Re: kern/57560: xennetback_xenbus.c rev 1.109 broke guests, causes DOM0 reboot

[Taylor R Campbell <riastradh%NetBSD.org@localhost>]

The following reply was made to PR port-xen/57560; it has been noted by GNATS.

From: Taylor R Campbell <riastradh%NetBSD.org@localhost>
To: brad%anduin.eldar.org@localhost
Cc: gnats-bugs%NetBSD.org@localhost
Subject: Re: kern/57560: xennetback_xenbus.c rev 1.109 broke guests, causes DOM0 reboot
Date: Fri, 4 Aug 2023 07:21:10 +0000

 This is a multi-part message in MIME format.
 --=_usKIEqQi97a3RY2xFPoqMtrNfJcy98qu
 
 Can you please try the attached patch?
 
 --=_usKIEqQi97a3RY2xFPoqMtrNfJcy98qu
 Content-Type: text/plain; charset="ISO-8859-1"; name="pr57560"
 Content-Transfer-Encoding: quoted-printable
 Content-Disposition: attachment; filename="pr57560.patch"
 
 From 569f569998b5b8a741d185a17d6a83c525db0476 Mon Sep 17 00:00:00 2001
 From: Taylor R Campbell <riastradh%NetBSD.org@localhost>
 Date: Fri, 4 Aug 2023 07:17:41 +0000
 Subject: [PATCH] xennet(4): Use correct criterion to test for unconsumed
  requests.
 
 Be less clever about minimizing xen_rmb and updates to
 xneti->xni_txring.req_cons.
 
 PR kern/57560
 ---
  sys/arch/xen/xen/xennetback_xenbus.c | 11 ++++-------
  1 file changed, 4 insertions(+), 7 deletions(-)
 
 diff --git a/sys/arch/xen/xen/xennetback_xenbus.c b/sys/arch/xen/xen/xennet=
 back_xenbus.c
 index bf7733d0da98..2402f3a20923 100644
 --- a/sys/arch/xen/xen/xennetback_xenbus.c
 +++ b/sys/arch/xen/xen/xennetback_xenbus.c
 @@ -803,23 +803,21 @@ xennetback_evthandler(void *arg)
  	netif_tx_request_t txreq;
  	struct mbuf *m, *m0 =3D NULL, *mlast =3D NULL;
  	int receive_pending;
 -	RING_IDX req_cons, req_prod;
 +	RING_IDX req_cons;
  	int queued =3D 0, m0_len =3D 0;
  	struct xnetback_xstate *xst;
  	const bool discard =3D ((ifp->if_flags & (IFF_UP | IFF_RUNNING)) !=3D
  	    (IFF_UP | IFF_RUNNING));
 =20
  	XENPRINTF(("xennetback_evthandler "));
 -	req_cons =3D xneti->xni_txring.req_cons;
  again:
 -	req_prod =3D xneti->xni_txring.sring->req_prod;
 -	xen_rmb();
 -	while (req_cons !=3D req_prod) {
 +	while (RING_HAS_UNCONSUMED_REQUESTS(&xneti->xni_txring)) {
 +		xen_rmb();
 +		req_cons =3D xneti->xni_txring.req_cons++;
  		RING_COPY_REQUEST(&xneti->xni_txring, req_cons,
  		    &txreq);
  		XENPRINTF(("%s pkt size %d\n", xneti->xni_if.if_xname,
  		    txreq.size));
 -		req_cons++;
  		if (__predict_false(discard)) {
  			/* interface not up, drop all requests */
  			if_statinc(ifp, if_iqdrops);
 @@ -959,7 +957,6 @@ mbuf_fail:
  	RING_FINAL_CHECK_FOR_REQUESTS(&xneti->xni_txring, receive_pending);
  	if (receive_pending)
  		goto again;
 -	xneti->xni_txring.req_cons =3D req_cons;
 =20
  	if (m0) {
  		/* Queue empty, and still unfinished multi-fragment request */
 
 --=_usKIEqQi97a3RY2xFPoqMtrNfJcy98qu--