From nobody@FreeBSD.org  Fri Mar 21 18:47:40 2014
Return-Path: <nobody@FreeBSD.org>
Received: from mx1.freebsd.org (mx1.freebsd.org [8.8.178.115])
	(using TLSv1 with cipher ADH-AES256-SHA (256/256 bits))
	(No client certificate requested)
	by hub.freebsd.org (Postfix) with ESMTPS id AE754836
	for <freebsd-gnats-submit@FreeBSD.org>; Fri, 21 Mar 2014 18:47:40 +0000 (UTC)
Received: from cgiserv.freebsd.org (cgiserv.freebsd.org [IPv6:2001:1900:2254:206a::50:4])
	(using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
	(No client certificate requested)
	by mx1.freebsd.org (Postfix) with ESMTPS id 9BFB3192
	for <freebsd-gnats-submit@FreeBSD.org>; Fri, 21 Mar 2014 18:47:40 +0000 (UTC)
Received: from cgiserv.freebsd.org ([127.0.1.6])
	by cgiserv.freebsd.org (8.14.8/8.14.8) with ESMTP id s2LIle2P069235
	for <freebsd-gnats-submit@FreeBSD.org>; Fri, 21 Mar 2014 18:47:40 GMT
	(envelope-from nobody@cgiserv.freebsd.org)
Received: (from nobody@localhost)
	by cgiserv.freebsd.org (8.14.8/8.14.8/Submit) id s2LIleth069234;
	Fri, 21 Mar 2014 18:47:40 GMT
	(envelope-from nobody)
Message-Id: <201403211847.s2LIleth069234@cgiserv.freebsd.org>
Date: Fri, 21 Mar 2014 18:47:40 GMT
From: Adrian Chadd <adrian@freebsd.org>
To: freebsd-gnats-submit@FreeBSD.org
Subject: [kern] /dev/mem accesses may cause page faults
X-Send-Pr-Version: www-3.1
X-GNATS-Notify:

>Number:         187826
>Category:       kern
>Synopsis:       [kern] /dev/mem accesses may cause page faults
>Confidential:   no
>Severity:       non-critical
>Priority:       low
>Responsible:    freebsd-bugs
>State:          open
>Quarter:
>Keywords:
>Date-Required:
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Fri Mar 21 18:50:00 UTC 2014
>Closed-Date:
>Last-Modified:
>Originator:     Adrian Chadd
>Release:        -HEAD
>Organization:
>Environment:
>Description:
From the commit to amd64 (r263475):

Fix two issues with /dev/mem access on amd64, both causing kernel page
  faults.

  First, for accesses to direct map region should check for the limit by
  which direct map is instantiated.

  Second, for accesses to the kernel map, success returned from the
  kernacc(9) does not guarantee that consequent attempt to read or write
  to the checked address succeed, since other thread might invalidate
  the address meantime.  Add a new thread private flag TDP_DEVMEMIO,
  which instructs vm_fault() to return error when fault happens on the
  MAP_ENTRY_NOFAULT entry, instead of panicing.  The trap handler would
  then see a page fault from access, and recover in normal way, making
  /dev/mem access safer.

  Remove GIANT_REQUIRED from the amd64 memrw(), since it is not needed
  and having Giant locked does not solve issues for amd64.

  Note that at least the second issue exists on other architectures, and
  requires similar patching for md code.

>How-To-Repeat:

>Fix:


>Release-Note:
>Audit-Trail:
>Unformatted:
