Skip site navigation (1)Skip section navigation (2) 
Date:      Mon, 25 Jul 2011 18:46:56 +0000 (UTC)
From:      Marius Strobl <marius@FreeBSD.org>
To:        src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-stable@freebsd.org, svn-src-stable-7@freebsd.org
Subject:   svn commit: r224377 - in stable/7/sys: kern sparc64/sparc64
Message-ID:  <201107251846.p6PIkuM0071524@svn.freebsd.org>
next in thread | raw e-mail | index | archive | help 
Author: marius
Date: Mon Jul 25 18:46:56 2011
New Revision: 224377
URL: http://svn.freebsd.org/changeset/base/224377

Log:
  MFC: r223795
  
  Call pmap_qremove() before freeing or unwiring the pages, otherwise
  there's a window during which a page can be re-used before its previous
  mapping is removed.
  
  Reviewed by:	alc

Modified:
  stable/7/sys/kern/vfs_bio.c
  stable/7/sys/sparc64/sparc64/pmap.c
Directory Properties:
  stable/7/sys/   (props changed)
  stable/7/sys/cddl/contrib/opensolaris/   (props changed)
  stable/7/sys/contrib/dev/acpica/   (props changed)
  stable/7/sys/contrib/pf/   (props changed)

Modified: stable/7/sys/kern/vfs_bio.c
==============================================================================
--- stable/7/sys/kern/vfs_bio.c	Mon Jul 25 18:46:54 2011	(r224376)
+++ stable/7/sys/kern/vfs_bio.c	Mon Jul 25 18:46:56 2011	(r224377)
@@ -1574,6 +1574,7 @@ vfs_vmio_release(struct buf *bp)
 	int i;
 	vm_page_t m;
 
+	pmap_qremove(trunc_page((vm_offset_t)bp->b_data), bp->b_npages);
 	VM_OBJECT_LOCK(bp->b_bufobj->bo_object);
 	vm_page_lock_queues();
 	for (i = 0; i < bp->b_npages; i++) {
@@ -1610,7 +1611,6 @@ vfs_vmio_release(struct buf *bp)
 	}
 	vm_page_unlock_queues();
 	VM_OBJECT_UNLOCK(bp->b_bufobj->bo_object);
-	pmap_qremove(trunc_page((vm_offset_t) bp->b_data), bp->b_npages);
 	
 	if (bp->b_bufsize) {
 		bufspacewakeup();
@@ -2950,6 +2950,10 @@ allocbuf(struct buf *bp, int size)
 			if (desiredpages < bp->b_npages) {
 				vm_page_t m;
 
+				pmap_qremove((vm_offset_t)trunc_page(
+				    (vm_offset_t)bp->b_data) +
+				    (desiredpages << PAGE_SHIFT),
+				    (bp->b_npages - desiredpages));
 				VM_OBJECT_LOCK(bp->b_bufobj->bo_object);
 				vm_page_lock_queues();
 				for (i = desiredpages; i < bp->b_npages; i++) {
@@ -2969,8 +2973,6 @@ allocbuf(struct buf *bp, int size)
 				}
 				vm_page_unlock_queues();
 				VM_OBJECT_UNLOCK(bp->b_bufobj->bo_object);
-				pmap_qremove((vm_offset_t) trunc_page((vm_offset_t)bp->b_data) +
-				    (desiredpages << PAGE_SHIFT), (bp->b_npages - desiredpages));
 				bp->b_npages = desiredpages;
 			}
 		} else if (size > bp->b_bcount) {

Modified: stable/7/sys/sparc64/sparc64/pmap.c
==============================================================================
--- stable/7/sys/sparc64/sparc64/pmap.c	Mon Jul 25 18:46:54 2011	(r224376)
+++ stable/7/sys/sparc64/sparc64/pmap.c	Mon Jul 25 18:46:56 2011	(r224377)
@@ -1158,6 +1158,7 @@ pmap_release(pmap_t pm)
 			pc->pc_pmap = NULL;
 	mtx_unlock_spin(&sched_lock);
 
+	pmap_qremove((vm_offset_t)pm->pm_tsb, TSB_PAGES);
 	obj = pm->pm_tsb_obj;
 	VM_OBJECT_LOCK(obj);
 	KASSERT(obj->ref_count == 1, ("pmap_release: tsbobj ref count != 1"));
@@ -1175,7 +1176,6 @@ pmap_release(pmap_t pm)
 		vm_page_unlock_queues();
 	}
 	VM_OBJECT_UNLOCK(obj);
-	pmap_qremove((vm_offset_t)pm->pm_tsb, TSB_PAGES);
 	PMAP_LOCK_DESTROY(pm);
 }

Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201107251846.p6PIkuM0071524>