lkml.org 
[lkml]   [1997]   [Nov]   [8]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    From
    SubjectRe: Pentium DEATH in user-mode
    Hi Erik,

    Erik wrote:

    > In article <199711080849.VAA02265@karaka.chch.cri.nz> you wrote:
    > > Doesn't stop Cyrix 166 MMX's
    >
    > There seems to be a different sequence that affects Cyrixes though.
    >
    > See <http://www.heise.de/ct/art_ab97/9713030/>. If you don't
    > understand German you will probably want to skip down to the
    > assembler code at the bottom of the article.
    >
    > I don't have a Cyrix, so I can't test it, but it seems to me
    > that the 'sti' must be unnecessary and impossible on Linux in
    > user mode. Apparently the effect of the loop is to stop the
    > handling of interrupts.
    >
    > - --
    > Erik Corry erik@arbat.com

    I don't understand German, so that made it a little harder to check this
    information.

    Here are the *bad* news:
    ========================

    You *can* deadlock a 6x86 in user mode with the sequence or a small
    variations on the sequence proposed in the article.
    Here is the source of a small user-space program that will lock your
    Cyrix in a loop:

    static unsigned char c[4] = {0x36, 0x78, 0x38, 0x36};
    main()
    {
    asm ("movl $c, %ebx\n\t"
    "again: xchgl (%ebx), %eax\n\t"
    "movl %eax, %edx\n\t"
    "jmp again\n\t");
    }

    I am sorry if it's not as elegant as Richard Johnson's example.

    Compiling and running as a simple user the above program will lock my
    6x86L box. I didn't try it on the 6x86MX (I will report later on the
    6x86MX).

    Explanation (my guess, I may be completely wrong):
    ==================================================
    The exchange instruction (xchgl above) on the 6x86 will lock the cpu bus
    and effectively disable interrupts during its execution. It seems that
    the combination of speculative execution and register renaming plus the
    intelligent pipelines in the 6x86 will prevent interrupt servicing
    during the execution of the movl and jmp instructions. Consequently
    interrupts never get serviced and the processor is effectively locked in
    a loop that runs in its cache line.

    And here are the good news:
    ===========================

    Setting the NO_LOCK bit in CCR1 will prevent the deadlock caused by the
    above code sequence. Here is a short call to set6x86 that does this:

    set6x86 -p 0xc1 -s 0x10.

    Page table accesses and interrupt acknowledge cycles will still be
    executed in locked cycles, but the xchgl instruction will *not* generate
    locked cycles anymore.

    I don't know if setting the NO_LOCK bit will cause problems when running
    Linux. I don't think so...

    Comments are welcome.

    Cheers,

    ========================================================
    Andrew D. Balsa
    Home Page: http://www.tux.org/~balsa
    andrewbalsa@usa.net
    ========================================================

    \
     
     \ /
      Last update: 2005-03-22 13:40    [W:0.034 / U:60.912 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site