Re: [PATCH] x86/vpt: Validate timer object with generation number

[Jan Beulich <jbeulich@xxxxxxxx>]

On 23.10.2026 03:12, Tu Dinh wrote:
> The remote completion path of pt_update_irq removes timers from tm_list
> by checking that their addresses match the previous iteration. However,
> if the guest rearms a timer during the gap between two list iterations,
> the resulting timer object is no longer the same, even if their
> addresses match. Removing the timer from the list will then lose the
> armed timer object.
> 
> Record a generation number in each timer object upon arming, and check
> that the generation number matches before removing it from the list.

Fixes: 0bcbc971feaa ("x86/vpt: add support for level interrupts")

> Signed-off-by: Tu Dinh <ngoc-tu.dinh@xxxxxxxxxx>

Reviewed-by: Jan Beulich <jbeulich@xxxxxxxx>
preferably with ...

> --- a/xen/arch/x86/hvm/vpt.c
> +++ b/xen/arch/x86/hvm/vpt.c
> @@ -318,6 +318,7 @@ int pt_update_irq(struct vcpu *v)
>      struct list_head *head = &v->arch.hvm.tm_list;
>      struct periodic_time *pt, *temp, *earliest_pt;
>      uint64_t max_lag;
> +    uint64_t generation;

... this folded with the earlier line.

> --- a/xen/arch/x86/include/asm/hvm/vpt.h
> +++ b/xen/arch/x86/include/asm/hvm/vpt.h
> @@ -34,6 +34,7 @@ struct periodic_time {
>      u8 irq;
>      struct vcpu *vcpu;          /* vcpu timer interrupt delivers to */
>      u32 pending_intr_nr;        /* pending timer interrupts */
> +    u64 generation;             /* distinguish two armings of the same timer 
> */
>      u64 period;                 /* frequency in ns */
>      s_time_t scheduled;         /* scheduled timer interrupt */
>      u64 last_plt_gtime;         /* platform time when last IRQ is injected */

Also, no matter that adjacent lines use u<N>, it wants to be uint<N>_t for
new fields. Otherwise we will never get rid of the remaining u<N>.

I can make these adjustments while committing, no need to send a v2 just for
that.

Jan