[PATCH] tmem: fix domain shutdown problem/race

[PATCH] tmem: fix domain shutdown problem/race

[Dan Magenheimer]

[-- Attachment #1: Type: text/plain, Size: 2351 bytes --]

Tmem fails to put_domain so a dying domain never gets
properly shut down.  Also, fix race condition when
domain is dying by not allowing any new ops to succeed.

Signed-off-by: Dan Magenheimer <dan.magenheimer@oracle.com>

diff -r accded2f185f xen/common/tmem.c
--- a/xen/common/tmem.c	Thu Nov 12 13:15:40 2009 +0000
+++ b/xen/common/tmem.c	Fri Nov 13 17:46:24 2009 -0700
@@ -2229,6 +2229,12 @@ EXPORT long do_tmem_op(tmem_cli_op_t uop
     DUP_START_CYC_COUNTER(flush,succ_get);
     DUP_START_CYC_COUNTER(flush_obj,succ_get);
 
+    if ( client != NULL && tmh_client_is_dying(client) )
+    {
+        rc = -ENODEV;
+        goto out;
+    }
+
     if ( unlikely(tmh_get_tmemop_from_client(&op, uops) != 0) )
     {
         printk("tmem: can't get tmem struct from %s\n",client_str);
@@ -2392,6 +2398,12 @@ EXPORT void tmem_destroy(void *v)
     if ( client == NULL )
         return;
 
+    if ( !tmh_client_is_dying(client) )
+    {
+        printk("tmem: tmem_destroy can only destroy dying client\n");
+        return;
+    }
+
     if ( tmh_lock_all )
         spin_lock(&tmem_spinlock);
     else
diff -r accded2f185f xen/common/tmem_xen.c
--- a/xen/common/tmem_xen.c	Thu Nov 12 13:15:40 2009 +0000
+++ b/xen/common/tmem_xen.c	Fri Nov 13 17:46:24 2009 -0700
@@ -314,6 +314,7 @@ EXPORT void tmh_client_destroy(tmh_clien
 #ifndef __i386__
     xmem_pool_destroy(tmh->persistent_pool);
 #endif
+    put_domain(tmh->domain);
     xfree(tmh);
 }
 
diff -r accded2f185f xen/include/xen/tmem_xen.h
--- a/xen/include/xen/tmem_xen.h	Thu Nov 12 13:15:40 2009 +0000
+++ b/xen/include/xen/tmem_xen.h	Fri Nov 13 17:46:24 2009 -0700
@@ -280,7 +280,7 @@ typedef struct page_info pfp_t;
 /* this appears to be unreliable when a domain is being shut down */
 static inline struct client *tmh_client_from_cli_id(cli_id_t cli_id)
 {
-    struct domain *d = get_domain_by_id(cli_id);
+    struct domain *d = get_domain_by_id(cli_id); /* incs d->refcnt! */
     if (d == NULL)
         return NULL;
     return (struct client *)(d->tmem);
@@ -290,6 +290,8 @@ static inline struct client *tmh_client_
 {
     return (struct client *)(current->domain->tmem);
 }
+
+#define tmh_client_is_dying(_client) (!!_client->tmh->domain->is_dying)
 
 static inline cli_id_t tmh_get_cli_id_from_current(void)
 {

[-- Attachment #2: tmem-race.patch --]
[-- Type: application/octet-stream, Size: 2063 bytes --]

diff -r accded2f185f xen/common/tmem.c
--- a/xen/common/tmem.c	Thu Nov 12 13:15:40 2009 +0000
+++ b/xen/common/tmem.c	Fri Nov 13 17:46:24 2009 -0700
@@ -2229,6 +2229,12 @@ EXPORT long do_tmem_op(tmem_cli_op_t uop
     DUP_START_CYC_COUNTER(flush,succ_get);
     DUP_START_CYC_COUNTER(flush_obj,succ_get);
 
+    if ( client != NULL && tmh_client_is_dying(client) )
+    {
+        rc = -ENODEV;
+        goto out;
+    }
+
     if ( unlikely(tmh_get_tmemop_from_client(&op, uops) != 0) )
     {
         printk("tmem: can't get tmem struct from %s\n",client_str);
@@ -2392,6 +2398,12 @@ EXPORT void tmem_destroy(void *v)
     if ( client == NULL )
         return;
 
+    if ( !tmh_client_is_dying(client) )
+    {
+        printk("tmem: tmem_destroy can only destroy dying client\n");
+        return;
+    }
+
     if ( tmh_lock_all )
         spin_lock(&tmem_spinlock);
     else
diff -r accded2f185f xen/common/tmem_xen.c
--- a/xen/common/tmem_xen.c	Thu Nov 12 13:15:40 2009 +0000
+++ b/xen/common/tmem_xen.c	Fri Nov 13 17:46:24 2009 -0700
@@ -314,6 +314,7 @@ EXPORT void tmh_client_destroy(tmh_clien
 #ifndef __i386__
     xmem_pool_destroy(tmh->persistent_pool);
 #endif
+    put_domain(tmh->domain);
     xfree(tmh);
 }
 
diff -r accded2f185f xen/include/xen/tmem_xen.h
--- a/xen/include/xen/tmem_xen.h	Thu Nov 12 13:15:40 2009 +0000
+++ b/xen/include/xen/tmem_xen.h	Fri Nov 13 17:46:24 2009 -0700
@@ -280,7 +280,7 @@ typedef struct page_info pfp_t;
 /* this appears to be unreliable when a domain is being shut down */
 static inline struct client *tmh_client_from_cli_id(cli_id_t cli_id)
 {
-    struct domain *d = get_domain_by_id(cli_id);
+    struct domain *d = get_domain_by_id(cli_id); /* incs d->refcnt! */
     if (d == NULL)
         return NULL;
     return (struct client *)(d->tmem);
@@ -290,6 +290,8 @@ static inline struct client *tmh_client_
 {
     return (struct client *)(current->domain->tmem);
 }
+
+#define tmh_client_is_dying(_client) (!!_client->tmh->domain->is_dying)
 
 static inline cli_id_t tmh_get_cli_id_from_current(void)
 {

[-- Attachment #3: Type: text/plain, Size: 138 bytes --]

_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xensource.com
http://lists.xensource.com/xen-devel