From mboxrd@z Thu Jan  1 00:00:00 1970
From: Avi Kivity <avi@redhat.com>
Subject: Re: [RFC -v4 PATCH 3/3] kvm: use yield_to instead of sleep in kvm_vcpu_on_spin
Date: Thu, 13 Jan 2011 15:16:52 +0200
Message-ID: <4D2EFB44.2060906@redhat.com>
References: <20110113002108.3abdf953@annuminas.surriel.com> <20110113002745.51190252@annuminas.surriel.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Cc: kvm@vger.kernel.org, linux-kernel@vger.kernel.org,
	Srivatsa Vaddagiri <vatsa@linux.vnet.ibm.com>,
	Peter Zijlstra <a.p.zijlstra@chello.nl>,
	Mike Galbraith <efault@gmx.de>,
	Chris Wright <chrisw@sous-sol.org>
To: Rik van Riel <riel@redhat.com>
Return-path: <linux-kernel-owner@vger.kernel.org>
In-Reply-To: <20110113002745.51190252@annuminas.surriel.com>
Sender: linux-kernel-owner@vger.kernel.org
List-Id: kvm.vger.kernel.org

On 01/13/2011 07:27 AM, Rik van Riel wrote:
> Instead of sleeping in kvm_vcpu_on_spin, which can cause gigantic
> slowdowns of certain workloads, we instead use yield_to to hand
> the rest of our timeslice to another vcpu in the same KVM guest.
>
>

> +	for (pass = 0; pass<  2&&  !yielded; pass++) {
> +		kvm_for_each_vcpu(i, vcpu, kvm) {
> +			struct task_struct *task = vcpu->task;
> +			if (!pass&&  i<  last_boosted_vcpu) {
> +				i = last_boosted_vcpu;
> +				continue;
> +			} else if (pass&&  i>  last_boosted_vcpu)
> +				break;
> +			if (vcpu == me)
> +				continue;
> +			if (!task)
> +				continue;
> +			if (waitqueue_active(&vcpu->wq))
> +				continue;

Suppose the vcpu exits at this point, and its task terminates.

> +			if (task->flags&  PF_VCPU)
> +				continue;

Here you dereference freed memory.

> +			kvm->last_boosted_vcpu = i;
> +			yielded = 1;
> +			yield_to(task, 1);

And here you do unimaginable things to that freed memory.

I think the first patch needs some reference counting... I'd move it to 
the outermost KVM_RUN loop to reduce the performance impact.

> +			break;
> +		}
> +	}
>   }
>   EXPORT_SYMBOL_GPL(kvm_vcpu_on_spin);

-- 
error compiling committee.c: too many arguments to function