From owner-svn-src-head@FreeBSD.ORG  Mon Jan 26 10:11:56 2015
Return-Path: <owner-svn-src-head@FreeBSD.ORG>
Delivered-To: svn-src-head@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org
 [IPv6:2001:1900:2254:206a::19:1])
 (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits))
 (No client certificate requested)
 by hub.freebsd.org (Postfix) with ESMTPS id 7616EBDF;
 Mon, 26 Jan 2015 10:11:56 +0000 (UTC)
Received: from svn.freebsd.org (svn.freebsd.org
 [IPv6:2001:1900:2254:2068::e6a:0])
 (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
 (Client did not present a certificate)
 by mx1.freebsd.org (Postfix) with ESMTPS id 62500B83;
 Mon, 26 Jan 2015 10:11:56 +0000 (UTC)
Received: from svn.freebsd.org ([127.0.1.70])
 by svn.freebsd.org (8.14.9/8.14.9) with ESMTP id t0QABu1Z057282;
 Mon, 26 Jan 2015 10:11:56 GMT (envelope-from kib@FreeBSD.org)
Received: (from kib@localhost)
 by svn.freebsd.org (8.14.9/8.14.9/Submit) id t0QABugM057281;
 Mon, 26 Jan 2015 10:11:56 GMT (envelope-from kib@FreeBSD.org)
Message-Id: <201501261011.t0QABugM057281@svn.freebsd.org>
X-Authentication-Warning: svn.freebsd.org: kib set sender to kib@FreeBSD.org
 using -f
From: Konstantin Belousov <kib@FreeBSD.org>
Date: Mon, 26 Jan 2015 10:11:56 +0000 (UTC)
To: src-committers@freebsd.org, svn-src-all@freebsd.org,
 svn-src-head@freebsd.org
Subject: svn commit: r277743 - head/sys/arm/arm
X-SVN-Group: head
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
X-BeenThere: svn-src-head@freebsd.org
X-Mailman-Version: 2.1.18-1
Precedence: list
List-Id: SVN commit messages for the src tree for head/-current
 <svn-src-head.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/options/svn-src-head>,
 <mailto:svn-src-head-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/svn-src-head/>
List-Post: <mailto:svn-src-head@freebsd.org>
List-Help: <mailto:svn-src-head-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/svn-src-head>,
 <mailto:svn-src-head-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Mon, 26 Jan 2015 10:11:56 -0000

Author: kib
Date: Mon Jan 26 10:11:55 2015
New Revision: 277743
URL: https://svnweb.freebsd.org/changeset/base/277743

Log:
  Ensure that _tmppt KVA is used exclusively by providing exclusive sx
  lock around the mapping and uiomove().  Before r277643, it was
  partially protected by Giant (but potential sleeping in fault from
  uiomove() would still allow other thread to reuse the mapping).
  
  Noted by:	ian
  Reviewed by:	alc, ian
  Sponsored by:	The FreeBSD Foundation
  MFC after:	3 weeks

Modified:
  head/sys/arm/arm/mem.c

Modified: head/sys/arm/arm/mem.c
==============================================================================
--- head/sys/arm/arm/mem.c	Mon Jan 26 09:53:41 2015	(r277742)
+++ head/sys/arm/arm/mem.c	Mon Jan 26 10:11:55 2015	(r277743)
@@ -55,6 +55,7 @@ __FBSDID("$FreeBSD$");
 #include <sys/mutex.h>
 #include <sys/proc.h>
 #include <sys/signalvar.h>
+#include <sys/sx.h>
 #include <sys/systm.h>
 #include <sys/uio.h>
 
@@ -72,6 +73,9 @@ MALLOC_DEFINE(M_MEMDESC, "memdesc", "mem
 
 struct mem_range_softc mem_range_softc;
 
+static struct sx tmppt_lock;
+SX_SYSINIT(tmppt, &tmppt_lock, "mem4map");
+
 /* ARGSUSED */
 int
 memrw(struct cdev *dev, struct uio *uio, int flags)
@@ -107,6 +111,7 @@ memrw(struct cdev *dev, struct uio *uio,
 			}
 			if (!address_valid)
 				return (EINVAL);
+			sx_xlock(&tmppt_lock);
 			pmap_kenter((vm_offset_t)_tmppt, v);
 			o = (int)uio->uio_offset & PAGE_MASK;
 			c = (u_int)(PAGE_SIZE - ((int)iov->iov_base & PAGE_MASK));
@@ -114,6 +119,7 @@ memrw(struct cdev *dev, struct uio *uio,
 			c = min(c, (u_int)iov->iov_len);
 			error = uiomove((caddr_t)&_tmppt[o], (int)c, uio);
 			pmap_qremove((vm_offset_t)_tmppt, 1);
+			sx_xunlock(&tmppt_lock);
 			continue;
 		}
 		else if (dev2unit(dev) == CDEV_MINOR_KMEM) {