Re: [Xen-devel] [PATCH] x86: irq: Do not BUG_ON multiple unbind calls for shared pirqs

[Roger Pau Monné <roger.pau@xxxxxxxxxx>]

On Wed, Jul 03, 2019 at 04:46:13PM +0200, Varad Gautam wrote:
> It is possible to receive multiple __pirq_guest_unbind calls for the same pirq
> if the pirq has not yet been removed from the domain's pirq_tree. For a shared
> pirq (nr_guests > 1), the first call zaps the current domain from the pirq's
> guests[] list, but the action handler is never freed as there are other guests
> using this pirq. As a result, on the second call, __pirq_guest_unbind tries
> search for the current domain which has been removed from the guests[] list,
> and hits a BUG_ON.

Thanks for digging into this, the passthrough code is quite complex
and not easy to debug.

As raised by Jan, I'm not sure I see how the above can happen. For
PIRQs bound to event channels the freeing can only happen once, as
the event channel is afterwards closed and further calls won't make
progress (regardless of whether the underlying PIRQ is shared or not).

So I assume this is something that you have seen with HVM guests and
dpci?

Getting the full trace that leads to the BUG_ON would be very
helpful, because as pointed out this is likely something that wants
to be fixed in the caller of pirq_guest_unbind.

Do you have a reliable way to reproduce?

> Allow xen to continue if a shared pirq has already been unbound from this 
> guest.
> It will be cleaned up from the domain's pirq_tree during the destruction in
> complete_domain_destroy.
> 
> Signed-off-by: Varad Gautam <vrd@xxxxxxxxx>
> 
> ---
> 
> To apply stable-4.11 onwards.

Do you also have a bisection of when the issue was introduced?

Thanks, Roger.

_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxxxxxxxxx
https://lists.xenproject.org/mailman/listinfo/xen-devel