From nobody Mon Sep 14 13:15:57 2026 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4hk5JF1NZ5z6sYnG for ; Mon, 14 Sep 2026 13:16:13 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR2" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4hk5JF0JSRz4F5H for ; Mon, 14 Sep 2026 13:16:13 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1789391773; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=8+9LomeR/Ma9V1snfGEwDmgsy7cN6ohvbsZZP7klbfQ=; b=P41MV7nsHUbIXqCh8IwowK0ijrTuaJHLH24gCtapDea3xvWPy7ucGd9rbhTcZFh/sHV1Q2 RI99OgD1UqmphW3sEtXeCEtV+sBIn8Rn4rv0paGdmAfhPEOxLL03L1s2HUwXZ/Nl2hyFSC 3LgeR9utihE+wlP9nupZiA2DmRtJvc9vrWFUO8/M9xVFjF8VVwT97a9Si+j1UHp2QDVcCE ZIGQfGO5LorKXHhoL5p5Is6PGQ0u8rqmuupemoLu+5BBOYEzFLmO2jOV+VAxlGbHWH/JrI P+iVMny8pGtmnqa/ATFLvuXCoDW91Fv0qbxv7ky6M8ihxv1nCmpEVWpuLvNVbw== ARC-Seal: i=1; a=rsa-sha256; d=freebsd.org; s=dkim; cv=none; t=1789391773; b=x3vNykxudZnyo0UG9jb5iFyrRMWz3Mm/SJw1ozybR0prQtYOvFQhOZhMn+QMKPTneIleXE ZrNaPclHfHiTV/QMq90FbT1u0aUZ6nUR7eyueGCxh/6RV3x5cnNgOYnJz9cMYV6JO12bHq OX0J8JdROHsj7kwFhQAzFYgPgtGpgmJUp2JXMfPmJeypyo/gs3XRCgxH6DEFgd1OJyxx1b aUN+NCG6FAs555kAPwb9fM2AtMb8Yg+LCjWCH6UrQFVeg1DgpCxHwg/9TZcKV1Z9MCRgBo xX4wTpH2pVD80onEIXYDSnF6ltydxYBWJUhKoVm2xqjJW3Ev1JqgBl5y5zW5Yg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1789391773; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=8+9LomeR/Ma9V1snfGEwDmgsy7cN6ohvbsZZP7klbfQ=; b=QZPoQ0rffsIrIVYOz54rgbgQ7Z5YefnyVEP7R4x+/LjaLVhbCkTyLtcUqX0JgccECf1klM XMLC+u9EUZSgAUHoTLxli+3IRCp2JhY0UcHhHNJ5sW52p+Ix4dBdg8Rd0tXTW2OTLDTSk6 zlO0Vg8ZexVpgWefzIDJUR6s9v26ttHzLG5YMld0Z/psNDBV7lBLQ4m1Fy7QCv3Fqw1RPW Vsa+OUAeS6Q4AhppBpppqcyHm8mXk/DGl6Xd3vigPl5xp5RXflUxTZUf8Y92U1cJ04htgW GIZVeRtmfMv789vnWmBPytFk3VeH0YH6zWXjpqc68RtYdJF6zW2qTvONlpQo8A== ARC-Authentication-Results: i=1; mx1.freebsd.org; none Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4hk5JD6ShczDvL for ; Mon, 14 Sep 2026 13:16:12 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 21bd9 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Mon, 14 Sep 2026 13:15:57 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org From: Piotr Kubaj Subject: git: 42c69445ca33 - main - powerpc/radix: acquire the pmap lock in mmu_radix_extract() List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: pkubaj X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: 42c69445ca336b13e27e3e5960ace344c64ae0eb Auto-Submitted: auto-generated Date: Mon, 14 Sep 2026 13:15:57 +0000 Message-Id: <6aa7f38d.21bd9.2e904f50@gitrepo.freebsd.org> The branch main has been updated by pkubaj: URL: https://cgit.FreeBSD.org/src/commit/?id=42c69445ca336b13e27e3e5960ace344c64ae0eb commit 42c69445ca336b13e27e3e5960ace344c64ae0eb Author: Piotr Kubaj AuthorDate: 2026-09-14 13:13:51 +0000 Commit: Piotr Kubaj CommitDate: 2026-09-14 13:15:48 +0000 powerpc/radix: acquire the pmap lock in mmu_radix_extract() mmu_radix_extract() walks the page tables without holding the pmap lock, unlike its hash MMU counterpart moea64_extract(). A concurrent unmap can free and recycle the page table page being walked, so the read returns whatever now occupies that memory and the caller gets a physical address that never existed. That is how mmu_radix_sync_icache() came to hand a bogus address to __syncicache() and panic the machine. Commit 1574ca1955f5 worked around it by taking the pmap lock in mmu_radix_sync_icache(), but the machine independent callers of pmap_extract() - vm_sync_icache(), proc_rwmem() and the vslock() paths - remain exposed to the same failure. Rename the existing body to mmu_radix_extract_locked(), which asserts the lock, and make mmu_radix_extract() a thin wrapper that acquires it. mmu_radix_sync_icache() already holds the pmap lock, so it calls the locked variant directly and neither recurses nor reacquires the lock once per page. Suggested by: alc MFC after: 1 week Differential Revision: https://reviews.freebsd.org/D59320 Reviewed by: markj, jhibbits --- sys/powerpc/aim/mmu_radix.c | 20 +++++++++++++++----- 1 file changed, 15 insertions(+), 5 deletions(-) diff --git a/sys/powerpc/aim/mmu_radix.c b/sys/powerpc/aim/mmu_radix.c index 0d958f0ebc5e..7d456a587d29 100644 --- a/sys/powerpc/aim/mmu_radix.c +++ b/sys/powerpc/aim/mmu_radix.c @@ -3492,19 +3492,19 @@ mmu_radix_enter_quick(pmap_t pmap, vm_offset_t va, vm_page_t m, PMAP_UNLOCK(pmap); } -vm_paddr_t -mmu_radix_extract(pmap_t pmap, vm_offset_t va) +static vm_paddr_t +mmu_radix_extract_locked(pmap_t pmap, vm_offset_t va) { pml3_entry_t *l3e; pt_entry_t *pte; vm_paddr_t pa; + PMAP_LOCK_ASSERT(pmap, MA_OWNED); l3e = pmap_pml3e(pmap, va); if (__predict_false(l3e == NULL)) return (0); if (be64toh(*l3e) & RPTE_LEAF) { pa = (be64toh(*l3e) & PG_PS_FRAME) | (va & L3_PAGE_MASK); - pa |= (va & L3_PAGE_MASK); } else { /* * Beware of a concurrent promotion that changes the @@ -3519,11 +3519,21 @@ mmu_radix_extract(pmap_t pmap, vm_offset_t va) return (0); pa = be64toh(*pte); pa = (pa & PG_FRAME) | (va & PAGE_MASK); - pa |= (va & PAGE_MASK); } return (pa); } +vm_paddr_t +mmu_radix_extract(pmap_t pmap, vm_offset_t va) +{ + vm_paddr_t pa; + + PMAP_LOCK(pmap); + pa = mmu_radix_extract_locked(pmap, va); + PMAP_UNLOCK(pmap); + return (pa); +} + vm_page_t mmu_radix_extract_and_hold(pmap_t pmap, vm_offset_t va, vm_prot_t prot) { @@ -5980,7 +5990,7 @@ mmu_radix_sync_icache(pmap_t pm, vm_offset_t va, vm_size_t sz) PMAP_LOCK(pm); while (sz > 0) { - pa = pmap_extract(pm, va); + pa = mmu_radix_extract_locked(pm, va); sync_sz = PAGE_SIZE - (va & PAGE_MASK); sync_sz = min(sync_sz, sz); if (pa != 0) {