From owner-svn-src-head@FreeBSD.ORG Thu Feb 25 03:56:17 2010 Return-Path: Delivered-To: svn-src-head@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id AED681065670; Thu, 25 Feb 2010 03:56:17 +0000 (UTC) (envelope-from nwhitehorn@freebsd.org) Received: from agogare.doit.wisc.edu (agogare.doit.wisc.edu [144.92.197.211]) by mx1.freebsd.org (Postfix) with ESMTP id 7A0B38FC14; Thu, 25 Feb 2010 03:56:17 +0000 (UTC) MIME-version: 1.0 Content-transfer-encoding: 7BIT Content-type: text/plain; CHARSET=US-ASCII; format=flowed Received: from avs-daemon.smtpauth2.wiscmail.wisc.edu by smtpauth2.wiscmail.wisc.edu (Sun Java(tm) System Messaging Server 7u2-7.05 32bit (built Jul 30 2009)) id <0KYD00D00PLS4Y00@smtpauth2.wiscmail.wisc.edu>; Wed, 24 Feb 2010 21:56:16 -0600 (CST) Received: from comporellon.tachypleus.net (adsl-76-233-146-74.dsl.mdsnwi.sbcglobal.net [76.233.146.74]) by smtpauth2.wiscmail.wisc.edu (Sun Java(tm) System Messaging Server 7u2-7.05 32bit (built Jul 30 2009)) with ESMTPSA id <0KYD007SYPLQWH10@smtpauth2.wiscmail.wisc.edu>; Wed, 24 Feb 2010 21:56:15 -0600 (CST) Date: Wed, 24 Feb 2010 21:56:13 -0600 From: Nathan Whitehorn In-reply-to: <201002250353.o1P3rLxX095091@svn.freebsd.org> To: Nathan Whitehorn Message-id: <4B85F4DD.7040400@freebsd.org> X-Spam-Report: AuthenticatedSender=yes, SenderIP=76.233.146.74 X-Spam-PmxInfo: Server=avs-14, Version=5.5.5.374460, Antispam-Engine: 2.7.1.369594, Antispam-Data: 2010.2.25.33930, SenderIP=76.233.146.74 References: <201002250353.o1P3rLxX095091@svn.freebsd.org> User-Agent: Thunderbird 2.0.0.23 (X11/20100206) Cc: svn-src-head@freebsd.org, svn-src-all@freebsd.org, src-committers@freebsd.org Subject: Re: svn commit: r204297 - head/sys/powerpc/aim X-BeenThere: svn-src-head@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: SVN commit messages for the src tree for head/-current List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 25 Feb 2010 03:56:17 -0000 I can't seem to type the correct words tonight. This should have read: Move the OEA64 scratchpage to the end of KVA from the beginning, and set its PVO to map physical address 0 instead of kernelstart. This fixes a situation in which a user process could attempt to read this address via KVM, have it fault while being modified, and then panic the kernel because (a) it is supposed to map a valid address and (b) it lies in the no-fault region between VM_MIN_KERNEL_ADDRESS and virtual_avail. While here, move msgbuf and dpcpu back into regular KVA space for consistency with other implementations. -Nathan Nathan Whitehorn wrote: > Author: nwhitehorn > Date: Thu Feb 25 03:53:21 2010 > New Revision: 204297 > URL: http://svn.freebsd.org/changeset/base/204297 > > Log: > Move the OEA64 scratchpage to the end of KVA from the beginning, and set > its PVO to map physical address 0 instead of kernelstart. This fixes a > situation in which a user process could attempt to return this address > via KVM, have it fault while being modified, and then panic the kernel > because (a) it is supposed to map a valid address and (b) it lies in the > no-fault region between VM_MIN_KERNEL_ADDRESS and virtual_avail. > > While here, move msgbuf and dpcpu make into regular KVA space for > consistency with other implementations. > > Modified: > head/sys/powerpc/aim/mmu_oea64.c > > Modified: head/sys/powerpc/aim/mmu_oea64.c > ============================================================================== > --- head/sys/powerpc/aim/mmu_oea64.c Thu Feb 25 03:49:17 2010 (r204296) > +++ head/sys/powerpc/aim/mmu_oea64.c Thu Feb 25 03:53:21 2010 (r204297) > @@ -970,10 +970,10 @@ moea64_bridge_bootstrap(mmu_t mmup, vm_o > > mtx_init(&moea64_scratchpage_mtx, "pvo zero page", NULL, MTX_DEF); > for (i = 0; i < 2; i++) { > - moea64_scratchpage_va[i] = virtual_avail; > - virtual_avail += PAGE_SIZE; > + moea64_scratchpage_va[i] = (virtual_end+1) - PAGE_SIZE; > + virtual_end -= PAGE_SIZE; > > - moea64_kenter(mmup,moea64_scratchpage_va[i],kernelstart); > + moea64_kenter(mmup,moea64_scratchpage_va[i],0); > > LOCK_TABLE(); > moea64_scratchpage_pvo[i] = moea64_pvo_find_va(kernel_pmap, > @@ -1004,20 +1004,25 @@ moea64_bridge_bootstrap(mmu_t mmup, vm_o > * Allocate virtual address space for the message buffer. > */ > pa = msgbuf_phys = moea64_bootstrap_alloc(MSGBUF_SIZE, PAGE_SIZE); > - msgbufp = (struct msgbuf *)msgbuf_phys; > - while (pa - msgbuf_phys < MSGBUF_SIZE) { > - moea64_kenter(mmup, pa, pa); > + msgbufp = (struct msgbuf *)virtual_avail; > + va = virtual_avail; > + virtual_avail += round_page(MSGBUF_SIZE); > + while (va < virtual_avail) { > + moea64_kenter(mmup, va, pa); > pa += PAGE_SIZE; > + va += PAGE_SIZE; > } > > /* > * Allocate virtual address space for the dynamic percpu area. > */ > pa = moea64_bootstrap_alloc(DPCPU_SIZE, PAGE_SIZE); > - dpcpu = (void *)pa; > - while (pa - (vm_offset_t)dpcpu < DPCPU_SIZE) { > - moea64_kenter(mmup, pa, pa); > + dpcpu = (void *)virtual_avail; > + virtual_avail += DPCPU_SIZE; > + while (va < virtual_avail) { > + moea64_kenter(mmup, va, pa); > pa += PAGE_SIZE; > + va += PAGE_SIZE; > } > dpcpu_init(dpcpu, 0); > } >