Re: [PATCH v13 04/14] xen/percpu: defer freeing per-CPU areas after resume failures

[Jan Beulich <jbeulich@xxxxxxxx>]

On 27.10.2026 22:05, Mykola Kvach wrote:
> When a CPU fails to come back during system resume, cpu_up() sends
> CPU_UP_CANCELED. After trying the other CPUs, enable_nonboot_cpus()
> sends CPU_RESUME_FAILED for the same CPU.
> 
> On architectures which do not park offline CPUs, both notifications
> queue free_percpu_area(). The release metadata, including the rcu_head,
> is stored in that CPU's per-CPU area. The first callback may already
> have freed the area when the second notification arrives, or the same
> rcu_head may be queued twice. The CPU_RESUME_FAILED callbacks also need
> the area to clean up timers and CPU-pool state.

I think there's another change needed, for the change you presently do
to not cause a leak: If enable_nonboot_cpus() calls cpu_up() for a CPU
whose bit isn't set in frozen_cpus, and if that call fails, the CPU
later wouldn't have the CPU_RESUME_FAILED notification sent for it.
IOW the freeing would then not happen at all. Question is whether
simply setting the bit in frozen_cpus would be correct: Notify
handlers may not expect CPU_RESUME_FAILED for a CPU which wasn't
online at the point of suspend.

> --- a/xen/common/percpu.c
> +++ b/xen/common/percpu.c
> @@ -82,6 +82,15 @@ static int cf_check cpu_percpu_callback(
>          break;
>  
>      case CPU_UP_CANCELED:
> +        /*
> +         * On resume, CPU_RESUME_FAILED is sent after all CPUs have been
> +         * tried. Keep the area alive for its cleanup callbacks and let
> +         * that notification release it.
> +         */
> +        if ( system_state == SYS_STATE_resume )
> +            break;
> +        fallthrough;
> +
>      case CPU_DEAD:
>      case CPU_RESUME_FAILED:
>          if ( !park_offline_cpus && system_state != SYS_STATE_suspend )

Nit: While generally we want blank lines between non-fall-through
case blocks, imo between fall-through ones such blank lines would
better be omitted, to make the falling through visually easier to
notice.

Jan