[PATCH v13 04/14] xen/percpu: defer freeing per-CPU areas after resume failures

[Mykola Kvach <mykola_kvach@xxxxxxxx>]

When a CPU fails to come back during system resume, cpu_up() sends
CPU_UP_CANCELED. After trying the other CPUs, enable_nonboot_cpus()
sends CPU_RESUME_FAILED for the same CPU.

On architectures which do not park offline CPUs, both notifications
queue free_percpu_area(). The release metadata, including the rcu_head,
is stored in that CPU's per-CPU area. The first callback may already
have freed the area when the second notification arrives, or the same
rcu_head may be queued twice. The CPU_RESUME_FAILED callbacks also need
the area to clean up timers and CPU-pool state.

Skip the per-CPU release for CPU_UP_CANCELED during resume. Let
CPU_RESUME_FAILED release the area after the other cleanup callbacks.

This prepares the common code for Arm system suspend. x86 parks offline
CPUs and does not take this release path.

Signed-off-by: Mykola Kvach <mykola_kvach@xxxxxxxx>
---
Changes in v13:
- New patch.
---
 xen/common/percpu.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/xen/common/percpu.c b/xen/common/percpu.c
index f180f37253..e957c3c58d 100644
--- a/xen/common/percpu.c
+++ b/xen/common/percpu.c
@@ -82,6 +82,15 @@ static int cf_check cpu_percpu_callback(
         break;
 
     case CPU_UP_CANCELED:
+        /*
+         * On resume, CPU_RESUME_FAILED is sent after all CPUs have been
+         * tried. Keep the area alive for its cleanup callbacks and let
+         * that notification release it.
+         */
+        if ( system_state == SYS_STATE_resume )
+            break;
+        fallthrough;
+
     case CPU_DEAD:
     case CPU_RESUME_FAILED:
         if ( !park_offline_cpus && system_state != SYS_STATE_suspend )
-- 
2.53.0