From nobody Sun Oct 18 17:15:05 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4j75094M4mz6w4ZL for ; Sun, 18 Oct 2026 17:15:05 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by mx1.freebsd.org (Postfix) with ESMTPS id 4j75093Y2Cz4PwY for ; Sun, 18 Oct 2026 17:15:05 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1792343705; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=okAUv/zarXvGPLaP8ngA4a3iJcRZVkfvjSphlDCjcwY=; b=V+nMfpn3eNQMCLRzCJOE5qByqBpElOJJAj5cp0GpVjkKFKFJTBocAcc6andpe6FL+zchW7 /KDyweoX0+baUYMy4Wgq+kHPEyxruKHgVZ9rb3Av1pETavkNHZBUbogKbvXQPFFS7kTVnK 7tu/UdjfyJBay4nB7s8XDoghXYYjVFV6F9wIfA3CbN46Jhj4YxJOJhT+fci9golReb3EGV lMr3m0hz24+mCPjhew0uo9UgBuaFCPhdwXg8geGtH2D8YtLrGnOt6EoSbY5xRPOOW8mikV 8nxVtLYchDCHnl4xARioAdRwazvEpHoapk/eB9Y4bjU2Lg6wXWZXDcdaNY/NxQ== ARC-Seal: i=1; a=rsa-sha256; d=freebsd.org; s=dkim; cv=none; t=1792343705; b=El6zXUGMNhXBo9ZZcX8kpCLvQVtRaGko7xOoxiGVQY7HKC05cYm7ZksPuvLzlaHViDOVIj jXEYwzmMhT7Qz+6ZWziGLA5BucTchmIHaGzV/D9/dzG2O1MTaqxSwiLd0e59pHraW72Ddg Vd8lTRgaTbe5O+lI+XWB4GJRg1TMRlAYGVdxB8Q+0zVQRWBeE01c5XwMBhP6x90U2z+stb 9KqeFoww8opnjhJtAhTTz0nTHrx0eBXEJoLnyJN0H5M1VHvE42iKCCBJ8A3ZncdIBJpCCt tpVSsSJpUJrRuk38AvqkM2nOoIu33AkNX0K2Gq+f1ZgGSPK1Ttvvz9DjiT6m+Q== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1792343705; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=okAUv/zarXvGPLaP8ngA4a3iJcRZVkfvjSphlDCjcwY=; b=NmcjQjLDIIeuOM3I+JP7Lv8537A6moRMCZY3Phuk1hYKWIFzxjghiYsbcvwjEUdpczx4wF 2+0P+5QAjkmXl35eXbS29yGsXcWUPvc3GnMmEHiF/2Ur7FQPCSo7ZZCMRNHBNoCwCNix0I mQbmZN7wMZpbyLCWoCjBV2HpGVbXjuqUfGEMKftexVqEt6D5L/C6JffOLaAahgAgJlkgS7 cF3SAeR4XjFMqzQRfDQTsqQhjRlXvWPM8HwGAaKqCLHi0X+YT0gzLU5yNdHuNzw15d3IwS JA7XHfRp6RE6AQKsUZF9Lq2KQZ8Px0dGau2jd0UoUqkwAgjovY5dNFjtsoPh/Q== ARC-Authentication-Results: i=1; mx1.freebsd.org; none Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4j750933Ttz10Gc for ; Sun, 18 Oct 2026 17:15:05 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 1e1e6 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Sun, 18 Oct 2026 17:15:05 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Alan Cox Subject: git: dbec277b5f70 - stable/15 - arm64 pmap: correct the condition for flushing the icache List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: Commits to the stable branches of the FreeBSD src repository List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: alc X-Git-Repository: src X-Git-Refname: refs/heads/stable/15 X-Git-Reftype: branch X-Git-Commit: dbec277b5f70339a24e54376eef91953e021957c Auto-Submitted: auto-generated Date: Sun, 18 Oct 2026 17:15:05 +0000 Message-Id: <6ad4fe99.1e1e6.2c8c1093@gitrepo.freebsd.org> The branch stable/15 has been updated by alc: URL: https://cgit.FreeBSD.org/src/commit/?id=dbec277b5f70339a24e54376eef91953e021957c commit dbec277b5f70339a24e54376eef91953e021957c Author: Alan Cox AuthorDate: 2026-08-29 07:08:01 +0000 Commit: Alan Cox CommitDate: 2026-10-18 16:48:58 +0000 arm64 pmap: correct the condition for flushing the icache Whenever we create a user-space mapping, we always set ATTR_S1_PXN in the PTE, which blocks execution of user-space code while running in kernel mode. However, when seeking to determine whether we need to perform an icache flush before installing the new PTE, we test whether sometimes the old PTE or other times the new PTE has ATTR_S1_XN set. The trouble is that ATTR_S1_XN is defined as the bitwise OR of ATTR_S1_PXN and ATTR_S1_UXN, and so the test for whether ATTR_S1_XN is set is satisfied if either of its constituent bits is set, i.e., we write (l3e & ATTR_S1_XN) != 0. Consequently, the test is always true. In practice, I believe that the ill effects of this bug are limited: In pmap_enter(), in rare circumstances, e.g., wiring a code page, an unnecessary icache flush will be performed. In pmap_enter_l2() and pmap_enter_l3c(), no icache flush will be performed. However, typically an icache flush would have already been performed on each of the constituent base pages. (cherry picked from commit 57407179be431dbe567de083aab5ce152163f4d3) --- sys/arm64/arm64/pmap.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/sys/arm64/arm64/pmap.c b/sys/arm64/arm64/pmap.c index 12ab8750c77a..753184574c09 100644 --- a/sys/arm64/arm64/pmap.c +++ b/sys/arm64/arm64/pmap.c @@ -5686,7 +5686,7 @@ validate: */ if ((prot & VM_PROT_EXECUTE) && pmap != kernel_pmap && m->md.pv_memattr == VM_MEMATTR_WRITE_BACK && - (opa != pa || (orig_l3 & ATTR_S1_XN))) { + (opa != pa || (orig_l3 & ATTR_S1_UXN) != 0)) { PMAP_ASSERT_STAGE1(pmap); cpu_icache_sync_range((void *)PHYS_TO_DMAP(pa), PAGE_SIZE); @@ -5996,8 +5996,8 @@ pmap_enter_l2(pmap_t pmap, vm_offset_t va, pd_entry_t new_l2, u_int flags, /* * Conditionally sync the icache. See pmap_enter() for details. */ - if ((new_l2 & ATTR_S1_XN) == 0 && (PTE_TO_PHYS(new_l2) != - PTE_TO_PHYS(old_l2) || (old_l2 & ATTR_S1_XN) != 0) && + if ((new_l2 & ATTR_S1_UXN) == 0 && (PTE_TO_PHYS(new_l2) != + PTE_TO_PHYS(old_l2) || (old_l2 & ATTR_S1_UXN) != 0) && pmap != kernel_pmap && m->md.pv_memattr == VM_MEMATTR_WRITE_BACK) { cpu_icache_sync_range((void *)PHYS_TO_DMAP(PTE_TO_PHYS(new_l2)), L2_SIZE); @@ -6225,7 +6225,7 @@ have_l3p: /* * Sync the icache before the mapping is stored. */ - if ((l3e & ATTR_S1_XN) == 0 && pmap != kernel_pmap && + if ((l3e & ATTR_S1_UXN) == 0 && pmap != kernel_pmap && m->md.pv_memattr == VM_MEMATTR_WRITE_BACK) cpu_icache_sync_range((void *)PHYS_TO_DMAP(pa), L3C_SIZE);