Re: [Xen-devel] [PATCH] x86/vm_event: fix race between vmx_vmexit_handler() and vm_event_resume()

[Andrew Cooper <andrew.cooper3@xxxxxxxxxx>]

On 27/04/2017 08:22, Razvan Cojocaru wrote:
> The introspection agent can reply to a vm_event faster than
> vmx_vmexit_handler() can complete in some cases, where it is then
> not safe for vm_event_set_registers() to modify v->arch.user_regs.
> This patch ensures that vm_event_resume() code only sets per-VCPU
> data to be used for the actual setting of registers only in
> hvm_do_resume() (similar to the model used to control setting of CRs
> and MSRs).
> The patch additionally removes the sync_vcpu_execstate(v) call from
> vm_event_resume(), which is no longer necessary, which removes the
> associated broadcast TLB flush (read: performance improvement).
>
> Signed-off-by: Razvan Cojocaru <rcojocaru@xxxxxxxxxxxxxxx>
> Signed-off-by: Andrew Cooper <andrew.cooper3@xxxxxxxxxx>

FWIW, Reivewed-by: Andrew Cooper <andrew.cooper3@xxxxxxxxxx>  (this has
taken an embarrassingly long time to get to the root cause of,
considering the eventual simplicity of the patch) with one trivial
correction I have just spotted below.

CC'ing Julien and Ian in their RM capacity, as this bugfix should be
taken for 4.9

> diff --git a/xen/common/vm_event.c b/xen/common/vm_event.c
> index 0fe9a53..498749b 100644
> --- a/xen/common/vm_event.c
> +++ b/xen/common/vm_event.c
> @@ -357,6 +357,13 @@ void vm_event_resume(struct domain *d, struct 
> vm_event_domain *ved)
>  {
>      vm_event_response_t rsp;
>  
> +    /*
> +     * vm_event_resume() runs either from XEN_DOMCTL_VM_EVENT_OP_*, or
> +     * EVTCHN_send from the introspection consumer.  Both contexts are

I have just spotted that this should read "runs in either
XEN_DOMCTL_VM_EVENT_OP_*, or EVTCHN_send context from".  I can fix up on
commit, if there are no other issues.

~Andrew

> +     * guaranteed not to be the subject of vm_event responses.
> +     */
> +    ASSERT(d != current->domain);
> +
>      /* Pull all responses off the ring. */
>      while ( vm_event_get_response(d, ved, &rsp) )
>      {


_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxx
https://lists.xen.org/xen-devel