[9fans] crashing plan9 source boot CD with key combination (buffer overflow)

2014-06-20 Thread Yoann Padioleau
Hi, There is another buffer overflow somewhere I think. The code in kbdputsc() in kbd.c does not look very safe: kbscan-kc[kbscan-nk++] = c; - no bound checking, can overflow. c = latin1(kbscan-kc, kbscan-nk); if(c -1) /* need more

Re: [9fans] cache lines, and 60000 cycles of doom

2014-06-20 Thread erik quanstrom
the astounding thing is that t1-t0 is often ~ 60,000 cycles. it only hits a small fraction of the time, and the average is much lower. but that just blows the mind. 6 cycles! (other versions with sched were much worse.) as far as i can tell, there are no funny bits in the

Re: [9fans] cache lines, and 60000 cycles of doom

2014-06-20 Thread erik quanstrom
On Fri Jun 20 01:04:20 EDT 2014, devon.od...@gmail.com wrote: Weird. I assume cycles is using rdtsc or rdtscp. Perhaps some of it is due to a combination of contention and rdtsc(p) being serializing instructions? On Jun 19, 2014 12:04 PM, erik quanstrom quans...@quanstro.net wrote: other than

Re: [9fans] crashing plan9 source boot CD with key combination (buffer overflow)

2014-06-20 Thread erik quanstrom
On Fri Jun 20 06:24:25 EDT 2014, p...@fb.com wrote: good catch, but... The code in kbdputsc() in kbd.c does not look very safe: kbscan-kc[kbscan-nk++] = c; - no bound checking, can overflow. this behavior depends entirely on what latin1() does. if latin1() will

Re: [9fans] cache lines, and 60000 cycles of doom

2014-06-20 Thread Devon H. O'Dell
2014-06-20 7:50 GMT-04:00 erik quanstrom quans...@quanstro.net: On Fri Jun 20 01:04:20 EDT 2014, devon.od...@gmail.com wrote: Weird. I assume cycles is using rdtsc or rdtscp. Perhaps some of it is due to a combination of contention and rdtsc(p) being serializing instructions? I forget that

Re: [9fans] cache lines, and 60000 cycles of doom

2014-06-20 Thread erik quanstrom
It disables out-of-order execution by the processor, so there's a pipeline stall. we know there's going to be a stall already, since we can't get the cacheline we're looking for. There's overhead to calling the tsc instructions, but not that much. Does `srb-wmach != m-machno` imply that t0