diff options
author | bde <bde@FreeBSD.org> | 2004-06-18 02:10:55 +0000 |
---|---|---|
committer | bde <bde@FreeBSD.org> | 2004-06-18 02:10:55 +0000 |
commit | ddf2ab11f4b789d38a12ccc49baa9a6781f11e80 (patch) | |
tree | cafe3c620fe43b302ce470ab9af4bd3f32cfeb21 /sys | |
parent | f0aeb408c294739845f2c7ae018a79924f4880f4 (diff) | |
download | FreeBSD-src-ddf2ab11f4b789d38a12ccc49baa9a6781f11e80.zip FreeBSD-src-ddf2ab11f4b789d38a12ccc49baa9a6781f11e80.tar.gz |
Fixed a panic caused by over-optimizing npxdrop() in the non-FXSR case.
frstor can trap despite it being a control instruction, since it bogusly
checks for pending exceptions in the state that it is overwriting.
This used to be a non-problem because frstor was always paired with a
previous fnsave, and fnsave does an implicit fninit so any pending
exceptions only remain live in the saved state. Now frstor is sometimes
paired with npxdrop() and we must do a little more than just forget
that the npx was used in npxdrop() to avoid a trap later. This is a
non-problem in the FXSR case because fxrstor doesn't do the bogus check.
FXSR is part of SSE, and npxdrop() is only in FreeBSD-5.x, so this bug
only affected old machines running FreeBSD-5.x.
PR: 68058
Diffstat (limited to 'sys')
-rw-r--r-- | sys/i386/isa/npx.c | 9 |
1 files changed, 9 insertions, 0 deletions
diff --git a/sys/i386/isa/npx.c b/sys/i386/isa/npx.c index 4844efe..43e019f 100644 --- a/sys/i386/isa/npx.c +++ b/sys/i386/isa/npx.c @@ -872,6 +872,15 @@ npxdrop() { struct thread *td; + /* + * Discard pending exceptions in the !cpu_fxsr case so that unmasked + * ones don't cause a panic on the next frstor. + */ +#ifdef CPU_ENABLE_SSE + if (!cpu_fxsr) +#endif + fnclex(); + td = PCPU_GET(fpcurthread); PCPU_SET(fpcurthread, NULL); td->td_pcb->pcb_flags &= ~PCB_NPXINITDONE; |