[src/netbsd-6]: src/sys/external/bsd/drm/dist/bsd-core Pull up following revi...

[riz <riz%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/1c565394c9df
branches:  netbsd-6
changeset: 774240:1c565394c9df
user:      riz <riz%NetBSD.org@localhost>
date:      Sun Jun 24 02:49:31 2012 +0000

description:
Pull up following revision(s) (requested by chs in ticket #353):
        sys/external/bsd/drm/dist/bsd-core/drm_bufs.c: revision 1.11
when freeing the DRM_SHM kernel memory that can be mapped by a user process,
remove any user mappings before freeing the memory, so that a user process
doesn't have still have access to that physical memory after it's reused.
this really shouldn't be using kernel malloc'd memory at all,
but changing that would be much more involved.

diffstat:

 sys/external/bsd/drm/dist/bsd-core/drm_bufs.c |  21 +++++++++++++++++++++
 1 files changed, 21 insertions(+), 0 deletions(-)

diffs (38 lines):

diff -r f1193101841c -r 1c565394c9df sys/external/bsd/drm/dist/bsd-core/drm_bufs.c
--- a/sys/external/bsd/drm/dist/bsd-core/drm_bufs.c     Sat Jun 23 23:05:52 2012 +0000
+++ b/sys/external/bsd/drm/dist/bsd-core/drm_bufs.c     Sun Jun 24 02:49:31 2012 +0000
@@ -316,6 +316,22 @@
        return 0;
 }
 
+static void
+drm_rmmap_user(void *addr, size_t size)
+{
+       vaddr_t va, eva;
+       paddr_t pa;
+       struct vm_page *pg;
+
+       va = (vaddr_t)addr;
+       eva = va + size;
+       for (; va < eva; va += PAGE_SIZE) {
+               pmap_extract(pmap_kernel(), va, &pa);
+               pg = PHYS_TO_VM_PAGE(pa);
+               pmap_page_protect(pg, VM_PROT_NONE);
+       }
+}
+
 void drm_rmmap(struct drm_device *dev, drm_local_map_t *map)
 {
        DRM_SPINLOCK_ASSERT(&dev->dev_lock);
@@ -338,6 +354,11 @@
                }
                break;
        case _DRM_SHM:
+
+               /*
+                * Remove any user mappings before we free the kernel memory.
+                */
+               drm_rmmap_user(map->handle, map->size);
                free(map->handle, DRM_MEM_MAPS);
                break;
        case _DRM_AGP: