Remove a check which caused spurious SIGSEGV on usermode access to the

mapped address without valid pte installed, when parallel wiring of
the entry happen.  The entry must be copy on write.  If entry is COW
but was already copied, and parallel wiring set
MAP_ENTRY_IN_TRANSITION, vm_fault() would sleep waiting for the
MAP_ENTRY_IN_TRANSITION flag to clear.  After that, the fault handler
is restarted and vm_map_lookup() or vm_map_lookup_locked() trip over
the check.  Note that this is race, if the address is accessed after
the wiring is done, the entry does not fault at all.

There is no reason in the current kernel to disallow write access to
the COW wired entry if the entry permissions allow it.  Initially this
was done in r24666, since that kernel did not supported proper
copy-on-write for wired text, which was fixed in r199869.  The r251901
revision re-introduced the r24666 fix for the current VM.

Note that write access must clear MAP_ENTRY_NEEDS_COPY entry flag by
performing COW.  In reverse, when MAP_ENTRY_NEEDS_COPY is set in
vmspace_fork(), the MAP_ENTRY_USER_WIRED flag is cleared.  Put the
assert stating the invariant, instead of returning the error.

Reported and debugging help by:	peter
Reviewed by:	alc
Sponsored by:	The FreeBSD Foundation
MFC after:	1 week

1 files changed, 4 insertions, 10 deletions

diff --git a/sys/vm/vm_map.c b/sys/vm/vm_map.c
index 65c3e2c..2e69b87 100644
--- a/sys/vm/vm_map.c
+++ b/sys/vm/vm_map.c
@@ -3969,12 +3969,10 @@ RetryLookup:;
 		vm_map_unlock_read(map);
 		return (KERN_PROTECTION_FAILURE);
 	}
-	if ((entry->eflags & MAP_ENTRY_USER_WIRED) &&
-	    (entry->eflags & MAP_ENTRY_COW) &&
-	    (fault_type & VM_PROT_WRITE)) {
-		vm_map_unlock_read(map);
-		return (KERN_PROTECTION_FAILURE);
-	}
+	KASSERT((prot & VM_PROT_WRITE) == 0 || (entry->eflags &
+	    (MAP_ENTRY_USER_WIRED | MAP_ENTRY_NEEDS_COPY)) !=
+	    (MAP_ENTRY_USER_WIRED | MAP_ENTRY_NEEDS_COPY),
+	    ("entry %p flags %x", entry, entry->eflags));
 	if ((fault_typea & VM_PROT_COPY) != 0 &&
 	    (entry->max_protection & VM_PROT_WRITE) == 0 &&
 	    (entry->eflags & MAP_ENTRY_COW) == 0) {
@@ -4128,10 +4126,6 @@ vm_map_lookup_locked(vm_map_t *var_map,		/* IN/OUT */
 	fault_type &= VM_PROT_READ | VM_PROT_WRITE | VM_PROT_EXECUTE;
 	if ((fault_type & prot) != fault_type)
 		return (KERN_PROTECTION_FAILURE);
-	if ((entry->eflags & MAP_ENTRY_USER_WIRED) &&
-	    (entry->eflags & MAP_ENTRY_COW) &&
-	    (fault_type & VM_PROT_WRITE))
-		return (KERN_PROTECTION_FAILURE);
 
 	/*
 	 * If this page is not pageable, we have to get it for all possible