On Mon, Jan 07, 2019 at 08:10:06PM +0100, Cédric Le Goater wrote: > This will be used to destroy the KVM XICS or XIVE device when the > sPAPR machine is reseted. When the VM boots, the CAS negotiation > process will determine which interrupt mode to use and the appropriate > KVM device will then be created. What would be the consequence if we didn't destroy the device? The reason I ask is that we will have to be much more careful about memory allocation lifetimes with this patch. Having KVM devices last until the KVM instance is destroyed means that we generally avoid use-after-free bugs. With this patch we will have to do a careful analysis of the lifetime of the xive structures vs. possible accesses on other threads to prove there are no use-after-free bugs. For example, it is not sufficient to set any pointers in struct kvm or struct kvm_vcpu that point into xive structures to NULL before freeing the structures. There could be code on another CPU that has read the pointer value before you set it to NULL and then goes and accesses it after you have freed it. You need to prove that can't happen, possibly using some sort of explicit synchronization that ensures that no other CPU could still be accessing the structure at the time when you free it. RCU can help with this, but in general means you need RCU synchronization primitives (rcu_read_lock() etc.) at all the places where you use the pointer, which I don't think you currently have. If there is a good fundamental reason why this can't happen, even though you don't have explicit synchronization, then at a minimum you need to explain that in the patch description, and ideally also in code comments. Paul.
