cd155b5603
from the top of user memory to one page lower on machines with the Ryzen (AMD Family 17h) CPU. This pushes ps_strings and the stack down by one page as well. On Ryzen there is some sort of interaction between code running at the top of user memory address space and interrupts that can cause FreeBSD to either hang or silently reset. This sounds similar to the problem found with DragonFly BSD that was fixed with this commit: https://gitweb.dragonflybsd.org/dragonfly.git/commitdiff/b48dd28447fc8ef62fbc963accd301557fd9ac20 but our signal trampoline location was already lower than the address that DragonFly moved their signal trampoline to. It also does not appear to be related to SMT as described here: https://www.phoronix.com/forums/forum/hardware/processors-memory/955368-some-ryzen-linux-users-are-facing-issues-with-heavy-compilation-loads?p=955498#post955498 "Hi, Matt Dillon here. Yes, I did find what I believe to be a hardware issue with Ryzen related to concurrent operations. In a nutshell, for any given hyperthread pair, if one hyperthread is in a cpu-bound loop of any kind (can be in user mode), and the other hyperthread is returning from an interrupt via IRETQ, the hyperthread issuing the IRETQ can stall indefinitely until the other hyperthread with the cpu-bound loop pauses (aka HLT until next interrupt). After this situation occurs, the system appears to destabilize. The situation does not occur if the cpu-bound loop is on a different core than the core doing the IRETQ. The %rip the IRETQ returns to (e.g. userland %rip address) matters a *LOT*. The problem occurs more often with high %rip addresses such as near the top of the user stack, which is where DragonFly's signal trampoline traditionally resides. So a user program taking a signal on one thread while another thread is cpu-bound can cause this behavior. Changing the location of the signal trampoline makes it more difficult to reproduce the problem. I have not been because the able to completely mitigate it. When a cpu-thread stalls in this manner it appears to stall INSIDE the microcode for IRETQ. It doesn't make it to the return pc, and the cpu thread cannot take any IPIs or other hardware interrupts while in this state." since the system instability has been observed on FreeBSD with SMT disabled. Interrupts to appear to play a factor since running a signal-intensive process on the first CPU core, which handles most of the interrupts on my machine, is far more likely to trigger the problem than running such a process on any other core. Also lower sv_maxuser to prevent a malicious user from using mmap() to load and execute code in the top page of user memory that was made available when the shared page was moved down. Make the same changes to the 64-bit Linux emulator. PR: 219399 Reported by: nbe@renzel.net Reviewed by: kib Reviewed by: dchagin (previous version) Tested by: nbe@renzel.net (earlier version) MFC after: 2 weeks Differential Revision: https://reviews.freebsd.org/D11780
68 lines
2.9 KiB
C
68 lines
2.9 KiB
C
/*-
|
|
* Copyright (c) 1995 Bruce D. Evans.
|
|
* All rights reserved.
|
|
*
|
|
* Redistribution and use in source and binary forms, with or without
|
|
* modification, are permitted provided that the following conditions
|
|
* are met:
|
|
* 1. Redistributions of source code must retain the above copyright
|
|
* notice, this list of conditions and the following disclaimer.
|
|
* 2. Redistributions in binary form must reproduce the above copyright
|
|
* notice, this list of conditions and the following disclaimer in the
|
|
* documentation and/or other materials provided with the distribution.
|
|
* 3. Neither the name of the author nor the names of contributors
|
|
* may be used to endorse or promote products derived from this software
|
|
* without specific prior written permission.
|
|
*
|
|
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
|
|
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
|
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
|
|
* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
|
|
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
|
|
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
|
|
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
|
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
|
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
|
|
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
|
|
* SUCH DAMAGE.
|
|
*
|
|
* $FreeBSD$
|
|
*/
|
|
|
|
#ifndef _MACHINE_MD_VAR_H_
|
|
#define _MACHINE_MD_VAR_H_
|
|
|
|
#include <x86/x86_var.h>
|
|
|
|
extern uint64_t *vm_page_dump;
|
|
extern int hw_lower_amd64_sharedpage;
|
|
|
|
struct savefpu;
|
|
struct sysentvec;
|
|
|
|
void amd64_db_resume_dbreg(void);
|
|
void amd64_lower_shared_page(struct sysentvec *);
|
|
void amd64_syscall(struct thread *td, int traced);
|
|
void doreti_iret(void) __asm(__STRING(doreti_iret));
|
|
void doreti_iret_fault(void) __asm(__STRING(doreti_iret_fault));
|
|
void ld_ds(void) __asm(__STRING(ld_ds));
|
|
void ld_es(void) __asm(__STRING(ld_es));
|
|
void ld_fs(void) __asm(__STRING(ld_fs));
|
|
void ld_gs(void) __asm(__STRING(ld_gs));
|
|
void ld_fsbase(void) __asm(__STRING(ld_fsbase));
|
|
void ld_gsbase(void) __asm(__STRING(ld_gsbase));
|
|
void ds_load_fault(void) __asm(__STRING(ds_load_fault));
|
|
void es_load_fault(void) __asm(__STRING(es_load_fault));
|
|
void fs_load_fault(void) __asm(__STRING(fs_load_fault));
|
|
void gs_load_fault(void) __asm(__STRING(gs_load_fault));
|
|
void fsbase_load_fault(void) __asm(__STRING(fsbase_load_fault));
|
|
void gsbase_load_fault(void) __asm(__STRING(gsbase_load_fault));
|
|
void fpstate_drop(struct thread *td);
|
|
void pagezero(void *addr);
|
|
void setidt(int idx, alias_for_inthand_t *func, int typ, int dpl, int ist);
|
|
void sse2_pagezero(void *addr);
|
|
struct savefpu *get_pcb_user_save_td(struct thread *td);
|
|
struct savefpu *get_pcb_user_save_pcb(struct pcb *pcb);
|
|
|
|
#endif /* !_MACHINE_MD_VAR_H_ */
|