[Top][All Lists]

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

[Qemu-devel] [PATCH] SMP BIOS race condition bug

From: David Wentzlaff
Subject: [Qemu-devel] [PATCH] SMP BIOS race condition bug
Date: Thu, 27 Mar 2008 21:39:50 -0400 (EDT)

This patch fixes a race condition in the Bochs rombios. Under normal MP processor enumeration, the boot processor sends an inter-processor-interrupt (IPI) to the non-boot processors vectoring them to "smp_ap_boot_code_start". The code at smp_ap_boot_code_start then increments CPU_COUNT_ADDR. The current code base increments with an incw instruction, unfortunately incw is not atomic and multiple processors can read, then modify, then write back the result at the same time resulting in fewer processors being counted than are actually in the system. I have seen this happen in high processor (>=16) count QEMU emulations. I have experienced anywhere from {n, n-1, n-2} processors detected by the BIOS. The fix is to simply lock the incw with the x86 'lock' prefix. Attached is the patch. I have CCed qemu-devel as it that project as well as bochs.

David Wentzlaff

Index: rombios32start.S
RCS file: /cvsroot/bochs/bochs/bios/rombios32start.S,v
retrieving revision 1.4
diff -d -u -r1.4 rombios32start.S
--- rombios32start.S    26 Jan 2008 09:15:27 -0000      1.4
+++ rombios32start.S    28 Mar 2008 01:29:49 -0000
@@ -42,7 +42,7 @@
   xor %ax, %ax
   mov %ax, %ds
+  lock incw CPU_COUNT_ADDR
   jmp 1b

reply via email to

[Prev in Thread] Current Thread [Next in Thread]