The bus_space_map() function on armv7 fails in the corner case where
you want to allocate the last memory page.
Consider a case where bpa = 0xfffffc00 and size=0x120. startpa becomes
0xfffff000 while endpa becomes startpa + PAGE_SIZE which is 0x00000000.
The following for-loop is currently conditioned to terminate when
pa < endpa, but in this case endpa < startpa due to integer overflow,
so the bus space is never mapped.
Below is a patch that converts the for-loop's termination condition to
startpa != endpa, which performs the expected action in this corner
case.
Index: sys/arch/arm/armv7/armv7_space.c
===================================================================
RCS file: /cvs/src/sys/arch/arm/armv7/armv7_space.c,v
retrieving revision 1.10
diff -u -p -r1.10 armv7_space.c
--- sys/arch/arm/armv7/armv7_space.c 20 Mar 2018 23:04:48 -0000 1.10
+++ sys/arch/arm/armv7/armv7_space.c 8 Mar 2019 01:12:18 -0000
@@ -187,7 +187,7 @@ armv7_bs_map(void *t, uint64_t bpa, bus_
if (flags & BUS_SPACE_MAP_CACHEABLE)
pmap_flags = 0;
- for (pa = startpa; pa < endpa; pa += PAGE_SIZE, va += PAGE_SIZE)
+ for (pa = startpa; pa != endpa; pa += PAGE_SIZE, va += PAGE_SIZE)
pmap_kenter_pa(va, pa | pmap_flags, PROT_READ | PROT_WRITE);
pmap_update(pmap_kernel());
