Author: andrew
Date: Wed Apr 19 15:59:16 2017
New Revision: 317147
URL: https://svnweb.freebsd.org/changeset/base/317147
Log:
MFC 313772:
Load the new sp_el0 with interrupts disabled in fork_trampoline. If an
interrupt arrives in fork_trampoline after sp_el0 was written we may then
switch to a new thread, enter userland so change this stack pointer, then
return to this code with the wrong value. This fixes this case by moving
the load of sp_el0 until after interrupts have been disabled.
Modified:
stable/11/sys/arm64/arm64/swtch.S
Directory Properties:
stable/11/ (props changed)
Modified: stable/11/sys/arm64/arm64/swtch.S
==============================================================================
--- stable/11/sys/arm64/arm64/swtch.S Wed Apr 19 15:46:34 2017
(r317146)
+++ stable/11/sys/arm64/arm64/swtch.S Wed Apr 19 15:59:16 2017
(r317147)
@@ -241,11 +241,6 @@ ENTRY(fork_trampoline)
mov fp, #0 /* Stack traceback stops here. */
bl _C_LABEL(fork_exit)
- /* Restore sp and lr */
- ldp x0, x1, [sp]
- msr sp_el0, x0
- mov lr, x1
-
/* Restore the registers other than x0 and x1 */
ldp x2, x3, [sp, #TF_X + 2 * 8]
ldp x4, x5, [sp, #TF_X + 4 * 8]
@@ -261,14 +256,18 @@ ENTRY(fork_trampoline)
ldp x24, x25, [sp, #TF_X + 24 * 8]
ldp x26, x27, [sp, #TF_X + 26 * 8]
ldp x28, x29, [sp, #TF_X + 28 * 8]
- /* Skip x30 as it was restored above as lr */
/*
* Disable interrupts to avoid
- * overwriting spsr_el1 by an IRQ exception.
+ * overwriting spsr_el1 and sp_el0 by an IRQ exception.
*/
msr daifset, #2
+ /* Restore sp and lr */
+ ldp x0, x1, [sp]
+ msr sp_el0, x0
+ mov lr, x1
+
/* Restore elr and spsr */
ldp x0, x1, [sp, #16]
msr elr_el1, x0
_______________________________________________
svn-src-all@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/svn-src-all
To unsubscribe, send any mail to "svn-src-all-unsubscr...@freebsd.org"
