Invalidate cache in pmap_remove_all() on ARM.

When pages are removed from virtual address space by calling pmap_remove_all()
CPU caches were not invalidated, which led to read corruption when another
page got mapped at this same virtual address at later time (the CPU was
retrieving stale contents).

Submitted by:	Piotr Ziecik
Obtained from:	Semihalf

1 files changed, 12 insertions, 0 deletions

diff --git a/sys/arm/arm/pmap.c b/sys/arm/arm/pmap.c
index cbd6c21..c2b2ec0 100644
--- a/sys/arm/arm/pmap.c
+++ b/sys/arm/arm/pmap.c
@@ -3124,7 +3124,19 @@ pmap_remove_all(vm_page_t m)
 		if (flush == FALSE && (pv->pv_pmap == curpm ||
 		    pv->pv_pmap == pmap_kernel()))
 			flush = TRUE;
+
 		PMAP_LOCK(pv->pv_pmap);
+		/*
+		 * Cached contents were written-back in pmap_remove_write(),
+		 * but we still have to invalidate the cache entry to make
+		 * sure stale data are not retrieved when another page will be
+		 * mapped under this virtual address.
+		 */
+		if (pmap_is_current(pv->pv_pmap)) {
+			cpu_dcache_inv_range(pv->pv_va, PAGE_SIZE);
+			cpu_l2cache_inv_range(pv->pv_va, PAGE_SIZE);
+		}
+
 		l2b = pmap_get_l2_bucket(pv->pv_pmap, pv->pv_va);
 		KASSERT(l2b != NULL, ("No l2 bucket"));
 		ptep = &l2b->l2b_kva[l2pte_index(pv->pv_va)];