[Xen-devel] [PATCH] mm: fix LLVM code-generation issue

[Roger Pau Monne <roger.pau@xxxxxxxxxx>]

LLVM code generation can attempt to perform a load from a variable in
the next condition of an expression under certain circumstances, thus
turning the following condition:

if ( system_state < SYS_STATE_active && opt_bootscrub == BOOTSCRUB_IDLE )

Into:

0xffff82d080223967 <+103>: cmpl   $0x3,0x37b032(%rip) # 0xffff82d08059e9a0 
<system_state>
0xffff82d08022396e <+110>: setb   -0x29(%rbp)
0xffff82d080223972 <+114>: cmpl   $0x2,0x228a8b(%rip) # 0xffff82d08044c404 
<opt_bootscrub>

Such code will trigger a page fault if system_state >=
SYS_STATE_active.

In order to prevent such optimization signal to the compiler that
accessing opt_bootscrub can have side effects by using ACCESS_ONCE.
This has been reported and discussed with upstream LLVM:

https://bugs.llvm.org/show_bug.cgi?id=39707

I haven't been able to find any other instances of such conditional
expression that uses system_state together with an init variable or
function.

Signed-off-by: Roger Pau Monné <roger.pau@xxxxxxxxxx>
---
Cc: Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
Cc: George Dunlap <George.Dunlap@xxxxxxxxxxxxx>
Cc: Ian Jackson <ian.jackson@xxxxxxxxxxxxx>
Cc: Jan Beulich <jbeulich@xxxxxxxx>
Cc: Julien Grall <julien.grall@xxxxxxx>
Cc: Konrad Rzeszutek Wilk <konrad.wilk@xxxxxxxxxx>
Cc: Stefano Stabellini <sstabellini@xxxxxxxxxx>
Cc: Tim Deegan <tim@xxxxxxx>
Cc: Wei Liu <wei.liu2@xxxxxxxxxx>
---
 xen/common/page_alloc.c | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/xen/common/page_alloc.c b/xen/common/page_alloc.c
index 08ee8cfbb9..60adf6f64b 100644
--- a/xen/common/page_alloc.c
+++ b/xen/common/page_alloc.c
@@ -1772,7 +1772,17 @@ static void init_heap_pages(
     first_valid_mfn = mfn_min(page_to_mfn(pg), first_valid_mfn);
     spin_unlock(&heap_lock);
 
-    if ( system_state < SYS_STATE_active && opt_bootscrub == BOOTSCRUB_IDLE )
+    if ( system_state < SYS_STATE_active &&
+         /*
+          * Use ACCESS_ONCE in order to let the compiler know accessing
+          * opt_bootscrub in this context can have side-effects (since it
+          * might be unmapped depending on the value of system_state).
+          * This prevents the compiler from attempting a load of
+          * opt_bootscrub before checking the value of system_state. See:
+          *
+          * https://bugs.llvm.org/show_bug.cgi?id=39707
+          */
+         ACCESS_ONCE(opt_bootscrub) == BOOTSCRUB_IDLE )
         idle_scrub = true;
 
     for ( i = 0; i < nr_pages; i++ )
-- 
2.19.1


_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxxxxxxxxx
https://lists.xenproject.org/mailman/listinfo/xen-devel