Skip to contentSkip to conversation

Fix races in iret hypercall

PATCH In review Christoph Egger 2 participants 2 messages Aug 9, 2007

lore
Share & tools
lore

Christoph Egger

author
#0 lore raw

PATCH 1/1 Fix races in iret hypercall

Hi!

Attached patch fixes races seen on SMP when multiple HVM guests execute the iret instruction at the same time.

current vcpu can change in the middle of do_iret().

Signed-off-by Christoph Egger <[email protected]>
Signature · 12 lines
AMD Saxony, Dresden, Germany
Operating System Research Center

Legal Information:
AMD Saxony Limited Liability Company & Co. KG
Sitz (Geschäftsanschrift):
   Wilschdorfer Landstr. 101, 01109 Dresden, Deutschland
Registergericht Dresden: HRA 4896
vertretungsberechtigter Komplementär:
   AMD Saxony LLC (Sitz Wilmington, Delaware, USA)
Geschäftsführer der AMD Saxony LLC:
   Dr. Hans-R. Deppe, Thomas McCoy
xen/arch/x86/x86_32/traps.c +4 -3
diff -r 484848f240e8 xen/arch/x86/x86_32/traps.c
@@ -172,6 +172,7 @@ unsigned long do_iret(void)
 unsigned long do_iret(void)
 {
     struct cpu_user_regs *regs = guest_cpu_user_regs();
+    struct vcpu *v = current;
     u32 eflags;
 
     /* Check worst-case stack frame for overlap with Xen protected area. */

@@ -215,10 +216,10 @@ unsigned long do_iret(void)
     }
 
     /* No longer in NMI context. */
-    current->nmi_masked = 0;
+    v->nmi_masked = 0;
 
     /* Restore upcall mask from supplied EFLAGS.IF. */
-    current->vcpu_info->evtchn_upcall_mask = !(eflags & X86_EFLAGS_IF);
+    vcpu_info(v, evtchn_upcall_mask) = !(eflags & X86_EFLAGS_IF);
 
     /*
      * The hypercall exit path will overwrite EAX with this return

@@ -228,7 +229,7 @@ unsigned long do_iret(void)
 
  exit_and_crash:
     gdprintk(XENLOG_ERR, "Fatal error\n");
-    domain_crash(current->domain);
+    domain_crash(v->domain);
     return 0;
 }
xen/arch/x86/x86_64/traps.c +2 -2
diff -r 484848f240e8 xen/arch/x86/x86_64/traps.c
@@ -235,10 +235,10 @@ unsigned long do_iret(void)
     }
 
     /* No longer in NMI context. */
-    current->nmi_masked = 0;
+    v->nmi_masked = 0;
 
     /* Restore upcall mask from supplied EFLAGS.IF. */
-    vcpu_info(current, evtchn_upcall_mask) = !(iret_saved.rflags & EF_IE);
+    vcpu_info(v, evtchn_upcall_mask) = !(iret_saved.rflags & EF_IE);
 
     /* Saved %rax gets written back to regs->rax in entry.S. */
     return iret_saved.rax;

_______________________________________________
Xen-devel mailing list
[email protected]
http://lists.xensource.com/xen-devel

#1 lore raw
Quoted 4 lines · Christoph Egger

Attached patch fixes races seen on SMP when multiple HVM guests execute the iret instruction at the same time.

current vcpu can change in the middle of do_iret().

This is fine as a cleanup, but it does not fix any bugs!

For two reasons:
1. Current vcpu *cannot* change in the middle of do_iret(). Xen does not
support involuntary preemption.
2. HVM guests do not ever execute do_iret(). That function is for pv guests
only.

How did you conclude there was a bug?

-- Keir