kvm: x86: Fix racy event propagation in kmv timer

Commit Message

Jan Kiszka June 9, 2009, 9:28 a.m. UTC

Minor issues that likely had no practical relevance: The kvm timer
function so far incremented the pending counter and then may reset it
again to 1 in case reinjection was disabled. This opened a small racy
window with the corresponding VCPU loop that may have happened to run on
another (real) CPU and already consumed the value.

Moveover, the previous code tried to optimize the setting of
KVM_REQ_PENDING_TIMER, but used atomic_inc_and_test - which always
returns true unless pending had the invalid value of -1 on entry.

Signed-off-by: Jan Kiszka <[e-mail]>
---

 arch/x86/kvm/timer.c |   11 +++++------
 1 files changed, 5 insertions(+), 6 deletions(-)

--
To unsubscribe from this list: send the line "unsubscribe kvm" in
the body of a message to [e-mail]
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Patch

diff --git a/arch/x86/kvm/timer.c b/arch/x86/kvm/timer.c
index 86dbac0..18fd17c 100644
--- a/arch/x86/kvm/timer.c
+++ b/arch/x86/kvm/timer.c
@@ -9,12 +9,11 @@  static int __kvm_timer_fn(struct kvm_vcpu *vcpu, struct kvm_timer *ktimer)
 	int restart_timer = 0;
 	wait_queue_head_t *q = &vcpu->wq;
 
-	/* FIXME: this code should not know anything about vcpus */
-	if (!atomic_inc_and_test(&ktimer->pending))
-		set_bit(KVM_REQ_PENDING_TIMER, &vcpu->requests);
-
-	if (!ktimer->reinject)
-		atomic_set(&ktimer->pending, 1);
+	if (ktimer->reinject || !atomic_read(&ktimer->pending)) {
+		/* FIXME: this code should not know anything about vcpus */
+		if (atomic_inc_return(&ktimer->pending) == 1)
+			set_bit(KVM_REQ_PENDING_TIMER, &vcpu->requests);
+	}
 
 	if (waitqueue_active(q))
 		wake_up_interruptible(q);