From mboxrd@z Thu Jan  1 00:00:00 1970
Received: from eggs.gnu.org ([2001:4830:134:3::10]:57633)
	by lists.gnu.org with esmtp (Exim 4.71)
	(envelope-from <paolo.bonzini@gmail.com>) id 1YLRkR-0001vQ-7Z
	for qemu-devel@nongnu.org; Wed, 11 Feb 2015 02:30:12 -0500
Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71)
	(envelope-from <paolo.bonzini@gmail.com>) id 1YLRkM-00034K-8U
	for qemu-devel@nongnu.org; Wed, 11 Feb 2015 02:30:11 -0500
Received: from mail-wi0-x22d.google.com ([2a00:1450:400c:c05::22d]:36861)
	by eggs.gnu.org with esmtp (Exim 4.71)
	(envelope-from <paolo.bonzini@gmail.com>) id 1YLRkM-00032b-2c
	for qemu-devel@nongnu.org; Wed, 11 Feb 2015 02:30:06 -0500
Received: by mail-wi0-f173.google.com with SMTP id bs8so17894596wib.0
	for <qemu-devel@nongnu.org>; Tue, 10 Feb 2015 23:30:05 -0800 (PST)
Sender: Paolo Bonzini <paolo.bonzini@gmail.com>
Message-ID: <54DB04F8.3080405@redhat.com>
Date: Wed, 11 Feb 2015 08:30:00 +0100
From: Paolo Bonzini <pbonzini@redhat.com>
MIME-Version: 1.0
References: <1423572769-4238-1-git-send-email-pbonzini@redhat.com>
	<20150211051302.3809.50882@loki>
In-Reply-To: <20150211051302.3809.50882@loki>
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 7bit
Subject: Re: [Qemu-devel] [PATCH] memory: unregister AddressSpace
 MemoryListener within BQL
List-Id: <qemu-devel.nongnu.org>
List-Unsubscribe: <https://lists.nongnu.org/mailman/options/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=unsubscribe>
List-Archive: <http://lists.nongnu.org/archive/html/qemu-devel>
List-Post: <mailto:qemu-devel@nongnu.org>
List-Help: <mailto:qemu-devel-request@nongnu.org?subject=help>
List-Subscribe: <https://lists.nongnu.org/mailman/listinfo/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=subscribe>
To: Michael Roth <mdroth@linux.vnet.ibm.com>, qemu-devel <qemu-devel@nongnu.org>



On 11/02/2015 06:13, Michael Roth wrote:
> (gdb) print node
> $1 = (struct rcu_head *) 0x11189a68
> (gdb) print node->func
> $2 = (RCUCBFunc *) 0x0
> (gdb) print node->next
> $3 = (struct rcu_head *) 0x3fff9800d4f0
> 
> I've seen it on both x86 and pseries (with spapr hotplug patches applied), and
> have only seen it occur at this spot.
> 
> AFAICT node->func is only set via 1 of:
> 
>   call_rcu(old_view, flatview_unref, rcu);
>   call_rcu(as, do_address_space_destroy, rcu);
> 
> so it shouldn't ever be NULL... and there's a wmb after node->func is set,
> prior to the node being made available to the RCU thread via enqueue(), so
> that doesn't seem to be the issue.
> 
> I think the node in this case is a FlatView*, if that helps narrow it down:
> 
> (gdb) print ((AddressSpace *)(0x3fff9800d4f0))->name
> $5 = 0x100000000 <Address 0x100000000 out of bounds>

This is node->next, not node.  The weird address looks almost like node
== &dummy.  I'll try to reproduce.

Paolo