[Xen-changelog] [xen-unstable] [IA64] Resolve a race in tlb_track_search_and_remove()

[Xen patchbot-unstable <patchbot-unstable@xxxxxxxxxxxxxxxxxxx>]

# HG changeset patch
# User awilliam@xxxxxxxxxxxx
# Date 1168628618 25200
# Node ID 8835443fa3b37b5dde5e71a0e7ca49b9237b9cda
# Parent  9cbb1d6fb34ab5b831c78a3b3c8e0382739a624d
[IA64] Resolve a race in tlb_track_search_and_remove()

When tlb_track_search_and_remove() is about to remove a found entry,
another cpu might update p2m entry and insert the entry right before that.
It must be aware of it.

Signed-off-by: Isaku Yamahata <yamahata@xxxxxxxxxxxxx>
---
 xen/arch/ia64/xen/tlb_track.c |   25 +++++++++++++++++++++++++
 1 files changed, 25 insertions(+)

diff -r 9cbb1d6fb34a -r 8835443fa3b3 xen/arch/ia64/xen/tlb_track.c
--- a/xen/arch/ia64/xen/tlb_track.c     Thu Jan 11 17:03:25 2007 -0700
+++ b/xen/arch/ia64/xen/tlb_track.c     Fri Jan 12 12:03:38 2007 -0700
@@ -454,6 +454,31 @@ tlb_track_search_and_remove(struct tlb_t
             continue;
 
         if (pte_pfn(entry->pte_val) == mfn) {
+            /*
+             * PARANOIA
+             * We're here after zapping p2m entry.  However another pCPU
+             * may update the same p2m entry entry the same mfn at the
+             * same time in theory.  In such a case, we can't determine
+             * whether this entry is for us or for the racy p2m update.
+             * Such a guest domain's racy behaviour doesn't make sense,
+             * but is allowed.  Go the very pessimistic way.  Leave this
+             * entry to be found later and do full flush at this time.
+             *
+             * NOTE: Updating tlb tracking hash is protected by spin lock and
+             *       setting _PAGE_TLB_INSERTED and_PAGE_TLB_INSERTED_MANY bits
+             *       is serialized by the same spin lock.
+             *       See tlb_track_insert_or_dirty().
+             */
+            pte_t current_pte = *ptep;
+            if (unlikely(pte_pfn(current_pte) == mfn &&
+                         pte_tlb_tracking(current_pte) &&
+                         pte_tlb_inserted(current_pte))) {
+                BUG_ON(pte_tlb_inserted_many(current_pte));
+                spin_unlock(&tlb_track->hash_lock);
+                perfc_incrc(tlb_track_sar_many);
+                return TLB_TRACK_MANY;
+            }
+
             list_del(&entry->list);
             spin_unlock(&tlb_track->hash_lock);
             *entryp = entry;

_______________________________________________
Xen-changelog mailing list
Xen-changelog@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-changelog