From nobody Sun Nov 01 21:00:00 2026 X-Original-To: dev-commits-src-main@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4jHnKD2bPBz6xw0R for ; Sun, 01 Nov 2026 21:00:00 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by mx1.freebsd.org (Postfix) with ESMTPS id 4jHnKD24jjz4STq for ; Sun, 01 Nov 2026 21:00:00 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1793566800; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=ZtmBqBsd+IMG0J8A2h7H+HejMM3nkaHVOgFpXHn6qng=; b=CTHCk7kaDAYGRhZpdnkAoKarCu6V768hN5tbujgp5Pk2b2snTGF/RoMtn5iTMao0RYFFmy SCHK45/bNIHjOLrgabc+Sy7Jk03h+p77EDIzfSfJaV35eUVLfUSPNdlAU24MYlrk1HUqZ3 W7ZjDrnlwQnze9ZWSbFNFOOOXNy7O3Au99b7U/ZtLrfCgBMQWOzWktxh2QvaI4p22XGqsF 1wY9//0rN2pI2d4gROefgroe26beCEvCwZR6s+SNtTziQJ1NMlhiGEoG62d9fx/VLh9dGw VRv97BliNYrccGh6qUrvETqryTL7sh/uXLqNM9qZjf0J8vfLTrvjoZtInfs00Q== ARC-Seal: i=1; a=rsa-sha256; d=freebsd.org; s=dkim; cv=none; t=1793566800; b=JSz+JGbXbYy7piFmd2x3uxEl4AkPQE2nV0x7lpwX6I5C/MORfcJuT/YGbYPOEUIYOf8/Y1 S4JRw52n6gSPvXJqSCzjL2URUeL4pW1nMFuCc5sChrHklRa08UzgWTEf6cbNA+cGKK5KRA NQM7kLISRs/qUJu3j4R9AZhibCfCpkri8F+aqKV//wCUZqpYhtI3bIK0+EQnWpBymDb+Ct pkIZ+xSPkDe30wkbZ+xn8OLhF3ZZjSYKXF458gqmM0pM/L5sNtSMnBxsnBFRdpTdvIqdMQ Fi1QLCX5WHkZy5QnG5mvYNoMvwRU1WIfcl98A+sJD9WtrHpWFLQMU0qsCrkk3g== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1793566800; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=ZtmBqBsd+IMG0J8A2h7H+HejMM3nkaHVOgFpXHn6qng=; b=m28dIx0c4M0KbwlgFsF8MpIriOzqPVz9AK9mO9OOT/8KiM+vFw0cQlZtFOK8wKC/cISW5e Mjaq5UMEqjgygzQoOrtUXABfyLSY9cZmmB6PAR1qRr9KOS/T79k8eYUuCKX1dXLtGcF/7S ub6ClzQ4ZObAoYiLjB+Vv856M+nmLEeePH1Jdvlp20CPy3fqNpKoPEqTL14tnLWVxqSHwH S7HQQoLcFVS9TYxSiRrK48Z2xXK3QJ1+4yEfyOlziCk0dRAyD5RKLL8COMVsrrPv3F0pcT Ag3eQVvMo+TfyarCeotkm/jfOs3otLGqW5Fhuxptx9EJ6bS9V9jV/4BoeVo5BQ== ARC-Authentication-Results: i=1; mx1.freebsd.org; none Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4jHnKD1TBQzDrZ for ; Sun, 01 Nov 2026 21:00:00 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 3b015 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Sun, 01 Nov 2026 21:00:00 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org From: Alan Cox Subject: git: 6d7960628f82 - main - arm64 pmap: demote L3C pages in pmap_clear_modify() List-Archive: https://lists.freebsd.org/archives/dev-commits-src-main X-BeenThere: dev-commits-src-main@freebsd.org Sender: owner-dev-commits-src-main@FreeBSD.org List-Id: Commit messages for the main branch of the src repository List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: alc X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: 6d7960628f825f1eec0959d6000a79ca8a4ae927 Auto-Submitted: auto-generated Date: Sun, 01 Nov 2026 21:00:00 +0000 Message-Id: <6ae7a850.3b015.1fd4790e@gitrepo.freebsd.org> The branch main has been updated by alc: URL: https://cgit.FreeBSD.org/src/commit/?id=6d7960628f825f1eec0959d6000a79ca8a4ae927 commit 6d7960628f825f1eec0959d6000a79ca8a4ae927 Author: Alan Cox AuthorDate: 2026-11-01 18:25:05 +0000 Commit: Alan Cox CommitDate: 2026-11-01 20:56:44 +0000 arm64 pmap: demote L3C pages in pmap_clear_modify() When pmap_clear_modify() demotes a dirty L2 block mapping, it write protects the L3 entry that maps "m", so that a subsequent write access may repromote. However, since fd6cb031f577, the L3 entries created by pmap_demote_l2_locked() may have ATTR_CONTIGUOUS set, and pmap_clear_modify() was write protecting one L3 entry within an L3C page while leaving the page's other L3 entries writeable with ATTR_CONTIGUOUS still set. A TLB entry that a processor creates from any of those other L3 entries may translate "m"'s virtual address and permit writes to "m" without a fault. To fix this issue, as in pmap_remove_write(), demote the L3C page before write protecting the L3 entry. Found by: Claude Code (Opus 5.5) Fixes: fd6cb031f577 "arm64 pmap: Add ATTR_CONTIGUOUS support [Part 1]" MFC after: 1 week --- sys/arm64/arm64/pmap.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/sys/arm64/arm64/pmap.c b/sys/arm64/arm64/pmap.c index f27ddd379976..6ed49f051ac5 100644 --- a/sys/arm64/arm64/pmap.c +++ b/sys/arm64/arm64/pmap.c @@ -8369,6 +8369,8 @@ restart: */ va += VM_PAGE_TO_PHYS(m) - PTE_TO_PHYS(oldl2); l3 = pmap_l2_to_l3(l2, va); + if ((pmap_load(l3) & ATTR_CONTIGUOUS) != 0) + (void)pmap_demote_l3c(pmap, l3, va); oldl3 = pmap_load(l3); while (!atomic_fcmpset_long(l3, &oldl3, (oldl3 & ~ATTR_SW_DBM) | ATTR_S1_AP(ATTR_S1_AP_RO)))