{"ref":"refs/heads/master","commits":[{"author":{"name":"rstone","email":"34e381dbbbc76b0c79642ff6052579f8980e1a2f@ccf9f872-aa2e-dd11-9fc8-001c23d0bc1f"},"url":"https://api.github.com/repos/freebsd/freebsd-head/commits/8e9c4e17e29b9c3195c3cb710891f2fe055927a0","message":"On i386, fbt probes are implemented by writing an invalid opcode over\ncertain instructions in a function prologue or epilogue.  DTrace has a\nhook into the invalid opcode fault handler that checks whether the fault\nwas due to an probe and if so, runs the DTrace magic.\n\nUpon returning from an invalid opcode fault caused by a probe, DTrace must\nemulate the instruction that was replaced with the invalid opcode and then\nreturn control to the instruction following the invalid opcode.\n\nThere were a pair of related bugs in the emulation for the leave\ninstruction.  The leave instruction is used to pop off a stack frame prior\nto returning from a function.  The emulation for this instruction must\nmove the trap frame for the invalid opcode fault down the stack to the\nbottom of the stack frame that is being removed, and then execute an iret.\n\nAt two points in this process, the emulation code was storing values above\nthe current value of the stack pointer.  This opened up a window in which\nif we were two take an interrupt, the trap frame for the interrupt would\noverwrite the values stored on the stack, causing the system to panic\nlater.\n\nThe first bug was that at one point the emulation code saves the new value\nfor $esp above the current stack pointer value.  The fix is to save this\nvalue instead inside of the original trap frame.  At this point we do\nnot need the original trap frame so this is safe.\n\nThe second bug is that when the emulate code loads $esp from the stack, it\npoints part-way through the new trap frame instead of at its beginning.\nThe emulation code adjusts the stack pointer to the correct value\nimmediately afterwards, but this still leaves a one instruction window in\nwhich an interrupt would corrupt this trap frame.  Fix this by adjusting\nthe stack frame value before loading it into $esp.\n\nThis fixes panics in invop_leave on i386 when using fbt return probes.\n\nReviewed by:\trpaulo, attilio\nMFC after:\t1 week\n\n\ngit-svn-id: svn+ssh://svn.freebsd.org/base/head@227430 ccf9f872-aa2e-dd11-9fc8-001c23d0bc1f","sha":"8e9c4e17e29b9c3195c3cb710891f2fe055927a0"},{"author":{"name":"yongari","email":"79c7d24101a3af56696b485dbd1362edab3b7da5@ccf9f872-aa2e-dd11-9fc8-001c23d0bc1f"},"url":"https://api.github.com/repos/freebsd/freebsd-head/commits/7042ebfc9df97393a1a11caeac7b1f031f884b21","message":"style.\nNo functional changes.\n\n\ngit-svn-id: svn+ssh://svn.freebsd.org/base/head@227431 ccf9f872-aa2e-dd11-9fc8-001c23d0bc1f","sha":"7042ebfc9df97393a1a11caeac7b1f031f884b21"}],"head":"7042ebfc9df97393a1a11caeac7b1f031f884b21","size":2,"push_id":49553887}