Fixed misclassification of npx interrupts caused by npx_probe().

Dividing by 0 in order to check for irq13/exception16 delivery apparently
always causes an irq13 even if we have configured for exception16 (by
setting CR0_NE).  This was expected, but the timing of the irq13 was
unexpected.  Without CR0_NE, the irq13 is delivered synchronously at
least on my test machine, but with CR0_NE it is delivered a little
later (about 250 nsec) in PIC mode and much later (5000-10000 nsec)
in APIC mode.  So especially in APIC mode, the irq13 may arrive after
it is supposed to be shut down.  It should then be masked, but the
shutdown is incomplete, so the irq goes to a null handler that just
reports it as stray.  The fix is to wait a bit after dividing by 0 to
give a good chance of the irq13 being handled by its proper handler.

Removed the hack that was supposed to recover from the incomplete shutdown
of irq13.  The shutdown is now even more incomplete, or perhaps just
incomplete in a different way, but the hack now has no effect because
irq13 is edge triggered and handling of edge triggered interrupts is
now optimized by skipping their masking.  The hack only worked due
to it accidentally not losing races.

The incomplete shutdown of irq13 still allows unprivileged users to
generate a stray irq13 (except on systems where irq13 is actually used)
by unmasking an npx exception and causing one.  The exception gets
handled properly by the exception 16 handler.  A spurious irq13 is
delivered asynchronously but is harmless (as in the probe) because it
is almost perfectly not handled by the null interrupt handler.
Perfectly not handling it involves mainly not resetting the npx busy
latch.  This prevents further irq13's despite them not being masked in
the [A]PIC.

1 files changed, 1 insertions, 12 deletions

diff --git a/sys/i386/isa/npx.c b/sys/i386/isa/npx.c
index ad5e4d0..4844efe 100644
--- a/sys/i386/isa/npx.c
+++ b/sys/i386/isa/npx.c
@@ -368,6 +368,7 @@ npx_probe(dev)
 #endif
 			npx_traps_while_probing = npx_intrs_while_probing = 0;
 			fp_divide_by_0();
+			DELAY(1000);	/* wait for any IRQ13 */
 			if (npx_traps_while_probing != 0) {
 				/*
 				 * Good, exception 16 works.
@@ -405,18 +406,6 @@ npx_probe(dev)
 no_irq13:
 	idt[IDT_MF] = save_idt_npxtrap;
 	bus_teardown_intr(dev, irq_res, irq_cookie);
-
-	/*
-	 * XXX hack around brokenness of bus_teardown_intr().  If we left the
-	 * irq active then we would get it instead of exception 16.
-	 */
-	{
-		struct intsrc *isrc;
-
-		isrc = intr_lookup_source(irq_num);
-		isrc->is_pic->pic_disable_source(isrc);
-	}
-
 	bus_release_resource(dev, SYS_RES_IRQ, irq_rid, irq_res);
 	bus_release_resource(dev, SYS_RES_IOPORT, ioport_rid, ioport_res);
 	return (0);