From nobody Mon Sep 21 08:04:06 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4hpG2v0nVdz6tRKb for ; Mon, 21 Sep 2026 08:04:07 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR2" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4hpG2t6l4Mz4k7y for ; Mon, 21 Sep 2026 08:04:06 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1789977847; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=YnAPix4gFf2KHnouJmhpvW17tOXOHc8iMu91sIEWhFY=; b=N2KpMVsBz/NDvYjPDNHlDfBWaYH712fOgS1SUoxuviznA8S9vqE3eWDKQ9O3HtouTA4VZC 8OB20M5169HS/h5ZBMGsIltRgzsllQ39eLxg47Ra2HHraCg/VTu1X9kLENZaWHQO0XuO6q oSvLnuIw/e4dAbsFTtcyZmWZviyP4LRSoxEkTT7PD3MZfmL2ErVHGGVvLThs1DzQi8of9A TuD78e+x3K8bIomJOB+WAw+PxZb5FjdScHptQ9wpv+z61Hbye2f6f+PjRotjpQeVqkC356 DpeLI7m/2t4yeT0m6Vi+XmjkWvFg2V1clVD4f79IfUHZ8SXnyn2NUev8Zpvk2Q== ARC-Seal: i=1; a=rsa-sha256; d=freebsd.org; s=dkim; cv=none; t=1789977847; b=vST6j7ZB4ekANiMmUOCT+pj/kkRU/jCsX2PWQZwDpx8yVHWlQVjkm6YGLDRVhf6qkWL3+g mpQQRrzbQsQnXesRNDPXrHWpc6leADDI25JNO0R8+tFLipkbWdR6rwin+zQWkh1RSOd34o MVL5ceiQmYJQZAV+0xQRg5xsRvpKoGiNdDgvP3SZw5w59YC1lFkrzpxAjBNO0t1xgBO00k uvTyCme0GHq6vH6VxOpd8sIABgrE7xGQir/RLBsfKh9rzomX8xdF/QKvEdcLj5TnOJZmxS 6rRPe8aw6IpqvlAb3vAsoUGEtmOjWm/8dIUn/cgM/hEl/ueXwRUyEp8San2afg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1789977847; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=YnAPix4gFf2KHnouJmhpvW17tOXOHc8iMu91sIEWhFY=; b=Q5vDH8w6U7UIkuxFsxFrv2mRUMs4H6CcDZwccuu88sALFtm6yUrAmxwDZcP6DXC7L4qKjb BxrxkKmQUNuyYKPffAh1TVGXBCq97IN/zwy9rdtdBf1vqlZuLpcVER71YnGPBrc0EAKbxj d0HH1t+FwNTZfYjDD4eYf8wP09AZ2O99ZLCv9RTMOM+BOalQQ431Bl0kY7V/69apNKzWZ+ pLun62PZO3HD7aQVRPAs5BBELdsVPULxTdW7RqHwit0pY29pvk/YBrvqqvEC+zLXAYwkqj tjwhX1oV/wCE4C7uoI12m43gd6q3ZrPw3mHKwNXXR3r/6RFMS39X3kZru4M9TQ== ARC-Authentication-Results: i=1; mx1.freebsd.org; none Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4hpG2t5VPpz1BZj for ; Mon, 21 Sep 2026 08:04:06 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 4607d by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Mon, 21 Sep 2026 08:04:06 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Piotr Kubaj Subject: git: deb4c7369349 - stable/14 - powerpc/radix: acquire the pmap lock in mmu_radix_extract() List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: pkubaj X-Git-Repository: src X-Git-Refname: refs/heads/stable/14 X-Git-Reftype: branch X-Git-Commit: deb4c7369349646b9439ecacb3929e295060909c Auto-Submitted: auto-generated Date: Mon, 21 Sep 2026 08:04:06 +0000 Message-Id: <6ab0e4f6.4607d.4c4ba8dc@gitrepo.freebsd.org> The branch stable/14 has been updated by pkubaj: URL: https://cgit.FreeBSD.org/src/commit/?id=deb4c7369349646b9439ecacb3929e295060909c commit deb4c7369349646b9439ecacb3929e295060909c Author: Piotr Kubaj AuthorDate: 2026-09-14 13:13:51 +0000 Commit: Piotr Kubaj CommitDate: 2026-09-21 07:52:32 +0000 powerpc/radix: acquire the pmap lock in mmu_radix_extract() mmu_radix_extract() walks the page tables without holding the pmap lock, unlike its hash MMU counterpart moea64_extract(). A concurrent unmap can free and recycle the page table page being walked, so the read returns whatever now occupies that memory and the caller gets a physical address that never existed. That is how mmu_radix_sync_icache() came to hand a bogus address to __syncicache() and panic the machine. Commit 1574ca1955f5 worked around it by taking the pmap lock in mmu_radix_sync_icache(), but the machine independent callers of pmap_extract() - vm_sync_icache(), proc_rwmem() and the vslock() paths - remain exposed to the same failure. Rename the existing body to mmu_radix_extract_locked(), which asserts the lock, and make mmu_radix_extract() a thin wrapper that acquires it. mmu_radix_sync_icache() already holds the pmap lock, so it calls the locked variant directly and neither recurses nor reacquires the lock once per page. Suggested by: alc MFC after: 1 week Differential Revision: https://reviews.freebsd.org/D59320 Reviewed by: markj, jhibbits (cherry picked from commit 42c69445ca336b13e27e3e5960ace344c64ae0eb) --- sys/powerpc/aim/mmu_radix.c | 20 +++++++++++++++----- 1 file changed, 15 insertions(+), 5 deletions(-) diff --git a/sys/powerpc/aim/mmu_radix.c b/sys/powerpc/aim/mmu_radix.c index 089b4af6bd93..f762e8db0afc 100644 --- a/sys/powerpc/aim/mmu_radix.c +++ b/sys/powerpc/aim/mmu_radix.c @@ -3450,19 +3450,19 @@ mmu_radix_enter_quick(pmap_t pmap, vm_offset_t va, vm_page_t m, PMAP_UNLOCK(pmap); } -vm_paddr_t -mmu_radix_extract(pmap_t pmap, vm_offset_t va) +static vm_paddr_t +mmu_radix_extract_locked(pmap_t pmap, vm_offset_t va) { pml3_entry_t *l3e; pt_entry_t *pte; vm_paddr_t pa; + PMAP_LOCK_ASSERT(pmap, MA_OWNED); l3e = pmap_pml3e(pmap, va); if (__predict_false(l3e == NULL)) return (0); if (be64toh(*l3e) & RPTE_LEAF) { pa = (be64toh(*l3e) & PG_PS_FRAME) | (va & L3_PAGE_MASK); - pa |= (va & L3_PAGE_MASK); } else { /* * Beware of a concurrent promotion that changes the @@ -3477,11 +3477,21 @@ mmu_radix_extract(pmap_t pmap, vm_offset_t va) return (0); pa = be64toh(*pte); pa = (pa & PG_FRAME) | (va & PAGE_MASK); - pa |= (va & PAGE_MASK); } return (pa); } +vm_paddr_t +mmu_radix_extract(pmap_t pmap, vm_offset_t va) +{ + vm_paddr_t pa; + + PMAP_LOCK(pmap); + pa = mmu_radix_extract_locked(pmap, va); + PMAP_UNLOCK(pmap); + return (pa); +} + vm_page_t mmu_radix_extract_and_hold(pmap_t pmap, vm_offset_t va, vm_prot_t prot) { @@ -5938,7 +5948,7 @@ mmu_radix_sync_icache(pmap_t pm, vm_offset_t va, vm_size_t sz) PMAP_LOCK(pm); while (sz > 0) { - pa = pmap_extract(pm, va); + pa = mmu_radix_extract_locked(pm, va); sync_sz = PAGE_SIZE - (va & PAGE_MASK); sync_sz = min(sync_sz, sz); if (pa != 0) {