From win-pv-devel-bounces@lists.xenproject.org Wed May 13 14:05:16 2026 Return-path: Envelope-to: archives@lists.xenproject.org Delivery-date: Wed, 13 May 2026 14:05:16 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1308076.1579617 (Exim 4.92) (envelope-from ) id 1wNAD5-00011Y-Id; Wed, 13 May 2026 14:05:15 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1308076.1579617; Wed, 13 May 2026 14:05:15 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wNAD5-00011O-Fa; Wed, 13 May 2026 14:05:15 +0000 Received: by outflank-mailman (input) for mailman id 1308076; Wed, 13 May 2026 14:05:13 +0000 Received: from mx.expurgate.net ([195.190.135.10]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wNAD3-00010w-93 for win-pv-devel@lists.xenproject.org; Wed, 13 May 2026 14:05:13 +0000 Received: from mx.expurgate.net (helo=localhost) by mx.expurgate.net with esmtp id 1wNAD2-000luV-Fv for win-pv-devel@lists.xenproject.org; Wed, 13 May 2026 16:05:12 +0200 Received: from [10.42.69.8] (helo=localhost) by localhost with ESMTP (eXpurgate MTA 0.9.1) (envelope-from ) id 6a048512-e002-0a2a0a5209dd-0a2a4508ec02-34 for ; Wed, 13 May 2026 16:05:12 +0200 Received: from [52.101.56.21] (helo=BN1PR04CU002.outbound.protection.outlook.com) by tlsNG-c1860d.mxtls.expurgate.net with ESMTPS (eXpurgate 4.56.1) (envelope-from ) id 6a048516-63b5-0a2a45080019-346538152edf-3 for ; Wed, 13 May 2026 16:05:12 +0200 Received: from SA6PR03MB7760.namprd03.prod.outlook.com (2603:10b6:806:43c::5) by SA2PR03MB5723.namprd03.prod.outlook.com (2603:10b6:806:118::6) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.9913.11; Wed, 13 May 2026 14:05:09 +0000 Received: from SA6PR03MB7760.namprd03.prod.outlook.com ([fe80::4d5b:a91f:46a3:4b38]) by SA6PR03MB7760.namprd03.prod.outlook.com ([fe80::4d5b:a91f:46a3:4b38%7]) with mapi id 15.20.9913.009; Wed, 13 May 2026 14:05:08 +0000 X-BeenThere: win-pv-devel@lists.xenproject.org List-Id: Developer list for the Windows PV Drivers subproject List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: win-pv-devel-bounces@lists.xenproject.org Precedence: list Sender: "win-pv-devel" Authentication-Results: eu.smtp.expurgate.cloud; dkim=pass header.s=selector1 header.d=citrix.com header.i="@citrix.com" header.h="From:Date:Subject:Message-ID:Content-Type:MIME-Version:x-ms-exchange-senderadcheck" ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=wfIo9lYG8AsN75vT0z3qb7rGNwzYRW4W1LCZpXrbadpVARRDTqEZjoL/6cHJY33ScFmMV+wju7Rexfm3nqmct2VOVml+Kmv75ONZtUX6RrMq9twTPdYOqS+OBGMIli5HcdEkut/EHlvRMHCtkD6yRfnAeSbi83y4529NOYs2fZNNJbsoyd7XKWyahzq49O5UBxLM0EWmq/Ze7U1egD1F3Iz+tTj4IszTy+Z/f1UnIwUt0nmCo4USt+93ikCQARs3gU3Ofx/+/f9O6Z1rV+OghKXKIAQq5NoxhHr9kv0w30rLQqOJ+sL9IrhrOjylih58itIS8uCMFztbj9RVP7NvJA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=AywKJuq7cZ17BIUIhFo4V+zRD9jDte/+vdmVxlJzaSk=; b=O6jofNli6wIKy/SHHNzQEZxfXaqOBzGIBMsK6OGyzhZr6e5EzVbi2HEGQ2yU4yIEuol+wXLRL9lXGg6dsuoB8cU7cnbO5cG1aZ2MAv4iDypjE1M4AzslfHmr5EX0Vrv+rrDPJgnVFKIgJYAyHC/dEPPs2ITv31aEh5DeeFfyKyIgVJ40dLU4eTAM4W8yPvhFT6vHF//ajMmcLEIUcXwsMGBQsD8pV12BiJZQ4yhN+K7hOrBEcYzvp/oJNGc9Pw6vfBH8ZpitY55QtsM/2uJICmmnbKmlG70ra6l+7i/TDkY1nFf5xBhhnBgvLEQvoTok6s0pu5cmjIZy73SSpUXtLA== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=citrix.com; dmarc=pass action=none header.from=citrix.com; dkim=pass header.d=citrix.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=citrix.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=AywKJuq7cZ17BIUIhFo4V+zRD9jDte/+vdmVxlJzaSk=; b=vpfxYJMgc/9NDEAEsqbteQ0z7j4TMOVNDU1ghxpJ4D0Eo76So99F+bTll48YSYeltyPlCmm6avMoUhgV25wffUZ9e8Qh4J1k6ySmdWeMZqsULz1l9m6cCvxZ5sCf8Hrn9wy/dV15bkM9R8UIbUJUP69yYtzVKZXZxTADlpxfnX8= From: Owen Smith To: Tu Dinh , "win-pv-devel@lists.xenproject.org" Subject: Re: [PATCH 4/5] Implement rundown-based MRSW lock Thread-Topic: [PATCH 4/5] Implement rundown-based MRSW lock Thread-Index: AQHczZGVucbfB0LVdUy2gYIuu73oyrYMJkPM Date: Wed, 13 May 2026 14:05:08 +0000 Message-ID: References: <20260416110952.355-1-ngoc-tu.dinh@vates.tech> <20260416110952.355-5-ngoc-tu.dinh@vates.tech> In-Reply-To: <20260416110952.355-5-ngoc-tu.dinh@vates.tech> Accept-Language: en-GB, en-US Content-Language: en-GB X-MS-Has-Attach: X-MS-TNEF-Correlator: msip_labels: authentication-results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=citrix.com; x-ms-publictraffictype: Email x-ms-traffictypediagnostic: SA6PR03MB7760:EE_|SA2PR03MB5723:EE_ x-ms-office365-filtering-correlation-id: c0058b20-596f-45d9-a159-08deb0f8a44a x-ms-exchange-senderadcheck: 1 x-ms-exchange-antispam-relay: 0 x-microsoft-antispam: BCL:0;ARA:13230040|1800799024|366016|376014|38070700021|11063799003|56012099003|18002099003|22082099003; x-microsoft-antispam-message-info: G66HA7dlWNcvXJY4uXxYAZ4Nzclnf8DfBgFRFZdWvUszGMMW0CEcu0r0950+faihgRVGP2Aed0WjPeDEkLQYTNYmNEbmVi3cfIrMV65LHF2zJiWMKlZasJDgzVham3FJHWzenOw2nBkj97rSahyE2pCEq1Bpr97sm+iR0ZRSQOnJiODxpQsCcSyCXzFvrAZs736+b7KREDnUf3Q5GtTGYt6EIDeUoJHHGhWYxA0kg5DpDUOa//Kv2HjNaCdrNiIXLjhu1o1F3NQbWfVuf1cbdWyyRPJ7FFF6H1shQtXEZINveYMN6tOz6/LAfd/8HprB5haRvoaZ7Ytbio9T1TExLdyLdi2fhA9aLWD5hBgQH2JXmiBGaNOASwHvHOyHkYgFR6s9ee0YW38QUC6yT2znQOLb6Ke176hSTdmZnEGWzQteK34MIkG6zBhGPhfUoXAplwlKT53HFaVXsEUzX3kXqnfcgDXLPINnYoz3+xENYGi0hGafsXewImAeMyVe4/JaRf8SUvnJc1+OGJBvpdpoGhV4FyTtlD42FrRpLFpCiqZB2pkqECRCHU/ZC9KJxxcDP89ztAD93nqR8eoQeGOAz1aMCJNHb3L/oHvXkhYAC8JyyXs8JOBt8xtnMYqU6R2ZrRJJw2vKB0sXJfssa28zJHXPuHOEQQA6KH9uoPNUZ+R63P0EYZ/+8aIAceCryS3F x-forefront-antispam-report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:SA6PR03MB7760.namprd03.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(1800799024)(366016)(376014)(38070700021)(11063799003)(56012099003)(18002099003)(22082099003);DIR:OUT;SFP:1101; x-ms-exchange-antispam-messagedata-chunkcount: 1 x-ms-exchange-antispam-messagedata-0: =?us-ascii?Q?ognhfiOVuOrCA0pISYyrFLDOJNmXPUrwbRgK1GPuojtu8B9bNSZ70WXg39FJ?= =?us-ascii?Q?wSDSD1CBaMcJ/wWCLysL0nKTfZ0V6WB1b5KkKs/u0TGRXKIR4Da1pN1PzNa0?= =?us-ascii?Q?/aE2WglwFalBaMMkBlMTnc19Ce+TdnAl6bVO7DP6iY36dJ1l0/b7WLexG+Ei?= =?us-ascii?Q?rzxXzKHqLFh8vL1uPuo4FnPcQyWEXUKrs/ppOIEv5Jma2TTlUUxzAOc/wG4O?= =?us-ascii?Q?BumeXI/TUQYPHIERVyWmkA1fbjnG18ur6VA5WopsFT7vJFYGaidHH/mseVgp?= =?us-ascii?Q?w6fcGWQFh8vh1vYrjpmGrKem2Su9lL8H/0xP13CkYU6XSMAwjBAx3md5foSB?= =?us-ascii?Q?cuv/vIDUsOwm0G2XL4L4k7p2B/u51kg88skBHsU8p/ya3UqKCRIk+tmFBHuX?= =?us-ascii?Q?hRRWAlGj+M4GTk0UOLrOO0CRhivPIgpE1RCTSN10S+6nxQm8Lci9zAoaITr0?= =?us-ascii?Q?5ksI4DuN5XtqkvLrthusiDQ4gGYA0MawZ3iPuMiKAjMNeabVvIT+PgamDL8R?= =?us-ascii?Q?1rPT4x8W//7EGBbhqGOygLkZbWkraWwRUfGCDsf8OyFKrhXQojHwMQyEworf?= =?us-ascii?Q?dvgGL5S7cHurncIiL9kmeF2J+TcvQPFQyRgnx5CpxpOk5cMfTmEAM+qJZrpz?= =?us-ascii?Q?DXewGadOoK0VekyKK8jGjeycf7WnjPBctgvohZ2OE8kajM+WKr+GZTzTVXBd?= =?us-ascii?Q?bMt3peCZIlT2mnhAvPwFz5g+42z1pQQMDqOQkvj7rRXT569jspjRUNmLsIIC?= =?us-ascii?Q?yRBHufiaa0Lb9MtdSj64tFmuNpR7esvhOttvyxn7dbDjdLt8C+6n03bM4q1U?= =?us-ascii?Q?DRjnxOzDITpqrriUT88pqMuwdXPqy3FgyDIeyCNsndlcD3a+b7Q5EpQlN7KS?= =?us-ascii?Q?FFwnQy1kAn9HYpeE0BEXeS21j5tc6jiWwLNtno8beqvief/X2W0e4opK/qhm?= =?us-ascii?Q?RNGwZBwZOi2+cK7KN3hiO3s7rFB/i+D4uLMxUVP6fCHAde6hTPNMBEClN/M9?= =?us-ascii?Q?xAxdRqE8hKqSGeGReS0TR250TgLr+DO/+BwhgF5bZsg+Uu3wxDLDv6omMY0N?= =?us-ascii?Q?NvMRX7v0+5dyxYIF55IwV8uvpPu7WgZPc6WWKZhH+1ca51TeRrPcC81tZGjP?= =?us-ascii?Q?Iwu6vLNQCuoy6bjFTh16+3g2M+SfAjpUwVBuiqdYsLrsB9hP5C4hsR1YYigW?= =?us-ascii?Q?XAWrDdfwlWzuSkUedsSwIghJNkGip1WlWCD7KiOwreNcYmKG/uYkB2zkd4oS?= =?us-ascii?Q?aKMylXLPFoJmAva2KS2TyBknZJuQJigU0IHZIEBeJcnr+HY1c8QiPjSv7bKK?= =?us-ascii?Q?pVfvBoLQtYabOj3dWqaqmm/3x3UVE9AtHh7Do1MU3XsuSCfH5brEHIoytvLu?= =?us-ascii?Q?wciG0ljKJU6cDlv68R4yhURNJlh75GSIYUkmIdDTlQmf/IjO/KYIrBl9rPRL?= =?us-ascii?Q?jeTqVI7bqXNXP+O3ixNvW92TjMWJQXNK5+/ju9p+9d2ciuPt4Uu0a7t9JaFK?= =?us-ascii?Q?3/rzpiiQ+qtvu7ojOTbY5aPX/SA2+D88Cqmac/p+HKUFvf/b2693vQJ/shQr?= =?us-ascii?Q?hxJjy42QGpJfllK/DsTMOXNnuCfvO2sSfvuQfNzfrUxdksopb2rY1j5v0qu8?= =?us-ascii?Q?fD9vnpwkE7t0VfR6xGYQavmQwfpzk9R5OrtEeEl+a2KlfreDmr4Cz/rcQe4/?= =?us-ascii?Q?uuwmynTznh+/JA12QnH7lDTUF5EuByA2672LKHkhhdOelG44DMzEKAZLSeH9?= =?us-ascii?Q?It0GeJgDeA=3D=3D?= Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-OriginatorOrg: citrix.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: SA6PR03MB7760.namprd03.prod.outlook.com X-MS-Exchange-CrossTenant-Network-Message-Id: c0058b20-596f-45d9-a159-08deb0f8a44a X-MS-Exchange-CrossTenant-originalarrivaltime: 13 May 2026 14:05:08.7798 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 335836de-42ef-43a2-b145-348c2ee9ca5b X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: d5RFPxkhgnn24jX2cCVdy/rKXOSe2udcAgn0BCRQtegXS27kvF41k1kGguAvbJ3FavssZEikL1GICUZxH2o1fA== X-MS-Exchange-Transport-CrossTenantHeadersStamped: SA2PR03MB5723 X-purgate-ID: tlsNG-c1860d/1778681112-C4E78DB1-D188237C/0/0 X-purgate-type: clean X-purgate-size: 33421 Hi Tu, I'm having an issue with this patch During a VM start, its possible for a single system thread to acquire the l= ock exclusively, and while its locked, a DPC can then attempt to acquire the lock in shared = mode, resulting in a deadlock (if AcquireMrswLockShared is called) or spin (if SpinAcquireM= rswLockShared is called). 0: kd> k # Child-SP RetAddr Call Site 00 fffff805`49b48aa8 fffff805`b66b2b2c nt!DbgBreakPointWithStatus 01 fffff805`49b48ab0 fffff805`b66b0ada nt!KeAccumulateTicks+0x70c 02 fffff805`49b48b20 fffff805`b66b0833 nt!KiUpdateRunTime+0xd6 03 fffff805`49b48c70 fffff805`b66aed45 nt!KiUpdateTime+0x473 04 fffff805`49b48e20 fffff805`b66ae35d nt!KeClockInterruptNotify+0x195 05 fffff805`49b48f50 fffff805`b6a7520e nt!KiCallInterruptServiceRoutine= +0x2ed 06 fffff805`49b48fb0 fffff805`b6a75a1c nt!KiInterruptSubDispatchNoLockN= oEtw+0x4e 07 fffff805`49b412b0 fffff805`b66d6616 nt!KiInterruptDispatchNoLockNoEt= w+0x3c 08 fffff805`49b41448 fffff805`4c1d6689 nt!ExfAcquireRundownProtection+0= x6 09 (Inline Function) --------`-------- xenvif!__MrswRundownAcquire+0x9 = [src\xenvif\mrsw.h @ 84] 0a (Inline Function) --------`-------- xenvif!__SpinAcquireMrswLockShar= ed+0x9 [src\xenvif\mrsw.h @ 283] 0b fffff805`49b41450 fffff805`4c4a5dd0 xenvif!VifReceiverReturnPacket+0= x29 [src\xenvif\vif.c @ 537] 0c (Inline Function) --------`-------- xennet!__ReceiverReturnNetBuffer= Lists+0x54 [src\xennet\receiver.c @ 213] 0d (Inline Function) --------`-------- xennet!ReceiverReturnNetBufferLi= sts+0x54 [src\xennet\receiver.c @ 535] 0e fffff805`49b414a0 fffff805`4ac84661 xennet!MiniportReturnNetBufferLi= sts+0x70 [src\xennet\miniport.c @ 208] 0f fffff805`49b414d0 fffff805`4b341824 ndis!NdisFReturnNetBufferLists+0= x411 10 fffff805`49b415a0 fffff805`4b34759a wfplwfs!LwfLowerReturnNetBufferL= ists+0x84 11 fffff805`49b415f0 fffff805`4b347afa wfplwfs!L2NdisReceiveNetBufferLi= stsComplete+0x4e 12 fffff805`49b41620 fffff805`4ac8b628 wfplwfs!LwfLowerRecvNetBufferLis= ts+0x20a 13 fffff805`49b416e0 fffff805`4c4a62d4 ndis!NdisMIndicateReceiveNetBuff= erLists+0xa78 14 (Inline Function) --------`-------- xennet!__IndicateReceiveNetBuffe= rLists+0x41 [src\xennet\receiver.c @ 353] 15 (Inline Function) --------`-------- xennet!__ReceiverPushPackets+0xa= a [src\xennet\receiver.c @ 422] 16 fffff805`49b41900 fffff805`4c4a1147 xennet!ReceiverQueuePacket+0x1c4= [src\xennet\receiver.c @ 603] 17 fffff805`49b41980 fffff805`4c1c3cea xennet!AdapterVifCallback+0x77 [= src\xennet\adapter.c @ 237] 18 (Inline Function) --------`-------- xenvif!VifReceiverQueuePacket+0x= 90 [src\xenvif\vif.c @ 1244] 19 (Inline Function) --------`-------- xenvif!__ReceiverRingSwizzle+0x6= f1 [src\xenvif\receiver.c @ 1541] 1a fffff805`49b41a00 fffff805`b665993e xenvif!ReceiverRingQueueDpc+0x71= a [src\xenvif\receiver.c @ 1637] 1b fffff805`49b41ad0 fffff805`b6604f1b nt!KiExecuteAllDpcs+0x67e 1c fffff805`49b41d20 fffff805`b6a7ae15 nt!KiRetireDpcList+0x36b 1d fffff805`49b41fb0 fffff805`b6a7adbf nt!KxSwapStacksAndRetireDpcList+= 0x5 1e ffffdf04`854cf2f0 fffff805`b66ed1d5 nt!KiPlatformSwapStacksAndCallRe= turn 1f ffffdf04`854cf300 fffff805`b6a7a24f nt!KiDispatchInterrupt+0x65 20 ffffdf04`854cf330 fffff805`b6608670 nt!KiDpcInterrupt+0x39f 21 ffffdf04`854cf4c0 fffff805`4c1d5991 nt!KeReleaseSpinLock+0x30 22 (Inline Function) --------`-------- xenvif!FrontendSetState+0x1b4 [s= rc\xenvif\frontend.c @ 2797] 23 ffffdf04`854cf4f0 fffff805`4c4a5c83 xenvif!VifEnable+0x241 [src\xenv= if\vif.c @ 176] 24 (Inline Function) --------`-------- xennet!AdapterEnable+0x64 [src\x= ennet\adapter.c @ 1934] 25 ffffdf04`854cf550 fffff805`4adceb91 xennet!MiniportRestart+0x73 [src= \xennet\miniport.c @ 143] 26 ffffdf04`854cf580 fffff805`4ade13d1 ndis!ndisMInvokeRestart+0x51 27 ffffdf04`854cf5d0 fffff805`4adcea65 ndis!ndisMRestartMiniportInner+0= x141 28 ffffdf04`854cf660 fffff805`4adbf26c ndis!ndisMRestartMiniport+0x65 29 ffffdf04`854cf750 fffff805`4adbb4fb ndis!Ndis::BindEngine::Iterate+0= x7dc 2a ffffdf04`854cf910 fffff805`4adbac8a ndis!Ndis::BindEngine::UpdateBin= dings+0xab 2b ffffdf04`854cf9c0 fffff805`4add1771 ndis!Ndis::BindEngine::UpdateBin= dingsWorkItem+0x5a 2c ffffdf04`854cfa10 fffff805`b6709e32 ndis!KWorkItemBase >::CallbackThunk+0x11 2d ffffdf04`854cfa40 fffff805`b685904a nt!ExpWorkerThread+0x1b2 2e ffffdf04`854cfbf0 fffff805`b6a741c4 nt!PspSystemThreadStartup+0x5a 2f ffffdf04`854cfc40 00000000`00000000 nt!KiStartSystemThread+0x34 This seems to be a race condition, which depends on the ReceiverRingQueueDp= c getting executed when FrontendSetState drops the spinlock Owen ________________________________________ From: Tu Dinh Sent: 16 April 2026 12:10 PM To: win-pv-devel@lists.xenproject.org Cc: Tu Dinh; Owen Smith Subject: [PATCH 4/5] Implement rundown-based MRSW lock The current MRSW lock has a few downsides: * Large size (have to store a 1KB holder list) * Long fast-path acquire (~1KB of code) due to having to scan the holder list every acquire * Limited to 64 holders * Multiple IRQL operations per acquire * Always raises the critical section to DISPATCH_LEVEL It's currently only used as the cleanup lock for the VIF interface, so replace it with something simpler. Implement a read-write lock with the following properties: * The reader section is protected by an EX_RUNDOWN_REF. * Writer/cleanup section is implemented by running down the reference within a guarded mutex. * It offers 3 read acquire flavors: try acquire, spin acquire (both of which can be used from DISPATCH_LEVEL) and sleeping acquire (using the guarded mutex). * It makes the downgrade call explicit instead of overloading it via ReleaseMrswLockExclusive. * Finally, the lock supports cache-aware mode, where EX_RUNDOWN_REF is replaced with EX_RUNDOWN_REF_CACHE_AWARE using the corresponding macros. As the changes are only internal to vif.c, the VIF version doesn't need to be increased. Signed-off-by: Tu Dinh --- src/xenvif/mrsw.h | 530 +++++++++++++++++++++++++--------------------- src/xenvif/vif.c | 65 +++--- 2 files changed, 327 insertions(+), 268 deletions(-) diff --git a/src/xenvif/mrsw.h b/src/xenvif/mrsw.h index e1ff056..8bfa441 100644 --- a/src/xenvif/mrsw.h +++ b/src/xenvif/mrsw.h @@ -1,289 +1,347 @@ /* Copyright (c) Xen Project. * Copyright (c) Cloud Software Group, Inc. + * Copyright (c) Vates. * All rights reserved. - * - * Redistribution and use in source and binary forms, - * with or without modification, are permitted provided + * + * Redistribution and use in source and binary forms, + * with or without modification, are permitted provided * that the following conditions are met: - * - * * Redistributions of source code must retain the above - * copyright notice, this list of conditions and the + * + * * Redistributions of source code must retain the above + * copyright notice, this list of conditions and the * following disclaimer. - * * Redistributions in binary form must reproduce the above - * copyright notice, this list of conditions and the - * following disclaimer in the documentation and/or other + * * Redistributions in binary form must reproduce the above + * copyright notice, this list of conditions and the + * following disclaimer in the documentation and/or other * materials provided with the distribution. - * - * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND - * CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, - * INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF - * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE - * DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR - * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, - * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, - * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR - * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS - * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, - * WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING - * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE - * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF + * + * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND + * CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, + * INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF + * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE + * DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR + * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, + * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, + * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR + * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS + * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, + * WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING + * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE + * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF * SUCH DAMAGE. */ -#ifndef _XENVIF_MRSW_H -#define _XENVIF_MRSW_H +#ifndef _MRSW_H +#define _MRSW_H -#include +#include #include "assert.h" #include "util.h" -#pragma warning(disable:4127) // conditional expression is constant - -typedef struct _XENVIF_MRSW_HOLDER { - PKTHREAD Thread; - LONG Level; -} XENVIF_MRSW_HOLDER, *PXENVIF_MRSW_HOLDER; - -typedef struct _XENVIF_MRSW_LOCK { - volatile LONG64 Mask; - XENVIF_MRSW_HOLDER Holder[64]; - KEVENT Event; -} XENVIF_MRSW_LOCK, *PXENVIF_MRSW_LOCK; - -C_ASSERT(RTL_FIELD_SIZE(XENVIF_MRSW_LOCK, Holder) =3D=3D RTL_FIELD_SIZE(XE= NVIF_MRSW_LOCK, Mask) * 8 * sizeof (XENVIF_MRSW_HOLDER)); - -#define XENVIF_MRSW_EXCLUSIVE_SLOT 0 - -static FORCEINLINE VOID -InitializeMrswLock( - IN PXENVIF_MRSW_LOCK Lock +#pragma warning(push) +#pragma warning(disable:4201) // nameless struct/union +struct _MRSW_LOCK { + KGUARDED_MUTEX Mutex; + union { + EX_RUNDOWN_REF Rundown; + PEX_RUNDOWN_REF_CACHE_AWARE RundownCacheAware; + }; +}; +#pragma warning(pop) + +typedef struct _MRSW_LOCK MRSW_LOCK, *PMRSW_LOCK; +typedef struct _MRSW_LOCK MRSW_CACHE_AWARE_LOCK, *PMRSW_CACHE_AWARE_LOCK= ; + +static FORCEINLINE NTSTATUS +__MrswRundownInitialize( + _Inout_ struct _MRSW_LOCK *Lock, + _In_ BOOLEAN CacheAware, + _In_ ULONG Tag ) { - LONG Slot; - - RtlZeroMemory(Lock, sizeof (XENVIF_MRSW_LOCK)); - - for (Slot =3D 0; Slot < (LONG) sizeof (Lock->Mask) * 8; Slot++) - Lock->Holder[Slot].Level =3D -1; + if (CacheAware) { + Lock->RundownCacheAware =3D ExAllocateCacheAwareRundownProtection(= NonPagedPoolNx, + Ta= g); + if (!Lock->RundownCacheAware) + return STATUS_NO_MEMORY; + } else { + ExInitializeRundownProtection(&Lock->Rundown); + } - KeInitializeEvent(&Lock->Event, NotificationEvent, FALSE); + return STATUS_SUCCESS; } static FORCEINLINE BOOLEAN -__ClaimExclusive( - IN PXENVIF_MRSW_LOCK Lock +__MrswRundownAcquire( + _Inout_ struct _MRSW_LOCK *Lock, + _In_ BOOLEAN CacheAware ) { - LONG64 Old; - LONG64 New; - - Old =3D 0; - New =3D 1ll << XENVIF_MRSW_EXCLUSIVE_SLOT; - - return (InterlockedCompareExchange64(&Lock->Mask, New, Old) =3D=3D Old= ) ? TRUE : FALSE; + if (CacheAware) + return ExAcquireRundownProtectionCacheAware(Lock->RundownCacheAwar= e); + else + return ExAcquireRundownProtection(&Lock->Rundown); } -static FORCEINLINE KIRQL -__drv_maxIRQL(APC_LEVEL) -__drv_raisesIRQL(DISPATCH_LEVEL) -__drv_savesIRQL -__AcquireMrswLockExclusive( - IN PXENVIF_MRSW_LOCK Lock +static FORCEINLINE VOID +__MrswRundownRelease( + _Inout_ struct _MRSW_LOCK *Lock, + _In_ BOOLEAN CacheAware ) { - KIRQL Irql; - LONG Slot; - PKTHREAD Self; - PXENVIF_MRSW_HOLDER Holder; - - ASSERT3U(KeGetCurrentIrql(), <, DISPATCH_LEVEL); - KeRaiseIrql(DISPATCH_LEVEL, &Irql); - - Self =3D KeGetCurrentThread(); - - // Make sure we do not already hold the lock - for (Slot =3D 0; Slot < (LONG) sizeof (Lock->Mask) * 8; Slot++) - ASSERT(Lock->Holder[Slot].Thread !=3D Self); - - for (;;) { - if (__ClaimExclusive(Lock)) - break; - - KeLowerIrql(Irql); - - (VOID) KeWaitForSingleObject(&Lock->Event, - Executive, - KernelMode, - FALSE, - NULL); - KeClearEvent(&Lock->Event); - - KeRaiseIrql(DISPATCH_LEVEL, &Irql); - } - - Holder =3D &Lock->Holder[XENVIF_MRSW_EXCLUSIVE_SLOT]; - - ASSERT3P(Holder->Thread, =3D=3D, NULL); - Holder->Thread =3D Self; - Holder->Level =3D 0; - - return Irql; + if (CacheAware) + ExReleaseRundownProtectionCacheAware(Lock->RundownCacheAware); + else + ExReleaseRundownProtection(&Lock->Rundown); } -#define AcquireMrswLockExclusive(_Lock, _Irql) \ - do { \ - *(_Irql) =3D __AcquireMrswLockExclusive(_Lock); \ - } while (FALSE) - static FORCEINLINE VOID -__drv_maxIRQL(DISPATCH_LEVEL) -__drv_requiresIRQL(DISPATCH_LEVEL) -ReleaseMrswLockExclusive( - IN PXENVIF_MRSW_LOCK Lock, - IN __drv_restoresIRQL KIRQL Irql, - IN BOOLEAN Shared +__MrswRundownWait( + _Inout_ struct _MRSW_LOCK *Lock, + _In_ BOOLEAN CacheAware ) { - LONG Slot; - PKTHREAD Self; - LONG64 Old; - LONG64 New; - PXENVIF_MRSW_HOLDER Holder; - - ASSERT3U(KeGetCurrentIrql(), =3D=3D, DISPATCH_LEVEL); - - Slot =3D XENVIF_MRSW_EXCLUSIVE_SLOT + 1; // Choose any slot other than= the exclusive slot - - Old =3D 1ll << XENVIF_MRSW_EXCLUSIVE_SLOT; - New =3D (Shared) ? (1ll << Slot) : 0; - - Old =3D InterlockedCompareExchange64(&Lock->Mask, New, Old); - ASSERT3U(Old, =3D=3D , 1ll << XENVIF_MRSW_EXCLUSIVE_SLOT); - - Self =3D KeGetCurrentThread(); - - ASSERT3P(Lock->Holder[XENVIF_MRSW_EXCLUSIVE_SLOT].Thread, =3D=3D, Self= ); - - // If we are leaving the lock held shared then we need to transfer - // our identity information into the hew slot. - if (Shared) - Lock->Holder[Slot] =3D Lock->Holder[XENVIF_MRSW_EXCLUSIVE_SLOT]; - - Holder =3D &Lock->Holder[XENVIF_MRSW_EXCLUSIVE_SLOT]; - - Holder->Thread =3D NULL; - Holder->Level =3D -1; - - KeLowerIrql(Irql); + if (CacheAware) + ExWaitForRundownProtectionReleaseCacheAware(Lock->RundownCacheAwar= e); + else + ExWaitForRundownProtectionRelease(&Lock->Rundown); } -static FORCEINLINE LONG -__ClaimShared( - IN PXENVIF_MRSW_LOCK Lock +static FORCEINLINE VOID +__MrswRundownCompleted( + _Inout_ struct _MRSW_LOCK *Lock, + _In_ BOOLEAN CacheAware ) { - LONG Slot; - LONG64 Old; - LONG64 New; - - // Make sure the exclusive bit is set so that we don't find it - Old =3D Lock->Mask | (1ll << XENVIF_MRSW_EXCLUSIVE_SLOT); - - Slot =3D __ffu((ULONG64)Old); - ASSERT(Slot >=3D 0); - ASSERT3U(Slot, !=3D , XENVIF_MRSW_EXCLUSIVE_SLOT); + if (CacheAware) + ExRundownCompletedCacheAware(Lock->RundownCacheAware); + else + ExRundownCompleted(&Lock->Rundown); +} - Old &=3D ~(1ll << XENVIF_MRSW_EXCLUSIVE_SLOT); - New =3D Old | (1ll << Slot); +static FORCEINLINE VOID +__MrswRundownReInitialize( + _Inout_ struct _MRSW_LOCK *Lock, + _In_ BOOLEAN CacheAware + ) +{ + if (CacheAware) + ExReInitializeRundownProtectionCacheAware(Lock->RundownCacheAware)= ; + else + ExReInitializeRundownProtection(&Lock->Rundown); +} - return (InterlockedCompareExchange64(&Lock->Mask, New, Old) =3D=3D Old= ) ? Slot : -1; +static FORCEINLINE VOID +__MrswRundownTeardown( + _Inout_ struct _MRSW_LOCK *Lock, + _In_ BOOLEAN CacheAware + ) +{ + if (CacheAware) + ExFreeCacheAwareRundownProtection(Lock->RundownCacheAware); + else + RtlZeroMemory(&Lock->Rundown, sizeof(Lock->Rundown)); } +_IRQL_requires_min_(PASSIVE_LEVEL) +_IRQL_requires_max_(APC_LEVEL) +static FORCEINLINE NTSTATUS +__InitializeMrswLock( + _Out_ struct _MRSW_LOCK *Lock, + _In_ BOOLEAN CacheAware, + _In_ ULONG Tag + ) +{ + KeInitializeGuardedMutex(&Lock->Mutex); + return __MrswRundownInitialize(Lock, CacheAware, Tag); +} +#define InitializeMrswLock(Lock, Tag) \ + __InitializeMrswLock(Lock, FALSE, Tag) +#define InitializeMrswCacheAwareLock(Lock, Tag) \ + __InitializeMrswLock(Lock, TRUE, Tag) + +_Requires_lock_not_held_(*Lock) +_IRQL_requires_min_(PASSIVE_LEVEL) +_IRQL_requires_max_(APC_LEVEL) +static FORCEINLINE VOID +__TeardownMrswLock( + _Inout_ struct _MRSW_LOCK *Lock, + _In_ BOOLEAN CacheAware + ) +{ +#if DBG + BUG_ON(!KeTryToAcquireGuardedMutex(&Lock->Mutex)); + BUG_ON(!__MrswRundownAcquire(Lock, CacheAware)); + KeReleaseGuardedMutex(&Lock->Mutex); + __MrswRundownRelease(Lock, CacheAware); +#endif + + __MrswRundownTeardown(Lock, CacheAware); + RtlZeroMemory(Lock, sizeof(MRSW_LOCK)); +} +#define TeardownMrswLock(Lock) \ + __TeardownMrswLock(Lock, FALSE) +#define TeardownMrswCacheAwareLock(Lock) \ + __TeardownMrswLock(Lock, TRUE) + +_Acquires_lock_(_Global_critical_region_) +_Requires_lock_not_held_(*Lock) +_Acquires_exclusive_lock_(*Lock) +_IRQL_requires_min_(PASSIVE_LEVEL) +_IRQL_requires_max_(APC_LEVEL) static FORCEINLINE VOID -AcquireMrswLockShared( - IN PXENVIF_MRSW_LOCK Lock +__AcquireMrswLockExclusive( + _Inout_ struct _MRSW_LOCK *Lock, + _In_ BOOLEAN CacheAware ) { - KIRQL Irql; - LONG Level; - LONG Slot; - PKTHREAD Self; - PXENVIF_MRSW_HOLDER Holder; + ASSERT3U(KeGetCurrentIrql(), <=3D, APC_LEVEL); + KeAcquireGuardedMutex(&Lock->Mutex); + __MrswRundownWait(Lock, CacheAware); + __MrswRundownCompleted(Lock, CacheAware); +} +#define AcquireMrswLockExclusive(Lock) \ + __AcquireMrswLockExclusive(Lock, FALSE) +#define AcquireMrswCacheAwareLockExclusive(Lock) \ + __AcquireMrswLockExclusive(Lock, TRUE) + +_Releases_lock_(_Global_critical_region_) +_Requires_exclusive_lock_held_(*Lock) +_Releases_exclusive_lock_(*Lock) +_IRQL_requires_min_(PASSIVE_LEVEL) +_IRQL_requires_max_(APC_LEVEL) +static FORCEINLINE VOID +__ReleaseMrswLockExclusive( + _Inout_ struct _MRSW_LOCK *Lock, + _In_ BOOLEAN CacheAware + ) +{ + __MrswRundownReInitialize(Lock, CacheAware); + KeReleaseGuardedMutex(&Lock->Mutex); +} +#define ReleaseMrswLockExclusive(Lock) \ + __ReleaseMrswLockExclusive(Lock, FALSE) +#define ReleaseMrswCacheAwareLockExclusive(Lock) \ + __ReleaseMrswLockExclusive(Lock, TRUE) + +_Releases_lock_(_Global_critical_region_) +_Requires_exclusive_lock_held_(*Lock) +_Releases_exclusive_lock_(*Lock) +_Acquires_shared_lock_(*Lock) +_IRQL_requires_min_(PASSIVE_LEVEL) +_IRQL_requires_max_(APC_LEVEL) +static FORCEINLINE VOID +__DowngradeMrswLockExclusive( + _Inout_ struct _MRSW_LOCK *Lock, + _In_ BOOLEAN CacheAware + ) +{ + __MrswRundownReInitialize(Lock, CacheAware); + BUG_ON(!__MrswRundownAcquire(Lock, CacheAware)); + KeReleaseGuardedMutex(&Lock->Mutex); +} +#define DowngradeMrswLockExclusive(Lock) \ + __DowngradeMrswLockExclusive(Lock, FALSE) +#define DowngradeMrswCacheAwareLockExclusive(Lock) \ + __DowngradeMrswLockExclusive(Lock, TRUE) + +_When_(return, _Acquires_shared_lock_(*Lock)) +_IRQL_requires_min_(PASSIVE_LEVEL) +_IRQL_requires_max_(DISPATCH_LEVEL) +static FORCEINLINE BOOLEAN +__TryAcquireMrswLockShared( + _Inout_ struct _MRSW_LOCK *Lock, + _In_ BOOLEAN CacheAware + ) +{ +#if DBG ASSERT3U(KeGetCurrentIrql(), <=3D, DISPATCH_LEVEL); - KeRaiseIrql(DISPATCH_LEVEL, &Irql); - - Self =3D KeGetCurrentThread(); - - // Do we already hold the lock? If so, get the nesting level - Level =3D -1; - for (Slot =3D 0; Slot < (LONG) sizeof (Lock->Mask) * 8; Slot++) { - if (Lock->Holder[Slot].Thread =3D=3D Self && Lock->Holder[Slot].Le= vel > Level) - Level =3D Lock->Holder[Slot].Level; - } - Level++; +#endif - for (;;) { - Slot =3D __ClaimShared(Lock); - if (Slot >=3D 0) - break; - - _mm_pause(); - } - - Holder =3D &Lock->Holder[Slot]; - - Holder->Thread =3D Self; - Holder->Level =3D Level; - - KeLowerIrql(Irql); + return __MrswRundownAcquire(Lock, CacheAware); } - +#define TryAcquireMrswLockShared(Lock) \ + __TryAcquireMrswLockShared(Lock, FALSE) +#define TryAcquireMrswCacheAwareLockShared(Lock) \ + __TryAcquireMrswLockShared(Lock, TRUE) + +_Acquires_shared_lock_(*Lock) +_IRQL_requires_min_(PASSIVE_LEVEL) +_IRQL_requires_max_(DISPATCH_LEVEL) static FORCEINLINE VOID -ReleaseMrswLockShared( - IN PXENVIF_MRSW_LOCK Lock +__SpinAcquireMrswLockShared( + _Inout_ struct _MRSW_LOCK *Lock, + _In_ BOOLEAN CacheAware ) { - KIRQL Irql; - PKTHREAD Self; - LONG Level; - LONG Deepest; - LONG Slot; - LONG64 Old; - LONG64 New; - PXENVIF_MRSW_HOLDER Holder; - +#if DBG ASSERT3U(KeGetCurrentIrql(), <=3D, DISPATCH_LEVEL); - KeRaiseIrql(DISPATCH_LEVEL, &Irql); - - Self =3D KeGetCurrentThread(); - - Level =3D -1; - Deepest =3D -1; - for (Slot =3D 0; Slot < (LONG) sizeof (Lock->Mask) * 8; Slot++) { - if (Lock->Holder[Slot].Thread =3D=3D Self && Lock->Holder[Slot].Le= vel > Level) { - Level =3D Lock->Holder[Slot].Level; - Deepest =3D Slot; - } - } - ASSERT(Level >=3D 0); - - Slot =3D Deepest; - ASSERT3U(Slot, !=3D, XENVIF_MRSW_EXCLUSIVE_SLOT); - - Holder =3D &Lock->Holder[Slot]; +#endif - Holder->Thread =3D NULL; - Holder->Level =3D -1; - - do { - Old =3D Lock->Mask; - New =3D Old & ~(1ll << Slot); - } while (InterlockedCompareExchange64(&Lock->Mask, New, Old) !=3D Old)= ; - - KeSetEvent(&Lock->Event, IO_NO_INCREMENT, FALSE); - KeLowerIrql(Irql); + while (!__MrswRundownAcquire(Lock, CacheAware)) + YieldProcessor(); +} +#define SpinAcquireMrswLockShared(Lock) \ + __SpinAcquireMrswLockShared(Lock, FALSE) +#define SpinAcquireMrswCacheAwareLockShared(Lock) \ + __SpinAcquireMrswLockShared(Lock, TRUE) + +/* + * Unlike SpinAcquireMrswLockShared, AcquireMrswLockShared will + * sleep when the lock acquisition fails. Thus it cannot be used at + * DISPATCH_LEVEL. + */ +_Acquires_shared_lock_(*Lock) +_IRQL_requires_min_(PASSIVE_LEVEL) +_IRQL_requires_max_(APC_LEVEL) +static FORCEINLINE VOID +__AcquireMrswLockShared( + _Inout_ struct _MRSW_LOCK *Lock, + _In_ BOOLEAN CacheAware + ) +{ +#if DBG + ASSERT3U(KeGetCurrentIrql(), <=3D, APC_LEVEL); +#endif + + if (__MrswRundownAcquire(Lock, CacheAware)) + return; + + /* + * Don't bother retrying, since it's most likely that another writer s= ection + * is cleaning up and not ending any time soon. Just jump straight int= o + * sleep. + */ + KeAcquireGuardedMutex(&Lock->Mutex); + /* + * Since we have the write mutex, we know that there are no writers. S= o this + * acquire must succeed. + */ + BUG_ON(!__MrswRundownAcquire(Lock, CacheAware)); + KeReleaseGuardedMutex(&Lock->Mutex); +} +#define AcquireMrswLockShared(Lock) \ + __AcquireMrswLockShared(Lock, FALSE) +#define AcquireMrswCacheAwareLockShared(Lock) \ + __AcquireMrswLockShared(Lock, TRUE) + +_Requires_shared_lock_held_(*Lock) +_Releases_shared_lock_(*Lock) +_IRQL_requires_min_(PASSIVE_LEVEL) +_IRQL_requires_max_(DISPATCH_LEVEL) +static FORCEINLINE VOID +__ReleaseMrswLockShared( + _Inout_ struct _MRSW_LOCK *Lock, + _In_ BOOLEAN CacheAware + ) +{ + __MrswRundownRelease(Lock, CacheAware); } +#define ReleaseMrswLockShared(Lock) \ + __ReleaseMrswLockShared(Lock, FALSE) +#define ReleaseMrswCacheAwareLockShared(Lock) \ + __ReleaseMrswLockShared(Lock, TRUE) -#endif // _XENVIF_MRSW_H +#endif // _MRSW_H diff --git a/src/xenvif/vif.c b/src/xenvif/vif.c index 6f468ee..cb4cf84 100644 --- a/src/xenvif/vif.c +++ b/src/xenvif/vif.c @@ -47,7 +47,7 @@ struct _XENVIF_VIF_CONTEXT { PXENVIF_PDO Pdo; - XENVIF_MRSW_LOCK Lock; + MRSW_LOCK Lock; LONG References; PXENVIF_FRONTEND Frontend; BOOLEAN Enabled; @@ -150,13 +150,12 @@ VifEnable( ) { PXENVIF_VIF_CONTEXT Context =3D Interface->Context; - KIRQL Irql; BOOLEAN Exclusive; NTSTATUS status; Trace("=3D=3D=3D=3D>\n"); - AcquireMrswLockExclusive(&Context->Lock, &Irql); + AcquireMrswLockExclusive(&Context->Lock); Exclusive =3D TRUE; if (Context->Enabled) @@ -188,7 +187,7 @@ VifEnable( done: ASSERT(Exclusive); - ReleaseMrswLockExclusive(&Context->Lock, Irql, FALSE); + ReleaseMrswLockExclusive(&Context->Lock); Trace("<=3D=3D=3D=3D\n"); @@ -199,7 +198,7 @@ fail3: (VOID) FrontendSetState(Context->Frontend, FRONTEND_CONNECTED); - ReleaseMrswLockExclusive(&Context->Lock, Irql, TRUE); + DowngradeMrswLockExclusive(&Context->Lock); Exclusive =3D FALSE; ReceiverWaitForPackets(FrontendGetReceiver(Context->Frontend)); @@ -234,7 +233,7 @@ fail1: Context->Callback =3D NULL; if (Exclusive) - ReleaseMrswLockExclusive(&Context->Lock, Irql, FALSE); + ReleaseMrswLockExclusive(&Context->Lock); else ReleaseMrswLockShared(&Context->Lock); @@ -389,17 +388,16 @@ VifEnableVersion9( ) { PXENVIF_VIF_CONTEXT Context =3D Interface->Context; - KIRQL Irql; NTSTATUS status; Trace("=3D=3D=3D=3D>\n"); - AcquireMrswLockExclusive(&Context->Lock, &Irql); + AcquireMrswLockExclusive(&Context->Lock); Context->CallbackVersion9 =3D Callback; Context->ArgumentVersion9 =3D Argument; - ReleaseMrswLockExclusive(&Context->Lock, Irql, FALSE); + ReleaseMrswLockExclusive(&Context->Lock); status =3D VifEnable(Interface, VifCallbackVersion9, Context); @@ -416,17 +414,16 @@ VifEnableVersion8( ) { PXENVIF_VIF_CONTEXT Context =3D Interface->Context; - KIRQL Irql; NTSTATUS status; Trace("=3D=3D=3D=3D>\n"); - AcquireMrswLockExclusive(&Context->Lock, &Irql); + AcquireMrswLockExclusive(&Context->Lock); Context->CallbackVersion8 =3D Callback; Context->ArgumentVersion8 =3D Argument; - ReleaseMrswLockExclusive(&Context->Lock, Irql, FALSE); + ReleaseMrswLockExclusive(&Context->Lock); status =3D VifEnableVersion9(Interface, VifCallbackVersion8, Context); @@ -441,14 +438,13 @@ VifDisable( ) { PXENVIF_VIF_CONTEXT Context =3D Interface->Context; - KIRQL Irql; Trace("=3D=3D=3D=3D>\n"); - AcquireMrswLockExclusive(&Context->Lock, &Irql); + AcquireMrswLockExclusive(&Context->Lock); if (!Context->Enabled) { - ReleaseMrswLockExclusive(&Context->Lock, Irql, FALSE); + ReleaseMrswLockExclusive(&Context->Lock); goto done; } @@ -463,7 +459,7 @@ VifDisable( (VOID) FrontendSetState(Context->Frontend, FRONTEND_CONNECTED); - ReleaseMrswLockExclusive(&Context->Lock, Irql, TRUE); + DowngradeMrswLockExclusive(&Context->Lock); ReceiverWaitForPackets(FrontendGetReceiver(Context->Frontend)); TransmitterAbortPackets(FrontendGetTransmitter(Context->Frontend)); @@ -511,7 +507,7 @@ VifQueryStatistic( status =3D STATUS_INVALID_PARAMETER; if (Index >=3D XENVIF_VIF_STATISTIC_COUNT) goto done; - + AcquireMrswLockShared(&Context->Lock); FrontendQueryStatistic(Context->Frontend, Index, Value); @@ -567,7 +563,8 @@ VifReceiverReturnPacket( { PXENVIF_VIF_CONTEXT Context =3D Interface->Context; - AcquireMrswLockShared(&Context->Lock); + // Called from MINIPORT_RETURN_NET_BUFFER_LISTS + SpinAcquireMrswLockShared(&Context->Lock); ReceiverReturnPacket(FrontendGetReceiver(Context->Frontend), Cookie); @@ -592,9 +589,10 @@ VifTransmitterQueuePacket( PXENVIF_VIF_CONTEXT Context =3D Interface->Context; NTSTATUS status; - AcquireMrswLockShared(&Context->Lock); - status =3D STATUS_UNSUCCESSFUL; + if (!TryAcquireMrswLockShared(&Context->Lock)) + return status; + if (!Context->Enabled) goto done; @@ -948,9 +946,8 @@ VifAcquire( ) { PXENVIF_VIF_CONTEXT Context =3D Interface->Context; - KIRQL Irql; - AcquireMrswLockExclusive(&Context->Lock, &Irql); + AcquireMrswLockExclusive(&Context->Lock); if (Context->References++ !=3D 0) goto done; @@ -963,7 +960,7 @@ VifAcquire( Trace("<=3D=3D=3D=3D\n"); done: - ReleaseMrswLockExclusive(&Context->Lock, Irql, FALSE); + ReleaseMrswLockExclusive(&Context->Lock); return STATUS_SUCCESS; } @@ -974,9 +971,8 @@ VifRelease( ) { PXENVIF_VIF_CONTEXT Context =3D Interface->Context; - KIRQL Irql; - AcquireMrswLockExclusive(&Context->Lock, &Irql); + AcquireMrswLockExclusive(&Context->Lock); if (--Context->References > 0) goto done; @@ -991,7 +987,7 @@ VifRelease( Trace("<=3D=3D=3D=3D\n"); done: - ReleaseMrswLockExclusive(&Context->Lock, Irql, FALSE); + ReleaseMrswLockExclusive(&Context->Lock); } static struct _XENVIF_VIF_INTERFACE_V8 VifInterfaceVersion8 =3D { @@ -1100,7 +1096,9 @@ VifInitialize( if (*Context =3D=3D NULL) goto fail1; - InitializeMrswLock(&(*Context)->Lock); + status =3D InitializeMrswLock(&(*Context)->Lock, XENVIF_VIF_TAG); + if (!NT_SUCCESS(status)) + goto fail2; FdoGetSuspendInterface(PdoGetFdo(Pdo),&(*Context)->SuspendInterface); @@ -1110,7 +1108,7 @@ VifInitialize( *Context, &(*Context)->MacThread); if (!NT_SUCCESS(status)) - goto fail2; + goto fail3; (*Context)->Pdo =3D Pdo; @@ -1118,7 +1116,7 @@ VifInitialize( return STATUS_SUCCESS; -fail2: +fail3: Error("fail3\n"); RtlZeroMemory(&(*Context)->MacEvent, sizeof (KEVENT)); @@ -1126,7 +1124,10 @@ fail2: RtlZeroMemory(&(*Context)->SuspendInterface, sizeof (XENBUS_SUSPEND_INTERFACE)); - RtlZeroMemory(&(*Context)->Lock, sizeof (XENVIF_MRSW_LOCK)); + TeardownMrswLock(&(*Context)->Lock); + +fail2: + Error("fail2\n"); ASSERT(IsZeroMemory(*Context, sizeof (XENVIF_VIF_CONTEXT))); __VifFree(*Context); @@ -1205,7 +1206,7 @@ VifGetInterface( } return status; -} +} VOID VifTeardown( @@ -1228,7 +1229,7 @@ VifTeardown( RtlZeroMemory(&Context->SuspendInterface, sizeof (XENBUS_SUSPEND_INTERFACE)); - RtlZeroMemory(&Context->Lock, sizeof (XENVIF_MRSW_LOCK)); + TeardownMrswLock(&Context->Lock); ASSERT(IsZeroMemory(Context, sizeof (XENVIF_VIF_CONTEXT))); __VifFree(Context); -- 2.53.0.windows.2 -- Ngoc Tu Dinh | Vates XCP-ng Developer XCP-ng & Xen Orchestra - Vates solutions web: https://vates.tech From win-pv-devel-bounces@lists.xenproject.org Wed May 13 15:22:55 2026 Return-path: Envelope-to: archives@lists.xenproject.org Delivery-date: Wed, 13 May 2026 15:22:55 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1308226.1579756 (Exim 4.92) (envelope-from ) id 1wNBQE-0003dC-Dz; Wed, 13 May 2026 15:22:54 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1308226.1579756; Wed, 13 May 2026 15:22:54 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wNBQE-0003d5-BF; Wed, 13 May 2026 15:22:54 +0000 Received: by outflank-mailman (input) for mailman id 1308226; Wed, 13 May 2026 15:22:53 +0000 Received: from mx.expurgate.net ([195.190.135.10]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wNBQC-0003cz-SR for win-pv-devel@lists.xenproject.org; Wed, 13 May 2026 15:22:53 +0000 Received: from mx.expurgate.net (helo=localhost) by mx.expurgate.net with esmtp id 1wNBQC-005JCz-93 for win-pv-devel@lists.xenproject.org; Wed, 13 May 2026 17:22:52 +0200 Received: from [10.42.69.5] (helo=localhost) by localhost with ESMTP (eXpurgate MTA 0.9.1) (envelope-from ) id 6a04973a-bab6-0a2a0a5309dd-0a2a4505bd1c-24 for ; Wed, 13 May 2026 17:22:52 +0200 Received: from [185.255.28.34] (helo=prod-mta-13.swg-srv.net) by tlsNG-c201ff.mxtls.expurgate.net with ESMTPS (eXpurgate 4.56.1) (envelope-from ) id 6a04974b-aaa8-0a2a45050019-b9ff1c22a9fd-3 for ; Wed, 13 May 2026 17:22:52 +0200 Received: from mail2.vates.fr ([37.26.189.201] mail2.vates.fr) (Authenticated sender: 8631fc262581453bbf619ec5b2062170/smtp/7773de5a-2839-4720-82ee-e06722ae1d3e) by prod-mta-13.swg-srv.net (ZoneMTA - prod-mta-13) with ESMTPSA id 19e21eef1e5000f373.002 for (version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384); Wed, 13 May 2026 15:22:48 +0000 Received: from [37.26.189.201] (mail2.vates.fr [37.26.189.201]) (Authenticated sender: ngoc-tu.dinh@835de637.internal) by mail2.vates.fr (Postfix) with ESMTPSA id 7D9C986424; Wed, 13 May 2026 17:22:47 +0200 (CEST) X-BeenThere: win-pv-devel@lists.xenproject.org List-Id: Developer list for the Windows PV Drivers subproject List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: win-pv-devel-bounces@lists.xenproject.org Precedence: list Sender: "win-pv-devel" Authentication-Results: eu.smtp.expurgate.cloud; dkim=pass header.s=selector1 header.d=vates.tech header.i="@vates.tech" header.h="From:Subject:Date:Message-ID:To:Cc:MIME-Version:Content-Type:Feedback-ID" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=vates.tech; q=dns/txt; s=selector1; bh=v9Wv4ZHpddNx+EKtI0TqGoefHD9yf89+1yR14Ib48cM=; h=from:subject:date:message-id:to:cc:mime-version:content-type:feedback-id; b=jx3aGg9oc293jbBV80BpQG95OObmBV44Wc7NIXs7nkwDO2uBQBoK7ycxrxvLKDfKxK+unKrJW Nl3A1k+gd/ZGOFbOBW2wf3tzIQsxeFBEs5H9lyMPslRWvM1akoGvO2yuB5/LC3P4yxxBM0GtVfw TK7iVI6bJ+px/i5parEa8608RA7zj1UO0iHKyjf1gpbUSa7Wpf1w3ES5VcDjop4VcQBjD3ImhvE eEok9DOkWaeFP3xUal+6+3OuuzXpqF85QY1OaVvaAONRjtaOCSwJMV9NzUMM2ssCObvjWHCxvTI caUVwZcpXWm1kQmjhN2QttkCdC5ccTv30fSRZlrBuNHg== X-Zone-Loop: 6bdaf70135c2af2ac3c96cb4cc7b0ce0c99058902f43 x-campaign-type: default x-transaction-id: 079e5128-30e8-4864-aec0-8fcace5ca3c1 x-swg-uid: 01-9d0a74f1-6672-4ffd-a605-f35d6a151e5e X-Mailer: Sweego Message-ID: <1778685768.8631fc262581453bbf619ec5b2062170.19e21eef1e5000f373@vates.tech> x-swg-bid: 1778685768.8631fc262581453bbf619ec5b2062170.19e21eef1e5000f373 Feedback-ID: default:8631fc262581453bbf619ec5b2062170:Sweego x-campaign-id: default x-client-id: 8631fc262581453bbf619ec5b2062170 X-Originating-IP: [37.26.189.201] Date: Wed, 13 May 2026 17:22:46 +0200 Subject: Re: [PATCH 4/5] Implement rundown-based MRSW lock X-Android-Message-ID: <95328a1f-1fe0-4503-9cb4-78be8323f408@email.android.com> From: Ngoc Tu Dinh To: Owen Smith Cc: win-pv-devel@lists.xenproject.org Importance: Normal X-Priority: 3 X-MSMail-Priority: Normal MIME-Version: 1.0 X-BM-Disclaimer: Yes Content-Type: multipart/alternative; boundary="-=Part.bae.fc8657cf149906f8.19e21eeeff1.cc137a118f92ad64=-" X-Bm-Milter-Handled: 4ffbd6c1-ee69-4e1b-aabd-f977039bd3e2 X-Bm-Transport-Timestamp: 1778685767670 X-purgate-ID: tlsNG-c201ff/1778685772-E00637E3-435BFE07/0/0 X-purgate-type: clean X-purgate-size: 98187 ---=Part.bae.fc8657cf149906f8.19e21eeeff1.cc137a118f92ad64=- Content-Type: multipart/related; boundary="-=Part.baf.bf3f53f3ec167425.19e21eeeff6.b1b31f559e950585=-" ---=Part.baf.bf3f53f3ec167425.19e21eeeff6.b1b31f559e950585=- Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: quoted-printable
=
Hi Owen,

Thanks for the info=2E This must have been caused by the MRSW lock'= s writer section no longer running at DISPATCH_LEVEL and so caused the writ= er section to be preempted by a reader DPC=2E 
=
I'll look for a solution, but I = wonder if it's possible to make ReceiverReturnPacket fallible/retryable or = otherwise influence the timing of DPCs=2E

=
On May 13, 2026 16:05, Owen Smith <= ;owen=2Esmith@citrix=2Ecom> wrote:
<= blockquote style=3D"margin:0 0 0 0=2E8ex;border-left:1px #ccc solid;padding= -left:1ex">
Hi Tu,

I'm ha= ving an issue with this patch
During a VM start, its pos= sible for a single system thread to acquire the lock exclusively, and while its locked, a DPC can then attempt to acquire the lock = in shared mode, resulting
in a deadlock (if AcquireMrswL= ockShared is called) or spin (if SpinAcquireMrswLockShared
= is called)=2E

0: kd> k
= # Child-SP RetAddr Call Site
00 fffff805`49b48aa8 ff= fff805`b66b2b2c nt!DbgBreakPointWithStatus
01 fffff805`4= 9b48ab0 fffff805`b66b0ada nt!KeAccumulateTicks+0x70c
02 = fffff805`49b48b20 fffff805`b66b0833 nt!KiUpdateRunTime+0xd6
= 03 fffff805`49b48c70 fffff805`b66aed45 nt!KiUpdateTime+0x473 04 fffff805`49b48e20 fffff805`b66ae35d nt!KeClockInterruptNotify+0= x195
05 fffff805`49b48f50 fffff805`b6a7520e nt!KiCallInt= erruptServiceRoutine+0x2ed
06 fffff805`49b48fb0 fffff805= `b6a75a1c nt!KiInterruptSubDispatchNoLockNoEtw+0x4e
07 f= ffff805`49b412b0 fffff805`b66d6616 nt!KiInterruptDispatchNoLockNoEtw+0x3c =
08 fffff805`49b41448 fffff805`4c1d6689 nt!ExfAcquireRundo= wnProtection+0x6
09 (Inline Function) --------`-------- = xenvif!__MrswRundownAcquire+0x9 [src\xenvif\mrsw=2Eh @ 84]
= 0a (Inline Function) --------`-------- xenvif!__SpinAcquireMrswLockShare= d+0x9 [src\xenvif\mrsw=2Eh @ 283]
0b fffff805`49b41450 f= ffff805`4c4a5dd0 xenvif!VifReceiverReturnPacket+0x29 [src\xenvif\vif=2Ec @ = 537]
0c (Inline Function) --------`-------- xennet!__Rec= eiverReturnNetBufferLists+0x54 [src\xennet\receiver=2Ec @ 213]
= 0d (Inline Function) --------`-------- xennet!ReceiverReturnNetBuffe= rLists+0x54 [src\xennet\receiver=2Ec @ 535]
0e fffff805`= 49b414a0 fffff805`4ac84661 xennet!MiniportReturnNetBufferLists+0x70 [src\xe= nnet\miniport=2Ec @ 208]
0f fffff805`49b414d0 fffff805`4= b341824 ndis!NdisFReturnNetBufferLists+0x411
10 fffff805= `49b415a0 fffff805`4b34759a wfplwfs!LwfLowerReturnNetBufferLists+0x84 =
11 fffff805`49b415f0 fffff805`4b347afa wfplwfs!L2NdisReceiveN= etBufferListsComplete+0x4e
12 fffff805`49b41620 fffff805= `4ac8b628 wfplwfs!LwfLowerRecvNetBufferLists+0x20a
13 ff= fff805`49b416e0 fffff805`4c4a62d4 ndis!NdisMIndicateReceiveNetBufferLists+0= xa78
14 (Inline Function) --------`-------- xennet!__Ind= icateReceiveNetBufferLists+0x41 [src\xennet\receiver=2Ec @ 353]
= 15 (Inline Function) --------`-------- xennet!__ReceiverPushPackets= +0xaa [src\xennet\receiver=2Ec @ 422]
16 fffff805`49b419= 00 fffff805`4c4a1147 xennet!ReceiverQueuePacket+0x1c4 [src\xennet\receiver= =2Ec @ 603]
17 fffff805`49b41980 fffff805`4c1c3cea xenne= t!AdapterVifCallback+0x77 [src\xennet\adapter=2Ec @ 237]
= 18 (Inline Function) --------`-------- xenvif!VifReceiverQueuePacket+0x90 = [src\xenvif\vif=2Ec @ 1244]
19 (Inline Function) -------= -`-------- xenvif!__ReceiverRingSwizzle+0x6f1 [src\xenvif\receiver=2Ec @ 15= 41]
1a fffff805`49b41a00 fffff805`b665993e xenvif!Receiv= erRingQueueDpc+0x71a [src\xenvif\receiver=2Ec @ 1637]
1b= fffff805`49b41ad0 fffff805`b6604f1b nt!KiExecuteAllDpcs+0x67e
= 1c fffff805`49b41d20 fffff805`b6a7ae15 nt!KiRetireDpcList+0x36b =
1d fffff805`49b41fb0 fffff805`b6a7adbf nt!KxSwapStacksAndRet= ireDpcList+0x5
1e ffffdf04`854cf2f0 fffff805`b66ed1d5 nt= !KiPlatformSwapStacksAndCallReturn
1f ffffdf04`854cf300 = fffff805`b6a7a24f nt!KiDispatchInterrupt+0x65
20 ffffdf0= 4`854cf330 fffff805`b6608670 nt!KiDpcInterrupt+0x39f
21 = ffffdf04`854cf4c0 fffff805`4c1d5991 nt!KeReleaseSpinLock+0x30
= 22 (Inline Function) --------`-------- xenvif!FrontendSetState+0x1b4 = [src\xenvif\frontend=2Ec @ 2797]
23 ffffdf04`854cf4f0 ff= fff805`4c4a5c83 xenvif!VifEnable+0x241 [src\xenvif\vif=2Ec @ 176] 24 (Inline Function) --------`-------- xennet!AdapterEnable+0x64 = [src\xennet\adapter=2Ec @ 1934]
25 ffffdf04`854cf550 fff= ff805`4adceb91 xennet!MiniportRestart+0x73 [src\xennet\miniport=2Ec @ 143] =
26 ffffdf04`854cf580 fffff805`4ade13d1 ndis!ndisMInvokeR= estart+0x51
27 ffffdf04`854cf5d0 fffff805`4adcea65 ndis!= ndisMRestartMiniportInner+0x141
28 ffffdf04`854cf660 fff= ff805`4adbf26c ndis!ndisMRestartMiniport+0x65
29 ffffdf0= 4`854cf750 fffff805`4adbb4fb ndis!Ndis::BindEngine::Iterate+0x7dc 2a ffffdf04`854cf910 fffff805`4adbac8a ndis!Ndis::BindEngine::Upd= ateBindings+0xab
2b ffffdf04`854cf9c0 fffff805`4add1771 = ndis!Ndis::BindEngine::UpdateBindingsWorkItem+0x5a
2c ff= ffdf04`854cfa10 fffff805`b6709e32 ndis!KWorkItemBase<Ndis::BindEngine,KW= orkItem<Ndis::BindEngine> >::CallbackThunk+0x11
= 2d ffffdf04`854cfa40 fffff805`b685904a nt!ExpWorkerThread+0x1b2 2e ffffdf04`854cfbf0 fffff805`b6a741c4 nt!PspSystemThreadStartup+0= x5a
2f ffffdf04`854cfc40 00000000`00000000 nt!KiStartSys= temThread+0x34

This seems to be a race condi= tion, which depends on the ReceiverRingQueueDpc getting
= executed when FrontendSetState drops the spinlock

= Owen

_________________________________= _______
From: Tu Dinh <ngoc-tu=2Edinh@vates=2Etech>= ;
Sent: 16 April 2026 12:10 PM
To: wi= n-pv-devel@lists=2Exenproject=2Eorg
Cc: Tu Dinh; Owen Sm= ith
Subject: [PATCH 4/5] Implement rundown-based MRSW lo= ck

The current MRSW lock has a few downsides= :
* Large size (have to store a 1KB holder list) =
* Long fast-path acquire (~1KB of code) due to having to scan t= he holder
list every acquire
* Limite= d to 64 holders
* Multiple IRQL operations per acquire =
* Always raises the critical section to DISPATCH_LEVEL =

It's currently only used as the cleanup lock f= or the VIF interface, so
replace it with something simpl= er=2E

Implement a read-write lock with the f= ollowing properties:
* The reader section is protected b= y an EX_RUNDOWN_REF=2E
* Writer/cleanup section is imple= mented by running down the reference
within a guarded mu= tex=2E
* It offers 3 read acquire flavors: try acquire, = spin acquire (both of
which can be used from DISPATCH_LE= VEL) and sleeping acquire (using the
guarded mutex)=2E =
* It makes the downgrade call explicit instead of overloa= ding it via
ReleaseMrswLockExclusive=2E
= * Finally, the lock supports cache-aware mode, where EX_RUNDOWN_REF is =
replaced with EX_RUNDOWN_REF_CACHE_AWARE using the corres= ponding
macros=2E

As the = changes are only internal to vif=2Ec, the VIF version doesn't need <= br> to be increased=2E

Signed-off-by:= Tu Dinh <ngoc-tu=2Edinh@vates=2Etech>
--- =
src/xenvif/mrsw=2Eh | 530 +++++++++++++++++++++++++------------= ---------
src/xenvif/vif=2Ec | 65 +++---
= 2 files changed, 327 insertions(+), 268 deletions(-)
=
diff --git a/src/xenvif/mrsw=2Eh b/src/xenvif/mrsw=2Eh =
index e1ff056=2E=2E8bfa441 100644
--- a/src/= xenvif/mrsw=2Eh
+++ b/src/xenvif/mrsw=2Eh
= @@ -1,289 +1,347 @@
/* Copyright (c) Xen Project=2E=
* Copyright (c) Cloud Software Group, Inc=2E + * Copyright (c) Vates=2E
* All rights reserve= d=2E
- *
- * Redistribution and use i= n source and binary forms,
- * with or without modificat= ion, are permitted provided
+ *
+ * R= edistribution and use in source and binary forms,
+ * wi= th or without modification, are permitted provided
* tha= t the following conditions are met:
- *
= - * * Redistributions of source code must retain the above
= - * copyright notice, this list of conditions and the
= + *
+ * * Redistributions of source code must retain= the above
+ * copyright notice, this list of conditions= and the
* following disclaimer=2E
- = * * Redistributions in binary form must reproduce the above
= - * copyright notice, this list of conditions and the
= - * following disclaimer in the documentation and/or other
= + * * Redistributions in binary form must reproduce the above <= br> + * copyright notice, this list of conditions and the + * following disclaimer in the documentation and/or other =
* materials provided with the distribution=2E
= - *
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOL= DERS AND
- * CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMP= LIED WARRANTIES,
- * INCLUDING, BUT NOT LIMITED TO, THE = IMPLIED WARRANTIES OF
- * MERCHANTABILITY AND FITNESS FO= R A PARTICULAR PURPOSE ARE
- * DISCLAIMED=2E IN NO EVENT= SHALL THE COPYRIGHT HOLDER OR
- * CONTRIBUTORS BE LIABL= E FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXE= MPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
- * BUT NOT= LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
- * SERV= ICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
- * INT= ERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
= - * WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
= - * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE =
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF =
+ *
+ * THIS SOFTWARE IS PROVIDED BY = THE COPYRIGHT HOLDERS AND
+ * CONTRIBUTORS "AS IS" AND A= NY EXPRESS OR IMPLIED WARRANTIES,
+ * INCLUDING, BUT NOT= LIMITED TO, THE IMPLIED WARRANTIES OF
+ * MERCHANTABILI= TY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIM= ED=2E IN NO EVENT SHALL THE COPYRIGHT HOLDER OR
+ * CONT= RIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
= + * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
= + * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR + * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS + * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, =
+ * WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCL= UDING
+ * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OU= T OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF TH= E POSSIBILITY OF
* SUCH DAMAGE=2E
*/ =

-#ifndef _XENVIF_MRSW_H
-= #define _XENVIF_MRSW_H
+#ifndef _MRSW_H
= +#define _MRSW_H

-#include <ntddk=2Eh&= gt;
+#include <wdm=2Eh>

= #include "assert=2Eh"
#include "util=2Eh"
-#pragma warning(disable:4127) // conditional express= ion is constant
-
-typedef struct _XE= NVIF_MRSW_HOLDER {
- PKTHREAD Thread; - LONG Level;
-} XENVIF_MRSW_HOLDER, *PXENVIF_M= RSW_HOLDER;
-
-typedef struct _XENVIF= _MRSW_LOCK {
- volatile LONG64 Mask;
= - XENVIF_MRSW_HOLDER Holder[64];
- KEVENT Event;=
-} XENVIF_MRSW_LOCK, *PXENVIF_MRSW_LOCK;
= -
-C_ASSERT(RTL_FIELD_SIZE(XENVIF_MRSW_LOCK, Holder= ) =3D=3D RTL_FIELD_SIZE(XENVIF_MRSW_LOCK, Mask) * 8 * sizeof (XENVIF_MRSW_H= OLDER));
-
-#define XENVIF_MRSW_EXCLU= SIVE_SLOT 0
-
-static FORCEINLINE VOI= D
-InitializeMrswLock(
- IN PXENVIF_M= RSW_LOCK Lock
+#pragma warning(push)
= +#pragma warning(disable:4201) // nameless struct/union
= +struct _MRSW_LOCK {
+ KGUARDED_MUTEX Mutex; =
+ union {
+ EX_RUNDOWN_REF Rundo= wn;
+ PEX_RUNDOWN_REF_CACHE_AWARE RundownCacheAware; =
+ };
+};
+#pragma war= ning(pop)
+
+typedef struct _MRSW_LOC= K MRSW_LOCK, *PMRSW_LOCK;
+typedef struct _MRSW_LOCK MRS= W_CACHE_AWARE_LOCK, *PMRSW_CACHE_AWARE_LOCK;
+ +static FORCEINLINE NTSTATUS
+__MrswRundownIni= tialize(
+ _Inout_ struct _MRSW_LOCK *Lock,
= + _In_ BOOLEAN CacheAware,
+ _In_ ULONG Tag =
)
{
- LONG Slot= ;
-
- RtlZeroMemory(Lock, sizeof (XEN= VIF_MRSW_LOCK));
-
- for (Slot =3D 0;= Slot < (LONG) sizeof (Lock->Mask) * 8; Slot++)
- = Lock->Holder[Slot]=2ELevel =3D -1;
+ if (CacheAware) = {
+ Lock->RundownCacheAware =3D ExAllocateCac= heAwareRundownProtection(NonPagedPoolNx,
+ Tag); =
+ if (!Lock->RundownCacheAware)
+ return = STATUS_NO_MEMORY;
+ } else {
= + ExInitializeRundownProtection(&Lock->Rundown);
= + }

- KeInitializeEvent(&Lock->Event,= NotificationEvent, FALSE);
+ return STATUS_SUCCESS; =
}

static FORCEINLINE BOOLEAN=
-__ClaimExclusive(
- IN PXENVIF_MRSW= _LOCK Lock
+__MrswRundownAcquire(
+ _= Inout_ struct _MRSW_LOCK *Lock,
+ _In_ BOOLEAN CacheAwar= e
)
{
- LO= NG64 Old;
- LONG64 New;
-
= - Old =3D 0;
- New =3D 1ll << XENVIF_MRSW_= EXCLUSIVE_SLOT;
-
- return (Interlock= edCompareExchange64(&Lock->Mask, New, Old) =3D=3D Old) ? TRUE : FALS= E;
+ if (CacheAware)
+ return ExAcqui= reRundownProtectionCacheAware(Lock->RundownCacheAware);
= + else
+ return ExAcquireRundownProtection(&Lock-= >Rundown);
}

-static F= ORCEINLINE KIRQL
-__drv_maxIRQL(APC_LEVEL)
= -__drv_raisesIRQL(DISPATCH_LEVEL)
-__drv_savesIRQL=
-__AcquireMrswLockExclusive(
- IN PX= ENVIF_MRSW_LOCK Lock
+static FORCEINLINE VOID +__MrswRundownRelease(
+ _Inout_ struct _MRSW_L= OCK *Lock,
+ _In_ BOOLEAN CacheAware
= )
{
- KIRQL Irql;
= - LONG Slot;
- PKTHREAD Self;
= - PXENVIF_MRSW_HOLDER Holder;
-
- AS= SERT3U(KeGetCurrentIrql(), <, DISPATCH_LEVEL);
- KeRa= iseIrql(DISPATCH_LEVEL, &Irql);
-
= - Self =3D KeGetCurrentThread();
-
-= // Make sure we do not already hold the lock
- for (Slo= t =3D 0; Slot < (LONG) sizeof (Lock->Mask) * 8; Slot++)
= - ASSERT(Lock->Holder[Slot]=2EThread !=3D Self);
= -
- for (;;) {
- if (__Clai= mExclusive(Lock))
- break;
- <= br> - KeLowerIrql(Irql);
-
- (= VOID) KeWaitForSingleObject(&Lock->Event,
- Execu= tive,
- KernelMode,
- FALSE, <= br> - NULL);
- KeClearEvent(&Lock->Event);=
-
- KeRaiseIrql(DISPATCH_LEVEL, &= ;Irql);
- }
-
- Ho= lder =3D &Lock->Holder[XENVIF_MRSW_EXCLUSIVE_SLOT];
= -
- ASSERT3P(Holder->Thread, =3D=3D, NULL); =
- Holder->Thread =3D Self;
- Holder->= Level =3D 0;
-
- return Irql; =
+ if (CacheAware)
+ ExReleaseRundownProtecti= onCacheAware(Lock->RundownCacheAware);
+ else =
+ ExReleaseRundownProtection(&Lock->Rundown); }

-#define AcquireMrswLockExclusive= (_Lock, _Irql) \
- do { \
- *(_Irql) = =3D __AcquireMrswLockExclusive(_Lock); \
- } while (FALS= E)
-
static FORCEINLINE VOID <= br> -__drv_maxIRQL(DISPATCH_LEVEL)
-__drv_require= sIRQL(DISPATCH_LEVEL)
-ReleaseMrswLockExclusive( =
- IN PXENVIF_MRSW_LOCK Lock,
- IN __drv_rest= oresIRQL KIRQL Irql,
- IN BOOLEAN Shared
= +__MrswRundownWait(
+ _Inout_ struct _MRSW_LOCK *Loc= k,
+ _In_ BOOLEAN CacheAware
) =
{
- LONG Slot;
-= PKTHREAD Self;
- LONG64 Old;
- LONG6= 4 New;
- PXENVIF_MRSW_HOLDER Holder;
= -
- ASSERT3U(KeGetCurrentIrql(), =3D=3D, DISPATCH_LEVEL)= ;
-
- Slot =3D XENVIF_MRSW_EXCLUSIVE_= SLOT + 1; // Choose any slot other than the exclusive slot
= -
- Old =3D 1ll << XENVIF_MRSW_EXCLUSIVE_SLOT; =
- New =3D (Shared) ? (1ll << Slot) : 0; -
- Old =3D InterlockedCompareExchange64(&L= ock->Mask, New, Old);
- ASSERT3U(Old, =3D=3D , 1ll &l= t;< XENVIF_MRSW_EXCLUSIVE_SLOT);
-
= - Self =3D KeGetCurrentThread();
-
-= ASSERT3P(Lock->Holder[XENVIF_MRSW_EXCLUSIVE_SLOT]=2EThread, =3D=3D, Sel= f);
-
- // If we are leaving the lock= held shared then we need to transfer
- // our identity = information into the hew slot=2E
- if (Shared) - Lock->Holder[Slot] =3D Lock->Holder[XENVIF_MRSW_EXCLUSIVE= _SLOT];
-
- Holder =3D &Lock->= Holder[XENVIF_MRSW_EXCLUSIVE_SLOT];
-
= - Holder->Thread =3D NULL;
- Holder->Level =3D -1= ;
-
- KeLowerIrql(Irql);
= + if (CacheAware)
+ ExWaitForRundownProtectionRel= easeCacheAware(Lock->RundownCacheAware);
+ else =
+ ExWaitForRundownProtectionRelease(&Lock->Rundown); =
}

-static FORCEINLINE LONG=
-__ClaimShared(
- IN PXENVIF_MRSW_LO= CK Lock
+static FORCEINLINE VOID
+__M= rswRundownCompleted(
+ _Inout_ struct _MRSW_LOCK *Lock, =
+ _In_ BOOLEAN CacheAware
) {
- LONG Slot;
- LO= NG64 Old;
- LONG64 New;
-
= - // Make sure the exclusive bit is set so that we don't find it =
- Old =3D Lock->Mask | (1ll << XENVIF_MRSW_EXCLUS= IVE_SLOT);
-
- Slot =3D __ffu((ULONG6= 4)Old);
- ASSERT(Slot >=3D 0);
- A= SSERT3U(Slot, !=3D , XENVIF_MRSW_EXCLUSIVE_SLOT);
+ if (= CacheAware)
+ ExRundownCompletedCacheAware(Lock->Rund= ownCacheAware);
+ else
+ ExRundownCom= pleted(&Lock->Rundown);
+}
- Old &=3D ~(1ll << XENVIF_MRSW_EXCLUSIVE_SLOT); =
- New =3D Old | (1ll << Slot);
+static= FORCEINLINE VOID
+__MrswRundownReInitialize( + _Inout_ struct _MRSW_LOCK *Lock,
+ _In_ BOOLE= AN CacheAware
+ )
+{ <= br> + if (CacheAware)
+ ExReInitializeRundownProt= ectionCacheAware(Lock->RundownCacheAware);
+ else =
+ ExReInitializeRundownProtection(&Lock->Rundown); =
+}

- return (InterlockedCo= mpareExchange64(&Lock->Mask, New, Old) =3D=3D Old) ? Slot : -1; =
+static FORCEINLINE VOID
+__MrswRundownTe= ardown(
+ _Inout_ struct _MRSW_LOCK *Lock,
= + _In_ BOOLEAN CacheAware
+ )
+= {
+ if (CacheAware)
+ ExFreeC= acheAwareRundownProtection(Lock->RundownCacheAware);
= + else
+ RtlZeroMemory(&Lock->Rundown, sizeof(Loc= k->Rundown));
}

+_IRQL= _requires_min_(PASSIVE_LEVEL)
+_IRQL_requires_max_(APC_L= EVEL)
+static FORCEINLINE NTSTATUS
+_= _InitializeMrswLock(
+ _Out_ struct _MRSW_LOCK *Lock, =
+ _In_ BOOLEAN CacheAware,
+ _In_ ULONG= Tag
+ )
+{
= + KeInitializeGuardedMutex(&Lock->Mutex);
+ ret= urn __MrswRundownInitialize(Lock, CacheAware, Tag);
+} =
+#define InitializeMrswLock(Lock, Tag) \
= + __InitializeMrswLock(Lock, FALSE, Tag)
+#define Ini= tializeMrswCacheAwareLock(Lock, Tag) \
+ __InitializeMrs= wLock(Lock, TRUE, Tag)
+
+_Requires_l= ock_not_held_(*Lock)
+_IRQL_requires_min_(PASSIVE_LEVEL)=
+_IRQL_requires_max_(APC_LEVEL)
+sta= tic FORCEINLINE VOID
+__TeardownMrswLock(
= + _Inout_ struct _MRSW_LOCK *Lock,
+ _In_ BOOLEAN C= acheAware
+ )
+{
= +#if DBG
+ BUG_ON(!KeTryToAcquireGuardedMutex(&am= p;Lock->Mutex));
+ BUG_ON(!__MrswRundownAcquire(Lock,= CacheAware));
+ KeReleaseGuardedMutex(&Lock->Mut= ex);
+ __MrswRundownRelease(Lock, CacheAware); +#endif
+
+ __MrswRundownTe= ardown(Lock, CacheAware);
+ RtlZeroMemory(Lock, sizeof(M= RSW_LOCK));
+}
+#define TeardownMrswL= ock(Lock) \
+ __TeardownMrswLock(Lock, FALSE) +#define TeardownMrswCacheAwareLock(Lock) \
+ _= _TeardownMrswLock(Lock, TRUE)
+
+_Acq= uires_lock_(_Global_critical_region_)
+_Requires_lock_no= t_held_(*Lock)
+_Acquires_exclusive_lock_(*Lock) =
+_IRQL_requires_min_(PASSIVE_LEVEL)
+_IRQL_r= equires_max_(APC_LEVEL)
static FORCEINLINE VOID <= br> -AcquireMrswLockShared(
- IN PXENVIF_MRSW_LOC= K Lock
+__AcquireMrswLockExclusive(
+= _Inout_ struct _MRSW_LOCK *Lock,
+ _In_ BOOLEAN CacheAw= are
)
{
- = KIRQL Irql;
- LONG Level;
- LONG Slot= ;
- PKTHREAD Self;
- PXENVIF_MRSW_HOL= DER Holder;
+ ASSERT3U(KeGetCurrentIrql(), <=3D, APC_= LEVEL);

+ KeAcquireGuardedMutex(&Lock-&g= t;Mutex);
+ __MrswRundownWait(Lock, CacheAware); =
+ __MrswRundownCompleted(Lock, CacheAware);
= +}
+#define AcquireMrswLockExclusive(Lock) \
= + __AcquireMrswLockExclusive(Lock, FALSE)
+#defi= ne AcquireMrswCacheAwareLockExclusive(Lock) \
+ __Acquir= eMrswLockExclusive(Lock, TRUE)
+
+_Re= leases_lock_(_Global_critical_region_)
+_Requires_exclus= ive_lock_held_(*Lock)
+_Releases_exclusive_lock_(*Lock) =
+_IRQL_requires_min_(PASSIVE_LEVEL)
+= _IRQL_requires_max_(APC_LEVEL)
+static FORCEINLINE VOID =
+__ReleaseMrswLockExclusive(
+ _Inout= _ struct _MRSW_LOCK *Lock,
+ _In_ BOOLEAN CacheAware =
+ )
+{
+ __Mr= swRundownReInitialize(Lock, CacheAware);
+ KeReleaseGuar= dedMutex(&Lock->Mutex);
+}
+#d= efine ReleaseMrswLockExclusive(Lock) \
+ __ReleaseMrswLo= ckExclusive(Lock, FALSE)
+#define ReleaseMrswCacheAwareL= ockExclusive(Lock) \
+ __ReleaseMrswLockExclusive(Lock, = TRUE)
+
+_Releases_lock_(_Global_crit= ical_region_)
+_Requires_exclusive_lock_held_(*Lock) =
+_Releases_exclusive_lock_(*Lock)
+_Acqu= ires_shared_lock_(*Lock)
+_IRQL_requires_min_(PASSIVE_LE= VEL)
+_IRQL_requires_max_(APC_LEVEL)
= +static FORCEINLINE VOID
+__DowngradeMrswLockExclusive( =
+ _Inout_ struct _MRSW_LOCK *Lock,
+ = _In_ BOOLEAN CacheAware
+ )
+{
+#if DBG
= ASSERT3U(KeGetCurrentIrql(), <=3D, DISPATCH_LEVEL);
= - KeRaiseIrql(DISPATCH_LEVEL, &Irql);
- - Self =3D KeGetCurrentThread();
-
= - // Do we already hold the lock? If so, get the nesting level =
- Level =3D -1;
- for (Slot =3D 0; Slot &l= t; (LONG) sizeof (Lock->Mask) * 8; Slot++) {
= - if (Lock->Holder[Slot]=2EThread =3D=3D Self && Lock->Holder= [Slot]=2ELevel > Level)
- Level =3D Lock->Holder[S= lot]=2ELevel;
- }
- Level++; <= br> +#endif

- for (;;) { =
- Slot =3D __ClaimShared(Lock);
- if (Slo= t >=3D 0)
- break;
-
= - _mm_pause();
- }
- - Holder =3D &Lock->Holder[Slot];
- =
- Holder->Thread =3D Self;
- Holder-&g= t;Level =3D Level;
-
- KeLowerIrql(Ir= ql);
+ return __MrswRundownAcquire(Lock, CacheAware); =
}
-
+#define TryAcqu= ireMrswLockShared(Lock) \
+ __TryAcquireMrswLockShared(L= ock, FALSE)
+#define TryAcquireMrswCacheAwareLockShared(= Lock) \
+ __TryAcquireMrswLockShared(Lock, TRUE) =
+
+_Acquires_shared_lock_(*Lock)
= +_IRQL_requires_min_(PASSIVE_LEVEL)
+_IRQL_requi= res_max_(DISPATCH_LEVEL)
static FORCEINLINE VOID =
-ReleaseMrswLockShared(
- IN PXENVIF_MRSW_LO= CK Lock
+__SpinAcquireMrswLockShared(
= + _Inout_ struct _MRSW_LOCK *Lock,
+ _In_ BOOLEAN Cache= Aware
)
{
= - KIRQL Irql;
- PKTHREAD Self;
- LONG= Level;
- LONG Deepest;
- LONG Slot; =
- LONG64 Old;
- LONG64 New; - PXENVIF_MRSW_HOLDER Holder;
-
= +#if DBG
ASSERT3U(KeGetCurrentIrql(), <=3D, DISP= ATCH_LEVEL);
- KeRaiseIrql(DISPATCH_LEVEL, &Irql); =
-
- Self =3D KeGetCurrentThread(); =
-
- Level =3D -1;
- D= eepest =3D -1;
- for (Slot =3D 0; Slot < (LONG) sizeo= f (Lock->Mask) * 8; Slot++) {
- if (Lock->= Holder[Slot]=2EThread =3D=3D Self && Lock->Holder[Slot]=2ELevel = > Level) {
- Level =3D Lock->Holder[Slot]= =2ELevel;
- Deepest =3D Slot;
- } =
- }
- ASSERT(Level >=3D 0); -
- Slot =3D Deepest;
- ASS= ERT3U(Slot, !=3D, XENVIF_MRSW_EXCLUSIVE_SLOT);
- =
- Holder =3D &Lock->Holder[Slot];
+#e= ndif

- Holder->Thread =3D NULL; - Holder->Level =3D -1;
-
= - do {
- Old =3D Lock->Mask;
= - New =3D Old & ~(1ll << Slot);
- } while= (InterlockedCompareExchange64(&Lock->Mask, New, Old) !=3D Old); =
-
- KeSetEvent(&Lock->Event, IO_N= O_INCREMENT, FALSE);
- KeLowerIrql(Irql);
= + while (!__MrswRundownAcquire(Lock, CacheAware))
+= YieldProcessor();
+}
+#define SpinAc= quireMrswLockShared(Lock) \
+ __SpinAcquireMrswLockShare= d(Lock, FALSE)
+#define SpinAcquireMrswCacheAwareLockSha= red(Lock) \
+ __SpinAcquireMrswLockShared(Lock, TRUE) =
+
+/*
+ * Unlike Spi= nAcquireMrswLockShared, AcquireMrswLockShared will
+ * s= leep when the lock acquisition fails=2E Thus it cannot be used at + * DISPATCH_LEVEL=2E
+ */
= +_Acquires_shared_lock_(*Lock)
+_IRQL_requires_min_(PASS= IVE_LEVEL)
+_IRQL_requires_max_(APC_LEVEL)
= +static FORCEINLINE VOID
+__AcquireMrswLockShared(=
+ _Inout_ struct _MRSW_LOCK *Lock,
+= _In_ BOOLEAN CacheAware
+ )
+{
+ __MrswRundownRelease(Lock, CacheA= ware);
}
+#define ReleaseMrswLockShar= ed(Lock) \
+ __ReleaseMrswLockShared(Lock, FALSE) =
+#define ReleaseMrswCacheAwareLockShared(Lock) \
= + __ReleaseMrswLockShared(Lock, TRUE)

= -#endif // _XENVIF_MRSW_H
+#endif // _MRSW_H
= diff --git a/src/xenvif/vif=2Ec b/src/xenvif/vif=2Ec
= index 6f468ee=2E=2Ecb4cf84 100644
--- a/src/xenvif/= vif=2Ec
+++ b/src/xenvif/vif=2Ec
@@ -= 47,7 +47,7 @@

struct _XENVIF_VIF_CONTEXT {
PXENVIF_PDO Pdo;
- XENVIF_MRSW= _LOCK Lock;
+ MRSW_LOCK Lock;
LONG Re= ferences;
PXENVIF_FRONTEND Frontend;
= BOOLEAN Enabled;
@@ -150,13 +150,12 @@ VifEnable( =
)
{
PXENVIF_VIF_= CONTEXT Context =3D Interface->Context;
- KIRQL Irql;=
BOOLEAN Exclusive;
NTSTATUS status; =

Trace("=3D=3D=3D=3D>\n");
=
- AcquireMrswLockExclusive(&Context->Lock, &Irql= );
+ AcquireMrswLockExclusive(&Context->Lock); =
Exclusive =3D TRUE;

if (Con= text->Enabled)
@@ -188,7 +187,7 @@ VifEnable( =

done:
ASSERT(Exclusive); =
- ReleaseMrswLockExclusive(&Context->Lock, Irql, FALSE);=
+ ReleaseMrswLockExclusive(&Context->Lock); =

Trace("<=3D=3D=3D=3D\n");
=
@@ -199,7 +198,7 @@ fail3:

(VOID= ) FrontendSetState(Context->Frontend, FRONTEND_CONNECTED);
=
- ReleaseMrswLockExclusive(&Context->Lock, Irql, T= RUE);
+ DowngradeMrswLockExclusive(&Context->Lock= );
Exclusive =3D FALSE;

R= eceiverWaitForPackets(FrontendGetReceiver(Context->Frontend)); @@ -234,7 +233,7 @@ fail1:
Context->Callbac= k =3D NULL;

if (Exclusive)
= - ReleaseMrswLockExclusive(&Context->Lock, Irql, FALSE); + ReleaseMrswLockExclusive(&Context->Lock);
= else
ReleaseMrswLockShared(&Context->Lock); =

@@ -389,17 +388,16 @@ VifEnableVersion9( =
)
{
PXENVIF_V= IF_CONTEXT Context =3D Interface->Context;
- KIRQL Ir= ql;
NTSTATUS status;

Trac= e("=3D=3D=3D=3D>\n");

- AcquireMrswLockEx= clusive(&Context->Lock, &Irql);
+ AcquireMrsw= LockExclusive(&Context->Lock);

Contex= t->CallbackVersion9 =3D Callback;
Context->Argumen= tVersion9 =3D Argument;

- ReleaseMrswLockExc= lusive(&Context->Lock, Irql, FALSE);
+ ReleaseMrs= wLockExclusive(&Context->Lock);

statu= s =3D VifEnable(Interface, VifCallbackVersion9, Context);
=
@@ -416,17 +414,16 @@ VifEnableVersion8(
)=
{
PXENVIF_VIF_CONTEXT Contex= t =3D Interface->Context;
- KIRQL Irql;
= NTSTATUS status;

Trace("=3D=3D=3D=3D&g= t;\n");

- AcquireMrswLockExclusive(&Cont= ext->Lock, &Irql);
+ AcquireMrswLockExclusive(&am= p;Context->Lock);

Context->CallbackVer= sion8 =3D Callback;
Context->ArgumentVersion8 =3D Arg= ument;

- ReleaseMrswLockExclusive(&Conte= xt->Lock, Irql, FALSE);
+ ReleaseMrswLockExclusive(&a= mp;Context->Lock);

status =3D VifEnableVe= rsion9(Interface, VifCallbackVersion8, Context);

= @@ -441,14 +438,13 @@ VifDisable(
)
= {
PXENVIF_VIF_CONTEXT Context =3D Interface-= >Context;
- KIRQL Irql;

= Trace("=3D=3D=3D=3D>\n");

- AcquireMrsw= LockExclusive(&Context->Lock, &Irql);
+ Acqui= reMrswLockExclusive(&Context->Lock);

= if (!Context->Enabled) {
- ReleaseMrswLockExc= lusive(&Context->Lock, Irql, FALSE);
+ ReleaseMrs= wLockExclusive(&Context->Lock);
goto done; =
}

@@ -463,7 +459,7 @@ VifDisabl= e(

(VOID) FrontendSetState(Context->Front= end, FRONTEND_CONNECTED);

- ReleaseMrswLockE= xclusive(&Context->Lock, Irql, TRUE);
+ Downgrade= MrswLockExclusive(&Context->Lock);

Re= ceiverWaitForPackets(FrontendGetReceiver(Context->Frontend)); TransmitterAbortPackets(FrontendGetTransmitter(Context->Fronten= d));
@@ -511,7 +507,7 @@ VifQueryStatistic(
= status =3D STATUS_INVALID_PARAMETER;
if (Index &g= t;=3D XENVIF_VIF_STATISTIC_COUNT)
goto done;
= -
+
AcquireMrswLockShared(&am= p;Context->Lock);

FrontendQueryStatistic(= Context->Frontend, Index, Value);
@@ -567,7 +563,8 @@= VifReceiverReturnPacket(
{
P= XENVIF_VIF_CONTEXT Context =3D Interface->Context;
- AcquireMrswLockShared(&Context->Lock);
= + // Called from MINIPORT_RETURN_NET_BUFFER_LISTS
+ Sp= inAcquireMrswLockShared(&Context->Lock);

= ReceiverReturnPacket(FrontendGetReceiver(Context->Frontend), =
Cookie);
@@ -592,9 +589,10 @@ VifTransmitter= QueuePacket(
PXENVIF_VIF_CONTEXT Context =3D Interface-&= gt;Context;
NTSTATUS status;

= - AcquireMrswLockShared(&Context->Lock);
- =
status =3D STATUS_UNSUCCESSFUL;
+ if (!= TryAcquireMrswLockShared(&Context->Lock))
+ retur= n status;
+
if (!Context->Enabled)=
goto done;

@@ -948,9 +94= 6,8 @@ VifAcquire(
)
{ =
PXENVIF_VIF_CONTEXT Context =3D Interface->Context; =
- KIRQL Irql;

- AcquireMrswLockE= xclusive(&Context->Lock, &Irql);
+ AcquireMrs= wLockExclusive(&Context->Lock);

if (C= ontext->References++ !=3D 0)
goto done;
= @@ -963,7 +960,7 @@ VifAcquire(
Trace("<=3D=3D= =3D=3D\n");

done:
- Relea= seMrswLockExclusive(&Context->Lock, Irql, FALSE);
= + ReleaseMrswLockExclusive(&Context->Lock);

= return STATUS_SUCCESS;
}
@@ -= 974,9 +971,8 @@ VifRelease(
)
{
@@ -1100,7 +1096,9 @= @ VifInitialize(
if (*Context =3D=3D NULL)
= goto fail1;

- InitializeMrswLock(&= (*Context)->Lock);
+ status =3D InitializeMrswLock(&a= mp;(*Context)->Lock, XENVIF_VIF_TAG);
+ if (!NT_SUCCE= SS(status))
+ goto fail2;

= FdoGetSuspendInterface(PdoGetFdo(Pdo),&(*Context)->SuspendInterface= );

@@ -1110,7 +1108,7 @@ VifInitialize( =
*Context,
&(*Context)->MacThread);=
if (!NT_SUCCESS(status))
- goto fail= 2;
+ goto fail3;

(*Contex= t)->Pdo =3D Pdo;

@@ -1118,7 +1116,7 @@ Vi= fInitialize(

return STATUS_SUCCESS; <= br>
-fail2:
+fail3:
= Error("fail3\n");

RtlZeroMemory(&(*Con= text)->MacEvent, sizeof (KEVENT));
@@ -1126,7 +1124,1= 0 @@ fail2:
RtlZeroMemory(&(*Context)->SuspendInt= erface,
sizeof (XENBUS_SUSPEND_INTERFACE));
=
- RtlZeroMemory(&(*Context)->Lock, sizeof (XENVIF= _MRSW_LOCK));
+ TeardownMrswLock(&(*Context)->Loc= k);
+
+fail2:
+ Er= ror("fail2\n");

ASSERT(IsZeroMemory(*Context= , sizeof (XENVIF_VIF_CONTEXT)));
__VifFree(*Context); =
@@ -1205,7 +1206,7 @@ VifGetInterface(
= }

return status;
-} =
+}

VOID
Vif= Teardown(
@@ -1228,7 +1229,7 @@ VifTeardown(
= RtlZeroMemory(&Context->SuspendInterface,
= sizeof (XENBUS_SUSPEND_INTERFACE));

- RtlZe= roMemory(&Context->Lock, sizeof (XENVIF_MRSW_LOCK));
= + TeardownMrswLock(&Context->Lock);

= ASSERT(IsZeroMemory(Context, sizeof (XENVIF_VIF_CONTEXT)));
= __VifFree(Context);
--
2=2E53= =2E0=2Ewindows=2E2



-= -
Ngoc Tu Dinh | Vates XCP-ng Developer
=
XCP-ng & Xen Orchestra - Vates solutions
=
web: https://vates=2Etech<= /a>

=
&= nbsp;
--
= =
 
Ngoc Tu = Dinh | Vates XCP-ng Developer
=
<= strong>
XCP-ng & Xen Orchestra - Vates solutions
=

web: http= s://vates=2Etech
3D""
---=Part.baf.bf3f53f3ec167425.19e21eeeff6.b1b31f559e950585=- Content-Type: image/png; charset=utf-8; name="x-disclaimer-1126181503-1778685767667.png" Content-Transfer-Encoding: base64 Content-ID: Content-Disposition: inline; filename="x-disclaimer-1126181503-1778685767667.png" Content-Description: x-disclaimer-1126181503-1778685767667.png iVBORw0KGgoAAAANSUhEUgAAAK4AAACfCAYAAABgKuLmAAAm4XpUWHRSYXcgcHJvZmlsZSB0eXBl IGV4aWYAAHjatZxpkmSpcoX/swotgXlYDuBgph1o+foOkVmva2jZa8lU1VWZFRlxL+DuZ3C47c5/ /ed1/8GvEYZ3ubReR62eX3nkESffdP/5Nd/fwef39+el8/Wz8PPrbtyvH0ReSnxNn3/2+vX+79fD jwt8vky+K3+5UN9fP1g//2Dkr+v3Xy70daOkEUW+se8RfV0oxc8PwtcF5mdavo7e/jqF9TW1r89/ loE/Tn/dHYdeK+vzs1//nRurZ4X7pBhPCsnzd0pfA0j6E12afFP5O6YU30vvlc7fIcWvkbAgf1qn H7+4rbsaav7jm36Kyo/vfonWGV9r9Gu0cvx6S/plkeuPr3983YXy56i8pf/LnXP/+i7+/ProMX5G 9Mvqv8W/1u+bM7OYubLU9WtS31N83/E+wpF16+4YWvWNP4VLtPd78LuT1ZtUML/94vcOI0TCdUMO Fma44byvO2yGmONxsfFNjDum92JPLY64iVtIWb/DjS2NZMQxpv3CnlP8MZbwbjv8du9unTtb4K0x cLHwkuAf/nb/9AP3qhRC0FoS+vCJb4xabIahyOlv3kZEwv1a1PIW+Pv3r78U10QEi1ZZJTJY2PW5 xCrhX0iQXqATbyx8/dRgaPZ1AZaIWxcGExIRIGohlVCDbzG2EFjIToAmQ48px0UEQinRGGTMKVVi 06NuzUdaeG+NJfKy43XAjEgUKq4Rm5Emwcq5kD8td3JollRyKaWWVnoZZdZUcy211lYFirOlll0r rbbWehtt9tRzL7321nsffY44EqBZRh1t9DHGnNxzcuXJpydvmHPFlVZexa262uprrLlJn5132XW3 3ffY06IlAz+sWrNuw+YJh1Q6+ZRTTzv9jDMvqXaTu/mWW2+7/Y47f0TtK6y//f4HUQtfUYsvUnpj +xE1Xm3t+xJBcFIUMwIWXQ5EvCkEJHRUzHwPOUdFTjHzA8RLJTLIophZUMSIYD4hlhu+Y+fiJ6KK 3P8pbq7ln+IW/7eRcwrdP4zc73H7U9RMNLRfxD5VqEX1ierj56fP2KfI7revTjNvjRUI8HbqXrdv xdvlv139mjVY7qcXSmjvnE4bo8XF2Po+56wzNhTXorNcILFSOrVFGe7A9LnFNK3KmL3OuveqQXFo dY9uQGIfkzocZ0Cv8/S0/XDHjzVuYJly3SeNUl+5pphZwnA2ydC5/Gms3vWbhUrjhH59OqOcMI3q tTTNBUi/7wWM2upzkzUk28nDkwibpeRNfVeuOYkcWVEWoyHtrJzdejkdFUJybDcy60sGdOZf9xzr 7tVPLgZWA7unpRuJQj8ELu92/SHFjDBxrTEZXWplj7tcjiRQ4D5UgmkAhMlaKocx7HLjJAQl9VJO mYvI1pLi7gW+inX1OEsjy85pbl7+BXiFxSL5wj8LObqCTULGAjEO1rnnwFVOKo0ViBEtRMFsS6GX mk+2c1ybjIVsz7WWXfhA8jt3VrhNhlQHFGQzHX4eZjUS/aSpW55k96xiSA/L0ABTG6msQIjyQvgR 07amtR6O1VNaM4TSYvixPq0RQ0zGHM3yu8WsA54kRg4as3LTaiSL7RbO1PULaxupwhzbYriRYgtj o35KhXszeTLrqYUs3Zv5Uj9uz7vJCkpxmU+FYDZbKIZUQN6Qx76gQSdpxs0I0VlJRj9O7kq+ESja 3fKmRM4l+FVE0ts+FR0WSvOdwJ05zt61BMqn8P6sb3KROvzDV/d3P+ArI2aAo+Vl5PoF2pjz7GUZ f3ZpixEAFndYSd5ZbHu3g7q4hXRf5cRrYeUMqhAAgn8LRDbvzMHbmoHwGtULYwdAYuUWNffgiHnb CcCpfiRIgpvCkk0IC5MCdjESpKS45mPpSOM23fU0tA24Vcoq2cCj0ljOvraFsVoKBygJaezT7LbG ZftNdsqezHCWvfxRvjLwPQjcpNiJ0J7AyDk1jNJCzGVITzWSgMQPdw6GulgkQwyRPLycbZGTzOSm aicBIevmmMO8w92FvlpzFWp5VIubWS9KCtSKB4IrI5L2fs9FnXrrZyYwoTAR4MoD3iFQ9WE4BCJz WaQh6bqbNaqMer0l2WAGm8iV2QLVEU05xLhPBy9yIFFLPZpF4JaOpSX5gfmRbh8xqzJnaCWBCZV/ 8zFKB73YMCswBIgcy5lb8Y+xGtzVUlzH7eZBm7JT2tQxeQBjWa2HdbwR7iqwwRi5Ax/oGWNGK+qe 4ChoR2neDKzG5YI/lfWf5Sq+eofFAEN11Bs1ukG6OOPRrM5B5RbgASIjWTpkOS4/7cPyJPyeRG7x xA0MrlJmznPtjQFsZfrT4csNvEYSgjFwXVYXSjA+yNioPXHFudRaXBQjl5IZYI2qRqLAHq7YrYLg c3cIm5QmkKx0hUJUfavDYmQVP9zmJnFBSPcKas+sFIaCFuIkGFkcdqvkk5HNKz9p3jdTj3B6k468 jPV4gAOoLQR6Znj9dooOfjjiNIqBP/bFpQav+Pm+93/z1f32A+gH4Ukq1JOgssPStw3JwfynwhyQ iGpvyfDNS6Ch2WTRLdsKR4+3mp04YMjSSbs4Ka8hCaw4g4Z8CJHEihCJQt1INC0iFkMfTMhRY/Mu JnzJbjyHl3Bi8XoX1gP6jZrwECpaqwrtKA1WhUEbvL+mJAjyaTsqdiC1oqgFLO+oPZUQtE3ZiZt4 6xqinw2tJt6VVRKFNIROU7G28cD+uLoo2YFCGIb4AfP6nO1Ax8BvTJXc6wYHpKbvblGt7ZA6tcB4 pKuQGMze3DWMV52icGOw7aiwmrLukCtzCh9JP8ogGQxb6pOFYPm9naWRAVeSXqf0K8U3iCsY6nKf VW/KAhNgp4IRtc7LgA/xKtQF9YegPNVSrHyu8SKpXtwDcEgEyqIe9uNXBIJW1b9kgs9IZ2iHeW3k QkbropKAJ+IY4KZMAiC0CBdsM1rjSowX7fnUBzIuAohIyQbYIQ1hi0l2AyJA4eKGAAGhYLnCEaQ4 FEJBb4vNIWgYRPKKu8omwWngQLKnFA6ITpUjdsXB6Yqtqb0pcRML3M8FVwuQBrIIgASuO/V19R+R Qoyg0akfOB+/la7ZZml5F682FBXw5jsy10Hz2QgSq9tJbCKU14K20MOpUR2dSuk7XH1EQ5/Q/RVm iwFQ28dmb5J+YNlAId7Hrghw6NI/lkZ6/DtfixlubSy3rQAEudThFyrPp3Q8UoSlHcd4A3oe1YyE R6rHhQIuZGEn6nBDUQZy45VGdSREAR6JBapWqnTiWU7D45jaIEgVrdtl+CdU2ADjeUVeyw4fWDs+ n1SSO6jHLc24Qfk6FqxNjlNVLXnk32DJK1oYyQuKAHukDjA8MAPoGeCXOidbNwRJmkGfUAicRf3o dnJESUKZ+k8d82Faki0rSGitzzVwC/sywE61wVitOxZ4oyqhn0SUIAwQDnc0QAHAjgxgTRa5jtZj han0+qXUScl+SRR0xOGaLgEhr6GAEQifCt8jI0P0flJkngQQHWWxJFtH6zLe4tX3qipkxL8oxkFS TAqWQ9kcALxJBMaSVfckL1kzfTGPifK3UPbob0IC65JJwCjv405ze8cIPD4EYAC9kK8suFJW/pRy 0GXhfOCIT7CCYy6KuU4KH7GLx9hG9clqOIwliQmeLtQw+W31bhCJoXX4dEaWmTVgqEVYB/YAZ6An Sh0J6GMhqTBUq1IiCMBja9cDTUEHU7MghUBUqTmsgkHYT1QDi4hHJAGQvTEkvuYkj5V2yehsNAkL FAwEmRNjsQX4oSL3A54OjbcQa7gh3tQRAbFQ3qTG9lsgenApESnmgB+jGKAkcAbtjZ6BLzHCAN6B mpBCcwSiTQIrTZFOqaNWD+gHDuaKo+x2p7N7UVpeFKGhBRyTbkj+XgkzxsK/GDp/GCJmA1RA5EdW Ti2wSg4RNKY27t4SaKgqUtTjkRYpl0UAOxEk4Phc3M5ZCV1MwTI1ZMNDNDIuiJTAsoCIIGNmarfy XvlRrB0431hcFPcqCETCeNOtuGUuBm2thX5BmB0YGECmGOSy/85+v68Lw4p5Yf2O76iggwZOMD1q RTl1JbDD83WIURg6S5PB1QaMI94lfMBYCX442cslSY61K/6naDCuBY6TkDywKdIAJKZo0eFEGQ6R 7BURjryANggvspKA9UEyIyhYXMQ1ohBEgRzJu1wzMgq9TzGSkMOEQWTERMPAsbAQlA7q9+UX6IFF 24lsBluJt+QVLoscQKHhQQnG1IQdeOszYoOy2RDpwNvqDhQWVjo3y0gguMEQTohoZJtxV+JUKOw4 kCDUKF44uowWRMDkhiGW9qDExF19nxmBm2tCIPVgUBcCt8uSzLlQWih3ro3iAHgzVhQM52OsCT/E z6IN+WHHQCw0PDWIcztNmrPydkqJIhJ7YgrxMxdyRwaPUzHHeeM8wIvbgqwimabmNZ4b6s7PsJJD 8ckXiEshRXQPVp2AdRYiV3WXnDy/YTNPqjgASLmAs9gx8jExJEAUEGhwA4DP2mK8WN9B3cIyov/G RRaGyQW0RCXeaPCLiwloClz+JSlQORQvNQqg14TyQFpPBA0IBuGRKig0hY2cmym7NVJsSKfI20gB TNWD4y9oHZVgQEa4INaBYbTMbTqItzCcBulQJLiNlNwHfEFJ7Gc4H6kUYUIYAlEzkFn5brIfTbdA IuXRAIqPyK2Qm9hww8dRIgnp2ja4UyWu0IHrUDuIFwgLJ4Ptq6fLE+A9D9mHlInPZmCU0KRSLI14 uziWBdAQn0PS5IjlQUMhVHfWssaGbS/6GzLinixuxloP6PYCc4/Gr3yQw7zjGLH2IBGrsaXKKOYO JEGRh0msAS+q0plegcRZNwQNkSBdq4WI2kNmOO02NRINR0tCJzCIZV9kPwUInB2P7CUCFKotNQeh 4N0lTTe1g7a+CRoAtR3FRI01WIc0Gr2jeFkhxBWuEQoCwLpnkkudJNQ6OI7p4q8h9Sr7nkhlVsNR kGgttKIZ3MuNMGUJ6WuMOIA93bxQOG4AFoAC+NXOeZ5g7CfOUPOM1pHxH/3V/w4m40SAqB1rPe8p lGBuaAemi+CeRNTIK0cJTYUlHwQhSQ50Y/AoRji5W2bs0MVFOIBGhHKA+SsI7QZVFlHDi3RqsTks FmOlPvAdkXStYcJ82BByMQYSrNaGYasIGQo43ZZVyVXMBWMEQKKX68sh/AE1UlId8ELfDK1FDCPr FpkJH5sUASwEBsBTSPuQZeD2JrS2YahANTFV11dQq1rtWFhWbYUnUkORrggIYnQoVplspLCxL/29 CFKkco8ujBrAXxyHNAasmIZym8TPZig66mdGqQA0a2pVPr0QZ8gy+MDMcH0kKAqg4DqYUVtgdvKo ctBTzVNwgJzSTJFt2Fo8LbxV1RGs6k8EFU6mHGHfirzLwBI4hKpy6jUuxhGylGC9KH302FNwWtyg pUC78FG01lI3ed7LMnbKcUrhCR+gBzfxH5qSqbHNZxF6XVm2qGx1eOS7jFXrSZtF8v94P0TTaZTQ ZVA9YGMlIvAp8J7QSXR4tdU7q2oSJAOXh5jSh8kyMqJUgfRIpC2xEGojxyEN5IubFZ84iXeEp9XO 1FrbyqqrCDyk68FXYEwdAZAtlWcRDnx8yGN0cJKV9w7MuaoyqRRxlzQPQILqgehKUNMG9G5kE5AP SVR5YGMF8VsgyJYPiLfgRRAH2I09qV34HSETRaymlkhDYvFFu5hhJUA5xtrk1DtUAHKR1vV5TbV9 UOVzHaCWyr3Q7dj26YUaVNn/fcPlfnohyLfhFagX5Bwq69ELyR4gl9s2KvBOuSVMh3wCmv+1JvZM z/dDBd4aa/xAnSJE4oC461G3evlj1jjJf6z6IH+xikLGim9eQ9uEbZhrYBgCg7RJmHojSXANmK0K u3p7TgJjLd6H1Ej4HUuPBAxUJR0hogL7UmYsNl4ablQXrcqO1NI2iYeO56LIeaRUVa8nT5BB9hFp jNEbZCQKSY3xJlvsbIbYnjNCi6NDQFJCPZVNGWinvJN6CKR9R0/h1kS0Er8YaDW2N8KQFPausAo4 yIDNmCQ3ghZUIK9kvckR9D2wF1Di0COvRxRxU2NQzc+k3l4lwcq6rsULUWGWo5SfkR/oMNxAr0n7 PkQnq1OKwmVlgW+GAhYgpyBuxMDBc0nBZMclcBlUGWasCH1UJ0gSbp7UlED8seLYCcww9R+Upw+P YBKApG2UYvLpOioc2JLBWTcAH1tdcQQ/YWuRIp0kNuDdwUG5r7f5xDxx6gk9S1HUFRrY6IKOUeCU cScJfoMpKFuo72ovK4YQqUSkCQlPfjGbpL2HQaYhliCMpZ2GQ5Y6lhjYR6p5eAiUQnyrpQDqkFP3 IFNRM/ACYY/DTGZmdDzF7p4yQlCpFQ4jY2pwayjb+LZSKytzyAybS1s4B505IcY91KuBEwFIct7u oZBQN4CTIaMPueuGZ/mo5whtUNdloSNImaBtUAwLfN1RXyhkBDWwzFi7NBtRB5kRW9pNBRDMaRPv U+65pf5P2it/LfbVULWvCYrI1/bDSqQ92CajeVrVvugFGZFHmbXqFQ5Gj7PMRBaQRmcsVD946d3O R0UMQrxtR5wbpAS0gqirk7QocPDtykVi4utOkCE2Mowzj0dxTmQBybS40BWBQfpgJ1pD+yiwONhH ul3BpxQWV8JaET/lpNcqErTI2jV5/w4Quartko6/yIFvhDmUSlj19WJR0WrIs9Rkt1o0VLB62JAg 2B8W2hOdbDBMcHVBMoxUO942t4eb4OKpVl2QImC2FZZWYyyomcEPXjc7elQhxgeZEMHE7ZL21du1 myVqsHOYFxg0IoQQP9R4er0W8iOJ0OJuW0PC9sWtPlqhNFnW46gjZrcZT8eoQj1F2nDlcnBh2jBg GIFJYg+RX1fdeXmdzkxmNJjEUOZlNtcRktSwr9ryPt2QEqDIwKYgw+L0alDBT0kVTWaC+7vfpcxG iwUyb6nHv7bLGw+HMtM2b/u0WFGjQAFy+YBfSELlBqZ9HFOLjvIoSwiGTzyIi6RdsX2dUBobL8k3 UQ6oNSCLqio7yVdgqNDUiMaKlg/YaOC3GrBP0EdCg1UqDlaCjpp6HIhwFE/QnimevXtJPRAcFYdn I/B4CGzb8VQ9ohGoqjDSYiqVG2hbfrhYtTnpXzhNHrYQUpQiA99cs8L7UTsGUoJTWyjaxIckVsBP 5nfYqWMx8P1UCDAGtKyFoJi1AkMF5whVJg3F1OzH+XkIlNWO+Af4lAVFpvQ7lyQYes/BweCcNiju XmDn7b5AIMSHrK3AQcfzR6/0yyzr1g5qRGTierT3BU5CX0Cdo+jxORtSUwMfQgNjKobiG1uq/x93 VX98df7ffOP/z4XQrKyQQe24MASGuL9bQst6ZDlvWoAz5SIRTf2zMAAzYFIR92qkqpWFVcLeC6BY 66kyjHh93532mfldIDxpvxi4FgrAi/77EwLqgQF0acSOBLAV8a6FN5BSaD+kYdJxBKkRtPqtHbjH aSbuRjUBABkfGwgtMgLO9/XsMUgo8VLxfQ2xLsiXIl4M7+PUw4xxC6j35rMYn/vzvXQraoK5XB2J IR1JUvRSBdxwtQlzTKI6rx2XEnFDCCYk1YaE0WPYT4EkN3y5LF4Hc3NX7xHEu1jv65EuU3vTOsvj Sn0HTeTqAfqo4zddR4d8ax4PAUYh7aDfO+4AsaI2DMoEC2vdhnAh4wZwW1xSK5DRMYpf1lAnaj4z 67+PmjBCL0YxHCijtusiwhmKxxvKgejzBHVzOXwnqgFwWSh7BgXnqJrRWVvdfaH2jbkkUMUvHKRw Sy6SKUXs5lIcYGSS5vdJ/Wm0o32G5ub32H4fmv91cJtcAuFFnB7c53MFAQ1krG5O27m1fgXi9AKx kYdSZ9BqeTs12LjXisZNI68Qs0AIvJyLyoSgwm9tYI7JhC3KEhgHtbPByXwYDByIsJfbswVc6+wW CYOivdQS9ApjlSu1GFbxUv4IuJs17iniVpS4vQ2QT4QGCU6ENfxsgDkMTrlUMQb0aSwdGaNWA1YU AvubvVxkHJUGqOOAQt7kDk5c7RJAq01UA7qfq09yMLhGNDN1NZP29PuldqeteWPVdjJWMlydNJQ0 FpVh/UhezJjISBvjOjekNj/h10kPyWOsH6uHGMaisgQNAeELYQ77Y3XebjIAoqNA2BsEEIFicXXc B99vmOVV1TNIF3ZBUuaKsjlSAVtNY+0s4pyRgQSyjXEE32iaDglFirYbFHbx/RdLAkuetpg0fiYG dCRrq+0rhdNQce0oXnBwgG5ginN5h5zmJhIduV+TEyZqI6ohEQ5Wh2EddcQKLk0t3ZKQ3QDOEjX1 Vv3FgUBZpjNRI1MJB60dUP6wok6ZHJgT+Yvqw4lR+ls722h9fF7QDmel0iNqg4zUDFjsxji6OggH l41fUwdVR0ZC6aQGJIp+EiIDc0ZVNrVEESpk/2Itr3aRieVQMxoTUkSXMm/uuY/8zAlFofPhgixE ltqB1xBShJJ6azqigp5JF62PHmf28qP5deR4xYHyx9SOydJsQy2UygLwxhGokbMl83LD6peFYfSG BYBRMKM2Vq7aeqEcC4Ids3TV6H6ZTuBwFPgJmJlvQHxisuCC8bbb9/DaVB0Zrtbukc5ewQJqjjow t7HWE2hEENi9KKqqTRrZ0hVxZUJF7Pc6W0Lr6Him2nZZh1/iOwGjVXSBkWBGn6QkSwGZpO4/yhY0 0XYNCffGCiSkDMChgs8A+yqGHRxSg9/OTk7aBi80BIdGXiL+qHDmiuNbG76ksMhOLR+ufhMaGVQs KsoOuESzsZpm4+33+23etBPGL92UpcDCBWU3mNzVtUcbbb1AWeaedbwGB77RqEO9bjjYRaEXF21S VQxmzBKoc9uwDWt4DiIO2QCJgAng/y6gLZndN+UYcBJN5zDII+BK4hL3bzgOcsKrWYnuy20NbCXY RrCKtoPgLTweinn7VXVDzBO5qfM8YzgSGsOoYyZFB6LgBKCIdDdDbWBzQPLwPDf8XNQZTSA3L/SJ zZj8UA3esZf7CLODbdPB3D8roqr9Udm3pZ0M+MNQj8MbzN4wFxcnvJyaq0wy6+Rjxv9g8KunsifW FA/BmIz4Q4TzpIOgzV1nNxEtpWG3prQzAyzDeeqEPMLzok1b40YHiY+kx6NXQsi15Wcg6aWhg5yI 4FGOfCx1wlC1SiM64lyLjpBpgzm8bT7tg8TedCIRmFrvVCDABIri+JZ6+OqdtBhuQrlrR+dYd4h7 yLcEHSTd6GhVPUU6dIIdc32W6JB5KhBQChiVcNkrUXTW0ntoIBD46+5YF/jBqlPOSAbgAT4qmExy biIQKSivwwUZ/wSzUCtXA4euhU4VUCaWKTjA4mR1sK8xsL2eqhusynk9owPwogPTQWZ1vGPQCcDd IU7eFhg6NYOmKur5o7goq463YDhXx1gM/MIaa8fXIxp0/C9REs9HRX6rNwThJWEAljiJ7xw0Cp00 xG1TPwfFAHLpKQl/dI6YcL8tacPiwHEnJ4zPq8/4OrxendSGhXHEEMEAmHudF8bQaopKMfgPfTl0 Bkgf2TqdnpG+Jplzs863JTFjWAcI6w6ppJ0SxHyGjHVqGL4qwiF4DZgD2YAGzF0lsOgwon/1oAjI fjC2nRxXUzg40jKMoX8sIicHpP5Xwt+9k3VeUT1oAcHgVoePMRSNFGZ6W1GA3/S47L11GnRfaYqE xmG5UtKR8gdlVGsj/4GloazLDAj6YbaxemTdODqkuxMG0M0MFqu2SIwTtWfqBRAJrwUyzopVrl6H jRpRIEKv8wE2wKWrHgTJAPsEtfNo0/hFAC3ADd6esVEb2lssgzlSYHCgR4Uj+6oIXk6vMo5oBiji 8XGQxLWqr6oqyaYjZxVRON5OiLW+0HpDMafgxI2FSIOSeppGbSkdgQw6NlGhbAxreMeaO9WMpNGZ 0QAJAcctHnUVECpqEIfLaMT8XQeug69wUQvomoa9cGkfpRy0HgSo2gdeRY3apOkOomIKNkoI4Djq j4mLQH6IMenmOg+FRHRfm1YXkiTN/nZHC1WDBtisLtLLr0Taa/9rCWYBA234LrUukVZd54x76L7q yaG+Gf+R1D0oCqAJB6LKRyVoPxysQanOgXyJ0seGzZIgSO9MDzGjng0loxNuL46eGh1oOu1yIowB pV58IwA2H4ztuhjeojhcifs2ryOIhqeaLOEcOquBqx3ECqbhR+BMzWhHKf6zVmaE2rHWUUuSCWDG HWXtCZMDSU0BHX+N8EBWGwpNzdB6DFldWk2qFykdMgs80UEFPV4RElS6VnALo1d03EQa0MAc9Ymp RcJraHxyBeGIEGZygQVbr5BAjl+XwWkd3mkcTd7rMFrLVZ6yaN80KuSAdWuJggb+NCOdVLMpYmJA SKikkqZEdDbD5DtAiKhUnV+7EcA1LItsaBfd7N/h9AZxdHinvTsl9RPPtNvMReU+agY/jhQbRB8h 7SW1PseQgYC/QcYI4arJJ6+UcZADR5CRdlHaDv9AxWR1RcVi0XMPUl590KTm45MAY/WlE8Y1Te0J o5W0CbVsoF7xjy0Z1oWrl/IFaTDeB9ISiPRGQ3VM1vo+VMQ6Bgz3BelRcU5OJQ17khIVgoZBXQ1j /vgp4jJMx60PAg0FopFXHSSHvX/BUfcTkJazovrrADeVeXwt1BdXguOTpChFKoG+u55+MnRgkmMr rIK5ObAAynVZaBKRUbfzJrKOL0qRv8znzWYPqQ+qAk5d2u7FVq2rJ1h0ejXorNzU0SOdxUchfNr2 k4T34zW3oZyQ/3U379/9dDdEiNSIHnlBA189VVR1RgM8itPrgRLteQ30DTaEbNE5Edwe0TAdTAe+ HrqC76yfd6QsBMfoyHc+CBSqs7LUISAD9pT3bu1PuLAAhKLTVwlUOq69XUDyyriYWlIr6qDYVOcB 8CezqqaFatDO7tQzEg2hijCLIyxLrFXW6VY1NKtcjI7HnWY68IPa1uPDUYVXtUcjh4cy0qnTI+Ir /etRC1Dp+0Cn037hMZ3HBWh6fudXoQ2DjZAgEABGtqFetSGQZPt1bkb9IeEaK7tX0IFFlL8ekEG/ qpmvapOOkAJfcELSqalS9QSOdm6pTuqaCUfspajcK+6EHVGfdR7yneE22SB8xL8yqGJeH5PgpNsn hYoO0vDm9jmAMtunb4Oiso8XyThe7S/r5HlSH2ZVrPJRSwQxKfV+f7qX7pTePljXoYwE1zqv1rYe 22lBp+fOmDGKei7CVU/qaIOx+dfVwG1or1znqV+3cSMATMdaqEamtq72unb13evgWJL1U/97+Pf4 VxVibz0uhmYkJUERzAq6O8hg6/kHaGLrFKueWwHM/e46fagng8DrY6anGfaV4FDL8zA+dC6qwN+q xpT8MchedXwKh39c0JNoF87ziMrxtcJ/WV/yoSFu4LQGsthmHjAy6by1PYfW06FrH7MjrlsgtbxB uLpQ1YXa94Xi8xAe5sWLBsKuh7tC8Tr7dpCNkJ2O/Ban58Z+D3R+GdF+itJVH4zqgEYoJ27WdTRC J4sA5ekgXC9/iO3QU9wqzS6JjKFHFCDRCxoFhAgvcXw0dZd0EpbYlxqwhjrjMrHrkyqbpdg7mzY1 h+/xa1PqGNZFzxOyKKbVxfLrUbKLdiHZHy7BVEkPntSHuwnB8g0QQ8ckGqrkarfyqeyLtAJNsMNa XD2F0CAK7VagxKEj70LQI5RepwcwzGLtGrInq/bRc80jk/aoBPQs5I7OCP6CmTfFrtPwwDmSTeN0 fx7oH8fZPuP8HA75daSSfnok1mIEzScJl7yIcckVYt/6x6v9SIsf+RXV+s/Wi/inJu+yTvvoZKwO MGRI8Wh3HJcHStX/cYFr1OltnVsPlLjTg+AYvPQNEXt9rfBn1GGzolx+NsGDrqPNdj1yMdfrISRI XgF3wi0ddQnv2EGbOYK0oANiE7/3+R8ElKwjOkYt6fzJ1rFFCAiunF0n8UH105x6u/2ds6CueC8a ZWLowSdqyy/R6aDGk/oeOvgdYNzp/5L48QOFTl2ydzud290hYIn1UDbqdH5qoiblpU72j6ND5qHg S1Fs1D1LGEkhYgOLpLXD3GCQThoWSBHmRymqlaltPcjToi549PRbVAcpyhz0jiGfgUigglie5CKU ixIbb1cQw6fI7qXnPYcUNCUStU/lwxZSEr4aV44WMWnLrg5FA8iIdxfWMp20g5HnV3+PNfru7wVp GSbX1HUrUpZVR9JT1qF9eHRR2k197eFsjIYi9NrllvhHNlxtwUG5V8dZcfWsfHzNvoSEfE8x1iZn hvOyZ9DWTlf7/QxnUjMIh4iIZL5JZ1dJEGgCOga3buO1Tm1VPYnbSSevTTu15hIXJufV0QLS9Thx gVWv/tcEEF97nRLtRkxZS/8auuTMfhpCF23Ub1ZTOWtnlDjqqOd7qIvKQ4aOT6niuD+F8Kb5Cpzw 4z4/Wxlo3vg6pNpyYbV0cMnFsHgbUqYundrX8TcdhD9BnZC3Al/X/1z9c23/dfWmq+M8qCLtZcNw aBltgOgJwaRBH1YTL+vzeyQiqxdWt9ScpZOzMr8h8VLX/75BveU+HHX1lqEhCFG4lpCG2p0ZMLE0 vp7mJXVhx04IR2N9vY6XHD07YnpuRKSxigNXq8zX2xH+vmrQFnkXk34vw4hSNDuCpkl2IOg5Gj1l gfE8A3PiekNB6Fk+VgJHTnVsMbSaFd+XlXq1PpYdibF1SalsH/qa5VOy+SLYS9HxFfWlNtUBs+p8 BUyCDvRBZk9tMSipvP8XRg7azQhJj1kyzLNg213PdTCeTlJTE72mlMZ77GzrkRXBjXb71ipd55a2 Glx6diuj9H1epWHCxJuqvUr4jzr1yKKES1xYftMeI4HzehSydmEette/p41SVtWwGClRy9pe1lnz BMAyIrTJ0mGLIypX6Lok8ce4EDxdtr3LAgXaTBp64Kd1oq4d/2PKkFrRR11PAp7wykec4aGTqFVO 611svYfQ9NTppzxIO6FMHDJk/bwD8Se497gOfF3L0YYBWBBkipUwOuZetBuvDa5P1akzrII4uF21 OLWptgZO6TidysQmyAlcM+0X6lQQmhEIkGBtepZ963jC1tEZkinO9lkJPTvyulkarvtYAkYshwUp H4nHV0B6qF3PFyQ9w9yE0jonpHOJeuzWH6G8nod4hd0cNbY//SPUivS52PKsqh/DhTZQhbdKLSMr 9RzK0D4j2ZIMnNl6eNSTqdXpiT+CgEfpLHuTavpEuuAFlKY6Y+kTSLBAfjSf9uY/R7DexlQNldie 5ChkcdeM7+i72nY23H8DuWZ05wi91FUAAAGEaUNDUElDQyBwcm9maWxlAAB4nH2RPUjDQBzFX1O1 IhUHC4o4ZKhOFqSKOGoVilAh1AqtOphc+iE0aUhSXBwF14KDH4tVBxdnXR1cBUHwA8TRyUnRRUr8 X1JoEePBcT/e3XvcvQOEeplpVsc4oOm2mU4mxGxuRQy9ogsDiCCEuMwsY1aSUvAdX/cI8PUuxrP8 z/05etW8xYCASDzDDNMmXiee2rQNzvvEEVaSVeJz4jGTLkj8yHXF4zfORZcFnhkxM+k54gixWGxj pY1ZydSIJ4mjqqZTvpD1WOW8xVkrV1nznvyF4by+vMR1msNIYgGLkCBCQRUbKMNGjFadFAtp2k/4 +Idcv0QuhVwbYOSYRwUaZNcP/ge/u7UKE3EvKZwAOl8c52MECO0CjZrjfB87TuMECD4DV3rLX6kD 05+k11pa9Ajo2wYurluasgdc7gCDT4Zsyq4UpCkUCsD7GX1TDui/BXpWvd6a+zh9ADLUVeoGODgE RouUvebz7u723v490+zvB3gHcqkloKXxAAAN/WlUWHRYTUw6Y29tLmFkb2JlLnhtcAAAAAAAPD94 cGFja2V0IGJlZ2luPSLvu78iIGlkPSJXNU0wTXBDZWhpSHpyZVN6TlRjemtjOWQiPz4KPHg6eG1w bWV0YSB4bWxuczp4PSJhZG9iZTpuczptZXRhLyIgeDp4bXB0az0iWE1QIENvcmUgNC40LjAtRXhp djIiPgogPHJkZjpSREYgeG1sbnM6cmRmPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5LzAyLzIyLXJk Zi1zeW50YXgtbnMjIj4KICA8cmRmOkRlc2NyaXB0aW9uIHJkZjphYm91dD0iIgogICAgeG1sbnM6 eG1wTU09Imh0dHA6Ly9ucy5hZG9iZS5jb20veGFwLzEuMC9tbS8iCiAgICB4bWxuczpzdEV2dD0i aHR0cDovL25zLmFkb2JlLmNvbS94YXAvMS4wL3NUeXBlL1Jlc291cmNlRXZlbnQjIgogICAgeG1s bnM6ZGM9Imh0dHA6Ly9wdXJsLm9yZy9kYy9lbGVtZW50cy8xLjEvIgogICAgeG1sbnM6R0lNUD0i aHR0cDovL3d3dy5naW1wLm9yZy94bXAvIgogICAgeG1sbnM6dGlmZj0iaHR0cDovL25zLmFkb2Jl LmNvbS90aWZmLzEuMC8iCiAgICB4bWxuczp4bXA9Imh0dHA6Ly9ucy5hZG9iZS5jb20veGFwLzEu MC8iCiAgIHhtcE1NOkRvY3VtZW50SUQ9ImdpbXA6ZG9jaWQ6Z2ltcDo5NmE3ZjI0MS1lMjNjLTRi MWEtOTdjZS1kNmU2NjliOTk4ZTIiCiAgIHhtcE1NOkluc3RhbmNlSUQ9InhtcC5paWQ6MGNlZmJj NjYtNjFiMy00ZDZkLWExYzgtMTg5M2QwNWFjOTg5IgogICB4bXBNTTpPcmlnaW5hbERvY3VtZW50 SUQ9InhtcC5kaWQ6NDIyZDdlNTItOGE2Ny00NmExLWI5MjYtNTJiOGEzMGIxOGIwIgogICBkYzpG b3JtYXQ9ImltYWdlL3BuZyIKICAgR0lNUDpBUEk9IjIuMCIKICAgR0lNUDpQbGF0Zm9ybT0iTGlu dXgiCiAgIEdJTVA6VGltZVN0YW1wPSIxNjU2MDE0ODk0NDU0Mjg5IgogICBHSU1QOlZlcnNpb249 IjIuMTAuMzAiCiAgIHRpZmY6T3JpZW50YXRpb249IjEiCiAgIHhtcDpDcmVhdG9yVG9vbD0iR0lN UCAyLjEwIj4KICAgPHhtcE1NOkhpc3Rvcnk+CiAgICA8cmRmOlNlcT4KICAgICA8cmRmOmxpCiAg ICAgIHN0RXZ0OmFjdGlvbj0ic2F2ZWQiCiAgICAgIHN0RXZ0OmNoYW5nZWQ9Ii8iCiAgICAgIHN0 RXZ0Omluc3RhbmNlSUQ9InhtcC5paWQ6YTY0MGI4MmMtMDg0My00MjYwLTk3NmMtYTg1ZjA3MDc5 ZjcwIgogICAgICBzdEV2dDpzb2Z0d2FyZUFnZW50PSJHaW1wIDIuMTAgKExpbnV4KSIKICAgICAg c3RFdnQ6d2hlbj0iMjAyMi0wNC0yOVQxMzoyMzo1NCswMjowMCIvPgogICAgIDxyZGY6bGkKICAg ICAgc3RFdnQ6YWN0aW9uPSJzYXZlZCIKICAgICAgc3RFdnQ6Y2hhbmdlZD0iLyIKICAgICAgc3RF dnQ6aW5zdGFuY2VJRD0ieG1wLmlpZDozYTUyMDNkNS04NGRiLTQzNDMtOWZhYy03NjFmZDZmZmFh YjgiCiAgICAgIHN0RXZ0OnNvZnR3YXJlQWdlbnQ9IkdpbXAgMi4xMCAoTGludXgpIgogICAgICBz dEV2dDp3aGVuPSIyMDIyLTA2LTIzVDIyOjA4OjE0KzAyOjAwIi8+CiAgICA8L3JkZjpTZXE+CiAg IDwveG1wTU06SGlzdG9yeT4KICA8L3JkZjpEZXNjcmlwdGlvbj4KIDwvcmRmOlJERj4KPC94Onht cG1ldGE+CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAKICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIAogICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIAog ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgCiAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAKICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgIAogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAKICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIAogICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIAogICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgCiAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgIAogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAKICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIAogICAgICAgICAgICAgICAgICAgICAgICAg ICAKPD94cGFja2V0IGVuZD0idyI/PlmiVpAAAAAGYktHRADwAKIAftw2PhcAAAAJcEhZcwAALiMA AC4jAXilP3YAAAAHdElNRQfmBhcUCA56CWQaAAAgAElEQVR42ux9Z5gkV3X2e+6tqk4Td3d2epN2 tUlhJRSQQEKABpFE/ggm2SAMxmBbtjA2/uwPJ2wwGNs8BBuDbTAyOdnYGIEtECMhhISQYIXianOc 2Z3diR2r7j3fj3sqdO/M7Ehik9TneXq3p7u6uvrWe8894T3nEjrymOWnT79UFdaUledrUoFPBADW AgzYRoio3rTR2CQfuW/UPuPgdu6M2GMX6gzBI5MvAuqiN7+8N9/f1Uta94C5xzbCZQCWE/MSUqoL zAFZVrAccWRqNoomOTIj1vIBT6uDNjTTptqYmtkxOnHR5ntqnVHtAPe4yAcA9aprX3O231N6ktJ6 E0AbCLyWmc8gYFApBTADlsHWAswgZsAwYC3YMmAsODKwYVSHtXs4srvYmK22GT1ga817p3cdvOei n9871hntDnAfs4x95DeWB+XBl0S18MW1feMbibEUhD4AgAXADGYGCVhhOXkNNn7YBMDuISCOH5Fp IjKH2JgDpt78cWOy+vWoEd1y/o/ujDp3oAPcBcn0z79O/uKlJZ6aXG12bX0bwuYvAeiv7DgYmJka gWXAmMEWABxQs6CNwcqMFKjt/xsHYjY2AbH73xgY2zC18CFTb36Cm9G3olrz0Dk/vqvZuTsd4M4q tT3f61G54tNA9FoeP/wqs3NLCcagfmgS9f3jIM4CFSBmB073T6phGQDbDHjbtW1sPlhQon3NUSBG ZGEb4RbbjK63jehbY7f85L7LEHa0cAe4Tr4P0OUjt7xA5XK/CqWv4kp1UfTQPUCjhqjWRGXHKLhp kNW2DsDynMkBVQCdALXNdKDY/s2YDWwtyLADa6yBI3kexQA2sI3oAW5G/9mcqn7irLt+uqsD2ycw cOt7vqOY9BqVL/wx+cGLoPQAIkPhQ/eCx8cAZtT2HUHzyLSAVAZMNC/Hmje2d5E1F6zYuQCxPE+c tVbTIQYtotgeNmDDgDUpkCMLhKZpm9HOqFr/a2v4c9GRmfDcrQ89YUNr+gkJ2t3f7qEg9xKVy3+a fP/ZINUFIjIj+2EO7AGshak00Dg04bReLC3gjac9y1NuUwecqoW246ntfOCMCiH3lI5WK5qIFmtP X03Aucr3HvytpUsP//3IKHeA+0QA7Y5vbaRC/t0IgveS5y0FiKAItlJFtO0hoFEDW0ZjbApmun70 CZgyiJsNgTHwSMwKyiA9A0aOj6UW0B6FYzpqUfSUUptI0ZUKmH7TpHrgk80p0zEVHqdSve/LSnV1 PY3y+Q/C858KpRVIAUoDDITbt8Ls3ApSCrYRorL9oFu6E13q7AViyuCWW7VwxmEjMR1iBy0xGVqi D3GEIXXYkHHYkvdixy1yNm9sPnAzGjfN8PP1w5U/O3fLA0c6wD3JwibSbK0GW5+NLbCNjA2bDQ6b hqPQchRZNpEtrjlrQctk9YEv+6pQeBHlCx8nzyuz0gTScMBVsJUaGrffArIWpBTqByfRHJvODBCJ kkyXf7KZEUwiDXL9MTiRcdjaw2aZBEUK3NjObQ2XJeCNDDhiUGQcsCMLNE1omtE3o0b4e8pXu9bd cfcTwnTwTrULMmFjEVuzni0vh4lK1kTEJiKOIsCaBlszzdZMsAkPTz949xSHYQXM1Z4nXTbrclm9 9/NFlcu9SeVzH4BW3dmVGaI8w507wI0moBWstQgnKslSziCQ876S5Z8TwLZaDUycrPMxnlODFanZ EL+usrpDOa1MBCiV2gwxyBWBtQLYgKHSL2b4CniF76mSZf59APd2NO4Jlqg6vQTAZTCmLwYsoojY RMaayMJEPhujOQVzncNwkk1z3IbRITbRyOJnvHAyNQ8+X9CFwrWUy70bnt8LJaYBacTPbb2J6i03 A40aSGuYWhO1fUdafKv5BooZIMqALLZtmVvBl9W0nIn5xq+bWTSvbYvtGuPeiyMNJmM6GAbl9O3N 6fp163545487wD1B0jh4gMjXl7C1Z7GJFKLIMts9BGxja2esiRgmUjYMCxw2+zkKl9owLLOJijAR WRMZNlEdUTRmw+jhXF80mh/w30aF4l+S9rqgtQNt/CD3f3PvftTvuhPEBqQ1wqkqmmMzqe161GAd 7Zy1BA1sm/0bZ9CQPncWRzZpkUkNcxa8DDbGxXqtgDR+L5S/TQpgHXgMojubk9W3nXnrnT/rmAon xK5tehzaIluj2Rpma7eTUncWVp8Vth06PrX5tgNs7QMwkeJmY4BNuMZG0UpEUcma6EzYaD1pfR4F /luIkBPPqQ1qTqWaI0fAjRBQnNqnQkkEEZjIEWbiMxBnIJzGcuNvOEr7QlQy24y1EM+KTMRBUaqB KY6JMUgpMDsnEZ4CIoBgwR5l7Q2AGTay5HcFTwl68h/ceeVT3r7m5h9v7wD3OItt1tlGIWCMYhM1 2PK+nk2XhLMd23PB0xJdBuAAgAOj//VZn61ZbqNwdXFQvTS3uPBGIsq1hKJa9KN7bmZmwGEIaAcA HXiIFDkPPrED2j5Oqf3bEpeNTYckOpaJAVNGUyukSQvKfI2iVr3ODsCkyH0LE6Al2MYK7AGAkRMy 2DAsA7rgP5eZ37v1souuXX/7T490gHscpbj6rGjq53dU2BogipS19hF5x4MvfUMIYFf17n9eqoq5 FytPdR29zvNRhhKDYKMISkLa5Cn4/UUXVbAupcs0Wyx3lvPNYnsxZ4E9WzzXARNWJgQh0bgOsCxu oYA30bAWBAX24vnrZoM1FirnQxf81+RQOnQj8M7nOnQ/rkSdUhGFWvWgqVUiU6/6tl7pfcSx2js/ PkC++jPy6KzUPIhVIKcevizDYED39jizMjJgE4EjA5UPECzpBnn66Ngrs3ATRCPDgpH+zVnGWBwB ludHWcYUTx52c4FE9SqAldPApMhpYqXccy1/a3ccKeVWC3m4cxEo5yld8N941vOe9pbHo8Y9pYDL YWO/rVWnTK0amGqlPPrNzwcL/ez4v/+5B/BvkadelLC42jJaRyk+ZgTLlwF+DhxGCXhhDXQxQH55 H4LFJaiCB/KUA1qW6WWt8HIFfAkrjJNH1gim9vgZ0tBZelnueCKn6V14jEQLKwE2pWBVAGnKAFdW CN+DCrw+rxhct+s5l118/8aN1AHucZJFV1wd2Ub9XlurwNSqK2zYGFjoZ/0l3c9Xvn6HI7s4NDHz LIt5JjEAhtffi/yTNsGGkQNvaMCRAUcRQIygv4TCikXIr+hHfkU/gmX9CAZ64C8qwesrQHcF8IoB dM6HCjyQryWRHpNonOfPcTQgq30zThqJicCKkjgxqRSryGpgUqlJodwBDrwO1GzZTTRfQ+W8c3Uh +N2uM5eUOjbu8XTSarVdNmruYWPWsok27f3sRw6ufMN14Xyfmfzvv1iuct4fgdADy26pzWhVZLQf tdu7xCiesxGILGp33gmERixG9zkLgDwNnfOAonJLM1HCMcjGGBJeQRLGlZBW5GxPjgw4NOBGCNuM YKoNl/iw6bUloeBsAE4ULospQYpdEoKNHJwlO5D7Lq3Er2RoBK82kfnOtisv+cK6m3/CHeAeBym/ /E3R3s999CdsomUcmY0cRTsBbJnr+MOffZf2unJvIOJLnBtunbPCFiS2KLNuATC1k2ICH8WLNsFb sgi1n26GnZ4Em2YmicCwrKEYYM/ZlaQAaOXASgJaUuJXCdJiGyFW8vH5LCdEdI4MTK0JU2nAzFQR zdQltSuJB2KXvYudNY41NLtMGqwYxNYBWJGjRSoCPC+2PAK/K/eeqBF+F8BoB7jHS+vWa4c5Mvew NU+xxlyx7UPvPrLune+btZDQX1TaCMIbAeQSMncc0FcshYtWNJQAxrLEbV1CF2CQVsiduQrByuUI Rw8hGhmFnZ4G12tAWAfCJtiGQDNyqWGtQUwg0oCWeC9ZsCzj1OIJphExzsRsiQHyPZCn4ZXywJIe sImBXIep1GBrTZhq08WaORMyY7lyFcfW4siDcpPVMpSvwYEnsQhenesr/h6AP3g8APeUNdh3fPQ9 RRs1n8/GnAFjdrAx393w7g9VW0yEb/yxTznv3bpU+DOVCwDfB3nuAc8HPA+kPEDLQ2lAe+CWtK9y z4lApNyQKPc/hyG4EYKbTQhXQlKwkctagUHW2cQEYX+5WDQoioCoCYQNcLPuPgvKmDApo6w98ZFl idlmCFMPHZCnazCTVXBkMsWYklXLknUiC10K4PcUHYssioBmBNsItzanar+0+pu3/qwD3OMoD3/g XQNszP+BMUU25ic2Mnec875/TOquxr/yByu9ntLdqpgfoMAD+YGA1nP/ax+kNaB9uJSvgFd5gFIO wEqlXpBSmWVeZZIPqjUR0ZIZQyvN0XJS/ZDSFg240QDqVXB1GlyZBlcmgXpVQmwSTrOcOHDcUuLj +Ak2isDNCNFkBeGRGdh6U0p9suAFYCzIU8gN9gChTZxNbhhj6s0PTNy7/z2bfn5/2AHucZSH/vTa jWzM89gazZG5ka19YNPf/SsDwOTX//B9urv4R5TziQK/ReOS5wlgZ9G6ygMrBVKO2ug0MBBTHSle jikT8CeAWbUl0lqdojTjlbFrM5oxKWM3wjlo1MEzU+DpCfDMBNCog8M6OGwCRiaAkfhwzMmNARoa hNM1B+BqA7YRyXnTmrf8qkXuPKERu9nA1sKfR9Xmq1Z99aYtHRv3eCYlKpWtUKqPjbkCxj7LGtME sPXwP//mMqXptWBLR3NdnZYisgBZMImjJsTw2CYErLMZrQWRcl67smCbAShJViqpfKC20FqWdBOH stLXKE4oAGAoB17tJgrl84CfA/UtdsCqVYDqDOzMJLgyBcxMgK2rTI/TvkkGzdPwe4vwSjmYSgPR VBXRZBW21kiiDCyZwGxZkcrx+RSZK3a87BnbzvzPH5y2GbVTvnTnH370M/7NS590iKOwyCZayZFZ /mtnrR9dvGnJy1TOfwV52leeLPOkkqWf4r/lQXFgNKMhCRLgByVJqzRcRq00B8qEuxJiubx+lPZF i2kRg7m9Lo3bExGeD8oXobp6QaV+UM8iUL4AGGcvE7ddV3zNnoZXyMEr5qACDxxGYGuhSzmoQCe8 oCTRYblP+frLH7pnW9gB7nGUj9+x2fzGxecesM1oKYxZpjXO6FrV/Xqd99c7G1biq0olYak4ch+H qwAl2ah2AGa8/hhaTKm2nM26mqWSkaid7hh/dyuYqf08NJsmJ5DWYD8AFbug+5aAuvqE+hhJ6CtT jZEkLBR0zoPXlQdpBXgaKtCZ0qPkWlc2p6r/+eH7dx7oAPc4yz/+5L7oN87fuIejqKzz6ik67w35 3UFR5XxQFrixxo0B2wJeJGGjJKqfZNFUGxYpA+A58EuUwSQfrXUFnDQLIz3W+URHfwFTWyElKVCQ g+pdBOruA5QHshZswgT0JMmU2KzQ+QC6qwjl+RLL5qzWJQDVD/1s6/90gHsC5BObH2q+/bz1I7m+ 4GkEfpYJDfndOajAl4ySSp0rSvP7FCcDkvwpzfL/LG5rsiRTK7E8k5WjozTzLDbwUeDN2MDyeUos ZEoATekMSTW254FK3VClXqhc0dn1Yf1oCgQBKshBFQsg7WK5HEWp4if0vW5L/dP/1JiMOsA9AfIX b7lC5RcVXmItPzmsNhHVQ/jdeSjfazUXlErDWImNmzUP6JEHVtiRZx3uCG053xatfrSKbbOFidqO EB1MbYVqbXZ3ch6tnT1c6gEK3UDYAKIo07OBQYEPFQRuRfI8kOc57oS1IEU6WNXzgw/fs/207Izj nXYXnNNd5HuXeqUcZkam0RyvYGr7QfSsL8Pv1s4OJAkjkcRBYR14LYNhj4Zqu8mb7dihtDtPrAI5 Trva1AyJqxYSnZkloGcKexTJNcQvKYl6xH4jAVaBlAWzAhQjtYA55T+wc7gckTwPpT1QsRt2/BB4 bASoVR2NR2vAc+X35DOU2M5mega2Wiv6/T1PN8w/auzewsrzTX7FWu4A9zgJG7uYPD7Xy2t0repF Zf8UGocmMcWM7vXL4fd7SdM5F+aKg/tGaCyUhMISZRnnYpXYiUoSCETp/6QkR6tS+1ecvZTdZVu1 aYsTlzEbIARxJba1UCIpS9Zjm8SQKWPJZvluBBbwimmwuAyUemCOHALGD4GUA2pMu4yvxOvuhvG8 HFTXUOWhzbfrXK5mrZ2sHdg1rTx/mrQ3HSxaajrA/QXJyJ++kmy1cb7KeQEsw8/76DqjHzN7J9A4 NAUbWXSftRK5xb2upFy0LZEFWwLYIOvXJ0kCBZCSrBepjEWhWioSQKJR4wSFOhrAiPmwMZOrxXrg pM6MbOoTAgAsuetwvLS2OHEavyXWLcVChEjAy04L5wvQS5eDu3qByjQQ1Y6uygBDI09EXtkcPniW GlxWBxETUZ1J1UipSnPy8GGl/f1Q6pBX7LId4D6WZMRMhWDNxV5vIUmRenkf3WuWYGr7ITSPTGPy vl3oPXcNckt6QUYIKCZmTikwmTT5QNwKYEmUOWXHDszK1X7F3j8RA5bSpEQM7qTVAWcAzWn4jdEa KFZZ8Aq0bEpddCnoWfxFHWvgNJjrXvdSzjoDVCwBQQnUqMPOjIG4hpTX7swOCuu56P6fPOQtecFe gAYYWAqgZIEuApYyaKNSQcU0ajtIeztJ6xqRsh3gPkKhyBDXG5tsvQnKec4UsAwv56F34zJMbT2I xuFpTPxsG3rOX4vC4CLJiMXsKSN+i3GVtko7jaycxkvWZPk74RwoSstqSIl2zfQHI5VoXmTrx5iO tpvjyshY8yYJihjAbrJRsrirWYMdaVxCZ173Ms9ZEjAeSPvgyjioNikmkgb5AFvbT4e2e91nXbQF wJbK9vsVrOmDCcsglC3QA3AvcXARSJ1FpLYx824AE0TEHeAuUKofvRHF33nuRlttQHcX0nZFiqE9 B97pXR6qe49g4qdbYM45E12ry0k4LE6Zoi3k77DHwlXgFFxKA2SkYLLdUROerEo5sQzleoslwITU oVHatSaxh9MHIcMFV7H1qqSDjqSiMwBuddg4S6dw3GMwCB7IKHFGA6BrMeDlgMo4UJ8Rh832kfUW xectrT3XAjgC4Eh9ZPeDMKafQWUAZwC82ILPI/JXEaktzLydiE5aKE2d6mCtj+wmU68pZu454/Ch jWxoma00HLWPWUpiXIBdeRo9Z5ZRWj0A2wgxde82TG7ZA9NoCgHFpMebTG9aeR3WZB629WEMEEUJ QSb5XKY0B2zSjjNx07qWjuUp26u9lCcFc1pjxkpJuY6W+jJKqJiucFI75yumZyr5W7KJ8IQdJ6Ew 5EugnqWgYj/geyBf++Tp/u/NEhPMl8+wuaUrDoP5frb2BxyFP+dmI+Sw2cvWXAjgHGb2Ohq3TQ7f 8i3f6+3LcxQus1FztQqC/nD8cDcA31ZqsPUmKPBBSgBnlHOstEbP2mWA1qjsHMX0vdthGyF6zl4D r5AXe9ZzlQJJVEol/RJIcRKidT27MrRHZIokk9dj8nhWEzvSOif9QFKOr1DGEo3M1JYuTmzgWJGn kQ1SGnEfBafHZdlvSWcwCNqNhfFSsyK2bQFQrH2nx4BGtGj1W1/o4Z9vmJW3ECwpM4CZcGLsHhuF oQI/Ccw+PP9cUmoMrq9FB7h7PvN3XbqrZ9A2aitto7AympnMgygkoolo/15CFDEzw0xWoUt5p1mM Y3WRNQ4QWqPnzGXQ+RymH96HmQd2IqrU0XveOgS9Pc7WZRcPTcrPFYOUdpW6BJAWABpOQ2TZzBuz A6tSmWVfpd1pSDmQsZgolh0IkwqJ1AZmUm3ZOk4dPpuaGe7w2AZWAkorZkWbzeuyFK02MWXjwl0A aSiV6+49R2kA8xJu/L4l3Dw8+qC19gyydoli9qG9VTZsjio/sE9Y4G75y+uKKpc/N6rW1kB7i0l7 PkAVADtJe7t1d+/YzA1fOIejkEEa5vAU7KJuKK0daA07+qJQGYkIpWWLofM5TN63A7U9I4iqdfRd sBGFgcWAjp0rKdmKPW4BYtJuKY7f8izghQLX6+BmE5TLg/J5cdxUxplL7WsYAbXKkH2Yjo7/zpZh E83rSnWkT69SaTwXypUlJXRKlZCGkigC0kY87u8CYFA0hYVlUIPFg7Y+sntGWX/AMoM8308Zd08g 4N71yueRLuY93du1KZqaebIu2S4QMYFnCPgZaW+LLhQrpjIdBj2Ledfbn+trYwmKwI0Q0dgk/Hzg Mk1khP1lQWQcMJRCYVEP9JPPxpHNWxEensDh2+5B30Vno7RyEPDS+C10ppkHuYJKluLHuEmH075W ogiM6MgRmIlxhwat4JWXQ/f1Sz1bHCZTqQdGkoY2nPYlUxkvjV34LO3B0BZPSIIMEus1ovFZzAat UnOA/JaohQO1zoBYIO55HuuFZf4rW+/N22ZjKVtLyu3vNkpK8xMKuHe8aEhxZFayMU+31foqMAwI h0F0P4Cfr/nNP6ke9aHIGBibcGjDg5PQfV1Aj4YiI0ATEDMljeGCUh5LLjkbE/fvQn3/IRz50WZE 561H9/rV0PmcgNJhkiV+y1IUxsSiGeNqWwJHDYSjo7DTk5msmkK0fx9UoQgKgrRwkjNxWbKpJo4N 3JYoBGUa6FFbq9NMnzIid26F1N5uy7ARuwhJkiaG16px43N52ir/2DCY3HxbzkbhJYrQBWay4P1k ov358hlPHODePnSZ5mrjEpP3LwNRD1ueAeFuAPec+8FPjc8Zx52oTHOOmIzk90Mg3D+OIJ+DVQpk LEAuO8baOltWu2Xa830sOm8tprqLmHloN6bueRjhZBW9m9Yh6OlKa9BYpYWMkgJ2HRstQBqm0UQ4 sh92ZsaxupQSLe+0oJ2cgF4y4MrgW2K/3NqNJsmypbxdjsNlSrWnupJgbxrG4zQC0RYqAynAatcz V6d8iTRtnIJc53I1v6s0r406fsf3ejiKLmRqrLVsFTGPKvDdhdVnVZ8wUYVbNp1P0Uz9WSrnXUqE AMxjIHybiHZf8Kl/nzcuSFqFkF4DiBzXwEzMIDo0Bb/cLzHPuDRHHDUYuUOA0ho9Zy6HXypgYvPD qO3ch2hyGr0XnIVieUmijuLtnYhbkw62XkNz3z7YatWV0iglpB6VEHpsZQZ60aKjQJlUWyT9wVRi w7JQL51il++nTOOR2Gywadw53RSFUs5DvKsPeTKRbBpliM0FnfkbDPJ0FRqzAvfQ/35Vkx9ssGFz kwL3WdfgabtS6q7i+vOnnlgJCLYXcZMutYhyxDwBa79JRHsu+Y/vHnPJMX1do/rIhE2864jBHCHc NwZVykP36gSsTrM4jetuvnFaUGkUBxfBu/xJGN/8MMIjUzh822aE561H95krHbdXmoiwZUdUIYat 1dDYsxdcr2dirKKNlYDRWlfNa0wCPBaqolvaM8mNtgyaOy4u1HTZvcQkQIZUzi29+49uGKk0iL2M 2REbHpyGzrImSRhNHL73wURh7PviPyjy/EAFuaUcRReBaEDmzIxi3AOih7ufdPlJL/k5ocAdPnNj F4f2AlguANrA8j0M7HnK8B0LspOoUpuC5SqMKba0V66FaO4YQbB+JXR3UZwXkwEsUuaxmAFBdwGL Lz4bkw/vQW33CCbufgDhVBW9Z62B310UXDGYCaYyjXDvPthaVSqD40SAaOM4ARD3YoiipFVTmiLm Nns21pay1EtLUbKZqg1QUrnAnNbJtdQxcFsimAiSz209JGMmIILQHS0oFxze8Kf/YHZ/6oMead3P JhokpddzFC2XfOA4gD0A7ut/+gsmTpUo1InVuIZ7mE0vrCIwmhzZQ0+/e/OCjXuaqVkGdhBjietF ALDnNv2wk1U0tx9AsHY5dHdJbpLcPM7cPEq3dPLyAfrOWYOgtwuT9+9A5aHtCCen0XvOWhTKSwBi RGMTiA4cADcbzg6OTYOEtG7FPnbFmSzZtaTal9itDnEoDUga1aUZCE4IO6wy5TxCoYwrLDiJCLTt 5scZaJKX2LwsHc2zh1A8gyOANU+bah07Pvae820YrlTAEhD1WgqhgEMgPMxEexpTM2OrXvvrpxRX 94QClw1HZGHY9ZLNwdCiR3YCZgAPwfClSHxsm9h4dmIGzW37E/DGFbGsKWmRy4pb9iRTWqFr1VJ4 3UVM/HwrmiNjODI1g9KG1SiUcrCHD8vSLyaBirNaUspOSl6XaIcx7hEDVykJswmIFSXhsKOcNQGw 40BQ6nMlnF+VDAOhrchSCA+kc+67rDOLkkN00sAM1kaIqlWEU9Nh9cDoJjZRFwiaQREYuwG6j5U+ gCiqD77iLaccpfHEa1zGEWbeSeABZtLQ6sKb1569B0Q7rtz2wLFnNBNg7T2OdB0bacq11xQNbMen 0XxoN4K1K6D6ul2TEKSUAdKZ1rmWJdevke/rweJLzsXkfdtR33sQ48N3odKVQ/eKRfAKOZehk33Q XBIh5g64PgxxNIAj2Vw6abEYmwQqWfIpm2WLaZCU6ZZDShJznKmfUxmHk9JO57GpwORqy5SW3mga MBGsNa59aqOOaHoG0cw0bK3mtHdopqNqbYKNGQeww4IeVkqNn3HN756SYD1pwH3W/q3R95etu5Ut dRPzuYBdykq9jBTfdvP6s++/cuuD0/N93uYDpnrzTmoaZw9qm4Z5JIwFTbDTNTTu3wlvxQD0kj5n OgSUtP+MebbQygFJAyALbS26l/SARw+hVm+iPlWDma6juGoRCv1daYdyss4WTXqP2dSMEIJO0ksh BmQmRew0asbGNZlSdZJMWmJFxHTJjA17VK2RVPAqH6bRhKnXYWo12FoFplqFqVRgmw0Qu4mqcwWo fA4Atk/v3Ptl02ju3vjuD51WRZMnpQXT95et6wFwKRRdTory0NQkrQ5Aq/tJ0z3PfOC+OQG8+wUX roGxPwZhAFq5BsaZDt0JoUU7WqIq5qC6S9CLeqB6SlCFAijnWjOBXeWrrTZgp2Zgq1Vwo+k27as2 MbN/EmG1AeVr5Ad60LW8HzoXuMWBFjYAACAASURBVEgFpWwtQuqs6cUDCDZuyPR3oJYGzNmWpMja si2vZ96LqZMJ+SYO+QE2jGCqNZhKFabWAIcM2wydgxiGieZXngevuwdeVze8gtSoKQrZmo/lNz33 93AayknrHfb9Zes0QMtBeCYpWgOPfNKKyVMNeGoHaXU/ebSbfN0gX0Xkeeby4dt599UXLoYxnwXz CxzVT2VayTuwZvdNgFauylUKB0kraYCXlrFztl2SjhvguQbJ0yNTaIxX3X4RpQA9Zw4g6CpAaS39 aSk5DykFPbAUwYb1rYBUWQBniDbZluM0W6k8JfYxRxGiag1RtYpopoJoesZ1kYwpFX4Oygsc1VFp 6FIXgr5+B9hiwX2XS9O6lcHYKRs235rf9OyvdID7aEG8Yv0qUnQ+NK0irfrJUyV4isjXNeWrA+Tr feTrEQq8qXxem77m9LXUDN/lUv8OmKwFQPHeCEQOpKJ9Y1AmGlll3lMZjSjAJa0S6mF1oobqwWmY egTyFEor+lEc6IHO+SkoBZB66VLkNm5odb5UpkGJoqTJM0tTvJSfa2EjA9towDQaMLWG06bVKrjZ TDQ3KQXyPei8W/J1Vw+83n54XT3wu7rhlbqgfD9pPcpxv2B2HGTXTMTuCyvTl5cuuHpPB7iPNc57 xsZuaCqTokHy1HJ4qky+WqwCrSnQlgK/pgJvqqjt2XkTvlUp5EiRUGMpaTCXhJPYiK8Ta2OVaGPK AjUBcgbEif1KIAWEDYPqoRnUj1QArRD0FVEq9yHfV0z6OTAAtXgJ/HVrXWdEk5LWbRRJO/1I3pPW n6GBDSPYZhMcNh1BPjMRSBFUEEB3d8Pr6oIuFaG7itCFAnQuD10swF+0FCqXd90kkwaASJoAMrfv 0G4BE30rWPf0F+M0lVOKjzu0e8s0gOmb1529FZbzsJyD5SJHdjmDliuOBi3z4kbOa2hShxRhpdIe yHcNL5QfPzTI90Gedg9p0USedtmpRLPS0VNYgArpnRtHHXylUFgH1KbrmNz8AJpHKogqDVSKubRN LgOq+zD03jHJvkmaldM0MmSXSHdeSlYAUgoUBPAX9cLr6YLuKsHv6oJXKkDl8/I7PChPqhxiTV7s AgW5tEslZ6riJWyX7V/ivo/YRvgiTmM5JSsgrtz2IAOoyWPiBxddcICY7wYzgaGbTP19pjlAxv4y e55m4wG+LLWc8lFVzJpSGgh8IPBBfgDlyw45nvTLFQ2XdHSMCxez8VN57i8l5JcuwfjmB1DfvR/N 8UrGPiZopUHVmpgqGqw1yNdQMglUPgddLMArFqCLBac5i3nnNOVybS2ksi2lkFybc7oAeD5UroCE 6xXveJlllVG6fatLO1uwwQFrzXc6wD3O8oyfbs5uEGYAjO55yaWf5cPVl4LRFwOPfQ34ngOp74F9 B1Yb+KDAAwUBOPBhfR8UOACTp8WRa3XYjuqpgLR5niagf8MqTHOI6t5RmHrkqt89heKKJShu2gAV BK4tlO9DBb5bCYKg1d4las2mxRuryH4kJCQZNrFpY1OWmKegC6WY/wG0tFHN0BaTymVytq17+4sq CKY7wD0Zxvmqvlt4qnYP18NnxuVg1Ixca/lGmEQZWMjcnN2hUWvA11JsmLFvdVqU2AoupFqZKFl2 CznAW9mP6lgFjYkabNOgcWQahcggN9CVmANJijjuRB6H0qAc9VGlapLjY1m1lANxhpRDWkEVSm67 AGtTk4dtS+untFNPTNIgEHicib9hGrXTupW+Pl0v/EN3bjfvuGDNjD1SfSURWnrcU0t3xex+uEiN Ues2HoGxbiMS49rNI4qAMBInKkpTuFLpy9akLfEBaE3Ideeh8x6iaghTa6IxOY2w3oDfU3ImQmLf Zri0nCmOjCmU8ZoS794eX2uyH7B7UeWL0F09LaZAAk7O7AecCarFf7O1/83G/Gth3TNrHeCeJHn7 isFd0Ux4lTnSWJX2MUhvcKJogKSbdwKGJGXMKcvMWnBoYBoGptqEqYsGR6YSlzOfSzrDEPy8j6A3 7wiESiGcmELtwBgoF0DnA+d8MbcCMbPrTgIym6F5Z/cEjr8rl4fX15+QZ+bKrbc4nXG9mbVTUa3x 4fyZV9yB01y803rWDXTVTGQ+HI03nhztreeooKALChQoaF+BAg0VKChfupbDAFaWabaJA2aMgY0s TCOCqUWw9QgxQZs0Qffk4C8qwe/JZ4g2Cqw4Q75R8JRCz7I+2CVLUBufRmP0CCZ+ch9qK5aia80K FJb0O7ILK+ETuMoJZDgJ2XKflO/gbCFVKMLr6XPfHfdjiHuXcXsTXm7Rxszg+sTUgfv++pPTNwLB c4Hm6XzvT/uNibe87PKBaNvYv/C+6kuTpVM8fPIJ5JELl+WU2w9BkhEMcrFUw8nOOGzRatNm9tBV nkawrAtBXzHT+Ty2mymJCZPvIzhnA6irhOrBI5h+eA9sowlVLKCwfAA968+AVypKdYRqidei5bVM Jk0pqHwe3pIBUC7naJIUGwFtfX+pNfOWtEY1trnzhps/t+dX37+bBnr/F8AdVx3abk9bpXW6A/dj D+2t/s75a+pcbV6Fui0l4GW4ComIXQ6/bmBqBqZqYGoRTCWCrRlw0+0pxnHD5vYVl1MurK00oUsB lG6rxM1uJmIMqKcHXm83gp4u5JcuggkNzEwVzcMTqI2MAbLZCGXolmCb9iKLTZt4c5QggL94idul J7aTk7BfVg1lgy+ZPdgIgDGfffBPPvYJnmluBGEdgJHrq+NjHeCeRHn3bz9vW2PHofU83rgw6cGZ 2RAa3L64tFYSUNZxi6P1LQ2eKXHa2Vj4pVwG3PHewKlzRYEP1dvlSDe+j+LSRdClAjgyCCdnUN93 EM3pGSjPh8r5LusnoE3sYDm3yufhDQxA5fMttiu1zJg0htvSjze2+a3dwlH0tt0f++oWNCIPwBkA zrym1L/7+ur41Ol4zwmPE3n4FU87I9py6Aa7p7qplSKY+aUxOVujdfsnTUmrT7e5dDYEhpYlmHyN wooeeKWglTij0nAZFYsILjgHqpDLxIYVTDNC/fAEZrbvQzRThcoFyJWXoLR6OfJL+jMpZve/7umG v3QAFOTld7SxxmKnsn0Xobjw0iF3mg1fx6H5bG71M6KbBtaWALwcwFkAtgH4j6sObZ/sAPdk2rtX X/qc6KGxb/CRZgnZJnLZkFGchdJJ+vMo8EK4Dy3HxzFUBfiLCigs6ZIYcab+LGObBudthF68SEg8 6W5AIIIJI8zsOYjKrv1gY6ByAfLlJejesBp+VxHwPHh9vfCXLgX5Hlo2giDV+nd7x5tMlx0iGLb2 86bZvDa/5llJwuGmgbWLAPwqgH4AwwBuvurQ9tMqrqsfT8C97qK1+8HW2Knm0xGxbp2eWV5C2y46 oKT0uyX+Ge+G094aiQFd8DO75WTf42QjaW9xb2a5To9TWiG/qAe5gX5YY2GqdTTHxlHbdxBMQLBs KfIryiBf4WhDti3cNVcozPVZ2myb0bX5Nc8ayR5xfXW8dk2p/wiAcwGsArD7+ur4eAe4J0k+ev/u 6LqL1z1oTbQaU81zwS196Y/aLK/1ZWpxspKAvXQXz8b02TB0zoP2VGrnirOWJD9qDVBvN1QuSE8q AI7juDoXoDDQB18akphGA83KNMJaDdZa6MCHzgetAVmeJU47K355Dxvz9tzqoZ/O9vY1pf4pAAUA awEMXFPqf+D66vhpo3UfV6ZCYu++9LLV4cNjX7L7ak+N98BLQlvZJTW2eQkZjkImjKTJTW2NdGMR iYL5fXnk+gqOxK4yfcJUthqiD/65awHPS7ZsJZWpcohplL4Pb3ARjCJMPrQDtV17HaGnvw/FNavQ s2Et/O5uHL0vG6V2b8tmajTOlt8WVutfL539gjlDXjcNrC0DeDWAATEXvtsB7skG7yuv2Bj+fOTf 7Wj93KxSTR2uzHNFGcpfZlhiuzUGL6UtRVWgUBjscjRDIbS3OmsK5GvotavgLR9ICeoZGiM8Dd3b hdwZg1DFHECupq16cByTP38IzUOHwcZCFQvo2rgePRvWwSvmQdpDa1tzuVb39xQYf2Ii+4n82ucc M8lw08Da5wO4AsAEgM9ddWj7wY6pcBLlnetXHuFA/QhhdBnXTRktMfl5NtDLOnNx909u3x2SwJah fZWYC9QWz4VUHXC1DirmHTNMlnnSCrqrAH/5YgTLF4kD5sJqpBSCniK6Vq+Av6gfzAwzNY3qjl2o 7NoDYwzI86DjDQkJ2VDcNJj/xkT8kfy65y4oM3ZNqb8GYBOAbgAz15T6d11fHe8A92TJR7bsxR+/ 4YrR5tjM3WDzZK5Gy1oC8nR0PDcFL9DCfYj9nbb9OthaeHk/w1nIOGixNCOgUgOKeahCDrqvBL/c h2BpP3RXrpX3kLGFSRGC3m4Uly9FbnAAqlBAc+wwarv2oLp3P5pTFfn+HKTb4gyAP42a9iOF9c9f cDr3mlL/DIDzAPTJVN12fXW82QHuSZS/veUBvPuFF+83im9GM7qYq9EKJC0PqSVJQUeBN8OyijNo 3KZ1DaA95TJpQGtbUM7MkjACGjUEq5YgWD0IHVdN2CzZBhnyDSeZOVIEv6uIwuASlM5cBVXIIzx0 BI3Rg6jvO4DKnv2I6o2KtfjjmYMTn7rjkl+qf+4RjNH11XFcU+o/B8ASAD6AB6+vjp/yXF3CE0S2 XX3JoBmb+ajZPfNS27D5JGLQFv6CJCCo3ZlL+hu4piIuSUHw8hqF/rw4ZM7WJU+KMD0FlfNAOSH5 5H34mzYgWLcKqpRPS3B0WiKUlOTEpUUtSQkNgBDVm5jeuReVnXvRGB07MLNz7Lbp23Y9wJVwOxib 4Xp9VUCoXXVwOx/DxtUA3iphMQbw6asObd/eAe4pJHtfdXlfuG/qOnOgcq0day6xyoGXhRye7Bop iYW4gXhL+liliQhogDyFfF8OftFH3OeBPAUEGsrPRBmIQNrtA6xXLIW/cTW88mKokpSOJ7vmqKQa I67MyBJ6EgArbcJ68zu7v3Hzp/b98TeZBoI1cBvsEYBJALsB7AVwEG4LqMmrDm1vtIG2COBiAFcB yImp8OmrDm3f0QHuKSb7fv25+fDBg8/kidp77c7KpWziPRkgtEJhESaZMAdQViTWQxxWEAWpCbrL R7Ck4BIGnk7Da0l1sTDHVCZ0FnjwBpdAryrDX1WG6iqkIE22hFItFcdJtQbpcfaCD8HPfyq35oUH biqv82F4EYAyXCp3A4CSTLWq2L9VABV5biSGuxjAoIAWcDvofOmqQ9vHOsA9FTXvm5+jzP6JMlea 77K7Jt/Ik1E/DChJ+WbSxUnzOdVmF6us2aDgDxagu4LEXEhitNn4bty4JC4N0uSqkQs5eKtXwD9z OVRPt9sGy0tAmikvUg1o/x7ki+8C0W25DS9vSRjctHQtgeEDyANYDeAc+b+AlKWRvffx/bcC6Buh 6KdXjW7jDnBPYal84To19oUfPdfunXwnjzeeyhNRLyxad30kauUraMwKXspp+INFqECnnIWYeKPR ymeINXEyMTK1ZINL4K9eDjXQD10qgAp5kO8beP6DCILPcan/44UNL1kwo+umgbU+gGUAlosp0Sca No5mNwGMArjnqkPb93YSEKeRHPi/r+xr3rXzRXam+Toeqz6PRxp+mmnLgFcBRzHPVFopoUoa/qI8 KNAtO0Qm5kJG06avq8z5UzYb5XPQ5QF4a1c9EKw740tU6vpa/uI33v+L+L03DazNifZlEDWuOrjt tCOUd4ArMva3b6bqj7cuhu892R6uvs3uPPICHqkFrj3MHODNpoYVQB5BFTX8/pyzd7OtneL2ULEJ ojMApqwNTAxPR7Sof6saGPgEafVtb9PZu3pfdF2zc5c6wJ1TRt/7RgoPVQLS+qxo3+E3m4dHrsZE Y4Aj20PVyGtJYChKCTnCayCPoHIKXl8OKqdaTQTp8sjZFLMmKZVX0+QHk7S49261fPCz3hkrv2PG J2uLf+NvTOeudID7iOXI1/6yv/K9u59p9h6+gierm9A0a2HsGXy4UsRkoxW8RIBPIA8gX8HrDaAK 4lwRUq2qFVDMMbTeC0/vpEJ+K/UWf6RXL7958Tv+fktn1DvA/YXKwY++Y3Hjvp0reaK6DL5eg2a4 kWcaa2CilVxtLEY+txTVRhGaFGmX+lWeangF7zAF3gQU7UHg7abA3wZjtqCQO6CXLdnvv/iZ+3ov eUtHs3aAe/xl/N//Sjfu2RZEe8Z8rtV8O1HRKOQ1pisq0azWAgD7pcBQITDkqwg9pVAtH2gO/MEn w84odqQjHelIRzrSkY50pCMd6UhHOtKRjnSkIx3pSEc60pGOdKQjHelIRzrSkY50pCMd6UhHOtKR jnSkIx3pSEc60pGOdKQjHelIRzry2OW4FksOD5bVPN9hh0ZH+GScc3iwTMf47bzQaxseLB+PHsM8 2zXIdavHeu6h0RG7wN8Wf58H1xyvC67P2BSIDsqGwo/qPj5W8Y4jaPMAPgy3l1a7GACfA3DDIzpn eVkJzB+D60Q4283+RwA3L+BUlwG4fB7w7gLwtQX8xhyATx+HcawA+CiAn7W9fg2A5+GxNeSeGh4s v3dodGTXMe7dagBXA3gJgIvgGuel21YyjwO4C8B/DQ+WbwRwYGh0pHnaA1ekBLery2ySf6TABfOz AfwKXOfsdpkG8EcL1Nh/LgCYS3YND5ZvGxod2X+M02n5fb/ocZyUidMO3Ivl+x4LcMcA/INMztnG Zy3c5n1vgWuWN5cU4BrpvQTAdgCfGB4sf2ZodOTQiQCuOo7nbgL4+jzvnz88WF7/CM/5ynlu2o1w /V2PJRfB7XkwnywG8MIFXtPxaBiX3U16Ia//Is6N4cHyebJqvfsYoG2XtQDeB+CTw4Pllac1cMWO uh/AfXMcshTA0x+B6bEcwCXzXPNXZbIcS64WYB5rpXjO8GC58ERxdoYHy4MA/hLAcx6l7+MDeCmA jw4PlntOZ40LAPsA/HCO93oAXC524kLkcnEQZpOHAfzsWE6H3JxnIO3APZ/TejFcY+STMYbH02k+ yjEV8+n5AP7PPL/HOWXO/p7PdHougF+Rc56eNu7Q6EhleLD8QwCvFaC2y5MBrITbxXs+wHkAnjaH owcAt8kkOZZslO9ciKwDcMnwYHnz0OjIXH29DID/Fm3DswBkBYAL5/jsNgAPzOOcPdKN8u6Ea9B8 LNBOiA3dri3fNs/nDosTeq9M+mcCeAWA4izHdsHtzv4fCzTdTknnDKJx980B3PMBrB8eLG8/Rkhl 2TxmwgyAW4dGR6aPAf4AwBDctkgLXY1eCuArcrPnsuPfNs/nXwng7+ewM28A8Bdz/CaeBVzHko8B +J8F2uQTs9j0F88zOT8K4P1DoyOhjOXXANQAvHkOn+MyUUinL3CHRke2DQ+Wfwa3qUb7TQoAPBtu 6/nGPKc5U5yqucyR2xZwKT0CpNmkMYf58Gy5ARNz/DaeSzPKUjk1j4NUHRod+UVuEjI5NDryaLcz XTZHpCYG+v/EoJXfPT48WP4C3G49g3Pgas3wYPmuhcaMT0WNGztOL5cQWLu8BMD75wLu8GDZFyeu e45BvW9odGQhLeYvBHDBHO99GsCvzXLz8gBeI0vk41n0McyLFbO8fheA/zfHSqrEKT9uiYkTBdzv ybJx5izvnSWAGp7js3kAL5tnqf76Aq/hrXO8flCW8wvFAWyX1w0Plj94LFPkNJfRY4D6ncOD5fuH RkcezGjdaTGjToqcKOBOi7H+zjlm9GvmAe66eeyvIwC+tYBQz5kAnjXH2/8DYD+Ab8wB3BUSQvvq aRDSOmY0Yg5f4hBcEmHDHPfnMgBfGx4sfxzAF+V+mpOR6j1R4bDsYH0ZQDTHIVcPD5a753jvl+aZ YN+Yx47MyivnWNIsgG/LOX4AYLZtwwPMnf07leQ88fbne1wyR2y6KYCcT+tuEgfwHgDvhQtlLjtO XI1TA7giWwH8eI73Fosj1K5BcuLZz+U0fOlYs354sNwF4AUCwHZ5CMDPxYHYKSGl2cboQskqncry Plm15nt8Hi5N265YIgD/BuDuBeBlJYD/C+C7cr53DQ+WL5WQ5eMSuDNwMc/ZpCjgapfL4TZHnk3u xtxx0KxcKnb0bMvoT2WJBIARmVizxWxXArjycWDLRvO8t0MAudANqAtifr0PwJfg0r1nPe6AK8yh 2+cIH2kAF8yS534hZg9yQ2zbY8VuPYlILJ9jIt0yNDpSzZgzt4i9N5uD+MzhwfKix6t3JqvOTeJv 3A639y8vEENr4ZhrNw4Pll9+IswHdYLH54F5QkvrsuEqAcllmD2+OA6XdGgc4/uWwsUaZ9O2YwC+ 3/ba7QD2zHGuZ8BR/U5noWOBd2h05CdwfIXflWjQyALPrWV1/EcALzne4FUneFaPALgDwGw7ziwR 5yG2RS+QmTyb3ANH4DmWh71ewN8uDMdt2NJ2fdNys2ZbUpcBuPJE23KPUCn88BiPuwDUF3CfKkOj I/8kjvE14ozdfgxTI5ZBONromsdDOCwr/wsX7B+Y5b0r4XidYxICm22JDwH8eAFcWQ9zJz2MRDlm ky8DuG6OsXk9gH9e4A080fJBGdtj2biHH4GimQDwv8OD5WHRpBsB/LIAumceDX6BaN2/F8fvcQHc H8pyPBtwLxOwRrI0zzYwk1hYTr57njDWYQDfmeO9ewFsnkNTPxku9XzrKQjcIwuYzI/FP9k/PFg+ IPfvQ3DZzhdi7lTxCwF88nhN8hMO3KHRkVBIGhfOYqoU4IL9/425ubq7sTBuwksAlOd47z/FOcMc 2vgLcwBXwVUGnIrAfdQyXF7mg7k8h6JgAKNDoyNNcWBDAA8MD5bfKtGEZ83xuXPx2Co1TinnLJav zGNrvVpMhtnI3hbAfw2NjtTmvRFnrCYAb5xnKfvqHGGvOLrwXczNCLvqRLH8T6B0i4n01VkeX5pt EkuJzn/Po1GXHE98nSzg7p3Fo4/lfMyeGgZchucLxzx7o3GpzPjZgLsZwEPHSFyMYO4U9GIAL35c wZa5LhGTp8zyuAyOTz3Xij2XcpjE44BkM5uD9RUAL5ojrHLmXMpUTIVjyQsxN+n8pgU4KFMSXXjZ LDemCOD5w4Pl64+l+U+wLJLypmOJBXA4S1MUrTkszudsyu2Vw4Pl7wO4YWh0pCJRmzXi/M5lDjw4 16p22gJ3aHTEDg+W7xAQnvEIPvplzB5Ky4bB5ivPmQJwW5x0mOf6zPBg+W65vvbYLcmqcB5mTxGf LLlOPP5jyQSAP0Rr1UkIx1V4FWZPjS+FY9B9e3iwvANpFcSl82jcb2FhNYCnlcaNl+ObAbxhgcfv AXDHAojJ52Fu3u02uDTvQuRe0RqzJR3WAnjq8GD57nnKek60XLjA48bQxm0eGh3h4cHybXCkpbki MUvhYrp2ASbmVgDfPl6hsJNp42JodGQSjpFVX+BHbsYxSkGElPPMORw7A2Dz0OjItgVe39Q810di jvSdjhbtbLbn0OjIEQAfAPCTY9imx8LMtGjn+4/nj1AneRDvWKDNWodL8U4c47heuErV2aSGBXB3 2+QGzB02u/IRmjmnvAyNjvwUwNvh4uThozjFGFyM95+O90p0soF7HxbG8NorID+WXArgSfMM6o2P 8Po2z6M5igB+6VGWYc/X/2w+ITz20vV5zzE0OnIXXCebd8CliBcSGYgE7G8B8Fcnwmn1TvIMN8OD 5X+CY4z58xz6EIjuPYaZQBJJuH6Owb5DzJNH6kR+SGxjmsP8mG9J3gbHc7WzvPeTR7lCFfHYAvvT cJUj8/3uEbkvXxVF8Hy4FPxaAIuQlrnvgOMwfBuOPzJxoqoiCCdZFtA5EVhg98RjnIsfZXfIR33O X/T1LHCs8IsYy3m+lzKT71GPa0c60pGOdKQjHelIRzrSkY50pCMd6UhHOtKRjnTk8S3UGYKOPBaR quc+KHV46MD+E5aI8DIXkIOr4rwIjrd6B4CDx5MsIe2RngzH2pqY57gyXIn0UwA89bHmwuW3FuF6 ytpf0G/Jwe0dMX66ZJKGB8sb4Squ/+bR7JYjGbWXAfhtWPt2OBroY72mM+B2T/rAfFtaeXJwNxy5 +GVwvIECHBHkT4cHy9+V5xpaN2BML4AwZsJnvrBXNPjk0OgIDy9bTrC2AKI6mLsBqKHRkfamcmcA +ASAa4YHy3cB8KFUE9b2A2gMjY7MDJeXebJN1DMBvAdAODxYjs/bBaAuBZgFue4JSGv7odGRppBg egFEQ6Mj0zLYr5XBed7wYHmfHG/h0pjxcxvv2yU9ehWImkMjB1i0TC+AytDoSEx7fBVcO6JLhwfL R+AI2SZzjpyMTwNAfP25+Jjh8jIN5l4AtfaJKb8hB6XqsLZXXp4UHm3LuGcA1QsgglIVWFuQ87K8 1wdH8u6D69n2D5nP9QAJ7XQ2YHULbiaFyxEXru6T/dFivm6XTGIjr3fL39FweRmBuQDH+ssDyEHr iaH9+1i+/2oAH2/DFgBMxb+R5I3Xy418J4i+LwP4DqQbtJ0LR7LwATwVjqjxKTi+agGOef9sOd+t AK4HUQjm98NtLHIFHGv+63CN6iL53nPh9vN6k1zYs+U7LhEAfgRuP4TPwxGZbwXw+wB+A66n68UA /lpu0lvlmB/IwO6EK+a7RlYRgiNKPwxHvXsaXB+C98BVqhblRj4omvPw0OjIl6Ujy9Uyyf4VrlvL tXCdd8bk2rbJOZ8j3/ERuLKkzUOjI/8hv/UaOJ7w9aIk7pLf+8+iLH4HjsQyKWP07cyNWya/eULG EnDNqON95DwAnwXwXzLOvwxHjKnLeGwA8Fcyad4k3zsNx3x7hUy6MRmrIRmrHwC4Pgvg4cHyi+V4 wJFqPgXXTuD1cO32r5HvXwbXjOVOGY83y98/gev4GME1DblLvq8fwI/gejecAeCbcM0Ot8Ix1a6S 7/whgE8OjY5UlcyyV8P1Zht5LAAABqlJREFU0bpxaORANDQ6clgGOA9XLLcObu+rQG7QDBxZuCxf 8DoZyE+K1n4NmEtwNLcNcDtM3i6TYy7a4SoAvwdHFv9rGYA/guPR/hBuQ7mvyOu/Jtf8kMzkv8pc WwjgtwSsa+B6YX1NburvC8h/CNfG6Xq4yoohAU6fAP4ypK37SSbuFQKUj8P1zP0buL6674fr3nKb gOEzMjmubvutl8r3lOA4w++S756Qm9kHtyfEjwH89fBgOdsTuEdAcbaM5VbRklfLZx+AI4EPyHe8 C65m7tNwZf7Xyji9EK7E5wa4nT0vFpBpuPqxV8tnPgHXmvV1cSul4cHyYri2TLfJuL1IxqQsz7sE YL8s3/0ZuU8fkM98Uu7F6wRXr5fnXxWF9lbBS0LegavUfp0A+pMyad40PFimmEvah6PLsadkxg7I zbsHjiB8C4C/E4A8Ha7i9Udw3NotctFPF018BK6c/HY4el8Vs7dljwFyH4BvDo2O/FDAtlau4QHR SrfAUQlnBKx/I8vSMnl+swx8XJ7TkKXrQgHJtXC7NW6Ta7ldNIoF8CMQXSugtjiaGhmfZwOADw6N jtws2vpv4cqQtsu1/ihjr7efI/7byCT7SwHl+QKGg0ib+V02y/34N1l1viTn+qRcx+dl6V8Pt13T dwF8BkTfk1ViXFayF8n5PyOrzafkmj1RQHfClSxtg+MuXyaAhBx3CK6DpoLr7HgnWisqrIzpfwoY bxXz4IsyWW6QyReIQvq3odGRG+Dq3T4DVysYV5X0yiT8X7me+2VSPx9IieQPAtjQtufYWjlJvMFe Dek+DVUBblE04JNktr5G1H7cZypE2lExks/PF8mYRFpg15zlhnPmuCPiOMa/oS72Tw1puc0eAH8m N+YPAfwBWjfbsJn/DwyNHDDynNBaNBjvHRzvZ+uKLbVuCmCnM9eXPWeWY5xv+z3xTkOBPK6W8XuV KIltbZO6nvmNkTwqmbEyojkDub7m0MgBztwryL2qZZp7VDP3tARXr/dquBZL8X0MM8B9L1x711+R lWbTLBNzKvP7K3I/4r9n5BqVHFsRezqSz/lIucZK/r5Iruc18trtEIeJZeadB+DPhwfLTx0eLL9I LvLHSLsrXgLg9cOD5U1idyyVyMOtcsJvy2NV22Adr5BbfN4xGZy3SPPl18qyDLG/3gjXxv/34Dbc O0eAVoIreJytQ/ceAE8bHizHG55cLQP9M1mZfn14sHw2jHmr2LPL5abk4NqRFgV4Vw4Pls8ZHiw/ DbN3xoGM734B0OfEJDobR3dJXMg4hnLPXgjXu+si+f0DAvRb5fUXDw+Wnyz3sU9Af5N8xw2Z+9jM ALsgy/k4gN8W5XEFHhmpPfsbCgDeMDxYfsrwYPnZYgrdn1n5p2QCB2Lz3ij271hW4/5UbJ+nidr+ sCz7fyQgJFkWLhFj+w2yzG2VZWqLLA1fkxt4Y0bbRpnZWEFr55N42TdyfCWjVUN5j2UAq5llaSZz nu1iR70IwL/LcnOPDPiorCZfkCXyftEYPxAQflhmdDXW0hIe+7RMhv+QSMEd8v6E2M9PlvNdB+Bf BHxxR8S/kwjI+5FutP0O+b5qRvMY+b4pAL8JV8N2qzgtX0brVrLZcUL7OTLvN+Umf09Mp8/IdT8k 4/lV0VgfFafwiEywUCbNw/Kbvy7A+Z84HDo0OjIjy/Z1goUV8tsa8t2xhs0Wl9ba/q7LayzPd8q1 /Ivcxw9ncBOKP7EbrmXW12X8/2todIRbt8ZctlzB2mUApmVAIcb5r4nH/OsxqOSHZMMk/fIDk5DX cHmZD6IoDkwPl5d5AOzQyAELAMPLVxCs9UjriI0hENTQgQMu4rBsmQJDATAgIjCroZEDLpQCaBCZ bMB7uLwsB+ZeaH0I1moALEt/HC8uktaHrnQhFyTnAQwICgzEx8tnAgCLoNRhABbMyJzPB9AHosmh kQPNzDXE57RDIwfscHlZAOZ+AEegFIMZ0NrAGA9KRRL+yQby+0E0PTRyoKWyWM7rAYiGRg64UCNz +reMI7SKhvbt45tXriIOw0UA6iCqtnx2+QqCMYtBVBHQKQBmaORA/Lk+AdbkbPFoCU8uhivTaQyv WKlgjIJSBtZqEHjogIzTsuWejJvc0+VOOzuM3Sq4+qFo3/Gh0REeXrGSsuMjwYMuAB6Umojv+TGX HwHuW8Xof8sCKm070pFjYWqlOPS/OjQ68t3HlDmbR1iWLfP/x0DDk0lGwYgCX6AjJE8o7eAQU+oy 0vJkklEwokpcRuiIwR9yp9wBBiwyY5u0u3MAAAAASUVORK5CYII= ---=Part.baf.bf3f53f3ec167425.19e21eeeff6.b1b31f559e950585=--- ---=Part.bae.fc8657cf149906f8.19e21eeeff1.cc137a118f92ad64=--- From win-pv-devel-bounces@lists.xenproject.org Mon May 18 09:40:07 2026 Return-path: Envelope-to: archives@lists.xenproject.org Delivery-date: Mon, 18 May 2026 09:40:07 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1311726.1581841 (Exim 4.92) (envelope-from ) id 1wOuSE-0001Tg-2F; Mon, 18 May 2026 09:40:06 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1311726.1581841; Mon, 18 May 2026 09:40:06 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wOuSD-0001TY-VE; Mon, 18 May 2026 09:40:05 +0000 Received: by outflank-mailman (input) for mailman id 1311726; Mon, 18 May 2026 09:40:04 +0000 Received: from mx.expurgate.net ([195.190.135.10]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wOuSB-00015g-Qr for win-pv-devel@lists.xenproject.org; Mon, 18 May 2026 09:40:04 +0000 Received: from mx.expurgate.net (helo=localhost) by mx.expurgate.net with esmtp id 1wOuSB-00041y-6B for win-pv-devel@lists.xenproject.org; Mon, 18 May 2026 11:40:03 +0200 Received: from [10.42.69.2] (helo=localhost) by localhost with ESMTP (eXpurgate MTA 0.9.1) (envelope-from ) id 6a0ade72-bab6-0a2a0a5309dd-0a2a4502ddda-2 for ; Mon, 18 May 2026 11:40:03 +0200 Received: from [185.255.28.34] (helo=prod-mta-13.swg-srv.net) by tlsNG-720697.mxtls.expurgate.net with ESMTPS (eXpurgate 4.56.1) (envelope-from ) id 6a0ade72-af86-0a2a45020019-b9ff1c22aa6f-3 for ; Mon, 18 May 2026 11:40:02 +0200 Received: from mail2.vates.fr ([37.26.189.201] mail2.vates.fr) (Authenticated sender: 8631fc262581453bbf619ec5b2062170/smtp/7773de5a-2839-4720-82ee-e06722ae1d3e) by prod-mta-13.swg-srv.net (ZoneMTA - prod-mta-13) with ESMTPSA id 19e3a74ebb1000f373.002 for (version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384); Mon, 18 May 2026 09:40:01 +0000 Received: from localhost.localdomain (155.223.66.37.rev.sfr.net [37.66.223.155]) (Authenticated sender: ngoc-tu.dinh@vates.tech) by mail2.vates.fr (Postfix) with ESMTPSA id EA82B865C1; Mon, 18 May 2026 11:40:00 +0200 (CEST) X-BeenThere: win-pv-devel@lists.xenproject.org List-Id: Developer list for the Windows PV Drivers subproject List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: win-pv-devel-bounces@lists.xenproject.org Precedence: list Sender: "win-pv-devel" Authentication-Results: eu.smtp.expurgate.cloud; dkim=pass header.s=selector1 header.d=vates.tech header.i="@vates.tech" header.h="From:Subject:Date:Message-ID:To:Cc:MIME-Version:Content-Type:Feedback-ID" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=vates.tech; q=dns/txt; s=selector1; bh=tVXfWoXmvIndjajnD5CI9ZMCqyOJryIZ/6X3tZ02vZ0=; h=from:subject:date:message-id:to:cc:mime-version:content-type:feedback-id; b=V6o9f/AXBuDxT2WfGVrxyEAUKjwGsntSfF+UYp9yJnTZ2SXOgiXYcoeLBEUyFr5jk9qFCzBag LQ3pWGhY456UaaucYB46g93ldGP1xQ4y1lKcujXwZWyhCd806Yk1JqV/EgWyRxzPJEBML1pIxap qz9dOTNdzRn09BtrPEAPjtdqMfX4w7OUBpXwHuQh0WYx4S3cLaV0fKkY3tGlAaLzrz9l0Zwszy1 h/h90muD4pLCR22bf/c3TUDeKNhZpfb613Zot+trvBLydpnhTKJPJdVMIgYSlVUhznkpf1PRfcd +wimtADOcPIihMptXPEXveHSLdrCvHmR6vy2cIbf5k6A== X-Zone-Loop: 10a227e69e246281e4cc49d5b142172c198d156eb0dc x-campaign-type: default x-transaction-id: e280ebfa-7ea6-41e8-8de0-c2c486a97987 x-swg-uid: 01-3c066e1e-9b26-4312-93fb-51d84ce33249 X-Mailer: Sweego Message-ID: <1779097201.8631fc262581453bbf619ec5b2062170.19e3a74ebb1000f373@vates.tech> x-swg-bid: 1779097201.8631fc262581453bbf619ec5b2062170.19e3a74ebb1000f373 Feedback-ID: default:8631fc262581453bbf619ec5b2062170:Sweego x-campaign-id: default x-client-id: 8631fc262581453bbf619ec5b2062170 X-Originating-IP: [37.26.189.201] From: Tu Dinh To: win-pv-devel@lists.xenproject.org Cc: Tu Dinh , Owen Smith Subject: [PATCH] Remove MRSW shared acquire from VifReceiverReturnPacket Date: Mon, 18 May 2026 11:39:51 +0200 MIME-Version: 1.0 X-BM-Disclaimer: Yes Content-Type: multipart/alternative; boundary="-=Part.d77.b62694e8c6c696af.19e3a74e989.935fa6773fa9f3af=-" X-Bm-Milter-Handled: 4ffbd6c1-ee69-4e1b-aabd-f977039bd3e2 X-Bm-Transport-Timestamp: 1779097201033 X-purgate-ID: tlsNG-720697/1779097203-8137C161-91465FAD/0/0 X-purgate-type: clean X-purgate-size: 1523 ---=Part.d77.b62694e8c6c696af.19e3a74e989.935fa6773fa9f3af=- Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable VifReceiverReturnPacket may be called early/late during the enable/ disable sequence respectively=2E Notably, this can happen during the exclusive window of VifEnable/VifDisable, and so acquiring a shared lock via spinning will cause a deadlock=2E As ReceiverReturnPacket is protected by the VIF refcount (and in fact can be called regardless of enabled/disabled state), remove the MRSW shared lock requirement from it=2E Reported-by: Owen Smith Signed-off-by: Tu Dinh --- src/xenvif/vif=2Ec | 5 ----- 1 file changed, 5 deletions(-) diff --git a/src/xenvif/vif=2Ec b/src/xenvif/vif=2Ec index 6782cc7=2E=2E38b6b71 100644 --- a/src/xenvif/vif=2Ec +++ b/src/xenvif/vif=2Ec @@ -565,13 +565,8 @@ VifReceiverReturnPacket( { PXENVIF_VIF_CONTEXT Context =3D Interface->Context; =20 - // Called from MINIPORT_RETURN_NET_BUFFER_LISTS - SpinAcquireMrswLockShared(&Context->Lock); - ReceiverReturnPacket(FrontendGetReceiver(Context->Frontend), Cookie); - - ReleaseMrswLockShared(&Context->Lock); } =20 static NTSTATUS --=20 2=2E54=2E0=2Ewindows=2E1 -- Ngoc Tu Dinh | Vates XCP-ng Developer XCP-ng & Xen Orchestra - Vates = solutions web: https://vates=2Etech ---=Part.d77.b62694e8c6c696af.19e3a74e989.935fa6773fa9f3af=--- From win-pv-devel-bounces@lists.xenproject.org Mon May 18 10:24:37 2026 Return-path: Envelope-to: archives@lists.xenproject.org Delivery-date: Mon, 18 May 2026 10:24:37 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1311748.1581863 (Exim 4.92) (envelope-from ) id 1wOv9I-000872-F9; Mon, 18 May 2026 10:24:36 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1311748.1581863; Mon, 18 May 2026 10:24:36 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wOv9I-00086v-CE; Mon, 18 May 2026 10:24:36 +0000 Received: by outflank-mailman (input) for mailman id 1311748; Mon, 18 May 2026 10:24:35 +0000 Received: from mx.expurgate.net ([195.190.135.10]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wOv9H-00086p-DN for win-pv-devel@lists.xenproject.org; Mon, 18 May 2026 10:24:35 +0000 Received: from mx.expurgate.net (helo=localhost) by mx.expurgate.net with esmtp id 1wOv9G-009SCC-Kg for win-pv-devel@lists.xenproject.org; Mon, 18 May 2026 12:24:34 +0200 Received: from [10.42.69.9] (helo=localhost) by localhost with ESMTP (eXpurgate MTA 0.9.1) (envelope-from ) id 6a0ae8dc-e002-0a2a0a5209dd-0a2a45099cf4-16 for ; Mon, 18 May 2026 12:24:34 +0200 Received: from [185.255.28.34] (helo=prod-mta-13.swg-srv.net) by tlsNG-bad1c0.mxtls.expurgate.net with ESMTPS (eXpurgate 4.56.1) (envelope-from ) id 6a0ae8e2-2497-0a2a45090019-b9ff1c22934f-3 for ; Mon, 18 May 2026 12:24:34 +0200 Received: from mail2.vates.fr ([37.26.189.201] mail2.vates.fr) (Authenticated sender: 8631fc262581453bbf619ec5b2062170/smtp/7773de5a-2839-4720-82ee-e06722ae1d3e) by prod-mta-13.swg-srv.net (ZoneMTA - prod-mta-13) with ESMTPSA id 19e3a9da3de000f373.001 for (version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384); Mon, 18 May 2026 10:24:30 +0000 Received: from localhost.localdomain (155.223.66.37.rev.sfr.net [37.66.223.155]) (Authenticated sender: ngoc-tu.dinh@vates.tech) by mail2.vates.fr (Postfix) with ESMTPSA id 7475C86671; Mon, 18 May 2026 12:24:29 +0200 (CEST) X-BeenThere: win-pv-devel@lists.xenproject.org List-Id: Developer list for the Windows PV Drivers subproject List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: win-pv-devel-bounces@lists.xenproject.org Precedence: list Sender: "win-pv-devel" Authentication-Results: eu.smtp.expurgate.cloud; dkim=pass header.s=selector1 header.d=vates.tech header.i="@vates.tech" header.h="From:Subject:Date:Message-ID:To:Cc:MIME-Version:Content-Type:Feedback-ID" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=vates.tech; q=dns/txt; s=selector1; bh=EioS9mxHOV6zLEwfOBGRMJ6P32yn2HKsQph2dllgW/U=; h=from:subject:date:message-id:to:cc:mime-version:content-type:feedback-id; b=Q/pxW7W3A3APN4sKci/s2aLcoN+kkTyasl0FK1roYcjfa+N1GoHO1PQ65tg3U7MXgMi6u8h6w k559jIHCksihT1ynS+H4ex6X7Z/z9r8EDKmBp1CIRLsc12LTbzOizYNGHEAVUPT0qTxpRmg70a4 C8IbBmd5mwQeDjqKXnUJafXcx6x2zzTVPbGTv1hZjsJy402mO0z1tQ81cUXbnWp2Tq5gnpEjXzS WYvkCKMV0+mzJlqmC2OX0JvLzcyS7xuZe35M+/BHk+FpufFu6PpgKL42HEcFXIoU3eu0NaneVwO 93WOEkTJUAvZqQDbx5m56LdEpSyCEy7piiC6GHo+db4w== X-Zone-Loop: c6fba1da2a423334703864827ae6e3c9ac7972a2bdc7 x-campaign-type: default x-transaction-id: 8c824be4-40cf-4243-883b-d78ea1b06fef x-swg-uid: 01-c45d6747-e596-479b-8246-841004b6aa0f X-Mailer: Sweego Message-ID: <1779099870.8631fc262581453bbf619ec5b2062170.19e3a9da3de000f373@vates.tech> x-swg-bid: 1779099870.8631fc262581453bbf619ec5b2062170.19e3a9da3de000f373 Feedback-ID: default:8631fc262581453bbf619ec5b2062170:Sweego x-campaign-id: default x-client-id: 8631fc262581453bbf619ec5b2062170 X-Originating-IP: [37.26.189.201] From: Tu Dinh To: win-pv-devel@lists.xenproject.org Cc: Tu Dinh Subject: [PATCH MULTISERIES] Optimize Xen barriers Date: Mon, 18 May 2026 12:24:24 +0200 MIME-Version: 1.0 X-BM-Disclaimer: Yes Content-Type: multipart/alternative; boundary="-=Part.d7f.ea835c663b8ed469.19e3a9da188.d762024dec7abea7=-" X-Bm-Milter-Handled: 4ffbd6c1-ee69-4e1b-aabd-f977039bd3e2 X-Bm-Transport-Timestamp: 1779099869576 X-purgate-ID: tlsNG-bad1c0/1779099874-40D67A53-A18F6DAC/0/0 X-purgate-type: clean X-purgate-size: 985 ---=Part.d7f.ea835c663b8ed469.19e3a9da188.d762024dec7abea7=- Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable This series aims to optimize the use of memory barriers in all Windows PV drivers=2E Particularly, the following have been changed: * x86 is TSO and only needs a compiler barrier as read/write barriers=2E So the xen_* barriers in xen-types=2Eh don't always need to be KeMemoryBarrier (which is a full barrier using a locked instruction)=2E * Barriers right next to Interlocked* operations were deleted, as these operations serve as implicit full barriers=2E * Ring operations were converted acquire-release semantics instead of full barriers=2E * As a related change, LockThread tracking was conditioned to debug builds=2E -- Ngoc Tu Dinh | Vates XCP-ng Developer XCP-ng & Xen Orchestra - Vates = solutions web: https://vates=2Etech ---=Part.d7f.ea835c663b8ed469.19e3a9da188.d762024dec7abea7=--- From win-pv-devel-bounces@lists.xenproject.org Mon May 18 10:25:41 2026 Return-path: Envelope-to: archives@lists.xenproject.org Delivery-date: Mon, 18 May 2026 10:25:41 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1311749.1581868 (Exim 4.92) (envelope-from ) id 1wOvAL-0008BF-Jm; Mon, 18 May 2026 10:25:41 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1311749.1581868; Mon, 18 May 2026 10:25:41 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wOvAL-0008B8-FN; Mon, 18 May 2026 10:25:41 +0000 Received: by outflank-mailman (input) for mailman id 1311749; Mon, 18 May 2026 10:25:40 +0000 Received: from mx.expurgate.net ([195.190.135.10]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wOvAK-0008A4-CG for win-pv-devel@lists.xenproject.org; Mon, 18 May 2026 10:25:40 +0000 Received: from mx.expurgate.net (helo=localhost) by mx.expurgate.net with esmtp id 1wOvAJ-008cuD-O9 for win-pv-devel@lists.xenproject.org; Mon, 18 May 2026 12:25:39 +0200 Received: from [10.42.69.3] (helo=localhost) by localhost with ESMTP (eXpurgate MTA 0.9.1) (envelope-from ) id 6a0ae91e-bab6-0a2a0a5309dd-0a2a4503d79e-16 for ; Mon, 18 May 2026 12:25:39 +0200 Received: from [185.255.28.34] (helo=prod-mta-13.swg-srv.net) by tlsNG-33051d.mxtls.expurgate.net with ESMTPS (eXpurgate 4.56.1) (envelope-from ) id 6a0ae923-672d-0a2a45030019-b9ff1c22b1db-3 for ; Mon, 18 May 2026 12:25:39 +0200 Received: from mail2.vates.fr ([37.26.189.201] mail2.vates.fr) (Authenticated sender: 8631fc262581453bbf619ec5b2062170/smtp/7773de5a-2839-4720-82ee-e06722ae1d3e) by prod-mta-13.swg-srv.net (ZoneMTA - prod-mta-13) with ESMTPSA id 19e3a9ea7fd000f373.001 for (version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384); Mon, 18 May 2026 10:25:36 +0000 Received: from localhost.localdomain (155.223.66.37.rev.sfr.net [37.66.223.155]) (Authenticated sender: ngoc-tu.dinh@vates.tech) by mail2.vates.fr (Postfix) with ESMTPSA id 32D128108D; Mon, 18 May 2026 12:25:36 +0200 (CEST) X-BeenThere: win-pv-devel@lists.xenproject.org List-Id: Developer list for the Windows PV Drivers subproject List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: win-pv-devel-bounces@lists.xenproject.org Precedence: list Sender: "win-pv-devel" Authentication-Results: eu.smtp.expurgate.cloud; dkim=pass header.s=selector1 header.d=vates.tech header.i="@vates.tech" header.h="From:Subject:Date:Message-ID:To:Cc:MIME-Version:Content-Type:In-Reply-To:References:Feedback-ID" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=vates.tech; q=dns/txt; s=selector1; bh=PrtcdJW2+qWbyNHGtioxhNSpLXD7Eowv1+nYCzrnCAg=; h=from:subject:date:message-id:to:cc:mime-version:content-type:in-reply-to:references:feedback-id; b=DJNxUKaC+oJIlTnmuW/LhNFBu+SOf2WdBJU1dMJRrl09DxJ7wTg7HOqlUtMAua5l5/G1bQJT5 KY5R+Z0eFbMSzC2uSpvCJs7U9HpA5gWQjuuuC3VfHv7zZ0dkWoRTEsMvXVgJuTsfjcLUJ4mgzb5 +5AeD7mSZ7H4YLEm+fd5IeEV3UW197IVFrl39S9oSqnrFPM3Mb0Ff+jKv8wGwMNZ7IyaX33//27 BSIF6/tjaj10s9s4KYr2dwvE6EkAKyaXTYc9WALigY8Z7+yo3nMsQ/KvKBlIkoXk4vzB2p0WVR2 DbNMsMKvvWpqbo9Er3VM8HUJEFKowgzytg0sfj+PjYJg== X-Zone-Loop: 70c2b0503fccf2cf5eeec350458defda68e7cbf6bac0 x-campaign-type: default x-transaction-id: cadf4259-de08-45dc-8171-38ef5c882bac x-swg-uid: 01-35a275db-5fab-4570-a835-fac861c23bd0 X-Mailer: Sweego Message-ID: <1779099936.8631fc262581453bbf619ec5b2062170.19e3a9ea7fd000f373@vates.tech> x-swg-bid: 1779099936.8631fc262581453bbf619ec5b2062170.19e3a9ea7fd000f373 Feedback-ID: default:8631fc262581453bbf619ec5b2062170:Sweego x-campaign-id: default x-client-id: 8631fc262581453bbf619ec5b2062170 X-Originating-IP: [37.26.189.201] From: Tu Dinh To: win-pv-devel@lists.xenproject.org Cc: Tu Dinh Subject: [XENBUS PATCH 1/2] Reduce the strength of Xen barriers on x86 Date: Mon, 18 May 2026 12:25:20 +0200 In-Reply-To: <1779099870.8631fc262581453bbf619ec5b2062170.19e3a9da3de000f373@vates.tech> References: <1779099870.8631fc262581453bbf619ec5b2062170.19e3a9da3de000f373@vates.tech> MIME-Version: 1.0 X-BM-Disclaimer: Yes Content-Type: multipart/alternative; boundary="-=Part.d80.1626eab81a8df860.19e3a9ea632.c557f78050c7aaf4=-" X-Bm-Milter-Handled: 4ffbd6c1-ee69-4e1b-aabd-f977039bd3e2 X-Bm-Transport-Timestamp: 1779099936306 X-purgate-ID: tlsNG-33051d/1779099939-3B360938-0250BD36/0/0 X-purgate-type: clean X-purgate-size: 1152 ---=Part.d80.1626eab81a8df860.19e3a9ea632.c557f78050c7aaf4=- Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable x86 is TSO and only needs a compiler barrier as read/write barriers=2E Signed-off-by: Tu Dinh --- include/xen-types=2Eh | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/include/xen-types=2Eh b/include/xen-types=2Eh index e4c19a4=2E=2E3446ac7 100644 --- a/include/xen-types=2Eh +++ b/include/xen-types=2Eh @@ -47,4 +47,13 @@ typedef USHORT uint16_t; typedef ULONG uint32_t; typedef ULONG64 uint64_t; =20 +#define xen_mb() KeMemoryBarrier() +#if defined(_M_IX86) || defined(_M_X64) +#define xen_wmb() KeMemoryBarrierWithoutFence() +#define xen_rmb() KeMemoryBarrierWithoutFence() +#else +#define xen_wmb() KeMemoryBarrier() +#define xen_rmb() KeMemoryBarrier() +#endif + #endif // _XEN_TYPES_H --=20 2=2E54=2E0=2Ewindows=2E1 -- Ngoc Tu Dinh | Vates XCP-ng Developer XCP-ng & Xen Orchestra - Vates = solutions web: https://vates=2Etech ---=Part.d80.1626eab81a8df860.19e3a9ea632.c557f78050c7aaf4=--- From win-pv-devel-bounces@lists.xenproject.org Mon May 18 10:25:41 2026 Return-path: Envelope-to: archives@lists.xenproject.org Delivery-date: Mon, 18 May 2026 10:25:41 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1311752.1581876 (Exim 4.92) (envelope-from ) id 1wOvAL-0008CP-Tc; Mon, 18 May 2026 10:25:41 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1311752.1581876; Mon, 18 May 2026 10:25:41 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wOvAL-0008Bm-KL; Mon, 18 May 2026 10:25:41 +0000 Received: by outflank-mailman (input) for mailman id 1311752; Mon, 18 May 2026 10:25:40 +0000 Received: from mx.expurgate.net ([195.190.135.10]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wOvAK-0008AB-Ko for win-pv-devel@lists.xenproject.org; Mon, 18 May 2026 10:25:40 +0000 Received: from mx.expurgate.net (helo=localhost) by mx.expurgate.net with esmtp id 1wOvAK-007ub1-0k for win-pv-devel@lists.xenproject.org; Mon, 18 May 2026 12:25:40 +0200 Received: from [10.42.69.1] (helo=localhost) by localhost with ESMTP (eXpurgate MTA 0.9.1) (envelope-from ) id 6a0ae91d-2eae-0a2a0a5409dd-0a2a4501a19c-18 for ; Mon, 18 May 2026 12:25:39 +0200 Received: from [185.255.28.34] (helo=prod-mta-13.swg-srv.net) by tlsNG-d62444.mxtls.expurgate.net with ESMTPS (eXpurgate 4.56.1) (envelope-from ) id 6a0ae923-c1f2-0a2a45010019-b9ff1c229629-3 for ; Mon, 18 May 2026 12:25:39 +0200 Received: from mail2.vates.fr ([37.26.189.201] mail2.vates.fr) (Authenticated sender: 8631fc262581453bbf619ec5b2062170/smtp/7773de5a-2839-4720-82ee-e06722ae1d3e) by prod-mta-13.swg-srv.net (ZoneMTA - prod-mta-13) with ESMTPSA id 19e3a9ea99b000f373.001 for (version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384); Mon, 18 May 2026 10:25:37 +0000 Received: from localhost.localdomain (155.223.66.37.rev.sfr.net [37.66.223.155]) (Authenticated sender: ngoc-tu.dinh@vates.tech) by mail2.vates.fr (Postfix) with ESMTPSA id B29DF86313; Mon, 18 May 2026 12:25:36 +0200 (CEST) X-BeenThere: win-pv-devel@lists.xenproject.org List-Id: Developer list for the Windows PV Drivers subproject List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: win-pv-devel-bounces@lists.xenproject.org Precedence: list Sender: "win-pv-devel" Authentication-Results: eu.smtp.expurgate.cloud; dkim=pass header.s=selector1 header.d=vates.tech header.i="@vates.tech" header.h="From:Subject:Date:Message-ID:To:Cc:MIME-Version:Content-Type:In-Reply-To:References:Feedback-ID" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=vates.tech; q=dns/txt; s=selector1; bh=bkqiRWcEBfrnVaVTvGQFuQvNVEPU6+6zg9Q5FoGiAFM=; h=from:subject:date:message-id:to:cc:mime-version:content-type:in-reply-to:references:feedback-id; b=b773uOYksy4LTi7YHYaeZo/9p4rrqcrKleKHaBd+Agw0+aUUokIg1LY6liLRMtO/G+NiU0VKZ 6zVvtv0/a09dqWpl/EExNVZkl8u7BTSClrv0IIBniruxARyHqD7Brx501a2ZIvXNems+v89Yn3K tkMnE8qdY+XvQvgMBB9aB0Cyf/a2TLVojR2w2oN2oXkRqpltzT17yMly/64bMVScj7bOZBpa1Yk GGNu2/3t6FQtCCldZTvpRRdIWjIzW8mQLyR7FXjht4a0SQaXs6bq7TrJ0kqXu2PBaXDlUiRnxza l9S4kTz7OQQz7Kupr7NBWTZf+vW/3nABiKFFlXC3xbqw== X-Zone-Loop: 97a5aba85d474fe424b3a99d46164c0790a36ef46330 x-campaign-type: default x-transaction-id: cb7d7b21-440d-49e7-8bf4-d1e6f33f3a34 x-swg-uid: 01-89dd8800-86cf-41f0-bb8f-c14e317e9550 X-Mailer: Sweego Message-ID: <1779099937.8631fc262581453bbf619ec5b2062170.19e3a9ea99b000f373@vates.tech> x-swg-bid: 1779099937.8631fc262581453bbf619ec5b2062170.19e3a9ea99b000f373 Feedback-ID: default:8631fc262581453bbf619ec5b2062170:Sweego x-campaign-id: default x-client-id: 8631fc262581453bbf619ec5b2062170 X-Originating-IP: [37.26.189.201] From: Tu Dinh To: win-pv-devel@lists.xenproject.org Cc: Tu Dinh Subject: [XENCONS PATCH] Reduce the strength of Xen barriers on x86 Date: Mon, 18 May 2026 12:25:22 +0200 In-Reply-To: <20260518102530.873-1-ngoc-tu.dinh@vates.tech> References: <1779099870.8631fc262581453bbf619ec5b2062170.19e3a9da3de000f373@vates.tech> <20260518102530.873-1-ngoc-tu.dinh@vates.tech> MIME-Version: 1.0 X-BM-Disclaimer: Yes Content-Type: multipart/alternative; boundary="-=Part.d82.e631e700fd1f22d8.19e3a9ea836.37d65932a25b7076=-" X-Bm-Milter-Handled: 4ffbd6c1-ee69-4e1b-aabd-f977039bd3e2 X-Bm-Transport-Timestamp: 1779099936822 X-purgate-ID: tlsNG-d62444/1779099939-AF957FF4-43A0C80D/0/0 X-purgate-type: clean X-purgate-size: 1179 ---=Part.d82.e631e700fd1f22d8.19e3a9ea836.37d65932a25b7076=- Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable x86 is TSO and only needs a compiler barrier as read/write barriers=2E Signed-off-by: Tu Dinh --- include/xen-types=2Eh | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/include/xen-types=2Eh b/include/xen-types=2Eh index 6eb8693=2E=2Eb618af2 100644 --- a/include/xen-types=2Eh +++ b/include/xen-types=2Eh @@ -48,7 +48,12 @@ typedef ULONG uint32_t; typedef ULONG64 uint64_t; =20 #define xen_mb() KeMemoryBarrier() +#if defined(_M_IX86) || defined(_M_X64) +#define xen_wmb() KeMemoryBarrierWithoutFence() +#define xen_rmb() KeMemoryBarrierWithoutFence() +#else #define xen_wmb() KeMemoryBarrier() -#define xen_rmb() KememoryBarrier() +#define xen_rmb() KeMemoryBarrier() +#endif =20 #endif // _XEN_TYPES_H --=20 2=2E54=2E0=2Ewindows=2E1 -- Ngoc Tu Dinh | Vates XCP-ng Developer XCP-ng & Xen Orchestra - Vates = solutions web: https://vates=2Etech ---=Part.d82.e631e700fd1f22d8.19e3a9ea836.37d65932a25b7076=--- From win-pv-devel-bounces@lists.xenproject.org Mon May 18 10:25:42 2026 Return-path: Envelope-to: archives@lists.xenproject.org Delivery-date: Mon, 18 May 2026 10:25:42 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1311750.1581879 (Exim 4.92) (envelope-from ) id 1wOvAL-0008Bb-U6; Mon, 18 May 2026 10:25:41 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1311750.1581879; Mon, 18 May 2026 10:25:41 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wOvAL-0008BJ-Gd; Mon, 18 May 2026 10:25:41 +0000 Received: by outflank-mailman (input) for mailman id 1311750; Mon, 18 May 2026 10:25:40 +0000 Received: from mx.expurgate.net ([195.190.135.10]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wOvAK-0008A5-HQ for win-pv-devel@lists.xenproject.org; Mon, 18 May 2026 10:25:40 +0000 Received: from mx.expurgate.net (helo=localhost) by mx.expurgate.net with esmtp id 1wOvAJ-008cuD-TM for win-pv-devel@lists.xenproject.org; Mon, 18 May 2026 12:25:39 +0200 Received: from [10.42.69.3] (helo=localhost) by localhost with ESMTP (eXpurgate MTA 0.9.1) (envelope-from ) id 6a0ae91e-bab6-0a2a0a5309dd-0a2a4503d79e-18 for ; Mon, 18 May 2026 12:25:39 +0200 Received: from [185.255.28.34] (helo=prod-mta-13.swg-srv.net) by tlsNG-33051d.mxtls.expurgate.net with ESMTPS (eXpurgate 4.56.1) (envelope-from ) id 6a0ae923-672d-0a2a45030019-b9ff1c22b1db-4 for ; Mon, 18 May 2026 12:25:39 +0200 Received: from mail2.vates.fr ([37.26.189.201] mail2.vates.fr) (Authenticated sender: 8631fc262581453bbf619ec5b2062170/smtp/7773de5a-2839-4720-82ee-e06722ae1d3e) by prod-mta-13.swg-srv.net (ZoneMTA - prod-mta-13) with ESMTPSA id 19e3a9eac01000f373.001 for (version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384); Mon, 18 May 2026 10:25:37 +0000 Received: from localhost.localdomain (155.223.66.37.rev.sfr.net [37.66.223.155]) (Authenticated sender: ngoc-tu.dinh@vates.tech) by mail2.vates.fr (Postfix) with ESMTPSA id 59CDC86313; Mon, 18 May 2026 12:25:37 +0200 (CEST) X-BeenThere: win-pv-devel@lists.xenproject.org List-Id: Developer list for the Windows PV Drivers subproject List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: win-pv-devel-bounces@lists.xenproject.org Precedence: list Sender: "win-pv-devel" Authentication-Results: eu.smtp.expurgate.cloud; dkim=pass header.s=selector1 header.d=vates.tech header.i="@vates.tech" header.h="From:Subject:Date:Message-ID:To:Cc:MIME-Version:Content-Type:In-Reply-To:References:Feedback-ID" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=vates.tech; q=dns/txt; s=selector1; bh=bspkFQZBhIgNB/IC5YhYJY1OSFO5ftWiFlomfsEMQHs=; h=from:subject:date:message-id:to:cc:mime-version:content-type:in-reply-to:references:feedback-id; b=fWLZHfSC8Hr75FyWkChJRN5U9tuqaV0hQLm/g6yl3PpMNLJWY4Jqzzj8Dd2+EUppeidDnN22c yLJNpZdLAjC7Am/zESzciHqLrYD2WyjdeSr9feOSHW6jTMsRbDg008WZ6SWLnGhgVhyv9tAXQ8i 1f967k6kWatKPEYkxWpoTxp1NTZOKZ1NvxJ6ugmRJ9A+GeVKvVkvmBoKsQ9mwUT7vglOAN+h2WG R8U5u4Gchdw9GR5C5ooKjaYGHaoSyyyERl+qvmakj1oa6iLqhy5/83D2eIcQsdW9XYVyS5i+5Ru vmq3OuywkgfHJtc6WStD8AJEfquGWHjqvklM+xTCoNPg== X-Zone-Loop: db9e850d9c0dacea164762eb4c1ea7c84db4d5fae1bd x-campaign-type: default x-transaction-id: 5cdca112-3ba4-47a8-ab92-07945a1a01ba x-swg-uid: 01-ad99ea05-ae52-46a7-ae6b-5d81367eb3c0 X-Mailer: Sweego Message-ID: <1779099937.8631fc262581453bbf619ec5b2062170.19e3a9eac01000f373@vates.tech> x-swg-bid: 1779099937.8631fc262581453bbf619ec5b2062170.19e3a9eac01000f373 Feedback-ID: default:8631fc262581453bbf619ec5b2062170:Sweego x-campaign-id: default x-client-id: 8631fc262581453bbf619ec5b2062170 X-Originating-IP: [37.26.189.201] From: Tu Dinh To: win-pv-devel@lists.xenproject.org Cc: Tu Dinh Subject: [XENVBD PATCH 2/3] Reduce the strength of Xen barriers on x86 Date: Mon, 18 May 2026 12:25:25 +0200 In-Reply-To: <20260518102530.873-1-ngoc-tu.dinh@vates.tech> References: <1779099870.8631fc262581453bbf619ec5b2062170.19e3a9da3de000f373@vates.tech> <20260518102530.873-1-ngoc-tu.dinh@vates.tech> MIME-Version: 1.0 X-BM-Disclaimer: Yes Content-Type: multipart/alternative; boundary="-=Part.d85.d2a85fa75dd055c7.19e3a9eaa8c.836415edd8b85805=-" X-Bm-Milter-Handled: 4ffbd6c1-ee69-4e1b-aabd-f977039bd3e2 X-Bm-Transport-Timestamp: 1779099937421 X-purgate-ID: tlsNG-33051d/1779099939-41794938-9C942984/0/0 X-purgate-type: clean X-purgate-size: 1682 ---=Part.d85.d2a85fa75dd055c7.19e3a9eaa8c.836415edd8b85805=- Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable x86 is TSO and only needs a compiler barrier as read/write barriers=2E Signed-off-by: Tu Dinh --- include/xen-types=2Eh | 9 +++++++++ src/xenvbd/ring=2Ec | 3 --- 2 files changed, 9 insertions(+), 3 deletions(-) diff --git a/include/xen-types=2Eh b/include/xen-types=2Eh index 40f7c27=2E=2E0f53af3 100644 --- a/include/xen-types=2Eh +++ b/include/xen-types=2Eh @@ -47,4 +47,13 @@ typedef USHORT uint16_t; typedef ULONG uint32_t; typedef ULONG64 uint64_t; =20 +#define xen_mb() KeMemoryBarrier() +#if defined(_M_IX86) || defined(_M_X64) +#define xen_wmb() KeMemoryBarrierWithoutFence() +#define xen_rmb() KeMemoryBarrierWithoutFence() +#else +#define xen_wmb() KeMemoryBarrier() +#define xen_rmb() KeMemoryBarrier() +#endif + #endif // _XEN_TYPES_H diff --git a/src/xenvbd/ring=2Ec b/src/xenvbd/ring=2Ec index 5a8f236=2E=2E205e93a 100644 --- a/src/xenvbd/ring=2Ec +++ b/src/xenvbd/ring=2Ec @@ -57,9 +57,6 @@ #define XENVBD_MAX_RING_PAGE_ORDER (4) #define XENVBD_MAX_RING_PAGES (1 << XENVBD_MAX_RING_PAGE_ORDER) =20 -#define xen_mb KeMemoryBarrier -#define xen_wmb KeMemoryBarrier - typedef struct _XENVBD_BLKIF_RING { PXENVBD_RING Ring; ULONG Index; --=20 2=2E54=2E0=2Ewindows=2E1 -- Ngoc Tu Dinh | Vates XCP-ng Developer XCP-ng & Xen Orchestra - Vates = solutions web: https://vates=2Etech ---=Part.d85.d2a85fa75dd055c7.19e3a9eaa8c.836415edd8b85805=--- From win-pv-devel-bounces@lists.xenproject.org Mon May 18 10:25:42 2026 Return-path: Envelope-to: archives@lists.xenproject.org Delivery-date: Mon, 18 May 2026 10:25:42 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1311751.1581874 (Exim 4.92) (envelope-from ) id 1wOvAL-0008C1-Tf; Mon, 18 May 2026 10:25:41 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1311751.1581874; Mon, 18 May 2026 10:25:41 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wOvAL-0008BX-IM; Mon, 18 May 2026 10:25:41 +0000 Received: by outflank-mailman (input) for mailman id 1311751; Mon, 18 May 2026 10:25:40 +0000 Received: from mx.expurgate.net ([195.190.135.10]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wOvAK-0008AA-KU for win-pv-devel@lists.xenproject.org; Mon, 18 May 2026 10:25:40 +0000 Received: from mx.expurgate.net (helo=localhost) by mx.expurgate.net with esmtp id 1wOvAK-00FbzK-0R for win-pv-devel@lists.xenproject.org; Mon, 18 May 2026 12:25:40 +0200 Received: from [10.42.69.12] (helo=localhost) by localhost with ESMTP (eXpurgate MTA 0.9.1) (envelope-from ) id 6a0ae91f-5cb7-0a2a0a5109dd-0a2a450cb130-8 for ; Mon, 18 May 2026 12:25:39 +0200 Received: from [185.255.28.34] (helo=prod-mta-13.swg-srv.net) by tlsNG-d25034.mxtls.expurgate.net with ESMTPS (eXpurgate 4.56.1) (envelope-from ) id 6a0ae923-62f1-0a2a450c0019-b9ff1c22a005-3 for ; Mon, 18 May 2026 12:25:39 +0200 Received: from mail2.vates.fr ([37.26.189.201] mail2.vates.fr) (Authenticated sender: 8631fc262581453bbf619ec5b2062170/smtp/7773de5a-2839-4720-82ee-e06722ae1d3e) by prod-mta-13.swg-srv.net (ZoneMTA - prod-mta-13) with ESMTPSA id 19e3a9ea8c2000f373.001 for (version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384); Mon, 18 May 2026 10:25:36 +0000 Received: from localhost.localdomain (155.223.66.37.rev.sfr.net [37.66.223.155]) (Authenticated sender: ngoc-tu.dinh@vates.tech) by mail2.vates.fr (Postfix) with ESMTPSA id 83C76861E7; Mon, 18 May 2026 12:25:36 +0200 (CEST) X-BeenThere: win-pv-devel@lists.xenproject.org List-Id: Developer list for the Windows PV Drivers subproject List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: win-pv-devel-bounces@lists.xenproject.org Precedence: list Sender: "win-pv-devel" Authentication-Results: eu.smtp.expurgate.cloud; dkim=pass header.s=selector1 header.d=vates.tech header.i="@vates.tech" header.h="From:Subject:Date:Message-ID:To:Cc:MIME-Version:Content-Type:In-Reply-To:References:Feedback-ID" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=vates.tech; q=dns/txt; s=selector1; bh=aQHTEYH/8DTNVQsulV5O/D2NKLp9ffvbR2UZJGZqRpQ=; h=from:subject:date:message-id:to:cc:mime-version:content-type:in-reply-to:references:feedback-id; b=P8k1HaQGD1VdOWKGhVjg3jJZbtgx+VCN3ZOHEv0SK2iL/4TtrL2yPLXdtuLY9t86Kg9sjrHF8 T6hid0ApI9H0widYeFf52SSzPoVgHzer/oShTOc08rkm7zpyCsGAYZeaJntmzBCI9rIdSgzG1bb /V/S6LQf5IZlPgPNvU/kklFYl9b/5qmdo8Z8YAF//Nzr1d5ZUAsaHRastlgJHabxAED2ZAAYQWo 3C4xQ+bj3ztEugbEOTYTwAc99QjpndOr02PTs1PUJ0FYxvI8GyW6RehOD9riYbCKgNHKmF44U8s LHP0Zi40Yy8hf0/1mjL0yqjJEExoiRZdwrqd9RoTmTqQ== X-Zone-Loop: d7118a64b6360dd60dbd57ddaf44d6b242f8aaff2880 x-campaign-type: default x-transaction-id: 53106281-9001-49e9-99fd-bbfba83e2bf0 x-swg-uid: 01-bd57703b-8b93-4fab-86bb-04763d9ab85e X-Mailer: Sweego Message-ID: <1779099937.8631fc262581453bbf619ec5b2062170.19e3a9ea8c2000f373@vates.tech> x-swg-bid: 1779099937.8631fc262581453bbf619ec5b2062170.19e3a9ea8c2000f373 Feedback-ID: default:8631fc262581453bbf619ec5b2062170:Sweego x-campaign-id: default x-client-id: 8631fc262581453bbf619ec5b2062170 X-Originating-IP: [37.26.189.201] From: Tu Dinh To: win-pv-devel@lists.xenproject.org Cc: Tu Dinh Subject: [XENBUS PATCH 2/2] Remove barriers in Acquire/ReleaseHighLock Date: Mon, 18 May 2026 12:25:21 +0200 In-Reply-To: <20260518102530.873-1-ngoc-tu.dinh@vates.tech> References: <1779099870.8631fc262581453bbf619ec5b2062170.19e3a9da3de000f373@vates.tech> <20260518102530.873-1-ngoc-tu.dinh@vates.tech> MIME-Version: 1.0 X-BM-Disclaimer: Yes Content-Type: multipart/alternative; boundary="-=Part.d81.6ecc6b6a0a85cc71.19e3a9ea745.f6d6aee571ba8f2f=-" X-Bm-Milter-Handled: 4ffbd6c1-ee69-4e1b-aabd-f977039bd3e2 X-Bm-Transport-Timestamp: 1779099936581 X-purgate-ID: tlsNG-d25034/1779099939-DB57FCF5-CFD1C561/0/0 X-purgate-type: clean X-purgate-size: 1098 ---=Part.d81.6ecc6b6a0a85cc71.19e3a9ea745.f6d6aee571ba8f2f=- Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable InterlockedCompareExchange/InterlockedExchange are already full barriers=2E Signed-off-by: Tu Dinh --- src/common/high=2Eh | 4 ---- 1 file changed, 4 deletions(-) diff --git a/src/common/high=2Eh b/src/common/high=2Eh index 4e21f5b=2E=2Ebdebc7f 100644 --- a/src/common/high=2Eh +++ b/src/common/high=2Eh @@ -57,8 +57,6 @@ __AcquireHighLock( while (InterlockedCompareExchange(Lock, LOCK_MAGIC, 0) !=3D 0) _mm_pause(); =20 - KeMemoryBarrier(); - return Irql; } =20 @@ -75,8 +73,6 @@ ReleaseHighLock( _In_ _IRQL_restores_ KIRQL Irql ) { - KeMemoryBarrier(); - InterlockedExchange(Lock, 0); KeLowerIrql(Irql); } --=20 2=2E54=2E0=2Ewindows=2E1 -- Ngoc Tu Dinh | Vates XCP-ng Developer XCP-ng & Xen Orchestra - Vates = solutions web: https://vates=2Etech ---=Part.d81.6ecc6b6a0a85cc71.19e3a9ea745.f6d6aee571ba8f2f=--- From win-pv-devel-bounces@lists.xenproject.org Mon May 18 10:25:42 2026 Return-path: Envelope-to: archives@lists.xenproject.org Delivery-date: Mon, 18 May 2026 10:25:42 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1311753.1581883 (Exim 4.92) (envelope-from ) id 1wOvAM-0008DR-26; Mon, 18 May 2026 10:25:42 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1311753.1581883; Mon, 18 May 2026 10:25:41 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wOvAL-0008CE-MX; Mon, 18 May 2026 10:25:41 +0000 Received: by outflank-mailman (input) for mailman id 1311753; Mon, 18 May 2026 10:25:40 +0000 Received: from mx.expurgate.net ([195.190.135.10]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wOvAK-0008AC-Le for win-pv-devel@lists.xenproject.org; Mon, 18 May 2026 10:25:40 +0000 Received: from mx.expurgate.net (helo=localhost) by mx.expurgate.net with esmtp id 1wOvAK-00FbzK-1N for win-pv-devel@lists.xenproject.org; Mon, 18 May 2026 12:25:40 +0200 Received: from [10.42.69.2] (helo=localhost) by localhost with ESMTP (eXpurgate MTA 0.9.1) (envelope-from ) id 6a0ae91b-5cb7-0a2a0a5109dd-0a2a4502cdbe-30 for ; Mon, 18 May 2026 12:25:39 +0200 Received: from [185.255.28.34] (helo=prod-mta-13.swg-srv.net) by tlsNG-720697.mxtls.expurgate.net with ESMTPS (eXpurgate 4.56.1) (envelope-from ) id 6a0ae923-af86-0a2a45020019-b9ff1c22b6b9-3 for ; Mon, 18 May 2026 12:25:39 +0200 Received: from mail2.vates.fr ([37.26.189.201] mail2.vates.fr) (Authenticated sender: 8631fc262581453bbf619ec5b2062170/smtp/7773de5a-2839-4720-82ee-e06722ae1d3e) by prod-mta-13.swg-srv.net (ZoneMTA - prod-mta-13) with ESMTPSA id 19e3a9eab3b000f373.001 for (version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384); Mon, 18 May 2026 10:25:37 +0000 Received: from localhost.localdomain (155.223.66.37.rev.sfr.net [37.66.223.155]) (Authenticated sender: ngoc-tu.dinh@vates.tech) by mail2.vates.fr (Postfix) with ESMTPSA id 2DADF8637A; Mon, 18 May 2026 12:25:37 +0200 (CEST) X-BeenThere: win-pv-devel@lists.xenproject.org List-Id: Developer list for the Windows PV Drivers subproject List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: win-pv-devel-bounces@lists.xenproject.org Precedence: list Sender: "win-pv-devel" Authentication-Results: eu.smtp.expurgate.cloud; dkim=pass header.s=selector1 header.d=vates.tech header.i="@vates.tech" header.h="From:Subject:Date:Message-ID:To:Cc:MIME-Version:Content-Type:In-Reply-To:References:Feedback-ID" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=vates.tech; q=dns/txt; s=selector1; bh=TZSDGS0/47vrWZDc/aImT4e9mCSB5UeKGuqD0AzxICQ=; h=from:subject:date:message-id:to:cc:mime-version:content-type:in-reply-to:references:feedback-id; b=lq2SjfKrqUu+oFEY0Dezutidwr9B7fslG+B7LWEFRMIMgVEQCZF4gpOsGrIsh2HLgPTpd8rl1 tE0+ioUt3gdrEBZSqlo7wrZv/vYXxi+Tvn9bYAL/WGYBZKzCVsLagSu6JTLp3vmjGwuij1rE7x5 WA6Ly3PODPcEmKYq1/ukK0AUaWOVqeO0hAJxLqRNF6vF1/8hhLzgPtitBVMTimWa0OVsUYHNYSE uyOCHxNpEZB+6G8/QtoDqaSn5tlKH9ndOu2J0hbo44wTaFz2ZttEZHM1VeyM2RMHeJnbPlSL4pU vlVRtWg/H2mN/+fy8l8C9GsKUDVefllcU6uTRnsHYeQA== X-Zone-Loop: a9ee3d999ee42b264f94bdcea32a2bc03b98473a287f x-campaign-type: default x-transaction-id: d22494bc-b2d7-4b55-8aaa-908d6f8b11e8 x-swg-uid: 01-9126e773-b61c-4fcf-9b40-9ce954a3d15a X-Mailer: Sweego Message-ID: <1779099937.8631fc262581453bbf619ec5b2062170.19e3a9eab3b000f373@vates.tech> x-swg-bid: 1779099937.8631fc262581453bbf619ec5b2062170.19e3a9eab3b000f373 Feedback-ID: default:8631fc262581453bbf619ec5b2062170:Sweego x-campaign-id: default x-client-id: 8631fc262581453bbf619ec5b2062170 X-Originating-IP: [37.26.189.201] From: Tu Dinh To: win-pv-devel@lists.xenproject.org Cc: Tu Dinh Subject: [XENVBD PATCH 1/3] ring: Remove LockThread tracking from release builds Date: Mon, 18 May 2026 12:25:24 +0200 In-Reply-To: <20260518102530.873-1-ngoc-tu.dinh@vates.tech> References: <1779099870.8631fc262581453bbf619ec5b2062170.19e3a9da3de000f373@vates.tech> <20260518102530.873-1-ngoc-tu.dinh@vates.tech> MIME-Version: 1.0 X-BM-Disclaimer: Yes Content-Type: multipart/alternative; boundary="-=Part.d84.fa3df17471c9f615.19e3a9ea9d8.59678ae944d40ef6=-" X-Bm-Milter-Handled: 4ffbd6c1-ee69-4e1b-aabd-f977039bd3e2 X-Bm-Transport-Timestamp: 1779099937240 X-purgate-ID: tlsNG-720697/1779099939-8137C161-14447D56/0/0 X-purgate-type: clean X-purgate-size: 2511 ---=Part.d84.fa3df17471c9f615.19e3a9ea9d8.59678ae944d40ef6=- Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable LockThread is not used for anything besides debugging=2E Move the current code managing LockThread into a debug-only #ifdef=2E Signed-off-by: Tu Dinh --- src/xenvbd/ring=2Ec | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/src/xenvbd/ring=2Ec b/src/xenvbd/ring=2Ec index 625675d=2E=2E5a8f236 100644 --- a/src/xenvbd/ring=2Ec +++ b/src/xenvbd/ring=2Ec @@ -79,7 +79,9 @@ typedef struct _XENVBD_BLKIF_RING { BOOLEAN Enabled; BOOLEAN Stopped; PVOID Lock; +#if DBG PKTHREAD LockThread; +#endif LIST_ENTRY SrbQueue; LIST_ENTRY PreparedQueue; LIST_ENTRY SubmittedList; @@ -1322,7 +1324,9 @@ BlkifRingSwizzle( LIST_ENTRY List; ULONG Count; =20 +#if DBG ASSERT3P(BlkifRing->LockThread, =3D=3D , KeGetCurrentThread()); +#endif =20 InitializeListHead(&List); =20 @@ -1465,11 +1469,13 @@ __BlkifRingTryAcquireLock( =20 KeMemoryBarrier(); =20 +#if DBG if (Acquired) { ASSERT3P(BlkifRing->LockThread, =3D=3D , NULL); BlkifRing->LockThread =3D KeGetCurrentThread(); KeMemoryBarrier(); } +#endif =20 return Acquired; } @@ -1508,13 +1514,17 @@ __BlkifRingTryReleaseLock( ULONG_PTR New; BOOLEAN Released; =20 +#if DBG ASSERT3U(KeGetCurrentIrql(), =3D=3D , DISPATCH_LEVEL); ASSERT3P(KeGetCurrentThread(), =3D=3D , BlkifRing->LockThread); +#endif =20 Old =3D XENVBD_LOCK_BIT; New =3D 0; =20 +#if DBG BlkifRing->LockThread =3D NULL; +#endif =20 KeMemoryBarrier(); =20 @@ -1524,11 +1534,13 @@ __BlkifRingTryReleaseLock( =20 KeMemoryBarrier(); =20 +#if DBG if (!Released) { ASSERT3P(BlkifRing->LockThread, =3D=3D , NULL); BlkifRing->LockThread =3D KeGetCurrentThread(); KeMemoryBarrier(); } +#endif =20 return Released; } --=20 2=2E54=2E0=2Ewindows=2E1 -- Ngoc Tu Dinh | Vates XCP-ng Developer XCP-ng & Xen Orchestra - Vates = solutions web: https://vates=2Etech ---=Part.d84.fa3df17471c9f615.19e3a9ea9d8.59678ae944d40ef6=--- From win-pv-devel-bounces@lists.xenproject.org Mon May 18 10:25:43 2026 Return-path: Envelope-to: archives@lists.xenproject.org Delivery-date: Mon, 18 May 2026 10:25:43 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1311754.1581888 (Exim 4.92) (envelope-from ) id 1wOvAM-0008IY-Vv; Mon, 18 May 2026 10:25:42 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1311754.1581888; Mon, 18 May 2026 10:25:42 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wOvAM-0008IQ-R1; Mon, 18 May 2026 10:25:42 +0000 Received: by outflank-mailman (input) for mailman id 1311754; Mon, 18 May 2026 10:25:40 +0000 Received: from mx.expurgate.net ([195.190.135.10]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wOvAK-0008AI-PP for win-pv-devel@lists.xenproject.org; Mon, 18 May 2026 10:25:40 +0000 Received: from mx.expurgate.net (helo=localhost) by mx.expurgate.net with esmtp id 1wOvAK-00FbzK-5N for win-pv-devel@lists.xenproject.org; Mon, 18 May 2026 12:25:40 +0200 Received: from [10.42.69.12] (helo=localhost) by localhost with ESMTP (eXpurgate MTA 0.9.1) (envelope-from ) id 6a0ae91f-5cb7-0a2a0a5109dd-0a2a450cb130-10 for ; Mon, 18 May 2026 12:25:40 +0200 Received: from [185.255.28.34] (helo=prod-mta-13.swg-srv.net) by tlsNG-d25034.mxtls.expurgate.net with ESMTPS (eXpurgate 4.56.1) (envelope-from ) id 6a0ae923-62f1-0a2a450c0019-b9ff1c22a005-4 for ; Mon, 18 May 2026 12:25:40 +0200 Received: from mail2.vates.fr ([37.26.189.201] mail2.vates.fr) (Authenticated sender: 8631fc262581453bbf619ec5b2062170/smtp/7773de5a-2839-4720-82ee-e06722ae1d3e) by prod-mta-13.swg-srv.net (ZoneMTA - prod-mta-13) with ESMTPSA id 19e3a9ead6c000f373.001 for (version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384); Mon, 18 May 2026 10:25:38 +0000 Received: from localhost.localdomain (155.223.66.37.rev.sfr.net [37.66.223.155]) (Authenticated sender: ngoc-tu.dinh@vates.tech) by mail2.vates.fr (Postfix) with ESMTPSA id B5BA98637A; Mon, 18 May 2026 12:25:37 +0200 (CEST) X-BeenThere: win-pv-devel@lists.xenproject.org List-Id: Developer list for the Windows PV Drivers subproject List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: win-pv-devel-bounces@lists.xenproject.org Precedence: list Sender: "win-pv-devel" Authentication-Results: eu.smtp.expurgate.cloud; dkim=pass header.s=selector1 header.d=vates.tech header.i="@vates.tech" header.h="From:Subject:Date:Message-ID:To:Cc:MIME-Version:Content-Type:In-Reply-To:References:Feedback-ID" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=vates.tech; q=dns/txt; s=selector1; bh=tIWM+A8HIf+QWMk/ROg2sq6M4JMP9zHHX4uFcI606F4=; h=from:subject:date:message-id:to:cc:mime-version:content-type:in-reply-to:references:feedback-id; b=h6XQdiSIEhA6jMPujAN0eMmT0CmDTphe0lRJOqGFjAZLuiCo7c6S7wVdhJHL0Na8XweN6TZ1a P8iJbrDpanSuRf3KCGpX9eurtWn4W73cvI0U/s7lgCRQD+OfL/86fyPsGbQjcP5obOG1WhmefN6 HynayGe7akiL0C+gN569C7E2kFgP2YqWr4xVD5Pw66OZMnasCrQupUPNFtPypoyBAM9qtQo30kP fnAgmcmR6+o56dJoLfAnje+AdsuLn1k8qCC02CJ8oBPqGUj/1DJJrGaI+9klrsOnNpWXbj34Bh9 6gciZkkg5SYv2ielTSCrXLyp99DlYG9VUAqG0KZb0+4Q== X-Zone-Loop: 9e63d64cd93d5959f4472325a15b54598cc1a756d27f x-campaign-type: default x-transaction-id: f3052cb2-e406-463b-8f4b-5f5a596b2f18 x-swg-uid: 01-e766cae0-48d4-4188-845f-5f735a761248 X-Mailer: Sweego Message-ID: <1779099938.8631fc262581453bbf619ec5b2062170.19e3a9ead6c000f373@vates.tech> x-swg-bid: 1779099938.8631fc262581453bbf619ec5b2062170.19e3a9ead6c000f373 Feedback-ID: default:8631fc262581453bbf619ec5b2062170:Sweego x-campaign-id: default x-client-id: 8631fc262581453bbf619ec5b2062170 X-Originating-IP: [37.26.189.201] From: Tu Dinh To: win-pv-devel@lists.xenproject.org Cc: Tu Dinh Subject: [XENVIF PATCH 1/3] transmitter: Remove LockThread tracking from release builds Date: Mon, 18 May 2026 12:25:27 +0200 In-Reply-To: <20260518102530.873-1-ngoc-tu.dinh@vates.tech> References: <1779099870.8631fc262581453bbf619ec5b2062170.19e3a9da3de000f373@vates.tech> <20260518102530.873-1-ngoc-tu.dinh@vates.tech> MIME-Version: 1.0 X-BM-Disclaimer: Yes Content-Type: multipart/alternative; boundary="-=Part.d87.9205124a3b10d2d1.19e3a9eac05.59203773ecd06573=-" X-Bm-Milter-Handled: 4ffbd6c1-ee69-4e1b-aabd-f977039bd3e2 X-Bm-Transport-Timestamp: 1779099937797 X-purgate-ID: tlsNG-d25034/1779099940-E1161CF5-F95FDAF9/0/0 X-purgate-type: clean X-purgate-size: 2533 ---=Part.d87.9205124a3b10d2d1.19e3a9eac05.59203773ecd06573=- Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable LockThread is not used for anything besides debugging=2E Move the current code managing LockThread into a debug-only #ifdef=2E Signed-off-by: Tu Dinh --- src/xenvif/transmitter=2Ec | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/src/xenvif/transmitter=2Ec b/src/xenvif/transmitter=2Ec index 58f8575=2E=2E1425058 100644 --- a/src/xenvif/transmitter=2Ec +++ b/src/xenvif/transmitter=2Ec @@ -188,7 +188,9 @@ typedef struct _XENVIF_TRANSMITTER_RING { BOOLEAN Enabled; BOOLEAN Stopped; PVOID Lock; +#if DBG PKTHREAD LockThread; +#endif LIST_ENTRY PacketQueue; LIST_ENTRY RequestQueue; XENVIF_TRANSMITTER_STATE State; @@ -2733,7 +2735,9 @@ TransmitterRingSwizzle( LIST_ENTRY List; ULONG Count; =20 +#if DBG ASSERT3P(Ring->LockThread, =3D=3D, KeGetCurrentThread()); +#endif =20 InitializeListHead(&List); =20 @@ -3121,11 +3125,13 @@ __TransmitterRingTryAcquireLock( =20 KeMemoryBarrier(); =20 +#if DBG if (Acquired) { ASSERT3P(Ring->LockThread, =3D=3D, NULL); Ring->LockThread =3D KeGetCurrentThread(); KeMemoryBarrier(); } +#endif =20 return Acquired; } @@ -3166,12 +3172,16 @@ __TransmitterRingTryReleaseLock( BOOLEAN Released; =20 ASSERT3U(KeGetCurrentIrql(), =3D=3D, DISPATCH_LEVEL); +#if DBG ASSERT3P(KeGetCurrentThread(), =3D=3D, Ring->LockThread); +#endif =20 Old =3D XENVIF_TRANSMITTER_LOCK_BIT; New =3D 0; =20 +#if DBG Ring->LockThread =3D NULL; +#endif =20 KeMemoryBarrier(); =20 @@ -3181,11 +3191,13 @@ __TransmitterRingTryReleaseLock( =20 KeMemoryBarrier(); =20 +#if DBG if (!Released) { ASSERT3P(Ring->LockThread, =3D=3D, NULL); Ring->LockThread =3D KeGetCurrentThread(); KeMemoryBarrier(); } +#endif =20 return Released; } --=20 2=2E54=2E0=2Ewindows=2E1 -- Ngoc Tu Dinh | Vates XCP-ng Developer XCP-ng & Xen Orchestra - Vates = solutions web: https://vates=2Etech ---=Part.d87.9205124a3b10d2d1.19e3a9eac05.59203773ecd06573=--- From win-pv-devel-bounces@lists.xenproject.org Mon May 18 10:25:43 2026 Return-path: Envelope-to: archives@lists.xenproject.org Delivery-date: Mon, 18 May 2026 10:25:43 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1311756.1581892 (Exim 4.92) (envelope-from ) id 1wOvAN-0008K1-4C; Mon, 18 May 2026 10:25:43 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1311756.1581892; Mon, 18 May 2026 10:25:43 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wOvAN-0008JK-0a; Mon, 18 May 2026 10:25:43 +0000 Received: by outflank-mailman (input) for mailman id 1311756; Mon, 18 May 2026 10:25:40 +0000 Received: from mx.expurgate.net ([195.190.135.10]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wOvAK-0008AK-R7 for win-pv-devel@lists.xenproject.org; Mon, 18 May 2026 10:25:40 +0000 Received: from mx.expurgate.net (helo=localhost) by mx.expurgate.net with esmtp id 1wOvAK-008cxR-7G for win-pv-devel@lists.xenproject.org; Mon, 18 May 2026 12:25:40 +0200 Received: from [10.42.69.7] (helo=localhost) by localhost with ESMTP (eXpurgate MTA 0.9.1) (envelope-from ) id 6a0ae916-bab6-0a2a0a5309dd-0a2a45078fce-22 for ; Mon, 18 May 2026 12:25:40 +0200 Received: from [185.255.28.34] (helo=prod-mta-13.swg-srv.net) by tlsNG-ef75cf.mxtls.expurgate.net with ESMTPS (eXpurgate 4.56.1) (envelope-from ) id 6a0ae923-229c-0a2a45070019-b9ff1c22ae77-3 for ; Mon, 18 May 2026 12:25:39 +0200 Received: from mail2.vates.fr ([37.26.189.201] mail2.vates.fr) (Authenticated sender: 8631fc262581453bbf619ec5b2062170/smtp/7773de5a-2839-4720-82ee-e06722ae1d3e) by prod-mta-13.swg-srv.net (ZoneMTA - prod-mta-13) with ESMTPSA id 19e3a9eaa7c000f373.001 for (version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384); Mon, 18 May 2026 10:25:37 +0000 Received: from localhost.localdomain (155.223.66.37.rev.sfr.net [37.66.223.155]) (Authenticated sender: ngoc-tu.dinh@vates.tech) by mail2.vates.fr (Postfix) with ESMTPSA id E8D8C8108D; Mon, 18 May 2026 12:25:36 +0200 (CEST) X-BeenThere: win-pv-devel@lists.xenproject.org List-Id: Developer list for the Windows PV Drivers subproject List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: win-pv-devel-bounces@lists.xenproject.org Precedence: list Sender: "win-pv-devel" Authentication-Results: eu.smtp.expurgate.cloud; dkim=pass header.s=selector1 header.d=vates.tech header.i="@vates.tech" header.h="From:Subject:Date:Message-ID:To:Cc:MIME-Version:Content-Type:In-Reply-To:References:Feedback-ID" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=vates.tech; q=dns/txt; s=selector1; bh=y0zAPnajZ8+Pp60QNrE8WxjINRAlhkEKfSgFIV4p5rE=; h=from:subject:date:message-id:to:cc:mime-version:content-type:in-reply-to:references:feedback-id; b=QyHWt7cXJvrjGToxTbJDJM7knBNoiYBclP262HA74BxZuCoHSNTXvgmRRoGTfuqr5DlbATTVI 9d14q5E6aF/71vh3adLiLKbJOLzjF2gumMQMMszmD2dRR+0LOieC1V18Q8JI+/gO0TsJMEdDUAI bYBiJQ/dFpyuLFctgQ4zdxeEOjZdDDRMYfnPYXv+1Cbe7j5YgrRvSCo+KCfXK3ZtW/OJFrg6xnM XurVTWJq1u8GYCHnfmzbI+iQF8UQA4YIxt8bP8h4EEbY4Yar4UOHjkdl4duuBPzTqoXMTb/OU8R d2VqdOBOI8I3eEtdvBVqVFsysLM0Iker0U3ks+IZy2WA== X-Zone-Loop: 0c872666e11fbf5c2626cba2f970e3025fc350fb6a31 x-campaign-type: default x-transaction-id: ce3847d6-9ea4-4981-a6a2-218b7c105839 x-swg-uid: 01-47433a19-e9f7-417c-aac7-eaaf0c8105fb X-Mailer: Sweego Message-ID: <1779099937.8631fc262581453bbf619ec5b2062170.19e3a9eaa7c000f373@vates.tech> x-swg-bid: 1779099937.8631fc262581453bbf619ec5b2062170.19e3a9eaa7c000f373 Feedback-ID: default:8631fc262581453bbf619ec5b2062170:Sweego x-campaign-id: default x-client-id: 8631fc262581453bbf619ec5b2062170 X-Originating-IP: [37.26.189.201] From: Tu Dinh To: win-pv-devel@lists.xenproject.org Cc: Tu Dinh Subject: [XENNET PATCH] Reduce the strength of Xen barriers on x86 Date: Mon, 18 May 2026 12:25:23 +0200 In-Reply-To: <20260518102530.873-1-ngoc-tu.dinh@vates.tech> References: <1779099870.8631fc262581453bbf619ec5b2062170.19e3a9da3de000f373@vates.tech> <20260518102530.873-1-ngoc-tu.dinh@vates.tech> MIME-Version: 1.0 X-BM-Disclaimer: Yes Content-Type: multipart/alternative; boundary="-=Part.d83.6d7face4c56aa44.19e3a9ea918.ff862966cc6c694c=-" X-Bm-Milter-Handled: 4ffbd6c1-ee69-4e1b-aabd-f977039bd3e2 X-Bm-Transport-Timestamp: 1779099937048 X-purgate-ID: tlsNG-ef75cf/1779099939-2216DC48-B4EF66B8/0/0 X-purgate-type: clean X-purgate-size: 1177 ---=Part.d83.6d7face4c56aa44.19e3a9ea918.ff862966cc6c694c=- Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable x86 is TSO and only needs a compiler barrier as read/write barriers=2E Signed-off-by: Tu Dinh --- include/xen-types=2Eh | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/include/xen-types=2Eh b/include/xen-types=2Eh index 6eb8693=2E=2Eb618af2 100644 --- a/include/xen-types=2Eh +++ b/include/xen-types=2Eh @@ -48,7 +48,12 @@ typedef ULONG uint32_t; typedef ULONG64 uint64_t; =20 #define xen_mb() KeMemoryBarrier() +#if defined(_M_IX86) || defined(_M_X64) +#define xen_wmb() KeMemoryBarrierWithoutFence() +#define xen_rmb() KeMemoryBarrierWithoutFence() +#else #define xen_wmb() KeMemoryBarrier() -#define xen_rmb() KememoryBarrier() +#define xen_rmb() KeMemoryBarrier() +#endif =20 #endif // _XEN_TYPES_H --=20 2=2E54=2E0=2Ewindows=2E1 -- Ngoc Tu Dinh | Vates XCP-ng Developer XCP-ng & Xen Orchestra - Vates = solutions web: https://vates=2Etech ---=Part.d83.6d7face4c56aa44.19e3a9ea918.ff862966cc6c694c=--- From win-pv-devel-bounces@lists.xenproject.org Mon May 18 10:25:43 2026 Return-path: Envelope-to: archives@lists.xenproject.org Delivery-date: Mon, 18 May 2026 10:25:43 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1311755.1581893 (Exim 4.92) (envelope-from ) id 1wOvAN-0008Is-6T; Mon, 18 May 2026 10:25:43 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1311755.1581893; Mon, 18 May 2026 10:25:43 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wOvAM-0008If-T4; Mon, 18 May 2026 10:25:42 +0000 Received: by outflank-mailman (input) for mailman id 1311755; Mon, 18 May 2026 10:25:40 +0000 Received: from mx.expurgate.net ([195.190.135.10]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wOvAK-0008AJ-QF for win-pv-devel@lists.xenproject.org; Mon, 18 May 2026 10:25:40 +0000 Received: from mx.expurgate.net (helo=localhost) by mx.expurgate.net with esmtp id 1wOvAK-007ub1-68 for win-pv-devel@lists.xenproject.org; Mon, 18 May 2026 12:25:40 +0200 Received: from [10.42.69.1] (helo=localhost) by localhost with ESMTP (eXpurgate MTA 0.9.1) (envelope-from ) id 6a0ae91d-2eae-0a2a0a5409dd-0a2a4501a19c-20 for ; Mon, 18 May 2026 12:25:40 +0200 Received: from [185.255.28.34] (helo=prod-mta-13.swg-srv.net) by tlsNG-d62444.mxtls.expurgate.net with ESMTPS (eXpurgate 4.56.1) (envelope-from ) id 6a0ae923-c1f2-0a2a45010019-b9ff1c229629-4 for ; Mon, 18 May 2026 12:25:40 +0200 Received: from mail2.vates.fr ([37.26.189.201] mail2.vates.fr) (Authenticated sender: 8631fc262581453bbf619ec5b2062170/smtp/7773de5a-2839-4720-82ee-e06722ae1d3e) by prod-mta-13.swg-srv.net (ZoneMTA - prod-mta-13) with ESMTPSA id 19e3a9eae4b000f373.001 for (version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384); Mon, 18 May 2026 10:25:38 +0000 Received: from localhost.localdomain (155.223.66.37.rev.sfr.net [37.66.223.155]) (Authenticated sender: ngoc-tu.dinh@vates.tech) by mail2.vates.fr (Postfix) with ESMTPSA id E587D86313; Mon, 18 May 2026 12:25:37 +0200 (CEST) X-BeenThere: win-pv-devel@lists.xenproject.org List-Id: Developer list for the Windows PV Drivers subproject List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: win-pv-devel-bounces@lists.xenproject.org Precedence: list Sender: "win-pv-devel" Authentication-Results: eu.smtp.expurgate.cloud; dkim=pass header.s=selector1 header.d=vates.tech header.i="@vates.tech" header.h="From:Subject:Date:Message-ID:To:Cc:MIME-Version:Content-Type:In-Reply-To:References:Feedback-ID" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=vates.tech; q=dns/txt; s=selector1; bh=RbOVeV9RoXzohkSK7lldaT85yQzpjVt+MfoOqyIW2uY=; h=from:subject:date:message-id:to:cc:mime-version:content-type:in-reply-to:references:feedback-id; b=FjdU+2LNoU4IQU4YfR8W4x0i2HTZi6A7Pea72Ewbd8Eed1yJAQyrMCxxSR0hO/V95scG7LKOT ePbu8zmq0Uw0NEYgVGnTMhQD1uunGYeFCZYCdAPFVXC1dvZNCdalpeKD3vkUhseUvKQuwa0xBmy A94n+/tLoalAkpWUT0HAeNn2rZxwGqfKiAUJNGQcreZE6jsTT4Z4xUCDv420Ewig7xbMNm/w33S E4hgAxvw4eftP40PsRFPxqLJVO530wRESzySiZ24imu8JFinba5KoqRcpDk7K8F7OUFI+AsZg59 CZXxMnDKniPHt6XC613wyP/f7+SQ0JHtzFGsjtoSoqbA== X-Zone-Loop: 4d7efa0c0747921158997b8834557a920baab7540080 x-campaign-type: default x-transaction-id: 6538d411-4877-47e8-aa53-673a6186465c x-swg-uid: 01-6974f7e6-c02c-4936-8a0a-e7e510a40682 X-Mailer: Sweego Message-ID: <1779099938.8631fc262581453bbf619ec5b2062170.19e3a9eae4b000f373@vates.tech> x-swg-bid: 1779099938.8631fc262581453bbf619ec5b2062170.19e3a9eae4b000f373 Feedback-ID: default:8631fc262581453bbf619ec5b2062170:Sweego x-campaign-id: default x-client-id: 8631fc262581453bbf619ec5b2062170 X-Originating-IP: [37.26.189.201] From: Tu Dinh To: win-pv-devel@lists.xenproject.org Cc: Tu Dinh Subject: [XENVIF PATCH 2/3] Reduce the strength of Xen barriers on x86 Date: Mon, 18 May 2026 12:25:28 +0200 In-Reply-To: <20260518102530.873-1-ngoc-tu.dinh@vates.tech> References: <1779099870.8631fc262581453bbf619ec5b2062170.19e3a9da3de000f373@vates.tech> <20260518102530.873-1-ngoc-tu.dinh@vates.tech> MIME-Version: 1.0 X-BM-Disclaimer: Yes Content-Type: multipart/alternative; boundary="-=Part.d88.e1c3c0ef08d7f453.19e3a9eacf3.ed486d6ce4937a43=-" X-Bm-Milter-Handled: 4ffbd6c1-ee69-4e1b-aabd-f977039bd3e2 X-Bm-Transport-Timestamp: 1779099938035 X-purgate-ID: tlsNG-d62444/1779099940-AE75CFF4-474D8868/0/0 X-purgate-type: clean X-purgate-size: 1179 ---=Part.d88.e1c3c0ef08d7f453.19e3a9eacf3.ed486d6ce4937a43=- Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable x86 is TSO and only needs a compiler barrier as read/write barriers=2E Signed-off-by: Tu Dinh --- include/xen-types=2Eh | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/include/xen-types=2Eh b/include/xen-types=2Eh index 2480526=2E=2E3446ac7 100644 --- a/include/xen-types=2Eh +++ b/include/xen-types=2Eh @@ -48,7 +48,12 @@ typedef ULONG uint32_t; typedef ULONG64 uint64_t; =20 #define xen_mb() KeMemoryBarrier() +#if defined(_M_IX86) || defined(_M_X64) +#define xen_wmb() KeMemoryBarrierWithoutFence() +#define xen_rmb() KeMemoryBarrierWithoutFence() +#else #define xen_wmb() KeMemoryBarrier() -#define xen_rmb() KememoryBarrier() +#define xen_rmb() KeMemoryBarrier() +#endif =20 #endif // _XEN_TYPES_H --=20 2=2E54=2E0=2Ewindows=2E1 -- Ngoc Tu Dinh | Vates XCP-ng Developer XCP-ng & Xen Orchestra - Vates = solutions web: https://vates=2Etech ---=Part.d88.e1c3c0ef08d7f453.19e3a9eacf3.ed486d6ce4937a43=--- From win-pv-devel-bounces@lists.xenproject.org Mon May 18 10:25:43 2026 Return-path: Envelope-to: archives@lists.xenproject.org Delivery-date: Mon, 18 May 2026 10:25:43 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1311757.1581900 (Exim 4.92) (envelope-from ) id 1wOvAN-0008Km-I2; Mon, 18 May 2026 10:25:43 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1311757.1581900; Mon, 18 May 2026 10:25:43 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wOvAN-0008KE-30; Mon, 18 May 2026 10:25:43 +0000 Received: by outflank-mailman (input) for mailman id 1311757; Mon, 18 May 2026 10:25:40 +0000 Received: from mx.expurgate.net ([195.190.135.10]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wOvAK-0008AQ-S7 for win-pv-devel@lists.xenproject.org; Mon, 18 May 2026 10:25:40 +0000 Received: from mx.expurgate.net (helo=localhost) by mx.expurgate.net with esmtp id 1wOvAK-008cxR-85 for win-pv-devel@lists.xenproject.org; Mon, 18 May 2026 12:25:40 +0200 Received: from [10.42.69.3] (helo=localhost) by localhost with ESMTP (eXpurgate MTA 0.9.1) (envelope-from ) id 6a0ae91e-bab6-0a2a0a5309dd-0a2a4503d79e-22 for ; Mon, 18 May 2026 12:25:40 +0200 Received: from [185.255.28.34] (helo=prod-mta-13.swg-srv.net) by tlsNG-33051d.mxtls.expurgate.net with ESMTPS (eXpurgate 4.56.1) (envelope-from ) id 6a0ae923-672d-0a2a45030019-b9ff1c22b1db-5 for ; Mon, 18 May 2026 12:25:39 +0200 Received: from mail2.vates.fr ([37.26.189.201] mail2.vates.fr) (Authenticated sender: 8631fc262581453bbf619ec5b2062170/smtp/7773de5a-2839-4720-82ee-e06722ae1d3e) by prod-mta-13.swg-srv.net (ZoneMTA - prod-mta-13) with ESMTPSA id 19e3a9eaca8000f373.001 for (version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384); Mon, 18 May 2026 10:25:37 +0000 Received: from localhost.localdomain (155.223.66.37.rev.sfr.net [37.66.223.155]) (Authenticated sender: ngoc-tu.dinh@vates.tech) by mail2.vates.fr (Postfix) with ESMTPSA id 88B1D8108D; Mon, 18 May 2026 12:25:37 +0200 (CEST) X-BeenThere: win-pv-devel@lists.xenproject.org List-Id: Developer list for the Windows PV Drivers subproject List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: win-pv-devel-bounces@lists.xenproject.org Precedence: list Sender: "win-pv-devel" Authentication-Results: eu.smtp.expurgate.cloud; dkim=pass header.s=selector1 header.d=vates.tech header.i="@vates.tech" header.h="From:Subject:Date:Message-ID:To:Cc:MIME-Version:Content-Type:In-Reply-To:References:Feedback-ID" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=vates.tech; q=dns/txt; s=selector1; bh=0pigeTIbD3t0L51wYRL6h/g9/xwce3TNevrzrsv/i90=; h=from:subject:date:message-id:to:cc:mime-version:content-type:in-reply-to:references:feedback-id; b=JN6RTZ+rBo2SYC2VoBn+7Qw3TzKPuJwbSqudEwQuYkY0ZAIGySVqhY6PN789S9CMj4iOniSDS 89lVyU8FXHn32atRt7ZYRGB54SjXTufT5Q6Sqb9tZAkFKMsMNDQT36ugZY+kOe8i5rjYyzcbwgE C1opK+Cvj6pU4WxFa0KcKB+fVdn8wyDCJ7Yw2XssgUSdcPm0CXxWPnwGy9GaNcgIijn7AwksrwB oViyde3/YQ0usFyF3acIsAHQbO0/exzxzzZoGZyoRTken40jpdUf14cosoG1cvByZCJaEX/4RTC Il8Kxg1/CYx1L29fqG16qQkKlmICAHIQmjK+3XTWGLqA== X-Zone-Loop: b8e6116f2bd09c9a8f67b7b2d8fea25038151492a2d6 x-campaign-type: default x-transaction-id: 483f4ccc-e3e6-4b17-b2bc-6b6655f5d4f5 x-swg-uid: 01-541c6721-b39c-41d3-99df-258234bfe203 X-Mailer: Sweego Message-ID: <1779099938.8631fc262581453bbf619ec5b2062170.19e3a9eaca8000f373@vates.tech> x-swg-bid: 1779099938.8631fc262581453bbf619ec5b2062170.19e3a9eaca8000f373 Feedback-ID: default:8631fc262581453bbf619ec5b2062170:Sweego x-campaign-id: default x-client-id: 8631fc262581453bbf619ec5b2062170 X-Originating-IP: [37.26.189.201] From: Tu Dinh To: win-pv-devel@lists.xenproject.org Cc: Tu Dinh Subject: [XENVBD PATCH 3/3] ring: Weaken and delete unnecessary barriers Date: Mon, 18 May 2026 12:25:26 +0200 In-Reply-To: <20260518102530.873-1-ngoc-tu.dinh@vates.tech> References: <1779099870.8631fc262581453bbf619ec5b2062170.19e3a9da3de000f373@vates.tech> <20260518102530.873-1-ngoc-tu.dinh@vates.tech> MIME-Version: 1.0 X-BM-Disclaimer: Yes Content-Type: multipart/alternative; boundary="-=Part.d86.332e49366c052fa8.19e3a9eab4d.1023e61d1548d834=-" X-Bm-Milter-Handled: 4ffbd6c1-ee69-4e1b-aabd-f977039bd3e2 X-Bm-Transport-Timestamp: 1779099937613 X-purgate-ID: tlsNG-33051d/1779099940-39171938-00DC14BA/0/0 X-purgate-type: clean X-purgate-size: 4458 ---=Part.d86.332e49366c052fa8.19e3a9eab4d.1023e61d1548d834=- Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable KeMemoryBarrier() is too strong for many of the barriers used in here=2E BlkifRingPoll: * First barrier replaced with the equivalent xen_mb() for consistency=2E * Second barrier only needs to be an acquire, moved down a little bit as a micro-optimization=2E * Third barrier only needs to be a release (rmb+wmb)=2E __BlkifRingCompleteResponse * Interlocked was replaced with non-interlocked since operation is done under lock=2E Release barrier in BlkifRingPoll is enough=2E __BlkifRingTryAcquireLock/__BlkifRingTryReleaseLock: * All barriers are unnecessary since InterlockedCompareExchangePointer is already a full barrier=2E RingWatchdog: * Barriers not necessary since __BlkifRingAcquire/ReleaseLock are already full barriers, and BlkifRingPoll has its own barriers=2E Signed-off-by: Tu Dinh --- src/xenvbd/ring=2Ec | 25 ++++++------------------- 1 file changed, 6 insertions(+), 19 deletions(-) diff --git a/src/xenvbd/ring=2Ec b/src/xenvbd/ring=2Ec index 205e93a=2E=2E10ca6ee 100644 --- a/src/xenvbd/ring=2Ec +++ b/src/xenvbd/ring=2Ec @@ -1203,7 +1203,7 @@ __BlkifRingCompleteResponse( BlkifRingPutRequest(BlkifRing, Request); =20 // complete srb - if (InterlockedDecrement(&SrbExt->RequestCount) =3D=3D 0) { + if (--SrbExt->RequestCount =3D=3D 0) { __BlkifRingCompleteSrb(BlkifRing, SrbExt); } } @@ -1228,16 +1228,16 @@ BlkifRingPoll( RING_IDX rsp_prod; RING_IDX rsp_cons; =20 - KeMemoryBarrier(); + xen_mb(); =20 rsp_prod =3D BlkifRing->Shared->rsp_prod; rsp_cons =3D BlkifRing->Front=2Ersp_cons; =20 - KeMemoryBarrier(); - if (rsp_cons =3D=3D rsp_prod || Retry) break; =20 + xen_rmb(); + while (rsp_cons !=3D rsp_prod && !Retry) { blkif_response_t *rsp; PXENVBD_REQUEST Request; @@ -1260,7 +1260,8 @@ BlkifRingPoll( Retry =3D TRUE; } =20 - KeMemoryBarrier(); + xen_rmb(); + xen_wmb(); =20 BlkifRing->Front=2Ersp_cons =3D rsp_cons; BlkifRing->Shared->rsp_event =3D rsp_cons + 1; @@ -1455,8 +1456,6 @@ __BlkifRingTryAcquireLock( =20 ASSERT3U(KeGetCurrentIrql(), =3D=3D , DISPATCH_LEVEL); =20 - KeMemoryBarrier(); - Old =3D (ULONG_PTR)BlkifRing->Lock & ~XENVBD_LOCK_BIT; New =3D Old | XENVBD_LOCK_BIT; =20 @@ -1464,13 +1463,10 @@ __BlkifRingTryAcquireLock( (PVOID)New, (PVOID)Old) = =3D=3D Old) ? TRUE : FALSE; =20 - KeMemoryBarrier(); - #if DBG if (Acquired) { ASSERT3P(BlkifRing->LockThread, =3D=3D , NULL); BlkifRing->LockThread =3D KeGetCurrentThread(); - KeMemoryBarrier(); } #endif =20 @@ -1523,19 +1519,14 @@ __BlkifRingTryReleaseLock( BlkifRing->LockThread =3D NULL; #endif =20 - KeMemoryBarrier(); - Released =3D ((ULONG_PTR)InterlockedCompareExchangePointer(&BlkifRing= ->Lock, (PVOID)New, (PVOID)Old) = =3D=3D Old) ? TRUE : FALSE; =20 - KeMemoryBarrier(); - #if DBG if (!Released) { ASSERT3P(BlkifRing->LockThread, =3D=3D , NULL); BlkifRing->LockThread =3D KeGetCurrentThread(); - KeMemoryBarrier(); } #endif =20 @@ -1694,8 +1685,6 @@ RingWatchdog( __BlkifRingAcquireLock(BlkifRing); =20 if (BlkifRing->Enabled) { - KeMemoryBarrier(); - if (BlkifRing->Shared->rsp_prod !=3D rsp_prod && BlkifRing->Front=2Ersp_cons =3D=3D rsp_cons) { XENBUS_DEBUG(Trigger, @@ -1707,8 +1696,6 @@ RingWatchdog( (VOID) BlkifRingPoll(BlkifRing); } =20 - KeMemoryBarrier(); - rsp_prod =3D BlkifRing->Shared->rsp_prod; rsp_cons =3D BlkifRing->Front=2Ersp_cons; } --=20 2=2E54=2E0=2Ewindows=2E1 -- Ngoc Tu Dinh | Vates XCP-ng Developer XCP-ng & Xen Orchestra - Vates = solutions web: https://vates=2Etech ---=Part.d86.332e49366c052fa8.19e3a9eab4d.1023e61d1548d834=--- From win-pv-devel-bounces@lists.xenproject.org Mon May 18 10:25:43 2026 Return-path: Envelope-to: archives@lists.xenproject.org Delivery-date: Mon, 18 May 2026 10:25:43 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1311758.1581897 (Exim 4.92) (envelope-from ) id 1wOvAN-0008M5-F2; Mon, 18 May 2026 10:25:43 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1311758.1581897; Mon, 18 May 2026 10:25:43 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wOvAN-0008Ko-8D; Mon, 18 May 2026 10:25:43 +0000 Received: by outflank-mailman (input) for mailman id 1311758; Mon, 18 May 2026 10:25:41 +0000 Received: from mx.expurgate.net ([195.190.135.10]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wOvAK-0008AZ-UQ for win-pv-devel@lists.xenproject.org; Mon, 18 May 2026 10:25:40 +0000 Received: from mx.expurgate.net (helo=localhost) by mx.expurgate.net with esmtp id 1wOvAK-00FbzK-AD for win-pv-devel@lists.xenproject.org; Mon, 18 May 2026 12:25:40 +0200 Received: from [10.42.69.12] (helo=localhost) by localhost with ESMTP (eXpurgate MTA 0.9.1) (envelope-from ) id 6a0ae91f-5cb7-0a2a0a5109dd-0a2a450cb130-12 for ; Mon, 18 May 2026 12:25:40 +0200 Received: from [185.255.28.34] (helo=prod-mta-13.swg-srv.net) by tlsNG-d25034.mxtls.expurgate.net with ESMTPS (eXpurgate 4.56.1) (envelope-from ) id 6a0ae923-62f1-0a2a450c0019-b9ff1c22a005-5 for ; Mon, 18 May 2026 12:25:40 +0200 Received: from mail2.vates.fr ([37.26.189.201] mail2.vates.fr) (Authenticated sender: 8631fc262581453bbf619ec5b2062170/smtp/7773de5a-2839-4720-82ee-e06722ae1d3e) by prod-mta-13.swg-srv.net (ZoneMTA - prod-mta-13) with ESMTPSA id 19e3a9eb013000f373.001 for (version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384); Mon, 18 May 2026 10:25:38 +0000 Received: from localhost.localdomain (155.223.66.37.rev.sfr.net [37.66.223.155]) (Authenticated sender: ngoc-tu.dinh@vates.tech) by mail2.vates.fr (Postfix) with ESMTPSA id 574FD8667C; Mon, 18 May 2026 12:25:38 +0200 (CEST) X-BeenThere: win-pv-devel@lists.xenproject.org List-Id: Developer list for the Windows PV Drivers subproject List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: win-pv-devel-bounces@lists.xenproject.org Precedence: list Sender: "win-pv-devel" Authentication-Results: eu.smtp.expurgate.cloud; dkim=pass header.s=selector1 header.d=vates.tech header.i="@vates.tech" header.h="From:Subject:Date:Message-ID:To:Cc:MIME-Version:Content-Type:In-Reply-To:References:Feedback-ID" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=vates.tech; q=dns/txt; s=selector1; bh=vZ5BdisNbL5NAr6gcXnznbSpoWy9/BUSMzyBfDYszSI=; h=from:subject:date:message-id:to:cc:mime-version:content-type:in-reply-to:references:feedback-id; b=lhaVe/kLxQBUJGgRMkmVgWYV3nehMqgfGtb4hevQ7iPdIcnBm2d/Mym7+AionwNOzTg6glsGt nrGvWoLVnmZt966tnmOTDDW0IR1B1vuJWL3hS0DGGsVdh6TxmNhFoDewmn6Ou23vbzUKze4UHuR yoDuNOFXssBpEHOF5byS4VwaI9BAzUKyBqtfF81Rh+v/P8oXtpjFMwmqu94PfD8NgQHplmjQfpk 1x6nU5vr5xgHuqH+q8+nqBJerrZaI8w6+kpF+dX6YIXN+l6CPt1FXH9rhIOCBouUTfYH2FKfuBm DBd31Q8jbVzvtcEnPgtuNgJxjg5xmrdZph5/nf6MJkcQ== X-Zone-Loop: f6807b1062b365aad28dbfce06eef8e39b3c48ec18b1 x-campaign-type: default x-transaction-id: d238972e-119c-466c-8e68-05bfb683149c x-swg-uid: 01-addb195e-e0e9-4533-9b20-0dd04c75c8a5 X-Mailer: Sweego Message-ID: <1779099938.8631fc262581453bbf619ec5b2062170.19e3a9eb013000f373@vates.tech> x-swg-bid: 1779099938.8631fc262581453bbf619ec5b2062170.19e3a9eb013000f373 Feedback-ID: default:8631fc262581453bbf619ec5b2062170:Sweego x-campaign-id: default x-client-id: 8631fc262581453bbf619ec5b2062170 X-Originating-IP: [37.26.189.201] From: Tu Dinh To: win-pv-devel@lists.xenproject.org Cc: Tu Dinh Subject: [XENVKBD PATCH] Reduce the strength of Xen barriers on x86 Date: Mon, 18 May 2026 12:25:30 +0200 In-Reply-To: <20260518102530.873-1-ngoc-tu.dinh@vates.tech> References: <1779099870.8631fc262581453bbf619ec5b2062170.19e3a9da3de000f373@vates.tech> <20260518102530.873-1-ngoc-tu.dinh@vates.tech> MIME-Version: 1.0 X-BM-Disclaimer: Yes Content-Type: multipart/alternative; boundary="-=Part.d8a.af022b4da784028c.19e3a9eae95.250d4d1a2b17b60c=-" X-Bm-Milter-Handled: 4ffbd6c1-ee69-4e1b-aabd-f977039bd3e2 X-Bm-Transport-Timestamp: 1779099938453 X-purgate-ID: tlsNG-d25034/1779099940-DB97DCF5-D02CD508/0/0 X-purgate-type: clean X-purgate-size: 1179 ---=Part.d8a.af022b4da784028c.19e3a9eae95.250d4d1a2b17b60c=- Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable x86 is TSO and only needs a compiler barrier as read/write barriers=2E Signed-off-by: Tu Dinh --- include/xen-types=2Eh | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/include/xen-types=2Eh b/include/xen-types=2Eh index 2480526=2E=2E3446ac7 100644 --- a/include/xen-types=2Eh +++ b/include/xen-types=2Eh @@ -48,7 +48,12 @@ typedef ULONG uint32_t; typedef ULONG64 uint64_t; =20 #define xen_mb() KeMemoryBarrier() +#if defined(_M_IX86) || defined(_M_X64) +#define xen_wmb() KeMemoryBarrierWithoutFence() +#define xen_rmb() KeMemoryBarrierWithoutFence() +#else #define xen_wmb() KeMemoryBarrier() -#define xen_rmb() KememoryBarrier() +#define xen_rmb() KeMemoryBarrier() +#endif =20 #endif // _XEN_TYPES_H --=20 2=2E54=2E0=2Ewindows=2E1 -- Ngoc Tu Dinh | Vates XCP-ng Developer XCP-ng & Xen Orchestra - Vates = solutions web: https://vates=2Etech ---=Part.d8a.af022b4da784028c.19e3a9eae95.250d4d1a2b17b60c=--- From win-pv-devel-bounces@lists.xenproject.org Mon May 18 10:25:43 2026 Return-path: Envelope-to: archives@lists.xenproject.org Delivery-date: Mon, 18 May 2026 10:25:43 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1311759.1581908 (Exim 4.92) (envelope-from ) id 1wOvAN-0008Nj-T6; Mon, 18 May 2026 10:25:43 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1311759.1581908; Mon, 18 May 2026 10:25:43 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wOvAN-0008ME-Cn; Mon, 18 May 2026 10:25:43 +0000 Received: by outflank-mailman (input) for mailman id 1311759; Mon, 18 May 2026 10:25:41 +0000 Received: from mx.expurgate.net ([195.190.135.10]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wOvAL-0008Az-6b for win-pv-devel@lists.xenproject.org; Mon, 18 May 2026 10:25:41 +0000 Received: from mx.expurgate.net (helo=localhost) by mx.expurgate.net with esmtp id 1wOvAK-002hVG-In for win-pv-devel@lists.xenproject.org; Mon, 18 May 2026 12:25:40 +0200 Received: from [10.42.69.8] (helo=localhost) by localhost with ESMTP (eXpurgate MTA 0.9.1) (envelope-from ) id 6a0ae917-e002-0a2a0a5209dd-0a2a4508eb20-38 for ; Mon, 18 May 2026 12:25:40 +0200 Received: from [185.255.28.34] (helo=prod-mta-13.swg-srv.net) by tlsNG-c1860d.mxtls.expurgate.net with ESMTPS (eXpurgate 4.56.1) (envelope-from ) id 6a0ae924-63b5-0a2a45080019-b9ff1c228973-3 for ; Mon, 18 May 2026 12:25:40 +0200 Received: from mail2.vates.fr ([37.26.189.201] mail2.vates.fr) (Authenticated sender: 8631fc262581453bbf619ec5b2062170/smtp/7773de5a-2839-4720-82ee-e06722ae1d3e) by prod-mta-13.swg-srv.net (ZoneMTA - prod-mta-13) with ESMTPSA id 19e3a9eaf28000f373.001 for (version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384); Mon, 18 May 2026 10:25:38 +0000 Received: from localhost.localdomain (155.223.66.37.rev.sfr.net [37.66.223.155]) (Authenticated sender: ngoc-tu.dinh@vates.tech) by mail2.vates.fr (Postfix) with ESMTPSA id 2890386582; Mon, 18 May 2026 12:25:38 +0200 (CEST) X-BeenThere: win-pv-devel@lists.xenproject.org List-Id: Developer list for the Windows PV Drivers subproject List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: win-pv-devel-bounces@lists.xenproject.org Precedence: list Sender: "win-pv-devel" Authentication-Results: eu.smtp.expurgate.cloud; dkim=pass header.s=selector1 header.d=vates.tech header.i="@vates.tech" header.h="From:Subject:Date:Message-ID:To:Cc:MIME-Version:Content-Type:In-Reply-To:References:Feedback-ID" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=vates.tech; q=dns/txt; s=selector1; bh=iDnTALu65qC1Z3R7bsOrO1j3fDe73E5YOgR6ThBtbeE=; h=from:subject:date:message-id:to:cc:mime-version:content-type:in-reply-to:references:feedback-id; b=tWCKPq/zNOO0ivTcvmAb7TY9Hpz0S5TDqDRv7NrDH2MztYt1aNRpzKaat3FzjiYp55Tbubapp GeNIvmFpTYxqh9xLhFL0zslNgTdAsx8S2QzlY9aNkMJTwyA0A+vLI11JqYkYpBSVE3kGCycGeu+ CbMdaSAz7hqYzUIxs223RCk1n1lddE73CVZ27HDlpgLou+d9fY+8IMVoNJGAtXfAy/9YXdSeSTR tM4++KwCdwdeOLy888tiTNjr9XBvg8sgNd6aEU6ROkK5wvg8U9I1ASm4oVrC6476ISAz6tLHzZ1 qMqt7mKuSEDTNpzas5bMYJuEsG5j/BBgTG9bYtZQ/MzQ== X-Zone-Loop: 2c4ce0b760202330d977f494766a567a71344e99714d x-campaign-type: default x-transaction-id: 3f79d243-21cd-4c0b-aaf9-85d7c654a02c x-swg-uid: 01-51d2edfb-884e-4769-b35b-79917e4c6bf6 X-Mailer: Sweego Message-ID: <1779099938.8631fc262581453bbf619ec5b2062170.19e3a9eaf28000f373@vates.tech> x-swg-bid: 1779099938.8631fc262581453bbf619ec5b2062170.19e3a9eaf28000f373 Feedback-ID: default:8631fc262581453bbf619ec5b2062170:Sweego x-campaign-id: default x-client-id: 8631fc262581453bbf619ec5b2062170 X-Originating-IP: [37.26.189.201] From: Tu Dinh To: win-pv-devel@lists.xenproject.org Cc: Tu Dinh Subject: [XENVIF PATCH 3/3] Weaken and delete unnecessary barriers Date: Mon, 18 May 2026 12:25:29 +0200 In-Reply-To: <20260518102530.873-1-ngoc-tu.dinh@vates.tech> References: <1779099870.8631fc262581453bbf619ec5b2062170.19e3a9da3de000f373@vates.tech> <20260518102530.873-1-ngoc-tu.dinh@vates.tech> MIME-Version: 1.0 X-BM-Disclaimer: Yes Content-Type: multipart/alternative; boundary="-=Part.d89.62da52d422094baf.19e3a9eadab.1dcde85b9981e944=-" X-Bm-Milter-Handled: 4ffbd6c1-ee69-4e1b-aabd-f977039bd3e2 X-Bm-Transport-Timestamp: 1779099938219 X-purgate-ID: tlsNG-c1860d/1779099940-BE169DB1-783CA257/0/0 X-purgate-type: clean X-purgate-size: 5600 ---=Part.d89.62da52d422094baf.19e3a9eadab.1dcde85b9981e944=- Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable KeMemoryBarrier() is too strong for many of the barriers used in here=2E __ReceiverRingSwizzle: * Unclear purpose, removed since there's an InterlockedExchangePointer right after, and other paths don't need a barrier=2E ReceiverRingFill/ReceiverRingPoll/TransmitterRingPoll: * First barrier replaced with the equivalent xen_mb() for consistency=2E * Second barrier only needs to be an acquire=2E * Third barrier only needs to be a release (rmb+wmb)=2E ReceiverReturnPacket: * All barriers are unnecessary since InterlockedIncrement is already a full barrier=2E __TransmitterRingTryAcquire/ReleaseLock: * All barriers are unnecessary since InterlockedCompareExchangePointer is already a full barrier=2E Signed-off-by: Tu Dinh --- src/xenvif/receiver=2Ec | 21 ++++++++------------- src/xenvif/transmitter=2Ec | 17 ++++------------- 2 files changed, 12 insertions(+), 26 deletions(-) diff --git a/src/xenvif/receiver=2Ec b/src/xenvif/receiver=2Ec index 0cd1867=2E=2Ebde1cba 100644 --- a/src/xenvif/receiver=2Ec +++ b/src/xenvif/receiver=2Ec @@ -1350,8 +1350,6 @@ __ReceiverRingSwizzle( =20 InitializeListHead(&List); =20 - KeMemoryBarrier(); - // Only process the PacketQueue if the ring is not paused or it is be= ing flushed if (!Ring->Paused || Ring->Flush) { ListEntry =3D InterlockedExchangePointer(&Ring->PacketQueue, NULL= ); @@ -1838,12 +1836,12 @@ ReceiverRingFill( Receiver =3D Ring->Receiver; Frontend =3D Receiver->Frontend; =20 - KeMemoryBarrier(); + xen_mb(); =20 req_prod =3D Ring->Front=2Ereq_prod_pvt; rsp_cons =3D Ring->Front=2Ersp_cons; =20 - KeMemoryBarrier(); + xen_rmb(); =20 while (req_prod - rsp_cons < RING_SIZE(&Ring->Front)) { PXENVIF_RECEIVER_PACKET Packet; @@ -1881,7 +1879,8 @@ ReceiverRingFill( Ring->Pending[id] =3D Fragment; } =20 - KeMemoryBarrier(); + xen_rmb(); + xen_wmb(); =20 Ring->Front=2Ereq_prod_pvt =3D req_prod; =20 @@ -2052,12 +2051,12 @@ ReceiverRingPoll( TailMdl =3D NULL; EOP =3D TRUE; =20 - KeMemoryBarrier(); + xen_mb(); =20 rsp_prod =3D Ring->Shared->rsp_prod; rsp_cons =3D Ring->Front=2Ersp_cons; =20 - KeMemoryBarrier(); + xen_rmb(); =20 if (rsp_cons =3D=3D rsp_prod) { RING_IDX WorkToDo; @@ -2246,7 +2245,8 @@ ReceiverRingPoll( ASSERT3P(TailMdl, =3D=3D, NULL); ASSERT(EOP); =20 - KeMemoryBarrier(); + xen_rmb(); + xen_wmb(); =20 Ring->Front=2Ersp_cons =3D rsp_cons; } @@ -3780,13 +3780,8 @@ ReceiverReturnPacket( =20 __ReceiverRingReturnPacket(Ring, Packet, FALSE); =20 - KeMemoryBarrier(); - Returned =3D InterlockedIncrement(&Receiver->Returned); =20 - // Make sure Loaned is not sampled before Returned - KeMemoryBarrier(); - Loaned =3D Receiver->Loaned; =20 ASSERT3S(Loaned - Returned, >=3D, 0); diff --git a/src/xenvif/transmitter=2Ec b/src/xenvif/transmitter=2Ec index 1425058=2E=2Ecc6e52f 100644 --- a/src/xenvif/transmitter=2Ec +++ b/src/xenvif/transmitter=2Ec @@ -2482,12 +2482,12 @@ TransmitterRingPoll( RING_IDX rsp_cons; ULONG Extra; =20 - KeMemoryBarrier(); + xen_mb(); =20 rsp_prod =3D Ring->Shared->rsp_prod; rsp_cons =3D Ring->Front=2Ersp_cons; =20 - KeMemoryBarrier(); + xen_rmb(); =20 if (rsp_cons =3D=3D rsp_prod) { RING_IDX WorkToDo; @@ -2633,7 +2633,8 @@ TransmitterRingPoll( } ASSERT3U(Extra, =3D=3D, 0); =20 - KeMemoryBarrier(); + xen_rmb(); + xen_wmb(); =20 Ring->Front=2Ersp_cons =3D rsp_cons; } @@ -3114,8 +3115,6 @@ __TransmitterRingTryAcquireLock( =20 ASSERT3U(KeGetCurrentIrql(), =3D=3D, DISPATCH_LEVEL); =20 - KeMemoryBarrier(); - Old =3D (ULONG_PTR)Ring->Lock & ~XENVIF_TRANSMITTER_LOCK_BIT; New =3D Old | XENVIF_TRANSMITTER_LOCK_BIT; =20 @@ -3123,13 +3122,10 @@ __TransmitterRingTryAcquireLock( (PVOID)New, (PVOID)Old) = =3D=3D Old) ? TRUE : FALSE; =20 - KeMemoryBarrier(); - #if DBG if (Acquired) { ASSERT3P(Ring->LockThread, =3D=3D, NULL); Ring->LockThread =3D KeGetCurrentThread(); - KeMemoryBarrier(); } #endif =20 @@ -3183,19 +3179,14 @@ __TransmitterRingTryReleaseLock( Ring->LockThread =3D NULL; #endif =20 - KeMemoryBarrier(); - Released =3D ((ULONG_PTR)InterlockedCompareExchangePointer(&Ring->Loc= k, (PVOID)New, (PVOID)Old) = =3D=3D Old) ? TRUE : FALSE; =20 - KeMemoryBarrier(); - #if DBG if (!Released) { ASSERT3P(Ring->LockThread, =3D=3D, NULL); Ring->LockThread =3D KeGetCurrentThread(); - KeMemoryBarrier(); } #endif =20 --=20 2=2E54=2E0=2Ewindows=2E1 -- Ngoc Tu Dinh | Vates XCP-ng Developer XCP-ng & Xen Orchestra - Vates = solutions web: https://vates=2Etech ---=Part.d89.62da52d422094baf.19e3a9eadab.1dcde85b9981e944=--- From win-pv-devel-bounces@lists.xenproject.org Wed May 20 08:39:40 2026 Return-path: Envelope-to: archives@lists.xenproject.org Delivery-date: Wed, 20 May 2026 08:39:40 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1313725.1583826 (Exim 4.92) (envelope-from ) id 1wPcSo-0001V9-Gc; Wed, 20 May 2026 08:39:38 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1313725.1583826; Wed, 20 May 2026 08:39:38 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wPcSo-0001V2-Dg; Wed, 20 May 2026 08:39:38 +0000 Received: by outflank-mailman (input) for mailman id 1313725; Wed, 20 May 2026 08:39:37 +0000 Received: from mx.expurgate.net ([195.190.135.10]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wPcSm-0001Uw-La for win-pv-devel@lists.xenproject.org; Wed, 20 May 2026 08:39:37 +0000 Received: from mx.expurgate.net (helo=localhost) by mx.expurgate.net with esmtp id 1wPcSm-006o5r-0I for win-pv-devel@lists.xenproject.org; Wed, 20 May 2026 10:39:36 +0200 Received: from [10.42.69.5] (helo=localhost) by localhost with ESMTP (eXpurgate MTA 0.9.1) (envelope-from ) id 6a0d7341-5cb7-0a2a0a5109dd-0a2a4505add4-22 for ; Wed, 20 May 2026 10:39:35 +0200 Received: from [185.255.28.34] (helo=prod-mta-13.swg-srv.net) by tlsNG-c201ff.mxtls.expurgate.net with ESMTPS (eXpurgate 4.56.1) (envelope-from ) id 6a0d7347-aaa8-0a2a45050019-b9ff1c228b05-3 for ; Wed, 20 May 2026 10:39:35 +0200 Received: from mail2.vates.fr ([37.26.189.201] mail2.vates.fr) (Authenticated sender: 8631fc262581453bbf619ec5b2062170/smtp/7773de5a-2839-4720-82ee-e06722ae1d3e) by prod-mta-13.swg-srv.net (ZoneMTA - prod-mta-13) with ESMTPSA id 19e448a4bcf000f373.002 for (version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384); Wed, 20 May 2026 08:39:34 +0000 Received: from [192.168.1.61] (155.223.66.37.rev.sfr.net [37.66.223.155]) (Authenticated sender: ngoc-tu.dinh@vates.tech) by mail2.vates.fr (Postfix) with ESMTPSA id 0EB0286332; Wed, 20 May 2026 10:39:34 +0200 (CEST) X-BeenThere: win-pv-devel@lists.xenproject.org List-Id: Developer list for the Windows PV Drivers subproject List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: win-pv-devel-bounces@lists.xenproject.org Precedence: list Sender: "win-pv-devel" Authentication-Results: eu.smtp.expurgate.cloud; dkim=pass header.s=selector1 header.d=vates.tech header.i="@vates.tech" header.h="From:Subject:Date:Message-ID:To:MIME-Version:Content-Type:In-Reply-To:References:Feedback-ID" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=vates.tech; q=dns/txt; s=selector1; bh=Zsd7+mZMlEduk15vYieHG7nYGEVJIn5EoZwE9pAR/EM=; h=from:subject:date:message-id:to:mime-version:content-type:in-reply-to:references:feedback-id; b=l+MSd+cehIfdb5/wt/55XqqDmXJl4Oyz7fiwo9PTU7xGzJbU8VvmCGf7k8uJl5gRrviIcO0Pn jIkT0zd5fBMshPIyzHUjXgfG5sxe4dq0pUUlynTpqBPnon0upCekjcDhCyfvyJDJ4oz75uvnSaH EhHh/s3baA1pgQwM7qGUJutqvpGUzL5dcib8OYIT54247nKfvA+B/dYFyr6yc+TiVYUEA/Q2qoU gMSa38RbHQHSas8G3X6qk1MjbmjETO7k50QdTM9gjF7+lC7VyNUw2g6giAm9Mdq0D2tqHXhi/Gg 2ka11JU56tLZLiOhazyQQtcTZ+WwncEsYjaeLXiITojg== X-Zone-Loop: 16df06754094f3e381693436f955108be50f73917a38 x-campaign-type: default x-transaction-id: 07f2438a-4234-4020-85c0-9989a4b13871 x-swg-uid: 01-06c4b01a-c09a-413c-9068-c504c05a2300 X-Mailer: Sweego Message-ID: <1779266374.8631fc262581453bbf619ec5b2062170.19e448a4bcf000f373@vates.tech> x-swg-bid: 1779266374.8631fc262581453bbf619ec5b2062170.19e448a4bcf000f373 Feedback-ID: default:8631fc262581453bbf619ec5b2062170:Sweego x-campaign-id: default x-client-id: 8631fc262581453bbf619ec5b2062170 X-Originating-IP: [37.26.189.201] Date: Wed, 20 May 2026 10:39:33 +0200 MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [XENVBD PATCH 3/3] ring: Weaken and delete unnecessary barriers To: Owen Smith , "win-pv-devel@lists.xenproject.org" References: <1779099870.8631fc262581453bbf619ec5b2062170.19e3a9da3de000f373@vates.tech> <20260518102530.873-1-ngoc-tu.dinh@vates.tech> <1779099938.8631fc262581453bbf619ec5b2062170.19e3a9eaca8000f373@vates.tech> Content-Language: en-US From: Tu Dinh In-Reply-To: X-BM-Disclaimer: Yes Content-Type: multipart/alternative; boundary="-=Part.fc4.288fbe091fb80e06.19e448a49e6.1c40a569b10a26c8=-" X-Bm-Milter-Handled: 4ffbd6c1-ee69-4e1b-aabd-f977039bd3e2 X-Bm-Transport-Timestamp: 1779266374118 X-purgate-ID: tlsNG-c201ff/1779266375-D8B78443-CF6E6CFA/0/0 X-purgate-type: clean X-purgate-size: 1511 ---=Part.fc4.288fbe091fb80e06.19e448a49e6.1c40a569b10a26c8=- Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable On 20/05/2026 10:35, Owen Smith wrote: > While there is potentially a difference between xen_rmb() and xen_wmb() = in Linux, both > are defined as KeMemoryBarrierWithoutFence() in the Windows drivers=2E > Is it necessary to have both entries here? > I take it that using xen_mb() (i=2Ee=2E KeMemoryBarrier()) is not requir= ed, and a single > KeMemoryBarrierWithoutFence() should be sufficient >=20 > Owen >=20 > @@ -1260,7 +1260,8 @@ BlkifRingPoll( > Retry =3D TRUE; > } >=20 > - KeMemoryBarrier(); > + xen_rmb(); > + xen_wmb(); >=20 > BlkifRing->Front=2Ersp_cons =3D rsp_cons; > BlkifRing->Shared->rsp_event =3D rsp_cons + 1; I think the main difference would be in architectures with a weak memory= =20 model (ARM64) if we ever decide to port the Windows PV drivers there=2E At= =20 the same time, WDK doesn't seem to provide an equivalent barrier (we'd=20 have to resort to C11 barriers perhaps?) So I decided to keep both for=20 correctness with the release semantics that I was looking for=2E Should we make our own acquire/release barrier macros for this purpose? -- Ngoc Tu Dinh | Vates XCP-ng Developer XCP-ng & Xen Orchestra - Vates = solutions web: https://vates=2Etech ---=Part.fc4.288fbe091fb80e06.19e448a49e6.1c40a569b10a26c8=--- From win-pv-devel-bounces@lists.xenproject.org Wed May 20 08:47:17 2026 Return-path: Envelope-to: archives@lists.xenproject.org Delivery-date: Wed, 20 May 2026 08:47:17 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1313728.1583830 (Exim 4.92) (envelope-from ) id 1wPcaC-0002ex-2g; Wed, 20 May 2026 08:47:16 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1313728.1583830; Wed, 20 May 2026 08:47:16 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wPcaB-0002eq-Vl; Wed, 20 May 2026 08:47:15 +0000 Received: by outflank-mailman (input) for mailman id 1313728; Wed, 20 May 2026 08:47:14 +0000 Received: from mx.expurgate.net ([195.190.135.10]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wPcaA-0002ek-L4 for win-pv-devel@lists.xenproject.org; Wed, 20 May 2026 08:47:14 +0000 Received: from mx.expurgate.net (helo=localhost) by mx.expurgate.net with esmtp id 1wPcaA-009SHC-0k for win-pv-devel@lists.xenproject.org; Wed, 20 May 2026 10:47:14 +0200 Received: from [10.42.69.8] (helo=localhost) by localhost with ESMTP (eXpurgate MTA 0.9.1) (envelope-from ) id 6a0d7511-bab6-0a2a0a5309dd-0a2a4508b3bc-2 for ; Wed, 20 May 2026 10:47:13 +0200 Received: from [40.93.196.61] (helo=SA9PR02CU001.outbound.protection.outlook.com) by tlsNG-c1860d.mxtls.expurgate.net with ESMTPS (eXpurgate 4.56.1) (envelope-from ) id 6a0d7510-63b5-0a2a45080019-285dc43d067a-3 for ; Wed, 20 May 2026 10:47:13 +0200 Received: from SA6PR03MB7760.namprd03.prod.outlook.com (2603:10b6:806:43c::5) by PH0PR03MB5879.namprd03.prod.outlook.com (2603:10b6:510:35::7) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.48.14; Wed, 20 May 2026 08:47:10 +0000 Received: from SA6PR03MB7760.namprd03.prod.outlook.com ([fe80::4d5b:a91f:46a3:4b38]) by SA6PR03MB7760.namprd03.prod.outlook.com ([fe80::4d5b:a91f:46a3:4b38%7]) with mapi id 15.21.0048.013; Wed, 20 May 2026 08:47:10 +0000 X-BeenThere: win-pv-devel@lists.xenproject.org List-Id: Developer list for the Windows PV Drivers subproject List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: win-pv-devel-bounces@lists.xenproject.org Precedence: list Sender: "win-pv-devel" Authentication-Results: eu.smtp.expurgate.cloud; dkim=pass header.s=selector1 header.d=citrix.com header.i="@citrix.com" header.h="From:Date:Subject:Message-ID:Content-Type:MIME-Version:x-ms-exchange-senderadcheck" ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=Mabd0ZXsPSbMZWDoz3pw1DHnt+d7mmRvjB0kjHpEVlB652m+HgBkwMIZVmWPJ4k4caBq4Wn39bbMrrqmO6HwyG8PpapNAdzSzaNnREaiYFcCi15UYhNb8lOGBK+9ajOMFdwTBQlH8vGOS/Ajy9r1tHz18pezwZI0EaCwHsWYmxBoxjprn7TqsLxTiy1wvR8ICLG8JeMuvlA3GwMKgSCYAVanRlX5OJPuOePSl5mfg4AdLLPyYrRnYpl+pRlmgK3IldY/U2peCp+ImKPP0QGd1Qxvjj/PDavZwRgykxd57RxKqY1Vk2GDIxyNKtDHRMGQ1yVi6xNo4yWl2ZRHE3d6HQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=3eoox2H+gWG6QxLY7rT0Tc6EnDVPe9osmdFCfvMm4tQ=; b=dDx1/86DNdDI3h9aDpV39W4kpFCYflijMu0RtlMcKCBnU3RH0pWmzgBzqXMCfv5efizkSq34AReBSurkxrHnu6D0J0NKExWq42T9qNVuzgPDs5n9hkzRxJtADxjjN1I8IBYPN8QAt95RBjzEXjw6qwQmW0v1TLV8EXkkTKP+l7RwVSagVLR2hf/QHI6WJ3RJa2ryyS0NC2g2GaUNDt+5TVFsqQu09bux+1aTlM5/S1CBZH8Aqy6vzfrORK5kUZYrhLadkXEBto4/EPRhqZtlNybUmzGoi5nV8cqedUZaanJLFi1j9HYQI6qtgIlk52CalvdlAphAG+kI4JCefV+mJg== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=citrix.com; dmarc=pass action=none header.from=citrix.com; dkim=pass header.d=citrix.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=citrix.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=3eoox2H+gWG6QxLY7rT0Tc6EnDVPe9osmdFCfvMm4tQ=; b=NTGJUuZvsa0PDReVXi9zwW2IWT1WI6nEhAE3QFiBEe54mPHcnBEEV/FXKjXwZmLUACf/rXZH5P7mX3+ZaWhvnaahVlw7/4xC09rM73zdjT+Ez0WiOdeyjZBbY9ODx4ueX8q4Y3isLRq7ZQa9yWiDbnPJXzUN8M1ZnYTuNQtKoPY= From: Owen Smith To: Tu Dinh , "win-pv-devel@lists.xenproject.org" Subject: Re: [XENVBD PATCH 3/3] ring: Weaken and delete unnecessary barriers Thread-Topic: [XENVBD PATCH 3/3] ring: Weaken and delete unnecessary barriers Thread-Index: AQHc5rCzi+cjmgFw5kWi32C+9vSCMrYWmNMQgAACKICAAAHQfA== Date: Wed, 20 May 2026 08:47:10 +0000 Message-ID: References: <1779099870.8631fc262581453bbf619ec5b2062170.19e3a9da3de000f373@vates.tech> <20260518102530.873-1-ngoc-tu.dinh@vates.tech> <1779099938.8631fc262581453bbf619ec5b2062170.19e3a9eaca8000f373@vates.tech> <1779266374.8631fc262581453bbf619ec5b2062170.19e448a4bcf000f373@vates.tech> In-Reply-To: <1779266374.8631fc262581453bbf619ec5b2062170.19e448a4bcf000f373@vates.tech> Accept-Language: en-GB, en-US Content-Language: en-GB X-MS-Has-Attach: X-MS-TNEF-Correlator: msip_labels: authentication-results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=citrix.com; x-ms-publictraffictype: Email x-ms-traffictypediagnostic: SA6PR03MB7760:EE_|PH0PR03MB5879:EE_ x-ms-office365-filtering-correlation-id: 6001868e-140d-47bd-1cb1-08deb64c6169 x-ms-exchange-senderadcheck: 1 x-ms-exchange-antispam-relay: 0 x-microsoft-antispam: BCL:0;ARA:13230040|376014|366016|1800799024|38070700021|11063799006|4143699003|22082099003|56012099003|18002099003; x-microsoft-antispam-message-info: M7eQ3nPHR6DMgRDTiO2EMsr/+dMqIHh7AtITlwtjurffOHSz/jaQNo9Ua3QYX4Ym2LEpDQBVyj+kCpIxQKOzIiBmQTd6wb8qPKGkSO5TnkLwj8UdZzZGBDsSELJXYCv8ZvFPn2hZE9Ee6099YnH/wmoCqS/gSV/7j3dHLpvQg+Us21Bb77Gqm+atrwxuI7GrClN19ZPcf4M+JRN6dLPbJOJNa5oV0+hksz+6lINKR6p/T+7mbQB5gsN13udN86NRABlFsqgQzlXCjIMvWfHhmseVeUGsw47pUKFcLU2Lfm2vV1ZFD0uVFt2AsE0nqo3pSjtTsXWRsVyTLYWRV4CMSFIxhUw22cZL5PeyrvGN9dc7Ff9mBw3ltfkhKTh5DlgNcx5QepViQo7gvZw669XhR0e4HHt34cT0xfGsiCTE1P0AL+CIUf9abW3BkY9rwiwzg7O0bZIjJN6ZaTbnR0poZk0IpEkbyl/9Mb3UphfcKi0Q4DA9TtvNywWmH4TojrsiYzbocWR1BG6CoKwdSxQH2GNUDwVbebYFQzyveulTTClc2f3cC4RD7nTPU4x0h+xSrhG/LhKDGszBaAJ5iWjBnL2C52hAFGUWYL8qI4hbvPuZEzXmAz+O1ijH3AXIAzb5svGcPySGcHFab8XmI4wuGF8RYebGS0BdHXwsGt8rc2CFD0DJQm/f9+88GhsQ9y8R x-forefront-antispam-report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:SA6PR03MB7760.namprd03.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(376014)(366016)(1800799024)(38070700021)(11063799006)(4143699003)(22082099003)(56012099003)(18002099003);DIR:OUT;SFP:1101; x-ms-exchange-antispam-messagedata-chunkcount: 1 x-ms-exchange-antispam-messagedata-0: =?us-ascii?Q?aZo/GAB4+eCV7PXcc47VtTL6tCzai/SEdgUXbTaTqPM4waJdTj8ES4HySP2I?= =?us-ascii?Q?SiHlS0JRMxxeNRFJsECBAj2YxjbQVO6EoIqzAlvS3HErUDiOXFEyvs5QG6dw?= =?us-ascii?Q?HthFW4VjuJqtzgdjJr2lVUn16/H0FTpdHAAI4F1eVv1Hl6bdaWkink0V4H0Q?= =?us-ascii?Q?nzHJllUQYAWTlyIh7MI58D+nUhu0cza1xtBZ9gCPC2ukY6ymPCd1R0H835Jo?= =?us-ascii?Q?BngiQwco5VuWBj4VPwDQ/fpbtY8qoEZo9Tfag5L8+o8HyKOpkZw6v831s+ZU?= =?us-ascii?Q?7rzSmFqKnvShG1kv4Uy6C+2o0O86gWlX8CJQjv4cpTayOSO18mUWt0Dzy4Vw?= =?us-ascii?Q?CJ8lGUcvHZoKtdy0kDn6mXVJiKPf2fcrA/fKUbSifGtkjIDGa+TgsjFbEIlD?= =?us-ascii?Q?yRW6JFGULdxpXNVvOLoKE26Sg7dmIKH6JL5l/yptCLeEkGBVZI785vTyUL9D?= =?us-ascii?Q?KIHfWb7XL41IC4mIIsG3RrQeLjm2fu24fukCXnQB0+JnFfFpkK63XvpU51Vr?= =?us-ascii?Q?dkaTWW7xJvFXRYN6PyqyidVT1PIgDxedvUQAjrnQFjvcsV4npghwF0ClnUgm?= =?us-ascii?Q?06PmqfPuV04EGR95vWED4/49JH0ONjLeNZts84O/Qrylb2exuKE6LkrgVufA?= =?us-ascii?Q?6OcZEyY5Vu7pgPP9vSjtoSIOycfHjXdoSCviO25iDAX3D9Q7tHzc9//tDmLz?= =?us-ascii?Q?0skr8YNdU5qaLMhA3bVdiWsa7ZhhxDgdi/ZGO04aC+LlZglYSW1Y9vEhBZEw?= =?us-ascii?Q?oA2MpOoSqVbm2YA2LwPDW1E02547HiXFEtLSs0Mmq7VZh1AEFxVY3+VjmzCK?= =?us-ascii?Q?RvHqqXFlcfAWkyWZ2QfGSJ8cur7QlchtCGxQgJ2ByEKbmky2gQsA/R2h7BIm?= =?us-ascii?Q?lu9A08x8aWFg1Rv59ZwOCskVdIWioh7wPVM4663zeD/rQi3o5Lkq9MhttL5G?= =?us-ascii?Q?bS3HqXR/+VkCLug8VMzmAber8NEl7tWSdTGdBJLLotzEq7gC+4DrZmACePoX?= =?us-ascii?Q?gaKnPlLA3Us0uDEWsE9mRMTO2A+kNU1WazjkYh/o0WkufFEmsUHpETDBkvaA?= =?us-ascii?Q?Tn/iJmhINoKGibyr1AG3AWq3btqv5hs+iwschh50i+EkJsJerxZUBFUC2/ez?= =?us-ascii?Q?IuHqMik7NtVfE5tdFHpgJYdRHrtvV/xVbiIgrp5Gks92xP2zaVFJaIpiavfr?= =?us-ascii?Q?2dqfyFXw1/LbXFPMO3ka4sKmf5ndDwhIk2ULyPGB9Cfzd9XwApTEsx1yhkhJ?= =?us-ascii?Q?ShAO105wnL9AeOCoH4H9j8XdT1HE67dMcY5HNwzqLPImc53IuNXQIlCLLUVD?= =?us-ascii?Q?k/RWZaJBXEqR8BiH9T3305ib8srVr1X9VdYtl0QV0Mknfc5iJVT0b27pqrW0?= =?us-ascii?Q?gf1I2z0XZuRftj4aUpZcimqWQNQclBJ15xGucKN6S6DmHwOznRH5mihKEbHG?= =?us-ascii?Q?nIvW6UnKAPAiYlucOjdPv/RGFG6IaAK2LW9VymP0w0i8SXpw4VEoop28ngAV?= =?us-ascii?Q?E6GAp2HdYdrwdmx28OGPxMbEruq4jYbsBTQTfRNR2sx/qXgxZPN3DGWc5g3P?= =?us-ascii?Q?OzaC/8JGWq1jmWdnDiQyZfAKW184EqJl15SsM092ASVo+XPVkQAUatI67Dq/?= =?us-ascii?Q?FsZ6vbvmub3lza0xKhKOuhjfwyfraakElz96/an4Qa8VYnEHkFmmgb3IKJBV?= =?us-ascii?Q?bhufznHZYKX04JG4dVzxA8qbfw1EKhmcPQW0bgHw/LlbHc9+?= Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-OriginatorOrg: citrix.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: SA6PR03MB7760.namprd03.prod.outlook.com X-MS-Exchange-CrossTenant-Network-Message-Id: 6001868e-140d-47bd-1cb1-08deb64c6169 X-MS-Exchange-CrossTenant-originalarrivaltime: 20 May 2026 08:47:10.0817 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 335836de-42ef-43a2-b145-348c2ee9ca5b X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: Lljj45oS8mLB30qm2bkLIJAffaNryYLvR2CZyssPeKzCS7a22jxaUoeUa1TlGgriXemP8oouVef/Wa9hK22hgg== X-MS-Exchange-Transport-CrossTenantHeadersStamped: PH0PR03MB5879 X-purgate-ID: tlsNG-c1860d/1779266833-B7B7CDB1-16E8AB8F/0/0 X-purgate-type: clean X-purgate-size: 1735 I think this should be fine, 2 compiler barriers back-to-back shouldnt have significant additional overhead, and should still be lower than a full barr= ier I'm just running some basic tests, but this series looks good so far Owen ________________________________________ From: Tu Dinh Sent: 20 May 2026 9:39 AM To: Owen Smith; win-pv-devel@lists.xenproject.org Subject: Re: [XENVBD PATCH 3/3] ring: Weaken and delete unnecessary barrier= s On 20/05/2026 10:35, Owen Smith wrote: > While there is potentially a difference between xen_rmb() and xen_wmb() i= n Linux, both > are defined as KeMemoryBarrierWithoutFence() in the Windows drivers. > Is it necessary to have both entries here? > I take it that using xen_mb() (i.e. KeMemoryBarrier()) is not required, a= nd a single > KeMemoryBarrierWithoutFence() should be sufficient > > Owen > > @@ -1260,7 +1260,8 @@ BlkifRingPoll( > Retry =3D TRUE; > } > > - KeMemoryBarrier(); > + xen_rmb(); > + xen_wmb(); > > BlkifRing->Front.rsp_cons =3D rsp_cons; > BlkifRing->Shared->rsp_event =3D rsp_cons + 1; I think the main difference would be in architectures with a weak memory model (ARM64) if we ever decide to port the Windows PV drivers there. At the same time, WDK doesn't seem to provide an equivalent barrier (we'd have to resort to C11 barriers perhaps?) So I decided to keep both for correctness with the release semantics that I was looking for. Should we make our own acquire/release barrier macros for this purpose? -- Ngoc Tu Dinh | Vates XCP-ng Developer XCP-ng & Xen Orchestra - Vates solutions web: https://vates.tech From win-pv-devel-bounces@lists.xenproject.org Wed May 20 10:03:12 2026 Return-path: Envelope-to: archives@lists.xenproject.org Delivery-date: Wed, 20 May 2026 10:03:12 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1313778.1583853 (Exim 4.92) (envelope-from ) id 1wPdlf-0005T2-Il; Wed, 20 May 2026 10:03:11 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1313778.1583853; Wed, 20 May 2026 10:03:11 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wPdlf-0005Sr-F1; Wed, 20 May 2026 10:03:11 +0000 Received: by outflank-mailman (input) for mailman id 1313778; Wed, 20 May 2026 10:03:10 +0000 Received: from mx.expurgate.net ([195.190.135.10]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wPdld-0005S0-TL for win-pv-devel@lists.xenproject.org; Wed, 20 May 2026 10:03:10 +0000 Received: from mx.expurgate.net (helo=mx.expurgate.net) by mx.expurgate.net with esmtp id 1wPdld-00FDzl-9H for win-pv-devel@lists.xenproject.org; Wed, 20 May 2026 12:03:09 +0200 Received: from mx.expurgate.net (helo=localhost) by mx.expurgate.net with esmtp id 1wPcPF-00FPVr-9k for win-pv-devel@lists.xenproject.org; Wed, 20 May 2026 10:35:57 +0200 Received: from [10.42.69.10] (helo=localhost) by localhost with ESMTP (eXpurgate MTA 0.9.1) (envelope-from ) id 6a0d7262-2eae-0a2a0a5409dd-0a2a450a9bae-42 for ; Wed, 20 May 2026 10:35:57 +0200 Received: from [52.101.46.7] (helo=CO1PR03CU002.outbound.protection.outlook.com) by tlsNG-4011c0.mxtls.expurgate.net with ESMTPS (eXpurgate 4.56.1) (envelope-from ) id 6a0d726a-56b3-0a2a450a0019-34652e078afa-4 for ; Wed, 20 May 2026 10:35:56 +0200 Received: from SA6PR03MB7760.namprd03.prod.outlook.com (2603:10b6:806:43c::5) by PH0PR03MB6606.namprd03.prod.outlook.com (2603:10b6:510:b4::22) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.48.14; Wed, 20 May 2026 08:35:52 +0000 Received: from SA6PR03MB7760.namprd03.prod.outlook.com ([fe80::4d5b:a91f:46a3:4b38]) by SA6PR03MB7760.namprd03.prod.outlook.com ([fe80::4d5b:a91f:46a3:4b38%7]) with mapi id 15.21.0048.013; Wed, 20 May 2026 08:35:52 +0000 X-BeenThere: win-pv-devel@lists.xenproject.org List-Id: Developer list for the Windows PV Drivers subproject List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: win-pv-devel-bounces@lists.xenproject.org Precedence: list Sender: "win-pv-devel" Authentication-Results: eu.smtp.expurgate.cloud; dkim=pass header.s=selector1 header.d=citrix.com header.i="@citrix.com" header.h="From:Date:Subject:Message-ID:Content-Type:MIME-Version:x-ms-exchange-senderadcheck" ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=MCO4AhEo7QyCeVZNp3gM3rltSho3SUHQMinKcrOkRGOKkJ32JaGfii6SRXo8NANQ7LTt8tpKTSg9JGc37ihS4sIuBOr70Qs5pir7siHjZskIMir1USBICOV0P4snnhfeH6FmAk202fHIHQa32dj9R8oAO/MasC6OanyAO0wa6wcMdu9ef7eDd3Kfo7KFpeg0TFs5Z+tJ0aCkmHmIOAwUSWsgCU646+oJp1pSf+ks0ie37eF3b4RBb897Z00FE4c6QVJ8/h024/+NHvWCQ6vkearf4uCanBpMNeWVsU69QBoxf+HSp5BMoTMzJo7AUP09LGmm+XZv74gcTMvrTkbHfQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=tjpjZ0L9g4qRxYJ0RGtwwDvLE/IWxGCxzGBR2dCK8rs=; b=xqzyhytiXkEjxG3bYjDiZN3UMXy3rAdNFkOaYjq8O+hpw6j8ro2MVedy0qBs7a1WTg1FW6M6HKw6cy2ryfTh4HVgjWDF0Cvf9nXwj+EAUvMC8m7Hbq6maD0fFapWrfxDNDPhjMWTUnID02CB38vYa8nbUrPorSgHeZDhBV7g3Qclu4HDeeuHFPz0MlMuJAJVpA7ylh7KSPOvxICA1XXZwnplTDHTM8+fLb0ZHB3maI1VZ4GygH0VJBAf5LizlKOPbePz4sqonn6tstIGTROc8athfADbx6jxR7WmJ1mtOKg5ROKuhHCMkeKMA/6+MY+/wtgud5WSCPFLRMdW5CflBQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=citrix.com; dmarc=pass action=none header.from=citrix.com; dkim=pass header.d=citrix.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=citrix.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=tjpjZ0L9g4qRxYJ0RGtwwDvLE/IWxGCxzGBR2dCK8rs=; b=BN96CM+WZb0ykB7zzaTH03u5XZFQSVOHMQoPAQWc67WWjiZElSPw5q1UcV1vpwzTM05CBAeWvivK0N+erBmcAkALviGYRdV5xAyIem0Fh3jTWQkQSrCg53tiREDKYjdOgxb8c7tIu9JGIhapI7bZeCxTgi11A6jhuXNcpRoia+o= From: Owen Smith To: Tu Dinh , "win-pv-devel@lists.xenproject.org" Subject: Re: [XENVBD PATCH 3/3] ring: Weaken and delete unnecessary barriers Thread-Topic: [XENVBD PATCH 3/3] ring: Weaken and delete unnecessary barriers Thread-Index: AQHc5rCzi+cjmgFw5kWi32C+9vSCMrYWmNMQ Date: Wed, 20 May 2026 08:35:52 +0000 Message-ID: References: <1779099870.8631fc262581453bbf619ec5b2062170.19e3a9da3de000f373@vates.tech> <20260518102530.873-1-ngoc-tu.dinh@vates.tech> <1779099938.8631fc262581453bbf619ec5b2062170.19e3a9eaca8000f373@vates.tech> In-Reply-To: <1779099938.8631fc262581453bbf619ec5b2062170.19e3a9eaca8000f373@vates.tech> Accept-Language: en-GB, en-US Content-Language: en-GB X-MS-Has-Attach: X-MS-TNEF-Correlator: msip_labels: authentication-results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=citrix.com; x-ms-publictraffictype: Email x-ms-traffictypediagnostic: SA6PR03MB7760:EE_|PH0PR03MB6606:EE_ x-ms-office365-filtering-correlation-id: 0aa59225-94c4-4b4a-49c2-08deb64acda3 x-ms-exchange-senderadcheck: 1 x-ms-exchange-antispam-relay: 0 x-microsoft-antispam: BCL:0;ARA:13230040|1800799024|376014|366016|38070700021|4143699003|22082099003|18002099003|56012099003|11063799006; x-microsoft-antispam-message-info: zBFMc8lYAArrL8IF/el39Iluf/8M5gehHEM2LlzWYEU+DjVsrG7TI1buTHwcdmLBy93IwbB62/GTTvxzL5U3O3bsTT0TyBJs+MlgHUREkOU3zbO4/mgeDWUZT+B7386mLT8MEOSJoT+kSU6fk+yl3uoJQ4UcDLeHZjnc0ksErRfcI54nrv1+r/3kArLhRvGZ/ODHV9OszNXNxWzSuu5oeDjYMdAnz2MkI6vZoxfaAhj7W7Lqf6f3bldC8JoXvb1UIHCHQU71pZZYrSXrSygXOgYZveph5+e1YMbDRjX266q/gkWvDIJbDTURg/RGQOjfS80IghEUEV0FNDuVWX4QeYo2ObvQrR1Kwlp8CAeh3SKxBjkYAkjs07wp5lpRO9v1CtGx9NodRvUK8wGtaCNFI/QWDUO2s6TNt1Ph4Dta+Zld6kEfvBCQ1LVpyZ86zAeRen9qFzYRlvl2StqqAxPn6w7z6uXf4Q+aOBtwghTGbWXlIRFIhnQ/61FodwXNWsFIYVHdAx+flB7l9OYELTSgEuA1A7gPQDeCbyd9tvpLsRbmZsKJcCqHfaG1BBmDx81GsZkvMvXHq0GO1eWSGJVkh2hBNE5Mzxr7cxl69ABh4yCUZEzGu4UG4jj4hKF3V0Bwv9yV2EvM06ZH1VBYtMzsfO/8nqyKlGISifHxYavhZIjHdcJuhGK8X+yCWjvMUFEW9WJO8y4+ESlrvmBqVAbSC9GwYoX9PsDS8hqrt3fxbuB8+Rpl2lqjZ9mOI0UQukCa x-forefront-antispam-report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:SA6PR03MB7760.namprd03.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(1800799024)(376014)(366016)(38070700021)(4143699003)(22082099003)(18002099003)(56012099003)(11063799006);DIR:OUT;SFP:1101; x-ms-exchange-antispam-messagedata-chunkcount: 1 x-ms-exchange-antispam-messagedata-0: =?iso-8859-1?Q?/MbUWwwdRT16syBcnjmDq6N8XmWlxIJKY9c+sHOBOp2k6R1RzuD+9gvL2y?= =?iso-8859-1?Q?XovUqM5JbkQozXYRw0knMFcg9iYtes5wm1MryFcy7HWRjx2OWmBKDe/Pui?= =?iso-8859-1?Q?wIkKyG0YxkJFzO+fjBRlEuR6Df6hix7O99JH7IxkZQOhJFZywHN2fLsJbf?= =?iso-8859-1?Q?Bve+Zmkb6j2n/V4WmAfSLaAp/MPIdF7EPzWzPJpK4iTpv7X7rKFWOhEy0k?= =?iso-8859-1?Q?c1R+ejU0OSwPJSw3BFrRNIhH5s05qaP/1dKVjspcyc2V31ai77KUHBjMYh?= =?iso-8859-1?Q?HAU0+SR7S/wIlNhbCI6vDpvB+KkFm62LwbpBEmkbAcKcibGOKplMyfqXyD?= =?iso-8859-1?Q?XV+G8tMjw0oiShG3wVZFMhBgax0ROguERpmJH/hb0XkefdOTXvjp7fKNjv?= =?iso-8859-1?Q?PWemnXlx9kKoUJ3ZYURer4jvyXTiqS8iTxqpsBAeX2IXjQT2zT0QcT1jLE?= =?iso-8859-1?Q?beQ6vEPBdPLuy1Yjd5mCsZWjweKZdWAjp6QvyuGynIUsxaAbIJf6k1Ht5a?= =?iso-8859-1?Q?IPBA7HE3D+Kxk8r9jjlI2/vmeWnvdwy1Jnhqnup7nQmB3TdDwyS50RuX5B?= =?iso-8859-1?Q?wdL+EP27PaKvsAMAgbCtJqjdOrunfeQP3kL0N3llqrLMJ9zQS9Imw96jvc?= =?iso-8859-1?Q?b4EQsVMd/CC0WLAeNqHHWe4BldFNbhdw+kr7GvzcV3t7c55MSyQGSuwfVK?= =?iso-8859-1?Q?b37swg1tky/Y0BMjVI8qo7wbtk4+twCPAypLk5Mjwu5oMHOI0V1HJZ7qjn?= =?iso-8859-1?Q?rtavBONAE6Mlt0grU41q7skkFbEBGHiJ9LuZDkz9ALomPmg0K9gv3yZ2Pt?= =?iso-8859-1?Q?+xp1tar2ltMaEI9+NlxYZc3OzazBl8n86JHv+uWfzyNHQdNZ6v2cRVcEnP?= =?iso-8859-1?Q?TiTnLduYzJOd5AYZ1RG4ctbYEIh2YidlnaD5uI3VKPlc7/gc3tpyrncF2C?= =?iso-8859-1?Q?lcDPVXA6Sa9RWW3RDKY4euBHkWwWWJWAVETop/krJq+3MPedN0/9Q5yx0k?= =?iso-8859-1?Q?PXoFTW4/K2Dkf4hegODMnPvcKknAN6AfDWh7OoM8G8iQVZ3eHdKE1F4HNa?= =?iso-8859-1?Q?R/vpHZ/u4pFP+Pzy9spFkbxyTkiAxP7CPbUUMJtrQEyY0hAkOt1hkJTP5k?= =?iso-8859-1?Q?4CqWE08Zf3QQw44KOhgmsNnZmHbvWomr/9VQcsESEm1/0YR71/CF5NSYlW?= =?iso-8859-1?Q?j1zj9WcQ0OepjoW2+A1gK0uTxr0527aVOw0F4bfUIgQmcyxZqh3Ee7VDEg?= =?iso-8859-1?Q?/Z88wDrC4/yyh6DWNAlLlubi9ge+vwN5BSEWRk6F0jAjKEMde4hB40xI6K?= =?iso-8859-1?Q?aZOXt/ugsUleV75329zXB8m6f96ocOa1oGI+bKlvt1DZtNyaSUOQYfLYAc?= =?iso-8859-1?Q?jl2hCSfnfhSF8/7hL7tL3DzI24bVKA6VEL/UtX/ezwTHE0o0iou2nEJY6r?= =?iso-8859-1?Q?ZoXONF6RaFOIkKFxhWwp0qfm/DWkk8TguRHe0+t1Hhr/lr5Jwon73yObo9?= =?iso-8859-1?Q?psTI4LJ2qphI7IxFdq4OncwKtfF8xBQGuw3wKhvIHvL94Ch3bW98XTKSyy?= =?iso-8859-1?Q?uIy7MumMpfuJmghACgtMCpXvtfi9aI0a6jIWQEGGC0DgfDjaMCVbko1VbN?= =?iso-8859-1?Q?GsR3mtHDtmLcBjDR2pf/FD2as/7ymQYTkR5JYK3sGq/WQgvaNQ9J5JUgSy?= =?iso-8859-1?Q?qQVkIut/D66QxWSS3cFE+1/sUjHNotKlmVWGX+8pY9oBzT825Pr1nr9nJb?= =?iso-8859-1?Q?rdZJj2nGEdevuaS8wML5tcramsJggZr2vEaIszvOnyj5NF?= Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-OriginatorOrg: citrix.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: SA6PR03MB7760.namprd03.prod.outlook.com X-MS-Exchange-CrossTenant-Network-Message-Id: 0aa59225-94c4-4b4a-49c2-08deb64acda3 X-MS-Exchange-CrossTenant-originalarrivaltime: 20 May 2026 08:35:52.6557 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 335836de-42ef-43a2-b145-348c2ee9ca5b X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: 0A8wZG3wvAl7bFAHv3Z8IsmgCBE/rbvuqy+JaCs9OA1u2ITgAQ2uhpjok/JoUgURYgjQiqK8qcWIgHTKJN9bdQ== X-MS-Exchange-Transport-CrossTenantHeadersStamped: PH0PR03MB6606 X-purgate-ID: tlsNG-4011c0/1779266157-729768B7-2C8EF3DE/0/0 X-purgate-type: clean X-purgate-size: 694 While there is potentially a difference between xen_rmb() and xen_wmb() in = Linux, both=0A= are defined as KeMemoryBarrierWithoutFence() in the Windows drivers.=0A= Is it necessary to have both entries here?=0A= I take it that using xen_mb() (i.e. KeMemoryBarrier()) is not required, and= a single=0A= KeMemoryBarrierWithoutFence() should be sufficient=0A= =0A= Owen=0A= =0A= @@ -1260,7 +1260,8 @@ BlkifRingPoll(=0A= Retry =3D TRUE;=0A= }=0A= =0A= - KeMemoryBarrier();=0A= + xen_rmb();=0A= + xen_wmb();=0A= =0A= BlkifRing->Front.rsp_cons =3D rsp_cons;=0A= BlkifRing->Shared->rsp_event =3D rsp_cons + 1;=0A= From win-pv-devel-bounces@lists.xenproject.org Wed May 20 14:47:37 2026 Return-path: Envelope-to: archives@lists.xenproject.org Delivery-date: Wed, 20 May 2026 14:47:37 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1314058.1584081 (Exim 4.92) (envelope-from ) id 1wPiCu-0005Bd-B6; Wed, 20 May 2026 14:47:36 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1314058.1584081; Wed, 20 May 2026 14:47:36 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wPiCu-0005BW-8J; Wed, 20 May 2026 14:47:36 +0000 Received: by outflank-mailman (input) for mailman id 1314058; Wed, 20 May 2026 14:47:35 +0000 Received: from mx.expurgate.net ([195.190.135.10]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wPiCt-0005BI-Dc for win-pv-devel@lists.xenproject.org; Wed, 20 May 2026 14:47:35 +0000 Received: from mx.expurgate.net (helo=localhost) by mx.expurgate.net with esmtp id 1wPiCs-0082Qi-Pw for win-pv-devel@lists.xenproject.org; Wed, 20 May 2026 16:47:34 +0200 Received: from [10.42.69.3] (helo=localhost) by localhost with ESMTP (eXpurgate MTA 0.9.1) (envelope-from ) id 6a0dc97e-5cb7-0a2a0a5109dd-0a2a45038d8a-26 for ; Wed, 20 May 2026 16:47:34 +0200 Received: from [52.101.52.48] (helo=BL2PR02CU003.outbound.protection.outlook.com) by tlsNG-33051d.mxtls.expurgate.net with ESMTPS (eXpurgate 4.56.1) (envelope-from ) id 6a0dc985-672d-0a2a45030019-3465343049f8-3 for ; Wed, 20 May 2026 16:47:34 +0200 Received: from SA6PR03MB7760.namprd03.prod.outlook.com (2603:10b6:806:43c::5) by MN2PR03MB5328.namprd03.prod.outlook.com (2603:10b6:208:1e2::7) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.9913.12; Wed, 20 May 2026 14:47:32 +0000 Received: from SA6PR03MB7760.namprd03.prod.outlook.com ([fe80::4d5b:a91f:46a3:4b38]) by SA6PR03MB7760.namprd03.prod.outlook.com ([fe80::4d5b:a91f:46a3:4b38%7]) with mapi id 15.21.0048.013; Wed, 20 May 2026 14:47:31 +0000 X-BeenThere: win-pv-devel@lists.xenproject.org List-Id: Developer list for the Windows PV Drivers subproject List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: win-pv-devel-bounces@lists.xenproject.org Precedence: list Sender: "win-pv-devel" Authentication-Results: eu.smtp.expurgate.cloud; dkim=pass header.s=selector1 header.d=citrix.com header.i="@citrix.com" header.h="From:Date:Subject:Message-ID:Content-Type:MIME-Version:x-ms-exchange-senderadcheck" ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=YOlyC3fvGvxbSnkWG663ffel2LvZwTBGozXXhH9F+d3vE+gN+Ct2RuO2cCNmrJlJ5V9smURFo2x4keYx3nV1/WqVc0DERA8T40Bx+QuuM0wicmQRTCSUWqdrwUFSviGxcrsNVNrvrc/A5fOY2g5Gg7kpAQpQE4cApbJ20lJTvioBmXntD34JhGk9rxWkFWcrGa8qptwWUIty+/bDUjHHHq2onqCwbbh5yL1RuLXFRyWMBT+foeF4k3SewPWj0SaFIvUr+HmVrT87BSJkOPxwMCdcfY6TY8gkI3uAB7F1fRzszpxEqodcM2W+QDl/5yV8ddaSYEZaPRE9AV9l0QWFog== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=5u9CWZHPbSyytk77SLNejKTR8RPMpdi60m2fRcbykBI=; b=RwWWwF5KSg5Xa1ooHr/64l9PdGaDcGHU/SBhC7UPvrSJ+aSuUXI/ez164cPCx+5KUmQhavIsL6urY9uXrd9gjh1Fe6neg4EPawRjdnElAq0F08KcwVTtywUX+d/slMU+x2WKIHIYkf/3WmWeILVD0GtUcCFfnMZK2EPMXGgd/2/9qixE4CCj8nz9HwoDmlOUqe/Tpr2umxCUX/WCUZ3drd7dxYkrfmYhZ1boPILT8v9P7YMTzXMu+GqPW8dpfGoVK9b2UnGtrzuSp/4+UIIoKkAfR1hnHInGSLIS407ym67cKRFq1gpc1yHC/dGnnjkoMPbxIneRS+BcX9xyIRWu0w== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=citrix.com; dmarc=pass action=none header.from=citrix.com; dkim=pass header.d=citrix.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=citrix.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=5u9CWZHPbSyytk77SLNejKTR8RPMpdi60m2fRcbykBI=; b=UaLGkVmFG69kierS5FikGdsf1GAWsQaSToL/LMVWNNrEzdqNDCBfdWsv/BV5HzcNl9ERO1WwEOhf1+g75v6BPiVJWvvpDzo1FoqHoVUvPHYtvA0au0K89R5adxdOklwoRQ+wcxL7vW5sYVsTBOLX5bYsTjHZzF2tHWhK/6U3yi8= From: Owen Smith To: Tu Dinh , "win-pv-devel@lists.xenproject.org" Subject: Re: [PATCH MULTISERIES] Optimize Xen barriers Thread-Topic: [PATCH MULTISERIES] Optimize Xen barriers Thread-Index: AQHc5rCPv+zIYIja00qaP9EWQqQkLrYXAZ6J Date: Wed, 20 May 2026 14:47:31 +0000 Message-ID: References: <1779099870.8631fc262581453bbf619ec5b2062170.19e3a9da3de000f373@vates.tech> In-Reply-To: <1779099870.8631fc262581453bbf619ec5b2062170.19e3a9da3de000f373@vates.tech> Accept-Language: en-GB, en-US Content-Language: en-GB X-MS-Has-Attach: X-MS-TNEF-Correlator: msip_labels: authentication-results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=citrix.com; x-ms-publictraffictype: Email x-ms-traffictypediagnostic: SA6PR03MB7760:EE_|MN2PR03MB5328:EE_ x-ms-office365-filtering-correlation-id: 487f2061-8571-4343-c5b0-08deb67eb8d5 x-ms-exchange-senderadcheck: 1 x-ms-exchange-antispam-relay: 0 x-microsoft-antispam: BCL:0;ARA:13230040|366016|376014|1800799024|3023799007|38070700021|11063799006|18002099003|22082099003|56012099003; x-microsoft-antispam-message-info: 80GIUC7Hs22iM6jE75pYiK9RvZkDn/ABP7kiGilZgM8mYDjB1amfDBQK5dXeimCGhpADU87eb5/JvTYjvYT+vHHIsuXQV8K3A53pkM+NNGy8wYRsrOwvrZA01t9a3EFYHG7Sf5BfwrhnDHbGSFnu2t11MkN087ll99upfS5tVT2+r4xjJkz9Jc/uNbP4tLf0XvylbYlvs7yxD4jrxyxM46zf3r/nrExH13DGwqbrraJMKv+ndAZ09FfTQmSVkzLC3kTkwPmsZAaQQoUCuM/p3a/BqMIpn2B33Lk0B8IWFIgVeox6BGrJT877TNyqtFe2msulQ2QFrZu0m0enyy3NM68di2K+FXSFmRjcpigOm99gaXbLU4lhsd82fMOF+oCciS41mhOxjdShU/1M5aIB7Vgmx7EeS7HwOdMqpZkRNbGjpqePMpW8R9aoiO2BGEOEEDM72Igiazcz3KLgU//D2Vgmhv/Clb1LmeeW+GO9tVPVC1u1s9g1M0TM7yjLF1R0cx8irIcWZUv+UiwvGIXfzL7ZLMHQ3HYarWciDETSxSlhUuF2mIXGBe7wVnCDLCOfIMePyeSkW+cqxYeW1I3wnFKI0lkKyFngtmzrSjn8adYaW/QjmNlS5d5IW8ke2M1T/nrJC2FreiRAgLAmywC5241K+l6vqulv861hNXg0shjXKbP2qR6IfQouGoi0aGqL x-forefront-antispam-report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:SA6PR03MB7760.namprd03.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(366016)(376014)(1800799024)(3023799007)(38070700021)(11063799006)(18002099003)(22082099003)(56012099003);DIR:OUT;SFP:1101; x-ms-exchange-antispam-messagedata-chunkcount: 1 x-ms-exchange-antispam-messagedata-0: =?us-ascii?Q?6yX3noKAI3+vjh6DJ+pY6RrF7u6+2mtICxE+FmiKXd7GjCWifxM25mKfh9kI?= =?us-ascii?Q?eD47U4Tae+wjF5McC/vhiApgrFI28/agmpgLc9rPOnbJs+32Z2bbWS8EVerZ?= =?us-ascii?Q?xW7cqUD0Wf7QvDsRuKM6J0YrlutENOvLSXc/V9N7qoLwKis8Ik9qdhZqidkX?= =?us-ascii?Q?FyyMaNIhsJpsruRsYggYETHsBIlf6TM+RxwAkEbDf6xqoSQOZjZkXONdb04a?= =?us-ascii?Q?e6xvNIuqdgdjsc5i+2i8ChcZEbXhhUqBk0Igu33kNH4iuJWib0R5g/3ynPby?= =?us-ascii?Q?KSSzrfMe42U6bPWPlbQ0OvD/Fow+6x9pm807hmVroNJMmzX68P5wAauiFGfe?= =?us-ascii?Q?wy5/ha7TTVBkwR4IUTaH10v80+6ugm6bZObK6I58BjDV6lMQKzCvECW3v7nt?= =?us-ascii?Q?hV4sD36oMHfs00+LUnnxQCJ7C5Y9jcx0gBy4y6z3BNoArdSkiQRH32QG2L7n?= =?us-ascii?Q?oFFcvakyiPlS+PI/1gMbL/kg4cqqNKKVZDXjSjfdMO2bJ5vsYn7q3Pfyzyxy?= =?us-ascii?Q?VFhhvNgCB+1xW1e8CxtUoiZ6S7Yph+DX1JyGLMTCyTyjaO5rha2xuUBu65c5?= =?us-ascii?Q?Cu2Uhd3cWEaUmWZkGw3IMG3ovS3o01FPxS9pOLv97Jk7hNO3KoSkPO0j78KY?= =?us-ascii?Q?8hvw4awxs4hkgYUzAAp7mXFCKE1FVYInIfCW7hlUah1FXEstzyUSU9hHfT9A?= =?us-ascii?Q?tf4n6lXiaF2yPTBxjsWPHCU9F9HBPwyLkXNCRDOAQy28srzpEfpzEpJVzKwH?= =?us-ascii?Q?m+JmGqqZDE2Pj4GBl+l8c/21j3rzvVNohxEGLqwyjWbHhoW4T2EFuYGrVG2h?= =?us-ascii?Q?PEjZyl/eP/5i6Jq/sx0C5VggP0qutduCis+hYkqp1aKw2LlupIO6caU8FKT2?= =?us-ascii?Q?vD9SuPsUD62ck6uthBhpjnnNotVQ+0ZlNFdIq3QsytdQ4UAvp6y8UCxuB2zu?= =?us-ascii?Q?P3DMARrje3B7fCKCnnZlY646vZVg5qr1+s7shZVk8aJzjb5+opGq9q2kEwTx?= =?us-ascii?Q?ty18hXTSrqaZMQHV7fuiRZn43A5w1AWHBqrTwfmwrIVrtWYvhwooQDTjVo7u?= =?us-ascii?Q?fzH6bAfHlnUXpbVRGLnSJVStoHJ5tMJ0dWb2WAV8Ggh/acinVW4lIp+FKNbp?= =?us-ascii?Q?w9Kdd86Ci31LK+tIYBAWzKNz8qssKHaGr8bNOgSZTB8EPaU4t/sttzTzaWBk?= =?us-ascii?Q?gZGdnecMF5z2Mt9Q3tU8pG/gbHIRMuam/J9bJuARvjm4wUFV8QZ9qtd3xFGC?= =?us-ascii?Q?LeuCO+TYUeyhcx69vC86UmGfhTJFinTcmrzirMVXR9D9tHWpOJWnWafRlkoO?= =?us-ascii?Q?99TrxRN23pgSHOwCUI3Ur+rBfIyw7s5qdmfFhucBu2pyjQZXPsFWSjm38zHa?= =?us-ascii?Q?d220u6t7wFfVUm58APxAMMN72dl2RFUUSfyiAtu6dStm2HH9Sk5FNye+khUm?= =?us-ascii?Q?L7g0gkZouCCnrWVqfS7eMNIjAKwY/lrkaLbA7ykksqFwLgl67ru9Nyafbhpc?= =?us-ascii?Q?Mht8kHcrmZm4Sr06WE+1e4dmf5616XhSuzd+gIfBd6TWzNLzZpUWdGcyGT7M?= =?us-ascii?Q?T8Z320fTNalV821sb6MYnymEzb4A3sdCwrjzKFbHhGVBnmCWhdKdg29mlEAu?= =?us-ascii?Q?NF5Xz+CFU/QjTVDjTmj3zBp0UW6jf8xuo3rp5jy/F5eVIXKGMn6xwWLTjbtp?= =?us-ascii?Q?qezm9lzn9a3jAIXqTkiPo8+WbqOjjVp2QFkDjTI6cwWdhrxA?= Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-OriginatorOrg: citrix.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: SA6PR03MB7760.namprd03.prod.outlook.com X-MS-Exchange-CrossTenant-Network-Message-Id: 487f2061-8571-4343-c5b0-08deb67eb8d5 X-MS-Exchange-CrossTenant-originalarrivaltime: 20 May 2026 14:47:31.6167 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 335836de-42ef-43a2-b145-348c2ee9ca5b X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: Qw/Ax6wiB6j5S0H0BIQVx2fiJ2CGoUOLxCIoCp3KICExkwZ40JHAHpBSPKosgahs3TPvexlgbAtUbFTzmO5V0w== X-MS-Exchange-Transport-CrossTenantHeadersStamped: MN2PR03MB5328 X-purgate-ID: tlsNG-33051d/1779288454-3BF6A938-0CAA8D29/0/0 X-purgate-type: clean X-purgate-size: 1160 This series (xenbus, xencons, xennet, xenvbd, xenvkbd, xenvif) Reviewed-by: Owen Smith ________________________________________ From: win-pv-devel on behalf of= Tu Dinh Sent: 18 May 2026 11:24 AM To: win-pv-devel@lists.xenproject.org Cc: Tu Dinh Subject: [PATCH MULTISERIES] Optimize Xen barriers This series aims to optimize the use of memory barriers in all Windows PV drivers. Particularly, the following have been changed: * x86 is TSO and only needs a compiler barrier as read/write barriers. So the xen_* barriers in xen-types.h don't always need to be KeMemoryBarrier (which is a full barrier using a locked instruction). * Barriers right next to Interlocked* operations were deleted, as these operations serve as implicit full barriers. * Ring operations were converted acquire-release semantics instead of full barriers. * As a related change, LockThread tracking was conditioned to debug builds. -- Ngoc Tu Dinh | Vates XCP-ng Developer XCP-ng & Xen Orchestra - Vates solutions web: https://vates.tech From win-pv-devel-bounces@lists.xenproject.org Wed May 20 14:47:55 2026 Return-path: Envelope-to: archives@lists.xenproject.org Delivery-date: Wed, 20 May 2026 14:47:55 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1314059.1584084 (Exim 4.92) (envelope-from ) id 1wPiDD-0005EZ-DD; Wed, 20 May 2026 14:47:55 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1314059.1584084; Wed, 20 May 2026 14:47:55 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wPiDD-0005ES-Ad; Wed, 20 May 2026 14:47:55 +0000 Received: by outflank-mailman (input) for mailman id 1314059; Wed, 20 May 2026 14:47:54 +0000 Received: from mx.expurgate.net ([195.190.135.10]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wPiDC-0005EK-AU for win-pv-devel@lists.xenproject.org; Wed, 20 May 2026 14:47:54 +0000 Received: from mx.expurgate.net (helo=localhost) by mx.expurgate.net with esmtp id 1wPiDB-00AhHv-Mn for win-pv-devel@lists.xenproject.org; Wed, 20 May 2026 16:47:53 +0200 Received: from [10.42.69.1] (helo=localhost) by localhost with ESMTP (eXpurgate MTA 0.9.1) (envelope-from ) id 6a0dc997-e002-0a2a0a5209dd-0a2a45018702-8 for ; Wed, 20 May 2026 16:47:53 +0200 Received: from [52.101.52.50] (helo=BL2PR02CU003.outbound.protection.outlook.com) by tlsNG-d62444.mxtls.expurgate.net with ESMTPS (eXpurgate 4.56.1) (envelope-from ) id 6a0dc998-c1f2-0a2a45010019-346534329272-3 for ; Wed, 20 May 2026 16:47:53 +0200 Received: from SA6PR03MB7760.namprd03.prod.outlook.com (2603:10b6:806:43c::5) by MN2PR03MB5328.namprd03.prod.outlook.com (2603:10b6:208:1e2::7) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.9913.12; Wed, 20 May 2026 14:47:51 +0000 Received: from SA6PR03MB7760.namprd03.prod.outlook.com ([fe80::4d5b:a91f:46a3:4b38]) by SA6PR03MB7760.namprd03.prod.outlook.com ([fe80::4d5b:a91f:46a3:4b38%7]) with mapi id 15.21.0048.013; Wed, 20 May 2026 14:47:51 +0000 X-BeenThere: win-pv-devel@lists.xenproject.org List-Id: Developer list for the Windows PV Drivers subproject List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: win-pv-devel-bounces@lists.xenproject.org Precedence: list Sender: "win-pv-devel" Authentication-Results: eu.smtp.expurgate.cloud; dkim=pass header.s=selector1 header.d=citrix.com header.i="@citrix.com" header.h="From:Date:Subject:Message-ID:Content-Type:MIME-Version:x-ms-exchange-senderadcheck" ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=XxDMGNmNaIfJ7z9NciGKVKCg5eg+dtLoxcg1x9dLhdYabXOAk+DxfOE9VaH0iG7kC/IaA1KKmAC26M7wBm9vSObb1EGFRKprqJDBiqgJ4UF+xkR+oK25V/xXTnESzyF1c9oMqX+4ZozRNl0xb26jhxa22xL+viGNJDUnYmKs3nRYp4QJ+ySTTjBSRFk9i8cJdfsK/lFcdZ6PXYRXsWd3rw9/Ts6fI5//g53S/lVLaofQrH2tBeYwc0aWBTOpBqErDxaqyNPUdo1UzIJwwRbg8mTtjSuy3L8nCtb8Hv9laMgfDEWDwWv2Bn7jZ/A92gZMmAqza51O8Ziw8cuKjc6dVg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=045TW9Sh+A9M6C/7ANY1rEA5E34dUEF6RWfdSWuVXuo=; b=ealRZxM6WTGO3uaw1sTu+DNITyt4Z1FdlV4reSH3NovNavOM60iCd/8ofGvCpjhwxthzRNbZuDokdk34fiVQ0upgBtzThxSAJ9QQVcNY+082Ej7AGaxnAIq7omdo3dqHX0t6lBIwCtl/nvdYky5G+huX3LEI7c6sbXKdxtEe0fKDSNzdAJxUFy4P9zHR/in9w92IfEJHBn3eSrAME9teTKFghwoJQWDy1Mu6zXzhoXA/+6JuXK7yb4ViSZAgMwod7Psfg74kvLy9Ak2uuKZjb6xqNujDHOHoXjM4sMZEQvo7l7Wsl10WjX5jTfZHKCEEmrWIyao3ck/CQEqI/bi/xA== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=citrix.com; dmarc=pass action=none header.from=citrix.com; dkim=pass header.d=citrix.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=citrix.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=045TW9Sh+A9M6C/7ANY1rEA5E34dUEF6RWfdSWuVXuo=; b=iUCzRepk86VuhMyNSmwVidn5WBMPJKqHc7PzkTDUENzOqj7Q1omSnIJh9Qc2j65b8mI/jFpCpov2r2psvJh4j3CJ76D96Ymj/MSv2dhsinsJuBSbqbhSSO662D8ZFRGYwJu9PP/QsKxA9Tw6zulk7kZ3Hl2wQeH8iJwkxbRvALE= From: Owen Smith To: Tu Dinh , "win-pv-devel@lists.xenproject.org" Subject: Re: [PATCH] Remove MRSW shared acquire from VifReceiverReturnPacket Thread-Topic: [PATCH] Remove MRSW shared acquire from VifReceiverReturnPacket Thread-Index: AQHc5qpQR1z8gROqh0mbgXiPC/9ew7YXAd6o Date: Wed, 20 May 2026 14:47:51 +0000 Message-ID: References: <1779097201.8631fc262581453bbf619ec5b2062170.19e3a74ebb1000f373@vates.tech> In-Reply-To: <1779097201.8631fc262581453bbf619ec5b2062170.19e3a74ebb1000f373@vates.tech> Accept-Language: en-GB, en-US Content-Language: en-GB X-MS-Has-Attach: X-MS-TNEF-Correlator: msip_labels: authentication-results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=citrix.com; x-ms-publictraffictype: Email x-ms-traffictypediagnostic: SA6PR03MB7760:EE_|MN2PR03MB5328:EE_ x-ms-office365-filtering-correlation-id: 6045c4e3-1797-4917-7bed-08deb67ec487 x-ms-exchange-senderadcheck: 1 x-ms-exchange-antispam-relay: 0 x-microsoft-antispam: BCL:0;ARA:13230040|366016|376014|1800799024|38070700021|11063799006|18002099003|22082099003|56012099003; x-microsoft-antispam-message-info: xOjN3GQkJFypGwaU/76ukQ1fp80uoj7aBTkyvg8s9bGREYkhlKIt41wyXESu6cYDQINP9UrMOF/4WZml+nuMZUlPKdL0hgS4BZV6PQsqBLuOeXvmUDlv6W5dtylG4DkLiFAxaU2uaEmo8hJvkRZVZ5s5sImtkxdquhH/esAz3qPnNjqGxtqWRrvrPL0I9Xbp2WPqG7yO5H+zcPMcpC2PmN+UMp5JU8QEukz8VoysRdmmfu2rdrVSUqVhYxlZRFGWezG92KVyzXhOM3z6PFfb1PSw3MQp382RijmOMueKFAU/9sun5hxGsO097wZGNOYL+mdEqnBpN7O3lkQdcukYN3NKDdXNH9c+QhiXxXURdv0Hn4BzqR2TdwyrHFmAxEI+h+bvo/bixV4F52GRRDNizuep3SnCSkZCuJxXSMo5QhvBUQEL/qGsObtxFGkD83+xo3C49dclbs3x4PP/2qiLMsPdO3ssf6Sof3ABdkd870O9YmA2n8oE9n8hR5H0J+ZSJSlpNR48qu9AKDB8v+N4N2/kHb6cQoxOuSMXDFJ4np7c1WYR8hXUCo+mpa9xC8GV+eQBRVG1eoQ9B2hO7PbJyaELTKyXny5+8sYta5mdP0OSnQ9nj1LWPxtyElgvsDAXrNzU7E2bB7BUKKKrKXoKT3eTx/qvdr/YdN82NDp6eIXju80NeO/pyJbIcoawkqrz x-forefront-antispam-report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:SA6PR03MB7760.namprd03.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(366016)(376014)(1800799024)(38070700021)(11063799006)(18002099003)(22082099003)(56012099003);DIR:OUT;SFP:1101; x-ms-exchange-antispam-messagedata-chunkcount: 1 x-ms-exchange-antispam-messagedata-0: =?us-ascii?Q?4KNLFcFEyE5KyIWTiilrWGiLdEbveHFqecp78bRY5lbHb+TVUGGHqYzlpKhK?= =?us-ascii?Q?EeOM3dULJ9yW0uz7C29ncQFzpfrLiry/7GCeqhuH6f4rx6ixHfqOLuEm4csq?= =?us-ascii?Q?rHUwDpS9dKPCmSS2+NMc5d8sasDMQ/033Hk7UNBjkF8o/AOk6yk60wErNpOK?= =?us-ascii?Q?p9rgUu08aMicYLOJnH0Nc2C31dRJ+pg4YVUVU66kI0Zcdqd3TCEzC2R/Vkbr?= =?us-ascii?Q?Bka3KTiVBd74I6ZyBvMwDVTGCht0xxyK6otVpqjJYnIILYIQZaBAuI1+khmo?= =?us-ascii?Q?RDniaQ0iwYzrWqMBrskIMEk9vzh/lcweDG4+5W7WtpImAvA7GhcHmuvdvZ7t?= =?us-ascii?Q?RWD5divUkFRNYkGjv4ko/CmiIMOQT9GPSX9Kn8ig1/zVeYTJmi+Pd+3dSAv1?= =?us-ascii?Q?VEpSJvKmSysSgY9aWzL7Rnrb35gNIVdEtxoyV2zS+sS/jRUEnFJty8AJykJK?= =?us-ascii?Q?Q9F4oRHaxl38B/4tJXU3fBNX6ZRaPIY3hx62Jw1djxqjgRrfRwSN68WARAwe?= =?us-ascii?Q?TZpo3lVZ7EA3lipyWGp066rk9CB7CQr4yzGdOt3bKDS4r7lGGi8O6xiewj0L?= =?us-ascii?Q?5ontEAh1deIJa73g2f4gfJRvY4A9VIOWp3awUQN309FXpSu+06yfryvmzlRS?= =?us-ascii?Q?ak2GaPZiAnz7f5dqNVbKf6xdwCYrcWwkWvQuVEl+PHRSQ41fiCrv68/KqQrX?= =?us-ascii?Q?Gq8qM8O0IXl2q4YBrpxXjKVvZRDQYmOPJ6EYhjGJHft81XZuhbunJQ3EF2l9?= =?us-ascii?Q?t/LGmkDbMczPBLPvy+nRhVBdjOcmLqAPeHXQWS2RZ2Wyq7rU9XRV5pGN9O2Z?= =?us-ascii?Q?C20qOXJ2wARw2Cl0qAFJ7br4QTzHVLI+4A+cvRBu0Ao/I9K1xJQtShwxYeKW?= =?us-ascii?Q?pi/FFF1fnsPd/KXxbzlQ3RamyaUQGaeTGRrEbSlnXztvFhXr30c7zZ/0V4se?= =?us-ascii?Q?6P4pCIDKxkMT8yA4hZaSlxVvAyQg36U6poW0Ppx8siwo93/pRSJ2LjN/iaQO?= =?us-ascii?Q?mxwD/xJOoXknORoFtsdpcnsPk3PaejKHr+FuwE0RQBJbMlXrlcKGBwLWcm+Z?= =?us-ascii?Q?4d57NmrlRFNH1Bs0RATzlw4gVGuQhnmYqLUp3ltEkfzaH17vc4CCjfH+LFnp?= =?us-ascii?Q?GO0/YWqQt8MaDz/3wkt3HGGNtQBdbvnF39DmtFnOzu3+3q0hwuX4dgBpEHoR?= =?us-ascii?Q?Jdb2xG3ai8/6ZstnVFKVj3azmZmImxKn7qC+3+aITvzNXVR8ECEbsIfbApWI?= =?us-ascii?Q?nzB6Jq4VvwGpiv9Y55oHLRrM0KpGnOvgEPHzuX7Vsmd5I1YZBkEXb6UItVbR?= =?us-ascii?Q?SBjP49ELyZW4mL+l4djiagZ3alvwyT5dffKkCXlRzedK7LbQasFP2qUcfhGy?= =?us-ascii?Q?0AmymlGQyTiz3NVifw5gUQ7BxTjzrYGFEv/oeVv7bD12XtjhylvWXDrCDUMT?= =?us-ascii?Q?mI/FB4Iq2rUiUXNVWSzvEtiZ9GqER00GyQcYgnUHGDOp9v8Ky7W9EGJVCqBI?= =?us-ascii?Q?g9alBFMGdO0qgFT47IB0/T0ofi5EKYH9bkur0Q8llkW2TqHBS5mjJUepsmF8?= =?us-ascii?Q?BGMWujP/ix6tp1qMviGk1tPhwpZP2cljFF0PsmPv4WGgcSuRSnCZYTgxuyx5?= =?us-ascii?Q?Fmn1eq5fy5Q9g52nrslgO+6pDfkXR1epZg93gzgD4BCltLXGStzCSm3KbBax?= =?us-ascii?Q?IxYUp8T1L+kUUDQUe4//BDqFcyTy75eDGXEtfjEDKLYYT0XQ?= Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-OriginatorOrg: citrix.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: SA6PR03MB7760.namprd03.prod.outlook.com X-MS-Exchange-CrossTenant-Network-Message-Id: 6045c4e3-1797-4917-7bed-08deb67ec487 X-MS-Exchange-CrossTenant-originalarrivaltime: 20 May 2026 14:47:51.2263 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 335836de-42ef-43a2-b145-348c2ee9ca5b X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: FhE5DqO4qpjPTZ3aQVUbmzOfbNxa1oLbzIxsEIJkOxdMOMxsUnmqnTMQ0A52DVdNYRC8iu4E2buqNx3/iCdtSQ== X-MS-Exchange-Transport-CrossTenantHeadersStamped: MN2PR03MB5328 X-purgate-ID: tlsNG-d62444/1779288473-B494FFF4-F3F18001/0/0 X-purgate-type: clean X-purgate-size: 1560 Reviewed-by: Owen Smith ________________________________________ From: Tu Dinh Sent: 18 May 2026 10:39 AM To: win-pv-devel@lists.xenproject.org Cc: Tu Dinh; Owen Smith Subject: [PATCH] Remove MRSW shared acquire from VifReceiverReturnPacket VifReceiverReturnPacket may be called early/late during the enable/ disable sequence respectively. Notably, this can happen during the exclusive window of VifEnable/VifDisable, and so acquiring a shared lock via spinning will cause a deadlock. As ReceiverReturnPacket is protected by the VIF refcount (and in fact can be called regardless of enabled/disabled state), remove the MRSW shared lock requirement from it. Reported-by: Owen Smith Signed-off-by: Tu Dinh --- src/xenvif/vif.c | 5 ----- 1 file changed, 5 deletions(-) diff --git a/src/xenvif/vif.c b/src/xenvif/vif.c index 6782cc7..38b6b71 100644 --- a/src/xenvif/vif.c +++ b/src/xenvif/vif.c @@ -565,13 +565,8 @@ VifReceiverReturnPacket( { PXENVIF_VIF_CONTEXT Context =3D Interface->Context; - // Called from MINIPORT_RETURN_NET_BUFFER_LISTS - SpinAcquireMrswLockShared(&Context->Lock); - ReceiverReturnPacket(FrontendGetReceiver(Context->Frontend), Cookie); - - ReleaseMrswLockShared(&Context->Lock); } static NTSTATUS -- 2.54.0.windows.1 -- Ngoc Tu Dinh | Vates XCP-ng Developer XCP-ng & Xen Orchestra - Vates solutions web: https://vates.tech From win-pv-devel-bounces@lists.xenproject.org Tue May 26 16:29:51 2026 Return-path: Envelope-to: archives@lists.xenproject.org Delivery-date: Tue, 26 May 2026 16:29:51 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1320105.1587500 (Exim 4.92) (envelope-from ) id 1wRuf7-0004LY-Rm; Tue, 26 May 2026 16:29:49 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1320105.1587500; Tue, 26 May 2026 16:29:49 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wRuf7-0004LQ-Oq; Tue, 26 May 2026 16:29:49 +0000 Received: by outflank-mailman (input) for mailman id 1320105; Tue, 26 May 2026 16:29:49 +0000 Received: from mx.expurgate.net ([195.190.135.10]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wRuf6-0004LK-Vu for win-pv-devel@lists.xenproject.org; Tue, 26 May 2026 16:29:49 +0000 Received: from mx.expurgate.net (helo=localhost) by mx.expurgate.net with esmtp id 1wRuf6-008OIP-2q for win-pv-devel@lists.xenproject.org; Tue, 26 May 2026 18:29:48 +0200 Received: from [10.42.69.10] (helo=localhost) by localhost with ESMTP (eXpurgate MTA 0.9.1) (envelope-from ) id 6a15ca71-5cb7-0a2a0a5109dd-0a2a450ab55a-4 for ; Tue, 26 May 2026 18:29:47 +0200 Received: from [202.12.124.148] (helo=fout-b5-smtp.messagingengine.com) by tlsNG-4011c0.mxtls.expurgate.net with ESMTPS (eXpurgate 4.56.1) (envelope-from ) id 6a15ca7a-56b3-0a2a450a0019-ca0c7c94c3c3-3 for ; Tue, 26 May 2026 18:29:47 +0200 Received: from phl-compute-04.internal (phl-compute-04.internal [10.202.2.44]) by mailfout.stl.internal (Postfix) with ESMTP id B47C11D00075; Tue, 26 May 2026 12:29:45 -0400 (EDT) Received: from phl-frontend-03 ([10.202.2.162]) by phl-compute-04.internal (MEProxy); Tue, 26 May 2026 12:29:45 -0400 Received: by mail.messagingengine.com (Postfix) with ESMTPA; Tue, 26 May 2026 12:29:44 -0400 (EDT) X-BeenThere: win-pv-devel@lists.xenproject.org List-Id: Developer list for the Windows PV Drivers subproject List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: win-pv-devel-bounces@lists.xenproject.org Precedence: list Sender: "win-pv-devel" Authentication-Results: eu.smtp.expurgate.cloud; dkim=pass header.s=fm3 header.d=invisiblethingslab.com header.i="@invisiblethingslab.com" header.h="Cc:Content-Transfer-Encoding:Content-Type:Date:From:Message-ID:MIME-Version:Subject:To"; dkim=pass header.s=fm3 header.d=messagingengine.com header.i="@messagingengine.com" header.h="Cc:Content-Transfer-Encoding:Content-Type:Date:Feedback-ID:From:Message-ID:MIME-Version:Subject:To:X-ME-Proxy:X-ME-Sender" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= invisiblethingslab.com; h=cc:cc:content-transfer-encoding :content-type:content-type:date:date:from:from:in-reply-to :message-id:mime-version:reply-to:subject:subject:to:to; s=fm3; t=1779812985; x=1779899385; bh=WLc8iR5oacatnJ8gAg41foF3jGAjy8Iu EC2Mjgnuf+E=; b=dsvvWGiFMVGxsjAV8Mj/hb6zMfojNwvbYQ5xIRBFendlOsra abZICwAXZerqFKqr2HbeedwyCYtf5+LaaEsmMufuteSIF5hm90s9s8jtCohq6Pms C+w3DHaI6Ra8HKL1HUYQ0T3bT6lFhZKEsJR8ygpvg8igMWfLa3B59HHFjk108hX4 lJFBYK4Tj1wBwXjBp4jvgw0jv3D6tL2EVFD97N3JEeegnX66GQC7LcWpgdKakVzz za9fv5ouD/6CAgIxyHJkzjNi8UF27mahrQp/anXYWjAy8FH42RShYD/rQNazlvZ0 LraBt4AF3BEFEwLwv7rTeEm/0SpJ/9RNgOUFGg== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=cc:cc:content-transfer-encoding :content-type:content-type:date:date:feedback-id:feedback-id :from:from:in-reply-to:message-id:mime-version:reply-to:subject :subject:to:to:x-me-proxy:x-me-sender:x-me-sender:x-sasl-enc; s= fm3; t=1779812985; x=1779899385; bh=WLc8iR5oacatnJ8gAg41foF3jGAj y8IuEC2Mjgnuf+E=; b=UjwQk2pQ5BbinmGcvnhgoN3AQ6rjcfdeOPhf6U4DGSQw s6Hy6MvzzUmBXKPETQJVsYgIeowePycFOCZ981pcFApWdUV8M3kQmhIPXyIHFO8o fZRHRqVJF9LlQy5wlNkbbKD4TloOBFN15GiiyvzanbzSEKmmGz/CBzIwD+CBvVRN GpDXJFVe/5aC8u9X3clqIPN5TCaqgOwHsEqd+KbdsP9NFXn02MOLj9c/V8ncjqt7 JOXxtqVHAjF2RIQGx3GbsRlawvhXEvYtpfZmRYfMgdcrCq922idT7aDveIADRw9q j14pwqIaWHM8iBp1yPT7AmtrSW0MxJF9Ot1PTLCJTQ== X-ME-Sender: X-ME-Received: X-ME-Proxy-Cause: dmFkZTErpfY+UNxXG0KITPMd/FDA4n4EMF8Iw61MVfDKE6wK3uF3IaYm4g2IO7kSXjd7zR a3zrmj4BGbyiwKFEhXW+yYyKJ7Sg/4CQN1D9HXTI/FjrsqZhRzE1WF+HC01w8K3lp7K2Lm dzmz+xrwouHCWxE0QrhAOVtTMTA160W2Qh/EgFBHvAVe9ksH3Kz0I69GwN9SV9wBdgQ7Tm Mq1fqeC1rfe0NollSwLdGWz23igQfmow42yRQvBpl5sF5cATGsdRiIFB8oLycDSOqcEShN 2E+LX6I71m6WOxzbPc57b4yvRU+3Im4kMhf6xzxsGyN9dLFt6nf8v4GjeUDL38KBI81dLZ 8fyy3IT4Sr/iWyvRN/mTy9qTv739/UMkN7OP9RfDcghZZmXgNWlCeEqVw9wvZkAO/E8xA2 dW8H6XtfeXbkNe5kdkWgr7xyXFZrNGhkL98UY9QCfky6JXyCg8Ecl8yfpFtxhuXHBBIR6N JMtWElLzej2vNTcOId0aP/mxFn2pyDPlVj7XFnHTFYHr7K8JT2HCreow6sGStUPiUveGad 0argPp4UKDHi8fIupRqzCufDGSJUDS3wA2rdsgCh3+LrOtaG3d8mafQxWH561ZWM6bKneQ x+PpZEe8thR3QTsfHACGHAg2qEdM8B1iLjG6w8JBgBGtK/UuT5hrHxp5aIhA X-ME-Proxy: Feedback-ID: i409c4082:Fastmail From: =?UTF-8?q?Rafa=C5=82=20Wojdy=C5=82a?= To: win-pv-devel@lists.xenproject.org Cc: =?UTF-8?q?Rafa=C5=82=20Wojdy=C5=82a?= Subject: [PATCH 0/2] xeniface race fixes Date: Tue, 26 May 2026 18:29:32 +0200 Message-ID: <20260526162934.217954-1-omeg@invisiblethingslab.com> X-Mailer: git-send-email 2.54.0 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-purgate-ID: tlsNG-4011c0/1779812987-7EB898B7-87C619A0/0/0 X-purgate-type: clean X-purgate-size: 344 Rafał Wojdyła (2): Fix use-after-free in evtchn DPC Send gnttab unmap notify event after the grant is fully released src/xeniface/ioctl_evtchn.c | 21 ++++++++++++++------- src/xeniface/ioctl_gnttab.c | 16 +++++++++------- src/xeniface/ioctls.h | 1 + 3 files changed, 24 insertions(+), 14 deletions(-) -- 2.53.0 From win-pv-devel-bounces@lists.xenproject.org Tue May 26 16:29:53 2026 Return-path: Envelope-to: archives@lists.xenproject.org Delivery-date: Tue, 26 May 2026 16:29:53 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1320106.1587504 (Exim 4.92) (envelope-from ) id 1wRufB-0004ND-TS; Tue, 26 May 2026 16:29:53 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1320106.1587504; Tue, 26 May 2026 16:29:53 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wRufB-0004N5-QJ; Tue, 26 May 2026 16:29:53 +0000 Received: by outflank-mailman (input) for mailman id 1320106; Tue, 26 May 2026 16:29:53 +0000 Received: from mx.expurgate.net ([194.145.224.20]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wRufB-0004Mp-4T for win-pv-devel@lists.xenproject.org; Tue, 26 May 2026 16:29:53 +0000 Received: from mx.expurgate.net (helo=localhost) by mx.expurgate.net with esmtp id 1wRufA-001fiz-A6 for win-pv-devel@lists.xenproject.org; Tue, 26 May 2026 18:29:52 +0200 Received: from [10.42.69.8] (helo=localhost) by localhost with ESMTP (eXpurgate MTA 0.9.1) (envelope-from ) id 6a15ca58-e002-0a2a0a5209dd-0a2a4508a8bc-48 for ; Tue, 26 May 2026 18:29:52 +0200 Received: from [202.12.124.154] (helo=fhigh-b3-smtp.messagingengine.com) by tlsNG-c1860d.mxtls.expurgate.net with ESMTPS (eXpurgate 4.56.1) (envelope-from ) id 6a15ca7f-63b5-0a2a45080019-ca0c7c9aabbb-3 for ; Tue, 26 May 2026 18:29:51 +0200 Received: from phl-compute-04.internal (phl-compute-04.internal [10.202.2.44]) by mailfhigh.stl.internal (Postfix) with ESMTP id A62DF7A00FF; Tue, 26 May 2026 12:29:50 -0400 (EDT) Received: from phl-frontend-03 ([10.202.2.162]) by phl-compute-04.internal (MEProxy); Tue, 26 May 2026 12:29:50 -0400 Received: by mail.messagingengine.com (Postfix) with ESMTPA; Tue, 26 May 2026 12:29:49 -0400 (EDT) X-BeenThere: win-pv-devel@lists.xenproject.org List-Id: Developer list for the Windows PV Drivers subproject List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: win-pv-devel-bounces@lists.xenproject.org Precedence: list Sender: "win-pv-devel" Authentication-Results: eu.smtp.expurgate.cloud; dkim=pass header.s=fm3 header.d=invisiblethingslab.com header.i="@invisiblethingslab.com" header.h="Cc:Content-Transfer-Encoding:Content-Type:Date:From:In-Reply-To:Message-ID:MIME-Version:References:Subject:To"; dkim=pass header.s=fm3 header.d=messagingengine.com header.i="@messagingengine.com" header.h="Cc:Content-Transfer-Encoding:Content-Type:Date:Feedback-ID:From:In-Reply-To:Message-ID:MIME-Version:References:Subject:To:X-ME-Proxy:X-ME-Sender" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= invisiblethingslab.com; h=cc:cc:content-transfer-encoding :content-type:content-type:date:date:from:from:in-reply-to :in-reply-to:message-id:mime-version:references:reply-to:subject :subject:to:to; s=fm3; t=1779812990; x=1779899390; bh=49IhahRf7M wQrTDRTr3ryQOc7Iw27pPi6nHa8hqBW8Q=; b=f3juvvmGjeUo9fA4IEPIZsZXaY KXdh34IImaQfaZY4dzMnnvaTNncjgeDxqf7W16JbN9CPm0SzMHCwT2Aslt649SPe 3TuxKNuUwpf5OIqRZ6RNaeSsAKwzqkAozLmgtCaK4lGE3wxJHbUAv2cLrilXT9RX 3dPJ8ucBcp7Pic7VLNodJPYuEr42gBpNqWVweld2RUr0sWua/lJMrULYCxYz5btI 4adKU2aVOv3E3M64zvqLzS1++yjNmD2vdpltmj3fAjgh35TkbgHG7CZypYeq8BWl T/kJGyVDcCVfhsKHT7IwYv2k6XZ/F2nocUe1xOMDEnJMp/WpmrPsK9KU5VJg== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=cc:cc:content-transfer-encoding :content-type:content-type:date:date:feedback-id:feedback-id :from:from:in-reply-to:in-reply-to:message-id:mime-version :references:reply-to:subject:subject:to:to:x-me-proxy :x-me-sender:x-me-sender:x-sasl-enc; s=fm3; t=1779812990; x= 1779899390; bh=49IhahRf7MwQrTDRTr3ryQOc7Iw27pPi6nHa8hqBW8Q=; b=p siLx8I9jAbWR+m0teXFvC4+nOQF99NMVXPPgHM1RyZhrIYrs/H8M95BHRdq/y2LJ iUkNuFvDmcqMJ1MsIl9enAoxUHDHrBL0hXEUM0BPrMhZi+Afg/5n8nCzERMdo012 1EtCHQNTlMgJv/ziRoerPuOPAo137CVbFoZ8+Bx+rEKAh8DmdFjYlonahRkqD0eo aJGn0bpbxOcl2ylRUP5B3Iqzvt+P55pHGbCmy/1/46SzFjGs0OBguUjVCiFGsZ42 wZGVgSse5KWjrRiJmp8EA9/tUX7duBvDO7JDGvxWedP/wEPZs2kp3c9SsRajNGH7 pS2bQAXUu9BwTg6U6h0Gg== X-ME-Sender: X-ME-Received: X-ME-Proxy-Cause: dmFkZTFuSFIkYR1fFGGZmdd2HfB4GS9XDU8pGwhlKSN50wUlqODGmTiFsG2TyvaTaz48W5 n14+BqpVh4iPWuHOrkgU1WoHB/q8RnTee/CtRUC5843mHY2+zoQxItcmq+3mFg7Ht0KmIu /kc6J6AQgsmVNMczBeNl7V/DL1o2mPIimzKChvbrhThStDgxlH6SZa/lamD9M3WuVRijiF vHVZUD5xvSOr+WfLyPxLGaxdZj/2FWMTrh6xEt4SpYjxy599LuGXhvJ/tdhSmGUnSoVxlI /t5Fy8/chUM0E9fp8g4TxMjpLl+rnAjLks1e5JkHoikPy5splJPaiXgXxldkT/VVMa1Ioa wOIDBcqEs2vZqIb4S081lCpaox3W0nlgNPj8/z9PMUojU3WMEz5S5l53VJZ4Mf64omVqXf 1QjkUanANNbbQ9GFSVhpm275ZEP8WPg/knKcCi/SnXFDtZ8d/9KRIzvglDKPhifyD/OIOV K4z6Pdkf3asZhZDLySL7TwDpKc3yebarwGNCJqZPY54QUqMTFzsZt3HG8t8v4mRYFU/Scp aHFgU4pJUo1qk/a5rgn6MaJoDLXq/Ty6JjQp1pAdvcD2rYQdhf8xPOR6dnkNbRqTjLBibz PlLaUZzFd5mEB6hrmWCf0WZ69hG2Elvxf7PVsQu61V37BZvyO6FI9GVe6ffA X-ME-Proxy: Feedback-ID: i409c4082:Fastmail From: =?UTF-8?q?Rafa=C5=82=20Wojdy=C5=82a?= To: win-pv-devel@lists.xenproject.org Cc: =?UTF-8?q?Rafa=C5=82=20Wojdy=C5=82a?= Subject: [PATCH 1/2] Fix use-after-free in evtchn DPC Date: Tue, 26 May 2026 18:29:33 +0200 Message-ID: <20260526162934.217954-2-omeg@invisiblethingslab.com> X-Mailer: git-send-email 2.54.0 In-Reply-To: <20260526162934.217954-1-omeg@invisiblethingslab.com> References: <20260526162934.217954-1-omeg@invisiblethingslab.com> MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-purgate-ID: tlsNG-c1860d/1779812992-C5784DB1-40D58880/0/0 X-purgate-type: clean X-purgate-size: 3535 EvtchnFree() calls XENBUS_EVTCHN(Close) and then KeFlushQueuedDpcs() to drain any pending DPCs. A DPC queued just before Close returns can run in the window between Close completing and the flush draining it, at which point it dereferences Context->Channel inside XENBUS_EVTCHN(Unmask). Also move Context->Fdo initialization to before opening the channel so Context is fully populated by the time the channel can fire its first interrupt. Signed-off-by: Rafał Wojdyła --- src/xeniface/ioctl_evtchn.c | 21 ++++++++++++++------- src/xeniface/ioctls.h | 1 + 2 files changed, 15 insertions(+), 7 deletions(-) diff --git a/src/xeniface/ioctl_evtchn.c b/src/xeniface/ioctl_evtchn.c index 6d63996..e38e25f 100644 --- a/src/xeniface/ioctl_evtchn.c +++ b/src/xeniface/ioctl_evtchn.c @@ -58,11 +58,14 @@ EvtchnNotificationDpc( KeSetEvent(Context->Event, 0, FALSE); - (VOID) XENBUS_EVTCHN(Unmask, - &Context->Fdo->EvtchnInterface, - Context->Channel, - FALSE, - TRUE); + if (InterlockedCompareExchange(&Context->Ready, 1, 1) == 1) { + (VOID) XENBUS_EVTCHN(Unmask, + &Context->Fdo->EvtchnInterface, + Context->Channel, + FALSE, + TRUE); + + } } _Function_class_(KSERVICE_ROUTINE) @@ -103,6 +106,8 @@ EvtchnFree( Trace("Context %p, LocalPort %d, FO %p\n", Context, Context->LocalPort, Context->FileObject); + (VOID) InterlockedExchange(&Context->Ready, 0); + XENBUS_EVTCHN(Close, &Fdo->EvtchnInterface, Context->Channel); @@ -176,6 +181,7 @@ IoctlEvtchnBindUnbound( goto fail2; Context->FileObject = FileObject; + Context->Fdo = Fdo; Trace("> RemoteDomain %d, Mask %d, FO %p\n", In->RemoteDomain, In->Mask, FileObject); @@ -206,7 +212,7 @@ IoctlEvtchnBindUnbound( &Fdo->EvtchnInterface, Context->Channel); - Context->Fdo = Fdo; + (VOID) InterlockedExchange(&Context->Ready, 1); ExInterlockedInsertTailList(&Fdo->EvtchnList, &Context->Entry, &Fdo->EvtchnLock); @@ -269,6 +275,7 @@ IoctlEvtchnBindInterdomain( goto fail2; Context->FileObject = FileObject; + Context->Fdo = Fdo; Trace("> RemoteDomain %d, RemotePort %lu, Mask %d, FO %p\n", In->RemoteDomain, In->RemotePort, In->Mask, FileObject); @@ -300,7 +307,7 @@ IoctlEvtchnBindInterdomain( &Fdo->EvtchnInterface, Context->Channel); - Context->Fdo = Fdo; + (VOID) InterlockedExchange(&Context->Ready, 1); ExInterlockedInsertTailList(&Fdo->EvtchnList, &Context->Entry, &Fdo->EvtchnLock); diff --git a/src/xeniface/ioctls.h b/src/xeniface/ioctls.h index b4c8de2..f5eddbf 100644 --- a/src/xeniface/ioctls.h +++ b/src/xeniface/ioctls.h @@ -53,6 +53,7 @@ typedef struct _XENIFACE_EVTCHN_CONTEXT { PXENIFACE_FDO Fdo; KDPC Dpc; PVOID FileObject; + volatile LONG Ready; } XENIFACE_EVTCHN_CONTEXT, *PXENIFACE_EVTCHN_CONTEXT; typedef struct _XENIFACE_SUSPEND_CONTEXT { -- 2.53.0 From win-pv-devel-bounces@lists.xenproject.org Tue May 26 16:29:55 2026 Return-path: Envelope-to: archives@lists.xenproject.org Delivery-date: Tue, 26 May 2026 16:29:55 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1320107.1587508 (Exim 4.92) (envelope-from ) id 1wRufD-0004Ou-UF; Tue, 26 May 2026 16:29:55 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1320107.1587508; Tue, 26 May 2026 16:29:55 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wRufD-0004On-Rg; Tue, 26 May 2026 16:29:55 +0000 Received: by outflank-mailman (input) for mailman id 1320107; Tue, 26 May 2026 16:29:55 +0000 Received: from mx.expurgate.net ([195.190.135.10]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wRufD-0004OZ-73 for win-pv-devel@lists.xenproject.org; Tue, 26 May 2026 16:29:55 +0000 Received: from mx.expurgate.net (helo=localhost) by mx.expurgate.net with esmtp id 1wRufC-008OLK-J6 for win-pv-devel@lists.xenproject.org; Tue, 26 May 2026 18:29:54 +0200 Received: from [10.42.69.4] (helo=localhost) by localhost with ESMTP (eXpurgate MTA 0.9.1) (envelope-from ) id 6a15ca52-2eae-0a2a0a5409dd-0a2a45048c8a-46 for ; Tue, 26 May 2026 18:29:54 +0200 Received: from [202.12.124.148] (helo=fout-b5-smtp.messagingengine.com) by tlsNG-ebf023.mxtls.expurgate.net with ESMTPS (eXpurgate 4.56.1) (envelope-from ) id 6a15ca81-1dec-0a2a45040019-ca0c7c94b6b5-3 for ; Tue, 26 May 2026 18:29:54 +0200 Received: from phl-compute-08.internal (phl-compute-08.internal [10.202.2.48]) by mailfout.stl.internal (Postfix) with ESMTP id 2A9B11D000E1; Tue, 26 May 2026 12:29:53 -0400 (EDT) Received: from phl-frontend-03 ([10.202.2.162]) by phl-compute-08.internal (MEProxy); Tue, 26 May 2026 12:29:53 -0400 Received: by mail.messagingengine.com (Postfix) with ESMTPA; Tue, 26 May 2026 12:29:52 -0400 (EDT) X-BeenThere: win-pv-devel@lists.xenproject.org List-Id: Developer list for the Windows PV Drivers subproject List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: win-pv-devel-bounces@lists.xenproject.org Precedence: list Sender: "win-pv-devel" Authentication-Results: eu.smtp.expurgate.cloud; dkim=pass header.s=fm3 header.d=invisiblethingslab.com header.i="@invisiblethingslab.com" header.h="Cc:Content-Transfer-Encoding:Content-Type:Date:From:In-Reply-To:Message-ID:MIME-Version:References:Subject:To"; dkim=pass header.s=fm3 header.d=messagingengine.com header.i="@messagingengine.com" header.h="Cc:Content-Transfer-Encoding:Content-Type:Date:Feedback-ID:From:In-Reply-To:Message-ID:MIME-Version:References:Subject:To:X-ME-Proxy:X-ME-Sender" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= invisiblethingslab.com; h=cc:cc:content-transfer-encoding :content-type:content-type:date:date:from:from:in-reply-to :in-reply-to:message-id:mime-version:references:reply-to:subject :subject:to:to; s=fm3; t=1779812993; x=1779899393; bh=cEJAm10Y96 pub5C3Z/d2PRFY0MR1EBX7cDnQiJzYT9Q=; b=kuanc5JFjR/06FQLk5zpEUx2YQ ZOGXmpVO92IOQD+dfgn6gTOAHulr0x7iYEoaszBydaIA2p0WJF1trWri0zqc/sl0 9PGL+76JT6L1bBhDJR5Orbp0RVYhnVfA9uOKIdcybrxoOGTSOF8sprxeMklqMOtS seOJliqXPmlCgLoW6LJFB/3/INmf3JFUjOwzX/NwNZhAK7m2gOiIfvvevYyVeUkX R4wfmcatskLM8YXT7CLw/1DbsZ4Z3LE7i50moeelgJK2o5/I01qW1VoWYxpyV7ND kY+QRm2SdQLbYzFB4tVx1iXEMPV+gpbTmx+CZA52YJHz/EFgk07gcC/ED28Q== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=cc:cc:content-transfer-encoding :content-type:content-type:date:date:feedback-id:feedback-id :from:from:in-reply-to:in-reply-to:message-id:mime-version :references:reply-to:subject:subject:to:to:x-me-proxy :x-me-sender:x-me-sender:x-sasl-enc; s=fm3; t=1779812993; x= 1779899393; bh=cEJAm10Y96pub5C3Z/d2PRFY0MR1EBX7cDnQiJzYT9Q=; b=j p8a3Pfx5igNERhed6QW+iDZU/0nfsM7S/pDeeq1nUy/HftVxb7sk3tzwgp8pW2Of 4LuNvI3ij+yXdN1/1bnXQa2HWHxvHSQyqeHhzV3jZ2iU9JM5HOppSqvnHlDKae48 sDYowW+b+mt9Car+Jiw4BEGCe2gWLIlDNaPxDSxB5vUZnFmIsyfkbSKFKrFfJxPb A+oa+V0T2AaNuCGJr2O6L+f3Yud3n8TcFUF+YgbcKjeRIBWqkDKfp6GE7yCj+hSV u+72frJWD/XjSYW3hX533uAghXj3qLDtVuQErsVjLOVv0mMxGQTt/iQZwSCCoFx4 1SLZUJVR0meLzzjo1o3rg== X-ME-Sender: X-ME-Received: X-ME-Proxy-Cause: dmFkZTFuSFIkYR1fFGGZmdd2HfB4GS9XDU8pGwhlKSN50wUlqODGmTiFsG2TyvaTaz48W5 n14+BqpVh4iPWuHOrkgU1WoHB/q8RnTee/CtRUC5843mHY2+zoQxItcmq+3mFg7Ht0KmIu /kc6J6AQgsmVNMczBeNl7V/DL1o2mPIimzKChvbrhThStDgxlH6SZa/lamD9M3WuVRijiF vHVZUD5xvSOr+WfLyPxLGaxdZj/2FWMTrh6xEt4SpYjxy599LuGXhvJ/tdhSmGUnSoVxlI /t5Fy8/chUM0E9fp8g4TxMjpLl+rnAjLks1e5JkHoikPy5splJPaiXgXxldkT/VVMa1IWa bIXbeALWBZmewhxn+YHMCzu8H8ZTB+6X7NkNWjW0fB/YA3mQjHNnKmDRIRCYoLQEc3zIE3 v2Z43TpX3CVwdOQDuOrsM2dRzdnaS9P7xECJo+XkHnf099w4UHnJCfIO2YP8HGUkRxwL4t 55sCFiTusAo3n3XkCWHt3lyrXgnZNV2z0XSdwTFIi8lfsQ8ubcmmhsbyzYGEoyue7ubktk 2iOFqEb96xYqfzlGCoem6Q7EO07ffWMsSxKbkvO2+cgFKugMJiCYBQQPCLh3CBqveIcMnH cjwzQDi1vgZFnO0b2r56gXlEGKcTXyhaTk+4PYoZYZT5lJUTM8dA6+hPxDow X-ME-Proxy: Feedback-ID: i409c4082:Fastmail From: =?UTF-8?q?Rafa=C5=82=20Wojdy=C5=82a?= To: win-pv-devel@lists.xenproject.org Cc: =?UTF-8?q?Rafa=C5=82=20Wojdy=C5=82a?= Subject: [PATCH 2/2] Send gnttab unmap notify event after the grant is fully released Date: Tue, 26 May 2026 18:29:34 +0200 Message-ID: <20260526162934.217954-3-omeg@invisiblethingslab.com> X-Mailer: git-send-email 2.54.0 In-Reply-To: <20260526162934.217954-1-omeg@invisiblethingslab.com> References: <20260526162934.217954-1-omeg@invisiblethingslab.com> MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-purgate-ID: tlsNG-ebf023/1779812994-42D643FF-7F127016/0/0 X-purgate-type: clean X-purgate-size: 1823 Move the notification event to after the unmap hypercall completes, so the peer only gets notified after the grant is completely released on our side. Closes possible race when the peer could be notified before the grant was fully torn down. Signed-off-by: Rafał Wojdyła --- src/xeniface/ioctl_gnttab.c | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-) diff --git a/src/xeniface/ioctl_gnttab.c b/src/xeniface/ioctl_gnttab.c index ef77295..ee319cb 100644 --- a/src/xeniface/ioctl_gnttab.c +++ b/src/xeniface/ioctl_gnttab.c @@ -802,17 +802,11 @@ GnttabFreeMap( Trace("Context %p\n", Context); + // Write the notify value while the grant is still mapped. if (Context->Flags & XENIFACE_GNTTAB_USE_NOTIFY_OFFSET) { ((PCHAR)Context->KernelVa)[Context->NotifyOffset] = 0; } - if (Context->Flags & XENIFACE_GNTTAB_USE_NOTIFY_PORT) { - status = EvtchnNotify(Fdo, Context->NotifyPort, NULL); - - if (!NT_SUCCESS(status)) // non-fatal, we must free memory - Error("failed to notify port %lu: 0x%x\n", Context->NotifyPort, status); - } - // unmap from user address space MmUnmapLockedPages(Context->UserVa, Context->Mdl); @@ -828,6 +822,14 @@ GnttabFreeMap( ASSERT(NT_SUCCESS(status)); + // Notify the peer after the map is fully gone. + if (Context->Flags & XENIFACE_GNTTAB_USE_NOTIFY_PORT) { + status = EvtchnNotify(Fdo, Context->NotifyPort, NULL); + + if (!NT_SUCCESS(status)) // non-fatal, we must free memory + Error("failed to notify port %lu: 0x%x\n", Context->NotifyPort, status); + } + RtlZeroMemory(Context, sizeof(*Context)); __FreePoolWithTag(Context, XENIFACE_POOL_TAG); } -- 2.53.0 From win-pv-devel-bounces@lists.xenproject.org Wed May 27 01:41:49 2026 Return-path: Envelope-to: archives@lists.xenproject.org Delivery-date: Wed, 27 May 2026 01:41:49 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1320303.1587656 (Exim 4.92) (envelope-from ) id 1wS3HH-0005cX-I7; Wed, 27 May 2026 01:41:47 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1320303.1587656; Wed, 27 May 2026 01:41:47 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wS3HH-0005cP-FG; Wed, 27 May 2026 01:41:47 +0000 Received: by outflank-mailman (input) for mailman id 1320303; Wed, 27 May 2026 01:41:46 +0000 Received: from mx.expurgate.net ([195.190.135.10]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wS3HF-0005c0-Em for win-pv-devel@lists.xenproject.org; Wed, 27 May 2026 01:41:46 +0000 Received: from mx.expurgate.net (helo=localhost) by mx.expurgate.net with esmtp id 1wS3HE-00EHtH-Ki for win-pv-devel@lists.xenproject.org; Wed, 27 May 2026 03:41:44 +0200 Received: from [10.42.69.11] (helo=localhost) by localhost with ESMTP (eXpurgate MTA 0.9.1) (envelope-from ) id 6a164af4-5cb7-0a2a0a5109dd-0a2a450bd358-30 for ; Wed, 27 May 2026 03:41:43 +0200 Received: from [185.255.28.34] (helo=prod-mta-13.swg-srv.net) by tlsNG-42698a.mxtls.expurgate.net with ESMTPS (eXpurgate 4.56.1) (envelope-from ) id 6a164bd7-212f-0a2a450b0019-b9ff1c22a223-3 for ; Wed, 27 May 2026 03:41:43 +0200 Received: from mail2.vates.fr ([37.26.189.201] mail2.vates.fr) (Authenticated sender: 8631fc262581453bbf619ec5b2062170/smtp/7773de5a-2839-4720-82ee-e06722ae1d3e) by prod-mta-13.swg-srv.net (ZoneMTA - prod-mta-13) with ESMTPSA id 19e67182a7c000d780.002 for (version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384); Wed, 27 May 2026 01:41:37 +0000 Received: from [192.168.1.61] (155.223.66.37.rev.sfr.net [37.66.223.155]) (Authenticated sender: ngoc-tu.dinh@vates.tech) by mail2.vates.fr (Postfix) with ESMTPSA id C543F86464; Wed, 27 May 2026 03:41:36 +0200 (CEST) X-BeenThere: win-pv-devel@lists.xenproject.org List-Id: Developer list for the Windows PV Drivers subproject List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: win-pv-devel-bounces@lists.xenproject.org Precedence: list Sender: "win-pv-devel" Authentication-Results: eu.smtp.expurgate.cloud; dkim=pass header.s=selector1 header.d=vates.tech header.i="@vates.tech" header.h="From:Subject:Date:Message-ID:To:MIME-Version:Content-Type:In-Reply-To:References:Feedback-ID" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=vates.tech; q=dns/txt; s=selector1; bh=/CT0aeRyhaEK8EHOjboSJEf/9dsmI6+hmNv4vyFUrWA=; h=from:subject:date:message-id:to:mime-version:content-type:in-reply-to:references:feedback-id; b=ZnM9NfJXUxGqJsnXdjBKFZ6xzKH+i4plRWcIb+yd2oFiSnpvWrDMwTDV9h1kjeuBYUbPKYCgJ IGXqDt0m2A1m3HccTzns+EDnY03prXK9Sw9K30ItlqTCXOXrlCs8yULGVxJ6bTiKyZd54nN78Rr o/3Ew422bjJZncH+Y2Ato16wqpJOM6qT89KMbxYECgJALTD9uXlCvpCsyLOoVVvAjOHwNQ15gF3 iIrg7+os6OiNal3x4oypbHMRMswgGgajbp5xLHFMR2b5e58D7AZyqSJNnnp9UCollo8z7fYM1YM en1fE3PCT3oqBjj/vxQtA0ReiGJW3DR0wLvJ3y4mMrBg== X-Zone-Loop: fdcbd5a136416ecfafdd5dd230533aad929798da4964 x-campaign-type: default x-transaction-id: f61368df-1cb5-40c0-a512-e32127d21a20 x-swg-uid: 01-317f4880-8098-49a2-9a35-3061b852ee2b X-Mailer: Sweego Message-ID: <1779846097.8631fc262581453bbf619ec5b2062170.19e67182a7c000d780@vates.tech> x-swg-bid: 1779846097.8631fc262581453bbf619ec5b2062170.19e67182a7c000d780 Feedback-ID: default:8631fc262581453bbf619ec5b2062170:Sweego x-campaign-id: default x-client-id: 8631fc262581453bbf619ec5b2062170 X-Originating-IP: [37.26.189.201] Date: Wed, 27 May 2026 03:41:36 +0200 MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [PATCH 1/2] Fix use-after-free in evtchn DPC To: =?UTF-8?B?UmFmYcWCIFdvamR5xYJh?= , win-pv-devel@lists.xenproject.org References: <20260526162934.217954-1-omeg@invisiblethingslab.com> <20260526162934.217954-2-omeg@invisiblethingslab.com> Content-Language: en-US From: Tu Dinh In-Reply-To: <20260526162934.217954-2-omeg@invisiblethingslab.com> X-BM-Disclaimer: Yes Content-Type: multipart/alternative; boundary="-=Part.144c.b351cfb2eb215023.19e671827e5.7668ba9c04ec1d7f=-" X-Bm-Milter-Handled: 4ffbd6c1-ee69-4e1b-aabd-f977039bd3e2 X-Bm-Transport-Timestamp: 1779846096869 X-purgate-ID: tlsNG-42698a/1779846103-19165F3B-3E10BA4A/0/0 X-purgate-type: clean X-purgate-size: 4531 ---=Part.144c.b351cfb2eb215023.19e671827e5.7668ba9c04ec1d7f=- Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable On 26/05/2026 18:30, Rafa=C5=82 Wojdy=C5=82a wrote: > EvtchnFree() calls XENBUS_EVTCHN(Close) and then KeFlushQueuedDpcs() > to drain any pending DPCs=2E A DPC queued just before Close returns can > run in the window between Close completing and the flush draining it, > at which point it dereferences Context->Channel inside > XENBUS_EVTCHN(Unmask)=2E >=20 > Also move Context->Fdo initialization to before opening the channel > so Context is fully populated by the time the channel can fire its first > interrupt=2E >=20 > Signed-off-by: Rafa=C5=82 Wojdy=C5=82a > --- > src/xeniface/ioctl_evtchn=2Ec | 21 ++++++++++++++------- > src/xeniface/ioctls=2Eh | 1 + > 2 files changed, 15 insertions(+), 7 deletions(-) >=20 > diff --git a/src/xeniface/ioctl_evtchn=2Ec b/src/xeniface/ioctl_evtchn= =2Ec > index 6d63996=2E=2Ee38e25f 100644 > --- a/src/xeniface/ioctl_evtchn=2Ec > +++ b/src/xeniface/ioctl_evtchn=2Ec > @@ -58,11 +58,14 @@ EvtchnNotificationDpc( > =20 > KeSetEvent(Context->Event, 0, FALSE); > =20 > - (VOID) XENBUS_EVTCHN(Unmask, > - &Context->Fdo->EvtchnInterface, > - Context->Channel, > - FALSE, > - TRUE); > + if (InterlockedCompareExchange(&Context->Ready, 1, 1) =3D=3D 1) { > + (VOID) XENBUS_EVTCHN(Unmask, > + &Context->Fdo->EvtchnInterface, > + Context->Channel, > + FALSE, > + TRUE); > + > + } > } > =20 > _Function_class_(KSERVICE_ROUTINE) > @@ -103,6 +106,8 @@ EvtchnFree( > Trace("Context %p, LocalPort %d, FO %p\n", > Context, Context->LocalPort, Context->FileObjec= t); > =20 > + (VOID) InterlockedExchange(&Context->Ready, 0); > + Shouldn't KeFlushQueuedDpcs() be called before closing the channel?=20 Otherwise there could still be a DPC which has captured Context->Ready=3D1= =20 before InterlockedExchange is called, and then still running=20 concurrently with the XENBUS_EVTCHN(Close)=2E > XENBUS_EVTCHN(Close, > &Fdo->EvtchnInterface, > Context->Channel); > @@ -176,6 +181,7 @@ IoctlEvtchnBindUnbound( > goto fail2; > =20 > Context->FileObject =3D FileObject; > + Context->Fdo =3D Fdo; > =20 > Trace("> RemoteDomain %d, Mask %d, FO %p\n", > In->RemoteDomain, In->Mask, FileObject); > @@ -206,7 +212,7 @@ IoctlEvtchnBindUnbound( > &Fdo->EvtchnInterface, > Context->Channel); > =20 > - Context->Fdo =3D Fdo; > + (VOID) InterlockedExchange(&Context->Ready, 1); > =20 > ExInterlockedInsertTailList(&Fdo->EvtchnList, &Context->Entry, &Fd= o->EvtchnLock); > =20 > @@ -269,6 +275,7 @@ IoctlEvtchnBindInterdomain( > goto fail2; > =20 > Context->FileObject =3D FileObject; > + Context->Fdo =3D Fdo; > =20 > Trace("> RemoteDomain %d, RemotePort %lu, Mask %d, FO %p\n", > In->RemoteDomain, In->RemotePort, In->Mask, Fil= eObject); > @@ -300,7 +307,7 @@ IoctlEvtchnBindInterdomain( > &Fdo->EvtchnInterface, > Context->Channel); > =20 > - Context->Fdo =3D Fdo; > + (VOID) InterlockedExchange(&Context->Ready, 1); > =20 > ExInterlockedInsertTailList(&Fdo->EvtchnList, &Context->Entry, &Fd= o->EvtchnLock); > =20 > diff --git a/src/xeniface/ioctls=2Eh b/src/xeniface/ioctls=2Eh > index b4c8de2=2E=2Ef5eddbf 100644 > --- a/src/xeniface/ioctls=2Eh > +++ b/src/xeniface/ioctls=2Eh > @@ -53,6 +53,7 @@ typedef struct _XENIFACE_EVTCHN_CONTEXT { > PXENIFACE_FDO Fdo; > KDPC Dpc; > PVOID FileObject; > + volatile LONG Ready; > } XENIFACE_EVTCHN_CONTEXT, *PXENIFACE_EVTCHN_CONTEXT; > =20 > typedef struct _XENIFACE_SUSPEND_CONTEXT { -- Ngoc Tu Dinh | Vates XCP-ng Developer XCP-ng & Xen Orchestra - Vates = solutions web: https://vates=2Etech ---=Part.144c.b351cfb2eb215023.19e671827e5.7668ba9c04ec1d7f=--- From win-pv-devel-bounces@lists.xenproject.org Wed May 27 09:00:02 2026 Return-path: Envelope-to: archives@lists.xenproject.org Delivery-date: Wed, 27 May 2026 09:00:02 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1320388.1587690 (Exim 4.92) (envelope-from ) id 1wSA7M-0000Rp-Rr; Wed, 27 May 2026 09:00:00 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1320388.1587690; Wed, 27 May 2026 09:00:00 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wSA7M-0000Rh-OO; Wed, 27 May 2026 09:00:00 +0000 Received: by outflank-mailman (input) for mailman id 1320388; Wed, 27 May 2026 08:59:59 +0000 Received: from mx.expurgate.net ([194.145.224.20]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wSA7L-0000Rb-4M for win-pv-devel@lists.xenproject.org; Wed, 27 May 2026 08:59:59 +0000 Received: from mx.expurgate.net (helo=localhost) by mx.expurgate.net with esmtp id 1wSA7K-0042jV-15 for win-pv-devel@lists.xenproject.org; Wed, 27 May 2026 10:59:58 +0200 Received: from [10.42.69.3] (helo=localhost) by localhost with ESMTP (eXpurgate MTA 0.9.1) (envelope-from ) id 6a16b28d-5cb7-0a2a0a5109dd-0a2a4503b168-0 for ; Wed, 27 May 2026 10:59:57 +0200 Received: from [202.12.124.159] (helo=fhigh-b8-smtp.messagingengine.com) by tlsNG-33051d.mxtls.expurgate.net with ESMTPS (eXpurgate 4.56.1) (envelope-from ) id 6a16b28c-672d-0a2a45030019-ca0c7c9f885b-3 for ; Wed, 27 May 2026 10:59:57 +0200 Received: from phl-compute-02.internal (phl-compute-02.internal [10.202.2.42]) by mailfhigh.stl.internal (Postfix) with ESMTP id 242C37A00B5; Wed, 27 May 2026 04:59:56 -0400 (EDT) Received: from phl-frontend-03 ([10.202.2.162]) by phl-compute-02.internal (MEProxy); Wed, 27 May 2026 04:59:56 -0400 Received: by mail.messagingengine.com (Postfix) with ESMTPA; Wed, 27 May 2026 04:59:55 -0400 (EDT) X-BeenThere: win-pv-devel@lists.xenproject.org List-Id: Developer list for the Windows PV Drivers subproject List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: win-pv-devel-bounces@lists.xenproject.org Precedence: list Sender: "win-pv-devel" Authentication-Results: eu.smtp.expurgate.cloud; dkim=pass header.s=fm3 header.d=invisiblethingslab.com header.i="@invisiblethingslab.com" header.h="Content-Transfer-Encoding:Content-Type:Date:From:In-Reply-To:Message-ID:MIME-Version:References:Subject:To"; dkim=pass header.s=fm3 header.d=messagingengine.com header.i="@messagingengine.com" header.h="Content-Transfer-Encoding:Content-Type:Date:Feedback-ID:From:In-Reply-To:Message-ID:MIME-Version:References:Subject:To:X-ME-Proxy:X-ME-Sender" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= invisiblethingslab.com; h=cc:content-transfer-encoding :content-type:content-type:date:date:from:from:in-reply-to :in-reply-to:message-id:mime-version:references:reply-to:subject :subject:to:to; s=fm3; t=1779872395; x=1779958795; bh=6GLGSDZ0T/ vpK9eTNYTqcbhHEh7jAvXULp7jh0wrn78=; b=P/rwjjHqiSo5im4ID14roAWGPt q1q+COH1a995bxcjAQbyMXakkj9CPAn53Q5TQRWAPA/zInkgWnQQgJpvUW1WIvAy HFAUYuvgQ56QM9iaO/0OewoxjcWq4LfQ2DWiZfxphImX+ZGMhnMXTMGxmUedcpbI oC+/zd19XNII0DMkrWHgbdsIKMU7Jki/+M8UfIilEww6+e2nHYfQKWcrBAZI/bxj rITCKp/pAIWpElaPG5DmgHULKi+jF0i/c4uraY8hJRXvGSRxrJwIKmaEZ7ibbzzn GgnQV9YcANZ2EaJi9M7EqSET5DTvwT8uURFxOP+PgWkqal+SJTsBopYz+R0A== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=cc:content-transfer-encoding:content-type :content-type:date:date:feedback-id:feedback-id:from:from :in-reply-to:in-reply-to:message-id:mime-version:references :reply-to:subject:subject:to:to:x-me-proxy:x-me-sender :x-me-sender:x-sasl-enc; s=fm3; t=1779872395; x=1779958795; bh=6 GLGSDZ0T/vpK9eTNYTqcbhHEh7jAvXULp7jh0wrn78=; b=dZ/tYQ0VDerIuUo1G S0/7+OVTGzBstxGirj9ZmkHvNFR+KBWGi15/XYckQJwYYNww4aWGogFUOmgPwYTA hcUg8xNG8yHz4lctmguAhc9AX1gTpb5Xj3gR9llrv6AJoK5eQXMw4elmCwgUTE3Y KcN+caQbwn3d3NUt6l9UV0EzNTMCtbCT8XHlpd3FRjPkmFe7LzDpGHxC36t+Nb8t HXkW80QrmGitiVEkfh52QywTtiqBIYAxQ6iYWfUCjpys4DTbzwXjIDTPXt/LHSNk UOkqbpf2aZ/a2oeyd8hqThKstQ8LelKo4dR2cgvzW9ule1N2Q+R15tG09wZnAY89 ujn4g== X-ME-Sender: X-ME-Received: X-ME-Proxy-Cause: dmFkZTEirjkacJoJu7rDpUDgNbb/K13fudoNln2XqW6FjALHVVHcwcz/R3EgGGJ0A7El/A 7Q2tHhInrTqw4o9dJeT6KHeoiob0skntvptoYKsw5Y01iqklSCbuONp1E+sMaN6kqU3gSz TmqSkOFR5T/osFY3tSfuTDIUBHkk+V3NfRi+EB4GW+lxnYcDScCq+kVuiCKLOuFcdvsDgs bn/CsXdhnSpOe5DdpuGkaWnnJqipMk+X8YqpMKb5dzllBkHyrQ2QId4bnPRxbYG/AIhhR/ GwRMD7QPQxbnboWhsh4K8cQ7ngYch9saj2UtItzaDb2chQnxjvic+hJoq69stJ0xoOe3cB bEHHszbebr3a3sKdbExRWk1jFN8bqND4dB8ZbhUqY+Pd93E86uvXk4Z1FwndzVc0Wxn8V0 Axo/dN4z3xJyTZ6z/KH1vB93DayacMicaFX3HSqoBfHQn59TBT/2WdmO9ymv+GyXfUwWeX ABzBlCZB+i5L3kR7bySOV/fyf8BkjneFjO/yTeHqGb810PJ/rntEaFxXeiAAZmyo7IcyFb 0+z83BD9V0QYc3XfWwKj33d2U5zmG0cS+J4nSspc+bWDpHB18z/25KVviDY+lahfYfBXfr kC3vw8P/ldwObsyo7ZtdLg/SEr8qZh57nNsgnDdaEQoEy+vcwmhnuyO0v7sQ X-ME-Proxy: Feedback-ID: i409c4082:Fastmail Message-ID: <118fec27-e371-408a-a245-84aea0cef989@invisiblethingslab.com> Date: Wed, 27 May 2026 10:59:52 +0200 MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [PATCH 1/2] Fix use-after-free in evtchn DPC To: Tu Dinh , win-pv-devel@lists.xenproject.org References: <20260526162934.217954-1-omeg@invisiblethingslab.com> <20260526162934.217954-2-omeg@invisiblethingslab.com> <1779846097.8631fc262581453bbf619ec5b2062170.19e67182a7c000d780@vates.tech> Content-Language: en-US From: =?UTF-8?B?UmFmYcWCIFdvamR5xYJh?= In-Reply-To: <1779846097.8631fc262581453bbf619ec5b2062170.19e67182a7c000d780@vates.tech> Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 8bit X-purgate-ID: tlsNG-33051d/1779872397-36547938-7B50D7C5/0/0 X-purgate-type: clean X-purgate-size: 2417 W dniu 27.05.2026 o 03:41, Tu Dinh pisze: > On 26/05/2026 18:30, Rafał Wojdyła wrote: >> EvtchnFree() calls XENBUS_EVTCHN(Close) and then KeFlushQueuedDpcs() >> to drain any pending DPCs. A DPC queued just before Close returns can >> run in the window between Close completing and the flush draining it, >> at which point it dereferences Context->Channel inside >> XENBUS_EVTCHN(Unmask). >> >> Also move Context->Fdo initialization to before opening the channel >> so Context is fully populated by the time the channel can fire its first >> interrupt. >> >> Signed-off-by: Rafał Wojdyła >> --- >> src/xeniface/ioctl_evtchn.c | 21 ++++++++++++++------- >> src/xeniface/ioctls.h | 1 + >> 2 files changed, 15 insertions(+), 7 deletions(-) >> >> diff --git a/src/xeniface/ioctl_evtchn.c b/src/xeniface/ioctl_evtchn.c >> index 6d63996..e38e25f 100644 >> --- a/src/xeniface/ioctl_evtchn.c >> +++ b/src/xeniface/ioctl_evtchn.c >> @@ -58,11 +58,14 @@ EvtchnNotificationDpc( >> >> KeSetEvent(Context->Event, 0, FALSE); >> >> - (VOID) XENBUS_EVTCHN(Unmask, >> - &Context->Fdo->EvtchnInterface, >> - Context->Channel, >> - FALSE, >> - TRUE); >> + if (InterlockedCompareExchange(&Context->Ready, 1, 1) == 1) { >> + (VOID) XENBUS_EVTCHN(Unmask, >> + &Context->Fdo->EvtchnInterface, >> + Context->Channel, >> + FALSE, >> + TRUE); >> + >> + } >> } >> >> _Function_class_(KSERVICE_ROUTINE) >> @@ -103,6 +106,8 @@ EvtchnFree( >> Trace("Context %p, LocalPort %d, FO %p\n", >> Context, Context->LocalPort, Context->FileObject); >> >> + (VOID) InterlockedExchange(&Context->Ready, 0); >> + > > Shouldn't KeFlushQueuedDpcs() be called before closing the channel? > Otherwise there could still be a DPC which has captured Context->Ready=1 > before InterlockedExchange is called, and then still running > concurrently with the XENBUS_EVTCHN(Close). From my understanding KeFlushQueuedDpcs() flushes what's *currently* queued, so there would still be a window after it completes and before Close() finishes when new events could arrive. From win-pv-devel-bounces@lists.xenproject.org Wed May 27 09:02:16 2026 Return-path: Envelope-to: archives@lists.xenproject.org Delivery-date: Wed, 27 May 2026 09:02:16 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1320389.1587694 (Exim 4.92) (envelope-from ) id 1wSA9Y-0001Wk-0j; Wed, 27 May 2026 09:02:16 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1320389.1587694; Wed, 27 May 2026 09:02:15 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wSA9X-0001Wd-UT; Wed, 27 May 2026 09:02:15 +0000 Received: by outflank-mailman (input) for mailman id 1320389; Wed, 27 May 2026 09:02:14 +0000 Received: from mx.expurgate.net ([195.190.135.10]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wSA9V-0001WJ-EI for win-pv-devel@lists.xenproject.org; Wed, 27 May 2026 09:02:14 +0000 Received: from mx.expurgate.net (helo=localhost) by mx.expurgate.net with esmtp id 1wSA9T-001eeQ-Vq for win-pv-devel@lists.xenproject.org; Wed, 27 May 2026 11:02:12 +0200 Received: from [10.42.69.1] (helo=localhost) by localhost with ESMTP (eXpurgate MTA 0.9.1) (envelope-from ) id 6a16b309-5cb7-0a2a0a5109dd-0a2a4501948e-28 for ; Wed, 27 May 2026 11:02:11 +0200 Received: from [185.255.28.34] (helo=prod-mta-13.swg-srv.net) by tlsNG-d62444.mxtls.expurgate.net with ESMTPS (eXpurgate 4.56.1) (envelope-from ) id 6a16b313-c1f2-0a2a45010019-b9ff1c228337-3 for ; Wed, 27 May 2026 11:02:11 +0200 Received: from mail2.vates.fr ([37.26.189.201] mail2.vates.fr) (Authenticated sender: 8631fc262581453bbf619ec5b2062170/smtp/7773de5a-2839-4720-82ee-e06722ae1d3e) by prod-mta-13.swg-srv.net (ZoneMTA - prod-mta-13) with ESMTPSA id 19e68ab8189000d780.002 for (version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384); Wed, 27 May 2026 09:02:10 +0000 Received: from [192.168.1.61] (155.223.66.37.rev.sfr.net [37.66.223.155]) (Authenticated sender: ngoc-tu.dinh@vates.tech) by mail2.vates.fr (Postfix) with ESMTPSA id 41F04813C3; Wed, 27 May 2026 11:02:08 +0200 (CEST) X-BeenThere: win-pv-devel@lists.xenproject.org List-Id: Developer list for the Windows PV Drivers subproject List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: win-pv-devel-bounces@lists.xenproject.org Precedence: list Sender: "win-pv-devel" Authentication-Results: eu.smtp.expurgate.cloud; dkim=pass header.s=selector1 header.d=vates.tech header.i="@vates.tech" header.h="From:Subject:Date:Message-ID:To:MIME-Version:Content-Type:In-Reply-To:References:Feedback-ID" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=vates.tech; q=dns/txt; s=selector1; bh=vO+WqWMgdOtFNdg7CmRjKEs3U0ftS/FgNy77vQak0Fw=; h=from:subject:date:message-id:to:mime-version:content-type:in-reply-to:references:feedback-id; b=VKS5KMXDM/xAPXT4XB0Z6Qe1JpILCidYJEYu+HZvG+fjPQoSJH5xsNrL2AtNREFJ/SOA3eVki w29CmCo8132fzizQClf/y5jk2hA2meEOOadUXVv+xB92oVlvGFqnkaCKO1F97c0MWbQeeEh1xb3 iQm1HUd0iEfsYmT2ewW4HEARepSEimxCgtSox+2QWlTQ+rkTr5y2BXniz+bDXKAFvA9BlbM0X2R RNF2VAGBj0chSQpzq1rax+MxBf9QGOOx6dMt/8n1CFi05vGhV3Rm5W/I3iNqHFrofygnnsaocgy /agnVx0SNPP47kxk0Myk0LsKuHoMOfTSJ0YNQhNbYbFA== X-Zone-Loop: 6baab8e1c45173e97e4471a30e8e5d94eccdf317fdf9 x-campaign-type: default x-transaction-id: aaa3a978-d2a9-47d5-a881-448671a3dae0 x-swg-uid: 01-6b0d24ba-44df-4b5c-aa6b-eab065efce03 X-Mailer: Sweego Message-ID: <1779872530.8631fc262581453bbf619ec5b2062170.19e68ab8189000d780@vates.tech> x-swg-bid: 1779872530.8631fc262581453bbf619ec5b2062170.19e68ab8189000d780 Feedback-ID: default:8631fc262581453bbf619ec5b2062170:Sweego x-campaign-id: default x-client-id: 8631fc262581453bbf619ec5b2062170 X-Originating-IP: [37.26.189.201] Date: Wed, 27 May 2026 11:02:07 +0200 MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [PATCH 1/2] Fix use-after-free in evtchn DPC To: =?UTF-8?B?UmFmYcWCIFdvamR5xYJh?= , win-pv-devel@lists.xenproject.org References: <20260526162934.217954-1-omeg@invisiblethingslab.com> <20260526162934.217954-2-omeg@invisiblethingslab.com> <1779846097.8631fc262581453bbf619ec5b2062170.19e67182a7c000d780@vates.tech> <118fec27-e371-408a-a245-84aea0cef989@invisiblethingslab.com> Content-Language: en-US From: Tu Dinh In-Reply-To: <118fec27-e371-408a-a245-84aea0cef989@invisiblethingslab.com> X-BM-Disclaimer: Yes Content-Type: multipart/alternative; boundary="-=Part.14ae.bf55522961d5687f.19e68ab77c9.a2692fbf8f517346=-" X-Bm-Milter-Handled: 4ffbd6c1-ee69-4e1b-aabd-f977039bd3e2 X-Bm-Transport-Timestamp: 1779872528329 X-purgate-ID: tlsNG-d62444/1779872531-AE342FF4-A9590980/0/0 X-purgate-type: clean X-purgate-size: 4554 ---=Part.14ae.bf55522961d5687f.19e68ab77c9.a2692fbf8f517346=- Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable On 27/05/2026 10:59, Rafa=C5=82 Wojdy=C5=82a wrote: >=20 >=20 > W dniu 27=2E05=2E2026 o=C2=A003:41, Tu Dinh pisze: >> On 26/05/2026 18:30, Rafa=C5=82 Wojdy=C5=82a wrote: >>> EvtchnFree() calls XENBUS_EVTCHN(Close) and then KeFlushQueuedDpcs() >>> to drain any pending DPCs=2E A DPC queued just before Close returns ca= n >>> run in the window between Close completing and the flush draining it, >>> at which point it dereferences Context->Channel inside >>> XENBUS_EVTCHN(Unmask)=2E >>> >>> Also move Context->Fdo initialization to before opening the channel >>> so Context is fully populated by the time the channel can fire its fir= st >>> interrupt=2E >>> >>> Signed-off-by: Rafa=C5=82 Wojdy=C5=82a >>> --- >>> =C2=A0=C2=A0 src/xeniface/ioctl_evtchn=2Ec | 21 ++++++++++++++------- >>> =C2=A0=C2=A0 src/xeniface/ioctls=2Eh=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0 |=C2=A0 1 + >>> =C2=A0=C2=A0 2 files changed, 15 insertions(+), 7 deletions(-) >>> >>> diff --git a/src/xeniface/ioctl_evtchn=2Ec b/src/xeniface/ioctl_evtchn= =2Ec >>> index 6d63996=2E=2Ee38e25f 100644 >>> --- a/src/xeniface/ioctl_evtchn=2Ec >>> +++ b/src/xeniface/ioctl_evtchn=2Ec >>> @@ -58,11 +58,14 @@ EvtchnNotificationDpc( >>> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 KeSetEvent(Context->Event, 0, FAL= SE); >>> -=C2=A0=C2=A0=C2=A0 (VOID) XENBUS_EVTCHN(Unmask, >>> -=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= &Context->Fdo->EvtchnInterface, >>> -=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= Context->Channel, >>> -=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= FALSE, >>> -=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= TRUE); >>> +=C2=A0=C2=A0=C2=A0 if (InterlockedCompareExchange(&Context->Ready, 1,= 1) =3D=3D 1) { >>> +=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 (VOID) XENBUS_EVTCHN(Unmas= k, >>> +=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0 &Context->Fdo->EvtchnInterface, >>> +=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0 Context->Channel, >>> +=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0 FALSE, >>> +=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0 TRUE); >>> + >>> +=C2=A0=C2=A0=C2=A0 } >>> =C2=A0=C2=A0 } >>> =C2=A0=C2=A0 _Function_class_(KSERVICE_ROUTINE) >>> @@ -103,6 +106,8 @@ EvtchnFree( >>> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 Trace("Context %p, LocalPort %d, = FO %p\n", >>> =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0 Context, Context->LocalPort, Context-=20 >>> >FileObject); >>> +=C2=A0=C2=A0=C2=A0 (VOID) InterlockedExchange(&Context->Ready, 0); >>> + >> >> Shouldn't KeFlushQueuedDpcs() be called before closing the channel? >> Otherwise there could still be a DPC which has captured Context->Ready= =3D1 >> before InterlockedExchange is called, and then still running >> concurrently with the XENBUS_EVTCHN(Close)=2E > From my understanding KeFlushQueuedDpcs() flushes what's *currently*=20 > queued, so there would still be a window after it completes and before= =20 > Close() finishes when new events could arrive=2E Yes, but that's enough for protecting Context->Channel, as future queued= =20 DPCs will read Context->Ready=3D0 and won't try to use the channel=2E -- Ngoc Tu Dinh | Vates XCP-ng Developer XCP-ng & Xen Orchestra - Vates = solutions web: https://vates=2Etech ---=Part.14ae.bf55522961d5687f.19e68ab77c9.a2692fbf8f517346=--- From win-pv-devel-bounces@lists.xenproject.org Wed May 27 09:29:43 2026 Return-path: Envelope-to: archives@lists.xenproject.org Delivery-date: Wed, 27 May 2026 09:29:43 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1320398.1587707 (Exim 4.92) (envelope-from ) id 1wSAa5-0004al-Vt; Wed, 27 May 2026 09:29:41 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1320398.1587707; Wed, 27 May 2026 09:29:41 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wSAa5-0004ae-T7; Wed, 27 May 2026 09:29:41 +0000 Received: by outflank-mailman (input) for mailman id 1320398; Wed, 27 May 2026 09:29:40 +0000 Received: from mx.expurgate.net ([195.190.135.10]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wSAa4-0004aY-7G for win-pv-devel@lists.xenproject.org; Wed, 27 May 2026 09:29:40 +0000 Received: from mx.expurgate.net (helo=localhost) by mx.expurgate.net with esmtp id 1wSAa3-00CNVB-JH for win-pv-devel@lists.xenproject.org; Wed, 27 May 2026 11:29:39 +0200 Received: from [10.42.69.12] (helo=localhost) by localhost with ESMTP (eXpurgate MTA 0.9.1) (envelope-from ) id 6a16b97b-5cb7-0a2a0a5109dd-0a2a450c9a38-44 for ; Wed, 27 May 2026 11:29:39 +0200 Received: from [202.12.124.159] (helo=fhigh-b8-smtp.messagingengine.com) by tlsNG-d25034.mxtls.expurgate.net with ESMTPS (eXpurgate 4.56.1) (envelope-from ) id 6a16b982-62f1-0a2a450c0019-ca0c7c9fd665-3 for ; Wed, 27 May 2026 11:29:39 +0200 Received: from phl-compute-01.internal (phl-compute-01.internal [10.202.2.41]) by mailfhigh.stl.internal (Postfix) with ESMTP id D44027A0076; Wed, 27 May 2026 05:29:37 -0400 (EDT) Received: from phl-frontend-03 ([10.202.2.162]) by phl-compute-01.internal (MEProxy); Wed, 27 May 2026 05:29:37 -0400 Received: by mail.messagingengine.com (Postfix) with ESMTPA; Wed, 27 May 2026 05:29:36 -0400 (EDT) X-BeenThere: win-pv-devel@lists.xenproject.org List-Id: Developer list for the Windows PV Drivers subproject List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: win-pv-devel-bounces@lists.xenproject.org Precedence: list Sender: "win-pv-devel" Authentication-Results: eu.smtp.expurgate.cloud; dkim=pass header.s=fm3 header.d=invisiblethingslab.com header.i="@invisiblethingslab.com" header.h="Content-Transfer-Encoding:Content-Type:Date:From:In-Reply-To:Message-ID:MIME-Version:References:Subject:To"; dkim=pass header.s=fm3 header.d=messagingengine.com header.i="@messagingengine.com" header.h="Content-Transfer-Encoding:Content-Type:Date:Feedback-ID:From:In-Reply-To:Message-ID:MIME-Version:References:Subject:To:X-ME-Proxy:X-ME-Sender" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= invisiblethingslab.com; h=cc:content-transfer-encoding :content-type:content-type:date:date:from:from:in-reply-to :in-reply-to:message-id:mime-version:references:reply-to:subject :subject:to:to; s=fm3; t=1779874177; x=1779960577; bh=sy+exXnUwp 1D73uvIZ9YkX7IHIV+itYVIofsQYRsHuU=; b=J1wWXzTVNC3dsTBuBCBEhJSJcu rwoHJuJzzmd6HMLxRdN0HAPZFYGaknFLHDKdhTMoflLiGz7h+ZadBLmoC3B6IY88 IbSG6zYFiubZUOOrClXmh+wRy6eGSqXhZY7xUR1GTP1FNE1UkIyljBj/Xa+RBWQ/ B9vsGXORylvJBYG6wlpw3x96XxQ+13WtVMznCnEvrNWP4O1mfYRS/6y3pbZ3KHtO HCKCJJcc8+4TvsUPxB2iOQD7jnjnsPZepTqsYCxflldpKATfGS9UwqEGnrQAZ+QB vV2D1epYaTg5oFtStULxvXvhoIV2DnfwRcBLlSrCjdnuLfHHNZJxWNS7aY3w== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=cc:content-transfer-encoding:content-type :content-type:date:date:feedback-id:feedback-id:from:from :in-reply-to:in-reply-to:message-id:mime-version:references :reply-to:subject:subject:to:to:x-me-proxy:x-me-sender :x-me-sender:x-sasl-enc; s=fm3; t=1779874177; x=1779960577; bh=s y+exXnUwp1D73uvIZ9YkX7IHIV+itYVIofsQYRsHuU=; b=ESc+lsc6EvYXnkHmQ R4C7tePtRgiVnKgy+wqHGolhrjtEe/mRuHI8j2sDAZ1Io6YnWveB0Y28f6qAfZCf lcWTmtxZKyelz3P6kYdVRp2LI7a2utwl4pFm3Ky6314HrO+cExW6Qx1B7bi39+4A 2XIffYO5wHvIFQdNAIRh3angspA3GIdcTuCCrDp02bPTIhjsvQCzjHvwnHzwmCG5 HdEXbntet2YQ440uv5a8HWw1L0z5CE6Lz96PG5ej5JtIpBKQE91GIZ9oG5vta3Ls /Gui/bJQdsyA/u/XIUGIVm381Ci+vkfOOv+YaguK3e7FAZ0OHly4/CwMUYOlotQd moxbQ== X-ME-Sender: X-ME-Received: X-ME-Proxy-Cause: dmFkZTE8j5Xqka2C0Kbdvh7BHmz3hIyWmy8vytGY/ZjxVCFoiWlgLnOfK6jnbq5262oaBS aNJqghfAuTdSjk2sXb8mY1c88sqxOk6dwvWfnDmFtSeCXdiBFTgxT6eYmMzz2Cwak6S3py nEhhS/ZBreMpa+Vv+7+ehaJbKLI3BBYYPNfbn3Ji+zf9WQklVm41fb7lIYr5/eDCBP8Ttm vWKyhQjfy+ZSH3PAA4CWF2l7XILNvtT7SIrQ2cOl8q68RGnSz3fAVjh1gC90bz8WmbO4lq kqyKUkHrj8rFxnOIE/nFEQ2C/UFAfzFMPF49Z1OiExgNDf22r7kZ6QkdRLqOKqHRw0LLjM bRiqmgURqbhuR4TzdXHuCHEFKR9vjlruyfDyyb7u5/DAkXL78+CiZvnG/3PUY+n295eE3M maum3oNwLnYNwAxh+89Y2FZCun4cL9pwcxBonRNTIll6/L97/KhMzyXR16VWXD0YiHndv2 EV9utvIC++d+Ka8VVh/n+PtCAvaHtUFKxEstvagI1N9dFcQR0W6Jcbekk6vxKjT1ppXmsw 9QdXafuGd2NzTFTZvoswjssywqy9UWGu+T31rSYG1XSrsvIHEyP16euWpDp+8ChHqYFoiH qqZkCfqOQ/Gx4eW1hvo6m2fmR1YYSmkzUP+ICHhol+4b+fBqIkUZDb5cYKpQ X-ME-Proxy: Feedback-ID: i409c4082:Fastmail Message-ID: <4987be6b-4633-4ad4-a6d7-2d3c6a59fe0d@invisiblethingslab.com> Date: Wed, 27 May 2026 11:29:35 +0200 MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [PATCH 1/2] Fix use-after-free in evtchn DPC To: Tu Dinh , win-pv-devel@lists.xenproject.org References: <20260526162934.217954-1-omeg@invisiblethingslab.com> <20260526162934.217954-2-omeg@invisiblethingslab.com> <1779846097.8631fc262581453bbf619ec5b2062170.19e67182a7c000d780@vates.tech> <118fec27-e371-408a-a245-84aea0cef989@invisiblethingslab.com> <1779872530.8631fc262581453bbf619ec5b2062170.19e68ab8189000d780@vates.tech> Content-Language: en-US From: =?UTF-8?B?UmFmYcWCIFdvamR5xYJh?= In-Reply-To: <1779872530.8631fc262581453bbf619ec5b2062170.19e68ab8189000d780@vates.tech> Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 8bit X-purgate-ID: tlsNG-d25034/1779874179-DA975CF5-25546072/0/0 X-purgate-type: clean X-purgate-size: 3319 W dniu 27.05.2026 o 11:02, Tu Dinh pisze: > On 27/05/2026 10:59, Rafał Wojdyła wrote: >> >> >> W dniu 27.05.2026 o 03:41, Tu Dinh pisze: >>> On 26/05/2026 18:30, Rafał Wojdyła wrote: >>>> EvtchnFree() calls XENBUS_EVTCHN(Close) and then KeFlushQueuedDpcs() >>>> to drain any pending DPCs. A DPC queued just before Close returns can >>>> run in the window between Close completing and the flush draining it, >>>> at which point it dereferences Context->Channel inside >>>> XENBUS_EVTCHN(Unmask). >>>> >>>> Also move Context->Fdo initialization to before opening the channel >>>> so Context is fully populated by the time the channel can fire its first >>>> interrupt. >>>> >>>> Signed-off-by: Rafał Wojdyła >>>> --- >>>>    src/xeniface/ioctl_evtchn.c | 21 ++++++++++++++------- >>>>    src/xeniface/ioctls.h       |  1 + >>>>    2 files changed, 15 insertions(+), 7 deletions(-) >>>> >>>> diff --git a/src/xeniface/ioctl_evtchn.c b/src/xeniface/ioctl_evtchn.c >>>> index 6d63996..e38e25f 100644 >>>> --- a/src/xeniface/ioctl_evtchn.c >>>> +++ b/src/xeniface/ioctl_evtchn.c >>>> @@ -58,11 +58,14 @@ EvtchnNotificationDpc( >>>>        KeSetEvent(Context->Event, 0, FALSE); >>>> -    (VOID) XENBUS_EVTCHN(Unmask, >>>> -                         &Context->Fdo->EvtchnInterface, >>>> -                         Context->Channel, >>>> -                         FALSE, >>>> -                         TRUE); >>>> +    if (InterlockedCompareExchange(&Context->Ready, 1, 1) == 1) { >>>> +        (VOID) XENBUS_EVTCHN(Unmask, >>>> +                             &Context->Fdo->EvtchnInterface, >>>> +                             Context->Channel, >>>> +                             FALSE, >>>> +                             TRUE); >>>> + >>>> +    } >>>>    } >>>>    _Function_class_(KSERVICE_ROUTINE) >>>> @@ -103,6 +106,8 @@ EvtchnFree( >>>>        Trace("Context %p, LocalPort %d, FO %p\n", >>>>                           Context, Context->LocalPort, Context- >>>>> FileObject); >>>> +    (VOID) InterlockedExchange(&Context->Ready, 0); >>>> + >>> >>> Shouldn't KeFlushQueuedDpcs() be called before closing the channel? >>> Otherwise there could still be a DPC which has captured Context->Ready=1 >>> before InterlockedExchange is called, and then still running >>> concurrently with the XENBUS_EVTCHN(Close). >> From my understanding KeFlushQueuedDpcs() flushes what's *currently* >> queued, so there would still be a window after it completes and before >> Close() finishes when new events could arrive. > > Yes, but that's enough for protecting Context->Channel, as future queued > DPCs will read Context->Ready=0 and won't try to use the channel. > You are correct, I've been staring at this code for too long. My concern was also the KeSetEvent in the DPC, but that can be skipped if !Ready regardless of mask state since the channel is already being torn down (or being initialized). I'll send v2 after some more tests. From win-pv-devel-bounces@lists.xenproject.org Wed May 27 09:30:34 2026 Return-path: Envelope-to: archives@lists.xenproject.org Delivery-date: Wed, 27 May 2026 09:30:34 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1320399.1587710 (Exim 4.92) (envelope-from ) id 1wSAaw-0005bd-2x; Wed, 27 May 2026 09:30:34 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1320399.1587710; Wed, 27 May 2026 09:30:34 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wSAav-0005bW-WE; Wed, 27 May 2026 09:30:34 +0000 Received: by outflank-mailman (input) for mailman id 1320399; Wed, 27 May 2026 09:30:32 +0000 Received: from mx.expurgate.net ([195.190.135.10]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wSAau-0005bQ-0Q for win-pv-devel@lists.xenproject.org; Wed, 27 May 2026 09:30:32 +0000 Received: from mx.expurgate.net (helo=localhost) by mx.expurgate.net with esmtp id 1wSAat-00CNux-CS for win-pv-devel@lists.xenproject.org; Wed, 27 May 2026 11:30:31 +0200 Received: from [10.42.69.6] (helo=localhost) by localhost with ESMTP (eXpurgate MTA 0.9.1) (envelope-from ) id 6a16b9b4-5cb7-0a2a0a5109dd-0a2a4506bffe-16 for ; Wed, 27 May 2026 11:30:31 +0200 Received: from [52.101.57.61] (helo=BN8PR05CU002.outbound.protection.outlook.com) by tlsNG-16d1c6.mxtls.expurgate.net with ESMTPS (eXpurgate 4.56.1) (envelope-from ) id 6a16b9b5-7371-0a2a45060019-3465393dcfba-3 for ; Wed, 27 May 2026 11:30:30 +0200 Received: from SA6PR03MB7760.namprd03.prod.outlook.com (2603:10b6:806:43c::5) by DS7PR03MB8316.namprd03.prod.outlook.com (2603:10b6:8:261::18) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.71.12; Wed, 27 May 2026 09:30:27 +0000 Received: from SA6PR03MB7760.namprd03.prod.outlook.com ([fe80::4d5b:a91f:46a3:4b38]) by SA6PR03MB7760.namprd03.prod.outlook.com ([fe80::4d5b:a91f:46a3:4b38%3]) with mapi id 15.21.0071.011; Wed, 27 May 2026 09:30:27 +0000 X-BeenThere: win-pv-devel@lists.xenproject.org List-Id: Developer list for the Windows PV Drivers subproject List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: win-pv-devel-bounces@lists.xenproject.org Precedence: list Sender: "win-pv-devel" Authentication-Results: eu.smtp.expurgate.cloud; dkim=pass header.s=selector1 header.d=citrix.com header.i="@citrix.com" header.h="From:Date:Subject:Message-ID:Content-Type:MIME-Version:x-ms-exchange-senderadcheck" ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=fBN87PR2y95so8CpJQplldtNmb16WR1yneE/QRauSfAYwz+0JN+7s8/Mv4cdrIACzClBlk/YtVGnYy9DMMr4Cq+QcxaBibsdFj0D4IzTC+TDg5ALjecRLyhMhZOi57MofsiD7GceOGveUFDXAqbZUNZ3DhqUs706W6+hGUr+PD1+JH1MlSDh1c79XVklz1A7DG+th9VvO1yP9U5ZWTzMO6rUo/jUKWlLNqwp7EfaG5yvs+r8UpLHF6oK0nbWhPSaP/eQQ5wEME8tDpZjXWAolODMibIclvwhswTFFDEFN3vpZZTrYF4qgUqEUz+cbS7uGdsm0TSYKgHviedavMHyhw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=ol+1KZjhLHqRwi/qojjexDfpAcNr45nn6uHMEWYrjaw=; b=Uj2ZMJKfrGINEJ8V8AFC5LxUKRxmq/gOLhvzsyrvqlhByqNFPp81AMiC16tG9EKTDT6HSV+AgI8Ijtoga568/DLwtS2+pkS3uHuPFSI/MOYFJWNSeHbybTXPnaE+XfLnrm+tBgTPJFnbHKqFT3UrgOHev9dXOWAgKkaw/xTy+P2KGPL1L/RnMefEhYvcKaXlzc25ANJtVnvNnXkAnhBwma0KOVUYQs+0+6tYaX/kMLTw/cVfqqt5yZ9daYFPgFLM3blAS+9eOsq45spSsZTRHK5/ZXVEmH7BPS5AT87xZD7p6x6kDnVXHJk7YtVx6kP40WpjifICWxzgWAzh5YJh1Q== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=citrix.com; dmarc=pass action=none header.from=citrix.com; dkim=pass header.d=citrix.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=citrix.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=ol+1KZjhLHqRwi/qojjexDfpAcNr45nn6uHMEWYrjaw=; b=O4R7TY4nVp+50GinA3MnCMCCSm2n0iv59AvNsX3EfyUYs/gMF3oHj00PY+ZjK4C5rgXfeHkssqb6Hp37b5lTneJqU43/HUJwWWOpJu8DDz3BDFV6FJ+wF/QZUgz2mwANpvwaGu2B0KrxWhXkIaCCm8exjesHuxui3AUaKSRfapw= From: Owen Smith To: Tu Dinh , =?iso-8859-2?Q?Rafa=B3_Wojdy=B3a?= , "win-pv-devel@lists.xenproject.org" Subject: Re: [PATCH 1/2] Fix use-after-free in evtchn DPC Thread-Topic: [PATCH 1/2] Fix use-after-free in evtchn DPC Thread-Index: AQHc7SznkKvEC1veTkadT8U5o/IMXLYhGY4AgAB6dACAAAChgIAAB0F7 Date: Wed, 27 May 2026 09:30:27 +0000 Message-ID: References: <20260526162934.217954-1-omeg@invisiblethingslab.com> <20260526162934.217954-2-omeg@invisiblethingslab.com> <1779846097.8631fc262581453bbf619ec5b2062170.19e67182a7c000d780@vates.tech> <118fec27-e371-408a-a245-84aea0cef989@invisiblethingslab.com> <1779872530.8631fc262581453bbf619ec5b2062170.19e68ab8189000d780@vates.tech> In-Reply-To: <1779872530.8631fc262581453bbf619ec5b2062170.19e68ab8189000d780@vates.tech> Accept-Language: en-GB, en-US Content-Language: en-GB X-MS-Has-Attach: X-MS-TNEF-Correlator: msip_labels: authentication-results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=citrix.com; x-ms-publictraffictype: Email x-ms-traffictypediagnostic: SA6PR03MB7760:EE_|DS7PR03MB8316:EE_ x-ms-office365-filtering-correlation-id: 6266459e-16f6-4bde-20a9-08debbd2969c x-ms-exchange-senderadcheck: 1 x-ms-exchange-antispam-relay: 0 x-microsoft-antispam: BCL:0;ARA:13230040|1800799024|366016|376014|38070700021|56012099006|22082099003|18002099003|4143699003|11063799006|6133799003; x-microsoft-antispam-message-info: wGuojsiXLjk0MPU4T12MH+CEfjncsUebtztwhmEMKmFCkp2FAT/UNyW7k52Oeyv3dUykFnnM5yITcTbDRB56VN/AJv1q/KHUls15vDScqvd/b/dHdwb+2CK6FwZkuWljQ++A83SM0kZtn7B95bcQh56GaxTIz/l+5KbffNyY8/IRnqbvik3Xife3iOrK8O5MxZ/HPtWz+Zfmzf2f/mZMsX80J6ZByPT2RXpsiFDBnBNi/nKL2TQJCeHfsu2+Y7lk+4tjs+ZjMpk0pEIjFFB1vaxIvhjSzec8Lbc5R99urLiL4uRR5YmNq4AEytdZdnlks8llZ3lW4BC74pNIFysCU1XCk9m+iBx1ytJiweObtRQMfeONL9UFLYSw8zjY02WD27rJR2RihVrg6Gxe6QI1mfqdht77UrFi5JVMPgyNoMTtaFhwr367mP20e6CXj3FujRG8aTZA50erWqBkyAq7fJR3Bvw+wMtB7mOvFa7jNaBBj53OCZ8dDKq0kNe1gccuqVOJk0lC4M04ccTYXR1bHyBgcUQQ7AU77LYiZvh2uX2soSHVTnDQCUhAIm8NLzJmrsHfo54OY+Lf9aQAzONE35Ll7roLmSh/nZcmPQ0PqZcOL4sWjrg6YYkO6WBnyEud+Hlud1Vh8XAWJuRip9mpA7rPq/4w6XsfysERkvP1sXT3BMRKE6aRu8uhi5dpVaIJ x-forefront-antispam-report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:SA6PR03MB7760.namprd03.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(1800799024)(366016)(376014)(38070700021)(56012099006)(22082099003)(18002099003)(4143699003)(11063799006)(6133799003);DIR:OUT;SFP:1101; x-ms-exchange-antispam-messagedata-chunkcount: 1 x-ms-exchange-antispam-messagedata-0: =?iso-8859-2?Q?3knsQbGb89YeryEW3XSU9/jFp2pwTlnoARyWg1Vws9DbOogb5YYdt/tBhO?= =?iso-8859-2?Q?VSM3INcYtqNSicqz9No36H7nEJDqnOI51xhT7swFsRX4ZpgUHhlL6EEukJ?= =?iso-8859-2?Q?lFnVYBI1nhWjbZfHmm8en4x69Q0YdDGosd7afsnTLnSRFmbEZzov+8jf3R?= =?iso-8859-2?Q?gvac4OTpAkn2FU8AToFI4/0nKdwOWV8nnVWQfoIqxHgrjz1OAiK82NiWqN?= =?iso-8859-2?Q?TTxFlmkNFyetldfnGgb1cFx22l0YtIEyw1COI94V7sPLhm+o2lPpJwDTsY?= =?iso-8859-2?Q?4Fmr7U+AwCegKcl6LnF1OpuwilR3Hr70RtxXYDSPs6TfRlQHwO8AUZmW+c?= =?iso-8859-2?Q?f+vIAwwrdDmcZI1xmwiBSHXDj0fBo8sfGPOTOLzonYITEFOGmSK6H6XdUK?= =?iso-8859-2?Q?5yQ3Vp3ARtPaiBgTUVPPDyRQQd2q/ONkqq3/FBe9D/c38rLh3DiNYscb85?= =?iso-8859-2?Q?P2rwEbJbVB4QU98eU+eSeCOqbxWVbaLkiMc/i8gPG0Ckl7IkMtXr5wCBXc?= =?iso-8859-2?Q?cWjD3MzknhIjUAxdjbV6zj6C0mfqQ3ZivDEXIf6VhwDzccSFUK1KmVOjXz?= =?iso-8859-2?Q?RYYlDw1bv7PENuJwNGv5W/C5I89zq7fLeknLtwOXUD6eVFPiPDQT2Deo5k?= =?iso-8859-2?Q?1vYFOA/3cWR+0GsgT9n+G5QTBcGHszLpFD4X+bCemYid7TT1PHst1wD5a0?= =?iso-8859-2?Q?rICkKg+nV/tJzW43P8v7VekKxPxKwF29dova34oo1GPWk9AUC5fUyS+R0s?= =?iso-8859-2?Q?Ir71quQU5W8axhnwDG2V+naSjuiPTi9RDP+wMVPcxbKejg9XH95HrnNuyd?= =?iso-8859-2?Q?3YqGx3Lw6tap2TP9H897Yc64E378OmudDD3iyHlX+4k13JCKpFUGWRzU5j?= =?iso-8859-2?Q?xyacOBOvdnu//Bb1CVynduI60yOaIuUgdMsUNh+ZRKnbQ4/5ehq6xrno10?= =?iso-8859-2?Q?bdL5Zf/W6HtfiEciDKqyFDqxKxnb+U/8pY0XU0RNzegD4a+Kpe3fuX17ge?= =?iso-8859-2?Q?14blui5pVub9L7yJXJ2gdkdpO2uBMgv94hOVg5ny4sxJcshXwIhApzo3k+?= =?iso-8859-2?Q?XnSq4JfxmdkuZPXLkgwoegM19lSL2UOZSMI5DP5Ag6Ddy6CujaZ9Y9TlRY?= =?iso-8859-2?Q?aCTzJh0wtfXuvqlrV3kvmv9CFi7abv2o0so/hRmPe681QU0l9kLHHNEFzC?= =?iso-8859-2?Q?y0Bpq6vTaRG3bC2xH9UK0MQkbPJJHTQAU5CWgJ2cvZCi4AR6fpHqbR/vbc?= =?iso-8859-2?Q?Tr7RpRvm96uHxTnSLCqiJAFBgGeUppR8+IaL2djLMBoj66zWpo9pDsB4e0?= =?iso-8859-2?Q?JNZzFxcacXH2dFB1D7zMm5AWzfxYeiODSgR6D6SX7eusw5VgWM62c+5U4I?= =?iso-8859-2?Q?YEwnFaMEvVC1LVyYuQgm9cCWi5hNHubf0E+LX8UOFxEhySdMgwHlVpQvA2?= =?iso-8859-2?Q?8B8WlP0vVY+2Rqdnf6bDbm98Lvc/EbjK1JSmBIGae3xcpQy4uvEHvbjuBL?= =?iso-8859-2?Q?ToYQr1LLSm0Ia20mUB7wgW1JTJ4YP+tsOAyx6MNb6g2AI6A9xHppItV4Oc?= =?iso-8859-2?Q?Bi6uAQ/cuqu6r99IIkWAavKujf2Qkq6IK43vVwYBWl8w1d9xqAtKVsxxnK?= =?iso-8859-2?Q?Vz/TcH/fzV6MMhSyTaac86YVcOgcAm5ZPb6H7JI06ZivzdxGd0ewzDYogP?= =?iso-8859-2?Q?ET3pTkTFg3NDW9rJ39Js+H2HEfhbo+c1IVfreYeb9OxFwHU1Vac0Q+6+hX?= =?iso-8859-2?Q?AkshdgJTIi+bCYGu54qTPW1jpgANA/y8+lKjPWyL4DLiAe?= Content-Type: text/plain; charset="iso-8859-2" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-OriginatorOrg: citrix.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: SA6PR03MB7760.namprd03.prod.outlook.com X-MS-Exchange-CrossTenant-Network-Message-Id: 6266459e-16f6-4bde-20a9-08debbd2969c X-MS-Exchange-CrossTenant-originalarrivaltime: 27 May 2026 09:30:27.7127 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 335836de-42ef-43a2-b145-348c2ee9ca5b X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: MR9qgbB21de5un88VUXfMyX7Bmt1ni4UmaLGQoXuc2qGoBnKZhN1DcQBl9KWPF7ZX0T5AivwZEFR5GWcCHMIeA== X-MS-Exchange-Transport-CrossTenantHeadersStamped: DS7PR03MB8316 X-purgate-ID: tlsNG-16d1c6/1779874231-86974D75-F83C555A/0/0 X-purgate-type: clean X-purgate-size: 3388 It does introduce a very small potential race on Open EvtchnInterruptHandler and therefore EvtchnNotificationDpc can be executed = immediately after the call to XENBUS_EVTCHN(Open...), but as Context->Ready could not be set = at this point, then the event channel wont get unmasked in the DPC. Owen ________________________________________ From: win-pv-devel on behalf of= Tu Dinh Sent: 27 May 2026 10:02 AM To: Rafa=B3 Wojdy=B3a; win-pv-devel@lists.xenproject.org Subject: Re: [PATCH 1/2] Fix use-after-free in evtchn DPC On 27/05/2026 10:59, Rafa=B3 Wojdy=B3a wrote: > > > W dniu 27.05.2026 o 03:41, Tu Dinh pisze: >> On 26/05/2026 18:30, Rafa=B3 Wojdy=B3a wrote: >>> EvtchnFree() calls XENBUS_EVTCHN(Close) and then KeFlushQueuedDpcs() >>> to drain any pending DPCs. A DPC queued just before Close returns can >>> run in the window between Close completing and the flush draining it, >>> at which point it dereferences Context->Channel inside >>> XENBUS_EVTCHN(Unmask). >>> >>> Also move Context->Fdo initialization to before opening the channel >>> so Context is fully populated by the time the channel can fire its firs= t >>> interrupt. >>> >>> Signed-off-by: Rafa=B3 Wojdy=B3a >>> --- >>> src/xeniface/ioctl_evtchn.c | 21 ++++++++++++++------- >>> src/xeniface/ioctls.h |=A0 1 + >>> 2 files changed, 15 insertions(+), 7 deletions(-) >>> >>> diff --git a/src/xeniface/ioctl_evtchn.c b/src/xeniface/ioctl_evtchn.c >>> index 6d63996..e38e25f 100644 >>> --- a/src/xeniface/ioctl_evtchn.c >>> +++ b/src/xeniface/ioctl_evtchn.c >>> @@ -58,11 +58,14 @@ EvtchnNotificationDpc( >>> KeSetEvent(Context->Event, 0, FALSE); >>> - (VOID) XENBUS_EVTCHN(Unmask, >>> - &Context->Fdo->EvtchnInterface, >>> - Context->Channel, >>> - FALSE, >>> - TRUE); >>> + if (InterlockedCompareExchange(&Context->Ready, 1, 1) =3D=3D 1) { >>> + (VOID) XENBUS_EVTCHN(Unmask, >>> + &Context->Fdo->EvtchnInterface, >>> + Context->Channel, >>> + FALSE, >>> + TRUE); >>> + >>> + } >>> } >>> _Function_class_(KSERVICE_ROUTINE) >>> @@ -103,6 +106,8 @@ EvtchnFree( >>> Trace("Context %p, LocalPort %d, FO %p\n", >>> Context, Context->LocalPort, Context- >>> >FileObject); >>> + (VOID) InterlockedExchange(&Context->Ready, 0); >>> + >> >> Shouldn't KeFlushQueuedDpcs() be called before closing the channel? >> Otherwise there could still be a DPC which has captured Context->Ready= =3D1 >> before InterlockedExchange is called, and then still running >> concurrently with the XENBUS_EVTCHN(Close). > From my understanding KeFlushQueuedDpcs() flushes what's *currently* > queued, so there would still be a window after it completes and before > Close() finishes when new events could arrive. Yes, but that's enough for protecting Context->Channel, as future queued DPCs will read Context->Ready=3D0 and won't try to use the channel. -- Ngoc Tu Dinh | Vates XCP-ng Developer XCP-ng & Xen Orchestra - Vates solutions web: https://vates.tech From win-pv-devel-bounces@lists.xenproject.org Wed May 27 09:36:35 2026 Return-path: Envelope-to: archives@lists.xenproject.org Delivery-date: Wed, 27 May 2026 09:36:35 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1320403.1587727 (Exim 4.92) (envelope-from ) id 1wSAgk-0005p0-M1; Wed, 27 May 2026 09:36:34 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1320403.1587727; Wed, 27 May 2026 09:36:34 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wSAgk-0005ot-JJ; Wed, 27 May 2026 09:36:34 +0000 Received: by outflank-mailman (input) for mailman id 1320403; Wed, 27 May 2026 09:36:34 +0000 Received: from mx.expurgate.net ([194.145.224.20]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wSAgk-0005on-1z for win-pv-devel@lists.xenproject.org; Wed, 27 May 2026 09:36:34 +0000 Received: from mx.expurgate.net (helo=localhost) by mx.expurgate.net with esmtp id 1wSAgj-004CMx-46 for win-pv-devel@lists.xenproject.org; Wed, 27 May 2026 11:36:33 +0200 Received: from [10.42.69.9] (helo=localhost) by localhost with ESMTP (eXpurgate MTA 0.9.1) (envelope-from ) id 6a16bb16-bab6-0a2a0a5309dd-0a2a4509d3b6-22 for ; Wed, 27 May 2026 11:36:32 +0200 Received: from [185.255.28.34] (helo=prod-mta-13.swg-srv.net) by tlsNG-bad1c0.mxtls.expurgate.net with ESMTPS (eXpurgate 4.56.1) (envelope-from ) id 6a16bb20-2497-0a2a45090019-b9ff1c22881b-3 for ; Wed, 27 May 2026 11:36:32 +0200 Received: from mail2.vates.fr ([37.26.189.201] mail2.vates.fr) (Authenticated sender: 8631fc262581453bbf619ec5b2062170/smtp/7773de5a-2839-4720-82ee-e06722ae1d3e) by prod-mta-13.swg-srv.net (ZoneMTA - prod-mta-13) with ESMTPSA id 19e68cae1c4000d780.003 for (version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384); Wed, 27 May 2026 09:36:27 +0000 Received: from [192.168.1.61] (155.223.66.37.rev.sfr.net [37.66.223.155]) (Authenticated sender: ngoc-tu.dinh@vates.tech) by mail2.vates.fr (Postfix) with ESMTPSA id 6889B868E8; Wed, 27 May 2026 11:36:26 +0200 (CEST) X-BeenThere: win-pv-devel@lists.xenproject.org List-Id: Developer list for the Windows PV Drivers subproject List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: win-pv-devel-bounces@lists.xenproject.org Precedence: list Sender: "win-pv-devel" Authentication-Results: eu.smtp.expurgate.cloud; dkim=pass header.s=selector1 header.d=vates.tech header.i="@vates.tech" header.h="From:Subject:Date:Message-ID:To:MIME-Version:Content-Type:In-Reply-To:References:Feedback-ID" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=vates.tech; q=dns/txt; s=selector1; bh=KlZvzu85t1RR8T0pPFpLTwK2ym8yxGHiKlAOTpKz1Gc=; h=from:subject:date:message-id:to:mime-version:content-type:in-reply-to:references:feedback-id; b=fVkLIpY6QSCpBS+rlzsgfTwT8NM1esnyYHAS/kz/N0iq6UH9uOsWafmlYUj3UwcYTTFowwZei k54MtTW3nHl/SjZ/a1saq6m9LBzU8EdpyhOK6KQi25lqP+8724u7t4RhjJf8mbLTp4VaGKrTQiw T34DZBiuuYpOzA8INDX9oP2BvWrQagVsystGY/DBI/do1SibSEK/xYKwM+hdMoiWR0ceCHVPjSo bmweQPjuKe/Iefpvy5+MYh4o69jieJ8o8ejoo0gB6f0W7lc4emKV0pZCPkzIwBt7JSsVRHcSVCY Kojd5Q0GkefC43tHw/MHgWoDq5n7yJm1cDRYVRRVdNyw== X-Zone-Loop: 7531eaf0c78731f107d42c68512014ad94d939a80bc2 x-campaign-type: default x-transaction-id: e04e9ce8-d1c5-4595-b479-03f37254c254 x-swg-uid: 01-cf1e97b7-5feb-404c-9682-6f11b5c16b02 X-Mailer: Sweego Message-ID: <1779874587.8631fc262581453bbf619ec5b2062170.19e68cae1c4000d780@vates.tech> x-swg-bid: 1779874587.8631fc262581453bbf619ec5b2062170.19e68cae1c4000d780 Feedback-ID: default:8631fc262581453bbf619ec5b2062170:Sweego x-campaign-id: default x-client-id: 8631fc262581453bbf619ec5b2062170 X-Originating-IP: [37.26.189.201] Date: Wed, 27 May 2026 11:36:26 +0200 MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [PATCH 1/2] Fix use-after-free in evtchn DPC To: Owen Smith , =?UTF-8?B?UmFmYcWCIFdvamR5xYJh?= , "win-pv-devel@lists.xenproject.org" References: <20260526162934.217954-1-omeg@invisiblethingslab.com> <20260526162934.217954-2-omeg@invisiblethingslab.com> <1779846097.8631fc262581453bbf619ec5b2062170.19e67182a7c000d780@vates.tech> <118fec27-e371-408a-a245-84aea0cef989@invisiblethingslab.com> <1779872530.8631fc262581453bbf619ec5b2062170.19e68ab8189000d780@vates.tech> Content-Language: en-US From: Tu Dinh In-Reply-To: X-BM-Disclaimer: Yes Content-Type: multipart/alternative; boundary="-=Part.14c0.60cc70ab30e15689.19e68cadf86.7e91451258eb4903=-" X-Bm-Milter-Handled: 4ffbd6c1-ee69-4e1b-aabd-f977039bd3e2 X-Bm-Transport-Timestamp: 1779874586503 X-purgate-ID: tlsNG-bad1c0/1779874592-89D85A53-7988A7FD/0/0 X-purgate-type: clean X-purgate-size: 4155 ---=Part.14c0.60cc70ab30e15689.19e68cadf86.7e91451258eb4903=- Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable On 27/05/2026 11:30, Owen Smith wrote: > It does introduce a very small potential race on Open >=20 > EvtchnInterruptHandler and therefore EvtchnNotificationDpc can be execut= ed immediately after > the call to XENBUS_EVTCHN(Open=2E=2E=2E), but as Context->Ready could no= t be set at this point, then > the event channel wont get unmasked in the DPC=2E >=20 > Owen >=20 >=20 It sounds like Context->Channel is the real target of the DPC readiness=20 and should be managed via an interlocked pointer in that case=2E ________________________________________ > From: win-pv-devel on be= half of Tu Dinh > Sent: 27 May 2026 10:02 AM > To: Rafa=C5=82 Wojdy=C5=82a; win-pv-devel@lists=2Exenproject=2Eorg > Subject: Re: [PATCH 1/2] Fix use-after-free in evtchn DPC >=20 > On 27/05/2026 10:59, Rafa=C5=82 Wojdy=C5=82a wrote: >> >> >> W dniu 27=2E05=2E2026 o 03:41, Tu Dinh pisze: >>> On 26/05/2026 18:30, Rafa=C5=82 Wojdy=C5=82a wrote: >>>> EvtchnFree() calls XENBUS_EVTCHN(Close) and then KeFlushQueuedDpcs() >>>> to drain any pending DPCs=2E A DPC queued just before Close returns c= an >>>> run in the window between Close completing and the flush draining it, >>>> at which point it dereferences Context->Channel inside >>>> XENBUS_EVTCHN(Unmask)=2E >>>> >>>> Also move Context->Fdo initialization to before opening the channel >>>> so Context is fully populated by the time the channel can fire its fi= rst >>>> interrupt=2E >>>> >>>> Signed-off-by: Rafa=C5=82 Wojdy=C5=82a >>>> --- >>>> src/xeniface/ioctl_evtchn=2Ec | 21 ++++++++++++++------- >>>> src/xeniface/ioctls=2Eh |=C2=A0 1 + >>>> 2 files changed, 15 insertions(+), 7 deletions(-) >>>> >>>> diff --git a/src/xeniface/ioctl_evtchn=2Ec b/src/xeniface/ioctl_evtch= n=2Ec >>>> index 6d63996=2E=2Ee38e25f 100644 >>>> --- a/src/xeniface/ioctl_evtchn=2Ec >>>> +++ b/src/xeniface/ioctl_evtchn=2Ec >>>> @@ -58,11 +58,14 @@ EvtchnNotificationDpc( >>>> KeSetEvent(Context->Event, 0, FALSE); >>>> - (VOID) XENBUS_EVTCHN(Unmask, >>>> - &Context->Fdo->EvtchnInterface, >>>> - Context->Channel, >>>> - FALSE, >>>> - TRUE); >>>> + if (InterlockedCompareExchange(&Context->Ready, 1, 1) =3D=3D 1) = { >>>> + (VOID) XENBUS_EVTCHN(Unmask, >>>> + &Context->Fdo->EvtchnInterface, >>>> + Context->Channel, >>>> + FALSE, >>>> + TRUE); >>>> + >>>> + } >>>> } >>>> _Function_class_(KSERVICE_ROUTINE) >>>> @@ -103,6 +106,8 @@ EvtchnFree( >>>> Trace("Context %p, LocalPort %d, FO %p\n", >>>> Context, Context->LocalPort, Context- >>>>> FileObject); >>>> + (VOID) InterlockedExchange(&Context->Ready, 0); >>>> + >>> >>> Shouldn't KeFlushQueuedDpcs() be called before closing the channel? >>> Otherwise there could still be a DPC which has captured Context->Ready= =3D1 >>> before InterlockedExchange is called, and then still running >>> concurrently with the XENBUS_EVTCHN(Close)=2E >> From my understanding KeFlushQueuedDpcs() flushes what's *currently* >> queued, so there would still be a window after it completes and before >> Close() finishes when new events could arrive=2E >=20 > Yes, but that's enough for protecting Context->Channel, as future queued > DPCs will read Context->Ready=3D0 and won't try to use the channel=2E >=20 >=20 > -- > Ngoc Tu Dinh | Vates XCP-ng Developer >=20 > XCP-ng & Xen Orchestra - Vates solutions >=20 > web: https://vates=2Etech >=20 -- Ngoc Tu Dinh | Vates XCP-ng Developer XCP-ng & Xen Orchestra - Vates = solutions web: https://vates=2Etech ---=Part.14c0.60cc70ab30e15689.19e68cadf86.7e91451258eb4903=--- From win-pv-devel-bounces@lists.xenproject.org Wed May 27 11:32:16 2026 Return-path: Envelope-to: archives@lists.xenproject.org Delivery-date: Wed, 27 May 2026 11:32:16 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1320431.1587731 (Exim 4.92) (envelope-from ) id 1wSCUg-0003fx-Ff; Wed, 27 May 2026 11:32:14 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1320431.1587731; Wed, 27 May 2026 11:32:14 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wSCUg-0003fq-CM; Wed, 27 May 2026 11:32:14 +0000 Received: by outflank-mailman (input) for mailman id 1320431; Wed, 27 May 2026 11:32:13 +0000 Received: from mx.expurgate.net ([194.145.224.20]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wSCUf-0003fk-PZ for win-pv-devel@lists.xenproject.org; Wed, 27 May 2026 11:32:13 +0000 Received: from mx.expurgate.net (helo=localhost) by mx.expurgate.net with esmtp id 1wSCUf-004mbH-45 for win-pv-devel@lists.xenproject.org; Wed, 27 May 2026 13:32:13 +0200 Received: from [10.42.69.8] (helo=localhost) by localhost with ESMTP (eXpurgate MTA 0.9.1) (envelope-from ) id 6a16d63b-2eae-0a2a0a5409dd-0a2a4508a4d8-8 for ; Wed, 27 May 2026 13:32:13 +0200 Received: from [202.12.124.153] (helo=fhigh-b2-smtp.messagingengine.com) by tlsNG-c1860d.mxtls.expurgate.net with ESMTPS (eXpurgate 4.56.1) (envelope-from ) id 6a16d63b-63b5-0a2a45080019-ca0c7c99c1c1-3 for ; Wed, 27 May 2026 13:32:12 +0200 Received: from phl-compute-01.internal (phl-compute-01.internal [10.202.2.41]) by mailfhigh.stl.internal (Postfix) with ESMTP id 3BFA77A005B; Wed, 27 May 2026 07:32:11 -0400 (EDT) Received: from phl-frontend-04 ([10.202.2.163]) by phl-compute-01.internal (MEProxy); Wed, 27 May 2026 07:32:11 -0400 Received: by mail.messagingengine.com (Postfix) with ESMTPA; Wed, 27 May 2026 07:32:10 -0400 (EDT) X-BeenThere: win-pv-devel@lists.xenproject.org List-Id: Developer list for the Windows PV Drivers subproject List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: win-pv-devel-bounces@lists.xenproject.org Precedence: list Sender: "win-pv-devel" Authentication-Results: eu.smtp.expurgate.cloud; dkim=pass header.s=fm3 header.d=invisiblethingslab.com header.i="@invisiblethingslab.com" header.h="Cc:Content-Transfer-Encoding:Content-Type:Date:From:Message-ID:MIME-Version:Subject:To"; dkim=pass header.s=fm3 header.d=messagingengine.com header.i="@messagingengine.com" header.h="Cc:Content-Transfer-Encoding:Content-Type:Date:Feedback-ID:From:Message-ID:MIME-Version:Subject:To:X-ME-Proxy:X-ME-Sender" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= invisiblethingslab.com; h=cc:cc:content-transfer-encoding :content-type:content-type:date:date:from:from:in-reply-to :message-id:mime-version:reply-to:subject:subject:to:to; s=fm3; t=1779881530; x=1779967930; bh=+4geRS88Ohw0aDQXVTcdTzFkqQhguOoE pN/RWGSnqfY=; b=UG1ZQEZUTaI96tPfXGy50YQEwlUJSjW4dIjADGQDSAws7A37 9SyJg1kA++xXmsuBtdIrFAz5iNQUIccI4z/3M8lPgHQNtJ89YIhSDczLGl+ICgHo gBlS6MKC7iXH7JjwC1MkdOg/+Fp+hclnkCRRtEec1XvY7alDSatrPdTuegVyALfv shiJB92zP/TuvzXEe2u5kWHNp+sVKmT//zzBLCzGZ4BeNZM21HC4kD4BciJvJR2a K+Ykw5i+lKSEfMnChsUowCrTRTEVLu90rbCaDuns+wxwCneBJ93w/CGjptfAOs/q ztT2feMmYpkFieTR2IQ58nW1zcEvfiGh8orwWA== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=cc:cc:content-transfer-encoding :content-type:content-type:date:date:feedback-id:feedback-id :from:from:in-reply-to:message-id:mime-version:reply-to:subject :subject:to:to:x-me-proxy:x-me-sender:x-me-sender:x-sasl-enc; s= fm3; t=1779881530; x=1779967930; bh=+4geRS88Ohw0aDQXVTcdTzFkqQhg uOoEpN/RWGSnqfY=; b=FTX1rL7ORGyv3i/VREpXirPavS+KepI5u2moeLQbosoI 5M8Y+Qf8ynBTEye+MHLEKGJlCKuhCLtd8bvnBU0JUb0GxX53sFJ5ar0OgDYI/uIC srFW+zEEYupWpoe6829FRsfgjMBUETcv3jvElj49bGfYGJBKnKriQnes+RdOiO5B qrmP/AYMErrMjzMnJdKFTcCWsbEB8X+D9hpHJUI5cPTrjEM4m+QZSGTTK7J0DHaM 9KN8SkhlZWs0U81jkbNvOiKmV6DsI3h05OpWja6qoWgVxoRlX9xuwwZe/sybEzbn +UhyCnu7yMk7w71M32q2ZYO/JU/ftDuPvD5qh3jqYQ== X-ME-Sender: X-ME-Received: X-ME-Proxy-Cause: dmFkZTGazyn4nzGtm5+JNn0JmK54EgZsSHqzmXSnWj47ky0/p4xRcwdnw0hA+puBmn8b7d q53yUMTNI/cmI63s+hCrSOorHRf8OCWzUbR4v80dPtvh4rbB8hpvk+VeKX06/sweOp8WuE HC7/et0aBFDasf9q9MgKMlGncCc6UZs1uZvVgFBhH6ZzF6HJNEBq4YiJEZcjASGzt4yXB7 GBVwm5UKs4qP7Ewp8+6haTbKwKA/tYqApuJwqWOmLR6OaiIy3SHiAGBznVyZRlpaE6L++B x7rZCx2yBDWCyuCfmzym4zUpoznqdr8dIxjbPNezBvjLqKVVYyOVzdxugYIqFlOicnVTWt 7USVXHF4H9cMFtSO4JgZpWqNSRnjCazeqsfaEGLVz7dQ7N1Q7VeG6kMspB1QNHEpp4l5Dp S+988M5hJJaLh/IyRCDQEOn5rDyn9fZjGjIMKdEKKPZTizYYRGMWw4txQQi9XQir5iYEuW 6ov9JklZU2IFTGTUHmyLaHMtWtiXfeqzh/ckkbtM5zwVcf8O1ThaomO9am2vwaoENIgC8k Wca4CBd4kTHwVsgQ5nQAQMBLvOKPoODjkg1r7RiQafMmypbggvIuQhMlU4xaomx5y6x8hX leN7xomWMKfeakyC3QO79cMJDJJ4/4ny/HSRygfdr7rioAP758l5GwrfAFzw X-ME-Proxy: Feedback-ID: i409c4082:Fastmail From: =?UTF-8?q?Rafa=C5=82=20Wojdy=C5=82a?= To: win-pv-devel@lists.xenproject.org Cc: =?UTF-8?q?Rafa=C5=82=20Wojdy=C5=82a?= Subject: [PATCH v2 0/2] xeniface race fixes Date: Wed, 27 May 2026 13:31:50 +0200 Message-ID: <20260527113152.1135945-1-omeg@invisiblethingslab.com> X-Mailer: git-send-email 2.54.0 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-purgate-ID: tlsNG-c1860d/1779881533-BD76EDB1-79F99A6A/0/0 X-purgate-type: clean X-purgate-size: 315 Rafał Wojdyła (2): Fix use-after-free in evtchn DPC Send gnttab unmap notify event after the grant is fully released src/xeniface/ioctl_evtchn.c | 64 ++++++++++++++++++++++--------------- src/xeniface/ioctl_gnttab.c | 16 ++++++---- 2 files changed, 48 insertions(+), 32 deletions(-) -- 2.54.0 From win-pv-devel-bounces@lists.xenproject.org Wed May 27 11:32:19 2026 Return-path: Envelope-to: archives@lists.xenproject.org Delivery-date: Wed, 27 May 2026 11:32:19 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1320432.1587734 (Exim 4.92) (envelope-from ) id 1wSCUl-0003hb-GP; Wed, 27 May 2026 11:32:19 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1320432.1587734; Wed, 27 May 2026 11:32:19 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wSCUl-0003hU-Ds; Wed, 27 May 2026 11:32:19 +0000 Received: by outflank-mailman (input) for mailman id 1320432; Wed, 27 May 2026 11:32:18 +0000 Received: from mx.expurgate.net ([195.190.135.10]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wSCUk-0003hH-Lh for win-pv-devel@lists.xenproject.org; Wed, 27 May 2026 11:32:18 +0000 Received: from mx.expurgate.net (helo=localhost) by mx.expurgate.net with esmtp id 1wSCUk-0029H4-1d for win-pv-devel@lists.xenproject.org; Wed, 27 May 2026 13:32:18 +0200 Received: from [10.42.69.2] (helo=localhost) by localhost with ESMTP (eXpurgate MTA 0.9.1) (envelope-from ) id 6a16d635-2eae-0a2a0a5409dd-0a2a4502cab4-36 for ; Wed, 27 May 2026 13:32:17 +0200 Received: from [202.12.124.145] (helo=fout-c2-smtp.messagingengine.com) by tlsNG-720697.mxtls.expurgate.net with ESMTPS (eXpurgate 4.56.1) (envelope-from ) id 6a16d640-af86-0a2a45020019-ca0c7c91824d-3 for ; Wed, 27 May 2026 13:32:17 +0200 Received: from phl-compute-06.internal (phl-compute-06.internal [10.202.2.46]) by mailfout.stl.internal (Postfix) with ESMTP id 7AF811D00119; Wed, 27 May 2026 07:32:16 -0400 (EDT) Received: from phl-frontend-04 ([10.202.2.163]) by phl-compute-06.internal (MEProxy); Wed, 27 May 2026 07:32:16 -0400 Received: by mail.messagingengine.com (Postfix) with ESMTPA; Wed, 27 May 2026 07:32:15 -0400 (EDT) X-BeenThere: win-pv-devel@lists.xenproject.org List-Id: Developer list for the Windows PV Drivers subproject List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: win-pv-devel-bounces@lists.xenproject.org Precedence: list Sender: "win-pv-devel" Authentication-Results: eu.smtp.expurgate.cloud; dkim=pass header.s=fm3 header.d=invisiblethingslab.com header.i="@invisiblethingslab.com" header.h="Cc:Content-Transfer-Encoding:Content-Type:Date:From:In-Reply-To:Message-ID:MIME-Version:References:Subject:To"; dkim=pass header.s=fm3 header.d=messagingengine.com header.i="@messagingengine.com" header.h="Cc:Content-Transfer-Encoding:Content-Type:Date:Feedback-ID:From:In-Reply-To:Message-ID:MIME-Version:References:Subject:To:X-ME-Proxy:X-ME-Sender" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= invisiblethingslab.com; h=cc:cc:content-transfer-encoding :content-type:content-type:date:date:from:from:in-reply-to :in-reply-to:message-id:mime-version:references:reply-to:subject :subject:to:to; s=fm3; t=1779881536; x=1779967936; bh=hdYO3DFwgt pqFlhqz9txv3LbRyoyK36nnutLim0nRWk=; b=gs8vAK9o72yiQxza1Pm5Ke6W5b 6ByCkhsoYTmk2i5gwg4Rqbr67Lsk77/x1iDr9ryxNwNcXYZh56jNinez5XJiJ771 GyhHbCGi0n/vyWx5igyGBMjoogi5o/ipBqzNyjoYAMMVWcJ5m2nLUe5C+TiVg18y 2zIP2nePW8MJL/iFyATWw67ZJBdvSKobWC0iCzCPbQVriOulnKu7+nB0mi4ea4bG fd3SSw0wmwIxyLJHGyjwKfx/nNdLdJwjckffA9mhWtc2K+11YblgpdwtvZdL4jGZ d5rH97Fn8E/CxKtbE0WYyBeJibt0dalzsYJZJC14Nj282ZGr9zmr5HC3shHQ== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=cc:cc:content-transfer-encoding :content-type:content-type:date:date:feedback-id:feedback-id :from:from:in-reply-to:in-reply-to:message-id:mime-version :references:reply-to:subject:subject:to:to:x-me-proxy :x-me-sender:x-me-sender:x-sasl-enc; s=fm3; t=1779881536; x= 1779967936; bh=hdYO3DFwgtpqFlhqz9txv3LbRyoyK36nnutLim0nRWk=; b=J ux0EfuGPkkmZhffUGQvxCzqbj+i4Yxej5ns8bxEwqnnpEPYAcCbI2O2RI2slcdNS 3x2zKtpKCcN/zzHTIFn+U8ul+j3c1HJBLyvyWtx4srhZNBlUY/4FXz0UzFSudbVy dbYibJPLqtgGR1dEkfXOBvXXhApas6rrgbAq54zMvPvKijf/626CSf4AKU/GIXJ+ pToojS8tGIMT8uNBKfYc2JcxL4Uhfm7u5iHY13Raq3Fz5+DxNl9XWfFqCRiT6w5x eVOK8UHL2gKGpsw/Du/dRnjZuvekFlwuY8zl9WT9OMjiDPnkAPKZ0EbYWF2HLv3F E4shDu538/S27YFhHVE4A== X-ME-Sender: X-ME-Received: X-ME-Proxy-Cause: dmFkZTEfGZNIXSBkk1AJA7zmH9i5XpYo+TSZAAhariWFJOo9rdnyAcYFo5VIZBA3CQBtKe wOeFGKyqBnUX6dh/A2RcpASeeU/R77Ujr2FyjwT7S3rcAbLEYU10aqiY9W8jXvu/fhQsHy 6+3dtb20bJp0IHyyjB0q9Dd22JTsilzovPVsSR749xBQ2QABez5eIiS9to7ib25GjC3fyL /8ntrQC/rqQbQaeP9pckx5r3L1BrVcld8zOBuoqZfiqJfOjHe8KbTf1O2kwfXKVx35wGwI HCrYpmXvmXTRGAIZpmWY4LeZWlwyAtFGnMPPJ/WxsRBPjOQTlkdLkxIfhWyTIY7gRPRted gGomvBGN78Fx38FxnycgkVHzIwbflNvnpZlwFUqiseG/Hv7tMrwqNJPwyGJWM+T/dVC4Y2 bkXuOtOtjwvH3OqF432vxhm1ttw4BVaqlh8M1xzCtKoEsIPc7G1cen/CUbvq3hS0YB0dyj h2hImmzgD6v4fpgSo07P2uyn4bHFaqZ/u/+mWwCyXoWS+bd6HoOuF+p7QDrN8ysJbpPRy+ rQuGeq0knN2Q86d2tm9gyxcMyssaEl5lqV9zfKDGZ6lllThgm5G28Hjn3U0ABrWLwI+wF1 DJ33AV3ergi7aFoeYdEwrt2zbRaLiEpYCiG4Dc3vMkQbc2szpUgxukWxbPfA X-ME-Proxy: Feedback-ID: i409c4082:Fastmail From: =?UTF-8?q?Rafa=C5=82=20Wojdy=C5=82a?= To: win-pv-devel@lists.xenproject.org Cc: =?UTF-8?q?Rafa=C5=82=20Wojdy=C5=82a?= Subject: [PATCH v2 1/2] Fix use-after-free in evtchn DPC Date: Wed, 27 May 2026 13:31:51 +0200 Message-ID: <20260527113152.1135945-2-omeg@invisiblethingslab.com> X-Mailer: git-send-email 2.54.0 In-Reply-To: <20260527113152.1135945-1-omeg@invisiblethingslab.com> References: <20260527113152.1135945-1-omeg@invisiblethingslab.com> MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-purgate-ID: tlsNG-720697/1779881537-83B60161-25039590/0/0 X-purgate-type: clean X-purgate-size: 7151 EvtchnFree() calls XENBUS_EVTCHN(Close) and then KeFlushQueuedDpcs() to drain any pending DPCs. A DPC queued just before Close returns can run in the window between Close completing and the flush draining it, at which point it dereferences Context->Channel inside XENBUS_EVTCHN(Unmask). Use Context->Channel itself as the DPC readiness marker: - EvtchnFree() atomically swaps it to NULL as the first teardown step. - The DPC atomically reads it and exits without touching the channel or signalling Context->Event if NULL. Both bind paths publish the channel into Context->Channel atomically after acquiring a port from xenbus. Signed-off-by: Rafał Wojdyła --- src/xeniface/ioctl_evtchn.c | 64 ++++++++++++++++++++++--------------- 1 file changed, 39 insertions(+), 25 deletions(-) diff --git a/src/xeniface/ioctl_evtchn.c b/src/xeniface/ioctl_evtchn.c index 6d63996..4681a86 100644 --- a/src/xeniface/ioctl_evtchn.c +++ b/src/xeniface/ioctl_evtchn.c @@ -49,6 +49,7 @@ EvtchnNotificationDpc( ) { PXENIFACE_EVTCHN_CONTEXT Context = _Context; + PXENBUS_EVTCHN_CHANNEL Channel; UNREFERENCED_PARAMETER(Dpc); UNREFERENCED_PARAMETER(Argument1); @@ -56,11 +57,16 @@ EvtchnNotificationDpc( ASSERT(Context != NULL); + Channel = InterlockedCompareExchangePointer((PVOID *)&Context->Channel, + NULL, NULL); + if (Channel == NULL) + return; + KeSetEvent(Context->Event, 0, FALSE); (VOID) XENBUS_EVTCHN(Unmask, &Context->Fdo->EvtchnInterface, - Context->Channel, + Channel, FALSE, TRUE); } @@ -98,14 +104,18 @@ EvtchnFree( __inout PXENIFACE_EVTCHN_CONTEXT Context ) { + PXENBUS_EVTCHN_CHANNEL Channel; + ASSERT(KeGetCurrentIrql() == PASSIVE_LEVEL); Trace("Context %p, LocalPort %d, FO %p\n", Context, Context->LocalPort, Context->FileObject); + Channel = InterlockedExchangePointer((PVOID *)&Context->Channel, NULL); + XENBUS_EVTCHN(Close, &Fdo->EvtchnInterface, - Context->Channel); + Channel); // There may still be a pending event at this time. // Wait for our DPCs to complete. @@ -163,6 +173,7 @@ IoctlEvtchnBindUnbound( PXENIFACE_EVTCHN_BIND_UNBOUND_IN In = Buffer; PXENIFACE_EVTCHN_BIND_UNBOUND_OUT Out = Buffer; PXENIFACE_EVTCHN_CONTEXT Context; + PXENBUS_EVTCHN_CHANNEL Channel; status = STATUS_INVALID_BUFFER_SIZE; if (InLen != sizeof(XENIFACE_EVTCHN_BIND_UNBOUND_IN) || @@ -176,6 +187,7 @@ IoctlEvtchnBindUnbound( goto fail2; Context->FileObject = FileObject; + Context->Fdo = Fdo; Trace("> RemoteDomain %d, Mask %d, FO %p\n", In->RemoteDomain, In->Mask, FileObject); @@ -192,28 +204,28 @@ IoctlEvtchnBindUnbound( KeInitializeDpc(&Context->Dpc, EvtchnNotificationDpc, Context); status = STATUS_UNSUCCESSFUL; - Context->Channel = XENBUS_EVTCHN(Open, - &Fdo->EvtchnInterface, - XENBUS_EVTCHN_TYPE_UNBOUND, - EvtchnInterruptHandler, - Context, - In->RemoteDomain, - TRUE); - if (Context->Channel == NULL) + Channel = XENBUS_EVTCHN(Open, + &Fdo->EvtchnInterface, + XENBUS_EVTCHN_TYPE_UNBOUND, + EvtchnInterruptHandler, + Context, + In->RemoteDomain, + TRUE); + if (Channel == NULL) goto fail4; Context->LocalPort = XENBUS_EVTCHN(GetPort, &Fdo->EvtchnInterface, - Context->Channel); + Channel); - Context->Fdo = Fdo; + (VOID) InterlockedExchangePointer((PVOID *)&Context->Channel, Channel); ExInterlockedInsertTailList(&Fdo->EvtchnList, &Context->Entry, &Fdo->EvtchnLock); if (!In->Mask) { (VOID) XENBUS_EVTCHN(Unmask, &Fdo->EvtchnInterface, - Context->Channel, + Channel, FALSE, TRUE); } @@ -256,6 +268,7 @@ IoctlEvtchnBindInterdomain( PXENIFACE_EVTCHN_BIND_INTERDOMAIN_IN In = Buffer; PXENIFACE_EVTCHN_BIND_INTERDOMAIN_OUT Out = Buffer; PXENIFACE_EVTCHN_CONTEXT Context; + PXENBUS_EVTCHN_CHANNEL Channel; status = STATUS_INVALID_BUFFER_SIZE; if (InLen != sizeof(XENIFACE_EVTCHN_BIND_INTERDOMAIN_IN) || @@ -269,6 +282,7 @@ IoctlEvtchnBindInterdomain( goto fail2; Context->FileObject = FileObject; + Context->Fdo = Fdo; Trace("> RemoteDomain %d, RemotePort %lu, Mask %d, FO %p\n", In->RemoteDomain, In->RemotePort, In->Mask, FileObject); @@ -285,29 +299,29 @@ IoctlEvtchnBindInterdomain( KeInitializeDpc(&Context->Dpc, EvtchnNotificationDpc, Context); status = STATUS_UNSUCCESSFUL; - Context->Channel = XENBUS_EVTCHN(Open, - &Fdo->EvtchnInterface, - XENBUS_EVTCHN_TYPE_INTER_DOMAIN, - EvtchnInterruptHandler, - Context, - In->RemoteDomain, - In->RemotePort, - TRUE); - if (Context->Channel == NULL) + Channel = XENBUS_EVTCHN(Open, + &Fdo->EvtchnInterface, + XENBUS_EVTCHN_TYPE_INTER_DOMAIN, + EvtchnInterruptHandler, + Context, + In->RemoteDomain, + In->RemotePort, + TRUE); + if (Channel == NULL) goto fail4; Context->LocalPort = XENBUS_EVTCHN(GetPort, &Fdo->EvtchnInterface, - Context->Channel); + Channel); - Context->Fdo = Fdo; + (VOID) InterlockedExchangePointer((PVOID *)&Context->Channel, Channel); ExInterlockedInsertTailList(&Fdo->EvtchnList, &Context->Entry, &Fdo->EvtchnLock); if (!In->Mask) { (VOID) XENBUS_EVTCHN(Unmask, &Fdo->EvtchnInterface, - Context->Channel, + Channel, FALSE, TRUE); } -- 2.54.0 From win-pv-devel-bounces@lists.xenproject.org Wed May 27 11:32:22 2026 Return-path: Envelope-to: archives@lists.xenproject.org Delivery-date: Wed, 27 May 2026 11:32:22 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1320433.1587739 (Exim 4.92) (envelope-from ) id 1wSCUo-0003jb-I7; Wed, 27 May 2026 11:32:22 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1320433.1587739; Wed, 27 May 2026 11:32:22 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wSCUo-0003jU-FH; Wed, 27 May 2026 11:32:22 +0000 Received: by outflank-mailman (input) for mailman id 1320433; Wed, 27 May 2026 11:32:21 +0000 Received: from mx.expurgate.net ([195.190.135.10]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wSCUn-0003j5-8e for win-pv-devel@lists.xenproject.org; Wed, 27 May 2026 11:32:21 +0000 Received: from mx.expurgate.net (helo=localhost) by mx.expurgate.net with esmtp id 1wSCUm-0029H4-Kk for win-pv-devel@lists.xenproject.org; Wed, 27 May 2026 13:32:20 +0200 Received: from [10.42.69.9] (helo=localhost) by localhost with ESMTP (eXpurgate MTA 0.9.1) (envelope-from ) id 6a16d639-2eae-0a2a0a5409dd-0a2a4509a462-46 for ; Wed, 27 May 2026 13:32:20 +0200 Received: from [202.12.124.153] (helo=fhigh-b2-smtp.messagingengine.com) by tlsNG-bad1c0.mxtls.expurgate.net with ESMTPS (eXpurgate 4.56.1) (envelope-from ) id 6a16d643-2497-0a2a45090019-ca0c7c99e4f1-3 for ; Wed, 27 May 2026 13:32:20 +0200 Received: from phl-compute-04.internal (phl-compute-04.internal [10.202.2.44]) by mailfhigh.stl.internal (Postfix) with ESMTP id DC7347A0042; Wed, 27 May 2026 07:32:18 -0400 (EDT) Received: from phl-frontend-04 ([10.202.2.163]) by phl-compute-04.internal (MEProxy); Wed, 27 May 2026 07:32:18 -0400 Received: by mail.messagingengine.com (Postfix) with ESMTPA; Wed, 27 May 2026 07:32:17 -0400 (EDT) X-BeenThere: win-pv-devel@lists.xenproject.org List-Id: Developer list for the Windows PV Drivers subproject List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: win-pv-devel-bounces@lists.xenproject.org Precedence: list Sender: "win-pv-devel" Authentication-Results: eu.smtp.expurgate.cloud; dkim=pass header.s=fm3 header.d=invisiblethingslab.com header.i="@invisiblethingslab.com" header.h="Cc:Content-Transfer-Encoding:Content-Type:Date:From:In-Reply-To:Message-ID:MIME-Version:References:Subject:To"; dkim=pass header.s=fm3 header.d=messagingengine.com header.i="@messagingengine.com" header.h="Cc:Content-Transfer-Encoding:Content-Type:Date:Feedback-ID:From:In-Reply-To:Message-ID:MIME-Version:References:Subject:To:X-ME-Proxy:X-ME-Sender" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= invisiblethingslab.com; h=cc:cc:content-transfer-encoding :content-type:content-type:date:date:from:from:in-reply-to :in-reply-to:message-id:mime-version:references:reply-to:subject :subject:to:to; s=fm3; t=1779881538; x=1779967938; bh=eK/54nvPRS BQx4oZao9/VWKzbN5DDpRO78kBjTFrub8=; b=C1SNrMvHAZrdPt3iQN+XUeHNny yZ8edKDgnI/UOfsPtmtou1yFPrz/ElgIaOCDrbI5GOTxNVzQSLb8q/jKKZC8Tk8d BcNDM3T0pHCXmbWgVQ8KOXMknVQdHkMpxaaCQzOnCdiN8ENXl11dVdvEaiXsakRU dWDyLbp7KFEObty+h1/Iy2/VAKt0QZGUjqjmlob+YIhVPvp4bsOS4Z7EU1LMWrGj YcxmC/sW5yAqxJoGD3LidPfabGpsvL2RbYWRy1TqFry9krjyoe5HZ6Js+EGsNb5J 7g7N2vocL1uKfq4F5Ti/sJ0fTFNMik++kudQ3mf2eFQup6hjS7RIoC/aUH8A== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=cc:cc:content-transfer-encoding :content-type:content-type:date:date:feedback-id:feedback-id :from:from:in-reply-to:in-reply-to:message-id:mime-version :references:reply-to:subject:subject:to:to:x-me-proxy :x-me-sender:x-me-sender:x-sasl-enc; s=fm3; t=1779881538; x= 1779967938; bh=eK/54nvPRSBQx4oZao9/VWKzbN5DDpRO78kBjTFrub8=; b=h 79JydJtZBSpNyEYlCi1kQPIpVBQ57xUyxmcSfshMd1HPyCyY5tq8wwAk1HCVcGgt jY5sYt2guavNvtxBIE0Goo+FE7X4Y+eLcNhD1D3CZpATf0e0t6JrqJ9Wg16tq4PH m+TYhuOzFttdLdQTiQxZh/MEkbtmZ4cKVISkqGvaPPRKKCD4AaMD54At8ZXsnMhx rgvPvRyG7CkKnFZndU8WLeY5P0s328D+f94dlCihfwHn71lsuJJEKDHKkEFoD8Js JbaiGXYCZCBk+zWGc2sBj2CEBYdrFU5950dZeg7hJF8Goz5IwmG8BPJM1fmmqEyO CoKz1RCeMU5dI1f5dLvGg== X-ME-Sender: X-ME-Received: X-ME-Proxy-Cause: dmFkZTEfGZNIXSBkk1AJA7zmH9i5XpYo+TSZAAhariWFJOo9rdnyAcYFo5VIZBA3CQBtKe wOeFGKyqBnUX6dh/A2RcpASeeU/R77Ujr2FyjwT7S3rcAbLEYU10aqiY9W8jXvu/fhQsHy 6+3dtb20bJp0IHyyjB0q9Dd22JTsilzovPVsSR749xBQ2QABez5eIiS9to7ib25GjC3fyL /8ntrQC/rqQbQaeP9pckx5r3L1BrVcld8zOBuoqZfiqJfOjHe8KbTf1O2kwfXKVx35wGwI HCrYpmXvmXTRGAIZpmWY4LeZWlwyAtFGnMPPJ/WxsRBPjOQTlkdLkxIfhWyTIY7gRPRtAX zT6IfWX6yoznodVYMQdu20gtcNOHrcHr+AxToPJoPrUHO0cJD+QfgPZ3suwZkQsWxw9SPK JMzkTjabTONTl4X4Is9x0ZZOSM9j6v1yxYQv8EQGQrHKa4tyoNfJl2yP36GoXotOkmNfSg a8rPTdoCLgrROlS0wA0tH41CmK6qrSHrRP/qtkJiIq1sLkG4baTWsrdBj+l2KeIKb69XqI 2ezD8XAYTmSpSn9dkthBiB9Y9YDO0SyEx+eU+7CiR966122KpxNcpoi6LfvmI2ZwJ0XhNh HNkCCV7gSCpZmrBu/lW79vtS6QXYrui08Id0sSY2WE6hLqECWNSF+J9FYjWQ X-ME-Proxy: Feedback-ID: i409c4082:Fastmail From: =?UTF-8?q?Rafa=C5=82=20Wojdy=C5=82a?= To: win-pv-devel@lists.xenproject.org Cc: =?UTF-8?q?Rafa=C5=82=20Wojdy=C5=82a?= Subject: [PATCH v2 2/2] Send gnttab unmap notify event after the grant is fully released Date: Wed, 27 May 2026 13:31:52 +0200 Message-ID: <20260527113152.1135945-3-omeg@invisiblethingslab.com> X-Mailer: git-send-email 2.54.0 In-Reply-To: <20260527113152.1135945-1-omeg@invisiblethingslab.com> References: <20260527113152.1135945-1-omeg@invisiblethingslab.com> MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-purgate-ID: tlsNG-bad1c0/1779881540-37F7EA53-77153890/0/0 X-purgate-type: clean X-purgate-size: 1823 Move the notification event to after the unmap hypercall completes, so the peer only gets notified after the grant is completely released on our side. Closes possible race when the peer could be notified before the grant was fully torn down. Signed-off-by: Rafał Wojdyła --- src/xeniface/ioctl_gnttab.c | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-) diff --git a/src/xeniface/ioctl_gnttab.c b/src/xeniface/ioctl_gnttab.c index ef77295..ee319cb 100644 --- a/src/xeniface/ioctl_gnttab.c +++ b/src/xeniface/ioctl_gnttab.c @@ -802,17 +802,11 @@ GnttabFreeMap( Trace("Context %p\n", Context); + // Write the notify value while the grant is still mapped. if (Context->Flags & XENIFACE_GNTTAB_USE_NOTIFY_OFFSET) { ((PCHAR)Context->KernelVa)[Context->NotifyOffset] = 0; } - if (Context->Flags & XENIFACE_GNTTAB_USE_NOTIFY_PORT) { - status = EvtchnNotify(Fdo, Context->NotifyPort, NULL); - - if (!NT_SUCCESS(status)) // non-fatal, we must free memory - Error("failed to notify port %lu: 0x%x\n", Context->NotifyPort, status); - } - // unmap from user address space MmUnmapLockedPages(Context->UserVa, Context->Mdl); @@ -828,6 +822,14 @@ GnttabFreeMap( ASSERT(NT_SUCCESS(status)); + // Notify the peer after the map is fully gone. + if (Context->Flags & XENIFACE_GNTTAB_USE_NOTIFY_PORT) { + status = EvtchnNotify(Fdo, Context->NotifyPort, NULL); + + if (!NT_SUCCESS(status)) // non-fatal, we must free memory + Error("failed to notify port %lu: 0x%x\n", Context->NotifyPort, status); + } + RtlZeroMemory(Context, sizeof(*Context)); __FreePoolWithTag(Context, XENIFACE_POOL_TAG); } -- 2.54.0 From win-pv-devel-bounces@lists.xenproject.org Thu May 28 09:29:47 2026 Return-path: Envelope-to: archives@lists.xenproject.org Delivery-date: Thu, 28 May 2026 09:29:47 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1321033.1588057 (Exim 4.92) (envelope-from ) id 1wSX3h-0005Cf-J3; Thu, 28 May 2026 09:29:45 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1321033.1588057; Thu, 28 May 2026 09:29:45 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wSX3h-0005CX-GD; Thu, 28 May 2026 09:29:45 +0000 Received: by outflank-mailman (input) for mailman id 1321033; Thu, 28 May 2026 09:29:43 +0000 Received: from mx.expurgate.net ([194.145.224.20]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wSX3f-0005CR-7Y for win-pv-devel@lists.xenproject.org; Thu, 28 May 2026 09:29:43 +0000 Received: from mx.expurgate.net (helo=localhost) by mx.expurgate.net with esmtp id 1wSX3e-007VkE-9p for win-pv-devel@lists.xenproject.org; Thu, 28 May 2026 11:29:42 +0200 Received: from [10.42.69.4] (helo=localhost) by localhost with ESMTP (eXpurgate MTA 0.9.1) (envelope-from ) id 6a180b06-bab6-0a2a0a5309dd-0a2a45048e6a-0 for ; Thu, 28 May 2026 11:29:42 +0200 Received: from [185.255.28.34] (helo=prod-mta-13.swg-srv.net) by tlsNG-ebf023.mxtls.expurgate.net with ESMTPS (eXpurgate 4.56.1) (envelope-from ) id 6a180b05-1dec-0a2a45040019-b9ff1c229b73-3 for ; Thu, 28 May 2026 11:29:42 +0200 Received: from mail2.vates.fr ([37.26.189.201] mail2.vates.fr) (Authenticated sender: 8631fc262581453bbf619ec5b2062170/smtp/7773de5a-2839-4720-82ee-e06722ae1d3e) by prod-mta-13.swg-srv.net (ZoneMTA - prod-mta-13) with ESMTPSA id 19e6deafabe000d780.002 for (version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384); Thu, 28 May 2026 09:29:36 +0000 Received: from [192.168.1.61] (155.223.66.37.rev.sfr.net [37.66.223.155]) (Authenticated sender: ngoc-tu.dinh@vates.tech) by mail2.vates.fr (Postfix) with ESMTPSA id 06BC086B7F; Thu, 28 May 2026 11:29:36 +0200 (CEST) X-BeenThere: win-pv-devel@lists.xenproject.org List-Id: Developer list for the Windows PV Drivers subproject List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: win-pv-devel-bounces@lists.xenproject.org Precedence: list Sender: "win-pv-devel" Authentication-Results: eu.smtp.expurgate.cloud; dkim=pass header.s=selector1 header.d=vates.tech header.i="@vates.tech" header.h="From:Subject:Date:Message-ID:To:MIME-Version:Content-Type:In-Reply-To:References:Feedback-ID" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=vates.tech; q=dns/txt; s=selector1; bh=nKzIOySa08f2dADtyVQhLqnI6JRbW09XvuFQf9zNMWA=; h=from:subject:date:message-id:to:mime-version:content-type:in-reply-to:references:feedback-id; b=VsfSuryNR1Bz+KTk6Qc0i5jXduPjlqQf1inhDIL/tktYYU27kG2e3oIeNIC0KJz9CFTm0gAJS hCKx+xuyT9F/8iB9dW9oMZ7Xr0KlkIU2QXv92+fUxfO/kJi7qxPHt0WqmmyJiYdPanITJgkTz0x b17rOi+1jhQRDSQTVG7DFSBsyRtCok03BOyRsBPMSW5p06auVqeFVnVbSiK5CVzwBXzILIYRv+f /JRtWjsyOHKxhOHleDGkjEVL0/sYr77pMKPf86f8hGNvR8uUGa3m30IfP15AMXKhTGkwfuhKty1 /AAZCoS2uELKQ0eXUOLY3nQVb0cc0PN0CYUeazUVoC3A== X-Zone-Loop: 99797db2ba1318af63e06c542d76f18d7da699cea3e3 x-campaign-type: default x-transaction-id: df433e89-5ebf-4a59-8e1f-01a4d648736f x-swg-uid: 01-d92d7a9e-8bb4-4589-a07c-ad653a910563 X-Mailer: Sweego Message-ID: <1779960576.8631fc262581453bbf619ec5b2062170.19e6deafabe000d780@vates.tech> x-swg-bid: 1779960576.8631fc262581453bbf619ec5b2062170.19e6deafabe000d780 Feedback-ID: default:8631fc262581453bbf619ec5b2062170:Sweego x-campaign-id: default x-client-id: 8631fc262581453bbf619ec5b2062170 X-Originating-IP: [37.26.189.201] Date: Thu, 28 May 2026 11:29:35 +0200 MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [PATCH v2 2/2] Send gnttab unmap notify event after the grant is fully released To: =?UTF-8?B?UmFmYcWCIFdvamR5xYJh?= , win-pv-devel@lists.xenproject.org References: <20260527113152.1135945-1-omeg@invisiblethingslab.com> <20260527113152.1135945-3-omeg@invisiblethingslab.com> Content-Language: en-US From: Tu Dinh In-Reply-To: <20260527113152.1135945-3-omeg@invisiblethingslab.com> X-BM-Disclaimer: Yes Content-Type: multipart/alternative; boundary="-=Part.162c.e39966f05c9bb840.19e6deaf856.64a77185443907d8=-" X-Bm-Milter-Handled: 4ffbd6c1-ee69-4e1b-aabd-f977039bd3e2 X-Bm-Transport-Timestamp: 1779960576087 X-purgate-ID: tlsNG-ebf023/1779960582-4396A3FF-99180D5B/0/0 X-purgate-type: clean X-purgate-size: 2528 ---=Part.162c.e39966f05c9bb840.19e6deaf856.64a77185443907d8=- Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable On 27/05/2026 13:32, Rafa=C5=82 Wojdy=C5=82a wrote: > Move the notification event to after the unmap hypercall completes, > so the peer only gets notified after the grant is completely released > on our side=2E Closes possible race when the peer could be notified > before the grant was fully torn down=2E >=20 > Signed-off-by: Rafa=C5=82 Wojdy=C5=82a I don't have a way to test this change specifically but it looks correct= =20 to me=2E Reviewed-by: Tu Dinh > --- > src/xeniface/ioctl_gnttab=2Ec | 16 +++++++++------- > 1 file changed, 9 insertions(+), 7 deletions(-) >=20 > diff --git a/src/xeniface/ioctl_gnttab=2Ec b/src/xeniface/ioctl_gnttab= =2Ec > index ef77295=2E=2Eee319cb 100644 > --- a/src/xeniface/ioctl_gnttab=2Ec > +++ b/src/xeniface/ioctl_gnttab=2Ec > @@ -802,17 +802,11 @@ GnttabFreeMap( > =20 > Trace("Context %p\n", Context); > =20 > + // Write the notify value while the grant is still mapped=2E > if (Context->Flags & XENIFACE_GNTTAB_USE_NOTIFY_OFFSET) { > ((PCHAR)Context->KernelVa)[Context->NotifyOffset] =3D 0; > } > =20 > - if (Context->Flags & XENIFACE_GNTTAB_USE_NOTIFY_PORT) { > - status =3D EvtchnNotify(Fdo, Context->NotifyPort, NULL); > - > - if (!NT_SUCCESS(status)) // non-fatal, we must free memory > - Error("failed to notify port %lu: 0x%x\n", Context->NotifyP= ort, status); > - } > - > // unmap from user address space > MmUnmapLockedPages(Context->UserVa, Context->Mdl); > =20 > @@ -828,6 +822,14 @@ GnttabFreeMap( > =20 > ASSERT(NT_SUCCESS(status)); > =20 > + // Notify the peer after the map is fully gone=2E > + if (Context->Flags & XENIFACE_GNTTAB_USE_NOTIFY_PORT) { > + status =3D EvtchnNotify(Fdo, Context->NotifyPort, NULL); > + > + if (!NT_SUCCESS(status)) // non-fatal, we must free memory > + Error("failed to notify port %lu: 0x%x\n", Context->NotifyP= ort, status); > + } > + > RtlZeroMemory(Context, sizeof(*Context)); > __FreePoolWithTag(Context, XENIFACE_POOL_TAG); > } -- Ngoc Tu Dinh | Vates XCP-ng Developer XCP-ng & Xen Orchestra - Vates = solutions web: https://vates=2Etech ---=Part.162c.e39966f05c9bb840.19e6deaf856.64a77185443907d8=--- From win-pv-devel-bounces@lists.xenproject.org Thu May 28 09:46:17 2026 Return-path: Envelope-to: archives@lists.xenproject.org Delivery-date: Thu, 28 May 2026 09:46:17 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1321044.1588069 (Exim 4.92) (envelope-from ) id 1wSXJf-00081y-UT; Thu, 28 May 2026 09:46:15 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1321044.1588069; Thu, 28 May 2026 09:46:15 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wSXJf-00081r-Ru; Thu, 28 May 2026 09:46:15 +0000 Received: by outflank-mailman (input) for mailman id 1321044; Thu, 28 May 2026 09:46:14 +0000 Received: from mx.expurgate.net ([194.145.224.20]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wSXJe-00081l-2q for win-pv-devel@lists.xenproject.org; Thu, 28 May 2026 09:46:14 +0000 Received: from mx.expurgate.net (helo=localhost) by mx.expurgate.net with esmtp id 1wSXJd-007ZVx-Fo for win-pv-devel@lists.xenproject.org; Thu, 28 May 2026 11:46:13 +0200 Received: from [10.42.69.10] (helo=localhost) by localhost with ESMTP (eXpurgate MTA 0.9.1) (envelope-from ) id 6a180ed8-5cb7-0a2a0a5109dd-0a2a450ac872-28 for ; Thu, 28 May 2026 11:46:13 +0200 Received: from [185.255.28.34] (helo=prod-mta-13.swg-srv.net) by tlsNG-4011c0.mxtls.expurgate.net with ESMTPS (eXpurgate 4.56.1) (envelope-from ) id 6a180ee5-56b3-0a2a450a0019-b9ff1c2285b3-3 for ; Thu, 28 May 2026 11:46:13 +0200 Received: from mail2.vates.fr ([37.26.189.201] mail2.vates.fr) (Authenticated sender: 8631fc262581453bbf619ec5b2062170/smtp/7773de5a-2839-4720-82ee-e06722ae1d3e) by prod-mta-13.swg-srv.net (ZoneMTA - prod-mta-13) with ESMTPSA id 19e6dfa2152000d780.002 for (version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384); Thu, 28 May 2026 09:46:09 +0000 Received: from [192.168.1.61] (155.223.66.37.rev.sfr.net [37.66.223.155]) (Authenticated sender: ngoc-tu.dinh@vates.tech) by mail2.vates.fr (Postfix) with ESMTPSA id 07E3A80FB9; Thu, 28 May 2026 11:46:09 +0200 (CEST) X-BeenThere: win-pv-devel@lists.xenproject.org List-Id: Developer list for the Windows PV Drivers subproject List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: win-pv-devel-bounces@lists.xenproject.org Precedence: list Sender: "win-pv-devel" Authentication-Results: eu.smtp.expurgate.cloud; dkim=pass header.s=selector1 header.d=vates.tech header.i="@vates.tech" header.h="From:Subject:Date:Message-ID:To:MIME-Version:Content-Type:In-Reply-To:References:Feedback-ID" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=vates.tech; q=dns/txt; s=selector1; bh=COv3bWvh12JI2tSfp5SbJRsXQfbBD4IZRDJArgKh5uk=; h=from:subject:date:message-id:to:mime-version:content-type:in-reply-to:references:feedback-id; b=FylDG7Zc8hft1c1Uulq7RoEpLp/DUcf/PZgtzO6cvY9BCjRYdcL+Fi3r891IG4ht2do+cixK2 DJNHzxKF5mhq+IqBLhCsVmAXDWqKG6YaJtygZtyHR+WyHZfMOKc0S3HyGUcZcSwHOkLngh01kMK NKDTQbRJUWk250Wj+l8LYQFqs45YUlPwD6pOR6qHGUEmu9BpV8KrTAMvrLm3FHJmbKVosJIEAMJ 37CkNwqpay/R1JtlUHcy0BYtedsMy2Nh3DSSvHVtEhyd2ediBGu+6wL5M6AaYG39dBeNvgRKRnu Q6NL29DKnS89tBGy66R67rFkyKm71zz2jBiC4ITV4mMA== X-Zone-Loop: 175830013205260545f48ac6f3656ad4f81c1adf4373 x-campaign-type: default x-transaction-id: a6a9652d-4ac0-4d1a-8169-8cb3d2c8b091 x-swg-uid: 01-3ffcc6fa-2514-471f-ad7f-d7dcd51f1fa8 X-Mailer: Sweego Message-ID: <1779961569.8631fc262581453bbf619ec5b2062170.19e6dfa2152000d780@vates.tech> x-swg-bid: 1779961569.8631fc262581453bbf619ec5b2062170.19e6dfa2152000d780 Feedback-ID: default:8631fc262581453bbf619ec5b2062170:Sweego x-campaign-id: default x-client-id: 8631fc262581453bbf619ec5b2062170 X-Originating-IP: [37.26.189.201] Date: Thu, 28 May 2026 11:46:08 +0200 MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [PATCH v2 1/2] Fix use-after-free in evtchn DPC To: =?UTF-8?B?UmFmYcWCIFdvamR5xYJh?= , win-pv-devel@lists.xenproject.org References: <20260527113152.1135945-1-omeg@invisiblethingslab.com> <20260527113152.1135945-2-omeg@invisiblethingslab.com> Content-Language: en-US From: Tu Dinh In-Reply-To: <20260527113152.1135945-2-omeg@invisiblethingslab.com> X-BM-Disclaimer: Yes Content-Type: multipart/alternative; boundary="-=Part.1630.dd232844951a0b6.19e6dfa1f42.d6f9ab808400beda=-" X-Bm-Milter-Handled: 4ffbd6c1-ee69-4e1b-aabd-f977039bd3e2 X-Bm-Transport-Timestamp: 1779961569090 X-purgate-ID: tlsNG-4011c0/1779961573-7F3958B7-956419B4/0/0 X-purgate-type: clean X-purgate-size: 8449 ---=Part.1630.dd232844951a0b6.19e6dfa1f42.d6f9ab808400beda=- Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable On 27/05/2026 13:32, Rafa=C5=82 Wojdy=C5=82a wrote: > EvtchnFree() calls XENBUS_EVTCHN(Close) and then KeFlushQueuedDpcs() > to drain any pending DPCs=2E A DPC queued just before Close returns can > run in the window between Close completing and the flush draining it, > at which point it dereferences Context->Channel inside > XENBUS_EVTCHN(Unmask)=2E >=20 > Use Context->Channel itself as the DPC readiness marker: > - EvtchnFree() atomically swaps it to NULL as the first teardown step=2E > - The DPC atomically reads it and exits without touching the channel > or signalling Context->Event if NULL=2E >=20 > Both bind paths publish the channel into Context->Channel atomically > after acquiring a port from xenbus=2E >=20 > Signed-off-by: Rafa=C5=82 Wojdy=C5=82a > --- > src/xeniface/ioctl_evtchn=2Ec | 64 ++++++++++++++++++++++-------------= -- > 1 file changed, 39 insertions(+), 25 deletions(-) >=20 > diff --git a/src/xeniface/ioctl_evtchn=2Ec b/src/xeniface/ioctl_evtchn= =2Ec > index 6d63996=2E=2E4681a86 100644 > --- a/src/xeniface/ioctl_evtchn=2Ec > +++ b/src/xeniface/ioctl_evtchn=2Ec > @@ -49,6 +49,7 @@ EvtchnNotificationDpc( > ) > { > PXENIFACE_EVTCHN_CONTEXT Context =3D _Context; > + PXENBUS_EVTCHN_CHANNEL Channel; > =20 > UNREFERENCED_PARAMETER(Dpc); > UNREFERENCED_PARAMETER(Argument1); > @@ -56,11 +57,16 @@ EvtchnNotificationDpc( > =20 > ASSERT(Context !=3D NULL); > =20 > + Channel =3D InterlockedCompareExchangePointer((PVOID *)&Context->Ch= annel, > + NULL, NULL); > + if (Channel =3D=3D NULL) > + return; > + > KeSetEvent(Context->Event, 0, FALSE); > =20 > (VOID) XENBUS_EVTCHN(Unmask, > &Context->Fdo->EvtchnInterface, > - Context->Channel, > + Channel, > FALSE, > TRUE); > } > @@ -98,14 +104,18 @@ EvtchnFree( > __inout PXENIFACE_EVTCHN_CONTEXT Context > ) > { > + PXENBUS_EVTCHN_CHANNEL Channel; > + > ASSERT(KeGetCurrentIrql() =3D=3D PASSIVE_LEVEL); > =20 > Trace("Context %p, LocalPort %d, FO %p\n", > Context, Context->LocalPort, Context->FileObjec= t); > =20 > + Channel =3D InterlockedExchangePointer((PVOID *)&Context->Channel, = NULL); > + > XENBUS_EVTCHN(Close, > &Fdo->EvtchnInterface, > - Context->Channel); > + Channel); > =20 > // There may still be a pending event at this time=2E > // Wait for our DPCs to complete=2E > @@ -163,6 +173,7 @@ IoctlEvtchnBindUnbound( > PXENIFACE_EVTCHN_BIND_UNBOUND_IN In =3D Buffer; > PXENIFACE_EVTCHN_BIND_UNBOUND_OUT Out =3D Buffer; > PXENIFACE_EVTCHN_CONTEXT Context; > + PXENBUS_EVTCHN_CHANNEL Channel; > =20 > status =3D STATUS_INVALID_BUFFER_SIZE; > if (InLen !=3D sizeof(XENIFACE_EVTCHN_BIND_UNBOUND_IN) || > @@ -176,6 +187,7 @@ IoctlEvtchnBindUnbound( > goto fail2; > =20 > Context->FileObject =3D FileObject; > + Context->Fdo =3D Fdo; > =20 > Trace("> RemoteDomain %d, Mask %d, FO %p\n", > In->RemoteDomain, In->Mask, FileObject); > @@ -192,28 +204,28 @@ IoctlEvtchnBindUnbound( > KeInitializeDpc(&Context->Dpc, EvtchnNotificationDpc, Context); > =20 > status =3D STATUS_UNSUCCESSFUL; > - Context->Channel =3D XENBUS_EVTCHN(Open, > - &Fdo->EvtchnInterface, > - XENBUS_EVTCHN_TYPE_UNBOUND, > - EvtchnInterruptHandler, > - Context, > - In->RemoteDomain, > - TRUE); > - if (Context->Channel =3D=3D NULL) > + Channel =3D XENBUS_EVTCHN(Open, > + &Fdo->EvtchnInterface, > + XENBUS_EVTCHN_TYPE_UNBOUND, > + EvtchnInterruptHandler, > + Context, > + In->RemoteDomain, > + TRUE); > + if (Channel =3D=3D NULL) > goto fail4; > =20 > Context->LocalPort =3D XENBUS_EVTCHN(GetPort, > &Fdo->EvtchnInterface, > - Context->Channel); > + Channel); > =20 > - Context->Fdo =3D Fdo; > + (VOID) InterlockedExchangePointer((PVOID *)&Context->Channel, Chann= el); > =20 > ExInterlockedInsertTailList(&Fdo->EvtchnList, &Context->Entry, &Fd= o->EvtchnLock); > =20 > if (!In->Mask) { > (VOID) XENBUS_EVTCHN(Unmask, > &Fdo->EvtchnInterface, > - Context->Channel, > + Channel, > FALSE, > TRUE); > } > @@ -256,6 +268,7 @@ IoctlEvtchnBindInterdomain( > PXENIFACE_EVTCHN_BIND_INTERDOMAIN_IN In =3D Buffer; > PXENIFACE_EVTCHN_BIND_INTERDOMAIN_OUT Out =3D Buffer; > PXENIFACE_EVTCHN_CONTEXT Context; > + PXENBUS_EVTCHN_CHANNEL Channel; > =20 > status =3D STATUS_INVALID_BUFFER_SIZE; > if (InLen !=3D sizeof(XENIFACE_EVTCHN_BIND_INTERDOMAIN_IN) || > @@ -269,6 +282,7 @@ IoctlEvtchnBindInterdomain( > goto fail2; > =20 > Context->FileObject =3D FileObject; > + Context->Fdo =3D Fdo; > =20 > Trace("> RemoteDomain %d, RemotePort %lu, Mask %d, FO %p\n", > In->RemoteDomain, In->RemotePort, In->Mask, Fil= eObject); > @@ -285,29 +299,29 @@ IoctlEvtchnBindInterdomain( > KeInitializeDpc(&Context->Dpc, EvtchnNotificationDpc, Context); > =20 > status =3D STATUS_UNSUCCESSFUL; > - Context->Channel =3D XENBUS_EVTCHN(Open, > - &Fdo->EvtchnInterface, > - XENBUS_EVTCHN_TYPE_INTER_DOMAIN, > - EvtchnInterruptHandler, > - Context, > - In->RemoteDomain, > - In->RemotePort, > - TRUE); > - if (Context->Channel =3D=3D NULL) > + Channel =3D XENBUS_EVTCHN(Open, > + &Fdo->EvtchnInterface, > + XENBUS_EVTCHN_TYPE_INTER_DOMAIN, > + EvtchnInterruptHandler, > + Context, > + In->RemoteDomain, > + In->RemotePort, > + TRUE); > + if (Channel =3D=3D NULL) > goto fail4; > =20 > Context->LocalPort =3D XENBUS_EVTCHN(GetPort, > &Fdo->EvtchnInterface, > - Context->Channel); > + Channel); > =20 > - Context->Fdo =3D Fdo; > + (VOID) InterlockedExchangePointer((PVOID *)&Context->Channel, Chann= el); > =20 KeFlushQueuedDpcs() is still needed before closing the channel to avoid=20 racing with EvtchnNotificationDpc=2E I think overall it'd require 2=20 flushes (1 for the channel itself and another to prevent pending DPCs=20 from dereferencing a freed channel)=2E > ExInterlockedInsertTailList(&Fdo->EvtchnList, &Context->Entry, &Fd= o->EvtchnLock); > =20 > if (!In->Mask) { > (VOID) XENBUS_EVTCHN(Unmask, > &Fdo->EvtchnInterface, > - Context->Channel, > + Channel, > FALSE, > TRUE); > } -- Ngoc Tu Dinh | Vates XCP-ng Developer XCP-ng & Xen Orchestra - Vates = solutions web: https://vates=2Etech ---=Part.1630.dd232844951a0b6.19e6dfa1f42.d6f9ab808400beda=--- From win-pv-devel-bounces@lists.xenproject.org Thu May 28 12:42:44 2026 Return-path: Envelope-to: archives@lists.xenproject.org Delivery-date: Thu, 28 May 2026 12:42:44 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1321161.1588128 (Exim 4.92) (envelope-from ) id 1wSa4Q-0000Vj-Eb; Thu, 28 May 2026 12:42:42 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1321161.1588128; Thu, 28 May 2026 12:42:42 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wSa4Q-0000Vb-Bf; Thu, 28 May 2026 12:42:42 +0000 Received: by outflank-mailman (input) for mailman id 1321161; Thu, 28 May 2026 12:42:41 +0000 Received: from mx.expurgate.net ([195.190.135.10]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wSa4O-0000VV-Qq for win-pv-devel@lists.xenproject.org; Thu, 28 May 2026 12:42:41 +0000 Received: from mx.expurgate.net (helo=localhost) by mx.expurgate.net with esmtp id 1wSa4N-00Ep3V-HH for win-pv-devel@lists.xenproject.org; Thu, 28 May 2026 14:42:39 +0200 Received: from [10.42.69.10] (helo=localhost) by localhost with ESMTP (eXpurgate MTA 0.9.1) (envelope-from ) id 6a18383a-bab6-0a2a0a5309dd-0a2a450ac4b2-18 for ; Thu, 28 May 2026 14:42:39 +0200 Received: from [103.168.172.149] (helo=fout-a6-smtp.messagingengine.com) by tlsNG-4011c0.mxtls.expurgate.net with ESMTPS (eXpurgate 4.56.1) (envelope-from ) id 6a18383d-56b3-0a2a450a0019-67a8ac95e5db-3 for ; Thu, 28 May 2026 14:42:38 +0200 Received: from phl-compute-02.internal (phl-compute-02.internal [10.202.2.42]) by mailfout.phl.internal (Postfix) with ESMTP id 953CFEC007C; Thu, 28 May 2026 08:42:37 -0400 (EDT) Received: from phl-frontend-03 ([10.202.2.162]) by phl-compute-02.internal (MEProxy); Thu, 28 May 2026 08:42:37 -0400 Received: by mail.messagingengine.com (Postfix) with ESMTPA; Thu, 28 May 2026 08:42:36 -0400 (EDT) X-BeenThere: win-pv-devel@lists.xenproject.org List-Id: Developer list for the Windows PV Drivers subproject List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: win-pv-devel-bounces@lists.xenproject.org Precedence: list Sender: "win-pv-devel" Authentication-Results: eu.smtp.expurgate.cloud; dkim=pass header.s=fm3 header.d=invisiblethingslab.com header.i="@invisiblethingslab.com" header.h="Content-Transfer-Encoding:Content-Type:Date:From:In-Reply-To:Message-ID:MIME-Version:References:Subject:To"; dkim=pass header.s=fm3 header.d=messagingengine.com header.i="@messagingengine.com" header.h="Content-Transfer-Encoding:Content-Type:Date:Feedback-ID:From:In-Reply-To:Message-ID:MIME-Version:References:Subject:To:X-ME-Proxy:X-ME-Sender" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= invisiblethingslab.com; h=cc:content-transfer-encoding :content-type:content-type:date:date:from:from:in-reply-to :in-reply-to:message-id:mime-version:references:reply-to:subject :subject:to:to; s=fm3; t=1779972157; x=1780058557; bh=u1m5XuJiXp fc+11imBy56lr6/Dy5/BKTtMPWOK9WC/c=; b=cafopBLvcTn6YQHi2P3BK1vjEL oiT+MMga6Cql1IjWdYo88n7zO+O/lsDfkMCg6pWMURwyx2VJQoySAEOnzElIfB9J sL8Y6xh8/SfY2wplk4Waz2dq2z1lg9/AQbL3fIG7D+hU9BNm63juo8WEu+yVldXD BCkO/1XaA5Gw3tflN9L7Hvd7P8dF/NmlfNHPEABsO5M3YiyfAL+0/Zs5yCWubA8B ObuPFSp/xdYfJmT/OhCkQVxfOeq8N94H6gMulnVNX3MTO0Vo6VSdlg2k4PMXLUKj kLwoJet7FGAcQffqbs8B4N1Ly1W9Bcn2+cdG8i6FYLubWyLzacQ/nBkwE6Zg== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=cc:content-transfer-encoding:content-type :content-type:date:date:feedback-id:feedback-id:from:from :in-reply-to:in-reply-to:message-id:mime-version:references :reply-to:subject:subject:to:to:x-me-proxy:x-me-sender :x-me-sender:x-sasl-enc; s=fm3; t=1779972157; x=1780058557; bh=u 1m5XuJiXpfc+11imBy56lr6/Dy5/BKTtMPWOK9WC/c=; b=feRgs7ED2fSEtOne3 E6QFyxdl8SvHdlNzDBvjTeQyyvpsdLUOVrEcSNecAPcl4CWPNtDKrAPucZEnWD3V tKTAttVUexu1sl3NQmBHl3LmyXHeND//PGtMaOPMgfWjLRp/va1NytDEKB4mAQv6 AxwkK08wtijyYydDEhcT3lKpWBVDRHYcgKM/kfLiZ2Ycz122bugWTMuotyU+eaDg QDvo2EIDWu22GHdd3ECxdLGJyzn5xtxPzGIa3nymITHhhr4BVVNgCIHiEQPbr+dX gqzd+8m7w/4WNqsn9tn/OmoO7Nk2Fxm6RzraWESRaMN3D/F1zxY2OBfGz1vZ6Ear 9yPtg== X-ME-Sender: X-ME-Received: X-ME-Proxy-Cause: dmFkZTF1wK192hG6wSEvlfrmXpH4uUZ6cQG8Qrj2CtG9AmZ5qTQFr3gFMgx7vUpakA/wkY Qxslii7QyV4XrczUTM7eOm2IKGslWf2JZg6C2P3yhOe9zoMEzQ39rtp4CGTtUSQIyDalyv 9uZpWfewZi6Y+5rtcseULZIb1XVc0KnKKNuqCDKHh9CLoC+yipbAj7TPGzfZX/IajjaMpq i5zKjFAjKf8dpL1f/s+yonWg+w2awNMA1URW9APu3C24f0j+ehfzNfTcD/J1udOtoNFEh6 3F/v/XSlO23wziPj2VD1v7hvozFfTnVHnf5df6WAdP7Wpj7d4EiRj3q/Rm80RS84yd5vI3 RZq0YLyIF+4v0ebj7P2fD1dQpESTXt+KG7broTmo1dDEiS510OeAIIDmaRuCe2u5gOua8X 4qg8XH+1SpSxoPnlomzCM3ouEIvxRYR5SqFwtuCc/PIT2wW0E3no/4jtwPH3K49boDdS7T 9bsdt3Me5KjIoyPHaiFrB5ji4D6RC3/S4CvRNS1MVdtaX48Sc/flxx+2o43BihPg2Y24PS 4SYGM/ZTYFKevIixx9KBz0KFcvs9rtsdzWMXDdC2RRYdFOBxJv91fPJciPOhRrTkl2WyKS lZyx5JKhkT6nFd6dD1dQVZyaKTRfFX1R2Pm2v4ycjhjfrnwsQjKICvmZ5xZg X-ME-Proxy: Feedback-ID: i409c4082:Fastmail Message-ID: <4388b0f8-496a-4b22-9f31-f59dbe4ea8d0@invisiblethingslab.com> Date: Thu, 28 May 2026 14:42:35 +0200 MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [PATCH v2 1/2] Fix use-after-free in evtchn DPC To: Tu Dinh , win-pv-devel@lists.xenproject.org References: <20260527113152.1135945-1-omeg@invisiblethingslab.com> <20260527113152.1135945-2-omeg@invisiblethingslab.com> <1779961569.8631fc262581453bbf619ec5b2062170.19e6dfa2152000d780@vates.tech> Content-Language: en-US From: =?UTF-8?B?UmFmYcWCIFdvamR5xYJh?= In-Reply-To: <1779961569.8631fc262581453bbf619ec5b2062170.19e6dfa2152000d780@vates.tech> Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 8bit X-purgate-ID: tlsNG-4011c0/1779972159-7035B8B7-C6D73C39/0/0 X-purgate-type: clean X-purgate-size: 8323 W dniu 28.05.2026 o 11:46, Tu Dinh pisze: > On 27/05/2026 13:32, Rafał Wojdyła wrote: >> EvtchnFree() calls XENBUS_EVTCHN(Close) and then KeFlushQueuedDpcs() >> to drain any pending DPCs. A DPC queued just before Close returns can >> run in the window between Close completing and the flush draining it, >> at which point it dereferences Context->Channel inside >> XENBUS_EVTCHN(Unmask). >> >> Use Context->Channel itself as the DPC readiness marker: >> - EvtchnFree() atomically swaps it to NULL as the first teardown step. >> - The DPC atomically reads it and exits without touching the channel >> or signalling Context->Event if NULL. >> >> Both bind paths publish the channel into Context->Channel atomically >> after acquiring a port from xenbus. >> >> Signed-off-by: Rafał Wojdyła >> --- >> src/xeniface/ioctl_evtchn.c | 64 ++++++++++++++++++++++--------------- >> 1 file changed, 39 insertions(+), 25 deletions(-) >> >> diff --git a/src/xeniface/ioctl_evtchn.c b/src/xeniface/ioctl_evtchn.c >> index 6d63996..4681a86 100644 >> --- a/src/xeniface/ioctl_evtchn.c >> +++ b/src/xeniface/ioctl_evtchn.c >> @@ -49,6 +49,7 @@ EvtchnNotificationDpc( >> ) >> { >> PXENIFACE_EVTCHN_CONTEXT Context = _Context; >> + PXENBUS_EVTCHN_CHANNEL Channel; >> >> UNREFERENCED_PARAMETER(Dpc); >> UNREFERENCED_PARAMETER(Argument1); >> @@ -56,11 +57,16 @@ EvtchnNotificationDpc( >> >> ASSERT(Context != NULL); >> >> + Channel = InterlockedCompareExchangePointer((PVOID *)&Context->Channel, >> + NULL, NULL); >> + if (Channel == NULL) >> + return; >> + >> KeSetEvent(Context->Event, 0, FALSE); >> >> (VOID) XENBUS_EVTCHN(Unmask, >> &Context->Fdo->EvtchnInterface, >> - Context->Channel, >> + Channel, >> FALSE, >> TRUE); >> } >> @@ -98,14 +104,18 @@ EvtchnFree( >> __inout PXENIFACE_EVTCHN_CONTEXT Context >> ) >> { >> + PXENBUS_EVTCHN_CHANNEL Channel; >> + >> ASSERT(KeGetCurrentIrql() == PASSIVE_LEVEL); >> >> Trace("Context %p, LocalPort %d, FO %p\n", >> Context, Context->LocalPort, Context->FileObject); >> >> + Channel = InterlockedExchangePointer((PVOID *)&Context->Channel, NULL); >> + >> XENBUS_EVTCHN(Close, >> &Fdo->EvtchnInterface, >> - Context->Channel); >> + Channel); >> >> // There may still be a pending event at this time. >> // Wait for our DPCs to complete. >> @@ -163,6 +173,7 @@ IoctlEvtchnBindUnbound( >> PXENIFACE_EVTCHN_BIND_UNBOUND_IN In = Buffer; >> PXENIFACE_EVTCHN_BIND_UNBOUND_OUT Out = Buffer; >> PXENIFACE_EVTCHN_CONTEXT Context; >> + PXENBUS_EVTCHN_CHANNEL Channel; >> >> status = STATUS_INVALID_BUFFER_SIZE; >> if (InLen != sizeof(XENIFACE_EVTCHN_BIND_UNBOUND_IN) || >> @@ -176,6 +187,7 @@ IoctlEvtchnBindUnbound( >> goto fail2; >> >> Context->FileObject = FileObject; >> + Context->Fdo = Fdo; >> >> Trace("> RemoteDomain %d, Mask %d, FO %p\n", >> In->RemoteDomain, In->Mask, FileObject); >> @@ -192,28 +204,28 @@ IoctlEvtchnBindUnbound( >> KeInitializeDpc(&Context->Dpc, EvtchnNotificationDpc, Context); >> >> status = STATUS_UNSUCCESSFUL; >> - Context->Channel = XENBUS_EVTCHN(Open, >> - &Fdo->EvtchnInterface, >> - XENBUS_EVTCHN_TYPE_UNBOUND, >> - EvtchnInterruptHandler, >> - Context, >> - In->RemoteDomain, >> - TRUE); >> - if (Context->Channel == NULL) >> + Channel = XENBUS_EVTCHN(Open, >> + &Fdo->EvtchnInterface, >> + XENBUS_EVTCHN_TYPE_UNBOUND, >> + EvtchnInterruptHandler, >> + Context, >> + In->RemoteDomain, >> + TRUE); >> + if (Channel == NULL) >> goto fail4; >> >> Context->LocalPort = XENBUS_EVTCHN(GetPort, >> &Fdo->EvtchnInterface, >> - Context->Channel); >> + Channel); >> >> - Context->Fdo = Fdo; >> + (VOID) InterlockedExchangePointer((PVOID *)&Context->Channel, Channel); >> >> ExInterlockedInsertTailList(&Fdo->EvtchnList, &Context->Entry, &Fdo->EvtchnLock); >> >> if (!In->Mask) { >> (VOID) XENBUS_EVTCHN(Unmask, >> &Fdo->EvtchnInterface, >> - Context->Channel, >> + Channel, >> FALSE, >> TRUE); >> } >> @@ -256,6 +268,7 @@ IoctlEvtchnBindInterdomain( >> PXENIFACE_EVTCHN_BIND_INTERDOMAIN_IN In = Buffer; >> PXENIFACE_EVTCHN_BIND_INTERDOMAIN_OUT Out = Buffer; >> PXENIFACE_EVTCHN_CONTEXT Context; >> + PXENBUS_EVTCHN_CHANNEL Channel; >> >> status = STATUS_INVALID_BUFFER_SIZE; >> if (InLen != sizeof(XENIFACE_EVTCHN_BIND_INTERDOMAIN_IN) || >> @@ -269,6 +282,7 @@ IoctlEvtchnBindInterdomain( >> goto fail2; >> >> Context->FileObject = FileObject; >> + Context->Fdo = Fdo; >> >> Trace("> RemoteDomain %d, RemotePort %lu, Mask %d, FO %p\n", >> In->RemoteDomain, In->RemotePort, In->Mask, FileObject); >> @@ -285,29 +299,29 @@ IoctlEvtchnBindInterdomain( >> KeInitializeDpc(&Context->Dpc, EvtchnNotificationDpc, Context); >> >> status = STATUS_UNSUCCESSFUL; >> - Context->Channel = XENBUS_EVTCHN(Open, >> - &Fdo->EvtchnInterface, >> - XENBUS_EVTCHN_TYPE_INTER_DOMAIN, >> - EvtchnInterruptHandler, >> - Context, >> - In->RemoteDomain, >> - In->RemotePort, >> - TRUE); >> - if (Context->Channel == NULL) >> + Channel = XENBUS_EVTCHN(Open, >> + &Fdo->EvtchnInterface, >> + XENBUS_EVTCHN_TYPE_INTER_DOMAIN, >> + EvtchnInterruptHandler, >> + Context, >> + In->RemoteDomain, >> + In->RemotePort, >> + TRUE); >> + if (Channel == NULL) >> goto fail4; >> >> Context->LocalPort = XENBUS_EVTCHN(GetPort, >> &Fdo->EvtchnInterface, >> - Context->Channel); >> + Channel); >> >> - Context->Fdo = Fdo; >> + (VOID) InterlockedExchangePointer((PVOID *)&Context->Channel, Channel); >> > > KeFlushQueuedDpcs() is still needed before closing the channel to avoid > racing with EvtchnNotificationDpc. I think overall it'd require 2 > flushes (1 for the channel itself and another to prevent pending DPCs > from dereferencing a freed channel). You're right, two flushes is probably the best approach here. I'll send a fixup. > >> ExInterlockedInsertTailList(&Fdo->EvtchnList, &Context->Entry, &Fdo->EvtchnLock); >> >> if (!In->Mask) { >> (VOID) XENBUS_EVTCHN(Unmask, >> &Fdo->EvtchnInterface, >> - Context->Channel, >> + Channel, >> FALSE, >> TRUE); >> } > > > From win-pv-devel-bounces@lists.xenproject.org Thu May 28 16:19:28 2026 Return-path: Envelope-to: archives@lists.xenproject.org Delivery-date: Thu, 28 May 2026 16:19:28 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1321574.1588264 (Exim 4.92) (envelope-from ) id 1wSdSB-0001aT-6y; Thu, 28 May 2026 16:19:27 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1321574.1588264; Thu, 28 May 2026 16:19:27 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wSdSB-0001aM-4L; Thu, 28 May 2026 16:19:27 +0000 Received: by outflank-mailman (input) for mailman id 1321574; Thu, 28 May 2026 16:19:25 +0000 Received: from mx.expurgate.net ([195.190.135.10]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wSdS9-0001aE-Lu for win-pv-devel@lists.xenproject.org; Thu, 28 May 2026 16:19:25 +0000 Received: from mx.expurgate.net (helo=localhost) by mx.expurgate.net with esmtp id 1wSdS8-00FSqQ-AI for win-pv-devel@lists.xenproject.org; Thu, 28 May 2026 18:19:25 +0200 Received: from [10.42.69.3] (helo=localhost) by localhost with ESMTP (eXpurgate MTA 0.9.1) (envelope-from ) id 6a186aef-bab6-0a2a0a5309dd-0a2a4503b10c-26 for ; Thu, 28 May 2026 18:19:24 +0200 Received: from [103.168.172.145] (helo=fout-a2-smtp.messagingengine.com) by tlsNG-33051d.mxtls.expurgate.net with ESMTPS (eXpurgate 4.56.1) (envelope-from ) id 6a186b0b-672d-0a2a45030019-67a8ac919fd5-3 for ; Thu, 28 May 2026 18:19:23 +0200 Received: from phl-compute-04.internal (phl-compute-04.internal [10.202.2.44]) by mailfout.phl.internal (Postfix) with ESMTP id CA9D6EC0184; Thu, 28 May 2026 12:19:22 -0400 (EDT) Received: from phl-frontend-04 ([10.202.2.163]) by phl-compute-04.internal (MEProxy); Thu, 28 May 2026 12:19:22 -0400 Received: by mail.messagingengine.com (Postfix) with ESMTPA; Thu, 28 May 2026 12:19:21 -0400 (EDT) X-BeenThere: win-pv-devel@lists.xenproject.org List-Id: Developer list for the Windows PV Drivers subproject List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: win-pv-devel-bounces@lists.xenproject.org Precedence: list Sender: "win-pv-devel" Authentication-Results: eu.smtp.expurgate.cloud; dkim=pass header.s=fm3 header.d=invisiblethingslab.com header.i="@invisiblethingslab.com" header.h="Cc:Content-Transfer-Encoding:Content-Type:Date:From:Message-ID:MIME-Version:Subject:To"; dkim=pass header.s=fm3 header.d=messagingengine.com header.i="@messagingengine.com" header.h="Cc:Content-Transfer-Encoding:Content-Type:Date:Feedback-ID:From:Message-ID:MIME-Version:Subject:To:X-ME-Proxy:X-ME-Sender" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= invisiblethingslab.com; h=cc:cc:content-transfer-encoding :content-type:content-type:date:date:from:from:in-reply-to :message-id:mime-version:reply-to:subject:subject:to:to; s=fm3; t=1779985162; x=1780071562; bh=K+A4kK23AWUwi3pD6VjY9XHJMZldTfu6 WhW6h3IWd+4=; b=zLxxHle7RWbozYh+cdN3MU78l68PWQqdac1dov0Zz4RvdvMh ICcQFKRJeX0+9RbkeiMnkxcJ4MBgSceR5NQRo0XWXcNOi9IdHjKf+qPsUous1wYG WLUVPNDj5Lag4hfTKUs6J8XbZp4JscNUWJC6qNNUnqMSC1PvTdwEzgGNAwTHfWc9 ZAvD+UPAfF4P41UvnaT6QF+poCDjYTEOhwF2PXSfyUT+fgvVTql7J3Z3Iztdp/HU 5bBW2nJX8S3Aa9DfOSRW48hpnZ0/e9/Gch4h0LewVcLhrYJvGl/mqriQjaQcOQhD FhMcosbz0uAEFKVe0lE5KR9lWL5sSIGfk7VrRQ== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=cc:cc:content-transfer-encoding :content-type:content-type:date:date:feedback-id:feedback-id :from:from:in-reply-to:message-id:mime-version:reply-to:subject :subject:to:to:x-me-proxy:x-me-sender:x-me-sender:x-sasl-enc; s= fm3; t=1779985162; x=1780071562; bh=K+A4kK23AWUwi3pD6VjY9XHJMZld Tfu6WhW6h3IWd+4=; b=q0duS8OsylN7LHv/ys0khAsQJ9+2+EKz4cLU+tg+1lr5 9ad8YfDbGwWqdXiYlowFjXcwZEdm3okAJB5Imp3Jb72dg3t6Z3MtRF7hJz89XzaJ ZRhGfo6zCTFUbmCaPgom1o0QH9YPcFzKK+If9qiEprQtW7KLBt0xldIfdUXNX7h8 CUx4I1Cx/aSub8qEwGtLfYXS+1Lskx0uz4zOWm6pvwgxTTCVVhjCw/tFa/FNhVdH 0xNvv4e0l9rkI7PlQAP3MTZwO4EXEI03T0O9uvNcxLrUrzTeby7GOa28L+YzAuAK I3HVu7PP2JeLGlHivy1g02uUaFe6q67//bYHYkHbBg== X-ME-Sender: X-ME-Received: X-ME-Proxy-Cause: dmFkZTGLoGyEK2sINnLgcYXI04qsgamJ7UKUOhp2jT7XaapyeXspEO0/2sy/kjm2EhVEG3 8CHIqXFZvKjBSS0UhVRg946R12Cjg+PIcDPaitKPgA5YId/prSy+8MNagL6015+G4TPzjO kOPsQT6La7+rvtyi1sFKz0+FoGpcXrJFQeP9fOaOQsq7oW1/UkfOvf/0I40OjXkuFsYjCk PHTWnCZTTa8iIKzLIvikYtMqWjTgkEmRFCo5UOvXrlGSYw03GGd9gPtnGOU+suEAfEyaSI RC790K426kzvSXsevRfMczJ+Ok5jU3sR4TpXIYYgMFPivWefc3/fdyaE6NluhNGgr7MjZx iTHsNjaggCN4z1zr0V2chWRYee65zuDUrEW04BR6cXM34j369+rz1KsZqUPRYNHPB+BzAU JxbHbusRqZPbL4AKub9sJf+kEm6cJVw9x5oZaEiGBAREBI+4sCrOAPc9rOv3vK3tIf7C72 lI9jrKpEjz4RI7zeKtFjdf0iYKLfysCVI40BmZP0mL/EnwRaB9C+4d7GJhKZQsJSMLxxcd ZGwrNDGjHqbTKohnE+48nW/SUev5csaWeNh9nJV4YQDyYQXEet4wBpwWEZOS8I+0FcHbxi PdVd5V8RhY9PDrQp7HqcbXqb0WawBdPj6xoXwSTv6zleaG7QCIqoEkPVsLYQ X-ME-Proxy: Feedback-ID: i409c4082:Fastmail From: =?UTF-8?q?Rafa=C5=82=20Wojdy=C5=82a?= To: win-pv-devel@lists.xenproject.org Cc: =?UTF-8?q?Rafa=C5=82=20Wojdy=C5=82a?= Subject: [PATCH v3 0/2] xeniface race fixes Date: Thu, 28 May 2026 18:18:58 +0200 Message-ID: <20260528161900.2511174-1-omeg@invisiblethingslab.com> X-Mailer: git-send-email 2.54.0 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-purgate-ID: tlsNG-33051d/1779985164-3B96D938-ACD02B92/0/0 X-purgate-type: clean X-purgate-size: 314 Rafał Wojdyła (2): Fix use-after-free in evtchn DPC Send gnttab unmap notify event after the grant is fully released src/xeniface/ioctl_evtchn.c | 71 +++++++++++++++++++++++-------------- src/xeniface/ioctl_gnttab.c | 16 +++++---- 2 files changed, 53 insertions(+), 34 deletions(-) -- 2.54.0 From win-pv-devel-bounces@lists.xenproject.org Thu May 28 16:19:29 2026 Return-path: Envelope-to: archives@lists.xenproject.org Delivery-date: Thu, 28 May 2026 16:19:29 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1321575.1588270 (Exim 4.92) (envelope-from ) id 1wSdSD-0001bu-8w; Thu, 28 May 2026 16:19:29 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1321575.1588270; Thu, 28 May 2026 16:19:29 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wSdSD-0001bn-5Z; Thu, 28 May 2026 16:19:29 +0000 Received: by outflank-mailman (input) for mailman id 1321575; Thu, 28 May 2026 16:19:27 +0000 Received: from mx.expurgate.net ([195.190.135.10]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wSdSB-0001bU-HW for win-pv-devel@lists.xenproject.org; Thu, 28 May 2026 16:19:27 +0000 Received: from mx.expurgate.net (helo=localhost) by mx.expurgate.net with esmtp id 1wSdSA-00B8kD-UX for win-pv-devel@lists.xenproject.org; Thu, 28 May 2026 18:19:26 +0200 Received: from [10.42.69.8] (helo=localhost) by localhost with ESMTP (eXpurgate MTA 0.9.1) (envelope-from ) id 6a186b05-2eae-0a2a0a5409dd-0a2a4508c4c2-12 for ; Thu, 28 May 2026 18:19:26 +0200 Received: from [103.168.172.154] (helo=fhigh-a3-smtp.messagingengine.com) by tlsNG-c1860d.mxtls.expurgate.net with ESMTPS (eXpurgate 4.56.1) (envelope-from ) id 6a186b0d-63b5-0a2a45080019-67a8ac9ac193-3 for ; Thu, 28 May 2026 18:19:26 +0200 Received: from phl-compute-02.internal (phl-compute-02.internal [10.202.2.42]) by mailfhigh.phl.internal (Postfix) with ESMTP id C4FE914000BD; Thu, 28 May 2026 12:19:25 -0400 (EDT) Received: from phl-frontend-04 ([10.202.2.163]) by phl-compute-02.internal (MEProxy); Thu, 28 May 2026 12:19:25 -0400 Received: by mail.messagingengine.com (Postfix) with ESMTPA; Thu, 28 May 2026 12:19:24 -0400 (EDT) X-BeenThere: win-pv-devel@lists.xenproject.org List-Id: Developer list for the Windows PV Drivers subproject List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: win-pv-devel-bounces@lists.xenproject.org Precedence: list Sender: "win-pv-devel" Authentication-Results: eu.smtp.expurgate.cloud; dkim=pass header.s=fm3 header.d=invisiblethingslab.com header.i="@invisiblethingslab.com" header.h="Cc:Content-Transfer-Encoding:Content-Type:Date:From:In-Reply-To:Message-ID:MIME-Version:References:Subject:To"; dkim=pass header.s=fm3 header.d=messagingengine.com header.i="@messagingengine.com" header.h="Cc:Content-Transfer-Encoding:Content-Type:Date:Feedback-ID:From:In-Reply-To:Message-ID:MIME-Version:References:Subject:To:X-ME-Proxy:X-ME-Sender" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= invisiblethingslab.com; h=cc:cc:content-transfer-encoding :content-type:content-type:date:date:from:from:in-reply-to :in-reply-to:message-id:mime-version:references:reply-to:subject :subject:to:to; s=fm3; t=1779985165; x=1780071565; bh=OasVYCg6AS 1Gonfb5drfODiCzd883hNaSbP2zpjC6q4=; b=CKyuBij2uIv8sH4cZlRprMndxM dkyrYXi8xLsZarZsAF/A+nvw4z29Gim4apcuEzlf8oKzukbd+xMzJ249qGBDF2qK DGVvZFxgGihNXnMrNe+stzzLyzLW88UO/Z2P6R7+1Xz2h2wWLG7IwIrCz+YyOs0v OiVl3CXxUWy0kvEJAq2S9869u3aAZXNY1vO7jTqLvfLD4fF4NEsjglZHS+qS0pGX /kBVzSMvTu6TrXIM0cm3SmKDgxrV33j0v8+H4FjNgBw8mXP6ODxfi6WE3snn49ki a5i4/HdeH+YznFlHaX/GdBrK4SHcSri8kb2RltqkrtuaHsfaeHjeVU6tQbCA== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=cc:cc:content-transfer-encoding :content-type:content-type:date:date:feedback-id:feedback-id :from:from:in-reply-to:in-reply-to:message-id:mime-version :references:reply-to:subject:subject:to:to:x-me-proxy :x-me-sender:x-me-sender:x-sasl-enc; s=fm3; t=1779985165; x= 1780071565; bh=OasVYCg6AS1Gonfb5drfODiCzd883hNaSbP2zpjC6q4=; b=w Bw+ZlUdtxURbfPLAg69MSFe2cTvAndBDhtTsGXKuuKbQeAfq6rdcBnikyQA4ndg2 nJzZtjATvtUr7EU85x+yzfNMU69eyDjaVAbbrx/zKrZPous+L7YPWYaw6rz2nfZa GpRXR7vqk2IpBztA6D93lC9iPNwWKYKEFDzM+YUrbIUAGGq1R9DrG6XM/yuOe9dt ixVMmqsxuUxuiNxyOBoftcSPI+JGH9e8A3wq2JgfJRiNytaGxmhlN88U+NnRgW4s 5A57r2ctGrjO5TsqzqY/N7dyXGKqwDf8OnekruQbcsEZVoT7nS68PAIkihq+OyQL w9ymPPDGkDmkWx7fBWtmA== X-ME-Sender: X-ME-Received: X-ME-Proxy-Cause: dmFkZTEc+cQ9lYr9KpYN7QAPCTqTVE08HbONIARUmPOVqbS8OSoUwEjV/pWW+2c7UZfyUP bVhLwT93vxr4XLJoTxr1ckV6RMwc3WyvMY2sngqRO7k26TDQPAG+7OblEx4L6He5DKNa8q 1cOyRnU2GIxFVLLWFE1l4pGv6MI+VG+jivL3x3X/SlHowlNNEupGRdZh7LYXO3YfxD9jiI M2puyZYxD+EE7eTJzIwExCNLTjdXjnGk326wiNtCWPlRhW3+JVy5hLMHZlPDptLl6mu/6F p6q2VUmxTl4Q7kod9l/IwBVtRpPA03jlvM228wu0hIxHfL+xRrCA6dZTV8PBgdN7ujO2Q6 EMLlFhNKFFEv5d1Pz9H0NIbwkTfBN1erWSQV3lLC6lSOTyW5m0IcaKQ03upB+7UXgJ9LWZ j0lpG7T3NwOK8dFHwABFgeBHFfY/qLJBmL71Rb1ALBpHdMJmq8vHQB9vFiwC691lS2vsK7 wMSCQcH1GQMFaevyp2MSDywJJiP/+q9imjFoEJZ2D411V/5D/Orec7rEEWkdYqMA6mJw7s ZFSulkVwNryhvByxLaiWK49LSPYjqszjhgeKMU68gw7rR+AyvO8imoOpuPJdKce+u49DyM uBylvNesErWIGXeAyBVUdYFk/IVUA8k3WfqjtulsiQFVj7+kAMPZ4vK0tGiA X-ME-Proxy: Feedback-ID: i409c4082:Fastmail From: =?UTF-8?q?Rafa=C5=82=20Wojdy=C5=82a?= To: win-pv-devel@lists.xenproject.org Cc: =?UTF-8?q?Rafa=C5=82=20Wojdy=C5=82a?= Subject: [PATCH v3 1/2] Fix use-after-free in evtchn DPC Date: Thu, 28 May 2026 18:18:59 +0200 Message-ID: <20260528161900.2511174-2-omeg@invisiblethingslab.com> X-Mailer: git-send-email 2.54.0 In-Reply-To: <20260528161900.2511174-1-omeg@invisiblethingslab.com> References: <20260528161900.2511174-1-omeg@invisiblethingslab.com> MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-purgate-ID: tlsNG-c1860d/1779985166-BD56FDB1-DD7287F7/0/0 X-purgate-type: clean X-purgate-size: 7437 EvtchnFree() calls XENBUS_EVTCHN(Close) and then KeFlushQueuedDpcs() to drain any pending DPCs. A DPC queued just before Close returns can run in the window between Close completing and the flush draining it, at which point it dereferences Context->Channel inside XENBUS_EVTCHN(Unmask). Use Context->Channel itself as the DPC readiness marker: - EvtchnFree() atomically swaps it to NULL as the first teardown step. - The DPC atomically reads it and exits without touching the channel or signalling Context->Event if NULL. Both bind paths publish the channel into Context->Channel atomically after acquiring a port from xenbus. Signed-off-by: Rafał Wojdyła --- src/xeniface/ioctl_evtchn.c | 71 +++++++++++++++++++++++-------------- 1 file changed, 44 insertions(+), 27 deletions(-) diff --git a/src/xeniface/ioctl_evtchn.c b/src/xeniface/ioctl_evtchn.c index 6d63996..fa63d7f 100644 --- a/src/xeniface/ioctl_evtchn.c +++ b/src/xeniface/ioctl_evtchn.c @@ -49,6 +49,7 @@ EvtchnNotificationDpc( ) { PXENIFACE_EVTCHN_CONTEXT Context = _Context; + PXENBUS_EVTCHN_CHANNEL Channel; UNREFERENCED_PARAMETER(Dpc); UNREFERENCED_PARAMETER(Argument1); @@ -56,11 +57,16 @@ EvtchnNotificationDpc( ASSERT(Context != NULL); + Channel = InterlockedCompareExchangePointer((PVOID *)&Context->Channel, + NULL, NULL); + if (Channel == NULL) + return; + KeSetEvent(Context->Event, 0, FALSE); (VOID) XENBUS_EVTCHN(Unmask, &Context->Fdo->EvtchnInterface, - Context->Channel, + Channel, FALSE, TRUE); } @@ -98,17 +104,24 @@ EvtchnFree( __inout PXENIFACE_EVTCHN_CONTEXT Context ) { + PXENBUS_EVTCHN_CHANNEL Channel; + ASSERT(KeGetCurrentIrql() == PASSIVE_LEVEL); Trace("Context %p, LocalPort %d, FO %p\n", Context, Context->LocalPort, Context->FileObject); + Channel = InterlockedExchangePointer((PVOID *)&Context->Channel, NULL); + + // Flush DPCs that can have Channel captured before the swap. + KeFlushQueuedDpcs(); + XENBUS_EVTCHN(Close, &Fdo->EvtchnInterface, - Context->Channel); + Channel); - // There may still be a pending event at this time. - // Wait for our DPCs to complete. + // A second flush is needed so DPCs queued after the first flush + // don't dereference invalid Context. KeFlushQueuedDpcs(); ObDereferenceObject(Context->Event); @@ -163,6 +176,7 @@ IoctlEvtchnBindUnbound( PXENIFACE_EVTCHN_BIND_UNBOUND_IN In = Buffer; PXENIFACE_EVTCHN_BIND_UNBOUND_OUT Out = Buffer; PXENIFACE_EVTCHN_CONTEXT Context; + PXENBUS_EVTCHN_CHANNEL Channel; status = STATUS_INVALID_BUFFER_SIZE; if (InLen != sizeof(XENIFACE_EVTCHN_BIND_UNBOUND_IN) || @@ -176,6 +190,7 @@ IoctlEvtchnBindUnbound( goto fail2; Context->FileObject = FileObject; + Context->Fdo = Fdo; Trace("> RemoteDomain %d, Mask %d, FO %p\n", In->RemoteDomain, In->Mask, FileObject); @@ -192,28 +207,28 @@ IoctlEvtchnBindUnbound( KeInitializeDpc(&Context->Dpc, EvtchnNotificationDpc, Context); status = STATUS_UNSUCCESSFUL; - Context->Channel = XENBUS_EVTCHN(Open, - &Fdo->EvtchnInterface, - XENBUS_EVTCHN_TYPE_UNBOUND, - EvtchnInterruptHandler, - Context, - In->RemoteDomain, - TRUE); - if (Context->Channel == NULL) + Channel = XENBUS_EVTCHN(Open, + &Fdo->EvtchnInterface, + XENBUS_EVTCHN_TYPE_UNBOUND, + EvtchnInterruptHandler, + Context, + In->RemoteDomain, + TRUE); + if (Channel == NULL) goto fail4; Context->LocalPort = XENBUS_EVTCHN(GetPort, &Fdo->EvtchnInterface, - Context->Channel); + Channel); - Context->Fdo = Fdo; + (VOID) InterlockedExchangePointer((PVOID *)&Context->Channel, Channel); ExInterlockedInsertTailList(&Fdo->EvtchnList, &Context->Entry, &Fdo->EvtchnLock); if (!In->Mask) { (VOID) XENBUS_EVTCHN(Unmask, &Fdo->EvtchnInterface, - Context->Channel, + Channel, FALSE, TRUE); } @@ -256,6 +271,7 @@ IoctlEvtchnBindInterdomain( PXENIFACE_EVTCHN_BIND_INTERDOMAIN_IN In = Buffer; PXENIFACE_EVTCHN_BIND_INTERDOMAIN_OUT Out = Buffer; PXENIFACE_EVTCHN_CONTEXT Context; + PXENBUS_EVTCHN_CHANNEL Channel; status = STATUS_INVALID_BUFFER_SIZE; if (InLen != sizeof(XENIFACE_EVTCHN_BIND_INTERDOMAIN_IN) || @@ -269,6 +285,7 @@ IoctlEvtchnBindInterdomain( goto fail2; Context->FileObject = FileObject; + Context->Fdo = Fdo; Trace("> RemoteDomain %d, RemotePort %lu, Mask %d, FO %p\n", In->RemoteDomain, In->RemotePort, In->Mask, FileObject); @@ -285,29 +302,29 @@ IoctlEvtchnBindInterdomain( KeInitializeDpc(&Context->Dpc, EvtchnNotificationDpc, Context); status = STATUS_UNSUCCESSFUL; - Context->Channel = XENBUS_EVTCHN(Open, - &Fdo->EvtchnInterface, - XENBUS_EVTCHN_TYPE_INTER_DOMAIN, - EvtchnInterruptHandler, - Context, - In->RemoteDomain, - In->RemotePort, - TRUE); - if (Context->Channel == NULL) + Channel = XENBUS_EVTCHN(Open, + &Fdo->EvtchnInterface, + XENBUS_EVTCHN_TYPE_INTER_DOMAIN, + EvtchnInterruptHandler, + Context, + In->RemoteDomain, + In->RemotePort, + TRUE); + if (Channel == NULL) goto fail4; Context->LocalPort = XENBUS_EVTCHN(GetPort, &Fdo->EvtchnInterface, - Context->Channel); + Channel); - Context->Fdo = Fdo; + (VOID) InterlockedExchangePointer((PVOID *)&Context->Channel, Channel); ExInterlockedInsertTailList(&Fdo->EvtchnList, &Context->Entry, &Fdo->EvtchnLock); if (!In->Mask) { (VOID) XENBUS_EVTCHN(Unmask, &Fdo->EvtchnInterface, - Context->Channel, + Channel, FALSE, TRUE); } -- 2.54.0 From win-pv-devel-bounces@lists.xenproject.org Thu May 28 16:19:31 2026 Return-path: Envelope-to: archives@lists.xenproject.org Delivery-date: Thu, 28 May 2026 16:19:31 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1321576.1588274 (Exim 4.92) (envelope-from ) id 1wSdSF-0001e0-Af; Thu, 28 May 2026 16:19:31 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1321576.1588274; Thu, 28 May 2026 16:19:31 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wSdSF-0001dt-7X; Thu, 28 May 2026 16:19:31 +0000 Received: by outflank-mailman (input) for mailman id 1321576; Thu, 28 May 2026 16:19:29 +0000 Received: from mx.expurgate.net ([194.145.224.20]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wSdSD-0001c7-EN for win-pv-devel@lists.xenproject.org; Thu, 28 May 2026 16:19:29 +0000 Received: from mx.expurgate.net (helo=localhost) by mx.expurgate.net with esmtp id 1wSdSC-008ifu-Qe for win-pv-devel@lists.xenproject.org; Thu, 28 May 2026 18:19:28 +0200 Received: from [10.42.69.2] (helo=localhost) by localhost with ESMTP (eXpurgate MTA 0.9.1) (envelope-from ) id 6a186af4-5cb7-0a2a0a5109dd-0a2a4502a8c0-40 for ; Thu, 28 May 2026 18:19:28 +0200 Received: from [103.168.172.154] (helo=fhigh-a3-smtp.messagingengine.com) by tlsNG-720697.mxtls.expurgate.net with ESMTPS (eXpurgate 4.56.1) (envelope-from ) id 6a186b0f-af86-0a2a45020019-67a8ac9aa765-3 for ; Thu, 28 May 2026 18:19:28 +0200 Received: from phl-compute-04.internal (phl-compute-04.internal [10.202.2.44]) by mailfhigh.phl.internal (Postfix) with ESMTP id A834D140005C; Thu, 28 May 2026 12:19:27 -0400 (EDT) Received: from phl-frontend-04 ([10.202.2.163]) by phl-compute-04.internal (MEProxy); Thu, 28 May 2026 12:19:27 -0400 Received: by mail.messagingengine.com (Postfix) with ESMTPA; Thu, 28 May 2026 12:19:26 -0400 (EDT) X-BeenThere: win-pv-devel@lists.xenproject.org List-Id: Developer list for the Windows PV Drivers subproject List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: win-pv-devel-bounces@lists.xenproject.org Precedence: list Sender: "win-pv-devel" Authentication-Results: eu.smtp.expurgate.cloud; dkim=pass header.s=fm3 header.d=invisiblethingslab.com header.i="@invisiblethingslab.com" header.h="Cc:Content-Transfer-Encoding:Content-Type:Date:From:In-Reply-To:Message-ID:MIME-Version:References:Subject:To"; dkim=pass header.s=fm3 header.d=messagingengine.com header.i="@messagingengine.com" header.h="Cc:Content-Transfer-Encoding:Content-Type:Date:Feedback-ID:From:In-Reply-To:Message-ID:MIME-Version:References:Subject:To:X-ME-Proxy:X-ME-Sender" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= invisiblethingslab.com; h=cc:cc:content-transfer-encoding :content-type:content-type:date:date:from:from:in-reply-to :in-reply-to:message-id:mime-version:references:reply-to:subject :subject:to:to; s=fm3; t=1779985167; x=1780071567; bh=eK/54nvPRS BQx4oZao9/VWKzbN5DDpRO78kBjTFrub8=; b=QHosLNj+KwJflb4FU7SUFHCzqO S4RDG6D21Wzb2cWjQiqE5yyfDLqt2M/JtZyhKu6I1Ph4tQOAdhyjOH0PikfSjYH2 gLai9mtqGRue9qalkkWQtNND1Cs9gNqVpT4YhbFQ1SFMnFwnYBhNpC5EqHZlBHlC QuBcDw854t743VKYuPUKhFB6gnuV7fInvnRWPHcA8cpvdpBfdq+t+DBPeuh/mD2i KsNfD1LDgAaQ7VPrqoYeQsmqt/BzebTcbQBX0fgEHp2wmf73NJXzrYX2Shs6/Uey 5vJMglGxCljGVdcMFtRJcnNAyoPRfDEpXJvhNIpX3zFPqtQhbLDv+nfGvDXw== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=cc:cc:content-transfer-encoding :content-type:content-type:date:date:feedback-id:feedback-id :from:from:in-reply-to:in-reply-to:message-id:mime-version :references:reply-to:subject:subject:to:to:x-me-proxy :x-me-sender:x-me-sender:x-sasl-enc; s=fm3; t=1779985167; x= 1780071567; bh=eK/54nvPRSBQx4oZao9/VWKzbN5DDpRO78kBjTFrub8=; b=H 503PW1iibhCSMXOSY6ZfCDABVMALYV+YzVJXMcSv4JLwaqNZ8dRUZjDPS19+qKmt bCSVoiDrRGIPUe40Y4a2ynO3uTP8aqRjS+v9uUDGAv1ZqZwvjCNhBvE0vOByCzvp 7oBOiXv44CKr7ALa75t+uxx+VFWX1etBHAYiMYOhwX47eDFxyiiY7BP00AXrTzMU cm/ifD/lOi8HaoqwAlw+X06D5bTPHQrSu+ovXE4zDTBdcKMwgoGL17/sPOOb3AII WDiJdCQwqHnfKSsqqlWNwmiBjG86Sc3BcJIbVkemPnk0y0IKNXWq/5zuO1buG9AR esWA60GTUUKMiOTGUnFDg== X-ME-Sender: X-ME-Received: X-ME-Proxy-Cause: dmFkZTEc+cQ9lYr9KpYN7QAPCTqTVE08HbONIARUmPOVqbS8OSoUwEjV/pWW+2c7UZfyUP bVhLwT93vxr4XLJoTxr1ckV6RMwc3WyvMY2sngqRO7k26TDQPAG+7OblEx4L6He5DKNa8q 1cOyRnU2GIxFVLLWFE1l4pGv6MI+VG+jivL3x3X/SlHowlNNEupGRdZh7LYXO3YfxD9jiI M2puyZYxD+EE7eTJzIwExCNLTjdXjnGk326wiNtCWPlRhW3+JVy5hLMHZlPDptLl6mu/6F p6q2VUmxTl4Q7kod9l/IwBVtRpPA03jlvM228wu0hIxHfL+xRrCA6dZTV8PBgdN7ujO2lw xyEJLQHoWHlbo43jXiMSSNeL95rL6SqjErUHtpsW+dgzYTXNXQuF08PNq3WIr7i35wTcmb 0puMsp+WTgixPDzxs+5YjAHpQfwYKMJ1WnXVkccQNTaQjwtOhHjUjtBp1WPV7lWYDOcaYG r38Xag2u+kAY5LLKqqqZ3p35slJlxyBg5s76OTIElEmzPBcDlJvNd4yxiwPdmt43uJOtSs E6rPJ2VFNEjZsRBFaD8EbBhoSa2B7Jo7nH5Typ7VKnQAaGO9mBkGDFIYIFGVqlMsSLbIqV CpMbUHxM+UsRLNNZH8bfMlcJ5G8XlmxooPXCk5+8Py4zfMz+h9GmMO+O+9Ew X-ME-Proxy: Feedback-ID: i409c4082:Fastmail From: =?UTF-8?q?Rafa=C5=82=20Wojdy=C5=82a?= To: win-pv-devel@lists.xenproject.org Cc: =?UTF-8?q?Rafa=C5=82=20Wojdy=C5=82a?= Subject: [PATCH v3 2/2] Send gnttab unmap notify event after the grant is fully released Date: Thu, 28 May 2026 18:19:00 +0200 Message-ID: <20260528161900.2511174-3-omeg@invisiblethingslab.com> X-Mailer: git-send-email 2.54.0 In-Reply-To: <20260528161900.2511174-1-omeg@invisiblethingslab.com> References: <20260528161900.2511174-1-omeg@invisiblethingslab.com> MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-purgate-ID: tlsNG-720697/1779985168-A937C161-144D6951/0/0 X-purgate-type: clean X-purgate-size: 1823 Move the notification event to after the unmap hypercall completes, so the peer only gets notified after the grant is completely released on our side. Closes possible race when the peer could be notified before the grant was fully torn down. Signed-off-by: Rafał Wojdyła --- src/xeniface/ioctl_gnttab.c | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-) diff --git a/src/xeniface/ioctl_gnttab.c b/src/xeniface/ioctl_gnttab.c index ef77295..ee319cb 100644 --- a/src/xeniface/ioctl_gnttab.c +++ b/src/xeniface/ioctl_gnttab.c @@ -802,17 +802,11 @@ GnttabFreeMap( Trace("Context %p\n", Context); + // Write the notify value while the grant is still mapped. if (Context->Flags & XENIFACE_GNTTAB_USE_NOTIFY_OFFSET) { ((PCHAR)Context->KernelVa)[Context->NotifyOffset] = 0; } - if (Context->Flags & XENIFACE_GNTTAB_USE_NOTIFY_PORT) { - status = EvtchnNotify(Fdo, Context->NotifyPort, NULL); - - if (!NT_SUCCESS(status)) // non-fatal, we must free memory - Error("failed to notify port %lu: 0x%x\n", Context->NotifyPort, status); - } - // unmap from user address space MmUnmapLockedPages(Context->UserVa, Context->Mdl); @@ -828,6 +822,14 @@ GnttabFreeMap( ASSERT(NT_SUCCESS(status)); + // Notify the peer after the map is fully gone. + if (Context->Flags & XENIFACE_GNTTAB_USE_NOTIFY_PORT) { + status = EvtchnNotify(Fdo, Context->NotifyPort, NULL); + + if (!NT_SUCCESS(status)) // non-fatal, we must free memory + Error("failed to notify port %lu: 0x%x\n", Context->NotifyPort, status); + } + RtlZeroMemory(Context, sizeof(*Context)); __FreePoolWithTag(Context, XENIFACE_POOL_TAG); } -- 2.54.0 From win-pv-devel-bounces@lists.xenproject.org Fri May 29 05:25:11 2026 Return-path: Envelope-to: archives@lists.xenproject.org Delivery-date: Fri, 29 May 2026 05:25:11 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1321806.1588323 (Exim 4.92) (envelope-from ) id 1wSpiY-00035D-42; Fri, 29 May 2026 05:25:10 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1321806.1588323; Fri, 29 May 2026 05:25:10 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wSpiY-000355-1C; Fri, 29 May 2026 05:25:10 +0000 Received: by outflank-mailman (input) for mailman id 1321806; Fri, 29 May 2026 05:25:09 +0000 Received: from mx.expurgate.net ([195.190.135.10]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wSpiW-00034z-Pb for win-pv-devel@lists.xenproject.org; Fri, 29 May 2026 05:25:09 +0000 Received: from mx.expurgate.net (helo=localhost) by mx.expurgate.net with esmtp id 1wSpiV-00CWY8-UO for win-pv-devel@lists.xenproject.org; Fri, 29 May 2026 07:25:08 +0200 Received: from [10.42.69.6] (helo=localhost) by localhost with ESMTP (eXpurgate MTA 0.9.1) (envelope-from ) id 6a19232a-bab6-0a2a0a5309dd-0a2a4506b2f8-6 for ; Fri, 29 May 2026 07:25:07 +0200 Received: from [185.255.28.34] (helo=prod-mta-13.swg-srv.net) by tlsNG-16d1c6.mxtls.expurgate.net with ESMTPS (eXpurgate 4.56.1) (envelope-from ) id 6a192331-7371-0a2a45060019-b9ff1c22a671-3 for ; Fri, 29 May 2026 07:25:06 +0200 Received: from mail2.vates.fr ([37.26.189.201] mail2.vates.fr) (Authenticated sender: 8631fc262581453bbf619ec5b2062170/smtp/7773de5a-2839-4720-82ee-e06722ae1d3e) by prod-mta-13.swg-srv.net (ZoneMTA - prod-mta-13) with ESMTPSA id 19e723178a5000d780.002 for (version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384); Fri, 29 May 2026 05:25:05 +0000 Received: from [192.168.1.61] (155.223.66.37.rev.sfr.net [37.66.223.155]) (Authenticated sender: ngoc-tu.dinh@vates.tech) by mail2.vates.fr (Postfix) with ESMTPSA id 80EB08623E; Fri, 29 May 2026 07:25:04 +0200 (CEST) X-BeenThere: win-pv-devel@lists.xenproject.org List-Id: Developer list for the Windows PV Drivers subproject List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: win-pv-devel-bounces@lists.xenproject.org Precedence: list Sender: "win-pv-devel" Authentication-Results: eu.smtp.expurgate.cloud; dkim=pass header.s=selector1 header.d=vates.tech header.i="@vates.tech" header.h="From:Subject:Date:Message-ID:To:MIME-Version:Content-Type:In-Reply-To:References:Feedback-ID" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=vates.tech; q=dns/txt; s=selector1; bh=Ke975h9NbhN99T4sazC+yJI3E+3haItiXi7kIt5WoRo=; h=from:subject:date:message-id:to:mime-version:content-type:in-reply-to:references:feedback-id; b=pfs6oEJ763ar7hyDW5/cihahO75N6hMnhJpuZra8EjwcRaj5/DUDqf3pRfDQHUqq2HV279NkB dLzw4/1ui86L9n/qlJKOmsNP7KNo/ZGirbOrNLbp5FRfSmZVfX1aSNPJPHQRGlsxH5HSxvW+Dc5 W6voQoNllZCYv6/b3BCOTeMInuKzN4DEyJ9OawxpoHaONHq8aFHLnQh0xqgp+0eyvMji12osAkT c3mT+xAmZiO8HH35onr2u9QDQhyvLJRlzR9MGHLrwfBP6p3RP6oTtEWkS7ho9veyIK3jWbXdrHF X+sjpGEO7Wmrqt9q331UKkqE7HF/+defyguPZShq1/Jw== X-Zone-Loop: 65f0f283d9d25ba71aa55a307742729c8eb006801851 x-campaign-type: default x-transaction-id: 9c88318e-b0a7-4ab7-8c50-b6a6a7ce09ad x-swg-uid: 01-2ef90538-ed00-48f2-be29-90ab152ec636 X-Mailer: Sweego Message-ID: <1780032305.8631fc262581453bbf619ec5b2062170.19e723178a5000d780@vates.tech> x-swg-bid: 1780032305.8631fc262581453bbf619ec5b2062170.19e723178a5000d780 Feedback-ID: default:8631fc262581453bbf619ec5b2062170:Sweego x-campaign-id: default x-client-id: 8631fc262581453bbf619ec5b2062170 X-Originating-IP: [37.26.189.201] Date: Fri, 29 May 2026 07:25:04 +0200 MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [PATCH v3 0/2] xeniface race fixes To: =?UTF-8?B?UmFmYcWCIFdvamR5xYJh?= , win-pv-devel@lists.xenproject.org References: <20260528161900.2511174-1-omeg@invisiblethingslab.com> Content-Language: en-US From: Tu Dinh In-Reply-To: <20260528161900.2511174-1-omeg@invisiblethingslab.com> X-BM-Disclaimer: Yes Content-Type: multipart/alternative; boundary="-=Part.16e5.469fbdaa4ecde19d.19e723175cf.9b556cb83cd5fea=-" X-Bm-Milter-Handled: 4ffbd6c1-ee69-4e1b-aabd-f977039bd3e2 X-Bm-Transport-Timestamp: 1780032304591 X-purgate-ID: tlsNG-16d1c6/1780032306-87B7DD75-7FEB9143/0/0 X-purgate-type: clean X-purgate-size: 803 ---=Part.16e5.469fbdaa4ecde19d.19e723175cf.9b556cb83cd5fea=- Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable On 28/05/2026 18:19, Rafa=C5=82 Wojdy=C5=82a wrote: > Rafa=C5=82 Wojdy=C5=82a (2): > Fix use-after-free in evtchn DPC > Send gnttab unmap notify event after the grant is fully released >=20 > src/xeniface/ioctl_evtchn=2Ec | 71 +++++++++++++++++++++++------------= -- > src/xeniface/ioctl_gnttab=2Ec | 16 +++++---- > 2 files changed, 53 insertions(+), 34 deletions(-) >=20 Both patches: Reviewed-by: Tu Dinh -- Ngoc Tu Dinh | Vates XCP-ng Developer XCP-ng & Xen Orchestra - Vates = solutions web: https://vates=2Etech ---=Part.16e5.469fbdaa4ecde19d.19e723175cf.9b556cb83cd5fea=---