[Xen-devel] xen irq unmask bug brainstroming

["Zhang, Fengzhe" <fengzhe.zhang@xxxxxxxxx>]

Hi, we found a bug related to xen spin unlock ipi. Looking forward to 
brainstorming for a clean fixup.

How the bug happens:
1. Dom0 poweroff.
2. CPU0 takes down other CPUs.
3. IRQs are unmasked in function fixup_irqs on other CPUs.
4. IPI IRQ for "lock_kicker_irq" is unmasked (which should never happen).
5. Other CPUs receives lock_kicker_irq and dummy_handler (handler for ipi 
XEN_SPIN_UNLOCK_VECTOR) is invoked.
6. Dummy_handler reports bug and crashes Dom0.

Main cause:
Function fixup_irqs masks and then unmasks each irq when taking cpus down. And 
Xen irq_chip structure does not distinguish disable_ops from mask_ops. So when 
the lock_kicker_irq is unmasked, it is effectively re-enabled.

A possible fixup:
Provide a dedicated disable_ops for xen irq_chip structure. Prevent unmask_ops 
to enable irqs that are disabled.

-Fengzhe Zhang


_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-devel