[src/trunk]: src/sys/external/bsd/drm/dist/bsd-core when freeing the DRM_SHM ...

[chs <chs%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/1dd30d187e8a
branches:  trunk
changeset: 779773:1dd30d187e8a
user:      chs <chs%NetBSD.org@localhost>
date:      Sun Jun 17 15:15:34 2012 +0000

description:
when freeing the DRM_SHM kernel memory that can be mapped by a user process,
remove any user mappings before freeing the memory, so that a user process
doesn't have still have access to that physical memory after it's reused.
this really shouldn't be using kernel malloc'd memory at all,
but changing that would be much more involved.

diffstat:

 sys/external/bsd/drm/dist/bsd-core/drm_bufs.c |  21 +++++++++++++++++++++
 1 files changed, 21 insertions(+), 0 deletions(-)

diffs (38 lines):

diff -r 7ebc8c5f6843 -r 1dd30d187e8a sys/external/bsd/drm/dist/bsd-core/drm_bufs.c
--- a/sys/external/bsd/drm/dist/bsd-core/drm_bufs.c     Sun Jun 17 15:12:13 2012 +0000
+++ b/sys/external/bsd/drm/dist/bsd-core/drm_bufs.c     Sun Jun 17 15:15:34 2012 +0000
@@ -316,6 +316,22 @@
        return 0;
 }
 
+static void
+drm_rmmap_user(void *addr, size_t size)
+{
+       vaddr_t va, eva;
+       paddr_t pa;
+       struct vm_page *pg;
+
+       va = (vaddr_t)addr;
+       eva = va + size;
+       for (; va < eva; va += PAGE_SIZE) {
+               pmap_extract(pmap_kernel(), va, &pa);
+               pg = PHYS_TO_VM_PAGE(pa);
+               pmap_page_protect(pg, VM_PROT_NONE);
+       }
+}
+
 void drm_rmmap(struct drm_device *dev, drm_local_map_t *map)
 {
        DRM_SPINLOCK_ASSERT(&dev->dev_lock);
@@ -338,6 +354,11 @@
                }
                break;
        case _DRM_SHM:
+
+               /*
+                * Remove any user mappings before we free the kernel memory.
+                */
+               drm_rmmap_user(map->handle, map->size);
                free(map->handle, DRM_MEM_MAPS);
                break;
        case _DRM_AGP: