The branch main has been updated by kib: URL: https://cgit.FreeBSD.org/src/commit/?id=2eddd8ebf96a83fdb01d1a7e45e2d652aa05f4b8
commit 2eddd8ebf96a83fdb01d1a7e45e2d652aa05f4b8 Author: Konstantin Belousov <[email protected]> AuthorDate: 2022-09-09 20:44:48 +0000 Commit: Konstantin Belousov <[email protected]> CommitDate: 2022-09-14 15:47:57 +0000 i386: explain the handshake between copyout_fast.s and page fault handler Tested by: pho Sponsored by: The FreeBSD Foundation MFC after: 1 week --- sys/i386/i386/copyout_fast.s | 11 +++++++++++ sys/i386/i386/exception.s | 33 ++++++++++++++++++++++----------- 2 files changed, 33 insertions(+), 11 deletions(-) diff --git a/sys/i386/i386/copyout_fast.s b/sys/i386/i386/copyout_fast.s index 4391f36b18e4..2aa17a5c45c8 100644 --- a/sys/i386/i386/copyout_fast.s +++ b/sys/i386/i386/copyout_fast.s @@ -37,6 +37,17 @@ #include "assym.inc" +/* + * Fast path for copyout code. We switch to user space %cr3 and perform + * move operation between user memory and copyout buffer, located in the + * trampoline area. We must switch to trampoline stack, because both + * user and kernel buffer accesses might cause page fault. + * + * Page fault handler expects %edx to point to the onfault routine. + * Handler switches to idlePTD and calls the routine. + * The routine must restore the stack, enable interrupts, and + * return to the caller, informing it about failure. + */ .text ENTRY(copyout_fast) diff --git a/sys/i386/i386/exception.s b/sys/i386/i386/exception.s index a2a6f5311a87..1a950b80b9b6 100644 --- a/sys/i386/i386/exception.s +++ b/sys/i386/i386/exception.s @@ -130,15 +130,25 @@ IDTVEC(prot) jmp irettraps IDTVEC(page) testl $PSL_VM, TF_EFLAGS-TF_ERR(%esp) - jnz 6f + jnz upf testb $SEL_RPL_MASK, TF_CS-TF_ERR(%esp) - jnz 6f + jnz upf cmpl $PMAP_TRM_MIN_ADDRESS, TF_EIP-TF_ERR(%esp) - jb 6f + jb upf + + /* + * This is a handshake between copyout_fast.s and page fault + * handler. We check for page fault occuring at the special + * places in the copyout fast path, where page fault can + * legitimately happen while accessing either user space or + * kernel pageable memory, and return control to *%edx. + * We switch to the idleptd page table from a user page table, + * if needed. + */ pushl %eax movl TF_EIP-TF_ERR+4(%esp), %eax addl $1f, %eax - call 7f + call 5f 1: cmpl $pf_x1, %eax je 2f cmpl $pf_x2, %eax @@ -159,23 +169,24 @@ IDTVEC(page) je 4f cmpl $pf_y2, %eax je 4f - jmp 5f + jmp upf_eax 2: movl $tramp_idleptd, %eax subl $3f, %eax - call 8f + call 6f 3: movl (%eax), %eax movl %eax, %cr3 4: popl %eax movl %edx, TF_EIP-TF_ERR(%esp) addl $4, %esp iret -5: popl %eax -6: pushl $T_PAGEFLT - jmp alltraps -7: subl (%esp), %eax +5: subl (%esp), %eax retl -8: addl (%esp), %eax +6: addl (%esp), %eax retl + +upf_eax:popl %eax +upf: pushl $T_PAGEFLT + jmp alltraps IDTVEC(rsvd_pti) IDTVEC(rsvd) pushl $0; TRAP(T_RESERVED)
