From patchwork Wed Dec 18 10:53:37 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Varad Gautam X-Patchwork-Id: 11300263 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 797EE1580 for ; Wed, 18 Dec 2019 10:55:46 +0000 (UTC) Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id 5547324686 for ; Wed, 18 Dec 2019 10:55:46 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=fail reason="signature verification failed" (1024-bit key) header.d=amazon.de header.i=@amazon.de header.b="CI69wnW7" DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 5547324686 Authentication-Results: mail.kernel.org; dmarc=fail (p=quarantine dis=none) header.from=amazon.de Authentication-Results: mail.kernel.org; spf=none smtp.mailfrom=xen-devel-bounces@lists.xenproject.org Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.89) (envelope-from ) id 1ihWxs-0006Hz-BH; Wed, 18 Dec 2019 10:54:00 +0000 Received: from all-amaz-eas1.inumbo.com ([34.197.232.57] helo=us1-amaz-eas2.inumbo.com) by lists.xenproject.org with esmtp (Exim 4.89) (envelope-from ) id 1ihWxq-0006Hu-EC for xen-devel@lists.xenproject.org; Wed, 18 Dec 2019 10:53:58 +0000 X-Inumbo-ID: b13321d6-2184-11ea-9058-12813bfff9fa Received: from smtp-fw-4101.amazon.com (unknown [72.21.198.25]) by us1-amaz-eas2.inumbo.com (Halon) with ESMTPS id b13321d6-2184-11ea-9058-12813bfff9fa; Wed, 18 Dec 2019 10:53:58 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=amazon.de; i=@amazon.de; q=dns/txt; s=amazon201209; t=1576666438; x=1608202438; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=6zc8O12Jp7l0QY1iZGfmSgSmleNUDq9WTG4Oaq5lriY=; b=CI69wnW7ie/5GzMHuxElHQNjs+3AcmRYPDByUD7l4IluBxn/vVKdVJF3 QEs3+jZMUjRL8KELhVw2iVEC3dcT3+vyLbabq020eqZ3+6Wivzy9HgpBE tccCjWphPpsgvJ3yVh2z8N7ciQOtzvphFJwuH/zKwMlV14XjpOCmr8hia 4=; IronPort-SDR: bqPLBvWVVOJxsCjIM1XBgahAgfYxhp+WQoJM0Xsj+5FWCKBMFAzphTCtUTwebq2rpARQtrOLMN 7zCVvWgblO5g== X-IronPort-AV: E=Sophos;i="5.69,329,1571702400"; d="scan'208";a="9017212" Received: from iad12-co-svc-p1-lb1-vlan3.amazon.com (HELO email-inbound-relay-2c-87a10be6.us-west-2.amazon.com) ([10.43.8.6]) by smtp-border-fw-out-4101.iad4.amazon.com with ESMTP; 18 Dec 2019 10:53:56 +0000 Received: from EX13MTAUEA002.ant.amazon.com (pdx4-ws-svc-p6-lb7-vlan2.pdx.amazon.com [10.170.41.162]) by email-inbound-relay-2c-87a10be6.us-west-2.amazon.com (Postfix) with ESMTPS id 2E1BAA210A; Wed, 18 Dec 2019 10:53:56 +0000 (UTC) Received: from EX13D22EUA003.ant.amazon.com (10.43.165.210) by EX13MTAUEA002.ant.amazon.com (10.43.61.77) with Microsoft SMTP Server (TLS) id 15.0.1236.3; Wed, 18 Dec 2019 10:53:55 +0000 Received: from EX13MTAUWA001.ant.amazon.com (10.43.160.58) by EX13D22EUA003.ant.amazon.com (10.43.165.210) with Microsoft SMTP Server (TLS) id 15.0.1367.3; Wed, 18 Dec 2019 10:53:54 +0000 Received: from u908889d5e8f057.ant.amazon.com (10.28.86.33) by mail-relay.amazon.com (10.43.160.118) with Microsoft SMTP Server id 15.0.1367.3 via Frontend Transport; Wed, 18 Dec 2019 10:53:52 +0000 From: Varad Gautam To: Date: Wed, 18 Dec 2019 11:53:37 +0100 Message-ID: <1576666417-20989-1-git-send-email-vrd@amazon.de> X-Mailer: git-send-email 2.7.4 In-Reply-To: <1562165173-31383-1-git-send-email-vrd@amazon.de> References: <1562165173-31383-1-git-send-email-vrd@amazon.de> MIME-Version: 1.0 Precedence: Bulk Subject: [Xen-devel] [PATCH v2] x86: irq: Do not BUG_ON multiple unbind calls for shared pirqs X-BeenThere: xen-devel@lists.xenproject.org X-Mailman-Version: 2.1.23 List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Cc: Andrew Cooper , Varad Gautam , Jan Beulich , =?utf-8?q?Roger_Pau_Monn=C3=A9?= Errors-To: xen-devel-bounces@lists.xenproject.org Sender: "Xen-devel" XEN_DOMCTL_destroydomain creates a continuation if domain_kill -ERESTARTS. In that scenario, it is possible to receive multiple _pirq_guest_unbind calls for the same pirq from domain_kill, if the pirq has not yet been removed from the domain's pirq_tree, as: domain_kill() -> domain_relinquish_resources() -> pci_release_devices() -> pci_clean_dpci_irq() -> pirq_guest_unbind() -> __pirq_guest_unbind() For a shared pirq (nr_guests > 1), the first call would zap the current domain from the pirq's guests[] list, but the action handler is never freed as there are other guests using this pirq. As a result, on the second call, __pirq_guest_unbind searches for the current domain which has been removed from the guests[] list, and hits a BUG_ON. Make __pirq_guest_unbind safe to be called multiple times by letting xen continue if a shared pirq has already been unbound from this guest. The PIRQ will be cleaned up from the domain's pirq_tree during the destruction in complete_domain_destroy anyways. Signed-off-by: Varad Gautam CC: Jan Beulich CC: Roger Pau Monné CC: Andrew Cooper v2: Split the check on action->nr_guests > 0 and make it an ASSERT, reword. Reviewed-by: Paul Durrant --- xen/arch/x86/irq.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/xen/arch/x86/irq.c b/xen/arch/x86/irq.c index 5d0d94c..3eb7b22 100644 --- a/xen/arch/x86/irq.c +++ b/xen/arch/x86/irq.c @@ -1863,7 +1863,16 @@ static irq_guest_action_t *__pirq_guest_unbind( for ( i = 0; (i < action->nr_guests) && (action->guest[i] != d); i++ ) continue; - BUG_ON(i == action->nr_guests); + if ( i == action->nr_guests ) { + ASSERT(action->nr_guests > 0) ; + /* In case the pirq was shared, unbound for this domain in an earlier call, but still + * existed on the domain's pirq_tree, we still reach here if there are any later + * unbind calls on the same pirq. Return if such an unbind happens. */ + if ( action->shareable ) + return NULL; + BUG(); + } + memmove(&action->guest[i], &action->guest[i+1], (action->nr_guests-i-1) * sizeof(action->guest[0])); action->nr_guests--;