From owner-cvs-all@FreeBSD.ORG Sun Dec 2 12:49:29 2007 Return-Path: Delivered-To: cvs-all@FreeBSD.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 812E716A419; Sun, 2 Dec 2007 12:49:29 +0000 (UTC) (envelope-from cognet@FreeBSD.org) Received: from repoman.freebsd.org (repoman.freebsd.org [IPv6:2001:4f8:fff6::29]) by mx1.freebsd.org (Postfix) with ESMTP id 73FA813C46A; Sun, 2 Dec 2007 12:49:29 +0000 (UTC) (envelope-from cognet@FreeBSD.org) Received: from repoman.freebsd.org (localhost [127.0.0.1]) by repoman.freebsd.org (8.14.1/8.14.1) with ESMTP id lB2CnTal071211; Sun, 2 Dec 2007 12:49:29 GMT (envelope-from cognet@repoman.freebsd.org) Received: (from cognet@localhost) by repoman.freebsd.org (8.14.1/8.14.1/Submit) id lB2CnTTP071210; Sun, 2 Dec 2007 12:49:29 GMT (envelope-from cognet) Message-Id: <200712021249.lB2CnTTP071210@repoman.freebsd.org> From: Olivier Houchard Date: Sun, 2 Dec 2007 12:49:29 +0000 (UTC) To: src-committers@FreeBSD.org, cvs-src@FreeBSD.org, cvs-all@FreeBSD.org X-FreeBSD-CVS-Branch: HEAD Cc: Subject: cvs commit: src/sys/arm/include asmacros.h atomic.h X-BeenThere: cvs-all@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: CVS commit messages for the entire tree List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 02 Dec 2007 12:49:29 -0000 cognet 2007-12-02 12:49:29 UTC FreeBSD src repository Modified files: sys/arm/include asmacros.h atomic.h Log: Close a race. The RAS implementation would set the end address, then the start address. These were used by the kernel to restart a RAS sequence if it was interrupted. When the thread switching code ran, it would check these values and adjust the PC and clear them if it did. However, there's a small flaw in this scheme. Thread T1, sets the end address and gets preempted. Thread T2 runs and also does a RAS operation. This resets end to zero. Thread T1 now runs again and sets start and then begins the RAS sequence, but is preempted before the RAS sequence executes its last instruction. The kernel code that would ordinarily restart the RAS sequence doesn't because the PC isn't between start and 0, so the PC isn't set to the start of the sequence. So when T1 is resumed again, it is at the wrong location for RAS to produce the correct results. This causes the wrong results for the atomic sequence. The window for the first race is 3 instructions. The window for the second race is 5-10 instructions depending on the atomic operation. This makes this failure fairly rare and hard to reproduce. Mutexs are implemented in libthr using atomic operations. When the above race would occur, a lock could get stuck locked, causing many downstream problems, as you might expect. Also, make sure to reset the start and end address when doing a syscall, or a malicious process could set them before doing a syscall. Reviewed by: imp, ups (thanks guys) Pointy hat to: cognet MFC After: 3 days Revision Changes Path 1.7 +8 -1 src/sys/arm/include/asmacros.h 1.23 +41 -18 src/sys/arm/include/atomic.h