[PATCH] hvm passthru: Fix a xen-unstable crash

[Wei Wang2 <wei.wang2@amd.com>]

[-- Attachment #1: Type: text/plain, Size: 3588 bytes --]

Hi,
I got the following crash with latest unstable on my testing machine when 
destroying a hvm guest with passthru devices.

(XEN) ----[ Xen-4.1-unstable  x86_64  debug=y  Tainted:    C ]----
(XEN) CPU:    1
(XEN) RIP:    e008:[<ffff82c480115cb5>] free_xenheap_pages+0x10d/0x122
(XEN) RFLAGS: 0000000000010283   CONTEXT: hypervisor
(XEN) rax: 0000000000100000   rbx: 0000000000001000   rcx: 0000000000065d10
(XEN) rdx: ffff82f601600008   rsi: 0000000000000014   rdi: ffff82f600945e00
(XEN) rbp: ffff83014feefe10   rsp: ffff83014feefe10   r8:  bfffffffffffffff
(XEN) r9:  ffffffffffffffff   r10: 0000000000000004   r11: 0000000000000004
(XEN) r12: ffff83014a396000   r13: ffff83014a396000   r14: ffffffffffffffff
(XEN) r15: ffff83014feeff18   cr0: 000000008005003b   cr4: 00000000000006f0
(XEN) cr3: 0000000249201000   cr2: ffff82f601600008
(XEN) ds: 0000   es: 0000   fs: 0000   gs: 0000   ss: e010   cs: e008
(XEN) Xen stack trace from rsp=ffff83014feefe10:
(XEN)    ffff83014feefe20 ffff82c4801283c7 ffff83014feefe40 ffff82c480155044
(XEN)    ffff8300afe58000 00000000ffffffff ffff83014feefe70 ffff82c4801050b8
(XEN)    ffff83014feefea0 0000000000000000 ffff83014ffa81a0 0000000000000000
(XEN)    ffff83014feefea0 ffff82c480128e43 0000000000000001 0000000000000001
(XEN)    0000000000000001 ffff82c4802af080 ffff83014feefee0 ffff82c480121243
(XEN)    ffff83014feeff18 ffff83014feeff18 ffff8300afe6a000 ffff83014feefdf8
(XEN)    ffff8300afcdc000 ffff83014ffa8040 ffff83014feefef0 ffff82c480121397
(XEN)    ffff83014feeff10 ffff82c480151e06 ffff82c480121397 0000000000000001
(XEN)    ffff83014feefd28 0000000000000000 0000000000000000 0000000000000000
(XEN)    ffffffff807dc004 ffffffff8079bf48 0000000000000000 0000000000000246
(XEN)    0000000000000060 0000000000000000 0000000000000000 0000000000000000
(XEN)    ffffffff802053aa 0000000000000001 00000000deadbeef 00000000deadbeef
(XEN)    0000010000000000 ffffffff802053aa 000000000000e033 0000000000000246
(XEN)    ffffffff8079bf10 000000000000e02b 000000000000beef 000000000000beef
(XEN)    000000000000beef 000000000000beef 0000000000000001 ffff8300afe6a000
(XEN)    0000003ccfcd5d80 0000000000000000
(XEN) Xen call trace:
(XEN)    [<ffff82c480115cb5>] free_xenheap_pages+0x10d/0x122
(XEN)    [<ffff82c4801283c7>] xfree+0x9d/0xad
(XEN)    [<ffff82c480155044>] arch_domain_destroy+0x2de/0x2e3
(XEN)    [<ffff82c4801050b8>] complete_domain_destroy+0x71/0x12c
(XEN)    [<ffff82c480128e43>] rcu_process_callbacks+0x173/0x1df
(XEN)    [<ffff82c480121243>] __do_softirq+0x86/0x97
(XEN)    [<ffff82c480121397>] do_softirq+0x64/0x69
(XEN)    [<ffff82c480151e06>] idle_loop+0x57/0x59
(XEN)
(XEN) Pagetable walk from ffff82f601600008:
(XEN)  L4[0x105] = 00000000afca2027 5555555555555555
(XEN)  L3[0x1d8] = 000000024ede2063 5555555555555555
(XEN)  L2[0x00b] = 0000000000000000 ffffffffffffffff
(XEN)
(XEN) ****************************************
(XEN) Panic on CPU 1:
(XEN) FATAL PAGE FAULT
(XEN) [error_code=0002]
(XEN) Faulting linear address: ffff82f601600008
(XEN) ****************************************
(XEN)
(XEN) Reboot in five seconds...

It looks like, in function unmap_domain_pirq_emuirq(),  emuirq = 
domain_pirq_to_emuirq(d, pirq) returns a negative array subscript(-2). 
Attached patch could fix this issue.

Thanks,
Wei

Signed-off-by: Wei Wang <wei.wang2@amd.com>

Legal Information:
Advanced Micro Devices GmbH
Sitz: Dornach, Gemeinde Aschheim, 
Landkreis München Registergericht München, 
HRB Nr. 43632
Geschäftsführer:
Alberto Bozzo, Andrew Bowd

[-- Attachment #2: fix_emuirq.patch --]
[-- Type: text/x-diff, Size: 426 bytes --]

diff -r 66df4f35b8de xen/arch/x86/irq.c
--- a/xen/arch/x86/irq.c	Fri Nov 26 10:10:40 2010 +0000
+++ b/xen/arch/x86/irq.c	Mon Nov 29 14:57:40 2010 +0100
@@ -1860,7 +1860,8 @@ int unmap_domain_pirq_emuirq(struct doma
     }
 
     d->arch.pirq_emuirq[pirq] = IRQ_UNBOUND;
-    d->arch.emuirq_pirq[emuirq] = IRQ_UNBOUND;
+    if ( emuirq != IRQ_PT )
+        d->arch.emuirq_pirq[emuirq] = IRQ_UNBOUND;
 
  done:
     return ret;

[-- Attachment #3: Type: text/plain, Size: 138 bytes --]

_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xensource.com
http://lists.xensource.com/xen-devel