Skip to content

arm and riscv5 os_switch_seg_to_context() incorrectly write to app's TLS slot #8022

Description

@derekbruening

In os_switch_seg_to_context() for aarchxx and riscv I noticed this comment and corresponding code:

        /* On switching to app's TLS, we need put DR's TLS base into app's TLS
         * at the same offset so it can be loaded on entering code cache.
         * Otherwise, the context switch code on entering fcache will fault on
         * accessing DR's TLS.
         * The app's TLS slot value is stored into privlib's TLS slot for
         * later restore on switching back to privlib's TLS.
         */

That looks off: I think that may be from an old flow in early aarch32 support where the hardware thread pointer was swapped while in the code cache. That seems fragile: we don't want to assume anything about the app's TLS layout (bad enough to depend on private library TLS layout). Today we keep the hardware tpid* register pointing to DR's TLS and mangle app reads of that register. We should go back to DR context before entering the cache, so I think this code needs to be cleaned up. I suspect it hasn't caused a problem because swapping to native and back only happens on Linux for the split init-start window in any supported usage. Although I'm now wondering about detach: is this happening on detach?

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions