[Bug 266103] ioctl(/dev/mem, MEM_EXTRACT_PADDR, <0x80000000>) on /dev/mem on riscv64 panics

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=266103

            Bug ID: 266103
           Summary: ioctl(/dev/mem, MEM_EXTRACT_PADDR, <0x80000000>) on
                    /dev/mem on riscv64 panics
           Product: Base System
           Version: CURRENT
          Hardware: riscv
                OS: Any
            Status: New
          Severity: Affects Some People
          Priority: ---
         Component: riscv
          Assignee: riscv@FreeBSD.org
          Reporter: rtm@lcs.mit.edu

On qemu riscv64, the program below causes "panic: pmap_l2_to_l3: PA
out of range, PA: 0x0" on an INVARIANTS kernel, and a kernel page
fault without INVARIANTS. The immediate problem seems to be that the
l2 PTE that pmap_extract() finds is all zeroes, but pmap_l2_to_l3()
assumes it contains a valid physical address.

#include <sys/ioctl.h>
#include <unistd.h>
#include <string.h>
#include <fcntl.h>
#include <sys/memrange.h>
int
main() {
  int fd = open("/dev/mem", 2);
  struct mem_extract m;
  memset(&m, 0, sizeof(m));
  m.me_vaddr = 0x80000000;
  ioctl(fd, MEM_EXTRACT_PADDR, &m);
}

# uname -a
FreeBSD  14.0-CURRENT FreeBSD 14.0-CURRENT #40 main-n250928-b8170f38ccc7-dirty:
Mon Aug 29 13:09:55 EDT 2022    
rtm@xxx:/usr/obj/usr/rtm/symbsd/src/riscv.riscv64/sys/RTM riscv
# cc x.c
# ./a.out
panic: Fatal page fault at 0xffffffc000618a18: 0xffffffcf80000000
panic() at panic+0x2a
page_fault_handler() at page_fault_handler+0x1d6
do_trap_supervisor() at do_trap_supervisor+0x76
cpu_exception_handler_supervisor() at cpu_exception_handler_supervisor+0x70
--- exception 13, tval = 0xffffffcf80000000
pmap_extract() at pmap_extract+0x64
memioctl() at memioctl+0x78
devfs_ioctl() at devfs_ioctl+0xbe
VOP_IOCTL_APV() at VOP_IOCTL_APV+0x30
VOP_IOCTL() at VOP_IOCTL+0x36
vn_ioctl() at vn_ioctl+0xba
devfs_ioctl_f() at devfs_ioctl_f+0x20
fo_ioctl() at fo_ioctl+0xa
kern_ioctl() at kern_ioctl+0x242
sys_ioctl() at sys_ioctl+0x120
syscallenter() at syscallenter+0xec
ecall_handler() at ecall_handler+0x18
do_trap_user() at do_trap_user+0xea
cpu_exception_handler_user() at cpu_exception_handler_user+0x72

-- 
You are receiving this mail because:
You are the assignee for the bug.