dbx and panic "munhash"

[Wiegandt]

 We have recently had a few "panic munhash" crashes of 4.2bsd on our VAX-
11/780.  There are only ra81 disks on this machine.  If my memory is right
there have been news articles on the same subject in July or so, but I have
not seen any fix on the net, at least here in Europe, so here it comes.

The problem has been traced down to the use of dbx, which when it needs to
modify the protection of the text segment, eventually calls chgprot in
vm_machdep.c, which, in turn, calls munhash, but in the failing case with
a negative disk block number.

This is due to the fact that
	(daddr_t)(u_long)c->c_blkno
compiles into an extv instruction (extract with sign extension) rather than an
extzv instruction (extract with zero fill). c_blkno is defined in cmap.h to
be an unsigned int of 20 bits. For disk block numbers > 524287 (2**19 - 1),
as you can easily have on a ra81, the block number will turn negative.

Our fix was to remove the double type cast altogether, which will certainly
make lint unhappy, but also allows us to use dbx again without causing
crashes.

This double type cast is also used in vm_mem.c, which we took out as well.
Here are the diffs:

*** /usr/sys/vax/vm_machdep.c	Tue Aug 21 12:05:54 1984
--- /usr/sys/vax/vm_machdep.c.berk	Tue Aug 21 12:04:02 1984
***************
*** 145,152
  		c = &cmap[pgtocm(pte->pg_pfnum)];
  		if (c->c_blkno && c->c_mdev != MSWAPX)
  			munhash(mount[c->c_mdev].m_dev,
! /*                          (daddr_t)(u_long)c->c_blkno);             */
!                           c->c_blkno);        /*CERN 840821*/
  	}
  	*(int *)pte &= ~PG_PROT;
  	*(int *)pte |= tprot;

--- 145,151 -----
  		c = &cmap[pgtocm(pte->pg_pfnum)];
  		if (c->c_blkno && c->c_mdev != MSWAPX)
  			munhash(mount[c->c_mdev].m_dev,
! 			    (daddr_t)(u_long)c->c_blkno);
  	}
  	*(int *)pte &= ~PG_PROT;
  	*(int *)pte |= tprot;

---------------------------------------------------------------

*** /usr/sys/sys/vm_mem.c	Fri Aug 24 17:22:32 1984
--- /usr/sys/sys/vm_mem.c.berk	Fri Jul 29 16:07:27 1983
***************
*** 251,258
  			}
  			if (mfind(c->c_mdev == MSWAPX ?
  			      swapdev : mount[c->c_mdev].m_dev,
! /*                            (daddr_t)(u_long)c->c_blkno))  */
!                             c->c_blkno))
  				panic("memall mfind");
  			c1->c_mdev = 0;
  			c1->c_blkno = 0;

--- 251,257 -----
  			}
  			if (mfind(c->c_mdev == MSWAPX ?
  			      swapdev : mount[c->c_mdev].m_dev,
! 			      (daddr_t)(u_long)c->c_blkno))
  				panic("memall mfind");
  			c1->c_mdev = 0;
  			c1->c_blkno = 0;


decvax!mcvax!cernvax!dietrich

D. Wiegandt
CERN
European Laboratory for Particle Physics
CH-1211 Geneva 23
Switzerland