port-sh3/49597: swapcontext(3) stack pointer problem on NetBSD/sh3

[oshima-ya%yagoto-urayama.jp@localhost]

>Number:         49597
>Category:       port-sh3
>Synopsis:       swapcontext(3) stack pointer problem on NetBSD/sh3
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    port-sh3-maintainer
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Thu Jan 22 14:05:00 +0000 2015
>Originator:     Yasushi Oshima
>Release:        NetBSD 7.0_BETA
>Organization:
>Environment:
NetBSD usl5p1 7.0_BETA NetBSD 7.0_BETA (GENERIC) #2: Sun Jan 18 01:57:10 JST 2015  oshima@sweety:/export/netbsd-7/obj/landisk/sys/arch/landisk/compile/GENERIC landisk
>Description:
In src/lib/libc/arch/sh3/gen/swapcontext.S,
Though SP is incremented 4 or 3 times in swapcontext(3)
till getcontext(2), it does not adjust stack pointer
in ocup->uc_mcontext.__gregs[_REG_SP] after that.

When will return to this context, 
PC will be set to a caller address of swapcontext(3).
But SP will show an invalid address. 
This will cause to crash.

The problem tends to occur by a program which is
compiled by gcc 4.8.x.
gcc 4.5.x generates code to save SP to another register
before function call and restore after, but gcc 4.8.x
does not save.
>How-To-Repeat:
On NetBSD/sh3 -7.0_BETA or -current,

cd /usr/tests/lib/libc/sys
atf-run t_swapcontext

This test failes by SIGSEGV.
>Fix:
Adjust SP in oldcontext by getcontext.

In the following patch, add #12 (PIC case, default)
or #8 (no PIC) to UC_MACHINE_SP(oucp).

--- lib/libc/arch/sh3/gen/swapcontext.S 12 Sep 2013 15:36:15 -0000      1.10
+++ lib/libc/arch/sh3/gen/swapcontext.S 21 Jan 2015 15:30:08 -0000
@@ -53,6 +53,11 @@
        /* Note: getcontext does _UC_MACHINE_INTRV(oucp) = 0 for us */
        mov.l   @sp, r0
        mov.l   r0, @(36 + 1 * 4, r1)   /* _UC_MACHINE_SET_PC(oucp, pr) */
+       /* Adjust stack pointer */
+       mov     sp, r2
+#ifdef __PIC__
+       add     #12, r2                 /* for 2 -sp + PIC_PROLOGUE */
+#else
+       add     #8, r2                  /* for 2 -sp */
+#endif
+       mov     #(36 + 21 * 4), r0      /* offset _UC_MACHINE_SP(oucp) */
+       mov.l   r2, @(r0, r1)           /* store SP */
        mov.l   .L_setcontext, r2
 2:     CALL    r2                      /* setcontext(ucp) */
         mov.l  @(4, sp), r4