From nobody Sun May 5 09:37:03 2024 Delivered-To: importer@patchew.org Received-SPF: none (zohomail.com: 192.237.175.120 is neither permitted nor denied by domain of lists.xenproject.org) client-ip=192.237.175.120; envelope-from=xen-devel-bounces@lists.xenproject.org; helo=lists.xenproject.org; Authentication-Results: mx.zohomail.com; spf=none (zohomail.com: 192.237.175.120 is neither permitted nor denied by domain of lists.xenproject.org) smtp.mailfrom=xen-devel-bounces@lists.xenproject.org ARC-Seal: i=1; a=rsa-sha256; t=1583844287; cv=none; d=zohomail.com; s=zohoarc; b=FfvQyOWc3fnmOYoRlGEWLc0rYpjqTFGkoSs8e6dl7dEfzrAxa65DhsoooVf8WfH1l2dFIByHD1I3VzBeCY7rLDNxYwSnlyIkE5je2Mw+IME6ge0Av718hZdGWeLHsMZz/KzyccatO4k9LaG6ccwk/XYV4ffovvnnR7pdZU4Fjm4= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1583844287; h=Content-Type:Content-Transfer-Encoding:Cc:Date:From:List-Subscribe:List-Post:List-Id:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:To; bh=8ZAtt+lSYLyYYo3vzZ4OQqHmAcaXzeg6e2ZyRplNAmI=; b=QjQfQPXXfwIFvG7kkkj8JXORGUKFNVL1e/oITOOuvTD5CV8KqzZzQVaDn47jj0cDRaiF9nTzra7djspvIRKZj+OCNaqjdmtLY7udZQxExWX4PqG+0kj7v5Sr5r4+8qEp/+mJnpLrZ62KzapJ+T/hKcaRKzxCrpq83m34/HWKudo= ARC-Authentication-Results: i=1; mx.zohomail.com; spf=none (zohomail.com: 192.237.175.120 is neither permitted nor denied by domain of lists.xenproject.org) smtp.mailfrom=xen-devel-bounces@lists.xenproject.org Return-Path: Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) by mx.zohomail.com with SMTPS id 1583844287423275.6145776175953; Tue, 10 Mar 2020 05:44:47 -0700 (PDT) Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.89) (envelope-from ) id 1jBeEu-00080W-2R; Tue, 10 Mar 2020 12:44:04 +0000 Received: from us1-rack-iad1.inumbo.com ([172.99.69.81]) by lists.xenproject.org with esmtp (Exim 4.89) (envelope-from ) id 1jBeEs-00080R-8c for xen-devel@lists.xenproject.org; Tue, 10 Mar 2020 12:44:02 +0000 Received: from smtp-fw-9102.amazon.com (unknown [207.171.184.29]) by us1-rack-iad1.inumbo.com (Halon) with ESMTPS id d14d323e-62cc-11ea-92cf-bc764e2007e4; Tue, 10 Mar 2020 12:44:01 +0000 (UTC) Received: from sea32-co-svc-lb4-vlan3.sea.corp.amazon.com (HELO email-inbound-relay-1a-7d76a15f.us-east-1.amazon.com) ([10.47.23.38]) by smtp-border-fw-out-9102.sea19.amazon.com with ESMTP; 10 Mar 2020 12:44:01 +0000 Received: from EX13MTAUEA002.ant.amazon.com (iad55-ws-svc-p15-lb9-vlan2.iad.amazon.com [10.40.159.162]) by email-inbound-relay-1a-7d76a15f.us-east-1.amazon.com (Postfix) with ESMTPS id D7629A2879; Tue, 10 Mar 2020 12:43:58 +0000 (UTC) Received: from EX13D22EUB002.ant.amazon.com (10.43.166.131) by EX13MTAUEA002.ant.amazon.com (10.43.61.77) with Microsoft SMTP Server (TLS) id 15.0.1236.3; Tue, 10 Mar 2020 12:43:57 +0000 Received: from EX13MTAUEA002.ant.amazon.com (10.43.61.77) by EX13D22EUB002.ant.amazon.com (10.43.166.131) with Microsoft SMTP Server (TLS) id 15.0.1497.2; Tue, 10 Mar 2020 12:43:56 +0000 Received: from u2f063a87eabd5f.cbg10.amazon.com (10.125.106.135) by mail-relay.amazon.com (10.43.61.169) with Microsoft SMTP Server id 15.0.1236.3 via Frontend Transport; Tue, 10 Mar 2020 12:43:55 +0000 X-Inumbo-ID: d14d323e-62cc-11ea-92cf-bc764e2007e4 IronPort-SDR: OKbgj6z6JFAm2Fy48+mWUE4QxhGcfOxgGNoONaL3g3DWIW9O+fzC1haX3kQtenXY+6AzzizxBM gprxO16kXbcg== X-IronPort-AV: E=Sophos;i="5.70,537,1574121600"; d="scan'208";a="30321223" From: To: Date: Tue, 10 Mar 2020 12:43:53 +0000 Message-ID: <20200310124353.4337-1-paul@xen.org> X-Mailer: git-send-email 2.20.1 MIME-Version: 1.0 Precedence: Bulk Subject: [Xen-devel] [PATCH v5] x86: irq: Do not BUG_ON multiple unbind calls for shared pirqs X-BeenThere: xen-devel@lists.xenproject.org X-Mailman-Version: 2.1.23 List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Cc: Julien Grall , Paul Durrant , Andrew Cooper , Varad Gautam , Jan Beulich , =?UTF-8?q?Roger=20Pau=20Monn=C3=A9?= Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Errors-To: xen-devel-bounces@lists.xenproject.org Sender: "Xen-devel" From: Varad Gautam XEN_DOMCTL_destroydomain creates a continuation if domain_kill -ERESTARTS. In that scenario, it is possible to receive multiple __pirq_guest_unbind calls for the same pirq from domain_kill, if the pirq has not yet been removed from the domain's pirq_tree, as: domain_kill() -> domain_relinquish_resources() -> pci_release_devices() -> pci_clean_dpci_irq() -> pirq_guest_unbind() -> __pirq_guest_unbind() For a shared pirq (nr_guests > 1), the first call would zap the current domain from the pirq's guests[] list, but the action handler is never freed as there are other guests using this pirq. As a result, on the second call, __pirq_guest_unbind searches for the current domain which has been removed from the guests[] list, and hits a BUG_ON. Make __pirq_guest_unbind safe to be called multiple times by letting xen continue if a shared pirq has already been unbound from this guest. The PIRQ will be cleaned up from the domain's pirq_tree during the destruction in complete_domain_destroy anyway. Signed-off-by: Varad Gautam [taking over from Varad at v4] Signed-off-by: Paul Durrant --- Cc: Jan Beulich Cc: Julien Grall Cc: Roger Pau Monn=C3=A9 Cc: Andrew Cooper Roger suggested cleaning the entry from the domain pirq_tree so that we need not make it safe to re-call __pirq_guest_unbind(). This seems like a reasonable suggestion but the semantics of the code are almost impenetrable (e.g. 'pirq' is used to mean an index, a pointer and is also the name of struct so you generally have little idea what it actally means) so I prefer to stick with a small fix that I can actually reason about. v5: - BUG_ON(!shareable) rather than ASSERT(shareable) - Drop ASSERT on nr_guests v4: - Re-work the guest array search to make it clearer v3: - Style fixups v2: - Split the check on action->nr_guests > 0 and make it an ASSERT --- xen/arch/x86/irq.c | 19 ++++++++++++++++--- 1 file changed, 16 insertions(+), 3 deletions(-) diff --git a/xen/arch/x86/irq.c b/xen/arch/x86/irq.c index cc2eb8e925..a3701354e6 100644 --- a/xen/arch/x86/irq.c +++ b/xen/arch/x86/irq.c @@ -1680,9 +1680,22 @@ static irq_guest_action_t *__pirq_guest_unbind( =20 BUG_ON(!(desc->status & IRQ_GUEST)); =20 - for ( i =3D 0; (i < action->nr_guests) && (action->guest[i] !=3D d); i= ++ ) - continue; - BUG_ON(i =3D=3D action->nr_guests); + for ( i =3D 0; i < action->nr_guests; i++ ) + if ( action->guest[i] =3D=3D d ) + break; + + if ( i =3D=3D action->nr_guests ) /* No matching entry */ + { + /* + * In case the pirq was shared, unbound for this domain in an earl= ier + * call, but still existed on the domain's pirq_tree, we still rea= ch + * here if there are any later unbind calls on the same pirq. Retu= rn + * if such an unbind happens. + */ + BUG_ON(!action->shareable); + return NULL; + } + memmove(&action->guest[i], &action->guest[i+1], (action->nr_guests-i-1) * sizeof(action->guest[0])); action->nr_guests--; --=20 2.20.1 _______________________________________________ Xen-devel mailing list Xen-devel@lists.xenproject.org https://lists.xenproject.org/mailman/listinfo/xen-devel