From nobody Mon Oct 12 18:28:59 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4j3QwC3swCz6jyPh for ; Mon, 12 Oct 2026 18:28:59 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR2" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4j3QwC3Hgsz4fKR for ; Mon, 12 Oct 2026 18:28:59 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1791829739; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=7fjMd85AlKV67Y5LH1P9o31+J4+g7aM1ffXqHfTy9TU=; b=xltVH0f0Jgj8i1A4qdE+tWl88Zw9gvpCzRTg/GW8cEvfpCSY9sdgSzgM2vaINI1WoE5vCt QYA0enBPWkN92n/qZt30hQbfC9/XFrgJV0ednmTAK+cVlnD4BxHx5o+MPK8c55S9q+yhCb sbcSlPCMzqEvyf07JRfHC7RbEoOQnEW/Ffcwd9443lwSOpu31IyhUa3dDEqXdJ8UtCybeR mofkzerRU2cFNb41P/KtAIWuTSTwdwSlb5dkcpVm8ZP16eolOBNthsqck3kMoijnZEQNU3 +4gUTaplOkVUW5dDX4YF+ouCB9A97M6TuAVEfvgNEdZIohItInZvKmdA/ri5TA== ARC-Seal: i=1; a=rsa-sha256; d=freebsd.org; s=dkim; cv=none; t=1791829739; b=NBWex8XcjWSAL8XKCwaRFDMKQ9pF8s1K3MtzJjty+e7e07sL02LBLxv8hJPYkkaRsPWvmL Xzlxhwg4poYCAdgZ2c8LOmf9+0EhKAn6Z3xlOtISirVWZMXd+isA/2delkZ2tlBy8Nf0dm mlBrFM9/w4Gqvd/OiFDCRT6fVaEDJ2AMGg/mO2F+xyKY30r469nEoM9y27LSatG4s+oVbl 8YjLQj5RlH3aZ+3oZSVaWl8ilysV5qRqbG4v5o0HpspHRjJb25ORzvUaSJQ9RJR2hp8n13 D5PkhjhwpxWdNK/XSfPgzTz4ioaOteP9DNgFpibc8+EWmTtdjnxGGBs+D5KB8Q== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1791829739; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=7fjMd85AlKV67Y5LH1P9o31+J4+g7aM1ffXqHfTy9TU=; b=Kq7JB0P9+izcR4VH17LSCs3HTPen2fV5psQ3cqL6lZewmsrALlRDiMylww8gCvT9nj7OxR /6qpHhY1Ax1DL4iOoSIPm9mmA06B1PhjF0xc+42LufB+5s9OtNbp33Cg3u5kxrhYQI7l5H YuUtzBY7nUwpZ9Hpx7Ejgntl3lF3HAruK0RLHPkywCRSqoMj/Wz5nZaiQbraRrxfrYyhOm 3YLAwub9vqqksbyyNANtcmQEwMQ5izw4nQwHb5jUJ2qypjwVMBmOLw7k+maoaT7rZvrZ1L mvK4vze5+M7xlyCs7z9MmJTRXeEMxxGGFxVDhN+3PSvlNu9hGYOxaJfpdWD+Ng== ARC-Authentication-Results: i=1; mx1.freebsd.org; none Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4j3QwC224Gzgy6 for ; Mon, 12 Oct 2026 18:28:59 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 37a16 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Mon, 12 Oct 2026 18:28:59 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Piotr Kubaj Subject: git: d38acf590a08 - stable/14 - powerpc: keep FP, VMX and VSX ownership changes atomic with preemption List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: Commits to the stable branches of the FreeBSD src repository List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: pkubaj X-Git-Repository: src X-Git-Refname: refs/heads/stable/14 X-Git-Reftype: branch X-Git-Commit: d38acf590a08c6669964c268e304cceb69b5a71e Auto-Submitted: auto-generated Date: Mon, 12 Oct 2026 18:28:59 +0000 Message-Id: <6acd26eb.37a16.2a107e7b@gitrepo.freebsd.org> The branch stable/14 has been updated by pkubaj: URL: https://cgit.FreeBSD.org/src/commit/?id=d38acf590a08c6669964c268e304cceb69b5a71e commit d38acf590a08c6669964c268e304cceb69b5a71e Author: Piotr Kubaj AuthorDate: 2026-09-21 12:48:06 +0000 Commit: Piotr Kubaj CommitDate: 2026-10-12 18:18:54 +0000 powerpc: keep FP, VMX and VSX ownership changes atomic with preemption trap() and set_mcontext() change the FP/VMX/VSX ownership state in several steps with preemption enabled. A context switch in between leaves the thread computing with another thread's register contents: - enable_fpu()/enable_vec() set PCB_FPU/PCB_VEC before loading the registers, so a switch mid-load saves a half-loaded unit over the PCB. - set_mcontext() clears the frame's MSR bits and then the PCB flags; a switch in between re-enables the unit, and the thread returns to user space with it enabled but not owned, so it is neither saved nor restored until the next signal. Both paths run after every sigreturn(2), setcontext(2) and swapcontext(3). A POWER9 test that keeps f14-f31 live across a signal, with other threads using the FPU on the same CPU, saw 283 corrupted round trips out of 882000; none after this change. Hold a critical section around both, as amd64 and arm64 do. Reviewed by: jhibbits MFC after: 1 week Differential Revision: https://reviews.freebsd.org/D60054 (cherry picked from commit 1f1043d550ea2b8282e692019f17a88896212a76) (cherry picked from commit 61afe54265dc757b42cd37d9146f4cd65d543bd4) --- sys/powerpc/powerpc/exec_machdep.c | 8 +++++++- sys/powerpc/powerpc/trap.c | 6 ++++++ 2 files changed, 13 insertions(+), 1 deletion(-) diff --git a/sys/powerpc/powerpc/exec_machdep.c b/sys/powerpc/powerpc/exec_machdep.c index 073266f87c46..3f7318ef6a50 100644 --- a/sys/powerpc/powerpc/exec_machdep.c +++ b/sys/powerpc/powerpc/exec_machdep.c @@ -522,7 +522,14 @@ set_mcontext(struct thread *td, mcontext_t *mcp) * * Additionally, ensure VSX is disabled as well, as it is illegal * to leave it turned on when FP or VEC are off. + * + * The MSR bits in the frame and the PCB flags must change together: + * if the thread is switched out in between, cpu_switchin() still + * sees the flags, reloads the registers and puts the MSR bits back + * into the frame, and the thread then runs with the units enabled + * but without owning them. */ + critical_enter(); tf->srr1 &= ~(PSL_FP | PSL_VSX | PSL_VEC); pcb->pcb_flags &= ~(PCB_FPU | PCB_VSX | PCB_VEC); @@ -536,7 +543,6 @@ set_mcontext(struct thread *td, mcontext_t *mcp) * sigresume is callled will used by the resumed thread, instead of the * previously saved data from the mcontext. */ - critical_enter(); msr = mfmsr() & ~(PSL_FP | PSL_VSX | PSL_VEC); isync(); mtmsr(msr); diff --git a/sys/powerpc/powerpc/trap.c b/sys/powerpc/powerpc/trap.c index dae1228c30fa..8bec7efb0df9 100644 --- a/sys/powerpc/powerpc/trap.c +++ b/sys/powerpc/powerpc/trap.c @@ -295,24 +295,30 @@ trap(struct trapframe *frame) case EXC_FPU: KASSERT((td->td_pcb->pcb_flags & PCB_FPU) != PCB_FPU, ("FPU already enabled for thread")); + critical_enter(); enable_fpu(td); + critical_exit(); break; case EXC_VEC: KASSERT((td->td_pcb->pcb_flags & PCB_VEC) != PCB_VEC, ("Altivec already enabled for thread")); + critical_enter(); enable_vec(td); + critical_exit(); break; case EXC_VSX: KASSERT((td->td_pcb->pcb_flags & PCB_VSX) != PCB_VSX, ("VSX already enabled for thread")); + critical_enter(); if (!(td->td_pcb->pcb_flags & PCB_VEC)) enable_vec(td); if (td->td_pcb->pcb_flags & PCB_FPU) save_fpu(td); td->td_pcb->pcb_flags |= PCB_VSX; enable_fpu(td); + critical_exit(); break; case EXC_FAC: