svn commit: r317147 - stable/11/sys/arm64/arm64

[Andrew Turner]

Author: andrew
Date: Wed Apr 19 15:59:16 2017
New Revision: 317147
URL: https://svnweb.freebsd.org/changeset/base/317147

Log:
  MFC 313772:
  
  Load the new sp_el0 with interrupts disabled in fork_trampoline. If an
  interrupt arrives in fork_trampoline after sp_el0 was written we may then
  switch to a new thread, enter userland so change this stack pointer, then
  return to this code with the wrong value. This fixes this case by moving
  the load of sp_el0 until after interrupts have been disabled.

Modified:
  stable/11/sys/arm64/arm64/swtch.S
Directory Properties:
  stable/11/   (props changed)

Modified: stable/11/sys/arm64/arm64/swtch.S
==============================================================================
--- stable/11/sys/arm64/arm64/swtch.S	Wed Apr 19 15:46:34 2017	(r317146)
+++ stable/11/sys/arm64/arm64/swtch.S	Wed Apr 19 15:59:16 2017	(r317147)
@@ -241,11 +241,6 @@ ENTRY(fork_trampoline)
 	mov	fp, #0	/* Stack traceback stops here. */
 	bl	_C_LABEL(fork_exit)
 
-	/* Restore sp and lr */
-	ldp	x0, x1, [sp]
-	msr	sp_el0, x0
-	mov	lr, x1
-
 	/* Restore the registers other than x0 and x1 */
 	ldp	x2, x3, [sp, #TF_X + 2 * 8]
 	ldp	x4, x5, [sp, #TF_X + 4 * 8]
@@ -261,14 +256,18 @@ ENTRY(fork_trampoline)
 	ldp	x24, x25, [sp, #TF_X + 24 * 8]
 	ldp	x26, x27, [sp, #TF_X + 26 * 8]
 	ldp	x28, x29, [sp, #TF_X + 28 * 8]
-	/* Skip x30 as it was restored above as lr */
 
 	/*
 	 * Disable interrupts to avoid
-	 * overwriting spsr_el1 by an IRQ exception.
+	 * overwriting spsr_el1 and sp_el0 by an IRQ exception.
 	 */
 	msr	daifset, #2
 
+	/* Restore sp and lr */
+	ldp	x0, x1, [sp]
+	msr	sp_el0, x0
+	mov	lr, x1
+
 	/* Restore elr and spsr */
 	ldp	x0, x1, [sp, #16]
 	msr	elr_el1, x0