439 movl 4(%esp),%ecx
441 /* caller's return address - child won't execute this routine */
442 movl (%esp),%eax
443 movl %eax,PCB_EIP(%ecx)
445 movl %cr3,%eax
446 movl %eax,PCB_CR3(%ecx)
448 movl %ebx,PCB_EBX(%ecx)
449 movl %esp,PCB_ESP(%ecx)
450 movl %ebp,PCB_EBP(%ecx)
451 movl %esi,PCB_ESI(%ecx)
452 movl %edi,PCB_EDI(%ecx)
454 #if NNPX > 0
456 * If npxthread == NULL, then the npx h/w state is irrelevant and the
457 * state had better already be in the pcb. This is true for forks
458 * but not for dumps (the old book-keeping with FP flags in the pcb
459 * always lost for dumps because the dump pcb has 0 flags).
461 * If npxthread != NULL, then we have to save the npx h/w state to
462 * npxthread's pcb and copy it to the requested pcb, or save to the
463 * requested pcb and reload. Copying is easier because we would
464 * have to handle h/w bugs for reloading. We used to lose the
465 * parent's npx state for forks by forgetting to reload.
467 movl PCPU(npxthread),%eax
468 testl %eax,%eax
469 je 1f
471 pushl %ecx /* target pcb */
472 movl TD_SAVEFPU(%eax),%eax /* originating savefpu area */
473 pushl %eax
475 pushl %eax
476 call npxsave
477 addl $4,%esp
479 popl %eax
480 popl %ecx
482 pushl $PCB_SAVEFPU_SIZE
483 leal PCB_SAVEFPU(%ecx),%ecx
484 pushl %ecx
485 pushl %eax
486 call bcopy
487 addl $12,%esp
488 #endif /* NNPX > 0 */
494 * cpu_idle_restore() (current thread in %eax on entry) (one-time execution)
496 * Don't bother setting up any regs other then %ebp so backtraces
497 * don't die. This restore function is used to bootstrap into the
498 * cpu_idle() LWKT only, after that cpu_lwkt_*() will be used for
499 * switching.
501 * Clear TDF_RUNNING in old thread only after we've cleaned up %cr3.
503 * If we are an AP we have to call ap_init() before jumping to
504 * cpu_idle(). ap_init() will synchronize with the BP and finish
505 * setting up various ncpu-dependant globaldata fields. This may
506 * happen on UP as well as SMP if we happen to be simulating multiple
507 * cpus.
509 ENTRY(cpu_idle_restore)
510 /* cli */
511 movl IdlePTD,%ecx
512 movl $0,%ebp
513 pushl $0
514 movl %ecx,%cr3
515 andl $~TDF_RUNNING,TD_FLAGS(%ebx)
516 orl $TDF_RUNNING,TD_FLAGS(%eax)
517 #ifdef SMP
518 cmpl $0,PCPU(cpuid)
519 je 1f
520 call ap_init
522 #endif
524 * ap_init can decide to enable interrupts early, but otherwise, or if
525 * we are UP, do it here.
528 jmp cpu_idle
531 * cpu_kthread_restore() (current thread is %eax on entry) (one-time execution)
533 * Don't bother setting up any regs other then %ebp so backtraces
534 * don't die. This restore function is used to bootstrap into an
535 * LWKT based kernel thread only. cpu_lwkt_switch() will be used
536 * after this.
538 * Since all of our context is on the stack we are reentrant and
539 * we can release our critical section and enable interrupts early.
541 ENTRY(cpu_kthread_restore)
543 movl IdlePTD,%ecx
544 movl TD_PCB(%eax),%edx
545 movl $0,%ebp
546 movl %ecx,%cr3
547 andl $~TDF_RUNNING,TD_FLAGS(%ebx)
548 orl $TDF_RUNNING,TD_FLAGS(%eax)
549 subl $TDPRI_CRIT,TD_PRI(%eax)
550 popl %eax /* kthread exit function */
551 pushl PCB_EBX(%edx) /* argument to ESI function */
552 pushl %eax /* set exit func as return address */
553 movl PCB_ESI(%edx),%eax
554 jmp *%eax
557 * cpu_lwkt_switch()
559 * Standard LWKT switching function. Only non-scratch registers are
560 * saved and we don't bother with the MMU state or anything else.
562 * This function is always called while in a critical section.
564 * There is a one-instruction window where curthread is the new
565 * thread but %esp still points to the old thread's stack, but
566 * we are protected by a critical section so it is ok.
568 * YYY BGL, SPL
570 ENTRY(cpu_lwkt_switch)
571 pushl %ebp /* note: GDB hacked to locate ebp relative to td_sp */
572 pushl %ebx
573 movl PCPU(curthread),%ebx
574 pushl %esi
575 pushl %edi
576 pushfl
577 /* warning: adjust movl into %eax below if you change the pushes */
579 #if NNPX > 0
581 * Save the FP state if we have used the FP. Note that calling
582 * npxsave will NULL out PCPU(npxthread).
584 * We have to deal with the FP state for LWKT threads in case they
585 * happen to get preempted or block while doing an optimized
586 * bzero/bcopy/memcpy.
588 cmpl %ebx,PCPU(npxthread)
589 jne 1f
590 pushl TD_SAVEFPU(%ebx)
591 call npxsave /* do it in a big C function */
592 addl $4,%esp /* EAX, ECX, EDX trashed */
594 #endif /* NNPX > 0 */
596 movl 4+20(%esp),%eax /* switch to this thread */
597 pushl $cpu_lwkt_restore
598 movl %esp,TD_SP(%ebx)
599 movl %eax,PCPU(curthread)
600 movl TD_SP(%eax),%esp
603 * eax contains new thread, ebx contains old thread.
608 * cpu_lwkt_restore() (current thread in %eax on entry)
610 * Standard LWKT restore function. This function is always called
611 * while in a critical section.
613 * Warning: due to preemption the restore function can be used to
614 * 'return' to the original thread. Interrupt disablement must be
615 * protected through the switch so we cannot run splz here.
617 * YYY we theoretically do not need to load IdlePTD into cr3, but if
618 * so we need a way to detect when the PTD we are using is being
619 * deleted due to a process exiting.
621 ENTRY(cpu_lwkt_restore)
622 movl IdlePTD,%ecx /* YYY borrow but beware desched/cpuchg/exit */
623 movl %cr3,%edx
624 cmpl %ecx,%edx
625 je 1f
626 movl %ecx,%cr3
628 andl $~TDF_RUNNING,TD_FLAGS(%ebx)
629 orl $TDF_RUNNING,TD_FLAGS(%eax)
630 popfl
631 popl %edi
632 popl %esi
633 popl %ebx
634 popl %ebp