From owner-freebsd-hackers  Fri Aug 24  9:45:53 2001
Delivered-To: freebsd-hackers@freebsd.org
Received: from earth.backplane.com (earth-nat-cw.backplane.com [208.161.114.67])
	by hub.freebsd.org (Postfix) with ESMTP id 2588337B405
	for <freebsd-hackers@FreeBSD.ORG>; Fri, 24 Aug 2001 09:45:49 -0700 (PDT)
	(envelope-from dillon@earth.backplane.com)
Received: (from dillon@localhost)
	by earth.backplane.com (8.11.4/8.11.2) id f7OGjgX96286;
	Fri, 24 Aug 2001 09:45:42 -0700 (PDT)
	(envelope-from dillon)
Date: Fri, 24 Aug 2001 09:45:42 -0700 (PDT)
From: Matt Dillon <dillon@earth.backplane.com>
Message-Id: <200108241645.f7OGjgX96286@earth.backplane.com>
To: Alfred Perlstein <bright@mu.org>, David Greenman <dg@root.com>
Cc: Julian Elischer <julian@elischer.org>,
	freebsd-hackers@FreeBSD.ORG
Subject: Possible race in i386/i386/pmap.c:pmap_copy()
Sender: owner-freebsd-hackers@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-hackers.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-hackers>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-hackers>
X-Loop: FreeBSD.ORG

    Alfred, DG, could you take a look at pmap_copy() in i386/i386/pmap.c
    and tell me if what I think I'm seeing is what I'm seeing?

    My read of this code is that a global, APTDpde, is being set, and
    then that pointer is being used in a loop later on in the routine.
    the problem is that the pmap_allocpte() call can block and, by my
    read, that means some other process can go in and change APTDpde out
    from under the loop.

    This could also be related to problem Julian has been seeing with his
    KSE patch set.

    There is a comment:

                                /*
                                 * We have to check after allocpte for the
                                 * pte still being around...  allocpte can
                                 * block.
                                 */
                                dstmpte = pmap_allocpte(dst_pmap, addr);
                                if ((*dst_pte == 0) && (ptetemp = *src_pte)) {
                                        /*
                                         * Clear the modified and
					...

    But I do not believe this check is sufficient if APTDpde gets ripped
    out from under the loop.  Is this race real or am I blowing smoke?

						-Matt


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-hackers" in the body of the message