This is a note to let you know that I've just added the patch titled xen/blkback: use lateeoi irq binding to the 4.4-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: xen-blkback-use-lateeoi-irq-binding.patch and it can be found in the queue-4.4 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <stable@xxxxxxxxxxxxxxx> know about it. >From foo@baz Tue Nov 17 12:26:02 PM CET 2020 From: Juergen Gross <jgross@xxxxxxxx> Date: Tue, 3 Nov 2020 17:22:31 +0100 Subject: xen/blkback: use lateeoi irq binding To: stable@xxxxxxxxxxxxxxx Message-ID: <20201103162238.30264-7-jgross@xxxxxxxx> From: Juergen Gross <jgross@xxxxxxxx> commit 01263a1fabe30b4d542f34c7e2364a22587ddaf2 upstream. In order to reduce the chance for the system becoming unresponsive due to event storms triggered by a misbehaving blkfront use the lateeoi irq binding for blkback and unmask the event channel only after processing all pending requests. As the thread processing requests is used to do purging work in regular intervals an EOI may be sent only after having received an event. If there was no pending I/O request flag the EOI as spurious. This is part of XSA-332. Cc: stable@xxxxxxxxxxxxxxx Reported-by: Julien Grall <julien@xxxxxxx> Signed-off-by: Juergen Gross <jgross@xxxxxxxx> Reviewed-by: Jan Beulich <jbeulich@xxxxxxxx> Reviewed-by: Wei Liu <wl@xxxxxxx> Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx> --- drivers/block/xen-blkback/blkback.c | 22 +++++++++++++++++----- drivers/block/xen-blkback/xenbus.c | 5 ++--- 2 files changed, 19 insertions(+), 8 deletions(-) --- a/drivers/block/xen-blkback/blkback.c +++ b/drivers/block/xen-blkback/blkback.c @@ -173,7 +173,7 @@ static inline void shrink_free_pagepool( #define vaddr(page) ((unsigned long)pfn_to_kaddr(page_to_pfn(page))) -static int do_block_io_op(struct xen_blkif *blkif); +static int do_block_io_op(struct xen_blkif *blkif, unsigned int *eoi_flags); static int dispatch_rw_block_io(struct xen_blkif *blkif, struct blkif_request *req, struct pending_req *pending_req); @@ -594,6 +594,8 @@ int xen_blkif_schedule(void *arg) struct xen_vbd *vbd = &blkif->vbd; unsigned long timeout; int ret; + bool do_eoi; + unsigned int eoi_flags = XEN_EOI_FLAG_SPURIOUS; while (!kthread_should_stop()) { if (try_to_freeze()) @@ -617,16 +619,23 @@ int xen_blkif_schedule(void *arg) if (timeout == 0) goto purge_gnt_list; + do_eoi = blkif->waiting_reqs; + blkif->waiting_reqs = 0; smp_mb(); /* clear flag *before* checking for work */ - ret = do_block_io_op(blkif); + ret = do_block_io_op(blkif, &eoi_flags); if (ret > 0) blkif->waiting_reqs = 1; if (ret == -EACCES) wait_event_interruptible(blkif->shutdown_wq, kthread_should_stop()); + if (do_eoi && !blkif->waiting_reqs) { + xen_irq_lateeoi(blkif->irq, eoi_flags); + eoi_flags |= XEN_EOI_FLAG_SPURIOUS; + } + purge_gnt_list: if (blkif->vbd.feature_gnt_persistent && time_after(jiffies, blkif->next_lru)) { @@ -1094,7 +1103,7 @@ static void end_block_io_op(struct bio * * and transmute it to the block API to hand it over to the proper block disk. */ static int -__do_block_io_op(struct xen_blkif *blkif) +__do_block_io_op(struct xen_blkif *blkif, unsigned int *eoi_flags) { union blkif_back_rings *blk_rings = &blkif->blk_rings; struct blkif_request req; @@ -1117,6 +1126,9 @@ __do_block_io_op(struct xen_blkif *blkif if (RING_REQUEST_CONS_OVERFLOW(&blk_rings->common, rc)) break; + /* We've seen a request, so clear spurious eoi flag. */ + *eoi_flags &= ~XEN_EOI_FLAG_SPURIOUS; + if (kthread_should_stop()) { more_to_do = 1; break; @@ -1175,13 +1187,13 @@ done: } static int -do_block_io_op(struct xen_blkif *blkif) +do_block_io_op(struct xen_blkif *blkif, unsigned int *eoi_flags) { union blkif_back_rings *blk_rings = &blkif->blk_rings; int more_to_do; do { - more_to_do = __do_block_io_op(blkif); + more_to_do = __do_block_io_op(blkif, eoi_flags); if (more_to_do) break; --- a/drivers/block/xen-blkback/xenbus.c +++ b/drivers/block/xen-blkback/xenbus.c @@ -200,9 +200,8 @@ static int xen_blkif_map(struct xen_blki BUG(); } - err = bind_interdomain_evtchn_to_irqhandler(blkif->domid, evtchn, - xen_blkif_be_int, 0, - "blkif-backend", blkif); + err = bind_interdomain_evtchn_to_irqhandler_lateeoi(blkif->domid, + evtchn, xen_blkif_be_int, 0, "blkif-backend", blkif); if (err < 0) { xenbus_unmap_ring_vfree(blkif->be->dev, blkif->blk_ring); blkif->blk_rings.common.sring = NULL; Patches currently in stable-queue which might be from jgross@xxxxxxxx are queue-4.4/xen-blkback-use-lateeoi-irq-binding.patch queue-4.4/xen-events-block-rogue-events-for-some-time.patch queue-4.4/xen-events-fix-race-in-evtchn_fifo_unmask.patch queue-4.4/xen-events-switch-user-event-channels-to-lateeoi-model.patch queue-4.4/xen-events-defer-eoi-in-case-of-excessive-number-of-events.patch queue-4.4/xen-events-add-a-new-late-eoi-evtchn-framework.patch queue-4.4/xen-events-use-a-common-cpu-hotplug-hook-for-event-channels.patch queue-4.4/xen-events-avoid-removing-an-event-channel-while-handling-it.patch queue-4.4/xen-netback-use-lateeoi-irq-binding.patch queue-4.4/xen-pciback-use-lateeoi-irq-binding.patch queue-4.4/xen-events-add-a-proper-barrier-to-2-level-uevent-unmasking.patch queue-4.4/xen-scsiback-use-lateeoi-irq-binding.patch