From cperciva@xps.daemonology.net  Tue Dec 28 00:18:08 2010
Return-Path: <cperciva@xps.daemonology.net>
Received: from mx2.freebsd.org (mx2.freebsd.org [IPv6:2001:4f8:fff6::35])
	by hub.freebsd.org (Postfix) with ESMTP id 75F9C106566C
	for <FreeBSD-gnats-submit@freebsd.org>; Tue, 28 Dec 2010 00:18:08 +0000 (UTC)
	(envelope-from cperciva@xps.daemonology.net)
Received: from xps.daemonology.net (freefall.freebsd.org [IPv6:2001:4f8:fff6::28])
	by mx2.freebsd.org (Postfix) with SMTP id 3843114EC00
	for <FreeBSD-gnats-submit@freebsd.org>; Tue, 28 Dec 2010 00:18:08 +0000 (UTC)
Received: (qmail 89178 invoked by uid 1001); 28 Dec 2010 00:18:07 -0000
Message-Id: <20101228001807.89177.qmail@xps.daemonology.net>
Date: 28 Dec 2010 00:18:07 -0000
From: Colin Percival <cperciva@freebsd.org>
Reply-To: Colin Percival <cperciva@freebsd.org>
To: FreeBSD-gnats-submit@freebsd.org
Cc:
Subject: XEN pmap code abuses vm page queue lock
X-Send-Pr-Version: 3.113
X-GNATS-Notify:

>Number:         153477
>Category:       kern
>Synopsis:       [xen] XEN pmap code abuses vm page queue lock
>Confidential:   no
>Severity:       serious
>Priority:       low
>Responsible:    freebsd-xen
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:  
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Tue Dec 28 00:20:12 UTC 2010
>Closed-Date:    
>Last-Modified:  Tue Dec 28 00:38:41 UTC 2010
>Originator:     Colin Percival
>Release:        n/a
>Organization:
>Environment:
>Description:

In the FreeBSD/i386 Xen/PV pmap.c code, the vm page queue lock is abused
to control access to the queue of page remapping hypervisor requests.
This lock is asserted in _xen_queue_pt_update in i386/xen/xen_machdep.c,
and this results in it being locked/unlocked a number of times in
i386/xen/pmap.c.  (Judging by the i386 code, there are times when
holding the vm page queue lock in pmap.c is appropriate; but the locking
in pmap_pte and pmap_pte_release is not such an occasion, for example.)

In addition to being subjectively inappropriate, the current locking
creates a LOR between the vm page queue lock and PMAP2mutex.

>How-To-Repeat:

Running 'mdconfig -l' results in a LOR warning being printed.

>Fix:

We should probably have a new xen_pt_update_mtx spin mutex, lock/unlock
it in i386/xen/pmap.c around the page table update calls, and then audit
the vm_page_lock_queues calls to see which can be ripped out.

I'll probably get around to doing this at some point (this PR is mostly
an aide-memoire) but I'd be overjoyed if someone else wants to look at
this first...
>Release-Note:
>Audit-Trail:
Responsible-Changed-From-To: freebsd-bugs->freebsd-xen 
Responsible-Changed-By: cperciva 
Responsible-Changed-When: Tue Dec 28 00:22:02 UTC 2010 
Responsible-Changed-Why:  
Assign xen bug to freebsd-xen list. 

http://www.freebsd.org/cgi/query-pr.cgi?pr=153477 
>Unformatted:
