From nobody Mon Sep 21 07:31:42 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4hpFKV68d4z6tPyT for ; Mon, 21 Sep 2026 07:31:42 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR2" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4hpFKV53fTz4fWq for ; Mon, 21 Sep 2026 07:31:42 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1789975902; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=7Da7LoCmOYp+CoMwMPNidqDbaLUFgfjPYyKo/AoBkPk=; b=a0n1UXFUCvOrf4gDDBMoouI426HDGXCH9ZirKarc0kbgCZz8NqyiS5R1HDZfxFPRMDnbOV nDOgRN5FHpgjDOJI3p/HRoGi1Lq/bkhUwTPJbOeGreJHzldxPQd9Oxko2zkuo84sTlJ/iU ZyuphRWDcRCuCR4Liw5neIFzomyIqnrorvMUbue9gpXaUwbxfsLdtz+1hl7I+aPFfgh79S Umnm3oD8YfnZR6gyHwIp2OZ9sYn/23K2ITdLnbblm7v36ghnbJC3CUYdzsbtRTmRnVaOKC 1+IiSmkhXxnrYiCrUeWoABsPqIqNX+0Hc5oybVYUmyobx+UQYBxcFEiHrtOwjA== ARC-Seal: i=1; a=rsa-sha256; d=freebsd.org; s=dkim; cv=none; t=1789975902; b=hg2NWRIStKnvAGWdwEMbqDp1lUTL1uQMizJ4fiyzi48B7mg0ifHAhHH5SK15x65yAOxPqK wVnmrWdxNU3sjsYjyxfBxgvn2kXujgBOfzGuUSmfsPRy+uLxJ0neGIaNwRLYVs2j1HvsRe 2Q4V9pZb8qZpeQUwU5MqQJuETNIAg4QI90xX33AJrVfE9c3w4++tp+gqES/Cyo6E+anvNe 5JapuHXF0DhZ1WjnYNzpJMQ+FBJ8tZ7R0ag5gA6JOrLyb94Fzql4GsbXyNBNEufk+z0Mn3 McSX49rvtwBxkfK0OPdVRaDHI3xckzGcgDGNfa0Y0Qx3xqw9VB4J0edQODWPAw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1789975902; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=7Da7LoCmOYp+CoMwMPNidqDbaLUFgfjPYyKo/AoBkPk=; b=ohODojqX0VsmRNnOBRV+vegGUlzJCihz3gjUeOaMoV+is+HGhSLIMLiyc2qyGZmcGkccfm wsEb71hJhvE3s1DyG4MmgBPAFVckgIDjfciA7Iy176NDDHcfsI3vBLiHrCkwIkniJ7Kx0q /8x4z/W67EfMiEz8SvHkzRBPL1yjji/cVIkEvFFr8tQ54zOTZeUEc9QYKi/9nA9tKmGdH9 k3N6pX3P0Bewnug2BtpZp9LrPBq87doxUf050129jQBU6an4Yg5jZpwoUb+NnNMGxhqCkR idJa2ii1uQtTqnu1feZfF2c6Q4V63nNn6h1FllUWot94MZC4+CnHhXFftjbZNw== ARC-Authentication-Results: i=1; mx1.freebsd.org; none Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4hpFKV3sXzz19Zq for ; Mon, 21 Sep 2026 07:31:42 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 46409 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Mon, 21 Sep 2026 07:31:42 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Piotr Kubaj Subject: git: e77d5a7d20eb - stable/15 - powerpc/radix: acquire the pmap lock in mmu_radix_extract() List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: pkubaj X-Git-Repository: src X-Git-Refname: refs/heads/stable/15 X-Git-Reftype: branch X-Git-Commit: e77d5a7d20ebc2f9b62cea03ffab60bc20de6c9c Auto-Submitted: auto-generated Date: Mon, 21 Sep 2026 07:31:42 +0000 Message-Id: <6ab0dd5e.46409.2390195d@gitrepo.freebsd.org> The branch stable/15 has been updated by pkubaj: URL: https://cgit.FreeBSD.org/src/commit/?id=e77d5a7d20ebc2f9b62cea03ffab60bc20de6c9c commit e77d5a7d20ebc2f9b62cea03ffab60bc20de6c9c Author: Piotr Kubaj AuthorDate: 2026-09-14 13:13:51 +0000 Commit: Piotr Kubaj CommitDate: 2026-09-21 07:31:36 +0000 powerpc/radix: acquire the pmap lock in mmu_radix_extract() mmu_radix_extract() walks the page tables without holding the pmap lock, unlike its hash MMU counterpart moea64_extract(). A concurrent unmap can free and recycle the page table page being walked, so the read returns whatever now occupies that memory and the caller gets a physical address that never existed. That is how mmu_radix_sync_icache() came to hand a bogus address to __syncicache() and panic the machine. Commit 1574ca1955f5 worked around it by taking the pmap lock in mmu_radix_sync_icache(), but the machine independent callers of pmap_extract() - vm_sync_icache(), proc_rwmem() and the vslock() paths - remain exposed to the same failure. Rename the existing body to mmu_radix_extract_locked(), which asserts the lock, and make mmu_radix_extract() a thin wrapper that acquires it. mmu_radix_sync_icache() already holds the pmap lock, so it calls the locked variant directly and neither recurses nor reacquires the lock once per page. Suggested by: alc MFC after: 1 week Differential Revision: https://reviews.freebsd.org/D59320 Reviewed by: markj, jhibbits (cherry picked from commit 42c69445ca336b13e27e3e5960ace344c64ae0eb) --- sys/powerpc/aim/mmu_radix.c | 20 +++++++++++++++----- 1 file changed, 15 insertions(+), 5 deletions(-) diff --git a/sys/powerpc/aim/mmu_radix.c b/sys/powerpc/aim/mmu_radix.c index e54fdbb80933..dce3103e087d 100644 --- a/sys/powerpc/aim/mmu_radix.c +++ b/sys/powerpc/aim/mmu_radix.c @@ -3498,19 +3498,19 @@ mmu_radix_enter_quick(pmap_t pmap, vm_offset_t va, vm_page_t m, PMAP_UNLOCK(pmap); } -vm_paddr_t -mmu_radix_extract(pmap_t pmap, vm_offset_t va) +static vm_paddr_t +mmu_radix_extract_locked(pmap_t pmap, vm_offset_t va) { pml3_entry_t *l3e; pt_entry_t *pte; vm_paddr_t pa; + PMAP_LOCK_ASSERT(pmap, MA_OWNED); l3e = pmap_pml3e(pmap, va); if (__predict_false(l3e == NULL)) return (0); if (be64toh(*l3e) & RPTE_LEAF) { pa = (be64toh(*l3e) & PG_PS_FRAME) | (va & L3_PAGE_MASK); - pa |= (va & L3_PAGE_MASK); } else { /* * Beware of a concurrent promotion that changes the @@ -3525,11 +3525,21 @@ mmu_radix_extract(pmap_t pmap, vm_offset_t va) return (0); pa = be64toh(*pte); pa = (pa & PG_FRAME) | (va & PAGE_MASK); - pa |= (va & PAGE_MASK); } return (pa); } +vm_paddr_t +mmu_radix_extract(pmap_t pmap, vm_offset_t va) +{ + vm_paddr_t pa; + + PMAP_LOCK(pmap); + pa = mmu_radix_extract_locked(pmap, va); + PMAP_UNLOCK(pmap); + return (pa); +} + vm_page_t mmu_radix_extract_and_hold(pmap_t pmap, vm_offset_t va, vm_prot_t prot) { @@ -5987,7 +5997,7 @@ mmu_radix_sync_icache(pmap_t pm, vm_offset_t va, vm_size_t sz) PMAP_LOCK(pm); while (sz > 0) { - pa = pmap_extract(pm, va); + pa = mmu_radix_extract_locked(pm, va); sync_sz = PAGE_SIZE - (va & PAGE_MASK); sync_sz = min(sync_sz, sz); if (pa != 0) {