Author: marius
Date: Mon Jul 25 18:46:54 2011
New Revision: 224376
URL: http://svn.freebsd.org/changeset/base/224376
Log:
MFC: r223795
Call pmap_qremove() before freeing or unwiring the pages, otherwise
there's a window during which a page can be re-used before its previous
mapping is removed.
Reviewed by: alc
Modified:
stable/8/sys/kern/vfs_bio.c
stable/8/sys/sparc64/sparc64/pmap.c
Directory Properties:
stable/8/sys/ (props changed)
stable/8/sys/amd64/include/xen/ (props changed)
stable/8/sys/cddl/contrib/opensolaris/ (props changed)
stable/8/sys/contrib/dev/acpica/ (props changed)
stable/8/sys/contrib/pf/ (props changed)
stable/8/sys/geom/label/ (props changed)
Modified: stable/8/sys/kern/vfs_bio.c
==============================================================================
--- stable/8/sys/kern/vfs_bio.c Mon Jul 25 18:44:46 2011 (r224375)
+++ stable/8/sys/kern/vfs_bio.c Mon Jul 25 18:46:54 2011 (r224376)
@@ -1602,6 +1602,7 @@ vfs_vmio_release(struct buf *bp)
int i;
vm_page_t m;
+ pmap_qremove(trunc_page((vm_offset_t)bp->b_data), bp->b_npages);
VM_OBJECT_LOCK(bp->b_bufobj->bo_object);
vm_page_lock_queues();
for (i = 0; i < bp->b_npages; i++) {
@@ -1638,7 +1639,6 @@ vfs_vmio_release(struct buf *bp)
}
vm_page_unlock_queues();
VM_OBJECT_UNLOCK(bp->b_bufobj->bo_object);
- pmap_qremove(trunc_page((vm_offset_t) bp->b_data), bp->b_npages);
if (bp->b_bufsize) {
bufspacewakeup();
@@ -2995,6 +2995,10 @@ allocbuf(struct buf *bp, int size)
if (desiredpages < bp->b_npages) {
vm_page_t m;
+ pmap_qremove((vm_offset_t)trunc_page(
+ (vm_offset_t)bp->b_data) +
+ (desiredpages << PAGE_SHIFT),
+ (bp->b_npages - desiredpages));
VM_OBJECT_LOCK(bp->b_bufobj->bo_object);
vm_page_lock_queues();
for (i = desiredpages; i < bp->b_npages; i++) {
@@ -3014,8 +3018,6 @@ allocbuf(struct buf *bp, int size)
}
vm_page_unlock_queues();
VM_OBJECT_UNLOCK(bp->b_bufobj->bo_object);
- pmap_qremove((vm_offset_t)
trunc_page((vm_offset_t)bp->b_data) +
- (desiredpages << PAGE_SHIFT), (bp->b_npages
- desiredpages));
bp->b_npages = desiredpages;
}
} else if (size > bp->b_bcount) {
Modified: stable/8/sys/sparc64/sparc64/pmap.c
==============================================================================
--- stable/8/sys/sparc64/sparc64/pmap.c Mon Jul 25 18:44:46 2011
(r224375)
+++ stable/8/sys/sparc64/sparc64/pmap.c Mon Jul 25 18:46:54 2011
(r224376)
@@ -1290,6 +1290,7 @@ pmap_release(pmap_t pm)
pc->pc_pmap = NULL;
mtx_unlock_spin(&sched_lock);
+ pmap_qremove((vm_offset_t)pm->pm_tsb, TSB_PAGES);
obj = pm->pm_tsb_obj;
VM_OBJECT_LOCK(obj);
KASSERT(obj->ref_count == 1, ("pmap_release: tsbobj ref count != 1"));
@@ -1307,7 +1308,6 @@ pmap_release(pmap_t pm)
vm_page_unlock_queues();
}
VM_OBJECT_UNLOCK(obj);
- pmap_qremove((vm_offset_t)pm->pm_tsb, TSB_PAGES);
PMAP_LOCK_DESTROY(pm);
}
_______________________________________________
[email protected] mailing list
http://lists.freebsd.org/mailman/listinfo/svn-src-all
To unsubscribe, send any mail to "[email protected]"
