d/freebsd-nq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Close a race.

Browse Source 
The RAS implementation would set the end address, then the start
address.  These were used by the kernel to restart a RAS sequence if
it was interrupted.  When the thread switching code ran, it would
check these values and adjust the PC and clear them if it did.

However, there's a small flaw in this scheme.  Thread T1, sets the end
address and gets preempted.  Thread T2 runs and also does a RAS
operation.  This resets end to zero.  Thread T1 now runs again and
sets start and then begins the RAS sequence, but is preempted before
the RAS sequence executes its last instruction.  The kernel code that
would ordinarily restart the RAS sequence doesn't because the PC isn't
between start and 0, so the PC isn't set to the start of the sequence.
So when T1 is resumed again, it is at the wrong location for RAS to
produce the correct results.  This causes the wrong results for the
atomic sequence.

The window for the first race is 3 instructions.  The window for the
second race is 5-10 instructions depending on the atomic operation.
This makes this failure fairly rare and hard to reproduce.

Mutexs are implemented in libthr using atomic operations.  When the
above race would occur, a lock could get stuck locked, causing many
downstream problems, as you might expect.

Also, make sure to reset the start and end address when doing a syscall, or
a malicious process could set them before doing a syscall.

Reviewed by: imp, ups (thanks guys)
Pointy hat to:	cognet
MFC After:	3 days
This commit is contained in:
Olivier Houchard 2007-12-02 12:49:28 +00:00
parent cc43c38c87
commit b21a1da537
2 changed files with 49 additions and 19 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
sys/arm/include/asmacros.h
View File

@ -67,7 +67,13 @@
stmia r0, {r13-r14}^; /* Push the user mode registers */ \
mov r0, r0; /* NOP for previous instruction */ \
mrs r0, spsr_all; /* Put the SPSR on the stack */ \
str r0, [sp, #-4]!;
str r0, [sp, #-4]!; \
mov r0, #0xe0000004; \
mov r1, #0; \
str r1, [r0]; \
mov r0, #0xe0000008; \
mov r1, #0xffffffff; \
str r1, [r0];
/*
* PULLFRAME - macro to pull a trap frame from the stack in the current mode
@ -121,6 +127,7 @@
ldrgt r4, [r1]; /* Get the end of the RAS */ \
movgt r2, #0; /* Reset the magic addresses */ \
strgt r2, [r5]; \
movgt r2, #0xffffffff; \
strgt r2, [r1]; \
cmpgt lr, r3; /* Were we in the RAS ? */ \
cmpgt r4, lr; \

59
sys/arm/include/atomic.h
View File

@ -148,17 +148,21 @@ atomic_cmpset_32(volatile u_int32_t *p, volatile u_int32_t cmpval, volatile u_in
register int done, ras_start;
__asm __volatile("1:\n"
"mov %0, #0xe0000008\n"
"adr %1, 2f\n"
"str %1, [%0]\n"
"adr %1, 1b\n"
"mov %0, #0xe0000004\n"
"str %1, [%0]\n"
"mov %0, #0xe0000008\n"
"adr %1, 2f\n"
"str %1, [%0]\n"
"ldr %1, [%2]\n"
"cmp %1, %3\n"
"streq %4, [%2]\n"
"2:\n"
"mov %1, #0\n"
"mov %0, #0xe0000004\n"
"str %1, [%0]\n"
"mov %1, #0xffffffff\n"
"mov %0, #0xe0000008\n"
"str %1, [%0]\n"
"moveq %1, #1\n"
"movne %1, #0\n"
@ -173,18 +177,22 @@ atomic_add_32(volatile u_int32_t *p, u_int32_t val)
int ras_start, start;
__asm __volatile("1:\n"
"mov %0, #0xe0000008\n"
"adr %1, 2f\n"
"str %1, [%0]\n"
"adr %1, 1b\n"
"mov %0, #0xe0000004\n"
"str %1, [%0]\n"
"mov %0, #0xe0000008\n"
"adr %1, 2f\n"
"str %1, [%0]\n"
"ldr %1, [%2]\n"
"add %1, %1, %3\n"
"str %1, [%2]\n"
"2:\n"
"mov %0, #0xe0000004\n"
"mov %1, #0\n"
"str %1, [%0]\n"
"mov %1, #0xffffffff\n"
"mov %0, #0xe0000008\n"
"str %1, [%0]\n"
: "=r" (ras_start), "=r" (start), "+r" (p), "+r" (val)
: : "memory");
}
@ -195,18 +203,22 @@ atomic_subtract_32(volatile u_int32_t *p, u_int32_t val)
int ras_start, start;
__asm __volatile("1:\n"
"mov %0, #0xe0000008\n"
"adr %1, 2f\n"
"str %1, [%0]\n"
"adr %1, 1b\n"
"mov %0, #0xe0000004\n"
"str %1, [%0]\n"
"mov %0, #0xe0000008\n"
"adr %1, 2f\n"
"str %1, [%0]\n"
"ldr %1, [%2]\n"
"sub %1, %1, %3\n"
"str %1, [%2]\n"
"2:\n"
"mov %0, #0xe0000004\n"
"mov %1, #0\n"
"str %1, [%0]\n"
"mov %1, #0xffffffff\n"
"mov %0, #0xe0000008\n"
"str %1, [%0]\n"
: "=r" (ras_start), "=r" (start), "+r" (p), "+r" (val)
: : "memory");
@ -218,18 +230,22 @@ atomic_set_32(volatile uint32_t *address, uint32_t setmask)
int ras_start, start;
__asm __volatile("1:\n"
"mov %0, #0xe0000008\n"
"adr %1, 2f\n"
"str %1, [%0]\n"
"adr %1, 1b\n"
"mov %0, #0xe0000004\n"
"str %1, [%0]\n"
"mov %0, #0xe0000008\n"
"adr %1, 2f\n"
"str %1, [%0]\n"
"ldr %1, [%2]\n"
"orr %1, %1, %3\n"
"str %1, [%2]\n"
"2:\n"
"mov %0, #0xe0000004\n"
"mov %1, #0\n"
"str %1, [%0]\n"
"mov %1, #0xffffffff\n"
"mov %0, #0xe0000008\n"
"str %1, [%0]\n"
: "=r" (ras_start), "=r" (start), "+r" (address), "+r" (setmask)
: : "memory");
@ -241,18 +257,22 @@ atomic_clear_32(volatile uint32_t *address, uint32_t clearmask)
int ras_start, start;
__asm __volatile("1:\n"
"mov %0, #0xe0000008\n"
"adr %1, 2f\n"
"str %1, [%0]\n"
"adr %1, 1b\n"
"mov %0, #0xe0000004\n"
"str %1, [%0]\n"
"mov %0, #0xe0000008\n"
"adr %1, 2f\n"
"str %1, [%0]\n"
"ldr %1, [%2]\n"
"bic %1, %1, %3\n"
"str %1, [%2]\n"
"2:\n"
"mov %0, #0xe0000004\n"
"mov %1, #0\n"
"str %1, [%0]\n"
"mov %1, #0xffffffff\n"
"mov %0, #0xe0000008\n"
"str %1, [%0]\n"
: "=r" (ras_start), "=r" (start), "+r" (address), "+r" (clearmask)
: : "memory");
@ -264,12 +284,12 @@ atomic_fetchadd_32(volatile uint32_t *p, uint32_t v)
uint32_t ras_start, start;
__asm __volatile("1:\n"
"mov %0, #0xe0000008\n"
"adr %1, 2f\n"
"str %1, [%0]\n"
"adr %1, 1b\n"
"mov %0, #0xe0000004\n"
"str %1, [%0]\n"
"mov %0, #0xe0000008\n"
"adr %1, 2f\n"
"str %1, [%0]\n"
"ldr %1, [%2]\n"
"add %0, %1, %3\n"
"str %0, [%2]\n"
@ -277,6 +297,9 @@ atomic_fetchadd_32(volatile uint32_t *p, uint32_t v)
"mov %0, #0xe0000004\n"
"mov %3, #0\n"
"str %3, [%0]\n"
"mov %0, #0xe0000008\n"
"mov %3, #0xffffffff\n"
"str %3, [%0]\n"
: "=r" (ras_start), "=r" (start), "+r" (p), "+r" (v)
: : "memory");
return (start);