From mboxrd@z Thu Jan  1 00:00:00 1970
From: Keir Fraser <keir@xen.org>
Subject: Re: [PATCH] hvm passthru: Fix a xen-unstable crash
Date: Mon, 29 Nov 2010 14:48:46 +0000
Message-ID: <C9196DCE.B449%keir@xen.org>
References: <201011291534.51800.wei.wang2@amd.com>
Mime-Version: 1.0
Content-Type: text/plain;
	charset="ISO-8859-1"
Content-Transfer-Encoding: quoted-printable
Return-path: <xen-devel-bounces@lists.xensource.com>
In-Reply-To: <201011291534.51800.wei.wang2@amd.com>
List-Unsubscribe: <http://lists.xensource.com/mailman/listinfo/xen-devel>,
	<mailto:xen-devel-request@lists.xensource.com?subject=unsubscribe>
List-Post: <mailto:xen-devel@lists.xensource.com>
List-Help: <mailto:xen-devel-request@lists.xensource.com?subject=help>
List-Subscribe: <http://lists.xensource.com/mailman/listinfo/xen-devel>,
	<mailto:xen-devel-request@lists.xensource.com?subject=subscribe>
Sender: xen-devel-bounces@lists.xensource.com
Errors-To: xen-devel-bounces@lists.xensource.com
To: Wei Wang2 <wei.wang2@amd.com>, "xen-devel@lists.xensource.com" <xen-devel@lists.xensource.com>, Stefano Stabellini <stefano.stabellini@eu.citrix.com>
List-Id: xen-devel@lists.xenproject.org

Stefano,

Can you ack/nack this patch please.

 -- Keir

On 29/11/2010 14:34, "Wei Wang2" <wei.wang2@amd.com> wrote:

> Hi,
> I got the following crash with latest unstable on my testing machine when
> destroying a hvm guest with passthru devices.
>=20
> (XEN) ----[ Xen-4.1-unstable  x86_64  debug=3Dy  Tainted:    C ]----
> (XEN) CPU:    1
> (XEN) RIP:    e008:[<ffff82c480115cb5>] free_xenheap_pages+0x10d/0x122
> (XEN) RFLAGS: 0000000000010283   CONTEXT: hypervisor
> (XEN) rax: 0000000000100000   rbx: 0000000000001000   rcx: 0000000000065d=
10
> (XEN) rdx: ffff82f601600008   rsi: 0000000000000014   rdi: ffff82f600945e=
00
> (XEN) rbp: ffff83014feefe10   rsp: ffff83014feefe10   r8:  bfffffffffffff=
ff
> (XEN) r9:  ffffffffffffffff   r10: 0000000000000004   r11: 00000000000000=
04
> (XEN) r12: ffff83014a396000   r13: ffff83014a396000   r14: ffffffffffffff=
ff
> (XEN) r15: ffff83014feeff18   cr0: 000000008005003b   cr4: 00000000000006=
f0
> (XEN) cr3: 0000000249201000   cr2: ffff82f601600008
> (XEN) ds: 0000   es: 0000   fs: 0000   gs: 0000   ss: e010   cs: e008
> (XEN) Xen stack trace from rsp=3Dffff83014feefe10:
> (XEN)    ffff83014feefe20 ffff82c4801283c7 ffff83014feefe40 ffff82c480155=
044
> (XEN)    ffff8300afe58000 00000000ffffffff ffff83014feefe70 ffff82c480105=
0b8
> (XEN)    ffff83014feefea0 0000000000000000 ffff83014ffa81a0 0000000000000=
000
> (XEN)    ffff83014feefea0 ffff82c480128e43 0000000000000001 0000000000000=
001
> (XEN)    0000000000000001 ffff82c4802af080 ffff83014feefee0 ffff82c480121=
243
> (XEN)    ffff83014feeff18 ffff83014feeff18 ffff8300afe6a000 ffff83014feef=
df8
> (XEN)    ffff8300afcdc000 ffff83014ffa8040 ffff83014feefef0 ffff82c480121=
397
> (XEN)    ffff83014feeff10 ffff82c480151e06 ffff82c480121397 0000000000000=
001
> (XEN)    ffff83014feefd28 0000000000000000 0000000000000000 0000000000000=
000
> (XEN)    ffffffff807dc004 ffffffff8079bf48 0000000000000000 0000000000000=
246
> (XEN)    0000000000000060 0000000000000000 0000000000000000 0000000000000=
000
> (XEN)    ffffffff802053aa 0000000000000001 00000000deadbeef 00000000deadb=
eef
> (XEN)    0000010000000000 ffffffff802053aa 000000000000e033 0000000000000=
246
> (XEN)    ffffffff8079bf10 000000000000e02b 000000000000beef 000000000000b=
eef
> (XEN)    000000000000beef 000000000000beef 0000000000000001 ffff8300afe6a=
000
> (XEN)    0000003ccfcd5d80 0000000000000000
> (XEN) Xen call trace:
> (XEN)    [<ffff82c480115cb5>] free_xenheap_pages+0x10d/0x122
> (XEN)    [<ffff82c4801283c7>] xfree+0x9d/0xad
> (XEN)    [<ffff82c480155044>] arch_domain_destroy+0x2de/0x2e3
> (XEN)    [<ffff82c4801050b8>] complete_domain_destroy+0x71/0x12c
> (XEN)    [<ffff82c480128e43>] rcu_process_callbacks+0x173/0x1df
> (XEN)    [<ffff82c480121243>] __do_softirq+0x86/0x97
> (XEN)    [<ffff82c480121397>] do_softirq+0x64/0x69
> (XEN)    [<ffff82c480151e06>] idle_loop+0x57/0x59
> (XEN)
> (XEN) Pagetable walk from ffff82f601600008:
> (XEN)  L4[0x105] =3D 00000000afca2027 5555555555555555
> (XEN)  L3[0x1d8] =3D 000000024ede2063 5555555555555555
> (XEN)  L2[0x00b] =3D 0000000000000000 ffffffffffffffff
> (XEN)
> (XEN) ****************************************
> (XEN) Panic on CPU 1:
> (XEN) FATAL PAGE FAULT
> (XEN) [error_code=3D0002]
> (XEN) Faulting linear address: ffff82f601600008
> (XEN) ****************************************
> (XEN)
> (XEN) Reboot in five seconds...
>=20
> It looks like, in function unmap_domain_pirq_emuirq(),  emuirq =3D
> domain_pirq_to_emuirq(d, pirq) returns a negative array subscript(-2).
> Attached patch could fix this issue.
>=20
> Thanks,
> Wei
>=20
> Signed-off-by: Wei Wang <wei.wang2@amd.com>
>=20
> Legal Information:
> Advanced Micro Devices GmbH
> Sitz: Dornach, Gemeinde Aschheim,
> Landkreis M=FCnchen Registergericht M=FCnchen,
> HRB Nr. 43632
> Gesch=E4ftsf=FChrer:
> Alberto Bozzo, Andrew Bowd
> _______________________________________________
> Xen-devel mailing list
> Xen-devel@lists.xensource.com
> http://lists.xensource.com/xen-devel