Re: [PATCH] x86/vpt: Validate timer object with generation number

[Tu Dinh <ngoc-tu.dinh@xxxxxxxxxx>]

On 28/10/2026 12:31, Jan Beulich wrote:
> On 23.10.2026 03:12, Tu Dinh wrote:
>> The remote completion path of pt_update_irq removes timers from tm_list
>> by checking that their addresses match the previous iteration. However,
>> if the guest rearms a timer during the gap between two list iterations,
>> the resulting timer object is no longer the same, even if their
>> addresses match. Removing the timer from the list will then lose the
>> armed timer object.
>>
>> Record a generation number in each timer object upon arming, and check
>> that the generation number matches before removing it from the list.
> 
> Fixes: 0bcbc971feaa ("x86/vpt: add support for level interrupts")
> 
>> Signed-off-by: Tu Dinh <ngoc-tu.dinh@xxxxxxxxxx>
> 
> Reviewed-by: Jan Beulich <jbeulich@xxxxxxxx>

Thank you very much for the review.

> preferably with ...
> 
>> --- a/xen/arch/x86/hvm/vpt.c
>> +++ b/xen/arch/x86/hvm/vpt.c
>> @@ -318,6 +318,7 @@ int pt_update_irq(struct vcpu *v)
>>       struct list_head *head = &v->arch.hvm.tm_list;
>>       struct periodic_time *pt, *temp, *earliest_pt;
>>       uint64_t max_lag;
>> +    uint64_t generation;
> 
> ... this folded with the earlier line.
> 
>> --- a/xen/arch/x86/include/asm/hvm/vpt.h
>> +++ b/xen/arch/x86/include/asm/hvm/vpt.h
>> @@ -34,6 +34,7 @@ struct periodic_time {
>>       u8 irq;
>>       struct vcpu *vcpu;          /* vcpu timer interrupt delivers to */
>>       u32 pending_intr_nr;        /* pending timer interrupts */
>> +    u64 generation;             /* distinguish two armings of the same 
>> timer */
>>       u64 period;                 /* frequency in ns */
>>       s_time_t scheduled;         /* scheduled timer interrupt */
>>       u64 last_plt_gtime;         /* platform time when last IRQ is injected 
>> */
> 
> Also, no matter that adjacent lines use u<N>, it wants to be uint<N>_t for
> new fields. Otherwise we will never get rid of the remaining u<N>.
> 
> I can make these adjustments while committing, no need to send a v2 just for
> that.
> 

Yes, please go ahead and make the adjustments.

> Jan



--
Ngoc Tu Dinh | Vates XCP-ng Developer

XCP-ng & Xen Orchestra - Vates solutions

web: https://vates.tech