Module Name: src
Committed By: martin
Date: Sat Jan 7 14:57:55 UTC 2023
Modified Files:
src/sys/arch/m68k/m68k [netbsd-9]: bus_dma.c
Log Message:
Pull up following revision(s) (requested by tsutsui in ticket #1564):
sys/arch/m68k/m68k/bus_dma.c: revision 1.39
Fix out of bounds invalidate (and writeback) in bus_dmamap_sync(9) ops.
Detected by the POOL_REDZONE check in sys/kern/subr_pool.c that
has been activated if options DIAGNOSTIC is enabled on post netbsd-9.
The extra invalidate on DMASYNC_PREREAD op discards redzone pattern
data allocated right after an mbuf cluster without proper writeback
to memory so that it triggers false redzone assertions on freeing mbufs.
This bug was my botch in rev 1.25 committed 15 years ago. (sigh)
Fixes PR/57107 (kernel panic on -current when configuring network
with sn(4) on mac68k), as actually the bus_dma(9) op changes
in the past days were introduced for mac68k sn(4) improvements
by using the MI SONIC (src/sys/dev/ic/dp83932.c) driver.
https://mail-index.netbsd.org/port-mac68k/2007/06/01/0001.html
To generate a diff of this commit:
cvs rdiff -u -r1.35 -r1.35.34.1 src/sys/arch/m68k/m68k/bus_dma.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
Modified files:
Index: src/sys/arch/m68k/m68k/bus_dma.c
diff -u src/sys/arch/m68k/m68k/bus_dma.c:1.35 src/sys/arch/m68k/m68k/bus_dma.c:1.35.34.1
--- src/sys/arch/m68k/m68k/bus_dma.c:1.35 Fri Oct 25 09:46:10 2013
+++ src/sys/arch/m68k/m68k/bus_dma.c Sat Jan 7 14:57:55 2023
@@ -1,4 +1,4 @@
-/* $NetBSD: bus_dma.c,v 1.35 2013/10/25 09:46:10 martin Exp $ */
+/* $NetBSD: bus_dma.c,v 1.35.34.1 2023/01/07 14:57:55 martin Exp $ */
/*
* This file was taken from from alpha/common/bus_dma.c
@@ -41,7 +41,7 @@
#include <sys/cdefs.h> /* RCS ID & Copyright macro defns */
-__KERNEL_RCSID(0, "$NetBSD: bus_dma.c,v 1.35 2013/10/25 09:46:10 martin Exp $");
+__KERNEL_RCSID(0, "$NetBSD: bus_dma.c,v 1.35.34.1 2023/01/07 14:57:55 martin Exp $");
#include <sys/param.h>
#include <sys/systm.h>
@@ -490,7 +490,8 @@ _bus_dmamap_sync(bus_dma_tag_t t, bus_dm
}
/* flush cachelines per 128bytes */
- while ((p < e) && (p & PAGE_MASK) != 0) {
+ while ((p + CACHELINE_SIZE * 8 <= e) &&
+ (p & PAGE_MASK) != 0) {
DCFL(p);
p += CACHELINE_SIZE;
DCFL(p);
@@ -566,7 +567,8 @@ _bus_dmamap_sync(bus_dma_tag_t t, bus_dm
}
/* purge cachelines per 128bytes */
- while ((p < e) && (p & PAGE_MASK) != 0) {
+ while ((p + CACHELINE_SIZE * 8 <= e) &&
+ (p & PAGE_MASK) != 0) {
DCPL(p);
p += CACHELINE_SIZE;
DCPL(p);
