From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:46144) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1YLXA1-0003rr-8u for qemu-devel@nongnu.org; Wed, 11 Feb 2015 08:16:58 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1YLX9v-0002gl-CL for qemu-devel@nongnu.org; Wed, 11 Feb 2015 08:16:57 -0500 Received: from e9.ny.us.ibm.com ([32.97.182.139]:43020) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1YLX9v-0002en-61 for qemu-devel@nongnu.org; Wed, 11 Feb 2015 08:16:51 -0500 Received: from /spool/local by e9.ny.us.ibm.com with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted for from ; Wed, 11 Feb 2015 08:16:50 -0500 Received: from b01cxnp23033.gho.pok.ibm.com (b01cxnp23033.gho.pok.ibm.com [9.57.198.28]) by d01dlp01.pok.ibm.com (Postfix) with ESMTP id 154D538C803B for ; Wed, 11 Feb 2015 08:16:47 -0500 (EST) Received: from d01av01.pok.ibm.com (d01av01.pok.ibm.com [9.56.224.215]) by b01cxnp23033.gho.pok.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id t1BDGlTC27525374 for ; Wed, 11 Feb 2015 13:16:47 GMT Received: from d01av01.pok.ibm.com (localhost [127.0.0.1]) by d01av01.pok.ibm.com (8.14.4/8.14.4/NCO v10.0 AVout) with ESMTP id t1BDGkHQ001740 for ; Wed, 11 Feb 2015 08:16:46 -0500 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable From: Michael Roth References: <1423572769-4238-1-git-send-email-pbonzini@redhat.com> <20150211051302.3809.50882@loki> <54DB04F8.3080405@redhat.com> In-Reply-To: <54DB04F8.3080405@redhat.com> Message-ID: <20150211131641.3809.42730@loki> Date: Wed, 11 Feb 2015 07:16:41 -0600 Subject: Re: [Qemu-devel] [PATCH] memory: unregister AddressSpace MemoryListener within BQL List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: Paolo Bonzini , qemu-devel Quoting Paolo Bonzini (2015-02-11 01:30:00) > On 11/02/2015 06:13, Michael Roth wrote: > > (gdb) print node > > $1 =3D (struct rcu_head *) 0x11189a68 > > (gdb) print node->func > > $2 =3D (RCUCBFunc *) 0x0 > > (gdb) print node->next > > $3 =3D (struct rcu_head *) 0x3fff9800d4f0 > > = > > I've seen it on both x86 and pseries (with spapr hotplug patches applie= d), and > > have only seen it occur at this spot. > > = > > AFAICT node->func is only set via 1 of: > > = > > call_rcu(old_view, flatview_unref, rcu); > > call_rcu(as, do_address_space_destroy, rcu); > > = > > so it shouldn't ever be NULL... and there's a wmb after node->func is s= et, > > prior to the node being made available to the RCU thread via enqueue(),= so > > that doesn't seem to be the issue. > > = > > I think the node in this case is a FlatView*, if that helps narrow it d= own: > > = > > (gdb) print ((AddressSpace *)(0x3fff9800d4f0))->name > > $5 =3D 0x100000000
> = > This is node->next, not node. The weird address looks almost like node > =3D=3D &dummy. I'll try to reproduce. Doh, sorry, not sure why I started looking at that address. node looks to b= e an AddressSpace* by way of do_pci_register_device(): (gdb) print node $21 =3D (struct rcu_head *) 0x11189a68 (gdb) print ((PCIDevice *)(0x11189860))->name $22 =3D "virtio-net-pci", '\000' (gdb) print ((AddressSpace *)(node))->root->name $13 =3D 0x1117a410 "bus master" (gdb) print ((PCIDevice *)(0x11189860))->devfn $23 =3D 64 Is this state unexpected? (gdb) print ((DeviceState *)(0x11189860))->realized $24 =3D true (gdb) print ((Object *)(0x11189860))->ref $25 =3D 4 (gdb) Since the AddressSpace is a fields of PCIDevice, do we maybe need to make sure it's refcount doesn't drop to 0 prior to the RCU callback taking place? > = > Paolo