From: "Christoph Egger" Subject: [PATCH] Fix races in iret hypercall Date: Thu, 9 Aug 2007 10:35:08 +0200 Message-ID: <200708091035.08282.Christoph.Egger@amd.com> Mime-Version: 1.0 Content-Type: multipart/mixed; boundary="Boundary-00=_8GtuGwCSz0psLbz" Return-path: List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: xen-devel-bounces@lists.xensource.com Errors-To: xen-devel-bounces@lists.xensource.com To: xen-devel@lists.xensource.com List-Id: xen-devel@lists.xenproject.org --Boundary-00=_8GtuGwCSz0psLbz Content-Type: text/plain; charset=iso-8859-1 Content-Transfer-Encoding: quoted-printable Content-Disposition: inline Hi! Attached patch fixes races seen on SMP when multiple HVM guests execute the iret instruction at the same time. current vcpu can change in the middle of do_iret(). Signed-off-by: Christoph Egger =2D-=20 AMD Saxony, Dresden, Germany Operating System Research Center Legal Information: AMD Saxony Limited Liability Company & Co. KG Sitz (Gesch=E4ftsanschrift): Wilschdorfer Landstr. 101, 01109 Dresden, Deutschland Registergericht Dresden: HRA 4896 vertretungsberechtigter Komplement=E4r: AMD Saxony LLC (Sitz Wilmington, Delaware, USA) Gesch=E4ftsf=FChrer der AMD Saxony LLC: Dr. Hans-R. Deppe, Thomas McCoy --Boundary-00=_8GtuGwCSz0psLbz Content-Type: text/x-diff; charset=us-ascii; name=iret_race.diff Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename=iret_race.diff diff -r 484848f240e8 xen/arch/x86/x86_32/traps.c --- a/xen/arch/x86/x86_32/traps.c Wed Aug 08 17:50:24 2007 +0100 +++ b/xen/arch/x86/x86_32/traps.c Thu Aug 09 10:04:52 2007 +0000 @@ -172,6 +172,7 @@ unsigned long do_iret(void) unsigned long do_iret(void) { struct cpu_user_regs *regs = guest_cpu_user_regs(); + struct vcpu *v = current; u32 eflags; /* Check worst-case stack frame for overlap with Xen protected area. */ @@ -215,10 +216,10 @@ unsigned long do_iret(void) } /* No longer in NMI context. */ - current->nmi_masked = 0; + v->nmi_masked = 0; /* Restore upcall mask from supplied EFLAGS.IF. */ - current->vcpu_info->evtchn_upcall_mask = !(eflags & X86_EFLAGS_IF); + vcpu_info(v, evtchn_upcall_mask) = !(eflags & X86_EFLAGS_IF); /* * The hypercall exit path will overwrite EAX with this return @@ -228,7 +229,7 @@ unsigned long do_iret(void) exit_and_crash: gdprintk(XENLOG_ERR, "Fatal error\n"); - domain_crash(current->domain); + domain_crash(v->domain); return 0; } diff -r 484848f240e8 xen/arch/x86/x86_64/traps.c --- a/xen/arch/x86/x86_64/traps.c Wed Aug 08 17:50:24 2007 +0100 +++ b/xen/arch/x86/x86_64/traps.c Thu Aug 09 10:13:21 2007 +0000 @@ -235,10 +235,10 @@ unsigned long do_iret(void) } /* No longer in NMI context. */ - current->nmi_masked = 0; + v->nmi_masked = 0; /* Restore upcall mask from supplied EFLAGS.IF. */ - vcpu_info(current, evtchn_upcall_mask) = !(iret_saved.rflags & EF_IE); + vcpu_info(v, evtchn_upcall_mask) = !(iret_saved.rflags & EF_IE); /* Saved %rax gets written back to regs->rax in entry.S. */ return iret_saved.rax; --Boundary-00=_8GtuGwCSz0psLbz Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ Xen-devel mailing list Xen-devel@lists.xensource.com http://lists.xensource.com/xen-devel --Boundary-00=_8GtuGwCSz0psLbz--