Author: kib
Date: Wed May 12 10:29:35 2010
New Revision: 207958
URL: http://svn.freebsd.org/changeset/base/207958
Log:
Route all returns from the interrupts and faults through the doreti_iret
labeled iretq instruction.
Suppose that multithreaded process executes two threads, currently
scheduled on different processors. Let assume that thread A executes
using %cs or %ss pointing into the descriptor from LDT. If IPI comes
which handler does not return by jump to doreti, and meantime thread B
invalidates descriptor pointed to by %cs or %ss, then iretq from IPI
handler could fault.
Routing the return by doreti_iret allows kernel to catch the situation
and recover from it by sending signal to the usermode.
Tested by: pho
MFC after: 1 week
Modified:
head/sys/amd64/amd64/apic_vector.S
head/sys/amd64/amd64/exception.S
Modified: head/sys/amd64/amd64/apic_vector.S
==============================================================================
--- head/sys/amd64/amd64/apic_vector.S Wed May 12 10:29:06 2010
(r207957)
+++ head/sys/amd64/amd64/apic_vector.S Wed May 12 10:29:35 2010
(r207958)
@@ -41,6 +41,7 @@
#include "assym.s"
+ .extern doreti_iret
/*
* I/O Interrupt Entry Point. Rather than having one entry point for
* each interrupt source, we use one entry point for each 32-bit word
@@ -81,7 +82,7 @@ IDTVEC(spuriousint)
/* No EOI cycle used here */
- iretq
+ jmp doreti_iret
ISR_VEC(1, apic_isr1)
ISR_VEC(2, apic_isr2)
@@ -135,7 +136,7 @@ IDTVEC(invltlb)
incl smp_tlb_wait
popq %rax
- iretq
+ jmp doreti_iret
/*
* Single page TLB shootdown
@@ -155,7 +156,7 @@ IDTVEC(invlpg)
incl smp_tlb_wait
popq %rax
- iretq
+ jmp doreti_iret
/*
* Page range TLB shootdown.
@@ -181,7 +182,7 @@ IDTVEC(invlrng)
popq %rdx
popq %rax
- iretq
+ jmp doreti_iret
/*
* Invalidate cache.
@@ -200,7 +201,7 @@ IDTVEC(invlcache)
incl smp_tlb_wait
popq %rax
- iretq
+ jmp doreti_iret
/*
* Handler for IPIs sent via the per-cpu IPI bitmap.
@@ -247,7 +248,7 @@ IDTVEC(cpususpend)
call cpususpend_handler
POP_FRAME
- iretq
+ jmp doreti_iret
/*
* Executed by a CPU when it receives a RENDEZVOUS IPI from another CPU.
Modified: head/sys/amd64/amd64/exception.S
==============================================================================
--- head/sys/amd64/amd64/exception.S Wed May 12 10:29:06 2010
(r207957)
+++ head/sys/amd64/amd64/exception.S Wed May 12 10:29:35 2010
(r207958)
@@ -553,7 +553,7 @@ nmi_restoreregs:
movq TF_R14(%rsp),%r14
movq TF_R15(%rsp),%r15
addq $TF_RIP,%rsp
- iretq
+ jmp doreti_iret
ENTRY(fork_trampoline)
movq %r12,%rdi /* function */
_______________________________________________
svn-src-all@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/svn-src-all
To unsubscribe, send any mail to "svn-src-all-unsubscr...@freebsd.org"
