[DragonFlyBSD - Bug #3430] pc64 pmap: wired-to-wired PTE replacement loses wire references

[sigttou]

Issue #3430 has been updated by sigttou.

File 0001-pmap-wired-replacement-v3.patch added

@dillon braces added, as discussed on IRC.

There was another wired-fault issue. With a shared file mapped twice, mlock
one alias, MADV_INVAL that alias, then read it: the original three-patch kernel
panics in vm_page_wire() because the fast fault path returns a soft-busied page.
The VM entry is still wired, but the old wired PTE/reference has been removed.
The unwired control and vm.fault_bypass=0 wired control both pass.

The revised #3430 patch also makes vm_fault_bypass() reject FW_WIRED, so those
faults use the normal hard-busy path.

----------------------------------------
Bug #3430: pc64 pmap: wired-to-wired PTE replacement loses wire references
http://bugs.dragonflybsd.org/issues/3430#change-14769

* Author: sigttou
* Status: New
* Priority: Normal
* Category: Kernel
* Target version: 6.6
* Start date: 2026-10-03
----------------------------------------
pmap_enter() only adds the new wired reference when the old PTE was not wired,
but it always drops the old wired reference. Replacing a wired mapping with
another wired mapping therefore loses a pmap wire count and a vm_page wire count.

This shows up as a panic ("vm_page_unwire: invalid wire count: 0") after an
mlock()ed mapping has its protection changed to read-only and back, and as a
negative wired count ("fatal pmap problem ... wirecnt=-6") when a vkernel exits.

Fix: count the new wired reference whenever the new PTE is wired, matching the
unconditional drop of the old one. For an already-wired same-page replacement,
which may be soft-busied, use vm_page_wire_quick() instead of vm_page_wire().
Skip fictitious pages, which have no physical wire count.

---Files--------------------------------
0001-pmap-wired-replacement.patch (1.36 KB)
0001-pmap-wired-replacement-v3.patch (2.55 KB)


-- 
You have received this notification because you have either subscribed to it, or are involved in it.
To change your notification preferences, please click here: http://bugs.dragonflybsd.org/my/account