thread0.td_frame overwritten in cpu_startup()
Mark Tinguely
tinguely at casselton.net
Thu Feb 12 14:17:02 PST 2009
on startup, the initarm() sets the thread0.td_frame to a local trapframe
structure.
in arm/ARCH/ARCH_machdep.c
thread0.td_frame = &proc0_tf;
But cpu_startup() in arm/arm/machdep.c overwrites it with a value at the end
of the kernel stack. unfortunately, that space is also used by the thread0
pcb structure.
in arm/ARCH/ARCH_machdep.c
thread0.td_pcb = (struct pcb *)
(thread0.td_kstack + KSTACK_PAGES * PAGE_SIZE) - 1
in arm/arm/machdep.c
pcb->un_32.pcb32_sp = (u_int)thread0.td_kstack +
USPACE_SVC_STACK_TOP;
note: USPACE_SVC_STACK_TOP is defined as KSTACK_PAGES * PAGE_SIZE, so this
is the top of the kernel stack.
thread0.td_frame = (struct trapframe *)pcb->un_32.pcb32_sp - 1;
This td_frame assignment in arm/arm/machdep.c should be removed. Not only
did it overwrite a perfectly good trapframe, it overwrited it with memory
that is shared with the pcb.
--Mark Tinguely.
More information about the freebsd-arm
mailing list