git: 93d3ac1daa0e - main - arm64: Fix kernel panic in get_arm64_sve during core dump

From: Andrew Turner <andrew_at_FreeBSD.org>
Date: Fri, 30 Jan 2026 17:20:32 UTC
The branch main has been updated by andrew:

URL: https://cgit.FreeBSD.org/src/commit/?id=93d3ac1daa0ef3ac54ffcd5cc64a14638d04bd60

commit 93d3ac1daa0ef3ac54ffcd5cc64a14638d04bd60
Author:     Andy Carrel <william.a@carrel.org>
AuthorDate: 2026-01-05 07:50:27 +0000
Commit:     Andrew Turner <andrew@FreeBSD.org>
CommitDate: 2026-01-30 17:01:49 +0000

    arm64: Fix kernel panic in get_arm64_sve during core dump
    
    The coredump logic calls get_arm64_sve twice: once to get the note size,
    and once to get the data. The note size calculation depended on the
    volatile `PCB_FP_SVEVALID` flag. If this flag was cleared between the
    two calls (e.g., due to a context switch clearing the flag to comply
    with the ABI), the second call would expect a smaller buffer size than
    the first, triggering a KASSERT panic ("invalid size").
    
    Fix this by ensuring the SVE state is saved to the PCB before we decide
    whether to use SVE or VFP.
    
    PR: 292195
    Reviewed by: andrew
    Differential Revision: https://reviews.freebsd.org/D54532
---
 sys/arm64/arm64/vfp.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/sys/arm64/arm64/vfp.c b/sys/arm64/arm64/vfp.c
index bcddebfaf66e..64f13458e2d9 100644
--- a/sys/arm64/arm64/vfp.c
+++ b/sys/arm64/arm64/vfp.c
@@ -934,6 +934,9 @@ get_arm64_sve(struct regset *rs, struct thread *td, void *buf,
 
 	pcb = td->td_pcb;
 
+	if (td == curthread && (pcb->pcb_fpflags & PCB_FP_STARTED) != 0)
+		vfp_save_state(td, pcb);
+
 	/* If there is no SVE support in HW then we don't support NT_ARM_SVE */
 	if (pcb->pcb_sve_len == 0)
 		return (false);
@@ -955,9 +958,6 @@ get_arm64_sve(struct regset *rs, struct thread *td, void *buf,
 		KASSERT(*sizep == sizeof(struct svereg_header) + buf_size,
 		    ("%s: invalid size", __func__));
 
-		if (td == curthread && (pcb->pcb_fpflags & PCB_FP_STARTED) != 0)
-			vfp_save_state(td, pcb);
-
 		header = buf;
 		memset(header, 0, sizeof(*header));