From owner-svn-src-all@FreeBSD.ORG Sat Mar 20 15:27:02 2010 Return-Path: Delivered-To: svn-src-all@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 5C27A106564A; Sat, 20 Mar 2010 15:27:02 +0000 (UTC) (envelope-from nwhitehorn@FreeBSD.org) Received: from svn.freebsd.org (svn.freebsd.org [IPv6:2001:4f8:fff6::2c]) by mx1.freebsd.org (Postfix) with ESMTP id 2FB908FC0C; Sat, 20 Mar 2010 15:27:02 +0000 (UTC) Received: from svn.freebsd.org (localhost [127.0.0.1]) by svn.freebsd.org (8.14.3/8.14.3) with ESMTP id o2KFR2c0012210; Sat, 20 Mar 2010 15:27:02 GMT (envelope-from nwhitehorn@svn.freebsd.org) Received: (from nwhitehorn@localhost) by svn.freebsd.org (8.14.3/8.14.3/Submit) id o2KFR25l012208; Sat, 20 Mar 2010 15:27:02 GMT (envelope-from nwhitehorn@svn.freebsd.org) Message-Id: <201003201527.o2KFR25l012208@svn.freebsd.org> From: Nathan Whitehorn Date: Sat, 20 Mar 2010 15:27:02 +0000 (UTC) To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-stable@freebsd.org, svn-src-stable-8@freebsd.org X-SVN-Group: stable-8 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Cc: Subject: svn commit: r205382 - stable/8/sys/powerpc/aim X-BeenThere: svn-src-all@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: "SVN commit messages for the entire src tree \(except for " user" and " projects" \)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 20 Mar 2010 15:27:02 -0000 Author: nwhitehorn Date: Sat Mar 20 15:27:01 2010 New Revision: 205382 URL: http://svn.freebsd.org/changeset/base/205382 Log: MFC r204297: Move the OEA64 scratchpage to the end of KVA from the beginning, and set its PVO to map physical address 0 instead of kernelstart. This fixes a situation in which a user process could attempt to return this address via KVM, have it fault while being modified, and then panic the kernel because (a) it is supposed to map a valid address and (b) it lies in the no-fault region between VM_MIN_KERNEL_ADDRESS and virtual_avail. While here, move msgbuf and dpcpu back into regular KVA space for consistency with other implementations. Modified: stable/8/sys/powerpc/aim/mmu_oea64.c Directory Properties: stable/8/sys/ (props changed) stable/8/sys/amd64/include/xen/ (props changed) stable/8/sys/cddl/contrib/opensolaris/ (props changed) stable/8/sys/contrib/dev/acpica/ (props changed) stable/8/sys/contrib/pf/ (props changed) stable/8/sys/dev/xen/xenpci/ (props changed) Modified: stable/8/sys/powerpc/aim/mmu_oea64.c ============================================================================== --- stable/8/sys/powerpc/aim/mmu_oea64.c Sat Mar 20 15:23:06 2010 (r205381) +++ stable/8/sys/powerpc/aim/mmu_oea64.c Sat Mar 20 15:27:01 2010 (r205382) @@ -970,10 +970,10 @@ moea64_bridge_bootstrap(mmu_t mmup, vm_o mtx_init(&moea64_scratchpage_mtx, "pvo zero page", NULL, MTX_DEF); for (i = 0; i < 2; i++) { - moea64_scratchpage_va[i] = virtual_avail; - virtual_avail += PAGE_SIZE; + moea64_scratchpage_va[i] = (virtual_end+1) - PAGE_SIZE; + virtual_end -= PAGE_SIZE; - moea64_kenter(mmup,moea64_scratchpage_va[i],kernelstart); + moea64_kenter(mmup,moea64_scratchpage_va[i],0); LOCK_TABLE(); moea64_scratchpage_pvo[i] = moea64_pvo_find_va(kernel_pmap, @@ -1004,20 +1004,25 @@ moea64_bridge_bootstrap(mmu_t mmup, vm_o * Allocate virtual address space for the message buffer. */ pa = msgbuf_phys = moea64_bootstrap_alloc(MSGBUF_SIZE, PAGE_SIZE); - msgbufp = (struct msgbuf *)msgbuf_phys; - while (pa - msgbuf_phys < MSGBUF_SIZE) { - moea64_kenter(mmup, pa, pa); + msgbufp = (struct msgbuf *)virtual_avail; + va = virtual_avail; + virtual_avail += round_page(MSGBUF_SIZE); + while (va < virtual_avail) { + moea64_kenter(mmup, va, pa); pa += PAGE_SIZE; + va += PAGE_SIZE; } /* * Allocate virtual address space for the dynamic percpu area. */ pa = moea64_bootstrap_alloc(DPCPU_SIZE, PAGE_SIZE); - dpcpu = (void *)pa; - while (pa - (vm_offset_t)dpcpu < DPCPU_SIZE) { - moea64_kenter(mmup, pa, pa); + dpcpu = (void *)virtual_avail; + virtual_avail += DPCPU_SIZE; + while (va < virtual_avail) { + moea64_kenter(mmup, va, pa); pa += PAGE_SIZE; + va += PAGE_SIZE; } dpcpu_init(dpcpu, 0); }