From owner-freebsd-bugs@FreeBSD.ORG Tue Dec 28 00:20:12 2010 Return-Path: Delivered-To: freebsd-bugs@hub.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id DB1071065697 for ; Tue, 28 Dec 2010 00:20:12 +0000 (UTC) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (freefall.freebsd.org [IPv6:2001:4f8:fff6::28]) by mx1.freebsd.org (Postfix) with ESMTP id A29698FC1B for ; Tue, 28 Dec 2010 00:20:12 +0000 (UTC) Received: from freefall.freebsd.org (localhost [127.0.0.1]) by freefall.freebsd.org (8.14.4/8.14.4) with ESMTP id oBS0KCL1013199 for ; Tue, 28 Dec 2010 00:20:12 GMT (envelope-from gnats@freefall.freebsd.org) Received: (from gnats@localhost) by freefall.freebsd.org (8.14.4/8.14.4/Submit) id oBS0KCJA013198; Tue, 28 Dec 2010 00:20:12 GMT (envelope-from gnats) Resent-Date: Tue, 28 Dec 2010 00:20:12 GMT Resent-Message-Id: <201012280020.oBS0KCJA013198@freefall.freebsd.org> Resent-From: FreeBSD-gnats-submit@FreeBSD.org (GNATS Filer) Resent-To: freebsd-bugs@FreeBSD.org Resent-Reply-To: FreeBSD-gnats-submit@FreeBSD.org, Colin Percival Received: from mx2.freebsd.org (mx2.freebsd.org [IPv6:2001:4f8:fff6::35]) by hub.freebsd.org (Postfix) with ESMTP id 75F9C106566C for ; Tue, 28 Dec 2010 00:18:08 +0000 (UTC) (envelope-from cperciva@xps.daemonology.net) Received: from xps.daemonology.net (freefall.freebsd.org [IPv6:2001:4f8:fff6::28]) by mx2.freebsd.org (Postfix) with SMTP id 3843114EC00 for ; Tue, 28 Dec 2010 00:18:08 +0000 (UTC) Received: (qmail 89178 invoked by uid 1001); 28 Dec 2010 00:18:07 -0000 Message-Id: <20101228001807.89177.qmail@xps.daemonology.net> Date: 28 Dec 2010 00:18:07 -0000 From: Colin Percival To: FreeBSD-gnats-submit@FreeBSD.org X-Send-Pr-Version: 3.113 Cc: Subject: kern/153477: XEN pmap code abuses vm page queue lock X-BeenThere: freebsd-bugs@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: Colin Percival List-Id: Bug reports List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 28 Dec 2010 00:20:12 -0000 >Number: 153477 >Category: kern >Synopsis: XEN pmap code abuses vm page queue lock >Confidential: no >Severity: serious >Priority: low >Responsible: freebsd-bugs >State: open >Quarter: >Keywords: >Date-Required: >Class: sw-bug >Submitter-Id: current-users >Arrival-Date: Tue Dec 28 00:20:12 UTC 2010 >Closed-Date: >Last-Modified: >Originator: Colin Percival >Release: n/a >Organization: >Environment: >Description: In the FreeBSD/i386 Xen/PV pmap.c code, the vm page queue lock is abused to control access to the queue of page remapping hypervisor requests. This lock is asserted in _xen_queue_pt_update in i386/xen/xen_machdep.c, and this results in it being locked/unlocked a number of times in i386/xen/pmap.c. (Judging by the i386 code, there are times when holding the vm page queue lock in pmap.c is appropriate; but the locking in pmap_pte and pmap_pte_release is not such an occasion, for example.) In addition to being subjectively inappropriate, the current locking creates a LOR between the vm page queue lock and PMAP2mutex. >How-To-Repeat: Running 'mdconfig -l' results in a LOR warning being printed. >Fix: We should probably have a new xen_pt_update_mtx spin mutex, lock/unlock it in i386/xen/pmap.c around the page table update calls, and then audit the vm_page_lock_queues calls to see which can be ripped out. I'll probably get around to doing this at some point (this PR is mostly an aide-memoire) but I'd be overjoyed if someone else wants to look at this first... >Release-Note: >Audit-Trail: >Unformatted: