[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

[Xen-devel] [PATCH] x86: fix next->vcpu_dirty_cpumask checking in context_switch()



There was a timing window where flush_tlb_mask() could be called with
an empty mask (triggering a WARN_ON() in send_IPI_mask_flat() along
with APIC errors) because rather than using the already taken snapshot
of next's vcpu_dirty_cpumask struct vcpu's field was used directly,
which can get its only bit cleared by remote CPUs.

Replacing the structure field's use by the local variable then made the
inner cpus_empty() check completely redundant with the one in the
surrounding if()'s condition.

Signed-off-by: Jan Beulich <jbeulich@xxxxxxxxxx>

--- 2009-03-27.orig/xen/arch/x86/domain.c       2009-04-20 13:00:16.000000000 
+0200
+++ 2009-03-27/xen/arch/x86/domain.c    2009-04-20 13:03:34.000000000 +0200
@@ -1325,8 +1325,7 @@ void context_switch(struct vcpu *prev, s
     if ( unlikely(!cpu_isset(cpu, dirty_mask) && !cpus_empty(dirty_mask)) )
     {
         /* Other cpus call __sync_lazy_execstate from flush ipi handler. */
-        if ( !cpus_empty(next->vcpu_dirty_cpumask) )
-            flush_tlb_mask(next->vcpu_dirty_cpumask);
+        flush_tlb_mask(dirty_mask);
     }
 
     if ( is_hvm_vcpu(prev) && !list_empty(&prev->arch.hvm_vcpu.tm_list) )




_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-devel


 


Rackspace

Lists.xenproject.org is hosted with RackSpace, monitoring our
servers 24x7x365 and backed by RackSpace's Fanatical Support®.