mirror/freebsd
1
0
Fork 0
mirror of https://git.FreeBSD.org/src.git synced 2024-12-03 09:00:21 +00:00
Code Issues Releases Activity

riscv: Fix another race in pmap_pinit()

Browse Source 
Commit c862d5f2a7 ("riscv: Fix a race in pmap_pinit()") did not really
fix the race.  Alan writes,

 Suppose that N entries in the L1 tables are in use, and we are in the
 middle of the memcpy().  Specifically, we have read the zero-filled
 (N+1)st entry from the kernel L1 table.  Then, we are preempted.  Now,
 another core/thread does pmap_growkernel(), which fills the (N+1)st
 entry.  Finally, we return to the original core/thread, and overwrite
 the valid entry with the zero that we earlier read.

Try to fix the race properly, by copying kernel L1 entries while holding
the allpmaps lock.  To avoid doing unnecessary work while holding this
global lock, copy only the entries that we expect to be valid.

Fixes:		c862d5f2a7 ("riscv: Fix a race in pmap_pinit()")
Reported by:	alc, jrtc27
Reviewed by:	alc
MFC after:	1 week
Sponsored by:	The FreeBSD Foundation
Differential Revision:	https://reviews.freebsd.org/D34267
This commit is contained in:
Mark Johnston 2022-02-22 09:26:33 -05:00
parent 692bb3f029
commit d5c0a7b6d3
1 changed files with 10 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
sys/riscv/riscv/pmap.c
View File

@ -1231,12 +1231,20 @@ pmap_pinit(pmap_t pmap)
CPU_ZERO(&pmap->pm_active);
/*
* Copy L1 entries from the kernel pmap. This must be done with the
* allpmaps lock held to avoid races with pmap_distribute_l1().
*/
mtx_lock(&allpmaps_lock);
LIST_INSERT_HEAD(&allpmaps, pmap, pm_list);
for (size_t i = pmap_l1_index(VM_MIN_KERNEL_ADDRESS);
i < pmap_l1_index(VM_MAX_KERNEL_ADDRESS); i++)
pmap->pm_l1[i] = kernel_pmap->pm_l1[i];
for (size_t i = pmap_l1_index(DMAP_MIN_ADDRESS);
i < pmap_l1_index(DMAP_MAX_ADDRESS); i++)
pmap->pm_l1[i] = kernel_pmap->pm_l1[i];
mtx_unlock(&allpmaps_lock);
memcpy(pmap->pm_l1, kernel_pmap->pm_l1, PAGE_SIZE);
vm_radix_init(&pmap->pm_root);
return (1);