Skip to content

Commit ee424b8

Browse files
committed
runtime-fix #2: route __storeload_barrier to userland path under FSTACK
amd64 __storeload_barrier() uses `lock; addl $0,%gs:OFFSETOF_MONITORBUF` when _KERNEL is defined, which accesses the per-CPU segment via the %gs selector. That selector is set up by the FreeBSD kernel for in-kernel threads, but never initialized for userland processes — so when F-Stack runs the same instruction it dereferences an unmapped address and the process dies with SIGSEGV. After fix #1 unblocked uma_startup1, the next crash surfaced in smr_create() (PC at +150 -> `lock addl $0x0,%gs:0x100`), with the stack: smr_create -> zone_ctor -> uma_zcreate -> filelistinit -> mi_startup The userland branch of __storeload_barrier already exists (uses `lock; addl $0,-8(%rsp)` against the redzone, which is safe and equally serializing on x86). Just include FSTACK in the predicate that selects the userland implementation: #if defined(_KERNEL) && !defined(FSTACK) ... %gs-based variant ... #else /* !_KERNEL || FSTACK */ ... rsp-based variant ... #endif Verified by disassembling libfstack.ro::smr_create after a clean rebuild: the instruction is now `lock addl $0x0,-0x8(%rsp)` instead of `lock addl $0x0,%gs:0x100`.
1 parent 424f8a9 commit ee424b8

1 file changed

Lines changed: 9 additions & 3 deletions

File tree

freebsd/amd64/include/atomic.h

Lines changed: 9 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -322,12 +322,18 @@ atomic_testandclear_long(volatile u_long *p, u_int v)
322322
static __inline void
323323
__storeload_barrier(void)
324324
{
325-
#if defined(_KERNEL)
325+
#if defined(_KERNEL) && !defined(FSTACK)
326326
__asm __volatile("lock; addl $0,%%gs:%c0"
327327
: : "i" (OFFSETOF_MONITORBUF) : "memory", "cc");
328-
#else /* !_KERNEL */
328+
#else /* !_KERNEL || FSTACK */
329+
/*
330+
* F-Stack DP-RT-2026-06-01: F-Stack runs in user space; %gs PCPU
331+
* segment is not set up by the userland process, so accessing
332+
* %gs:OFFSETOF_MONITORBUF would SIGSEGV (observed in smr_create()).
333+
* Fall back to the userland-safe rsp variant.
334+
*/
329335
__asm __volatile("lock; addl $0,-8(%%rsp)" : : : "memory", "cc");
330-
#endif /* _KERNEL*/
336+
#endif /* _KERNEL && !FSTACK */
331337
}
332338

333339
#define ATOMIC_LOAD(TYPE) \

0 commit comments

Comments
 (0)