[Xen-devel] [PATCHv4 1/4] evtchn: clear xen_consumer when clearing state

[David Vrabel <david.vrabel@xxxxxxxxxx>]

Freeing a xen event channel would clear xen_consumer before clearing
the channel state, leaving a window where the channel is in a funny
state (still bound but no consumer).

Move the clear of xen_consumer into free_evtchn() where the state is
also cleared.

Signed-off-by: David Vrabel <david.vrabel@xxxxxxxxxx>
---
v4:
- consumer_is_xen() check is only valid when guest requested the close.
---
 xen/common/event_channel.c |   17 +++++++----------
 1 file changed, 7 insertions(+), 10 deletions(-)

diff --git a/xen/common/event_channel.c b/xen/common/event_channel.c
index 2208de0..26870b6 100644
--- a/xen/common/event_channel.c
+++ b/xen/common/event_channel.c
@@ -202,6 +202,7 @@ static void free_evtchn(struct domain *d, struct evtchn 
*chn)
     /* Reset binding to vcpu0 when the channel is freed. */
     chn->state          = ECS_FREE;
     chn->notify_vcpu_id = 0;
+    chn->xen_consumer   = 0;
 
     xsm_evtchn_close_post(chn);
 }
@@ -468,7 +469,7 @@ static long evtchn_bind_pirq(evtchn_bind_pirq_t *bind)
 }
 
 
-static long __evtchn_close(struct domain *d1, int port1)
+static long __evtchn_close(struct domain *d1, int port1, bool_t guest)
 {
     struct domain *d2 = NULL;
     struct vcpu   *v;
@@ -488,7 +489,7 @@ static long __evtchn_close(struct domain *d1, int port1)
     chn1 = evtchn_from_port(d1, port1);
 
     /* Guest cannot close a Xen-attached event channel. */
-    if ( unlikely(consumer_is_xen(chn1)) )
+    if ( unlikely(guest && consumer_is_xen(chn1)) )
     {
         rc = -EINVAL;
         goto out;
@@ -600,7 +601,7 @@ static long __evtchn_close(struct domain *d1, int port1)
 
 static long evtchn_close(evtchn_close_t *close)
 {
-    return __evtchn_close(current->domain, close->port);
+    return __evtchn_close(current->domain, close->port, 1);
 }
 
 int evtchn_send(struct domain *ld, unsigned int lport)
@@ -952,7 +953,7 @@ static long evtchn_reset(evtchn_reset_t *r)
         goto out;
 
     for ( i = 0; port_is_valid(d, i); i++ )
-        (void)__evtchn_close(d, i);
+        (void)__evtchn_close(d, i, 1);
 
     spin_lock(&d->event_lock);
 
@@ -1185,11 +1186,10 @@ void free_xen_event_channel(struct domain *d, int port)
     BUG_ON(!port_is_valid(d, port));
     chn = evtchn_from_port(d, port);
     BUG_ON(!consumer_is_xen(chn));
-    chn->xen_consumer = 0;
 
     spin_unlock(&d->event_lock);
 
-    (void)__evtchn_close(d, port);
+    (void)__evtchn_close(d, port, 0);
 }
 
 
@@ -1286,10 +1286,7 @@ void evtchn_destroy(struct domain *d)
 
     /* Close all existing event channels. */
     for ( i = 0; port_is_valid(d, i); i++ )
-    {
-        evtchn_from_port(d, i)->xen_consumer = 0;
-        (void)__evtchn_close(d, i);
-    }
+        (void)__evtchn_close(d, i, 0);
 
     /* Free all event-channel buckets. */
     spin_lock(&d->event_lock);
-- 
1.7.10.4


_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxx
http://lists.xen.org/xen-devel