From owner-svn-src-all@FreeBSD.ORG  Wed Sep  8 16:58:06 2010
Return-Path: <owner-svn-src-all@FreeBSD.ORG>
Delivered-To: svn-src-all@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34])
	by hub.freebsd.org (Postfix) with ESMTP id 7435210656C8;
	Wed,  8 Sep 2010 16:58:06 +0000 (UTC)
	(envelope-from nwhitehorn@FreeBSD.org)
Received: from svn.freebsd.org (svn.freebsd.org [IPv6:2001:4f8:fff6::2c])
	by mx1.freebsd.org (Postfix) with ESMTP id 636878FC20;
	Wed,  8 Sep 2010 16:58:06 +0000 (UTC)
Received: from svn.freebsd.org (localhost [127.0.0.1])
	by svn.freebsd.org (8.14.3/8.14.3) with ESMTP id o88Gw6pT050445;
	Wed, 8 Sep 2010 16:58:06 GMT
	(envelope-from nwhitehorn@svn.freebsd.org)
Received: (from nwhitehorn@localhost)
	by svn.freebsd.org (8.14.3/8.14.3/Submit) id o88Gw6H1050442;
	Wed, 8 Sep 2010 16:58:06 GMT
	(envelope-from nwhitehorn@svn.freebsd.org)
Message-Id: <201009081658.o88Gw6H1050442@svn.freebsd.org>
From: Nathan Whitehorn <nwhitehorn@FreeBSD.org>
Date: Wed, 8 Sep 2010 16:58:06 +0000 (UTC)
To: src-committers@freebsd.org, svn-src-all@freebsd.org,
	svn-src-head@freebsd.org
X-SVN-Group: head
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Cc: 
Subject: svn commit: r212322 - head/sys/powerpc/aim
X-BeenThere: svn-src-all@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: "SVN commit messages for the entire src tree \(except for &quot;
	user&quot; and &quot; projects&quot; \)" <svn-src-all.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/svn-src-all>,
	<mailto:svn-src-all-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/svn-src-all>
List-Post: <mailto:svn-src-all@freebsd.org>
List-Help: <mailto:svn-src-all-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/svn-src-all>,
	<mailto:svn-src-all-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Wed, 08 Sep 2010 16:58:06 -0000

Author: nwhitehorn
Date: Wed Sep  8 16:58:06 2010
New Revision: 212322
URL: http://svn.freebsd.org/changeset/base/212322

Log:
  Fix a typo in the original import of this code from NetBSD that caused the
  wrong element of the VSID bitmap array to be examined after a collision,
  leading to reallocation of in-use VSIDs under some circumstances, with
  attendant memory corruption. Also add an assert to check for this kind of
  problem in the future.
  
  MFC after:	4 days

Modified:
  head/sys/powerpc/aim/mmu_oea.c
  head/sys/powerpc/aim/mmu_oea64.c

Modified: head/sys/powerpc/aim/mmu_oea.c
==============================================================================
--- head/sys/powerpc/aim/mmu_oea.c	Wed Sep  8 16:34:08 2010	(r212321)
+++ head/sys/powerpc/aim/mmu_oea.c	Wed Sep  8 16:58:06 2010	(r212322)
@@ -1618,7 +1618,7 @@ moea_pinit(mmu_t mmu, pmap_t pmap)
 				entropy = (moea_vsidcontext >> 20);
 				continue;
 			}
-			i = ffs(~moea_vsid_bitmap[i]) - 1;
+			i = ffs(~moea_vsid_bitmap[n]) - 1;
 			mask = 1 << i;
 			hash &= 0xfffff & ~(VSID_NBPW - 1);
 			hash |= i;

Modified: head/sys/powerpc/aim/mmu_oea64.c
==============================================================================
--- head/sys/powerpc/aim/mmu_oea64.c	Wed Sep  8 16:34:08 2010	(r212321)
+++ head/sys/powerpc/aim/mmu_oea64.c	Wed Sep  8 16:58:06 2010	(r212322)
@@ -2080,11 +2080,13 @@ moea64_get_unique_vsid(void) {
 				entropy = (moea64_vsidcontext >> 20);
 				continue;
 			}
-			i = ffs(~moea64_vsid_bitmap[i]) - 1;
+			i = ffs(~moea64_vsid_bitmap[n]) - 1;
 			mask = 1 << i;
 			hash &= VSID_HASHMASK & ~(VSID_NBPW - 1);
 			hash |= i;
 		}
+		KASSERT(!(moea64_vsid_bitmap[n] & mask),
+		    ("Allocating in-use VSID %#x\n", hash));
 		moea64_vsid_bitmap[n] |= mask;
 		mtx_unlock(&moea64_slb_mutex);
 		return (hash);