diff options
| author | Alan Cox <alc@FreeBSD.org> | 2026-08-29 07:08:01 +0000 |
|---|---|---|
| committer | Alan Cox <alc@FreeBSD.org> | 2026-09-04 05:19:13 +0000 |
| commit | 57407179be431dbe567de083aab5ce152163f4d3 (patch) | |
| tree | 20aaa28bb46d54dfb7ab1659051b50a192075fde /packages/certctl | |
| parent | 1a296762b3d093e1fed4e74f9251206102f68355 (diff) | |
Whenever we create a user-space mapping, we always set ATTR_S1_PXN in
the PTE, which blocks execution of user-space code while running in
kernel mode. However, when seeking to determine whether we need to
perform an icache flush before installing the new PTE, we test whether
sometimes the old PTE or other times the new PTE has ATTR_S1_XN set.
The trouble is that ATTR_S1_XN is defined as the bitwise OR of
ATTR_S1_PXN and ATTR_S1_UXN, and so the test for whether ATTR_S1_XN is
set is satisfied if either of its constituent bits is set, i.e., we
write (l3e & ATTR_S1_XN) != 0. Consequently, the test is always true.
In practice, I believe that the ill effects of this bug are limited:
In pmap_enter(), in rare circumstances, e.g., wiring a code page, an
unnecessary icache flush will be performed. In pmap_enter_l2() and
pmap_enter_l3c(), no icache flush will be performed. However,
typically an icache flush would have already been performed on each of
the constituent base pages.
Reviewed by: kib, markj
MFC after: 3 weeks
Differential Revision: https://reviews.freebsd.org/D59265
Diffstat (limited to 'packages/certctl')
0 files changed, 0 insertions, 0 deletions
