Commit f7104db2 authored Jun 09, 2009 by Jan Kiszka Committed by Avi Kivity Sep 10, 2009

KVM: Fix racy event propagation in timer

Minor issue that likely had no practical relevance: the kvm timer
function so far incremented the pending counter and then may reset it
again to 1 in case reinjection was disabled. This opened a small racy
window with the corresponding VCPU loop that may have happened to run
on another (real) CPU and already consumed the value.

Fix it by skipping the incrementation in case pending is already > 0.
This opens a different race windows, but may only rarely cause lost
events in case we do not care about them anyway (!reinject).

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
Signed-off-by: Avi Kivity <avi@redhat.com>

parent 33e4c686

arch/x86/kvm/timer.c

+10 −6

Original line number	Diff line number	Diff line
		@@ -9,12 +9,16 @@ static int __kvm_timer_fn(struct kvm_vcpu vcpu, struct kvm_timer ktimer)
		int restart_timer = 0;
		wait_queue_head_t *q = &vcpu->wq;

		/*
		* There is a race window between reading and incrementing, but we do
		* not care about potentially loosing timer events in the !reinject
		* case anyway.
		*/
		if (ktimer->reinject \|\| !atomic_read(&ktimer->pending)) {
		/* FIXME: this code should not know anything about vcpus */
		if (!atomic_inc_and_test(&ktimer->pending))
		set_bit(KVM_REQ_PENDING_TIMER, &vcpu->requests);

		if (!ktimer->reinject)
		atomic_set(&ktimer->pending, 1);
		}

		if (waitqueue_active(q))
		wake_up_interruptible(q);

Admin message