From owner-svn-src-head@freebsd.org Wed Feb 15 14:56:48 2017 Return-Path: Delivered-To: svn-src-head@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id C216DCDFA9E; Wed, 15 Feb 2017 14:56:48 +0000 (UTC) (envelope-from andrew@FreeBSD.org) Received: from repo.freebsd.org (repo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:0]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id 8EFD3694; Wed, 15 Feb 2017 14:56:48 +0000 (UTC) (envelope-from andrew@FreeBSD.org) Received: from repo.freebsd.org ([127.0.1.37]) by repo.freebsd.org (8.15.2/8.15.2) with ESMTP id v1FEulWn084304; Wed, 15 Feb 2017 14:56:47 GMT (envelope-from andrew@FreeBSD.org) Received: (from andrew@localhost) by repo.freebsd.org (8.15.2/8.15.2/Submit) id v1FEulq5084303; Wed, 15 Feb 2017 14:56:47 GMT (envelope-from andrew@FreeBSD.org) Message-Id: <201702151456.v1FEulq5084303@repo.freebsd.org> X-Authentication-Warning: repo.freebsd.org: andrew set sender to andrew@FreeBSD.org using -f From: Andrew Turner Date: Wed, 15 Feb 2017 14:56:47 +0000 (UTC) To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org Subject: svn commit: r313772 - head/sys/arm64/arm64 X-SVN-Group: head MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-BeenThere: svn-src-head@freebsd.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: SVN commit messages for the src tree for head/-current List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 15 Feb 2017 14:56:48 -0000 Author: andrew Date: Wed Feb 15 14:56:47 2017 New Revision: 313772 URL: https://svnweb.freebsd.org/changeset/base/313772 Log: Load the new sp_el0 with interrupts disabled in fork_trampoline. If an interrupt arrives in fork_trampoline after sp_el0 was written we may then switch to a new thread, enter userland so change this stack pointer, then return to this code with the wrong value. This fixes this case by moving the load of sp_el0 until after interrupts have been disabled. Reported by: Mark Millard (markmi@dsl-only.net) Sponsored by: ABT Systems Ltd Differential Revision: https://reviews.freebsd.org/D9593 Modified: head/sys/arm64/arm64/swtch.S Modified: head/sys/arm64/arm64/swtch.S ============================================================================== --- head/sys/arm64/arm64/swtch.S Wed Feb 15 14:34:40 2017 (r313771) +++ head/sys/arm64/arm64/swtch.S Wed Feb 15 14:56:47 2017 (r313772) @@ -241,11 +241,6 @@ ENTRY(fork_trampoline) mov fp, #0 /* Stack traceback stops here. */ bl _C_LABEL(fork_exit) - /* Restore sp and lr */ - ldp x0, x1, [sp] - msr sp_el0, x0 - mov lr, x1 - /* Restore the registers other than x0 and x1 */ ldp x2, x3, [sp, #TF_X + 2 * 8] ldp x4, x5, [sp, #TF_X + 4 * 8] @@ -261,14 +256,18 @@ ENTRY(fork_trampoline) ldp x24, x25, [sp, #TF_X + 24 * 8] ldp x26, x27, [sp, #TF_X + 26 * 8] ldp x28, x29, [sp, #TF_X + 28 * 8] - /* Skip x30 as it was restored above as lr */ /* * Disable interrupts to avoid - * overwriting spsr_el1 by an IRQ exception. + * overwriting spsr_el1 and sp_el0 by an IRQ exception. */ msr daifset, #2 + /* Restore sp and lr */ + ldp x0, x1, [sp] + msr sp_el0, x0 + mov lr, x1 + /* Restore elr and spsr */ ldp x0, x1, [sp, #16] msr elr_el1, x0